dsh-code-server-app 0.3.7 → 0.3.9

package/README.en.md

@@ -207,32 +207,42 @@ only the editor knows, and lets editor gestures drive the current session.
   still go through its own `fs` tools; the bridge only *knows about* them.
 - Status bar shows `$(plug) DSH` while connected (click it for the log in the "DSH Editor Bridge" output channel).
 
-### The three channels
+### The channels (since 0.3.9 they live on DSH's webServer under `/code-server-bridge`)
 
 ```
-extension → host   POST /api/code-server/bridge/sync    one round trip: push editor state + take pending events
-extension → host   POST /api/code-server/bridge/ask     push an editor question into the current session
-extension → host   GET  /api/code-server/bridge/health  unauthenticated liveness probe
-host → extension   POST /api/code-server/bridge/event   extension reports open/close etc. (host log tail)
-host → extension   <extensionsDir>/.dshcs-bridge/bridge.json   port + token, re-read by the extension every 5s
+extension → host   POST /code-server-bridge/sync    one round trip: push editor state + take pending events
+extension → host   POST /code-server-bridge/ask     push an editor question into the current session
+extension → host   GET  /code-server-bridge/health  unauthenticated liveness probe
+extension → host   POST /code-server-bridge/event   extension reports open/close etc. (host log tail)
+host → extension   <extensionsDir>/.dshcs-bridge/bridge.json   base URL + token, re-read by the extension every 5s
 ```
 
+> **Why not under `/api` (fixed in 0.3.9)**: Connection puts a Host/Origin/cookie fence on `/api`
+> (`requestRejection` in `packages/client/connection/src/index.ts` → 401 without a cookie), while the bridge's
+> client is a **Node process inside the extension host** — it can never hold a browser cookie, so its requests were
+> rejected before ever reaching the plugin's route. Measured on 0.3.7: the extension polled
+> `/api/code-server/bridge/sync` and got either 405 (it reached the launcher/VS Code instead) or 401 (the /api
+> fence) — the bridge had never actually synced. It now mounts on DSH's own webServer with its own token as the
+> only gate. The cost: the bridge needs DSH to provide `webServer` — **the web profile has it, desktop does not**.
+> On desktop the host writes no `bridge.json` (dormant beats pointing at a dead address) and says so in the log;
+> **file opening is unaffected** (it uses the signal file and works in every mode).
+
 **Why state is pushed, not pulled**: the extension host is a child process of the VS Code server and **listens on
 no port** — the host cannot call into it. Editor state therefore rides the extension's own polling request, and
 the host caches it for the tools (at most one 600 ms cycle behind; older than 10 s and the tool says so instead
 of passing stale data off as fresh).
 
-**Why no SSE/WebSocket**: `ctx.connection.fetch.register` only allows `GET | HEAD | POST` (streaming would need
-the WS mux already owned by `dsh-api-gateway`). Polling also buys two useful properties: it is idempotent (a
-dropped event only costs one notification — the data always lives in the editor) and the cached state is
-inherently fresh.
+**Why no SSE/WebSocket**: the extension host has no HTTP server of its own, and everything DSH can offer is
+request/response (the Connection fetch channel allows only `GET | HEAD | POST`; streaming would need the WS mux
+already owned by `dsh-api-gateway`). Polling also buys two useful properties: it is idempotent (a dropped event
+only costs one notification — the data always lives in the editor) and the cached state is inherently fresh.
 
 ### Security model (four invariants; read before touching `lib/bridge.mjs`)
 
 The token lives in `<extensionsDir>/.dshcs-bridge/bridge.json`, **readable by any process of the same local
 user**, so:
 
-1. **`/api/code-server/bridge/*` is permanently read-only.** No route writes files, edits documents, or runs
+1. **`/code-server-bridge/*` is permanently read-only.** No route writes files, edits documents, or runs
    commands. A leaked token is therefore bounded to "sees information that is in the editor" and **can never**
    become arbitrary file writes or command execution. A whitelist assertion in `scripts/test-bridge-routes.mjs`
    guards this.
@@ -574,10 +584,10 @@ Host/Origin fence and browser auth); in the desktop profile `apps/desktop-host`
 | POST | `/api/code-server/stop` | Stop and recycle the process tree |
 | POST | `/api/code-server/setup` | **Compatibility no-op**: since 0.1.36 dependencies are installed by the package manager, so this only re-runs the env self-check and returns |
 | POST | `/api/code-server/open-file` | body `{ file }` — writes the signal consumed by the built-in `dshcs-open-file` extension to open the file in code-server |
-| GET | `/api/code-server/bridge/health` | **unauthenticated**: `{ ok, bridge, pid, url }` — liveness only, no editor data |
-| POST | `/api/code-server/bridge/sync` | editor bridge: the extension pushes state (`{context, diagnostics, workspace, at}`) and takes back events; `?since=<seq>` is the event cursor. Requires `x-dshcs-bridge-token` |
-| POST | `/api/code-server/bridge/ask` | editor bridge: push an editor question into the current session (`{text, file?, lineStart?, lineEnd?, selection?, languageId?}`); **409** when no session can receive it |
-| POST | `/api/code-server/bridge/event` | editor bridge: extension reports open/close and similar (host log tail). Requires the token |
+| GET | `/code-server-bridge/health` | editor-bridge liveness (**unauthenticated**; no editor data). Mounted on DSH's webServer, not under `/api` |
+| POST | `/code-server-bridge/sync` | editor bridge: the extension pushes state (`{context, diagnostics, workspace, at}`) and takes back events; `?since=<seq>` is the event cursor. Requires `x-dshcs-bridge-token`, and **any Origin header is 403** |
+| POST | `/code-server-bridge/ask` | editor bridge: push an editor question into the current session (`{text, file?, lineStart?, lineEnd?, selection?, languageId?}`); **409** when no session can receive it |
+| POST | `/code-server-bridge/event` | editor bridge: extension reports open/close and similar (host log tail). Requires the token |
 
 > All four bridge routes carry their own token check — they **cannot** rely on DSH's cookie fence, because the
 > extension host has no browser cookie — and they are read-only by construction. See "Working with DSH" above.
@@ -653,9 +663,13 @@ What remains on the plugin side:
 
