@dimina-kit/devtools 0.4.0-dev.20260625063832 → 0.4.0-dev.20260630033804

package/dist/main/ipc/bridge-router.d.ts

@@ -49,6 +49,27 @@ export interface BridgeRouterHandle {
     getDevice(): NativeDeviceInfo | null;
     /** Cache the selected device + push DEVICE_CHANGE to the live simulator WC(s). */
     setDevice(device: NativeDeviceInfo): void;
+    /**
+     * Deterministically tear down every app session bound to the given simulator
+     * WebContentsView id (project close / DeviceShell respawn). The session
+     * mappings are cleared, the render-host guest webContents are closed, and the
+     * service-host window is closed/released — synchronously, instead of waiting
+     * on the WCV's async `'destroyed'` cascade — so the next project never
+     * re-resolves or screenshots the outgoing project's render guest. Idempotent
+     * with the `simulatorWc.once('destroyed')` hook (`disposeAppSession`
+     * early-returns once a session is gone). Optional so partial test mocks of the
+     * handle need not stub it.
+     *
+     * The synchronous prefix of the underlying disposeAppSession clears every map
+     * + closes the render guests + the service window before it awaits, so the
+     * bridge is clean the moment this is called. The returned promise resolves
+     * after the async tail (pool.release / resourceServer.close) so the lifecycle
+     * owner can sequence a reopen after full teardown. NOTE: disposeAppSession
+     * catches and logs pool/resource-release failures internally, so the promise
+     * resolves rather than rejecting on those — it is a completion signal, not an
+     * error channel.
+     */
+    disposeSessionsForSimulator?(simulatorWcId: number): Promise<void>;
     /**
      * The flag-gated debugTap (§7) over the bridge message stream. Exposed so a
      * hidden devtools panel / automation can read `.entries()` when

