@doany-ai/vite-plugin

Doany's Vite integration for website-builder apps running in sandboxed iframes. It provides JSX source instrumentation, HMR and navigation notifications, error forwarding, visual selection/editing, a loopback build status endpoint, and analytics injection. It is backend-SDK independent.

This is an early parity fork for Doany-owned website-builder scaffolds.

Install

After publication:

npm install @doany-ai/vite-plugin

For a local packed build, use the .tgz emitted by npm pack.

Usage

import doany from "@doany-ai/vite-plugin";

export default {
  plugins: [
    doany({
      hmrNotifier: true,
      navigationNotifier: true,
      analyticsTracker: true,
      visualEditAgent: true,
    }),
  ],
};

Options

| Option | Default | Purpose | | --- | --- | --- | | hmrNotifier | false | Forward HMR lifecycle events to the embedding editor. | | navigationNotifier | false | Notify the editor when the iframe route changes. | | visualEditAgent | false | Enable DOM-to-source selection and inline visual editing. | | analyticsTracker | false | Inject the production page-view tracker. | | sandbox | auto | Force sandbox behavior on or off. Auto-detection checks Doany, Daytona, then legacy Modal markers. |

Environment

| Variable | Purpose | | --- | --- | | VITE_DOANY_APP_ID | Identify the app for production analytics. | | VITE_DOANY_APP_BASE_URL | Proxy /api during local frontend development. | | DOANY_HMR_HOST | Override the sandbox HMR WebSocket host. | | DOANY_BUILD_STATUS_ENABLED | Enable the loopback-only build-status endpoint. | | DOANY_SANDBOX_ID or DAYTONA_SANDBOX_ID | Detect sandbox execution. |

Security status

The current iframe protocol uses wildcard postMessage targets, does not consistently validate inbound parent origins, opens sandbox iframe/dev-host headers, and injects the Tailwind CDN during visual-edit development. Treat it as an internal parity build, not a production-hardened trust boundary.

The next hardening milestone is a controller-provided parent-origin allowlist or capability handshake. It must be introduced with editor-side protocol tests so security changes do not silently break visual edit or HMR.

Development

npm install
npm test
npm pack

npm test rebuilds both the Vite plugin and the browser bridge before running the public-contract tests.

License

MIT.