 ## Known limitations
 
-- **The editor bridge only works under `serve: loopback`.** `serve: dsh` is a named-pipe mode with no dedicated
-  port, so the bridge's "loopback host + own token" model does not apply: it stays disabled there
-  (`bridge.supported=false` in `status`). Use the default `loopback` when you want the integration.
+- **The editor bridge needs DSH to provide `webServer`** (corrected in 0.3.9): its client is a Node process inside
+  the extension host, which can only reach DSH over HTTP at DSH's own origin (the bridge mounts under
+  `BRIDGE_BASE` with its own token). **The web profile has webServer (both `serve: dsh` and loopback) → the bridge
+  works; desktop has none → it stays disabled** (`bridge.supported=false`, no `bridge.json` is written, one log
+  line explains it). **File opening is unaffected**: it uses the signal file and works regardless of mode.
+  Up to 0.3.7 the bridge was registered under `/api/code-server/bridge/*` and was killed by Connection's cookie
+  fence (401) — that was a bug.
 - **Bridged state can lag by up to 600 ms**, and the tools say "stale" rather than serving data older than 10 s.
 - **Unsaved buffers are reported, not taken over.** The agent still edits via its own `fs` tools, i.e. against
   disk. What the bridge adds is a notice *before* writing a dirty file, a diff *after*, and a warning instead of

package/README.md

@@ -203,34 +203,47 @@ DSH 用**资源地址**命名文件,`openFile` 只负责把地址交给右侧栏
 - 编辑器侧的入口还有状态栏的 `$(plug) DSH`(连通时显示,点击打开日志),日志在输出面板
   「DSH Editor Bridge」里 —— 出问题时先看它。
 
-### 三条通道
+### 三条通道(0.3.9 起走 DSH webServer 的 `/code-server-bridge`)
 
 ```
-扩展 → host     POST /api/code-server/bridge/sync   一趟来回:上报编辑器状态 + 取回待处理事件
-扩展 → host     POST /api/code-server/bridge/ask    把编辑器里的提问投进当前会话
-扩展 → host     GET  /api/code-server/bridge/health 无鉴权探活(便于重启后一眼确认)
-host  → 扩展    POST /api/code-server/bridge/event  扩展上报打开/关闭文件等(进 host 日志尾)
-host  → 扩展    <extensionsDir>/.dshcs-bridge/bridge.json  端口 + 令牌(扩展每 5s 重读)
+扩展 → host     POST /code-server-bridge/sync   一趟来回:上报编辑器状态 + 取回待处理事件
+扩展 → host     POST /code-server-bridge/ask    把编辑器里的提问投进当前会话
+扩展 → host     GET  /code-server-bridge/health 无鉴权探活(便于重启后一眼确认)
+扩展 → host     POST /code-server-bridge/event  扩展上报打开/关闭文件等(进 host 日志尾)
+host  → 扩展    <extensionsDir>/.dshcs-bridge/bridge.json  base URL + 令牌(扩展每 5s 重读)
 ```
 
+> **为什么不在 `/api` 下(0.3.9 修正)**:Connection 给 `/api` 装了 Host/Origin/cookie fence
+> (`packages/client/connection/src/index.ts` 里 `requestRejection` → 无 cookie 即 401),而桥的客户端
+> 是扩展宿主里的 **Node 进程** —— 它永远拿不到浏览器 cookie,请求在到达插件路由之前就被挡掉了。
+> 实测(0.3.7):扩展按 `/api/code-server/bridge/sync` 轮询,要么 405(打到 launcher/VS Code)、
+> 要么 401(打到 DSH 的 /api fence),**桥从来没有真正同步过**。
+> 现在桥挂在 DSH 自己的 webServer 前缀下,鉴权完全由桥自己的令牌承担(见下)。
+> 代价:桥需要 DSH 提供 `webServer` —— **web profile 有,desktop 没有**。
+> desktop 下 host 不写 `bridge.json`(宁可休眠,不可指向死地址),并在日志里说明;
+> **文件打开不受影响**(它走信号文件,与 serve 模式无关)。
+
 **为什么状态是"推"而不是"拉"**:扩展宿主是 VS Code server 的一个子进程,**不监听任何端口** ——
 host 反向请求不到它。所以编辑器状态只能在扩展主动发起的那趟轮询里带上来,host 缓存后给工具读
 (缓存滞后最多一个轮询周期 600ms,超过 10s 没更新就判为过期,工具会明说"状态已过期");
 
-**为什么不用 SSE/WebSocket**:`ctx.connection.fetch.register` 的 methods 只允许 `GET | HEAD | POST`
-(流式要另走已被 `dsh-api-gateway` 占用的 WS mux)。轮询反而给了两条好性质:幂等(丢一次事件只是
-少一次提示,数据本身永远在编辑器里),以及状态天然最新(每趟都刷新)。
+**为什么不用 SSE/WebSocket**:扩展宿主里没有 HTTP 服务器,而 DSH 侧能给的无非是请求/响应
+(Connection 的 fetch 通道只允许 `GET | HEAD | POST`,流式要另走已被 `dsh-api-gateway` 占用的 WS mux)。
+轮询反而给了两条好性质:幂等(丢一次事件只是少一次提示,数据本身永远在编辑器里),以及状态天然最新(每趟都刷新)。
 
 ### 安全模型(四条不变量,改 `lib/bridge.mjs` 之前先读)
 
 桥的令牌写在 `<extensionsDir>/.dshcs-bridge/bridge.json`(**对本机同用户进程可读**),所以:
 
