@dimina-kit/devtools 0.3.1-dev.20260513123738 → 0.3.1-dev.20260515105504

package/dist/renderer/assets/workbenchSettings-q2_-nc8t.js

@@ -0,0 +1,8 @@
+import{S as e,T as t,w as n,x as r}from"./ipc-transport-CUsl-fS2.js";import{c as i,i as a,o,r as s,s as c}from"./settings-api-BjJalghB.js";var l=t(e(),1),u=t(n(),1),d=r(),f=[{id:`general`,label:`通用`},{id:`debug`,label:`调试`},{id:`mcp`,label:`MCP`}];function p({checked:e,onClick:t}){return(0,d.jsx)(`button`,{type:`button`,onClick:t,className:`relative inline-flex h-5 w-9 shrink-0 rounded-full transition-colors`,style:{background:e?`var(--color-accent)`:`var(--color-surface-3)`},children:(0,d.jsx)(`span`,{className:`inline-block h-3.5 w-3.5 rounded-full bg-white transition-transform`,style:{marginTop:3,transform:e?`translateX(18px)`:`translateX(3px)`}})})}function m(){let[e,t]=(0,u.useState)({cdp:{enabled:!1,port:9222},mcp:{enabled:!1,port:7789},compile:{watch:!0},theme:`system`}),[n,r]=(0,u.useState)(null),[l,m]=(0,u.useState)(`general`),[h,g]=(0,u.useState)(!1),[_,v]=(0,u.useState)(`9222`),[y,b]=(0,u.useState)(`7789`);(0,u.useEffect)(()=>{let e=o(e=>{t(e.settings),v(String(e.settings.cdp.port)),b(String(e.settings.mcp.port))});return a().then(e=>{t(e),v(String(e.cdp.port)),b(String(e.mcp.port))}),s().then(r),e},[]);function x(){g(!0),window.setTimeout(()=>g(!1),2e3)}function S(){t(e=>({...e,cdp:{...e.cdp,enabled:!e.cdp.enabled}}))}function C(){t(e=>({...e,mcp:{...e.mcp,enabled:!e.mcp.enabled}}))}function w(n){let r={...e,theme:n};t(r),i(n),c(r)}function T(n){let r={...e,compile:{...e.compile,watch:n}};t(r),c(r).then(x)}async function E(){let n=parseInt(_,10);if(Number.isNaN(n)||n<1024||n>65535)return;let i=parseInt(y,10);if(Number.isNaN(i)||i<1024||i>65535)return;let a={...e,cdp:{...e.cdp,port:n},mcp:{...e.mcp,port:i}};t(a),await c(a),r(await s()),x()}let D=n&&!n.implicitDevDefault&&(e.cdp.enabled!==n.active||e.cdp.enabled&&n.active&&e.cdp.port!==n.activePort);return(0,d.jsxs)(`div`,{className:`flex flex-col h-screen bg-surface text-text`,children:[(0,d.jsx)(`div`,{className:`flex items-center border-b border-border shrink-0`,children:f.map(e=>(0,d.jsx)(`button`,{className:`flex-1 py-2.5 text-[12px] text-center transition-colors ${l===e.id?`text-accent border-b-2 border-accent`:`text-text-secondary hover:text-text`}`,onClick:()=>m(e.id),children:e.label},e.id))}),(0,d.jsxs)(`div`,{className:`flex-1 overflow-y-auto p-4`,children:[l===`general`&&(0,d.jsxs)(`div`,{className:`space-y-4`,children:[(0,d.jsxs)(`section`,{className:`rounded-lg border border-border p-4 space-y-4 bg-bg`,children:[(0,d.jsxs)(`div`,{children:[(0,d.jsx)(`h2`,{className:`text-[13px] font-medium mb-1`,children:`编译`}),(0,d.jsx)(`p`,{className:`text-[11px] leading-relaxed text-text-secondary`,children:`开启后，打开项目时会监听源文件改动并自动重新编译。