@dimina-kit/devtools 0.3.2-dev.20260601115343 → 0.3.2-dev.20260610114009

package/dist/main/services/views/devtools-tabs.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Customize the embedded Chrome DevTools front-end's panel tab bar.
+ *
+ * The right-panel DevTools (a WebContents rendering `devtools://`, attached to the
+ * service-host via `setDevToolsWebContents` + `openDevTools`) shows ALL its panels
+ * by default. For the mini-app workflow only Elements / Console / Network are
+ * meaningful in the default tab bar — but we do NOT want to delete the rest: they
+ * stay reachable on demand via the command menu (Cmd+Shift+P → "Show Sources" …).
+ *
+ * ── How (registry, not DOM) ─────────────────────────────────────────────────
+ * The modern ESM DevTools front-end does NOT expose `UI.ViewManager` on
+ * `globalThis`, so the tab bar can't be driven through the view manager. Panels
+ * register themselves via `registerViewExtension({id, location:'panel', persistence})`
+ * into a module-level registry; the official mutators are `registerViewExtension`,
+ * `getRegisteredViewExtensions` and `maybeRemoveViewExtension`. We:
+ *   1. `import('./ui/legacy/legacy.js')` to reach those functions (the real export
+ *      path on Electron 41 / Chromium ~138, verified at runtime);
+ *   2. whitelist-patch `registerViewExtension` so any future non-kept panel comes
+ *      in with `persistence:'transient'` (hidden from the default bar);
+ *   3. for the already-registered non-kept panels, `maybeRemoveViewExtension(id)`
+ *      then re-register a copy with `persistence:'transient'`.
+ * Transient views are not shown in the default tab bar but stay in the command
+ * menu — and because this is DevTools' own panel path, there is NO `>>` overflow
+ * or `×` close-button residue (which a DOM `display:none` hack leaves behind).
+ *
+ * ── Locale infobar ──────────────────────────────────────────────────────────
+ * The "DevTools is now available in 中文" banner is suppressed via the official
+ * host preference `disable-locale-info-bar` (a GLOBAL setting that lives in host
+ * preferences, NOT page localStorage), set through `InspectorFrontendHost.setPreference`.
+ *
+ * ── Degradation ─────────────────────────────────────────────────────────────
+ * If the ESM module can't be resolved, a bounded DOM `display:none` fallback hides
+ * the non-kept tabs (by visible name) so the bar still looks right. Everything is
+ * wrapped in try/catch in the injected realm and silently no-ops on any failure.
+ */
+/**
+ * Canonical DevTools panel view ids kept in the DEFAULT tab bar (stable front-end
+ * ids, unchanged for many Chromium releases): `elements`, `console`, `network`.
+ */
+export declare const DEVTOOLS_KEPT_VIEW_IDS: readonly string[];
+/**
+ * Build the `executeJavaScript` source injected into the DevTools front-end
+ * WebContents. The kept ids + display names are carried as JSON data literals
+ * (never interpolated as bare code), same discipline as the other injectors.
+ */
+export declare function buildCustomizeTabsScript(keptIds?: readonly string[]): string;
+//# sourceMappingURL=devtools-tabs.d.ts.map

package/dist/main/services/views/devtools-tabs.js

@@ -0,0 +1,95 @@
+/**
+ * Customize the embedded Chrome DevTools front-end's panel tab bar.
+ *
+ * The right-panel DevTools (a WebContents rendering `devtools://`, attached to the
+ * service-host via `setDevToolsWebContents` + `openDevTools`) shows ALL its panels
+ * by default. For the mini-app workflow only Elements / Console / Network are
+ * meaningful in the default tab bar — but we do NOT want to delete the rest: they
+ * stay reachable on demand via the command menu (Cmd+Shift+P → "Show Sources" …).
+ *
+ * ── How (registry, not DOM) ─────────────────────────────────────────────────
+ * The modern ESM DevTools front-end does NOT expose `UI.ViewManager` on
+ * `globalThis`, so the tab bar can't be driven through the view manager. Panels
+ * register themselves via `registerViewExtension({id, location:'panel', persistence})`
+ * into a module-level registry; the official mutators are `registerViewExtension`,
+ * `getRegisteredViewExtensions` and `maybeRemoveViewExtension`. We:
+ *   1. `import('./ui/legacy/legacy.js')` to reach those functions (the real export
+ *      path on Electron 41 / Chromium ~138, verified at runtime);
+ *   2. whitelist-patch `registerViewExtension` so any future non-kept panel comes
+ *      in with `persistence:'transient'` (hidden from the default bar);
+ *   3. for the already-registered non-kept panels, `maybeRemoveViewExtension(id)`
+ *      then re-register a copy with `persistence:'transient'`.
