@dimina-kit/devtools 0.3.1-dev.20260513123738 → 0.3.1-dev.20260515105504

package/dist/main/services/views/view-manager.js

@@ -1,5 +1,7 @@
 import { WebContentsView, webContents } from 'electron';
 import path from 'path';
+import { mainPreloadPath } from '../../utils/paths.js';
+import { applyNavigationHardening } from '../../windows/navigation-hardening.js';
 import * as layout from '../layout/index.js';
 import { getDefaultTab } from '../workbench-context.js';
 /**
@@ -143,8 +145,16 @@ export function createViewManager(ctx) {
     async function showSettings() {
         if (!settingsView) {
             settingsView = new WebContentsView({
-                webPreferences: { nodeIntegration: true, contextIsolation: false },
+                webPreferences: {
+                    nodeIntegration: false,
+                    contextIsolation: true,
+                    sandbox: false,
+                    preload: mainPreloadPath,
+                },
             });
+            // Overlay loads mainPreloadPath, so the same navigation rules as the
+            // main window apply — see navigation-hardening.ts.
+            applyNavigationHardening(settingsView.webContents, ctx.rendererDir);
             await settingsView.webContents.loadFile(path.join(ctx.rendererDir, 'entries/settings/index.html'));
         }
         if (!settingsViewAdded) {
@@ -165,8 +175,15 @@ export function createViewManager(ctx) {
     function showPopover(data) {
         hidePopover();
         const popover = new WebContentsView({
-            webPreferences: { nodeIntegration: true, contextIsolation: false },
+            webPreferences: {
+                nodeIntegration: false,
+                contextIsolation: true,
+                sandbox: false,
+                preload: mainPreloadPath,
+            },
         });
+        // Popover overlay loads mainPreloadPath — same navigation rules apply.
+        applyNavigationHardening(popover.webContents, ctx.rendererDir);
         popoverView = popover;
         popover.setBackgroundColor('#00000000');
         ctx.mainWindow.contentView.addChildView(popover);
@@ -247,6 +264,20 @@ export function createViewManager(ctx) {
                 return null;
             return settingsView.webContents;
         },
+        getSettingsWebContentsId: () => {
+            if (!settingsView)
+                return null;
+            if (settingsView.webContents.isDestroyed())
+                return null;
+            return settingsView.webContents.id;
+        },
+        getPopoverWebContentsId: () => {
+            if (!popoverView)
+                return null;
+            if (popoverView.webContents.isDestroyed())
+                return null;
+            return popoverView.webContents.id;
+        },
         resize,
         setVisible,
     };

package/dist/main/services/window-service.d.ts

@@ -0,0 +1,24 @@
+import type { BrowserWindow } from 'electron';
+/**
+ * Owns every top-level BrowserWindow the workbench is responsible for.
+ *
+ * Callers should prefer this service over reading bare `mainWindow` /
+ * `workbenchSettingsWindow` fields off `WorkbenchContext` — the latter
+ * remain as @deprecated synchronized mirrors during the migration window.
+ */
+export interface WindowService {
+    /** The primary devtools window. Created during app bootstrap. */
+    readonly mainWindow: BrowserWindow;
+    /** Standalone workbench-settings BrowserWindow, or null when closed. */
+    readonly settingsWindow: BrowserWindow | null;
+    /** Update the tracked settings window (null when closed/destroyed). */
+    setSettingsWindow(win: BrowserWindow | null): void;
+    /** Close the settings window if it is open and clear the reference. */
+    closeSettingsWindow(): void;
+    /** True when `webContentsId` belongs to the (alive) main window renderer. */
+    isMainSender(webContentsId: number): boolean;
+    /** True when `webContentsId` belongs to the (alive) settings window renderer. */
+    isSettingsWindowSender(webContentsId: number): boolean;
+}
+export declare function createWindowService(mainWindow: BrowserWindow): WindowService;
+//# sourceMappingURL=window-service.d.ts.map

package/dist/main/services/window-service.js

@@ -0,0 +1,26 @@
+export function createWindowService(mainWindow) {
+    let settingsWin = null;
+    return {
+        get mainWindow() {
+            return mainWindow;
+        },
+        get settingsWindow() {
+            return settingsWin;
+        },
+        setSettingsWindow(win) {
+            settingsWin = win;
+        },
+        closeSettingsWindow() {
+            if (settingsWin && !settingsWin.isDestroyed())
+                settingsWin.close();
+            settingsWin = null;
+        },
+        isMainSender(id) {
+            return !mainWindow.isDestroyed() && mainWindow.webContents.id === id;
+        },
+        isSettingsWindowSender(id) {
+            return !!settingsWin && !settingsWin.isDestroyed() && settingsWin.webContents.id === id;
+        },
+    };
+}
+//# sourceMappingURL=window-service.js.map

