@dimina-kit/devtools 0.3.2-dev.20260525152421 → 0.3.2-dev.20260610082053

package/dist/main/services/workbench-context.d.ts

@@ -1,6 +1,11 @@
 import type { BrowserWindow } from 'electron';
 import type { CompilationAdapter, WorkbenchConfig } from '../../shared/types.js';
-import { DisposableRegistry } from '../utils/disposable.js';
+import type { BridgeRouterHandle } from '../ipc/bridge-router.js';
+import type { ConsoleForwarder } from './console-forward/index.js';
+import type { NetworkForwarder } from './network-forward/index.js';
+import type { AppDataTap } from './simulator-appdata/index.js';
+import type { StorageApi } from './simulator-storage/index.js';
+import { DisposableRegistry, type ConnectionRegistry } from '@dimina-kit/electron-deck/main';
 import type { SenderPolicy } from '../utils/ipc-registry.js';
 import { type RendererNotifier } from './notifications/renderer-notifier.js';
 import { type ViewManager } from './views/view-manager.js';
@@ -97,6 +102,66 @@ export interface WorkbenchContext {
     toolbar: ToolbarStore;
     /** Aggregates dispose handlers for every IPC handler, listener, watcher, and CDP session registered by the workbench. */
     registry: DisposableRegistry;
+    /**
+     * Per-webContents connection registry. Each trusted webContents (main window,
+     * overlay views, native simulator/render guests) is one `Connection` that
+     * owns the resources tied to its lifetime and tears them down deterministically
+     * on `webContents.once('destroyed')` (hard) or `reset(id)` (soft pool reuse).
+     * The substrate for connection-scoped resource ownership — see
+     * packages/electron-deck/docs/foundation.md §4. Domain services consume it by
+     * `own()`-ing their per-endpoint resources and observing `reset`/`closed`.
+     */
+    connections: ConnectionRegistry;
+    /**
+     * Accessor over the bridge-router's private state, set by `installBridgeRouter`.
+     * Lets other main services (simulator-storage, automation, appdata) resolve
+     * live render/service WebContents and the native-host flag without owning
+     * router state. Undefined until the bridge router is installed.
+     */
+    bridge?: BridgeRouterHandle;
+    /**
+     * Native-host AppData tap, set by `setupSimulatorAppData` (app.ts) when
+     * native-host is on. bridge-router feeds it the service→render setData stream
+     * + page evictions so the AppData panel can be sourced from main. Undefined on
+     * the default dimina-fe path (which sniffs setData via a Worker hook).
+     */
+    appData?: AppDataTap;
+    /**
+     * Native-host async-storage runtime hook, set by `setupSimulatorStorage` when
+     * native-host is on. bridge-router routes async `wx.setStorage`/etc. here so
+     * they hit the same service-host `file://` store as the sync APIs (one origin).
+     * Undefined on the default dimina-fe path (storage handled in the guest).
+     */
+    storageApi?: StorageApi;
+    /**
+     * Native-host console sink. The render-host / service-host guest preloads
+     * monkeypatch `console.*` and post each entry to main as a `consoleLog`
+     * container message; bridge-router routes those here. Owned by the
+     * `ConsoleForwarder` (set in `installBridgeRouter`), whose `emit` fans every
+     * entry out to subscribers (automation WS) AND mirrors render-layer entries
+     * into the service host's own console for the embedded DevTools.
+     */
+    guestConsole?: {
+        emit(entry: unknown): void;
+    };
+    /**
+     * Always-on console fan-out, set by `installBridgeRouter`. Other services
+     * (automation) call `subscribe` to receive every guest console entry instead
+     * of each clobbering `ctx.guestConsole`. Undefined until the bridge router is
+     * installed.
+     */
+    consoleForwarder?: ConsoleForwarder;
+    /**
+     * Native-host network forwarder, set in app bootstrap. Attaches the CDP
+     * debugger to the simulator WCV (where `wx.request`/`downloadFile`/`uploadFile`
+     * run) and injects its raw Network.* CDP events into the DevTools FRONT-END wc
+     * (`window.DevToolsAPI.dispatchMessage`) so the native Network tab renders them;
+     * falls back to a `[网络]` service-host console line when the front-end is
+     * unavailable. The ViewManager calls `attachSimulator` + `setDevtoolsHost` from
+     * `attachNativeSimulator` once the simulator WCV + DevTools host exist.
+     * Undefined until bootstrap wires it.
+     */
+    networkForward?: NetworkForwarder;
 }
 /**
  * Inputs for `createWorkbenchContext`. The scalar config fields it shares with