关闭则只在打开/手动重新编译时构建。配置在下次打开项目时生效。`})]}),(0,d.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,d.jsx)(`span`,{className:`text-[12px] text-text-secondary`,children:`监听文件变化自动编译`}),(0,d.jsx)(p,{checked:e.compile.watch,onClick:()=>T(!e.compile.watch)})]})]}),(0,d.jsxs)(`section`,{className:`rounded-lg border border-border p-4 space-y-3 bg-bg`,children:[(0,d.jsx)(`div`,{children:(0,d.jsx)(`h2`,{className:`text-[13px] font-medium mb-1`,children:`外观`})}),(0,d.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,d.jsx)(`span`,{className:`text-[12px] text-text-secondary`,children:`颜色模式`}),(0,d.jsx)(`div`,{className:`flex rounded overflow-hidden border border-border text-[11px]`,children:[`system`,`dark`,`light`].map((t,n)=>{let r=t===`system`?`跟随系统`:t===`dark`?`深色`:`浅色`,i=e.theme===t;return(0,d.jsx)(`button`,{onClick:()=>w(t),className:[`px-3 py-1 transition-colors`,n>0?`border-l border-border`:``,i?`bg-accent text-white`:`text-text-secondary hover:text-text hover:bg-surface-3`].join(` `),children:r},t)})})]})]}),h&&(0,d.jsx)(`div`,{className:`text-[11px] text-status-success`,children:`已保存`})]}),l===`debug`&&(0,d.jsxs)(`section`,{className:`rounded-lg border border-border p-4 space-y-4 bg-bg`,children:[(0,d.jsxs)(`div`,{children:[(0,d.jsx)(`h2`,{className:`text-[13px] font-medium mb-1`,children:`DevTools Protocol`}),(0,d.jsx)(`p`,{className:`text-[11px] leading-relaxed text-text-secondary`,children:`开启后可通过 DevTools Protocol 连接调试模拟器。配置变更需要重启应用后生效。`})]}),(0,d.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,d.jsx)(`span`,{className:`text-[12px] text-text-secondary`,children:`启用 DevTools Protocol`}),(0,d.jsx)(p,{checked:e.cdp.enabled,onClick:S})]}),(0,d.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,d.jsx)(`label`,{className:`text-[12px] shrink-0 w-16 text-text-secondary`,children:`调试端口`}),(0,d.jsx)(`input`,{type:`number`,min:1024,max:65535,value:_,onChange:e=>v(e.target.value),disabled:!e.cdp.enabled,className:`w-24 h-7 px-2 rounded text-[12px] outline-none bg-surface border border-border text-text`,style:{opacity:e.cdp.enabled?1:.4}}),(0,d.jsx)(`span`,{className:`text-[11px] text-text-dim`,children:`默认 9222`})]}),(0,d.jsxs)(`div`,{className:`rounded p-3 space-y-2 border border-border bg-surface`,children:[(0,d.jsx)(`div`,{className:`text-[11px] font-medium text-text-secondary`,children:`当前状态`}),(0,d.jsxs)(`div`,{className:`flex items-center gap-2`,children:[(0,d.jsx)(`span`,{className:`inline-block w-2 h-2 rounded-full`,style:{background:n?.active?`var(--color-status-success)`:`var(--color-text-dim)`}}),(0,d.jsx)(`span`,{className:`text-[12px] text-text-secondary`,children:n?.active?