Merge remote-tracking branch 'origin/main' into fix/webcontainer-dock-and-auth

Author: antfubot

docs/content/1.guide/15.agent-native.md

@@ -96,7 +96,7 @@ ctx.agent.registerResource({
 })
 ```
 
-Every `ctx.rpc.sharedState` key is exposed as a `devframe://state/<key>` resource and via the **`devframe:state:read` tool** (wire `devframe_state_read`): no args → key list, `key` → its value. `exposeSharedState: false` (or a filter) on `createMcpServer` opts out.
+Every `ctx.rpc.sharedState` key is exposed as a `devframe://state/<key>` resource and via the **`devframe:state:read` tool** (wire `devframe_state_read`): no args → key list, `key` → its value. `exposeSharedState: false` (or a filter) on `createMcpServer`, or inside the `mcp` route options of the dev server and the hub, opts out.
 
 ## Starting the MCP server
 

docs/content/1.guide/18.hub-initiate.md

@@ -89,7 +89,7 @@ Registrations are validated fail-fast: one module per type (`DF8108`), an existi
 
 The hub's **single Auth** is one gate at the shared transport for every mounted devframe, built-ins, and the MCP route; one handshake (OTP, magic link, or pre-shared token) unlocks the namespace; `auth: false` disables it for localhost.
 
-The aggregate MCP route mounts through the `'auto'` default once any mounted devframe (or an agent-flagged hub command) exposes agent tools; `mcp: true` forces it on, `mcp: false` off. It has its own origin gate, independent of this RPC Auth: the mounted route trusts same-machine callers, and `mcp: { authorization }` adds an identity check when the hub is reachable beyond loopback. The hub exposes one aggregate route over every mounted devframe's tools.
+The aggregate MCP route mounts through the `'auto'` default once any mounted devframe (or an agent-flagged hub command) exposes agent tools; `mcp: true` forces it on, `mcp: false` off. It has its own origin gate, independent of this RPC Auth: the mounted route trusts same-machine callers, and `mcp: { authorization }` adds an identity check when the hub is reachable beyond loopback. `mcp: { exposeSharedState }` takes `false` or a `(key) => boolean` filter to choose which shared-state keys agents can read through `devframe_state_read` and `devframe://state/<key>`. The hub exposes one aggregate route over every mounted devframe's tools.
 
 ## Singular vs hub mounting
 

docs/content/2.adapters/7.mcp.md

@@ -59,6 +59,16 @@ A request presents the bearer as `Authorization: Bearer <token>`, matched in con
 
 Never place the token in a URL, in `__connection.json`, in the instance registry, in logs, or on the command line; it belongs only in configuration and the `Authorization` header.
 
+### Choosing which shared state agents see
+
+Every shared-state key is exposed to agents by default, through the `devframe_state_read` tool and the `devframe://state/<key>` resources. `exposeSharedState` on the route options narrows that to the keys a filter accepts, or turns it off with `false`. The UI keeps using the same states over RPC.
+
+```ts
+devframeViteBridge(myDevframe, {
+  mcp: { exposeSharedState: key => !key.startsWith('my-tool:private:') },
+})
+```
+
 ### Hosted bridges
 
 Both bridges forward the setting to their side-car dev server, advertising the mounted endpoint in `__connection.json`:

docs/content/4.ecosystem.md

@@ -81,6 +81,12 @@ packages:
     category: Hosts
     image: /images/ecosystem/logos/nuxt-devtools.svg
     color: "#00dc82"
+  - name: Vue DevTools
+    description: Devtools for debugging Vue.js applications
+    author: vuejs
+    repo: vuejs/devtools
+    category: Devframes
+    image: /images/ecosystem/logos/vue-devtools.svg
   - name: "@devframes/plugin-data-inspector"
     description: Queries live server objects with jora
     author: devframes
@@ -135,7 +141,7 @@ packages:
     author: devframes
     url: /add-ons/devframes/assets
     category: Devframes
-    icon: i-ph:images-duotone
+    icon: i-ph:folder-notch-open-duotone
     official: true
   - name: "@devframes/plugin-messages"
     description: Browses, filters and dismisses the hub message feed

docs/content/5.add-ons/1.devframes/8.assets.md

@@ -1,7 +1,7 @@
 ---
 title: 'Assets'
 navigation:
-  icon: i-ph:image-square-duotone
+  icon: i-ph:folder-notch-open-duotone
 description: 'Browse, preview, and manage files in a directory, porting Nuxt DevTools'' Assets tab.'
 ---
 

docs/nuxt.config.ts

@@ -31,9 +31,14 @@ export default defineNuxtConfig({
     },
   },
 
+  // Nuxt DevTools v4 imports the workspace `devframe`, which is unbuilt in
+  // `docs:build` (Vercel), so keep it dev-only.
+  devtools: { enabled: false },
+
   // Dev only: mount the devframes into Nuxt DevTools. The imports are lazy,
   // so `docs:build` needs no built workspace packages.
   $development: {
+    devtools: { enabled: true },
     // DevTools v4 sets `noExternals` to an array when it is unset. Nitro 2 reads
     // any truthy value as "inline everything" and fails on `playwright-core`.
     nitro: { noExternals: false },

docs/package.json

@@ -28,6 +28,7 @@
     "@devframes/plugin-og": "workspace:*",
     "@nuxt/devtools-kit": "catalog:docs",
     "@types/d3-shape": "catalog:types",
-    "devframe": "workspace:*"
+    "devframe": "workspace:*",
+    "satori": "catalog:docs"
   }
 }