+ * Transient views are not shown in the default tab bar but stay in the command
+ * menu — and because this is DevTools' own panel path, there is NO `>>` overflow
+ * or `×` close-button residue (which a DOM `display:none` hack leaves behind).
+ *
+ * ── Locale infobar ──────────────────────────────────────────────────────────
+ * The "DevTools is now available in 中文" banner is suppressed via the official
+ * host preference `disable-locale-info-bar` (a GLOBAL setting that lives in host
+ * preferences, NOT page localStorage), set through `InspectorFrontendHost.setPreference`.
+ *
+ * ── Degradation ─────────────────────────────────────────────────────────────
+ * If the ESM module can't be resolved, a bounded DOM `display:none` fallback hides
+ * the non-kept tabs (by visible name) so the bar still looks right. Everything is
+ * wrapped in try/catch in the injected realm and silently no-ops on any failure.
+ */
+/**
+ * Canonical DevTools panel view ids kept in the DEFAULT tab bar (stable front-end
+ * ids, unchanged for many Chromium releases): `elements`, `console`, `network`.
+ */
+export const DEVTOOLS_KEPT_VIEW_IDS = ['elements', 'console', 'network'];
+/**
+ * Build the `executeJavaScript` source injected into the DevTools front-end
+ * WebContents. The kept ids + display names are carried as JSON data literals
+ * (never interpolated as bare code), same discipline as the other injectors.
+ */
+export function buildCustomizeTabsScript(keptIds = DEVTOOLS_KEPT_VIEW_IDS) {
+    // Kept panels are matched by view id (registry path) and by visible NAME (DOM
+    // fallback path); the DevTools UI may be EN or ZH, so include both.
+    const NAME_MAP = {
+        elements: ['Elements', '元素'], console: ['Console', '控制台'], network: ['Network', '网络'],
+    };
+    const keepNames = keptIds.flatMap((id) => NAME_MAP[id] ?? [id]);
+    const keepIdsJson = JSON.stringify(JSON.stringify([...keptIds]));
+    const keepNamesJson = JSON.stringify(JSON.stringify(keepNames));
+    return `(function(){try{
+    var KEEPID = new Set(JSON.parse(${keepIdsJson}));
+    var KEEPNAME = new Set(JSON.parse(${keepNamesJson}));
+    // (1) Locale infobar — official host-preference suppression (NOT localStorage).
+    try { var IFH=globalThis.InspectorFrontendHost; if(IFH&&typeof IFH.setPreference==='function'){ IFH.setPreference('disable-locale-info-bar','true'); } }catch(_){}
+    function deepCollect(sel,cap){ var out=[],seen=0,stack=[document]; while(stack.length&&seen<(cap||40000)){ var root=stack.pop(); try{var m=root.querySelectorAll?root.querySelectorAll(sel):[];for(var i=0;i<m.length;i++)out.push(m[i]);}catch(_){} try{var all=root.querySelectorAll?root.querySelectorAll('*'):[];for(var j=0;j<all.length;j++){seen++;if(all[j].shadowRoot)stack.push(all[j].shadowRoot);}}catch(_){} } return out; }
+    function txt(el){ return ((el&&el.textContent)||'').replace(/\\s+/g,' ').trim(); }
+    var PATHS=['./ui/legacy/legacy.js','./ui/legacy/ViewManager.js','devtools://devtools/bundled/ui/legacy/legacy.js'];
+    (async function(){
+      var VM=null,maybeRemove=null,origReg=null,reg=null,getReg=null;
+      for(var i=0;i<PATHS.length;i++){ try{ var m=await import(PATHS[i]); if(!m)continue; var v=m.ViewManager||m;
+        var mr=(v&&typeof v.maybeRemoveViewExtension==='function')?v.maybeRemoveViewExtension.bind(v):(typeof m.maybeRemoveViewExtension==='function'?m.maybeRemoveViewExtension:null);
+        if(mr){ VM=v;maybeRemove=mr;
+          origReg=(v&&typeof v.registerViewExtension==='function')?v.registerViewExtension:m.registerViewExtension; reg=origReg;
+          getReg=(v&&typeof v.getRegisteredViewExtensions==='function')?v.getRegisteredViewExtensions.bind(v):(typeof m.getRegisteredViewExtensions==='function'?m.getRegisteredViewExtensions:null);
+          break; } }catch(_){} }
+      if(maybeRemove){
+        // (2) future non-kept panels register as transient