`CDP 已激活 - 端口 ${n.activePort}`:`CDP 未激活`})]}),n?.implicitDevDefault&&(0,d.jsx)(`div`,{className:`text-[11px] text-text-dim`,children:`当前为开发模式默认端口`}),n?.active&&(0,d.jsxs)(`div`,{className:`text-[11px] text-text-dim font-mono`,children:[`调试地址: http://localhost:`,n.activePort]})]}),D&&(0,d.jsx)(`div`,{className:`rounded px-3 py-2 text-[12px] border bg-warn-bg text-[var(--color-status-warn)]`,children:`配置已变更，需要重启应用后生效`}),(0,d.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,d.jsx)(`button`,{onClick:E,className:`h-7 px-4 rounded text-[13px] font-medium text-white bg-accent hover:bg-accent-hover`,children:`保存`}),h&&(0,d.jsx)(`span`,{className:`text-[11px] text-status-success`,children:`已保存`})]})]}),l===`mcp`&&(0,d.jsxs)(`section`,{className:`rounded-lg border border-border p-4 space-y-4 bg-bg`,children:[(0,d.jsxs)(`div`,{children:[(0,d.jsx)(`h2`,{className:`text-[13px] font-medium mb-1`,children:`MCP 配置`}),(0,d.jsx)(`p`,{className:`text-[11px] leading-relaxed text-text-secondary`,children:`AI 助手可以通过 MCP 连接当前开发工具，读取 console、截图、执行 JS、查看 DOM / Storage / 网络请求。启用后开发工具启动时会自动监听 SSE 端点，并自动启用 CDP。`})]}),(0,d.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,d.jsx)(`span`,{className:`text-[12px] text-text-secondary`,children:`启用 MCP 服务`}),(0,d.jsx)(p,{checked:e.mcp.enabled,onClick:C})]}),(0,d.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,d.jsx)(`label`,{className:`text-[12px] shrink-0 w-16 text-text-secondary`,children:`SSE 端口`}),(0,d.jsx)(`input`,{type:`number`,min:1024,max:65535,value:y,onChange:e=>b(e.target.value),disabled:!e.mcp.enabled,className:`w-24 h-7 px-2 rounded text-[12px] outline-none bg-surface border border-border text-text`,style:{opacity:e.mcp.enabled?1:.4}}),(0,d.jsx)(`span`,{className:`text-[11px] text-text-dim`,children:`默认 7789`})]}),(0,d.jsxs)(`div`,{className:`rounded p-3 border border-border bg-surface`,children:[(0,d.jsx)(`div`,{className:`text-[11px] font-medium mb-2 text-text-secondary`,children:"`.mcp.json` 示例（SSE 传输）"}),(0,d.jsx)(`pre`,{className:`text-[11px] whitespace-pre-wrap leading-relaxed text-[var(--color-code-blue)] font-mono`,children:`{
+  "mcpServers": {
+    "dimina-devtools": {
+      "url": "http://127.0.0.1:${e.mcp.port}/sse"
+    }
+  }
+}`})]}),(0,d.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,d.jsx)(`button`,{onClick:E,className:`h-7 px-4 rounded text-[13px] font-medium text-white bg-accent hover:bg-accent-hover`,children:`保存`}),h&&(0,d.jsx)(`span`,{className:`text-[11px] text-status-success`,children:`已保存`})]})]})]})]})}l.createRoot(document.getElementById(`root`)).render((0,d.jsx)(m,{}));
+//# sourceMappingURL=workbenchSettings-q2_-nc8t.js.map

