Repository navigation
Cloudflare: clear error for a missing __VARLOCK_ENV binding, redact RSC dev console replay, vinext guide - #1236
Merged
Merged
Conversation
React's dev-only react-server-dom server build wraps every console method when it loads and serializes the original call args into the RSC flight stream. It loads after the varlock init module, so its wrapper sat outside ours and saw raw values: logging a sensitive item in a Server Component put the secret into the inlined flight payload, where response leak detection caught it and truncated the page. Re-patch the console right after that module evaluates, so our redacting wrapper is on the outside again, matching what the Next.js integration does in every server file. In dev the body lives in a lazily invoked factory in a shared pre-bundled chunk, so the dep entry that calls it is matched too. Also document using varlockCloudflareVitePlugin with vinext.
Running the build output under plain wrangler dev, or deploying it with plain wrangler deploy or a tool that drives wrangler itself (vinext-cloudflare deploy), leaves the Worker without the binding. It then died in initVarlockEnv with advice (auto-load, varlock run) that cannot apply inside workerd. The injected entry code now throws a Cloudflare-specific error pointing at varlock-wrangler dev / deploy with the same --config. Docs: vinext start/deploy script swap and a troubleshooting entry. Closes #1234
Setup with varlockCloudflareVitePlugin, the start/deploy script swap to varlock-wrangler against dist/server/wrangler.json, why vinext-cloudflare deploy cannot be used, and the boot errors to expect. Cloudflare and Next.js pages link to it.
Contributor
|
The changes in this PR will be included in the next version bump.
|
varlock
@varlock/astro-integration
@varlock/cloudflare-integration
@varlock/nuxt-integration
@varlock/vite-integration
@varlock/native-helper-darwin
@varlock/native-helper-linux-arm64
@varlock/native-helper-linux-x64
@varlock/native-helper-win32-x64
commit: |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | beca468 | Commit Preview URL Branch Preview URL |
Oct 19 2026, 05:21 AM |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Important
The RSC re-patch still runs too early in a shared lazy-factory optimizer topology, leaving the dev console replay fix incomplete.
Reviewed changes: Reviewed the Cloudflare startup diagnostic, Vite RSC console re-patching, associated tests, and vinext documentation.
- Worker startup: Missing runtime bindings now produce actionable
varlock-wranglerguidance. - RSC console replay: SSR init exposes a global console patch, and matching React dev modules receive an appended re-patch.
- Vinext setup: A new guide covers the legacy Wrangler integration, script replacements, env access, and troubleshooting.
- Verification: Integration builds passed, along with all 18 Vite and 50 Cloudflare unit tests; a full vinext request and website build were not run.
gpt-6.1-sol ｜ 𝕏
Review caught a topology the previous placement missed: when another optimized dependency also requires server.edge, the dep optimizer moves the require_server_edge factory into a shared chunk. That chunk matched and ran the appended re-patch while only defining the factory, and the facade that later calls it did not match, so React's wrapper went back outside ours. Insert the re-patch right after the statement that installs React's wrapper instead. It then runs whenever that body executes, whatever chunk or lazy factory it lives in. The tests now evaluate the transformed code and assert the replay wrapper receives redacted args, in both the direct and the shared-factory shapes.
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the console replay ordering fix and regression tests added since the prior review.
- Moved the re-patch: Inserted console redaction immediately after React installs its replay wrapper, inside the module body so shared lazy factories preserve the correct execution order.
- Added execution coverage: Verified replay receives redacted arguments after both direct module evaluation and a delayed shared-factory invocation.
- Verified the update: Built the Vite integration and its prerequisites; all 19 Vite tests passed. A full vinext request was not exercised.
gpt-6.1-sol ｜ 𝕏
cf CLI support is coming, so naming varlock-wrangler in a string baked into every bundle would go stale on installed versions. The error now says the build output must be run and deployed through varlock's wrappers and links a stable troubleshooting anchor, where the per-tool commands live.
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the startup diagnostic and documentation changes since the prior Pullfrog review.
- Generalized the diagnostic: Replaced hardcoded wrapper commands with tool-agnostic guidance and a link to the Cloudflare documentation page.
- Updated troubleshooting: Kept concrete
varlock-wranglercommands in the docs, clarified the unsupportedcfCLI, and removed the heading-specific link. - Verified the diagnostic: Passed all five Cloudflare binding-loader tests. A website build and full vinext request were not run.
gpt-6.1-sol ｜ 𝕏
The RSC console replay re-patch looks for globalThis.__varlockPatchConsole, which the init module only set on the init-only/resolved-env path. With ssrInjectMode: 'auto-load' the re-patch was a no-op, leaving React's replay wrapper outside varlock's redaction as before.
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the auto-load console re-patch exposure added since the prior Pullfrog review.
- Exposed the re-patch function: Added
globalThis.__varlockPatchConsoleinauto-loadmode so the RSC transform can restore outer console redaction after React installs its replay wrapper. - Extended mode coverage: Checked global exposure for both ordinary and preserved side-effect imports. The Vite integration and its prerequisites built successfully, and all 19 Vite tests passed; generated
auto-loadmodule execution and a full vinext request were not exercised.
gpt-6.1-sol ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fallout from #1234 (vinext +
@varlock/cloudflare-integration) and from building a vinext example.Missing
__VARLOCK_ENVbinding now fails with a usable messageThe built Worker only gets its env from the
__VARLOCK_ENVbinding. Running the build output under plainwrangler dev, or deploying it with plainwrangler deployor a tool that drives wrangler itself (vinext-cloudflare deploy), leaves it out, and the Worker died ininitVarlockEnvwith advice (auto-load,varlock run) that cannot apply inside workerd. The injected Cloudflare entry code now throws a specific error: run and deploy the build output through varlock's wrappers, with a link to the Cloudflare docs page, whose troubleshooting entry lists the commands. The string stays tool-agnostic on purpose, sincecfCLI support is coming and bundles already installed cannot be updated; the docs can. Verified on the issue's repro: stockwrangler devshows the new error,varlock-wrangler dev --config dist/server/wrangler.jsonserves the page.Fixes #1234
Secrets logged in Server Components leaked into the dev RSC payload
React's dev-only
react-server-dom-*-server.*.development.jswraps every console method when it loads and serializes the original call args into the flight stream (so server logs show in browser devtools). It loads after the varlock init module, so its wrapper sat outside our redacting one:console.log(ENV.SECRET)in a Server Component put the raw value into the inlined RSC payload, response leak detection then caught it and truncated the page (1.4KB instead of 15KB under vinext dev).The vite integration's transform now inserts a console re-patch right after the statement that installs React's wrapper, inside React's module body, putting our wrapper back on the outside, the same thing the Next.js integration already does via its loader. Placing it inside the body (not at the end of the module) matters in dev, where the dep optimizer wraps the body in a lazy
require_*factory in a shared chunk that only runs when some entry calls it. The init module exposesglobalThis.__varlockPatchConsole, matching the init-server/init-edge bundles. Tests evaluate the transformed code and check the replay wrapper gets redacted args, in the direct and shared-factory shapes.Docs
/integrations/vinext/guide: setup, thestart/deployscript swap, whyvinext-cloudflare deploycannot be used, boot errors; listed in the sidebar and the integrations overviewExample project: dmno-dev/varlock-examples
integrations/vinext(separate PR).