From 08d406a5933ebf98391f4b3a2685ef39fa834e4d Mon Sep 17 00:00:00 2001
From: Anthony Fu <github@antfu.me>
Date: Thu, 23 Jul 2026 15:06:47 +0900
Subject: [PATCH] fix(kit): disable devframe auth prompt fallback

---
 packages/kit/src/client/connection.test.ts | 33 ++++++++++++++++++++++
 packages/kit/src/client/connection.ts      |  8 +++++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 packages/kit/src/client/connection.test.ts

diff --git a/packages/kit/src/client/connection.test.ts b/packages/kit/src/client/connection.test.ts
new file mode 100644
index 000000000..78d3ada7a
--- /dev/null
+++ b/packages/kit/src/client/connection.test.ts
@@ -0,0 +1,33 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDevToolsRpcClient } from './connection'
+
+const mocks = vi.hoisted(() => ({
+  getDevframeRpcClient: vi.fn(async () => ({})),
+}))
+
+vi.mock('@devframes/hub/client', () => ({
+  getDevframeRpcClient: mocks.getDevframeRpcClient,
+}))
+
+describe('getDevToolsRpcClient', () => {
+  beforeEach(() => {
+    mocks.getDevframeRpcClient.mockClear()
+  })
+
+  it('disables devframe simple auth in favor of the Vite DevTools auth UI', async () => {
+    await getDevToolsRpcClient({ baseURL: '/__devtools/' })
+
+    expect(mocks.getDevframeRpcClient).toHaveBeenCalledWith({
+      baseURL: '/__devtools/',
+      simpleAuth: false,
+    })
+  })
+
+  it('does not allow callers to enable the browser-prompt fallback', async () => {
+    await getDevToolsRpcClient({ simpleAuth: true })
+
+    expect(mocks.getDevframeRpcClient).toHaveBeenCalledWith({
+      simpleAuth: false,
+    })
+  })
+})
diff --git a/packages/kit/src/client/connection.ts b/packages/kit/src/client/connection.ts
index e2657760c..85de75012 100644
--- a/packages/kit/src/client/connection.ts
+++ b/packages/kit/src/client/connection.ts
@@ -12,9 +12,15 @@ import { getDevframeRpcClient } from '@devframes/hub/client'
  * `__connection.json` without dialing its own base's (wrong) endpoint — is
  * handled natively by devframe's client via `ConnectionMeta.baseUrl` since
  * devframe 0.7.2 (devframes/devframe#98), so no extra rewriting is needed here.
+ *
+ * Vite DevTools provides its own interactive authorization view, so disable
+ * devframe's native browser-prompt fallback for every kit-managed connection.
  */
 export function getDevToolsRpcClient(
   options: DevframeRpcClientOptions = {},
 ): Promise<DevframeRpcClient> {
-  return getDevframeRpcClient(options)
+  return getDevframeRpcClient({
+    ...options,
+    simpleAuth: false,
+  })
 }