@lvce-editor/extension-management-worker 4.51.0 → 4.52.0

package/dist/extensionManagementWorkerMain.js

@@ -546,7 +546,7 @@ const waitForWebSocketToBeOpen = webSocket => {
     open: Open
   });
 };
-const create$c = async ({
+const create$d = async ({
   webSocket
 }) => {
   const firstWebSocketEvent = await waitForWebSocketToBeOpen(webSocket);
@@ -583,7 +583,7 @@ const wrap = webSocket => {
 };
 const IpcParentWithWebSocket$1 = {
   __proto__: null,
-  create: create$c,
+  create: create$d,
   wrap
 };
 
@@ -863,7 +863,7 @@ const getErrorResponse = (id, error, preparePrettyError, logError) => {
   const errorProperty = getErrorProperty(error, prettyError);
   return create$1$1(id, errorProperty);
 };
-const create$b = (message, result) => {
+const create$c = (message, result) => {
   return {
     id: message.id,
     jsonrpc: Two$1,
@@ -872,7 +872,7 @@ const create$b = (message, result) => {
 };
 const getSuccessResponse = (message, result) => {
   const resultProperty = result ?? null;
-  return create$b(message, resultProperty);
+  return create$c(message, resultProperty);
 };
 const getErrorResponseSimple = (id, error) => {
   return {
@@ -966,7 +966,7 @@ const handleJsonRpcMessage = async (...args) => {
 
 const Two = '2.0';
 
-const create$a = (method, params) => {
+const create$b = (method, params) => {
   return {
     jsonrpc: Two,
     method,
@@ -974,7 +974,7 @@ const create$a = (method, params) => {
   };
 };
 
-const create$9 = (id, method, params) => {
+const create$a = (id, method, params) => {
   const message = {
     id,
     jsonrpc: Two,
@@ -985,12 +985,12 @@ const create$9 = (id, method, params) => {
 };
 
 let id = 0;
-const create$8 = () => {
+const create$9 = () => {
   return ++id;
 };
 
 const registerPromise = map => {
-  const id = create$8();
+  const id = create$9();
   const {
     promise,
     resolve
@@ -1007,7 +1007,7 @@ const invokeHelper = async (callbacks, ipc, method, params, useSendAndTransfer)
     id,
     promise
   } = registerPromise(callbacks);
-  const message = create$9(id, method, params);
+  const message = create$a(id, method, params);
   if (useSendAndTransfer && ipc.sendAndTransfer) {
     ipc.sendAndTransfer(message);
   } else {
@@ -1043,7 +1043,7 @@ const createRpc = ipc => {
      * @deprecated
      */
     send(method, ...params) {
-      const message = create$a(method, params);
+      const message = create$b(method, params);
       ipc.send(message);
     }
   };
@@ -1083,7 +1083,7 @@ const listen$1 = async (module, options) => {
   return ipc;
 };
 
-const create$7 = async ({
+const create$8 = async ({
   commandMap,
   isMessagePortOpen = true,
   messagePort
@@ -1101,7 +1101,7 @@ const create$7 = async ({
   return rpc;
 };
 
-const create$6 = async ({
+const create$7 = async ({
   commandMap,
   isMessagePortOpen,
   send
@@ -1111,7 +1111,7 @@ const create$6 = async ({
     port2
   } = new MessageChannel();
   await send(port1);
-  return create$7({
+  return create$8({
     commandMap,
     isMessagePortOpen,
     messagePort: port2
@@ -1146,13 +1146,13 @@ const createSharedLazyRpc = factory => {
   };
 };
 
-const create$5 = async ({
+const create$6 = async ({
   commandMap,
   isMessagePortOpen,
   send
 }) => {
   return createSharedLazyRpc(() => {
-    return create$6({
+    return create$7({
       commandMap,
       isMessagePortOpen,
       send
@@ -1180,7 +1180,7 @@ const getProtocol = () => {
   return location.protocol;
 };
 
-const create$4 = async ({
+const create$5 = async ({
   commandMap,
   webSocket
 }) => {
@@ -1212,7 +1212,7 @@ const connect = async ({
 }) => {
   const webSocket = new WebSocket(wsUrl);
   try {
-    const rpc = await create$4({
+    const rpc = await create$5({
       commandMap,
       webSocket
     });
@@ -1225,7 +1225,7 @@ const connect = async ({
     throw error;
   }
 };
-const create$3 = async ({
+const create$4 = async ({
   commandMap,
   onClose,
   type
@@ -1254,7 +1254,7 @@ const create$3 = async ({
   return connection.rpc;
 };
 
-const create$2 = async ({
+const create$3 = async ({
   commandMap,
   isMessagePortOpen,
   messagePort
@@ -1271,7 +1271,7 @@ const create$2 = async ({
   return rpc;
 };
 
-const create$1 = async ({
+const create$2 = async ({
   commandMap
 }) => {
   // TODO create a commandMap per rpc instance
@@ -1302,19 +1302,19 @@ const createMockRpc = ({
   return mockRpc;
 };
 
-const rpcs$2 = Object.create(null);
+const rpcs$3 = Object.create(null);
 const set$a = (id, rpc) => {
-  rpcs$2[id] = rpc;
+  rpcs$3[id] = rpc;
 };
 const get$6 = id => {
-  return rpcs$2[id];
+  return rpcs$3[id];
 };
 const remove$2 = id => {
-  delete rpcs$2[id];
+  delete rpcs$3[id];
 };
 
