@heybox/hb-sdk 0.6.5 → 0.6.6-alpha.0

package/dist/cli-chunks/{doctor-DEgZa2qC.cjs → doctor-OIjeEwrd.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CKat0ExC.cjs');
+var index = require('./index-Ck6a9STO.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-CKat0ExC.cjs → index-Ck6a9STO.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CKat0ExC.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CKat0ExC.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CKat0ExC.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CKat0ExC.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CKat0ExC.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.5';
+const BUILT_CLI_VERSION = '0.6.6-alpha.0';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13668,31 +13668,31 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-B6gERpSX.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CqXRKZgq.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-B6gERpSX.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CqXRKZgq.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-B6gERpSX.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CqXRKZgq.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-D3BBKay9.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CG36zW_8.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-C3u5FXIy.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-BjlyFzNU.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DEgZa2qC.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-OIjeEwrd.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BfQiZzeJ.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-vquOa1cT.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-B5gEl9ow.cjs → index-NrjOOQMK.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-CKat0ExC.cjs');
+var index$2 = require('./index-Ck6a9STO.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var context$1 = require('./context-DjepdCaa.cjs');
+var context$1 = require('./context-Do5YcZPw.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');

package/dist/cli-chunks/{login-B6gERpSX.cjs → login-CqXRKZgq.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DPEq__gB.cjs');
+var session = require('./session-DUM4KQHQ.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CKat0ExC.cjs');
+var index = require('./index-Ck6a9STO.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{remote-BfQiZzeJ.cjs → remote-vquOa1cT.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-CKat0ExC.cjs');
-var session = require('./session-DPEq__gB.cjs');
+var index = require('./index-Ck6a9STO.cjs');
+var session = require('./session-DUM4KQHQ.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var context = require('./context-DjepdCaa.cjs');
+var context = require('./context-Do5YcZPw.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -264,7 +264,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-B5gEl9ow.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-NrjOOQMK.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{session-DPEq__gB.cjs → session-DUM4KQHQ.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-CKat0ExC.cjs');
+var index = require('./index-Ck6a9STO.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-CKat0ExC.cjs');
+var index = require('./cli-chunks/index-Ck6a9STO.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/index.html

@@ -384,6 +384,7 @@
           <div class="actions" style="margin-top: 10px">
             <button id="reset-permissions-button" type="button">恢复初始权限</button>
           </div>
+          <div class="mac-app-status" id="permission-persistence-status"></div>
           <ul class="release-diagnostics" id="release-diagnostics"></ul>
         </section>
 

package/dist/devtools/mock-host/main.js

@@ -3427,6 +3427,11 @@ function requireBrowser () {
 
 var browserExports = requireBrowser();
 
+/** Dev Shell 读取局域网 Dev Session endpoint 的 query 参数。 */
+const MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM = 'dev_context_url';
+/** Mock Host 创建和读取 Dev Session 的固定路径。 */
+const MINI_PROGRAM_DEV_CONTEXT_PATH = '/__hb_sdk__/dev-context';
+
 function createCSPViolationPanel(container) {
     const seen = new Set();
     const list = document.createElement('ol');
@@ -6385,6 +6390,7 @@ function isPlainRecord(value) {
 
