rivet-design 0.9.10 → 0.10.1

package/dist/routes/static.d.ts

@@ -1,7 +1,12 @@
 import { Router } from 'express';
 import { StaticFileService } from '../services/StaticFileService';
+type StaticRoutesOptions = {
+    isPreviewBridgeEnabled?: boolean;
+    expectedPreviewParentOrigin?: string;
+};
 /**
  * Create routes for serving static files
  */
-export declare const createStaticRoutes: (staticService: StaticFileService, _projectPath: string) => Router;
+export declare const createStaticRoutes: (staticService: StaticFileService, _projectPath: string, options?: StaticRoutesOptions) => Router;
+export {};
 //# sourceMappingURL=static.d.ts.map

package/dist/routes/static.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/routes/static.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAqB,MAAM,EAAE,MAAM,SAAS,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,eAAe,iBAAiB,EAChC,cAAc,MAAM,KACnB,MAyCF,CAAC"}
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/routes/static.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAqB,MAAM,EAAE,MAAM,SAAS,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAMlE,KAAK,mBAAmB,GAAG;IACzB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,eAAe,iBAAiB,EAChC,cAAc,MAAM,EACpB,UAAS,mBAAwB,KAChC,MAuDF,CAAC"}

package/dist/routes/static.js

@@ -41,17 +41,29 @@ const express_1 = __importStar(require("express"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const logger_1 = require("../utils/logger");
+const preview_bridge_1 = require("../proxy-middleware/preview-bridge");
 const log = (0, logger_1.createLogger)('StaticRoutes');
 /**
  * Create routes for serving static files
  */
-const createStaticRoutes = (staticService, _projectPath) => {
+const createStaticRoutes = (staticService, _projectPath, options = {}) => {
     const router = (0, express_1.Router)();
     // Serve static files from project directory
     const basePath = staticService.getBasePath();
     const entryFileName = staticService.getEntryFileName();
     log.info(`Serving static files from: ${basePath}`);
     log.info(`Entry file: ${entryFileName}`);
+    const sendEntry = (res, entryPath) => {
+        if (options.isPreviewBridgeEnabled) {
+            res
+                .type('html')
+                .send((0, preview_bridge_1.injectPreviewBridge)(fs_1.default.readFileSync(entryPath, 'utf8'), {
+                expectedParentOrigin: options.expectedPreviewParentOrigin,
+            }));
+            return;
+        }
+        res.sendFile(entryFileName, { root: basePath });
+    };
     // Serve the entry point at /static/ (root of static site)
     router.get('/static', (_req, res) => {
         const entryPath = path_1.default.join(basePath, entryFileName);
@@ -63,7 +75,7 @@ const createStaticRoutes = (staticService, _projectPath) => {
             });
             return;
         }
-        res.sendFile(entryFileName, { root: basePath });
+        sendEntry(res, entryPath);
     });
     router.get('/static/', (_req, res) => {
         const entryPath = path_1.default.join(basePath, entryFileName);
@@ -75,7 +87,7 @@ const createStaticRoutes = (staticService, _projectPath) => {
             });
             return;
         }
-        res.sendFile(entryFileName, { root: basePath });
+        sendEntry(res, entryPath);
     });
     // Serve all other static files
     router.use('/static', express_1.default.static(basePath));

package/dist/routes/static.js.map

@@ -1 +1 @@