 /* eslint-disable  @typescript-eslint/explicit-function-return-type */
-const create = rpcId => {
+const create$1 = rpcId => {
   return {
     async dispose() {
       const rpc = get$6(rpcId);
@@ -1351,9 +1351,9 @@ const create = rpcId => {
 };
 
 const {
-  invoke: invoke$5,
+  invoke: invoke$6,
   set: set$9
-} = create(6010);
+} = create$1(6010);
 
 const Web = 1;
 const Electron = 2;
@@ -1366,32 +1366,32 @@ const RendererWorker = 1;
 const SharedProcess = 1492;
 
 const {
-  invoke: invoke$4,
+  invoke: invoke$5,
   set: set$8
-} = create(ErrorWorker);
+} = create$1(ErrorWorker);
 
 const {
-  invoke: invoke$3,
+  invoke: invoke$4,
   set: set$7
-} = create(FileSystemWorker);
+} = create$1(FileSystemWorker);
 const readFile$1 = async uri => {
-  return invoke$3('FileSystem.readFile', uri);
+  return invoke$4('FileSystem.readFile', uri);
 };
 const writeFile = async (uri, content) => {
-  return invoke$3('FileSystem.writeFile', uri, content);
+  return invoke$4('FileSystem.writeFile', uri, content);
 };
 const mkdir = async uri => {
-  return invoke$3('FileSystem.mkdir', uri);
+  return invoke$4('FileSystem.mkdir', uri);
 };
 const exists = async uri => {
-  return invoke$3('FileSystem.exists', uri);
+  return invoke$4('FileSystem.exists', uri);
 };
 
 const {
-  invoke: invoke$2,
+  invoke: invoke$3,
   invokeAndTransfer: invokeAndTransfer$1,
   set: set$6
-} = create(RendererWorker);
+} = create$1(RendererWorker);
 const sendMessagePortToAuthWorker = async (port, rpcId) => {
   const command = 'HandleMessagePort.handleMessagePort';
   await invokeAndTransfer$1('SendMessagePortToExtensionHostWorker.sendMessagePortToAuthWorker', port, command, rpcId);
@@ -1414,9 +1414,9 @@ const sendMessagePortToSharedProcess = async port => {
 };
 
 const {
-  invoke: invoke$1,
+  invoke: invoke$2,
   set: set$5
-} = create(SharedProcess);
+} = create$1(SharedProcess);
 
 const None = 0;
 const Activating = 2;
@@ -1450,18 +1450,18 @@ const createEmptyRuntimeStatus = id => {
     status: None
   };
 };
-const state = {
+const state$1 = {
   extensionsState: createInitialState()
 };
 const get$5 = () => {
-  return state.extensionsState;
+  return state$1.extensionsState;
 };
 const set$4 = newState => {
-  state.extensionsState = newState;
+  state$1.extensionsState = newState;
 };
 const update = newState => {
   set$4({
-    ...state.extensionsState,
+    ...state$1.extensionsState,
     ...newState
   });
 };
@@ -1471,11 +1471,11 @@ const setPlatform = platform => {
   });
 };
 const hasWebExtensionUri = uri => {
-  return state.extensionsState.webExtensions.some(extension => extension.uri === uri);
+  return state$1.extensionsState.webExtensions.some(extension => extension.uri === uri);
 };
 const addExtension$1 = extension => {
   update({
-    webExtensions: [...state.extensionsState.webExtensions, extension]
+    webExtensions: [...state$1.extensionsState.webExtensions, extension]
   });
 };
 const clearCachedExtensions = () => {
@@ -1486,7 +1486,7 @@ const clearCachedExtensions = () => {
 const setRuntimeStatus = status => {
   update({
     runtimeStatuses: {
-      ...state.extensionsState.runtimeStatuses,
+      ...state$1.extensionsState.runtimeStatuses,
       [status.id]: {
         ...status
       }
@@ -1494,7 +1494,7 @@ const setRuntimeStatus = status => {
   });
 };
 const updateRuntimeStatus = (id, statusUpdate) => {
-  const previousStatus = state.extensionsState.runtimeStatuses[id] || createEmptyRuntimeStatus(id);
+  const previousStatus = state$1.extensionsState.runtimeStatuses[id] || createEmptyRuntimeStatus(id);
   setRuntimeStatus({
     ...previousStatus,
     ...statusUpdate,
@@ -1502,7 +1502,7 @@ const updateRuntimeStatus = (id, statusUpdate) => {
   });
 };
 const getRuntimeStatus$1 = extensionId => {
-  return state.extensionsState.runtimeStatuses[extensionId];
+  return state$1.extensionsState.runtimeStatuses[extensionId];
 };
 const omit = (record, id) => {
   const result = {
@@ -1513,9 +1513,9 @@ const omit = (record, id) => {
 };
 const resetExtensionRuntimeState = extensionId => {
   update({
-    activatedExtensions: omit(state.extensionsState.activatedExtensions, extensionId),
-    cachedActivationEvents: omit(state.extensionsState.cachedActivationEvents, extensionId),
-    runtimeStatuses: omit(state.extensionsState.runtimeStatuses, extensionId)
+    activatedExtensions: omit(state$1.extensionsState.activatedExtensions, extensionId),
+    cachedActivationEvents: omit(state$1.extensionsState.cachedActivationEvents, extensionId),
+    runtimeStatuses: omit(state$1.extensionsState.runtimeStatuses, extensionId)
   });
 };
 
