Description

Adds a second path for building custom DevTools UIs: plugin authors can point an iframe dock at a hosted website instead of bundling a SPA dist with their plugin. The core allocates a session-only, origin-locked auth token per dock registration and injects a connection descriptor (WS URL + token) into the iframe URL — as a fragment by default, or optionally as a query param. The hosted page connects back with the new one-liner connectRemoteDevTools() from @vitejs/devtools-kit/client, which reuses the existing DevToolsRpcClient.

The new RemoteConnectionInfo type extends ConnectionMeta, so a parsed descriptor drops straight into getDevToolsRpcClient({ connectionMeta }) with no shape translation. Tokens live in memory only, are bound to the dock URL's origin by default (opt-out via originLock: false), and are revoked on force re-registration. The WS handshake check in ws.ts runs before the persisted trust store so revoked remote tokens can't accidentally match stale entries. Full docs live at docs/kit/remote-client.md with a mermaid flow, the transport/origin-lock tradeoffs, and the trust model.

Linked Issues

Additional context

• 20 new tests cover parser round-trips (fragment/query/precedence/error paths), URL enrichment, when-clause defaulting to hide in build mode, force-register revocation, and origin-locked trust logic.
• Address bar in ViewIframe.vue strips the descriptor so the auth token isn't visible or copyable.
• Worth a focused review: the wsEndpoint timing dance in ws.ts + host-docks.ts — register() runs before the WS port is allocated, so enrichment happens lazily in values() and createWsServer re-emits dock:entry:updated for remote docks once the endpoint is known.

🤖 Generated with Claude Code