package/dist/main/services/workbench-context.d.ts

@@ -1,19 +1,24 @@
 import type { BrowserWindow } from 'electron';
 import type { CompilationAdapter } from '../../shared/types.js';
+import { DisposableRegistry } from '../utils/disposable.js';
+import type { SenderPolicy } from '../utils/ipc-registry.js';
 import { type RendererNotifier } from './notifications/renderer-notifier.js';
 import { type ViewManager } from './views/view-manager.js';
+import { type WindowService } from './window-service.js';
 import { type WorkspaceService } from './workspace/workspace-service.js';
 /**
  * Shared mutable state for the workbench application.
  * Passed to each IPC module so they can read/write shared state without closures.
  */
 export interface WorkbenchContext {
+    /** @deprecated use ctx.windows.mainWindow */
     mainWindow: BrowserWindow;
     adapter: CompilationAdapter;
     /** Absolute path to the preload script loaded into the simulator webview */
     preloadPath: string;
     /** Absolute path to the renderer dist directory */
     rendererDir: string;
+    /** @deprecated use ctx.windows.settingsWindow / setSettingsWindow / closeSettingsWindow */
     workbenchSettingsWindow: BrowserWindow | null;
     /** Built-in panel IDs to display (default: all) */
     panels: string[];
@@ -37,10 +42,20 @@ export interface WorkbenchContext {
     };
     /** Unified lifecycle manager for all overlay WebContentsViews */
     views: ViewManager;
+    /** Owns BrowserWindow instances (main + settings) and their sender-id checks. */
+    windows: WindowService;
     /** Unified main → renderer event dispatcher */
     notify: RendererNotifier;
     /** Single source of truth for project + session + per-project settings */
     workspace: WorkspaceService;
+    /**
+     * Trust predicate consulted by `IpcRegistry` for every incoming IPC.
+     * Resolves the currently-trusted senders (main renderer + overlays)
+     * lazily so it stays correct as windows/views come and go.
+     */
+    senderPolicy: SenderPolicy;
+    /** Aggregates dispose handlers for every IPC handler, listener, watcher, and CDP session registered by the workbench. */
+    registry: DisposableRegistry;
 }
 export interface CreateContextOptions {
     mainWindow: BrowserWindow;

package/dist/main/services/workbench-context.js

@@ -1,6 +1,9 @@
+import { DisposableRegistry } from '../utils/disposable.js';
+import { createWorkbenchSenderPolicy } from '../utils/sender-policy.js';
 import { defaultAdapter } from './default-adapter.js';
 import { createRendererNotifier, } from './notifications/renderer-notifier.js';
 import { createViewManager } from './views/view-manager.js';
+import { createWindowService } from './window-service.js';
 import { createWorkspaceService, } from './workspace/workspace-service.js';
 export function hasBuiltinPanel(ctx, panelId) {
     return ctx.panels.includes(panelId);
@@ -25,9 +28,12 @@ export function createWorkbenchContext(opts) {
         brandingProvider: opts.brandingProvider,
         workbenchSettingsWindow: null,
     };
+    ctx.registry = new DisposableRegistry();
+    ctx.windows = createWindowService(ctx.mainWindow);
     ctx.views = createViewManager(ctx);
     ctx.notify = createRendererNotifier(ctx);
     ctx.workspace = createWorkspaceService(ctx);
+    ctx.senderPolicy = createWorkbenchSenderPolicy(ctx);
     return ctx;
 }
 //# sourceMappingURL=workbench-context.js.map

package/dist/main/services/workspace/workspace-service.d.ts

@@ -28,6 +28,7 @@ export interface WorkspaceService {
     listProjects(): Project[];
     addProject(dirPath: string): Project;
     removeProject(dirPath: string): void;
+    hasProject(dirPath: string): boolean;
     validateProjectDir(dirPath: string): string | null;
     openProject(projectPath: string): Promise<OpenProjectResult>;
     closeProject(): Promise<void>;

