@dimina-kit/devtools 0.4.0-dev.20260615070430 → 0.4.0-dev.20260616024534

package/dist/main/ipc/app.js

@@ -1,91 +1,11 @@
 import { AppChannel } from '../../shared/ipc-channels.js';
 import { IpcRegistry } from '../utils/ipc-registry.js';
-function readString(value) {
-    if (typeof value !== 'string')
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed.length > 0 ? trimmed : undefined;
-}
-function normalizeHeaderAvatar(value) {
-    if (!value || typeof value !== 'object')
-        return null;
-    const raw = value;
-    const avatar = {};
-    const displayName = readString(raw.displayName);
-    const displayInitial = readString(raw.displayInitial);
-    const avatarUrl = readString(raw.avatarUrl);
-    const tooltip = readString(raw.tooltip);
-    if (displayName)
-        avatar.displayName = displayName;
-    if (displayInitial)
-        avatar.displayInitial = displayInitial;
-    if (avatarUrl)
-        avatar.avatarUrl = avatarUrl;
-    if (tooltip)
-        avatar.tooltip = tooltip;
-    return avatar.displayName || avatar.displayInitial || avatar.avatarUrl ? avatar : null;
-}
-function readPlacement(value) {
-    return value === 'left' || value === 'center' || value === 'right' ? value : undefined;
-}
-function normalizeHeaderAction(value) {
-    if (!value || typeof value !== 'object')
-        return null;
-    const raw = value;
-    const id = readString(raw.id);
-    const label = readString(raw.label);
-    if (!id || !label)
-        return null;
-    const action = { id, label };
-    const tooltip = readString(raw.tooltip);
-    const placement = readPlacement(raw.placement);
-    if (tooltip)
-        action.tooltip = tooltip;
-    if (placement)
-        action.placement = placement;
-    if (typeof raw.disabled === 'boolean')
-        action.disabled = raw.disabled;
-    return action;
-}
-function normalizeHeaderActions(value) {
-    if (!Array.isArray(value))
-        return [];
-    const actions = [];
-    const seen = new Set();
-    for (const item of value) {
-        const action = normalizeHeaderAction(item);
-        if (!action || seen.has(action.id))
-            continue;
-        seen.add(action.id);
-        actions.push(action);
-    }
-    return actions.slice(0, 8);
-}
 export function registerAppIpc(ctx) {
     return new IpcRegistry(ctx.senderPolicy)
         .handle(AppChannel.GetBranding, async () => {
         if (ctx.brandingProvider)
             return ctx.brandingProvider();
         return { appName: ctx.appName };
-    })
-        .handle(AppChannel.GetHeaderAvatar, async () => {
-        if (!ctx.headerAvatarProvider)
-            return null;
-        return normalizeHeaderAvatar(await ctx.headerAvatarProvider());
-    })
-        .handle(AppChannel.InvokeHeaderAvatar, async () => {
-        await ctx.headerAvatarActionHandler?.();
-    })
-        .handle(AppChannel.GetHeaderActions, async () => {
-        if (!ctx.headerActionsProvider)
-            return [];
-        return normalizeHeaderActions(await ctx.headerActionsProvider());
-    })
-        .handle(AppChannel.InvokeHeaderAction, async (_event, id) => {
-        const actionId = readString(id);
-        if (!actionId)
-            return;
-        await ctx.headerActionHandler?.(actionId);
     });
 }
 //# sourceMappingURL=app.js.map

package/dist/main/runtime/miniapp-runtime.d.ts

@@ -15,8 +15,10 @@
  *    syntax: under strictFunctionTypes method signatures compare bivariantly,
  *    which would let a wrongly-narrowed implementation or host override slip
  *    past the drift sentinel.
- *  - `workspace.openProject` stays writable (no `readonly`): qdmp gates
- *    project permissions by reassigning it (documented monkey-patch contract).
+ *  - `workspace.openProject` stays writable (no `readonly`) for backward
+ *    compat: hosts MAY still gate permissions by reassigning it. The preferred
+ *    path is now the declarative `WorkbenchAppConfig.onBeforeOpenProject` hook
+ *    (runs before any side effect, throw to veto) — see host-migration.md §7.
  *
  * `asMiniappRuntime(ctx)` is an identity return — the contract is a typed
  * VIEW onto the live context, not a snapshot/projection. That is what makes

