Skip to content

feat(proxy): add proxy.origin for a separate client-facing proxy origin - #973

Merged
harlan-zw merged 1 commit into
nuxt:mainfrom
felixgabler:feat/proxy-origin
Oct 27, 2026
Merged

harlan-zw merged 1 commit into
nuxt:mainfrom
felixgabler:feat/proxy-origin

Conversation

@felixgabler

Copy link
Copy Markdown
Contributor

Fixes #972

The first-party proxy builds every client-facing URL from location.origin: the intercept plugin, bundle rewrites (self.location.origin+...) and the GA proxyEndpoints. The proxy therefore cannot live on another host, for example a tracking subdomain that points at the same deployment.

This adds an optional proxy.origin. When it is set, the module resolves a client prefix new URL(proxyPrefix, origin).href and hands it to every client-facing consumer. AST rewrites drop the self.location.origin+ prefix when the rewrite target is already absolute. The intercept plugin builds proxied URLs with new URL(..., location.origin) and leaves URLs that already point at the proxy unchanged.

The server handler route, the server-side proxy config, bundled assets and devtools keep the relative prefix, so nothing changes when origin is unset.

Consumer Prefix
Intercept plugin proxyUrl client (origin when set)
Bundle AST rewrites client
Auto-injected registry endpoints (applyAutoInject) client
GA proxyEndpoints.googleAnalytics client
Partytown resolveUrl client
Server handler route <prefix>/p/** relative
runtimeConfig['nuxt-scripts-proxy'].proxyPrefix relative
Bundled assets (buildAssetUrl) relative
Devtools data relative

Tests: AST rewrite cases for absolute and relative targets, intercept proxyUrl runtime cases, and the proxy-alias fixture now sets origin to assert the absolute GA and Plausible endpoints while the relative server route still answers.

`proxy.origin` resolves the client proxy prefix against another host, so the
intercept plugin, bundle rewrites, auto-injected endpoints, the GA proxy
endpoint and Partytown `resolveUrl` emit `https://<origin>/_scripts/p/...`.
The server route, server proxy config, bundled assets and devtools keep the
relative prefix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@vercel

vercel Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

@felixgabler is attempting to deploy a commit to the Nuxt Team on Vercel.

A member of the Team first needs to authorize it.

@pkg-pr-new

pkg-pr-new Bot commented Oct 26, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts-devtools@973
npm i https://pkg.pr.new/@nuxt/scripts@973

commit: 1c8144a

@coderabbitai

coderabbitai Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 9e5052bb-f8b7-4cf7-9c1a-90d40724e6b3
Commits

Reviewing files that changed from the base of the PR and between 321e757 and 1c8144a.

Files selected for processing: 11
  • docs/content/docs/1.guides/2.first-party.md
  • docs/content/docs/3.api/5.nuxt-config.md
  • packages/script/src/module.ts
  • packages/script/src/plugins/intercept.ts
  • packages/script/src/plugins/rewrite-ast.ts
  • test/e2e/proxy-alias.test.ts
  • test/fixtures/proxy-alias/app.vue
  • test/fixtures/proxy-alias/nuxt.config.ts
  • test/unit/bundle-sdk-patches.test.ts
  • test/unit/proxy-alias-generators.test.ts
  • test/unit/rewrite-ast.test.ts
Files with no reviewable changes: 1
  • test/unit/bundle-sdk-patches.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Walkthrough

The proxy configuration adds an optional origin for client-facing proxy URLs. The module uses it for generated endpoints, request interception, Partytown and bundle rewrites; server routes and bundled assets retain relative paths. Interception avoids rewriting URLs that already use the proxy base. AST rewrites add the page origin only to relative targets. Documentation and tests cover the option and URL behaviour.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: Minimal · up to 1c814

