@leadconnector/vite-plugin-dev-server-bridge

Vite development-server bridge for preview diagnostics, restart notifications, and browser error collection.

Usage

import { devServerBridgePlugin } from "@leadconnector/vite-plugin-dev-server-bridge";

export default {
  plugins: [devServerBridgePlugin()],
};

The plugin only applies to vite serve. Control request bodies time out after 2000ms by default and can be configured with controlBodyReadTimeoutMs.

Control routes

• POST /__vibe/restart-announce
• GET /_sandbox/preview/viewers
• POST /_sandbox/preview/execute

Restart and preview execution are delivered over Vite custom HMR events. The injected restart client forwards { type: "VIBE_DEV_SERVER_RESTARTING" } to the parent frame.

Preview execution is limited to 50 KiB of UTF-8 code. Its timeout defaults to 1500ms and is clamped to 5000ms. Viewer results are normalized into bounded JSON-wire-safe payloads before they are sent over HMR.

Error collector

devServerBridgePlugin() enables browser error collection by default. The collector route, POST /__vibe/error-collector, captures runtime errors, failed resources, and unhandled promise rejections.

Reports are written as JSONL to /tmp/vibe/runtime-errors.log. The active log and one deterministic rotation are each bounded to 1 MiB. Newly created output directories and all log files use modes 0700 and 0600; existing custom parent directories are never chmodded. The plugin-owned default /tmp/vibe directory is owner-checked before its mode is tightened. Parent directories stay anchored by open descriptors. On Linux, traversal starts at an open root descriptor and opens every component through /proc/self/fd; the complete descriptor chain remains open for the server generation. Reset validates an existing entry, unlinks it through the anchored parent, and creates a new exclusive 0600 file. On Darwin, where Node does not expose openat, every existing path component must be a real directory owned by the current user (or a non-writable root-owned system directory); only known root-owned sticky system temp directories may be writable. Darwin then keeps the validated parent and file descriptors for the generation and does not reopen files for mutation. Every log mutation rechecks that its descriptor is a regular file owned by the current uid with exactly one hard link and exact mode 0600. When a successor server generation uses the same output, it retires the prior generation before its serialized reset; already accepted writes finish first, while later requests to the retired middleware are rejected. Symlink ancestors, pre-planted hard links, replaced parents, and non-regular output targets are rejected.

The Darwin fallback intentionally does not claim protection from a malicious same-uid process racing path operations after descriptors are established; its boundary blocks pre-planted links, unsafe ancestors, and other-user storage. Retained logs are normalized from bounded tail reads, while reset truncates directly without reading old content. Oversized reports become complete truncated-report JSONL records rather than partial byte slices.

devServerBridgePlugin({
  errorCollector: {
    endpoint: "/__vibe/error-collector",
    outputFile: "/tmp/vibe/runtime-errors.log",
    maxBodyBytes: 64 * 1024,
    bodyReadTimeoutMs: 2000,
    maxOutputBytes: 1024 * 1024,
    resetOnStart: true,
  },
});

Set errorCollector: false to disable collection. The collector can also be used independently:

import { errorCollectorPlugin } from "@leadconnector/vite-plugin-dev-server-bridge";

export default {
  plugins: [errorCollectorPlugin()],
};