@reticlehq/init 3.8.2 → 3.10.0

package/dist/no-package-json.js

@@ -7,11 +7,12 @@
  * Django, several pages) and stops.
  */
 import { dirname, join } from 'node:path';
+import { ReticleTool } from '@reticlehq/core';
 import { PackageManager, Framework } from './detect/detect.js';
 import { PACKAGE_JSON } from './detect/workspace-apps.js';
 import { detectDjangoProject, detectStreamlitProject, djangoSetupMessage, NoPackageJsonCase, noPackageJsonAnswer, streamlitSetupMessage, } from './detect/non-js-project.js';
 import { InitFailure } from './diagnose/init-failure.js';
-import { HTML_INDEX_PATH, STATIC_TOKEN_MODULE, staticTokenFiles, withStaticSnippet, } from './patch/static-page.js';
+import { HTML_INDEX_PATH, hasStaticSnippet, STATIC_TOKEN_MODULE, staticTokenFiles, withStaticSnippet, } from './patch/static-page.js';
 import { connectArg, reticleConfigContent, staticPageSnippetWithLocalToken, } from './patch/snippets.js';
 import { djangoMiddlewareSnippet, pythonConnectArg, streamlitPageSnippet, } from './patch/python-snippets.js';
 import { RETICLE_CONFIG_FILE } from './detect/existing-config.js';
@@ -25,6 +26,14 @@ const SNIPPET_WRITTEN = `Wrote the dev-only connect snippet into ${HTML_INDEX_PA
 const TOKEN_MODULE_WRITTEN = `This machine’s pairing token is in ${STATIC_TOKEN_MODULE}, which is gitignored. Serve it beside ` +
     'the page: the snippet imports it. Keep it out of anything you publish.';
 const SNIPPET_ALREADY = `${HTML_INDEX_PATH} already loads the Reticle SDK — nothing to change.`;
+/**
+ * Said when Reticle's static server serves the page, so the file stays as the user wrote it (#1544).
+ * The lease route is named first because it changes no file at all.
+ */
+const SNIPPET_SERVED = `${HTML_INDEX_PATH} is unchanged. Reticle's static server adds the dev-only connect snippet to ` +
+    `the page that it serves. This machine's pairing token is in ${STATIC_TOKEN_MODULE}, which is ` +
+    'gitignored. To serve the folder another way, change no file: serve it, then call ' +
+    `\`${ReticleTool.LEASE} { action: "acquire", url }\`.`;
 /** How far up `init` looks for the app it was run inside. The same bound as the workspace walk. */
 const MAX_ANCESTOR_DEPTH = 8;
 const HOME_FOLDER = 'This is your home folder, not a project. Go to the folder of your app (the one with its ' +
@@ -41,14 +50,17 @@ const insideApp = (dir) => `No package.json here, but this folder is inside the
 function namedDirectory(io) {
     const home = io.homeDir();
     let dir = io.cwd();
-    if (dir === home)
+    if (dir === home) {
         return HOME_FOLDER;
+    }
     for (let depth = 0; depth < MAX_ANCESTOR_DEPTH; depth++) {
         const parent = dirname(dir);
-        if (parent === dir || parent === home)
+        if (parent === dir || parent === home) {
             return undefined;
-        if (null !== io.readFile(join(parent, PACKAGE_JSON)))
+        }
+        if (null !== io.readFile(join(parent, PACKAGE_JSON))) {
             return insideApp(parent);
+        }
         dir = parent;
     }
     return undefined;
@@ -76,24 +88,46 @@ function printedSnippet(streamlit, django, connect) {
     }
     return staticPageSnippetWithLocalToken(connect);
 }
+/** The line `wireStaticPage` prints, in the order of its cases. */
+function staticPageLine(written, moved, port, served) {
+    if (null !== written) {
+        return SNIPPET_WRITTEN;
+    }
+    if (null !== moved && port !== undefined) {
+        return `Updated ${HTML_INDEX_PATH}: ${portMoveDetail(moved.from, port)}.`;
+    }
+    return served ? SNIPPET_SERVED : SNIPPET_ALREADY;
+}
+/** What to say for this kind of project before its snippet. */
+function setupMessage(streamlit, django, otherwise) {
+    if (streamlit) {
+        return streamlitSetupMessage();
+    }
+    if (django) {
+        return djangoSetupMessage();
+    }
+    return otherwise;
+}
 function wireStaticPage(options, io, connect) {
     writeTokenModule(io);
