@adep/cli 0.4.0 → 0.4.1

package/README.md

@@ -126,7 +126,7 @@ adep --json whoami
 ```bash
 adep login                       # 打开浏览器；终端会同时打印验证码与链接
 adep login --no-browser          # 不开浏览器：手工访问打印出来的链接（SSH / 无桌面）
-adep login -s <url>              # 指定平台（缺省 ADEP_SERVER，再缺省 https://adep.jajabjbj.top）
+adep login -s <url>              # 指定平台（缺省 ADEP_SERVER，再缺省 https://adep.top）
 adep login -e <邮箱> -p <密码>   # 邮箱密码直登，不发起浏览器流程（CI / 老平台）
 adep whoami                      # 查看当前身份（读凭据并向平台确认会话仍有效）
 adep logout                      # 通知平台注销并清除本地凭据
@@ -554,7 +554,7 @@ adep app build --offline                     # 消费服务端 .adepack：离线
 
 | 变量              | 说明                              | 缺省                          |
 | ----------------- | --------------------------------- | ----------------------------- |
-| `ADEP_SERVER`     | 平台地址（CLI 请求的默认 server） | `https://adep.jajabjbj.top`   |
+| `ADEP_SERVER`     | 平台地址（CLI 请求的默认 server） | `https://adep.top`   |
 | `ADEP_HOME`       | 凭据目录（测试隔离用）            | `~/.adep`                     |
 | `ADEP_NO_BROWSER` | `1` = `adep login` 不打开浏览器   | 未设置（TTY 下自动打开）      |
 

package/dist/index.js

@@ -15,7 +15,7 @@ function resolvePaths(env = process.env) {
   return { home, credentialsFile: `${home}/credentials` };
 }
 function resolveServer(env = process.env) {
-  return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, "");
+  return (env["ADEP_SERVER"] ?? "https://adep.top").replace(/\/+$/, "");
 }
 function resolveElectronMirror(env = process.env) {
   return env["ELECTRON_MIRROR"] ?? DEFAULT_ELECTRON_MIRROR;
@@ -23904,6 +23904,28 @@ function transpile(code) {
 function transformExports(code) {
   return transformModule(code);
 }
+function realmValue(value) {
+  return { [REALM_VALUE_KEY]: value };
+}
+function isRealmValue(value) {
+  return typeof value === "object" && value !== null && REALM_VALUE_KEY in value;
+}
+function createSandboxContext(sandboxGlobals) {
+  const direct = {};
+  const realmEntries = {};
+  for (const [key, value] of Object.entries(sandboxGlobals)) {
+    if (isRealmValue(value)) realmEntries[key] = value[REALM_VALUE_KEY];
+    else direct[key] = value;
+  }
+  const context = vm.createContext(direct, { codeGeneration: { strings: false, wasm: false } });
+  if (Object.keys(realmEntries).length > 0) {
+    const literal2 = JSON.stringify(JSON.stringify(realmEntries));
+    vm.runInContext(`Object.assign(globalThis, JSON.parse(${literal2}))`, context, {
+      filename: "<sandbox-realm-globals>"
+    });
+  }
+  return context;
+}
 function resolveModulePath(fromDir, request, files) {
   if (!request.startsWith("./") && !request.startsWith("../")) return null;
   const base = joinPosix(fromDir, request);
@@ -23977,12 +23999,13 @@ function loadModule(path, files, sandboxGlobals, cache, resolveBare, bareCache)
   } catch (error51) {
     throw syntaxErrorWithLocation(error51, path);
   }
+  const context = createSandboxContext(sandboxGlobals);
   let wrapper;
   try {
-    wrapper = vm.runInNewContext(
+    wrapper = vm.runInContext(
       `(function (module, exports, require) { ${transformed} 
 })`,
-      vm.createContext({ ...sandboxGlobals }),
+      context,
       { filename: path }
     );
   } catch (error51) {
@@ -24004,13 +24027,14 @@ function loadFunctionModule(files, entry, sandboxGlobals, resolveBare) {
   }
   return { handler };
 }
-var bunTranspiler, SANDBOX_BUILTIN_REJECTED;
+var bunTranspiler, SANDBOX_BUILTIN_REJECTED, REALM_VALUE_KEY;
 var init_sandbox = __esm({
   "packages/runtime/src/functions/runtime/sandbox.ts"() {
     "use strict";
     init_exports();
     init_regexp();
     SANDBOX_BUILTIN_REJECTED = "FN_SANDBOX_BUILTIN_BLOCKED";
+    REALM_VALUE_KEY = "__adepRealmValue";
   }
 });
 
@@ -24209,18 +24233,24 @@ function headersToRecord(headers) {
