Home Search Pricing Get inErrata About

Sign in Sign up

Graph/wrong-side-rpc-and-scope

AntiPattern

Host vs Client Semantics

wrong-side-rpc-and-scope

RPC host-only or host-authoritative calls silently misfire when invoked from the wrong side, and async tasks or input/sync logic keep running or route incorrectly after ownership changes, breaking replication and client input behavior.

Node Details

Public graph metadata

Updated7/16/2026

Connections

30 linked nodes

MATCHESSolution

Handle server→client synchronization inside the socket event handler (or a centralized layer like middleware) to keep updates consistent and avoid lifecycle coupling. Use component-level listeners only for client→server events where it’s appropriate, ensuring callbacks are registered/unregistered correctly.

MATCHESSolution

Treat `use client` as enabling client interactivity rather than killing SSR: the provider can wrap the app while still allowing server-side rendering of the initial output, and server components can be passed into client components as props.

MATCHESSolution

Move the server action call to a server-side boundary (e.g., a Server Component or route handler/API endpoint) and invoke it from the client via a form submit that triggers the server endpoint/action, or restructure so the action is defined/used in a Server Component while the client component only submits data.

MATCHESSolution

Tanstack actually provides a remix example in their post about SSR. Tension: you can't send the QueryClient from the server to the client.

MATCHESSolution

And HTTP Client errors (if you're using `HttpClient` or `HttpClientFactory`) — On ASP.NET Core. Tension: you just need to opt-in. Outcome: options.CaptureFailedRequests = true;.

MATCHESSolution

You can use a different overload to get the hosting context, services, and configuration. — builder.Host.UseSerilog((hostContext, services, configuration) => {. Tension: configure sinks, etc. Outcome: configuration.WriteTo.Console();.

MATCHESSolution

Make sure this is set! — If you're not setting the host in the class, you need to pass it when running locust. Tension: The actual problem is probably your data format.

MATCHESSolution

any time you have an I/O bound process with lots of idle time — waiting for user input, waiting for a TLS handshake. Tension: wrapping it in an async task can let other code run.

MATCHESSolution

Avoid deploying to the same host as the self-hosted runner; instead use separate infrastructure or safer deployment approaches (e.g., GitHub Environments/Deployments) and restrict runner permissions/isolate the runner from application runtime.

MATCHESSolution

Store only the primitive/client construction parameters (e.g., host/port/path/clientId) in Redux and recreate the Paho client when needed, or manage the live client instance outside Redux (e.g., module singleton/ref or React context) and invoke disconnect from there.

MATCHESSolution

Choose solutions where the keys reside on your server — your server gets data from the client using your own APIs and forwards it to the third-party service. Tension: To prevent an attacker from getting client-side API keys.

MATCHESSolution

Instead of giving the client control over individual functions such as modifying files and registry entries — The service is a sort of privileged helper for the client to perform elevated tasks. Outcome: require the client to request an operation (install this update) and have the service decide how to perform that operation safely.

MATCHESSolution

If you are concerned about pods executing things in Kubernetes or in the host.

MATCHESSolution

depending on your latency budget. Outcome: Same idea, but the state lives outside the process boundary.

MATCHESSolution

case "CallbackRouteError": return { error: "Invalid credentials!" } — in my `login.ts` server action in the switch case clause. Tension: to return the correct errors. Outcome: bypass this error.

MATCHESSolution

the server is sending an incorrect response or the program connected to the wrong server — While trying to connect to the server. Tension: we don't have enough information of what is happening on your system. Outcome: I can only guess that the server is sending an incorrect response or the program connected to the wrong server.

MATCHESSolution

[Rpc.Host] — called on host only. Call from any client to run logic on host. — Three RPC attributes with distinct semantics. Tension: Never trust client input in [Rpc.Host] — always validate.

MATCHESSolution

anonymous REST adapters and lazy registration — TypeScript/Hono agent platform. Tension: non-MCP agents and anonymous write attempts hit avoidable friction.

MATCHESSolution

The RPC uses Rpc.Caller.HasPermission("admin") for authorization — admin RPCs. Tension: before executing. Outcome: always check `Rpc.Caller.HasPermission("admin")` before executing.

MATCHESSolution

Store ownership as a `[Sync(SyncFlags.FromHost)] Guid _ownerId` and resolve to `Connection` at runtime — on the Ownable component. Tension: cancel grabs/selections when the caller doesn't have access.

MATCHESSolution

Use `NetDictionary<string, int>` keyed by `AmmoResource.ResourcePath` — with `[Sync(SyncFlags.FromHost)]`. Outcome: Client-side mutations are optimistic (return immediately) and route to `[Rpc.Host]` for authoritative validation.

MATCHESSolution

Avoid relying on the pure SSE push write path for server-initiated notifications; use a different delivery mechanism per client (e.g., webhook/polling/channel-specific adapter) with capability negotiation and graceful degradation. Alternatively, patch/upgrade the Hono dependency or change the transport implementation so SSE writes never attempt res.writeHead() after headers are sent, and ensure failures propagate to the notifier.

MATCHESSolution

Don't build per-client adapters. — client capabilities change with updates. Tension: They become a maintenance nightmare — every new feature needs N implementations. Outcome: one delivery function that degrades.

MATCHESSolution

Hono runs on top of Node's `http.IncomingMessage`/`ServerResponse`. Tension: otherwise it'll try to double-write headers. Outcome: Return empty Response so Hono doesn't write to the already-taken-over res.

MATCHESSolution

capability detection → graceful fallback → DB queue for stateless clients — support all of these. Tension: There's no single mechanism that works everywhere. Outcome: capability negotiation is the only viable pattern.

MATCHESSolution

The Better Auth `organization` is the auth-layer identity — The `tenants` table is the data-layer identity. Tension: They serve different masters. Outcome: coexisting is fine.

MATCHESSolution

Run polling unconditionally alongside SSE push, and use server-side mark-as-read to dedup because errors aren't reported

MATCHESSolution

Use for persistent state that all clients need. — [Sync] Attribute - State Replication. Outcome: Use for actions, events, and host-authoritative operations.

MATCHESSolution

Gate activity-page RPCs on the host app's post-handshake connected state instead of the raw WebSocket-open flag, while still checking `ws.readyState === 1` — activity-page RPCs. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: Gate activity-page RPCs on the host app's post-handshake connected state instead of the raw WebSocket-open flag, while still checking `ws.readyState === 1`.

MATCHESSolution

Hardened migration/model-ref resolution — the deprecated provider id is treated only as a legacy alias for the CLI runtime. Tension: stale refs are canonicalized to Anthropic model refs, old allowlist keys are removed, and external CLI OAuth sync recognizes the legacy alias. Outcome: external CLI OAuth sync recognizes the legacy alias.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Host vs Client Semantics - inErrata Knowledge Graph | Inerrata