package/dist/main/services/notifications/renderer-notifier.d.ts

@@ -65,10 +65,6 @@ export interface RendererNotifier {
      * placeholder div resizes (closes the host-toolbar dynamic-height loop).
      */
     hostToolbarHeightChanged(height: number): void;
-    /** Ask the main renderer to re-fetch the host-provided header avatar DTO. */
-    headerAvatarChanged(): void;
-    /** Ask the main renderer to re-fetch the host-provided header actions. */
-    headerActionsChanged(): void;
     /**
      * Ask the main renderer's Monaco editor to open a project file at a position.
      * Drives the "click a console file link → open in editor" pipeline.

package/dist/main/services/notifications/renderer-notifier.js

@@ -1,4 +1,4 @@
-import { ProjectChannel, WindowChannel, SettingsChannel, PopoverChannel, WorkbenchSettingsChannel, EditorChannel, ViewChannel, AppChannel, } from '../../../shared/ipc-channels.js';
+import { ProjectChannel, WindowChannel, SettingsChannel, PopoverChannel, WorkbenchSettingsChannel, EditorChannel, ViewChannel, } from '../../../shared/ipc-channels.js';
 /** Safely resolve a WebContents, skipping destroyed / missing targets. */
 function liveWebContents(wc) {
     if (!wc)
@@ -39,12 +39,6 @@ export function createRendererNotifier(ctx) {
         hostToolbarHeightChanged(height) {
             sendToMain(ViewChannel.HostToolbarHeightChanged, height);
         },
-        headerAvatarChanged() {
-            sendToMain(AppChannel.HeaderAvatarChanged);
-        },
-        headerActionsChanged() {
-            sendToMain(AppChannel.HeaderActionsChanged);
-        },
         editorOpenFile(payload) {
             sendToMain(EditorChannel.OpenFile, payload);
         },

package/dist/main/services/safe-area/index.d.ts

@@ -3,10 +3,12 @@ import type { ConnectionRegistry } from '@dimina-kit/electron-deck/main';
 import type { NativeDeviceInfo } from '../../../shared/ipc-channels.js';
 export interface SafeAreaController {
     /** Attach the debugger to a freshly-attached render-host guest and push the
-     *  current device's insets. No-op (warn) if the guest is already claimed by an
-     *  external CDP client — env then stays 0 rather than throwing. */
-    applyToGuest(guestWc: WebContents, device: NativeDeviceInfo | null): void;
-    /** Re-push insets to every still-attached guest after a device change. */
+     *  current device's insets. `isTabPage` selects the bottom-inset policy (0 for
+     *  tab pages, the real inset for full-bleed non-tab pages). No-op (warn) if the
+     *  guest is already claimed by an external CDP client — env then stays 0. */
+    applyToGuest(guestWc: WebContents, device: NativeDeviceInfo | null, isTabPage: boolean): void;
+    /** Re-push insets to every still-attached guest after a device change (each
+     *  guest keeps the page type it attached with). */
     reapplyAll(device: NativeDeviceInfo | null): void;
     /** Detach from all guests (teardown). */
     dispose(): void;

