@dimina-kit/devtools 0.4.0 → 0.5.0-dev.20260908120530

package/dist/main/services/simulator-temp-files/index.js

@@ -1,182 +1,2 @@
-/**
- * Wires the `difile://_tmp/*` protocol handler on the simulator session
- * and bridges renderer-side `setTempFileSink` callbacks to the main-process
- * byte store. Returned disposable clears the store, unregisters the protocol
- * handler, and tears down its private IPC channels.
- *
- * SENDER POLICY: The default workbench sender-policy intentionally rejects
- * the simulator `<webview>` (see `utils/sender-policy.ts`). The simulator
- * is the only legitimate writer for these channels, so this module installs
- * its own narrow policy that accepts a sender only when its WebContents
- * belongs to the simulator `Session` we were handed. This bypasses the
- * default policy without widening trust to any other source.
- *
- * WRITE-vs-RENDER RACE: `createTempFilePath` is synchronous on the renderer,
- * but the bytes travel here through `blob.arrayBuffer().then(ipcRenderer.send)`
- * — async. The simulator can race ahead: in `chooseMedia` the renderer
- * assigns `img.src = tempFilePath` (via `readImageMetadata`) immediately
- * after `createTempFilePath` returns, which fires a `difile://` GET before
- * our IPC write arrives. The protocol handler therefore parks a request on
- * a per-url waiter for up to PENDING_TIMEOUT_MS; the IPC `write` handler
- * drains the waiter on arrival.
- *
- * QUOTA: A single in-memory store backs all simulator sessions for the
- * lifetime of the WorkbenchApp instance. We cap it at MAX_STORE_ENTRIES
- * (FIFO eviction). Project switches do NOT clear the store on their own —
- * stale entries from a previous project simply age out as new ones land.
- * This is the same eviction shape WeChat uses for tmp files (LRU under a
- * size cap), simplified for a dev-tools session scope.
- */
-import { IpcRegistry } from '../../utils/ipc-registry.js';
-import { toDisposable } from '@dimina-kit/electron-deck/main';
-import { registerTempFile, revokeTempFile, revokeAllTempFiles } from './store.js';
-import { handleDifileRequest } from './request-handler.js';
-import { registerMiniappSessionConfigurator } from '../views/miniapp-partition.js';
-import { handleFsMkdir, handleFsRead, handleFsReaddir, handleFsStat, handleFsUnlink, handleFsWrite, } from './fs-channels.js';
-/** Upper bound for in-memory entries; oldest insertion is evicted (FIFO). */
-const MAX_STORE_ENTRIES = 200;
-/** Max time the protocol handler waits for an in-flight `write` IPC. */
-const PENDING_TIMEOUT_MS = 500;
-function enforceStoreCap(store) {
-    while (store.size > MAX_STORE_ENTRIES) {
-        const next = store.keys().next();
-        if (next.done)
-            break;
-        store.delete(next.value);
-    }
-}
-export function setupSimulatorTempFiles(simSession) {
-    const store = new Map();
-    const pendingWaiters = new Map();
-    let disposed = false;
-    function drainWaiters(path) {
-        const list = pendingWaiters.get(path);
-        if (!list)
-            return;
-        pendingWaiters.delete(path);
-        for (const fn of list)
-            fn();
-    }
-    function drainAllWaiters() {
-        const lists = Array.from(pendingWaiters.values());
-        pendingWaiters.clear();
-        for (const list of lists)
-            for (const fn of list)
-                fn();
-    }
-    // The protocol handler + IPC channels are shared across every per-project
-    // miniapp partition session (each project's render/service runs the same
-    // difile:// + temp-file FSM). The base session is always trusted; additional
-    // per-project partition sessions register themselves via `installOnSession`.
-    const trustedSessions = new Set([simSession]);
-    const simulatorOnlyPolicy = sender => !sender.isDestroyed() && trustedSessions.has(sender.session);
-    const registry = new IpcRegistry(simulatorOnlyPolicy);
-    registry.on('simulator:temp-file:write', (_event, payload) => {
-        if (disposed)
-            return;
-        const { path, mime, bytes } = payload;
-        registerTempFile(store, path, mime, bytes);
-        enforceStoreCap(store);
-        drainWaiters(path);
-    });
-    registry.on('simulator:temp-file:revoke', (_event, payload) => {
