refactor(rivetkit): move devtools to local script

[jog1t]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[railway-app]

🚅 Deployed to the rivet-pr-4669 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
frontend-cloud	😴 Sleeping (View Logs)	Web	Apr 25, 2026 at 7:46 pm
website	😴 Sleeping (View Logs)	Web	Apr 25, 2026 at 12:12 am
kitchen-sink	❌ Build Failed (View Logs)	Web	Apr 24, 2026 at 1:59 pm
frontend-inspector	😴 Sleeping (View Logs)	Web	Apr 22, 2026 at 12:50 am
mcp-hub	✅ Success (View Logs)	Web	Apr 15, 2026 at 6:38 pm
ladle	❌ Build Failed (View Logs)	Web	Apr 15, 2026 at 6:38 pm

[jog1t]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• refactor: inspector tabs bundled with actor #4670
• refactor(rivetkit): move devtools to local script #4669 👈 (View in Graphite)
• fix(rivetkit): minor rivetkit debug changes #4676
• feat(frontend): add enoys to the runner table #4675
• refactor(frontend): support envoys #4651
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Preview packages published to npm

Install with:

npm install rivetkit@pr-4669

All packages published as 0.0.0-pr.4669.591a8c9 with tag pr-4669.

Engine binary is shipped via @rivetkit/engine-cli on linux-x64-musl, linux-arm64-musl, darwin-x64, and darwin-arm64. Windows users should use the release installer or set RIVET_ENGINE_BINARY.

Docker images:

docker pull rivetdev/engine:slim-591a8c9
docker pull rivetdev/engine:full-591a8c9

Individual packages

npm install rivetkit@pr-4669
npm install @rivetkit/react@pr-4669
npm install @rivetkit/rivetkit-native@pr-4669
npm install @rivetkit/sqlite-wasm@pr-4669
npm install @rivetkit/workflow-engine@pr-4669

[claude]

PR Review: refactor(rivetkit): move devtools to local script

Summary

This PR shifts devtools delivery from a CDN-fetched bundle (releases.rivet.dev) to a locally-served artifact compiled at build time from @rivetkit/devtools. The manager now serves the bundle at GET /devtools/mod.js on port 6420, while the engine guard is moved to an internal port 6423 via RIVET__GUARD__PORT. A secondary change adds macOS linker flags to .cargo/config.toml for native Node.js addon support, and the R2 upload step for the standalone devtools CDN artifact is removed from CI.

The port split and local bundling approach are architecturally sound and eliminate the external CDN dependency entirely.

---

Issues

Critical

Missing import of readDevtoolsBundle in router.ts

readDevtoolsBundle() is called in the new /devtools/mod.js route handler but the function is never imported. This will cause a runtime ReferenceError (or build-time TypeScript error). This is almost certainly the cause of the Railway kitchen-sink build failure.

Fix:

import { readDevtoolsBundle } from "@/devtools-loader/serve-devtools";

---

High

/devtools/mod.js route not gated on config.inspector.enabled

The inspector /ui/* routes are correctly gated inside if (config.inspector.enabled). The new /devtools/mod.js route sits outside that block and is unconditionally available. Serving a JS bundle in production is an unnecessary information-disclosure risk and adds surface area. The devtools route should follow the same guard as the inspector routes, or the inconsistency should be documented.

dev-env.sh not updated with RIVET__GUARD__PORT

mod.ts now sets RIVET__GUARD__PORT=6423 when spawning the engine, but the comment in dev-env.sh says these two files must stay in sync. Developers who run the engine manually via dev-env.sh will get the engine binding to port 6420 (its default), conflicting with the manager. Add RIVET__GUARD__PORT=6423 to dev-env.sh.

---

Medium

Undefined endpoint produces a silent bad URL in devtools-loader/index.ts

If config.endpoint is undefined, the optional chain returns undefined and the template literal evaluates to "undefined/devtools/mod.js" with the literal word "undefined" as the hostname. A guard should return early or log a warning instead of silently constructing a broken URL.

---

Low

Explicit notGlobal: false in actor-driver.ts without explanation

notGlobal?: boolean is optional and defaults to false, so setting it explicitly is a no-op. If this was intentional (e.g., to guard against a future default change), a comment is needed. If it is a debugging artifact, it should be removed.

Fragile relative path in serve-devtools.ts

The ../../dist/devtools/mod.js path relative to the compiled output file follows the same pattern as getInspectorDir(), but a comment explaining the expected compiled layout (e.g., dist/tsup/devtools-loader/serve-devtools.js to dist/devtools/mod.js) would help maintainers avoid breakage if the output structure changes.

Double blank line in publish.yaml after removing the R2 upload step - cosmetic, remove one.

---

Positive Notes

• Removing the CDN dependency improves offline dev, reduces latency, and eliminates a third-party fetch that could fail or be blocked.
• The port architecture (6420 manager, 6423 engine guard) is clean and gives the manager full ownership of the public API.
• RIVET__GUARD__PORT correctly uses the existing config convention (RIVET__ prefix with __ separator).
• The turbo.json dependency chain is correct: build:pack-devtools depends on @rivetkit/devtools#build, and build:publish depends on build:pack-devtools.
• pack-devtools.ts errors explicitly when the devtools build is missing rather than silently producing a broken artifact.
• The macOS linker flags (-undefined dynamic_lookup) are correct for native Node.js addons, and the comment explaining why tokio_unstable must be repeated in target-specific blocks is accurate.

---

Required Before Merge

Priority	Location	Issue
Critical	runtime-router/router.ts	Add missing import { readDevtoolsBundle }
High	runtime-router/router.ts	Gate /devtools/mod.js inside if (config.inspector.enabled)
High	scripts/run/dev-env.sh	Add RIVET__GUARD__PORT=6423
Medium	devtools-loader/index.ts	Guard against undefined config.endpoint before template literal
Low	drivers/engine/actor-driver.ts	Add comment or remove explicit notGlobal: false

[jog1t]

Merge activity

• Apr 24, 1:59 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 24, 2:04 PM UTC: Graphite couldn't merge this pull request because a downstack PR fix(rivetkit): minor rivetkit debug changes #4676 failed to merge.