package/dist/main/services/safe-area/index.js

@@ -1,25 +1,31 @@
-function guestInsets(device) {
+function guestInsets(device, isTabPage) {
     const top = device?.safeAreaInsets.top ?? 0;
-    return { top, topMax: top, right: 0, rightMax: 0, bottom: 0, bottomMax: 0, left: 0, leftMax: 0 };
+    // A tab page's content sits above the shell-drawn tabBar (which fills the
+    // bottom safe area), so it never borders the bottom unsafe zone. A non-tab
+    // page is full-bleed to the device bottom, so surface the real inset for its
+    // own `env(safe-area-inset-bottom)` opt-in.
+    const bottom = isTabPage ? 0 : (device?.safeAreaInsets.bottom ?? 0);
+    return { top, topMax: top, right: 0, rightMax: 0, bottom, bottomMax: bottom, left: 0, leftMax: 0 };
 }
 export function createSafeAreaController(options = {}) {
-    // Guests we successfully attached `wc.debugger` to (so we don't re-attach,
-    // which throws). Pruned on guest destroy.
-    const attached = new Set();
-    function override(wc, device) {
+    // Guests we successfully attached `wc.debugger` to (value = the page's
+    // `isTabPage`, fixed for the guest's life — it's one page). So we don't
+    // re-attach (throws), and a device-change reapply reuses the same policy.
+    const attached = new Map();
+    function override(wc, device, isTabPage) {
         if (wc.isDestroyed())
             return;
         void wc.debugger
-            .sendCommand('Emulation.setSafeAreaInsetsOverride', { insets: guestInsets(device) })
+            .sendCommand('Emulation.setSafeAreaInsetsOverride', { insets: guestInsets(device, isTabPage) })
             .catch((err) => {
             console.warn('[safe-area] setSafeAreaInsetsOverride failed:', err instanceof Error ? err.message : err);
         });
     }
     return {
-        applyToGuest: (wc, device) => {
+        applyToGuest: (wc, device, isTabPage) => {
             if (!wc || wc.isDestroyed() || attached.has(wc)) {
                 if (wc && !wc.isDestroyed() && attached.has(wc))
-                    override(wc, device);
+                    override(wc, device, isTabPage);
                 return;
             }
             try {
@@ -31,21 +37,21 @@ export function createSafeAreaController(options = {}) {
                 console.warn('[safe-area] debugger.attach failed; env(safe-area-inset-*) stays 0:', err instanceof Error ? err.message : err);
                 return;
             }
-            attached.add(wc);
+            attached.set(wc, isTabPage);
             if (options.connections) {
                 options.connections.acquire(wc).own(() => attached.delete(wc));
             }
             else {
                 wc.once('destroyed', () => attached.delete(wc));
             }
-            override(wc, device);
+            override(wc, device, isTabPage);
         },
         reapplyAll: (device) => {
-            for (const wc of attached)
-                override(wc, device);
+            for (const [wc, isTabPage] of attached)
+                override(wc, device, isTabPage);
         },
         dispose: () => {
-            for (const wc of attached) {
+            for (const wc of attached.keys()) {
                 try {
                     if (!wc.isDestroyed())
                         wc.debugger.detach();

package/dist/main/services/simulator-storage/index.js

@@ -403,8 +403,10 @@ export function setupSimulatorStorage(host, options) {
             const filtered = prefix
                 ? result.entries.filter(([key]) => key.startsWith(prefix))
                 : result.entries;
-            // Keys are returned with their `${appId}_` prefix intact; stripping is
-            // a follow-up so the panel UI can stay compatible with the raw keys.
+            // Keys are returned with their `${appId}_` prefix intact: every write
+            // path (Set/Remove) keys off the raw storage key. The Storage panel
+            // display-strips the prefix for readability (storage-panel.tsx), so the
+            // wire keys stay raw while the UI shows clean, Chrome-like keys.
             return filtered.map(([key, value]) => ({ key, value }));
         });
     }