 const NETWORK_PROXY_PATH = '/__hb_sdk_mock_network__';
 const MOCK_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
+const DEV_PERMISSIONS_PATH = '/__hb_sdk__/dev-permissions';
 const RUNTIME_GATE_PROBE_METHOD = 'runtime.gate.probe';
 const params = new URL(location.href).searchParams;
 const miniUrl = params.get('mini_url');
@@ -6397,6 +6403,9 @@ const storage = new Map();
 const logs = [];
 let handshaken = false;
 let navigationBarStyle = 'dark';
+let mobileQrGeneration = 0;
+let mobileQrRefreshTimer;
+let mobileDevSessionCreation = Promise.resolve();
 let currentUser = {
     heybox_id: 'debug_user',
     nickname: 'PC Debug User',
@@ -6419,6 +6428,7 @@ const elements = {
     mobileQrStatus: queryElement('#mobile-qr-status'),
     nicknameInput: queryElement('#nickname-input'),
     networkPermissionSelect: queryElement('#network-permission-select'),
+    permissionPersistenceStatus: queryElement('#permission-persistence-status'),
     releaseDiagnostics: queryElement('#release-diagnostics'),
     resetPermissionsButton: queryElement('#reset-permissions-button'),
     storageSnapshot: queryElement('#storage-snapshot'),
@@ -6431,9 +6441,12 @@ if (!miniUrl) {
 }
 const miniProgramUrl = miniUrl;
 const bootstrap = await loadMockHostBootstrap();
-const devContext = bootstrap.devContext;
-const initialPermissionState = createMiniProgramMockPermissionState(devContext);
-let permissionState = clonePermissionState(initialPermissionState);
+let devContext = bootstrap.devContext;
+let remotePermissionState = createMiniProgramMockPermissionState(devContext);
+let permissionState = clonePermissionState(remotePermissionState);
+let hasPermissionOverride = false;
+let permissionActionMessage = '';
+await loadPersistedPermissionConfiguration();
 const iframe = document.createElement('iframe');
 iframe.src = appendNonce(miniProgramUrl, nonce);
 iframe.allow = 'clipboard-read; clipboard-write';
@@ -6468,6 +6481,7 @@ updateStorageSnapshot();
 updatePermissionControls();
 window.addEventListener('message', handleMessage);
 window.addEventListener('beforeunload', () => {
+    clearMobileQrRefreshTimer();
     postEvent('unload', { timestamp: Date.now() });
 });
 queryElement('#login-button').addEventListener('click', () => {
@@ -6494,13 +6508,10 @@ elements.mobileLanSelect.addEventListener('change', () => {
     void updateMobileQrCode();
 });
 elements.networkPermissionSelect.addEventListener('change', () => {
-    permissionState.networkRequest.status =
-        elements.networkPermissionSelect.value === 'enabled' ? 'enabled' : 'disabled';
-    rebuildRuntimeWithPermissions();
+    void savePermissionOverride(elements.networkPermissionSelect.value === 'enabled' ? 'enabled' : 'disabled');
 });
 elements.resetPermissionsButton.addEventListener('click', () => {
-    permissionState = clonePermissionState(initialPermissionState);
-    rebuildRuntimeWithPermissions();
+    void resetPermissionOverride();
 });
 const mobileAppQrReady = setupMobileAppQr();
 function createRuntime() {
@@ -6515,14 +6526,149 @@ function rebuildRuntimeWithPermissions() {
 }
 function updatePermissionControls() {
     elements.devContextStatus.textContent =
-        devContext.source === 'remote'
-            ? `已连接线上配置${devContext.miniProgramId ? ` · ${devContext.miniProgramId}` : ''}`
-            : '匿名本地沙箱';
+        devContext.source === 'remote' ? `已连接线上配置${devContext.miniProgramId ? ` · ${devContext.miniProgramId}` : ''}` : '匿名本地沙箱';
     elements.networkPermissionSelect.value = permissionState.networkRequest.status;
+    const remoteLabel = readPermissionStatusLabel(remotePermissionState.networkRequest.status);
+    const localLabel = readPermissionStatusLabel(permissionState.networkRequest.status);
+    const sourceDescription = hasPermissionOverride
+        ? `远端基线：${remoteLabel} · 本地覆盖：${localLabel}`
+        : `${devContext.source === 'remote' ? '当前使用远端权限' : '当前使用匿名默认权限'}：${remoteLabel}`;
+    elements.permissionPersistenceStatus.textContent = permissionActionMessage
+        ? `${sourceDescription} · ${permissionActionMessage}`
+        : sourceDescription;
     const diagnostics = createMiniProgramDevReleaseDiagnostics(devContext, permissionState);
-    elements.releaseDiagnostics.innerHTML = diagnostics
-        .map((diagnostic) => `<li>${escapeHtml(diagnostic.message)}</li>`)
-        .join('');
+    elements.releaseDiagnostics.innerHTML = diagnostics.map((diagnostic) => `<li>${escapeHtml(diagnostic.message)}</li>`).join('');
+}
+async function loadPersistedPermissionConfiguration() {
+    try {
+        const response = await fetch(DEV_PERMISSIONS_PATH, { cache: 'no-store' });
+        const payload = await response.json();
+        const configuration = readPermissionConfiguration(payload);
+        if (!response.ok || !configuration) {
+            throw new Error('权限持久化配置加载失败');
+        }
+        applyPermissionConfiguration(configuration);
+    }
+    catch {
+        permissionActionMessage = '权限持久化暂不可用，刷新或重启后可能丢失本页修改。';
+    }
+}
+async function savePermissionOverride(status) {
+    elements.networkPermissionSelect.disabled = true;
+    elements.resetPermissionsButton.disabled = true;
+    permissionState = {
+        networkRequest: {
+            ...permissionState.networkRequest,
+            status,
+        },
+    };
+    hasPermissionOverride = true;
+    permissionActionMessage = '正在保存本地权限覆盖...';
+    rebuildRuntimeWithPermissions();
+    void updateMobileQrCode();
