vite-plugin-aipanel 1.2.7 → 1.2.9

package/lib/core/mcp-proxy.cjs

@@ -45,7 +45,9 @@ var __privateWrapper = (obj, member, setter, getter) => ({
 });
 var mcp_proxy_exports = {};
 __export(mcp_proxy_exports, {
-  McpProxy: () => McpProxy
+  CORE_MCP_ARGS: () => CORE_MCP_ARGS,
+  McpProxy: () => McpProxy,
+  filterUserMcpArgs: () => filterUserMcpArgs
 });
 module.exports = __toCommonJS(mcp_proxy_exports);
 var import_node_child_process = require("node:child_process");
@@ -53,8 +55,36 @@ var import_node_readline = require("node:readline");
 var import_node_crypto = __toESM(require("node:crypto"));
 var import_node_path = __toESM(require("node:path"));
 var import_node = require("@aipanel/core/node");
-var _proc, _rl, _messageId, _internalIdBase, _pending, _args, _startPromise, _lastExit, _stderrTail, _idleTimer, _idleTimeout, _McpProxy_instances, doStart_fn, formatNotAvailable_fn, resetIdleTimer_fn;
+var _proc, _rl, _messageId, _internalIdBase, _pending, _args, _env, _startPromise, _lastExit, _stderrTail, _idleTimer, _idleTimeout, _McpProxy_instances, doStart_fn, formatNotAvailable_fn, resetIdleTimer_fn;
 const log = (0, import_node.createLogger)("McpProxy");
+const CORE_MCP_ARGS = [
+  "--auto-connect",
+  "--no-usage-statistics",
+  "--no-performance-crux",
+  // chrome-devtools-mcp >=1.8.0 默认开启 pageIdRouting（要求每个页面级工具都传 pageId）。
+  // 代理层已自行校验 pageId 并用 select_page 选中目标页面后再转发，故显式关闭，
+  // 避免底层工具 schema 强制必填 pageId 导致转发时的参数校验失败。
+  "--no-page-id-routing"
+];
+const PROTECTED_FLAGS = /* @__PURE__ */ new Set([
+  "auto-connect",
+  "usage-statistics",
+  "performance-crux",
+  "page-id-routing"
+]);
+function canonicalFlagName(arg) {
+  let flag = arg.trim();
+  if (!flag.startsWith("-")) return null;
+  flag = flag.replace(/^--?/, "").split("=")[0] ?? "";
+  if (flag.startsWith("no-")) flag = flag.slice(3);
+  return flag || null;
+}
+function filterUserMcpArgs(userArgs) {
+  return userArgs.filter((arg) => {
+    const name = canonicalFlagName(arg);
+    return name === null || !PROTECTED_FLAGS.has(name);
+  });
+}
 function resolveChromeDevToolsMcpBin() {
   const pluginDir = (0, import_node.resolvePackageDir)("vite-plugin-aipanel");
   const require2 = (0, import_node.createPackageRequire)(pluginDir);
@@ -74,6 +104,7 @@ class McpProxy {
     __privateAdd(this, _internalIdBase, 1e6);
     __privateAdd(this, _pending, /* @__PURE__ */ new Map());
     __privateAdd(this, _args);
+    __privateAdd(this, _env);
     __privateAdd(this, _startPromise, null);
     /** 最近一次进程退出信息，用于生成精确错误（无退出记录时为 null） */
     __privateAdd(this, _lastExit, null);
@@ -82,15 +113,14 @@ class McpProxy {
     __privateAdd(this, _idleTimer, null);
     __privateAdd(this, _idleTimeout);
     __publicField(this, "sessionId");
-    __privateSet(this, _args, options.args ?? [
-      "--auto-connect",
-      "--no-usage-statistics",
-      "--no-performance-crux",
-      // chrome-devtools-mcp >=1.8.0 默认开启 pageIdRouting（要求每个页面级工具都传 pageId）。
-      // 代理层已自行校验 pageId 并用 select_page 选中目标页面后再转发，故显式关闭，
-      // 避免底层工具 schema 强制必填 pageId 导致转发时的参数校验失败。
-      "--no-page-id-routing"
-    ]);
+    const userArgs = options.userArgs ?? [];
+    const filtered = filterUserMcpArgs(userArgs);
+    if (filtered.length !== userArgs.length) {
+      const dropped = userArgs.filter((a) => !filtered.includes(a));
+      log.warn("chrome MCP \u7528\u6237\u53C2\u6570\u4E0E\u6838\u5FC3\u53D7\u4FDD\u62A4\u9879\u51B2\u7A81\uFF0C\u5DF2\u5FFD\u7565", { dropped });
+    }
+    __privateSet(this, _args, [...filtered, ...CORE_MCP_ARGS]);
+    __privateSet(this, _env, options.env);
     __privateSet(this, _idleTimeout, options.idleTimeout ?? 0);
     this.sessionId = import_node_crypto.default.randomUUID();
   }
@@ -184,6 +214,7 @@ _messageId = new WeakMap();
 _internalIdBase = new WeakMap();
 _pending = new WeakMap();
 _args = new WeakMap();
+_env = new WeakMap();
 _startPromise = new WeakMap();
 _lastExit = new WeakMap();
 _stderrTail = new WeakMap();
@@ -197,7 +228,8 @@ doStart_fn = async function() {
     __privateSet(this, _lastExit, null);
     __privateSet(this, _stderrTail, []);
     __privateSet(this, _proc, (0, import_node_child_process.spawn)(process.execPath, [binPath, ...__privateGet(this, _args)], {
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, ...__privateGet(this, _env) }
     }));
     log.debug("Using local chrome-devtools-mcp");
   } catch {
@@ -287,5 +319,7 @@ resetIdleTimer_fn = function() {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  McpProxy
+  CORE_MCP_ARGS,
+  McpProxy,
+  filterUserMcpArgs
 });