@@ -1528,17 +1528,6 @@ const getErrorMessage = error => {
 
 const commandMapRef = {};
 
-const extensionIds = new Set();
-const register = extensionId => {
-  extensionIds.add(extensionId);
-};
-const unregister = extensionId => {
-  extensionIds.delete(extensionId);
-};
-const getRegisteredExtensionIds = () => {
-  return [...extensionIds];
-};
-
 const extensions = Object.create(null);
 const get$4 = extensionId => {
   return extensions[extensionId];
@@ -1565,7 +1554,7 @@ const toFileSystemPath = path => {
 };
 const getExtensionRoot = async extension => {
   if (extension.builtin) {
-    const builtinExtensionsPath = await invoke$2('PlatformPaths.getBuiltinExtensionsPath');
+    const builtinExtensionsPath = await invoke$3('PlatformPaths.getBuiltinExtensionsPath');
     if (typeof builtinExtensionsPath !== 'string') {
       throw new TypeError('builtin extensions path must be a string');
     }
@@ -1595,6 +1584,9 @@ const getNodeRpcInfo = async (extensionId, rpcId) => {
   if (!extension) {
     throw new Error(`Extension ${extensionId} has no declared rpcs`);
   }
+  if (!extension.builtin) {
+    throw new Error(`Node rpc ${rpcId} is only available to built-in extensions`);
+  }
   const rpc = getDeclaredNodeRpc(extension, rpcId);
   const extensionRoot = await getExtensionRoot(extension);
   return {
@@ -1603,6 +1595,111 @@ const getNodeRpcInfo = async (extensionId, rpcId) => {
   };
 };
 
