@dimina-kit/devtools 0.4.0-dev.20260728110120 → 0.4.0-dev.20260731100034

package/dist/main/services/views/miniapp-partition.js

@@ -1,159 +1,2 @@
-/**
- * Per-project session partition for the native-host miniapp runtime (P0 debt).
- *
- * Historically every project's miniapp webContents — the simulator content
- * WebContentsView, its nested render-host `<webview>` guests, AND the
- * service-host window — shared ONE hard-coded `persist:simulator` Electron
- * session. Cookies / localStorage / cache / IndexedDB written by project A were
- * visible to (and clobbered by) project B; two projects open at once cross-
- * contaminate and "clear storage" on one nukes the other.
- *
- * The fix derives a STABLE per-project partition from the project identity:
- * the miniapp `appId` (which flows in via the simulator URL `?appId=` and the
- * spawn path's `appId`) PLUS the project path. appId alone is insufficient —
- * it comes from the project manifest, so two DIFFERENT project paths can declare
- * the SAME appId and would otherwise share a partition; folding the path in
- * isolates them. Same project (same appId + path) → same partition (storage
- * survives a relaunch); different projects → different partitions (no cross-
- * contamination). The shape mirrors the IDE state of the art (WeChat's static
- * partition, ByteDance's `persist:miniapp-<id>` dynamic partition).
- *
- * The protocol handlers (`difile://`, `dmb-resource`) and webRequest policies
- * (referer / CORS) that the simulator runtime needs were installed once on the
- * single `persist:simulator` session. With per-project partitions those have to
- * be (re)applied to EACH project session the first time it is used. The setup
- * sites register a partition-agnostic configurator here; `configureMiniappSession`
- * runs every registered configurator exactly once per partition.
- *
- * Partition CLEANUP (reclaiming on-disk `persist:` data) is intentionally NOT
- * done here — leaving the data on disk is the whole point of a `persist:`
- * partition (cache/storage survives a relaunch). That is a separate concern.
- *
- * MIGRATION (intentional one-time reset): folding the project path into the key
- * means a project that previously ran on the appId-only `persist:miniapp-<appId>`
- * now runs on `persist:miniapp-<appId>-p<hash>` and starts with empty
- * cookies/localStorage/cache. Old data is NOT migrated — a best-effort copy
- * could carry already-cross-contaminated state into the newly isolated space,
- * which defeats the isolation. The reset is accepted as a one-time cost.
- */
-import * as electron from 'electron';
-/** The legacy single-session partition. Still used by the pre-warm pool (which
- * is intentionally NOT isolation-aware — see `serviceHostSpec`) and as the
- * fallback when a project key cannot be derived. */
-export const SHARED_MINIAPP_PARTITION = 'persist:simulator';
-const PARTITION_PREFIX = 'persist:miniapp-';
-/**
- * Derive a stable, filesystem-safe partition key from a project `appId`.
- *
- * `appId` is the project identity (e.g. a `wxapp…` id). We pass through the
- * characters Electron is happy to put in a session partition / on-disk folder
- * name (`[A-Za-z0-9_-]`) verbatim so the common case is human-legible, and fold
- * anything else into a short deterministic hash suffix so two appIds that differ
- * only in stripped characters never collide. The same `appId` always yields the
- * same key (so storage survives a relaunch); different `appId`s yield different
- * keys.
- */
-export function miniappPartitionKey(appId, projectPath) {
-    const safe = appId.replace(/[^A-Za-z0-9_-]/g, '');
-    // Folding may have dropped distinguishing characters; if the input was not
-    // already fully safe, append a deterministic hash of the RAW appId so two
-    // distinct appIds can never alias onto the same key.
-    const base = safe === appId && safe.length > 0
-        ? safe
-        : safe.length > 0
-            ? `${safe}-${djb2(appId).toString(36)}`
-            : djb2(appId).toString(36);
-    // `appId` comes from the project manifest, not the path — two DIFFERENT
-    // project paths can declare the SAME appId. Fold the project path into the key
-    // so those projects get isolated partitions (no storage/cache cross-talk),
-    // while the same path always yields the same suffix (a relaunch reuses its
-    // storage). Path characters aren't partition-safe, so always hash. Omitting
-    // projectPath preserves the legacy appId-only key (pre-warm pool / callers
-    // that have no project identity).
-    if (!projectPath)
-        return base;
-    return `${base}-p${djb2(projectPath).toString(36)}`;
-}
-/**
- * The Electron session partition for a project. Returns the SHARED partition
- * when `appId` is empty/unknown (so the runtime still has a session to load on,
- * matching the legacy behavior) and a `persist:miniapp-<key>` partition
- * otherwise.
- */
-export function miniappPartition(appId, projectPath) {
-    if (!appId)
-        return SHARED_MINIAPP_PARTITION;
-    return `${PARTITION_PREFIX}${miniappPartitionKey(appId, projectPath)}`;
-}
-/** Small, stable string hash (djb2). Not cryptographic — only needs to be
- * deterministic and collision-resistant enough to disambiguate appIds. */
-function djb2(input) {
-    let h = 5381;
-    for (let i = 0; i < input.length; i++) {
-        h = ((h << 5) + h + input.charCodeAt(i)) >>> 0;
-    }
-    return h;
-}
-const configurators = new Set();
-const configuredPartitions = new Set();
-/**
- * Register a configurator that runs against every miniapp partition session.
- * Already-configured partitions are (re)configured immediately so registration
- * order does not matter. Returns a disposer that unregisters the configurator
- * (it does not undo work already applied to live sessions).
- */
-export function registerMiniappSessionConfigurator(fn) {
-    configurators.add(fn);
-    for (const partition of configuredPartitions) {
-        try {
-            fn(electron.session.fromPartition(partition), partition);
-        }
-        catch (err) {
-            console.warn('[miniapp-partition] configurator failed for', partition, err);
-        }
-    }
-    return () => {
-        configurators.delete(fn);
-    };
-}
-/**
- * Ensure a partition's session has every registered configurator applied. Safe
- * to call repeatedly per partition (idempotent — each partition is configured
- * once). Call this before loading project content on `partition`.
- *
- * Returns `null` when there is nothing to configure (no configurator registered)
- * so the partition derivation stays independent of any live Electron session —
- * the partition is a constructor-time fact, not a side effect of touching the
- * session API. Setup sites register configurators at app boot; in unit tests
- * that mock `electron` without a `session` export this short-circuits cleanly.
- */
-export function configureMiniappSession(partition) {
-    // Record that this partition should be configured even if no configurator is
-    // registered YET — a later `registerMiniappSessionConfigurator` back-fills it.
-    const alreadyConfigured = configuredPartitions.has(partition);
-    configuredPartitions.add(partition);
-    if (configurators.size === 0)
-        return null;
-    const sess = electron.session.fromPartition(partition);
-    if (alreadyConfigured)
-        return sess;
-    for (const fn of configurators) {
-        try {
-            fn(sess, partition);
-        }
-        catch (err) {
-            console.warn('[miniapp-partition] configurator failed for', partition, err);
-        }
-    }
-    return sess;
-}
-/**
- * Test-only: drop the configurator + configured-partition bookkeeping so each
- * test starts from a clean slate. (Module-level state otherwise leaks across
- * unit tests that mock `electron`.)
- */
-export function __resetMiniappSessionConfigForTests() {
-    configurators.clear();
-    configuredPartitions.clear();
-}
+export * from '@dimina-kit/electron-runtime/main/miniapp-partition';
 //# sourceMappingURL=miniapp-partition.js.map