package/lib/core/mcp-proxy.d.ts

@@ -1,5 +1,12 @@
+/** chrome-devtools-mcp 的核心受保护参数（用户不可覆盖；始终最后注入确保生效） */
+export declare const CORE_MCP_ARGS: readonly ["--auto-connect", "--no-usage-statistics", "--no-performance-crux", "--no-page-id-routing"];
+/** 过滤用户透传参数：剔除与核心受保护 flag 冲突的项，其余原样保留 */
+export declare function filterUserMcpArgs(userArgs: readonly string[]): string[];
 export interface McpProxyOptions {
-    args?: string[];
+    /** 用户透传的额外 CLI 参数（追加；与核心受保护项冲突的会被剔除） */
+    userArgs?: string[];
+    /** 用户透传的额外环境变量（合并到 process.env 之上） */
+    env?: Record<string, string>;
     idleTimeout?: number;
 }
 export declare class McpProxy {

package/lib/core/proxy-server.cjs

@@ -32,11 +32,13 @@ __export(proxy_server_exports, {
 module.exports = __toCommonJS(proxy_server_exports);
 var import_http = __toESM(require("http"));
 var import_core = require("@aipanel/core");
-const log = (0, import_core.createLogger)("ProxyServer");
+var import_node = require("@aipanel/core/node");
+const log = (0, import_node.createLogger)("ProxyServer");
 function startProxyServer(targetUrl, port, options = {}) {
   return new Promise((resolve, reject) => {
     const target = new URL(targetUrl);
     const bridgeScript = options.bridgeScript ?? "";
+    const webAuthCookie = options.webAuthCookie ?? "";
     const agent = new import_http.default.Agent({
       keepAlive: true,
       keepAliveMsecs: 3e4,
@@ -64,6 +66,9 @@ function startProxyServer(targetUrl, port, options = {}) {
         headers: {
           ...req.headers,
           host: target.host,
+          // 注入 Provider Web 服务的 browser-session 认证 Cookie：代理作为已认证客户端
+          // 替 iframe 里的浏览器完成 dsh 0.1.2+ 的会话认证（浏览器无需换取/携带该 Cookie）。
+          ...webAuthCookie ? { cookie: webAuthCookie } : {},
           // 上游（如 dsh 的 trust fence）校验 Origin 必须匹配自身 origin；
           // 页面经代理访问时浏览器发的 Origin 是代理端口，须改写为目标 origin 否则 403
           origin: `http://${target.host}`,
@@ -81,18 +86,20 @@ function startProxyServer(targetUrl, port, options = {}) {
           });
           proxyRes.on("end", () => {
             let body = Buffer.concat(chunks).toString("utf-8");
-            if (body.match(/<\/head>/i)) {
-              body = body.replace(
-                /<\/head>/i,
-                `<script src="${import_core.BRIDGE_SCRIPT_PATH}"></script></head>`
-              );
-            } else if (body.match(/<\/body>/i)) {
-              body = body.replace(
-                /<\/body>/i,
-                `<script src="${import_core.BRIDGE_SCRIPT_PATH}"></script></body>`
-              );
-            } else {
-              body += `<script src="${import_core.BRIDGE_SCRIPT_PATH}"></script>`;
+            if (bridgeScript.trim().length > 0) {
+              if (body.match(/<\/head>/i)) {
+                body = body.replace(
+                  /<\/head>/i,
+                  `<script src="${import_core.BRIDGE_SCRIPT_PATH}"></script></head>`
+                );
+              } else if (body.match(/<\/body>/i)) {
+                body = body.replace(
+                  /<\/body>/i,
+                  `<script src="${import_core.BRIDGE_SCRIPT_PATH}"></script></body>`
+                );
+              } else {
+                body += `<script src="${import_core.BRIDGE_SCRIPT_PATH}"></script>`;
+              }
             }
             const headers = {};
             for (const [key, value] of Object.entries(proxyRes.headers)) {
@@ -136,6 +143,8 @@ function startProxyServer(targetUrl, port, options = {}) {
         headers: {
           ...req.headers,
           host: target.host,
+          // 与 HTTP 分支一致：注入认证 Cookie，通过 dsh 0.1.2+ 的 browser-auth 门禁
+          ...webAuthCookie ? { cookie: webAuthCookie } : {},
           // 与 HTTP 分支一致：改写 Origin 为目标 origin，通过 dsh 的 trust fence
           origin: `http://${target.host}`
         }