+const isMissingRendererCommand = (error, command) => {
+  const moduleName = command.slice(0, command.indexOf('.'));
+  return error instanceof Error && (error.message.includes(command) || error.message.includes(`module ${moduleName} not found`)) && /command not found|not found/i.test(error.message);
+};
+const createLegacyConnection = () => ({
+  type: 'legacy-proxy'
+});
+const createNodeRpcConnection = async (extensionId, rpcId) => {
+  const {
+    path
+  } = await getNodeRpcInfo(extensionId, rpcId);
+  const {
+    platform
+  } = get$5();
+  if (platform === Remote) {
+    try {
+      const connectionInfo = await invoke$3('ExtensionNodeRpc.createConnection', extensionId, rpcId, path);
+      return {
+        ...connectionInfo,
+        type: 'websocket'
+      };
+    } catch (error) {
+      if (isMissingRendererCommand(error, 'ExtensionNodeRpc.createConnection')) {
+        return createLegacyConnection();
+      }
+      throw error;
+    }
+  }
+  if (platform === Electron) {
+    try {
+      const supported = await invoke$3('ExtensionNodeRpc.supportsDirectConnection');
+      return supported ? {
+        type: 'message-port'
+      } : createLegacyConnection();
+    } catch (error) {
+      if (isMissingRendererCommand(error, 'ExtensionNodeRpc.supportsDirectConnection')) {
+        return createLegacyConnection();
+      }
+      throw error;
+    }
+  }
+  throw new Error('Node rpc is not available on this platform');
+};
+const createNodeRpcMessagePort = async (extensionId, rpcId, port) => {
+  const {
+    platform
+  } = get$5();
+  if (platform !== Electron) {
+    throw new Error('Node rpc message ports are only available in Electron');
+  }
+  const {
+    path
+  } = await getNodeRpcInfo(extensionId, rpcId);
+  await invokeAndTransfer$1('ExtensionNodeRpc.createMessagePort', port, path);
+};
+
+const extensionIds = new Set();
+const register = extensionId => {
+  extensionIds.add(extensionId);
+};
+const unregister = extensionId => {
+  extensionIds.delete(extensionId);
+};
+const getRegisteredExtensionIds = () => {
+  return [...extensionIds];
+};
+
+const rpcs$2 = new Map();
+const state = {
+  nextId: 0
+};
+const getRpc$2 = (extensionId, id) => {
+  const rpc = rpcs$2.get(id);
+  if (!rpc || rpc.extensionId !== extensionId) {
+    throw new Error(`Node rpc ${id} not found`);
+  }
+  return rpc;
+};
+const create = async (extensionId, rpcId) => {
+  const {
+    name,
+    path
+  } = await getNodeRpcInfo(extensionId, rpcId);
+  const rendererRpcId = await invoke$3('ExtensionNodeRpc.create', name, path);
+  const id = ++state.nextId;
+  rpcs$2.set(id, {
+    extensionId,
+    rendererRpcId
+  });
+  return id;
+};
+const invoke$1 = async (extensionId, id, method, ...params) => {
+  const {
+    rendererRpcId
+  } = getRpc$2(extensionId, id);
+  return invoke$3('ExtensionNodeRpc.invoke', rendererRpcId, method, ...params);
+};
+const dispose = async (extensionId, id) => {
+  const {
+    rendererRpcId
+  } = getRpc$2(extensionId, id);
+  rpcs$2.delete(id);
+  await invoke$3('ExtensionNodeRpc.dispose', rendererRpcId);
+};
+
 const cacheName$1 = 'ExtensionSecrets';
 const getRequestUrl = (extensionId, key) => {
   return `https://secret-storage.invalid/${encodeURIComponent(extensionId)}/${encodeURIComponent(key)}`;
@@ -1614,7 +1711,7 @@ const deleteSecret = async (extensionId, key) => {
   string(extensionId);
   string(key);
   if (isElectron()) {
-    await invoke$1('SecretStorage.delete', extensionId, key);
+    await invoke$2('SecretStorage.delete', extensionId, key);
     return;
   }
   const cache = await caches.open(cacheName$1);
@@ -1624,7 +1721,7 @@ const getSecret = async (extensionId, key) => {
   string(extensionId);
   string(key);
   if (isElectron()) {
-    return invoke$1('SecretStorage.get', extensionId, key);
+    return invoke$2('SecretStorage.get', extensionId, key);
   }
   const cache = await caches.open(cacheName$1);
   const response = await cache.match(getRequestUrl(extensionId, key));
@@ -1635,7 +1732,7 @@ const storeSecret = async (extensionId, key, value) => {
   string(key);
   string(value);
   if (isElectron()) {
-    await invoke$1('SecretStorage.store', extensionId, key, value);
+    await invoke$2('SecretStorage.store', extensionId, key, value);
     return;
   }
   const cache = await caches.open(cacheName$1);
@@ -1650,21 +1747,55 @@ class CommandNotFoundError extends Error {
     });
   }
 }
+const allowedElectronPortCommand = 'HandleMessagePortForEmbedsProcess.handleMessagePortForEmbedsProcess';
+const privilegedCommandPrefixes = ['ElectronNet.', 'ClipBoard.', 'DebugSharedProcess.', 'Developer.', 'Electron', 'Exec.', 'ExtensionNodeRpc.', 'FileSystem', 'FileWatcher.', 'IpcParent.', 'PlatformPaths.', 'PersistentFileHandle.', 'Process.', 'RebuildNodePty.', 'SearchProcess.', 'SendMessagePort', 'SharedProcess.', 'TerminalProcess.', 'Transferrable.', 'WebSocketCapability.', 'WebView.compat'];
+const invokeGlobalCommand = (method, ...params) => {
+  const command = commandMapRef[method];
+  if (!command) {
+    throw new CommandNotFoundError(method);
+  }
+  return command(...params);
+};
+const executeCommand$1 = (id, ...args) => {
+  if (privilegedCommandPrefixes.some(prefix => id.startsWith(prefix))) {
+    throw new Error(`Isolated extensions cannot execute privileged command ${id}`);
+  }
+  return invokeGlobalCommand('Extensions.executeCommand', id, ...args);
+};
 const createExtensionCommandMap = extensionId => {
   return {
     ...commandMapRef,
+    'Extensions.createLegacyNodeRpc'(rpcId) {
+      return create(extensionId, rpcId);
+    },
+    'Extensions.createNodeRpcConnection'(rpcId) {
+      return createNodeRpcConnection(extensionId, rpcId);
+    },
+    'Extensions.createNodeRpcMessagePort'(rpcId, port) {
+      return createNodeRpcMessagePort(extensionId, rpcId, port);
+    },
     'Extensions.deleteSecret'(key) {
       return deleteSecret(extensionId, key);
     },
-    'Extensions.getNodeRpcInfo'(rpcId) {
-      return getNodeRpcInfo(extensionId, rpcId);
+    'Extensions.disposeLegacyNodeRpc'(id) {
+      return dispose(extensionId, id);
     },
+    'Extensions.executeCommand': executeCommand$1,
     'Extensions.getSecret'(key) {
       return getSecret(extensionId, key);
     },
+    'Extensions.invokeLegacyNodeRpc'(id, method, ...params) {
+      return invoke$1(extensionId, id, method, ...params);
+    },
     'Extensions.registerFileChangeHandler'() {
       register(extensionId);
     },
+    'Extensions.sendMessagePortToElectron'(port, initialCommand) {
+      if (initialCommand !== allowedElectronPortCommand) {
+        throw new Error(`Isolated extensions cannot send a port using ${initialCommand}`);
+      }
+      return invokeGlobalCommand('Extensions.sendMessagePortToElectron', port, initialCommand);
+    },
     'Extensions.storeSecret'(key, value) {
       return storeSecret(extensionId, key, value);
     },
@@ -1701,7 +1832,7 @@ const remove$1 = extensionId => {
 
 /* eslint-disable @typescript-eslint/prefer-readonly-parameter-types */
 const invoke = (method, ...params) => {
-  return invoke$2(method, ...params);
+  return invoke$3(method, ...params);
 };
 const invokeAndTransfer = (method, ...params) => {
   return invokeAndTransfer$1(method, ...params);
@@ -1728,7 +1859,7 @@ const createIsolatedExtensionHostWorker = async (extensionId, absolutePath, work
   return bindCommandMap(rpc, commandMap);
 };
 const createWorker = (extensionId, absolutePath, workerName, contentSecurityPolicy) => {
-  return createIsolatedExtensionHostWorker(extensionId, absolutePath, workerName, contentSecurityPolicy, create$6, invokeAndTransfer);
+  return createIsolatedExtensionHostWorker(extensionId, absolutePath, workerName, contentSecurityPolicy, create$7, invokeAndTransfer);
 };
 const createAndStoreRpc = async (extensionId, absolutePath, workerName, contentSecurityPolicy, create) => {
   const rpc = await create(extensionId, absolutePath, workerName, contentSecurityPolicy);
@@ -1777,14 +1908,119 @@ const activateIsolatedExtension = async (extensionId, absolutePath, workerName,
   }
 };
 