package/dist/main/ipc/bridge-router.js

@@ -119,11 +119,27 @@ function resolveCurrentApp(state, ctx, appId) {
         if (match)
             return match;
     }
-    // Maps preserve insertion order; the last entry is the most recent spawn.
+    // During a project close the workspace nulls its session BEFORE the bridge app
+    // session is torn down (disposeSession runs before disposeAll). Resolving here
+    // would hand a consumer the closing project's dying guest, so refuse to guess
+    // while a close is in flight.
+    if (ctx.workspace?.isClosing?.())
+        return undefined;
+    // No appId hint and no workspace session to disambiguate. Picking by appId is
+    // impossible, so fall back to the most-recent spawn — but ONLY when every live
+    // session belongs to the same app. Same-appId multiples are a respawn/reopen
+    // in progress where the newest is the live one (insertion order = spawn
+    // order). Multiple DISTINCT appIds mean a previous project is mid-teardown
+    // alongside the new one; any pick is a guess that can resolve the WRONG
+    // project's content (the screenshot/inspect-stale-app bug class), so prefer
+    // null over a wrong guess.
     let last;
-    for (const ap of state.appSessions.values())
+    const distinctAppIds = new Set();
+    for (const ap of state.appSessions.values()) {
         last = ap;
-    return last;
+        distinctAppIds.add(ap.appId);
+    }
+    return distinctAppIds.size <= 1 ? last : undefined;
 }
 export function installBridgeRouter(ctx) {
     const state = {
@@ -262,6 +278,22 @@ export function installBridgeRouter(ctx) {
                 }
             }
         },
+        disposeSessionsForSimulator: (simulatorWcId) => {
+            // Snapshot ids first: disposeAppSession mutates state.appSessions.
+            const ids = [];
+            for (const [id, ap] of state.appSessions) {
+                if (ap.simulatorWc.id === simulatorWcId)
+                    ids.push(id);
+            }
+            // disposeAppSession's synchronous prefix clears every map + closes the
+            // render guests + the service window, so the bridge is clean the moment
+            // this is called. The joined promise resolves after the async tail
+            // (pool.release / resourceServer.close) so a caller can sequence a reopen
+            // after full teardown. disposeAppSession logs those tail failures
+            // internally, so this resolves rather than rejecting on them — it is a
+            // completion signal, not an error channel.
+            return Promise.all(ids.map((id) => disposeAppSession(state, id))).then(() => { });
+        },
         debugTap: state.debugTap,
     };
     ctx.bridge = bridgeHandle;
@@ -506,6 +538,13 @@ async function handleSpawn(state, ctx, event, opts) {
         serviceWindow = createServiceHostWindow({
             bridgeId,
             appId,
+            // Same (appId, projectPath) pair the simulator WCV uses, so this project's
+            // service host and render guests land on ONE partition while a different
+            // project with the same appId is isolated. Use the path captured at spawn
+            // ENTRY (workspaceProjectPath), not a re-read: a project switch during the
+            // awaits above would otherwise give the service host a different path than
+            // the simulator WCV was built with, splitting the partition.
+            projectPath: workspaceProjectPath || undefined,
             pagePath,
             pkgRoot,
             root,
@@ -585,6 +624,17 @@ async function handleSpawn(state, ctx, event, opts) {
         void disposeAppSession(state, appSessionId);
     };
     simulatorWc.once('destroyed', onSimulatorDestroyed);
+    // The simulator WCV may have been torn down DURING this spawn's awaits
+    // (loadAppConfig / resource server / service-host creation) — e.g. a project
+    // close/switch that ran while we were mid-flight. In that case its 'destroyed'
+    // event already fired and the once() above will never run, so the freshly
+    // registered session would be a zombie owned by a dead simulator (the
+    // teardown's disposeSessionsForSimulator snapshot taken before appSessions.set
+    // could not have included it). Dispose now — idempotent with the graceful
+    // path — so a closed/superseded simulator can't leave a resurrected session.
+    if (simulatorWc.isDestroyed()) {
+        void disposeAppSession(state, appSessionId);
+    }
     if (usedPool) {
         // A pooled/fallback window passes through about:blank (warm load or the
         // fallback's initial load). Boot only once the REAL service.html navigation
@@ -1232,6 +1282,16 @@ async function disposeAppSession(state, appSessionId, opts = {}) {
     for (const page of ap.pages.values()) {
         if (page.renderWc && !page.renderWc.isDestroyed()) {
             state.wcIdToBridgeId.delete(page.renderWc.id);
+            // The render-host <webview> guest is otherwise reclaimed only when its
+            // host simulator WCV is destroyed, and that cascade is async. Close it
+            // here so a project-close / respawn tears the guest down deterministically
+            // rather than leaving the outgoing project's guest alive to be
+            // screenshotted or re-resolved by the next project. Idempotent with the
+            // cascade (guarded on isDestroyed).
+            try {
+                page.renderWc.close();
+            }
+            catch { /* guest already gone */ }
         }
         state.pageSessions.delete(page.bridgeId);
     }

package/dist/main/services/automation/index.js

@@ -91,7 +91,6 @@ export async function startAutomationServer(ctx, port = 0) {
             if (ipcMessageHostHandler) {
                 try {
                     if (!attachedSim.isDestroyed()) {
-                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
                         ;
                         attachedSim.removeListener('ipc-message-host', ipcMessageHostHandler);
                     }