package/lib/core/proxy-server.d.ts

@@ -4,6 +4,13 @@ export interface ProxyServerOptions {
     bridgeScript?: string;
     /** 绑定地址，需与端口检查使用的地址族一致，避免 IPv4/IPv6 不匹配 */
     hostname?: string;
+    /**
+     * Provider Web 服务的 browser-session 认证 Cookie（dsh 0.1.2+ 需要）。
+     * 代理在转发每个请求（含 WebSocket 升级）时把该 Cookie 注入到上游请求头，
+     * 使浏览器免于亲自换取/携带会话 Cookie（避免跨端口/跨站 SameSite 限制），
+     * 同时通过上游 /api 的 browser-auth 门禁。
+     */
+    webAuthCookie?: string;
 }
 export interface ProxyServerResult {
     server: http.Server;

package/lib/core/service.cjs

@@ -22,6 +22,7 @@ __export(service_exports, {
   AIPanelService: () => AIPanelService
 });
 module.exports = __toCommonJS(service_exports);
+var import_node_crypto = require("node:crypto");
 var import_core = require("@aipanel/core");
 var import_node = require("@aipanel/core/node");
 var import_system = require("../utils/system.cjs");
@@ -47,6 +48,11 @@ class AIPanelService {
     __publicField(this, "mcp", null);
     __publicField(this, "provider", null);
     __publicField(this, "unsubscribeEvents", null);
+    /**
+     * 宿主事件推送令牌（每轮 start 随机生成）。Provider 侧 Host 插件（dsh-plugin）推送
+     * ProviderEvent 时须携带该令牌，core 校验通过后按 SESSION_EVENT 广播给 SSE 客户端。
+     */
+    __publicField(this, "eventsToken", null);
     this.actualWebPort = config.webPort;
     this.actualProxyPort = config.proxyPort ?? import_core.DEFAULT_PROXY_PORT;
   }
@@ -81,6 +87,7 @@ class AIPanelService {
       throw new Error("Provider \u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 setProvider");
     }
     this.startPromise = (async () => {
+      this.eventsToken = (0, import_node_crypto.randomUUID)();
       const timer = log.timer("startServices", {
         corsOrigins,
         contextApiUrl,
@@ -117,6 +124,7 @@ class AIPanelService {
       this.sendTaskUpdate("preparing_runtime");
       this.sendTaskUpdate("starting_web");
       let webUrl;
+      let webAuthCookie;
       try {
         const startResult = await provider.start({
           port: this.actualWebPort,
@@ -127,11 +135,14 @@ class AIPanelService {
           contextApiUrl,
           logsApiUrl,
           verbose: this.config.verbose,
-          vueDevtoolsApiUrl
+          vueDevtoolsApiUrl,
+          // 宿主事件推送令牌：provider 将其注入 Host 插件（dsh-plugin）配置，用于回推事件鉴权
+          eventsToken: this.eventsToken ?? void 0
         });
         this.webProcess = startResult.processHandle ?? null;
         timer.checkpoint("Web process started");
         webUrl = startResult.url;
+        webAuthCookie = startResult.webAuthCookie;
         log.debug(`Waiting for Web UI to become ready at ${webUrl}...`);
         this.sendTaskUpdate("waiting_web_ready");
         await (0, import_system.waitForServer)(webUrl, import_core.SERVER_START_TIMEOUT, this.webProcess ?? void 0);
@@ -168,7 +179,8 @@ class AIPanelService {
       try {
         const result = await (0, import_proxy_server.startProxyServer)(webUrl, this.actualProxyPort, {
           bridgeScript: provider.bridgeScript,
-          hostname: this.config.hostname
+          hostname: this.config.hostname,
+          webAuthCookie
         });
         this.proxyServer = result.server;
         if (result.actualPort !== this.actualProxyPort) {
@@ -185,7 +197,8 @@ class AIPanelService {
           const nextPort = await (0, import_node.findAvailablePort)(this.actualProxyPort + 1, this.config.hostname);