-const addSemicolon = directive => {
-  return directive.endsWith(';') ? directive : `${directive};`;
+const getOrigin = () => {
+  return globalThis.location?.origin || 'http://localhost';
 };
-const getContentSecurityPolicy = directives => {
-  if (!directives) {
-    return '';
+
+/* eslint-disable @typescript-eslint/prefer-readonly-parameter-types */
+
+const allowedScriptSources = new Set([`'self'`, `'unsafe-eval'`]);
+const reservedDirectives = new Set(['child-src', 'connect-src', 'default-src', 'script-src', 'worker-src']);
+const parseDirective = directive => {
+  if (directive.includes('\n') || directive.includes('\r')) {
+    throw new Error('content security policy directives cannot contain newlines');
+  }
+  return directive.replace(/;$/, '').trim().split(/\s+/);
+};
+const getWorkerUrls = absolutePath => {
+  const applicationUrl = new URL(getOrigin());
+  const workerUrl = new URL(absolutePath, applicationUrl);
+  if (workerUrl.protocol !== 'http:' && workerUrl.protocol !== 'https:') {
+    return {
+      origin: applicationUrl.origin
+    };
+  }
+  const webSocketProtocol = applicationUrl.protocol === 'https:' ? 'wss:' : 'ws:';
+  return {
+    assetSource: new URL('./', workerUrl).href,
+    capabilitySource: `${webSocketProtocol}//${applicationUrl.host}/websocket/capability`,
+    origin: applicationUrl.origin
+  };
+};
+const validateExternalConnectSource = (source, applicationOrigin) => {
+  if (source.includes('*') || source === `'none'`) {
+    throw new Error(`invalid isolated extension connect source ${source}`);
+  }
+  let url;
+  try {
+    url = new URL(source);
+  } catch {
+    throw new Error(`isolated extension connect source must be an absolute URL: ${source}`);
+  }
+  if (!['http:', 'https:', 'ws:', 'wss:'].includes(url.protocol) || !url.hostname || url.username || url.password) {
+    throw new Error(`invalid isolated extension connect source ${source}`);
+  }
+  const applicationUrl = new URL(applicationOrigin);
+  if (url.host === applicationUrl.host) {
+    throw new Error(`isolated extensions cannot allow the application origin in connect-src`);
+  }
+  return source;
+};
+const addScriptSources = (scriptSources, sources) => {
+  for (const source of sources) {
+    if (!allowedScriptSources.has(source)) {
+      throw new Error(`invalid isolated extension script source ${source}`);
+    }
+    scriptSources.add(source);
+  }
+};
+const addConnectSources = (connectSources, sources, assetSource, origin) => {
+  for (const source of sources) {
+    if (source === `'self'`) {
+      if (assetSource) {
+        connectSources.add(assetSource);
+      }
+    } else {
+      connectSources.add(validateExternalConnectSource(source, origin));
+    }
+  }
+};
+const validateDefaultSources = sources => {
+  if (sources.length !== 1 || sources[0] !== `'none'`) {
+    throw new Error(`isolated extension default-src must be 'none'`);
+  }
+};
+const applyDirective = (directive, scriptSources, connectSources, assetSource, origin) => {
+  const [name, ...sources] = parseDirective(directive);
+  if (!name) {
+    return;
+  }
+  if (name === 'default-src') {
+    validateDefaultSources(sources);
+    return;
+  }
+  if (name === 'script-src') {
+    addScriptSources(scriptSources, sources);
+    return;
+  }
+  if (name === 'connect-src') {
+    addConnectSources(connectSources, sources, assetSource, origin);
+    return;
+  }
+  if (reservedDirectives.has(name)) {
+    throw new Error(`isolated extensions cannot override ${name}`);
   }
-  return directives.map(addSemicolon).join(' ');
+};
+const getContentSecurityPolicy = (directives, absolutePath) => {
+  const {
+    assetSource,
+    capabilitySource,
+    origin
+  } = getWorkerUrls(absolutePath);
+  const scriptSources = new Set([`'self'`]);
+  const connectSources = new Set();
+  if (capabilitySource) {
+    connectSources.add(capabilitySource);
+  }
+  if (assetSource) {
+    connectSources.add(assetSource);
+  }
+  const manifestDirectives = directives || [];
+  for (const directive of manifestDirectives) {
+    applyDirective(directive, scriptSources, connectSources, assetSource, origin);
+  }
+  const connectDirective = connectSources.size > 0 ? [...connectSources].join(' ') : `'none'`;
+  return `default-src 'none'; script-src ${[...scriptSources].join(' ')}; worker-src 'none'; child-src 'none'; connect-src ${connectDirective};`;
 };
 
 const rpcs = Object.create(null);
@@ -1859,7 +2095,7 @@ const activateExtension3 = async (extension, absolutePath, activationEvent, plat
     throw new Error(`Extension ${extensionId} does not use the isolated extension API`);
   }
   handleRpcInfos(extension, platform);
-  const contentSecurityPolicy = getContentSecurityPolicy(extension.contentSecurityPolicy);
+  const contentSecurityPolicy = getContentSecurityPolicy(extension.contentSecurityPolicy, absolutePath);
   await activateIsolatedExtension(extensionId, absolutePath, extension.workerName || '', contentSecurityPolicy, activationEvent);
 };
 