     const html = io.readFile(HTML_INDEX_PATH) ?? '';
+    // Setup serves the page with Reticle's static server when the user names no url of their own.
+    // That server adds the snippet to the page it serves, so the file the user hands over is not
+    // edited (#1544). With `--url` or `--files-only`, nothing of ours serves it, so the file gets it.
+    const served = true === options.continuesToRuntime && undefined === options.url;
     // A page that already connects still has its port compared: the snippet bakes the daemon URL, and
     // a re-run with a new `--port` that answered "already" left the page dialling the old daemon.
-    const written = withStaticSnippet(html, connect);
+    const written = served ? null : withStaticSnippet(html, connect);
     const moved = null === written ? retargetPort(html, options.port) : null;
     const patched = written ?? moved?.code ?? null;
-    if (null !== patched)
+    if (null !== patched) {
         io.writeFile(HTML_INDEX_PATH, patched);
-    io.print(null !== written
-        ? SNIPPET_WRITTEN
-        : null !== moved && options.port !== undefined
-            ? `Updated ${HTML_INDEX_PATH}: ${portMoveDetail(moved.from, options.port)}.`
-            : SNIPPET_ALREADY);
+    }
+    io.print(staticPageLine(written, moved, options.port, served && !hasStaticSnippet(html)));
     const outcome = { ok: true, stack: Framework.HTML };
-    if (true !== options.deferOutcome)
+    if (true !== options.deferOutcome) {
         io.host.reportOutcome(outcome);
+    }
     return {
         ok: true,
         applied: null === patched ? 0 : 1,
@@ -118,8 +152,9 @@ export function initWithoutPackageJson(options, io) {
     const answer = noPackageJsonAnswer(existsHere, io.rootFiles());
     if (!streamlit && !django && answer.kind === NoPackageJsonCase.WRONG_DIRECTORY) {
         io.print(namedDirectory(io) ?? answer.message);
-        if (!options.dryRun)
+        if (!options.dryRun) {
             io.host.reportOutcome({ ok: false, reason: InitFailure.NO_PACKAGE_JSON });
+        }
         return { ok: false, applied: 0, manual: 0 };
     }
     // Scope the project on disk before anything else, so the daemon can serve this page.
@@ -146,8 +181,9 @@ export function initWithoutPackageJson(options, io) {
             io.writeFile(RETICLE_CONFIG_FILE, moved.code);
             io.print(`Updated ${RETICLE_CONFIG_FILE}: ${portMoveDetail(moved.from, options.port)}.`);
         }
-        if (io.exists(RETICLE_CONFIG_FILE))
+        if (io.exists(RETICLE_CONFIG_FILE)) {
             return;
+        }
         io.writeFile(RETICLE_CONFIG_FILE, reticleConfigContent(Framework.HTML, options.port, nonJsProjectId, io.host.installSource()));
         rememberProjectOnDisk(io, nonJsProjectId, io.cwd(), Date.now());
         io.print(`Wrote ${RETICLE_CONFIG_FILE} (project "${nonJsProjectId}").`);
@@ -170,7 +206,7 @@ export function initWithoutPackageJson(options, io) {
     // a path problem and goes looking for a directory that cannot exist — reported from a
     // Streamlit app, where the search continued into hunting for a browser bundle to inject by
     // hand before the real answer surfaced.
-    streamlit ? streamlitSetupMessage() : django ? djangoSetupMessage() : answer.message);
+    setupMessage(streamlit, django, answer.message));
     writeConfig();
     // The message says "add the snippet below". Print the snippet, or the message is the same broken
     // promise in the other direction.
@@ -182,7 +218,8 @@ export function initWithoutPackageJson(options, io) {
     }
     // The onboarding funnel had NO instrumentation, so a setup that died here was indistinguishable
     // from someone who never ran the command — the two failure modes with the most different fixes.
-    if (!options.dryRun)
+    if (!options.dryRun) {
         io.host.reportOutcome({ ok: false, reason: InitFailure.NO_PACKAGE_JSON });
+    }
     return { ok: false, applied: 0, manual: 0 };
 }

