@dimina-kit/devtools 0.4.0-dev.20260828161241 → 0.4.0-dev.20260907055341

package/dist/main/services/workbench-coi-server.js

@@ -1,116 +1,15 @@
-/**
- * Cross-Origin-Isolation static server for the embedded VS Code workbench.
- *
- * The workbench needs `SharedArrayBuffer` for the TS web ext-host's
- * project-wide IntelliSense. Chromium only serves that to a document fetched
- * over http(s) carrying COOP `same-origin` + COEP `require-corp` (a custom
- * `protocol.handle` response does NOT unlock it), so the workbench bundle is
- * served from this in-process http server bound to 127.0.0.1 on a random port.
- * Every response carries the three isolation headers so same-origin
- * sub-resources and workers satisfy COEP `require-corp`.
- *
- * Kept separate from `dimina-resource-server` on purpose: that server sends
- * CORP `cross-origin` for the simulator bundles, which is incompatible with the
- * workbench's `same-origin` isolation requirement.
- *
- * `/__fs/*` bridges a `diminafs:`-style FileSystemProvider in the workbench to
- * the live active project on disk, reusing the renderer `project:fs:*`
- * sandbox's realpath-based guards (`resolveWithinProjectRoot`,
- * `assertWritableAncestor`, and the `O_NOFOLLOW` + post-open re-check inside
- * `readFileBuffer`/`writeFile`) so there is a SINGLE sandbox implementation: a
- * symlink inside the root pointing outside it cannot be followed to read or
- * write past the sandbox. The active project root is read per-request (via the
- * injected getter) so project switches take effect immediately.
- *
- * Mutating actions (write/mkdir/delete/rename) additionally require a non-GET
- * method and a same-origin (or origin-less) request, so an arbitrary localhost
- * page cannot drive a destructive `/__fs` call. GET serves only the read-only
- * stat/readdir/read actions.
- *
- * `/__fs/watch` is a read-only SSE stream of the active project's disk changes
- * (devtools-fs-core-feasibility.md §7), decoupled from the compile session so
- * the editor's memfs↔disk sync engine has a source that stays live regardless
- * of compile state; see {@link handleFsWatchRequest}.
- */
-import http from 'node:http';
-import nodeFs from 'node:fs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { readFileBufferWithin, writeFileWithin, statWithin, readdirWithin, mkdirWithin, deleteWithin, renameWithin, SKIP_DIRS, } from '../ipc/project-fs.js';
 import { handleFsWatchRequest } from './fs-watch-sse.js';
+import { createCoiServerShutdown } from './workbench-coi-shutdown.js';
+import { serveStaticFile } from './workbench-coi-static.js';
+import { registerCoiHostSession } from './workbench-coi-host.js';
+import { FS_TYPE_DIR, FS_TYPE_FILE, toFsBridgeEntry } from './fs-bridge-protocol.js';
 import { jsonRes } from './http-json.js';
 import { miniappPartitionKey } from './views/miniapp-partition.js';
 /** Max `/__fs/write` body; enough to save large source files without OOM. */
 const MAX_FS_WRITE_BYTES = 32 * 1024 * 1024;
-const MIME = {
-    '.html': 'text/html; charset=utf-8',
-    '.js': 'text/javascript; charset=utf-8',
-    '.mjs': 'text/javascript; charset=utf-8',
-    '.css': 'text/css; charset=utf-8',
-    '.json': 'application/json; charset=utf-8',
-    '.map': 'application/json; charset=utf-8',
-    '.wasm': 'application/wasm',
-    '.svg': 'image/svg+xml',
-    '.png': 'image/png',
-    '.ttf': 'font/ttf',
-    '.woff': 'font/woff',
-    '.woff2': 'font/woff2',
-    '.ico': 'image/x-icon',
-};
-function setIsolationHeaders(res) {
-    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
-    res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');
-    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
-}
-/** Resolve a request pathname inside `root`, rejecting lexical traversal escapes. */
-function containedStaticPath(root, pathname) {
-    const rel = pathname.replace(/^\/+/, '') || 'index.html';
-    const resolved = path.resolve(root, rel);
-    if (resolved !== root && !resolved.startsWith(root + path.sep))
-        return null;
-    return resolved;
-}
-/**
- * Serve a static file under `root`: lexical containment, then `fs.realpath`
- * BOTH the root and the resolved file before stat/stream, so a symlink inside
- * `root` pointing outside it cannot be served (the lexical check alone follows
- * symlinks because `stat`/`createReadStream` do). Sends the response itself.
- */
-function serveStaticFile(res, root, pathname) {
-    const candidate = containedStaticPath(root, pathname);
-    if (!candidate) {
-        res.writeHead(403);
-        res.end('Forbidden');
-        return;
-    }
-    Promise.all([fs.realpath(root), fs.realpath(candidate)])
-        .then(([realRoot, realFile]) => {
-        if (realFile !== realRoot && !realFile.startsWith(realRoot + path.sep)) {
-            res.writeHead(403);
-            res.end('Forbidden');
-            return;
-        }
-        nodeFs.stat(realFile, (err, stat) => {
-            if (err || !stat.isFile()) {
-                res.writeHead(404);
-                res.end('Not Found');
-                return;
-            }
-            res.writeHead(200, {
-                'Content-Type': MIME[path.extname(realFile)] ?? 'application/octet-stream',
-                'Content-Length': stat.size,
-                'Cache-Control': 'no-store',
-            });
-            // Stream the realpath'd file (already resolved to its real on-disk
-            // location, so a symlink inside the root cannot redirect it outside).
-            nodeFs.createReadStream(realFile).pipe(res);
-        });
-    })
-        .catch(() => { if (!res.headersSent) {
-        res.writeHead(404);
-        res.end('Not Found');
-    } });
-}
 /** Thrown by {@link readBody} when the accumulated body exceeds the cap. */
 class BodyTooLargeError extends Error {
     constructor() {
@@ -181,6 +80,22 @@ function rejectUnsafeMutation(req) {
     return null;
 }
 /** Map a node fs error to the HTTP status the provider expects. */
+/**
+ * Percent-decode a request path, answering the client on a malformed escape.
+ * A stray `%` is the client's error and belongs here, not at the shared
+ * listener's exception boundary, which cannot tell a bad request from a bug in