           const result = await (0, import_proxy_server.startProxyServer)(webUrl, nextPort, {
             bridgeScript: provider.bridgeScript,
-            hostname: this.config.hostname
+            hostname: this.config.hostname,
+            webAuthCookie
           });
           this.proxyServer = result.server;
           this.actualProxyPort = result.actualPort;
@@ -220,15 +233,7 @@ class AIPanelService {
       this.isStarted = true;
       this.unsubscribeEvents?.();
       this.unsubscribeEvents = provider.subscribeEvents((event) => {
-        this.sseClients.forEach((client) => {
-          try {
-            client.write(`data: ${JSON.stringify({ type: "SESSION_EVENT", event })}
-
-`);
-          } catch (e) {
-            log.debug("Failed to send SESSION_EVENT", { error: e });
-          }
-        });
+        this.pushProviderEvent(event);
       });
       if (warmupFailed) {
         this.sendTaskUpdate("chrome_mcp_failed", {
@@ -242,6 +247,18 @@ class AIPanelService {
     })();
     return this.startPromise;
   }
+  /** 把一条 ProviderEvent 广播给所有 SSE 客户端（SESSION_EVENT 载荷） */
+  pushProviderEvent(event) {
+    this.sseClients.forEach((client) => {
+      try {
+        client.write(`data: ${JSON.stringify({ type: "SESSION_EVENT", event })}
+
+`);
+      } catch (e) {
+        log.debug("Failed to send SESSION_EVENT", { error: e });
+      }
+    });
+  }
   async retryWarmupChromeMcp() {
     if (!this.mcp) {
       return { success: false, errorType: "UNKNOWN", errorMessage: "MCP not initialized" };
@@ -271,6 +288,7 @@ class AIPanelService {
     log.info("Stopping Web UI services...");
     this.unsubscribeEvents?.();
     this.unsubscribeEvents = null;
+    this.eventsToken = null;
     if (this.proxyServer) {
       log.debug("Closing proxy server");
       this.proxyServer.close();

package/lib/core/service.d.ts

@@ -1,6 +1,6 @@
 import type { ResultPromise } from "execa";
 import type http from "http";
-import type { PluginOptions, ServiceStartupTask, WebProvider } from "@aipanel/core";
+import type { PluginOptions, ProviderEvent, ServiceStartupTask, WebProvider } from "@aipanel/core";
 import { ChromeMcpWarmupErrorType } from "@aipanel/core";
 import type { McpProxy } from "./mcp-proxy";
 export declare class AIPanelService {
@@ -25,11 +25,18 @@ export declare class AIPanelService {
     private mcp;
     private provider;
     private unsubscribeEvents;
+    /**
+     * 宿主事件推送令牌（每轮 start 随机生成）。Provider 侧 Host 插件（dsh-plugin）推送
+     * ProviderEvent 时须携带该令牌，core 校验通过后按 SESSION_EVENT 广播给 SSE 客户端。
+     */
+    eventsToken: string | null;
     constructor(config: Required<PluginOptions>, sseClients: Set<http.ServerResponse>, onPortAllocated: (port: number) => void, onProxyPortAllocated: (port: number) => void);
     /** 设置 Provider（由编排层动态加载后调用） */
     setProvider(provider: WebProvider): void;
     private sendTaskUpdate;
     start(vitePort: number, corsOrigins: string[], contextApiUrl: string, logsApiUrl: string, viteOrigin: string, mcp: McpProxy, vueDevtoolsApiUrl?: string): Promise<void>;
+    /** 把一条 ProviderEvent 广播给所有 SSE 客户端（SESSION_EVENT 载荷） */
+    pushProviderEvent(event: ProviderEvent): void;
     retryWarmupChromeMcp(): Promise<{
         success: boolean;
         errorType?: string;

