@dimina-kit/devtools 0.4.0 → 0.5.0-dev.20260908120530

package/dist/main/app/app.js

@@ -1,309 +1,97 @@
 import { setupCdpPort, registerDifileScheme, suppressInsecureCspWarnings } from './bootstrap.js';
 import { installMaxListenersWarningDiagnostic } from './max-listeners-diagnostic.js';
+import { app, session } from 'electron';
+import { rendererDir as defaultRendererDir } from '../utils/paths.js';
+import { createAppServices, registerTrustedWindow } from '../services/app-services.js';
+import { createWindowContextRouter } from '../services/window-contexts/context-router.js';
+import { createInternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js';
+import { registerAppIpc, registerInternalDevtoolsIpc, registerTooltipIpc, registerProjectCreateIpc, registerDevicePickerIpc, registerViewsIpc, } from '../ipc/index.js';
 import { registerProjectFsIpc } from '../ipc/project-fs.js';
-import { app, BrowserWindow, nativeImage, session } from 'electron';
-import fs from 'fs';
-import path from 'path';
-import { rendererDir as defaultRendererDir, defaultPreloadPath, devtoolsPackageRoot } from '../utils/paths.js';
+import { setupSimulatorSessionPolicy } from '../services/views/simulator-session-policy.js';
+import { setupCompileWorkerStandby } from '../services/compile-standby.js';
 import { installThemeBackgroundSync } from '../utils/theme.js';
-import { createMainWindow, wireMainWindowEvents } from '../windows/main-window/index.js';
 import { isAppQuitting } from './lifecycle.js';
-import { resolveNativeAppDataKeys, resolveNativeStorageOverview } from './native-overview.js';
-// eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
-import { createWorkbenchContext } from '../services/workbench-context.js';
-import { setupCompileWorkerStandby } from '../services/compile-standby.js';
 import { loadWorkbenchSettings, applyTheme } from '../services/settings/index.js';
-import { installAppMenu } from '../menu/index.js';
-import { registerAppIpc, popoverModule, projectsModule, sessionModule, settingsModule, simulatorModule, } from '../ipc/index.js';
-import { startAutomationServer } from '../services/automation/index.js';
-import { startMcpServer, setNativeHost, setActiveBridgeId, setNativeOverviewProvider, } from '../services/mcp/index.js';
-import { setupSimulatorStorage } from '../services/simulator-storage/index.js';
-import { createNetworkForwarder } from '../services/network-forward/index.js';
-import { setupSimulatorWxml } from '../services/simulator-wxml/index.js';
-import { setupSimulatorAppData } from '../services/simulator-appdata/index.js';
-import { setupSimulatorCurrentPage } from '../services/simulator-current-page/index.js';
-import { createRenderInspector } from '../services/render-inspect/index.js';
-import { setupSimulatorTempFiles } from '../services/simulator-temp-files/index.js';
 import { SHARED_MINIAPP_PARTITION } from '../services/views/miniapp-partition.js';
-import { setupSimulatorSessionPolicy } from '../services/views/simulator-session-policy.js';
-import { startWorkbenchCoiServer } from '../services/workbench-coi-server.js';
+import { setupSimulatorTempFiles } from '../services/simulator-temp-files/index.js';
 import { UpdateManager } from '../services/update/index.js';
-import { toDisposable } from '@dimina-kit/electron-deck/main';
+import { toDisposable, DisposableRegistry } from '@dimina-kit/electron-deck/main';
 import { IpcRegistry } from '../utils/ipc-registry.js';
-const DEFAULT_MODULES = {
-    projects: true,
-    session: true,
-    simulator: true,
-    popover: true,
-    settings: true,
-};
-const BUILTIN_MODULES = {
-    projects: projectsModule,
-    session: sessionModule,
-    simulator: simulatorModule,
-    popover: popoverModule,
-    settings: settingsModule,
-};
-/**
- * Adds `win.webContents` to the context's trusted-sender set and returns a
- * Disposable that removes it again.
- *
- * Trust is reference-counted: registering the SAME window N times keeps it
- * trusted until every one of the N returned Disposables has been disposed.
- * `trustedWindowSenderIds` is a `Map<webContents.id, refCount>`; each register
- * bumps the count, each dispose decrements it, and the window is un-trusted
- * only when the count reaches zero.
- *
- * The window's `closed` event short-circuits the ref-count: it deletes the
- * map entry outright (the window is dead, so it must be un-trusted
- * immediately regardless of how many Disposables are still outstanding).
- * After `closed`, disposing any leftover Disposable is a safe no-op — the
- * map entry is already gone, so the decrement finds `undefined` and bails
- * without driving the count negative or resurrecting trust.
- *
- * Each returned Disposable is itself idempotent (`removed` flag), and its
- * `closed` listener removes itself once fired so a long-lived context
- * doesn't accumulate dead listeners on closed windows.
- */
-function registerTrustedWindow(context, win) {
-    const senderId = win.webContents.id;
-    const counts = context.trustedWindowSenderIds;
-    counts.set(senderId, (counts.get(senderId) ?? 0) + 1);
-    let removed = false;
-    const onClosed = () => {
-        // The window is gone: zero the ref-count for this sender id outright,
-        // regardless of any other outstanding registrations for the same window.
-        counts.delete(senderId);
-        win.removeListener('closed', onClosed);
-    };
-    function remove() {
-        if (removed)
-            return;
-        removed = true;
-        win.removeListener('closed', onClosed);
-        const count = counts.get(senderId);
-        // `undefined` → the entry was already cleared (e.g. by `closed` or by a
-        // prior sibling's decrement that hit zero). Nothing to do — never go
-        // negative, never resurrect trust.