package/dist/main/services/elements-forward/index.js

@@ -132,6 +132,24 @@ export function buildElementsHookScript() {
     return 'partial';
   }catch(e){ return 'error:' + (e && e.message); }})()`;
 }
+/**
+ * One reconcile tick run in the front-end realm: idempotently (re)install the
+ * hook AND drain the outbound queue in a SINGLE round-trip. The front-end's
+ * `globalThis` is wiped on every devtools (re)load (service-host pool swap on a
+ * hot-reload respawn re-opens DevTools and re-bootstraps the front-end), so the
+ * hook must be re-asserted continuously — not once on `dom-ready`. Returns
+ * `{ status, batch }`: `status` is `'installed'` the tick we (re)wrap a freshly
+ * loaded front-end (the caller re-primes + re-pulls so Elements snaps back to the
+ * render guest), `'already'` once it is in place, `'partial'` while the embedder
+ * global has not appeared yet. `batch` is the drained command queue.
+ */
+function buildReconcileScript() {
+    return `(function(){`
+        + `var status; try { status = ${buildElementsHookScript()}; } catch(e){ status = 'error:'+(e&&e.message); }`
+        + `var batch = []; try { if (globalThis.__diminaElementsOutbound) batch = globalThis.__diminaElementsOutbound.splice(0); } catch(_){}`
+        + `return { status: status, batch: batch };`
+        + `})()`;
+}
 // ── main → front-end dispatch (mirrored from network-forward/index.ts) ────────
 // network-forward keeps these file-private and the task forbids touching it, so
 // they're re-implemented here. Keep the chunk contract in sync if that changes.
@@ -171,14 +189,10 @@ function buildDocumentUpdatedScript() {
     const msg = JSON.stringify({ method: 'DOM.documentUpdated', params: {} });
     return buildDispatchScript(msg);
 }
+// Reconcile cadence: each tick re-asserts the hook (idempotent) and drains the
+// outbound queue. Fast enough that a freshly reloaded front-end is re-hooked
+// within a tick, cheap because the install script short-circuits to 'already'.
 const DRAIN_INTERVAL_MS = 150;
-/** Bounded retry for the front-end hook install (front-end boots asynchronously). */
-// Per-load install poll window. Must outlast the gap between a devtools
-// front-end `dom-ready` and `InspectorFrontendHost` becoming available on a
-// cold/slow open (pool cold-start). 200×50ms = 10s — generous, and each future
-// front-end load re-arms a fresh window anyway (see the `dom-ready` listener).
-const INSTALL_POLL_TRIES = 200;
-const INSTALL_POLL_INTERVAL_MS = 50;
 /**
  * Install Elements forwarding on a DevTools front-end host wc. Returns a disposer
  * (`stop`) that clears timers, unsubscribes render events, detaches ONLY the
@@ -192,8 +206,16 @@ const INSTALL_POLL_INTERVAL_MS = 50;
 export function installElementsForward(deps) {
     const { devtoolsWc, bridge } = deps;
     let disposed = false;
-    let installTimer = null;
-    let drainTimer = null;
+    // A single self-healing loop drives BOTH hook (re)install and outbound drain;
+    // it never self-terminates so a front-end reload (respawn) is re-hooked.
+    let reconcileTimer = null;
+    // Teardown that can only be wired AFTER the subscriptions below exist (render
+    // events, the dom-ready listener, the connection 'closed' sub). `stop()` runs it
+    // so EVERY teardown entry point — internal wc-destroy detection, the connection
+    // 'closed'/'destroyed' handler, and the returned disposer — does the SAME full,
+    // idempotent cleanup. Without this, a wc-destroy that reaches `stop()` directly
+    // would leave the render-event subscription (and dom-ready listener) dangling.
+    let lateCleanup = null;
     // Staleness is keyed on the CURRENT active render guest, resolved fresh from the
     // bridge per check — NOT a generation snapshot. An event/response is honoured
     // only while its originating guest is still the active one, so switching away
@@ -212,13 +234,9 @@ export function installElementsForward(deps) {
     const selfAttached = new Set();
     const stop = () => {
         disposed = true;