-{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/routes/static.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAA6D;AAC7D,gDAAwB;AACxB,4CAAoB;AAEpB,4CAA+C;AAE/C,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,cAAc,CAAC,CAAC;AAEzC;;GAEG;AACI,MAAM,kBAAkB,GAAG,CAChC,aAAgC,EAChC,YAAoB,EACZ,EAAE;IACV,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;IAEvD,GAAG,CAAC,IAAI,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,IAAI,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC;IAEzC,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA5CW,QAAA,kBAAkB,sBA4C7B"}
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/routes/static.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAA6D;AAC7D,gDAAwB;AACxB,4CAAoB;AAEpB,4CAA+C;AAC/C,uEAAyE;AAEzE,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,cAAc,CAAC,CAAC;AAOzC;;GAEG;AACI,MAAM,kBAAkB,GAAG,CAChC,aAAgC,EAChC,YAAoB,EACpB,UAA+B,EAAE,EACzB,EAAE;IACV,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;IAEvD,GAAG,CAAC,IAAI,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,IAAI,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC;IAEzC,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,SAAiB,EAAE,EAAE;QACrD,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnC,GAAG;iBACA,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CACH,IAAA,oCAAmB,EAAC,YAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;gBACtD,oBAAoB,EAAE,OAAO,CAAC,2BAA2B;aAC1D,CAAC,CACH,CAAC;YACJ,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA3DW,QAAA,kBAAkB,sBA2D7B"}

package/dist/server.d.ts

@@ -3,7 +3,46 @@ import { TelemetryService } from './services/TelemetryService';
 import { Framework } from './services/ProjectDetectionService';
 import { SessionBridgeService } from './services/SessionBridgeService';
 import type { AgentVariantsOrchestrator } from './mcp/agent-variants';
+export declare const INACTIVE_VARIANTS_EVENT_HEARTBEAT_MS = 30000;
+export declare const RIVET_CORS_ALLOWED_HEADERS: string[];
 export declare const DIST_UI_PATH: string;
+type RivetUiBootstrap = {
+    agentApplyMode: 'embedded' | 'external' | null;
+    queueAccessToken: string | null;
+};
+export declare const injectRivetUiBootstrap: (html: string, bootstrap: RivetUiBootstrap) => string;
+type InactiveVariantsEventRequest = {
+    on: (event: 'close', listener: () => void) => unknown;
+};
+type InactiveVariantsEventResponse = {
+    set: (headers: Record<string, string>) => unknown;
+    flushHeaders?: () => unknown;
+    write: (chunk: string) => unknown;
+};
+/**
+ * Keeps the inactive variants SSE endpoint well-formed for clients that always subscribe.
+ */
+export declare const sendInactiveVariantsEventStream: (req: InactiveVariantsEventRequest, res: InactiveVariantsEventResponse) => void;
+/**
+ * Returns the host interface Rivet should bind for the current runtime.
+ */
+export declare const resolveRivetListenHost: (agentApplyMode?: "embedded" | "external" | null) => string | undefined;
+export declare const resolveEmbeddedAgentUiOrigin: (port: number) => string;
+export declare const resolveEmbeddedAgentPreviewOrigin: (port: number) => string;
+export declare const isEmbeddedAgentUiHost: (hostname: string, agentApplyMode?: "embedded" | "external" | null) => boolean;
+export declare const isRivetUiStaticAssetPath: (requestPath: string) => boolean;
+type RivetCorsOriginCheck = {
+    requestOrigin?: string;
+    requestHostname: string;
+    requestPath: string;
+    allowedOrigins: ReadonlySet<string>;
+    agentApplyMode?: 'embedded' | 'external' | null;
+};
+/**
+ * Allows browser requests from the Rivet UI origin and the opaque sandbox
+ * origin used by embedded agent previews when loading preview assets.
