@heybox/hb-sdk 0.6.2 → 0.6.4-alpha.0

package/dist/vite.esm.js

@@ -1,17 +1,10 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
 import path from 'node:path';
-import require$$0 from 'path';
-import require$$1 from 'os';
-import { readFile, mkdir, writeFile, rename } from 'node:fs/promises';
 
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.2';
-
-function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
-}
+    : '0.6.4-alpha.0';
 
 var re = {exports: {}};
 
@@ -11584,328 +11577,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-var envPaths$1 = {exports: {}};
-
-var hasRequiredEnvPaths;
-
-function requireEnvPaths () {
-	if (hasRequiredEnvPaths) return envPaths$1.exports;
-	hasRequiredEnvPaths = 1;
-	const path = require$$0;
-	const os = require$$1;
-
-	const homedir = os.homedir();
-	const tmpdir = os.tmpdir();
-	const {env} = process;
-
-	const macos = name => {
-		const library = path.join(homedir, 'Library');
-
-		return {
-			data: path.join(library, 'Application Support', name),
-			config: path.join(library, 'Preferences', name),
-			cache: path.join(library, 'Caches', name),
-			log: path.join(library, 'Logs', name),
-			temp: path.join(tmpdir, name)
-		};
-	};
-
-	const windows = name => {
-		const appData = env.APPDATA || path.join(homedir, 'AppData', 'Roaming');
-		const localAppData = env.LOCALAPPDATA || path.join(homedir, 'AppData', 'Local');
-
-		return {
-			// Data/config/cache/log are invented by me as Windows isn't opinionated about this
-			data: path.join(localAppData, name, 'Data'),
-			config: path.join(appData, name, 'Config'),
-			cache: path.join(localAppData, name, 'Cache'),
-			log: path.join(localAppData, name, 'Log'),
-			temp: path.join(tmpdir, name)
-		};
-	};
-
-	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
-	const linux = name => {
-		const username = path.basename(homedir);
-
-		return {
-			data: path.join(env.XDG_DATA_HOME || path.join(homedir, '.local', 'share'), name),
-			config: path.join(env.XDG_CONFIG_HOME || path.join(homedir, '.config'), name),
-			cache: path.join(env.XDG_CACHE_HOME || path.join(homedir, '.cache'), name),
-			// https://wiki.debian.org/XDGBaseDirectorySpecification#state
-			log: path.join(env.XDG_STATE_HOME || path.join(homedir, '.local', 'state'), name),
-			temp: path.join(tmpdir, username, name)
-		};
-	};
-
-	const envPaths = (name, options) => {
-		if (typeof name !== 'string') {
-			throw new TypeError(`Expected string, got ${typeof name}`);
-		}
-
-		options = Object.assign({suffix: 'nodejs'}, options);
-
-		if (options.suffix) {
-			// Add suffix to prevent possible conflict with native apps
-			name += `-${options.suffix}`;
-		}
-
-		if (process.platform === 'darwin') {
-			return macos(name);
-		}
-
-		if (process.platform === 'win32') {
-			return windows(name);
-		}
-
-		return linux(name);
-	};
-
-	envPaths$1.exports = envPaths;
-	// TODO: Remove this for the next major release
-	envPaths$1.exports.default = envPaths;
-	return envPaths$1.exports;
-}
-
-var envPathsExports = requireEnvPaths();
-var envPaths = /*@__PURE__*/getDefaultExportFromCjs(envPathsExports);
-
-const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
-function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
-    return {
-        path: APIUserMiniprogramPublicSdkConfigPath,
-        searchParams: serviceTag ? { special_tag: serviceTag } : {},
-        headers: serviceTag ? { 'x-rylai-service-tag': serviceTag } : {},
-    };
-}
-function parseUserMiniprogramPublicSdkConfigResult(value) {
-    if (!isRecord(value) ||
-        typeof value.minimum_sdk_version !== 'string') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return value;
-}
-function parseUserMiniprogramPublicSdkConfigEnvelope(value) {
-    if (!isRecord(value) || value.status !== 'ok') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return parseUserMiniprogramPublicSdkConfigResult(value.result);
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null;
-}
-
-const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = APIUserMiniprogramPublicSdkConfigPath;
-
-const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
-async function resolveMinimumSdkVersion(options) {
-    const now = options.now ?? Date.now();
-    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
-    const cache = await readCache(cachePath);
-    let minimumSdkVersion;