-        if (installTimer) {
-            clearInterval(installTimer);
-            installTimer = null;
-        }
-        if (drainTimer) {
-            clearInterval(drainTimer);
-            drainTimer = null;
+        if (reconcileTimer) {
+            clearInterval(reconcileTimer);
+            reconcileTimer = null;
         }
         for (const cleanup of wiredGuests.values()) {
             try {
@@ -228,6 +246,15 @@ export function installElementsForward(deps) {
         }
         wiredGuests.clear();
         detachSelfAttached();
+        // Run the late-wired teardown once (render events, dom-ready, 'closed' sub).
+        if (lateCleanup) {
+            const c = lateCleanup;
+            lateCleanup = null;
+            try {
+                c();
+            }
+            catch { /* already gone */ }
+        }
     };
     /** Detach every session we own; leave safe-area's alone. */
     function detachSelfAttached() {
@@ -538,91 +565,73 @@ export function installElementsForward(deps) {
         pushDocumentUpdated();
     };
     const unsubscribeRenderEvents = bridge.onRenderEvent(onRenderEvent);
-    // ── startup: install hook (retry until embedder exists), then drain ─────────
+    // ── self-healing reconcile loop: (re)install hook + drain, every tick ───────
     const onReady = () => {
         if (disposed)
             return;
-        // Re-arm safe: a devtools front-end (re)load re-runs this, so clear any
-        // in-flight timers from a prior attempt before starting fresh ones — without
-        // this a reload would stack intervals (leak) and double-drain.
-        if (installTimer) {
-            clearInterval(installTimer);
-            installTimer = null;
-        }
-        if (drainTimer) {
-            clearInterval(drainTimer);
-            drainTimer = null;
-        }
-        let tries = 0;
-        installTimer = setInterval(() => {
-            tries++;
+        // Re-arm safe: a devtools front-end (re)load re-runs this, so clear any prior
+        // loop before starting a fresh one — without this a reload would stack
+        // intervals (leak) and double-drain.
+        if (reconcileTimer) {
+            clearInterval(reconcileTimer);
+            reconcileTimer = null;
+        }
+        // ONE loop, never self-terminating: each tick idempotently (re)installs the
+        // hook AND drains the outbound queue in a single round-trip. The earlier
+        // design stopped its install poll on first success and re-armed ONLY via
+        // `dom-ready` — but a service-host pool swap on a hot-reload respawn re-points
+        // the front-end without a reliable `dom-ready`, so the hook (which lives in
+        // the front-end `globalThis` and is wiped on every reload) stayed uninstalled
+        // and Elements fell back to the natively-inspected service host. Re-asserting
+        // the hook every tick makes re-establishment independent of any single event.
+        // The tick we freshly (re)wrap a reloaded front-end (`status === 'installed'`)
+        // we re-prime the active guest and nudge a re-pull so the panel snaps back to
+        // the render guest. We deliberately do NOT force showView('elements') — the
+        // panel stays on the user-preferred Console default; the eager DOM pull (and
+        // any later Elements click) is already routed to render.
+        reconcileTimer = setInterval(() => {
             if (disposed || devtoolsWc.isDestroyed()) {
                 stop();
                 return;
             }
             devtoolsWc
-                .executeJavaScript(buildElementsHookScript())
-                .then((status) => {
+                .executeJavaScript(buildReconcileScript())
+                .then((res) => {
                 if (disposed)
                     return;
-                if (status === 'installed' || status === 'already') {
-                    if (installTimer) {
-                        clearInterval(installTimer);
-                        installTimer = null;
