@reticlehq/vite-plugin 2.8.0 → 2.10.0

package/README.md

@@ -46,6 +46,7 @@ reticle({
   sourceMapping, // default true; stamp data-reticle-source (harmless on React <=18)
   inject, // default true; auto-inject reticle.connect()
   captureNetworkBodies, // default false; record request/response bodies on reticle_network
+  allowNonLocalhost, // default false; allow a page/bridge that is not on localhost (needs a token)
   desktop, // default false; also apply to `vite build`, for an Electron/Tauri renderer
   onWarn, // where a diagnostic goes; defaults to the console
 });
@@ -53,6 +54,8 @@ reticle({
 
 `captureNetworkBodies` is off by default because a body is the one part of a request that routinely carries a card number, a token, or a customer's address. It is also settable as `VITE_RETICLE_CAPTURE_BODIES=1` for a single debugging session.
 
+`allowNonLocalhost` is for a dev server that cannot be served on localhost — a host-based multi-tenant frontend, or an app with cookie-scoped auth on a custom dev hostname. It is **not sufficient on its own**: the SDK also requires a pairing token outside localhost, and refuses with "a pairing token is required outside localhost" when it is missing. The plugin supplies one automatically from the daemon's `~/.reticle/pairing-token`, so a running daemon is normally all it takes — pass `token` yourself only when that file is unreachable. A bridge that is itself non-local must also use `wss://`. Settable as `VITE_RETICLE_ALLOW_NON_LOCALHOST=1` for a single session.
+
 `desktop: true` makes the plugin apply to `vite build` as well and calls `connect()` with `allowInProduction`, because a packaged desktop renderer is a production build with no dev server. That means an instrumented production bundle, which a web app must never ship. Keep it behind your own dev-only build target.
 
 Apache-2.0.