-    try {
-        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
-    }
-    catch {
-        const cached = cache.environments[options.environment];
-        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
-        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
-            try {
-                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
-            }
-            catch {
-                // 非法缓存按不存在处理。
-            }
-        }
-        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
-    }
-    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
-    try {
-        await writeCache(cachePath, cache);
-    }
-    catch {
-        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
-    }
-    return minimumSdkVersion;
-}
-function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
-    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
-    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
-    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
-        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
-    }
-    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
-        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
-    }
-    return current;
-}
-function validateSdkVersion(value, label) {
-    const normalized = String(value).trim();
-    const parsed = semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function validateStableSdkVersion(value, label) {
-    const normalized = validateSdkVersion(value, label);
-    if (semverExports.prerelease(normalized) !== null)
-        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
-    return normalized;
-}
-async function readCache(cachePath) {
-    try {
-        const parsed = JSON.parse(await readFile(cachePath, 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
-            return parsed;
-    }
-    catch {
-        // 缓存缺失或损坏时继续请求最新配置。
-    }
-    return { environments: {} };
-}
-async function writeCache(cachePath, cache) {
-    await mkdir(path.dirname(cachePath), { recursive: true });
-    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
-    await writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
-    await rename(temporaryPath, cachePath);
-}
-
-const globalHeyboxCliRequestConfig = {};
-function readHeyboxCliRequestConfig() {
-    return normalizeHeyboxRylaiServiceTagConfig(globalHeyboxCliRequestConfig);
-}
-function resolveHeyboxRylaiServiceTag(pathWithQuery, config = readHeyboxCliRequestConfig()) {
-    const normalized = normalizeHeyboxRylaiServiceTagConfig(config);
-    const pathname = getPathname(pathWithQuery) ;
-    const specialTag = normalized.special_tag;
-    if (pathname && specialTag?.path_prefix_list.some((prefix) => pathname.startsWith(prefix))) {
-        return specialTag.tag_name;
-    }
-    return normalized.default_tag;
-}
-function normalizeHeyboxRylaiServiceTagConfig(config) {
-    const defaultTag = normalizeHeyboxRylaiServiceTag(config.default_tag);
-    const specialTagName = normalizeHeyboxRylaiServiceTag(config.special_tag?.tag_name);
-    const pathPrefixList = config.special_tag?.path_prefix_list?.filter(isValidPathPrefix) || [];
-    return {
-        ...(defaultTag ? { default_tag: defaultTag } : {}),
-        ...(specialTagName && pathPrefixList.length
-            ? {
-                special_tag: {
-                    tag_name: specialTagName,
-                    path_prefix_list: pathPrefixList,
-                },
-            }
-            : {}),
-    };
-}
-function normalizeHeyboxRylaiServiceTag(value) {
-    const tag = String(value ?? '').trim();
-    if (!tag) {
-        return undefined;
-    }
-    if (/[\r\n]/.test(tag)) {
-        throw new Error('x-rylai-service-tag 不允许包含换行符');
-    }
-    return tag;
-}
-function isValidPathPrefix(value) {
-    return typeof value === 'string' && value.startsWith('/') && !/[\r\n]/.test(value);
-}
-function getPathname(pathWithQuery) {
-    try {
-        return new URL(pathWithQuery, 'https://api.xiaoheihe.cn').pathname;
-    }
-    catch {
-        return '';
-    }
-}
-
-const paths = envPaths('hb-sdk');
-async function enforceViteSdkVersion(options) {
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const serviceTag = resolveHeyboxRylaiServiceTag(PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH, {
-        default_tag: options.serviceTag,