+    try {
+        const response = await fetch(DEV_PERMISSIONS_PATH, {
+            body: JSON.stringify({
+                runtime_permissions: createMiniProgramMockRuntimePermissions(permissionState),
+            }),
+            headers: { 'content-type': 'application/json' },
+            method: 'PUT',
+        });
+        const payload = await response.json();
+        const configuration = readPermissionConfiguration(payload);
+        if (!response.ok || !configuration) {
+            throw new Error(readResponseMessage(payload) ?? '保存失败');
+        }
+        applyPermissionConfiguration(configuration, configuration.persistenceError || '本地权限覆盖已保存。');
+        rebuildRuntimeWithPermissions();
+    }
+    catch (error) {
+        permissionActionMessage = `${readErrorText(error)}，当前页面仍会应用该权限，但刷新或重启后会丢失。`;
+        updatePermissionControls();
+    }
+    finally {
+        elements.networkPermissionSelect.disabled = false;
+        elements.resetPermissionsButton.disabled = false;
+    }
+}
+async function resetPermissionOverride() {
+    elements.networkPermissionSelect.disabled = true;
+    elements.resetPermissionsButton.disabled = true;
+    try {
+        const response = await fetch(DEV_PERMISSIONS_PATH, {
+            method: 'DELETE',
+        });
+        const payload = await response.json();
+        const configuration = readPermissionConfiguration(payload);
+        if (!response.ok || !configuration) {
+            throw new Error(readResponseMessage(payload) ?? '重置失败');
+        }
+        else {
+            applyPermissionConfiguration(configuration, configuration.source === 'remote' ? '已重新读取远端权限并清除本地覆盖。' : '已清除本地权限覆盖。');
+        }
+        rebuildRuntimeWithPermissions();
+        void updateMobileQrCode();
+    }
+    catch (error) {
+        permissionActionMessage = `重置失败：${readErrorText(error)}`;
+        updatePermissionControls();
+    }
+    finally {
+        elements.networkPermissionSelect.disabled = false;
+        elements.resetPermissionsButton.disabled = false;
+    }
+}
+function readPermissionConfiguration(value) {
+    if (!isRecord(value) || (value.source !== 'anonymous' && value.source !== 'remote')) {
+        return undefined;
+    }
+    const remotePermissions = value.remote_permissions;
+    const remoteParsed = parseMiniProgramRuntimePermissions(remotePermissions);
+    const overridePermissions = value.override_permissions;
+    const overrideParsed = parseMiniProgramRuntimePermissions(overridePermissions);
+    if (remotePermissions !== undefined && !remoteParsed.valid) {
+        return undefined;
+    }
+    if (overridePermissions !== undefined && !overrideParsed.valid) {
+        return undefined;
+    }
+    const source = value.source;
+    const fallbackContext = { };
+    return {
+        source,
+        miniProgramId: typeof value.mini_program_id === 'string' ? value.mini_program_id : undefined,
+        remotePermissions,
+        remoteState: createMiniProgramMockPermissionState(remotePermissions === undefined ? fallbackContext : { runtimePermissions: remotePermissions }),
+        ...(overridePermissions === undefined
+            ? {}
+            : {
+                overrideState: createMiniProgramMockPermissionState({ runtimePermissions: overridePermissions }),
+            }),
+        persistenceError: typeof value.persistence_error === 'string' ? value.persistence_error : undefined,
+    };
+}
+function applyPermissionConfiguration(configuration, message) {
+    devContext =
+        configuration.source === 'remote'
+            ? {
+                source: 'remote',
+                miniProgramId: configuration.miniProgramId,
+                runtimePermissions: configuration.remotePermissions,
+            }
+            : { source: 'anonymous', warning: devContext.warning };
+    remotePermissionState = clonePermissionState(configuration.remoteState);
+    permissionState = clonePermissionState(configuration.overrideState ?? configuration.remoteState);
+    hasPermissionOverride = Boolean(configuration.overrideState);
+    permissionActionMessage = message ?? configuration.persistenceError ?? '';
+}
+function readPermissionStatusLabel(status) {
+    return status === 'enabled' ? '允许' : '拒绝';
+}
+function readResponseMessage(value) {
+    return isRecord(value) && typeof value.message === 'string' ? value.message : undefined;
+}
+function readErrorText(error) {
+    return error instanceof Error && error.message ? error.message : '操作失败';
 }
 function clonePermissionState(state) {
     return {
@@ -6754,9 +6900,7 @@ async function loadMockHostBootstrap() {
             devContext: readDevContext(payload.devContext, payload.runtimePermissions),
             lanAddresses: Array.isArray(payload.lanAddresses) ? payload.lanAddresses.filter(isLanAddress) : [],
             macAppProtocol: typeof payload.macAppProtocol === 'string' ? payload.macAppProtocol : undefined,
-            nativeAppLaunchUnavailableReason: typeof payload.nativeAppLaunchUnavailableReason === 'string'
-                ? payload.nativeAppLaunchUnavailableReason
-                : undefined,
+            nativeAppLaunchUnavailableReason: typeof payload.nativeAppLaunchUnavailableReason === 'string' ? payload.nativeAppLaunchUnavailableReason : undefined,
             runtimePermissions: payload.runtimePermissions,
         };
     }
@@ -6805,6 +6949,8 @@ function setupMobileLanSelect() {
