@heybox/hb-sdk 0.6.6-alpha.1 → 0.6.6-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/README.md +2 -2
  2. package/dist/cli-chunks/{context-D-cb_pNY.cjs → context-CM46YbPT.cjs} +1 -1
  3. package/dist/cli-chunks/{create-DlU4nWz_.cjs → create-CxjB3oSo.cjs} +1 -1
  4. package/dist/cli-chunks/{dev-Bb4U965a.cjs → dev-Km0or0yY.cjs} +4 -4
  5. package/dist/cli-chunks/{doctor-DwDqOLdV.cjs → doctor-baVOqNSh.cjs} +1 -1
  6. package/dist/cli-chunks/{index-gP0K2xx1.cjs → index-ByDy5HXi.cjs} +13 -13
  7. package/dist/cli-chunks/{index-B6gnwx39.cjs → index-DCsEAuca.cjs} +2 -2
  8. package/dist/cli-chunks/{login-BFIcNgmi.cjs → login-fNe0eDs_.cjs} +2 -2
  9. package/dist/cli-chunks/{remote-YESvKni6.cjs → remote-BRIlRrCG.cjs} +4 -4
  10. package/dist/cli-chunks/{session-BRwveiW8.cjs → session-CTcelATz.cjs} +1 -1
  11. package/dist/cli.cjs +1 -1
  12. package/dist/index.cjs.js +1 -1
  13. package/dist/index.esm.js +1 -1
  14. package/dist/vite.cjs.js +3 -50
  15. package/dist/vite.esm.js +3 -50
  16. package/package.json +1 -1
  17. package/skill/references/api-root.md +5 -31
  18. package/skill/skill.json +4 -4
  19. package/types/vite/html-policy.d.ts +1 -4
  20. package/types/vite/index.d.ts +1 -10
package/README.md CHANGED
@@ -563,9 +563,9 @@ export default defineConfig({
563
563
 
564
564
  工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
565
565
 
566
- 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
566
+ 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 和 dev 都不会注入平台 CSP；项目已有的 CSP 会原样保留。浏览器原生 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe 和表单等能力不再由 SDK 构建产物统一限制，是否可用由宿主环境、项目自身策略和审核规则共同决定；需要宿主授权的业务网络请求仍应使用 `network.request()`。
567
567
 
568
- meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
568
+ meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 仍会使 build 失败。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
569
569
 
570
570
  失败与警告语义：
571
571
 
package/dist/cli-chunks/{context-D-cb_pNY.cjs → context-CM46YbPT.cjs} RENAMED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var session = require('./session-BRwveiW8.cjs');
3
+ var session = require('./session-CTcelATz.cjs');
4
4
  var fs$1 = require('node:fs');
5
5
  var fs = require('node:fs/promises');
6
6
  var path = require('node:path');
package/dist/cli-chunks/{create-DlU4nWz_.cjs → create-CxjB3oSo.cjs} RENAMED
@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
5
5
  var path = require('node:path');
6
6
  var require$$0 = require('fs');
7
7
  var require$$1 = require('path');
8
- var index = require('./index-gP0K2xx1.cjs');
8
+ var index = require('./index-ByDy5HXi.cjs');
9
9
  require('node:module');
10
10
  require('os');
11
11
  require('readline');
package/dist/cli-chunks/{dev-Bb4U965a.cjs → dev-Km0or0yY.cjs} RENAMED
@@ -12,8 +12,8 @@ var node_http = require('node:http');
12
12
  var node_crypto = require('node:crypto');
13
13
  var undici = require('undici');
14
14
  var browser = require('./browser-RAy8e8cV.cjs');
15
- var index = require('./index-gP0K2xx1.cjs');
16
- var context = require('./context-D-cb_pNY.cjs');
15
+ var index = require('./index-ByDy5HXi.cjs');
16
+ var context = require('./context-CM46YbPT.cjs');
17
17
  require('node:process');
18
18
  require('node:buffer');
19
19
  require('node:util');
@@ -27,7 +27,7 @@ require('events');
27
27
  require('stream');
28
28
  require('buffer');
29
29
  require('util');
30
- require('./session-BRwveiW8.cjs');
30
+ require('./session-CTcelATz.cjs');
31
31
  require('fs');
32
32
  require('constants');
33
33
 