+ * this handler. Returns `null` once the 400 has been sent.
+ */
+function decodePath(res, pathname) {
+    try {
+        return decodeURIComponent(pathname);
+    }
+    catch {
+        res.writeHead(400);
+        res.end('Bad Request');
+        return null;
+    }
+}
 function fsErrorStatus(e) {
     const code = e.code;
     if (code === 'ENOACTIVE')
@@ -199,7 +114,13 @@ function fsErrorStatus(e) {
 }
 async function fsStat(ctx) {
     const st = await statWithin(ctx.projectRoot, ctx.rel);
-    jsonRes(ctx.res, 200, { type: st.isDirectory() ? 2 : 1, size: st.size, ctime: st.ctimeMs, mtime: st.mtimeMs });
+    const payload = {
+        type: st.isDirectory() ? FS_TYPE_DIR : FS_TYPE_FILE,
+        size: st.size,
+        ctime: st.ctimeMs,
+        mtime: st.mtimeMs,
+    };
+    jsonRes(ctx.res, 200, payload);
 }
 async function fsReaddir(ctx) {
     const entries = await readdirWithin(ctx.projectRoot, ctx.rel);
@@ -208,14 +129,8 @@ async function fsReaddir(ctx) {
     // this returns, so listing them would pull entire dependency trees into the
     // editor memfs and the OPFS ledger. Same-named FILES stay visible.
     const visible = entries.filter((e) => !(e.isDirectory && SKIP_DIRS.has(e.name)));
-    // Wire shape: `[name, type]` for a directory, `[name, type, size, mtimeMs]`
-    // for a file — the sync engine's watch-batch stat-diffing
-    // (@dimina-kit/fs-core/sync/watch-expander) needs size+mtimeMs to tell a stat-unchanged
-    // survivor from an actually-modified file without re-reading its content.
-    // `size`/`mtimeMs` are simply absent (not `null`) for a stat-less entry
-    // (readdirWithin's readdir/stat race) — the client side then always
-    // treats it as changed.
-    jsonRes(ctx.res, 200, visible.map((e) => (e.isDirectory ? [e.name, 2] : [e.name, 1, e.size, e.mtimeMs])));
+    // Wire shape and why it carries stats: see fs-bridge-protocol.ts.
+    jsonRes(ctx.res, 200, visible.map(toFsBridgeEntry));
 }
 async function fsRead(ctx) {
     const buf = await readFileBufferWithin(ctx.projectRoot, ctx.rel);
@@ -356,15 +271,28 @@ function workspaceIdOf(identity) {
 export async function startWorkbenchCoiServer(options) {
     const root = path.resolve(options.rootDir);
     const contribRoot = options.extensionsDir ? path.resolve(options.extensionsDir) : null;
-    const server = http.createServer((req, res) => {
-        setIsolationHeaders(res);
-        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+    const shutdown = createCoiServerShutdown();
+    const handle = (req, res, url) => {
+        // This window is tearing down. Anything accepted from here on would act on
+        // a project the user has already closed, and a new SSE stream would outlive
+        // the drain that was supposed to end them all.
+        if (shutdown.closing) {
+            res.writeHead(503);
+            res.end('Closing');
+            return;
+        }
         // Special-cased ahead of the generic `/__fs/*` dispatch: unlike every other
         // action, this is a long-lived SSE stream, not a one-shot JSON response.
         if (url.pathname === '/__fs/watch') {
-            handleFsWatchRequest(req, res, options.getProjectRoot);
+            const endStream = handleFsWatchRequest(req, res, options.getProjectRoot);
+            if (endStream)
+                shutdown.trackWatchStream(res, endStream);
             return;
         }
+        // Everything below answers once. Shutdown lets these land rather than
+        // dropping the socket under them — a `/__fs/write` mid-body is the file the
+        // user just saved.
+        shutdown.trackRequest(res);
         if (url.pathname.startsWith('/__fs/')) {
             handleFsRequest(req, res, options.getProjectRoot(), url).catch((e) => {
                 if (!res.headersSent)
@@ -409,25 +337,39 @@ export async function startWorkbenchCoiServer(options) {
                     jsonRes(res, 500, { error: String(e) }); });
                 return;
             }
-            const rel = decodeURIComponent(url.pathname.slice('/__contrib/'.length));
+            const rel = decodePath(res, url.pathname.slice('/__contrib/'.length));
+            if (rel === null)
+                return;
             serveStaticFile(res, contribRoot, rel);
             return;
         }
-        serveStaticFile(res, root, decodeURIComponent(url.pathname));
-    });
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            server.off('error', reject);
-            resolve();
-        });
-    });
-    const addr = server.address();
-    const port = typeof addr === 'object' && addr ? addr.port : 0;
+        const filePath = decodePath(res, url.pathname);
+        if (filePath === null)
+            return;
+        serveStaticFile(res, root, filePath);
+    };
+    // The listener is shared with every other project window so they land on one
+    // origin; this window is reached through its own path prefix. See
+    // workbench-coi-host.ts for why the port cannot be per-window.
+    const registration = await registerCoiHostSession({ rootDir: root, extensionsDir: contribRoot, session: { handle } });
     return {
-        baseUrl: `http://127.0.0.1:${port}/`,
-        port,
-        close: () => new Promise((r) => server.close(() => r())),
+        baseUrl: `${registration.origin}/w/${registration.token}/`,
+        port: registration.port,
+        // Why this is not a bare `server.close()`: see workbench-coi-shutdown.ts.
+        // Drain first so this window's SSE streams end and its in-flight writes
+        // land, THEN drop the route — the listener itself only goes away with the
+        // last window.
+        close: async () => {
+            // `finally`: a drain that throws must still drop this window's route.
+            // Leaving it registered would keep a torn-down window's bridge reachable
+            // on the shared listener for the rest of the process.
+            try {
+                await shutdown.drain();
+            }
+            finally {
+                await registration.release();
+            }
+        },
     };
 }
 //# sourceMappingURL=workbench-coi-server.js.map