The separate proxy origin appears mergeable after normal checks; no unresolved issue was established.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 7 files. (3 skipped: 3… Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title clearly and concisely identifies the main change: adding proxy.origin for a separate client-facing proxy origin.
Description check Passed The description directly explains the proxy.origin behaviour, affected client-facing consumers, unchanged server-side behaviour, and test coverage.
Linked Issues check Passed Issue #972 requires optional proxy.origin support for client-facing proxy URLs, including the intercept plugin, bundle rewrites, proxyEndpoints, applyAutoInject, and Partytown. The PR summary re…
Out of Scope Changes check Passed The changes stay within issue #972. The implementation adds the requested proxy-origin behaviour. The documentation describes the new option and its cross-origin requirement. The fixture and unit test…
Full details: Linked Issues check

Explanation

Issue #972 requires optional proxy.origin support for client-facing proxy URLs, including the intercept plugin, bundle rewrites, proxyEndpoints, applyAutoInject, and Partytown. The PR summary reports origin?: string, client-prefix resolution, absolute-target handling in AST rewrites, and the intercept guard for already-proxied URLs. It also reports that server routes, the private proxy prefix, bundled assets, and devtools remain relative. The added tests cover absolute and relative rewrites, intercept runtime cases, and absolute GA and Plausible endpoints with the relative route still active.

Full details: Out of Scope Changes check

Explanation

The changes stay within issue #972. The implementation adds the requested proxy-origin behaviour. The documentation describes the new option and its cross-origin requirement. The fixture and unit tests verify the requested client and server URL behaviour. No unrelated product or infrastructure changes are identified.

Full details: Docstring Coverage

Explanation

Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 7 files. (3 skipped: 3 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown

📦 Package Size

⚠️ 2 size metrics grew

📚 22 runtime dependencies (no change)

Package output Gzipped Δ
@nuxt/scripts · export . 26 kB → 26 kB 🔴 +155 B (+0.6%)
@nuxt/scripts · published payload 223 kB → 223 kB 🔴 +155 B (+0.1%)
All tracked output (25)
Package output Gzipped Raw
@nuxt/scripts-cli · runtime dependencies 72 kB 355 kB ✅
@nuxt/scripts-cli · dependency magicast 72 kB 355 kB ✅
@nuxt/scripts-cli · export . 3.4 kB 12 kB ✅
@nuxt/scripts-cli · published payload 3.4 kB 12 kB ✅
@nuxt/scripts · runtime dependencies 543 kB 2.40 MB ✅
@nuxt/scripts · dependency @oxc-project/types 0 B 0 B ✅
@nuxt/scripts · dependency @vueuse/core 178 kB 720 kB ✅
@nuxt/scripts · dependency @vueuse/shared 39 kB 152 kB ✅
@nuxt/scripts · dependency lru-cache 141 kB 623 kB ✅
@nuxt/scripts · dependency semver 25 kB 72 kB ✅
@nuxt/scripts · dependency sirv 8.8 kB 21 kB ✅
@nuxt/scripts · dependency unstorage 70 kB 225 kB ✅
@nuxt/scripts · dependency valibot 82 kB 590 kB ✅
@nuxt/scripts · dist/runtime 104 kB 306 kB ✅
@nuxt/scripts · export . 26 kB 107 kB 🔴
@nuxt/scripts · export ./registry 30 kB 94 kB ✅
@nuxt/scripts · export ./stats 13 kB 92 kB ✅
@nuxt/scripts · export ./types-source 49 kB 247 kB ✅
@nuxt/scripts · published payload 223 kB 847 kB 🔴
@nuxt/scripts · app runtime 176 B 658 B ✅
@nuxt/scripts · components runtime 2.5 kB 6.4 kB ✅
@nuxt/scripts · composables runtime 7.8 kB 26 kB ✅
@nuxt/scripts · registry runtime 46 kB 136 kB ✅
@nuxt/scripts · server runtime 30 kB 89 kB ✅
@nuxt/scripts · utils runtime 2.9 kB 8.1 kB ✅
Runtime dependencies (22)
Package Dependency Requested Resolved Cost
@nuxt/scripts-cli magicast ^0.5.5 0.5.5 📦 72 kB gzip
@nuxt/scripts-cli pathe ^2.0.3 2.0.3 ♻️ free via Nuxt 4.6.0
@nuxt/scripts @nuxt/kit ^4.6.0 4.6.0 ♻️ free via Nuxt 4.6.0
@nuxt/scripts @oxc-project/types ^0.153.0 0.153.0 📦 0 B gzip
@nuxt/scripts @vueuse/core ^15.0.0 15.0.0 📦 178 kB gzip
@nuxt/scripts @vueuse/shared ^15.0.0 15.0.0 📦 39 kB gzip
@nuxt/scripts consola ^3.4.2 3.4.2 ♻️ free via Nuxt 4.6.0
@nuxt/scripts defu ^6.1.7 6.1.7 ♻️ free via Nuxt 4.6.0
@nuxt/scripts lru-cache ^11.5.3 11.5.3 📦 141 kB gzip
@nuxt/scripts magic-string ^1.4.3 1.4.3 ♻️ free via Nuxt 4.6.0
@nuxt/scripts ofetch ^1.5.1 1.5.1 ♻️ free via Nuxt 4.6.0
@nuxt/scripts ohash ^2.0.12 2.0.12 ♻️ free via Nuxt 4.6.0
@nuxt/scripts oxc-walker ^1.1.1 1.1.1 ♻️ free via Nuxt 4.6.0
@nuxt/scripts pathe ^2.0.3 2.0.3 ♻️ free via Nuxt 4.6.0
@nuxt/scripts semver ^7.8.5 7.8.5 📦 25 kB gzip
@nuxt/scripts sirv ^3.0.2 3.0.2 📦 8.8 kB gzip
@nuxt/scripts std-env ^4.3.0 4.3.0 ♻️ free via Nuxt 4.6.0
@nuxt/scripts ufo ^1.6.4 1.6.4 ♻️ free via Nuxt 4.6.0
@nuxt/scripts ultrahtml ^1.7.0 1.7.0 ♻️ free via Nuxt 4.6.0
@nuxt/scripts unplugin ^3.4.0 3.4.0 ♻️ free via Nuxt 4.6.0
@nuxt/scripts unstorage ^1.17.5 1.17.5 📦 70 kB gzip
@nuxt/scripts valibot ^1.5.0 1.5.0 📦 82 kB gzip

