A `concurrency:"multi"` call's result comes back as a deferred completion
event (`__logos_call_complete__`), delivered by RemoteEventHelper::onEventResponse
— a slot fired by the replica's eventResponse signal. Cross-process, that slot
runs on QtRO's read stack (QRemoteObjectNodePrivate::onClientRead). Until now the
async user callback was invoked *inline* there, and that callback routinely (a)
emits a module event — which the host-side ModuleProxy serializes onto the QtRO
source — and (b) release()s the client object. Doing either while onClientRead is
still unwinding re-enters QtRO and corrupts the node: a SIGSEGV in onClientRead
(EXC_BAD_ACCESS, KERN_INVALID_ADDRESS at 0x80). This is the crash the EVM wallet
backend hit from refresh_balances, which fans balance reads out to eth_rpc via
call_async and then emits `balances_updated` from the gather completion.
Primary fix (remote_transport.cpp): deliver the async completion callback on the
next event-loop turn via QTimer::singleShot(0, m_helper, …) instead of inline, so
all user code (event emits, release(), further calls) runs after onClientRead has
fully unwound. m_helper is the context so the callback is dropped if the object is
torn down first.
Defense-in-depth for the same re-entrancy class:
- remote_transport.cpp release()/disconnectEvents()/dtor: deleteLater() the helper
(signal receiver) and replica (signal sender) and disconnect first, instead of
deleting them inline — deleting a QObject mid-emission corrupts the connection
list Qt is iterating.
- module_proxy.cpp: always queue the source eventResponse emit to the owning
thread (Qt::QueuedConnection), never emit inline, so a module that emits from
inside a same-thread dispatch can't re-enter QtRO's source serialization.
Tests (tests/protocol/test_remote_transport_events.cpp, newly wired): qt_remote
LocalSocket event delivery (direct + full provider chain) and a reentrant-release
regression that drives release() from inside a deferred-completion callback. The
hard crash only reproduces cross-process (in-process QtRO posts the event, so the
read stack has already unwound) — the cross-process guard is the wallet Anvil
integration doctest, where this fix is A/B-proven: the published backend crashes
on refresh_balances, the patched backend returns balances cleanly.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: per-module concurrent dispatch (concurrency:"multi") — zero ABI change
A "multi" module serves calls concurrently behind the ORDINARY callMethod — no
new provider/host vtable method, so LogosProviderObject's ABI is byte-identical
to before and an old host/daemon loads and forwards a multi module unmodified.
Mechanism: a multi module's generated glue returns a pending sentinel
({"__logos_pending_call__": callId}) from callMethod and pushes the real result
back later as a __logos_call_complete__ event keyed by callId, over the existing
event channel. The consumer transport detects the sentinel and awaits the
completion transparently, so generated clients are unchanged.
- logos_async_dispatch.h: shared wire constants + the contract.
- remote_transport.cpp (QtRO) / plain_logos_object.{h,cpp} (plain): consumer
sentinel detection + await keyed by callId. The host is a pure forwarder.
- logos_protocol.h + nix/default.nix: protocol 0.2.0 (additive minor; same MAJOR
stays compatible, so an old host accepts a 0.2 "multi" module).
- rpc_server.cpp: fix a teardown self-deadlock (stop() held m_mu while invoking a
per-connection error handler that re-locks m_mu) that the new in-process
subscription path exposed.
- tests/protocol/test_concurrent_dispatch.cpp: proves a multi provider overlaps
two concurrent calls (peak 2) while single serializes (peak 1), over the plain
transport, with the host unchanged from master.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: coalesce concurrent async requestModule handshakes (+ async fan-out test)
A driver that fans out N async calls to an un-tokened target before any
completes used to fire N separate requestModule handshakes. Each mints a
distinct capability token and informs the target, and the later inform
OVERWRITES the earlier token there (the target stores one token per caller),
so the already-dispatched calls carried a superseded token and the target
rejected them as unauthorized ("auth token not recognized"). The sync path
never hit this — it blocks per call, so handshakes never overlap.
Coalesce in LogosAPIClient::invokeRemoteMethodAsync: the first async call to
an un-tokened target starts ONE handshake; concurrent calls to the same
target queue behind it and all drain with the single minted token when it
resolves. m_pendingHandshakes is touched only on the owner thread, so no lock
(appended last per the class's ABI note). This is what lets a concurrency:
"multi" worker actually run a single-threaded driver's fan-out concurrently —
otherwise the fanned-out calls are rejected before reaching dispatch.
Also add MultiProviderOverlapsAsync / SingleProviderSerializesAsync to the
concurrent-dispatch gtest: they fire N concurrent callMethodAsync() calls (the
fan-out pattern over the async consumer path, which the sync tests don't
exercise) and assert peak overlap 4 for "multi", 1 for "single".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Extract the Logos protocol layer from logos-cpp-sdk
Transports (plain TCP/TLS, qt_local, qt_remote/QRO, mock), token manager,
consumer core (LogosAPIClient/LogosAPIConsumer incl. the capability
auto-requestModule flow), ModuleProxy, the abstract LogosProviderObject
interface, and the canonical QVariant<->JSON conversion — now behind the
language-neutral lp_* C ABI (logos_protocol.h) carrying the protocol
semver (LOGOS_PROTOCOL_VERSION_*, lp_protocol_version()).
Bytes crossing the ABI use the lossless {"_bytes": base64url} tagging
(NUL-safe), matching the plain wire encoding.
Provider lp_* surface is compiled groundwork; serving lands with module
authoring.
* consumer: typed requestModule for the capability flow
Port of logos-cpp-sdk master f5a127dd ('use updated capability module',
cpp-sdk#85, Iuri Matias) — the touched files (logos_api_client.cpp,
logos_api_consumer.{h,cpp}) moved into this repo in the P1 extraction.
The capability auto-requestModule path now calls a typed std::string
helper on the consumer (which acquires the capability object directly)
instead of a stringly invokeRemoteMethod round-trip. 111/111 tests.
