refactor(rivetkit): move devtools to local script

[jog1t]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[railway-app]

🚅 Deployed to the rivet-pr-4669 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
website	😴 Sleeping (View Logs)	Web	Apr 15, 2026 at 6:48 pm
frontend-cloud	😴 Sleeping (View Logs)	Web	Apr 15, 2026 at 6:47 pm
frontend-inspector	😴 Sleeping (View Logs)	Web	Apr 15, 2026 at 6:46 pm
mcp-hub	✅ Success (View Logs)	Web	Apr 15, 2026 at 6:38 pm
kitchen-sink	❌ Build Failed (View Logs)	Web	Apr 15, 2026 at 6:38 pm
ladle	❌ Build Failed (View Logs)	Web	Apr 15, 2026 at 6:38 pm

[jog1t]

• refactor: inspector tabs bundled with actor #4670
• refactor(rivetkit): move devtools to local script #4669 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Preview packages published to npm

Install with:

npm install rivetkit@pr-4669

All packages published as 0.0.0-pr.4669.7c31bd8 with tag pr-4669.

Engine binary is shipped via @rivetkit/engine-cli on linux-x64-musl, linux-arm64-musl, darwin-x64, and darwin-arm64. Windows users should use the release installer or set RIVET_ENGINE_BINARY.

Docker images:

docker pull rivetdev/engine:slim-7c31bd8
docker pull rivetdev/engine:full-7c31bd8

Individual packages

npm install rivetkit@pr-4669
npm install @rivetkit/react@pr-4669
npm install @rivetkit/rivetkit-native@pr-4669
npm install @rivetkit/sqlite-wasm@pr-4669
npm install @rivetkit/workflow-engine@pr-4669

[claude]

Code Review: refactor(rivetkit): move devtools to local script

Overview

This PR moves devtools from being loaded from the external CDN (releases.rivet.dev) to being self-hosted and served directly from the rivetkit manager. It also splits the engine guard onto an internal port (6423) so the manager can own port 6420 and serve devtools/inspector from a single origin. Solid architectural improvement.

---

Issues

1. Devtools endpoint not gated (runtime-router/router.ts:472)

The new /devtools/mod.js route is always accessible, while the inspector is gated by config.inspector.enabled (which defaults to dev-only). This inconsistency means devtools JS will be served in production even though devtools injection is a dev-only concern. Consider gating it inside the existing if (config.inspector.enabled) block alongside the /ui routes.

2. Removed biome-ignore suppression (devtools-loader/index.ts:6)

The biome-ignore lint/style/noVar comment was removed from the declare global block. If Biome still flags var in declare global, this will break linting. Please verify CI lint passes.

3. notGlobal: false without explanation (drivers/engine/actor-driver.ts:186)

Explicitly setting a field to its presumed default is unusual. A short comment explaining why this needs to be set explicitly would help reviewers.

---

Suggestions

4. Path resolution fragility (devtools-loader/serve-devtools.ts)

The path ../../dist/devtools/mod.js relative to import.meta.url assumes a specific output directory structure after tsup compilation. If turbo output layout changes, this silently breaks with a "bundle not found" error. Consider documenting this assumption inline.

5. Trailing blank line in publish.yaml (~line 467)

After removing the R2 upload step, a blank line remains. Minor cleanup.

---

Positive Changes

• Self-hosting devtools removes the external CDN dependency: better for offline dev, security, and reduced latency.
• Port separation (6420 for manager, 6423 for engine guard) is clean architecture. A single endpoint now serves inspector, devtools, and actor API.
• Error messages now use the port constant instead of hardcoded strings.
• macOS linker flags (dynamic_lookup) correctly added for both Apple Silicon and x86, with a clear comment explaining why tokio_unstable must be repeated in target-specific blocks.
• turbo.json dependency chain is correct.