-        if (count === undefined)
-            return;
-        if (count <= 1)
-            counts.delete(senderId);
-        else
-            counts.set(senderId, count - 1);
-    }
-    win.once('closed', onClosed);
-    return toDisposable(remove);
-}
-/** Parse --auto, --auto-port, --project from process.argv. */
-function parseAutoArgs() {
-    const argv = process.argv;
-    let auto = false;
-    let autoPort = 9420;
-    let projectPath = '';
-    for (let i = 0; i < argv.length; i++) {
-        if (argv[i] === 'auto' || argv[i] === '--auto')
-            auto = true;
-        if ((argv[i] === '--auto-port' || argv[i] === '--auto_port') && argv[i + 1]) {
-            const parsed = parseInt(argv[i + 1], 10);
-            // 0 → OS-assigned free port (used by parallel e2e workers)
-            if (Number.isFinite(parsed) && parsed >= 0)
-                autoPort = parsed;
-        }
-        if (argv[i] === '--project' && argv[i + 1]) {
-            projectPath = argv[i + 1];
-        }
-    }
-    return { auto, autoPort, projectPath };
-}
-function resolveModules(config) {
-    return {
-        ...DEFAULT_MODULES,
-        ...config.modules,
-    };
-}
-async function disposeContext(ctx) {
-    await ctx.workspace.closeProject();
-    await ctx.registry.dispose().catch((err) => {
-        console.warn('[workbench] dispose registry encountered errors:', err);
-    });
-}
-function createConfiguredMainWindow(config, rendererDir) {
-    const mainWindow = createMainWindow({
-        title: config.appName ?? 'Dimina DevTools',
-        indexHtml: path.join(rendererDir, 'entries/main/index.html'),
-        width: config.window?.width,
-        height: config.window?.height,
-        minWidth: config.window?.minWidth,
-        minHeight: config.window?.minHeight,
-        autoShow: config.window?.autoShow,
-    });
-    // Set window/taskbar icon if provided (Linux/Windows; macOS uses app bundle icon)
-    if (config.icon) {
-        const icon = nativeImage.createFromPath(config.icon);
-        if (!icon.isEmpty())
-            mainWindow.setIcon(icon);
-    }
-    return mainWindow;
-}
-function createContext(config, mainWindow, rendererDir) {
-    return createWorkbenchContext({
-        mainWindow,
-        adapter: config.adapter,
-        preloadPath: config.preloadPath ?? defaultPreloadPath,
-        rendererDir,
-        appName: config.appName,
-        apiNamespaces: config.apiNamespaces,
-        fileTypes: config.fileTypes,
-        brandingProvider: config.brandingProvider,
-        // The host-supplied ProjectsProvider / template types in `shared/types`
-        // are structurally compatible with the main-process equivalents —
-        // these casts are safe; we re-narrow at the workspace-service /
-        // create-project-service boundary.
-        projectsProvider: config.projectsProvider,
-        projectTemplates: config.projectTemplates,
-        builtinTemplates: config.builtinTemplates,
-        customCreateProjectDialog: config.customCreateProjectDialog,
-        onBeforeOpenProject: config.onBeforeOpenProject,
-    });
-}
-function registerBuiltinModules(config, context) {
-    const modules = resolveModules(config);
-    Object.keys(modules).forEach((moduleId) => {
-        if (modules[moduleId])
-            context.registry.add(BUILTIN_MODULES[moduleId].setup(context));
-    });
-}
+import { createLauncherWindow } from './project-window.js';
+import { createProjectListSurface } from './project-list-surface.js';
+import { createWorkbenchWindowManager } from './workbench-window.js';
+import { registerModuleIpc, setupWindowModules } from './workbench-modules.js';
+import { registerOpenProjectWindowIpc } from './open-project-ipc.js';
+import { createUiExtensionTargets } from './ui-extension-targets.js';
+import { installGlobalMirrors } from './global-mirrors.js';
+import { installHostSidebarDefault } from './host-sidebar-default.js';
+import { installMenu } from './menu-setup.js';
+import { createOpenForMcp, createTargetForMcp, noteActiveMcpWindowChanged, setActiveMcpWindowResolver, } from '../services/mcp/index.js';
+import { setupAutomation, setupMcp } from './servers.js';
+import { enableDevRendererAutoReload } from './window-events.js';
+import { wireMainWindowEvents } from '../windows/main-window/index.js';
+export { setupWindowModules } from './workbench-modules.js';
 /**
- * Build the hand-written narrow `MenuContext` a host menu builder receives —
- * explicit construction (not clone+delete), so the runtime object carries
- * EXACTLY the contract members and nothing else. Every member is a lazy
- * closure over the live context: a host monkey-patch of
- * `context.workspace.openProject` (the documented permission-gate pattern)
- * still intercepts calls made through this menu surface.
+ * Registers the workbench's IPC surface against the router, so each message is
+ * answered with the context of the window it came from.
