fix: restore embedded dock and rpc auth in web container

[webfansplz]

Be related to vitejs/devtools#603:

• The dock was hidden in StackBlitz because all iframes were treated as Hub panels. Only skip mounting when the parent has a Hub client context.
• Correct OTPs failed because WebContainer lost the RPC session context during async setup and argument validation. Enter the session scope immediately before calling the handler.

[vercel]

@webfansplz is attempting to deploy a commit to the NuxtLabs Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

👁️‍🗨️ Review this pull request with grouped, summarized diffs at:
👉 https://pulls.review/gh/devframes/devframe/441?from=github-actions[bot]

raw result

💭 analyzed by vercel-ai-gateway/anthropic/claude-sonnet-5
🕰️ 2026-10-13 04:01 UTC
🔗 head e390c54
🤖 automated by pulls.review

{
  "headSha": "e390c547cc94b8281ec4390471cb17dcb6c1043c",
  "result": {
    "overallSummary": "Two unrelated regressions caused by WebContainer are fixed: (1) the embedded dock was incorrectly hidden because any cross-origin iframe parent was assumed to be a Hub panel, and (2) RPC authentication failed because the session's AsyncLocalStorage context was lost across async setup/validation before the handler ran.",
    "groups": [
      {
        "key": "rpc-session-fix",
        "label": "RPC session auth fix",
        "summary": "Fixes OTP/auth failures in WebContainer by entering the AsyncLocalStorage session scope immediately before invoking the resolved handler, since the context was lost across awaits during async setup and argument validation.",
        "category": "api",
        "filePaths": [
          "packages/devframe/src/node/rpc-core.ts",
          "packages/devframe/src/node/__tests__/rpc-core.test.ts"
        ],
        "critical": true,
        "fileNotes": [
          {
            "path": "packages/devframe/src/node/rpc-core.ts",
            "text": "Resolver now loads the handler definition lazily and wraps the inner handler so the session scope (`asyncStorage.run`) is entered right before the handler executes, after auth checks and setup/validation complete."
          }
        ]
      },
      {
        "key": "embedded-dock-fix",
        "label": "Embedded dock detection fix",
        "summary": "Replaces the naive `window.parent !== window` check with `isInsideHub`, which only skips mounting the embedded dock when the parent actually has a Hub client context, fixing the dock being hidden inside StackBlitz iframes.",
        "category": "ui",
        "filePaths": [
          "packages/hub-ui/src/client/embedded/index.ts",
          "packages/hub-ui/src/client/embedded/is-inside-hub.ts",
          "packages/hub-ui/src/client/embedded/is-inside-hub.test.ts"
        ],
        "fileNotes": [
          {
            "path": "packages/hub-ui/src/client/embedded/is-inside-hub.ts",
            "text": "Safely handles cross-origin parents (e.g. StackBlitz) where accessing the parent window throws a SecurityError, treating them as not inside Hub."
          }
        ]
      }
    ],
    "schemaVersion": 1,
    "source": "llm",
    "generatedAt": "2026-10-13T04:01:20.825Z",
    "model": "vercel-ai-gateway/anthropic/claude-sonnet-5",
    "locale": "en"
  }
}

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes address both reported regressions with focused implementation and comprehensive regression tests.

Review effort: Balanced
Findings: None

What changed in this PR

Restores the embedded dock and RPC authentication behavior in WebContainer environments.

Changes:

• Detects actual Hub parent contexts instead of suppressing all iframe docks.
• Restores RPC session scope immediately before handler execution.
• Adds regression coverage for iframe detection, validation, authorization, setup retries, and concurrent sessions.

File	Description
packages/​hub-ui/​src/​client/​embedded/​is-inside-hub.ts	Detects Hub panel parents safely.
packages/​hub-ui/​src/​client/​embedded/​is-inside-hub.test.ts	Tests top-level, same-origin, cross-origin, and Hub contexts.
packages/​hub-ui/​src/​client/​embedded/​index.ts	Uses Hub-aware dock suppression.
packages/​devframe/​src/​node/​rpc-core.ts	Restores session scope around RPC handlers.
packages/​devframe/​src/​node/​__tests__/​rpc-core.test.ts	Covers RPC session isolation and failure paths.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The fixes are focused, preserve authorization ordering, and include targeted regression coverage.

0 open findings

🧠 Review effort: Balanced