package/dist/main/services/workbench-coi-shutdown.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Shutdown bookkeeping for the workbench COI bridge, at two levels.
+ *
+ * A project window's bridge is closed as part of that window's teardown, which
+ * awaits it. Two things pull against each other at that moment. `/__fs/watch`
+ * is an SSE stream that only ever ends when its client disconnects, so waiting
+ * on it waits on the editor being destroyed in the same breath — the window
+ * hangs. Dropping every socket outright instead loses a `/__fs/write` whose
+ * body is still arriving, which is the file the user just saved.
+ *
+ * So neither extreme: {@link CoiServerShutdown.drain} ends the streams this
+ * owner started, lets a request already being served finish, and returns once
+ * it has — or once the grace window expires, so teardown is bounded no matter
+ * what a client does. The shared listener behind every window (see
+ * workbench-coi-host.ts) then uses {@link CoiServerShutdown.close}, which adds
+ * the server close and takes the sockets that outlived it.
+ */
+import type http from 'node:http';
+export interface CoiServerShutdown {
+    /** A live `/__fs/watch` stream, with the call that ends it server-side. */
+    trackWatchStream: (res: http.ServerResponse, endStream: () => void) => void;
+    /** A one-shot request whose response must be allowed to land. */
+    trackRequest: (res: http.ServerResponse) => void;
+    /**
+     * True once {@link drain} has started. The owner refuses new requests from
+     * here on: this bridge is bound to a window that is going away, and a
+     * request accepted now would act on a project the user has closed.
+     */
+    readonly closing: boolean;
+    /**
+     * End the tracked streams and wait for the tracked one-shot responses to
+     * land, bounded by the grace window. Leaves the listener alone — one window
+     * going away must not take the shared server with it.
+     */
+    drain: () => Promise<void>;
+    /** {@link drain}, plus closing the server and taking any surviving sockets. */
+    close: (server: http.Server) => Promise<void>;
+}
+export declare function createCoiServerShutdown(graceMs?: number): CoiServerShutdown;
+//# sourceMappingURL=workbench-coi-shutdown.d.ts.map