-                    }
-                    // Prime the current guest, then nudge the front-end to (re-)pull DOM
-                    // so the bootstrap document.getDocument is routed at the render guest.
-                    // We deliberately do NOT force showView('elements') — the panel stays
-                    // on the user-preferred Console default; the eager DOM pull (and any
-                    // later Elements click) is already routed to render.
+                const r = (res ?? {});
+                if (r.status === 'installed') {
                     const wc = activeRenderWc();
                     if (wc)
                         primeGuest(wc);
                     pushDocumentUpdated();
                 }
+                handleOutbound(r.batch);
             })
                 .catch(() => { });
-            if (tries > INSTALL_POLL_TRIES && installTimer) {
-                clearInterval(installTimer);
-                installTimer = null;
-            }
-        }, INSTALL_POLL_INTERVAL_MS);
-        // Poll-drain the outbound command queue.
-        drainTimer = setInterval(() => {
-            if (disposed || devtoolsWc.isDestroyed()) {
-                stop();
-                return;
-            }
-            devtoolsWc
-                .executeJavaScript('(globalThis.__diminaElementsOutbound ? __diminaElementsOutbound.splice(0) : [])')
-                .then(handleOutbound)
-                .catch(() => { });
         }, DRAIN_INTERVAL_MS);
     };
-    // Re-install on EVERY devtools front-end load, not once. The hook lives in the
-    // front-end's `globalThis` (`__diminaElementsHookInstalled`), so any front-end
-    // (re)load wipes it — most importantly a service-host pool SWAP, which re-opens
-    // DevTools (`pointNativeDevtoolsAtServiceWc`) and re-bootstraps the front-end.
-    // A single-shot `once('dom-ready')` left the hook uninstalled after such a
-    // reload, so Elements silently fell back to the native service-host DOM. A
-    // PERSISTENT listener re-runs the (idempotent — the sentinel returns 'already')
-    // install on each load; the immediate call covers an already-loaded wc and the
-    // first `openDevTools` whose `dom-ready` may have fired before this ran.
+    // `dom-ready` re-arms the loop promptly on a front-end (re)load; the loop itself
+    // is the durable self-healer (it re-asserts the hook every tick regardless), so
+    // a missed `dom-ready` no longer leaves Elements stuck on the service host.
     devtoolsWc.on('dom-ready', onReady);
     onReady();
     let devtoolsClosedSub;
     try {
         // Devtools front-end wc is never pool-reset → use `'closed'` (fires only on
-        // real destroy). `on('closed')` dispose() removes WITHOUT firing, so the
-        // returned teardown releases it then calls `stop()` directly — no stale
-        // `stop` disposers accumulate across re-install on a surviving devtoolsWc.
+        // real destroy). `on('closed')` dispose() removes WITHOUT firing, so `stop()`
+        // (which now disposes it) can be the sole teardown — no stale disposers
+        // accumulate across re-install on a surviving devtoolsWc.
         if (deps.connections)
             devtoolsClosedSub = deps.connections.acquire(devtoolsWc).on('closed', stop);
         else
             devtoolsWc.once('destroyed', stop);
     }
     catch { /* fake/minimal wc */ }
-    return () => {
+    // Now that every subscription exists, route them through `stop()` so a teardown
+    // from ANY entry point (returned disposer, 'closed'/'destroyed' handler, or the
+    // reconcile tick noticing the wc is gone) does the identical full cleanup.
+    lateCleanup = () => {
         try {
             unsubscribeRenderEvents();
         }
@@ -635,7 +644,7 @@ export function installElementsForward(deps) {
             devtoolsWc.removeListener('dom-ready', onReady);
         }
         catch { /* already gone */ }
-        stop();
     };
+    return stop;
 }
 //# sourceMappingURL=index.js.map