+        try{ if(origReg&&VM){ VM.registerViewExtension=function(r){ try{ if(r&&String(r.location)==='panel'&&!KEEPID.has(r.id)){ r.persistence='transient'; } }catch(_){} return origReg.apply(this,arguments); }; reg=VM.registerViewExtension; } }catch(_){}
+        // (3) already-registered non-kept panels -> remove + re-register transient
+        var exts=[]; try{ if(getReg) exts=getReg()||[]; }catch(_){}
+        var handled=false;
+        for(var e=0;e<exts.length;e++){ try{ var ex=exts[e]; var eid=ex&&ex.id; if(!eid||KEEPID.has(eid)) continue; if(String(ex.location)!=='panel') continue;
+          maybeRemove(eid);
+          var nr={}; try{ nr=Object.assign({},ex); }catch(_){ for(var k in ex){ try{nr[k]=ex[k];}catch(__){} } }
+          nr.persistence='transient';
+          try{ reg(nr); }catch(_){ try{ origReg(nr); }catch(__){} }
+          handled=true;
+        }catch(_){} }
+        // fallback: registrations not enumerable -> at least clear the bar by id
+        if(!handled){ var FALL=['timeline','resources','heap-profiler','sources','security','lighthouse','chrome-recorder','coverage','linear-memory-inspector','sensors','rendering','animations','autofill-view','medias','issues-pane']; for(var fr=0;fr<FALL.length;fr++){ try{ if(!KEEPID.has(FALL[fr])) maybeRemove(FALL[fr]); }catch(_){} } }
+      } else { domFallback(); }
+    })();
+    // DOM fallback: only if the ESM module couldn't be resolved at all.
+    function domFallback(){ var cachedBar=null;
+      function findBar(){ if(cachedBar&&cachedBar.isConnected)return cachedBar; cachedBar=null; var tabs=deepCollect('[role="tab"]'); var a=null; for(var i=0;i<tabs.length;i++){if(KEEPNAME.has(txt(tabs[i]))){a=tabs[i];break;}} if(!a)return null; var p=a.parentElement; while(p){try{if(p.querySelectorAll('[role="tab"]').length>1){cachedBar=p;return p;}}catch(_){} p=p.parentElement;} cachedBar=a.parentElement; return cachedBar; }
+      function apply(){ try{ var bar=findBar(); if(bar){ var bts=bar.querySelectorAll('[role="tab"]'); for(var b=0;b<bts.length;b++){var bt=bts[b]; if(KEEPNAME.has(txt(bt)))continue; try{if(bt.style)bt.style.display='none';}catch(_){}} try{var more=bar.querySelector('[aria-label*="More tabs"],.tabbed-pane-header-tabs-drop-down-container'); if(more&&more.style)more.style.display='none';}catch(_){} } }catch(_){} }
+      var tr=0,t=setInterval(function(){tr++;try{apply();}catch(_){}if(tr>120)clearInterval(t);},60); try{apply();}catch(_){} }
+  }catch(_){}})()`;
+}
+//# sourceMappingURL=devtools-tabs.js.map

package/dist/main/services/views/miniapp-partition.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Per-project session partition for the native-host miniapp runtime (P0 debt).
+ *
+ * Historically every project's miniapp webContents — the simulator content
+ * WebContentsView, its nested render-host `<webview>` guests, AND the
+ * service-host window — shared ONE hard-coded `persist:simulator` Electron
+ * session. Cookies / localStorage / cache / IndexedDB written by project A were
+ * visible to (and clobbered by) project B; two projects open at once cross-
+ * contaminate and "clear storage" on one nukes the other.
+ *
+ * The fix derives a STABLE per-project partition from the project identity (the
+ * miniapp `appId`, which flows in via the simulator URL `?appId=` and the spawn
+ * path's `appId`). Same project → same partition (storage survives a relaunch);
+ * different projects → different partitions (no cross-contamination). The shape
+ * mirrors the IDE state of the art (WeChat's static partition, ByteDance's
+ * `persist:miniapp-<id>` dynamic partition).
+ *
+ * The protocol handlers (`difile://`, `dmb-resource`) and webRequest policies
+ * (referer / CORS) that the simulator runtime needs were installed once on the
+ * single `persist:simulator` session. With per-project partitions those have to
+ * be (re)applied to EACH project session the first time it is used. The setup
+ * sites register a partition-agnostic configurator here; `configureMiniappSession`
+ * runs every registered configurator exactly once per partition.
