🔒 全面加固跨世界 GM RPC、用户脚本与 Agent 边界

docs/architecture.md

@@ -86,7 +86,7 @@ Each context is a separate bundle (see [Build pipeline & manifest](./references/
 | Context | Entry | Realm / capabilities | Bootstraps |
 |---|---|---|---|
 | **Service Worker** | [`src/service_worker.ts`](../src/service_worker.ts) | No DOM. Owns `chrome.*` privileged APIs, storage, permissions, routing. | `ExtensionMessage(true)` → `Server("serviceWorker")` + `MessageQueue` → `ServiceWorkerManager` |
-| **Content** | [`src/content.ts`](../src/content.ts) | Isolated content-script world. Bridges SW and the page. | `CustomEventMessage` channel to inject + `Server("content")` → `ScriptRuntime` |
+| **Content** | [`src/content.ts`](../src/content.ts) | `USER_SCRIPT` world. Uses a native extension channel for bootstrap, GM RPC, value updates, and callbacks; dedicated USER_SCRIPT listeners are preferred, with a token-bound regular port fallback when they cannot be registered. Retains a narrow DOM channel for synchronous node helpers. | `ExtensionMessage` + native callback port → `Server("content")` → `ScriptRuntime`; `CustomEventMessage` only for DOM handles |
 | **Inject** | [`src/inject.ts`](../src/inject.ts) | Page (`MAIN`) world. Has `unsafeWindow`; runs page userscripts. | `CustomEventMessage` to content + `Server("inject")` |
 | **Offscreen** | [`src/offscreen.ts`](../src/offscreen.ts) | DOM-capable background page (Blobs, clipboard, DOM scraping, local storage). | `ExtensionMessage()` + `WindowMessage(window, sandbox)` → `OffscreenManager` |
 | **Sandbox** | [`src/sandbox.ts`](../src/sandbox.ts) | `sandbox`ed iframe inside offscreen. Evaluates background/scheduled scripts; runs cron. | `WindowMessage(window, parent)` + `Server("sandbox")` → `SandboxManager` |
@@ -167,7 +167,7 @@ communication styles** over **several transports**.
 
 | Class | File | Connects | Underlying API |
 |---|---|---|---|
-| `ExtensionMessage` | [`extension_message.ts`](../packages/message/extension_message.ts) | SW ↔ Content / Inject / Offscreen | `chrome.runtime.sendMessage` / `onConnect` (+ `onUserScript*` on Firefox) |
+| `ExtensionMessage` | [`extension_message.ts`](../packages/message/extension_message.ts) | SW ↔ Content / Inject / Offscreen | `chrome.runtime.sendMessage` / `onConnect` (+ `onUserScript*` on Firefox; token-bound regular-port fallback when dedicated listeners are unavailable) |
 | `CustomEventMessage` | [`custom_event_message.ts`](../packages/message/custom_event_message.ts) | Content ↔ Inject | DOM `CustomEvent` dispatch (bypasses page tampering) |
 | `WindowMessage` | [`window_message.ts`](../packages/message/window_message.ts) | Offscreen ↔ Sandbox | `window.postMessage` |
 | `ServiceWorkerMessageSend` | [`window_message.ts`](../packages/message/window_message.ts) | SW → Offscreen (Chrome) | `clients.matchAll()` + `postMessage` |

docs/references/architecture-execution.md

@@ -24,12 +24,12 @@ go through a controlled context object instead of the page's real globals:
 Key points:
 
 - `with(arguments[0]||this.$)` makes every bare identifier resolve against the GM context first. The context is
-  a `Proxy` that intercepts reads, so the script sees `unsafeWindow`, the granted `GM_*` functions, and a
-  controlled view of globals — not the raw page scope.
+  a descriptor-based pseudo-window that projects `unsafeWindow`, the granted `GM_*` functions, and a controlled
+  view of globals — not the raw page scope. It is a compatibility projection rather than a security membrane.
 - Context and script name are passed as **unnamed `arguments`** (`arguments[0]`, `arguments[1]`) so user code
   can't shadow them by declaring variables of the same name.
-- `.call(this)` preserves `this` because `chrome.userScripts` invokes the function free-standing (an arrow
-  function would capture the wrong `this`).
+- The wrapper installs the body as a temporary method and removes it in the same expression. This preserves the
+  userscript `this` without resolving mutable page `call`, `apply`, or `bind` properties.
 