package/dist/patch/angular.js

@@ -143,6 +143,10 @@ export default {
   '${ANGULAR_TOKEN_PATH}': {
     target: 'http://127.0.0.1:9',
     bypass(req, res) {
+      // webpack-dev-server calls this for every request. Answer only this path.
+      if ((req.url ?? '').split('?')[0] !== '${ANGULAR_TOKEN_PATH}') {
+        return undefined;
+      }
       const site = req.headers['sec-fetch-site'];
       const allowed =
         LOOPBACK.has(req.socket.remoteAddress ?? '') && (site === undefined || site === 'same-origin');

package/dist/patch/brace-scan.d.ts

@@ -3,7 +3,8 @@
  *
  * A count, not a parser. A `{` or `}` inside a string literal would fool it. That only ever
  * shortens or lengthens the window we search, so the worst case is a MANUAL bail or a missed
- * merge — never a corrupted file written as APPLY.
+ * merge — never a corrupted file written as APPLY. A caller that must not be fooled runs the count
+ * on `maskStringsAndComments(source)`, which keeps every index where it was.
  */
 /**
  * The text from just inside an opening brace to its match.
@@ -22,3 +23,16 @@ export declare function matchingBraceEnd(source: string, at: number): number | u
  * `undefined` when the parens never balance.
  */
 export declare function matchingParenEnd(source: string, openAt: number): number | undefined;
+/** How many `{` are open at `index`, counted from the start of `source`. */
+export declare function braceDepth(source: string, index: number): number;
+/**
+ * The source with every string literal, regex literal and comment blanked to spaces, newlines kept,
+ * so each index still points at the same place in the real source. Null when the scan does not end
+ * cleanly: a string, comment or regex that never closes, or braces that do not balance.
+ *
+ * The counts below are fooled by a `{` inside a string, and a key search by a `plugins: [` in a
+ * comment. A patcher that runs them on this masked copy is not, and edits the real source at the
+ * same indices. The Vite patcher used to add a second `plugins` key whose list Vite never reads
+ * (#2134). A source this scan cannot read is a manual step for the caller, never a guess.
+ */
+export declare function maskStringsAndComments(source: string): string | null;