+ *
+ * Partition CLEANUP (reclaiming on-disk `persist:` data) is intentionally NOT
+ * done here — leaving the data on disk is the whole point of a `persist:`
+ * partition (cache/storage survives a relaunch). That is a separate concern.
+ */
+import type { Session } from 'electron';
+/** The legacy single-session partition. Still used by the pre-warm pool (which
+ * is intentionally NOT isolation-aware — see `serviceHostSpec`) and as the
+ * fallback when a project key cannot be derived. */
+export declare const SHARED_MINIAPP_PARTITION = "persist:simulator";
+/**
+ * Derive a stable, filesystem-safe partition key from a project `appId`.
+ *
+ * `appId` is the project identity (e.g. a `wxapp…` id). We pass through the
+ * characters Electron is happy to put in a session partition / on-disk folder
+ * name (`[A-Za-z0-9_-]`) verbatim so the common case is human-legible, and fold
+ * anything else into a short deterministic hash suffix so two appIds that differ
+ * only in stripped characters never collide. The same `appId` always yields the
+ * same key (so storage survives a relaunch); different `appId`s yield different
+ * keys.
+ */
+export declare function miniappPartitionKey(appId: string): string;
+/**
+ * The Electron session partition for a project. Returns the SHARED partition
+ * when `appId` is empty/unknown (so the runtime still has a session to load on,
+ * matching the legacy behavior) and a `persist:miniapp-<key>` partition
+ * otherwise.
+ */
+export declare function miniappPartition(appId: string | null | undefined): string;
+type SessionConfigurator = (sess: Session, partition: string) => void;
+/**
+ * Register a configurator that runs against every miniapp partition session.
+ * Already-configured partitions are (re)configured immediately so registration
+ * order does not matter. Returns a disposer that unregisters the configurator
+ * (it does not undo work already applied to live sessions).
+ */
+export declare function registerMiniappSessionConfigurator(fn: SessionConfigurator): () => void;
+/**
+ * Ensure a partition's session has every registered configurator applied. Safe
+ * to call repeatedly per partition (idempotent — each partition is configured
+ * once). Call this before loading project content on `partition`.
+ *
+ * Returns `null` when there is nothing to configure (no configurator registered)
+ * so the partition derivation stays independent of any live Electron session —
+ * the partition is a constructor-time fact, not a side effect of touching the
+ * session API. Setup sites register configurators at app boot; in unit tests
+ * that mock `electron` without a `session` export this short-circuits cleanly.
+ */
+export declare function configureMiniappSession(partition: string): Session | null;
+/**
+ * Test-only: drop the configurator + configured-partition bookkeeping so each
+ * test starts from a clean slate. (Module-level state otherwise leaks across
+ * unit tests that mock `electron`.)
+ */
+export declare function __resetMiniappSessionConfigForTests(): void;
+export {};
+//# sourceMappingURL=miniapp-partition.d.ts.map

package/dist/main/services/views/miniapp-partition.js

@@ -0,0 +1,138 @@
+/**
+ * Per-project session partition for the native-host miniapp runtime (P0 debt).
+ *
+ * Historically every project's miniapp webContents — the simulator content
+ * WebContentsView, its nested render-host `<webview>` guests, AND the
+ * service-host window — shared ONE hard-coded `persist:simulator` Electron
+ * session. Cookies / localStorage / cache / IndexedDB written by project A were
+ * visible to (and clobbered by) project B; two projects open at once cross-
+ * contaminate and "clear storage" on one nukes the other.
+ *
+ * The fix derives a STABLE per-project partition from the project identity (the
+ * miniapp `appId`, which flows in via the simulator URL `?appId=` and the spawn
+ * path's `appId`). Same project → same partition (storage survives a relaunch);
+ * different projects → different partitions (no cross-contamination). The shape
+ * mirrors the IDE state of the art (WeChat's static partition, ByteDance's
+ * `persist:miniapp-<id>` dynamic partition).
+ *
+ * The protocol handlers (`difile://`, `dmb-resource`) and webRequest policies
+ * (referer / CORS) that the simulator runtime needs were installed once on the
+ * single `persist:simulator` session. With per-project partitions those have to
+ * be (re)applied to EACH project session the first time it is used. The setup
+ * sites register a partition-agnostic configurator here; `configureMiniappSession`
+ * runs every registered configurator exactly once per partition.
+ *
+ * Partition CLEANUP (reclaiming on-disk `persist:` data) is intentionally NOT
+ * done here — leaving the data on disk is the whole point of a `persist:`
+ * partition (cache/storage survives a relaunch). That is a separate concern.