@@ -1257,7 +1257,7 @@ function cloneDefaultPermissionState() {
1257
1257
  /** 构建时替换为当前发布包的实际版本。 */
1258
1258
  const HB_SDK_VERSION = typeof undefined === 'string'
1259
1259
  ? undefined
1260
- : '0.6.6-alpha.1';
1260
+ : '0.6.6-alpha.2';
1261
1261
 
1262
1262
  class DevPermissionOverrideStoreError extends Error {
1263
1263
  code;
package/dist/cli-chunks/{doctor-DwDqOLdV.cjs → doctor-baVOqNSh.cjs} RENAMED
@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
4
4
  var fs = require('node:fs/promises');
5
5
  var os = require('node:os');
6
6
  var path = require('node:path');
7
- var index = require('./index-gP0K2xx1.cjs');
7
+ var index = require('./index-ByDy5HXi.cjs');
8
8
  require('node:module');
9
9
  require('path');
10
10
  require('os');
package/dist/cli-chunks/{index-gP0K2xx1.cjs → index-ByDy5HXi.cjs} RENAMED
@@ -234,19 +234,19 @@ function requireArgument () {
234
234
 
235
235
  var command = {};
236
236
 
237
- const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
237
+ const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-ByDy5HXi.cjs', document.baseURI).href)));
238
238
  function __require$4() { return require$5("node:events"); }
239
239
 
240
- const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
240
+ const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-ByDy5HXi.cjs', document.baseURI).href)));
241
241
  function __require$3() { return require$4("node:child_process"); }
242
242
 
243
- const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
243
+ const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-ByDy5HXi.cjs', document.baseURI).href)));
244
244
  function __require$2() { return require$3("node:path"); }
245
245
 
246
- const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
246
+ const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-ByDy5HXi.cjs', document.baseURI).href)));
247
247
  function __require$1() { return require$2("node:fs"); }
248
248
 
249
- const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-gP0K2xx1.cjs', document.baseURI).href)));
249
+ const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-ByDy5HXi.cjs', document.baseURI).href)));
250
250
  function __require() { return require$1("node:process"); }
251
251
 
252
252
  var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
13347
13347
  }
13348
13348
 
13349
13349
  const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
13350
- const BUILT_CLI_VERSION = '0.6.6-alpha.1';
13350
+ const BUILT_CLI_VERSION = '0.6.6-alpha.2';
13351
13351
  const PACKAGE_JSON_CANDIDATES = [
13352
13352
  path.resolve(__dirname, '..', '..', 'package.json'),
13353
13353
  path.resolve(__dirname, '..', 'package.json'),
@@ -13668,31 +13668,31 @@ function createCommandLoggerResolver(options) {
13668
13668
  };
13669
13669
  }
13670
13670
  const defaultClearLoginStatus = async (...args) => {
13671
- const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BFIcNgmi.cjs'); });
13671
+ const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-fNe0eDs_.cjs'); });
13672
13672
  return clearLoginStatus(...args);
13673
13673
  };
13674
13674
  const defaultLoginToHeybox = async (...args) => {
13675
- const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BFIcNgmi.cjs'); });
13675
+ const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-fNe0eDs_.cjs'); });
13676
13676
  return loginToHeybox(...args);
13677
13677
  };
13678
13678
  const defaultPrintLoginStatus = async (...args) => {
13679
- const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BFIcNgmi.cjs'); });
13679
+ const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-fNe0eDs_.cjs'); });
13680
13680
  return printLoginStatus(...args);
13681
13681
  };
13682
13682
  const defaultRunCreateCommand = async (...args) => {
13683
- const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-DlU4nWz_.cjs'); });
13683
+ const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CxjB3oSo.cjs'); });
13684
13684
  return runCreateCommand(...args);
13685
13685
  };
13686
13686
  const defaultRunDevCommand = async (...args) => {
13687
- const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-Bb4U965a.cjs'); });
13687
+ const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-Km0or0yY.cjs'); });
13688
13688
  return runDevCommand(...args);
13689
13689
  };
13690
13690
  const defaultRunDoctorCommand = async (...args) => {
13691
- const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DwDqOLdV.cjs'); });
13691
+ const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-baVOqNSh.cjs'); });
13692
13692
  return runDoctorCommand(...args);
13693
13693
  };
13694
13694
  const defaultRunRemoteCommand = async (...args) => {
13695
- const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-YESvKni6.cjs'); });
13695
+ const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BRIlRrCG.cjs'); });
13696
13696
  return runRemoteCommand(...args);
13697
13697
  };
13698
13698
  function resolveStandaloneLogger(options, verbose) {
package/dist/cli-chunks/{index-B6gnwx39.cjs → index-DCsEAuca.cjs} RENAMED
@@ -1,13 +1,13 @@
1
1
  'use strict';
2
2
 
