@heybox/hb-sdk 0.6.6-alpha.0 → 0.6.6-alpha.1

package/README.md

@@ -336,6 +336,8 @@ await network.request({
 
 `network.request` 由平台 Runtime 权限控制。未授权时 SDK 会收到 `PERMISSION_DENIED` 和“当前小程序暂不支持网络请求”；即使已开启网络请求，访问黑盒官方域名仍需要运营侧单独开启官方域名配置。业务代码不能自行请求或注入 Cookie、pkey 等官方凭据。
 
+权限开启后，`network.request` 可以访问任意 HTTP(S) 目标，包括本机、局域网和保留地址。Runtime 不按目标地址类别拦截请求；宿主网络适配器仍负责实际连接、重定向和系统网络错误。
+
 ## 生命周期事件
 
 导入 SDK 根包时会 eager 创建唯一默认实例并立即开始与父容器握手。使用 `on()` 监听父容器派发的小程序事件时不会创建第二个实例；`on()` 会返回取消监听函数，组件卸载或页面销毁时应及时调用。

package/dist/cli-chunks/{context-Do5YcZPw.cjs → context-D-cb_pNY.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var session = require('./session-DUM4KQHQ.cjs');
+var session = require('./session-BRwveiW8.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');

package/dist/cli-chunks/{create-CG36zW_8.cjs → create-DlU4nWz_.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-Ck6a9STO.cjs');
+var index = require('./index-gP0K2xx1.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-BjlyFzNU.cjs → dev-Bb4U965a.cjs}

@@ -12,8 +12,8 @@ var node_http = require('node:http');
 var node_crypto = require('node:crypto');
 var undici = require('undici');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-Ck6a9STO.cjs');
-var context = require('./context-Do5YcZPw.cjs');
+var index = require('./index-gP0K2xx1.cjs');
+var context = require('./context-D-cb_pNY.cjs');
 require('node:process');
 require('node:buffer');
 require('node:util');
@@ -27,7 +27,7 @@ require('events');
 require('stream');
 require('buffer');
 require('util');
-require('./session-DUM4KQHQ.cjs');
+require('./session-BRwveiW8.cjs');
 require('fs');
 require('constants');
 
@@ -422,7 +422,7 @@ async function fetchMockNetworkWithRedirects(options) {
     let method = options.method;
     let body = options.body;
     for (let redirectCount = 0; redirectCount <= MAX_MOCK_NETWORK_REDIRECTS; redirectCount += 1) {
-        const pinnedTarget = await resolvePublicMockNetworkTarget(url, options.lookupHostname);
+        const pinnedTarget = await resolveMockNetworkTarget(url, options.lookupHostname);
         options.pinnedTargets.set(createPinnedNetworkTargetKey(url), pinnedTarget);
         const response = await options.fetchImpl(url.toString(), {
             body,
@@ -451,17 +451,18 @@ async function fetchMockNetworkWithRedirects(options) {
     }
     throw createMockHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
 }
-async function resolvePublicMockNetworkTarget(url, lookupHostname) {
+async function resolveMockNetworkTarget(url, lookupHostname) {
     if (!['http:', 'https:'].includes(url.protocol)) {
         throw createMockHostError(403, 'NETWORK_TARGET_DENIED', 'network.request redirect 仅支持 HTTP(S) URL');
     }
     if (url.username || url.password) {
         throw createMockHostError(403, 'NETWORK_TARGET_DENIED', 'network.request URL 不允许包含凭据');
     }
-    const addressFamily = net.isIP(url.hostname);
-    const addresses = addressFamily ? [{ address: url.hostname, family: addressFamily }] : await lookupHostname(url.hostname);
-    if (!addresses.length || addresses.some(({ address, family }) => !isPublicIpAddress(address, family))) {
-        throw createMockHostError(403, 'NETWORK_TARGET_DENIED', 'network.request 不允许指向本机、内网或保留地址');
+    const hostname = normalizeNetworkHostname(url.hostname);
+    const addressFamily = net.isIP(hostname);
+    const addresses = addressFamily ? [{ address: hostname, family: addressFamily }] : await lookupHostname(hostname);
+    if (!addresses.length) {
+        throw new Error('network.request target DNS lookup returned no addresses');
     }
     return addresses[0];
 }
@@ -489,60 +490,6 @@ function createPinnedNetworkTargetKey(url) {
 function normalizeNetworkHostname(hostname) {
     return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
 }
-const blockedNetworkTargets = createBlockedNetworkTargets();
-const publicIpv6Targets = createPublicIpv6Targets();
-function createBlockedNetworkTargets() {
-    const blockList = new net.BlockList();
-    for (const [network, prefix] of [
-        ['0.0.0.0', 8],
-        ['10.0.0.0', 8],
-        ['100.64.0.0', 10],
-        ['127.0.0.0', 8],
-        ['169.254.0.0', 16],
-        ['172.16.0.0', 12],
-        ['192.0.0.0', 24],
-        ['192.0.2.0', 24],
-        ['192.168.0.0', 16],
-        ['198.18.0.0', 15],
-        ['198.51.100.0', 24],
-        ['203.0.113.0', 24],
-        ['224.0.0.0', 4],
-        ['240.0.0.0', 4],
-    ]) {
-        blockList.addSubnet(network, prefix, 'ipv4');
-    }
-    for (const [network, prefix] of [
-        ['::', 128],
-        ['::1', 128],
-        ['fc00::', 7],
-        ['fe80::', 10],
-        ['ff00::', 8],
-        ['2001:db8::', 32],
-        ['2001::', 23],
-        ['2002::', 16],
-        ['3ffe::', 16],
-    ]) {
-        blockList.addSubnet(network, prefix, 'ipv6');
-    }
-    return blockList;
-}
-function createPublicIpv6Targets() {
-    const blockList = new net.BlockList();
-    blockList.addSubnet('2000::', 3, 'ipv6');
-    return blockList;
-}
-function isPublicIpAddress(address, family) {
-    if (family === 4 || net.isIP(address) === 4) {
-        return !blockedNetworkTargets.check(address, 'ipv4');
-    }
-    if (family === 6 || net.isIP(address) === 6) {
-        if (address.toLowerCase().startsWith('::ffff:')) {
-            return false;
-        }
-        return publicIpv6Targets.check(address, 'ipv6') && !blockedNetworkTargets.check(address, 'ipv6');
-    }
-    return false;
-}
 async function readLimitedMockNetworkResponse(response) {
     if (!response.body) {
         return '';
@@ -1310,7 +1257,7 @@ function cloneDefaultPermissionState() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.0';
+    : '0.6.6-alpha.1';
 
