chore: update

Author: webfansplz

docs/guide/security.md

@@ -105,7 +105,7 @@ Higher-level integrations can drive their own authentication UI instead: disable
 WebSocket handshakes from browser extensions and other external viewers carry the viewer's own `Origin` header. A host can authorize that origin through a live registry:
 
 ```ts
-import { createWsOriginRegistry } from 'devframe/rpc/transports/ws-server'
+import { attachWsRpcTransport, createWsOriginRegistry } from 'devframe/rpc/transports/ws-server'
 
 const viewerOrigins = createWsOriginRegistry({
   validateOrigin: origin => origin.startsWith('chrome-extension://')

packages/hub/src/client/remote.test.ts

@@ -74,8 +74,9 @@ describe('remote connection URLs', () => {
   })
 
   it('preserves the original encoding of hash-route parameters', () => {
-    expect(stripRemoteConnectionFromUrl(
-      'https://viewer.example/#/inspect?tab=a%20b&devframe-remote-connection=descriptor',
-    )).toBe('https://viewer.example/#/inspect?tab=a%20b')
+    const baseUrl = 'https://viewer.example/#/inspect?tab=a%20b&filter=a+b'
+    const url = buildRemoteDevframeUrl(baseUrl, connection)
+    expect(url).toContain('#/inspect?tab=a%20b&filter=a+b&devframe-remote-connection=')
+    expect(stripRemoteConnectionFromUrl(url)).toBe(baseUrl)
   })
 })

packages/hub/src/remote-url.ts

@@ -9,6 +9,16 @@ function base64UrlEncode(value: string): string {
   return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
 }
 
+function setRemoteConnectionParam(value: string, param: string): string {
+  const parts = value ? value.split('&') : []
+  const existingIdx = parts.findIndex(part => part.split('=')[0] === REMOTE_CONNECTION_KEY)
+  if (existingIdx >= 0)
+    parts[existingIdx] = param
+  else
+    parts.push(param)
+  return parts.join('&')
+}
+
 /** Encode a remote connection descriptor into an external viewer URL. */
 export function buildRemoteConnectionUrl(
   baseUrl: string,
@@ -31,18 +41,11 @@ export function buildRemoteConnectionUrl(
     const routeQueryIdx = rawHash.indexOf('?')
     if (routeQueryIdx !== -1) {
       const route = rawHash.slice(0, routeQueryIdx + 1)
-      const params = new URLSearchParams(rawHash.slice(routeQueryIdx + 1))
-      params.set(REMOTE_CONNECTION_KEY, encoded)
-      return `${beforeHash}#${route}${params}`
+      const query = setRemoteConnectionParam(rawHash.slice(routeQueryIdx + 1), param)
+      return `${beforeHash}#${route}${query}`
     }
 
-    const parts = rawHash.split('&')
-    const existingIdx = parts.findIndex(part => part.split('=')[0] === REMOTE_CONNECTION_KEY)
-    if (existingIdx >= 0)
-      parts[existingIdx] = param
-    else
-      parts.push(param)
-    return `${beforeHash}#${parts.join('&')}`
+    return `${beforeHash}#${setRemoteConnectionParam(rawHash, param)}`
   }
 
   const hashIdx = baseUrl.indexOf('#')