package/dist/main/services/views/native-simulator-view.js

@@ -70,6 +70,7 @@ export function createNativeSimulatorView(ctx, reconciler, deps) {
     function tearDownNativeSimulatorView(label) {
         if (!nativeSimulatorView)
             return;
+        ctx.simulatorUiExtensions?.detach(nativeSimulatorView.webContents);
         if (nativeSimulatorViewAdded && !ctx.windows.mainWindow.isDestroyed()) {
             try {
                 ctx.windows.mainWindow.contentView.removeChildView(nativeSimulatorView);
@@ -219,6 +220,8 @@ export function createNativeSimulatorView(ctx, reconciler, deps) {
         // and the renderer placeholder behind it are all the same color.
         view.setBackgroundColor(simDeskBg());
         const simWc = view.webContents;
+        // Keep downstream UI bundles bound to this WCV until shared teardown.
+        ctx.simulatorUiExtensions?.attach(simWc);
         // Keep the WCV surface in sync with the active color scheme. The
         // process-wide installThemeBackgroundSync() re-syncs BrowserWindows on a
         // theme switch, but this top-level WebContentsView is not a window, so its

package/dist/main/services/views/simulator-session-policy.d.ts

@@ -1,28 +1,2 @@
-/**
- * Referer + CORS webRequest policy for the simulator runtime's sessions.
- *
- * The native render/service hosts fetch the compiled `<appId>/…` resources
- * cross-origin and need a WeChat-style page-frame `Referer`; this installs that
- * policy on the shared fallback session AND on every per-project
- * `persist:miniapp-<key>` partition (current + future) via the partition
- * configurator registry, so isolated projects load resources identically.
- *
- * TEARDOWN: a `webRequest` listener is per-session and there is exactly one
- * slot per (session, event) — re-installing replaces, never stacks. But the
- * configurator registration itself leaks if discarded: re-creating the
- * WorkbenchApp in the same process would register a second configurator that
- * keeps firing for every future partition. So this returns a {@link Disposable}
- * that unregisters the configurator AND clears the listeners off every session
- * it touched. Wire it into the context registry like any other module.
- */
-import { type Disposable } from '@dimina-kit/electron-deck/main';
-/**
- * Install the simulator referer/CORS policy on the shared fallback session and
- * register a configurator so every per-project partition session gets it too.
- * Returns a disposable that unregisters the configurator and clears the policy
- * off every session it installed on — call its teardown when the owning
- * context is disposed so re-creating the app never leaks a duplicate
- * configurator/listener.
- */
-export declare function setupSimulatorSessionPolicy(): Disposable;
+export * from '@dimina-kit/electron-runtime/main/session-policy';
 //# sourceMappingURL=simulator-session-policy.d.ts.map

package/dist/main/services/views/simulator-session-policy.js

@@ -1,99 +1,2 @@
-/**
- * Referer + CORS webRequest policy for the simulator runtime's sessions.
- *
- * The native render/service hosts fetch the compiled `<appId>/…` resources
- * cross-origin and need a WeChat-style page-frame `Referer`; this installs that
- * policy on the shared fallback session AND on every per-project
- * `persist:miniapp-<key>` partition (current + future) via the partition
- * configurator registry, so isolated projects load resources identically.
- *
- * TEARDOWN: a `webRequest` listener is per-session and there is exactly one
- * slot per (session, event) — re-installing replaces, never stacks. But the
- * configurator registration itself leaks if discarded: re-creating the
- * WorkbenchApp in the same process would register a second configurator that
- * keeps firing for every future partition. So this returns a {@link Disposable}
- * that unregisters the configurator AND clears the listeners off every session
- * it touched. Wire it into the context registry like any other module.
- */
-import { session } from 'electron';