package/dist/renderer/entries/main/index.html

@@ -2,12 +2,19 @@
 <html lang="zh-CN">
 <head>
   <meta charset="UTF-8" />
+  <!--
+    CSP: deliberately permissive (B5 phase). Inline JS/CSS + eval are kept for
+    dev tooling / nodeIntegration:true; connect-src spans http/ws because
+    automation, MCP, and the simulator dev server all open sockets. Tighten in
+    C-phase once the preload bridge removes the need for `unsafe-*`.
+  -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob: http: https:; connect-src 'self' http: https: ws: wss:;" />
   <title>Dimina DevTools</title>
-  <script type="module" crossorigin src="../../assets/index-D1p6crtf.js"></script>
-  <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-ClIvDcYY.js">
-  <link rel="modulepreload" crossorigin href="../../assets/input-DxfYnzX_.js">
-  <link rel="modulepreload" crossorigin href="../../assets/select-DMfp49f1.js">
-  <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-EiWxu_hG.css">
+  <script type="module" crossorigin src="../../assets/index-DW_0thr-.js"></script>
+  <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-CUsl-fS2.js">
+  <link rel="modulepreload" crossorigin href="../../assets/input-C5M5Wxn6.js">
+  <link rel="modulepreload" crossorigin href="../../assets/select-B1tF3UAc.js">
+  <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-CltRuvhi.css">
 </head>
 <body>
   <div id="root"></div>