package/dist/main/services/views/view-manager.js

@@ -1,6 +1,7 @@
-import { ipcMain, shell, WebContentsView, webContents } from 'electron';
+import { ipcMain, nativeTheme, shell, WebContentsView, webContents } from 'electron';
 import path from 'path';
 import { cjsSiblingPreloadPath, mainPreloadPath } from '../../utils/paths.js';
+import { simDeskBg } from '../../utils/theme.js';
 import { applyNavigationHardening, handleWindowOpenExternal, } from '../../windows/navigation-hardening.js';
 import { SimulatorCustomApiBridgeChannel } from '../../../shared/ipc-channels.js';
 import { OPEN_IN_EDITOR_SCHEME, decodeOpenInEditorUrl, resourceUrlToProjectRelativePath, } from '../../../shared/open-in-editor.js';
@@ -806,12 +807,27 @@ export function createViewManager(ctx) {
             },
         });
         nativeSimulatorView = view;
-        // Paint the WCV surface the simulator-panel background (≈ --color-sim-bg
-        // hsl(0 0% 7%)) so a height-resize that grows the region never flashes white
-        // in the newly-exposed strip before DeviceShell's desk repaints — the WCV,
-        // the desk, and the renderer placeholder behind it are all the same color.
-        view.setBackgroundColor('#121212');
+        // Paint the WCV surface the themed desk color (simDeskBg(): dark #121212 /
+        // light #e8e8e8) so a height-resize that grows the region never flashes a
+        // mismatched strip before DeviceShell's desk repaints — the WCV, the desk,
+        // and the renderer placeholder behind it are all the same color.
+        view.setBackgroundColor(simDeskBg());
         const simWc = view.webContents;
+        // Keep the WCV surface in sync with the active color scheme. The
+        // process-wide installThemeBackgroundSync() re-syncs BrowserWindows on a
+        // theme switch, but this top-level WebContentsView is not a window, so its
+        // creation-time backgroundColor would otherwise freeze. Mirror simDeskBg()
+        // here on every nativeTheme `updated`; the listener is owned by the wc's
+        // connection so it detaches when the simulator view is torn down.
+        const syncDeskBg = () => {
+            try {
+                if (!simWc.isDestroyed())
+                    view.setBackgroundColor(simDeskBg());
+            }
+            catch { /* view/wc gone */ }
+        };
+        nativeTheme.on('updated', syncDeskBg);
+        ctx.connections.acquire(simWc).own(() => nativeTheme.removeListener('updated', syncDeskBg));
         // Service the simulator-side `__diminaCustomApis` bridge: this top-level
         // WebContentsView has no embedder renderer to proxy through, so dispatch its
         // `sendToHost` requests straight to `ctx.simulatorApis` from main.
@@ -822,12 +838,23 @@ export function createViewManager(ctx) {
         // them with contextIsolation/sandbox off so the render runtime + its preload
         // share the page realm. (A top-level WebContentsView can host these guests; a
         // `<webview>` guest cannot — that's the whole point of Option A.)
+        // Page type (`isTab`) of each attaching guest, captured from its render-host
+        // URL in will-attach (where `params.src` carries the full URL) and consumed
+        // FIFO in the matching did-attach — `guestWc.getURL()` is still empty there.
+        // Per-attach scope: a fresh simWc + handlers are built on every (re)attach.
+        const pendingGuestIsTab = [];
         simWc.on('will-attach-webview', (_event, webPreferences, params) => {
             ;
             webPreferences.partition = partition;
             params.partition = partition;
             webPreferences.contextIsolation = false;
             webPreferences.sandbox = false;
+            let isTab = false;
+            try {
+                isTab = new URL(params.src).searchParams.get('isTab') === '1';
+            }
+            catch { /* keep false */ }
+            pendingGuestIsTab.push(isTab);
         });
         simWc.on('did-attach-webview', (_event, guestWc) => {
             // Scale the nested render-host page with the device zoom. The host WCV is
@@ -841,8 +868,13 @@ export function createViewManager(ctx) {
             }
             catch { /* guest not ready; setNativeSimulatorViewBounds re-applies */ }
             // Simulate this device's CSS env(safe-area-inset-*) on the fresh guest
-            // before it paints, so notch-aware page layout resolves correctly.
-            safeArea.applyToGuest(guestWc, ctx.bridge?.getDevice() ?? null);
+            // before it paints, so notch-aware page layout resolves correctly. The
+            // bottom inset is page-type-dependent (see services/safe-area): a tab
+            // page's content sits above the shell tabBar (bottom 0); a non-tab page
+            // is full-bleed (real bottom inset). The page type was captured from the
+            // render-host URL in will-attach (FIFO).
+            const isTabGuest = pendingGuestIsTab.shift() ?? false;
+            safeArea.applyToGuest(guestWc, ctx.bridge?.getDevice() ?? null, isTabGuest);
             guestWc.setWindowOpenHandler(({ url }) => handleWindowOpenExternal(url));
             guestWc.on('will-navigate', (e, url) => {
                 try {