-1. **`/api/code-server/bridge/*` 永久只读。** 没有写文件、改文档、执行命令的路由。
+1. **`/code-server-bridge/*` 永久只读。** 没有写文件、改文档、执行命令的路由。
    令牌泄露的爆炸半径被封在"看到编辑器里的信息",**不会**变成任意文件写/任意命令执行。
-   `scripts/test-bridge-routes.mjs` 里有一条白名单断言盯着这件事。
+   `scripts/test-bridge-routes.mjs` 里有一条白名单断言盯着这件事(未知后缀一律 404)。
 2. **带 `Origin` 的请求一律 403。** 浏览器发起必带 Origin(含沙箱 iframe 的 `Origin: null`),
    扩展宿主是 Node 进程、不带。判定顺序上 Origin **先于令牌** —— 否则等于给浏览器一个
    "令牌猜对没有"的 oracle。
+   实现细节:Node 路由 → Fetch 适配器把**原始 headers** 挂在 request 上(`dshcsRawHeaders`),
+   因为 undici 的 `Request` 构造器会把 `origin` 当 forbidden header 归一化掉 —— 读 `request.headers`
+   会让这道 403 静默失效(测试里有这条实测记录)。
 3. **路径收敛在编辑器当前工作区**(`workspaceFolder` 之外的诊断直接丢弃)。
 4. **有界**:诊断默认 200 条 / 单条截断 500 字符 / 上报体上限 256KB / 事件环形缓冲 64 条。
 
@@ -574,15 +587,15 @@ desktop profile 由 `apps/desktop-host` 把 `/api/*` 交给同一个 `createShar
 | POST | `/api/code-server/stop` | 停止并回收进程树 |
 | POST | `/api/code-server/setup` | **兼容空操作**:0.1.36 起依赖由包管理器安装,调用只重新自检 `env` 并返回 |
 | POST | `/api/code-server/open-file` | body `{ file }` — 写信号文件,由内置扩展 `dshcs-open-file` 在 code-server 中打开 |
-| GET | `/api/code-server/bridge/health` | **无鉴权**:`{ ok, bridge, pid, url }`。只回答"桥活着吗",不含任何编辑器数据 |
-| POST | `/api/code-server/bridge/sync` | 编辑器桥:扩展上报状态(`{context, diagnostics, workspace, at}`)并取回事件;`?since=<seq>` 是事件游标。需 `x-dshcs-bridge-token` |
-| POST | `/api/code-server/bridge/ask` | 编辑器桥:把编辑器里的提问投进当前会话(`{text, file?, lineStart?, lineEnd?, selection?, languageId?}`);没有可投递的会话时回 **409** |
-| POST | `/api/code-server/bridge/event` | 编辑器桥:扩展上报打开/关闭文件等(进 host 日志尾)。需令牌 |
+| GET | `/code-server-bridge/health` | 编辑器桥探活(**无鉴权**;只回答"桥活着吗",不含任何编辑器数据)。挂 DSH 的 webServer,不在 `/api` 下 |
+| POST | `/code-server-bridge/sync` | 编辑器桥:扩展上报状态(`{context, diagnostics, workspace, at}`)并取回事件;`?since=<seq>` 是事件游标。需 `x-dshcs-bridge-token`,**带 Origin 一律 403** |
+| POST | `/code-server-bridge/ask` | 编辑器桥:把编辑器里的提问投进当前会话(`{text, file?, lineStart?, lineEnd?, selection?, languageId?}`);没有可投递的会话时回 **409** |
+| POST | `/code-server-bridge/event` | 编辑器桥:扩展上报打开/关闭文件等(进 host 日志尾)。需令牌 |
 
 > 桥的四条路由都自带令牌鉴权(它们**不依赖** DSH 的 cookie fence —— 扩展宿主拿不到浏览器 cookie),
-> 且永远只读。前面的守护规则与取舍见「与 DSH 的协同」。
+> 且永远只读。这也是它们**不能**挂在 `/api` 下的原因(见「与 DSH 的协同」)。
 
-> 插件不再注册 `/code-server/*` 这类 webServer 专有路由;code-server 图标已内联为 data URI(client bundle 内),
+> 除桥之外,插件不再注册任何插件自有 HTTP 路由;code-server 图标已内联为 data URI(client bundle 内),
 > 因此客户端不请求任何插件自有 HTTP 资源。
 
 ## DSH Desktop(无 webServer)
@@ -632,9 +645,12 @@ desktop profile 由 `apps/desktop-host` 把 `/api/*` 交给同一个 `createShar
 
 ## 已知限制
 
-- **编辑器桥只在 `serve: loopback` 下工作**:`serve: dsh` 是管道模式、没有独立端口,桥的
-  "回环 Host + 独立令牌"模型不适用 → 该模式下自动不启用(status 的 `bridge.supported=false`)。
-  需要协同能力就用默认的 `loopback`(0.2.0 起也是默认)。
+- **编辑器桥需要 DSH 提供 `webServer`**(0.3.9 修正):桥的客户端是扩展宿主里的 Node 进程,
+  它只能通过 HTTP 打到 DSH 自己的 origin(桥挂在 `BRIDGE_BASE` 前缀下,自带令牌鉴权)。
+  **web profile(`serve: dsh` 或 loopback 都行)有 webServer → 桥可用;desktop 没有 → 不启用**
+  (status 的 `bridge.supported=false`,host 不写 `bridge.json`,日志里说明一次)。
+  **文件打开不受影响**:它走信号文件,与 serve 模式和 webServer 都无关。
+  0.3.7 及以前把桥挂在 `/api/code-server/bridge/*`,被 Connection 的 cookie fence 401 挡死 —— 那是个 bug。
 - **桥的状态有最多 600ms 滞后**:扩展每 600ms 推一次;超过 10s 没更新时工具会明说"状态已过期"
   而不是拿旧数据当新数据(例如用户在 IDE 里关掉面板之后)。
 - **未保存缓冲区是"上报"而不是"接管"**:agent 仍然通过它自己的 `fs` 工具按磁盘内容编辑。

package/assets/extensions/dshcs-editor-bridge/extension.js

@@ -496,9 +496,11 @@ function activate(context) {
 
   // **方向说明(改之前先读)**:扩展宿主里**没有** HTTP 服务器 —— 它是 VS Code server 的
   // 一个子进程,不监听任何端口。所以 host **不能**反向请求本扩展拿编辑器状态。
-  // 实际方向是:本扩展在每次轮询里 `POST /api/code-server/bridge/sync`,把状态推上去、
+  // 实际方向是:本扩展在每次轮询里 `POST <BRIDGE_BASE>/sync`,把状态推上去、
   // 同时取回 host 的待处理事件(agent 改了哪个文件)。host 侧缓存状态供 agent 工具读。
   // 见 lib/bridge-client.js 的 sync() 与 lib/bridge.mjs 顶部的通道说明。
+  // **路径是 /code-server-bridge,不是 /api/...**(0.3.9 修正):/api 那层要求浏览器 cookie,
+  // 扩展宿主拿不到 ⇒ 请求永远到不了插件路由。
 
