feat(vite,next): forward allowedOrigins through bridge and Next handler

[antfubot]

What

@devframes/vite's devframeViteBridge/devframeVite and @devframes/next's createDevframeNextHandler forwarded no allowedOrigins to initDevframe, so their RPC WebSocket inherited devframe's loopback-only origin check with no way to widen it.

Whenever the dev server is reached at a non-loopback origin — vite --host, Docker/WSL/dev-containers, Codespaces, or a tunnel — the WS upgrade is rejected with HTTP 403, and a connectDevframe() client sits on status: 'connecting' forever with no error surfaced.

Change

• Add allowedOrigins?: readonly string[] | WsOriginRegistry | false to DevframeViteBridgeOptions (inherited by DevframeViteOptions) and forward it to initDevframe.
• Add the matching allowedOrigins to CreateDevframeNextHandlerOptions, forwarded to its side-car initDevframe.
• Document the new option in both framework reference pages.
• Cover the Vite bridge behaviour: a non-loopback origin is rejected by default and accepted once forwarded through allowedOrigins.

The auth gate remains the trust boundary; false disables the origin check for a same-origin dev server that gates another way.

Closes #348

---

This PR was created with the help of an agent.

[coldtea-pr-lens]

◈ PR Lens

🟢 +0 new · 🟠 ~2 changed · 🔴 -0 removed · 2 flows · 6 files · commit d5dbddc

Architecture

2 components touched across 2 lanes.

Open full size

Data flow

Vite bridge origin initialization · Next.js handler origin initialization

Open full size

The other flows — 1 sequence

Next.js handler origin initialization

Drill down

Framework Kits ＆ Hosts — 2 components

🟡 CHANGED Vite Framework Kit

Vite bridge adapter that configures Devframe middleware, now accepting and forwarding allowedOrigins to initDevframe for non-loopback WebSocket connections.

• packages/vite/src/single.ts:120-198
• packages/vite/test/single.test.ts:244-294
• packages/vite/package.json:61-71
• docs/content/3.frameworks/1.vite.md:43-47

🟡 CHANGED Next.js Framework Kit

Next.js route handler adapter that now accepts and forwards allowedOrigins to initDevframe for remote host environments.

• packages/next/src/handler.ts:27-152
• docs/content/3.frameworks/3.next.md:49-53

View

• Architecture lens
• Data flow lens
• Expand every detail
• Show unchanged neighbours

Tip

The diagrams follow your GitHub theme, so dark mode gets the dark render and light mode the light one, and the moving dots show this pull request's data in motion.

🪧 More tips

• Run PR Lens on your own machine: npx skills add coldteadotai/pr-lens installs the agent skill. Then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Draw a diff before it is even a pull request: npx @coldtea/pr-lens-cli analyze --base origin/main reads the diff with your own model key, and npx @coldtea/pr-lens-cli render .pr-lens/graph.json draws the same lenses on your machine.
• The boxes under View are live. Tick Architecture lens or Data flow lens to choose which diagrams appear, or Expand every detail to open every drill-down at once. The comment redraws in place a few seconds later.
• Show unchanged neighbours lists the components this change did not touch alongside the ones it did, so the drill-down shows what the changed code sits next to.
• GitHub will not let you zoom an image in a comment. The link under each diagram opens it full size on a page of its own, where you can.
• The CLI's render picks up .github/pr-lens.yml automatically and applies your corrections (renames, exclusions, lane pins) at draw time.
• Would you rather run it from CI on a key of your own? Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and a model key in your repository secrets, say GEMINI_API_KEY. The Action asks Gemini by default, or OpenAI and any endpoint speaking /chat/completions through its provider input.
• PR Lens is free for open source. A star on the repository is what keeps it going.
• Push a new commit and the whole comment re-renders for the new head. An older run never overwrites a newer one, so a slow render cannot put a stale diagram back.

---

◈ Rendered by PR Lens · crafted with ❤️ by the Coldtea team · Something drawn wrong?

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
devframe	Ready	Preview	Sep 3, 2026 1:17pm UTC