package/dist/main/services/workbench-context.d.ts

@@ -1,5 +1,5 @@
 import type { BrowserWindow } from 'electron';
-import type { CompilationAdapter, HeaderActionsProvider, HeaderAvatarProvider, WorkbenchConfig } from '../../shared/types.js';
+import type { CompilationAdapter, WorkbenchConfig } from '../../shared/types.js';
 import type { BridgeRouterHandle } from '../ipc/bridge-router.js';
 import type { ConsoleForwarder } from './console-forward/index.js';
 import type { NetworkForwarder } from './network-forward/index.js';
@@ -35,14 +35,6 @@ export interface WorkbenchContext {
     }> | {
         appName: string;
     };
-    /** Host-injected profile provider for the built-in header avatar slot. */
-    headerAvatarProvider?: HeaderAvatarProvider;
-    /** Host-injected click handler for the built-in header avatar slot. */
-    headerAvatarActionHandler?: () => void | Promise<void>;
-    /** Host-injected compact action provider for the built-in project header. */
-    headerActionsProvider?: HeaderActionsProvider;
-    /** Host-injected click handler for the built-in project header actions. */
-    headerActionHandler?: (id: string) => void | Promise<void>;
     /** Unified lifecycle manager for all overlay WebContentsViews */
     views: ViewManager;
     /** Owns BrowserWindow instances (main + settings) and their sender-id checks. */
@@ -82,6 +74,13 @@ export interface WorkbenchContext {
         parentWindow: BrowserWindow;
         templates: ProjectTemplate[];
     }) => Promise<CustomCreateProjectDialogResult>;
+    /**
+     * Host permission gate consulted by `workspace.openProject` BEFORE any side
+     * effect. Throwing vetoes the open (see `WorkbenchAppConfig.onBeforeOpenProject`).
+     * Wired from the config by `createDevtoolsRuntime`; undefined for the
+     * single-tenant default.
+     */
+    onBeforeOpenProject?: (projectPath: string) => void | Promise<void>;
     /**
      * Trust predicate consulted by `IpcRegistry` for every incoming IPC.
      * Resolves the currently-trusted senders (main renderer + overlays)
@@ -183,10 +182,6 @@ export interface CreateContextOptions extends Pick<WorkbenchConfig, 'adapter' |
     preloadPath: string;
     rendererDir: string;
     brandingProvider?: WorkbenchContext['brandingProvider'];
-    headerAvatarProvider?: WorkbenchContext['headerAvatarProvider'];
-    headerAvatarActionHandler?: WorkbenchContext['headerAvatarActionHandler'];
-    headerActionsProvider?: WorkbenchContext['headerActionsProvider'];
-    headerActionHandler?: WorkbenchContext['headerActionHandler'];
     /** Host-supplied project list backend. Defaults to LocalProjectsProvider. */
     projectsProvider?: ProjectsProvider;
     /** Templates injected by the host; same-id overrides a built-in. */
@@ -195,6 +190,8 @@ export interface CreateContextOptions extends Pick<WorkbenchConfig, 'adapter' |
     builtinTemplates?: 'all' | 'none' | readonly string[];
     /** Host-supplied "新建项目" dialog hook. */
     customCreateProjectDialog?: WorkbenchContext['customCreateProjectDialog'];
+    /** Host permission gate run before a project opens (throw to veto). */
+    onBeforeOpenProject?: WorkbenchContext['onBeforeOpenProject'];
 }
 export declare function createWorkbenchContext(opts: CreateContextOptions): WorkbenchContext;
 export { sanitizeTemplates };