   }
   return out;
 }
-function contentLength(res) {
-  const headers = res.headers;
+function headerValue(headers, name) {
   if (headers === void 0 || headers === null) return null;
+  let raw;
   if (typeof headers.get === "function") {
-    const raw2 = headers.get?.("content-length");
-    if (raw2 === void 0 || raw2 === null || raw2.trim() === "") return null;
-    const n2 = Number(raw2);
-    return Number.isFinite(n2) && n2 >= 0 ? n2 : null;
-  }
-  const record2 = headers;
-  const raw = record2["content-length"] ?? record2["Content-Length"];
-  if (raw === void 0 || raw === null) return null;
+    raw = headers.get?.(name);
+  } else {
+    const record2 = headers;
+    raw = record2[name.toLocaleLowerCase()] ?? record2[name];
+  }
+  if (raw === void 0 || raw === null || raw.trim() === "") return null;
+  return raw;
+}
+function contentLength(res) {
+  const raw = headerValue(
+    res.headers,
+    "content-length"
+  );
+  if (raw === null) return null;
   const n = Number(raw);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
@@ -24298,46 +24328,74 @@ function createSandboxFetch(options) {
   const fetchImpl = options.fetchImpl ?? defaultFetch;
   const { allowlist, timeoutMs } = options;
   const maxBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
-  return async (url2, init) => {
+  const maxRedirects = Math.max(0, options.maxRedirects ?? DEFAULT_MAX_REDIRECTS);
+  const guard = (raw) => {
     let parsed;
     try {
-      parsed = new URL(url2);
+      parsed = new URL(raw);
     } catch {
-      throw new SandboxFetchError("FN_FETCH_INVALID_URL", `cloud.fetch \u6536\u5230\u975E\u6CD5 URL"${url2}"`);
+      throw new SandboxFetchError("FN_FETCH_INVALID_URL", `cloud.fetch \u6536\u5230\u975E\u6CD5 URL"${raw}"`);
     }
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw FORBIDDEN(url2);
-    if (!isHostAllowed(parsed.hostname, allowlist)) throw FORBIDDEN(url2);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw FORBIDDEN(raw);
+    if (!isHostAllowed(parsed.hostname, allowlist)) throw FORBIDDEN(raw);
+    return parsed;
+  };
+  const fetchOnce = async (url2, init) => {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     const signals = [controller.signal];
     if (init?.signal !== void 0) signals.push(init.signal);
     const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+    const request = {
+      ...init,
+      signal,
+      redirect: "manual"
+    };
     try {
-      let res;
-      try {
-        res = await fetchImpl(url2, { ...init, signal });
-      } catch (error51) {
-        if (controller.signal.aborted) {
-          throw new SandboxFetchError(
-            "FN_FETCH_TIMEOUT",
-            `cloud.fetch \u8BF7\u6C42\u8D85\u65F6\uFF08\u8D85\u8FC7 ${timeoutMs}ms\uFF09`
-          );
-        }
-        if (init?.signal?.aborted === true) {
-          throw new SandboxFetchError("FN_FETCH_ABORTED", "cloud.fetch \u8BF7\u6C42\u88AB\u8C03\u7528\u65B9\u4E2D\u6B62");
-        }
-        throw new SandboxFetchError(
-          "FN_FETCH_FAILED",
-          `cloud.fetch \u8BF7\u6C42\u5931\u8D25\uFF1A${errorMessageOf(error51)}`
-        );
+      return await fetchImpl(url2, request);
+    } catch (error51) {
+      if (controller.signal.aborted) {
+        throw new SandboxFetchError("FN_FETCH_TIMEOUT", `cloud.fetch \u8BF7\u6C42\u8D85\u65F6\uFF08\u8D85\u8FC7 ${timeoutMs}ms\uFF09`);
+      }
+      if (init?.signal?.aborted === true) {
+        throw new SandboxFetchError("FN_FETCH_ABORTED", "cloud.fetch \u8BF7\u6C42\u88AB\u8C03\u7528\u65B9\u4E2D\u6B62");
       }
-      return normalizeResponse(res, maxBytes);
+      throw new SandboxFetchError(
+        "FN_FETCH_FAILED",
+        `cloud.fetch \u8BF7\u6C42\u5931\u8D25\uFF1A${errorMessageOf(error51)}`
+      );
