[miniflare] Restrict dev registry registration to user workers

[edmundhung]

Fixes #15035.

This replaces #10411 with a fresh implementation on current main.

Miniflare previously advertised every named worker in the dev registry. That includes internal workers started by the Cloudflare Vite plugin and any external helper workers sharing the Miniflare instance. This adds an opt-in unsafeRegisterWorker worker option and enables it only for user-worker paths in Wrangler, the Vite plugin, and platform proxy.

The dev registry, cross-process queue, Local Explorer, and compatibility fixture tests now explicitly register the workers that other processes need to discover.

Windows validation using the same harness as #15038 is running in #15041.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this is an internal local-development integration; the new Miniflare option is documented in the package README.

A picture of a cute animal (not mandatory, but encouraged)

---

[changeset-bot]

🦋 Changeset detected

Latest commit: db3a117

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
miniflare	Major
@cloudflare/deploy-helpers	Patch
@cloudflare/pages-shared	Patch
@cloudflare/remote-bindings	Patch
@cloudflare/runtime-types	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch
wrangler	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[github-actions]

✅ All changesets look good

[ask-bonk]

Confirmed: watch() (line 2198) is called separately from register() (line 2729). External service discovery is independent of registration. The empty-entries short-circuit in register is safe.

The PR is well-implemented, well-tested, and correctly scoped. All user-worker instantiation paths are updated, docs and changeset are correct, and I found no logic bugs, security issues, backward-compat violations, or incorrect API behavior.

LGTM

github run

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@15040

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@15040

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@15040

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@15040

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@15040

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@15040

miniflare

npm i https://pkg.pr.new/miniflare@15040

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@15040

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@15040

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@15040

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@15040

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@15040

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@15040

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@15040

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@15040

wrangler

npm i https://pkg.pr.new/wrangler@15040

commit: db3a117

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[edmundhung]

Validation result: this does not fix the Windows flake, so #15040 should be judged as the internal-worker collision/churn fix for #15035 only.

I reused #15038's harness unchanged in #15041 and ran the vite dev <-> vite dev suite four times on Windows. The result was:

• 19 std::terminate aborts (versus 23 in DO NOT MERGE: validate dev-registry reconcile fix on Windows #15038)
• 11 sessions marked CRASH-DETECTED
• 3 failed tests out of 42:
  • round 1 supports exported handler fetch over service binding returned Vite HTML instead of the Worker response
  • round 2 of the same test timed out
  • round 2 supports tail handler timed out in waitFor

Job: https://github.com/cloudflare/workers-sdk/actions/runs/31017919389/job/92346768939

The difference in raw abort count is too small and noisy to indicate an improvement; the abort remains readily reproducible after the internal registry entries are removed. #15018's Windows skip needs to stay. This rules out the fixed-name internal-worker collisions as the sole trigger, while #15040 still removes those accidental entries and the cross-session registry traffic they cause.

[petebacondarwin]

Approved with a few nits.

To be clear this is actually a breaking change for Miniflare, which is allowed because we are in v5 pre-release.

[workers-devprod]

Codeowners reviews satisfied