  */
-function toMenuContext(context) {
-    return {
-        appName: context.appName,
-        workspace: {
-            hasActiveSession: () => context.workspace.hasActiveSession(),
-            getProjectPath: () => context.workspace.getProjectPath(),
-            openProject: (projectPath) => context.workspace.openProject(projectPath),
-            closeProject: () => context.workspace.closeProject(),
-            getSession: () => context.workspace.getSession(),
-        },
-        openSettings: () => context.openSettings(),
-        notify: {
-            projectStatus: (payload) => context.notify.projectStatus(payload),
-            windowNavigateBack: () => context.notify.windowNavigateBack(),
-        },
-    };
-}
-function installMenu(config, mainWindow, context) {
-    // Menu: use host-provided builder or fall back to default
-    if (config.menuBuilder) {
-        config.menuBuilder(mainWindow, toMenuContext(context));
-    }
-    else {
-        installAppMenu(context);
-    }
-}
-async function setupAutomation(instance) {
-    // Start automation server if --auto flag is present
-    const autoArgs = parseAutoArgs();
-    if (autoArgs.auto) {
-        const server = await startAutomationServer(instance.context, autoArgs.autoPort);
-        instance.automationServer = server;
-        instance.context.registry.add(() => server.close());
-        // Stable, parseable line for e2e harnesses that scrape stdout.
-        console.log(`[automation] listening on ws://127.0.0.1:${server.port}`);
-    }
-}
-function setupMcp() {
-    const settings = loadWorkbenchSettings();
-    if (!settings.mcp.enabled)
-        return null;
-    const cdpPortSwitch = app.commandLine.getSwitchValue('remote-debugging-port');
-    const cdpPort = cdpPortSwitch ? parseInt(cdpPortSwitch, 10) : settings.cdp.port;
-    return startMcpServer(cdpPort, settings.mcp.port);
-}
-function wireAppWindowEvents(config, instance) {
-    const { mainWindow, context } = instance;
-    // In-flight guard: `closeProject()` is async, and the window stays open
-    // (preventDefault'd) while it runs — a second close click during that window
-    // would re-enter and tear the same session down twice. Swallow re-entrancy.
-    let closing = false;
-    return wireMainWindowEvents(mainWindow, {
-        context,
-        onResize: () => context.views.repositionAll(),
-        onClose: async (e) => {
-            // A real application quit (⌘Q / menu "Quit" / app.quit()) fires
-            // `before-quit` first, then this window's `close`. Let it through so the
-            // app actually exits — do NOT convert it into "close the project".
-            // Without this, `hasActiveSession()` would be true and the quit gets
-            // swallowed into closeProject(), so the app can never be quit while a
-            // project is open.
-            if (isAppQuitting())
-                return;
-            // A close arriving while a project teardown is already in flight (the
-            // user rapid-double-clicked the close button) MUST keep the window open.
-            // This guard runs BEFORE hasActiveSession() on purpose: `closeProject()`
-            // → `disposeSession()` synchronously nulls the active session before it
-            // finishes awaiting `session.close()`, so by the time the second close
-            // arrives `hasActiveSession()` is already false. With the old guard order
-            // that second close fell straight through the hasActiveSession() check
-            // WITHOUT `preventDefault()`, so Electron destroyed the last window →
-            // `window-all-closed` → `app.quit()`, quitting the whole app on a
-            // double-click. Swallow the re-entrant close and keep the window.
-            if (closing) {
-                e.preventDefault();
-                return;
-            }
-            if (!context.workspace.hasActiveSession())
-                return;
-            // Close button while a project session is open: stay in the workbench
-            // and surface the project list. Tear down only the session — do NOT
-            // dispose `context.registry`, which owns every IPC handler (projects,
-            // dialog, settings…). Disposing it would leave the renderer alive but
-            // unable to invoke anything, so subsequent clicks on Import/etc. would
-            // raise `No handler registered for ...`.
-            e.preventDefault();
-            closing = true;
-            try {
-                if (config.onBeforeClose) {
-                    await config.onBeforeClose(instance);
-                }
-                await context.workspace.closeProject();
-                context.notify.windowNavigateBack();
-            }
-            finally {
-                closing = false;
-            }
-        },
-    });
-}
-function enableDevRendererAutoReload(rendererDir) {
-    // Auto-reload renderer windows when dist files change during development
-    if (app.isPackaged) {
-        return toDisposable(() => { });
-    }
-    let reloadTimer = null;
-    const watcher = fs.watch(rendererDir, { recursive: true }, () => {
-        if (reloadTimer)
-            clearTimeout(reloadTimer);
-        reloadTimer = setTimeout(() => {
-            for (const win of BrowserWindow.getAllWindows()) {
-                win.webContents.reload();
-            }
-        }, 300);
-    });
-    return toDisposable(() => {
-        if (reloadTimer) {
-            clearTimeout(reloadTimer);
-            reloadTimer = null;
-        }
-        watcher.close();
-    });
+function registerWorkbenchIpc(config, router, context, mainWindow, appRegistry) {
+    appRegistry.add(registerAppIpc(router));
+    // Sandboxed project file-system IPC (the renderer-side project:fs:* surface).
+    appRegistry.add(registerProjectFsIpc(router));
+    // Standalone internal (app-wide) DevTools debug window controller — the
+    // independent floating CDP panel that debugs the whole Electron app (as
+    // opposed to the right-panel CDP, which inspects only the user's
+    // mini-program). Assembled before the IPC handler below so a request
+    // arriving right after boot always finds it.
+    // `isAppQuitting` lets the controller stop intercepting 'close' during a
+    // real quit — its habitual preventDefault()+hide() would otherwise cancel
+    // the quit itself and strand the process with a hidden window.
+    // One per window (each debugs its own renderer), so it is parked on the
+    // window's context registry, not the app's.