@@ -1942,7 +2178,7 @@ const getWebDisabledExtensionIds = async () => {
 };
 const getRemoteDisabledExtensionIds = async () => {
   try {
-    const uri = await invoke$2('WebView.compatSharedProcessInvoke', 'PlatformPaths.getDisabledExtensionsJsonUri');
+    const uri = await invoke$3('WebView.compatSharedProcessInvoke', 'PlatformPaths.getDisabledExtensionsJsonUri');
     const exists$1 = await exists(uri);
     if (!exists$1) {
       return [];
@@ -1981,8 +2217,8 @@ const isHttpLocation = () => {
 };
 const getRuntimeContext = async (assetDir, platform) => {
   const shouldInferPlatform = isMissingPlatform(platform);
-  const resolvedAssetDir = isMissingAssetDir(assetDir) ? await invoke$2('Layout.getAssetDir') : assetDir;
-  const resolvedPlatform = shouldInferPlatform ? await invoke$2('Layout.getPlatform') : platform;
+  const resolvedAssetDir = isMissingAssetDir(assetDir) ? await invoke$3('Layout.getAssetDir') : assetDir;
+  const resolvedPlatform = shouldInferPlatform ? await invoke$3('Layout.getPlatform') : platform;
   if (shouldInferPlatform && isHttpLocation() && isStaticHttpAssetDir(resolvedAssetDir)) {
     return {
       assetDir: resolvedAssetDir,
@@ -2061,7 +2297,7 @@ const stringifyJson = data => {
   return JSON.stringify(data, null, 2) + '\n';
 };
 const getWorkspaceUri = async () => {
-  const workspacePath = await invoke$2('Workspace.getPath');
+  const workspacePath = await invoke$3('Workspace.getPath');
   return toWorkspaceUri(workspacePath);
 };
 const getWorkspaceConfigDirUri = async () => {
@@ -2169,7 +2405,7 @@ const getAllExtensionsWithState = async (extensionsState, assetDir, platform) =>
     const compatibleExtensions = [...webExtensions, ...meta].filter(extension => isExtensionCompatible(extension, resolvedPlatform));
     return getExtensionsWithState(compatibleExtensions, extensionsState, resolvedPlatform);
   }
-  const local = await invoke$1('ExtensionManagement.getAllExtensions');
+  const local = await invoke$2('ExtensionManagement.getAllExtensions');
   return getExtensionsWithState([...local, ...meta], extensionsState, resolvedPlatform);
 };
 
@@ -2194,7 +2430,7 @@ const getAbsolutePath$1 = (extension, assetDir, platform) => {
 };
 const notifyRunningExtensionsChanged = () => {
   setTimeout(() => {
-    void invoke$2('Layout.handleExtensionsChanged');
+    void invoke$3('Layout.handleExtensionsChanged');
   }, 0);
 };
 const doActivateExtension = async (extension, absolutePath, event, platform) => {
@@ -2251,21 +2487,21 @@ const activateByEvent = async (event, assetDir, platform) => {
 const invalidateExtensionsCache = async (extensionId, disabled) => {
   try {
     if (extensionId) {
-      await invoke$2('ExtensionManagement.handleExtensionsCacheInvalidated', extensionId, disabled);
+      await invoke$3('ExtensionManagement.handleExtensionsCacheInvalidated', extensionId, disabled);
       return;
     }
-    await invoke$2('ExtensionManagement.handleExtensionsCacheInvalidated');
+    await invoke$3('ExtensionManagement.handleExtensionsCacheInvalidated');
   } catch {
     // Older renderer workers do not expose the cache invalidation notification.
   }
 };
 
 const handleChange = async _id => {
-  const statusBarVisible = await invoke$2('Layout.getStatusBarVisible');
+  const statusBarVisible = await invoke$3('Layout.getStatusBarVisible');
   if (!statusBarVisible) {
     return;
   }
-  await invoke$2('StatusBar.handleItemsChanged');
+  await invoke$3('StatusBar.handleItemsChanged');
 };
 