package/dist/patch/brace-scan.js

@@ -3,7 +3,8 @@
  *
  * A count, not a parser. A `{` or `}` inside a string literal would fool it. That only ever
  * shortens or lengthens the window we search, so the worst case is a MANUAL bail or a missed
- * merge — never a corrupted file written as APPLY.
+ * merge — never a corrupted file written as APPLY. A caller that must not be fooled runs the count
+ * on `maskStringsAndComments(source)`, which keeps every index where it was.
  */
 /**
  * The text from just inside an opening brace to its match.
@@ -31,16 +32,141 @@ export function matchingParenEnd(source, openAt) {
         return undefined;
     return matchingCloser(source, openAt + 1, '(', ')');
 }
+/** What `c` does to the open count: +1 for the opener, -1 for the closer, 0 for anything else. */
+function depthStep(c, open, close) {
+    if (c === open) {
+        return 1;
+    }
+    return c === close ? -1 : 0;
+}
 function matchingCloser(source, innerStart, open, close) {
     let depth = 1;
     for (let i = innerStart; i < source.length; i++) {
-        if (source[i] === open)
-            depth += 1;
-        else if (source[i] === close) {
-            depth -= 1;
-            if (0 === depth)
-                return i;
+        depth += depthStep(source[i], open, close);
+        if (0 === depth) {
+            return i;
         }
     }
     return undefined;
 }
+/** How many `{` are open at `index`, counted from the start of `source`. */
+export function braceDepth(source, index) {
+    let depth = 0;
+    for (let i = 0; i < index; i += 1) {
+        depth += depthStep(source[i], '{', '}');
+    }
+    return depth;
+}
+/**
+ * The source with every string literal, regex literal and comment blanked to spaces, newlines kept,
+ * so each index still points at the same place in the real source. Null when the scan does not end
+ * cleanly: a string, comment or regex that never closes, or braces that do not balance.
+ *
+ * The counts below are fooled by a `{` inside a string, and a key search by a `plugins: [` in a
+ * comment. A patcher that runs them on this masked copy is not, and edits the real source at the
+ * same indices. The Vite patcher used to add a second `plugins` key whose list Vite never reads
+ * (#2134). A source this scan cannot read is a manual step for the caller, never a guess.
+ */
+export function maskStringsAndComments(source) {
+    const out = source.split('');
+    const blank = (from, to) => {
+        for (let k = from; k < to && k < out.length; k += 1) {
+            if ('\n' !== out[k]) {
+                out[k] = ' ';
+            }
+        }
+    };
+    /** The last character before `at` that is not whitespace, in the masked output so far. */
+    const previousToken = (at) => {
+        for (let k = at - 1; k >= 0; k -= 1) {
+            const c = out[k] ?? '';
+            if (!/\s/.test(c)) {
+                return c;
+            }
+        }
+        return '';
+    };
+    let i = 0;
+    while (i < source.length) {
+        const ch = source[i] ?? '';
+        const next = source[i + 1];
+        let stop;
+        if ('/' === ch && '/' === next) {
+            const end = source.indexOf('\n', i);
+            stop = -1 === end ? source.length : end;
+        }
+        else if ('/' === ch && '*' === next) {
+            const end = source.indexOf('*/', i + 2);
+            stop = -1 === end ? null : end + 2;
+        }
+        else if ("'" === ch || '"' === ch || '`' === ch) {
+            stop = closingQuote(source, i, ch);
+        }
+        else if ('/' === ch && REGEX_MAY_FOLLOW.includes(previousToken(i))) {
+            stop = closingRegex(source, i);
+        }
+        else {
+            i += 1;
+            continue;
+        }
+        if (null === stop) {
+            return null;
+        }
+        blank(i, stop);
+        i = stop;
+    }
+    const masked = out.join('');
+    return 0 === braceDepth(masked, masked.length) ? masked : null;
+}
+/** Where a `/` starts a regex literal rather than a division: after one of these, or at the start. */
+const REGEX_MAY_FOLLOW = ['', '(', ',', '=', ':', '[', '!', '&', '|', '?', '{', '}', ';'];
+/** The index just past the quote that closes the string opened at `at`, or null. */
+function closingQuote(source, at, quote) {
+    let j = at + 1;
+    while (j < source.length) {
+        const c = source[j];
+        if ('\\' === c) {
+            j += 2;
+        }
+        else if (quote === c) {
+            return j + 1;
+        }
+        else if ('\n' === c && '`' !== quote) {
+            return null;
+        }
+        else {
+            j += 1;
+        }
+    }
+    return null;
+}
+/** The index just past the flags of the regex literal opened at `at`, or null. */
+function closingRegex(source, at) {
+    let j = at + 1;
+    let inClass = false;
+    while (j < source.length) {
+        const c = source[j];
+        if ('\\' === c) {
+            j += 2;
+            continue;
+        }
+        if ('\n' === c) {
+            return null;
+        }
+        if ('[' === c) {
+            inClass = true;
+        }
+        else if (']' === c) {
+            inClass = false;
+        }
+        else if ('/' === c && !inClass) {
+            j += 1;
+            while (j < source.length && /[a-z]/i.test(source[j] ?? '')) {
+                j += 1;
+            }
+            return j;
+        }
+        j += 1;
+    }
+    return null;
+}

