dsh-vscode-mode 0.12.0 → 0.13.0

package/src/processTree.ts

@@ -0,0 +1,63 @@
+/** LSP/DAP 共用进程树终止；POSIX 子进程必须 detached 成为独立进程组。 */
+import { spawn, spawnSync } from 'node:child_process'
+import type { ChildProcess } from 'node:child_process'
+import { childEnv } from './childEnv.js'
+
+type Logger = (line: string) => void
+
+/**
+ * 按平台回收进程树；Windows 在父进程仍存活时直接 taskkill /T，避免先杀父丢失后代。
+ * @public
+ * @author ddj 2026年09月28号
+ * @param child 已启动的独立进程组根
+ * @param logger 可选错误记录器
+ * @param sync 宿主 exit 事件中必须同步完成
+ * @param platform 当前系统，测试可注入
+ */
+export function killTree(child: ChildProcess, logger?: Logger, sync = false, platform = process.platform): void {
+  if (!child.pid) return
+  try {
+    if (platform !== 'win32') {
+      process.kill(-child.pid, 'SIGKILL')
+      return
+    }
+    const args = ['/PID', String(child.pid), '/T', '/F']
+    const options = { windowsHide: true, stdio: 'ignore' as const, env: childEnv() }
+    if (sync) {
+      const result = spawnSync('taskkill', args, { ...options, timeout: 5000 })
+      if (result.error) logger?.('taskkill error: ' + String(result.error))
+      return
+    }
+    const killer = spawn('taskkill', args, options)
+    killer.once('error', (error) => logger?.('taskkill error: ' + String(error)))
+    killer.unref()
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ESRCH') logger?.('kill tree error: ' + String(error))
+  }
+}
+
+/**
+ * 停止独立进程树；POSIX 先通知整组，定时升级不依赖根进程 alive 状态。
+ * @public
+ * @author ddj 2026年09月28号
+ * @param child 进程树根
+ * @param logger 可选诊断输出
+ * @param platform 当前系统，测试可注入
+ * @returns 可立即强杀的收尾函数（幂等）
+ */
+export function stopTree(child: ChildProcess, logger?: Logger, platform = process.platform): () => void {
+  let finished = false
+  let timer: NodeJS.Timeout | undefined
+  /** @private @author ddj 2026年09月28号 @description 强杀树并清理升级定时器。 */
+  const finish = (): void => {
+    if (finished) return
+    finished = true
+    if (timer) clearTimeout(timer)
+    killTree(child, logger, false, platform)
+  }
+  if (platform === 'win32') { finish(); return finish }
+  try { if (child.pid) process.kill(-child.pid, 'SIGTERM') } catch { /* 根可能已经退出，仍保留升级 */ }
+  timer = setTimeout(finish, 1500)
+  timer.unref()
+  return finish
+}

package/src/reveal.ts

@@ -11,6 +11,7 @@
  */
 import { spawn } from 'node:child_process'
 import { dirname } from 'node:path'
+import { childEnv } from './childEnv.js'
 
 /** reveal 结果（沿 revert.ts 的 Result 风格）。 */
 export type RevealResult = { ok: true } | { ok: false; error: string }
@@ -42,12 +43,13 @@ export function revealCommand(absPath: string, isDir: boolean, platform: NodeJS.
  * 构造 opener 子进程启动选项。
  * `windowsHide` 必须为 **false**：置 true 会把 Explorer 等 GUI 窗口一起隐藏，
  * 症状即「RPC 回 ok:true 但窗口不出现」（本文件头注释记录的回归）。
- * @author ddj 2026年09月20号
+ * @public
+ * @author ddj 2026年09月28号
  * @param cwd 子进程工作目录（打开文件时用其父目录）
  * @returns child_process.spawn 选项
  */
-export function revealSpawnOpts(cwd: string): { cwd: string; stdio: 'ignore'; windowsHide: false; detached: true } {
-  return { cwd, stdio: 'ignore', windowsHide: false, detached: true }
+export function revealSpawnOpts(cwd: string): { cwd: string; stdio: 'ignore'; windowsHide: false; detached: true; env: NodeJS.ProcessEnv } {
+  return { cwd, stdio: 'ignore', windowsHide: false, detached: true, env: childEnv() }
 }
 