     } finally {
       clearTimeout(timer);
     }
   };
+  return async (url2, init) => {
+    let target = guard(url2);
+    let currentInit = init === void 0 ? void 0 : { ...init };
+    let lastRes = null;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+      const res = await fetchOnce(target.href, currentInit);
+      const location = REDIRECT_STATUSES.has(res.status) ? headerValue(res.headers, "location") : null;
+      if (location === null || hop === maxRedirects) {
+        lastRes = res;
+        break;
+      }
+      let next;
+      try {
+        next = new URL(location, target.href);
+      } catch {
+        lastRes = res;
+        break;
+      }
+      if (res.status !== 307 && res.status !== 308 && currentInit !== void 0) {
+        currentInit.method = "GET";
+        delete currentInit.body;
+      }
+      target = guard(next.href);
+    }
+    return normalizeResponse(lastRes, maxBytes);
+  };
 }
-var SandboxFetchError, DEFAULT_MAX_RESPONSE_BYTES, defaultFetch, FORBIDDEN, TOO_LARGE, encoder, decoder;
+var SandboxFetchError, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_MAX_REDIRECTS, REDIRECT_STATUSES, defaultFetch, FORBIDDEN, TOO_LARGE, encoder, decoder;
 var init_sandbox_fetch = __esm({
   "packages/runtime/src/functions/runtime/sandbox-fetch.ts"() {
     "use strict";
@@ -24350,6 +24408,8 @@ var init_sandbox_fetch = __esm({
       }
     };
     DEFAULT_MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
+    DEFAULT_MAX_REDIRECTS = 5;
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
     defaultFetch = (url2, init) => (
       // 真实 Response 与内部 ResponseLike 结构性一致；getReader 的多态签名差异属纯类型问题，运行语义等价。
       globalThis.fetch(url2, init)
@@ -24543,8 +24603,8 @@ async function normalizeResultBody(value) {
     }
   }
   const headers = {};
-  value.headers.forEach((headerValue, key) => {
-    headers[key] = headerValue;
+  value.headers.forEach((headerValue2, key) => {
+    headers[key] = headerValue2;
   });
   return { __adepHttp: { status: value.status, body: payload, headers } };
 }
@@ -24651,7 +24711,7 @@ function runWorker(input, port) {
     structuredClone
   };
   if (input.env !== void 0) {
-    sandboxGlobals["process"] = { env: input.env };
+    sandboxGlobals["process"] = realmValue({ env: input.env });
   }
   if (input.fetch !== void 0) {
     const sandboxFetch = createSandboxFetch({
@@ -28445,7 +28505,7 @@ function createCliContext(deps) {
 init_auth();
 init_config();
 function registerAuth(program2, ctx) {
-  program2.command("login").description("\u767B\u5F55\u5E73\u53F0\uFF1A\u7F3A\u7701\u6253\u5F00\u6D4F\u89C8\u5668\u7528\u7F51\u9875\u6388\u6743\u767B\u5F55\uFF1B-e/-p \u8D70\u90AE\u7BB1\u5BC6\u7801\u76F4\u767B\uFF08CI / \u65E0\u6D4F\u89C8\u5668\uFF09").option("-s, --server <url>", "\u5E73\u53F0\u5730\u5740\uFF08\u7F3A\u7701\u8BFB\u53D6 ADEP_SERVER \u6216 https://adep.jajabjbj.top\uFF09").option("-e, --email <email>", "\u767B\u5F55\u90AE\u7BB1\uFF08\u4E0E -p \u4E00\u8D77\u8D70\u5BC6\u7801\u76F4\u767B\uFF0C\u4E0D\u53D1\u8D77\u6D4F\u89C8\u5668\u6D41\u7A0B\uFF09").option("-p, --password <password>", "\u767B\u5F55\u5BC6\u7801\uFF08\u6CE8\u610F shell \u5386\u53F2\uFF1B\u7F3A\u7701\u4EA4\u4E92\u8F93\u5165\uFF09").option("--no-browser", "\u4E0D\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF1A\u53EA\u6253\u5370\u9A8C\u8BC1\u7801\u4E0E\u94FE\u63A5\uFF0C\u7531\u4F60\u624B\u5DE5\u8BBF\u95EE\uFF08SSH / \u65E0\u684C\u9762\uFF09").action(