package/dist/main/services/workspace/workspace-service.js

@@ -1,11 +1,12 @@
 import * as repo from '../projects/project-repository.js';
 import { clearSimulatorServicewechatReferer, setSimulatorServicewechatReferer, } from '../simulator/referer.js';
+import { loadWorkbenchSettings } from '../settings/index.js';
 /** Build a workspace service bound to the given workbench context. */
 export function createWorkspaceService(ctx) {
     let currentSession = null;
     let currentProjectPath = '';
-    function sendStatus(status, message) {
-        ctx.notify.projectStatus({ status, message });
+    function sendStatus(status, message, hotReload) {
+        ctx.notify.projectStatus(hotReload ? { status, message, hotReload: true } : { status, message });
     }
     function bestEffort(label, fn) {
         try {
@@ -40,6 +41,7 @@ export function createWorkspaceService(ctx) {
         listProjects: () => repo.listProjects(),
         addProject: (dirPath) => repo.addProject(dirPath),
         removeProject: (dirPath) => repo.removeProject(dirPath),
+        hasProject: (dirPath) => repo.hasProject(dirPath),
         validateProjectDir: (dirPath) => repo.validateProjectDir(dirPath),
         async openProject(projectPath) {
             clearSimulatorServicewechatReferer();
@@ -58,12 +60,14 @@ export function createWorkspaceService(ctx) {
                 return { success: false, error: dirError };
             }
             sendStatus('compiling', '正在编译...');
+            const { compile } = loadWorkbenchSettings();
             let session;
             try {
                 session = await ctx.adapter.openProject({
                     projectPath,
                     sourcemap: true,
-                    onRebuild: () => sendStatus('ready', '编译完成，已热更新'),
+                    watch: compile.watch,
+                    onRebuild: () => sendStatus('ready', '编译完成，已热更新', true),
                     onBuildError: (err) => sendStatus('error', String(err)),
                 });
             }

package/dist/main/simulator-apis.d.ts

@@ -0,0 +1,23 @@
+import { type SimulatorApiHandler } from './services/simulator/custom-apis.js';
+export type { SimulatorApiHandler } from './services/simulator/custom-apis.js';
+/**
+ * Register a handler for a simulator API callable from mini-program code.
+ *
+ * The handler runs in the Electron main process (Node.js context) and may
+ * use any main-process capability (filesystem, network, native deps). When
+ * the mini-program invokes `wx.<name>(params)` inside the simulator, the
+ * simulator forwards the call over IPC and resolves to the handler's return
+ * value. Errors thrown by the handler propagate back as a rejection.
+ *
+ * Re-registering the same name silently replaces the previous handler.
+ * The returned disposer removes only the registration it created — if the
+ * name was overwritten by a later `registerSimulatorApi`, calling the
+ * earlier disposer is a no-op.
+ *
+ * @example
+ *   registerSimulatorApi('myCompany.login', async ({ username }) => {
+ *     return await callInternalAuth(username)
+ *   })
+ */
+export declare function registerSimulatorApi(name: string, handler: SimulatorApiHandler): () => void;
+//# sourceMappingURL=simulator-apis.d.ts.map

package/dist/main/simulator-apis.js

@@ -0,0 +1,24 @@
+import { simulatorApiRegistry } from './services/simulator/custom-apis.js';
+/**
+ * Register a handler for a simulator API callable from mini-program code.
+ *
+ * The handler runs in the Electron main process (Node.js context) and may
+ * use any main-process capability (filesystem, network, native deps). When
+ * the mini-program invokes `wx.<name>(params)` inside the simulator, the
+ * simulator forwards the call over IPC and resolves to the handler's return
+ * value. Errors thrown by the handler propagate back as a rejection.
+ *
+ * Re-registering the same name silently replaces the previous handler.
+ * The returned disposer removes only the registration it created — if the
+ * name was overwritten by a later `registerSimulatorApi`, calling the
+ * earlier disposer is a no-op.
+ *
+ * @example
+ *   registerSimulatorApi('myCompany.login', async ({ username }) => {
+ *     return await callInternalAuth(username)
+ *   })
+ */
+export function registerSimulatorApi(name, handler) {
+    return simulatorApiRegistry.register(name, handler);
+}
+//# sourceMappingURL=simulator-apis.js.map

