feat(tron-wallet-snap): add Core messenger plumbing by ulissesferreira · Pull Request #95 · MetaMask/internal-snaps

ulissesferreira · 2026-07-31T22:08:42Z

Summary

Instantiate Core messenger via getMessenger and endow RemoteFeatureFlagController:getState
Resolve assets migration stage from remote feature flags on each account asset read
No routing decisions yet — all reads still delegate to SnapAssetsAdapter

Part 1 of 2 split from #94. Part 2: WPN-1497-core-adapter-routing.

Jira

WPN-1497
Parent: WPN-1478

Test plan

yarn workspace @metamask/tron-wallet-snap build
yarn workspace @metamask/tron-wallet-snap run jest --no-coverage (887 tests)

Stacks on #92 (WPN-1497-snap-owned-helpers).

socket-security · 2026-07-31T22:09:20Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

ulissesferreira · 2026-08-02T12:29:53Z

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published snap dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:54Z

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.

ulissesferreira · 2026-08-02T12:29:55Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.1.0
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-08-02T12:29:56Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@2.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:57Z

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:58Z

@SocketSecurity ignore npm/@metamask/core-backend@8.1.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:00Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

ulissesferreira · 2026-08-02T12:30:01Z

@SocketSecurity ignore npm/@metamask/geolocation-controller@1.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:02Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:03Z

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:04Z

@SocketSecurity ignore npm/@metamask/network-controller@35.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:06Z

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:07Z

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:08Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:10Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@5.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:11Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.
AI anomaly is benign signature-verification utility code.

ulissesferreira · 2026-08-02T12:30:12Z

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:13Z

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:14Z

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack. Standard keccak native addon used across MetaMask/core for address/hash operations.
Native binaries alert is expected for this package.

ulissesferreira · 2026-08-02T12:30:15Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

ulissesferreira · 2026-08-05T11:45:36Z

+  messenger: coreMessenger as RemoteFeatureFlagsProviderMessenger,
+});
+const assetsProvider = new AssetsProvider({
+  messenger: coreMessenger as AssetsProviderMessenger,


I haven't been able to automatically have this type set yet. Will ask @mikesposito when he is back to see if we can come up with some ideas.

ulissesferreira · 2026-08-06T08:12:05Z

@cursoragent rebase with latest main then babysit PR until green

cursor · 2026-08-06T08:12:16Z

Rebase and CI babysitting are complete. PR #95 is green.

Rebase

Rebased WPN-1497-messenger-plumbing onto latest main (6fbb3e38 — chore: support intra-repository dependencies chore: support intra-repository dependencies #126)
Two commits were dropped as already upstream:
- ci: reuse Build job artifacts in the Test matrix
- build: run workspace builds in topological-dev order
Remaining commits (3):
- feat(tron-wallet-snap): add Core messenger plumbing
- fix(tron-wallet-snap): sync CI manifest shasum
- fix(tron-wallet-snap): format manifest and sync CI shasum
Force-pushed to origin/WPN-1497-messenger-plumbing

CI status

All 47 checks passed, including:

Lint (eslint, misc, constraints, dependencies, readme)
Build (24.x)
Tests for @metamask/tron-wallet-snap (20.x and 22.x)
Changelog validation
Security scans (CodeQL, Semgrep, zizmor, Socket Security)
Main / All jobs pass (required)

No code changes were needed — the rebase was clean and CI passed on the first run after the push.

Instantiate Core messenger via getMessenger and wire RemoteFeatureFlagsProvider / AssetsProvider into context for the upcoming AssetsController migration. Reads still delegate to SnapAssetsAdapter. Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

ulissesferreira requested review from a team as code owners July 31, 2026 22:08

ulissesferreira mentioned this pull request Jul 31, 2026

feat(tron-wallet-snap): implement feature-flagged AssetsController #94

Closed

2 tasks

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from b67ea64 to 8624473 Compare July 31, 2026 22:18

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 2339dbc to 1413a43 Compare July 31, 2026 22:32

ulissesferreira added the no-changelog label Jul 31, 2026

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 86f8e33 to 91b9f68 Compare August 5, 2026 11:42

ulissesferreira commented Aug 5, 2026

View reviewed changes

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 91b9f68 to b24a871 Compare August 5, 2026 11:47

ulissesferreira mentioned this pull request Aug 5, 2026

feat(solana-wallet-snap): add Core messenger plumbing for Solana AssetsProvider #122

Draft

4 tasks

cursor Bot mentioned this pull request Aug 5, 2026

feat(solana-wallet-snap): remove Solana Snap assets tracking after flag migration #125

Draft

4 tasks

github-advanced-security AI found potential problems Aug 5, 2026

View reviewed changes

Comment thread .github/workflows/lint-build-test.yml Fixed

Comment thread .github/workflows/lint-build-test.yml Fixed

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from 4a61bb5 to 5da8934 Compare August 5, 2026 18:09

cursor Bot changed the base branch from main to ulissesferreira/ci-share-build-artifacts-cb0e August 5, 2026 18:09

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from 5da8934 to 938c2bf Compare August 5, 2026 18:10

ulissesferreira mentioned this pull request Aug 5, 2026

feat(tron-wallet-snap): route asset reads through Core AssetsController #127

Open

2 tasks

cursor Bot force-pushed the ulissesferreira/ci-share-build-artifacts-cb0e branch from 9eb091f to e05970e Compare August 5, 2026 19:08

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch 2 times, most recently from 6587ae2 to 9428a52 Compare August 5, 2026 19:34

ulissesferreira marked this pull request as draft August 6, 2026 07:26

Base automatically changed from ulissesferreira/ci-share-build-artifacts-cb0e to main August 6, 2026 07:43

ulissesferreira marked this pull request as ready for review August 6, 2026 08:11

ulissesferreira temporarily deployed to default-branch August 6, 2026 08:11 — with GitHub Actions Inactive

cursoragent and others added 3 commits August 6, 2026 08:12

fix(tron-wallet-snap): sync CI manifest shasum

1fdfc05

Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

fix(tron-wallet-snap): format manifest and sync CI shasum

489bab0

Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from 9428a52 to 489bab0 Compare August 6, 2026 08:14

gabrieledm approved these changes Aug 6, 2026

View reviewed changes

ulissesferreira added this pull request to the merge queue Aug 6, 2026

Merged via the queue into main with commit ae92221 Aug 6, 2026
49 checks passed

ulissesferreira deleted the WPN-1497-messenger-plumbing branch August 6, 2026 08:31

This was referenced Aug 7, 2026

Release/7.0.0 #137

Open

fix: type Core messenger as AsyncMessenger without provider casts #138

Draft

Uh oh!

Conversation

ulissesferreira commented Jul 31, 2026

Summary

Jira

Test plan

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ulissesferreira commented Aug 6, 2026

Uh oh!

cursor Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rebase

CI status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

socket-security Bot commented Jul 31, 2026 •

edited

Loading

cursor Bot commented Aug 6, 2026 •

edited

Loading