[Aejkatappaja]

What is it?

• Bug

Description

DevTools already had a loopback guard for the build-analysis rebuild, but it never worked. birpc awaits before it calls the RPC function, so by then the request context set around the websocket handler was already cleared and every caller looked remote. From localhost the "Build Report" button never showed up.

The package install and update RPCs had no guard at all. If the dev server was reachable from another machine, for example a phone or laptop on the same network with vite --host, that machine could add or update dependencies in your project from the Packages tab.

This PR has three commits:

1. test(devtools): run test files vitest was skipping. The root vitest config only picks up *.unit.* and *.spec.*, so 8 devtools *.test.ts files never ran. They are renamed (31 more tests running, all green), the duplicate ssrPerfMiddleware suite is merged, and __snapshots__ is excluded from the include so the renamed .snap file isn't treated as a test.
2. fix(devtools): keep the RPC caller context during async dispatch. The context is captured in the birpc resolver, which runs synchronously when the message arrives, and set again around the call. getBuildAnalysisStatus now reads it before its first await. The new tests go through the real RPC dispatch with a fake Vite websocket instead of mocking the context, since the mock is what hid this.
3. fix(devtools): restrict package install and update to local clients. Same loopback check as build analysis, moved to plugin/src/rpc/security.ts so both features share it. QWIK_DEVTOOLS_ALLOW_REMOTE_PACKAGE_MANAGEMENT=1 opts back in for setups like Docker where the browser is never on loopback.

A client behind a reverse proxy on localhost still counts as local. That was already the case for build analysis and I left it alone.

Demo

Recorded against a Router SSR app with qwikDevtools(). First on localhost, where rebuild and install both work, then the same page opened through the LAN IP, where both are refused with the opt-in hint.

devtools-rpc-guard-demo.mp4

Checklist

• My code follows the developer guidelines of this project
• I performed a self-review of my own code
• I added a changeset with pnpm change
• I added new tests to cover the fix / functionality

[changeset-bot]

🦋 Changeset detected

Latest commit: f4195a6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
@qwik.dev/devtools	Patch
create-qwik	Patch
eslint-plugin-qwik	Patch
@qwik.dev/mcp	Patch
@qwik.dev/react	Patch
@qwik.dev/router	Patch
@qwik.dev/utils	Patch
@qwik.dev/core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@qwik.dev/core

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/core@9123

@qwik.dev/router

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/router@9123

@qwik.dev/utils

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/utils@9123

eslint-plugin-qwik

npm i https://pkg.pr.new/QwikDev/qwik/eslint-plugin-qwik@9123

create-qwik

npm i https://pkg.pr.new/QwikDev/qwik/create-qwik@9123

@qwik.dev/optimizer

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/optimizer@9123

@qwik.dev/devtools

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/devtools@9123

@qwik.dev/mcp

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/mcp@9123

commit: f4195a6

[maiieul]