Rust-core port follow-ups - #77
Merged
Merged
Conversation
Replace the Nova host-container, auth, and signing path with the worker-backed Rust core. Keep dotli responsible only for browser policy, persistence, UI, and physical chain transports.
Notification grants do not alter iframe Permissions Policy. Reloading disposed the in-flight Rust request before its response reached the product.
The pending-message flush drops send failures silently, matching the pre-port behavior. Surfacing them as JSON-RPC errors moves to a follow-up PR with test coverage.
…follow-up
Keep @polkadot-api/signer and @polkadot-labs/hdkd{,-helpers} declared
(unused since before the port) and limit rpc-chain tests to the new
core gateway provider surface. Removing the dead deps and adding
coverage for pre-existing chain checks moves to a follow-up PR.
Keep the base panel top offset and suffix-based terminator matching (minus the removed host-papp events). The offset correction, the exact-match terminator set, and the @dotli/config dependency declaration move to a follow-up PR.
Prompts always reach the modal, matching the pre-port behavior. The sliding-window limiter returns in a follow-up PR together with the denied-path semantics and a test that trips the window.
AllowanceKeys persist as plain hex through the same path as every other core storage key. The at-rest cipher moves to a follow-up PR where the scheme (per-write nonce, plain-hex read fallback) can get a focused security review.
The bridge emits only the first_inbound/first_outbound lifecycle events. The per-frame TrUAPI tap that feeds the debug panel timeline returns in a follow-up PR; the panel's truapi event handling stays in place and receives no events until then.
… follow-up Login failures fall back to the raw reason except for the base OriginPersonProviderError mapping, and the permissions popover renders last-write-wins without a staleness guard or unavailable-state hint. The failure-message pack and popover hardening move to a follow-up PR.
…i-host 0.1.0 The published packages replace the temporary personal-scope npm aliases used while the port was in review.
pgherveou
requested review from
BigTava,
Cyr06130,
KarimJedda,
TorstenStueber,
ba1uev,
justraman,
leonardocustodio,
tallesborges and
valentinfernandez1
as code owners
July 15, 2026 14:40
Contributor
⚡ Performance Report
|
Contributor
Bundle Size ReportChunks over 500 KB:
All files
Commit: d5e26bc |
leonardocustodio
temporarily deployed
to
dotli.dev
July 25, 2026 18:30 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Member
|
Only issues that I saw when testing on https://host-playground.dotli.dev on
Ofc allocating all resources would fail the bulletin step: Let me know if this will be handled elsewhere. |
TarikGul
reviewed
Jul 27, 2026
TarikGul
left a comment
TarikGul
left a comment
Member
There was a problem hiding this comment.
Compiled my review with claude here: https://gist.github.com/TarikGul/36916b1a6c2a2b4c2a7f989b22ac9ead
Includes reproducibles, and examples.
valentinfernandez1
had a problem deploying
to
dotli.dev
July 27, 2026 17:16 — with
GitHub Actions
Error
GitHub Actions
Error
valentinfernandez1
had a problem deploying
to
dotli.dev
July 27, 2026 17:35 — with
GitHub Actions
Error
GitHub Actions
Error
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
valentinfernandez1
temporarily deployed
to
dotli.dev
July 27, 2026 17:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Collaborator
|
@leonardocustodio This PR resolves the issue regarding bulletin allowance with smoldot-direct, the fix was on the core so here we just consume the new truapi release. The change is already deployed on dotli.dev so feel free to verify the fix. Should also improve some stability issues with smoldot. |
3 tasks
leonardocustodio
previously approved these changes
Jul 28, 2026
valentinfernandez1
temporarily deployed
to
dotli.dev
July 28, 2026 14:05 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
pgherveou
pushed a commit
that referenced
this pull request
Jul 28, 2026
#70 (Switch to Rust core) and #77 (Rust-core port follow-ups) landed on main in between. #70 was squash-merged, so this branch and main carried the same port content under different commits, and every file the port added conflicted add/add. Resolution: main is authoritative for everything except the four commits that are unique to this branch (aa229af, 72bda6c, 99549e2, ae4112b). Those were reapplied on top of main's tree, so the branch diff against main is now the chain-ownership change alone. Conflicts of substance: - broker.ts: kept #77's ref-counted token release (loop over every local token sharing the upstream token) and its early-subscription buffering, and added this branch's terminal `transactionWatch_v1_watchEvent` events to the release condition. - client.ts: took the new `createPapiChainProvider` adapter. #77's only change here added JSON-RPC error responses when a queued `chainSend` flush failed; that code path is deleted, and the adapter's `failOutstanding` covers the same case for every outstanding request, not just flushed ones. - bulletin-bitswap.ts: kept #77's RPC-gateway warning, dropped its `isRemoteChainSupported` branch. Bulletin is always in the supported set, so that branch was dead; unsupported chains now surface as `UNSUPPORTED_CHAIN` from the protocol runtime at connect time. - resolver/tests/rpc-chain.test.ts: kept #77's People and unknown-genesis cases, renamed to `isRpcUpstreamSupported` / `createRpcUpstreamProvider`. - network.ts: refreshed two comments that still described the Rust-core callback as the thing choosing chains.
smohan-dw
added a commit
to smohan-dw/dotli-community
that referenced
this pull request
Jul 29, 2026
… input validation paritytech#122) into commons-0.9.9 # Conflicts: # packages/resolver/tests/chains.test.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups to the Rust-core port (#70, merged). Two kinds of work: features that were split out of that PR to keep its review focused, and fixes for what the port review and a later audit turned up.
What's new
What's fixed
@parity/truapi-hostto 0.2.1, which fixes the allowance-propagation race that made a bulletin allocation come backNotAvailable(and preimage submit fail) in smoldot-direct. The dotli side needed no change, the fix is in the core.remove-legacy-novafor one-grep removal once products migrate.chainSendflush failures come back as JSON-RPC errors instead of hanging.locationparam is gone.