package/dist/main/utils/disposable.d.ts

@@ -0,0 +1,13 @@
+export interface Disposable {
+    dispose(): void | Promise<void>;
+}
+export type DisposeFn = () => void | Promise<void>;
+export declare function toDisposable(fn: DisposeFn): Disposable;
+export declare class DisposableRegistry implements Disposable {
+    private entries;
+    private _disposed;
+    add(d: Disposable | DisposeFn): Disposable;
+    disposeAll(): Promise<void>;
+    dispose(): Promise<void>;
+}
+//# sourceMappingURL=disposable.d.ts.map

package/dist/main/utils/disposable.js

@@ -0,0 +1,60 @@
+export function toDisposable(fn) {
+    let done = false;
+    return {
+        dispose() {
+            if (done)
+                return;
+            done = true;
+            return fn();
+        },
+    };
+}
+export class DisposableRegistry {
+    entries = [];
+    _disposed = false;
+    add(d) {
+        if (this._disposed) {
+            throw new Error('cannot add to disposed registry');
+        }
+        const fn = typeof d === 'function' ? d : () => d.dispose();
+        const entry = { fn, released: false };
+        this.entries.push(entry);
+        return {
+            dispose: () => {
+                if (entry.released)
+                    return;
+                entry.released = true;
+                const i = this.entries.indexOf(entry);
+                if (i >= 0)
+                    this.entries.splice(i, 1);
+                return fn();
+            },
+        };
+    }
+    async disposeAll() {
+        if (this._disposed)
+            return;
+        this._disposed = true;
+        const items = this.entries.slice().reverse();
+        this.entries = [];
+        const errors = [];
+        for (const entry of items) {
+            if (entry.released)
+                continue;
+            entry.released = true;
+            try {
+                await entry.fn();
+            }
+            catch (e) {
+                errors.push(e);
+            }
+        }
+        if (errors.length > 0) {
+            throw new AggregateError(errors, 'DisposableRegistry encountered errors during disposeAll');
+        }
+    }
+    dispose() {
+        return this.disposeAll();
+    }
+}
+//# sourceMappingURL=disposable.js.map

package/dist/main/utils/ipc-registry.d.ts

@@ -0,0 +1,39 @@
+import type { WebContents } from 'electron';
+import { ipcMain } from 'electron';
+import { type Disposable } from './disposable.js';
+type HandleFn = Parameters<typeof ipcMain.handle>[1];
+type ListenerFn = Parameters<typeof ipcMain.on>[1];
+/**
+ * Trust predicate used to gate IPC delivery on the main process.
+ *
+ * Returns true when the calling WebContents is allowed to invoke / emit on
+ * the channel, false otherwise.
+ */
+export type SenderPolicy = (sender: WebContents) => boolean;
+/**
+ * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
+ * matching removeHandler/removeListener registered into an internal registry.
+ *
+ * Each `register*Ipc(ctx)` returns one of these as a Disposable so the
+ * workbench-level registry can dispose all built-in handlers in one shot.
+ *
+ * If a {@link SenderPolicy} is provided, every incoming invocation is gated:
+ * - `handle`: rejected senders cause the invoke promise to reject with
+ *   `Error('IPC sender rejected for channel <channel>')`.
+ * - `on`: rejected senders are silently dropped (the original listener is
+ *   never called).
+ * In both cases a single `console.warn` is emitted with the channel name
+ * and a short sender summary. Without a policy the wrapper is a no-op,
+ * preserving backwards compatibility for unit tests and callers that
+ * opted out.
+ */
+export declare class IpcRegistry implements Disposable {
+    private policy?;
+    private registry;
+    constructor(policy?: SenderPolicy | undefined);
+    handle(channel: string, fn: HandleFn): this;
+    on(channel: string, fn: ListenerFn): this;
+    dispose(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=ipc-registry.d.ts.map

