feat(core): allow configuring extra allowed origins for the DevTools WS transport

packages/core/src/node/config.ts

@@ -24,6 +24,16 @@ export interface DevToolsConfig extends Partial<StartOptions> {
    * will be auto-approved without a terminal prompt.
    */
   clientAuthTokens?: string[]
+  /**
+   * Origins allowed to open the DevTools WebSocket connection, in addition to the built-in
+   * loopback allowlist (`localhost`, `127.0.0.1`, etc).
+   *
+   * The loopback check is a plain string match against the `Origin` header, not a DNS/hosts-file
+   * resolution — a custom dev hostname that resolves to loopback via `/etc/hosts` or a local DNS
+   * override (e.g. `dev-my-app.example.com`) is invisible to it and gets rejected. List such
+   * hostnames here explicitly.
+   */
+  allowedOrigins?: string[]
 }
 
 export interface ResolvedDevToolsConfig {

packages/core/src/node/ws.ts

@@ -15,6 +15,7 @@
 import { colors as c } from 'devframe/utils/colors'
 import { getPort } from 'get-port-please'
 import { createDebug } from 'obug'
+import type { DevToolsConfig } from './config'
 import { getAuthHandler } from './auth-handler'
 import { MARK_INFO } from './constants'
 import { diagnostics } from './diagnostics'
@@ -146,8 +147,16 @@
     ? { server: viteHttpServer, path: DEVTOOLS_WS_PATH, destroyUnmatched: false }
     : { port: port!, host, https }
 
+  // Vite's published types bundle a frozen snapshot of `DevToolsConfig` (to type
+  // `ResolvedConfig.devtools` without depending on this package at runtime), so a field just
+  // added here isn't visible through `context.viteConfig.devtools.config` until Vite re-vendors
+  // it — the same gap `vite-augment.ts` works around for `Plugin.devtools`. Read it through a
+  // narrow cast rather than waiting on that.
+  const allowedOrigins = (context.viteConfig.devtools?.config as DevToolsConfig | undefined)?.allowedOrigins
+
   attachWsRpcTransport(rpcGroup, {
     ...binding,
+    allowedOrigins,
     definitions: rpcHost.definitions,
     onConnected: (peer, meta) => {
       // crossws exposes the upgrade request (with its query string + headers)