feat(tron-wallet-snap): add Core messenger plumbing by ulissesferreira · Pull Request #95 · MetaMask/internal-snaps

ulissesferreira · 2026-07-31T22:08:42Z

Summary

Instantiate Core messenger via getMessenger and endow RemoteFeatureFlagController:getState
Resolve assets migration stage from remote feature flags on each account asset read
No routing decisions yet — all reads still delegate to SnapAssetsAdapter

Part 1 of 2 split from #94. Part 2: WPN-1497-core-adapter-routing.

Jira

WPN-1497
Parent: WPN-1478

Test plan

yarn workspace @metamask/tron-wallet-snap build
yarn workspace @metamask/tron-wallet-snap run jest --no-coverage (887 tests)

Stacks on #92 (WPN-1497-snap-owned-helpers).

socket-security · 2026-07-31T22:09:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@metamask/remote-feature-flag-controller@4.2.2

View full report

socket-security · 2026-07-31T22:09:20Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

npm/@metamask/remote-feature-flag-controller@4.2.2

View full report

ulissesferreira · 2026-08-02T12:29:53Z

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published snap dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:54Z

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.

ulissesferreira · 2026-08-02T12:29:55Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.1.0
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-08-02T12:29:56Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@2.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:57Z

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:58Z

@SocketSecurity ignore npm/@metamask/core-backend@8.1.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:00Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

ulissesferreira · 2026-08-02T12:30:01Z

@SocketSecurity ignore npm/@metamask/geolocation-controller@1.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:02Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:03Z

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:04Z

@SocketSecurity ignore npm/@metamask/network-controller@35.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:06Z

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:07Z

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:08Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:10Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@5.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:11Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.
AI anomaly is benign signature-verification utility code.

ulissesferreira · 2026-08-02T12:30:12Z

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:13Z

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:14Z

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack. Standard keccak native addon used across MetaMask/core for address/hash operations.
Native binaries alert is expected for this package.

ulissesferreira · 2026-08-02T12:30:15Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

ulissesferreira · 2026-08-02T12:30:16Z

@SocketSecurity ignore npm/rlp@2.2.7
Transitive via @metamask/assets-controller. Standard RLP encoding library in MetaMask/core dependency tree.
Publisher change holgerd77 → ralxz is ethereumjs org maintainer rotation.

ulissesferreira · 2026-08-02T12:30:17Z

@SocketSecurity ignore npm/ulid@2.4.0
Transitive via @metamask/assets-controller. Standard ULID generator used by MetaMask controllers.
Publisher change alizain → perrymitchell is routine npm maintainer handoff on the ulid package.

ulissesferreira · 2026-08-02T23:30:46Z

@SocketSecurity ignore npm/@metamask/assets-controller@13.1.0
Direct devDependency for Core messenger/types wiring in this PR (not bundled into snap output).
First-party MetaMask controller; network access via fetch is expected and already used across MetaMask/core.

@SocketSecurity ignore npm/ws@8.18.0
Transitive via @metamask/assets-controller@13.1.0. Standard WebSocket library; AI anomaly is benign EventTarget mixin code.

ulissesferreira · 2026-08-03T13:38:58Z

+ * Typed messenger for Core controller actions available to this Snap via
+ * `endowment:messenger` / `getMessenger`.
+ */
+export type CoreMessenger = Messenger<string, CoreMessengerActions>;


Must be AsyncMessenger

string as namespace is too wide

ulissesferreira · 2026-08-04T10:55:28Z

@cursoragent task list:

rebase with latest base branch
use RemoteFeatureFlagProvider from the preview build @metamask-previews/snap-networks-utils@0.0.0-preview-a0892371
Core messenger type must be AsyncMessenger
Instantiate AssetsProvider from the preview build @metamask-previews/snap-networks-utils@0.0.0-preview-a0892371 as well
stop resolving stage of migration, only add the messenger plumbing and instantiation in context.ts and the other changes (manifest) required for it
change PR title and description to match the only adding plumbing

cursor · 2026-08-04T10:55:35Z

Completed the task list on WPN-1497-messenger-plumbing, rebased onto latest WPN-1497-snap-owned-helpers (#92).