-        if (disposed)
-            return;
-        const { path } = payload;
-        revokeTempFile(store, path);
-    });
-    registry.on('simulator:temp-file:revoke-all', () => {
-        if (disposed)
-            return;
-        revokeAllTempFiles(store);
-    });
-    const difileHandler = async (req) => {
-        const url = req.url;
-        // Forward any HTTP headers Electron parsed (Range / If-None-Match)
-        // to the pure dispatcher so it can do its own conditional / range
-        // shaping.
-        const headers = {};
-        try {
-            req.headers.forEach((v, k) => { headers[k] = v; });
-        }
-        catch {
-            // Older Electron headers shape may not be iterable — best effort.
-        }
-        const ctx = { tempStore: store };
-        let res = await handleDifileRequest(ctx, { url, headers });
-        // Race waiter: the renderer-side `createTempFilePath` is synchronous
-        // but its `bytes` IPC arrives later. If we miss a `_tmp/*` lookup,
-        // park briefly and retry once.
-        if (res.status === 404
-            && !disposed
-            && url.startsWith('difile://_tmp/')) {
-            await new Promise((resolve) => {
-                let timer = null;
-                const notify = () => {
-                    if (timer)
-                        clearTimeout(timer);
-                    resolve();
-                };
-                const list = pendingWaiters.get(url) ?? new Set();
-                list.add(notify);
-                pendingWaiters.set(url, list);
-                timer = setTimeout(() => {
-                    const cur = pendingWaiters.get(url);
-                    if (cur) {
-                        cur.delete(notify);
-                        if (cur.size === 0)
-                            pendingWaiters.delete(url);
-                    }
-                    resolve();
-                }, PENDING_TIMEOUT_MS);
-            });
-            res = await handleDifileRequest(ctx, { url, headers });
-        }
-        return res;
-    };
-    // Install the difile:// protocol handler on a session. Idempotent per
-    // session: a stale handler from a prior setup (e.g. fast app re-init in
-    // tests) is replaced rather than throwing. Trusts that session's senders for
-    // the temp-file / fs IPC channels.
-    const installedSessions = new Set();
-    function installOnSession(sess) {
-        trustedSessions.add(sess);
-        if (installedSessions.has(sess))
-            return;
-        installedSessions.add(sess);
-        try {
-            sess.protocol.unhandle('difile');
-        }
-        catch {
-            // Not previously registered — fine.
-        }
-        sess.protocol.handle('difile', difileHandler);
-    }
-    installOnSession(simSession);
-    // Apply to every per-project miniapp partition session (current + future).
-    const unregisterConfigurator = registerMiniappSessionConfigurator((sess) => installOnSession(sess));
-    // Renderer FSM → main fs operations bridge. The same simulator-only sender
-    // policy applies — registry instance is shared.
-    registry.handle('simulator:fs:read', (_event, payload) => handleFsRead(payload));
-    registry.handle('simulator:fs:write', (_event, payload) => handleFsWrite(payload));
-    registry.handle('simulator:fs:stat', (_event, payload) => handleFsStat(payload));
-    registry.handle('simulator:fs:readdir', (_event, payload) => handleFsReaddir(payload));
-    registry.handle('simulator:fs:unlink', (_event, payload) => handleFsUnlink(payload));
-    registry.handle('simulator:fs:mkdir', (_event, payload) => handleFsMkdir(payload));
-    return toDisposable(async () => {
-        disposed = true;
-        unregisterConfigurator();
-        drainAllWaiters();
-        store.clear();
-        for (const sess of installedSessions) {
-            try {
-                sess.protocol.unhandle('difile');
-            }
-            catch {
-                // May already have been unhandled by app shutdown.
-            }
-        }
-        await registry.dispose();
-    });
-}
+export * from '@dimina-kit/electron-runtime/main/temp-files';
 //# sourceMappingURL=index.js.map