 ### Path A — Page scripts → `chrome.userScripts`
 
@@ -38,7 +38,9 @@ patterns and registers the compiled payload (the `scripting` bundle) with `chrom
 `MAIN` or `USER_SCRIPT` world as required. At document time the content/inject pair
 ([`script_runtime.ts`](../../src/app/service/content/script_runtime.ts),
 [`exec_script.ts`](../../src/app/service/content/exec_script.ts)) evaluates the compiled function with the GM
-context.
+context. The `USER_SCRIPT` content path obtains its matched scripts directly from the service worker over
+`ExtensionMessage`; the isolated `scripting` bundle keeps the page-observable event bridge for `MAIN` execution and
+the synchronous DOM helper only.
 
 ### Path B — Background scripts → Offscreen → Sandbox
 

docs/references/architecture-gm-api.md

@@ -7,12 +7,15 @@ across contexts to a privileged handler, then streams the result back. The imple
 
 - **Content side** ([`src/app/service/content/gm_api/`](../../src/app/service/content/gm_api)) — what runs *near*
   the userscript. Synchronous-feeling APIs (`GM_getValue`, `GM_log`) and the client half of async ones
-  (`GM_xmlhttpRequest`, `GM_setValue`). Built on `GM_Base`, which owns the messaging plumbing.
+  (`GM_xmlhttpRequest`, `GM_setValue`). Built on `GM_Base`, which owns the request facade. `USER_SCRIPT` calls use
+  the native extension channel; the DOM helper remains a narrow synchronous `CustomEventMessage` path.
 - **Service-worker side** ([`src/app/service/service_worker/gm_api/`](../../src/app/service/service_worker/gm_api))
   — the privileged half: permission verification, cross-origin requests, DNR rule building.
 - **Offscreen side** ([`src/app/service/offscreen/gm_api.ts`](../../src/app/service/offscreen/gm_api.ts)) —
   DOM-dependent operations for background scripts (page-context XHR, `window.open`, clipboard).
-- **Values** flow through `ValueService` and are broadcast so every tab running the same script sees updates.
+- **Values** flow through `ValueService`. MAIN updates use the scripting broadcast, while USER_SCRIPT updates are
+  delivered over the native per-document callback port so privileged packets do not cross the page-observable DOM
+  channel.
 
 ### Registration: the `@GMContext.API` decorator
 

packages/message/common.ts

@@ -8,9 +8,14 @@ export const CustomEventClone = CustomEvent;
 const performanceClone = (process.env.VI_TESTING === "true" ? new EventTarget() : performance) as Performance;
 
 // 避免页面载入后改动 EventTarget.prototype 的方法导致消息传递失败
-export const pageDispatchEvent = performanceClone.dispatchEvent.bind(performanceClone);
-export const pageAddEventListener = performanceClone.addEventListener.bind(performanceClone);
-export const pageRemoveEventListener = performanceClone.removeEventListener.bind(performanceClone);
+const nativeReflectApply = Reflect.apply;
+const nativeFunctionBind = Function.prototype.bind;
+const bindNative = <T extends (...args: any[]) => any>(fn: T, receiver: any): T =>
+  nativeReflectApply(nativeFunctionBind, fn, [receiver]) as T;
+
+export const pageDispatchEvent = bindNative(performanceClone.dispatchEvent, performanceClone);
+export const pageAddEventListener = bindNative(performanceClone.addEventListener, performanceClone);
+export const pageRemoveEventListener = bindNative(performanceClone.removeEventListener, performanceClone);
 const detailClone = typeof cloneInto === "function" ? cloneInto : null;
 export const pageDispatchCustomEvent = <T = any>(eventType: string, detail: T) => {
   if (detailClone && detail) detail = <T>detailClone(detail, performanceClone);

packages/message/custom_event_message.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { CustomEventMessage } from "./custom_event_message";
 import { createMouseEvent, pageDispatchEvent } from "@Packages/message/common";
 