package/dist/main/utils/ipc-registry.js

@@ -0,0 +1,109 @@
+import { ipcMain } from 'electron';
+import { DisposableRegistry } from './disposable.js';
+import { IpcValidationError } from './ipc-schema.js';
+import { createLogger } from './logger.js';
+const log = createLogger('ipc');
+/**
+ * Funnels errors thrown by an `on()` listener into the logger so they don't
+ * escape into Electron's event loop. Validation errors get a compact `warn`
+ * (channel + zod paths), other errors get a full `error` with stack.
+ */
+function reportListenerError(channel, err) {
+    if (err instanceof IpcValidationError) {
+        log.warn(`schema reject on '${channel}' at [${err.paths.join(', ')}]`);
+        return;
+    }
+    if (err instanceof Error) {
+        log.error(`listener threw on '${channel}': ${err.message}`, err.stack);
+        return;
+    }
+    log.error(`listener threw on '${channel}'`, err);
+}
+function isThenable(v) {
+    return (v != null &&
+        (typeof v === 'object' || typeof v === 'function') &&
+        typeof v.then === 'function');
+}
+function summarizeSender(sender) {
+    if (sender.isDestroyed())
+        return '<destroyed>';
+    const url = sender.getURL();
+    return `id=${sender.id} ${url.slice(0, 120)}`;
+}
+/**
+ * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
+ * matching removeHandler/removeListener registered into an internal registry.
+ *
+ * Each `register*Ipc(ctx)` returns one of these as a Disposable so the
+ * workbench-level registry can dispose all built-in handlers in one shot.
+ *
+ * If a {@link SenderPolicy} is provided, every incoming invocation is gated:
+ * - `handle`: rejected senders cause the invoke promise to reject with
+ *   `Error('IPC sender rejected for channel <channel>')`.
+ * - `on`: rejected senders are silently dropped (the original listener is
+ *   never called).
+ * In both cases a single `console.warn` is emitted with the channel name
+ * and a short sender summary. Without a policy the wrapper is a no-op,
+ * preserving backwards compatibility for unit tests and callers that
+ * opted out.
+ */
+export class IpcRegistry {
+    policy;
+    registry = new DisposableRegistry();
+    constructor(policy) {
+        this.policy = policy;
+    }
+    handle(channel, fn) {
+        const policy = this.policy;
+        const guarded = policy
+            ? (event, ...args) => {
+                const sender = event.sender;
+                if (!policy(sender)) {
+                    console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`);
+                    throw new Error(`IPC sender rejected for channel ${channel}`);
+                }
+                return fn(event, ...args);
+            }
+            : fn;
+        ipcMain.handle(channel, guarded);
+        this.registry.add(() => ipcMain.removeHandler(channel));
+        return this;
+    }
+    on(channel, fn) {
+        const policy = this.policy;
+        const raw = fn;
+        const safeInvoke = (event, args) => {
+            try {
+                const ret = raw(event, ...args);
+                if (isThenable(ret)) {
+                    // Async listeners would otherwise leak rejections into Electron's
+                    // event loop as `UnhandledPromiseRejection`. Funnel them into the
+                    // same logger path as sync throws.
+                    Promise.resolve(ret).catch((err) => reportListenerError(channel, err));
+                }
+            }
+            catch (err) {
+                reportListenerError(channel, err);
+            }
+        };
+        const guarded = policy
+            ? (event, ...args) => {
+                const sender = event.sender;
+                if (!policy(sender)) {
+                    console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`);
+                    return;
+                }
+                safeInvoke(event, args);
+            }
+            : (event, ...args) => safeInvoke(event, args);
+        ipcMain.on(channel, guarded);
+        this.registry.add(() => {
+            ipcMain.removeListener(channel, guarded);
+        });
+        return this;
+    }
+    dispose() {
+        return this.registry.dispose();
+    }
+}
+//# sourceMappingURL=ipc-registry.js.map

package/dist/main/utils/ipc-schema.d.ts

@@ -0,0 +1,28 @@
+import type { z } from 'zod';
+/**
+ * Thrown by {@link validate} when an IPC payload fails its zod schema.
+ *
+ * Carries the channel name plus a compact list of failing zod paths so
+ * the IpcRegistry wrapper can log a short, actionable summary without
+ * dumping the full payload.
+ */
+export declare class IpcValidationError extends Error {
+    readonly channel: string;
+    readonly paths: string[];
+    constructor(channel: string, issues: ReadonlyArray<{
+        path: ReadonlyArray<PropertyKey>;
+    }>);
+}
+/**
+ * Parse an IPC handler's argument tuple against a zod schema.
+ *
+ * On failure: warns to console with the channel name + issue list, then throws
+ * an {@link IpcValidationError} so that:
+ *  - `ipcMain.handle` invocations reject the renderer's invoke promise
+ *    without leaking schema internals.
+ *  - `ipcMain.on` listeners (wrapped by IpcRegistry.on) can recognise the
+ *    error type and log a structured warning instead of letting the throw
+ *    escape into Electron's event loop.
+ */
+export declare function validate<T extends z.ZodTypeAny>(channel: string, schema: T, args: unknown[]): z.infer<T>;
+//# sourceMappingURL=ipc-schema.d.ts.map