   // 命令
   context.subscriptions.push(vscode.commands.registerCommand('dsh-code-server.askAboutSelection', () => {

package/assets/extensions/dshcs-editor-bridge/lib/bridge-client.js

@@ -7,7 +7,7 @@
 // 三条通道里属于扩展的两条:
 //   1. 读 `<extensionsDir>/.dshcs-bridge/bridge.json` —— host 写,扩展**每次请求前重读**
 //      (host 重启会让端口与令牌轮换,而 IDE 进程可能被 adopt 继续活着,env 方案跟不上);
-//   2. `POST /api/code-server/bridge/sync?since=N` —— **一趟来回同时做两件事**:
+//   2. `POST <BRIDGE_BASE>/sync?since=N` —— **一趟来回同时做两件事**:
 //      把编辑器状态(活动文件/脏缓冲区/诊断)推给 host,并取回 host 推来的 agent 改动提示。
 //      为什么合并:扩展宿主里没有 HTTP 服务器,host 反向请求不到它,状态只能由扩展推上来;
 //      而轮询本来就在跑,合并成一个请求就省掉了第二个定时器与一次往返。
@@ -22,6 +22,9 @@ const path = require('path');
  *  里有一条一致性断言,会把两边的字面量放在一起比)。 */
 const BRIDGE_DIRNAME = '.dshcs-bridge';
 const BRIDGE_FILENAME = 'bridge.json';
+/** 桥的挂载前缀。**故意不在 `/api` 下**:那层有 Connection 的 cookie fence,扩展宿主(Node 进程)
+ *  拿不到浏览器 cookie,请求会在到达插件路由之前被 401(0.3.9 修正)。 */
+const BRIDGE_BASE = '/code-server-bridge';
 const TOKEN_HEADER = 'x-dshcs-bridge-token';
 const STATE_FILENAME = 'extension-state.json';
 const REQUEST_TIMEOUT_MS = 3000;
@@ -173,7 +176,7 @@ function createClient(options) {
     },
     /** 轻量探活:host 端点是否可达(不碰编辑器)。 */
     async health() {
-      return request('/api/code-server/bridge/health');
+      return request(`${BRIDGE_BASE}/health`);
     },
     /**
      * **一趟来回:上报编辑器状态 + 取回待处理事件。**
@@ -187,7 +190,7 @@ function createClient(options) {
     async sync(payload) {
       if (refreshConfig(false) === null) return { ok: false, error: 'dormant', status: 0 };
       try {
-        const body = await request(`/api/code-server/bridge/sync?since=${since}`, {
+        const body = await request(`${BRIDGE_BASE}/sync?since=${since}`, {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify(payload),
@@ -203,7 +206,7 @@ function createClient(options) {
     },
     /** 把"选中内容 + 问题"投给 DSH 的当前会话。 */
     async ask(payload) {
-      return request('/api/code-server/bridge/ask', {
+      return request(`${BRIDGE_BASE}/ask`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(payload),
@@ -226,6 +229,7 @@ function createClient(options) {
 module.exports = {
   BRIDGE_DIRNAME,
   BRIDGE_FILENAME,
+  BRIDGE_BASE,
   TOKEN_HEADER,
   STATE_FILENAME,
   POLL_INTERVAL_MS,

package/lib/bridge.mjs

@@ -30,7 +30,7 @@
  *
  * ## 安全不变量(改这个文件之前先读这四条)
  *
- * 1. **`/api/code-server/bridge/*` 命名空间永久只读。** 不允许出现任何写文件、改文档、执行命令、
+ * 1. **`BRIDGE_BASE`(`/code-server-bridge`)命名空间永久只读。** 不允许出现任何写文件、改文档、执行命令、
  *    拉起进程的路由 —— `bridge.json` 里那个令牌对本机同用户进程可读,爆炸半径必须封在
  *    "泄露编辑器里的信息",绝不能变成任意文件写 / 任意命令执行。
  * 2. **带 `Origin` 的请求一律 403。** 浏览器发起的请求必带 Origin,扩展宿主进程不带。
@@ -49,8 +49,15 @@ export const BRIDGE_DIRNAME = '.dshcs-bridge';
 /** 桥配置文件名。 */
 export const BRIDGE_FILENAME = 'bridge.json';
 
-/** 桥路由前缀(与既有 `/api/code-server/*` 同命名空间,便于统一审计)。 */
-export const BRIDGE_BASE = '/api/code-server/bridge';
+/** 桥路由前缀。
+ *
+ *  **故意不放在 `/api` 下(0.3.9 修正)**:Connection 给 `/api` 装了 Host/Origin/cookie fence
+ *  (`packages/client/connection/src/index.ts`:`requestRejection` → 无 cookie 即 401),而桥的客户端是
+ *  VS Code 扩展宿主里的一个 Node 进程 —— 它**永远拿不到浏览器 cookie**,请求在到达插件路由之前就被挡掉了。
+ *  实测(0.3.7):扩展按 `/api/code-server/bridge/sync` 轮询,请求要么 405(打到 launcher/VS Code)、
+ *  要么 401(打到 DSH 的 /api fence),桥从来没有真正同步过。
+ *  现在挂到 DSH 自己的 webServer 前缀下,鉴权完全由桥自己的令牌承担(见下方安全不变量)。 */
+export const BRIDGE_BASE = '/code-server-bridge';
 
