ModuleProxy::callRemoteMethod is the choke point every cross-module call
passes through on the callee side. It logged the full QVariantList of
arguments at debug level, which dumped secrets — mnemonics, passwords,
auth tokens, key material — into module logs in plaintext.
Log only the argument count, matching the other transport call sites
(LogosAPIClient/LogosAPIConsumer/LocalLogosObject/RemoteLogosObject all
already log args.size() only).
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
A `concurrency:"multi"` call's result comes back as a deferred completion
event (`__logos_call_complete__`), delivered by RemoteEventHelper::onEventResponse
— a slot fired by the replica's eventResponse signal. Cross-process, that slot
runs on QtRO's read stack (QRemoteObjectNodePrivate::onClientRead). Until now the
async user callback was invoked *inline* there, and that callback routinely (a)
emits a module event — which the host-side ModuleProxy serializes onto the QtRO
source — and (b) release()s the client object. Doing either while onClientRead is
still unwinding re-enters QtRO and corrupts the node: a SIGSEGV in onClientRead
(EXC_BAD_ACCESS, KERN_INVALID_ADDRESS at 0x80). This is the crash the EVM wallet
backend hit from refresh_balances, which fans balance reads out to eth_rpc via
call_async and then emits `balances_updated` from the gather completion.
Primary fix (remote_transport.cpp): deliver the async completion callback on the
next event-loop turn via QTimer::singleShot(0, m_helper, …) instead of inline, so
all user code (event emits, release(), further calls) runs after onClientRead has
fully unwound. m_helper is the context so the callback is dropped if the object is
torn down first.
Defense-in-depth for the same re-entrancy class:
- remote_transport.cpp release()/disconnectEvents()/dtor: deleteLater() the helper
(signal receiver) and replica (signal sender) and disconnect first, instead of
deleting them inline — deleting a QObject mid-emission corrupts the connection
list Qt is iterating.
- module_proxy.cpp: always queue the source eventResponse emit to the owning
thread (Qt::QueuedConnection), never emit inline, so a module that emits from
inside a same-thread dispatch can't re-enter QtRO's source serialization.
Tests (tests/protocol/test_remote_transport_events.cpp, newly wired): qt_remote
LocalSocket event delivery (direct + full provider chain) and a reentrant-release
regression that drives release() from inside a deferred-completion callback. The
hard crash only reproduces cross-process (in-process QtRO posts the event, so the
read stack has already unwound) — the cross-process guard is the wallet Anvil
integration doctest, where this fix is A/B-proven: the published backend crashes
on refresh_balances, the patched backend returns balances cleanly.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Extract the Logos protocol layer from logos-cpp-sdk
Transports (plain TCP/TLS, qt_local, qt_remote/QRO, mock), token manager,
consumer core (LogosAPIClient/LogosAPIConsumer incl. the capability
auto-requestModule flow), ModuleProxy, the abstract LogosProviderObject
interface, and the canonical QVariant<->JSON conversion — now behind the
language-neutral lp_* C ABI (logos_protocol.h) carrying the protocol
semver (LOGOS_PROTOCOL_VERSION_*, lp_protocol_version()).
Bytes crossing the ABI use the lossless {"_bytes": base64url} tagging
(NUL-safe), matching the plain wire encoding.
Provider lp_* surface is compiled groundwork; serving lands with module
authoring.
* consumer: typed requestModule for the capability flow
Port of logos-cpp-sdk master f5a127dd ('use updated capability module',
cpp-sdk#85, Iuri Matias) — the touched files (logos_api_client.cpp,
logos_api_consumer.{h,cpp}) moved into this repo in the P1 extraction.
The capability auto-requestModule path now calls a typed std::string
helper on the consumer (which acquires the capability object directly)
instead of a stringly invokeRemoteMethod round-trip. 111/111 tests.