 class DevPermissionOverrideStoreError extends Error {
     code;

package/dist/cli-chunks/{doctor-OIjeEwrd.cjs → doctor-DwDqOLdV.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-Ck6a9STO.cjs');
+var index = require('./index-gP0K2xx1.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{index-NrjOOQMK.cjs → index-B6gnwx39.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-Ck6a9STO.cjs');
+var index$2 = require('./index-gP0K2xx1.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var context$1 = require('./context-Do5YcZPw.cjs');
+var context$1 = require('./context-D-cb_pNY.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');

package/dist/cli-chunks/{index-Ck6a9STO.cjs → index-gP0K2xx1.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Ck6a9STO.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.6-alpha.0';
+const BUILT_CLI_VERSION = '0.6.6-alpha.1';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13668,31 +13668,31 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CqXRKZgq.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BFIcNgmi.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CqXRKZgq.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BFIcNgmi.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CqXRKZgq.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BFIcNgmi.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CG36zW_8.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DlU4nWz_.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-BjlyFzNU.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-Bb4U965a.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-OIjeEwrd.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DwDqOLdV.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-vquOa1cT.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-YESvKni6.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{login-CqXRKZgq.cjs → login-BFIcNgmi.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-DUM4KQHQ.cjs');
+var session = require('./session-BRwveiW8.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-Ck6a9STO.cjs');
+var index = require('./index-gP0K2xx1.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{remote-vquOa1cT.cjs → remote-YESvKni6.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-Ck6a9STO.cjs');
-var session = require('./session-DUM4KQHQ.cjs');
+var index = require('./index-gP0K2xx1.cjs');
+var session = require('./session-BRwveiW8.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var context = require('./context-Do5YcZPw.cjs');
+var context = require('./context-D-cb_pNY.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -264,7 +264,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-NrjOOQMK.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-B6gnwx39.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {

package/dist/cli-chunks/{session-DUM4KQHQ.cjs → session-BRwveiW8.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-Ck6a9STO.cjs');
+var index = require('./index-gP0K2xx1.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-Ck6a9STO.cjs');
+var index = require('./cli-chunks/index-gP0K2xx1.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/devtools/mock-host/main.js