+  program2.command("login").description("\u767B\u5F55\u5E73\u53F0\uFF1A\u7F3A\u7701\u6253\u5F00\u6D4F\u89C8\u5668\u7528\u7F51\u9875\u6388\u6743\u767B\u5F55\uFF1B-e/-p \u8D70\u90AE\u7BB1\u5BC6\u7801\u76F4\u767B\uFF08CI / \u65E0\u6D4F\u89C8\u5668\uFF09").option("-s, --server <url>", "\u5E73\u53F0\u5730\u5740\uFF08\u7F3A\u7701\u8BFB\u53D6 ADEP_SERVER \u6216 https://adep.top\uFF09").option("-e, --email <email>", "\u767B\u5F55\u90AE\u7BB1\uFF08\u4E0E -p \u4E00\u8D77\u8D70\u5BC6\u7801\u76F4\u767B\uFF0C\u4E0D\u53D1\u8D77\u6D4F\u89C8\u5668\u6D41\u7A0B\uFF09").option("-p, --password <password>", "\u767B\u5F55\u5BC6\u7801\uFF08\u6CE8\u610F shell \u5386\u53F2\uFF1B\u7F3A\u7701\u4EA4\u4E92\u8F93\u5165\uFF09").option("--no-browser", "\u4E0D\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF1A\u53EA\u6253\u5370\u9A8C\u8BC1\u7801\u4E0E\u94FE\u63A5\uFF0C\u7531\u4F60\u624B\u5DE5\u8BBF\u95EE\uFF08SSH / \u65E0\u684C\u9762\uFF09").action(
     async (flags) => {
       const command = ctx.io("login");
       await command.run(async () => {
@@ -29118,7 +29178,7 @@ function registerApp(program2, ctx) {
   const app = program2.command("app").description("\u684C\u9762 / \u79FB\u52A8\u5E94\u7528\u58F3\u5DE5\u7A0B\uFF08\u5F53\u524D\u652F\u6301\uFF1Ainit / build\uFF09");
   app.command("init").description("\u751F\u6210\u58F3\u5DE5\u7A0B\uFF1A--platform desktop\uFF08\u7F3A\u7701\uFF0CElectron\uFF09| mobile\uFF08Capacitor \u79FB\u52A8\u58F3\uFF09").requiredOption("-p, --project <slug>", "\u5E73\u53F0\u9879\u76EE slug\uFF08\u5FC5\u586B\uFF1B\u4E91\u51FD\u6570\u7ECF\u8BE5\u9879\u76EE\u7684 /api/* \u6267\u884C\uFF09").requiredOption("-n, --name <\u5E94\u7528\u540D>", "\u5E94\u7528\u663E\u793A\u540D\uFF08\u5FC5\u586B\uFF1B\u7A97\u53E3\u6807\u9898 / \u5B89\u88C5\u5305 productName / \u79FB\u52A8\u7AEF\u663E\u793A\u540D\uFF09").option("--dir <\u76EE\u5F55>", "\u76EE\u6807\u76EE\u5F55\uFF08\u7F3A\u7701 ./<slug>-app\uFF09").option("--platform <\u58F3>", "desktop\uFF08\u7F3A\u7701\uFF0CElectron \u684C\u9762\u58F3\uFF09| mobile\uFF08Capacitor \u79FB\u52A8\u58F3\uFF0CAPP-009\uFF09").option(
     "-s, --server <url>",
-    "\u5E73\u53F0\u5730\u5740\uFF08\u7F3A\u7701\u5F53\u524D\u767B\u5F55\u5E73\u53F0\uFF0C\u6216 ADEP_SERVER / https://adep.jajabjbj.top\uFF09"
+    "\u5E73\u53F0\u5730\u5740\uFF08\u7F3A\u7701\u5F53\u524D\u767B\u5F55\u5E73\u53F0\uFF0C\u6216 ADEP_SERVER / https://adep.top\uFF09"
   ).action(
     async (flags) => {
       const command = ctx.io("app init");

package/dist/vite.js

@@ -3717,6 +3717,29 @@ function transformExports(code) {
   return transformModule(code);
 }
 var SANDBOX_BUILTIN_REJECTED = "FN_SANDBOX_BUILTIN_BLOCKED";
+var REALM_VALUE_KEY = "__adepRealmValue";
+function realmValue(value) {
+  return { [REALM_VALUE_KEY]: value };
+}
+function isRealmValue(value) {
+  return typeof value === "object" && value !== null && REALM_VALUE_KEY in value;
+}
+function createSandboxContext(sandboxGlobals) {
+  const direct = {};
+  const realmEntries = {};
+  for (const [key, value] of Object.entries(sandboxGlobals)) {
+    if (isRealmValue(value)) realmEntries[key] = value[REALM_VALUE_KEY];
+    else direct[key] = value;
+  }
+  const context = vm.createContext(direct, { codeGeneration: { strings: false, wasm: false } });
+  if (Object.keys(realmEntries).length > 0) {
+    const literal = JSON.stringify(JSON.stringify(realmEntries));
+    vm.runInContext(`Object.assign(globalThis, JSON.parse(${literal}))`, context, {
+      filename: "<sandbox-realm-globals>"
+    });
+  }
+  return context;
+}
 function resolveModulePath(fromDir, request, files) {
   if (!request.startsWith("./") && !request.startsWith("../")) return null;
   const base = joinPosix(fromDir, request);
@@ -3790,12 +3813,13 @@ function loadModule(path, files, sandboxGlobals, cache, resolveBare, bareCache)
   } catch (error) {
     throw syntaxErrorWithLocation(error, path);
   }
+  const context = createSandboxContext(sandboxGlobals);
   let wrapper;
   try {
-    wrapper = vm.runInNewContext(
+    wrapper = vm.runInContext(
       `(function (module, exports, require) { ${transformed} 
 })`,