package/dist/main/services/workbench-coi-shutdown.js

@@ -0,0 +1,69 @@
+/** How long a request already in flight may hold up the window's teardown. */
+const DEFAULT_GRACE_MS = 2_000;
+export function createCoiServerShutdown(graceMs = DEFAULT_GRACE_MS) {
+    const watchStreams = new Set();
+    const inFlight = new Set();
+    let onDrained = null;
+    let closing = false;
+    const drain = () => new Promise((resolve) => {
+        closing = true;
+        for (const endStream of watchStreams)
+            endStream();
+        watchStreams.clear();
+        // Nothing is being served: the sockets that remain are a client's to
+        // keep alive, and waiting on them is waiting on nobody.
+        if (inFlight.size === 0) {
+            resolve();
+            return;
+        }
+        let deadline = null;
+        const finish = () => {
+            onDrained = null;
+            if (deadline)
+                clearTimeout(deadline);
+            resolve();
+        };
+        const expire = () => {
+            // The grace window is up and something is still mid-request — a client
+            // that stalled halfway through a body, most likely. Destroying it here
+            // is the point: the handler still holds the closing window's project,
+            // so a body that lands minutes from now would write into a project the
+            // user has closed, and the socket would outlive the window on the
+            // shared listener.
+            for (const res of [...inFlight])
+                res.destroy();
+            inFlight.clear();
+            finish();
+        };
+        deadline = setTimeout(expire, graceMs);
+        onDrained = finish;
+    });
+    return {
+        get closing() {
+            return closing;
+        },
+        trackWatchStream(res, endStream) {
+            watchStreams.add(endStream);
+            res.on('close', () => watchStreams.delete(endStream));
+        },
+        trackRequest(res) {
+            inFlight.add(res);
+            res.on('close', () => {
+                inFlight.delete(res);
+                if (inFlight.size === 0)
+                    onDrained?.();
+            });
+        },
+        drain,
+        async close(server) {
+            // Stop accepting first, so nothing new arrives during the drain; the
+            // callback only fires once every connection is gone, which is why the
+            // sockets are taken below rather than waited on.
+            const closed = new Promise((resolve) => server.close(() => resolve()));
+            await drain();
+            server.closeAllConnections();
+            await closed;
+        },
+    };
+}
+//# sourceMappingURL=workbench-coi-shutdown.js.map

package/dist/main/services/workbench-coi-static.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Static-file serving and the cross-origin-isolation headers shared by the
+ * workbench COI host and every window's bridge.
+ *
+ * Split out of `workbench-coi-server.ts` so the host module can serve the
+ * bundle without importing the per-window bridge (which imports the host).
+ */
+import http from 'node:http';
+/**
+ * The workbench needs `SharedArrayBuffer` for the TS web ext-host's
+ * project-wide IntelliSense, and Chromium only serves that to a
+ * cross-origin-isolated document. Every response carries the three headers so
+ * same-origin sub-resources and workers satisfy COEP `require-corp`.
+ */
+export declare function setIsolationHeaders(res: http.ServerResponse): void;
+/**
+ * Serve a static file under `root`: lexical containment, then `fs.realpath`
+ * BOTH the root and the resolved file before stat/stream, so a symlink inside
+ * `root` pointing outside it cannot be served (the lexical check alone follows
+ * symlinks because `stat`/`createReadStream` do). Sends the response itself.
+ */
+export declare function serveStaticFile(res: http.ServerResponse, root: string, pathname: string): void;
+//# sourceMappingURL=workbench-coi-static.d.ts.map