 /**

package/src/routes.ts

@@ -1,183 +1,185 @@
-/**
- * dsh-vscode-mode host — webServer 路由注册（/edrv/rpc、/edrv/assets/*、/edrv/vendor/*）。
- * 迁移自原 src/index.ts 的路由部分，路径/行为一字不改。
- * 作者 ddj 2026-08-20
- */
-import { readFile, stat } from 'node:fs/promises'
-import { extname, join, normalize, resolve, sep } from 'node:path'
+/** Authenticated plugin HTTP routes and offline editor assets. @author ddj 2026年09月28号 */
+import { readFile, realpath, stat } from 'node:fs/promises'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { extname, isAbsolute, join, relative, resolve } from 'node:path'
 import { ROUTE_PREFIX, noteOwnRoute, resetOwnRoutes, routeConflict } from './compat.js'
 import { RPC_PATH } from './shared/rpc.js'
 import type { RpcMethod, RpcRequestMap } from './shared/rpc.js'
 import type { Ctx } from './store.js'
 import { VENDOR_PREFIX, imageDirOf, vendorDirOf } from './paths.js'
+import { admitRoute, readRpc, replyJson } from './httpGuard.js'
 
 const IMG_ROUTES = [
   { url: '/edrv/assets/compare-idle.png', file: 'compare_idle.png' },
   { url: '/edrv/assets/compare-select.png', file: 'compare_select.png' },
 ]
-
-/** Monaco AMD 构建静态资源（随包发布，离线可用；前缀路由 /edrv/vendor/*）。 */
 const VENDOR_MIME: Record<string, string> = {
-  '.js': 'text/javascript; charset=utf-8',
-  '.mjs': 'text/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
-  '.json': 'application/json',
-  '.map': 'application/json',
-  '.ts': 'text/plain; charset=utf-8',
-  '.svg': 'image/svg+xml',
-  '.png': 'image/png',
-  '.gif': 'image/gif',
-  '.ico': 'image/x-icon',
-  '.woff': 'font/woff',
-  '.woff2': 'font/woff2',
-  '.ttf': 'font/ttf',
-  '.html': 'text/html; charset=utf-8',
-  '.md': 'text/markdown',
-  '.bcmap': 'application/octet-stream',
-  '.pfb': 'application/octet-stream',
+  '.js': 'text/javascript; charset=utf-8', '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8', '.json': 'application/json', '.map': 'application/json',
+  '.ts': 'text/plain; charset=utf-8', '.svg': 'image/svg+xml', '.png': 'image/png',
+  '.gif': 'image/gif', '.ico': 'image/x-icon', '.woff': 'font/woff', '.woff2': 'font/woff2',
+  '.ttf': 'font/ttf', '.html': 'text/html; charset=utf-8', '.md': 'text/markdown',
+  '.bcmap': 'application/octet-stream', '.pfb': 'application/octet-stream',
 }
 
-/** 图标目录（paths.ts 统一解析：config.imageDir 覆盖优先，否则插件包 assets/）。 */
-const imgDirOf = (config: unknown): string => imageDirOf(config, import.meta.url)
+type RpcHandler = <M extends RpcMethod>(method: M, args: RpcRequestMap[M]) => Promise<unknown>
+type HttpHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>
+interface PluginRoute { kind: 'exact' | 'prefix'; path: string; methods: string[]; handler: HttpHandler }
 