+ */
+import * as electron from 'electron';
+/** The legacy single-session partition. Still used by the pre-warm pool (which
+ * is intentionally NOT isolation-aware — see `serviceHostSpec`) and as the
+ * fallback when a project key cannot be derived. */
+export const SHARED_MINIAPP_PARTITION = 'persist:simulator';
+const PARTITION_PREFIX = 'persist:miniapp-';
+/**
+ * Derive a stable, filesystem-safe partition key from a project `appId`.
+ *
+ * `appId` is the project identity (e.g. a `wxapp…` id). We pass through the
+ * characters Electron is happy to put in a session partition / on-disk folder
+ * name (`[A-Za-z0-9_-]`) verbatim so the common case is human-legible, and fold
+ * anything else into a short deterministic hash suffix so two appIds that differ
+ * only in stripped characters never collide. The same `appId` always yields the
+ * same key (so storage survives a relaunch); different `appId`s yield different
+ * keys.
+ */
+export function miniappPartitionKey(appId) {
+    const safe = appId.replace(/[^A-Za-z0-9_-]/g, '');
+    // Folding may have dropped distinguishing characters; if the input was not
+    // already fully safe, append a deterministic hash of the RAW appId so two
+    // distinct appIds can never alias onto the same key.
+    if (safe === appId && safe.length > 0)
+        return safe;
+    const hash = djb2(appId).toString(36);
+    return safe.length > 0 ? `${safe}-${hash}` : hash;
+}
+/**
+ * The Electron session partition for a project. Returns the SHARED partition
+ * when `appId` is empty/unknown (so the runtime still has a session to load on,
+ * matching the legacy behavior) and a `persist:miniapp-<key>` partition
+ * otherwise.
+ */
+export function miniappPartition(appId) {
+    if (!appId)
+        return SHARED_MINIAPP_PARTITION;
+    return `${PARTITION_PREFIX}${miniappPartitionKey(appId)}`;
+}
+/** Small, stable string hash (djb2). Not cryptographic — only needs to be
+ * deterministic and collision-resistant enough to disambiguate appIds. */
+function djb2(input) {
+    let h = 5381;
+    for (let i = 0; i < input.length; i++) {
+        h = ((h << 5) + h + input.charCodeAt(i)) >>> 0;
+    }
+    return h;
+}
+const configurators = new Set();
+const configuredPartitions = new Set();
+/**
+ * Register a configurator that runs against every miniapp partition session.
+ * Already-configured partitions are (re)configured immediately so registration
+ * order does not matter. Returns a disposer that unregisters the configurator
+ * (it does not undo work already applied to live sessions).
+ */
+export function registerMiniappSessionConfigurator(fn) {
+    configurators.add(fn);
+    for (const partition of configuredPartitions) {
+        try {
+            fn(electron.session.fromPartition(partition), partition);
+        }
+        catch (err) {
+            console.warn('[miniapp-partition] configurator failed for', partition, err);
+        }
+    }
+    return () => {
+        configurators.delete(fn);
+    };
+}
+/**
+ * Ensure a partition's session has every registered configurator applied. Safe
+ * to call repeatedly per partition (idempotent — each partition is configured
+ * once). Call this before loading project content on `partition`.
+ *
+ * Returns `null` when there is nothing to configure (no configurator registered)
+ * so the partition derivation stays independent of any live Electron session —
+ * the partition is a constructor-time fact, not a side effect of touching the
+ * session API. Setup sites register configurators at app boot; in unit tests
+ * that mock `electron` without a `session` export this short-circuits cleanly.
+ */
+export function configureMiniappSession(partition) {
+    // Record that this partition should be configured even if no configurator is
+    // registered YET — a later `registerMiniappSessionConfigurator` back-fills it.
+    const alreadyConfigured = configuredPartitions.has(partition);
+    configuredPartitions.add(partition);
+    if (configurators.size === 0)
+        return null;
+    const sess = electron.session.fromPartition(partition);
+    if (alreadyConfigured)
+        return sess;
+    for (const fn of configurators) {
+        try {
+            fn(sess, partition);
+        }
+        catch (err) {
+            console.warn('[miniapp-partition] configurator failed for', partition, err);
+        }
+    }
+    return sess;
+}
+/**
+ * Test-only: drop the configurator + configured-partition bookkeeping so each
+ * test starts from a clean slate. (Module-level state otherwise leaks across
+ * unit tests that mock `electron`.)