package/dist/patch/vite-config.d.ts

@@ -14,10 +14,21 @@ export declare const VitePatchKind: {
 };
 export type VitePatchKind = PatchKind;
 type VitePatch = SourcePatch;
+/**
+ * The package a new config imports `defineConfig` from.
+ *
+ * A Vite+ app imports it from `vite-plus`. Under pnpm it may not declare `vite` at all, so an
+ * import from `vite` would not resolve, and Vite+'s own lint rule refuses it.
+ */
+export declare const DefineConfigSource: {
+    readonly VITE: "vite";
+    readonly VITE_PLUS: "vite-plus";
+};
+export type DefineConfigSource = (typeof DefineConfigSource)[keyof typeof DefineConfigSource];
 /**
  * A whole config for a plain Vite app that has none: Vite's defaults plus the plugin. Written out
  * rather than patched from an empty one, because it is a file the person will open and read.
  */
-export declare function newViteConfig(port?: number, captureBodies?: boolean, inject?: boolean, sourceMapping?: boolean): string;
+export declare function newViteConfig(port?: number, captureBodies?: boolean, inject?: boolean, sourceMapping?: boolean, defineConfigFrom?: DefineConfigSource): string;
 export declare function patchViteConfig(source: string, port?: number, captureBodies?: boolean, inject?: boolean, sourceMapping?: boolean): VitePatch;
 export {};