-/** Monaco AMD 静态目录（随包发布，paths.ts 统一解析）。 */
-const vendorDir = vendorDirOf(import.meta.url)
+// #region RPC
+/**
+ * Serialize RPC results, retaining the binary preview transport.
+ * @author ddj 2026年09月28号
+ * @param res HTTP response.
+ * @param result RPC business result or binary envelope.
+ */
+function sendRpc(res: ServerResponse, result: unknown): void {
+  const envelope = result as { ok?: boolean; binary?: { bytes?: Uint8Array; mime?: string; size?: number; version?: string } } | null
+  const binary = envelope?.binary
+  if (envelope?.ok !== true || !(binary?.bytes instanceof Uint8Array)) {
+    replyJson(res, 200, result)
+    return
+  }
+  res.statusCode = 200
+  res.setHeader('cache-control', 'no-store')
+  res.setHeader('content-type', 'application/octet-stream')
+  res.setHeader('x-edrv-mime', String(binary.mime ?? ''))
+  res.setHeader('x-edrv-version', String(binary.version ?? ''))
+  res.setHeader('x-edrv-size', String(binary.size ?? binary.bytes.byteLength))
+  res.end(Buffer.from(binary.bytes))
+}
 
 /**
- * 注册全部 webServer 路由（带兼容护栏：前缀冲突预警 + 注册失败降级跳过）。
- * @author ddj 2026年08月20号
- * @param ctx DSH 上下文
- * @param config 插件配置（可选 imageDir 等）
- * @param handleRpc RPC 分发入口（method,args → RpcResult）
- * @param onWarning 兼容性警告收集（可选）
+ * Build a bounded RPC handler; authorization is applied by mountRoute.
+ * @author ddj 2026年09月28号
+ * @param dispatch Business dispatcher.
+ * @returns HTTP handler rejecting malformed bodies before dispatch.
  */
-export function registerRoutes(
-  ctx: Ctx,
-  config: unknown,
-  handleRpc: <M extends RpcMethod>(method: M, args: RpcRequestMap[M]) => Promise<unknown>,
-  onWarning?: (warning: string) => void,
-): void {
-  const imgDir = imgDirOf(config)
-  const web = ctx.get('webServer')
-  if (!web) return
+function rpcHandler(dispatch: RpcHandler): HttpHandler {
+  /** @author ddj 2026年09月28号 @param req Admitted request. @param res HTTP response. */
+  async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const decoded = await readRpc(req)
+    if ('status' in decoded) {
+      replyJson(res, decoded.status, { ok: false, error: decoded.error })
+      return
+    }
+    const { method, args } = decoded.input
+    sendRpc(res, await dispatch(method as RpcMethod, args as never))
+  }
+  return handle
+}
+// #endregion
 
-  resetOwnRoutes()
-  const conflict = routeConflict(web, ROUTE_PREFIX)
-  if (conflict) onWarning?.('兼容性：' + conflict)
+// #region Static files
+/**
+ * Check a resolved asset remains under its canonical asset root.
+ * @author ddj 2026年09月28号
+ * @param root Canonical asset directory.
+ * @param target Candidate canonical file path.
+ * @returns Whether the target lies strictly below the root.
+ */
+function assetInside(root: string, target: string): boolean {
+  const rel = relative(root, target)
+  return rel !== '' && rel !== '..' && !rel.startsWith('../') && !rel.startsWith('..\\') && !isAbsolute(rel)
+}
+
+/**
+ * Serve a file with conditional caching, honoring HEAD without loading its body.
+ * @author ddj 2026年09月28号
+ * @param req Admitted GET or HEAD request.
+ * @param res HTTP response.
+ * @param target Canonical asset file.
+ * @param mime Content type.
+ */
+async function sendAsset(req: IncomingMessage, res: ServerResponse, target: string, mime: string): Promise<void> {
+  const info = await stat(target)
+  if (!info.isFile()) { res.statusCode = 404; res.end(); return }
+  const etag = 'W/"' + info.mtimeMs.toString(16) + '-' + info.size.toString(16) + '"'
+  res.setHeader('etag', etag)
+  res.setHeader('cache-control', 'private, max-age=3600')
+  if (req.headers['if-none-match'] === etag) { res.statusCode = 304; res.end(); return }
+  res.statusCode = 200
+  res.setHeader('content-type', mime)
+  res.setHeader('content-length', info.size)
+  res.end(req.method === 'HEAD' ? undefined : await readFile(target))
+}
 