package/dist/main/services/workbench-context.js

@@ -1,4 +1,4 @@
-import { DisposableRegistry } from '../utils/disposable.js';
+import { createConnectionRegistry, DisposableRegistry, } from '@dimina-kit/electron-deck/main';
 import { createWorkbenchSenderPolicy } from '../utils/sender-policy.js';
 import { defaultAdapter } from './default-adapter.js';
 import { createRendererNotifier, } from './notifications/renderer-notifier.js';
@@ -32,6 +32,11 @@ export function createWorkbenchContext(opts) {
         brandingProvider: opts.brandingProvider,
     };
     ctx.registry = new DisposableRegistry();
+    // Empty connection registry as a first-class context field. Connections are
+    // acquired by real wiring points (app bootstrap, view-manager endpoints),
+    // NOT here — the constructor stays side-effect-free so focused unit tests can
+    // build a context with a minimal mainWindow fake.
+    ctx.connections = createConnectionRegistry();
     ctx.trustedWindowSenderIds = new Map();
     ctx.simulatorApis = createSimulatorApiRegistry();
     ctx.toolbar = createToolbarStore();

package/dist/main/services/workspace/workspace-service.d.ts

@@ -38,6 +38,14 @@ export interface WorkspaceService {
         appInfo: unknown;
     } | null;
     getProjectPath(): string;
+    /**
+     * The project path most recently torn down by `closeProject`, or '' if none
+     * since the last `openProject`. Lets the project-fs sandbox accept an
+     * in-flight write (debounced/teardown flush) that targets the just-closed
+     * project even though `getProjectPath()` has already been cleared. Reset to
+     * '' on the next `openProject` so it never accumulates stale roots.
+     */
+    getLastClosedProjectPath(): string;
     hasActiveSession(): boolean;
     captureThumbnail(projectPath: string): Promise<string | null>;
     getThumbnail(projectPath: string): Promise<string | null>;

package/dist/main/services/workspace/workspace-service.js

@@ -6,6 +6,10 @@ import { loadWorkbenchSettings } from '../settings/index.js';
 export function createWorkspaceService(ctx) {
     let currentSession = null;
     let currentProjectPath = '';
+    // The last project path cleared by `closeProject`; consumed by project-fs to
+    // accept an in-flight write that targets the just-closed project. Reset at
+    // the start of every `openProject` so it never accumulates a stale root.
+    let lastClosedProjectPath = '';
     function sendStatus(status, message, hotReload) {
         ctx.notify.projectStatus(hotReload ? { status, message, hotReload: true } : { status, message });
     }
@@ -61,6 +65,9 @@ export function createWorkspaceService(ctx) {
             clearSimulatorServicewechatReferer();
             await disposeSession();
             currentProjectPath = '';
+            // A fresh open starts a clean sandbox window — drop any previously
+            // recorded last-closed root so it can't accept writes after this point.
+            lastClosedProjectPath = '';
             // Reject obviously broken projects up front so we never spin up a
             // compile/server that the simulator will then fetch asset-by-asset.
             // Without this guard, deleted recent-list entries and typo'd CLI paths
@@ -109,11 +116,16 @@ export function createWorkspaceService(ctx) {
         async closeProject() {
             clearSimulatorServicewechatReferer();
             await disposeSession();
+            // Record the root being torn down BEFORE clearing it, so a teardown/
+            // debounced write already in flight can still be accepted against it.
+            if (currentProjectPath !== '')
+                lastClosedProjectPath = currentProjectPath;
             currentProjectPath = '';
             ctx.views.disposeAll();
         },
         getSession: () => currentSession,
         getProjectPath: () => currentProjectPath,
+        getLastClosedProjectPath: () => lastClosedProjectPath,
         hasActiveSession: () => currentSession !== null,
         async captureThumbnail(projectPath) {
             const wc = ctx.views.getSimulatorWebContents();