package/dist/patch/vite-config.js

@@ -4,6 +4,7 @@
  * bails to a `manual` result so we never half-edit a build config (a broken config is worse than a
  * documented manual step).
  */
+import { braceDepth, maskStringsAndComments, matchingBraceEnd } from './brace-scan.js';
 import { PatchKind } from './patch-kind.js';
 export const VITE_IMPORT = "import { reticle } from '@reticlehq/vite-plugin';";
 const RETICLE_MARKER = '@reticlehq/vite-plugin';
@@ -42,14 +43,23 @@ function reticlePluginCall(opts) {
     ];
     return 0 === options.length ? 'reticle()' : `reticle({ ${options.join(', ')} })`;
 }
-/** Matches the start of a `plugins: [` array literal. */
-const PLUGINS_ARRAY = /plugins\s*:\s*\[/;
+/** A `plugins:` key, up to the start of its value. */
+const PLUGINS_KEY_COLON = /\bplugins\s*:\s*/g;
 /**
- * A `plugins` key in any shape: `plugins: <expr>`, or the shorthand `{ plugins }`. When this holds
- * and PLUGINS_ARRAY does not, the key is there but not as an array literal, so adding our own key
- * would make a second one. The later key wins, and one of the two lists is lost.
+ * The start of a plugin list we can extend, read at the start of the key's value: a plain array
+ * literal, or the same array returned by Vite+'s `lazyPlugins(() => [...])`.
+ *
+ * `vp migrate` and `vp create` wrap the app's plugins in `lazyPlugins`, so Vite+ can read the lint
+ * and format blocks without loading every plugin. The list inside is still the app's plugin list,
+ * and Vite loads it for `vp dev`. Without this form, init left a migrated Laravel app as a manual
+ * step (#2134).
+ */
+const PLUGIN_LIST_START = /^(?:lazyPlugins\s*\(\s*(?:async\s*)?\(\s*\)\s*=>\s*)?\[/;
+/**
+ * The shorthand `{ plugins }` key. When it holds, the key is there but not as an array literal, so
+ * adding our own key would make a second one. The later key wins, and one of the two lists is lost.
  */
-const PLUGINS_KEY = /\bplugins\s*[:,}]/;
+const PLUGINS_SHORTHAND = /\bplugins\s*[,}]/;
 /** Matches an ES import statement (used to place our import after the last one). */
 const IMPORT_LINE = /^import\s.+from\s+['"][^'"]+['"];?\s*$/gm;
 /**
@@ -62,9 +72,15 @@ const IMPORT_LINE = /^import\s.+from\s+['"][^'"]+['"];?\s*$/gm;
  * bails — the rule stays "only edit a shape we can see whole".
  */
 const CONFIG_OBJECT = /(export\s+default\s+(?:defineConfig\s*\(\s*)?)\{/;
+/** Where the default export starts, for a config that is not an object literal. */
+const EXPORT_DEFAULT = /\bexport\s+default\b/;
 /** Alias kept so existing call sites read in Vite terms; the vocabulary is shared (see patch-kind). */
 export const VitePatchKind = PatchKind;
+const UNREADABLE_REASON = 'init could not read this config safely (a string, comment or regex that it could not follow), ' +
+    'so it did not change it. Add `reticle()` to the `plugins` list of the exported config.';
 const NO_PLUGINS_REASON = "couldn't find a `plugins: [...]` array to extend";
+const AMBIGUOUS_PLUGINS_REASON = 'the config function builds more than one `plugins` list at the same level, so init did not ' +
+    'pick one. Add `reticle()` to the `plugins` list of the config that the function returns.';
 const PLUGINS_NOT_ARRAY_REASON = 'the `plugins` key is not an array literal, so init did not change it. Add `reticle()` to the ' +
     'list that the key builds. Do not add a second `plugins` key: the later key replaces the first.';
 function insertImport(source) {
@@ -83,15 +99,144 @@ function insertImport(source) {
  * what a formatter rewrites, turning a one-line install into a diff against the user's own style. A
  * single-line array needs the space, or the result reads `[reticle(),react()]`.
  */
-function insertPlugin(source, call) {
-    // `(match, offset, source)` — PLUGINS_ARRAY has no capture group. Reading the second argument as
-    // one put the whole source string in `offset`, so the index below was `undefined` and the
-    // separator was empty every single time.
-    return source.replace(PLUGINS_ARRAY, (match, offset) => {
-        const next = source[offset + match.length] ?? '';
-        const separator = '' === next || /\s/.test(next) ? '' : ' ';
-        return `${match}${call},${separator}`;
-    });
+function insertPlugin(source, call, at) {
+    const next = source[at] ?? '';
+    const separator = '' === next || /\s/.test(next) ? '' : ' ';
+    return `${source.slice(0, at)}${call},${separator}${source.slice(at)}`;
+}
+/** No single `plugins` key can be told to be the config's own: two lists compete for it. */
+const AMBIGUOUS = 'ambiguous';
+/**
+ * Where the value of the config's OWN `plugins` key starts, undefined when the config has none, or
+ * AMBIGUOUS when two lists compete and nothing says which one Vite reads.
+ *
+ * Other blocks can hold a `plugins` key too: Vite+'s `lint.plugins` names oxlint plugins, and