+    context.internalDevtoolsWindow = createInternalDevtoolsWindow(mainWindow, { isAppQuitting });
+    context.registry.add(toDisposable(() => context.internalDevtoolsWindow?.dispose()));
+    // Unconditional (not a toggleable BUILTIN_MODULES entry): it's core dev
+    // tooling, not a host-configurable feature.
+    appRegistry.add(registerInternalDevtoolsIpc(router));
+    // Unconditional (not a toggleable BUILTIN_MODULES entry): the tooltip
+    // overlay is core UI chrome (every toolbar in this app relies on it), not a
+    // host-configurable feature.
+    appRegistry.add(registerTooltipIpc(router));
+    // Unconditional: the project-create dialog is core UI chrome (the built-in
+    // "新建项目" flow every host falls back to), not a host-configurable feature.
+    appRegistry.add(registerProjectCreateIpc(router));
+    // Unconditional for the same reason as the tooltip above: the device picker
+    // is an overlay WebContentsView the simulator toolbar opens, and `ctx.views`
+    // exists regardless of the `simulator` module toggle. A host that turns the
+    // simulator off simply never renders the trigger.
+    appRegistry.add(registerDevicePickerIpc(router));
+    // Unconditional (not a toggleable BUILTIN_MODULES entry): placement/host-
+    // slot IPC has no real dependency on the simulator module — `ctx.views`
+    // (ViewManager) is constructed unconditionally regardless of
+    // `modules.simulator`, and host-sidebar in particular lives on the
+    // project-list page, unrelated to the simulator webview. Every renderer
+    // entry point also blocks its first render on `AllocatePlacementGeneration`
+    // (see renderer-placement-generation.ts) — gating any of this behind the
+    // simulator toggle would strand a host that disables it on the fatal
+    // boot-failure page, or leave placement silently non-functional.
+    appRegistry.add(registerViewsIpc(router));
+    // Referer/CORS webRequest policy for the simulator runtime's sessions (shared
+    // fallback + every per-project partition). Registered into the app registry so
+    // its configurator + per-session listeners are torn down with the app —
+    // re-creating the app never leaks a duplicate configurator, and a window
+    // closing must not strip the policy off the sessions other windows still use.
+    appRegistry.add(setupSimulatorSessionPolicy());
+    // One process-wide listener that re-syncs every window's native
+    // backgroundColor on theme change — windows otherwise keep the stale
+    // creation-time color (see installThemeBackgroundSync).
+    appRegistry.add(installThemeBackgroundSync());
+    // Warm-standby compile worker: only meaningful for the devkit-backed
+    // default adapter (a host-injected adapter has no devkit fork to adopt the
+    // spare). Registered into the registry so the spare dies with the app.
+    if (!config.adapter)
+        appRegistry.add(setupCompileWorkerStandby(context));
+    registerModuleIpc(config, router, appRegistry);
 }
 /**
  * Pre-ready bootstrap side effects (app name, CDP port, CSP suppression,
@@ -338,13 +126,23 @@ export function runDevtoolsBootstrap(config = {}) {
     catch { /* electron stub in tests */ }
 }
 /**
- * Domain runtime assembly — the post-whenReady body. Builds the main window +
- * context, registers IPC modules, stands up simulator/storage/CDP/native-host
- * services, and returns the fat {@link WorkbenchAppInstance}. Extracted so the
- * v2 `RuntimeBackend.assemble` reuses the exact same body (parity by shared
+ * Domain runtime assembly — the post-whenReady body. Builds the app-wide
+ * services and the context router, opens the project window, registers IPC
+ * against the router, stands up simulator/storage/CDP/native-host services, and
+ * returns the fat {@link WorkbenchAppInstance}. Extracted so the v2
+ * `RuntimeBackend.assemble` reuses the exact same body (parity by shared
  * implementation, not behavioural re-creation).
  */
-export async function createDevtoolsRuntime(config = {}) {
+export async function createDevtoolsRuntime(config = {}, 
+/**
+ * Fired the instant the `WorkbenchAppInstance` exists — BEFORE `config.onSetup`
+ * is awaited below, which may run arbitrarily long host code (including
+ * loading the host-toolbar, which opens a live MessagePort). A caller that
+ * only learns `instance` from this function's return value would not see it
+ * until `onSetup` resolves, leaving a window where an app-quit teardown hook
+ * has nothing to dispose yet a live toolbar port already exists.
+ */
+onInstanceCreated) {
     // Self-gate on Electron readiness: this builds a BrowserWindow immediately, so
     // it must run after `app.whenReady()`. The framework backend path already
     // awaited it (idempotent no-op here); this guards any direct caller against
@@ -352,252 +150,239 @@ export async function createDevtoolsRuntime(config = {}) {
     await app.whenReady();
     applyTheme(loadWorkbenchSettings().theme);
     const rendererDir = config.rendererDir ?? defaultRendererDir;
-    const mainWindow = createConfiguredMainWindow(config, rendererDir);
-    const context = createContext(config, mainWindow, rendererDir);
-    // Anchor the main window's renderer as the first Connection. Resources
-    // scoped to the main webContents (acquired by later wiring) tear down with
-    // it; see packages/electron-deck/docs/foundation.md §4.
-    context.connections.acquire(mainWindow.webContents);
-    context.registry.add(registerAppIpc(context));
-    // Sandboxed project file-system IPC (the renderer-side project:fs:* surface).
-    context.registry.add(registerProjectFsIpc(context));
-    // Referer/CORS webRequest policy for the simulator runtime's sessions (shared
-    // fallback + every per-project partition). Registered into the context
-    // registry so its configurator + per-session listeners are torn down with the
-    // context — re-creating the app never leaks a duplicate configurator.