package/dist/main/services/simulator-temp-files/request-handler.d.ts

@@ -1,30 +1,2 @@
-/**
- * Pure dispatcher for `difile://` URL requests.
- *
- * Spec: `packages/devtools/docs/file-system.md` §4.3.
- *
- * The shipping implementation in `index.ts` registers a thin
- * `simSession.protocol.handle('difile')` wrapper that delegates here; the race
- * waiter on `_tmp/*` lives in `index.ts` because it owns the IPC lifecycle.
- * For unit tests we assume the bytes are already in the store.
- *
- * Response shape:
- *   - 200: full body, with Content-Type, Cache-Control (immutable), ETag
- *   - 206: range slice, plus Content-Range
- *   - 304: empty body when `If-None-Match` matches the on-disk ETag. Per RFC
- *     9110 §13.1.2 If-None-Match wins over Range.
- *   - 404: anything `resolveVPath` rejects, plus disk-side ENOENT and any
- *     other I/O error. The protocol handler in `index.ts` translates this
- *     into the renderer's network failure surface; we deliberately do not
- *     leak errno strings.
- */
-import type { TempFileStore } from './resolver.js';
-export interface HandleDifileContext {
-    tempStore: TempFileStore;
-}
-export interface HandleDifileRequest {
-    url: string;
-    headers?: Record<string, string>;
-}
-export declare function handleDifileRequest(ctx: HandleDifileContext, req: HandleDifileRequest): Promise<Response>;
+export * from '@dimina-kit/electron-runtime/main/temp-files/request-handler';
 //# sourceMappingURL=request-handler.d.ts.map