-    });
-    const minimumSdkVersion = await resolveMinimumSdkVersion({
-        cacheDir: options.cacheDir ?? paths.cache,
-        environment: options.environment,
-        fetchMinimumSdkVersion: async () => {
-            const request = createUserMiniprogramPublicSdkConfigRequest(serviceTag);
-            const url = new URL(request.path, options.environment);
-            for (const [key, value] of Object.entries(request.searchParams)) {
-                url.searchParams.set(key, value);
-            }
-            const response = await fetchImpl(url, {
-                headers: request.headers,
-            });
-            if (!response.ok) {
-                throw new Error('公共 SDK 配置响应无效');
-            }
-            return parseUserMiniprogramPublicSdkConfigEnvelope(await response.json())
-                .minimum_sdk_version;
-        },
-    });
-    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
-}
-
-const HEYBOX_API_BASE_URL = 'https://api.xiaoheihe.cn';
-const TRUSTED_HEYBOX_API_HOST_SUFFIXES = ['.xiaoheihe.cn', '.debugmode.cn'];
-function resolveHeyboxApiBaseUrl(options = {}) {
-    const env = options.env;
-    const baseUrl = normalizeHeyboxOriginUrl(options.apiBaseUrl ?? env?.HB_SDK_API_BASE_URL ?? HEYBOX_API_BASE_URL, 'Heybox API baseUrl');
-    assertSafeHeyboxApiBaseUrl(baseUrl, {
-        allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl === true || isTruthyEnvFlag(env?.HB_SDK_ALLOW_UNSAFE_API_BASE_URL),
-    });
-    return baseUrl;
-}
-function normalizeHeyboxOriginUrl(value, label) {
-    const raw = String(value ?? '').trim();
-    if (!raw) {
-        throw new Error(`${label} 不能为空`);
-    }
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        throw new Error(`${label} 必须是合法的 http(s) origin：${raw}`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`${label} 只支持 http(s) 协议：${raw}`);
-    }
-    if (url.username || url.password) {
-        throw new Error(`${label} 不允许包含用户名或密码：${raw}`);
-    }
-    const rawSuffix = raw.match(/^[a-z][a-z\d+.-]*:\/\/[^/?#]+(.*)$/i)?.[1] ?? '';
-    if ((rawSuffix && rawSuffix !== '/') || url.search || url.hash) {
-        throw new Error(`${label} 只支持 origin，不允许包含 path、query 或 hash：${raw}`);
-    }
-    return url.origin;
-}
-function assertSafeHeyboxApiBaseUrl(origin, options) {
-    if (options.allowUnsafeApiBaseUrl) {
-        return;
-    }
-    const url = new URL(origin);
-    if (url.protocol !== 'https:' || !isTrustedHeyboxApiHost(url.hostname)) {
-        throw new Error('Heybox API baseUrl 默认只允许 Heybox 受信 HTTPS origin；本地调试请显式使用 --allow-unsafe-api-base-url 或 HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1');
-    }
-}
-function isTrustedHeyboxApiHost(hostname) {
-    return TRUSTED_HEYBOX_API_HOST_SUFFIXES.some((suffix) => hostname === suffix.slice(1) || hostname.endsWith(suffix));
-}
-function isTruthyEnvFlag(value) {
-    return ['1', 'true', 'yes', 'on'].includes(String(value ?? '')
-        .trim()
-        .toLowerCase());
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
-function miniappManifest(options = {}) {
+function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11929,22 +11603,6 @@ function miniappManifest(options = {}) {
             command = resolved.command;
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
-        async buildStart() {
-            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
-                return;
-            try {
-                await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
-                    sdkVersion: resolveSdkVersion(),
-                    environment: resolveHeyboxApiBaseUrl({ env: process.env }),
-                    serviceTag: process.env.HB_SDK_SERVICE_TAG,
-                    allowPrerelease: true,
-                });
-            }
-            catch (error) {
-                priorBuildError = toError(error);
-                throw priorBuildError;
-            }
-        },
         buildEnd(error) {
             if (error) {
                 priorBuildError = priorBuildError ?? toError(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.2",
+  "version": "0.6.4-alpha.0",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -92,7 +92,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.1"
+    "@heybox/hb-api": "~1.25.3"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/SKILL.md