-    context.registry.add(setupSimulatorSessionPolicy());
-    // One process-wide listener that re-syncs every window's native
-    // backgroundColor on theme change — windows otherwise keep the stale
-    // creation-time color (see installThemeBackgroundSync).
-    context.registry.add(installThemeBackgroundSync());
-    // Warm-standby compile worker: only meaningful for the devkit-backed
-    // default adapter (a host-injected adapter has no devkit fork to adopt the
-    // spare). Registered into the registry so the spare dies with the context.
-    if (!config.adapter)
-        context.registry.add(setupCompileWorkerStandby(context));
-    registerBuiltinModules(config, context);
+    // App-wide, built once: the project list, the templates, the trusted-sender
+    // ledger and the host's simulator APIs are properties of the application, not
+    // of any single window.
+    const appServices = createAppServices({
+        // The host-supplied ProjectsProvider / template types in `shared/types`
+        // are structurally compatible with the main-process equivalents —
+        // these casts are safe; we re-narrow at the workspace-service /
+        // create-project-service boundary.
+        projectsProvider: config.projectsProvider,
+        projectTemplates: config.projectTemplates,
+        builtinTemplates: config.builtinTemplates,
+    });
+    const router = createWindowContextRouter();
+    // App-lifetime registry. `ipcMain.handle` is a process-wide singleton per
+    // channel, so the IPC surface is registered exactly once and answers
+    // whichever window a message came from. Keeping it OFF the launcher
+    // context's registry is what lets the user close the project list without
+    // stripping every handler out from under the workbench windows still open.
+    const appRegistry = new DisposableRegistry();
+    const launcher = createLauncherWindow({ config, rendererDir, appServices, router });
+    const { window: mainWindow, context } = launcher;
+    const projectList = createProjectListSurface({ window: mainWindow, context });
+    registerWorkbenchIpc(config, router, context, mainWindow, appRegistry);
+    // No `setupWindowModules` here: the only per-window module is the simulator's
+    // bridge router, and the project list runs no mini-app — it has no simulator,
+    // no service host and no page stack. Installing one here would also claim the
+    // process-global `dmb:*` invoke channels before the first workbench window
+    // could. `installGlobalMirrors` skips the console/diagnostics mirrors when the
+    // router never ran, so the list window keeps its own internal DevTools.
+    installGlobalMirrors(context, mainWindow);
     // Wire the simulator-side difile:// protocol handler + temp-file IPC
     // before host onSetup so any host-driven simulator boot sees the
     // protocol live. The module installs its own narrow sender-policy
     // (simulator-session-only) — see file header — because the default
     // workbench policy intentionally rejects the simulator <webview>.
     const simSession = session.fromPartition(SHARED_MINIAPP_PARTITION);
-    context.registry.add(setupSimulatorTempFiles(simSession));
-    installMenu(config, mainWindow, context);
-    // Gated custom-IPC surface for the host. Bound to ctx.senderPolicy so
-    // host channels go through the same gateway as built-in IPC, and
-    // registered into ctx.registry so its handlers are torn down with the
-    // context.
-    const hostIpc = new IpcRegistry(context.senderPolicy);
-    context.registry.add(hostIpc);
+    appRegistry.add(setupSimulatorTempFiles(simSession));
+    // Gated custom-IPC surface for the host. Admits any sender the router places
+    // in a live window, so a host channel invoked from a workbench window is
+    // answered the same as one invoked from the list — binding it to the
+    // launcher's own policy would reject every workbench renderer.
+    const hostIpc = new IpcRegistry((sender) => router.resolve(sender) !== null);
+    appRegistry.add(hostIpc);
+    // Host-registered simulator UI extensions are app-level, but an extension can
+    // only live in a project window, so the ledger keeps one copy per window.
+    const uiExtensions = createUiExtensionTargets({
+        projectWindows: () => workbenchWindows.list().map((pw) => pw.context),
+        activeWindow: () => workbenchWindows.activeContext(),
+    });
+    // The open-project IPC is registered below, well before `config.onSetup` is
+    // awaited, so a renderer that races ahead can ask for a project window while
+    // the host is still wiring its extensions up. Those opens park on `ready`
+    // instead of producing a window the host never got to extend.
+    let markReady;
+    const ready = new Promise((resolve) => { markReady = resolve; });
+    // The parked open reports an onSetup failure to whoever asked for the
+    // window; this keeps the rejection handled when nobody ever asks.
+    void ready.catch(() => { });
+    const workbenchWindows = createWorkbenchWindowManager({
+        config,
+        rendererDir,
+        appServices,
+        router,
+        ready,
+        // Not wrapped in try/catch the way `onBeforeClose` is: this hook runs on
+        // the way IN, so a host that could not configure the window has no window
+        // worth keeping — the manager tears it down and the error reaches the
+        // caller.
+        setupProjectWindow: async (opened, project) => {
+            await config.setupProjectWindow?.(instance, {
+                path: project.path,
+                name: project.name,
+                window: opened.window,
+                context: opened.context,
+            });
+        },
+        setupWindowModules: (ctx) => {
+            setupWindowModules(config, ctx);
+            uiExtensions.attachTo(ctx);
+        },
+        // MCP's CDP connections are aimed at the active project window and have to
+        // follow it when the user moves.