package/dist/main/services/workbench-context.js

@@ -18,10 +18,6 @@ export function createWorkbenchContext(opts) {
         apiNamespaces: opts.apiNamespaces ?? [],
         appName: opts.appName ?? 'Dimina DevTools',
         brandingProvider: opts.brandingProvider,
-        headerAvatarProvider: opts.headerAvatarProvider,
-        headerAvatarActionHandler: opts.headerAvatarActionHandler,
-        headerActionsProvider: opts.headerActionsProvider,
-        headerActionHandler: opts.headerActionHandler,
     };
     ctx.registry = new DisposableRegistry();
     // Empty connection registry as a first-class context field. Connections are
@@ -41,6 +37,7 @@ export function createWorkbenchContext(opts) {
     ctx.projectsProvider = opts.projectsProvider ?? createLocalProjectsProvider();
     ctx.projectTemplates = resolveTemplates(BUILTIN_TEMPLATES, opts.projectTemplates ?? [], opts.builtinTemplates ?? 'all');
     ctx.customCreateProjectDialog = opts.customCreateProjectDialog;
+    ctx.onBeforeOpenProject = opts.onBeforeOpenProject;
     ctx.workspace = createWorkspaceService(ctx);
     ctx.senderPolicy = createWorkbenchSenderPolicy(ctx);
     return ctx;

package/dist/main/services/workspace/workspace-service.js

@@ -80,6 +80,19 @@ export function createWorkspaceService(ctx) {
             ? provider.validateProjectDir(dirPath)
             : null,
         async openProject(projectPath) {
+            // Host permission gate — runs BEFORE any side effect (referer reset,
+            // session teardown, compile/dev-server spin-up). A throwing hook vetoes
+            // the open: return early with the error and leave the currently-active
+            // session fully intact. The declarative replacement for monkey-patching
+            // this method. See WorkbenchAppConfig.onBeforeOpenProject.
+            if (ctx.onBeforeOpenProject) {
+                try {
+                    await ctx.onBeforeOpenProject(projectPath);
+                }
+                catch (err) {
+                    return { success: false, error: err instanceof Error ? err.message : String(err) };
+                }
+            }
             clearSimulatorServicewechatReferer();
             // Invalidate the outgoing session's onLog BEFORE teardown starts (same
             // order as closeProject below): the dying compile worker flushes

package/dist/main/utils/theme.d.ts

@@ -8,6 +8,21 @@ import { type Disposable } from '@dimina-kit/electron-deck/main';
  * Light: hsl(0 0% 98%) ≈ #fafafa  (--color-bg)
  */
 export declare function themeBg(): string;
+/**
+ * Backdrop ("desk") color for the native simulator WebContentsView — the
+ * surface the simulated phone sits on. Unlike {@link themeBg} (the window bg),
+ * the desk is a neutral grey kept a touch off the window so the light-colored
+ * phone keeps contrast against it in BOTH schemes.
+ *
+ * Dark:  hsl(0 0% 7%)  ≈ #121212  (the long-standing desk color — unchanged)
+ * Light: hsl(0 0% 91%) ≈ #e8e8e8  (neutral grey; the white phone reads on it)
+ *
+ * MUST stay equal to the renderer's `--color-sim-bg` (design.css) and the
+ * simulator page's `.device-shell-root` background (device-shell.css): the WCV,
+ * the desk, and the placeholder behind it are the same color so a height-resize
+ * never flashes a mismatched strip. Update all three together.
+ */
+export declare function simDeskBg(): string;
 /**
  * Install a single process-wide listener that keeps every window's native
  * `backgroundColor` in sync with the active color scheme.

