Rust-core port follow-ups#77
Open
pgherveou wants to merge 57 commits into
Open
Conversation
Replace the Nova host-container, auth, and signing path with the worker-backed Rust core. Keep dotli responsible only for browser policy, persistence, UI, and physical chain transports.
Notification grants do not alter iframe Permissions Policy. Reloading disposed the in-flight Rust request before its response reached the product.
The pending-message flush drops send failures silently, matching the pre-port behavior. Surfacing them as JSON-RPC errors moves to a follow-up PR with test coverage.
…follow-up
Keep @polkadot-api/signer and @polkadot-labs/hdkd{,-helpers} declared
(unused since before the port) and limit rpc-chain tests to the new
core gateway provider surface. Removing the dead deps and adding
coverage for pre-existing chain checks moves to a follow-up PR.
Keep the base panel top offset and suffix-based terminator matching (minus the removed host-papp events). The offset correction, the exact-match terminator set, and the @dotli/config dependency declaration move to a follow-up PR.
Prompts always reach the modal, matching the pre-port behavior. The sliding-window limiter returns in a follow-up PR together with the denied-path semantics and a test that trips the window.
AllowanceKeys persist as plain hex through the same path as every other core storage key. The at-rest cipher moves to a follow-up PR where the scheme (per-write nonce, plain-hex read fallback) can get a focused security review.
The bridge emits only the first_inbound/first_outbound lifecycle events. The per-frame TrUAPI tap that feeds the debug panel timeline returns in a follow-up PR; the panel's truapi event handling stays in place and receives no events until then.
… follow-up Login failures fall back to the raw reason except for the base OriginPersonProviderError mapping, and the permissions popover renders last-write-wins without a staleness guard or unavailable-state hint. The failure-message pack and popover hardening move to a follow-up PR.
…i-host 0.1.0 The published packages replace the temporary personal-scope npm aliases used while the port was in review.
pgherveou
requested review from
BigTava,
Cyr06130,
KarimJedda,
TorstenStueber,
ba1uev,
justraman,
leonardocustodio,
tallesborges and
valentinfernandez1
as code owners
July 15, 2026 14:40
Contributor
⚡ Performance Report
|
Contributor
Bundle Size ReportChunks over 500 KB:
All files
Commit: 4775909 |
PAPI registers Function.prototype as a WebSocket no-op. Sentry's BrowserApiErrors wrapper then marks the prototype and makes later event listeners resolve to that no-op.
Resolve the dependency audit advisories by locking patched fast-uri and brace-expansion releases within existing dependency ranges.
Independent providers drained the same smoldot response queue, allowing concurrent Statement Store calls to steal replies.
Override AJV's transitive fast-uri to 3.1.4 to address GHSA-v2hh-gcrm-f6hx.
…ge-in-core-dotli # Conflicts: # packages/metrics/src/sentry.ts
…ermissions popover Map slot-exhaustion, rejected-transaction, and JSON-RPC registration failures to actionable copy with the raw reason as a detail line, and guard the async permissions popover against stale renders with an unavailable-state fallback.
Wrap each core provider so every inbound/outbound wire frame is decoded and emitted on the dotli debug bus when the panel is listening, restoring per-frame protocol traffic in the timeline.
AllowanceKeys slots are AES-GCM encrypted before hitting localStorage. Known issues to resolve before merge: derive a random per-write nonce (the current fixed nonce is obfuscation, not encryption) and accept the plain-hex format written before this change as a read fallback.
Prompt-driven host callbacks share a 20-per-10s sliding window so a hostile product cannot flood the host with modal prompts.
Align the docked panel with the 56px topbar iframe, close system flows by exact layer:event names so setup_ready no longer false-matches the ready suffix, and declare the @dotli/config dependency that chain-registry already imports.
Remove @polkadot-api/signer and @polkadot-labs/hdkd{,-helpers}, which
nothing in the resolver imports, and cover isChainSupported and the
pre-existing rpc-chain provider behavior with unit tests.
Failed sends flushed after chainConnect resolve to JSON-RPC error responses, matching the direct send path, so polkadot-api's client sees the failure instead of hanging.
Backend read failures no longer push a terminal error into the preimage lookup subscription, so the stream keeps polling and slow Bulletin/IPFS propagation surfaces as a late result instead of a permanent failure. Gateway mode logs that sandbox bitswap is unavailable rather than advertising the Bulletin chain.
Ref-count upstream tokens shared by local sessions and buffer subscription events that arrive before their token response. Broker transport hardening kept separate from the Rust host migration.
valentinfernandez1
force-pushed
the
codex/dotli-rust-port-follow-ups
branch
from
July 23, 2026 18:17
7728508 to
a33bfdb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
All follow-up work for the Rust-core port (#70), consolidated into a single stacked PR. Each commit is an independent unit with its context in the commit message:
feat(topbar)— friendly login-failure explanations (statement-store slot exhaustion, rejected registration transactions, JSON-RPC failures) with the raw reason as a detail line; permissions-popover stale-render guard and unavailable-state fallback.feat(debug)— per-frame TrUAPI wire tap feeding the debug panel timeline. Without this commit the panel's TrUAPI lane receives no events.feat(ui)— AllowanceKeys slots are AES-GCM encrypted at rest.feat(ui)— permission and notification prompts share a 20-per-10s sliding window so a hostile product cannot flood the host with modals.fix(debug)— dock offset matches the 56px topbar iframe, system flows close on exactlayer:eventnames (setup_readyno longer false-matches thereadysuffix),@dotli/configdeclared wherechain-registryimports it.chore(resolver)— drops unused@polkadot-api/signerand@polkadot-labs/hdkd{,-helpers}; adds unit coverage for pre-existing chain support checks.fix(protocol)—chainSendmessages flushed afterchainConnectsurface send failures as JSON-RPC error responses, matching the direct-send path.fix(ui)— preimage lookup subscriptions keep polling after backend read failures; gateway mode logs that sandbox bitswap is unavailable.fix(protocol)— broker ref-counts upstream tokens shared by local sessions and buffers subscription events that arrive before their token response.Base
Stacked on #70. Supersedes #73, #74, and #76.
Verification
bun install --frozen-lockfilebun run format:checkbunx --bun turbo run lint typecheck test build:prod --forcebun auditmake e2e-dotlifrom the parent truapi checkout runs against Switch to Rust core #70 directly; this branch layers cleanly on top.