+        onActiveContextChanged: noteActiveMcpWindowChanged,
+        onBeforeClose: async (closing, project) => {
+            try {
+                await config.onBeforeClose?.(instance, {
+                    path: project.path,
+                    name: project.name,
+                    window: closing.window,
+                    context: closing.context,
+                });
+            }
+            catch (err) {
+                // The host gets to react to the close, not to cancel it: revealing the
+                // list window below is what keeps something on screen, and it must not
+                // be skipped because host code threw.
+                console.error('[workbench] host onBeforeClose hook failed:', err);
+            }
+            // The closing window keeps its place in the manager's list until its
+            // teardown finishes, so "the last project" means no OTHER window is
+            // open. The list window may be hidden behind it (see the close handler
+            // below) — leaving it hidden strands the user with a running app and
+            // nothing on screen.
+            if (workbenchWindows.list().every((pw) => pw === closing))
+                projectList.revealProjectList();
+        },
+    });
+    // Menu, automation and MCP drive whatever project the user is working in, so
+    // they read the active WORKBENCH context, resolved per call — never the list
+    // window, which owns no session. With no project open they fall back to the
+    // launcher context, whose `hasActiveSession()` is false, while MCP's CDP
+    // targets and native-host state live in the window itself: null instead.
+    const activeProjectContext = () => workbenchWindows.activeContext() ?? context;
+    setActiveMcpWindowResolver(() => workbenchWindows.activeContext());
+    appRegistry.add(toDisposable(() => setActiveMcpWindowResolver(() => null)));
+    installMenu(config, mainWindow, activeProjectContext, projectList.revealProjectList);
+    appRegistry.add(registerOpenProjectWindowIpc(router, (project) => workbenchWindows.open(project)));
     const instance = {
         mainWindow,
         context,
         ipc: hostIpc,
+        // `awaitReady: false`: `ready` only resolves once `config.onSetup` itself
+        // settles (`markReady(setup)` below), so a host that calls
+        // `instance.openProjectWindow` FROM WITHIN its own `onSetup` would
+        // otherwise deadlock — `open()` awaiting `ready` while `ready` awaits the
+        // very `onSetup` call that is awaiting `open()`. The renderer-facing IPC
+        // path (`registerOpenProjectWindowIpc` above) keeps the default: a
+        // renderer racing ahead of `onSetup` still has to park.
+        openProjectWindow: (project) => workbenchWindows.open(project, { awaitReady: false }),
+        projectWindows: () => workbenchWindows.list(),
+        disposeViews: () => {
+            for (const ctx of router.list())
+                ctx.views.disposeAll();
+        },
         // Return the registry wrapper, not the raw disposable: disposing the
         // wrapper splices the registry entry out AND drives the underlying
         // teardown, so a single dispose leaves no dead entry behind.
-        registerTrustedWindow: (win) => context.registry.add(registerTrustedWindow(context, win)),
-        registerSimulatorApi: (name, handler) => context.registry.add(toDisposable(context.simulatorApis.register(name, handler))),
-        dispose: () => disposeContext(context),
-        async getLaunchConfigs() {
-            const projectPath = context.workspace.getProjectPath();
-            if (!projectPath)
-                return [];
-            return context.workspace.getLaunchConfigs(projectPath);
-        },
-        async setLaunchConfigs(configs) {
-            const projectPath = context.workspace.getProjectPath();
-            if (!projectPath)
-                return;
-            await context.workspace.saveLaunchConfigs(projectPath, configs);
-            context.notify.popoverUpdateLaunchConfigs(configs);
-        },
-        async setActiveLaunchConfig(id) {
-            const projectPath = context.workspace.getProjectPath();
-            if (!projectPath)
-                return;
-            await context.workspace.saveActiveLaunchConfigId(projectPath, id);
-            context.notify.popoverSwitchLaunchConfig(id);
+        // App-level: the trusted-sender ledger and the simulator API map are
+        // shared by every window, so they outlive any one of them.
+        registerTrustedWindow: (win) => appRegistry.add(registerTrustedWindow(appServices, win)),
+        // Simulator APIs live in the ONE registry AppServices owns, which every
+        // window's context points at, so a single registration serves every
+        // window — including windows opened later, since the service host reads
+        // the registered names off it when it spawns. The disposer therefore
+        // belongs to the app: parking it on a window would let that window's close
+        // delete the handler out from under every other open window.
+        registerSimulatorApi: (name, handler) => appRegistry.add(toDisposable(appServices.simulatorApis.register(name, handler))),
+        registerSimulatorUiExtension: (registration) => uiExtensions.register(registration),
+        dispose: async () => {
+            await workbenchWindows.disposeAll();
+            await launcher.dispose();
+            await appRegistry.dispose();
         },
     };
+    onInstanceCreated?.(instance);
     // Built-in simulator APIs: devtools-supplied wx.* implementations that run
     // in the main process. Hosts can override any of these in their onSetup by
     // re-registering the same name (last-write-wins on the Map).
     instance.registerSimulatorApi('login', async () => {
         return 'hello';
     });
-    if (config.onSetup) {
-        await config.onSetup(instance);
-    }
+    installHostSidebarDefault(context, rendererDir);
+    // Run inside an async IIFE so a hook that throws SYNCHRONOUSLY still settles
+    // `ready` — leaving it pending would park every queued open forever, and
+    // `disposeAll()` waits on those queues.