-  /** 护栏注册：重复路由抛错时降级为警告并跳过，不让单条路由拖垮装配。 */
-  const guarded = (route: { kind: 'exact' | 'prefix'; path: string; handler?: unknown }, label: string): (() => void) | undefined => {
+/**
+ * Build an asset handler that refuses traversal and symlinks outside its root.
+ * @author ddj 2026年09月28号
+ * @param directory Static assets directory.
+ * @param prefix URL prefix, absent for a fixed asset filename.
+ * @param filename Optional fixed asset name.
+ * @returns Authenticated route body handler.
+ */
+function assetHandler(directory: string, prefix?: string, filename?: string): HttpHandler {
+  /** @author ddj 2026年09月28号 @param req Admitted request. @param res HTTP response. */
+  async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    try {
+      const pathname = new URL(req.url ?? '/', 'http://localhost').pathname
+      const name = filename ?? decodeURIComponent(pathname.slice(prefix!.length)).replace(/^\/+/, '')
+      if (!name) { res.statusCode = 404; res.end(); return }
+      const root = await realpath(directory)
+      const target = await realpath(resolve(root, name))
+      if (!assetInside(root, target)) { res.statusCode = 403; res.end(); return }
+      await sendAsset(req, res, target, VENDOR_MIME[extname(target)] ?? 'application/octet-stream')
+    } catch {
+      if (!res.headersSent) res.statusCode = 404
+      res.end()
+    }
+  }
+  return handle
+}
+// #endregion
+
+/**
+ * Register one owned route, enforcing authentication before any asset or RPC access.
+ * @author ddj 2026年09月28号
+ * @param ctx Host context.
+ * @param route Plugin route descriptor.
+ * @param warning Optional registration diagnostic sink.
+ */
+function mountRoute(ctx: Ctx, route: PluginRoute, warning?: (text: string) => void): void {
+  /** @author ddj 2026年09月28号 @param req Original HTTP request. @param res HTTP response. */
+  async function guarded(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    if (!admitRoute(ctx, req, res, route.methods)) return
+    try { await route.handler(req, res) } catch {
+      if (!res.headersSent) replyJson(res, 500, { ok: false, error: 'Plugin request failed' })
+      else res.end()
+    }
+  }
+  /** @author ddj 2026年09月28号 @returns Route disposer, or undefined on a registration conflict. */
+  function install(): (() => void) | undefined {
     try {
-      const dispose = web.register(route)
+      const dispose = ctx.get('webServer').register({ kind: route.kind, path: route.path, handler: guarded })
       noteOwnRoute(route.kind, route.path)
       return dispose
     } catch (error) {
-      onWarning?.('兼容性：' + label + ' 注册失败（' + String(error) + '）')
+      warning?.('兼容性：' + route.path + ' 注册失败（' + String(error) + '）')
       return undefined
     }
   }
+  ctx.effect(install, 'edrv: ' + route.path)
+}
 