package/dist/main/services/workbench-coi-static.js

@@ -0,0 +1,87 @@
+import nodeFs from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const MIME = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.wasm': 'application/wasm',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ttf': 'font/ttf',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ico': 'image/x-icon',
+};
+/**
+ * The workbench needs `SharedArrayBuffer` for the TS web ext-host's
+ * project-wide IntelliSense, and Chromium only serves that to a
+ * cross-origin-isolated document. Every response carries the three headers so
+ * same-origin sub-resources and workers satisfy COEP `require-corp`.
+ */
+export function setIsolationHeaders(res) {
+    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');
+    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+}
+/** Resolve a request pathname inside `root`, rejecting lexical traversal escapes. */
+function containedStaticPath(root, pathname) {
+    const rel = pathname.replace(/^\/+/, '') || 'index.html';
+    const resolved = path.resolve(root, rel);
+    if (resolved !== root && !resolved.startsWith(root + path.sep))
+        return null;
+    return resolved;
+}
+/**
+ * Serve a static file under `root`: lexical containment, then `fs.realpath`
+ * BOTH the root and the resolved file before stat/stream, so a symlink inside
+ * `root` pointing outside it cannot be served (the lexical check alone follows
+ * symlinks because `stat`/`createReadStream` do). Sends the response itself.
+ */
+export function serveStaticFile(res, root, pathname) {
+    const candidate = containedStaticPath(root, pathname);
+    if (!candidate) {
+        res.writeHead(403);
+        res.end('Forbidden');
+        return;
+    }
+    Promise.all([fs.realpath(root), fs.realpath(candidate)])
+        .then(([realRoot, realFile]) => {
+        if (realFile !== realRoot && !realFile.startsWith(realRoot + path.sep)) {
+            res.writeHead(403);
+            res.end('Forbidden');
+            return;
+        }
+        nodeFs.stat(realFile, (err, stat) => {
+            if (err || !stat.isFile()) {
+                res.writeHead(404);
+                res.end('Not Found');
+                return;
+            }
+            res.writeHead(200, {
+                'Content-Type': MIME[path.extname(realFile)] ?? 'application/octet-stream',
+                'Content-Length': stat.size,
+                'Cache-Control': 'no-store',
+            });
+            // Stream the realpath'd file (already resolved to its real on-disk
+            // location, so a symlink inside the root cannot redirect it outside).
+            const stream = nodeFs.createReadStream(realFile);
+            // The file can vanish or lose permissions between the stat and the
+            // open. The stream reports that asynchronously, once the 200 and the
+            // Content-Length are already on the wire, so no status can be changed
+            // — and an unhandled 'error' on a stream is an uncaught exception in
+            // the main process. Take the socket instead, which is what a client
+            // sees for a truncated body anyway.
+            stream.on('error', () => { res.destroy(); });
+            stream.pipe(res);
+        });
+    })
+        .catch(() => { if (!res.headersSent) {
+        res.writeHead(404);
+        res.end('Not Found');
+    } });
+}
+//# sourceMappingURL=workbench-coi-static.js.map