+ */
+export declare const isRivetCorsOriginAllowed: ({ requestOrigin, requestHostname, requestPath, allowedOrigins, agentApplyMode, }: RivetCorsOriginCheck) => boolean;
 export type ServerOptions = Omit<CLIOptions, 'help' | 'version' | 'debug'> & {
     framework: Framework;
     telemetry?: TelemetryService;
@@ -16,6 +55,14 @@ export type ServerOptions = Omit<CLIOptions, 'help' | 'version' | 'debug'> & {
     agentVariantsOrchestrator?: AgentVariantsOrchestrator;
     /** The editor running the MCP session (e.g. 'claude', 'cursor', 'codex'). Shown in the UI button. */
     mcpEditor?: string;
+    /** Whether apply progress is handled inside Rivet or by an external editor. */
+    agentApplyMode?: 'embedded' | 'external';
+    /** Cancels active embedded terminal-agent work when the UI Stop control is used. */
+    agentRunController?: {
+        cancelActiveRun: () => {
+            stoppedCount: number;
+        };
+    };
     /** Skip registering process-level exit/signal handlers. Set true when embedded in another process (e.g. MCP server). */
     skipProcessHandlers?: boolean;
     /** Explicit port for the Rivet Express server. Defaults to DEFAULT_PORT (4000). */
@@ -46,4 +93,5 @@ export type ServerHandle = {
     close: () => Promise<void>;
 };
 export declare const startServer: (options: ServerOptions) => Promise<ServerHandle>;
+export {};
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAmC,MAAM,GAAG,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAQ/D,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAO/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAKvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AA+CtE,eAAO,MAAM,YAAY,QAAkB,CAAC;AAkD5C,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG;IAC3E,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,mGAAmG;IACnG,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IACtD,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wHAAwH;IACxH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,6BAA6B,CAAC,EAAE,MAAM,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CA44BtB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAmC,MAAM,GAAG,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAW/D,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAQ/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAKvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAsBtE,eAAO,MAAM,oCAAoC,QAAS,CAAC;AAC3D,eAAO,MAAM,0BAA0B,UAItC,CAAC;AAgCF,eAAO,MAAM,YAAY,QAAkB,CAAC;AAE5C,KAAK,gBAAgB,GAAG;IACtB,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;IAC/C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAAC;AAiBF,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,WAAW,gBAAgB,KAC1B,MAMF,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC;CACvD,CAAC;AAEF,KAAK,6BAA6B,GAAG;IACnC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC;IAClD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;IAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC1C,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,KACjC,IAgBF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,iBAAiB,UAAU,GAAG,UAAU,GAAG,IAAI,KAC9C,MAAM,GAAG,SAC4D,CAAC;AAEzE,eAAO,MAAM,4BAA4B,GAAI,MAAM,MAAM,KAAG,MACZ,CAAC;AAEjD,eAAO,MAAM,iCAAiC,GAAI,MAAM,MAAM,KAAG,MAChB,CAAC;AAElD,eAAO,MAAM,qBAAqB,GAChC,UAAU,MAAM,EAChB,iBAAiB,UAAU,GAAG,UAAU,GAAG,IAAI,KAC9C,OACuE,CAAC;AAE3E,eAAO,MAAM,wBAAwB,GAAI,aAAa,MAAM,KAAG,OAGtB,CAAC;AAE1C,KAAK,oBAAoB,GAAG;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;CACjD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,kFAMtC,oBAAoB,KAAG,OAczB,CAAC;AAkDF,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG;IAC3E,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,mGAAmG;IACnG,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IACtD,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACzC,oFAAoF;IACpF,kBAAkB,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACzE,wHAAwH;IACxH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,6BAA6B,CAAC,EAAE,MAAM,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CA4kCtB,CAAC"}

package/dist/server.js

@@ -36,10 +36,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startServer = exports.DIST_UI_PATH = void 0;
+exports.startServer = exports.isRivetCorsOriginAllowed = exports.isRivetUiStaticAssetPath = exports.isEmbeddedAgentUiHost = exports.resolveEmbeddedAgentPreviewOrigin = exports.resolveEmbeddedAgentUiOrigin = exports.resolveRivetListenHost = exports.sendInactiveVariantsEventStream = exports.injectRivetUiBootstrap = exports.DIST_UI_PATH = exports.RIVET_CORS_ALLOWED_HEADERS = exports.INACTIVE_VARIANTS_EVENT_HEARTBEAT_MS = void 0;