-  ctx.effect(() => guarded({
-    kind: 'exact',
-    path: RPC_PATH,
-    handler: async (req: unknown, res: { statusCode?: number; setHeader: (k: string, v: string) => void; end: (b?: string | Uint8Array) => void }) => {
-      try {
-        const chunks: Uint8Array[] = []
-        for await (const chunk of req as AsyncIterable<Uint8Array>) chunks.push(chunk)
-        let input: { method?: string; args?: unknown } = {}
-        try {
-          input = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}')
-        } catch (error) {
-          input = {}
-        }
-        const method = (typeof input.method === 'string' ? input.method : '') as RpcMethod
-        const result = await handleRpc(method, (input.args ?? {}) as never)
-        // 二进制预览信封（edrv.readBinary）：octet-stream + 元数据头直出原始字节，
-        // 省 base64 ~33% 体积；错误与其余方法仍走下方 JSON 分支（client 侧据此识别并回退）
-        const bin = (result as { ok?: boolean; binary?: { bytes?: Uint8Array; mime?: string; size?: number; version?: string } } | null)?.binary
-        if (result && (result as { ok?: boolean }).ok === true && bin?.bytes instanceof Uint8Array) {
-          res.statusCode = 200
-          res.setHeader('content-type', 'application/octet-stream')
-          res.setHeader('x-edrv-mime', String(bin.mime ?? ''))
-          res.setHeader('x-edrv-version', String(bin.version ?? ''))
-          res.setHeader('x-edrv-size', String(bin.size ?? bin.bytes.byteLength))
-          res.end(Buffer.from(bin.bytes))
-          return
-        }
-        res.statusCode = 200
-        res.setHeader('content-type', 'application/json')
-        res.end(JSON.stringify(result))
-      } catch (error) {
-        res.statusCode = 500
-        res.end(JSON.stringify({ ok: false, error: String(error) }))
-      }
-    },
-  }, '/edrv/rpc 精确路由'), 'edrv: routes')
-
-  for (const r of IMG_ROUTES) {
-    ctx.effect(() => guarded({
-      kind: 'exact',
-      path: r.url,
-      handler: async (req: unknown, res: { statusCode?: number; setHeader: (k: string, v: string) => void; end: (b?: string | Uint8Array) => void }) => {
-        try {
-          const body = await readFile(imgDir + '/' + r.file)
-          res.statusCode = 200
-          res.setHeader('content-type', 'image/png')
-          res.setHeader('cache-control', 'no-cache')
-          res.end(body)
-        } catch (error) {
-          res.statusCode = 404
-          res.end()
-        }
-      },
-    }, '静态资源 ' + r.file), 'edrv: routes')
+/**
+ * Register plugin RPC and offline asset routes with the official connection fence.
+ * @author ddj 2026年09月28号
+ * @param ctx Host context.
+ * @param config Plugin configuration.
+ * @param handleRpc Business RPC dispatcher.
+ * @param onWarning Optional compatibility diagnostic sink.
+ */
+export function registerRoutes(ctx: Ctx, config: unknown, handleRpc: RpcHandler, onWarning?: (text: string) => void): void {
+  const web = ctx.get('webServer')
+  if (!web) return
+  resetOwnRoutes()
+  const conflict = routeConflict(web, ROUTE_PREFIX)
+  if (conflict) onWarning?.('兼容性：' + conflict)
+  mountRoute(ctx, { kind: 'exact', path: RPC_PATH, methods: ['POST'], handler: rpcHandler(handleRpc) }, onWarning)
+  const images = imageDirOf(config, import.meta.url)
+  for (const image of IMG_ROUTES) {
+    mountRoute(ctx, { kind: 'exact', path: image.url, methods: ['GET', 'HEAD'], handler: assetHandler(images, undefined, image.file) }, onWarning)
   }
-
-  // Monaco Editor AMD 构建：/edrv/vendor/* → assets/vendor/*（路径穿越防护 + 按扩展名 MIME）
-  // ETag 协商缓存：弱 etag（mtime+size），配合 max-age 让浏览器 304 复用，插件升级内容变化自动失效。
-  ctx.effect(() => guarded({
-    kind: 'prefix',
-    path: VENDOR_PREFIX,
-    handler: async (req: { method?: string; url?: string; headers?: Record<string, string | string[] | undefined> }, res: { statusCode?: number; setHeader: (k: string, v: string) => void; end: (b?: string | Uint8Array) => void }) => {
-      try {
-        if (req.method !== 'GET' && req.method !== 'HEAD') {
-          res.statusCode = 405
-          res.end()
-          return
-        }
-        const pathname = new URL(req.url ?? '/', 'http://x').pathname
-        const rel = decodeURIComponent(pathname.slice(VENDOR_PREFIX.length)).replace(/^\/+/, '')
-        if (!rel) { res.statusCode = 404; res.end(); return }
-        const target = resolve(normalize(join(vendorDir, rel)))
-        if (target !== vendorDir && !target.startsWith(vendorDir + sep)) {
-          res.statusCode = 403
-          res.end()
-          return
-        }
-        const info = await stat(target).catch(() => null)
-        if (!info || !info.isFile()) { res.statusCode = 404; res.end(); return }
-        const etag = 'W/"' + info.mtimeMs.toString(16) + '-' + info.size.toString(16) + '"'
-        const reqEtag = (() => {
-          const raw = req.headers?.['if-none-match']
-          if (Array.isArray(raw)) return raw[0]
-          return raw
-        })()
-        if (reqEtag === etag) {
-          res.statusCode = 304
-          res.setHeader('etag', etag)
-          res.end()
-          return
-        }
-        const body = await readFile(target)
-        res.statusCode = 200
-        res.setHeader('content-type', VENDOR_MIME[extname(target)] ?? 'application/octet-stream')
-        res.setHeader('cache-control', 'public, max-age=3600')
-        res.setHeader('etag', etag)
-        res.end(body)
-      } catch (error) {
-        res.statusCode = 404
-        res.end()
-      }
-    },
-  }, '/edrv/vendor 前缀路由'), 'edrv: routes')
+  mountRoute(ctx, { kind: 'prefix', path: VENDOR_PREFIX, methods: ['GET', 'HEAD'], handler: assetHandler(vendorDirOf(import.meta.url), VENDOR_PREFIX) }, onWarning)
 }