package/dist/main/utils/ipc-registry.d.ts

@@ -1,6 +1,6 @@
-import type { WebContents } from 'electron';
+import type { IpcMainEvent, WebContents } from 'electron';
 import { ipcMain } from 'electron';
-import { type Disposable } from './disposable.js';
+import { type Disposable } from '@dimina-kit/electron-deck/main';
 type HandleFn = Parameters<typeof ipcMain.handle>[1];
 type ListenerFn = Parameters<typeof ipcMain.on>[1];
 /**
@@ -32,6 +32,15 @@ export declare class IpcRegistry implements Disposable {
     private registry;
     constructor(policy?: SenderPolicy | undefined);
     handle(channel: string, fn: HandleFn): this;
+    /**
+     * Register a SYNCHRONOUS `ipcRenderer.sendSync` handler. Unlike {@link on}
+     * (fire-and-forget), the renderer is blocked until we set `event.returnValue`,
+     * so `fn` MUST be synchronous and return the value to hand back. The sender
+     * policy gates it like {@link handle}; a rejected sender or a thrown error
+     * yields a structured `{ ok: false, code, message }` returnValue instead of
+     * the silent drop `on` uses, so the blocked renderer always gets an answer.
+     */
+    handleSync(channel: string, fn: (event: IpcMainEvent, ...args: unknown[]) => unknown): this;
     on(channel: string, fn: ListenerFn): this;
     dispose(): Promise<void>;
 }