     elements.mobileLanSelect.disabled = !hasLanAddress;
 }
 async function updateMobileQrCode() {
+    const generation = ++mobileQrGeneration;
+    clearMobileQrRefreshTimer();
     if (nativeAppLaunchUnavailableReason) {
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
@@ -6818,8 +6964,8 @@ async function updateMobileQrCode() {
         elements.mobileQrStatus.textContent = '';
         return;
     }
-    const payload = selected.mobileAppQrPayload;
-    if (!payload) {
+    const basePayload = selected.mobileAppQrPayload;
+    if (!basePayload) {
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
         elements.mobileQrStatus.textContent = '真机调试配置不可用，请重启 hb-sdk dev 后重试。';
@@ -6827,20 +6973,112 @@ async function updateMobileQrCode() {
     }
     elements.mobileQrStatus.textContent = '正在生成二维码...';
     try {
-        elements.mobileQrImage.src = await browserExports.toDataURL(payload, {
+        const devSession = await createMobileDevSession(selected);
+        if (generation !== mobileQrGeneration) {
+            return;
+        }
+        const payload = applyDevContextToMobileQrPayload(basePayload, devSession.url);
+        const imageUrl = await browserExports.toDataURL(payload, {
             errorCorrectionLevel: 'M',
             margin: 1,
             width: 176,
         });
+        if (generation !== mobileQrGeneration) {
+            return;
+        }
+        elements.mobileQrImage.src = imageUrl;
         elements.mobileQrImage.hidden = false;
         elements.mobileQrStatus.textContent = '';
+        scheduleMobileQrRefresh(devSession.expiresAt, generation);
     }
     catch {
+        if (generation !== mobileQrGeneration) {
+            return;
+        }
         elements.mobileQrImage.removeAttribute('src');
         elements.mobileQrImage.hidden = true;
         elements.mobileQrStatus.textContent = '二维码生成失败';
     }
 }
+async function createMobileDevSession(selected) {
+    const creation = mobileDevSessionCreation.then(() => requestMobileDevSession(selected));
+    mobileDevSessionCreation = creation.then(() => undefined, () => undefined);
+    return creation;
+}
+async function requestMobileDevSession(selected) {
+    const miniUrl = new URL(selected.appUrl);
+    const response = await fetch(MINI_PROGRAM_DEV_CONTEXT_PATH, {
+        body: JSON.stringify({
+            mini_url_origin: miniUrl.origin,
+            runtime_permissions: createMiniProgramMockRuntimePermissions({
+                ...permissionState,
+                networkRequest: {
+                    ...permissionState.networkRequest,
+                    useOfficialDomain: false,
+                },
+            }),
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'POST',
+    });
+    if (!response.ok) {
+        throw new Error('Failed to create mobile Dev Session');
+    }
+    const result = await response.json();
+    if (!isRecord(result) ||
+        typeof result.token !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(result.token) ||
+        typeof result.expires_at !== 'number' ||
+        !Number.isFinite(result.expires_at) ||
+        result.expires_at <= Date.now()) {
+        throw new Error('Invalid mobile Dev Session response');
+    }
+    const devContextUrl = new URL(`${MINI_PROGRAM_DEV_CONTEXT_PATH}/${result.token}`, location.origin);
+    devContextUrl.hostname = miniUrl.hostname;
+    return {
+        expiresAt: result.expires_at,
+        url: devContextUrl.toString(),
+    };
+}
+function scheduleMobileQrRefresh(expiresAt, generation) {
+    mobileQrRefreshTimer = window.setTimeout(() => {
+        if (generation !== mobileQrGeneration) {
+            return;
+        }
+        elements.mobileQrImage.removeAttribute('src');
+        elements.mobileQrImage.hidden = true;
+        elements.mobileQrStatus.textContent = '二维码已过期，正在重新生成...';
+        void updateMobileQrCode();
+    }, Math.max(0, expiresAt - Date.now()));
+}
+function clearMobileQrRefreshTimer() {
+    if (mobileQrRefreshTimer === undefined) {
+        return;
+    }
+    window.clearTimeout(mobileQrRefreshTimer);
+    mobileQrRefreshTimer = undefined;
+}
+function applyDevContextToMobileQrPayload(payload, devContextUrl) {
+    const protocolMarker = '#heybox://';
+    const protocolIndex = payload.indexOf(protocolMarker);
+    if (protocolIndex < 0) {
+        throw new Error('Invalid mobile App QR payload');
+    }
+    const encodedPayload = payload.slice(protocolIndex + protocolMarker.length);
+    const openWindowPayload = JSON.parse(decodeURIComponent(encodedPayload));
+    if (!isRecord(openWindowPayload) || !isRecord(openWindowPayload.webview)) {
+        throw new Error('Invalid mobile App openWindow payload');
+    }
+    const devShellUrlValue = openWindowPayload.webview.url;
+    if (typeof devShellUrlValue !== 'string') {
+        throw new Error('Missing mobile App dev shell URL');
+    }
+    const devShellUrl = new URL(devShellUrlValue);
+    devShellUrl.searchParams.delete('dev_network_request');
+    devShellUrl.searchParams.set(MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM, devContextUrl);
+    openWindowPayload.webview.url = devShellUrl.toString();
+    return `${payload.slice(0, protocolIndex)}${protocolMarker}${encodeURIComponent(JSON.stringify(openWindowPayload))}`;
+}
 function updateNativeAppLaunchAvailability() {
     const isUnavailable = Boolean(nativeAppLaunchUnavailableReason);
     elements.macAppButton.disabled = isUnavailable;