package/src/rpc.ts

@@ -38,7 +38,7 @@ import { normalizeFileOpenTool, FILE_OPEN_DEFAULT, FILE_OPEN_SETTINGS_NS, sectio
 import { INTEGRATION_BASE_DEFAULT } from './shared/integration.js'
 import { shellMenuRegister, shellMenuRemove, shellMenuStatus } from './integrate.js'
 import { unityAdd, unityInstall, unityList, unityRemove } from './unityBridge.js'
-import { handoffOpen, pendingState, pollPending } from './externalHandoff.js'
+import { ackPending, handoffOpen, pendingState, pollPending } from './externalHandoff.js'
 import { buildReport } from './compat.js'
 import { findProfileDir, readDevForm, setDevForm } from './devForm.js'
 import { normalizeRel } from './tree.js'
@@ -296,8 +296,8 @@ function activeSessionIds(ctx: Ctx): Set<string> {
 }
 
 /** profile patch 文件定位（依赖本插件的 profile，同 devForm）。 */
-async function patchFileInfo(): Promise<{ profileDir?: string; patchPath?: string }> {
-  const profileDir = findProfileDir()
+async function patchFileInfo(ctx: Ctx): Promise<{ profileDir?: string; patchPath?: string }> {
+  const profileDir = findProfileDir(ctx)
   if (!profileDir) return {}
   return { profileDir, patchPath: join(profileDir, 'cordis.patch.yml') }
 }
@@ -1009,12 +1009,12 @@ export function buildHandlers(
       return { ok: true, fileOpenTool: normalizeFileOpenTool(value?.fileOpenTool), integrationBaseUrl: await integrationBaseUrlOf(ctx), revision: section?.revision }
     },
     'compat': async () => ({ ok: true, report: await buildReport(ctx) }),
-    'vscode.devFormGet': async () => ({ ok: true, devForm: readDevForm() }),
+    'vscode.devFormGet': async () => ({ ok: true, devForm: readDevForm(ctx) }),
     'vscode.devFormSet': async (args) => {
       try {
         const result = await setDevForm(ctx, args.enabled === true, args.path)
         if (!result.ok) return { ok: false, error: result.error ?? '切换开发形态失败' }
-        return { ok: true, devForm: readDevForm(), restart: result.restart }
+        return { ok: true, devForm: readDevForm(ctx), restart: result.restart }
       } catch (error) {
         return { ok: false, error: String(error) }
       }
@@ -1064,7 +1064,7 @@ export function buildHandlers(
     },
     'edrv.unity.install': async (args) => {
       try {
-        return { ok: true, project: await unityInstall(args.path) }
+        return { ok: true, project: await unityInstall(args.path, undefined, { ctx, baseUrl: await integrationBaseUrlOf(ctx) }) }
       } catch (error) {
         return { ok: false, error: String(error) }
       }
@@ -1086,10 +1086,11 @@ export function buildHandlers(
       ok: true,
       ...handoffOpen({ paths: args.paths, line: args.line, column: args.column }),
     }),
-    'edrv.external.pending': async () => ({ ok: true, open: pollPending() }),
+    'edrv.external.pending': async (args) => ({ ok: true, open: pollPending(args) }),
+    'edrv.external.ack': async (args) => ({ ok: true, accepted: ackPending(args) }),
     'edrv.external.pendingState': async (args) => ({
       ok: true,
-      delivered: pendingState(args.token, args.take === true).delivered,
+      ...pendingState(args.token, args.take === true),
     }),
     'edrv.perf.inventory': async () => {
       try {
@@ -1163,7 +1164,7 @@ export function buildHandlers(