@@ -49,7 +49,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 ## Step 5: Use CLI workflows
 
 1. Use `hb-sdk create <project-name>` to scaffold a standalone external mini-program template.
-2. Use `hb-sdk dev` for local browser debugging through the built-in mock runtime host. The project must bind `package.json.heybox.miniProgramId` and the CLI must be logged in so dev can load the real Runtime permission snapshot before starting Vite.
+2. Use `hb-sdk dev` for local browser, Mac App, or mobile App debugging through the built-in mock runtime host. Vite and native dev-shell entrypoints only require the local `mini_url`: a missing project binding, CLI login, remote dev-context failure, or the 3-second context timeout must fall back to an anonymous local sandbox instead of blocking startup. Anonymous mode denies managed capabilities by default. When a verified remote dev context is available, the Mock Host uses its Runtime permission snapshot as the initial local simulation and reports local-versus-online permission differences.
 3. Use `hb-sdk remote ...` for developer-owned remote mini-program management. Top-level `hb-sdk deploy` has been hard-cut and must not be recommended as a compatibility alias.
 4. Use `hb-sdk remote entity list`, `hb-sdk remote entity current`, and `hb-sdk remote entity switch <entity-id>` to inspect or change the developer platform server-side current entity before remote management commands.
 5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. CLI project configuration contains only `package.json.heybox.miniProgramId`; mini-program name, icon, and cover images are maintained on the Open platform version-publish flow. On first submit without prior approved profile, the server injects a default name and default images.
@@ -59,12 +59,12 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 9. Always provide a concise release note before deploy. Non-interactive environments must pass `--release-note`; interactive terminals may prompt for it. The default is manual release after approval with `hb-sdk remote release <version>`; use `--auto-publish` when the audited version should automatically release after approval.
 10. Use `hb-sdk remote release <version>`, `hb-sdk remote withdraw <version>`, `hb-sdk remote take-down`, and `hb-sdk remote reopen` for dangerous remote changes. Interactive terminals should confirm after showing enough context; non-interactive environments must pass `--yes`.
 11. For internal test/staging backend operations, use origin-only custom URLs: `HB_SDK_API_BASE_URL` or `hb-sdk remote ... --api-base-url <url>` for remote platform APIs, and `HB_SDK_LOGIN_BASE_URL` or `hb-sdk login --login-base-url <url>` for browser login. CLI flags override env vars. API base URLs must be Heybox trusted HTTPS origins by default; use `--allow-unsafe-api-base-url` or `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` only for local backend debugging. Do not include path, query, or hash in these URLs.
-12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate used by manual builds. Deploy builds skip that client-side version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
+12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
 13. If a remote command targets a custom login environment, pass the same `--login-base-url` or `HB_SDK_LOGIN_BASE_URL` used for `hb-sdk login`; remote commands reject cached CLI login state from a different login origin.
 14. Add `--verbose` / `-v` only when diagnosing failures; default CLI errors are intentionally concise, while verbose output includes backend envelope, HTTP status, trace fields, raw body, or original submit-audit failure details.
 15. Use `--json` for script consumption of `hb-sdk remote` commands. With `--json`, stdout must contain exactly one JSON object; progress, warnings, update reminders, and verbose diagnostics must not pollute stdout.
 16. Do not expect custom base URLs to affect `hb-sdk doctor`, npm latest checks, or mock-host `network.request()`.
-17. Use the Mock runtime host's "在 Mac 版 APP 中启动" button for Mac App debugging, or the "Mobile App" QR code after selecting a LAN interface for phone App debugging; the phone must be on the same LAN and use a Heybox App version that supports the mini-program dev shell.
+17. Use the Mock runtime host's "在 Mac 版 APP 中启动" button for Mac App debugging, or the "Mobile App" QR code after selecting a LAN interface for phone App debugging; these entrypoints remain available in anonymous mode. The phone must be on the same LAN and use a Heybox App version that supports the mini-program dev shell.
 18. Use `--port`, `--mock-port`, and `--no-open` when the default Vite/mock ports or browser opening behavior need to be controlled.
 19. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for the CLI's own Heybox auth cache. Keep `hb-sdk login` top-level; it is not a remote mini-program command.
 20. Treat `selectedEntity` in the CLI auth cache as a non-authoritative hint snapshot only. Every remote command must use the server-side current entity as the source of truth.
@@ -93,6 +93,8 @@ For CLI and local development:
 2. Do not use `hb-sdk login` as a workaround for iframe SDK authentication.
 3. Do not bypass `hb-sdk dev` by adding a second browser mock host.
 4. Keep the Vite `miniappManifest()` plugin enabled so builds only start in a compatible APP Runtime. Normal deploy always runs the project build.
+5. Keep Mock Host permission overrides in devtools-only memory. They must not rebuild the iframe, interrupt Vite HMR, mutate online permissions, or be passed through URL query parameters.
+6. Treat remote dev context as optional diagnostics and initialization data. Do not use a public mini-program detail request as a dev startup gate.
 