-      vm.createContext({ ...sandboxGlobals }),
+      context,
       { filename: path }
     );
   } catch (error) {
@@ -3975,6 +3999,8 @@ var SandboxFetchError = class extends Error {
   }
 };
 var DEFAULT_MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
+var DEFAULT_MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 var defaultFetch = (url, init) => (
   // 真实 Response 与内部 ResponseLike 结构性一致；getReader 的多态签名差异属纯类型问题，运行语义等价。
   globalThis.fetch(url, init)
@@ -4013,18 +4039,24 @@ function headersToRecord(headers) {
   }
   return out;
 }
-function contentLength(res) {
-  const headers = res.headers;
+function headerValue(headers, name) {
   if (headers === void 0 || headers === null) return null;
+  let raw;
   if (typeof headers.get === "function") {
-    const raw2 = headers.get?.("content-length");
-    if (raw2 === void 0 || raw2 === null || raw2.trim() === "") return null;
-    const n2 = Number(raw2);
-    return Number.isFinite(n2) && n2 >= 0 ? n2 : null;
-  }
-  const record = headers;
-  const raw = record["content-length"] ?? record["Content-Length"];
-  if (raw === void 0 || raw === null) return null;
+    raw = headers.get?.(name);
+  } else {
+    const record = headers;
+    raw = record[name.toLocaleLowerCase()] ?? record[name];
+  }
+  if (raw === void 0 || raw === null || raw.trim() === "") return null;
+  return raw;
+}
+function contentLength(res) {
+  const raw = headerValue(
+    res.headers,
+    "content-length"
+  );
+  if (raw === null) return null;
   const n = Number(raw);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
@@ -4104,44 +4136,72 @@ function createSandboxFetch(options) {
   const fetchImpl = options.fetchImpl ?? defaultFetch;
   const { allowlist, timeoutMs } = options;
   const maxBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
-  return async (url, init) => {
+  const maxRedirects = Math.max(0, options.maxRedirects ?? DEFAULT_MAX_REDIRECTS);
+  const guard = (raw) => {
     let parsed;
     try {
-      parsed = new URL(url);
+      parsed = new URL(raw);
     } catch {
-      throw new SandboxFetchError("FN_FETCH_INVALID_URL", `cloud.fetch \u6536\u5230\u975E\u6CD5 URL"${url}"`);
+      throw new SandboxFetchError("FN_FETCH_INVALID_URL", `cloud.fetch \u6536\u5230\u975E\u6CD5 URL"${raw}"`);
     }
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw FORBIDDEN(url);
-    if (!isHostAllowed(parsed.hostname, allowlist)) throw FORBIDDEN(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw FORBIDDEN(raw);
+    if (!isHostAllowed(parsed.hostname, allowlist)) throw FORBIDDEN(raw);
+    return parsed;
+  };
+  const fetchOnce = async (url, init) => {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     const signals = [controller.signal];
     if (init?.signal !== void 0) signals.push(init.signal);
     const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+    const request = {
+      ...init,
+      signal,
+      redirect: "manual"
+    };
     try {
-      let res;
-      try {
-        res = await fetchImpl(url, { ...init, signal });
-      } catch (error) {
-        if (controller.signal.aborted) {
-          throw new SandboxFetchError(
-            "FN_FETCH_TIMEOUT",
-            `cloud.fetch \u8BF7\u6C42\u8D85\u65F6\uFF08\u8D85\u8FC7 ${timeoutMs}ms\uFF09`
-          );
-        }
-        if (init?.signal?.aborted === true) {
-          throw new SandboxFetchError("FN_FETCH_ABORTED", "cloud.fetch \u8BF7\u6C42\u88AB\u8C03\u7528\u65B9\u4E2D\u6B62");
-        }
-        throw new SandboxFetchError(
-          "FN_FETCH_FAILED",
-          `cloud.fetch \u8BF7\u6C42\u5931\u8D25\uFF1A${errorMessageOf(error)}`
-        );
+      return await fetchImpl(url, request);
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw new SandboxFetchError("FN_FETCH_TIMEOUT", `cloud.fetch \u8BF7\u6C42\u8D85\u65F6\uFF08\u8D85\u8FC7 ${timeoutMs}ms\uFF09`);