package/dist/main/services/simulator-temp-files/request-handler.js

@@ -1,178 +1,2 @@
-/**
- * Pure dispatcher for `difile://` URL requests.
- *
- * Spec: `packages/devtools/docs/file-system.md` §4.3.
- *
- * The shipping implementation in `index.ts` registers a thin
- * `simSession.protocol.handle('difile')` wrapper that delegates here; the race
- * waiter on `_tmp/*` lives in `index.ts` because it owns the IPC lifecycle.
- * For unit tests we assume the bytes are already in the store.
- *
- * Response shape:
- *   - 200: full body, with Content-Type, Cache-Control (immutable), ETag
- *   - 206: range slice, plus Content-Range
- *   - 304: empty body when `If-None-Match` matches the on-disk ETag. Per RFC
- *     9110 §13.1.2 If-None-Match wins over Range.
- *   - 404: anything `resolveVPath` rejects, plus disk-side ENOENT and any
- *     other I/O error. The protocol handler in `index.ts` translates this
- *     into the renderer's network failure surface; we deliberately do not
- *     leak errno strings.
- */
-import { resolveVPath } from '../../../shared/vpath.js';
-import { readDiskFile } from './disk.js';
-const CACHE_CONTROL = 'public, max-age=31536000, immutable';
-function getHeader(headers, name) {
-    if (!headers)
-        return undefined;
-    const lc = name.toLowerCase();
-    for (const k of Object.keys(headers)) {
-        if (k.toLowerCase() === lc)
-            return headers[k];
-    }
-    return undefined;
-}
-/**
- * Weak ETag comparison per RFC 9110 §8.8.3.2: strip the optional `W/` prefix
- * from each side before comparing. Both our generated ETags and conditional
- * headers may or may not include the weak prefix; the comparison must accept
- * `W/"abc"` and `"abc"` as equivalent.
- */
-function etagsMatch(a, b) {
-    if (!a)
-        return false;
-    const stripped = (s) => (s.startsWith('W/') ? s.slice(2) : s);
-    return stripped(a.trim()) === stripped(b);
-}
-/**
- * Parse a `Range: bytes=<start>-<end>` header into an inclusive `{start,end}`.
- * Returns `null` if absent or malformed (callers should treat that as "no
- * range" — a full 200 response, not a 416). `totalSize` clamps the end.
- */
-function parseRange(header, totalSize) {
-    if (!header)
-        return null;
-    const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
-    if (!m)
-        return null;
-    const startStr = m[1];
-    const endStr = m[2];
-    if (startStr === '' && endStr === '')
-        return null;
-    if (startStr === '') {
-        // Suffix range: last N bytes.
-        const n = Number(endStr);
-        if (!Number.isFinite(n) || n <= 0)
-            return null;
-        const start = Math.max(0, totalSize - n);
-        return { start, end: totalSize - 1 };
-    }
-    const start = Number(startStr);
-    if (!Number.isFinite(start) || start < 0)
-        return null;
-    const end = endStr === '' ? totalSize - 1 : Number(endStr);
-    if (!Number.isFinite(end))
-        return null;
-    return { start, end };
-}
-function notFound() {
-    return new Response(null, { status: 404 });
-}
-function notModified(etag) {
-    return new Response(null, {
-        status: 304,
-        headers: {
-            ETag: etag,
-            'Cache-Control': CACHE_CONTROL,
-            'Access-Control-Allow-Origin': '*',
-        },
-    });
-}
-function bufferToBody(bytes) {
-    // Copy into a fresh ArrayBuffer so the result is definitely typed as
-    // `ArrayBuffer` (not `ArrayBufferLike` / `SharedArrayBuffer`) and is
-    // safe to hand to Response without aliasing the Node Buffer pool.
-    const out = new ArrayBuffer(bytes.byteLength);
-    new Uint8Array(out).set(bytes);
-    return out;
-}
-function tempBody(bytes, mime) {
-    return new Response(bufferToBody(bytes), {
-        status: 200,
-        headers: {
-            'Content-Type': mime,
-            'Cache-Control': CACHE_CONTROL,
-            'Access-Control-Allow-Origin': '*',
-        },
-    });
-}
-export async function handleDifileRequest(ctx, req) {
-    const v = resolveVPath(req.url);
-    if (!v)
-        return notFound();
-    if (v.kind === 'tmp') {
-        const record = ctx.tempStore.get(req.url);
-        if (!record)
-            return notFound();
-        return tempBody(record.bytes, record.mime || 'application/octet-stream');
-    }
-    if (!v.realPath)
-        return notFound();
-    // Disk-backed: _store or usr.
-    try {
-        // Probe first to learn the ETag/size so If-None-Match can short-circuit
-        // without reading the body. The probe also doubles as our existence /
-        // permission check, so anything that throws here (ENOENT, EACCES, ...)
-        // surfaces as a 404.
-        const probe = await readDiskFile(v.realPath);
-        const etag = probe.etag;
-        const totalSize = probe.totalSize;
-        const mime = probe.mime;
-        const ifNoneMatch = getHeader(req.headers, 'If-None-Match');
-        if (etagsMatch(ifNoneMatch, etag)) {
-            return notModified(etag);
-        }
-        const rangeHeader = getHeader(req.headers, 'Range');
-        const range = parseRange(rangeHeader, totalSize);
-        if (range) {
-            // Range out of bounds → 416 (Range Not Satisfiable) per RFC 9110 §15.4.
-            // Distinct from 404 so callers can tell "wrong file" from "wrong slice".
-            if (range.start < 0 || range.start >= totalSize || range.end < range.start) {
-                return new Response(null, {
-                    status: 416,
-                    headers: {
-                        'Content-Range': `bytes */${totalSize}`,
-                        'Access-Control-Allow-Origin': '*',
-                    },
-                });
-            }
-            const clampedEnd = Math.min(range.end, totalSize - 1);
-            const sliced = await readDiskFile(v.realPath, { range: { start: range.start, end: clampedEnd } });
-            const { bytes } = sliced;
-            const lastByte = range.start + bytes.length - 1;
-            return new Response(bufferToBody(bytes), {
-                status: 206,
-                headers: {
-                    'Content-Type': mime,
-                    'Content-Length': String(bytes.length),
-                    'Content-Range': `bytes ${range.start}-${lastByte}/${totalSize}`,
-                    'Cache-Control': CACHE_CONTROL,
-                    ETag: etag,
-                    'Access-Control-Allow-Origin': '*',
-                },
-            });
-        }
-        return new Response(bufferToBody(probe.bytes), {
-            status: 200,
-            headers: {
-                'Content-Type': mime,
-                'Cache-Control': CACHE_CONTROL,
-                ETag: etag,
-                'Access-Control-Allow-Origin': '*',
-            },
-        });
-    }
-    catch {
-        return notFound();
-    }
-}
+export * from '@dimina-kit/electron-runtime/main/temp-files/request-handler';
 //# sourceMappingURL=request-handler.js.map