@@ -4107,57 +4107,14 @@ function assertNetworkAllowedKeys(payload) {
 }
 function readNetworkRequestUrl(value) {
     const requestUrl = readMiniProgramRuntimeHttpUrl(value, 'network.request url 必须是 HTTP(S) URL');
-    assertPublicNetworkRequestUrl(requestUrl);
+    assertNetworkRequestUrl(requestUrl);
     return requestUrl;
 }
-function assertPublicNetworkRequestUrl(requestUrl) {
+function assertNetworkRequestUrl(requestUrl) {
     const url = new URL(requestUrl);
     if (url.username || url.password) {
         throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'network.request url 不允许包含用户信息');
     }
-    if (isUnsafeNetworkHost(url.hostname)) {
-        throw createMiniProgramRuntimeBridgeError('INVALID_PARAMS', 'network.request url 不允许指向本机、内网或保留地址');
-    }
-}
-function isUnsafeNetworkHost(hostname) {
-    const normalizedHost = hostname.toLowerCase();
-    const ipv6Host = normalizedHost.startsWith('[') && normalizedHost.endsWith(']')
-        ? normalizedHost.slice(1, -1)
-        : normalizedHost;
-    if (normalizedHost === 'localhost' ||
-        normalizedHost.endsWith('.localhost') ||
-        normalizedHost.endsWith('.local') ||
-        normalizedHost === 'metadata.google.internal') {
-        return true;
-    }
-    if (isUnsafeIPv4Host(normalizedHost)) {
-        return true;
-    }
-    return isUnsafeIPv6Host(ipv6Host);
-}
-function isUnsafeIPv4Host(hostname) {
-    if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) {
-        return false;
-    }
-    const parts = hostname.split('.').map(part => Number(part));
-    if (parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) {
-        return true;
-    }
-    const [a, b] = parts;
-    return (a === 0 ||
-        a === 10 ||
-        a === 127 ||
-        (a === 100 && b >= 64 && b <= 127) ||
-        (a === 169 && b === 254) ||
-        (a === 172 && b >= 16 && b <= 31) ||
-        (a === 192 && b === 168));
-}
-function isUnsafeIPv6Host(hostname) {
-    return (hostname === '::' ||
-        hostname === '::1' ||
-        hostname.startsWith('fc') ||
-        hostname.startsWith('fd') ||
-        hostname.startsWith('fe80:'));
 }
 function readNetworkRequestHeaders(value) {
     const headers = readStringRecord(value, 'network.request headers 必须是 Record<string, string>');

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.0';
+    : '0.6.6-alpha.1';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.0';
+    : '0.6.6-alpha.1';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/vite.cjs.js

@@ -7,7 +7,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.0';
+    : '0.6.6-alpha.1';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.6-alpha.0';
+    : '0.6.6-alpha.1';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.6-alpha.0",
+  "version": "0.6.6-alpha.1",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -93,7 +93,7 @@
     "vue": "^2.7.16",
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
-    "@heybox/hb-api": "~1.25.4"
+    "@heybox/hb-api": "~1.25.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.6-alpha.0`
+- Version at generation time: `0.6.6-alpha.1`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -749,6 +749,8 @@ await network.request({
 
 `network.request` 由平台 Runtime 权限控制。未授权时 SDK 会收到 `PERMISSION_DENIED` 和“当前小程序暂不支持网络请求”；即使已开启网络请求，访问黑盒官方域名仍需要运营侧单独开启官方域名配置。业务代码不能自行请求或注入 Cookie、pkey 等官方凭据。
 
+权限开启后，`network.request` 可以访问任意 HTTP(S) 目标，包括本机、局域网和保留地址。Runtime 不按目标地址类别拦截请求；宿主网络适配器仍负责实际连接、重定向和系统网络错误。
+
 ## 生命周期事件
 
 导入 SDK 根包时会 eager 创建唯一默认实例并立即开始与父容器握手。使用 `on()` 监听父容器派发的小程序事件时不会创建第二个实例；`on()` 会返回取消监听函数，组件卸载或页面销毁时应及时调用。

package/skill/references/cli.md

@@ -126,7 +126,7 @@ Dev Context 中调整的 `network.request` 权限不会修改线上配置，但
 
 ### 浏览器 Mock 的边界
 
-浏览器 Mock 用于提高开发效率，不代表正式线上环境。Dev Session 的网络请求只对绑定 token 的本机或局域网开发页面生效，通过本地代理转发，不使用黑盒原生凭据 adapter；`useOfficialDomain` 始终为 `false`。旧 `dev_network_request` query 不再授权，权限只能来自有效的不可变 Dev Session 快照。该方案不要求修改 Android/iOS 客户端；用户状态仍只保存在浏览器 Mock，线上权限、客户端兼容性和最终交互仍需按真实发布配置验收。
+浏览器 Mock 用于提高开发效率，不代表正式线上环境。Dev Session 的网络请求只对绑定 token 的本机或局域网开发页面生效，通过本地代理转发，不使用黑盒原生凭据 adapter；`useOfficialDomain` 始终为 `false`。代理允许访问本机、局域网和保留地址，并对初始 URL 与每次重定向分别解析和固定连接地址。旧 `dev_network_request` query 不再授权，权限只能来自有效的不可变 Dev Session 快照。该方案不要求修改 Android/iOS 客户端；用户状态仍只保存在浏览器 Mock，线上权限、客户端兼容性和最终交互仍需按真实发布配置验收。
 
 ### 常用参数
 

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.6-alpha.0+skill.cfc5c9fb3951",
+  "skillVersion": "0.6.6-alpha.1+skill.2799351c9553",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.6-alpha.0",
-    "compatibility": "0.6.6-alpha.0"
+    "version": "0.6.6-alpha.1",
+    "compatibility": "0.6.6-alpha.1"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-cfc5c9fb39515fb1aa10fa2fc4db030d31ff0034b389062e009c0d6f2195e9e4"
+  "integrity": "sha256-2799351c9553f32af834bd0a53e6d016d647aafb275dff139ddd0dfaf2261321"
 }