package/dist/main/utils/ipc-registry.js

@@ -1,5 +1,5 @@
 import { ipcMain } from 'electron';
-import { DisposableRegistry } from './disposable.js';
+import { DisposableRegistry } from '@dimina-kit/electron-deck/main';
 import { IpcValidationError } from './ipc-schema.js';
 import { createLogger } from './logger.js';
 const log = createLogger('ipc');
@@ -30,6 +30,23 @@ function summarizeSender(sender) {
     const url = sender.getURL();
     return `id=${sender.id} ${url.slice(0, 120)}`;
 }
+function isMainFrameSender(event) {
+    // Read via loose casts: the Electron types declare these always-present, but
+    // unit-test stubs legitimately omit them — and real events can carry a null
+    // senderFrame after navigation/destruction.
+    const frame = event.senderFrame;
+    const main = event.sender.mainFrame;
+    // Frame-unaware stub (NEITHER field modeled) → not a real frame boundary; the
+    // sender-id white-list is the gate. Real events always have both, so they fall
+    // through to the strict check; a partial/malformed event (only one field) also
+    // falls through and fail-closes below rather than escaping here.
+    if (frame === undefined && main === undefined)
+        return true;
+    // Real event, unresolvable frame (navigate-after-send / destroyed) → reject.
+    if (frame == null || main == null)
+        return false;
+    return frame.routingId === main.routingId && frame.processId === main.processId;
+}
 /**
  * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
  * matching removeHandler/removeListener registered into an internal registry.
@@ -62,7 +79,7 @@ export class IpcRegistry {
         const guarded = policy
             ? async (event, ...args) => {
                 const sender = event.sender;
-                if (!policy(sender)) {
+                if (!policy(sender) || !isMainFrameSender(event)) {
                     console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`);
                     throw new Error(`IPC sender rejected for channel ${channel}`);
                 }
@@ -73,6 +90,49 @@ export class IpcRegistry {
         this.registry.add(() => ipcMain.removeHandler(channel));
         return this;
     }
+    /**
+     * Register a SYNCHRONOUS `ipcRenderer.sendSync` handler. Unlike {@link on}
+     * (fire-and-forget), the renderer is blocked until we set `event.returnValue`,
+     * so `fn` MUST be synchronous and return the value to hand back. The sender
+     * policy gates it like {@link handle}; a rejected sender or a thrown error
+     * yields a structured `{ ok: false, code, message }` returnValue instead of
+     * the silent drop `on` uses, so the blocked renderer always gets an answer.
+     */
+    handleSync(channel, fn) {
+        const policy = this.policy;
+        const listener = (event, ...args) => {
+            // Everything — including the policy check — runs inside the try so EVERY
+            // path sets `event.returnValue`. sendSync blocks the renderer until it is
+            // set, so an unset value (e.g. a throwing policy fn) would hang the
+            // renderer forever; the catch guarantees a sentinel instead.
+            try {
+                if (policy && (!policy(event.sender) || !isMainFrameSender(event))) {
+                    console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(event.sender)})`);
+                    event.returnValue = {
+                        ok: false,
+                        code: 'EREJECTED',
+                        message: `IPC sender rejected for channel ${channel}`,
+                    };
+                    return;
+                }
+                event.returnValue = fn(event, ...args);
+            }
+            catch (err) {
+                reportListenerError(channel, err);
+                const code = err?.code;
+                event.returnValue = {
+                    ok: false,
+                    code: typeof code === 'string' ? code : 'EUNKNOWN',
+                    message: err instanceof Error ? err.message : String(err),
+                };
+            }
+        };
+        ipcMain.on(channel, listener);
+        this.registry.add(() => {
+            ipcMain.removeListener(channel, listener);
+        });
+        return this;
+    }
     on(channel, fn) {
         const policy = this.policy;
         const raw = fn;
@@ -93,7 +153,7 @@ export class IpcRegistry {
         const guarded = policy
             ? (event, ...args) => {
                 const sender = event.sender;
-                if (!policy(sender)) {
+                if (!policy(sender) || !isMainFrameSender(event)) {
                     console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`);
                     return;
                 }

package/dist/main/utils/paths.d.ts

@@ -1,12 +1,27 @@
 export declare const devtoolsPackageRoot: string;
 export declare const rendererDir: string;
 export declare const defaultPreloadPath: string;
+/**
+ * Resolve the CommonJS sibling (`*.cjs`) of a simulator preload bundle.
+ *
+ * A `<webview>`/session-frame preload is always loaded as CommonJS by Electron.
+ * The native-host simulator (the sole runtime) instead runs in a top-level
+ * WebContentsView whose `webPreferences.preload` obeys the `.js` +
+ * `"type":"module"` ESM rule — so the `.js` bundle would fail with
+ * `require is not defined`. We ship a byte-identical `.cjs` copy
+ * (build:preload emits both) and hand the WCV the `.cjs` sibling. If a host
+ * supplies a custom `.js` preload, we swap the extension; an already-`.cjs`
+ * path (or any non-`.js`) is returned unchanged.
+ */
+export declare function cjsSiblingPreloadPath(preloadPath: string): string;
 /**
  * Preload bundle for the main window, settings window, and the settings /
  * popover overlay WebContentsViews. Exposes `window.devtools.ipc` via
  * contextBridge so the renderer never needs `window.require('electron')`.
  */
 export declare const mainPreloadPath: string;
+/** Preload for the host-controllable toolbar WCV — runs the reverse size-advertiser. */
+export declare const hostToolbarPreloadPath: string;
 export declare const simulatorDir: string;
 export declare function getRendererDir(): string;
 export declare function getPreloadDir(): string;

package/dist/main/utils/paths.js

@@ -25,12 +25,31 @@ function resolveDevtoolsPackageRoot() {
 export const devtoolsPackageRoot = resolveDevtoolsPackageRoot();
 export const rendererDir = path.join(devtoolsPackageRoot, 'dist/renderer');
 export const defaultPreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/windows/simulator.js');
+/**
+ * Resolve the CommonJS sibling (`*.cjs`) of a simulator preload bundle.
+ *
+ * A `<webview>`/session-frame preload is always loaded as CommonJS by Electron.
+ * The native-host simulator (the sole runtime) instead runs in a top-level
+ * WebContentsView whose `webPreferences.preload` obeys the `.js` +
+ * `"type":"module"` ESM rule — so the `.js` bundle would fail with
+ * `require is not defined`. We ship a byte-identical `.cjs` copy
+ * (build:preload emits both) and hand the WCV the `.cjs` sibling. If a host
+ * supplies a custom `.js` preload, we swap the extension; an already-`.cjs`
+ * path (or any non-`.js`) is returned unchanged.
+ */
+export function cjsSiblingPreloadPath(preloadPath) {
+    return preloadPath.endsWith('.js')
+        ? preloadPath.slice(0, -'.js'.length) + '.cjs'
+        : preloadPath;
+}
 /**
  * Preload bundle for the main window, settings window, and the settings /
  * popover overlay WebContentsViews. Exposes `window.devtools.ipc` via
  * contextBridge so the renderer never needs `window.require('electron')`.
  */
 export const mainPreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/windows/main.cjs');
+/** Preload for the host-controllable toolbar WCV — runs the reverse size-advertiser. */
+export const hostToolbarPreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/windows/host-toolbar.cjs');
 export const simulatorDir = path.join(devtoolsPackageRoot, 'dist/simulator');
 export function getRendererDir() {
     return rendererDir;

package/dist/main/utils/sender-policy.d.ts

@@ -12,9 +12,15 @@ import type { SenderPolicy } from './ipc-registry.js';
  *
  * The simulator webview is intentionally NOT on this list. Anything it
  * needs from main (currently just the custom-apis bridge — see
- * `installCustomApisBridge` in `src/preload/runtime/custom-apis.ts` and the
- * matching `useCustomApiProxy` host hook) proxies through the trusted
- * main-window renderer via `ipcRenderer.sendToHost` + `<webview>.send`.
+ * `installCustomApisBridge` in `src/preload/runtime/custom-apis.ts`) reaches
+ * the host without being white-listed here via the native-host path:
+ * the simulator is a top-level WebContentsView (no embedder), and its
+ * custom-api traffic is dispatched by a `ctx.simulatorApis`-backed
+ * `ipcMain.on` listener bound to that exact simWc in view-manager
+ * `attachNativeCustomApiBridge` — it gates on the precise sender id rather
+ * than this white-list. (Historically a `<webview>` simulator proxied through
+ * the trusted main-window renderer via `ipcRenderer.sendToHost` + `<webview>.send`;
+ * that renderer-proxied path no longer exists — native-host is the sole runtime.)
  * Keeping the guest off this list contains the blast radius if the
  * simulator content is ever compromised.
  *

package/dist/main/utils/sender-policy.js

@@ -10,9 +10,15 @@
  *
  * The simulator webview is intentionally NOT on this list. Anything it
  * needs from main (currently just the custom-apis bridge — see
- * `installCustomApisBridge` in `src/preload/runtime/custom-apis.ts` and the
- * matching `useCustomApiProxy` host hook) proxies through the trusted
- * main-window renderer via `ipcRenderer.sendToHost` + `<webview>.send`.
+ * `installCustomApisBridge` in `src/preload/runtime/custom-apis.ts`) reaches
+ * the host without being white-listed here via the native-host path:
+ * the simulator is a top-level WebContentsView (no embedder), and its
+ * custom-api traffic is dispatched by a `ctx.simulatorApis`-backed
+ * `ipcMain.on` listener bound to that exact simWc in view-manager
+ * `attachNativeCustomApiBridge` — it gates on the precise sender id rather
+ * than this white-list. (Historically a `<webview>` simulator proxied through
+ * the trusted main-window renderer via `ipcRenderer.sendToHost` + `<webview>.send`;
+ * that renderer-proxied path no longer exists — native-host is the sole runtime.)
  * Keeping the guest off this list contains the blast radius if the
  * simulator content is ever compromised.
  *
@@ -43,7 +49,15 @@ export function createWorkbenchSenderPolicy(ctx) {
         const popoverViewId = ctx.views.getPopoverWebContentsId();
         if (popoverViewId != null && sender.id === popoverViewId)
             return true;
-        // simulator <webview> proxies through main-window renderer (see file header).
+        // The host-toolbar overlay is DELIBERATELY NOT trusted here. The host loads
+        // arbitrary content into it, so granting it the global white-list would open
+        // all ~72 IpcRegistry channels to that content. Its one channel (the reverse
+        // size-advertiser) is instead a raw `ipcMain.on` gated on its exact wc id in
+        // `registerViewsIpc` — same blast-radius containment as the simulator guest.
+        // The simulator (a top-level WebContentsView under native-host) is also
+        // DELIBERATELY off this white-list; its custom-api traffic is gated on the
+        // exact simWc id elsewhere (see file header). There is no longer a
+        // renderer-proxied <webview> simulator path.
         return false;
     };
 }

package/dist/main/utils/theme.d.ts

@@ -1,4 +1,4 @@
-import { type Disposable } from './disposable.js';
+import { type Disposable } from '@dimina-kit/electron-deck/main';
 /**
  * Background color that matches the current system color scheme.
  * Pass as `backgroundColor` when creating BrowserWindows to prevent

package/dist/main/utils/theme.js

@@ -1,5 +1,5 @@
 import { BrowserWindow, nativeTheme } from 'electron';
-import { toDisposable } from './disposable.js';
+import { toDisposable } from '@dimina-kit/electron-deck/main';
 /**
  * Background color that matches the current system color scheme.
  * Pass as `backgroundColor` when creating BrowserWindows to prevent

package/dist/main/windows/main-window/create.d.ts

@@ -6,12 +6,6 @@ export interface WindowOptions {
     minWidth?: number;
     minHeight?: number;
     indexHtml: string;
-    /**
-     * Absolute path to the simulator preload bundle. Registered at the session
-     * level so every frame inside the simulator <webview> gets the preload that
-     * exposes the `wx` runtime to the mini-program.
-     */
-    simulatorPreloadPath: string;
 }
 export declare function createMainWindow(opts: WindowOptions): BrowserWindow;
 //# sourceMappingURL=create.d.ts.map