 For host/runtime/protocol-maintenance code:
 

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.2`
+- Version at generation time: `0.6.4-alpha.0`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -203,25 +203,17 @@ import { HB_SDK_VERSION } from '../core/version';
 import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
-import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
-import { resolveHeyboxApiBaseUrl } from '../cli/auth/base-url';
 
 type MiniappManifestPlugin = {
   name: string;
   config: (config: MiniappManifestUserConfig) => MiniappManifestUserConfig | void;
   configResolved: (resolved: MiniappManifestResolvedConfig) => void;
-  buildStart: () => Promise<void>;
   /** Rollup 在构建失败后仍会跑 closeBundle；用 buildEnd 记录真实错误，避免二次校验掩盖原因。 */
   buildEnd: (error?: Error) => void;
   transformIndexHtml: (html: string) => string;
   closeBundle: (this: MiniappManifestPluginContext) => Promise<void>;
 };
 
-export interface MiniappManifestOptions {
-  /** 仅供平台测试和自托管 Remote Environment adapter 使用。 */
-  enforceSdkVersion?: typeof defaultEnforceRemoteSdkVersion;
-}
-
 interface MiniappManifestUserConfig {
   base?: string;
   define?: Record<string, string>;
@@ -254,7 +246,7 @@ interface MiniappManifestResolvedConfig {
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 
-export function miniappManifest(options: MiniappManifestOptions = {}): MiniappManifestPlugin {
+export function miniappManifest(): MiniappManifestPlugin {
   let root = process.cwd();
   let outDir = 'dist';
   let command: 'build' | 'serve' = 'build';
@@ -279,20 +271,6 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       command = resolved.command;
       hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
     },
-    async buildStart() {
-      if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1') return;
-      try {
-        await (options.enforceSdkVersion ?? defaultEnforceRemoteSdkVersion)({
-          sdkVersion: resolveSdkVersion(),
-          environment: resolveHeyboxApiBaseUrl({ env: process.env }),
-          serviceTag: process.env.HB_SDK_SERVICE_TAG,
-          allowPrerelease: true,
-        });
-      } catch (error) {
-        priorBuildError = toError(error);
-        throw priorBuildError;
-      }
-    },
     buildEnd(error) {
       if (error) {
         priorBuildError = priorBuildError ?? toError(error);
@@ -404,7 +382,7 @@ export default defineConfig({
 
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 
@@ -472,7 +450,9 @@ SDK 需要在黑盒小程序 iframe 容器内运行。父容器会为页面注
 npm run dev
 ```
 
-调试页会通过 iframe 加载本地页面并补齐小程序 bridge 环境；浏览器 Mock 从 mock host 的同源只读 bootstrap 接口读取服务端保留的 Runtime 权限快照，URL query 不能提供或覆盖权限。项目已绑定 `heybox.miniProgramId` 时，可以点击调试页里的「在 Mac 版 APP 中启动」按钮，或在「Mobile App」区域选择局域网网卡后用手机小黑盒 APP 扫码；真机 dev shell 只携带绑定的小程序 ID 和本地页面地址，H5 宿主按 ID 从公开详情接口读取可信 Runtime 权限快照。项目未绑定时仍可使用默认拒绝受管能力的浏览器 Mock，但 Mac 和手机真机入口会明确提示先运行 `hb-sdk remote create` 或 `hb-sdk remote bind <mini-program-id>`，并保持不可用。真实容器加载开发 `mini_url` 前会提示“即将打开未经验证的开发网页。该页面可能由本机或局域网服务提供，请确认来源可信后继续。”，用户确认后才继续加载。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP；遇到这种情况时，请在系统浏览器中打开同一个调试页后重试。
+调试页会通过 iframe 加载本地页面并补齐小程序 bridge 环境。`hb-sdk dev` 的基础启动只依赖本地页面地址：即使项目未绑定、CLI 未登录或远端暂时不可用，浏览器 Mock、Mac 启动协议和手机二维码也会继续生成，真机 dev shell 以匿名本地沙箱加载 `mini_url`，不会把公开 `detail` 查询作为启动门禁。项目已绑定时会限时 3 秒读取远端 dev context；成功后 Mock Host 用真实 Runtime 权限快照初始化本地模拟，失败或超时则显示脱敏警告，并默认拒绝 `network.request` 等受管能力。
+
+Mock Host 可以在内存中调整 devtools-only 权限模拟，不会重建 iframe，因此不影响 Vite HMR；本地设置不会修改线上权限。调试页会对比已读取的线上快照，提示本地放开但上线后会返回 `PERMISSION_DENIED` 的差异。权限快照只通过 mock host 的同源只读 bootstrap 接口传递，URL query 不能提供或覆盖权限。真实容器加载开发 `mini_url` 前会提示“即将打开未经验证的开发网页。该页面可能由本机或局域网服务提供，请确认来源可信后继续。”，用户确认后才继续加载。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP；遇到这种情况时，请在系统浏览器中打开同一个调试页后重试。
 
 在未使用脚手架的 Vite 项目中，可以把命令加到 `package.json`：
 

package/skill/references/cli.md

@@ -103,7 +103,7 @@ Agent rules:
 hb-sdk dev
 ```
 