+    const setup = (async () => { await config.onSetup?.(instance); })();
+    markReady(setup);
+    await setup;
     if (config.updateChecker) {
         instance.updateManager = new UpdateManager({
             checker: config.updateChecker,
-            mainWindow,
+            showUpdatePanel: (info) => projectList.showUpdate(info),
+            notifyDownloadProgress: (percent) => context.views.notifyUpdateDownloadProgress(percent),
+            hideUpdatePanel: () => context.views.hideUpdateDialog(),
             senderPolicy: context.senderPolicy,
             checkInterval: config.updateOptions?.checkInterval,
             initialDelay: config.updateOptions?.initialDelay,
             getCurrentVersion: config.updateOptions?.getCurrentVersion,
         });
-        context.registry.add(() => instance.updateManager.dispose());
+        appRegistry.add(() => instance.updateManager.dispose());
     }
-    await setupAutomation(instance);
-    const mcp = setupMcp();
+    const automation = await setupAutomation(instance, activeProjectContext, router);
+    if (automation)
+        appRegistry.add(automation);
+    const mcp = setupMcp(createTargetForMcp({
+        list: () => workbenchWindows.list(),
+        activeContext: activeProjectContext,
+        // `close()` (not `destroy()`) so the window's own close handling runs the
+        // same teardown a user-driven close does.
+        close: (window) => { if (!window.isDestroyed())
+            window.close(); },
+    }), createOpenForMcp(workbenchWindows));
     if (mcp)
-        context.registry.add(mcp);
-    // Resolve the active project's appId. Shared by the storage panel filter
-    // and the native-host WXML/element-inspect services (which scope the
-    // active render guest by appId).
-    const getActiveAppId = () => {
-        const session = context.workspace.getSession();
-        const appInfo = session?.appInfo;
-        return appInfo?.appId ?? null;
-    };
-    // Native-host: the real mini-app page runs in a nested render-host
-    // <webview> guest, not the localhost:7788 shell. Point the MCP
-    // `simulator` CDP target at the active render guest and keep it following
-    // the visible page across navigation/tab switches. Only wired under
-    // native-host so the default path stays byte-identical.
-    if (context.bridge?.isNativeHost()) {
-        setNativeHost(true);
-        setNativeOverviewProvider(async () => {
-            const appId = getActiveAppId();
-            const stack = context.bridge?.getPageStack?.(appId ?? undefined) ?? [];
-            const top = stack[stack.length - 1];
-            const overview = {
-                currentRoute: top?.pagePath ?? null,
-                pageStackDepth: stack.length,
-                storageKeys: [],
-                storageCount: 0,
-                appDataKeys: [],
-            };
-            if (appId) {
-                const storage = await resolveNativeStorageOverview(context, appId);
-                overview.storageKeys = storage.storageKeys;
-                overview.storageCount = storage.storageCount;
-                overview.appDataKeys = resolveNativeAppDataKeys(context, appId);
+        appRegistry.add(mcp);
+    // The list window opens no project, so its close needs none of the workbench
+    // teardown: just unregister its context, or a recycled `webContents.id`
+    // could later resolve to a destroyed window.
+    context.registry.add(wireMainWindowEvents(mainWindow, {
+        context,
+        onResize: () => context.views.repositionAll(),
+        onClose: (e) => {
+            if (isAppQuitting())
+                return;
+            // With projects still open, this window must survive its own close
+            // button: it is the only way back to the project list, and the
+            // app-level IPC it registered cannot be registered again on a
+            // replacement window. Hide it — every path back calls
+            // `projectList.revealProjectList()`, including the last project window
+            // closing.
+            if (workbenchWindows.list().length > 0) {
+                e.preventDefault();
+                mainWindow.hide();
+                return;
             }
-            return overview;
-        });
-        const off = context.bridge.onRenderEvent((ev) => setActiveBridgeId(ev.bridgeId));
-        context.registry.add(off);
-        context.registry.add(() => setNativeHost(false));
-        context.registry.add(() => setNativeOverviewProvider(null));
-    }
-    // Native-host inspector: injects the render-guest IIFE and drives WXML /
-    // element-highlight against the active render-host <webview>. Reused by
-    // the storage panel (element inspect) and the WXML panel service.
-    const renderInspector = createRenderInspector({ connections: context.connections });
-    const storage = setupSimulatorStorage(mainWindow.webContents, {
-        senderPolicy: context.senderPolicy,
-        connections: context.connections,
-        // Per-project filter for the simulator-storage panel: the simulator
-        // uses a fixed `persist:simulator` partition + a fixed simulator.html
-        // origin, so localStorage is shared across every project that has
-        // ever opened. The dimina runtime isolates writes with `${appId}_`
-        // prefixes; this callback lets the storage panel filter the CDP
-        // snapshot/event stream to the active appId.
-        getActiveAppId,
-        // Native-host: route element inspection to the active render guest, and
-        // read/write storage from the service-host window's file:// store.
-        bridge: context.bridge,
-        renderInspector,
-    });
-    context.registry.add(storage);
-    // Native-host: expose the async-storage runtime hook so bridge-router
-    // routes async wx.setStorage/etc. to the unified service-host store.
-    if (storage.storageApi) {
-        context.storageApi = storage.storageApi;
-        context.registry.add(() => { context.storageApi = undefined; });
-        // SYNC wx storage writes bypass main (they hit the service-host localStorage
-        // directly); the service-host posts `storageChanged` and bridge-router routes
-        // it here so the Storage panel stays live without a manual reload.
