use ping endpoint to check rpc health

[piyalbasu]

Closes #2342

We were hardcoding the RPC healthy value because our RPC health checks previously were not working properly. Using the v2 health check, we can now restore this notification.

Summary

This pull request enhances the way the extension checks and reports the health of the Soroban RPC service, aligning the backend and frontend logic with the latest API and improving test coverage. The main changes include updating the RPC health check to use a new endpoint, adjusting the backend settings loader to use this updated check, and adding an end-to-end test to verify the notification appears when the RPC is unhealthy.

RPC Health Check Improvements:

• Updated getIsRpcHealthy in account.ts to use the new INDEXER_V2_URL and the /ping?network=* endpoint, and to extract the rpc_health field from the response. The function now takes a localStore parameter and retrieves network details internally. [1] [2]
• Updated the loadBackendSettings handler to call getIsRpcHealthy with the correct parameters and return the actual RPC health status instead of a hardcoded value.
• Modified the popup message listener to pass the localStore to loadBackendSettings for proper context.

Testing Enhancements:

• Added a new end-to-end test (rpcHealthNotification.test.ts) that stubs the RPC health endpoint as unhealthy and verifies that the appropriate notification is shown in the UI.

[piyalbasu]

these settings are loaded async after balances have already been loaded. This ensures that this call doesn't slow down time to largest contentful paint.

[aristidesstaffieri]

@piyalbasu @sdfcharles what are your thoughts about making these notifications render outside of the layout(like mobile does or general toast patterns)?

My concern here is that rendering it where it is now will cause a layout shift, which is especially frustrating when it happens async and the user may already be interacting with the layout.

[piyalbasu]

Yeah, that's a good point. I can implement shadcn's toast here instead

[piyalbasu]

Toast added here: 05e5d5d

toast.mov

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​sonner@​2.0.7
	npm/​shadcn@​3.7.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @dotenvx/dotenvx under BSD-3-Clause Location: Package overview From: ? → npm/shadcn@3.7.0 → npm/@dotenvx/dotenvx@1.51.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@dotenvx/dotenvx@1.51.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: ? → npm/shadcn@3.7.0 → npm/caniuse-lite@1.0.30001764 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001764. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm diff under BSD-3-Clause Location: Package overview From: ? → npm/shadcn@3.7.0 → npm/diff@8.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/diff@8.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm fzf under BSD-3-Clause Location: Package overview From: ? → npm/shadcn@3.7.0 → npm/fzf@0.5.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fzf@0.5.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm qs under BSD-3-Clause Location: Package overview From: ? → npm/shadcn@3.7.0 → npm/qs@6.14.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/qs@6.14.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm tough-cookie under BSD-3-Clause Location: Package overview From: ? → npm/shadcn@3.7.0 → npm/tough-cookie@6.0.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tough-cookie@6.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm type-fest under CC0-1.0 AND MIT Location: Package overview From: ? → npm/shadcn@3.7.0 → npm/type-fest@5.4.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/type-fest@5.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This pull request updates the RPC health check to use a new v2 backend endpoint and replaces the old in-page notification banner with a toast notification using the sonner library. The changes restore the RPC health check that was previously hardcoded to always return true.

Changes:

• Updated getIsRpcHealthy to use the new INDEXER_V2_URL endpoint and accept localStore parameter
• Replaced inline notification banner with toast notification using sonner library
• Added unit tests for the RPC health check logic

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
extension/src/background/helpers/account.ts	Updated getIsRpcHealthy to use v2 endpoint and extract network details from localStore
extension/src/background/messageListener/handlers/loadBackendSettings.ts	Removed hardcoded isRpcHealthy = true and now calls actual function with localStore
extension/src/popup/views/Account/index.tsx	Replaced notification banner with toast using useEffect and sorobanErrorShownRef
extension/src/popup/basics/shadcn/Toast/index.tsx	New Toaster component wrapping sonner library
extension/src/popup/App.tsx	Added global Toaster component
extension/src/background/helpers/tests/account.test.ts	Added comprehensive tests for getIsRpcHealthy
extension/package.json	Added sonner and shadcn dependencies
extension/src/popup/locales/*/translation.json	Updated translation strings

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The API endpoint has been changed to use INDEXER_V2_URL instead of INDEXER_URL, but the response structure is assumed to be the same. Based on the PR description, the v2 endpoint should return rpc_health field according to the referenced backend PR, but the code still expects a status field (line 318: rpcHealth = await res.json() followed by line 327: if (rpcHealth.status !== "healthy")). Verify that the v2 endpoint returns the expected response format with a status field, or update the code to extract rpc_health from the response.

[Copilot]

The useEffect will show the toast every time isSorobanSuported becomes false, but the ref only prevents showing it multiple times within the same component lifecycle. If the user navigates away and returns to the Account view, the ref will still be true and the toast won't show again even if the RPC is still unhealthy. Consider resetting the ref when isSorobanSuported becomes true, or use a different approach to track whether the notification should be shown.

Suggested change

	sorobanErrorShownRef.current = true;
	sorobanErrorShownRef.current = true;
	} else if (isSorobanSuported) {
	sorobanErrorShownRef.current = false;

[Copilot]

The Portuguese translation is missing - it's using the English text instead of a Portuguese translation.

Suggested change

	"Soroban is temporarily experiencing issues": "Soroban is temporarily experiencing issues",
	"Soroban is temporarily experiencing issues": "O Soroban está temporariamente com problemas",

[Copilot]

The Portuguese translation is missing - it's using the English text instead of a Portuguese translation.

Suggested change

	"You may not be able to transact with Soroban smart contracts or see your Soroban tokens at this time.": "You may not be able to transact with Soroban smart contracts or see your Soroban tokens at this time.",
	"You may not be able to transact with Soroban smart contracts or see your Soroban tokens at this time.": "Você talvez não consiga realizar transações com contratos inteligentes Soroban ou ver seus tokens Soroban neste momento.",

[Copilot]

When the fetch response is not ok (!res.ok), the code logs an exception but continues to parse the response as JSON. This could fail or return unexpected data. Consider returning early with an unhealthy status or a default value when the response is not ok, before attempting to parse the JSON.

Suggested change

	}
	rpcHealth = await res.json();
	rpcHealth = { status: "unhealthy" };
	} else {
	rpcHealth = await res.json();
	}