 const Sentry = __importStar(require("@sentry/node"));
 const express_1 = __importDefault(require("express"));
 const cors_1 = __importDefault(require("cors"));
+const crypto_1 = require("crypto");
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const index_core_1 = require("./index-core");
@@ -55,6 +56,7 @@ const proxy_config_1 = require("./proxy-middleware/proxy-config");
 const StaticFileService_1 = require("./services/StaticFileService");
 const static_1 = require("./routes/static");
 const ConfigManager_1 = require("./services/ConfigManager");
+const accessTokenRefresh_1 = require("./services/accessTokenRefresh");
 const evaluateFlags_1 = require("./config/evaluateFlags");
 const FeatureFlagService_1 = require("./services/FeatureFlagService");
 const DesktopVersionPolicyService_1 = require("./services/DesktopVersionPolicyService");
@@ -70,7 +72,19 @@ const HostedDemoAuthSessionStore_1 = require("./services/HostedDemoAuthSessionSt
 const shouldRecordHostedDemoSessionAction_1 = require("./utils/shouldRecordHostedDemoSessionAction");
 const hostedDemoSessionAuthRefresh_1 = require("./services/hostedDemoSessionAuthRefresh");
 const RequestAuthContext_1 = require("./services/RequestAuthContext");
+const queueAccess_1 = require("./utils/queueAccess");
 const log = (0, index_core_1.createLogger)('RivetServer');
+const QUEUE_ACCESS_TOKEN_BYTES = 32;
+const RIVET_BOOTSTRAP_SCRIPT_ID = 'rivet-bootstrap-config';
+const EMBEDDED_AGENT_LISTEN_HOST = '127.0.0.1';
+const EMBEDDED_AGENT_PREVIEW_HOST = 'localhost';
+const OPAQUE_PREVIEW_ORIGIN = 'null';
+exports.INACTIVE_VARIANTS_EVENT_HEARTBEAT_MS = 30_000;
+exports.RIVET_CORS_ALLOWED_HEADERS = [
+    'Content-Type',
+    'Authorization',
+    'x-rivet-queue-token',
+];
 /**
  * Resolve UI dist path for both development and packaged (desktop app) environments
  */
@@ -96,6 +110,76 @@ const resolveUiPath = () => {
     return devPath;
 };
 exports.DIST_UI_PATH = resolveUiPath();
+const setNoStoreHeaders = (res) => {
+    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
+};
+const escapeScriptJson = (value) => JSON.stringify(value)
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+const injectRivetUiBootstrap = (html, bootstrap) => {
+    const script = `<script id="${RIVET_BOOTSTRAP_SCRIPT_ID}">window.__RIVET_BOOTSTRAP__=${escapeScriptJson(bootstrap)};</script>`;
+    if (html.includes('</head>')) {
+        return html.replace('</head>', `${script}</head>`);
+    }
+    return `${script}${html}`;
+};
+exports.injectRivetUiBootstrap = injectRivetUiBootstrap;
+/**
+ * Keeps the inactive variants SSE endpoint well-formed for clients that always subscribe.
+ */
+const sendInactiveVariantsEventStream = (req, res) => {
+    res.set({
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache, no-transform',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+    });
+    res.flushHeaders?.();
+    res.write('data: {"active":false}\n\n');
+    const heartbeat = setInterval(() => {
+        res.write(': heartbeat\n\n');
+    }, exports.INACTIVE_VARIANTS_EVENT_HEARTBEAT_MS);
+    req.on('close', () => {
+        clearInterval(heartbeat);
+    });
+};
+exports.sendInactiveVariantsEventStream = sendInactiveVariantsEventStream;
+/**
+ * Returns the host interface Rivet should bind for the current runtime.
+ */
+const resolveRivetListenHost = (agentApplyMode) => agentApplyMode === 'embedded' ? EMBEDDED_AGENT_LISTEN_HOST : undefined;
+exports.resolveRivetListenHost = resolveRivetListenHost;
+const resolveEmbeddedAgentUiOrigin = (port) => `http://${EMBEDDED_AGENT_LISTEN_HOST}:${port}`;
+exports.resolveEmbeddedAgentUiOrigin = resolveEmbeddedAgentUiOrigin;
+const resolveEmbeddedAgentPreviewOrigin = (port) => `http://${EMBEDDED_AGENT_PREVIEW_HOST}:${port}`;
+exports.resolveEmbeddedAgentPreviewOrigin = resolveEmbeddedAgentPreviewOrigin;
+const isEmbeddedAgentUiHost = (hostname, agentApplyMode) => agentApplyMode !== 'embedded' || hostname === EMBEDDED_AGENT_LISTEN_HOST;
+exports.isEmbeddedAgentUiHost = isEmbeddedAgentUiHost;
+const isRivetUiStaticAssetPath = (requestPath) => requestPath === '/rivet/favicon.ico' ||
+    requestPath.startsWith('/rivet/assets/') ||
+    requestPath.startsWith('/rivet/fonts/');
+exports.isRivetUiStaticAssetPath = isRivetUiStaticAssetPath;
+/**
+ * Allows browser requests from the Rivet UI origin and the opaque sandbox
+ * origin used by embedded agent previews when loading preview assets.