Baseline: main_@_321e7574___2026-10-13 · gzip is the comparison metric · changes below 16 B gzip are ignored

@harlan-zw harlan-zw added harlan-agent-review Approve automated work for the current issue state or pull request head commit. harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. harlan-agent-running An Agent holds a Task on this issue or pull request right now. and removed harlan-agent-review Approve automated work for the current issue state or pull request head commit. labels Oct 27, 2026
@harlan-zw

harlan-zw commented Oct 27, 2026 •

Copy link
Copy Markdown
Collaborator

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-27 02:42 UTC.

GitHub merged this pull request.

  • Logged (78/100): Setting proxy.origin makes Rybbit bundling depend on the deployment already being live. View code Optional follow-up: Optional follow-up: distinguish auto-injected collection endpoints from explicit upstream analyticsHost values when resolving Rybbit's bundle source.
    • Ask an agent to verify and fix this finding

60df4be9-2b1b-424e-a6f0-ed6c558d57a2

Selected findings run after merge and open separate pull requests.

@harlan-zw harlan-zw added harlan-agent-ready The automated Review passed every gate on this head commit. and removed harlan-agent-running An Agent holds a Task on this issue or pull request right now. harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. labels Oct 27, 2026
@harlan-zw

Copy link
Copy Markdown
Collaborator

Awesome work, thanks 🙌

@harlan-zw
harlan-zw merged commit e2f9868 into nuxt:main Oct 27, 2026
11 of 12 checks passed
@harlan-zw harlan-zw removed the harlan-agent-ready The automated Review passed every gate on this head commit. label Oct 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

First-party proxy: option for a separate client-facing origin

2 participants