 /** 事件环形缓冲上限:超出即丢最旧的(事件是提示,不是数据)。 */
 export const EVENT_RING_MAX = 64;
@@ -162,12 +169,17 @@ function originIsBrowser(origin) {
  * 顺序有意义:**先看 Origin**(浏览器一律拒绝,且不因为令牌碰巧对就放行 ——
  * 否则等于给浏览器一个"令牌对不对"的 oracle),再看令牌。两者都不消耗资源,故放在最前面。
  *
- * @param {Request} request 桥路由收到的请求
+ * header 读取面:`request.dshcsRawHeaders`(DSH webServer 路由给的 Node 原始 headers)优先于
+ * `request.headers` —— 因为 **undici 的 Request 构造器会把 `origin` 当 forbidden header 归一化掉**,
+ * 由它包一层的请求读不到 Origin,那道 403 会静默失效(scripts/test-bridge-routes.mjs 里有实测记录)。
+ *
+ * @param {Request & {dshcsRawHeaders?: {get(name: string): string|null}}} request 桥路由收到的请求
  * @param {string|null} expectedToken 当前桥令牌(未启用时 null)
  */
 export function bridgeGuard(request, expectedToken) {
+  const headers = request?.dshcsRawHeaders ?? request.headers;
   // 不变量 2:浏览器发起必带 Origin(`null` 也算)。扩展宿主(Node)不带。
-  const origin = request.headers.get('origin');
+  const origin = headers.get('origin');
   if (originIsBrowser(origin)) {
     return new Response(JSON.stringify({ ok: false, error: 'bridge 不接受带 Origin 的请求(浏览器一律拒绝)' }), {
       status: 403,
@@ -180,7 +192,7 @@ export function bridgeGuard(request, expectedToken) {
       headers: { 'content-type': 'application/json; charset=utf-8' },
     });
   }
-  const provided = request.headers.get(BRIDGE_TOKEN_HEADER);
+  const provided = headers.get(BRIDGE_TOKEN_HEADER);
   if (!tokenEquals(provided ?? '', expectedToken)) {
     return new Response(JSON.stringify({ ok: false, error: 'unauthorized' }), {
       status: 401,
@@ -197,7 +209,7 @@ export function bridgeGuard(request, expectedToken) {
  * `signal` 来自宿主工具调用的 `exec.signal`,取消即中断。
  *
  * @param {{base: string, token: string}} target 桥目标(启用时由 host 维护)
- * @param {string} route 形如 `/api/code-server/bridge/context`
+ * @param {string} route 形如 `${BRIDGE_BASE}/context`
  * @param {{method?: 'GET'|'POST', body?: unknown, query?: Record<string, string>, signal?: AbortSignal}} [options]
  */
 export async function callBridge(target, route, options = {}) {

package/lib/index.js

@@ -39,6 +39,7 @@ import { aliasNodePathDirs, ensureRuntimeLayout, resolveRuntime, runtimePackageN
 import { MOUNT_PATH, mountOnWebServer } from './serve-dsh.mjs';
 import { DEFAULT_CLAIM_EXTENSIONS, describeClaimPolicy, normalizeClaimExtensions } from './claim-types.js';
 import {
+  BRIDGE_BASE,
   BRIDGE_DIRNAME,
   bodyWithinLimit,
   bridgeGuard,
@@ -210,30 +211,74 @@ const BUNDLED_EXTENSIONS = [
   { name: 'dshcs-editor-bridge', placement: 'user' },
 ];
 
+/** 递归列出扩展源目录里的文件(相对路径,posix 分隔)。
+ *  为什么必须递归:编辑器桥(0.3.7 起)把纯逻辑放在 `lib/*.js` 里(便于单测,不 require('vscode')),
+ *  只拷 `extension.js` 会让扩展加载即 `Cannot find module './lib/bridge-client.js'` —— 而 VS Code
+ *  只会把这种失败记成一条 `Marked extension as removed`,界面上什么都没发生。
+ *  跳过开发期杂物;`.dshcs-bridge` 是运行期元数据目录,不属于扩展本体。
+ *  导出供 scripts/test-bridge-routes.mjs 直接验(它不启动 IDE,而安装发生在 start 里)。 */
+export function listExtensionFiles(srcDir) {
+  const skip = new Set(['node_modules', '.git', '.dshcs-bridge', 'test', 'tests']);
+  const out = [];
+  const walk = (rel) => {
+    const abs = rel === '' ? srcDir : path.join(srcDir, rel);
+    for (const ent of fs.readdirSync(abs, { withFileTypes: true })) {
+      if (skip.has(ent.name)) continue;
+      const next = rel === '' ? ent.name : `${rel}/${ent.name}`;
+      if (ent.isDirectory()) walk(next);
+      else if (ent.isFile()) out.push(next);
+    }
+  };
+  walk('');
+  return out;
+}
+
 /** 内置扩展安装:每次启动调用 —— 缺失**或内容有变化**即同步(自愈,且插件升级后能更新已装的旧副本)。
- *  同时清理"放错位置"的旧副本(用户级/内置两份同时存在会让 VS Code 打架)。 */
-function installBundledExtensions(extensionsDir, userDataDir) {
+ *  源目录里已不存在的文件会从目标里删掉(否则旧版本的 `lib/` 会一直留着)。
+ *  同时清理"放错位置"的旧副本(用户级/内置两份同时存在会让 VS Code 打架)。
+ *  导出供测试直接调(apply 期不装扩展,只有 start 才装)。 */
+export function installBundledExtensions(extensionsDir, userDataDir) {
   const here = path.dirname(fileURLToPath(import.meta.url));
   for (const ext of BUNDLED_EXTENSIONS) {
     try {
       const src = path.join(here, '..', 'assets', 'extensions', ext.name);
       const manifest = path.join(src, 'package.json');
       if (!fs.existsSync(manifest)) continue;
-      const files = ['package.json', 'extension.js'];
+      const files = listExtensionFiles(src);
       const target = extensionTarget(extensionsDir, ext.name, ext.placement);
       const dst = target.dst;
       const stale = files.filter((name) => {
         const to = path.join(dst, name);
         if (!fs.existsSync(to)) return true;
         try {
-          return fs.readFileSync(path.join(src, name), 'utf8') !== fs.readFileSync(to, 'utf8');
+          return !fs.readFileSync(path.join(src, name)).equals(fs.readFileSync(to));
         } catch {
           return true;
         }
       });
       if (stale.length > 0) {
-        fs.mkdirSync(dst, { recursive: true });
-        for (const name of stale) fs.copyFileSync(path.join(src, name), path.join(dst, name));
+        for (const name of stale) {
+          const to = path.join(dst, name);
+          fs.mkdirSync(path.dirname(to), { recursive: true });
+          fs.copyFileSync(path.join(src, name), to);
+        }
+      }
+      // 删除目标里多出来的文件(相对源目录):升级后旧文件不该留在扩展目录里
+      const removed = [];
+      if (fs.existsSync(dst)) {
+        const wanted = new Set(files);
+        const walkDst = (rel) => {
+          const abs = rel === '' ? dst : path.join(dst, rel);
+          for (const ent of fs.readdirSync(abs, { withFileTypes: true })) {
+            const next = rel === '' ? ent.name : `${rel}/${ent.name}`;
+            if (ent.isDirectory()) walkDst(next);
+            else if (ent.isFile() && !wanted.has(next)) {
+              fs.rmSync(path.join(dst, next), { force: true });
+              removed.push(next);
+            }
+          }
+        };
+        walkDst('');
       }
       // 清理放错位置的副本:dshcs-open-file 的旧用户级副本 / 编辑器桥的错误内置副本。
       const wrong = extensionTarget(extensionsDir, ext.name, ext.placement === 'builtin' ? 'user' : 'builtin');
@@ -241,7 +286,8 @@ function installBundledExtensions(extensionsDir, userDataDir) {
         fs.rmSync(wrong.dst, { recursive: true, force: true });
         console.log(`[code-server] 清理放错位置的扩展副本 ${wrong.dst}(${ext.name} 应装在${target.builtin ? '内置' : '用户级'}目录)`);
       }
-      console.log(`[code-server] bundled extension ${ext.name} -> ${dst}${target.builtin ? ' (内置,不可卸载)' : ' (用户级,可禁用)'}${stale.length > 0 ? ` [更新 ${stale.join(',')}]` : ''}`);
+      console.log(`[code-server] bundled extension ${ext.name} -> ${dst}${target.builtin ? ' (内置,不可卸载)' : ' (用户级,可禁用)'}`
+        + `${stale.length > 0 ? ` [更新 ${stale.join(',')}]` : ''}${removed.length > 0 ? ` [清理 ${removed.join(',')}]` : ''}`);
     } catch (err) {
       console.warn(`[code-server] bundled extension ${ext.name} install failed:`, err && err.message ? err.message : String(err));
     }
@@ -497,9 +543,9 @@ export async function apply(ctx, config) {
             // 关掉 → 立刻下线(删配置 + 注销工具);开启 → 若 IDE 在跑就补一份配置。
             if (bridgeSetting === false) {
               clearBridgeRuntime();
-            } else if (state.status === 'running' && state.serve === 'loopback' && Number.isSafeInteger(state.port) && state.port > 0) {
+            } else if (state.status === 'running' && state.pid !== null) {
               bridgeToken ??= mintBridgeToken();
-              syncBridgeRuntime({ host: cfg.host, port: state.port, pid: state.pid, startedAt: state.startedAt });
+              syncBridgeRuntime({ pid: state.pid, startedAt: state.startedAt });
             }
           }
         }
@@ -594,6 +640,79 @@ export async function apply(ctx, config) {
 