package/dist/main/utils/ipc-schema.js

@@ -0,0 +1,38 @@
+/**
+ * Thrown by {@link validate} when an IPC payload fails its zod schema.
+ *
+ * Carries the channel name plus a compact list of failing zod paths so
+ * the IpcRegistry wrapper can log a short, actionable summary without
+ * dumping the full payload.
+ */
+export class IpcValidationError extends Error {
+    channel;
+    paths;
+    constructor(channel, issues) {
+        const paths = issues.map((i) => i.path.map((p) => String(p)).join('.') || '<root>');
+        super(`Invalid IPC arguments for ${channel}`);
+        this.name = 'IpcValidationError';
+        this.channel = channel;
+        this.paths = paths;
+    }
+}
+/**
+ * Parse an IPC handler's argument tuple against a zod schema.
+ *
+ * On failure: warns to console with the channel name + issue list, then throws
+ * an {@link IpcValidationError} so that:
+ *  - `ipcMain.handle` invocations reject the renderer's invoke promise
+ *    without leaking schema internals.
+ *  - `ipcMain.on` listeners (wrapped by IpcRegistry.on) can recognise the
+ *    error type and log a structured warning instead of letting the throw
+ *    escape into Electron's event loop.
+ */
+export function validate(channel, schema, args) {
+    const r = schema.safeParse(args);
+    if (!r.success) {
+        console.warn('[ipc] schema reject', channel, r.error.issues);
+        throw new IpcValidationError(channel, r.error.issues);
+    }
+    return r.data;
+}
+//# sourceMappingURL=ipc-schema.js.map

package/dist/main/utils/paths.d.ts

@@ -1,6 +1,12 @@
 export declare const devtoolsPackageRoot: string;
 export declare const rendererDir: string;
 export declare const defaultPreloadPath: string;
+/**
+ * Preload bundle for the main window, settings window, and the settings /
+ * popover overlay WebContentsViews. Exposes `window.devtools.ipc` via
+ * contextBridge so the renderer never needs `window.require('electron')`.
+ */
+export declare const mainPreloadPath: string;
 export declare const simulatorDir: string;
 export declare function getRendererDir(): string;
 export declare function getPreloadDir(): string;

package/dist/main/utils/paths.js

@@ -25,6 +25,12 @@ function resolveDevtoolsPackageRoot() {
 export const devtoolsPackageRoot = resolveDevtoolsPackageRoot();
 export const rendererDir = path.join(devtoolsPackageRoot, 'dist/renderer');
 export const defaultPreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/windows/simulator.js');
+/**
+ * Preload bundle for the main window, settings window, and the settings /
+ * popover overlay WebContentsViews. Exposes `window.devtools.ipc` via
+ * contextBridge so the renderer never needs `window.require('electron')`.
+ */
+export const mainPreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/windows/main.cjs');
 export const simulatorDir = path.join(devtoolsPackageRoot, 'dist/simulator');
 export function getRendererDir() {
     return rendererDir;

package/dist/main/utils/sender-policy.d.ts

@@ -0,0 +1,23 @@
+import type { WorkbenchContext } from '../services/workbench-context.js';
+import type { SenderPolicy } from './ipc-registry.js';
+/**
+ * Default workbench sender white-list.
+ *
+ * An IPC message is accepted only when its `event.sender` matches one of
+ * the WebContents the main process itself created and trusts:
+ * - the main window's renderer
+ * - the optional workbench settings BrowserWindow's renderer (when open)
+ * - the settings overlay view (when open)
+ * - the popover overlay view (when open)
+ *
+ * The simulator webview is intentionally NOT on this list: its preload
+ * (`src/preload/windows/simulator.ts`) uses `ipcRenderer.sendToHost`
+ * exclusively, never `invoke`/`send`, so it can't legitimately reach an
+ * ipcMain handler. Including it would only widen the attack surface if
+ * the guest were ever compromised.
+ *
+ * Any other sender — including a stale/destroyed sender or an unknown
+ * iframe — is rejected.
+ */
+export declare function createWorkbenchSenderPolicy(ctx: Pick<WorkbenchContext, 'windows' | 'views'>): SenderPolicy;
+//# sourceMappingURL=sender-policy.d.ts.map