 const hasStatusBarItems = extension => {
@@ -2405,7 +2641,7 @@ const disableExtension2$1 = async (id, platform) => {
     };
     await setJson(disabledExtensionsCacheKey, newData);
   } else {
-    await invoke$1('ExtensionManagement.disable', id);
+    await invoke$2('ExtensionManagement.disable', id);
   }
 };
 const enableExtension2$1 = async (id, platform) => {
@@ -2458,7 +2694,7 @@ const enableExtension2 = async (id, platform) => {
   string(id);
   number(platform);
   if (platform === Remote || platform === Electron) {
-    const disabledExtensionsJsonPath = await invoke$2('WebView.compatSharedProcessInvoke', 'PlatformPaths.getDisabledExtensionsJsonUri');
+    const disabledExtensionsJsonPath = await invoke$3('WebView.compatSharedProcessInvoke', 'PlatformPaths.getDisabledExtensionsJsonUri');
     const exists$1 = await exists(disabledExtensionsJsonPath);
     if (!exists$1) {
       return undefined;
@@ -2514,7 +2750,7 @@ const getRpcForCommand = async (extensionsState, id, platform) => {
   return get$3(extensionId);
 };
 const executeRendererCommand = (id, args) => {
-  return invoke$2(id, ...args);
+  return invoke$3(id, ...args);
 };
 const executeCommand = async (extensionsState, id, ...args) => {
   const {
@@ -2546,7 +2782,7 @@ const executeExtensionCommand = async (extensionsState, id, ...args) => {
 
 const getLanguageServerRootUri = async () => {
   try {
-    const workspacePath = await invoke$2('Workspace.getPath');
+    const workspacePath = await invoke$3('Workspace.getPath');
     return typeof workspacePath === 'string' && workspacePath ? workspacePath : undefined;
   } catch {
     return undefined;
@@ -2622,7 +2858,7 @@ const executeLanguageServerCompletion = async (rpc, extension, textDocument, off
   let result;
   try {
     const rootUri = await getLanguageServerRootUri();
-    result = await invoke$1('LanguageServer.complete', {
+    result = await invoke$2('LanguageServer.complete', {
       argv: languageServer.argv,
       id: languageServer.id,
       offset,
@@ -2640,10 +2876,6 @@ const executeLanguageServerCompletion = async (rpc, extension, textDocument, off
   return result.map(sanitizeCompletionItem).filter(item => item !== undefined);
 };
 
-const getOrigin = () => {
-  return globalThis.location?.origin || 'http://localhost';
-};
-
 const getExtensionId$1 = extension => {
   return extension.id || interExtensionId(extension.uri || extension.path || '');
 };
@@ -2658,7 +2890,7 @@ const getRpc$1 = async (extension, assetDir, platform) => {
   }
   handleRpcInfos(extension, platform);
   const absolutePath = getAbsolutePath(extension, assetDir, platform);
-  const contentSecurityPolicy = getContentSecurityPolicy(extension.contentSecurityPolicy);
+  const contentSecurityPolicy = getContentSecurityPolicy(extension.contentSecurityPolicy, absolutePath);
   return getOrCreateIsolatedExtensionHostWorker(extensionId, absolutePath, extension.workerName || '', contentSecurityPolicy);
 };
 
@@ -2736,7 +2968,7 @@ const executeLanguageServerDiagnostic = async (rpc, extension, textDocument) =>
     return [];
   }
   const rootUri = await getLanguageServerRootUri();
-  const result = await invoke$1('LanguageServer.diagnostic', {
+  const result = await invoke$2('LanguageServer.diagnostic', {
     argv: languageServer.argv,
     id: languageServer.id,
     ...(rootUri && {
@@ -3263,10 +3495,10 @@ const getViewActionsDom = async (viewId, uid, assetDir, platform) => {
   }
 };
 const requestViewRerender = async uid => {
-  await invoke$2('Viewlet.executeViewletCommand', uid, 'rerender');
+  await invoke$3('Viewlet.executeViewletCommand', uid, 'rerender');
 };
 const showViewContextMenu = async (uid, viewId, menuId, x, y) => {
-  await invoke$2('ExtensionManagement.showViewContextMenu', uid, viewId, menuId, x, y);
+  await invoke$3('ExtensionManagement.showViewContextMenu', uid, viewId, menuId, x, y);
 };
 const renderViewInstance = async (viewId, uid, assetDir, platform) => {
   const instance = get$1(uid);
@@ -3293,7 +3525,7 @@ const saveViewInstanceState = async (viewId, uid, assetDir, platform) => {
 };
 
 const getAccessToken = (options = {}) => {
-  return invoke$5('Auth.getAccessToken', options);
+  return invoke$6('Auth.getAccessToken', options);
 };
 
 const transparent = (color, factor) => {
@@ -3430,7 +3662,7 @@ const getColorThemeCssCached = async (colorThemeId, platform, getData) => {
 };
 
 const readJson = url => {
-  return invoke$2('FileSystem.readJson', url);
+  return invoke$3('FileSystem.readJson', url);
 };
 
 const join = (pathSeparator, ...parts) => {
@@ -3599,7 +3831,7 @@ const createWebViewIpc = async webView => {
     port1,
     port2
   } = getPortTuple();
-  const rpcPromise = create$2({
+  const rpcPromise = create$3({
     commandMap: {},
     isMessagePortOpen: false,
     messagePort: port2
@@ -3880,7 +4112,7 @@ const handleFileChanges = async (changes = {}) => {
 };
 
 const handleMessagePort = async (port, rpcId) => {
-  await create$7({
+  await create$8({
     commandMap: commandMapRef,
     messagePort: port
   });
@@ -3888,44 +4120,69 @@ const handleMessagePort = async (port, rpcId) => {
 
 const prefix = '[Extension] Uncaught Error: ';
 const handleUncaughtExtensionError = async error => {
-  const prettyError = await invoke$4('Errors.prepare', error);
-  await invoke$4('Errors.print', prettyError, prefix);
+  const prettyError = await invoke$5('Errors.prepare', error);
+  await invoke$5('Errors.print', prettyError, prefix);
 };
 
 const handleViewContextChange = async (uid, viewId, context) => {
-  await invoke$2('ExtensionManagement.handleViewContextChange', uid, viewId, context);
+  await invoke$3('ExtensionManagement.handleViewContextChange', uid, viewId, context);
 };
 