3
- var index$2 = require('./index-gP0K2xx1.cjs');
3
+ var index$2 = require('./index-ByDy5HXi.cjs');
4
4
  var require$$0$2 = require('fs');
5
5
  var require$$2$1 = require('crypto');
6
6
  var require$$1$2 = require('path');
7
7
  var require$$0$3 = require('assert');
8
8
  var require$$4$2 = require('events');
9
9
  var require$$1$1 = require('util');
10
- var context$1 = require('./context-D-cb_pNY.cjs');
10
+ var context$1 = require('./context-CM46YbPT.cjs');
11
11
  var require$$0$5 = require('net');
12
12
  var require$$0$4 = require('url');
13
13
  var require$$2$2 = require('http');
package/dist/cli-chunks/{login-BFIcNgmi.cjs → login-fNe0eDs_.cjs} RENAMED
@@ -3,9 +3,9 @@
3
3
  var promises = require('node:readline/promises');
4
4
  var node_crypto = require('node:crypto');
5
5
  var node_http = require('node:http');
6
- var session = require('./session-BRwveiW8.cjs');
6
+ var session = require('./session-CTcelATz.cjs');
7
7
  var browser = require('./browser-RAy8e8cV.cjs');
8
- var index = require('./index-gP0K2xx1.cjs');
8
+ var index = require('./index-ByDy5HXi.cjs');
9
9
  require('node:path');
10
10
  require('fs');
11
11
  require('constants');
package/dist/cli-chunks/{remote-YESvKni6.cjs → remote-BRIlRrCG.cjs} RENAMED
@@ -1,13 +1,13 @@
1
1
  'use strict';
2
2
 
3
3
  var promises = require('node:readline/promises');
4
- var index = require('./index-gP0K2xx1.cjs');
5
- var session = require('./session-BRwveiW8.cjs');
4
+ var index = require('./index-ByDy5HXi.cjs');
5
+ var session = require('./session-CTcelATz.cjs');
6
6
  var childProcess = require('node:child_process');
7
7
  var fs = require('node:fs');
8
8
  var fs$1 = require('node:fs/promises');
9
9
  var path = require('node:path');
10
- var context = require('./context-D-cb_pNY.cjs');
10
+ var context = require('./context-CM46YbPT.cjs');
11
11
  require('node:module');
12
12
  require('path');
13
13
  require('os');
@@ -264,7 +264,7 @@ async function createDefaultCosClient(uploadToken) {
264
264
  };
265
265
  }
266
266
  async function loadCosConstructor() {
267
- const cosModule = await Promise.resolve().then(function () { return require('./index-B6gnwx39.cjs'); }).then(function (n) { return n.index; });
267
+ const cosModule = await Promise.resolve().then(function () { return require('./index-DCsEAuca.cjs'); }).then(function (n) { return n.index; });
268
268
  return cosModule.default;
269
269
  }
270
270
  function formatSize(bytes) {
package/dist/cli-chunks/{session-BRwveiW8.cjs → session-CTcelATz.cjs} RENAMED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./index-gP0K2xx1.cjs');
3
+ var index = require('./index-ByDy5HXi.cjs');
4
4
  var node_crypto = require('node:crypto');
5
5
  var path = require('node:path');
6
6
  var require$$0$2 = require('fs');
package/dist/cli.cjs CHANGED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var index = require('./cli-chunks/index-gP0K2xx1.cjs');
3
+ var index = require('./cli-chunks/index-ByDy5HXi.cjs');
4
4
  require('node:module');
5
5
  require('node:fs');
6
6
  require('node:fs/promises');
package/dist/index.cjs.js CHANGED
@@ -325,7 +325,7 @@ function createMessageId() {
325
325
  /** 构建时替换为当前发布包的实际版本。 */
326
326
  const HB_SDK_VERSION = typeof undefined === 'string'
327
327
  ? undefined
328
- : '0.6.6-alpha.1';
328
+ : '0.6.6-alpha.2';
329
329
 