       }
-      return normalizeResponse(res, maxBytes);
+      if (init?.signal?.aborted === true) {
+        throw new SandboxFetchError("FN_FETCH_ABORTED", "cloud.fetch \u8BF7\u6C42\u88AB\u8C03\u7528\u65B9\u4E2D\u6B62");
+      }
+      throw new SandboxFetchError(
+        "FN_FETCH_FAILED",
+        `cloud.fetch \u8BF7\u6C42\u5931\u8D25\uFF1A${errorMessageOf(error)}`
+      );
     } finally {
       clearTimeout(timer);
     }
   };
+  return async (url, init) => {
+    let target = guard(url);
+    let currentInit = init === void 0 ? void 0 : { ...init };
+    let lastRes = null;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+      const res = await fetchOnce(target.href, currentInit);
+      const location = REDIRECT_STATUSES.has(res.status) ? headerValue(res.headers, "location") : null;
+      if (location === null || hop === maxRedirects) {
+        lastRes = res;
+        break;
+      }
+      let next;
+      try {
+        next = new URL(location, target.href);
+      } catch {
+        lastRes = res;
+        break;
+      }
+      if (res.status !== 307 && res.status !== 308 && currentInit !== void 0) {
+        currentInit.method = "GET";
+        delete currentInit.body;
+      }
+      target = guard(next.href);
+    }
+    return normalizeResponse(lastRes, maxBytes);
+  };
 }
 
 // packages/runtime/src/functions/runtime/flat-rpc-proxy.ts
@@ -4292,8 +4352,8 @@ async function normalizeResultBody(value) {
     }
   }
   const headers = {};
-  value.headers.forEach((headerValue, key) => {
-    headers[key] = headerValue;
+  value.headers.forEach((headerValue2, key) => {
+    headers[key] = headerValue2;
   });
   return { __adepHttp: { status: value.status, body: payload, headers } };
 }
@@ -4400,7 +4460,7 @@ function runWorker(input, port) {
     structuredClone
   };
   if (input.env !== void 0) {
-    sandboxGlobals["process"] = { env: input.env };
+    sandboxGlobals["process"] = realmValue({ env: input.env });
   }
   if (input.fetch !== void 0) {
     const sandboxFetch = createSandboxFetch({

package/dist/worker-entry.js

@@ -246,6 +246,29 @@ function transformExports(code) {
   return transformModule(code);
 }
 var SANDBOX_BUILTIN_REJECTED = "FN_SANDBOX_BUILTIN_BLOCKED";
+var REALM_VALUE_KEY = "__adepRealmValue";
+function realmValue(value) {
+  return { [REALM_VALUE_KEY]: value };
+}
+function isRealmValue(value) {
+  return typeof value === "object" && value !== null && REALM_VALUE_KEY in value;
+}
+function createSandboxContext(sandboxGlobals) {
+  const direct = {};
+  const realmEntries = {};
+  for (const [key, value] of Object.entries(sandboxGlobals)) {
+    if (isRealmValue(value)) realmEntries[key] = value[REALM_VALUE_KEY];
+    else direct[key] = value;
+  }
+  const context = vm.createContext(direct, { codeGeneration: { strings: false, wasm: false } });
+  if (Object.keys(realmEntries).length > 0) {
+    const literal = JSON.stringify(JSON.stringify(realmEntries));
+    vm.runInContext(`Object.assign(globalThis, JSON.parse(${literal}))`, context, {
+      filename: "<sandbox-realm-globals>"
+    });
+  }
+  return context;
+}
 function resolveModulePath(fromDir, request, files) {
   if (!request.startsWith("./") && !request.startsWith("../")) return null;
   const base = joinPosix(fromDir, request);
@@ -319,12 +342,13 @@ function loadModule(path, files, sandboxGlobals, cache, resolveBare, bareCache)
   } catch (error) {
     throw syntaxErrorWithLocation(error, path);
   }
+  const context = createSandboxContext(sandboxGlobals);
   let wrapper;
   try {
-    wrapper = vm.runInNewContext(
+    wrapper = vm.runInContext(
       `(function (module, exports, require) { ${transformed} 
 })`,