-import { toDisposable } from '@dimina-kit/electron-deck/main';
-import { getSimulatorServicewechatReferer } from '../simulator/referer.js';
-import { registerMiniappSessionConfigurator, SHARED_MINIAPP_PARTITION, } from './miniapp-partition.js';
-/** The response headers this policy owns outright (compared lowercase). */
-const CORS_OVERRIDE_HEADERS = new Set([
-    'access-control-allow-origin',
-    'access-control-allow-headers',
-    'access-control-allow-methods',
-]);
-/** Apply the simulator runtime's referer + CORS webRequest policy to one
- * session. Each session installs its own listeners (a webRequest listener is
- * per-session), so this runs once per partition. */
-function applySimulatorWebRequestPolicy(simulatorSession) {
-    simulatorSession.webRequest.onBeforeSendHeaders((details, callback) => {
-        const forcedReferer = getSimulatorServicewechatReferer();
-        if (forcedReferer) {
-            details.requestHeaders['Referer'] = forcedReferer;
-        }
-        callback({ requestHeaders: details.requestHeaders });
-    });
-    simulatorSession.webRequest.onHeadersReceived((details, callback) => {
-        const headers = details.responseHeaders ?? {};
-        // CORS for the native render/service hosts to fetch compiled app resources
-        // cross-origin. (The COOP/COEP cross-origin-isolation headers were only for
-        // the removed default-path SharedArrayBuffer sync Worker — dropped.)
-        //
-        // This policy is the single authority for these three headers: any value
-        // the server itself sent must be REPLACED, not shadowed. responseHeaders
-        // keys keep the server's original casing, so assigning the lowercase key
-        // beside an existing `Access-Control-Allow-Origin` puts BOTH on the wire —
-        // Chromium then rejects the response for carrying multiple ACAO values
-        // (`*, *`), breaking every fetch against a CORS-compliant backend.
-        for (const key of Object.keys(headers)) {
-            if (CORS_OVERRIDE_HEADERS.has(key.toLowerCase()))
-                delete headers[key];
-        }
-        headers['access-control-allow-origin'] = ['*'];
-        headers['access-control-allow-headers'] = ['*'];
-        headers['access-control-allow-methods'] = ['*'];
-        callback({ responseHeaders: headers });
-    });
-}
-/** Remove the policy listeners from a session (passing `null` clears the slot). */
-function clearSimulatorWebRequestPolicy(simulatorSession) {
-    try {
-        simulatorSession.webRequest.onBeforeSendHeaders(null);
-        simulatorSession.webRequest.onHeadersReceived(null);
-    }
-    catch {
-        // Session already gone (app shutdown) — nothing to clear.
-    }
-}
-/**
- * Install the simulator referer/CORS policy on the shared fallback session and
- * register a configurator so every per-project partition session gets it too.
- * Returns a disposable that unregisters the configurator and clears the policy
- * off every session it installed on — call its teardown when the owning
- * context is disposed so re-creating the app never leaks a duplicate
- * configurator/listener.
- */
-export function setupSimulatorSessionPolicy() {
-    const configured = new Set();
-    function install(sess) {
-        if (configured.has(sess))
-            return;
-        configured.add(sess);
-        applySimulatorWebRequestPolicy(sess);
-    }
-    // Shared fallback session (pre-warm pool + unknown-appId path).
-    install(session.fromPartition(SHARED_MINIAPP_PARTITION));
-    // Every per-project miniapp partition session (current + future) gets the
-    // same referer/CORS policy so isolated projects load resources identically.
-    const unregister = registerMiniappSessionConfigurator((sess) => install(sess));
-    return toDisposable(() => {
-        unregister();
-        for (const sess of configured)
-            clearSimulatorWebRequestPolicy(sess);
-        configured.clear();
-    });
-}
+export * from '@dimina-kit/electron-runtime/main/session-policy';
 //# sourceMappingURL=simulator-session-policy.js.map