package/dist/main/services/simulator-temp-files/resolver.d.ts

@@ -1,22 +1,2 @@
-/**
- * Pure lookup helper backing the main-process `difile://_tmp/*` protocol
- * handler. Receives the shared {@link TempFileStore} that the
- * `simulator:temp-file:*` IPC channels populate from the renderer.
- *
- * The full URL (including scheme + host) is used as the Map key — the resolver
- * never re-parses or normalises it, so any URL with a wrong scheme or host
- * misses regardless of suffix similarity.
- */
-export interface TempFileRecord {
-    bytes: Buffer;
-    mime: string;
-}
-export type TempFileStore = Map<string, TempFileRecord>;
-export declare function resolveTempFile(store: TempFileStore, url: string): {
-    status: 200;
-    bytes: Buffer;
-    mime: string;
-} | {
-    status: 404;
-};
+export * from '@dimina-kit/electron-runtime/main/temp-files/resolver';
 //# sourceMappingURL=resolver.d.ts.map

package/dist/main/services/simulator-temp-files/resolver.js

@@ -1,22 +1,2 @@
-/**
- * Pure lookup helper backing the main-process `difile://_tmp/*` protocol
- * handler. Receives the shared {@link TempFileStore} that the
- * `simulator:temp-file:*` IPC channels populate from the renderer.
- *
- * The full URL (including scheme + host) is used as the Map key — the resolver
- * never re-parses or normalises it, so any URL with a wrong scheme or host
- * misses regardless of suffix similarity.
- */
-export function resolveTempFile(store, url) {
-    if (!url.startsWith('difile://_tmp/'))
-        return { status: 404 };
-    const record = store.get(url);
-    if (!record)
-        return { status: 404 };
-    return {
-        status: 200,
-        bytes: record.bytes,
-        mime: record.mime || 'application/octet-stream',
-    };
-}
+export * from '@dimina-kit/electron-runtime/main/temp-files/resolver';
 //# sourceMappingURL=resolver.js.map

package/dist/main/services/simulator-temp-files/store.d.ts

@@ -1,14 +1,2 @@
-/**
- * Mutators for the shared {@link TempFileStore}. The renderer-side bridge
- * forwards every `createTempFilePath` / `registerTempFilePath` /
- * `revokeTempFilePath` / `revokeAllTempFilePaths` call over IPC, and these
- * helpers translate the payloads into Map writes.
- *
- * ArrayBuffer inputs are normalised to Buffer at the boundary so the
- * resolver hot path can return the bytes directly without re-wrapping.
- */
-import type { TempFileStore } from './resolver.js';
-export declare function registerTempFile(store: TempFileStore, path: string, mime: string, bytes: ArrayBuffer | Buffer): void;
-export declare function revokeTempFile(store: TempFileStore, path: string): void;
-export declare function revokeAllTempFiles(store: TempFileStore): void;
+export * from '@dimina-kit/electron-runtime/main/temp-files/store';
 //# sourceMappingURL=store.d.ts.map

package/dist/main/services/simulator-temp-files/store.js

@@ -1,24 +1,2 @@
-/**
- * Mutators for the shared {@link TempFileStore}. The renderer-side bridge
- * forwards every `createTempFilePath` / `registerTempFilePath` /
- * `revokeTempFilePath` / `revokeAllTempFilePaths` call over IPC, and these
- * helpers translate the payloads into Map writes.
- *
- * ArrayBuffer inputs are normalised to Buffer at the boundary so the
- * resolver hot path can return the bytes directly without re-wrapping.
- */
-export function registerTempFile(store, path, mime, bytes) {
-    const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(new Uint8Array(bytes));
-    // delete-then-set so an existing entry's insertion order is refreshed.
-    // Without this, a FIFO cap eviction over `store.keys()` could drop a
-    // recently re-written path.
-    store.delete(path);
-    store.set(path, { bytes: buf, mime });
-}
-export function revokeTempFile(store, path) {
-    store.delete(path);
-}
-export function revokeAllTempFiles(store) {
-    store.clear();
-}
+export * from '@dimina-kit/electron-runtime/main/temp-files/store';
 //# sourceMappingURL=store.js.map