     },
     'edrv.perf.configGet': async () => {
       try {
-        const { profileDir, patchPath } = await patchFileInfo()
+        const { profileDir, patchPath } = await patchFileInfo(ctx)
         const block = perfConfigBlock()
         if (!patchPath) return { ok: true, applied: false, block }
         const text = await readFile(patchPath, 'utf8').catch(() => '')
@@ -1175,7 +1176,7 @@ export function buildHandlers(
     },
     'edrv.perf.configApply': async () => {
       try {
-        const { patchPath } = await patchFileInfo()
+        const { patchPath } = await patchFileInfo(ctx)
         if (!patchPath) return { ok: false, error: '未找到依赖本插件的 profile（检查 DSH_HOME/profiles）' }
         const text = await readFile(patchPath, 'utf8').catch(() => '')
         const backup = patchPath + '.bak-' + Date.now()
@@ -1189,7 +1190,7 @@ export function buildHandlers(
     },
     'edrv.perf.configUndo': async () => {
       try {
-        const { patchPath } = await patchFileInfo()
+        const { patchPath } = await patchFileInfo(ctx)
         if (!patchPath) return { ok: false, error: '未找到依赖本插件的 profile（检查 DSH_HOME/profiles）' }
         const backup = await latestPatchBackup(patchPath)
         if (backup) {
@@ -1305,7 +1306,7 @@ export async function handleRpc<M extends RpcMethod>(
   dapHandlers?: Partial<RpcHandlerMap>,
 ): Promise<RpcResult<M>> {
   const handlers = buildHandlers(ctx, registry, searcher, contentSearcher, lspHandlers, aiHandlers, fileVersions, svnHandlers, dapHandlers)
-  const handler = handlers[method]
-  if (!handler) return { ok: false, error: '未知方法: ' + String(method) } as RpcResult<M>
+  const handler = Object.hasOwn(handlers, method) ? handlers[method] : undefined
+  if (typeof handler !== 'function') return { ok: false, error: '未知方法: ' + String(method) } as RpcResult<M>
   return handler(args)
 }

package/src/shared/appUrl.ts

@@ -0,0 +1,19 @@
+/** Browser application URL resolution shared by transport and asset loaders. @author ddj 2026年09月28号 */
+
+/**
+ * Resolve a product-local path under the current application's document base.
+ * Supports HTTP reverse-proxy prefixes and the official Desktop dsh-app origin.
+ * @author ddj 2026年09月28号
+ * @param path Root-shaped internal endpoint or asset path; never an external URL.
+ * @param base Explicit document base for tests; otherwise document.baseURI or location.href.
+ * @returns Absolute application URL, or the original root path outside a browser.
+ */
+export function appUrl(path: string, base?: string): string {
+  if (!path.startsWith('/') || path.startsWith('//')) throw new Error('Expected an application-local path')
+  const source = base ?? (typeof document !== 'undefined' ? document.baseURI : undefined)
+    ?? (typeof location !== 'undefined' ? location.href : undefined)
+  if (!source) return path
+  const root = new URL('.', source)
+  if (!['http:', 'https:', 'dsh-app:'].includes(root.protocol)) throw new Error('Unsupported application origin')
+  return new URL(path.slice(1), root).href
+}

package/src/shared/externalOpen.ts

@@ -21,6 +21,77 @@ export const EDRV_PARAM_KEYS = [EDRV_OPEN_FLAG, EDRV_PATHS_KEY, EDRV_LINE_KEY, E
 /** 路径分隔符（编码后路径不含裸逗号，分隔安全）。 */
 export const PATHS_SEPARATOR = ','
 
