feat(tron-wallet-snap): add Core messenger plumbing by ulissesferreira · Pull Request #95 · MetaMask/internal-snaps

ulissesferreira · 2026-07-31T22:08:42Z

Summary

Instantiate Core messenger via getMessenger and endow RemoteFeatureFlagController:getState
Resolve assets migration stage from remote feature flags on each account asset read
No routing decisions yet — all reads still delegate to SnapAssetsAdapter

Part 1 of 2 split from #94. Part 2: WPN-1497-core-adapter-routing.

Jira

WPN-1497
Parent: WPN-1478

Test plan

yarn workspace @metamask/tron-wallet-snap build
yarn workspace @metamask/tron-wallet-snap run jest --no-coverage (887 tests)

Stacks on #92 (WPN-1497-snap-owned-helpers).

socket-security · 2026-07-31T22:09:20Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

ulissesferreira · 2026-08-02T12:29:53Z

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published snap dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:54Z

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.

ulissesferreira · 2026-08-02T12:29:55Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.1.0
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-08-02T12:29:56Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@2.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:57Z

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:29:58Z

@SocketSecurity ignore npm/@metamask/core-backend@8.1.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:00Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

ulissesferreira · 2026-08-02T12:30:01Z

@SocketSecurity ignore npm/@metamask/geolocation-controller@1.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:02Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:03Z

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:04Z

@SocketSecurity ignore npm/@metamask/network-controller@35.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:06Z

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:07Z

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:08Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:10Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@5.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:11Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.
AI anomaly is benign signature-verification utility code.

ulissesferreira · 2026-08-02T12:30:12Z

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:13Z

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/tron-wallet-snap published output; already present across MetaMask/core.

ulissesferreira · 2026-08-02T12:30:14Z

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack. Standard keccak native addon used across MetaMask/core for address/hash operations.
Native binaries alert is expected for this package.

ulissesferreira · 2026-08-02T12:30:15Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

ulissesferreira · 2026-08-05T11:43:42Z

  "files": [],
  "scripts": {
-    "build": "yarn workspaces foreach --all --no-private --parallel --interlaced --verbose run build",
+    "build": "yarn workspaces foreach --all --no-private --parallel --topological-dev --interlaced --verbose run build",


This is needed because Yarn is smart and detects it can import the code from snap-networks-utils locally and not go through npm. However since the packages build at the same time there is a race condition. Paired with parallel this automatically orders things the best way possible.

ulissesferreira · 2026-08-05T11:45:36Z

+  messenger: coreMessenger as RemoteFeatureFlagsProviderMessenger,
+});
+const assetsProvider = new AssetsProvider({
+  messenger: coreMessenger as AssetsProviderMessenger,


I haven't been able to automatically have this type set yet. Will ask @mikesposito when he is back to see if we can come up with some ideas.

Instantiate Core messenger via getMessenger and wire RemoteFeatureFlagsProvider / AssetsProvider into context for the upcoming AssetsController migration. Reads still delegate to SnapAssetsAdapter. Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

ulissesferreira requested review from a team as code owners July 31, 2026 22:08

ulissesferreira mentioned this pull request Jul 31, 2026

feat(tron-wallet-snap): implement feature-flagged AssetsController #94

Closed

2 tasks

ulissesferreira force-pushed the WPN-1497-snap-owned-helpers branch from b67ea64 to 8624473 Compare July 31, 2026 22:18

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 2339dbc to 1413a43 Compare July 31, 2026 22:32

ulissesferreira added the no-changelog label Jul 31, 2026

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from c9d4f0c to d5a852a Compare August 4, 2026 13:54

cursor Bot force-pushed the WPN-1497-snap-owned-helpers branch 2 times, most recently from ca77bde to 721da6f Compare August 5, 2026 07:10

Base automatically changed from WPN-1497-snap-owned-helpers to main August 5, 2026 08:06

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from d5a852a to 053386c Compare August 5, 2026 08:15

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch 3 times, most recently from 24a1fdb to 7b59e7c Compare August 5, 2026 10:23

MetaMask deleted a comment from cursor Bot Aug 5, 2026

ulissesferreira marked this pull request as ready for review August 5, 2026 10:32

ulissesferreira temporarily deployed to default-branch August 5, 2026 10:32 — with GitHub Actions Inactive

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 192f20f to 602a0db Compare August 5, 2026 11:15

MetaMask deleted a comment from cursor Bot Aug 5, 2026

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch 3 times, most recently from 86f8e33 to 91b9f68 Compare August 5, 2026 11:42

ulissesferreira commented Aug 5, 2026

View reviewed changes

ulissesferreira force-pushed the WPN-1497-messenger-plumbing branch from 91b9f68 to b24a871 Compare August 5, 2026 11:47

ulissesferreira mentioned this pull request Aug 5, 2026

feat(WPN-1652): add Core messenger plumbing for Solana AssetsProvider #122

Draft

4 tasks

cursor Bot mentioned this pull request Aug 5, 2026

feat(WPN-1486): remove Solana Snap assets tracking after flag migration #125

Draft

4 tasks

github-advanced-security AI found potential problems Aug 5, 2026

View reviewed changes

Comment thread .github/workflows/lint-build-test.yml Fixed

Comment thread .github/workflows/lint-build-test.yml Fixed

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from 4a61bb5 to 5da8934 Compare August 5, 2026 18:09

cursor Bot changed the base branch from main to ulissesferreira/ci-share-build-artifacts-cb0e August 5, 2026 18:09

cursor Bot force-pushed the WPN-1497-messenger-plumbing branch from 5da8934 to 938c2bf Compare August 5, 2026 18:10

fix(tron-wallet-snap): sync CI manifest shasum

449b271

Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

ulissesferreira mentioned this pull request Aug 5, 2026

feat(tron-wallet-snap): route fungible reads through Core AssetsController #127

Draft

2 tasks

fix(tron-wallet-snap): format manifest and sync CI shasum

2c9554e

Co-authored-by: Ulisses Ferreira <ulisses@hey.com>

Uh oh!

Conversation

ulissesferreira commented Jul 31, 2026

Summary

Jira

Test plan

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira commented Aug 2, 2026

Uh oh!

ulissesferreira Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

ulissesferreira Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security Bot commented Jul 31, 2026 •

edited

Loading