-`hb-sdk dev` 会从当前目录向上查找最近的 `package.json`，并在项目已绑定且 CLI 已登录时尝试查询真实 Runtime 权限快照。项目未绑定、未登录或远端暂时不可用时，命令会输出警告并继续启动 Vite 和内置 mock runtime host；此时使用缺失权限快照，`network.request` 等受管能力默认拒绝。远端权限读取成功时，mock host 使用真实快照，远端明确关闭的能力仍稳定返回 `PERMISSION_DENIED`。本地 `package.json` 无法解析等配置错误不会被降级，命令会直接报错。调试页默认自动打开；需要真实黑盒小程序容器加载同一页面时，点击调试页里的「在 Mac 版 APP 中启动」按钮，或在「Mobile App」区域选择局域网网卡后用手机小黑盒 APP 扫码。
+`hb-sdk dev` 会从当前目录向上查找最近的 `package.json`。Vite、内置 mock runtime host、Mac 启动协议和手机二维码的基础启动只依赖本地页面地址，不要求项目先绑定或 CLI 先登录。项目已绑定时，CLI 会限时 3 秒读取远端 dev context；成功后用真实 Runtime 权限快照初始化 Mock Host，失败或超时则输出脱敏警告并继续匿名调试，`network.request` 等受管能力默认拒绝。公开 `detail` 查询不再是 dev 启动门禁。本地 `package.json` 无法解析等配置错误不会被降级，命令会直接报错。调试页默认自动打开；需要真实黑盒小程序容器加载同一页面时，点击调试页里的「在 Mac 版 APP 中启动」按钮，或在「Mobile App」区域选择局域网网卡后用手机小黑盒 APP 扫码。
 
 常用参数：
 
@@ -116,11 +116,13 @@ hb-sdk dev
 
 ## Mock runtime 边界
 
-`hb-sdk dev` 会把实际小程序页面地址编码到 mock host 的 `mini_url` query 中，由 mock host iframe 加载页面并补齐小程序 bridge 环境；浏览器 Mock 的 Runtime 权限只从 mock host 同源只读 bootstrap 接口读取，URL query 不能提供或覆盖权限。项目已绑定时，Mac 协议和手机二维码会把 `package.json.heybox.miniProgramId` 与本地页面地址交给 dev shell；H5 宿主按该 ID 从公开详情接口读取可信 Runtime 权限快照。项目未绑定时仍可使用默认拒绝受管能力的浏览器 Mock，但 Mac 和手机真机入口会明确提示先运行 `hb-sdk remote create` 或 `hb-sdk remote bind <mini-program-id>`，并保持不可用。mock host 内置登录/登出、`show`、`hide`、在 Mac 版 APP 中启动、手机扫码调试等调试入口，并通过同一份 devtools-only runtime adapter 处理 SDK 能力调用。真实 Mac / Mobile App dev shell 加载开发 `mini_url` 前会提示“即将打开未经验证的开发网页。该页面可能由本机或局域网服务提供，请确认来源可信后继续。”，用户确认后才继续加载。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP；遇到这种情况时，请在系统浏览器中打开同一个调试页后重试。
+`hb-sdk dev` 会把实际小程序页面地址编码到 mock host 的 `mini_url` query 中，由 mock host iframe 加载页面并补齐小程序 bridge 环境。Mac 协议和手机二维码始终携带本地页面地址；远端 dev context 可用时还会携带已验证的小程序 ID，不可用时则进入匿名本地沙箱。真机 dev shell 不依赖公开 `detail` 查询完成启动。真实 Mac / Mobile App dev shell 加载开发 `mini_url` 前会提示“即将打开未经验证的开发网页。该页面可能由本机或局域网服务提供，请确认来源可信后继续。”，用户确认后才继续加载。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP；遇到这种情况时，请在系统浏览器中打开同一个调试页后重试。
 