package/lib/endpoints/host-events.cjs

@@ -0,0 +1,100 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var host_events_exports = {};
+__export(host_events_exports, {
+  setupHostEventsEndpoint: () => setupHostEventsEndpoint
+});
+module.exports = __toCommonJS(host_events_exports);
+var import_core = require("@aipanel/core");
+var import_node = require("@aipanel/core/node");
+const log = (0, import_node.createLogger)("Endpoints:HostEvents");
+function setupHostEventsEndpoint(server, ctx) {
+  server.middlewares.use(import_core.HOST_EVENTS_API_PATH, async (req, res) => {
+    const reqCtx = new import_node.RequestContext(req.method || "GET", import_core.HOST_EVENTS_API_PATH);
+    res.setHeader("Content-Type", "application/json");
+    if (req.headers.origin) {
+      res.writeHead(403);
+      res.end(JSON.stringify({ error: "forbidden" }));
+      reqCtx.end(403);
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      reqCtx.end(204);
+      return;
+    }
+    if (req.method !== "POST") {
+      res.writeHead(405);
+      res.end(JSON.stringify({ error: "method not allowed" }));
+      reqCtx.end(405);
+      return;
+    }
+    let body = "";
+    req.on("data", (chunk) => body += chunk.toString());
+    req.on("error", () => {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: "request error" }));
+      reqCtx.end(400);
+    });
+    req.on("end", () => {
+      try {
+        const data = JSON.parse(body);
+        const expected = ctx.eventsToken;
+        if (!expected || data.token !== expected) {
+          res.writeHead(403);
+          res.end(JSON.stringify({ error: "invalid token" }));
+          reqCtx.end(403);
+          return;
+        }
+        const event = data.event;
+        if (!isProviderEvent(event)) {
+          res.writeHead(400);
+          res.end(JSON.stringify({ error: "invalid event" }));
+          reqCtx.end(400);
+          return;
+        }
+        ctx.pushProviderEvent(event);
+        res.writeHead(200);
+        res.end(JSON.stringify({ ok: true }));
+        reqCtx.end(200);
+      } catch {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: "invalid json" }));
+        reqCtx.end(400);
+      }
+    });
+  });
+}
+function isProviderEvent(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.type === "session.status" || v.type === "thinking") {
+    return typeof v.sessionId === "string" && v.sessionId.length > 0;
+  }
+  if (v.type === "session.updated") {
+    const s = v.session;
+    return typeof s === "object" && s !== null && typeof s.id === "string";
+  }
+  if (v.type === "connected") return true;
+  return false;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  setupHostEventsEndpoint
+});

package/lib/endpoints/host-events.d.ts

@@ -0,0 +1,8 @@
+import type { ViteDevServer } from "vite";
+import type { EndpointContext } from "./types";
+/**
+ * 宿主侧事件推送端点（dsh-plugin 等 Host 插件 → core → SSE 广播）。
+ * 只允许无浏览器 Origin 的服务端请求：携带每轮启动随机令牌（x-aipanel-token 头或 body.token），
+ * 通过校验后按 SESSION_EVENT 广播给全部 SSE 客户端（与 provider.subscribeEvents 同一通道）。
+ */
+export declare function setupHostEventsEndpoint(server: ViteDevServer, ctx: EndpointContext): void;