-        context.onServiceStorageChanged = storage.onSyncStorageChange;
-        context.registry.add(() => { context.onServiceStorageChanged = undefined; });
-    }
-    // Native-host WXML + AppData panels: main sources the data (WXML pulled
-    // from the active render guest; AppData tapped from the service→render
-    // setData stream in bridge-router) and pushes it to the renderer. Inert on
-    // the default dimina-fe path (which sources both from the simulator
-    // miniappSnapshot transport), so only wire them when native-host is on.
-    if (context.bridge?.isNativeHost()) {
-        // Native-host: surface the simulator WCV's network (wx.request/download/
-        // upload run there, not in the service host) in the embedded DevTools by
-        // injecting its raw Network.* CDP events into the DevTools front-end so the
-        // native Network tab renders them (service-host console line is the
-        // fallback). The ViewManager calls the forwarder's attachSimulator +
-        // setDevtoolsHost from attachNativeSimulator once the simulator WCV +
-        // DevTools host exist; getServiceWc here is the fallback sink target.
-        const networkForward = createNetworkForwarder({
-            getServiceWc: (appId) => context.bridge?.getServiceWc(appId) ?? null,
-            connections: context.connections,
-        });
-        context.networkForward = networkForward;
-        context.registry.add(networkForward);
-        context.registry.add(() => { context.networkForward = undefined; });
-        context.registry.add(setupSimulatorWxml(mainWindow.webContents, {
-            senderPolicy: context.senderPolicy,
-            bridge: context.bridge,
-            inspector: renderInspector,
-            getActiveAppId,
-        }));
-        const appDataService = setupSimulatorAppData(mainWindow.webContents, {
-            senderPolicy: context.senderPolicy,
-            getActiveAppId,
-        });
-        // bridge-router feeds this via ctx.appData (service→render tap + evict).
-        context.appData = appDataService;
-        context.registry.add(appDataService);
-        context.registry.add(() => { context.appData = undefined; });
-        // Push the visible page route to the toolbar on every navigation (the
-        // page stack lives in the DeviceShell WCV, invisible to renderer
-        // <webview> nav events).
-        context.registry.add(setupSimulatorCurrentPage(mainWindow.webContents, {
-            bridge: context.bridge,
-        }));
-    }
-    // Embedded workbench editor — the sole devtools editor. Stand up the COI
-    // http server that serves the workbench bundle with the SharedArrayBuffer
-    // isolation headers and bridges `/__fs/*` onto the active project, then hand its
-    // base URL to the view manager so the 'editor' dock slot mounts the workbench
-    // WebContentsView. Both the server and the WCV tear down with the context
-    // registry.
-    //
-    // Default the bundle dir to the devtools package's OWN `dist/vscode-workbench`
-    // (resolved from the package root), NOT relative to the caller's rendererDir:
-    // a host that overrides `rendererDir` but omits `editorViewConfig.bundleDir`
-    // would otherwise compute a path next to ITS renderer, where no workbench
-    // bundle exists → 404 / blank editor.
-    const bundleDir = config.editorViewConfig?.bundleDir ?? path.join(devtoolsPackageRoot, 'dist/vscode-workbench');
-    // Skip the entire editor assembly when the bundle is missing. Starting the COI
-    // server and attaching the WCV against a non-existent bundle yields a silent
-    // blank editor (the WCV loads index.html → 404); a launchable app with no
-    // editor is strictly better. The view manager never gets a source, so the
-    // 'editor' slot's lazy attach is a no-op.
-    if (!fs.existsSync(path.join(bundleDir, 'index.html'))) {
-        console.warn(`[workbench] editor bundle not found at ${bundleDir} — skipping embedded editor assembly`);
-    }
-    else {
-        const coiServer = await startWorkbenchCoiServer({
-            rootDir: bundleDir,
-            getProjectRoot: () => context.workspace.getProjectPath(),
-            extensionsDir: config.editorViewConfig?.extensionsDir,
-            getFileTypes: () => context.fileTypes,
-        });
-        // Return the close promise so the registry awaits server shutdown on dispose
-        // instead of fire-and-forgetting it (a dangling http server would keep the
-        // port + event loop alive past teardown).
-        context.registry.add(() => coiServer.close());
-        context.registry.add(() => context.views.detachWorkbench());
-        // Only HAND the view manager the COI URL — do NOT load yet. The heavy
-        // WebContentsView load (10MB bundle + ext-host) is deferred to the first time
-        // the 'editor' dock slot becomes visible (first non-zero bounds), so it never
-        // sits on the app boot critical path. Loading it eagerly here delayed
-        // preload/window-ready enough to trip the e2e launch health check.
-        context.views.setWorkbenchSource(coiServer.baseUrl);
-    }
-    context.registry.add(wireAppWindowEvents(config, instance));
-    context.registry.add(enableDevRendererAutoReload(rendererDir));
+            void launcher.dispose();
+        },
+    }));
+    // macOS keeps the app running with no window on screen. Clicking the dock
+    // icon then has to bring something back, and the project list is the app's
+    // home — a workbench window only exists for a project the user already
+    // chose.
+    const onActivate = () => {
+        if (mainWindow.isDestroyed())
+            return;
+        if (mainWindow.isVisible())
+            return;
+        if (workbenchWindows.list().some((pw) => !pw.window.isDestroyed() && pw.window.isVisible()))
+            return;
+        projectList.revealProjectList();
+    };
+    app.on('activate', onActivate);
+    appRegistry.add(toDisposable(() => { app.removeListener('activate', onActivate); }));
+    appRegistry.add(enableDevRendererAutoReload(rendererDir));
     return instance;
 }
 //# sourceMappingURL=app.js.map