fix(cloudflare): Instrument DO RPC methods on the prototype, not a Proxy - #23057
Open
JPeer264 wants to merge 1 commit into
Open
fix(cloudflare): Instrument DO RPC methods on the prototype, not a Proxy#23057JPeer264 wants to merge 1 commit into
JPeer264 wants to merge 1 commit into
Conversation
Contributor
size-limit report 📦
|
Base automatically changed from
jp/cloudflare-remove-instrument-prototype-methods
to
develop
August 5, 2026 14:57
JPeer264
force-pushed
the
jp/cloudflare-agent-rpc-proxy-private-fields
branch
4 times, most recently
from
August 6, 2026 08:10
32f9837 to
55d51ed
Compare
The RPC instrumentation returned a Proxy of the instance. The runtime stores that object and, on dispatch, resolves the method on the prototype and invokes it with the stored object as receiver. A stored Proxy has no private-field brand, so classes with native private fields throw. The Proxy traps cannot help — the method is read from the prototype, so no trap is consulted. Wrap the RPC methods on the class prototype instead (once per class), with per-instance state in a WeakMap keyed on the instance. The prototype is also the only interception point the runtime accepts for class targets: it rejects own instance properties and dispatches prototype properties only (workerd's `tryGetProperty`).
JPeer264
force-pushed
the
jp/cloudflare-agent-rpc-proxy-private-fields
branch
from
August 6, 2026 08:20
55d51ed to
cee3b62
Compare
JPeer264
marked this pull request as ready for review
August 6, 2026 08:20
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
|
|
||
| const state = isObjectLike(this) ? rpcInstanceStates.get(this) : undefined; | ||
|
|
||
| if (!state) { |
Contributor
There was a problem hiding this comment.
Bug: The RPC wrapper leaks the internal __sentry_rpc_meta__ object to the user's method if the Durable Object instance was initialized without RPC tracing enabled.
Severity: MEDIUM
Suggested Fix
In the fallback path where !state is true, extract and remove the RPC metadata from the args array before calling Reflect.apply(originalMethod, this, args). This ensures the user's method is always called with clean arguments.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: packages/cloudflare/src/durableobject.ts#L357
Potential issue: In `createRpcPrototypeWrapper`, when an RPC call with trace propagation
metadata is made to a Durable Object instance that was initialized with
`enableRpcTracePropagation: false`, the instance will lack state in `rpcInstanceStates`.
The wrapper function's fallback logic at line 358 will then invoke the original user
method with the raw arguments, which incorrectly includes the internal `{
__sentry_rpc_meta__: ... }` object. This can occur when different instances of the same
Durable Object class are created with mixed SDK configurations, causing the user's
method to receive an unexpected argument.
Did we get this right? 👍 / 👎 to inform future reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #23040
closes JS-3283
This is getting rid completely of the Proxy for methods on the DO entirely. It seems private calls were not working properly with Proxies, therefore we need to switch entirely to a prototype-wrapping. This was in already before in
instrumentPrototypeMethodsand moved over to a Proxy.I also did a benchmark on a deployed worker instance and it seems that there is no significant performance difference - they're even mostly the same in performance. So there is only a win doing this.
The main difference is that before every call was over the Proxy, which had the overhead, and now the overhead is on the instance creation of the DurableObject once.
The big downside
We had to add
resolveFrameworkManagedMethodsto it, that detects if the library is changing the prototypes. There is e.g. a case inagentswhere they change thecallablefields and update it on prototype level. They later check oncallableMetadata.getand check if the method is there - if we would overwrite it: 💥Not this check could have been solely done for that workaround in their library, but I don't think this is a one-off and tried to keep it generic. The good part is that this only happens when the instance of the DO is created (which is not once per request)
https://github.com/cloudflare/agents/blob/3172a232d2c663db6bff126c7ca1ccddb5beb45d/packages/agents/src/index.ts#L3618-L3626
Clanker description:
The RPC instrumentation returned a Proxy of the instance. The runtime stores that object and, on dispatch, resolves the method on the prototype and invokes it with the stored object as receiver. A stored Proxy has no private-field brand, so classes with native private fields throw. The Proxy traps cannot help, the method is read from the prototype, so no trap is consulted.
Wrap the RPC methods on the class prototype instead (once per class), with per-instance state in a WeakMap keyed on the instance. The prototype is also the only interception point the runtime accepts for class targets: it rejects own instance properties and dispatches prototype properties only (workerd's
tryGetProperty).