package/dist/main/services/update/github-release-checker.js

@@ -207,6 +207,12 @@ function httpGetText(url, init) {
 function downloadFile(url, dest, token, onProgress) {
     return new Promise((resolve, reject) => {
         const headers = ghHeaders(token);
+        // Awaited before every reject so callers (and tests) that observe the
+        // rejection never race a partial file still being unlinked — fs.unlink's
+        // callback form settles asynchronously, after the promise had already
+        // rejected, which left a truncated/aborted download file on disk for a
+        // window after the caller believed cleanup was done.
+        const cleanup = () => fs.promises.unlink(dest).catch(() => { });
         // GitHub asset downloads redirect to signed S3 URLs; keep following them.
         const attempt = (target, redirectsLeft) => {
             const req = https.get(target, { headers }, (res) => {
@@ -236,11 +242,24 @@ function downloadFile(url, dest, token, onProgress) {
                         onProgress((received / total) * 100);
                     }
                 });
+                // `.pipe()` does not forward source stream errors to the destination —
+                // an aborted/reset connection here would otherwise surface as an
+                // unhandled 'error' event on `res` (crashes the process) instead of
+                // rejecting this promise.
+                res.on('error', async (err) => { out.destroy(); await cleanup(); reject(err); });
                 res.pipe(out);
-                out.on('finish', () => { out.close(); resolve(); });
-                out.on('error', (err) => { fs.unlink(dest, () => { }); reject(err); });
+                out.on('finish', async () => {
+                    out.close();
+                    if (total > 0 && received !== total) {
+                        await cleanup();
+                        reject(new Error(`Downloaded ${received} bytes, expected ${total} — update download was truncated`));
+                        return;
+                    }
+                    resolve();
+                });
+                out.on('error', async (err) => { await cleanup(); reject(err); });
             });
-            req.on('error', (err) => { fs.unlink(dest, () => { }); reject(err); });
+            req.on('error', async (err) => { await cleanup(); reject(err); });
         };
         attempt(url, 5);
     });

package/dist/main/services/update/update-manager.d.ts

@@ -1,9 +1,13 @@
-import { BrowserWindow } from 'electron';
 import type { UpdateChecker, UpdateInfo } from '../../../shared/types.js';
 import { type SenderPolicy } from '../../utils/ipc-registry.js';
 export interface UpdateManagerOptions {
     checker: UpdateChecker;
-    mainWindow: BrowserWindow;
+    /** Show the update-available overlay panel, fed the discovered update's info. */
+    showUpdatePanel: (info: UpdateInfo) => void;
+    /** Forward a download-progress tick into the (already-shown) update overlay. */
+    notifyDownloadProgress: (percent: number) => void;
+    /** Hide the update overlay panel — the renderer's close (any path) forwards here. */
+    hideUpdatePanel: () => void;
     /** Check interval in milliseconds. Default: 1 hour */
     checkInterval?: number;
     /** Delay before the first check after startup in ms. Default: 5000 */
@@ -20,7 +24,9 @@ export interface UpdateManagerOptions {
 }
 export declare class UpdateManager {
     private checker;
-    private mainWindow;
+    private showUpdatePanel;
+    private notifyDownloadProgress;
+    private hideUpdatePanel;
     private getCurrentVersion;
     private latestUpdate;
     private downloadedPath;
@@ -37,6 +43,14 @@ export declare class UpdateManager {
     private timer;
     private initialTimer;
     private ipc;
+    /**
+     * Set by `dispose()`. Clearing the timers only stops FUTURE ticks — an
+     * in-flight `checkAndNotify()` invocation (already past its `await
+     * this.check()`) has no timer left to cancel it, and would otherwise call
+     * `showUpdatePanel` after dispose has torn down the overlay panel that
+     * owns (e.g. `views.disposeAll()` destroying its WebContentsView).
+     */
+    private disposed;
     constructor(opts: UpdateManagerOptions);
     private registerIpc;
     check(): Promise<{
@@ -48,7 +62,10 @@ export declare class UpdateManager {
         filePath?: string;
         error?: string;
     }>;
-    install(): void;
+    install(): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
     /**
      * Tear down timers + IPC handlers. Returns a Promise so callers that need
      * a settled cleanup (e.g. workbench registry shutdown, the unit-test