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.5';
+    : '0.6.6-alpha.0';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.5';
+    : '0.6.6-alpha.0';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/vite.cjs.js

@@ -7,7 +7,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.5';
+    : '0.6.6-alpha.0';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.5';
+    : '0.6.6-alpha.0';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.5",
+  "version": "0.6.6-alpha.0",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -51,7 +51,8 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "parse5": "^7.3.0"
+    "parse5": "^7.3.0",
+    "undici": "^7.28.0"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -92,7 +93,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.3"
+    "@heybox/hb-api": "~1.25.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/SKILL.md

@@ -80,7 +80,9 @@ For CLI and local development:
 2. Do not use `hb-sdk login` as a workaround for mini-program user authentication.
 3. Use the built-in local debugging page instead of creating another browser Mock.
 4. Keep the Vite `miniappManifest()` plugin enabled.
-5. Treat browser Mock settings as local-only; they must not be presented as online permissions.
+5. Treat Dev Context permission changes as persistent local overrides, not online configuration changes. `hb-sdk` scopes them by real project path and `miniProgramId`, restores them after page refresh or `hb-sdk dev` restart, and clears them only after an explicit reset successfully refetches remote permissions. A regenerated Mobile App QR code may carry only a `dev_context_url` backed by a 256-bit token that expires after 5 minutes; it must not embed a permission snapshot.
+6. Require the Runtime Host to fetch the immutable Dev Session snapshot before startup. Dev Session `network.request` must use the token-bound local proxy, never a native credential adapter, and must force `useOfficialDomain: false`.
+7. Do not treat the legacy `dev_network_request` query as authorization or as a fallback. This Web-only flow must preserve existing Android/iOS URL pass-through behavior without requiring client changes.
 
 For host/runtime/protocol-maintenance code: