@dimina-kit/devtools 0.3.2-dev.20260525152421 → 0.3.2-dev.20260610082053

package/dist/main/ipc/panels.d.ts

@@ -1,4 +1,4 @@
 import type { WorkbenchContext } from '../services/workbench-context.js';
-import type { Disposable } from '../utils/disposable.js';
+import type { Disposable } from '@dimina-kit/electron-deck/main';
 export declare function registerPanelsIpc(ctx: Pick<WorkbenchContext, 'panels' | 'views' | 'workspace' | 'senderPolicy'>): Disposable;
 //# sourceMappingURL=panels.d.ts.map

package/dist/main/ipc/panels.js

@@ -1,4 +1,4 @@
-import { PanelChannel } from '../../shared/ipc-channels.js';
+import { PanelChannel, WorkbenchRuntimeChannel } from '../../shared/ipc-channels.js';
 import { PanelEvalSchema, PanelSelectSchema, } from '../../shared/ipc-schemas.js';
 import { validate } from '../utils/ipc-schema.js';
 import { IpcRegistry } from '../utils/ipc-registry.js';
@@ -37,6 +37,10 @@ export function registerPanelsIpc(ctx) {
         if (ctx.views.hasSimulatorView() && !ctx.views.isSimulatorAdded()) {
             ctx.views.showSimulator(ctx.views.getLastSimWidth());
         }
-    });
+    })
+        // Renderer reads this once to pick panel data sources: native-host is the
+        // sole runtime, so WXML + AppData always come from the main process (the
+        // page/service logic live in separate webContents).
+        .handle(WorkbenchRuntimeChannel.GetNativeHost, () => true);
 }
 //# sourceMappingURL=panels.js.map

package/dist/main/ipc/popover.d.ts

@@ -1,6 +1,6 @@
 import type { WorkbenchContext } from '../services/workbench-context.js';
 import type { WorkbenchModule } from '../services/module.js';
-import type { Disposable } from '../utils/disposable.js';
+import type { Disposable } from '@dimina-kit/electron-deck/main';
 export declare function registerPopoverIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'senderPolicy'>): Disposable;
 export declare const popoverModule: WorkbenchModule;
 //# sourceMappingURL=popover.d.ts.map

package/dist/main/ipc/project-fs.d.ts

@@ -0,0 +1,57 @@
+import type { WorkbenchContext } from '../services/workbench-context.js';
+import type { Disposable } from '@dimina-kit/electron-deck/main';
+/**
+ * Synchronous, string-level guard: reject empty root (ENOACTIVE), NUL bytes
+ * and empty paths (EINVAL), and lexical `..` escapes (EACCES) by resolving
+ * both sides with `path.resolve` and a `path.sep`-aware containment check
+ * (so `/foo/bar` ⊄ `/foo/bar2`). This is the cheap first pass; it does NOT
+ * resolve symlinks — that is done by `resolveWithinProjectRoot` below.
+ */
+export declare function enforceWithinProjectRoot(abs: string, root: string): string;
+/**
+ * Pick the project root a write should be validated against: the CURRENT root
+ * or the LAST-CLOSED one (recorded by workspace-service in `closeProject`,
+ * reset in `openProject`). This rescues an in-flight teardown/debounced write
+ * whose target lives under the project that was just closed — `closeProject`
+ * clears `currentProjectPath` to '' BEFORE the renderer navigates away, so a
+ * write resolving its root via the live root alone would be rejected with
+ * ENOACTIVE and the developer's last edit lost.
+ *
+ * Selection is purely LEXICAL (same `path.resolve` + `path.sep`-aware
+ * containment as `enforceWithinProjectRoot`, no fs I/O): symlink/realpath
+ * hardening stays in the downstream `resolveWithinProjectRoot` /
+ * `assertWritableAncestor` defences, applied by the caller against the root
+ * this returns — so accepting the last-closed root never relaxes the sandbox.
+ *
+ *  - Returns whichever root lexically contains `absPath`, preferring `current`.
+ *  - An empty-string root ('') means "no such root" and is never selected.
+ *  - Throws when `absPath` is inside NEITHER root: ENOACTIVE when both roots
+ *    are empty (no project context at all), otherwise EACCES (the path escapes
+ *    every known sandbox root).
+ */
+export declare function pickWriteRoot(absPath: string, roots: {
+    current: string;
+    lastClosed: string;
+}): string;
+declare function readFile(root: string, p: string): Promise<string>;
+declare function writeFile(root: string, p: string, content: string): Promise<void>;
+/** Synchronous twin of {@link writeFile} — identical sandbox, blocking I/O. */
+declare function writeFileSync(root: string, p: string, content: string): void;
+declare function listFiles(root: string, rootArg: string): Promise<string[]>;
+/**
+ * Register the project-fs IPC channels. Call once during workbench setup;
+ * the returned Disposable removes every channel (park on `ctx.registry`).
+ */
+export declare function registerProjectFsIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'senderPolicy'>): Disposable;
+/** Test seams — pure handlers, no Electron needed. */
+export declare const __testing: {
+    readFile: typeof readFile;
+    writeFile: typeof writeFile;
+    writeFileSync: typeof writeFileSync;
+    listFiles: typeof listFiles;
+    pickWriteRoot: typeof pickWriteRoot;
+    SKIP_DIRS: ReadonlySet<string>;
+    LIST_FILE_LIMIT: number;
+};
+export {};
+//# sourceMappingURL=project-fs.d.ts.map

package/dist/main/ipc/project-fs.js

@@ -0,0 +1,448 @@
+/**
+ * Sandboxed project file-system IPC for the in-renderer Monaco editor.
+ *
+ * Replaces the OpenSumi editor's `editor:fs:*` bridge (which was gated to a
+ * separate WebContentsView via an allow-list). The Monaco editor now lives
+ * in the MAIN renderer, so these channels run under the standard workbench
+ * sender policy (`ctx.senderPolicy`) — the main window is already trusted.
+ *
+ * Sandbox: every path is resolved and verified against the live active
+ * project root (`ctx.workspace.getProjectPath()`, read per-call so project
+ * switches take effect immediately). `..`/escapes throw `EACCES`; no open
+ * project throws `ENOACTIVE`. Symlinks ARE resolved: both the root and the
+ * target go through `fs.realpath` before the containment check, so a symlink
+ * inside the root that points outside it (`proj/link -> ../secret`) cannot be
+ * used to read or write past the sandbox. Writes additionally verify the
+ * deepest existing ancestor directory with `fs.realpath` BEFORE any `mkdir`,
+ * so a symlinked-out parent cannot leak a `mkdir -p` side-effect (a directory
+ * created outside the sandbox) ahead of the containment check.
+ *
+ * TOCTOU hardening (two layers):
+ *   1. The final `open` uses `O_NOFOLLOW`, so a FINAL path component swapped to
+ *      a symlink between the realpath check and the open is refused instead of
+ *      followed out of the sandbox.
+ *   2. After the open, the resolved path is re-`realpath`'d and re-checked
+ *      against the root BEFORE any bytes are returned (read) or written (write).
+ *      This catches a MID-PATH directory component swapped to a symlink in the
+ *      same window — which `O_NOFOLLOW` does NOT guard. Writes open with
+ *      `O_CREAT` but WITHOUT `O_TRUNC`, and only truncate+write once this
+ *      re-check passes, so a detected mid-path race never writes the user's
+ *      content to an out-of-sandbox target (at worst it leaves a zero-byte file
+ *      if `O_CREAT` created one at the swapped location).
+ *
+ * Residual: a perfectly-timed swap-and-restore that puts the mid-path symlink
+ * in place only for the open and reverts it before the post-open realpath would
+ * evade detection. Provably closing that needs per-component `openat` /
+ * `F_GETPATH`-style resolution, which portable Node does not expose — an
+ * accepted residual under this dev-tool threat model (the main window is
+ * already trusted and there is no adversary racing the local filesystem).
+ *
+ * The same defences are mirrored synchronously in `writeFileSync` for the
+ * editor's `beforeunload` flush (`ProjectFsChannel.WriteFileSync`).
+ */
+import fs from 'node:fs/promises';
+import nodeFs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { IpcRegistry } from '../utils/ipc-registry.js';
+import { validate } from '../utils/ipc-schema.js';
+import { ProjectFsChannel } from '../../shared/ipc-channels.js';
+/** Cap for `listFiles` — huge monorepos would otherwise stall the renderer. */
+const LIST_FILE_LIMIT = 5000;
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', '.svn', '.hg', 'dist', 'build',
+    '.next', '.cache', '.turbo', '.parcel-cache', '.nuxt', '.output', '.vite',
+]);
+const PathArg = z.string().min(1);
+const ReadFileSchema = z.tuple([PathArg]);
+const WriteFileSchema = z.tuple([PathArg, z.string()]);
+const ListFilesSchema = z.tuple([PathArg]);
+function makeError(code, message) {
+    const err = new Error(message);
+    err.code = code;
+    return err;
+}
+/** `true` if `child` is `parent` itself or lives strictly under it. */
+function isWithin(parent, child) {
+    if (child === parent)
+        return true;
+    const rel = path.relative(parent, child);
+    // `rel` empty == same dir; `..`-prefixed or absolute == outside.
+    return rel.length > 0 && !rel.startsWith('..' + path.sep) && rel !== '..' && !path.isAbsolute(rel);
+}
+/**
+ * Synchronous, string-level guard: reject empty root (ENOACTIVE), NUL bytes
+ * and empty paths (EINVAL), and lexical `..` escapes (EACCES) by resolving
+ * both sides with `path.resolve` and a `path.sep`-aware containment check
+ * (so `/foo/bar` ⊄ `/foo/bar2`). This is the cheap first pass; it does NOT
+ * resolve symlinks — that is done by `resolveWithinProjectRoot` below.
+ */
+export function enforceWithinProjectRoot(abs, root) {
+    if (root === '') {
+        throw makeError('ENOACTIVE', 'No active project — open a project before using the editor file system');
+    }
+    if (typeof abs !== 'string' || abs.length === 0) {
+        throw makeError('EINVAL', 'path must be a non-empty string');
+    }
+    if (abs.includes('\0') || root.includes('\0')) {
+        throw makeError('EINVAL', 'path must not contain NUL bytes');
+    }
+    const resolvedRoot = path.resolve(root);
+    const resolved = path.resolve(abs);
+    if (!isWithin(resolvedRoot, resolved)) {
+        throw makeError('EACCES', `Path escapes project root: ${resolved}`);
+    }
+    return resolved;
+}
+/**
+ * Pick the project root a write should be validated against: the CURRENT root
+ * or the LAST-CLOSED one (recorded by workspace-service in `closeProject`,
+ * reset in `openProject`). This rescues an in-flight teardown/debounced write
+ * whose target lives under the project that was just closed — `closeProject`
+ * clears `currentProjectPath` to '' BEFORE the renderer navigates away, so a
+ * write resolving its root via the live root alone would be rejected with
+ * ENOACTIVE and the developer's last edit lost.
+ *
+ * Selection is purely LEXICAL (same `path.resolve` + `path.sep`-aware
+ * containment as `enforceWithinProjectRoot`, no fs I/O): symlink/realpath
+ * hardening stays in the downstream `resolveWithinProjectRoot` /
+ * `assertWritableAncestor` defences, applied by the caller against the root
+ * this returns — so accepting the last-closed root never relaxes the sandbox.
+ *
+ *  - Returns whichever root lexically contains `absPath`, preferring `current`.
+ *  - An empty-string root ('') means "no such root" and is never selected.
+ *  - Throws when `absPath` is inside NEITHER root: ENOACTIVE when both roots
+ *    are empty (no project context at all), otherwise EACCES (the path escapes
+ *    every known sandbox root).
+ */
+export function pickWriteRoot(absPath, roots) {
+    const resolved = path.resolve(absPath);
+    if (roots.current !== '' && isWithin(path.resolve(roots.current), resolved)) {
+        return roots.current;
+    }
+    if (roots.lastClosed !== '' && isWithin(path.resolve(roots.lastClosed), resolved)) {
+        return roots.lastClosed;
+    }
+    if (roots.current === '' && roots.lastClosed === '') {
+        throw makeError('ENOACTIVE', 'No active project — open a project before using the editor file system');
+    }
+    throw makeError('EACCES', `Path escapes project root: ${resolved}`);
+}
+/**
+ * Symlink-aware resolution: run the cheap lexical guard, then `fs.realpath`
+ * BOTH the root and the target before re-checking containment. This closes
+ * the symlink-escape hole — a link inside the root that points outside it
+ * resolves to an out-of-root real path and is rejected with EACCES.
+ *
+ * Writing a not-yet-existing file would make `realpath(target)` throw ENOENT,
+ * so when the target is missing we realpath its PARENT directory and re-join
+ * the basename: the file's containing directory must itself be inside the
+ * (realpath'd) root.
+ */
+async function resolveWithinProjectRoot(abs, root) {
+    // Lexical guard first (handles ENOACTIVE / EINVAL / `..` before any fs I/O).
+    const lexical = enforceWithinProjectRoot(abs, root);
+    const realRoot = await fs.realpath(path.resolve(root));
+    let realTarget;
+    try {
+        realTarget = await fs.realpath(lexical);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+        // Target does not exist yet (e.g. first write): the parent dir must.
+        const parent = path.dirname(lexical);
+        const realParent = await fs.realpath(parent);
+        if (!isWithin(realRoot, realParent)) {
+            throw makeError('EACCES', `Path escapes project root: ${lexical}`);
+        }
+        return path.join(realParent, path.basename(lexical));
+    }
+    if (!isWithin(realRoot, realTarget)) {
+        throw makeError('EACCES', `Path escapes project root: ${realTarget}`);
+    }
+    return realTarget;
+}
+/**
+ * Post-open TOCTOU re-verification: re-`realpath` the already-opened path and
+ * re-check containment. `O_NOFOLLOW` guards only the FINAL component, so a
+ * MID-PATH directory component swapped to a symlink in the realpath→open window
+ * would still be followed out of the sandbox. Re-resolving here AFTER the open
+ * catches that swap — callers run it before returning/writing bytes and reject
+ * on failure. (Residual: a swap reverted before this re-resolve; see file head.)
+ */
+async function assertOpenedWithinRoot(safe, root) {
+    const realRoot = await fs.realpath(path.resolve(root));
+    const real = await fs.realpath(safe);
+    if (!isWithin(realRoot, real)) {
+        throw makeError('EACCES', `Path escapes project root (mid-path race): ${real}`);
+    }
+}
+async function readFile(root, p) {
+    const safe = await resolveWithinProjectRoot(p, root);
+    // Open with O_NOFOLLOW so a final-component symlink swapped in AFTER the
+    // realpath containment check (the TOCTOU race) is not followed out of the
+    // sandbox. Operate on the FileHandle, never a second path-based open (which
+    // would re-follow the swapped symlink).
+    const fh = await fs.open(safe, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        // Re-verify post-open: catches a mid-path component swapped to a symlink in
+        // the realpath→open window (which O_NOFOLLOW does not guard). Reject before
+        // returning any bytes, so an escaped read leaks nothing.
+        await assertOpenedWithinRoot(safe, root);
+        return await fh.readFile('utf8');
+    }
+    finally {
+        await fh.close();
+    }
+}
+/**
+ * Symlink-aware ancestor guard, run BEFORE any `mkdir`. Walks up from the
+ * write target to the DEEPEST already-existing ancestor directory, then
+ * `fs.realpath`s it and checks it is still inside the (realpath'd) root.
+ *
+ * This closes the `mkdir -p` write side-channel: with `proj/escape ->
+ * /outside`, the lexical guard alone would let `mkdir -p proj/escape/new`
+ * follow the symlink and create `/outside/new` (an out-of-sandbox side-effect)
+ * before the post-mkdir realpath check could reject it. By realpath'ing the
+ * deepest existing ancestor first, we reject such writes with zero mkdir.
+ *
+ * Legitimate deep writes (`proj/a/b/c.txt` where `a`/`b` don't exist yet)
+ * walk up to the root itself — `realpath(root)` is inside the root, so they
+ * pass and `mkdir -p` is allowed to create the in-root intermediate dirs.
+ */
+async function assertWritableAncestor(lexical, root) {
+    const realRoot = await fs.realpath(path.resolve(root));
+    // Climb to the deepest ancestor that actually exists on disk.
+    let ancestor = path.dirname(lexical);
+    // Guard against an unbounded loop: `path.dirname` is a fixed point at the
+    // filesystem root ('/' -> '/'), so stop once it stops changing.
+    for (;;) {
+        let realAncestor;
+        try {
+            realAncestor = await fs.realpath(ancestor);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+            const next = path.dirname(ancestor);
+            if (next === ancestor) {
+                // Reached the filesystem root without finding an existing ancestor.
+                throw makeError('EACCES', `Path escapes project root: ${lexical}`);
+            }
+            ancestor = next;
+            continue;
+        }
+        // Deepest existing ancestor found — it must resolve inside the root.
+        if (!isWithin(realRoot, realAncestor)) {
+            throw makeError('EACCES', `Path escapes project root: ${lexical}`);
+        }
+        return;
+    }
+}
+async function writeFile(root, p, content) {
+    // First lexical guard so a `..` escape is rejected before any fs I/O.
+    const lexical = enforceWithinProjectRoot(p, root);
+    // Symlink-aware ancestor check BEFORE any mkdir, so a symlinked-out parent
+    // (`proj/escape -> /outside`) cannot leak a `mkdir -p` side-effect outside
+    // the sandbox. Rejected writes create nothing, in or out of the root.
+    await assertWritableAncestor(lexical, root);
+    await fs.mkdir(path.dirname(lexical), { recursive: true });
+    // Re-resolve through realpath now that the parent dir exists; final check
+    // for any boundary case introduced while creating the parent dirs.
+    const safe = await resolveWithinProjectRoot(p, root);
+    // Open with O_NOFOLLOW (final-component symlink guard) and O_CREAT but NOT
+    // O_TRUNC: truncating at open would destroy an out-of-sandbox file's contents
+    // before any mid-path re-check could run. We re-verify containment first, and
+    // only then truncate+write — so a detected mid-path race never mutates the
+    // user's content out of the sandbox.
+    const fh = await fs.open(safe, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW, 0o666);
+    try {
+        // Re-verify post-open: catches a mid-path component swapped to a symlink in
+        // the realpath→open window (which O_NOFOLLOW does not guard). Reject BEFORE
+        // writing, so an escaped write lands none of the user's content.
+        await assertOpenedWithinRoot(safe, root);
+        const buf = Buffer.from(content, 'utf8');
+        // Write the whole buffer at absolute offset 0, looping over any short write
+        // (a single `write` may persist fewer than requested bytes), then truncate
+        // to the exact length — the O_TRUNC-free replacement of prior contents.
+        let off = 0;
+        while (off < buf.length) {
+            const { bytesWritten } = await fh.write(buf, off, buf.length - off, off);
+            if (bytesWritten <= 0)
+                break;
+            off += bytesWritten;
+        }
+        await fh.truncate(buf.length);
+    }
+    finally {
+        await fh.close();
+    }
+}
+// ── Synchronous mirror (editor beforeunload flush) ──────────────────────────
+// The sync write path exists so the editor can flush a pending edit inside
+// `beforeunload` and BLOCK until it lands (an async write loses the race with a
+// hard window/app close). These functions mirror the async guards above EXACTLY
+// and MUST stay in lockstep — any divergence reopens a sandbox escape on the
+// sync path. They reuse the pure lexical helpers (`enforceWithinProjectRoot`,
+// `isWithin`, `pickWriteRoot`, `makeError`) so the boundary is single-sourced;
+// only sync-vs-async fs calls differ. All `node:fs` access goes through the
+// default `nodeFs` object so the same realpath/open surface is exercised.
+/** Synchronous twin of {@link resolveWithinProjectRoot}. */
+function resolveWithinProjectRootSync(abs, root) {
+    const lexical = enforceWithinProjectRoot(abs, root);
+    const realRoot = nodeFs.realpathSync(path.resolve(root));
+    let realTarget;
+    try {
+        realTarget = nodeFs.realpathSync(lexical);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+        const parent = path.dirname(lexical);
+        const realParent = nodeFs.realpathSync(parent);
+        if (!isWithin(realRoot, realParent)) {
+            throw makeError('EACCES', `Path escapes project root: ${lexical}`);
+        }
+        return path.join(realParent, path.basename(lexical));
+    }
+    if (!isWithin(realRoot, realTarget)) {
+        throw makeError('EACCES', `Path escapes project root: ${realTarget}`);
+    }
+    return realTarget;
+}
+/** Synchronous twin of {@link assertWritableAncestor}. */
+function assertWritableAncestorSync(lexical, root) {
+    const realRoot = nodeFs.realpathSync(path.resolve(root));
+    let ancestor = path.dirname(lexical);
+    for (;;) {
+        let realAncestor;
+        try {
+            realAncestor = nodeFs.realpathSync(ancestor);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+            const next = path.dirname(ancestor);
+            if (next === ancestor) {
+                throw makeError('EACCES', `Path escapes project root: ${lexical}`);
+            }
+            ancestor = next;
+            continue;
+        }
+        if (!isWithin(realRoot, realAncestor)) {
+            throw makeError('EACCES', `Path escapes project root: ${lexical}`);
+        }
+        return;
+    }
+}
+/** Synchronous twin of {@link assertOpenedWithinRoot}. */
+function assertOpenedWithinRootSync(safe, root) {
+    const realRoot = nodeFs.realpathSync(path.resolve(root));
+    const real = nodeFs.realpathSync(safe);
+    if (!isWithin(realRoot, real)) {
+        throw makeError('EACCES', `Path escapes project root (mid-path race): ${real}`);
+    }
+}
+/** Synchronous twin of {@link writeFile} — identical sandbox, blocking I/O. */
+function writeFileSync(root, p, content) {
+    const lexical = enforceWithinProjectRoot(p, root);
+    assertWritableAncestorSync(lexical, root);
+    nodeFs.mkdirSync(path.dirname(lexical), { recursive: true });
+    const safe = resolveWithinProjectRootSync(p, root);
+    const fd = nodeFs.openSync(safe, nodeFs.constants.O_WRONLY | nodeFs.constants.O_CREAT | nodeFs.constants.O_NOFOLLOW, 0o666);
+    try {
+        assertOpenedWithinRootSync(safe, root);
+        const buf = Buffer.from(content, 'utf8');
+        // Loop over short writes (see the async twin), then truncate to length.
+        let off = 0;
+        while (off < buf.length) {
+            const bytesWritten = nodeFs.writeSync(fd, buf, off, buf.length - off, off);
+            if (bytesWritten <= 0)
+                break;
+            off += bytesWritten;
+        }
+        nodeFs.ftruncateSync(fd, buf.length);
+    }
+    finally {
+        nodeFs.closeSync(fd);
+    }
+}
+async function listFiles(root, rootArg) {
+    const safeRoot = await resolveWithinProjectRoot(rootArg, root);
+    const out = [];
+    const queue = [safeRoot];
+    while (queue.length > 0) {
+        if (out.length >= LIST_FILE_LIMIT)
+            break;
+        const dir = queue.shift();
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'EACCES' || code === 'ENOENT' || code === 'ENOTDIR')
+                continue;
+            throw err;
+        }
+        for (const e of entries) {
+            if (out.length >= LIST_FILE_LIMIT)
+                break;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (SKIP_DIRS.has(e.name))
+                    continue;
+                queue.push(full);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            out.push(path.relative(safeRoot, full).split(path.sep).join('/'));
+        }
+    }
+    return out;
+}
+/**
+ * Register the project-fs IPC channels. Call once during workbench setup;
+ * the returned Disposable removes every channel (park on `ctx.registry`).
+ */
+export function registerProjectFsIpc(ctx) {
+    const getRoot = () => ctx.workspace.getProjectPath();
+    const getLastClosedRoot = () => ctx.workspace.getLastClosedProjectPath();
+    return new IpcRegistry(ctx.senderPolicy)
+        .handle(ProjectFsChannel.GetRoot, () => getRoot())
+        .handle(ProjectFsChannel.ReadFile, (_event, ...args) => {
+        const [p] = validate(ProjectFsChannel.ReadFile, ReadFileSchema, args);
+        // Reads stay scoped to the CURRENT root only — never widen the read
+        // surface to the last-closed project.
+        return readFile(getRoot(), p);
+    })
+        .handle(ProjectFsChannel.WriteFile, (_event, ...args) => {
+        const [p, content] = validate(ProjectFsChannel.WriteFile, WriteFileSchema, args);
+        // Accept a write under the current OR the just-closed project root (the
+        // latter rescues an in-flight teardown flush after `closeProject`). The
+        // selected root then runs the FULL sandbox (realpath containment +
+        // ancestor guard + O_NOFOLLOW) inside `writeFile`, so the boundary is
+        // never relaxed — only WHICH root is considered.
+        const root = pickWriteRoot(p, { current: getRoot(), lastClosed: getLastClosedRoot() });
+        return writeFile(root, p, content);
+    })
+        .handleSync(ProjectFsChannel.WriteFileSync, (_event, ...args) => {
+        // Synchronous twin of WriteFile for the editor's beforeunload flush. Same
+        // root selection + same sandbox (`writeFileSync` mirrors `writeFile`); the
+        // only difference is the blocking transport. Returns `{ ok: true }`; any
+        // throw is converted to `{ ok: false, code, message }` by `handleSync`.
+        const [p, content] = validate(ProjectFsChannel.WriteFileSync, WriteFileSchema, args);
+        const root = pickWriteRoot(p, { current: getRoot(), lastClosed: getLastClosedRoot() });
+        writeFileSync(root, p, content);
+        return { ok: true };
+    })
+        .handle(ProjectFsChannel.ListFiles, (_event, ...args) => {
+        const [p] = validate(ProjectFsChannel.ListFiles, ListFilesSchema, args);
+        return listFiles(getRoot(), p);
+    });
+}
+/** Test seams — pure handlers, no Electron needed. */
+export const __testing = { readFile, writeFile, writeFileSync, listFiles, pickWriteRoot, SKIP_DIRS, LIST_FILE_LIMIT };
+//# sourceMappingURL=project-fs.js.map

package/dist/main/ipc/projects.d.ts

@@ -1,6 +1,6 @@
 import type { WorkbenchContext } from '../services/workbench-context.js';
 import type { WorkbenchModule } from '../services/module.js';
-import type { Disposable } from '../utils/disposable.js';
+import type { Disposable } from '@dimina-kit/electron-deck/main';
 type ProjectsIpcCtx = Pick<WorkbenchContext, 'workspace' | 'windows' | 'senderPolicy' | 'projectsProvider' | 'projectTemplates' | 'customCreateProjectDialog'>;
 export declare function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable;
 export declare const projectsModule: WorkbenchModule;

package/dist/main/ipc/session.d.ts

@@ -1,6 +1,6 @@
 import type { WorkbenchContext } from '../services/workbench-context.js';
 import type { WorkbenchModule } from '../services/module.js';
-import type { Disposable } from '../utils/disposable.js';
+import type { Disposable } from '@dimina-kit/electron-deck/main';
 export declare function registerSessionIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'senderPolicy'>): Disposable;
 export declare const sessionModule: WorkbenchModule;
 //# sourceMappingURL=session.d.ts.map

package/dist/main/ipc/settings.d.ts

@@ -1,5 +1,5 @@
 import type { WorkbenchContext } from '../services/workbench-context.js';
-import type { Disposable } from '../utils/disposable.js';
+import type { Disposable } from '@dimina-kit/electron-deck/main';
 import type { WorkbenchModule } from '../services/module.js';
 export declare function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'workspace' | 'rendererDir' | 'senderPolicy' | 'windows'>): Disposable;
 export declare const settingsModule: WorkbenchModule;

package/dist/main/ipc/simulator-module.d.ts

@@ -3,6 +3,12 @@ import type { WorkbenchModule } from '../services/module.js';
  * The 'simulator' built-in module fans out into three IPC registrars
  * (core simulator, panels, toolbar). Bundle them under a single module
  * so app.ts only sees one entry per BuiltinModuleId.
+ *
+ * Bridge router (native-host PAGE_OPEN / NAV_ACTION / TAB_ACTION etc.) hooks
+ * up unconditionally — the `__diminaNativeHost.enabled` flag in the simulator
+ * window decides whether to actually call dmb:* channels, but the main-side
+ * handlers must always be ready or `ipcRenderer.invoke('dmb:spawn')` fails
+ * with `No handler registered`.
  */
 export declare const simulatorModule: WorkbenchModule;
 //# sourceMappingURL=simulator-module.d.ts.map

package/dist/main/ipc/simulator-module.js

@@ -1,11 +1,19 @@
-import { DisposableRegistry } from '../utils/disposable.js';
+import { DisposableRegistry } from '@dimina-kit/electron-deck/main';
 import { registerSimulatorIpc } from './simulator.js';
 import { registerPanelsIpc } from './panels.js';
 import { registerToolbarIpc } from './toolbar.js';
+import { installBridgeRouter } from './bridge-router.js';
+import { registerViewsIpc } from './views.js';
 /**
  * The 'simulator' built-in module fans out into three IPC registrars
  * (core simulator, panels, toolbar). Bundle them under a single module
  * so app.ts only sees one entry per BuiltinModuleId.
+ *
+ * Bridge router (native-host PAGE_OPEN / NAV_ACTION / TAB_ACTION etc.) hooks
+ * up unconditionally — the `__diminaNativeHost.enabled` flag in the simulator
+ * window decides whether to actually call dmb:* channels, but the main-side
+ * handlers must always be ready or `ipcRenderer.invoke('dmb:spawn')` fails
+ * with `No handler registered`.
  */
 export const simulatorModule = {
     setup: (ctx) => {
@@ -13,6 +21,8 @@ export const simulatorModule = {
         reg.add(registerSimulatorIpc(ctx));
         reg.add(registerPanelsIpc(ctx));
         reg.add(registerToolbarIpc(ctx));
+        reg.add(registerViewsIpc(ctx));
+        installBridgeRouter(ctx);
         return reg;
     },
 };

package/dist/main/ipc/simulator.d.ts

@@ -1,4 +1,4 @@
 import type { WorkbenchContext } from '../services/workbench-context.js';
-import type { Disposable } from '../utils/disposable.js';
-export declare function registerSimulatorIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'senderPolicy' | 'simulatorApis'>): Disposable;
+import type { Disposable } from '@dimina-kit/electron-deck/main';
+export declare function registerSimulatorIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'senderPolicy' | 'simulatorApis' | 'bridge'>): Disposable;
 //# sourceMappingURL=simulator.d.ts.map