package/dist/renderer/entries/popover/index.html

@@ -2,15 +2,17 @@
 <html lang="zh-CN">
 <head>
   <meta charset="UTF-8" />
+  <!-- See main/index.html for CSP rationale. -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob: http: https:; connect-src 'self' http: https: ws: wss:;" />
   <title>Compile Config</title>
   <style>
     html, body { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: transparent !important; }
   </style>
-  <script type="module" crossorigin src="../../assets/popover-CtXcBJtM.js"></script>
-  <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-ClIvDcYY.js">
-  <link rel="modulepreload" crossorigin href="../../assets/input-DxfYnzX_.js">
-  <link rel="modulepreload" crossorigin href="../../assets/select-DMfp49f1.js">
-  <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-EiWxu_hG.css">
+  <script type="module" crossorigin src="../../assets/popover-BSBPVO0o.js"></script>
+  <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-CUsl-fS2.js">
+  <link rel="modulepreload" crossorigin href="../../assets/input-C5M5Wxn6.js">
+  <link rel="modulepreload" crossorigin href="../../assets/select-B1tF3UAc.js">
+  <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-CltRuvhi.css">
 </head>
 <body>
   <div id="root"></div>

package/dist/renderer/entries/settings/index.html

@@ -2,12 +2,14 @@
 <html lang="zh-CN">
 <head>
   <meta charset="UTF-8" />
+  <!-- See main/index.html for CSP rationale. -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob: http: https:; connect-src 'self' http: https: ws: wss:;" />
   <title>Settings</title>
-  <script type="module" crossorigin src="../../assets/settings-DteGraEU.js"></script>
-  <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-ClIvDcYY.js">
-  <link rel="modulepreload" crossorigin href="../../assets/input-DxfYnzX_.js">
-  <link rel="modulepreload" crossorigin href="../../assets/settings-api-CY84UMpN.js">
-  <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-EiWxu_hG.css">
+  <script type="module" crossorigin src="../../assets/settings-7w54H6p-.js"></script>
+  <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-CUsl-fS2.js">
+  <link rel="modulepreload" crossorigin href="../../assets/input-C5M5Wxn6.js">
+  <link rel="modulepreload" crossorigin href="../../assets/settings-api-BjJalghB.js">
+  <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-CltRuvhi.css">
 </head>
 <body>
   <div id="root"></div>

package/dist/renderer/entries/workbench-settings/index.html

@@ -3,11 +3,13 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <!-- See entries/main/index.html for CSP rationale. -->
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob: http: https:; connect-src 'self' http: https: ws: wss:;" />
     <title>开发工具设置</title>
-    <script type="module" crossorigin src="../../assets/workbenchSettings-DjELLnSJ.js"></script>
-    <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-ClIvDcYY.js">
-    <link rel="modulepreload" crossorigin href="../../assets/settings-api-CY84UMpN.js">
-    <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-EiWxu_hG.css">
+    <script type="module" crossorigin src="../../assets/workbenchSettings-q2_-nc8t.js"></script>
+    <link rel="modulepreload" crossorigin href="../../assets/ipc-transport-CUsl-fS2.js">
+    <link rel="modulepreload" crossorigin href="../../assets/settings-api-BjJalghB.js">
+    <link rel="stylesheet" crossorigin href="../../assets/ipc-transport-CltRuvhi.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/shared/ipc-channels.d.ts

