fix: restore embedded dock and rpc auth in web container - #441

{
  "headSha": "e390c547cc94b8281ec4390471cb17dcb6c1043c",
  "result": {
    "overallSummary": "Two unrelated regressions caused by WebContainer are fixed: (1) the embedded dock was incorrectly hidden because any cross-origin iframe parent was assumed to be a Hub panel, and (2) RPC authentication failed because the session's AsyncLocalStorage context was lost across async setup/validation before the handler ran.",
    "groups": [
      {
        "key": "rpc-session-fix",
        "label": "RPC session auth fix",
        "summary": "Fixes OTP/auth failures in WebContainer by entering the AsyncLocalStorage session scope immediately before invoking the resolved handler, since the context was lost across awaits during async setup and argument validation.",
        "category": "api",
        "filePaths": [
          "packages/devframe/src/node/rpc-core.ts",
          "packages/devframe/src/node/__tests__/rpc-core.test.ts"
        ],
        "critical": true,
        "fileNotes": [
          {
            "path": "packages/devframe/src/node/rpc-core.ts",
            "text": "Resolver now loads the handler definition lazily and wraps the inner handler so the session scope (`asyncStorage.run`) is entered right before the handler executes, after auth checks and setup/validation complete."
          }
        ]
      },
      {
        "key": "embedded-dock-fix",
        "label": "Embedded dock detection fix",
        "summary": "Replaces the naive `window.parent !== window` check with `isInsideHub`, which only skips mounting the embedded dock when the parent actually has a Hub client context, fixing the dock being hidden inside StackBlitz iframes.",
        "category": "ui",
        "filePaths": [
          "packages/hub-ui/src/client/embedded/index.ts",
          "packages/hub-ui/src/client/embedded/is-inside-hub.ts",
          "packages/hub-ui/src/client/embedded/is-inside-hub.test.ts"
        ],
        "fileNotes": [
          {
            "path": "packages/hub-ui/src/client/embedded/is-inside-hub.ts",
            "text": "Safely handles cross-origin parents (e.g. StackBlitz) where accessing the parent window throws a SecurityError, treating them as not inside Hub."
          }
        ]
      }
    ],
    "schemaVersion": 1,
    "source": "llm",
    "generatedAt": "2026-10-13T04:01:20.825Z",
    "model": "vercel-ai-gateway/anthropic/claude-sonnet-5",
    "locale": "en"
  }
}