 不要为了本地调试再创建独立 mock runtime 包。CLI、模板和 mock host 都归属 `@heybox/hb-sdk`。
 
-本地 mock runtime 下已授权的 `network.request()` 会通过 `hb-sdk` 本地 mock network proxy 转发真实 HTTP(S) 请求，用于避免浏览器 CORS 影响本地调试。远端权限可用时 Mock Host 使用远端详情返回的同一份权限快照；不可用时使用缺失快照并默认拒绝受管能力。proxy 不会把黑盒客户端私有协议字段暴露给 iframe 业务代码。
+浏览器 Mock 的权限状态只存在于 Mock Host 内存中，URL query 不能提供或覆盖权限。远端 dev context 可用时，Mock Host 以线上快照作为初始值；不可用时匿名状态默认拒绝受管能力。开发者可以在调试页临时调整 `network.request` 和官方域名权限，变更只会重建 devtools-only mock runtime，不会重建 iframe 或中断 Vite HMR，也不会修改线上配置。调试页会对比线上快照并提示本地放开但上线后会返回 `PERMISSION_DENIED` 的差异。
+
+本地 mock runtime 下已授权的 `network.request()` 会通过 `hb-sdk` 本地 mock network proxy 转发真实 HTTP(S) 请求，用于避免浏览器 CORS 影响本地调试。proxy 不会把黑盒客户端私有协议字段暴露给 iframe 业务代码。CLI 登录态和远端 dev context 也不会注入 iframe。
 
 Use `hb-sdk dev` for local browser SDK debugging. Use the Mock runtime host's "在 Mac 版 APP 中启动" button for Mac App debugging, or the "Mobile App" QR code after selecting a LAN interface for phone App debugging. The phone must be on the same LAN and use a Heybox App version that supports the mini-program dev shell. If the mock host is open inside Codex, VSCode, or another embedded browser, ask the user to open the same debug page in the system browser before retrying because embedded browsers may block the `heybox://` protocol handoff.
 
@@ -165,11 +167,11 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 
 `manifest.json` 仅作为提交审核接口的 `manifest` 字段提交，不会上传到 CDN。Vite 项目通过 `miniappManifest()` 插件生成；CLI 不会自动注入插件，请在 `vite.config.ts` 中显式挂载。小程序构建产物需要使用相对资源路径；`hb-sdk create` 模板会显式配置 `base: './'`，未配置 `base` 的项目也会由 `miniappManifest()` 在 build 时默认补成 `./`。构建产物只能在兼容的小黑盒 Runtime 中启动，普通浏览器直接打开时不会执行标准业务脚本。
 
-`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。开发者手动执行 Vite build 时仍会运行最低 SDK 版本门禁。
+`dev`、手动 Vite build、`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。
 
 默认发布策略是 `auto_publish=false`：运营审核通过后使用 `hb-sdk remote versions` 查看版本状态，再用 `hb-sdk remote release <version>` 发布。需要审核通过后自动发布并下架旧线上版本时，使用 `--auto-publish`。如需让指定用户预览未发布候选版本，使用 `hb-sdk remote allowlist add <heybox_id>` 管理预览白名单。
 
-内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query，deploy 子构建不执行该门禁。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
+内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
 