+ */
+const isRivetCorsOriginAllowed = ({ requestOrigin, requestHostname, requestPath, allowedOrigins, agentApplyMode, }) => {
+    if (!requestOrigin) {
+        return true;
+    }
+    if (allowedOrigins.has(requestOrigin)) {
+        return true;
+    }
+    return (agentApplyMode === 'embedded' &&
+        requestHostname === EMBEDDED_AGENT_PREVIEW_HOST &&
+        !requestPath.startsWith('/api/') &&
+        !requestPath.startsWith('/rivet') &&
+        requestOrigin === OPAQUE_PREVIEW_ORIGIN);
+};
+exports.isRivetCorsOriginAllowed = isRivetCorsOriginAllowed;
 /**
  * Path to the dev-mode port marker. Written by the Rivet backend after listen()
  * succeeds and consumed by `src/ui/vite.config.ts` so that `yarn dev` in the UI
@@ -141,12 +225,16 @@ const removeDevPortFile = () => {
     }
 };
 const startServer = async (options) => {
-    const { userPort, userHost, telemetry, projectPath, framework, staticEntry, styleFramework, tailwindConfig, sessionBridge, mcpEditor, skipProcessHandlers, } = options;
+    const { userPort, userHost, telemetry, projectPath, framework, staticEntry, styleFramework, tailwindConfig, sessionBridge, mcpEditor, agentApplyMode, agentRunController, skipProcessHandlers, } = options;
     const userPortWithFallback = userPort ?? _1.DEFAULT_USER_PORT;
     const userHostWithFallback = userHost ?? 'localhost';
     const isDemoModeEnabled = options.demoMode?.enabled ?? false;
     const requiresDemoAuth = options.demoMode?.requireSignedInUsers ?? true;
     const isGitEnabled = options.isGitEnabled ?? !isDemoModeEnabled;
+    const queueAccessToken = sessionBridge && agentApplyMode === 'embedded'
+        ? (0, crypto_1.randomBytes)(QUEUE_ACCESS_TOKEN_BYTES).toString('base64url')
+        : null;
+    const rivetUiIndexHtml = fs_1.default.readFileSync(path_1.default.join(exports.DIST_UI_PATH, 'index.html'), 'utf8');
     if (process.env.SENTRY_DSN) {
         Sentry.init({
             dsn: process.env.SENTRY_DSN,
@@ -200,10 +288,9 @@ const startServer = async (options) => {
     }
     const listenPort = options.rivetPort ?? _1.DEFAULT_PORT;
     const app = (0, express_1.default)();
-    const corsOrigins = new Set([
-        `http://localhost:${listenPort}`,
-        `http://127.0.0.1:${listenPort}`,
-    ]);
+    const corsOrigins = new Set(agentApplyMode === 'embedded'
+        ? [(0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)]
+        : [`http://localhost:${listenPort}`, `http://127.0.0.1:${listenPort}`]);
     const rawCorsOrigins = process.env.RIVET_CORS_ORIGINS;
     if (rawCorsOrigins) {
         rawCorsOrigins
@@ -217,12 +304,22 @@ const startServer = async (options) => {
         corsOrigins.add('https://demo.rivet.design');
     }
     // CORS configuration for local development
-    app.use((0, cors_1.default)({
-        origin: [...corsOrigins],
-        credentials: true,
-        methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-        allowedHeaders: ['Content-Type', 'Authorization'],
-    }));
+    app.use((req, res, next) => {
+        (0, cors_1.default)({
+            origin: (origin, callback) => {
+                callback(null, (0, exports.isRivetCorsOriginAllowed)({
+                    requestOrigin: origin,
+                    requestHostname: req.hostname,
+                    requestPath: req.path,
+                    allowedOrigins: corsOrigins,
+                    agentApplyMode,
+                }));
+            },
+            credentials: true,
+            methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+            allowedHeaders: exports.RIVET_CORS_ALLOWED_HEADERS,
+        })(req, res, next);
+    });
     const jsonBodyParser = express_1.default.json({ limit: '50mb' });
     app.use((req, res, next) => {
         if (req.originalUrl.startsWith('/try/')) {
@@ -245,16 +342,12 @@ const startServer = async (options) => {
             // until the cache TTL expires). Hashed assets under /assets/* are
             // content-addressed and safe to long-cache.