330
330
  /**
331
331
  * 判断未知数据是否符合小程序 bridge 消息信封。
package/dist/index.esm.js CHANGED
@@ -321,7 +321,7 @@ function createMessageId() {
321
321
  /** 构建时替换为当前发布包的实际版本。 */
322
322
  const HB_SDK_VERSION = typeof undefined === 'string'
323
323
  ? undefined
324
- : '0.6.6-alpha.1';
324
+ : '0.6.6-alpha.2';
325
325
 
326
326
  /**
327
327
  * 判断未知数据是否符合小程序 bridge 消息信封。
package/dist/vite.cjs.js CHANGED
@@ -7,7 +7,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
7
7
  /** 构建时替换为当前发布包的实际版本。 */
8
8
  const HB_SDK_VERSION = typeof undefined === 'string'
9
9
  ? undefined
10
- : '0.6.6-alpha.1';
10
+ : '0.6.6-alpha.2';
11
11
 
12
12
  var re = {exports: {}};
13
13
 
@@ -11445,23 +11445,7 @@ const URL_ATTRIBUTES = {
11445
11445
  track: ['src'],
11446
11446
  video: ['src', 'poster'],
11447
11447
  };
11448
- const PRODUCTION_CSP = [
11449
- "default-src 'none'",
11450
- "connect-src 'none'",
11451
- "script-src 'self' 'unsafe-inline'",
11452
- "style-src 'self' 'unsafe-inline'",
11453
- "img-src 'self' data: blob:",
11454
- "font-src 'self' data:",
11455
- "media-src 'self' blob:",
11456
- "manifest-src 'self'",
11457
- "frame-src 'none'",
11458
- "child-src 'none'",
11459
- "worker-src 'none'",
11460
- "object-src 'none'",
11461
- "form-action 'none'",
11462
- "base-uri 'none'",
11463
- ].join('; ');
11464
- function enforceMiniappHtmlPolicy(html, options = {}) {
11448
+ function enforceMiniappHtmlPolicy(html) {
11465
11449
  const document = parse(html);
11466
11450
  const htmlElement = findElement(document, 'html');
11467
11451
  const head = findElement(htmlElement ?? document, 'head');
@@ -11471,22 +11455,6 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
11471
11455
  removePlatformCspMarkers(document);
11472
11456
  walk(document, element => validateElement(element));
11473
11457
  injectMiniappRuntimeGate(document);
11474
- const content = options.hmrWebSocketUrl
11475
- ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
11476
- : PRODUCTION_CSP;
11477
- head.childNodes.unshift({
11478
- nodeName: 'meta',
11479
- tagName: 'meta',
11480
- attrs: [
11481
- { name: 'http-equiv', value: 'Content-Security-Policy' },
11482
- { name: 'content', value: content },
11483
- { name: 'data-heybox-platform-csp', value: '' },
11484
- ],
11485
- namespaceURI: 'http://www.w3.org/1999/xhtml',
11486
- childNodes: [],
11487
- parentNode: head,
11488
- sourceCodeLocation: undefined,
11489
- });
11490
11458
  return serialize(document);
11491
11459
  }
11492
11460
  function validateElement(element) {
@@ -11585,8 +11553,6 @@ const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
11585
11553
  function miniappManifest() {
11586
11554
  let root = process.cwd();
11587
11555
  let outDir = 'dist';
11588
- let command = 'build';
11589
- let hmrWebSocketUrl;
11590
11556
  /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
11591
11557
  let priorBuildError;
11592
11558
  return {
@@ -11603,8 +11569,6 @@ function miniappManifest() {
11603
11569
  configResolved(resolved) {
11604
11570
  root = resolved.root;
11605
11571
  outDir = resolved.build.outDir;
11606
- command = resolved.command;
11607
- hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
11608
11572
  },
11609
11573
  buildEnd(error) {
11610
11574
  if (error) {
@@ -11612,7 +11576,7 @@ function miniappManifest() {
11612
11576
  }
11613
11577
  },
11614
11578
  transformIndexHtml(html) {
11615
- return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
11579
+ return enforceMiniappHtmlPolicy(html);
11616
11580
  },
11617
11581
  async closeBundle() {
11618
11582
  // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11671,16 +11635,5 @@ function resolveSdkVersion() {
11671
11635
  }
11672
11636
  return packageJson.version;
11673
11637
  }
11674
- function resolveHmrWebSocketUrl(resolved) {
11675
- const hmr = resolved.server.hmr;
11676
- if (hmr === false)
11677
- return undefined;
11678
- const options = typeof hmr === 'object' ? hmr : {};
11679
- const protocol = options.protocol ?? 'ws';
11680
- const configuredHost = options.host ?? resolved.server.host;
11681
- const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
11682
- const port = options.clientPort ?? options.port ?? resolved.server.port;
11683
- return `${protocol}://${host}${port ? `:${port}` : ''}`;
11684
- }
11685
11638
 