+ * `worker.plugins` and `build.rollupOptions.plugins` are other bundlers' lists. The first match in
+ * the file used to win. On a `vp create` React app that is `lint.plugins`, so init wrote
+ * `reticle()` into the lint settings, reported the step done, and the app never connected (#2134).
+ *
+ * So when the exported object is a literal we can see, only a key at that literal's own level, inside
+ * it, is its key. A config written as a function is read by `functionConfigPluginsAt`.
+ */
+function vitePluginsValueAt(source) {
+    const literal = exportedLiteralStart(source);
+    if (literal !== undefined) {
+        // The literal is in view, so only its own keys count. A key outside it is another object's: a
+        // hoisted `const lint = { plugins: [...] }` that the config names by shorthand.
+        return ownPluginsKeyAt(source, literal);
+    }
+    return functionConfigPluginsAt(source, exportedRegion(source));
+}
+/** Where the value of the `plugins` key of the object literal whose inner start is `literal` begins. */
+function ownPluginsKeyAt(source, literal) {
+    const end = matchingBraceEnd(source, literal) ?? source.length;
+    const depth = braceDepth(source, literal);
+    for (const match of source.matchAll(PLUGINS_KEY_COLON)) {
+        if (match.index > literal && match.index < end && depth === braceDepth(source, match.index)) {
+            return match.index + match[0].length;
+        }
+    }
+    return undefined;
+}
+/** An object literal a config function gives back: `return {` or an arrow's `=> ({`. */
+const RETURNED_OBJECT = /\breturn\s*\(?\s*\{|=>\s*\(\s*\{/g;
+/**
+ * The `plugins` value of a config built by a function (`defineConfig(({ mode }) => { ... })`).
+ *
+ * The config is the object the function returns. A body can build other objects with a `plugins`
+ * key first (`const x = { plugins: [legacy()] }`), at the same depth as the returned one, and the
+ * key that came first used to win. So the returned object literals are read first: one with its own
+ * `plugins` key is the config's list, and two (a config per mode) are AMBIGUOUS. A returned object
+ * inside another one is that object's value, such as an inline plugin's hook, and does not count.
+ *
+ * A function that returns a name (`return config`) or a call has no literal to read, and a returned
+ * literal may take its list from a spread (`...shared`). Then the key with the fewest open braces in
+ * the exported expression wins, and a tie is AMBIGUOUS. A
+ * const declared above the export (`const lint = { plugins: [...] }`) is never in that region.
+ */
+function functionConfigPluginsAt(source, region) {
+    const returned = [];
+    for (const match of source.matchAll(RETURNED_OBJECT)) {
+        const start = match.index + match[0].length;
+        if (match.index < region.from || match.index >= region.to) {
+            continue;
+        }
+        if (returned.some((outer) => start > outer.start && start <= outer.end)) {
+            continue;
+        }
+        returned.push({ start, end: matchingBraceEnd(source, start) ?? source.length });
+    }
+    const keys = returned
+        .map((object) => ownPluginsKeyAt(source, object.start))
+        .filter((at) => at !== undefined);
+    if (1 < keys.length) {
+        return AMBIGUOUS;
+    }
+    if (1 === keys.length) {
+        return keys[0];
+    }
+    // A returned literal with no `plugins` key of its own is the whole config, and it has no list:
+    // a `plugins` key elsewhere in the body is another object's. Only a spread (`...shared`) can
+    // bring one in, and then the body's own keys are all there is to go on.
+    if (0 < returned.length &&
+        !returned.some((object) => source.slice(object.start, object.end).includes('...'))) {
+        return undefined;
+    }
+    let best;
+    for (const match of source.matchAll(PLUGINS_KEY_COLON)) {
+        if (match.index < region.from || match.index >= region.to) {
+            continue;
+        }
+        const depth = braceDepth(source, match.index);
+        if (best === undefined || depth < best.depth) {
+            best = { depth, valueAt: match.index + match[0].length, tied: false };
+        }
+        else if (depth === best.depth) {
+            best.tied = true;
+        }
+    }
+    if (best !== undefined && best.tied) {
+        return AMBIGUOUS;
+    }
+    return best?.valueAt;
+}
+/** The name a default export refers to: `export default config` or `export default defineConfig(config)`. */
+const EXPORTED_NAME = /\bexport\s+default\s+(?:defineConfig\s*\(\s*)?([A-Za-z_$][\w$]*)\s*(?:[;)]|$)/m;
+/** Where `const|let|var <name> =` declares the name the default export refers to, if it does. */
+function exportedDeclaration(source) {
+    const name = EXPORTED_NAME.exec(source)?.[1];
+    if (name === undefined) {
+        return null;
+    }
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`\\b(?:const|let|var)\\s+${escaped}\\s*(?::[^=;]*)?=\\s*(?:defineConfig\\s*\\(\\s*)?`).exec(source);