             if (filePath.endsWith('.html')) {
-                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-                res.setHeader('Pragma', 'no-cache');
-                res.setHeader('Expires', '0');
+                setNoStoreHeaders(res);
             }
             else if (process.env.NODE_ENV !== 'production') {
                 // Dev: defeat caching for everything so HMR-like behavior is reliable
                 // without rebuilds bumping a hash.
-                res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-                res.setHeader('Pragma', 'no-cache');
-                res.setHeader('Expires', '0');
+                setNoStoreHeaders(res);
             }
             else {
                 // Production hashed assets are content-addressed (`main-<hash>.js`),
@@ -264,24 +357,48 @@ const startServer = async (options) => {
             }
         },
     };
+    const sendRivetUiIndex = (req, res) => {
+        if (!(0, exports.isEmbeddedAgentUiHost)(req.hostname, agentApplyMode)) {
+            res.redirect(302, `${(0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)}${req.originalUrl}`);
+            return;
+        }
+        setNoStoreHeaders(res);
+        res
+            .type('html')
+            .send((0, exports.injectRivetUiBootstrap)(rivetUiIndexHtml, {
+            agentApplyMode: agentApplyMode ?? null,
+            queueAccessToken,
+        }));
+    };
     // Serve hashed UI assets from root so both / and /rivet entrypoints can load them.
     app.use('/assets', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'assets'), uiStaticOptions));
+    app.use('/rivet/assets', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'assets'), uiStaticOptions));
     // Serve public font files used by auth and hosted demo UI.
     app.use('/fonts', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'fonts'), uiStaticOptions));
+    app.use('/rivet/fonts', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'fonts'), uiStaticOptions));
     // Serve favicon at root for hosted/static deployments.
     app.get('/favicon.ico', (_req, res) => {
         res.sendFile('favicon.ico', { root: exports.DIST_UI_PATH });
     });
+    app.get('/rivet/favicon.ico', (_req, res) => {
+        res.sendFile('favicon.ico', { root: exports.DIST_UI_PATH });
+    });
     // Serve Rivet UI at /rivet for non-static modes.
     if (framework !== 'static') {
-        app.use('/rivet', express_1.default.static(exports.DIST_UI_PATH, uiStaticOptions));
+        app.get(/^\/rivet(?:\/.*)?$/, (req, res, next) => {
+            if ((0, exports.isRivetUiStaticAssetPath)(req.path)) {
+                next();
+                return;
+            }
+            sendRivetUiIndex(req, res);
+        });
     }
     log.info(`Serving UI assets from: ${exports.DIST_UI_PATH}`);
     // Static mode - use root entrypoint for Rivet UI (no dev server to proxy to)
     if (framework === 'static') {
         app.get('/', (req, res) => {
             log.debug(`${framework} mode - serving Rivet at root`);
-            res.sendFile('index.html', { root: exports.DIST_UI_PATH });
+            sendRivetUiIndex(req, res);
         });
     }
     // For web frameworks, root route falls through to catch-all proxy (no special handling needed)
@@ -372,7 +489,9 @@ const startServer = async (options) => {
         return email.trim().toLowerCase();
     };
     const isDemoAuthExemptApiPath = (pathName) => {
-        if (pathName === '/config' || pathName === '/health' || pathName === '/auth/store') {
+        if (pathName === '/config' ||
+            pathName === '/health' ||
+            pathName === '/auth/store') {
             return true;
         }
         if (pathName === '/demo/session' || pathName.startsWith('/demo/session/')) {
@@ -393,7 +512,8 @@ const startServer = async (options) => {
         return false;
     };
     let demoSessionService = null;
-    if (isDemoModeEnabled && options.demoMode?.allowSessionProvisioning !== false) {
+    if (isDemoModeEnabled &&
+        options.demoMode?.allowSessionProvisioning !== false) {
         const sessionMetadataRedisUrl = options.demoMode?.sessionMetadataRedisUrl ??