package/dist/main/services/views/view-manager.d.ts

@@ -64,6 +64,11 @@ export interface ViewManagerContext {
      * Optional so partial test contexts compile.
      */
     simulatorApis?: WorkbenchContext['simulatorApis'];
+    /**
+     * Host-registered UI extensions that follow the native simulator WCV.
+     * Optional only for focused view-manager test doubles.
+     */
+    simulatorUiExtensions?: WorkbenchContext['simulatorUiExtensions'];
 }
 /**
  * Unified lifecycle manager for Electron WebContentsView overlays.

package/dist/main/services/workbench-context.d.ts

@@ -1,4 +1,5 @@
 import type { BrowserWindow } from 'electron';
+import { type RuntimeContext, type RuntimeEvents } from '@dimina-kit/electron-runtime/main/runtime-context';
 import type { CompilationAdapter, CustomFileTypes, WorkbenchConfig } from '../../shared/types.js';
 import type { BridgeRouterHandle } from '../ipc/bridge-router.js';
 import type { ConsoleForwarder } from './console-forward/index.js';
@@ -18,6 +19,7 @@ import { type ViewManager } from './views/view-manager.js';
 import { type WindowService } from './window-service.js';
 import { type WorkspaceService } from './workspace/workspace-service.js';
 import { type SimulatorApiRegistry } from './simulator/custom-apis.js';
+import { type SimulatorUiExtensionRegistry } from './simulator/ui-extensions.js';
 import { sanitizeTemplates } from './projects/templates.js';
 import type { ProjectsProvider, ProjectTemplate } from './projects/types.js';
 import type { CustomCreateProjectDialogResult } from '../../shared/types.js';
@@ -25,7 +27,7 @@ import type { CustomCreateProjectDialogResult } from '../../shared/types.js';
  * Shared mutable state for the workbench application.
  * Passed to each IPC module so they can read/write shared state without closures.
  */
-export interface WorkbenchContext {
+export interface WorkbenchContext extends RuntimeContext {
     adapter: CompilationAdapter;
     /** Absolute path to the preload script loaded into the simulator webview */
     preloadPath: string;
@@ -123,8 +125,15 @@ export interface WorkbenchContext {
      * One registry per context — no process-global crosstalk.
      */
     simulatorApis: SimulatorApiRegistry;
+    /**
+     * Per-context downstream simulator UI extensions. It owns renderer bundle
+     * installation and follows the active native simulator WebContentsView.
+     */
+    simulatorUiExtensions: SimulatorUiExtensionRegistry;
     /** Aggregates dispose handlers for every IPC handler, listener, watcher, and CDP session registered by the workbench. */
     registry: DisposableRegistry;
+    /** Runtime-domain events consumed by optional DevTools panels and renderer notifications. */
+    events: RuntimeEvents;
     /**
      * Per-webContents connection registry. Each trusted webContents (main window,
      * overlay views, native simulator/render guests) is one `Connection` that