package/dist/main/services/workbench-context.d.ts

@@ -12,6 +12,7 @@ import type { StorageApi } from './simulator-storage/index.js';
 import type { SyncStorageChange } from '../../shared/ipc-channels.js';
 import { DisposableRegistry, type ConnectionRegistry } from '@dimina-kit/electron-deck/main';
 import type { SenderPolicy } from '../utils/ipc-registry.js';
+import type { AppServices } from './app-services.js';
 import { type RendererNotifier } from './notifications/renderer-notifier.js';
 import { type CompileLogBuffer } from './workspace/compile-log-buffer.js';
 import { type SessionStatusStore } from './workspace/session-status-store.js';
@@ -120,6 +121,14 @@ export interface WorkbenchContext extends RuntimeContext {
      * lazily so it stays correct as windows/views come and go.
      */
     senderPolicy: SenderPolicy;
+    /**
+     * The subset of `senderPolicy` this context structurally OWNS — its own
+     * window's renderer, its settings window and the overlay views mounted
+     * inside it. Excludes the app-wide trusted-window map, which no single
+     * context can claim. `createWindowContextRouter` uses it to decide which
+     * window a message actually came from.
+     */
+    ownsSender: SenderPolicy;
     /**
      * Reference-counted map of `webContents.id` → live registration count for
      * host-owned BrowserWindows registered as trusted senders via
@@ -128,12 +137,20 @@ export interface WorkbenchContext extends RuntimeContext {
      * single `closed` event, which zeroes the count outright) to un-trust it.
      * Consulted by `createWorkbenchSenderPolicy` in addition to the static
      * main-window / overlay checks.
+     *
+     * Supplied by {@link AppServices} when the caller has one: the host
+     * registers its window against the application, so the same map backs every
+     * context.
      */
     trustedWindowSenderIds: Map<number, number>;
     /**
-     * Per-context registry of host-registered simulator custom APIs. Populated
-     * via `instance.registerSimulatorApi`; read by the simulator IPC handlers.
-     * One registry per context — no process-global crosstalk.
+     * Registry of host-registered simulator custom APIs. Populated via
+     * `instance.registerSimulatorApi`; read by the simulator IPC handlers.
+     *
+     * Supplied by {@link AppServices} when the caller has one, and therefore
+     * shared across contexts: the host registers each handler once, so a window
+     * opened afterwards must still answer those `wx.*` calls. A context built
+     * without app services (focused unit tests) gets its own registry.
      */
     simulatorApis: SimulatorApiRegistry;
     /**
@@ -258,6 +275,13 @@ export interface CreateContextOptions extends Pick<WorkbenchConfig, 'adapter' |
     mainWindow: BrowserWindow;
     preloadPath: string;
     rendererDir: string;
+    /**
+     * Services owned by the application rather than by this window. When
+     * present their instances are adopted instead of constructing per-context
+     * ones, so every window shares the host's single registration. Optional so
+     * focused unit tests can still build a stand-alone context.
+     */
+    appServices?: AppServices;
     brandingProvider?: WorkbenchContext['brandingProvider'];
     /** Host-supplied project list backend. Defaults to LocalProjectsProvider. */
     projectsProvider?: ProjectsProvider;

package/dist/main/services/workbench-context.js

@@ -1,7 +1,7 @@
 import { createRuntimeEvents, } from '@dimina-kit/electron-runtime/main/runtime-context';
 import { createCdpSessionBroker } from './cdp-session/index.js';
 import { createConnectionRegistry, DisposableRegistry, } from '@dimina-kit/electron-deck/main';
-import { createWorkbenchSenderPolicy } from '../utils/sender-policy.js';
+import { createWorkbenchOwnedSenderCheck, createWorkbenchSenderPolicy, } from '../utils/sender-policy.js';
 import { defaultAdapter } from './default-adapter.js';
 import { createRendererNotifier, } from './notifications/renderer-notifier.js';
 import { createCompileLogBuffer, } from './workspace/compile-log-buffer.js';
@@ -50,8 +50,9 @@ export function createWorkbenchContext(opts) {
     ctx.connections = createConnectionRegistry();
     ctx.cdpSessionBroker = createCdpSessionBroker({ connections: ctx.connections });
     ctx.registry.add(() => ctx.cdpSessionBroker.dispose());
-    ctx.trustedWindowSenderIds = new Map();
-    ctx.simulatorApis = createSimulatorApiRegistry();
+    ctx.trustedWindowSenderIds =
+        opts.appServices?.trustedWindowSenderIds ?? new Map();
+    ctx.simulatorApis = opts.appServices?.simulatorApis ?? createSimulatorApiRegistry();
     ctx.simulatorUiExtensions = createSimulatorUiExtensionRegistry();
     ctx.registry.add(() => ctx.simulatorUiExtensions.clear());
     ctx.windows = createWindowService(opts.mainWindow);
@@ -71,12 +72,16 @@ export function createWorkbenchContext(opts) {
     // at call time through the live context, which structurally satisfies the
     // helper's narrow OpenSettingsWindowDeps.
     ctx.openSettings = () => openSettingsWindow(ctx);
-    ctx.projectsProvider = opts.projectsProvider ?? createLocalProjectsProvider();
-    ctx.projectTemplates = resolveTemplates(BUILTIN_TEMPLATES, opts.projectTemplates ?? [], opts.builtinTemplates ?? 'all');
+    ctx.projectsProvider =
+        opts.appServices?.projectsProvider ?? opts.projectsProvider ?? createLocalProjectsProvider();
+    ctx.projectTemplates =
+        opts.appServices?.projectTemplates ??
+            resolveTemplates(BUILTIN_TEMPLATES, opts.projectTemplates ?? [], opts.builtinTemplates ?? 'all');
     ctx.customCreateProjectDialog = opts.customCreateProjectDialog;
     ctx.customEditProjectDialog = opts.customEditProjectDialog;
     ctx.onBeforeOpenProject = opts.onBeforeOpenProject;
     ctx.workspace = createWorkspaceService(ctx);
+    ctx.ownsSender = createWorkbenchOwnedSenderCheck(ctx);
     ctx.senderPolicy = createWorkbenchSenderPolicy(ctx);
     return ctx;
 }