-      vm.createContext({ ...sandboxGlobals }),
+      context,
       { filename: path }
     );
   } catch (error) {
@@ -357,6 +381,8 @@ var SandboxFetchError = class extends Error {
   }
 };
 var DEFAULT_MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
+var DEFAULT_MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 var defaultFetch = (url, init) => (
   // 真实 Response 与内部 ResponseLike 结构性一致；getReader 的多态签名差异属纯类型问题，运行语义等价。
   globalThis.fetch(url, init)
@@ -395,18 +421,24 @@ function headersToRecord(headers) {
   }
   return out;
 }
-function contentLength(res) {
-  const headers = res.headers;
+function headerValue(headers, name) {
   if (headers === void 0 || headers === null) return null;
+  let raw;
   if (typeof headers.get === "function") {
-    const raw2 = headers.get?.("content-length");
-    if (raw2 === void 0 || raw2 === null || raw2.trim() === "") return null;
-    const n2 = Number(raw2);
-    return Number.isFinite(n2) && n2 >= 0 ? n2 : null;
-  }
-  const record = headers;
-  const raw = record["content-length"] ?? record["Content-Length"];
-  if (raw === void 0 || raw === null) return null;
+    raw = headers.get?.(name);
+  } else {
+    const record = headers;
+    raw = record[name.toLocaleLowerCase()] ?? record[name];
+  }
+  if (raw === void 0 || raw === null || raw.trim() === "") return null;
+  return raw;
+}
+function contentLength(res) {
+  const raw = headerValue(
+    res.headers,
+    "content-length"
+  );
+  if (raw === null) return null;
   const n = Number(raw);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
@@ -486,44 +518,72 @@ function createSandboxFetch(options) {
   const fetchImpl = options.fetchImpl ?? defaultFetch;
   const { allowlist, timeoutMs } = options;
   const maxBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
-  return async (url, init) => {
+  const maxRedirects = Math.max(0, options.maxRedirects ?? DEFAULT_MAX_REDIRECTS);
+  const guard = (raw) => {
     let parsed;
     try {
-      parsed = new URL(url);
+      parsed = new URL(raw);
     } catch {
-      throw new SandboxFetchError("FN_FETCH_INVALID_URL", `cloud.fetch \u6536\u5230\u975E\u6CD5 URL"${url}"`);
+      throw new SandboxFetchError("FN_FETCH_INVALID_URL", `cloud.fetch \u6536\u5230\u975E\u6CD5 URL"${raw}"`);
     }
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw FORBIDDEN(url);
-    if (!isHostAllowed(parsed.hostname, allowlist)) throw FORBIDDEN(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw FORBIDDEN(raw);
+    if (!isHostAllowed(parsed.hostname, allowlist)) throw FORBIDDEN(raw);
+    return parsed;
+  };
+  const fetchOnce = async (url, init) => {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     const signals = [controller.signal];
     if (init?.signal !== void 0) signals.push(init.signal);
     const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+    const request = {
+      ...init,
+      signal,
+      redirect: "manual"
+    };
     try {
-      let res;
-      try {
-        res = await fetchImpl(url, { ...init, signal });
-      } catch (error) {
-        if (controller.signal.aborted) {
-          throw new SandboxFetchError(
-            "FN_FETCH_TIMEOUT",
-            `cloud.fetch \u8BF7\u6C42\u8D85\u65F6\uFF08\u8D85\u8FC7 ${timeoutMs}ms\uFF09`
-          );
-        }
-        if (init?.signal?.aborted === true) {
-          throw new SandboxFetchError("FN_FETCH_ABORTED", "cloud.fetch \u8BF7\u6C42\u88AB\u8C03\u7528\u65B9\u4E2D\u6B62");
-        }
-        throw new SandboxFetchError(
-          "FN_FETCH_FAILED",
-          `cloud.fetch \u8BF7\u6C42\u5931\u8D25\uFF1A${errorMessageOf(error)}`
-        );
+      return await fetchImpl(url, request);
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw new SandboxFetchError("FN_FETCH_TIMEOUT", `cloud.fetch \u8BF7\u6C42\u8D85\u65F6\uFF08\u8D85\u8FC7 ${timeoutMs}ms\uFF09`);