@@ -17,6 +17,30 @@ function createMessagePair() {
 }
 
 describe("CustomEventMessage relatedTarget lifecycle", () => {
+  it("ignores accessor envelopes without executing their getters", () => {
+    const receiver = new CustomEventMessage(`custom-event-message-test-${++flagCounter}`, true, "");
+    const received = vi.fn();
+    receiver.onMessage(received);
+    const envelope: Record<string, unknown> = {
+      messageId: "hostile",
+      type: "sendMessage",
+      data: { action: "custom-event-message-test/hostile" },
+    };
+    let accessed = false;
+    Object.defineProperty(envelope, "data", {
+      configurable: true,
+      enumerable: true,
+      get() {
+        accessed = true;
+        throw new Error("page getter executed");
+      },
+    });
+
+    expect(() => receiver.messageHandle(envelope as any, { postMessage: vi.fn() })).not.toThrow();
+    expect(accessed).toBe(false);
+    expect(received).not.toHaveBeenCalled();
+  });
+
   it("stores a received target on the receiving message until it is consumed", () => {
     const { sender, receiver } = createMessagePair();
     const target = document.createElement("div");

packages/message/custom_event_message.ts

@@ -1,6 +1,11 @@
 import type { Message, MessageConnect, RuntimeMessageSender, TMessage } from "./types";
 import { uuidv4 } from "@App/pkg/utils/uuid";
-import { type PostMessage, type WindowMessageBody, WindowMessageConnect } from "./window_message";
+import {
+  parseWindowMessageBody,
+  type PostMessage,
+  type WindowMessageBody,
+  WindowMessageConnect,
+} from "./window_message";
 import EventEmitter from "eventemitter3";
 import { DefinedFlags } from "@App/app/service/service_worker/runtime.consts";
 import {
@@ -78,6 +83,9 @@ export class CustomEventMessage implements Message {
   }
 
   messageHandle(data: WindowMessageBody, target: PostMessage) {
+    const safeData = parseWindowMessageBody(data);
+    if (!safeData) return;
+    data = safeData;
     // 处理消息
     if (data.type === "sendMessage") {
       // 接收到消息

packages/message/extension_message.test.ts

@@ -0,0 +1,123 @@
+import { describe, expect, it, vi } from "vitest";
+import { ExtensionContentMessageSend, ExtensionMessage, ExtensionMessageConnect } from "./extension_message";
+
+describe("ExtensionMessage USER_SCRIPT compatibility", () => {
+  it("reports a failed dedicated listener registration so USER_SCRIPT can use the regular-port fallback", () => {
+    const runtime = chrome.runtime as unknown as {
+      onUserScriptConnect?: { addListener: (callback: (...args: any[]) => void) => void };
+      onUserScriptMessage?: { addListener: (callback: (...args: any[]) => void) => void };
+      messageListener?: Array<(message: any, sender: any, sendResponse: (response: any) => void) => void>;
+      connectListener?: Array<(port: chrome.runtime.Port) => void>;
+    };
+    const originalConnect = runtime.onUserScriptConnect;
+    const originalMessage = runtime.onUserScriptMessage;
+    const initialMessageListenerCount = runtime.messageListener?.length ?? 0;
+    const initialConnectListenerCount = runtime.connectListener?.length ?? 0;
+    try {
+      runtime.onUserScriptConnect = {
+        addListener: () => {
+          throw new Error("userScripts permission unavailable");
+        },
+      };
+      runtime.onUserScriptMessage = {
+        addListener: () => {
+          throw new Error("userScripts permission unavailable");
+        },
+      };
+      const message = new ExtensionMessage(true);
+      message.onConnect(() => undefined);
+      message.onMessage(() => undefined);
+
+      const response = vi.fn();
+      const listeners = runtime.messageListener ?? [];
+      listeners.at(-1)?.({ type: "userScripts.LISTEN_CONNECTIONS" }, {}, response);
+
+      expect(response).toHaveBeenCalledWith(false);
+    } finally {
+      if (runtime.messageListener) runtime.messageListener.length = initialMessageListenerCount;
+      if (runtime.connectListener) runtime.connectListener.length = initialConnectListenerCount;
+      runtime.onUserScriptConnect = originalConnect;
+      runtime.onUserScriptMessage = originalMessage;
+    }
+  });
+
+  it("does not require unavailable runtime event listeners", () => {
+    const runtime = chrome.runtime as unknown as {
+      onConnect?: typeof chrome.runtime.onConnect;
+      onMessage?: typeof chrome.runtime.onMessage;
+    };
+    const onConnect = runtime.onConnect;
+    const onMessage = runtime.onMessage;
+
+    try {
+      runtime.onConnect = undefined;
+      runtime.onMessage = undefined;
+      const message = new ExtensionMessage();
+
+      expect(() => message.onConnect(() => undefined)).not.toThrow();
+      expect(() => message.onMessage(() => undefined)).not.toThrow();
+    } finally {
+      runtime.onConnect = onConnect;
+      runtime.onMessage = onMessage;
+    }
+  });
+
+  it("keeps native sendMessage and connect bindings after runtime mutation", async () => {
+    const runtime = chrome.runtime as unknown as {
+      sendMessage: unknown;
+      connect: unknown;
+    };
+    const sendMessage = runtime.sendMessage;
+    const connect = runtime.connect;
+    const message = new ExtensionMessage();
+
+    try {
+      runtime.sendMessage = () => {
+        throw new Error("patched sendMessage");
+      };
+      runtime.connect = () => {
+        throw new Error("patched connect");
+      };
+
+      await expect(message.sendMessage({ action: "test" })).resolves.toMatchObject({ success: true });
+      await expect(message.connect({ action: "test" })).resolves.toBeDefined();
+    } finally {
+      runtime.sendMessage = sendMessage;
+      runtime.connect = connect;
+    }
+  });
+
+  it("keeps a native port postMessage binding after port mutation", () => {
+    const nativePostMessage = vi.fn();
+    const port = {
+      postMessage: nativePostMessage,
+      onMessage: { addListener: vi.fn(), removeListener: vi.fn() },
+      onDisconnect: { addListener: vi.fn(), removeListener: vi.fn() },
+      disconnect: vi.fn(),
+    } as unknown as chrome.runtime.Port;
+    const connection = new ExtensionMessageConnect(port);
+
+    port.postMessage = vi.fn();
+    connection.sendMessage({ action: "native" });
+
+    expect(nativePostMessage).toHaveBeenCalledWith({ action: "native" });
+    connection.disconnect(true);
+  });
+
+  it("preserves an explicit main-frame target when frameId is zero", async () => {
+    const sendMessage = vi
+      .spyOn(chrome.tabs, "sendMessage")
+      .mockImplementation((_tabId, _message, optionsOrCallback, callback) => {
+        const responseCallback = typeof optionsOrCallback === "function" ? optionsOrCallback : callback;
+        responseCallback?.({ success: true });
+        return Promise.resolve({ success: true });
+      });
+    try {
+      await new ExtensionContentMessageSend(7, { frameId: 0 }).sendMessage({ action: "private" });
+
+      expect(sendMessage).toHaveBeenCalledWith(7, { action: "private" }, { frameId: 0 }, expect.any(Function));
+    } finally {
+      sendMessage.mockRestore();
+    }
+  });
+});