From 09019b484dd2bf80db114aa0b637544067a442b7 Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Fri, 13 Nov 2026 12:51:46 +0100
Subject: [PATCH] fix(cloudflare-code): the host build carries the sandbox-http
 native transport
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The published rhema-sandbox-http gates its reqwest code on the wasm
target alone, so a featureless build compiles only on wasm — and the
DO declares the crate featureless, because workerd has no sockets.
On the host, where the neutral half compiles and tests, the feature
is not optional: without it the crate cannot resolve `reqwest` and
the workspace does not build. This workspace only ever saw the
feature on, masked by member unification under --all-features; the
extraction to registry deps removed the mask.

The declaration splits by target: featureless on wasm (the fetch
transport covers the protocol there), native on host. The crate's
own cfg keeps the reqwest code native-only either way; the feature
brings the dependency. The upstream gate repair — gating the code on
the feature, not just the target — rides the rhema side.
---
 crates/rhema-cloudflare-code/Cargo.toml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/crates/rhema-cloudflare-code/Cargo.toml b/crates/rhema-cloudflare-code/Cargo.toml
index 35fcbb6..968388d 100644
--- a/crates/rhema-cloudflare-code/Cargo.toml
+++ b/crates/rhema-cloudflare-code/Cargo.toml
@@ -42,8 +42,11 @@ rhema-rsd = { version = "0.2.6", default-features = false }
 rhema-sandbox = { version = "0.2.6", default-features = false }
 # The protocol's HTTPS client: the `HttpTransport` seam this worker
 # implements over host fetch, plus the `HttpSandbox` the `http` backend
-# drives — reqwest behind its `native` feature, off here, workerd has
-# no sockets
+# drives. Featureless on wasm — workerd has no sockets — but with the
+# crate's native transport on host builds: the host compiles the
+# neutral half, and its only real transport is reqwest. The crate's
+# own cfg keeps the reqwest code native-only; the feature brings the
+# dependency.
 rhema-sandbox-http = { version = "0.2.6", default-features = false }
 rhema-transcript = { version = "0.2.6" }
 # The typed errors the backend choice and the turn's durable pieces report
@@ -52,6 +55,12 @@ async-trait = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 
+# The same client with its native transport, host-only: the declaration
+# above keeps the wasm build featureless, this one gives the host build
+# the reqwest transport.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+rhema-sandbox-http = { version = "0.2.6", default-features = false, features = ["native"] }
+
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 # Pinned to 0.8 (verified against this tree): the DurableObject trait,
 # SqlStorage, WebSocket, and Delay APIs this crate uses are 0.8-shaped;