@@ -15,8 +15,17 @@ export declare const SimulatorChannel: {
     readonly AppData: "simulator:appdata";
     readonly AppDataAll: "simulator:appdata-all";
 };
+export declare const SimulatorCustomApiChannel: {
+    readonly List: "simulator:custom-apis:list";
+    readonly Invoke: "simulator:custom-apis:invoke";
+};
 export declare const SimulatorStorageChannel: {
     readonly GetSnapshot: "simulator:storage:snapshot";
+    readonly GetActivePrefix: "simulator:storage:activePrefix";
+    readonly Set: "simulator:storage:set";
+    readonly Remove: "simulator:storage:remove";
+    readonly Clear: "simulator:storage:clear";
+    readonly ClearAll: "simulator:storage:clearAll";
     readonly Event: "simulator:storage:event";
 };
 export interface StorageItem {
@@ -38,6 +47,12 @@ export type StorageEvent = {
 } | {
     type: 'cleared';
 };
+export type StorageWriteResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
 export declare const SimulatorElementChannel: {
     readonly Inspect: "simulator:element:inspect";
     readonly Clear: "simulator:element:clear";
@@ -132,4 +147,11 @@ export declare const SettingsChannel: {
     readonly Closed: "settings:closed";
     readonly Changed: "settings:changed";
 };
+export declare const UpdateChannel: {
+    readonly Check: "updates:check";
+    readonly Download: "updates:download";
+    readonly Install: "updates:install";
+    readonly DownloadProgress: "updates:downloadProgress";
+    readonly Available: "updates:available";
+};
 //# sourceMappingURL=ipc-channels.d.ts.map

package/dist/shared/ipc-channels.js

@@ -16,10 +16,22 @@ export const SimulatorChannel = {
     AppData: 'simulator:appdata',
     AppDataAll: 'simulator:appdata-all',
 };
+// ── Custom simulator APIs (downstream-registered, main-process handlers) ──
+// list: simulator queries the names registered via @dimina-kit/devtools/simulator-apis.
+// invoke: simulator forwards an API call to the registry; result/reject propagates.
+export const SimulatorCustomApiChannel = {
+    List: 'simulator:custom-apis:list',
+    Invoke: 'simulator:custom-apis:invoke',
+};
 // ── Storage (CDP-backed; main process attaches the debugger to the
 // simulator <webview> and forwards DOMStorage events to the renderer) ──
 export const SimulatorStorageChannel = {
     GetSnapshot: 'simulator:storage:snapshot',
+    GetActivePrefix: 'simulator:storage:activePrefix',
+    Set: 'simulator:storage:set',
+    Remove: 'simulator:storage:remove',
+    Clear: 'simulator:storage:clear',
+    ClearAll: 'simulator:storage:clearAll',
     Event: 'simulator:storage:event',
 };
 // ── Element inspection (CDP-backed; WXML tree nodes map to real DOM by sid) ──
@@ -111,4 +123,15 @@ export const SettingsChannel = {
     Closed: 'settings:closed',
     Changed: 'settings:changed',
 };
+// ── Updates (UpdateManager) ──────────────────────────────────────────────
+//
+// String values are FROZEN: shipped builds key off them. Add new entries
+// here, never rename existing ones.
+export const UpdateChannel = {
+    Check: 'updates:check',
+    Download: 'updates:download',
+    Install: 'updates:install',
+    DownloadProgress: 'updates:downloadProgress',
+    Available: 'updates:available',
+};
 //# sourceMappingURL=ipc-channels.js.map