package/dist/main/windows/main-window/create.js

@@ -1,21 +1,15 @@
-import { app, BrowserWindow, View, session, shell } from 'electron';
+import { app, BrowserWindow, View, session } from 'electron';
 import path from 'path';
 import { getSimulatorServicewechatReferer } from '../../services/simulator/referer.js';
 import { mainPreloadPath } from '../../utils/paths.js';
 import { themeBg } from '../../utils/theme.js';
-import { applyNavigationHardening, handleWindowOpenExternal, } from '../navigation-hardening.js';
+import { applyNavigationHardening } from '../navigation-hardening.js';
 let simulatorSessionConfigured = false;
-function configureSimulatorSession(simulatorPreloadPath) {
+function configureSimulatorSession() {
     if (simulatorSessionConfigured)
         return;
     simulatorSessionConfigured = true;
     const simulatorSession = session.fromPartition('persist:simulator');
-    // Inject the simulator preload on every frame in this session. This is the
-    // mini-program runtime entry point (exposes `wx`, page registers, etc.).
-    simulatorSession.registerPreloadScript({
-        type: 'frame',
-        filePath: simulatorPreloadPath,
-    });
     simulatorSession.webRequest.onBeforeSendHeaders((details, callback) => {
         const forcedReferer = getSimulatorServicewechatReferer();
         if (forcedReferer) {
@@ -25,16 +19,17 @@ function configureSimulatorSession(simulatorPreloadPath) {
     });
     simulatorSession.webRequest.onHeadersReceived((details, callback) => {
         const headers = details.responseHeaders ?? {};
+        // CORS for the native render/service hosts to fetch compiled app resources
+        // cross-origin. (The COOP/COEP cross-origin-isolation headers were only for
+        // the removed default-path SharedArrayBuffer sync Worker — dropped.)
         headers['access-control-allow-origin'] = ['*'];
         headers['access-control-allow-headers'] = ['*'];
         headers['access-control-allow-methods'] = ['*'];
-        headers['Cross-Origin-Opener-Policy'] = ['same-origin'];
-        headers['Cross-Origin-Embedder-Policy'] = ['credentialless'];
         callback({ responseHeaders: headers });
     });
 }
 export function createMainWindow(opts) {
-    configureSimulatorSession(opts.simulatorPreloadPath);
+    configureSimulatorSession();
     const mainWindow = new BrowserWindow({
         width: opts.width ?? 1280,
         height: opts.height ?? 980,
@@ -50,8 +45,6 @@ export function createMainWindow(opts) {
             // to access contextBridge/ipcRenderer. The renderer itself runs isolated.
             sandbox: false,
             preload: mainPreloadPath,
-            // The simulator <webview> still relies on the webview tag; keep it enabled.
-            webviewTag: true,
         },
     });
     mainWindow.once('ready-to-show', () => {
@@ -60,7 +53,10 @@ export function createMainWindow(opts) {
         }
         else {
             mainWindow.show();
-            if (!app.isPackaged) {
+            // Don't auto-open a detached DevTools for the devtools UI shell itself —
+            // it's noise for normal use (the mini-app's Console lives in the embedded
+            // right-panel DevTools, not here). Opt in via env for debugging the shell.
+            if (!app.isPackaged && process.env.DIMINA_DEVTOOLS_MAIN_INSPECTOR === '1') {
                 mainWindow.webContents.openDevTools({ mode: 'detach' });
             }
         }
@@ -69,50 +65,6 @@ export function createMainWindow(opts) {
     // Restrict the main renderer to file:// URLs under the renderer bundle and
     // route every popup through the OS browser. See navigation-hardening.ts.
     applyNavigationHardening(mainWindow.webContents, rendererDir);
-    mainWindow.webContents.on('will-attach-webview', (event, webPreferences, params) => {
-        // Pin the simulator <webview> onto `persist:simulator` so it shares storage
-        // with the rest of the session and picks up the session-registered preload.
-        // Empirically (Electron 41) `webPreferences.partition` is the field the
-        // guest session actually consults; `params.partition` alone is a no-op,
-        // so we write both belt-and-braces.
-        ;
-        webPreferences.partition = 'persist:simulator';
-        params.partition = 'persist:simulator';
-        // The simulator <webview> intentionally runs with `contextIsolation: false`
-        // because the dimina runtime and the user-authored preload scripts share
-        // the same JavaScript realm as the page — the mini-program SDK reaches
-        // into the page's globals (e.g. AudioContext, custom registers) and
-        // attaches helpers via window-level injection. Flipping isolation on
-        // would break that contract.
-        webPreferences.contextIsolation = false;
-        void event;
-    });
-    // The simulator webview's webContents only exists once attached; wire its
-    // window-open / will-navigate handlers here so popups + redirects don't
-    // pivot to file:// or arbitrary origins.
-    mainWindow.webContents.on('did-attach-webview', (_event, webviewWebContents) => {
-        webviewWebContents.setWindowOpenHandler(({ url }) => handleWindowOpenExternal(url));
-        webviewWebContents.on('will-navigate', (e, url) => {
-            try {
-                const u = new URL(url);
-                // Allow the simulator's own host (localhost dev server) plus the
-                // initial about:blank that Chromium uses before src loads.
-                if (u.protocol === 'about:')
-                    return;
-                if ((u.protocol === 'http:' || u.protocol === 'https:') &&
-                    (u.hostname === 'localhost' || u.hostname === '127.0.0.1')) {
-                    return;
-                }
-                e.preventDefault();
-                if (u.protocol === 'http:' || u.protocol === 'https:') {
-                    void shell.openExternal(url);
-                }
-            }
-            catch {
-                e.preventDefault();
-            }
-        });
-    });
     mainWindow.loadFile(opts.indexHtml);
     const container = new View();
     const mainWebView = mainWindow.contentView;

