feat!: migrate to devframe 0.6 — official plugins, crossws + OTP auth#396
Merged
Conversation
…nspect Upgrade devframe and @devframes/hub to 0.6.0-beta.2 and replace the hand-rolled panels with the official portable devframe plugins: - Terminals and messages tabs are now provided by @devframes/plugin-terminals and @devframes/plugin-messages, mounted as built-ins. The hub's built-in ~terminals/~messages docks are suppressed via the new builtinDocks option; the message store/RPC is retained so toasts keep working. - Meta-introspection moves from the local self-inspect package to the official @devframes/plugin-inspect. - Align with the hub's reworked internals: crossws WebSocket transport and the OTP / magic-link auth handshake. Co-authored with the help of an agent.
commit: |
Collect the terminals, messages, and inspect panels under the shared "Vite+" dock group (alongside Rolldown) instead of each claiming its own top-level dock button.
When embedded in a Vite dev server, attach the RPC socket to Vite's own HTTP server on the /__devtools/__ws upgrade route instead of opening a separate port — friendlier to proxies and HTTPS. Standalone and CLI keep the dedicated-port fallback (no Vite server to share).
Add a "Revoke Access" action in Settings → Advanced that de-authorizes the current browser. A trusted-only `devtoolskit:internal:auth:revoke` RPC revokes the session's node-issued bearer token via devframe's `revokeAuthToken`; the resulting `devframe:auth:revoked` broadcast drops this (and any sibling) client back to untrusted.
- DTK0013: document the OTP code / magic-link trust flow, the `devframe:auth:exchange` pre-auth method, and Settings → Advanced → Revoke Access. - terminals / messages / kit index: attribute the panels to the official @devframes/plugin-terminals and @devframes/plugin-messages built-ins, and drop the removed built-in xterm panel / messages dock-badge notes. - remote-client: show the route-bound WS endpoint (shared Vite origin).
Bump devframe, @devframes/hub, and the plugins to 0.6.0-beta.3 and replace the hand-rolled auth wiring with devframe's new `createInteractiveAuth` recipe. It registers the renamed `anonymous:devframe:auth` / `:exchange` handshake, the built-in `devframe:auth:revoke` self-revoke, and the one-time-code banner — so the core no longer maintains its own handshake handlers or revoke RPC. The RPC resolver now gates purely on the `anonymous:` prefix (`isAnonymousRpcMethod`), dropping the hard-coded pre-auth allowlist. The connect-time bearer/remote-dock trust is preserved. The Revoke Access button calls the built-in `devframe:auth:revoke`.
Move the terminals, messages, and inspector panels into the `~builtin` dock category — alongside the built-in Settings dock — instead of the `~viteplus` group, which is reserved for integrations like Rolldown. In the playground, collect the demo docks under a dedicated "Playground" group (renamed from "Local Test").
antfubot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Upgrades
devframeand@devframes/hubto0.6.0-beta.3and adopts the official portable devframe plugins in place of the hand-rolled panels.Terminals & messages — the built-in terminals and messages tabs are now provided by
@devframes/plugin-terminalsand@devframes/plugin-messages, mounted as built-ins (gated bybuiltinDevTools). The hub's built-in~terminals/~messagesdocks are suppressed via thebuiltinDocksoption. The core message store/RPC is retained so toasts keep working (re-pointed at the messages plugin dock). The old webcomponents panels, the core terminals RPC, and the@xterm/*deps are removed.Self-inspect — meta-introspection moves from the local
packages/self-inspectpackage to the official@devframes/plugin-inspect; the local package is deleted.Auth — client auth is rewritten to devframe's OTP / magic-link model via the
createInteractiveAuthrecipe: theanonymous:devframe:auth/anonymous:devframe:auth:exchangehandshake, the built-indevframe:auth:revokeself-revoke (wired to a new Revoke Access button in Settings → Advanced), and the one-time-code banner. The RPC resolver gates purely on theanonymous:prefix (isAnonymousRpcMethod).WebSocket transport — migrated from
wsto crossws. When embedded in a Vite dev server the RPC socket attaches to Vite's own HTTP server on the/__devtools/__wsroute (friendlier to proxies/HTTPS); standalone/CLI keeps the dedicated-port fallback.Dock grouping — terminals, messages, and inspector live in the
~builtindock category alongside the built-in Settings dock; the~viteplus("Vite+") group is left for integrations like Rolldown. Playground demo docks are collected under a "Playground" group.pnpm lint,pnpm typecheck,pnpm test(188 passing), andpnpm buildall pass.Breaking changes
Warning
This is a breaking release.
@vitejs/devtools*and@vitejs/devtools-kitare pre-1.0 / experimental, and it pins a devframe pre-release.@vitejs/devtools-self-inspectis removed. The inspector is now the built-in@devframes/plugin-inspect(on by default). Migration: drop the@vitejs/devtools-self-inspectdependency and theDevToolsSelfInspect()plugin from your Vite config — the "Inspect" dock ships out of the box.devframe/@devframes/hub0.6.0-beta.3(up from0.5.4), inheriting devframe 0.6's own breaking changes (crossws transport, OTP auth, renamed RPC methods,nostics1.x). Kit consumers get devframe 0.6 transitively./__devtools/authpage is replaced by an OTP code /?devframe_otp=magic link over a route-bound socket. Anything that dialedws://…:7812?devframe_auth_token=…or drove the old page breaks;devtools.clientAuthTokensstill works for automation.devtoolskit:internal:terminals:*removed; auth methods renamed to theanonymous:devframe:auth*scope. These are@internal(not documented public API).Plugin-author surface is unchanged:
Plugin.devtools.setup,createPluginFromDevframe,DevTools(), andctx.terminals/ctx.messagesall keep their signatures.Linked Issues
Additional context
Reviewer focus (not covered by CI): please manually exercise the OTP auth handshake and the live WS/PTY paths via
pnpm -C packages/core run play— code entry +?devframe_otp=magic link, reconnect, Revoke Access, non-TTY — and confirm the route-bound socket connects (and coexists with Vite HMR) plus the terminals/messages/inspect panels render.BREAKING CHANGE: removes the published
@vitejs/devtools-self-inspectpackage (use the built-in@devframes/plugin-inspect), requires devframe/@devframes/hub0.6.0-beta.3, and replaces the token auth flow with devframe's OTP / magic-link handshake.This PR was created with the help of an agent.