package/dist/shared/ipc-schemas.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Centralised zod schemas for IPC handler argument validation.
+ *
+ * Only the highest-risk handlers are validated here. Each schema is shaped as a
+ * `z.tuple([...])` matching the `(event, ...args)` argument list that an
+ * `ipcMain.handle` callback receives (event is stripped before validation).
+ */
+import { z } from 'zod';
+/** panel:eval — single JS expression string. Cap at 50_000 chars to avoid DoS. */
+export declare const PanelEvalSchema: z.ZodTuple<[z.ZodString], null>;
+/** projects:add — absolute directory path. */
+export declare const ProjectsAddSchema: z.ZodTuple<[z.ZodString], null>;
+/** project:open — absolute project path. */
+export declare const ProjectOpenSchema: z.ZodTuple<[z.ZodString], null>;
+/**
+ * project:saveCompileConfig — absolute project path + CompileConfig.
+ */
+export declare const ProjectSaveCompileConfigSchema: z.ZodTuple<[z.ZodString, z.ZodObject<{
+    startPage: z.ZodOptional<z.ZodString>;
+    scene: z.ZodOptional<z.ZodNumber>;
+    queryParams: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$loose>>>;
+}, z.core.$loose>], null>;
+/** popover:show — must be an object (not undefined/null/string). */
+export declare const PopoverShowSchema: z.ZodTuple<[z.ZodObject<{}, z.core.$loose>], null>;
+/** simulator:attach — webContents id (positive int) + simulator width. */
+export declare const SimulatorAttachSchema: z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>;
+/** simulator:resize — simulator width. */
+export declare const SimulatorResizeSchema: z.ZodTuple<[z.ZodNumber], null>;
+/** simulator:setVisible — visible flag + simulator width. */
+export declare const SimulatorSetVisibleSchema: z.ZodTuple<[z.ZodBoolean, z.ZodNumber], null>;
+/**
+ * simulator:custom-apis:invoke — API name + arbitrary JSON-serialisable params.
+ *
+ * Params shape is owned by the downstream handler, so we only enforce that the
+ * name is a non-empty bounded string (cheap DoS guard) and accept any payload.
+ */
+export declare const SimulatorCustomApiInvokeSchema: z.ZodTuple<[z.ZodString, z.ZodUnknown], null>;
+/** project:getPages — absolute project path. */
+export declare const ProjectGetPagesSchema: z.ZodTuple<[z.ZodString], null>;
+/** project:getCompileConfig — absolute project path. */
+export declare const ProjectGetCompileConfigSchema: z.ZodTuple<[z.ZodString], null>;
+/** projects:remove — absolute project directory path. */
+export declare const ProjectsRemoveSchema: z.ZodTuple<[z.ZodString], null>;
+/**
+ * workbenchSettings:save — full WorkbenchSettings object.
+ *
+ * `saveWorkbenchSettings()` overwrites the whole settings file (no merge),
+ * so a partial payload would silently reset whatever fields it omits to
+ * defaults. Require every top-level slice so the renderer can't accidentally
+ * (or maliciously) wipe configuration by sending `{}`.
+ */
+export declare const WorkbenchSettingsSaveSchema: z.ZodTuple<[z.ZodObject<{
+    cdp: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        port: z.ZodNumber;
+    }, z.core.$loose>;
+    mcp: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        port: z.ZodNumber;
+    }, z.core.$loose>;
+    compile: z.ZodObject<{
+        watch: z.ZodBoolean;
+    }, z.core.$loose>;
+    theme: z.ZodEnum<{
+        system: "system";
+        dark: "dark";
+        light: "light";
+    }>;
+}, z.core.$loose>], null>;
+/** workbenchSettings:setTheme — fixed enum of supported theme sources. */
+export declare const WorkbenchSettingsSetThemeSchema: z.ZodTuple<[z.ZodEnum<{
+    system: "system";
+    dark: "dark";
+    light: "light";
+}>], null>;
+/** workbenchSettings:setVisible — boolean. */
+export declare const WorkbenchSettingsSetVisibleSchema: z.ZodTuple<[z.ZodBoolean], null>;
+/** settings:setVisible — boolean. */
+export declare const SettingsSetVisibleSchema: z.ZodTuple<[z.ZodBoolean], null>;
+/** settings:configChanged — full CompileConfig object (see shared/types.ts). */
+export declare const SettingsConfigChangedSchema: z.ZodTuple<[z.ZodObject<{
+    startPage: z.ZodOptional<z.ZodString>;
+    scene: z.ZodOptional<z.ZodNumber>;
+    queryParams: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$loose>>>;
+}, z.core.$loose>], null>;
+/** popover:relaunch — full CompileConfig object pushed back to main on relaunch. */
+export declare const PopoverRelaunchSchema: z.ZodTuple<[z.ZodObject<{
+    startPage: z.ZodOptional<z.ZodString>;
+    scene: z.ZodOptional<z.ZodNumber>;
+    queryParams: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$loose>>>;
+}, z.core.$loose>], null>;
+/**
+ * settings:projectSettingsChanged — Partial<ProjectSettings>.
+ *
+ * ProjectSettings currently has a single boolean field
+ * (`uploadWithSourceMap`); validated permissively to remain forward-
+ * compatible while still rejecting non-object payloads.
+ */
+export declare const SettingsProjectSettingsChangedSchema: z.ZodTuple<[z.ZodObject<{
+    uploadWithSourceMap: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>], null>;
+/** panel:select — single panel id string. */
+export declare const PanelSelectSchema: z.ZodTuple<[z.ZodString], null>;
+//# sourceMappingURL=ipc-schemas.d.ts.map