+ */
+export function __resetMiniappSessionConfigForTests() {
+    configurators.clear();
+    configuredPartitions.clear();
+}
+//# sourceMappingURL=miniapp-partition.js.map

package/dist/main/services/views/simulator-session-policy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Referer + CORS webRequest policy for the simulator runtime's sessions.
+ *
+ * The native render/service hosts fetch the compiled `<appId>/…` resources
+ * cross-origin and need a WeChat-style page-frame `Referer`; this installs that
+ * policy on the shared fallback session AND on every per-project
+ * `persist:miniapp-<key>` partition (current + future) via the partition
+ * configurator registry, so isolated projects load resources identically.
+ *
+ * TEARDOWN: a `webRequest` listener is per-session and there is exactly one
+ * slot per (session, event) — re-installing replaces, never stacks. But the
+ * configurator registration itself leaks if discarded: re-creating the
+ * WorkbenchApp in the same process would register a second configurator that
+ * keeps firing for every future partition. So this returns a {@link Disposable}
+ * that unregisters the configurator AND clears the listeners off every session
+ * it touched. Wire it into the context registry like any other module.
+ */
+import { type Disposable } from '@dimina-kit/electron-deck/main';
+/**
+ * Install the simulator referer/CORS policy on the shared fallback session and
+ * register a configurator so every per-project partition session gets it too.
+ * Returns a disposable that unregisters the configurator and clears the policy
+ * off every session it installed on — call its teardown when the owning
+ * context is disposed so re-creating the app never leaks a duplicate
+ * configurator/listener.
+ */
+export declare function setupSimulatorSessionPolicy(): Disposable;
+//# sourceMappingURL=simulator-session-policy.d.ts.map

package/dist/main/services/views/simulator-session-policy.js

@@ -0,0 +1,82 @@
+/**
+ * Referer + CORS webRequest policy for the simulator runtime's sessions.
+ *
+ * The native render/service hosts fetch the compiled `<appId>/…` resources
+ * cross-origin and need a WeChat-style page-frame `Referer`; this installs that
+ * policy on the shared fallback session AND on every per-project
+ * `persist:miniapp-<key>` partition (current + future) via the partition
+ * configurator registry, so isolated projects load resources identically.
+ *
+ * TEARDOWN: a `webRequest` listener is per-session and there is exactly one
+ * slot per (session, event) — re-installing replaces, never stacks. But the
+ * configurator registration itself leaks if discarded: re-creating the
+ * WorkbenchApp in the same process would register a second configurator that
+ * keeps firing for every future partition. So this returns a {@link Disposable}
+ * that unregisters the configurator AND clears the listeners off every session
+ * it touched. Wire it into the context registry like any other module.
+ */
+import { session } from 'electron';
+import { toDisposable } from '@dimina-kit/electron-deck/main';
+import { getSimulatorServicewechatReferer } from '../simulator/referer.js';
+import { registerMiniappSessionConfigurator, SHARED_MINIAPP_PARTITION, } from './miniapp-partition.js';
+/** Apply the simulator runtime's referer + CORS webRequest policy to one
+ * session. Each session installs its own listeners (a webRequest listener is
+ * per-session), so this runs once per partition. */
+function applySimulatorWebRequestPolicy(simulatorSession) {
+    simulatorSession.webRequest.onBeforeSendHeaders((details, callback) => {
+        const forcedReferer = getSimulatorServicewechatReferer();
+        if (forcedReferer) {
+            details.requestHeaders['Referer'] = forcedReferer;
+        }
+        callback({ requestHeaders: details.requestHeaders });
+    });
+    simulatorSession.webRequest.onHeadersReceived((details, callback) => {
+        const headers = details.responseHeaders ?? {};
+        // CORS for the native render/service hosts to fetch compiled app resources
+        // cross-origin. (The COOP/COEP cross-origin-isolation headers were only for
+        // the removed default-path SharedArrayBuffer sync Worker — dropped.)
+        headers['access-control-allow-origin'] = ['*'];
+        headers['access-control-allow-headers'] = ['*'];
+        headers['access-control-allow-methods'] = ['*'];
+        callback({ responseHeaders: headers });
+    });
+}
+/** Remove the policy listeners from a session (passing `null` clears the slot). */
+function clearSimulatorWebRequestPolicy(simulatorSession) {
+    try {
+        simulatorSession.webRequest.onBeforeSendHeaders(null);
+        simulatorSession.webRequest.onHeadersReceived(null);
+    }
+    catch {
+        // Session already gone (app shutdown) — nothing to clear.