package/dist/main/windows/main-window/events.d.ts

@@ -1,6 +1,6 @@
 import type { BrowserWindow } from 'electron';
 import type { WorkbenchContext } from '../../services/workbench-context.js';
-import { type Disposable } from '../../utils/disposable.js';
+import { type Disposable } from '@dimina-kit/electron-deck/main';
 export interface MainWindowEventState {
     context?: WorkbenchContext;
     onResize?: () => void;

package/dist/main/windows/main-window/events.js

@@ -1,5 +1,5 @@
 import { globalShortcut } from 'electron';
-import { DisposableRegistry, toDisposable } from '../../utils/disposable.js';
+import { DisposableRegistry, toDisposable } from '@dimina-kit/electron-deck/main';
 export function wireMainWindowEvents(win, state = {}) {
     const registry = new DisposableRegistry();
     const mainWebView = win.contentView.children[0];

package/dist/main/windows/service-host-window/create.d.ts

@@ -0,0 +1,52 @@
+import { BrowserWindow } from 'electron';
+import type { ServiceHostSpec } from '../../services/service-host-pool/pool.js';
+/** Session partition the service host shares with the simulator `<webview>`. */
+export declare const SERVICE_HOST_PARTITION = "persist:simulator";
+/** Absolute path to the service-host preload (loaded at runtime by path). */
+export declare const serviceHostPreloadPath: string;
+export interface ServiceHostWindowOptions {
+    bridgeId: string;
+    appId: string;
+    pagePath: string;
+    pkgRoot: string;
+    resourceBaseUrl: string;
+    hostEnvSnapshot?: Record<string, unknown>;
+}
+/**
+ * Construct an (un-navigated) service-host BrowserWindow. Split out from
+ * `createServiceHostWindow` so a pre-warm pool can build the window once and
+ * navigate it per spawn (the spawn context lives in the URL — see
+ * `buildServiceHostSpawnUrl`). The process-model flags here are the contract
+ * the service-host preload depends on (it `require('electron')` and writes
+ * globals onto the page realm).
+ */
+export declare function constructServiceHostWindow(opts?: {
+    appId?: string;
+    partition?: string;
+}): BrowserWindow;
+/**
+ * Build the file:// spawn URL carrying the per-spawn context the preload reads
+ * from `location.search` at eval time (bridgeId/appId/pagePath/pkgRoot/
+ * resourceBaseUrl/hostEnv).
+ */
+export declare function buildServiceHostSpawnUrl(opts: ServiceHostWindowOptions): string;
+/**
+ * Navigate a (constructed or pooled) service-host window to its spawn URL. The
+ * preload re-evaluates on this navigation, rebuilding `__diminaSpawnContext`.
+ * Returns the load promise (resolves on did-finish-load). Attaches the dev-only
+ * detached-DevTools hook, matching the original behavior.
+ */
+export declare function navigateServiceHost(win: BrowserWindow, url: string): Promise<void>;
+/**
+ * The spec a `ServiceHostPool` uses to pre-warm service-host windows. Keeps the
+ * pooled window byte-equivalent to `constructServiceHostWindow`'s output, and
+ * opts out of the reset storage-clear because the service host shares the
+ * `persist:simulator` session with live projects (see ServiceHostSpec docs).
+ */
+export declare function serviceHostSpec(): ServiceHostSpec;
+/**
+ * Construct + navigate a fresh service-host window (the non-pool path).
+ * Behavior-identical to the pre-refactor implementation.
+ */
+export declare function createServiceHostWindow(opts: ServiceHostWindowOptions): BrowserWindow;
+//# sourceMappingURL=create.d.ts.map