[petebacondarwin]

Backports the independently useful Vite plugin v1 effect of #16525. Stacked on #16580, which already supplies the published Miniflare 5.20261023.3-beta / Wrangler 4.156.0 runtime and coupled helper upgrades.

V1 calls the retained remote-bindings package during development for configured remote bindings. Its getRemoteBindingsAuthHook calls requireAuth on the selected Wrangler/CF auth implementation; an interactive missing/expired session can reach the shared browser OAuth callback server. An unrelated error callback currently ends that pending login, and provider error text can inject terminal control characters into the logger. workers-auth 0.15.4 supplies state validation for every callback, keeps the matching login available, and escapes control characters. This is an actual Vite remote-binding login path, rather than an installed Wrangler CLI behavior.

Update only the retained consumer's pinned @cloudflare/workers-auth version from 0.15.1 to intended 0.15.4, and add one plugin patch changeset. The existing runtime/helper pins stay in #16580. Private workspace packages and references stay intact; no public auth source, callback tests, Wrangler CLI tests, or fixtures are copied into V1.

Publication blocker: npm's exact 0.15.4 endpoint returns HTTP 404. The still-open Version Packages #16598 records that intended version and includes #16525; it is not a merged release trigger. The genuine published parent's lockfile is byte-identical in this draft. No resolution or integrity metadata is fabricated, and this draft cannot pass a frozen install until publication. Reuse this PR after npm publication, regenerate the lockfile, then run frozen install, build/types, retained remote-bindings/plugin suites and an appropriate plugin authentication smoke before marking ready. The intended dependency is not installed or validated here.

Static validation: inspected the original implementation/reviews, target manifests, retained call chain and effective stack; changeset validator and diff checks pass. The published #16580 parent passes all 58 check tasks and 8 retained test tasks (237 plugin tests), plus signed S3 dev/preview API checks. Those results validate the parent, not workers-auth 0.15.4. The additional cf token-management scope in #16557 is not a V1 feature and does not justify a separate backport.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows: verified the V1 remote-binding login call chain and exact npm 404; runtime validation is blocked on publication and listed above.
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: the plugin patch changeset describes the inherited OAuth fix; no new public API is introduced.

Note

This is a contribution from an AI agent: Codex, under the authorized v1 backport automation.

[changeset-bot]

🦋 Changeset detected

Latest commit: 14e69f6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@petebacondarwin (verified original author): please check this v1 backport of #16525 and approve it if it looks good. V1's retained remote-bindings auth hook can start the affected browser OAuth login. This draft pins intended workers-auth 0.15.4 atop #16580's runtime, without copying public auth source/tests; npm publication and the lockfile/install/build/types/plugin validation follow-up remain blockers. The original's human approval is from a reviewer outside the verified ant-core membership list, so I could not verify a qualifying human ant-core approver and have requested only the verified author's review.