package/dist/shared/ipc-schemas.js

@@ -0,0 +1,128 @@
+/**
+ * Centralised zod schemas for IPC handler argument validation.
+ *
+ * Only the highest-risk handlers are validated here. Each schema is shaped as a
+ * `z.tuple([...])` matching the `(event, ...args)` argument list that an
+ * `ipcMain.handle` callback receives (event is stripped before validation).
+ */
+import { z } from 'zod';
+/**
+ * Conservative absolute-path matcher.
+ * Accepts:
+ *   - POSIX absolute paths (start with `/`)
+ *   - Windows absolute paths (e.g. `C:\foo`, `C:/foo`)
+ * Rejects empty strings, relative paths and other shapes.
+ */
+const AbsolutePath = z
+    .string()
+    .min(1)
+    .refine((p) => p.startsWith('/') || /^[a-zA-Z]:\\/.test(p) || /^[a-zA-Z]:\//.test(p), 'must be an absolute path');
+/** panel:eval — single JS expression string. Cap at 50_000 chars to avoid DoS. */
+export const PanelEvalSchema = z.tuple([z.string().min(1).max(50_000)]);
+/** projects:add — absolute directory path. */
+export const ProjectsAddSchema = z.tuple([AbsolutePath]);
+/** project:open — absolute project path. */
+export const ProjectOpenSchema = z.tuple([AbsolutePath]);
+/**
+ * Shared shape for CompileConfig payloads (used by saveCompileConfig,
+ * settings:configChanged, and popover:relaunch). Permissive on the outer
+ * object so we stay forward-compatible with new fields; the known top-level
+ * keys are validated to catch wrong types early.
+ */
+const CompileConfigShape = z.looseObject({
+    startPage: z.string().optional(),
+    scene: z.number().optional(),
+    queryParams: z
+        .array(z.looseObject({ key: z.string(), value: z.string() }))
+        .optional(),
+});
+/**
+ * project:saveCompileConfig — absolute project path + CompileConfig.
+ */
+export const ProjectSaveCompileConfigSchema = z.tuple([
+    AbsolutePath,
+    CompileConfigShape,
+]);
+/** popover:show — must be an object (not undefined/null/string). */
+export const PopoverShowSchema = z.tuple([z.looseObject({})]);
+/**
+ * Reasonable simulator width range. Window width is clamped UI-side, but
+ * we still reject obvious garbage (negative, zero, absurdly large).
+ */
+const SimWidth = z.number().int().min(100).max(2000);
+/** simulator:attach — webContents id (positive int) + simulator width. */
+export const SimulatorAttachSchema = z.tuple([
+    z.number().int().positive(),
+    SimWidth,
+]);
+/** simulator:resize — simulator width. */
+export const SimulatorResizeSchema = z.tuple([SimWidth]);
+/** simulator:setVisible — visible flag + simulator width. */
+export const SimulatorSetVisibleSchema = z.tuple([z.boolean(), SimWidth]);
+/**
+ * simulator:custom-apis:invoke — API name + arbitrary JSON-serialisable params.
+ *
+ * Params shape is owned by the downstream handler, so we only enforce that the
+ * name is a non-empty bounded string (cheap DoS guard) and accept any payload.
+ */
+export const SimulatorCustomApiInvokeSchema = z.tuple([
+    z.string().min(1).max(256),
+    z.unknown(),
+]);
+/** project:getPages — absolute project path. */
+export const ProjectGetPagesSchema = z.tuple([AbsolutePath]);
+/** project:getCompileConfig — absolute project path. */
+export const ProjectGetCompileConfigSchema = z.tuple([AbsolutePath]);
+/** projects:remove — absolute project directory path. */
+export const ProjectsRemoveSchema = z.tuple([AbsolutePath]);
+/**
+ * workbenchSettings:save — full WorkbenchSettings object.
+ *
+ * `saveWorkbenchSettings()` overwrites the whole settings file (no merge),
+ * so a partial payload would silently reset whatever fields it omits to
+ * defaults. Require every top-level slice so the renderer can't accidentally
+ * (or maliciously) wipe configuration by sending `{}`.
+ */
+export const WorkbenchSettingsSaveSchema = z.tuple([
+    z.looseObject({
+        cdp: z.looseObject({
+            enabled: z.boolean(),
+            port: z.number().int().min(0).max(65535),
+        }),
+        mcp: z.looseObject({
+            enabled: z.boolean(),
+            port: z.number().int().min(0).max(65535),
+        }),
+        compile: z.looseObject({
+            watch: z.boolean(),
+        }),
+        theme: z.enum(['system', 'light', 'dark']),
+    }),
+]);
+/** workbenchSettings:setTheme — fixed enum of supported theme sources. */
+export const WorkbenchSettingsSetThemeSchema = z.tuple([
+    z.enum(['system', 'light', 'dark']),
+]);
+/** workbenchSettings:setVisible — boolean. */
+export const WorkbenchSettingsSetVisibleSchema = z.tuple([z.boolean()]);
+/** settings:setVisible — boolean. */
+export const SettingsSetVisibleSchema = z.tuple([z.boolean()]);
+/** settings:configChanged — full CompileConfig object (see shared/types.ts). */
+export const SettingsConfigChangedSchema = z.tuple([CompileConfigShape]);
+/** popover:relaunch — full CompileConfig object pushed back to main on relaunch. */
+export const PopoverRelaunchSchema = z.tuple([CompileConfigShape]);
+/**
+ * settings:projectSettingsChanged — Partial<ProjectSettings>.
+ *
+ * ProjectSettings currently has a single boolean field
+ * (`uploadWithSourceMap`); validated permissively to remain forward-
+ * compatible while still rejecting non-object payloads.
+ */
+export const SettingsProjectSettingsChangedSchema = z.tuple([
+    z.looseObject({
+        uploadWithSourceMap: z.boolean().optional(),
+    }),
+]);
+/** panel:select — single panel id string. */
+export const PanelSelectSchema = z.tuple([z.string().min(1).max(200)]);
+//# sourceMappingURL=ipc-schemas.js.map

package/dist/shared/types.d.ts

@@ -13,6 +13,8 @@ export interface CompilationAdapter {
         port?: number;
         sourcemap?: boolean;
         simulatorDir?: string;
+        /** When false, skip the file-watcher / auto-recompile loop. Default true. */
+        watch?: boolean;
         onRebuild?: () => void;
         onBuildError?: (err: unknown) => void;
     }): Promise<ProjectSession>;