+    }
+}
+/**
+ * Install the simulator referer/CORS policy on the shared fallback session and
+ * register a configurator so every per-project partition session gets it too.
+ * Returns a disposable that unregisters the configurator and clears the policy
+ * off every session it installed on — call its teardown when the owning
+ * context is disposed so re-creating the app never leaks a duplicate
+ * configurator/listener.
+ */
+export function setupSimulatorSessionPolicy() {
+    const configured = new Set();
+    function install(sess) {
+        if (configured.has(sess))
+            return;
+        configured.add(sess);
+        applySimulatorWebRequestPolicy(sess);
+    }
+    // Shared fallback session (pre-warm pool + unknown-appId path).
+    install(session.fromPartition(SHARED_MINIAPP_PARTITION));
+    // Every per-project miniapp partition session (current + future) gets the
+    // same referer/CORS policy so isolated projects load resources identically.
+    const unregister = registerMiniappSessionConfigurator((sess) => install(sess));
+    return toDisposable(() => {
+        unregister();
+        for (const sess of configured)
+            clearSimulatorWebRequestPolicy(sess);
+        configured.clear();
+    });
+}
+//# sourceMappingURL=simulator-session-policy.js.map

package/dist/main/services/views/view-manager.d.ts

@@ -1,4 +1,5 @@
 import type { WebContents } from 'electron';
+import type { NativeDeviceInfo } from '../../../shared/ipc-channels.js';
 import { type WorkbenchContext } from '../workbench-context.js';
 /**
  * Context surface used by the ViewManager. We only need a small slice of the
@@ -7,8 +8,41 @@ import { type WorkbenchContext } from '../workbench-context.js';
 export interface ViewManagerContext {
     windows: WorkbenchContext['windows'];
     rendererDir: string;
+    /**
+     * Per-webContents connection registry (foundation.md §4). The native-host
+     * simulator WebContentsView is acquired here so the registry tracks that
+     * trusted webContents and tears its per-wc resources (the custom-api bridge
+     * `ipcMain.on`) down deterministically on destroy — see P1 DoD #3. Required:
+     * `createWorkbenchContext` always supplies it.
+     */
+    connections: WorkbenchContext['connections'];
+    /**
+     * Absolute path to the simulator preload bundle. Only consumed by the
+     * native-host simulator WebContentsView (`attachNativeSimulator`); the
+     * default `<webview>` path gets its preload from the session-registered
+     * frame preload instead. Optional so partial test contexts compile.
+     */
+    preloadPath?: string;
     panels: string[];
     notify: WorkbenchContext['notify'];
+    bridge?: WorkbenchContext['bridge'];
+    /**
+     * Native-host network forwarder. `attachNativeSimulator` hands it the freshly
+     * created simulator WebContentsView (`attachSimulator`) so it can attach the
+     * CDP debugger, and the DevTools front-end host wc (`setDevtoolsHost`) so it can
+     * inject that WCV's Network.* events into the native Network tab (service-host
+     * console line is the fallback). Optional so partial test contexts compile.
+     */
+    networkForward?: WorkbenchContext['networkForward'];
+    /**
+     * Per-context registry of host-registered simulator custom APIs. The
+     * native-host simulator is a top-level WebContentsView with no embedder
+     * renderer, so `attachNativeSimulator` dispatches the simulator-side
+     * `__diminaCustomApis` bridge straight to this registry (the default
+     * `<webview>` path proxies through the trusted main renderer instead).
+     * Optional so partial test contexts compile.
+     */
+    simulatorApis?: WorkbenchContext['simulatorApis'];
     /**
      * Header bar height in px, used to position overlay views below the header.
      * Optional here so partial test contexts compile; `createWorkbenchContext`
@@ -36,6 +70,19 @@ export interface ViewManager {
      * tab; otherwise the view is created but not added yet).
      */
     attachSimulator(simWcId: number, simWidth: number): void;
+    /**
+     * NATIVE-HOST ONLY. Create the simulator itself as a top-level
+     * WebContentsView (not a renderer `<webview>` guest) loading `simulatorUrl`,
+     * position it in the simulator panel region, and treat its webContents as
+     * THE simulator webContents (so `getSimulatorWebContents` resolves it and the
+     * spawn/SIMULATOR_EVENTS pipeline flows through it). This is required because
+     * Electron force-disables the `<webview>` tag inside a webview guest, so the
+     * default `<webview>`-in-`<webview>` topology can never host DeviceShell's
+     * per-page render-host `<webview>`s. A top-level WebContentsView's webContents
+     * is NOT a guest and CAN host them. Then wires the DevTools/console view on
+     * top of it via `attachSimulator`. No-op (logs) when `preloadPath` is unset.