package/dist/main/services/workbench-context.js

@@ -1,3 +1,4 @@
+import { createRuntimeEvents, } from '@dimina-kit/electron-runtime/main/runtime-context';
 import { createCdpSessionBroker } from './cdp-session/index.js';
 import { createConnectionRegistry, DisposableRegistry, } from '@dimina-kit/electron-deck/main';
 import { createWorkbenchSenderPolicy } from '../utils/sender-policy.js';
@@ -12,11 +13,14 @@ import { openSettingsWindow } from '../windows/settings-window/index.js';
 import { createWorkspaceService, } from './workspace/workspace-service.js';
 import { createLocalProjectsProvider } from './projects/local-provider.js';
 import { createSimulatorApiRegistry, } from './simulator/custom-apis.js';
+import { createSimulatorUiExtensionRegistry, } from './simulator/ui-extensions.js';
 import { resolveTemplates, sanitizeTemplates } from './projects/templates.js';
 import { BUILTIN_TEMPLATES } from './projects/builtin-templates.js';
+import { runtimeAssetPaths } from '../utils/paths.js';
 export function createWorkbenchContext(opts) {
     const ctx = {
         adapter: opts.adapter ?? defaultAdapter,
+        assets: runtimeAssetPaths,
         preloadPath: opts.preloadPath,
         rendererDir: opts.rendererDir,
         apiNamespaces: opts.apiNamespaces ?? [],
@@ -25,6 +29,20 @@ export function createWorkbenchContext(opts) {
         brandingProvider: opts.brandingProvider,
     };
     ctx.registry = new DisposableRegistry();
+    ctx.events = createRuntimeEvents();
+    ctx.registry.add(ctx.events.on('session-status', (payload) => {
+        ctx.notify?.sessionRuntimeStatus(payload);
+    }));
+    ctx.registry.add(ctx.events.on('app-data-evict', ({ appId, bridgeId }) => {
+        ctx.appData?.evictBridge(appId, bridgeId);
+    }));
+    ctx.registry.add(ctx.events.on('app-data-message', ({ appId, message }) => {
+        ctx.appData?.onServiceToRender(appId, message);
+    }));
+    ctx.registry.add(ctx.events.on('storage-changed', ({ appId, change }) => {
+        ctx.onServiceStorageChanged?.(appId, change);
+    }));
+    ctx.registry.add(() => ctx.events.clear());
     // Empty connection registry as a first-class context field. Connections are
     // acquired by real wiring points (app bootstrap, view-manager endpoints),
     // NOT here — the constructor stays side-effect-free so focused unit tests can
@@ -34,6 +52,8 @@ export function createWorkbenchContext(opts) {
     ctx.registry.add(() => ctx.cdpSessionBroker.dispose());
     ctx.trustedWindowSenderIds = new Map();
     ctx.simulatorApis = createSimulatorApiRegistry();
+    ctx.simulatorUiExtensions = createSimulatorUiExtensionRegistry();
+    ctx.registry.add(() => ctx.simulatorUiExtensions.clear());
     ctx.windows = createWindowService(opts.mainWindow);
     ctx.views = createViewManager(ctx);
     // Full view teardown belongs to the CONTEXT's life, not a project's:

package/dist/main/utils/ipc-registry.d.ts

@@ -1,6 +1,6 @@
-import type { IpcMainEvent, WebContents } from 'electron';
+import type { IpcMainEvent } from 'electron';
 import { ipcMain } from 'electron';
-import { type Disposable } from '@dimina-kit/electron-deck/main';
+import { type Disposable, type IpcSenderPolicy } from '@dimina-kit/electron-deck/main';
 type HandleFn = Parameters<typeof ipcMain.handle>[1];
 type ListenerFn = Parameters<typeof ipcMain.on>[1];
 /**
@@ -9,7 +9,25 @@ type ListenerFn = Parameters<typeof ipcMain.on>[1];
  * Returns true when the calling WebContents is allowed to invoke / emit on
  * the channel, false otherwise.
  */
-export type SenderPolicy = (sender: WebContents) => boolean;
+export type SenderPolicy = IpcSenderPolicy;
+/**
+ * Defense-in-depth frame check (sits alongside the sender white-list). A trusted
+ * webContents could embed a sub-frame of arbitrary origin; only its top (main)
+ * frame should reach gated IPC, so a sub-frame can't spoof the trusted sender.
+ *
+ * Verified on Electron 41 that `event.senderFrame` is reliably present on
+ * invoke / send / sendSync — including the editor's `beforeunload` sendSync
+ * write — and equals `sender.mainFrame` for top-frame traffic, so this never
+ * mis-rejects legitimate callers.
+ *
+ * Fail-closed on a null frame for REAL events: a sub-frame can send a message
+ * and immediately navigate/destroy itself, so by delivery time `senderFrame`
+ * resolves to null — allowing that would let the navigate-after-send trick
+ * bypass the boundary. A real Electron event always exposes the `senderFrame`
+ * property and `sender.mainFrame`, so we can tell a real event (frame-modeled,
+ * possibly null) from a frame-unaware unit-test stub (neither present) and only
+ * skip the check for the latter (the sender-id white-list still gates tests).
+ */
 /**
  * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
  * matching removeHandler/removeListener registered into an internal registry.

package/dist/main/utils/ipc-registry.js

@@ -1,4 +1,5 @@
 import { ipcMain } from 'electron';
+import { isMainFrameIpcSender, } from '@dimina-kit/electron-deck/main';
 import { IpcValidationError } from './ipc-schema.js';
 import { createLogger } from './logger.js';
 const log = createLogger('ipc');
@@ -29,23 +30,24 @@ function summarizeSender(sender) {
     const url = sender.getURL();
     return `id=${sender.id} ${url.slice(0, 120)}`;
 }
-function isMainFrameSender(event) {
-    // Read via loose casts: the Electron types declare these always-present, but
-    // unit-test stubs legitimately omit them — and real events can carry a null
-    // senderFrame after navigation/destruction.
-    const frame = event.senderFrame;
-    const main = event.sender.mainFrame;
-    // Frame-unaware stub (NEITHER field modeled) → not a real frame boundary; the
-    // sender-id white-list is the gate. Real events always have both, so they fall
-    // through to the strict check; a partial/malformed event (only one field) also
-    // falls through and fail-closes below rather than escaping here.
-    if (frame === undefined && main === undefined)
-        return true;
-    // Real event, unresolvable frame (navigate-after-send / destroyed) → reject.
-    if (frame == null || main == null)
-        return false;
-    return frame.routingId === main.routingId && frame.processId === main.processId;
-}
+/**
+ * Defense-in-depth frame check (sits alongside the sender white-list). A trusted
+ * webContents could embed a sub-frame of arbitrary origin; only its top (main)
+ * frame should reach gated IPC, so a sub-frame can't spoof the trusted sender.
+ *
+ * Verified on Electron 41 that `event.senderFrame` is reliably present on
+ * invoke / send / sendSync — including the editor's `beforeunload` sendSync
+ * write — and equals `sender.mainFrame` for top-frame traffic, so this never
+ * mis-rejects legitimate callers.
+ *
+ * Fail-closed on a null frame for REAL events: a sub-frame can send a message
+ * and immediately navigate/destroy itself, so by delivery time `senderFrame`
+ * resolves to null — allowing that would let the navigate-after-send trick
+ * bypass the boundary. A real Electron event always exposes the `senderFrame`
+ * property and `sender.mainFrame`, so we can tell a real event (frame-modeled,
+ * possibly null) from a frame-unaware unit-test stub (neither present) and only
+ * skip the check for the latter (the sender-id white-list still gates tests).
+ */
 /**
  * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
  * matching removeHandler/removeListener registered into an internal registry.
@@ -84,7 +86,7 @@ export class IpcRegistry {
         const guarded = policy
             ? async (event, ...args) => {
                 const sender = event.sender;
-                if (!policy(sender) || !isMainFrameSender(event)) {
+                if (!policy(sender) || !isMainFrameIpcSender(event)) {
                     console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`);
                     throw new Error(`IPC sender rejected for channel ${channel}`);
                 }
@@ -106,26 +108,27 @@ export class IpcRegistry {
     handleSync(channel, fn) {
         const policy = this.policy;
         const listener = (event, ...args) => {
+            const syncEvent = event;
             // Everything — including the policy check — runs inside the try so EVERY
             // path sets `event.returnValue`. sendSync blocks the renderer until it is
             // set, so an unset value (e.g. a throwing policy fn) would hang the
             // renderer forever; the catch guarantees a sentinel instead.
             try {
-                if (policy && (!policy(event.sender) || !isMainFrameSender(event))) {
+                if (policy && (!policy(event.sender) || !isMainFrameIpcSender(event))) {
                     console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(event.sender)})`);
-                    event.returnValue = {
+                    syncEvent.returnValue = {
                         ok: false,
                         code: 'EREJECTED',
                         message: `IPC sender rejected for channel ${channel}`,
                     };
                     return;
                 }
-                event.returnValue = fn(event, ...args);
+                syncEvent.returnValue = fn(event, ...args);
             }
             catch (err) {
                 reportListenerError(channel, err);
                 const code = err?.code;
-                event.returnValue = {
+                syncEvent.returnValue = {
                     ok: false,
                     code: typeof code === 'string' ? code : 'EUNKNOWN',
                     message: err instanceof Error ? err.message : String(err),
@@ -156,7 +159,7 @@ export class IpcRegistry {
         const guarded = policy
             ? (event, ...args) => {
                 const sender = event.sender;
-                if (!policy(sender) || !isMainFrameSender(event)) {
+                if (!policy(sender) || !isMainFrameIpcSender(event)) {
                     console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`);
                     return;
                 }