   /** 本次启动生成的新桥令牌;null = 本实例没有令牌(adopt 旧实例时会回读 bridge.json)。 */
   let bridgeToken = null;
+  /** 桥的 webServer 挂载点(0.3.9)。null = 本部署没有可挂载的 HTTP 面(desktop)。 */
+  let bridgeMountDispose = null;
+  /** "桥不可用"只提示一次,避免每次起停都刷屏。 */
+  let bridgeUnavailableLogged = false;
+
+  /** 扩展宿主(Node 进程)能到达的 DSH origin;null = 本部署没有这样的 HTTP 面。
+   *
+   *  为什么不能用 launcher 的 host:port(0.3.7 的错误做法):launcher 只服务 workbench,
+   *  **没有任何 `/api` 路由** —— 实测 `POST http://127.0.0.1:8090/<path-token>/api/code-server/bridge/sync`
+   *  会穿透到 VS Code server 并得到 405。
+   *  为什么也不能挂在 `/api` 下(0.3.7 的第二个错误):Connection 给 `/api` 装了 cookie fence
+   *  (`packages/client/connection/src/index.ts`:`requestRejection` → 401),而扩展宿主是 Node 进程、
+   *  永远拿不到浏览器 cookie ⇒ 请求在到达插件路由之前就被 401 掉了。
+   *  所以桥改挂 DSH 自己的 webServer 前缀(`BRIDGE_BASE`),自带令牌校验(见 bridge.mjs 的安全不变量)。 */
+  function bridgeOrigin() {
+    if (webServerSvc === undefined || bridgeMountDispose === null) return null;
+    const port = typeof webServerSvc.port === 'number' ? webServerSvc.port : null;
+    if (port === null || !Number.isSafeInteger(port) || port <= 0) return null;
+    const raw = typeof webServerSvc.config?.host === 'string' ? webServerSvc.config.host : '';
+    const host = raw === '' || raw === '0.0.0.0' || raw === '::' ? '127.0.0.1' : raw;
+    return bridgeUrl(host, port);
+  }
+
+  /** 桥的四条路由(后缀 → Fetch 风格 handler)。做成函数而非常量:handler 声明在文件后段,
+   *  函数声明会提升,而常量在挂载时可能还在 TDZ。 */
+  function bridgeRouteTable() {
+    return [
+      { suffix: '/health', methods: ['GET'], fetch: handleBridgeHealth },
+      { suffix: '/sync', methods: ['POST'], fetch: handleBridgeSync },
+      { suffix: '/ask', methods: ['POST'], fetch: handleBridgeAsk },
+      { suffix: '/event', methods: ['POST'], fetch: handleBridgeEvent },
+    ];
+  }
+
+  /** 把 Fetch 风格 handler 适配成 DSH webServer 的 Node 路由(req/res ⇄ Request/Response)。 */
+  function nodeRouteFromFetch(dispatch) {
+    return async (req, res) => {
+      try {
+        const chunks = [];
+        for await (const chunk of req) chunks.push(chunk);
+        const body = Buffer.concat(chunks);
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? '127.0.0.1'}`);
+        const method = (req.method ?? 'GET').toUpperCase();
+        const response = await dispatch(url, method, req.headers, body);
+        const buffer = Buffer.from(await response.arrayBuffer());
+        const headers = {};
+        response.headers.forEach((value, key) => { headers[key] = value; });
+        res.writeHead(response.status, headers);
+        res.end(buffer);
+      } catch (error) {
+        if (!res.headersSent) res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
+        if (!res.writableEnded) res.end('bridge route error');
+        console.warn(`[code-server] 编辑器桥路由异常:${error && error.message ? error.message : error}`);
+      }
+    };
+  }
+
+  /** 桥挂载点的分发:按后缀查表,方法不符 405,未知路径 404(绝不落到 VS Code 那边)。 */
+  async function dispatchBridge(url, method, headers, body) {
+    const suffix = url.pathname.slice(BRIDGE_BASE.length) || '/';
+    const route = bridgeRouteTable().find((item) => item.suffix === suffix);
+    if (route === undefined) return jsonResponse({ ok: false, error: 'unknown bridge route' }, 404);
+    if (!route.methods.includes(method)) return jsonResponse({ ok: false, error: 'method not allowed' }, 405);
+    const request = new Request(url, {
+      method,
+      headers,
+      ...(method === 'GET' || method === 'HEAD' ? {} : { body }),
+    });
+    // Origin 必须从 Node 的原始 headers 读:undici 的 Request 构造器把 `origin` 当 forbidden header
+    // 归一化掉了,再读 request.headers 会得到 null,bridgeGuard 那道 403 就静默失效。
+    request.dshcsRawHeaders = { get: (name) => headers[String(name).toLowerCase()] ?? null };
+    return route.fetch(request);
+  }
 