package/dist/main/services/mcp/target-manager.d.ts

@@ -36,9 +36,9 @@ export interface NativeOverview {
 }
 export type NativeOverviewProvider = () => Promise<NativeOverview>;
 interface TargetState {
-    client: any;
+    client: CDP.Client | null;
     connected: boolean;
-    timer: any;
+    timer: ReturnType<typeof setTimeout> | null;
     consoleLogs: ConsoleLogEntry[];
     networkRequests: NetworkRequestEntry[];
 }
@@ -74,5 +74,5 @@ export declare function getTargetState(kind: TargetKind): TargetState;
 declare function listCdpTargets(): Promise<CDP.Target[]>;
 export { listCdpTargets as listTargets };
 export declare function connectTarget(kind: TargetKind): Promise<void>;
-export declare function getClient(kind: TargetKind): any;
+export declare function getClient(kind: TargetKind): CDP.Client;
 //# sourceMappingURL=target-manager.d.ts.map

package/dist/main/services/views/miniapp-partition.d.ts

@@ -8,12 +8,15 @@
  * visible to (and clobbered by) project B; two projects open at once cross-
  * contaminate and "clear storage" on one nukes the other.
  *
- * The fix derives a STABLE per-project partition from the project identity (the
- * miniapp `appId`, which flows in via the simulator URL `?appId=` and the spawn
- * path's `appId`). Same project → same partition (storage survives a relaunch);
- * different projects → different partitions (no cross-contamination). The shape
- * mirrors the IDE state of the art (WeChat's static partition, ByteDance's
- * `persist:miniapp-<id>` dynamic partition).
+ * The fix derives a STABLE per-project partition from the project identity:
+ * the miniapp `appId` (which flows in via the simulator URL `?appId=` and the
+ * spawn path's `appId`) PLUS the project path. appId alone is insufficient —
+ * it comes from the project manifest, so two DIFFERENT project paths can declare
+ * the SAME appId and would otherwise share a partition; folding the path in
+ * isolates them. Same project (same appId + path) → same partition (storage
+ * survives a relaunch); different projects → different partitions (no cross-
+ * contamination). The shape mirrors the IDE state of the art (WeChat's static
+ * partition, ByteDance's `persist:miniapp-<id>` dynamic partition).
  *
  * The protocol handlers (`difile://`, `dmb-resource`) and webRequest policies
  * (referer / CORS) that the simulator runtime needs were installed once on the
@@ -25,6 +28,13 @@
  * Partition CLEANUP (reclaiming on-disk `persist:` data) is intentionally NOT
  * done here — leaving the data on disk is the whole point of a `persist:`
  * partition (cache/storage survives a relaunch). That is a separate concern.
+ *
+ * MIGRATION (intentional one-time reset): folding the project path into the key
+ * means a project that previously ran on the appId-only `persist:miniapp-<appId>`
+ * now runs on `persist:miniapp-<appId>-p<hash>` and starts with empty
+ * cookies/localStorage/cache. Old data is NOT migrated — a best-effort copy
+ * could carry already-cross-contaminated state into the newly isolated space,
+ * which defeats the isolation. The reset is accepted as a one-time cost.
  */
 import type { Session } from 'electron';
 /** The legacy single-session partition. Still used by the pre-warm pool (which
@@ -42,14 +52,14 @@ export declare const SHARED_MINIAPP_PARTITION = "persist:simulator";
  * same key (so storage survives a relaunch); different `appId`s yield different
  * keys.
  */
-export declare function miniappPartitionKey(appId: string): string;
+export declare function miniappPartitionKey(appId: string, projectPath?: string | null): string;
 /**
  * The Electron session partition for a project. Returns the SHARED partition
  * when `appId` is empty/unknown (so the runtime still has a session to load on,
  * matching the legacy behavior) and a `persist:miniapp-<key>` partition
  * otherwise.
  */
-export declare function miniappPartition(appId: string | null | undefined): string;
+export declare function miniappPartition(appId: string | null | undefined, projectPath?: string | null): string;
 type SessionConfigurator = (sess: Session, partition: string) => void;
 /**
  * Register a configurator that runs against every miniapp partition session.

