feat: Add support for using the messenger in preinstalled Snaps

[FrederikBolding]

Add support for using the messenger in preinstalled Snaps. To access the messenger a Snap must specify a list of actions in endowment:messenger. Then, it can use getMessenger to get a messenger object for use inside the Snap. The actions used must return JSON-serializable values.

https://consensyssoftware.atlassian.net/browse/WPC-1021

---

Note

Medium Risk
Introduces a new path from Snap execution into client controller messengers; risk is mitigated by preinstall-only gating, manifest-scoped actions, and a blocklist of high-privilege controllers, but incorrect hook/delegation behavior could still widen access.

Overview
Adds endowment:messenger so preinstalled Snaps can declare allowed controller actions via a messengerScopes caveat (manifest-validated actions list). Snap code uses SDK getMessenger(), which forwards messenger.call(...) to the new permitted RPC snap_messengerCall.

The platform handler only exposes the method when the Snap is preinstalled and holds the messenger endowment; it builds a scoped messenger from a getMessenger hook, rejects calls into a fixed set of sensitive controller namespaces, and returns JSON-serializable results. snaps-simulation wires the same hook by delegating declared actions to the root controller messenger.

The preinstalled example Snap and test-snaps UI exercise PhishingController:testOrigin; LavaMoat policies now allow @metamask/messenger through @metamask/snaps-sdk.

^{Reviewed by Cursor Bugbot for commit 61fb96e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.59%. Comparing base (324299d) to head (61fb96e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4055   +/-   ##
=======================================
  Coverage   98.59%   98.59%           
=======================================
  Files         425      428    +3     
  Lines       12413    12484   +71     
  Branches     1969     1975    +6     
=======================================
+ Hits        12238    12309   +71     
  Misses        175      175           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[FrederikBolding]

bugbot run

[FrederikBolding]

Open to suggestions for a better name here

[Mrtenz]

Why does this need a type cast?

[FrederikBolding]

Type 'Promise<Json>' is not assignable to type 'Promise<Awaited<ExtractActionResponse<Action, ActionType>>>'.
  Type 'Json' is not assignable to type 'Awaited<ExtractActionResponse<Action, ActionType>>'.
    Type 'null' is not assignable to type 'Awaited<ExtractActionResponse<Action, ActionType>>'

[Mrtenz]

Maybe cast the return type rather than the whole object. Slightly cleaner imo.

[FrederikBolding]

I couldn't find a clean way to do that in c8e95fb 🤔

[FrederikBolding]

@metamaskbot update-pr

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e07f47a. Configure here.}