   /** 桥是否启用(行配置为种子,设置文档里可实时改)。 */
   function bridgeEnabled() {
@@ -617,14 +736,26 @@ export async function apply(ctx, config) {
   });
 
   /** 同步桥运行时:写入/更新 bridge.json,并(就绪时)注册编辑器工具。
-   *  端口、令牌、pid 三者任一变化都重写 —— 扩展每 5s 重读,故不需要任何推送。 */
-  function syncBridgeRuntime({ host, port, pid, startedAt }) {
+   *  端口、令牌、pid 三者任一变化都重写 —— 扩展每 5s 重读,故不需要任何推送。
+   *  **没有扩展可达的 origin 时(desktop)不写配置**,并清掉可能遗留的旧配置(宁可休眠,不可指向死地址)。 */
+  function syncBridgeRuntime({ pid, startedAt }) {
     if (!bridgeEnabled()) return;
-    if (typeof host !== 'string' || !Number.isSafeInteger(port) || port <= 0) return;
+    const base = bridgeOrigin();
+    if (base === null) {
+      if (bridgeMeta !== null) {
+        bridgeMeta = null;
+        try { removeBridgeConfig(bridgeExtensionsDir); } catch { /* 删不掉也不影响:扩展会因不可达而休眠 */ }
+      }
+      if (!bridgeUnavailableLogged) {
+        bridgeUnavailableLogged = true;
+        console.warn('[code-server] 编辑器桥:本部署没有扩展可达的 HTTP 面(desktop 无 webServer)→ 桥不启用'
+          + '(文件打开走信号文件,不受影响)');
+      }
+      return;
+    }
     bridgeToken ??= mintBridgeToken();
-    const base = bridgeUrl(host, port);
     const changed = bridgeMeta === null || bridgeMeta.url !== base || bridgeMeta.token !== bridgeToken || bridgeMeta.pid !== pid;
-    bridgeMeta = { url: base, token: bridgeToken, pid, startedAt: startedAt ?? null, host, port };
+    bridgeMeta = { url: base, token: bridgeToken, pid, startedAt: startedAt ?? null };
     try {
       writeBridgeConfig(bridgeExtensionsDir, { url: base, token: bridgeToken, pid, startedAt: startedAt ?? null });
     } catch (err) {
@@ -633,7 +764,7 @@ export async function apply(ctx, config) {
     }
     if (changed) {
       // 只打印"已启用",不打印令牌本身(与 path-token 同一决策)。
-      console.log(`[code-server] 编辑器桥:已启用(${base},令牌文件 ${path.join(bridgeMetaDir, 'bridge.json')})`);
+      console.log(`[code-server] 编辑器桥:已启用(${base}${BRIDGE_BASE},令牌文件 ${path.join(bridgeMetaDir, 'bridge.json')})`);
     }
     ensureBridgeTools();
   }
@@ -642,14 +773,18 @@ export async function apply(ctx, config) {
    * 接管实例时对齐桥令牌:磁盘上已有配置且基址一致 → 沿用(避免无谓轮换打乱正在运行的扩展);
    * 否则 mint 新的(扩展下次轮询就会读到新的 bridge.json,一次请求的失败无所谓)。
    */
-  function adoptBridgeRuntime(host, port, pid, startedAt) {
-    if (!bridgeEnabled() || typeof host !== 'string' || !Number.isSafeInteger(port) || port <= 0) return;
+  function adoptBridgeRuntime(pid, startedAt) {
+    if (!bridgeEnabled()) return;
+    const base = bridgeOrigin();
+    if (base === null) {
+      syncBridgeRuntime({ pid, startedAt });
+      return;
+    }
     const existing = readBridgeConfig(bridgeExtensionsDir);
-    const base = bridgeUrl(host, port);
     bridgeToken = existing !== null && existing.url === base && TOKEN_RE.test(String(existing.token))
       ? String(existing.token)
       : mintBridgeToken();
-    syncBridgeRuntime({ host, port, pid, startedAt });
+    syncBridgeRuntime({ pid, startedAt });
   }
 
   /** 注销桥运行时(停止 IDE / 插件卸载):删配置 + 注销工具 + 清缓存,扩展随即休眠。 */
@@ -719,6 +854,19 @@ export async function apply(ctx, config) {
       dshMount = null;
       console.error(`[code-server] serve=dsh 挂载失败(将回退 loopback):${error && error.message ? error.message : error}`);
     }
+    // 编辑器桥(0.3.9):挂在自己的前缀上,自带令牌 —— 走 /api 会被 Connection 的 cookie fence 401
+    // (扩展宿主是 Node 进程,没有浏览器 cookie),详见 bridgeOrigin() 的注释。
+    try {
+      bridgeMountDispose = wsCtx.webServer.register({
+        kind: 'prefix',
+        path: BRIDGE_BASE,
+        handler: nodeRouteFromFetch((url, method, headers, body) => dispatchBridge(url, method, headers, body)),
+      });
+      console.log(`[code-server] 编辑器桥挂载就绪:${BRIDGE_BASE}/* (DSH webServer,桥令牌鉴权)`);
+    } catch (error) {
+      bridgeMountDispose = null;
+      console.warn(`[code-server] 编辑器桥挂载失败(桥不可用):${error && error.message ? error.message : error}`);
+    }
   });
 
   ctx.effect(() => () => {
@@ -728,6 +876,12 @@ export async function apply(ctx, config) {
     }
   }, 'code-server: dsh mount');
 