+}
+/**
+ * The index just past the `{` of the exported config object literal: written in the export itself,
+ * or in the declaration of the name it exports (`const config = defineConfig({...})`).
+ */
+function exportedLiteralStart(source) {
+    const inline = CONFIG_OBJECT.exec(source);
+    if (null !== inline) {
+        return inline.index + inline[0].length;
+    }
+    const declared = exportedDeclaration(source);
+    if (null !== declared && '{' === source[declared.index + declared[0].length]) {
+        return declared.index + declared[0].length + 1;
+    }
+    return undefined;
+}
+/**
+ * The part of the file that holds the exported config: from the declaration of the name it exports
+ * up to the export, or from the export to the end of the file.
+ */
+function exportedRegion(source) {
+    const exported = EXPORT_DEFAULT.exec(source)?.index;
+    const declared = exportedDeclaration(source)?.index;
+    if (declared !== undefined && exported !== undefined && declared < exported) {
+        return { from: declared, to: exported };
+    }
+    return { from: exported ?? 0, to: source.length };
 }
 /**
  * Add a whole `plugins: [reticle()]` key to a config object that has none, matching the layout of
@@ -106,23 +251,46 @@ function insertPluginsKey(source, call) {
         return multiline ? `${prefix}{\n${indent}${key}` : `${prefix}{ ${key}`;
     });
 }
+/**
+ * The package a new config imports `defineConfig` from.
+ *
+ * A Vite+ app imports it from `vite-plus`. Under pnpm it may not declare `vite` at all, so an
+ * import from `vite` would not resolve, and Vite+'s own lint rule refuses it.
+ */
+export const DefineConfigSource = {
+    VITE: 'vite',
+    VITE_PLUS: 'vite-plus',
+};
 /**
  * A whole config for a plain Vite app that has none: Vite's defaults plus the plugin. Written out
  * rather than patched from an empty one, because it is a file the person will open and read.
  */
-export function newViteConfig(port, captureBodies = false, inject = true, sourceMapping = true) {
+export function newViteConfig(port, captureBodies = false, inject = true, sourceMapping = true, defineConfigFrom = DefineConfigSource.VITE) {
     const call = reticlePluginCall({ port, captureBodies, inject, sourceMapping });
-    return `import { defineConfig } from 'vite';\n${VITE_IMPORT}\n\nexport default defineConfig({\n  plugins: [${call}],\n});\n`;
+    return `import { defineConfig } from '${defineConfigFrom}';\n${VITE_IMPORT}\n\nexport default defineConfig({\n  plugins: [${call}],\n});\n`;
 }
 export function patchViteConfig(source, port, captureBodies = false, inject = true, sourceMapping = true) {
     if (source.includes(RETICLE_MARKER)) {
         return { kind: VitePatchKind.ALREADY };
     }
     const call = reticlePluginCall({ port, captureBodies, inject, sourceMapping });
-    if (PLUGINS_ARRAY.test(source)) {
-        return { kind: VitePatchKind.APPLY, code: insertImport(insertPlugin(source, call)) };
+    const masked = maskStringsAndComments(source);
+    if (null === masked) {
+        return { kind: VitePatchKind.MANUAL, reason: UNREADABLE_REASON };
+    }
+    const valueAt = vitePluginsValueAt(masked);
+    if (AMBIGUOUS === valueAt) {
+        return { kind: VitePatchKind.MANUAL, reason: AMBIGUOUS_PLUGINS_REASON };
+    }
+    if (valueAt !== undefined) {
+        const list = PLUGIN_LIST_START.exec(source.slice(valueAt));
+        if (null === list) {
+            return { kind: VitePatchKind.MANUAL, reason: PLUGINS_NOT_ARRAY_REASON };
+        }
+        const code = insertPlugin(source, call, valueAt + list[0].length);
+        return { kind: VitePatchKind.APPLY, code: insertImport(code) };
     }
-    if (PLUGINS_KEY.test(source)) {
+    if (PLUGINS_SHORTHAND.test(masked)) {
         return { kind: VitePatchKind.MANUAL, reason: PLUGINS_NOT_ARRAY_REASON };
     }
     if (CONFIG_OBJECT.test(source)) {

package/dist/plan/connect-steps.d.ts

@@ -62,3 +62,5 @@ export declare const STEP_TITLES: readonly StepTitle[];
 export declare const CONNECT_STEP_TITLES: ReadonlySet<StepTitle>;
 /** True when this step is what makes the app dial the daemon. */
 export declare function isConnectStep(title: string): boolean;
+/** True when this step patches the Vite config. */
+export declare function isViteConfigStep(title: string): boolean;

package/dist/plan/connect-steps.js

@@ -115,3 +115,12 @@ export const CONNECT_STEP_TITLES = new Set([
 export function isConnectStep(title) {
     return CONNECT_STEP_TITLES.has(title);
 }
+/** The steps that patch the Vite config the dev server loads. */
+const VITE_CONFIG_STEP_TITLES = new Set([
+    StepTitle.VITE_PLUGIN,
+    StepTitle.ELECTRON_VITE_PLUGIN,
+]);
+/** True when this step patches the Vite config. */
+export function isViteConfigStep(title) {
+    return VITE_CONFIG_STEP_TITLES.has(title);
+}