+      }
+      if (init?.signal?.aborted === true) {
+        throw new SandboxFetchError("FN_FETCH_ABORTED", "cloud.fetch \u8BF7\u6C42\u88AB\u8C03\u7528\u65B9\u4E2D\u6B62");
       }
-      return normalizeResponse(res, maxBytes);
+      throw new SandboxFetchError(
+        "FN_FETCH_FAILED",
+        `cloud.fetch \u8BF7\u6C42\u5931\u8D25\uFF1A${errorMessageOf(error)}`
+      );
     } finally {
       clearTimeout(timer);
     }
   };
+  return async (url, init) => {
+    let target = guard(url);
+    let currentInit = init === void 0 ? void 0 : { ...init };
+    let lastRes = null;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+      const res = await fetchOnce(target.href, currentInit);
+      const location = REDIRECT_STATUSES.has(res.status) ? headerValue(res.headers, "location") : null;
+      if (location === null || hop === maxRedirects) {
+        lastRes = res;
+        break;
+      }
+      let next;
+      try {
+        next = new URL(location, target.href);
+      } catch {
+        lastRes = res;
+        break;
+      }
+      if (res.status !== 307 && res.status !== 308 && currentInit !== void 0) {
+        currentInit.method = "GET";
+        delete currentInit.body;
+      }
+      target = guard(next.href);
+    }
+    return normalizeResponse(lastRes, maxBytes);
+  };
 }
 
 // packages/runtime/src/shared/capability-keys.ts
@@ -703,8 +763,8 @@ async function normalizeResultBody(value) {
     }
   }
   const headers = {};
-  value.headers.forEach((headerValue, key) => {
-    headers[key] = headerValue;
+  value.headers.forEach((headerValue2, key) => {
+    headers[key] = headerValue2;
   });
   return { __adepHttp: { status: value.status, body: payload, headers } };
 }
@@ -811,7 +871,7 @@ function runWorker(input, port) {
     structuredClone
   };
   if (input.env !== void 0) {
-    sandboxGlobals["process"] = { env: input.env };
+    sandboxGlobals["process"] = realmValue({ env: input.env });
   }
   if (input.fetch !== void 0) {
     const sandboxFetch = createSandboxFetch({

package/package.json

@@ -5,9 +5,9 @@
     "type": "git",
     "url": "git+https://gitcode.com/yunqiang_wu/ai-yunke.git"
   },
-  "homepage": "https://adep.jajabjbj.top",
+  "homepage": "https://adep.top",
   "bugs": "https://gitcode.com/yunqiang_wu/ai-yunke/issues",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "`adep` 命令行工具包位：登录 / 初始化 / 本地调试 / 部署 / 数据库维护 / 云存储 / 静态托管 / 微前端组件（widget），实现见任务单 CLI-001 ~ CLI-003 与 FE-002；子路径 `@adep/cli/vite` 提供云函数 vite 插件（CLI-014）",
   "bin": {
@@ -30,13 +30,13 @@
     "esbuild": "0.25.12",
     "yaml": "2.9.1",
     "zod": "^4.4.3",
-    "@adep/crypto": "0.1.0",
-    "@adep/cf-compat": "0.1.1",
-    "@adep/runtime": "0.3.2",
-    "@adep/vite-plugin": "0.1.8"
+    "@adep/cf-compat": "0.1.2",
+    "@adep/runtime": "0.3.3",
+    "@adep/crypto": "0.1.1",
+    "@adep/vite-plugin": "0.1.9"
   },
   "devDependencies": {
-    "@adep/types": "0.3.0"
+    "@adep/types": "0.3.1"
   },
   "scripts": {
     "test": "vitest run",

package/templates/app-mobile/plugins/adep-bridge/ios/AdepBridge.podspec

@@ -3,10 +3,10 @@ Pod::Spec.new do |s|
   s.version = '0.1.0'
   s.summary = 'AgentDeploy mobile shell native bridge (APP-009)'
   s.description = 'Native-side permission gate + ownerKey Keychain storage + native capability invoke routing'
-  s.homepage = 'https://adep.jajabjbj.top'
+  s.homepage = 'https://adep.top'
   s.license = 'MIT'
   s.author = 'AgentDeploy'
-  s.source = { :git => 'https://adep.jajabjbj.top/adep-bridge.git', :tag => s.version.to_s }
+  s.source = { :git => 'https://adep.top/adep-bridge.git', :tag => s.version.to_s }
   s.ios.deployment_target = '13.0'
   s.source_files = 'Sources/**/*.swift'
   s.swift_version = '5.1'