-const getRpcRemote = async () => {
-  const rpc = await create$3({
+const defaultDependencies = {
+  createLegacyWebSocketRpc: create$4,
+  createTransferMessagePortRpc: create$7,
+  createWebSocket(url, protocols) {
+    return new WebSocket(url, [...protocols]);
+  },
+  createWebSocketRpc: create$5,
+  invokeRenderer: invoke$3,
+  sendMessagePortToSharedProcess: sendMessagePortToSharedProcess,
+  setSharedProcess: set$5
+};
+const getRpcRemote = async dependencies => {
+  try {
+    const {
+      protocols,
+      url
+    } = await dependencies.invokeRenderer('WebSocketCapability.create', 'shared-process');
+    const webSocket = dependencies.createWebSocket(url, protocols);
+    return dependencies.createWebSocketRpc({
+      commandMap: commandMapRef,
+      webSocket
+    });
+  } catch (error) {
+    if (!(error instanceof Error && (error.message.includes('WebSocketCapability.create') || error.message.includes('module WebSocketCapability not found')) && /command not found|not found/i.test(error.message))) {
+      throw error;
+    }
+  }
+  return dependencies.createLegacyWebSocketRpc({
     commandMap: commandMapRef,
     type: 'shared-process'
   });
-  return rpc;
 };
-const getRpcElectron = async () => {
-  const rpc = create$6({
+const getRpcElectron = async dependencies => {
+  const rpc = dependencies.createTransferMessagePortRpc({
     commandMap: commandMapRef,
     async send(port) {
-      await sendMessagePortToSharedProcess(port);
+      await dependencies.sendMessagePortToSharedProcess(port);
     }
   });
   return rpc;
 };
-const getRpc = async platform => {
+const getRpc = async (platform, dependencies) => {
   // TODO create connection to shared process
   if (platform === Remote) {
-    return getRpcRemote();
+    return getRpcRemote(dependencies);
   }
   if (platform === Electron) {
-    return getRpcElectron();
+    return getRpcElectron(dependencies);
   }
   return undefined;
 };
-const initializeSharedProcess = async platform => {
-  const rpc = await getRpc(platform);
+const initializeSharedProcess = async (platform, dependencies = defaultDependencies) => {
+  const rpc = await getRpc(platform, dependencies);
   if (rpc) {
-    set$5(rpc);
+    dependencies.setSharedProcess(rpc);
   }
 };
 
@@ -3996,10 +4253,10 @@ const getLanguages = async (platform, assetDir) => {
 };
 
 const getPreference = async key => {
-  return invoke$2('Preferences.get', key);
+  return invoke$3('Preferences.get', key);
 };
 const setPreference = async (key, value) => {
-  await invoke$2('Preferences.update', {
+  await invoke$3('Preferences.update', {
     [key]: value
   });
 };
@@ -4013,7 +4270,7 @@ const sendMessagePortToFileSystemWorker = async port => {
 };
 
 const showQuickPick = async options => {
-  return invoke$2('ExtensionHostQuickPick.showQuickPick', options);
+  return invoke$3('ExtensionHostQuickPick.showQuickPick', options);
 };
 
 const uninstallExtension = async () => {
@@ -4105,7 +4362,7 @@ const commandMap = {
 };
 
 const initializeAuthWorker = async () => {
-  const rpc = await create$5({
+  const rpc = await create$6({
     commandMap: commandMapRef,
     async send(port) {
       await sendMessagePortToAuthWorker(port, 0);
@@ -4115,7 +4372,7 @@ const initializeAuthWorker = async () => {
 };
 
 const initializeErrorWorker = async () => {
-  const rpc = await create$5({
+  const rpc = await create$6({
     commandMap: commandMapRef,
     async send(port) {
       await sendMessagePortToErrorWorker(port, 0);
@@ -4125,7 +4382,7 @@ const initializeErrorWorker = async () => {
 };
 
 const initializeFileSystemWorker = async () => {
-  const rpc = await create$5({
+  const rpc = await create$6({
     commandMap: commandMapRef,
     async send(port) {
       await sendMessagePortToFileSystemWorker$1(port, 0);
@@ -4135,7 +4392,7 @@ const initializeFileSystemWorker = async () => {
 };
 
 const initializeIframeWorker = async () => {
-  const rpc = await create$5({
+  const rpc = await create$6({
     commandMap: {},
     async send(port) {
       await sendMessagePortToIconThemeWorker(port, 0);
@@ -4145,7 +4402,7 @@ const initializeIframeWorker = async () => {
 };
 
 const initializeRendererWorker = async () => {
-  const rpc = await create$1({
+  const rpc = await create$2({
     commandMap: commandMap
   });
   set$6(rpc);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/extension-management-worker",
-  "version": "4.51.0",
+  "version": "4.52.0",
   "description": "Webworker for the Extension Management functionality in Lvce Editor.",
   "keywords": [
     "web-worker"