package/dist/main/utils/theme.js

@@ -1,5 +1,6 @@
 import { BrowserWindow, nativeTheme } from 'electron';
 import { toDisposable } from '@dimina-kit/electron-deck/main';
+import { WorkbenchSettingsChannel } from '../../shared/ipc-channels.js';
 /**
  * Background color that matches the current system color scheme.
  * Pass as `backgroundColor` when creating BrowserWindows to prevent
@@ -11,6 +12,23 @@ import { toDisposable } from '@dimina-kit/electron-deck/main';
 export function themeBg() {
     return nativeTheme.shouldUseDarkColors ? '#1a1a1a' : '#fafafa';
 }
+/**
+ * Backdrop ("desk") color for the native simulator WebContentsView — the
+ * surface the simulated phone sits on. Unlike {@link themeBg} (the window bg),
+ * the desk is a neutral grey kept a touch off the window so the light-colored
+ * phone keeps contrast against it in BOTH schemes.
+ *
+ * Dark:  hsl(0 0% 7%)  ≈ #121212  (the long-standing desk color — unchanged)
+ * Light: hsl(0 0% 91%) ≈ #e8e8e8  (neutral grey; the white phone reads on it)
+ *
+ * MUST stay equal to the renderer's `--color-sim-bg` (design.css) and the
+ * simulator page's `.device-shell-root` background (device-shell.css): the WCV,
+ * the desk, and the placeholder behind it are the same color so a height-resize
+ * never flashes a mismatched strip. Update all three together.
+ */
+export function simDeskBg() {
+    return nativeTheme.shouldUseDarkColors ? '#121212' : '#e8e8e8';
+}
 /**
  * Install a single process-wide listener that keeps every window's native
  * `backgroundColor` in sync with the active color scheme.
@@ -36,10 +54,25 @@ export function themeBg() {
 export function installThemeBackgroundSync() {
     const apply = () => {
         const bg = themeBg();
+        const isDark = nativeTheme.shouldUseDarkColors;
         for (const win of BrowserWindow.getAllWindows()) {
-            if (!win.isDestroyed()) {
+            if (win.isDestroyed())
+                continue;
+            // Isolate each window: a window closing mid-loop (or a renderer torn down
+            // between the isDestroyed() check and the send) must not abort the sync
+            // for the remaining windows.
+            try {
                 win.setBackgroundColor(bg);
+                // Notify renderer JS consumers that can't observe the CSS
+                // `prefers-color-scheme` change (Monaco's theme). Electron does not
+                // dispatch the renderer's matchMedia change event for programmatic
+                // `nativeTheme.themeSource` flips, so push it from here — the one place
+                // that already centralizes color-scheme reactions.
+                if (!win.webContents.isDestroyed()) {
+                    win.webContents.send(WorkbenchSettingsChannel.ThemeChanged, isDark);
+                }
             }
+            catch { /* window/webContents gone mid-loop */ }
         }
     };
     nativeTheme.on('updated', apply);

package/dist/main/windows/main-window/create.d.ts

@@ -6,6 +6,12 @@ export interface WindowOptions {
     minWidth?: number;
     minHeight?: number;
     indexHtml: string;
+    /**
+     * Auto-show the window on `ready-to-show` in non-test envs. Defaults to
+     * `true`. `false` lets a login-gating host keep the window hidden and call
+     * `show()` itself. The test env always uses `showInactive()` regardless.
+     */
+    autoShow?: boolean;
 }
 export declare function createMainWindow(opts: WindowOptions): BrowserWindow;
 //# sourceMappingURL=create.d.ts.map

package/dist/main/windows/main-window/create.js

@@ -26,7 +26,11 @@ export function createMainWindow(opts) {
             mainWindow.showInactive();
         }
         else {
-            mainWindow.show();
+            // A login-gating host opts out via `autoShow: false` and shows the
+            // window itself once auth passes — don't flash an un-authed window.
+            if (opts.autoShow !== false) {
+                mainWindow.show();
+            }
             // Don't auto-open a detached DevTools for the devtools UI shell itself —
             // it's noise for normal use (the mini-app's Console lives in the embedded
             // right-panel DevTools, not here). Opt in via env for debugging the shell.

package/dist/preload/runtime/native-host.d.ts

@@ -4,6 +4,9 @@ export interface RenderHostUrlOptions {
     bridgeId: string;
     appId: string;
     pagePath: string;
+    /** Whether this page is a tabBar page. Surfaced on the URL so main can pick
+     *  the bottom safe-area policy at `did-attach-webview` (services/safe-area). */
+    isTab?: boolean;
 }
 export interface DiminaNativeHostBridge {
     enabled: boolean;

package/dist/preload/runtime/native-host.js

@@ -55,6 +55,8 @@ function buildBridge(cfg) {
             url.searchParams.set('bridgeId', opts.bridgeId);
             url.searchParams.set('appId', opts.appId);
             url.searchParams.set('pagePath', opts.pagePath);
+            if (opts.isTab)
+                url.searchParams.set('isTab', '1');
             return url.toString();
         },
         renderPreloadUrl: cfg.renderPreloadUrl,