package/dist/main/services/views/miniapp-partition.js

@@ -8,12 +8,15 @@
  * visible to (and clobbered by) project B; two projects open at once cross-
  * contaminate and "clear storage" on one nukes the other.
  *
- * The fix derives a STABLE per-project partition from the project identity (the
- * miniapp `appId`, which flows in via the simulator URL `?appId=` and the spawn
- * path's `appId`). Same project → same partition (storage survives a relaunch);
- * different projects → different partitions (no cross-contamination). The shape
- * mirrors the IDE state of the art (WeChat's static partition, ByteDance's
- * `persist:miniapp-<id>` dynamic partition).
+ * The fix derives a STABLE per-project partition from the project identity:
+ * the miniapp `appId` (which flows in via the simulator URL `?appId=` and the
+ * spawn path's `appId`) PLUS the project path. appId alone is insufficient —
+ * it comes from the project manifest, so two DIFFERENT project paths can declare
+ * the SAME appId and would otherwise share a partition; folding the path in
+ * isolates them. Same project (same appId + path) → same partition (storage
+ * survives a relaunch); different projects → different partitions (no cross-
+ * contamination). The shape mirrors the IDE state of the art (WeChat's static
+ * partition, ByteDance's `persist:miniapp-<id>` dynamic partition).
  *
  * The protocol handlers (`difile://`, `dmb-resource`) and webRequest policies
  * (referer / CORS) that the simulator runtime needs were installed once on the
@@ -25,6 +28,13 @@
  * Partition CLEANUP (reclaiming on-disk `persist:` data) is intentionally NOT
  * done here — leaving the data on disk is the whole point of a `persist:`
  * partition (cache/storage survives a relaunch). That is a separate concern.
+ *
+ * MIGRATION (intentional one-time reset): folding the project path into the key
+ * means a project that previously ran on the appId-only `persist:miniapp-<appId>`
+ * now runs on `persist:miniapp-<appId>-p<hash>` and starts with empty
+ * cookies/localStorage/cache. Old data is NOT migrated — a best-effort copy
+ * could carry already-cross-contaminated state into the newly isolated space,
+ * which defeats the isolation. The reset is accepted as a one-time cost.
  */
 import * as electron from 'electron';
 /** The legacy single-session partition. Still used by the pre-warm pool (which
@@ -43,15 +53,26 @@ const PARTITION_PREFIX = 'persist:miniapp-';
  * same key (so storage survives a relaunch); different `appId`s yield different
  * keys.
  */
-export function miniappPartitionKey(appId) {
+export function miniappPartitionKey(appId, projectPath) {
     const safe = appId.replace(/[^A-Za-z0-9_-]/g, '');
     // Folding may have dropped distinguishing characters; if the input was not
     // already fully safe, append a deterministic hash of the RAW appId so two
     // distinct appIds can never alias onto the same key.
-    if (safe === appId && safe.length > 0)
-        return safe;
-    const hash = djb2(appId).toString(36);
-    return safe.length > 0 ? `${safe}-${hash}` : hash;
+    const base = safe === appId && safe.length > 0
+        ? safe
+        : safe.length > 0
+            ? `${safe}-${djb2(appId).toString(36)}`
+            : djb2(appId).toString(36);
+    // `appId` comes from the project manifest, not the path — two DIFFERENT
+    // project paths can declare the SAME appId. Fold the project path into the key
+    // so those projects get isolated partitions (no storage/cache cross-talk),
+    // while the same path always yields the same suffix (a relaunch reuses its
+    // storage). Path characters aren't partition-safe, so always hash. Omitting
+    // projectPath preserves the legacy appId-only key (pre-warm pool / callers
+    // that have no project identity).
+    if (!projectPath)
+        return base;
+    return `${base}-p${djb2(projectPath).toString(36)}`;
 }
 /**
  * The Electron session partition for a project. Returns the SHARED partition
@@ -59,10 +80,10 @@ export function miniappPartitionKey(appId) {
  * matching the legacy behavior) and a `persist:miniapp-<key>` partition
  * otherwise.
  */
-export function miniappPartition(appId) {
+export function miniappPartition(appId, projectPath) {
     if (!appId)
         return SHARED_MINIAPP_PARTITION;
-    return `${PARTITION_PREFIX}${miniappPartitionKey(appId)}`;
+    return `${PARTITION_PREFIX}${miniappPartitionKey(appId, projectPath)}`;
 }
 /** Small, stable string hash (djb2). Not cryptographic — only needs to be
  * deterministic and collision-resistant enough to disambiguate appIds. */