package/lib/endpoints/index.cjs

@@ -28,6 +28,7 @@ var import_widget = require("./widget.cjs");
 var import_context = require("./context.cjs");
 var import_start = require("./start.cjs");
 var import_sse = require("./sse.cjs");
+var import_host_events = require("./host-events.cjs");
 var import_sessions = require("./sessions.cjs");
 var import_warmup = require("./warmup.cjs");
 var import_logs = require("./logs.cjs");
@@ -40,6 +41,7 @@ function setupMiddlewares(server, ctx, mcp, logFiles) {
   (0, import_context.setupContextEndpoint)(server, ctx);
   (0, import_start.setupStartEndpoint)(server, ctx);
   (0, import_sse.setupSseEndpoint)(server, ctx);
+  (0, import_host_events.setupHostEventsEndpoint)(server, ctx);
   (0, import_sessions.setupSessionsEndpoint)(server, ctx);
   (0, import_warmup.setupWarmupEndpoint)(server, ctx);
   (0, import_logs.setupLogsEndpoint)(server);

package/lib/endpoints/sessions.cjs

@@ -39,8 +39,10 @@ function setupSessionsEndpoint(server, ctx) {
     try {
       if (req.method === "GET") {
         reqCtx.checkpoint("Fetching sessions");
+        const url = new URL(req.url || "", `http://${req.headers.host}`);
+        const activeSessionId = url.searchParams.get("current") || void 0;
         const [sessions, capabilities] = await Promise.all([
-          ctx.getSessions(),
+          ctx.getSessions(activeSessionId),
           ctx.getCapabilities()
         ]);
         res.writeHead(200);

package/lib/endpoints/start.cjs

@@ -24,7 +24,7 @@ var import_core = require("@aipanel/core");
 var import_node = require("@aipanel/core/node");
 function setupStartEndpoint(server, ctx) {
   server.middlewares.use(import_core.START_API_PATH, async (_req, res) => {
-    const reqCtx = new import_node.RequestContext("GET", import_core.START_API_PATH);
+    const reqCtx = new import_node.RequestContext("GET", import_core.START_API_PATH, { quiet: true });
     res.setHeader("Content-Type", "application/json");
     res.setHeader("Access-Control-Allow-Origin", "*");
     res.writeHead(200);

package/lib/endpoints/types.d.ts

@@ -1,4 +1,4 @@
-import type { ChatSession, PageContext, ProviderCapabilities, ServiceStartupTask } from "@aipanel/core";
+import type { ChatSession, PageContext, ProviderCapabilities, ProviderEvent, ServiceStartupTask } from "@aipanel/core";
 import type http from "http";
 export interface EndpointContext {
     get webUrl(): string | null;
@@ -19,11 +19,16 @@ export interface EndpointContext {
     get actualProxyPort(): number;
     get actualWebPort(): number;
     get serviceInstanceId(): string;
-    getSessions: () => Promise<ChatSession[]>;
+    /** 获取会话列表；activeSessionId（当前选中会话）由客户端传入，供 Provider 对齐 UI 可见性规则 */
+    getSessions: (activeSessionId?: string) => Promise<ChatSession[]>;
     createSession: () => Promise<ChatSession>;
     deleteSession: (id: string) => Promise<void>;
     /** 获取当前 Provider 能力描述（客户端自适应行为依据） */
     getCapabilities: () => ProviderCapabilities;
+    /** 宿主事件推送令牌（Host 插件回推 ProviderEvent 时鉴权用；未启动时 null） */
+    get eventsToken(): string | null;
+    /** 广播一条 ProviderEvent 给所有 SSE 客户端（SESSION_EVENT 载荷；Host 插件回推与 Provider 订阅共用） */
+    pushProviderEvent: (event: ProviderEvent) => void;
     resolveWidgetPath: () => string;
     resolveWidgetStylePath: () => string;
     retryWarmupChromeMcp: () => Promise<{

