donotmerge: dummy inspector api

[abcxff]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[railway-app]

🚅 Deployed to the rivet-pr-5085 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
frontend-cloud	😴 Sleeping (View Logs)	Web	Jun 5, 2026 at 3:30 pm
kitchen-sink	❌ Build Failed (View Logs)	Web	Jun 5, 2026 at 3:21 pm
frontend-inspector	❌ Build Failed (View Logs)	Web	Jun 5, 2026 at 3:20 pm
website	😴 Sleeping (View Logs)	Web	Jun 3, 2026 at 5:12 am
ladle	✅ Success (View Logs)	Web	May 21, 2026 at 12:39 am
mcp-hub	✅ Success (View Logs)	Web	May 21, 2026 at 12:35 am

[abcxff]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• donotmerge: dummy inspector api #5085 👈 (View in Graphite)
• donotmerge: insert and clear actor queue #5065
• feat(workflow-engine): add retryOnTimeout opt-in for step timeout retries #5089 : 1 other dependent PR (#5125 )
• fix(rivetkit): wire CancellationToken through waitForNamesAvailable to eliminate KV busy-polling #5063 : 1 other dependent PR (#5050 )
• fix(rivetkit): fix BigInt serialization in inspector workflow history and state deserialization #5058
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

Code Review: /inspector/eval endpoint

Note: This is a donotmerge draft PR, so some incompleteness is expected.

Overview

Adds POST /inspector/eval to the native actor inspector. Accepts { code: string }, evaluates it via the AsyncFunction constructor, and exposes ctx, kv, rawKv, sql, db, state, queue, schedule, conns, and log as named parameters. The endpoint is gated by actorVerifyInspectorAuth.

---

Issues

1. Missing WebSocket inspector parity

docs-internal/engine/inspector-protocol.md requires HTTP inspector endpoints to mirror the WebSocket inspector. This endpoint has no corresponding WS message type. Either add a matching eval message type or document why this endpoint is HTTP-only.

2. logs dropped on non-Error throws

In the inner catch block, if user code throws a RivetError or any non-Error value, errorResponse(error) runs and the accumulated logs array is silently discarded. The non-Error branch should also include logs in the response body.

3. actorCtx.db via bare try/catch violates the Fail-By-Default rule

Silently swallowing the db access error hides misconfiguration. The hasDatabase/databaseProvider flag is already computed earlier in the factory. Use databaseProvider !== undefined ? actorCtx.db : undefined directly instead of catching the throw.

4. No tests

The inspector protocol reference requires corresponding tests in rivetkit-typescript/packages/rivetkit/tests/. None are present.

5. No documentation updates

Per docs-internal/engine/inspector-protocol.md, new inspector endpoints must update website/src/metadata/skill-base-rivetkit.md and website/src/content/docs/actors/debugging.mdx. Neither has been touched.

---

Minor

• The inline rawKv object duplicates the KV surface. Consider extracting it if future endpoints also need it.
• The Biome suppression comment (biome-ignore lint/security/noGlobalEval) is correct and sufficient.
• The outer finally block (actorCtx.dispose()) covers all return paths correctly.

---

Summary

The core approach (AsyncFunction constructor, auth gating, log capture) is sound for an admin eval endpoint. Blocking items before landing: fix logs-lost bug in the non-Error catch branch, replace try/catch db access with the databaseProvider flag, add tests, update docs, and address WS inspector parity.