+     */
+    attachNativeSimulator(simulatorUrl: string, simWidth: number): void;
     /**
      * Destroy and null out the simulator view (e.g. on simulator detach).
      * Also destroys the cached settings view and hides the popover —
@@ -75,6 +122,35 @@ export interface ViewManager {
     getSettingsWebContentsId(): number | null;
     /** Return the webContents ID of the popover overlay if alive, else null. */
     getPopoverWebContentsId(): number | null;
+    /**
+     * Return the webContents ID of the host-toolbar overlay if alive, else null.
+     * The host-toolbar WCV is the one overlay whose OWN renderer drives an IPC
+     * channel back to main (the reverse size-advertiser), so the sender policy
+     * must trust its id — see `createWorkbenchSenderPolicy`.
+     */
+    getHostToolbarWebContentsId(): number | null;
+    /**
+     * NATIVE-HOST ONLY. Position the simulator content WebContentsView over the
+     * renderer-measured simulator panel REGION rect (the flex:1 placeholder slot,
+     * CSS px from the main window content top-left, which maps 1:1 to overlay
+     * setBounds DIP) and apply the device zoom. The WCV fills the region as a
+     * plain rectangle; DeviceShell draws + scrolls the phone inside. No-op in the
+     * default `<webview>` path (`nativeSimulatorView` is null). See
+     * `computeNativeSimulatorViewParams`.
+     */
+    setNativeSimulatorViewBounds(params: {
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+        zoom: number;
+    }): void;
+    /**
+     * NATIVE-HOST ONLY. Re-push the selected device's CSS `env(safe-area-inset-*)`
+     * override to every attached render-host guest (on device change). New guests
+     * pick it up automatically when they attach (`did-attach-webview`).
+     */
+    reapplySafeArea(device: NativeDeviceInfo | null): void;
     /** Update lastSimWidth; reposition simulator + settings if they are added. */
     resize(simWidth: number): void;
     /** Show or hide the simulator overlay based on visibility flag. */
@@ -91,6 +167,55 @@ export interface ViewManager {
         width: number;
         height: number;
     }): void;
+    /**
+     * Apply a renderer-measured rectangle to the host-controllable toolbar
+     * WebContentsView (the strip above the devtools header). Forward anchor,
+     * mirroring `setSimulatorDevtoolsBounds`. `{ width: 0, height: 0 }` is
+     * treated as "hide" — the view is removed from the contentView but its
+     * WebContents (and the host's loaded content) stays alive. Lazily creates
+     * the view on the first non-empty rect.
+     */
+    setHostToolbarBounds(bounds: {
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+    }): void;
+    /**
+     * Reverse size-advertiser sink: the toolbar WCV's own renderer advertises
+     * its intrinsic content height (block-axis extent); we store it and push it
+     * to the main-window renderer so the placeholder div resizes (closing the
+     * dynamic-height loop).
+     */
+    setHostToolbarHeight(extent: number): void;
+    /**
+     * Host-facing control surface for the toolbar WebContentsView. The downstream
+     * host loads its own content into it (`loadURL` / `loadFile`) and fully drives
+     * it. Lazily creates the underlying view on the first load call.
+     */
+    readonly hostToolbar: HostToolbarControl;
+}
+/**
+ * The control object the downstream host uses to own the toolbar
+ * WebContentsView. Lazily backed by the view-manager's `hostToolbarView`.
+ */
+export interface HostToolbarControl {
+    /** Load a URL into the toolbar view (lazy-creates the view). */
+    loadURL(url: string): Promise<void>;
+    /** Load a local file into the toolbar view (lazy-creates the view). */
+    loadFile(path: string): Promise<void>;
+    /** The toolbar view's live WebContents, or null if not yet created/destroyed. */
+    readonly webContents: WebContents | null;
+    /** Remove the toolbar view from the contentView and reset it (kept alive). */
+    hide(): void;
+    /**
+     * Override the preload used when the toolbar view is first created. The
+     * host-shell (`launch(config)`) passes the host-controlled
+     * `toolbar.preloadPath` here; the host owns the bridge (it calls
+     * `exposeWorkbenchBridge()` itself). Must be set before the first
+     * `loadURL`/`loadFile`; `null` restores the built-in size-advertiser preload.
+     */
+    setPreloadPath(path: string | null): void;
 }
 /**
  * Build a ViewManager bound to the given context. The returned object is the