package/lib/index.cjs

@@ -57,7 +57,7 @@ const SILENT_CONTEXT_SCRIPT = `<script>
     if (!force && key === last) return;
     last = key;
     var sessionId = "";
-    try { sessionId = sessionStorage.getItem("_aipanel_pk") || ""; } catch (e) {}
+    try { sessionId = sessionStorage.getItem("${import_core.SESSION_ID_KEY}") || ""; } catch (e) {}
     fetch(API, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -113,7 +113,12 @@ function createAIPanelPlugin(options = {}) {
   let activeTabId = DEFAULT_TAB;
   const serviceInstanceId = import_crypto.default.randomUUID();
   const sseClients = /* @__PURE__ */ new Set();
-  const mcpProxy = new import_mcp_proxy.McpProxy({ idleTimeout: 5 * 60 * 1e3 });
+  const mcpProxy = new import_mcp_proxy.McpProxy({
+    idleTimeout: 5 * 60 * 1e3,
+    // 用户 chrome MCP 透传：追加 args/env（核心受保护参数不可覆盖，由 McpProxy 过滤）
+    userArgs: config.chromeMcp?.args,
+    env: config.chromeMcp?.env
+  });
   let provider = null;
   const service = new import_service.AIPanelService(
     config,
@@ -180,9 +185,15 @@ function createAIPanelPlugin(options = {}) {
           get serviceInstanceId() {
             return serviceInstanceId;
           },
-          getSessions: () => {
+          get eventsToken() {
+            return service.eventsToken;
+          },
+          pushProviderEvent(event) {
+            service.pushProviderEvent(event);
+          },
+          getSessions: (activeSessionId) => {
             if (!provider) return Promise.reject(new Error("Provider \u672A\u521D\u59CB\u5316"));
-            return provider.listSessions(service.workspaceRoot);
+            return provider.listSessions(service.workspaceRoot, activeSessionId);
           },
           createSession: () => {
             if (!provider) return Promise.reject(new Error("Provider \u672A\u521D\u59CB\u5316"));
@@ -323,7 +334,7 @@ function createAIPanelPlugin(options = {}) {
       ];
       const titleInject = `<script>
         (function () {
-          var KEY = "_aipanel_pk";
+          var KEY = "${import_core.SESSION_ID_KEY}";
           if (!sessionStorage.getItem(KEY)) {
             sessionStorage.setItem(KEY, "[" + Math.random().toString(36).slice(2, 10) + "]");
           }

package/lib/utils/format-bridge.cjs

@@ -24,20 +24,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_fs = __toESM(require("fs"));
 var import_http = __toESM(require("http"));
 var import_path = __toESM(require("path"));
+var import_core = require("@aipanel/core");
 const filePath = process.argv[2];
 if (!filePath) {
   console.error("Usage: node format-bridge.cjs <filePath>");
   process.exit(1);
 }
 const absPath = import_path.default.resolve(filePath);
-const PORT = parseInt(process.env.AIPANEL_VSCODE_PORT || "", 10) || 51939;
+const PORT = parseInt(process.env[import_core.ENV_VSCODE_PORT] || "", 10) || import_core.VSCODE_EXTENSION_PORT;
 function touchFile() {
   const now = /* @__PURE__ */ new Date();
   import_fs.default.utimesSync(absPath, now, now);
 }
 function probeHealth() {
   return new Promise((resolve) => {
-    const req = import_http.default.get(`http://127.0.0.1:${PORT}/health`, (res) => {
+    const req = import_http.default.get(`http://${import_core.DEFAULT_HOSTNAME}:${PORT}${import_core.VSCODE_ROUTE_HEALTH}`, (res) => {
       res.resume();
       resolve(res.statusCode === 200);
     });
@@ -53,9 +54,9 @@ function formatViaExtension() {
     const body = JSON.stringify({ filePath: absPath });
     const req = import_http.default.request(
       {
-        hostname: "127.0.0.1",
+        hostname: import_core.DEFAULT_HOSTNAME,
         port: PORT,
-        path: "/format",
+        path: import_core.VSCODE_ROUTE_FORMAT,
         method: "POST",
         headers: { "Content-Type": "application/json" },
         timeout: 5e3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-aipanel",
-  "version": "1.2.7",
+  "version": "1.2.9",
   "description": "Embed OpenCode Web UI in your Vite dev server for real-time code modification and preview",
   "type": "module",
   "main": "lib/index.cjs",
@@ -41,12 +41,12 @@
     "execa": "^9.6.1",
     "typescript-language-server": "^5.3.0",
     "unplugin-vue-inspector": "^3.0.0",
-    "@aipanel/core": "1.2.7",
-    "@aipanel/provider-opencode": "1.2.7"
+    "@aipanel/core": "1.2.9",
+    "@aipanel/provider-opencode": "1.2.9"
   },
   "peerDependencies": {
     "vite": ">=5.0.0",
-    "@aipanel/provider-deepseek": "1.2.7"
+    "@aipanel/provider-deepseek": "1.2.9"
   },
   "peerDependenciesMeta": {
     "@aipanel/provider-deepseek": {
@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "sharp": "^0.34.5",
-    "@aipanel/client": "1.2.7"
+    "@aipanel/client": "1.2.9"
   },
   "scripts": {
     "build": "pagoda-cli build && vite build -c vite.client.config.ts",