package/dist/main/utils/paths.d.ts

@@ -32,6 +32,20 @@ export declare const mainPreloadPath: string;
  */
 export declare const hostToolbarRuntimePreloadPath: string;
 export declare const simulatorDir: string;
+/**
+ * DevTools builds its own copy of every native mini-app runtime asset. Pin the
+ * shared runtime bridge to that copy so a packaged client never depends on the
+ * standalone npm package's optional asset assembly step.
+ */
+export declare const runtimeAssetPaths: {
+    root: string;
+    simulatorDir: string;
+    simulatorPreloadPath: string;
+    renderHostHtmlPath: string;
+    renderHostPreloadPath: string;
+    serviceHostHtmlPath: string;
+    serviceHostPreloadPath: string;
+};
 export declare function getRendererDir(): string;
 export declare function getPreloadDir(): string;
 export declare function getRendererHtml(filename: string): string;

package/dist/main/utils/paths.js

@@ -60,6 +60,20 @@ export const mainPreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/wind
  */
 export const hostToolbarRuntimePreloadPath = path.join(devtoolsPackageRoot, 'dist/preload/windows/host-toolbar-runtime.cjs');
 export const simulatorDir = path.join(devtoolsPackageRoot, 'dist/simulator');
+/**
+ * DevTools builds its own copy of every native mini-app runtime asset. Pin the
+ * shared runtime bridge to that copy so a packaged client never depends on the
+ * standalone npm package's optional asset assembly step.
+ */
+export const runtimeAssetPaths = {
+    root: path.join(devtoolsPackageRoot, 'dist'),
+    simulatorDir,
+    simulatorPreloadPath: path.join(devtoolsPackageRoot, 'dist/preload/windows/simulator.cjs'),
+    renderHostHtmlPath: path.join(devtoolsPackageRoot, 'dist/render-host/pageFrame.html'),
+    renderHostPreloadPath: path.join(devtoolsPackageRoot, 'dist/render-host/preload.cjs'),
+    serviceHostHtmlPath: path.join(devtoolsPackageRoot, 'dist/service-host/service.html'),
+    serviceHostPreloadPath: path.join(devtoolsPackageRoot, 'dist/service-host/preload.cjs'),
+};
 export function getRendererDir() {
     return rendererDir;
 }