package/dist/main/services/workspace/compile-mode-adapter.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Adapts the compile-mode half of `ProjectsProvider` — where every method is
+ * optional — onto the four methods `WorkspaceService` always exposes.
+ *
+ * A host may implement the mode list, only the older single-config pair, or
+ * neither. Each direction degrades on its own so a partial host still gets the
+ * behavior it can support instead of an exception.
+ */
+import type { CompileConfig, CompileModes } from '../../../shared/types.js';
+import type { ProjectsProvider } from '../projects/types.js';
+export interface CompileModeAdapter {
+    getCompileConfig(projectPath: string): Promise<CompileConfig>;
+    saveCompileConfig(projectPath: string, config: CompileConfig): Promise<void>;
+    getCompileModes(projectPath: string): Promise<CompileModes>;
+    saveCompileModes(projectPath: string, modes: CompileModes): Promise<void>;
+}
+export declare function createCompileModeAdapter(provider: ProjectsProvider): CompileModeAdapter;
+//# sourceMappingURL=compile-mode-adapter.d.ts.map

package/dist/main/services/workspace/compile-mode-adapter.js

@@ -0,0 +1,57 @@
+/**
+ * Adapts the compile-mode half of `ProjectsProvider` — where every method is
+ * optional — onto the four methods `WorkspaceService` always exposes.
+ *
+ * A host may implement the mode list, only the older single-config pair, or
+ * neither. Each direction degrades on its own so a partial host still gets the
+ * behavior it can support instead of an exception.
+ */
+import { compileConfigToModes, emptyCompileModes, resolveCompileConfig, } from '../../../shared/compile-modes.js';
+import { DEFAULT_COMPILE_CONFIG } from '../projects/types.js';
+export function createCompileModeAdapter(provider) {
+    return {
+        // Prefer the host's own resolver: only it can substitute the project's
+        // entry page for 普通编译's empty start page. Deriving from the mode list
+        // is the fallback for hosts that implement modes but not this.
+        async getCompileConfig(projectPath) {
+            if (provider.getCompileConfig) {
+                return (await provider.getCompileConfig(projectPath));
+            }
+            if (provider.getCompileModes) {
+                return resolveCompileConfig(await provider.getCompileModes(projectPath));
+            }
+            return DEFAULT_COMPILE_CONFIG;
+        },
+        async saveCompileConfig(projectPath, config) {
+            if (provider.saveCompileConfig) {
+                await provider.saveCompileConfig(projectPath, config);
+            }
+            // No persistence when the host opts out; the renderer's edits then
+            // do not survive a reload, matching the documented contract.
+        },
+        // Mirror of saveCompileModes' degradation: a host still on the single
+        // config gets it projected into one selected mode, so its start page and
+        // params actually launch instead of being read as 普通编译 and dropped.
+        async getCompileModes(projectPath) {
+            if (provider.getCompileModes) {
+                return await provider.getCompileModes(projectPath);
+            }
+            if (provider.getCompileConfig) {
+                return compileConfigToModes((await provider.getCompileConfig(projectPath)));
+            }
+            return emptyCompileModes();
+        },
+        async saveCompileModes(projectPath, modes) {
+            if (provider.saveCompileModes) {
+                await provider.saveCompileModes(projectPath, modes);
+                return;
+            }
+            // Degrade for a host still on the single-config setter: the selection
+            // still takes effect, it just cannot store the named list.
+            if (provider.saveCompileConfig) {
+                await provider.saveCompileConfig(projectPath, resolveCompileConfig(modes));
+            }
+        },
+    };
+}
+//# sourceMappingURL=compile-mode-adapter.js.map