[irvinebroque]

Merge prerequisite: cloudflare/workers-sdk#16588 must land and be released, then replace the commit-pinned @cloudflare/autoconfig preview with that release and remove the two preview-only shared-package overrides in pnpm-workspace.yaml. The published 0.8.3 package does not contain Vite+ command detection; this PR currently uses the verified preview from workers-sdk commit 147a75ae1bc58b81206dee52d4c795ff2a5686cd.

cf init now creates Worker projects with Vite+ installed locally and these scripts:

{
  "dev": "cf dev",
  "build": "cf build",
  "deploy": "cf deploy",
  "check": "cf workers types && vp check",
  "format": "vp fmt",
  "test": "vp test",
  "typecheck": "cf workers types && vp check --no-fmt --no-lint"
}

check covers formatting, type-aware linting, and type checking. The starter includes a Workers-runtime test that checks for HTTP 200 and Hello World! using the configured binding.

Vite+ command detection is provided by @cloudflare/autoconfig, which selects vp dev / vp build while preserving framework and custom scripts. Package-manager overrides keep plugins on matching Vite and Vitest versions with npm, pnpm, Yarn, and Bun. Yarn starters include .yarnrc.yml with nodeLinker: node-modules, as required by Vite+. Vinext command overrides also select vp when the project declares Vite+.

Validation: the full root pnpm check and 80 focused tests pass, including command detection against the installed autoconfig preview and vinext projects with and without Vite+.

Related PRs

Landing order:

1. [autoconfig] Use Vite+ commands for Vite+ projects workers-sdk#16588 — merge first, then publish the @cloudflare/autoconfig release containing Vite+ command detection.
2. feat(init): use Vite+ for new Worker projects #446 — update @cloudflare/autoconfig to that published release, then merge and publish cf.
3. [cf] Document Vite+ project defaults cloudflare-docs#34741 — land after the cf release is available, so the documented cf init defaults match the released CLI.

Independent: cloudflare/templates#1176 can land at any point. Its starters invoke Vite+ directly and do not depend on the autoconfig change or a new cf release.

[pkg-pr-new]

npm i https://pkg.pr.new/cf@446

commit: f2a7307

[github-actions]

cf --help startup

	mean	stddev	min	max
PR	224.0 ms	3.4 ms	217.0 ms	231.9 ms
base	223.5 ms	3.8 ms	215.5 ms	230.0 ms

Δ (PR vs base): — +0.4 ms (+0.2%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

[ask-bonk]

LGTM

github run

[ask-bonk]

LGTM!

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

@irvinebroque Bonk workflow was cancelled.

View workflow run · To retry, trigger Bonk again.

[ask-bonk]

Review: 1 findings.

Posted 1 inline finding.

github run

[ask-bonk]

No new concerns since the last review

github run

[clanky-the-clanker]

💬 Approved with comments — No new issues in the pin bump. Two INFO notes remain open: replace the autoconfig preview before publishing, as the description already says, and update a stale comment in vinext.ts.

Findings: 2 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

🚀 Release: 💬 1 info

The autoconfig release prerequisite is still open

Recommendation: 💬 Optional Nits

• [INFO] Merge prerequisite still open: replace the pkg.pr.new @cloudflare/autoconfig preview with its published release, and remove the two overrides in pnpm-workspace.yaml that only the preview needs, before publishing cf. (packages/cli/package.json:83)

View full review

Risk: Medium. The "cf": minor changeset fits a pre-1.0 behaviour change.

packages/cli/package.json:83 still points to the pkg.pr.new preview of @cloudflare/autoconfig (now commit 147a75a). pnpm-workspace.yaml still has the two overrides that only the preview needs. Because of those overrides, the lockfile holds two versions of @cloudflare/workers-utils. Once the autoconfig release with Vite+ detection is published, replace the URL and remove both overrides together, before publishing cf.

---

📝 Documentation: 💬 1 info

One code comment in vinext.ts is still out of date

Recommendation: 💬 Optional Nits

• [INFO] The comment still says vinext projects run vite dev/vite build. Projects that declare Vite+ now get vp dev/vp build, so the comment should cover both cases. (packages/cli/src/lib/vinext.ts:2)

View full review

• packages/cli/src/lib/vinext.ts:1-2 still says vinext projects run vite dev / vite build. getVinextCommand now returns vp when vite-plus is declared in dependencies or devDependencies. Update the comment to cover both cases.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

The preview @cloudflare/autoconfig tarball is pinned to a commit and has an integrity hash in pnpm-lock.yaml. The template and vinext changes use only fixed version strings and take no user-controlled input. The workspace overrides are scoped to @cloudflare/autoconfig and point to published versions.

---

📖 AGENTS.md: ✅ LGTM

No AGENTS.md concerns.

---

📋 Code Quality: ✅ LGTM

• packages/cli/package.json now pins the preview built from workers-sdk commit 147a75a. In pnpm-lock.yaml the specifier and the resolved version both use that URL, and the entry has a sha512 integrity hash, so the pin and the lockfile agree.
• packages/cli/src/__tests__/lib/autoconfig-vite-plus.test.ts runs analyzeProject against the installed package. If the pin goes back to a build without Vite+ detection, this test will fail.

---

⚡ Performance: ✅ LGTM

No performance concerns.

---

_{Reviewed commit: 8e801ab4}