+  ctx.effect(() => () => {
+    if (bridgeMountDispose === null) return;
+    try { bridgeMountDispose(); } catch { /* ignore */ }
+    bridgeMountDispose = null;
+  }, 'code-server: bridge mount');
+
   /** 回环模式的客户端 URL:随机端口 + 路径令牌(令牌是 URL 路径的一段,浏览器会把子请求与 WS
    *  一并带过去 —— 这正是不走 VS Code 自带 cookie 令牌的原因,见 launcher 文件头"安全模型")。 */
   function loopbackUrl() {
@@ -989,7 +1143,7 @@ export async function apply(ctx, config) {
           state.launchCwd = record.launchCwd ?? record.cwd ?? null;
           state.startedAt = record.startedAt ?? null;
           state.adopted = true;
-          adoptBridgeRuntime(cfg.host, cfg.port, record.pid, state.startedAt);
+          adoptBridgeRuntime(record.pid, state.startedAt);
           return snapshot();
         }
         state.status = 'error';
@@ -1131,15 +1285,13 @@ export async function apply(ctx, config) {
     // 编辑器桥:端口已定(loopback + 已知端口)时写入配置,扩展随即能连上来。
     // 新启动会轮换桥令牌 —— 与路径令牌同一时机(每次新启动都换)。
     // dsh 模式(无独立端口)不启用:桥的 Host 白名单假设是 127.0.0.1:<实际端口>,管道模式没有端口。
-    if (serve === 'loopback' && (cfg.port !== 0 || state.port !== null)) {
-      bridgeToken = mintBridgeToken();
-      syncBridgeRuntime({
-        host: cfg.host,
-        port: state.port,
-        pid: proc.pid ?? null,
-        startedAt: state.startedAt,
-      });
-    }
+    // 桥与 serve 模式无关:只要求"扩展宿主能到达 DSH 的 HTTP 面"(web 有 webServer;
+    // desktop 没有 → syncBridgeRuntime 会自己判定并保持休眠)。
+    bridgeToken = mintBridgeToken();
+    syncBridgeRuntime({
+      pid: proc.pid ?? null,
+      startedAt: state.startedAt,
+    });
 
     proc.on('error', (err) => {
       if (child !== proc) return;
@@ -1414,13 +1566,10 @@ export async function apply(ctx, config) {
     { path: `${API_BASE}/setup`, methods: ['POST'], fetch: handleSetup },
     { path: `${API_BASE}/open-file`, methods: ['POST'], fetch: handleOpenFile },
     { path: `${API_BASE}/ui-mode`, methods: ['POST'], fetch: handleUiMode },
-    // ---- 编辑器桥(0.3.0):扩展侧的 HTTP 面。全部自带令牌鉴权,**命名空间永久只读**。----
-    // 只有 4 条:扩展宿主没有 HTTP 服务器,所以"拿编辑器状态"由扩展在 /sync 里推上来,
-    // host 缓存后供 agent 工具读取(见 lib/bridge.mjs 顶部的通道说明)。
-    { path: `${API_BASE}/bridge/health`, methods: ['GET'], fetch: handleBridgeHealth },
-    { path: `${API_BASE}/bridge/sync`, methods: ['POST'], fetch: handleBridgeSync },
-    { path: `${API_BASE}/bridge/ask`, methods: ['POST'], fetch: handleBridgeAsk },
-    { path: `${API_BASE}/bridge/event`, methods: ['POST'], fetch: handleBridgeEvent },
+    // ---- 编辑器桥的 4 条路由**不在 /api 下**(0.3.9 修正)----
+    // 原因:Connection 给 `/api` 装了 cookie fence(无 cookie → 401),而扩展宿主是 Node 进程、
+    // 永远拿不到浏览器 cookie ⇒ 挂在这里的路由根本到不了(实测:带令牌也被 401/405 挡回)。
+    // 现在挂到 DSH webServer 的 `${BRIDGE_BASE}/*`,自带桥令牌鉴权(见该处注释与 lib/bridge.mjs 的安全不变量)。
   ].map(route => connection.fetch.register({
     path: route.path,
     methods: route.methods,
@@ -1514,7 +1663,7 @@ export async function apply(ctx, config) {
       state.startedAt = record.startedAt ?? null;
       state.adopted = true;
       console.log(`[code-server] adopted running instance pid=${record.pid} port=${adoptPort}(令牌已启用)`);
-      adoptBridgeRuntime(cfg.host, adoptPort, record.pid, state.startedAt);
+      adoptBridgeRuntime(record.pid, state.startedAt);
     } else {
       removePidFile(cfg);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Since 0.3.0 the bundle also ships an editor bridge (assets/extensions/dshcs-editor-bridge): a read-only channel between the in-tree VS Code extension host and DSH, giving the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and letting editor gestures drive the session. The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -96,6 +96,7 @@
     "node-addon-api": "6.1.0",
     "tar": "7.5.22",
     "tas-client": "0.4.3",
+    "tslib": "2.8.1",
     "typescript": "6.0.3",
     "vscode-oniguruma": "1.7.0",
     "vscode-regexpp": "3.1.0",

package/vendor/VENDOR.json

@@ -3,9 +3,9 @@
   "vscodeVersion": "1.137.0",
   "productPath": "stable-b11dabdaca0d3369986975be285db92c8795cea5",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-12T02:24:49.146Z",
+  "preparedAt": "2026-09-12T16:34:30.093Z",
   "source": "registry",
-  "node": "v24.13.1",
+  "node": "v24.21.0",
   "platform": "win32",
   "arch": "arm64",
   "sizeMB": 197.9