11686
11639
  exports.miniappManifest = miniappManifest;
package/dist/vite.esm.js CHANGED
@@ -4,7 +4,7 @@ import path from 'node:path';
4
4
  /** 构建时替换为当前发布包的实际版本。 */
5
5
  const HB_SDK_VERSION = typeof undefined === 'string'
6
6
  ? undefined
7
- : '0.6.6-alpha.1';
7
+ : '0.6.6-alpha.2';
8
8
 
9
9
  var re = {exports: {}};
10
10
 
@@ -11442,23 +11442,7 @@ const URL_ATTRIBUTES = {
11442
11442
  track: ['src'],
11443
11443
  video: ['src', 'poster'],
11444
11444
  };
11445
- const PRODUCTION_CSP = [
11446
- "default-src 'none'",
11447
- "connect-src 'none'",
11448
- "script-src 'self' 'unsafe-inline'",
11449
- "style-src 'self' 'unsafe-inline'",
11450
- "img-src 'self' data: blob:",
11451
- "font-src 'self' data:",
11452
- "media-src 'self' blob:",
11453
- "manifest-src 'self'",
11454
- "frame-src 'none'",
11455
- "child-src 'none'",
11456
- "worker-src 'none'",
11457
- "object-src 'none'",
11458
- "form-action 'none'",
11459
- "base-uri 'none'",
11460
- ].join('; ');
11461
- function enforceMiniappHtmlPolicy(html, options = {}) {
11445
+ function enforceMiniappHtmlPolicy(html) {
11462
11446
  const document = parse(html);
11463
11447
  const htmlElement = findElement(document, 'html');
11464
11448
  const head = findElement(htmlElement ?? document, 'head');
@@ -11468,22 +11452,6 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
11468
11452
  removePlatformCspMarkers(document);
11469
11453
  walk(document, element => validateElement(element));
11470
11454
  injectMiniappRuntimeGate(document);
11471
- const content = options.hmrWebSocketUrl
11472
- ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
11473
- : PRODUCTION_CSP;
11474
- head.childNodes.unshift({
11475
- nodeName: 'meta',
11476
- tagName: 'meta',
11477
- attrs: [
11478
- { name: 'http-equiv', value: 'Content-Security-Policy' },
11479
- { name: 'content', value: content },
11480
- { name: 'data-heybox-platform-csp', value: '' },
11481
- ],
11482
- namespaceURI: 'http://www.w3.org/1999/xhtml',
11483
- childNodes: [],
11484
- parentNode: head,
11485
- sourceCodeLocation: undefined,
11486
- });
11487
11455
  return serialize(document);
11488
11456
  }
11489
11457
  function validateElement(element) {
@@ -11582,8 +11550,6 @@ const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
11582
11550
  function miniappManifest() {
11583
11551
  let root = process.cwd();
11584
11552
  let outDir = 'dist';
11585
- let command = 'build';
11586
- let hmrWebSocketUrl;
11587
11553
  /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
11588
11554
  let priorBuildError;
11589
11555
  return {
@@ -11600,8 +11566,6 @@ function miniappManifest() {
11600
11566
  configResolved(resolved) {
11601
11567
  root = resolved.root;
11602
11568
  outDir = resolved.build.outDir;
11603
- command = resolved.command;
11604
- hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
11605
11569
  },
11606
11570
  buildEnd(error) {
11607
11571
  if (error) {
@@ -11609,7 +11573,7 @@ function miniappManifest() {
11609
11573
  }
11610
11574
  },
11611
11575
  transformIndexHtml(html) {
11612
- return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
11576
+ return enforceMiniappHtmlPolicy(html);
11613
11577
  },
11614
11578
  async closeBundle() {
11615
11579
  // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -11668,16 +11632,5 @@ function resolveSdkVersion() {
11668
11632
  }
11669
11633
  return packageJson.version;
11670
11634
  }
11671
- function resolveHmrWebSocketUrl(resolved) {
11672
- const hmr = resolved.server.hmr;
11673
- if (hmr === false)
11674
- return undefined;
11675
- const options = typeof hmr === 'object' ? hmr : {};
11676
- const protocol = options.protocol ?? 'ws';
11677
- const configuredHost = options.host ?? resolved.server.host;
11678
- const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
11679
- const port = options.clientPort ?? options.port ?? resolved.server.port;
11680
- return `${protocol}://${host}${port ? `:${port}` : ''}`;
11681
- }
11682
11635
 