             options.demoMode?.authRedisUrl;
         const sessionMetadataStore = sessionMetadataRedisUrl
@@ -444,7 +564,8 @@ const startServer = async (options) => {
                 if (!activeDemoSessionId) {
                     return undefined;
                 }
-                return demoSessionService.getSessionProxyTarget(activeDemoSessionId) ?? undefined;
+                return (demoSessionService.getSessionProxyTarget(activeDemoSessionId) ??
+                    undefined);
             },
         });
         app.use('/api', (req, res, next) => {
@@ -638,7 +759,12 @@ const startServer = async (options) => {
     app.use('/api', (0, support_1.createSupportRouter)(telemetry));
     // Static routes (only for static projects)
     if (staticService) {
-        app.use((0, static_1.createStaticRoutes)(staticService, projectPath));
+        app.use((0, static_1.createStaticRoutes)(staticService, projectPath, {
+            isPreviewBridgeEnabled: agentApplyMode === 'embedded',
+            expectedPreviewParentOrigin: agentApplyMode === 'embedded'
+                ? (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)
+                : undefined,
+        }));
         log.info('Static routes mounted at /static');
     }
     // Health check endpoint
@@ -653,6 +779,22 @@ const startServer = async (options) => {
             },
         });
     });
+    app.post('/api/agent/stop', (req, res) => {
+        if (agentApplyMode !== 'embedded' || !agentRunController) {
+            return res.status(404).json({ error: 'No embedded agent run active' });
+        }
+        if (!(0, queueAccess_1.isQueueAccessAuthorized)({
+            queueAccessToken,
+            getHeader: (name) => req.header(name),
+        })) {
+            return res.status(403).json({
+                error: 'Queue access denied',
+                reason: 'queue_token_required',
+            });
+        }
+        const result = agentRunController.cancelActiveRun();
+        return res.json({ success: true, ...result });
+    });
     // Config endpoint
     app.get('/api/config', async (req, res) => {
         const configManager = (0, ConfigManager_1.getConfigManager)();
@@ -662,10 +804,21 @@ const startServer = async (options) => {
         const isAuthenticated = demoAuthSessionService
             ? isAuthenticatedInDemoMode
             : configManager.isAuthenticated();
-        const email = demoAuthSessionService ? demoAuth?.email : configManager.getEmail();
+        const email = demoAuthSessionService
+            ? demoAuth?.email
+            : configManager.getEmail();
         const userId = demoAuthSessionService
             ? demoAuth?.userId
             : configManager.getUserId();
+        // Display name lives in the access token's user_metadata (Google OAuth).
+        // Decode the demo session's token directly; otherwise let ConfigManager
+        // read it off the locally stored token. May be undefined (email-only
+        // logins) — the UI falls back to email-derived initials.