What changed

Rebased — Reset to origin/WPN-1497-snap-owned-helpers (clean history; force-pushed).
Preview snap-networks-utils — Tron depends on @metamask-previews/snap-networks-utils@0.0.0-preview-a0892371 with a Yarn patch that exports RemoteFeatureFlagProvider from the package index (the preview build had it in dist/ but not in exports).
AsyncMessenger + narrow namespace — core-messenger.ts uses TronWalletSnap instead of string, and CoreMessenger is AsyncMessenger<CoreMessengerMessenger>.
Context plumbing — context.ts wires getMessenger, RemoteFeatureFlagProvider, and AssetsProvider (exposed on SnapExecutionContext for Part 2).
No migration stage resolution — AssetsService unchanged; no Core routing.
Manifest — Added endowment:messenger with RFF + three AssetsController read actions.
Monorepo alignment — Added RemoteFeatureFlagProvider to @metamask/snap-networks-utils so the workspace matches the preview API.

Verification

snap-networks-utils: build + tests pass
tron-wallet-snap: build + 896 tests pass

PR

Title updated to: feat(tron-wallet-snap): add Core messenger plumbing
PR description could not be auto-updated (not agent-managed). Suggested body:

## Summary
- Wire `endowment:messenger` with RFF + AssetsController account-asset read actions
- Instantiate `RemoteFeatureFlagProvider` and `AssetsProvider` from preview `@metamask-previews/snap-networks-utils@0.0.0-preview-a0892371`
- `AsyncMessenger` typing with `TronWalletSnap` namespace
- Plumbing only — no migration-stage resolution or Core routing yet

Part 1 of 2 from #94. Part 2: `WPN-1497-core-adapter-routing`.

PR: #95

Instantiate Core messenger via getMessenger and endow RemoteFeatureFlagController:getState plus AssetsController read actions. Wire RemoteFeatureFlagsProvider and AssetsProvider from @metamask/snap-networks-utils@1.0.0. No assets migration stage resolution or Core routing yet.

ulissesferreira requested review from a team as code owners July 31, 2026 22:08

ulissesferreira mentioned this pull request Jul 31, 2026

feat(tron-wallet-snap): implement feature-flagged AssetsController #94

Closed

2 tasks

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from b67ea64 to 8624473 Compare July 31, 2026 22:18

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 2339dbc to 1413a43 Compare July 31, 2026 22:32

ulissesferreira added the no-changelog label Jul 31, 2026

ulissesferreira marked this pull request as draft August 2, 2026 17:39

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from b8e5fa7 to d5876a7 Compare August 2, 2026 20:48

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from e2a7495 to 64e6d11 Compare August 2, 2026 20:48

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from d5876a7 to 81eb154 Compare August 2, 2026 23:20

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from b73d987 to 7302e9d Compare August 2, 2026 23:20

ulissesferreira mentioned this pull request Aug 2, 2026

feat(tron-wallet-snap): remove assets migration feature-flag routing #97

Draft

2 tasks

ulissesferreira commented Aug 3, 2026

View reviewed changes

cursor Bot force-pushed the WPN-1497-snap-owned-helpers branch from 81eb154 to e49c38b Compare August 4, 2026 10:39

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from f5bde1f to f53d7bf Compare August 4, 2026 11:09

cursor Bot changed the title ~~feat(tron-wallet-snap): wire core messenger and resolve migration stage on reads~~ feat(tron-wallet-snap): add Core messenger plumbing Aug 4, 2026

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from f53d7bf to c9d4f0c Compare August 4, 2026 13:45

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from 2242a06 to 8d95d05 Compare August 4, 2026 13:45

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from c9d4f0c to d5a852a Compare August 4, 2026 13:54

Uh oh!

Conversation

ulissesferreira commented Jul 31, 2026

Summary

Jira

Test plan

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

ulissesferreira commented Aug 4, 2026

Uh oh!

cursor Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Verification

PR

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security Bot commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading

cursor Bot commented Aug 4, 2026 •

edited

Loading