[edmundhung]

Fixes DEVX-2646.

Remote bindings in the v2 Vite plugin should use cf credentials, but they only did when Vite was started by cf dev. @cloudflare/remote-bindings picks the cf credential store only when CLOUDFLARE_CF_AUTH is set, and only cf dev sets it. So running vite dev or vite preview directly used Wrangler's credentials.

The plugin now passes its own cf auth hook to maybeStartOrUpdateRemoteProxySession() for both dev and preview. The hook resolves the cf profile from the project root and forwards the configured account ID. It reuses the plugin's existing cf auth setup (already used for tunnels). @cloudflare/remote-bindings is unchanged.

Hooks are cached per project root and account ID. maybeStartOrUpdateRemoteProxySession() restarts the session whenever it receives a different hook, and the plugin recomputes its Miniflare options several times per server (start, export type changes, restarts). Credentials are only resolved when a session first needs them.

The directory-bound profile e2e test now seeds a cf profile instead of a Wrangler one.

The Vitest plugin counterpart is #16424: its cloudflare.config.ts path gets the same cf auth hook. This PR should merge first.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this is a bug fix in the v2 beta with no new options. The changeset describes the credential change.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9b2f41c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ask-bonk]

LGTM!

github run

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@16428

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@16428

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@16428

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@16428

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@16428

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@16428

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@16428

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@16428

miniflare

npm i https://pkg.pr.new/miniflare@16428

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@16428

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@16428

@cloudflare/runtime-types

npm i https://pkg.pr.new/@cloudflare/runtime-types@16428

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@16428

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16428

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@16428

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@16428

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@16428

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@16428

wrangler

npm i https://pkg.pr.new/wrangler@16428

commit: 9b2f41c

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/vite-plugin-remote-bindings-cf-auth.md: [@cloudflare/wrangler]
• packages/vite-plugin-cloudflare/e2e/remote-bindings.test.ts: [@cloudflare/wrangler]
• packages/vite-plugin-cloudflare/src/tests/auth.spec.ts: [@cloudflare/wrangler]
• packages/vite-plugin-cloudflare/src/auth.ts: [@cloudflare/wrangler]
• packages/vite-plugin-cloudflare/src/context.ts: [@cloudflare/wrangler]
• packages/vite-plugin-cloudflare/src/miniflare-options.ts: [@cloudflare/wrangler]

[clanky-the-clanker]

💬 Approved with comments — The change does what it claims: remote bindings use cf credentials in both vite dev and vite preview, and the hooks are cached so proxy sessions don't restart for no reason. The only finding is an INFO note about the cached hook keeping the first server's logger.

Findings: 1 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #16428.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## INFO (1)

### [Code Quality] The cached remote-bindings auth hook keeps the logger and CloudflareAuth from the first Vite server, and a new logger passed after a restart is ignored. The impact is low.
- **File:** packages/vite-plugin-cloudflare/src/auth.ts:96

---

📋 Code Quality: 💬 1 info

The change is sound. One note: the cached auth hook keeps the logger from the first Vite server.

Recommendation: 💬 Optional Nits

• [INFO] The cached remote-bindings auth hook keeps the logger and CloudflareAuth from the first Vite server, and a new logger passed after a restart is ignored. The impact is low. (packages/vite-plugin-cloudflare/src/auth.ts:96)

View full review

• packages/vite-plugin-cloudflare/src/auth.ts:86-108 and src/miniflare-options.ts:531-536: the hook cache lives in the shared context, so it survives Vite dev-server restarts.
  • Each cached closure keeps the logger from the first call that created it. It also memoizes the CloudflareAuth instance built with that logger.
  • After a restart, the new logger passed to getRemoteBindingsAuth is ignored, because the cache key is only [profileDir, accountId].
  • Auth prompts and messages can therefore go through the previous server's logger. The cf profile is also not re-resolved until the process restarts.
  • The impact is low, and caching is needed to avoid session restarts. Possible fixes: keep a mutable current logger in the cache entry, or document that the first logger wins.

These checks found no problems:

• The cache key matches how maybeStartOrUpdateRemoteProxySession compares hooks, which is by reference.
• Dev and preview share the same cache.
• The unit test covers caching and the forwarding of profile and account.
• The e2e test now seeds a cf profile.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

No security concerns. Credentials are resolved through the existing cf auth flow, keyed by project root and account ID.

---

📖 AGENTS.md: ✅ LGTM

No AGENTS.md updates needed.

---

⚡ Performance: ✅ LGTM

No performance concerns. Credentials are resolved only when a session first needs them.

---

📝 Documentation: ✅ LGTM

The changeset describes the credential change, and the new function has JSDoc.

---

_{Reviewed commit: 9b2f41c4}