+export const OPEN_TTL_MS = 60_000
+export const OPEN_MAX_BYTES = 65_536
+export const OPEN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+export interface InboxOpen extends OpenParams {
+  version: 1
+  requestId: string
+  profile: string
+  createdAt: number
+}
+
+export interface InboxAck {
+  version: 1
+  requestId: string
+  profile: string
+  createdAt: number
+  success: boolean
+  error?: string
+}
+
+/**
+ * Detect the host platform without importing node builtins.
+ * @author ddj 2026年09月28号
+ * @returns Platform name, or an empty string outside Node.
+ */
+function platformName(): string {
+  return typeof process === 'object' && process !== null ? String(process.platform) : ''
+}
+
+/**
+ * Compare profile directories by physical identity, not by spelling.
+ * Windows accepts either separator and folds case; other platforms stay exact.
+ * @author ddj 2026年09月28号
+ * @param left Declared profile directory.
+ * @param right Expected profile directory.
+ * @param platform Platform name for separator and case rules.
+ * @returns Whether both name the same profile.
+ */
+export function sameProfile(left: string, right: string, platform = platformName()): boolean {
+  if (platform === 'win32') {
+    const fold = (value: string) => value.replace(/\//g, '\\').replace(/\\+$/, '').toLowerCase()
+    return fold(left) === fold(right)
+  }
+  return left.replace(/\/+$/, '') === right.replace(/\/+$/, '')
+}
+
+/** @public @author ddj 2026年09月28号
+ * Validate the open-only envelope before accepting filesystem input.
+ * @param value Parsed untrusted JSON.
+ * @param profile Exact expected profile directory.
+ * @param now Current epoch milliseconds.
+ * @param platform Platform name used for profile identity.
+ * @returns A typed request or null.
+ */
+export function parseInboxOpen(value: unknown, profile: string, now = Date.now(), platform = platformName()): InboxOpen | null {
+  if (!value || typeof value !== 'object') return null
+  const row = value as Record<string, unknown>
+  const keys = ['version', 'requestId', 'profile', 'paths', 'line', 'column', 'createdAt']
+  if (Object.keys(row).some((key) => !keys.includes(key))) return null
+  if (row.version !== 1 || typeof row.profile !== 'string' || !sameProfile(row.profile, profile, platform)
+    || typeof row.requestId !== 'string' || !OPEN_ID.test(row.requestId)) return null
+  if (typeof row.createdAt !== 'number' || !Number.isSafeInteger(row.createdAt)) return null
+  if (now - row.createdAt >= OPEN_TTL_MS || row.createdAt > now + 5000) return null
+  if (!Array.isArray(row.paths) || !row.paths.length || row.paths.length > 20) return null
+  if (!row.paths.every((path) => typeof path === 'string' && path.length <= 8192 && !/[\u0000-\u001f]/.test(path) && /^(?:\/|[a-z]:[\\/]|\\\\)/i.test(path))) return null
+  for (const key of ['line', 'column']) {
+    if (row[key] !== undefined && (!Number.isSafeInteger(row[key]) || Number(row[key]) < 1)) return null
+  }
+  return row as unknown as InboxOpen
+}
+
 /** 一次外部深链请求（解析结果）。 */
 export interface OpenParams {
   /** 待打开路径（已解码，首个路径可携带行列）。 */

package/src/shared/integration.ts

@@ -58,6 +58,8 @@ export interface UnityProjectEntry {
   upToDate: boolean
   /** 项目目录不存在。 */
   missingDir: boolean
+  /** 安装时绑定的本机 profile bridge 配置文件。 */
+  bridgeConfigPath?: string
   /** 非法原因（非 Unity 项目根等）。 */
   error?: string
 }