+        const name = demoAuthSessionService
+            ? demoAuth?.token
+                ? ((0, accessTokenRefresh_1.getJwtDisplayName)(demoAuth.token) ?? undefined)
+                : undefined
+            : configManager.getDisplayName();
         const featureFlagUserKey = (0, featureFlagUserKey_1.getConfigFeatureFlagUserKey)({
             headers: req.headers,
             fallbackEmail: email,
@@ -691,9 +844,13 @@ const startServer = async (options) => {
             agentModeAvailable: isAuthenticated,
             email,
             userId,
+            name,
             activeDemoSessionId,
             isMCPSession: sessionBridge?.isActive() ?? false,
             mcpEditor: mcpEditor ?? null,
+            agentApplyMode: sessionBridge?.isActive()
+                ? (agentApplyMode ?? 'external')
+                : null,
             featureFlags,
             projectPath: livePath,
             demoMode: isDemoModeEnabled,
@@ -749,15 +906,33 @@ const startServer = async (options) => {
                     deploymentEnv: process.env.NODE_ENV ?? 'development',
                 });
             }
-            return res.status(500).json({ error: 'Failed to store auth credentials' });
+            return res
+                .status(500)
+                .json({ error: 'Failed to store auth credentials' });
         }
         telemetry?.identifyUser();
         log.info(`Stored auth for ${email} via browser OAuth`);
         res.json({ success: true });
     });
+    app.post('/api/auth/logout', (req, res) => {
+        try {
+            if (demoAuthSessionService) {
+                demoAuthSessionService.clearAuthForRequest(req, res);
+            }
+            else {
+                (0, ConfigManager_1.getConfigManager)().clearAuth();
+            }
+        }
+        catch (error) {
+            log.warn('Logout failed', error);
+            return res.status(500).json({ error: 'Failed to log out' });
+        }
+        log.info('Cleared auth via logout');
+        res.json({ success: true });
+    });
     // MCP bridge routes (only when session bridge is provided)
     if (sessionBridge) {
-        app.use('/api/mcp', (0, mcp_1.createMCPRouter)(sessionBridge, options.telemetry, options.agentVariantsOrchestrator));
+        app.use('/api/mcp', (0, mcp_1.createMCPRouter)(sessionBridge, options.telemetry, options.agentVariantsOrchestrator, { queueAccessToken: queueAccessToken ?? undefined }));
         log.info('MCP bridge routes mounted at /api/mcp');
     }
     // Agent-driven variants — Express routes back the iframe chip (cycle pills,
@@ -766,12 +941,25 @@ const startServer = async (options) => {
         app.use('/api', (0, agentVariants_1.createAgentVariantsRouter)(options.agentVariantsOrchestrator, sessionBridge, telemetry));
         log.info('agent-variants routes mounted at /api/variants');
     }
+    else {
+        app.get('/api/variants/active', (_req, res) => {
+            res.json({ active: false });
+        });
+        app.get('/api/variants/events', (req, res) => {
+            (0, exports.sendInactiveVariantsEventStream)(req, res);
+        });
+    }
     // Proxy all other routes to user's dev server (catch-all)
     // This must come AFTER all Rivet-specific routes
     // Skip proxy setup for static apps
     let userDevProxy = null;
     if (framework !== 'static') {
-        userDevProxy = (0, proxy_config_1.createUserDevServerProxy)(userPortWithFallback, userHostWithFallback);
+        userDevProxy = (0, proxy_config_1.createUserDevServerProxy)(userPortWithFallback, userHostWithFallback, {
+            isPreviewBridgeEnabled: agentApplyMode === 'embedded',
+            expectedPreviewParentOrigin: agentApplyMode === 'embedded'
+                ? (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)
+                : undefined,
+        });
         // Inject the variant-target setter into the bridge so MCP-driven variant
         // sessions can swap upstreams without re-creating the proxy.
         sessionBridge?.registerVariantTargetSetter(userDevProxy.setVariantTarget);
@@ -812,11 +1000,18 @@ const startServer = async (options) => {
     // Start server
     const activeSockets = new Set();
     const httpServer = await new Promise((resolve, reject) => {
-        const server = app.listen(listenPort, () => {
-            log.info(`🎨 Rivet server running on http://localhost:${listenPort}`);
-            writeDevPortFile(listenPort);
-            resolve(server);
-        });
+        const listenHost = (0, exports.resolveRivetListenHost)(agentApplyMode);
+        const server = listenHost
+            ? app.listen(listenPort, listenHost, () => {
+                log.info(`🎨 Rivet server running on http://${listenHost}:${listenPort}`);
+                writeDevPortFile(listenPort);
+                resolve(server);
+            })
+            : app.listen(listenPort, () => {
+                log.info(`🎨 Rivet server running on http://localhost:${listenPort}`);
+                writeDevPortFile(listenPort);
+                resolve(server);
+            });
         server.on('error', (err) => {
             reject(err);
         });