 `hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.2+skill.f2a041bb2256",
+  "skillVersion": "0.6.4-alpha.0+skill.20921fb44039",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.2",
-    "compatibility": "0.6.2"
+    "version": "0.6.4-alpha.0",
+    "compatibility": "0.6.4-alpha.0"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-f2a041bb22563610e0fcaa991e2e5a2a94c331a029aafe4535083ecf89a4a6b0"
+  "integrity": "sha256-20921fb44039d21908fb692fc7d593c1dbc3b4f5dfa8f36f24aa0258ce150d13"
 }

package/types/miniapp-publish/index.d.ts

@@ -2,7 +2,6 @@ export declare const MINIAPP_UPLOAD_SCOPE = "activity";
 export declare const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 export declare const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 export declare const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES: number;
-export declare const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = "/user_miniprogram/public/sdk_config";
 export declare const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = "/mall/developer/user_miniprogram/access_status";
 export declare const DEVELOPER_ENTITY_LIST_API_PATH = "/mall/developer/entity/list";
 export declare const DEVELOPER_ENTITY_SWITCH_API_PATH = "/mall/developer/entity/switch";

package/types/vite/index.d.ts

@@ -1,18 +1,12 @@
-import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
 type MiniappManifestPlugin = {
     name: string;
     config: (config: MiniappManifestUserConfig) => MiniappManifestUserConfig | void;
     configResolved: (resolved: MiniappManifestResolvedConfig) => void;
-    buildStart: () => Promise<void>;
     /** Rollup 在构建失败后仍会跑 closeBundle；用 buildEnd 记录真实错误，避免二次校验掩盖原因。 */
     buildEnd: (error?: Error) => void;
     transformIndexHtml: (html: string) => string;
     closeBundle: (this: MiniappManifestPluginContext) => Promise<void>;
 };
-export interface MiniappManifestOptions {
-    /** 仅供平台测试和自托管 Remote Environment adapter 使用。 */
-    enforceSdkVersion?: typeof defaultEnforceRemoteSdkVersion;
-}
 interface MiniappManifestUserConfig {
     base?: string;
     define?: Record<string, string>;
@@ -37,5 +31,5 @@ interface MiniappManifestResolvedConfig {
         };
     };
 }
-export declare function miniappManifest(options?: MiniappManifestOptions): MiniappManifestPlugin;
+export declare function miniappManifest(): MiniappManifestPlugin;
 export {};

package/types/cli/auth/base-url.d.ts

@@ -1,20 +0,0 @@
-export interface HeyboxBaseUrlEnv extends NodeJS.ProcessEnv {
-    HB_SDK_API_BASE_URL?: string;
-    HB_SDK_ALLOW_UNSAFE_API_BASE_URL?: string;
-    HB_SDK_LOGIN_BASE_URL?: string;
-}
-export interface HeyboxBaseUrlResolveOptions {
-    env?: HeyboxBaseUrlEnv;
-}
-export interface HeyboxApiBaseUrlResolveOptions extends HeyboxBaseUrlResolveOptions {
-    allowUnsafeApiBaseUrl?: boolean;
-    apiBaseUrl?: string;
-}
-export interface HeyboxLoginBaseUrlResolveOptions extends HeyboxBaseUrlResolveOptions {
-    loginBaseUrl?: string;
-}
-export declare const HEYBOX_API_BASE_URL = "https://api.xiaoheihe.cn";
-export declare const HEYBOX_LOGIN_BASE_URL = "https://login.xiaoheihe.cn";
-export declare function resolveHeyboxApiBaseUrl(options?: HeyboxApiBaseUrlResolveOptions): string;
-export declare function resolveHeyboxLoginBaseUrl(options?: HeyboxLoginBaseUrlResolveOptions): string;
-export declare function normalizeHeyboxOriginUrl(value: string, label: string): string;

package/types/cli/config.d.ts

@@ -1,11 +0,0 @@
-import type { RylaiServiceTagConfig } from '@heybox/hb-types';
-export type HeyboxCliRequestConfig = RylaiServiceTagConfig;
-export declare function configureHeyboxCliRequestConfig(config: HeyboxCliRequestConfig): void;
-export declare function readHeyboxCliRequestConfig(): HeyboxCliRequestConfig;
-/**
- * 当 tag 为非空字符串时，把它设为 CLI 全局 default_tag；为空时不改动现有配置，
- * 避免清掉 env 预设阶段已注入的值。
- */
-export declare function applyServiceTagIfNeeded(tag: unknown): void;
-export declare function resolveHeyboxRylaiServiceTag(pathWithQuery?: string, config?: RylaiServiceTagConfig): string | undefined;
-export declare function normalizeHeyboxRylaiServiceTagConfig(config: HeyboxCliRequestConfig): RylaiServiceTagConfig;