11683
11636
  export { miniappManifest };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@heybox/hb-sdk",
3
- "version": "0.6.6-alpha.1",
3
+ "version": "0.6.6-alpha.2",
4
4
  "sideEffects": [
5
5
  "./src/index.ts",
6
6
  "./src/core/singleton.ts",
package/skill/references/api-root.md CHANGED
@@ -19,7 +19,7 @@
19
19
  ## Package metadata
20
20
 
21
21
  - Package: `@heybox/hb-sdk`
22
- - Version at generation time: `0.6.6-alpha.1`
22
+ - Version at generation time: `0.6.6-alpha.2`
23
23
  - Public root export: `@heybox/hb-sdk`
24
24
  - Protocol export: `@heybox/hb-sdk/protocol`
25
25
  - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -229,18 +229,7 @@ interface MiniappManifestResolvedConfig {
229
229
  build: {
230
230
  outDir: string;
231
231
  };
232
- server: {
233
- host?: string | boolean;
234
- port?: number;
235
- hmr?:
236
- | boolean
237
- | {
238
- clientPort?: number;
239
- host?: string;
240
- port?: number;
241
- protocol?: 'ws' | 'wss';
242
- };
243
- };
232
+ server: Record<string, unknown>;
244
233
  }
245
234
 
246
235
  const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
@@ -249,8 +238,6 @@ const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
249
238
  export function miniappManifest(): MiniappManifestPlugin {
250
239
  let root = process.cwd();
251
240
  let outDir = 'dist';
252
- let command: 'build' | 'serve' = 'build';
253
- let hmrWebSocketUrl: string | undefined;
254
241
  /** 构建链路中更早的失败原因；closeBundle 不得再用产物校验覆盖它。 */
255
242
  let priorBuildError: Error | undefined;
256
243
 
@@ -268,8 +255,6 @@ export function miniappManifest(): MiniappManifestPlugin {
268
255
  configResolved(resolved) {
269
256
  root = resolved.root;
270
257
  outDir = resolved.build.outDir;
271
- command = resolved.command;
272
- hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
273
258
  },
274
259
  buildEnd(error) {
275
260
  if (error) {
@@ -277,7 +262,7 @@ export function miniappManifest(): MiniappManifestPlugin {
277
262
  }
278
263
  },
279
264
  transformIndexHtml(html) {
280
- return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
265
+ return enforceMiniappHtmlPolicy(html);
281
266
  },
282
267
  async closeBundle() {
283
268
  // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -340,17 +325,6 @@ function resolveSdkVersion() {
340
325
  }
341
326
  return packageJson.version;
342
327
  }
343
-
344
- function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
345
- const hmr = resolved.server.hmr;
346
- if (hmr === false) return undefined;
347
- const options = typeof hmr === 'object' ? hmr : {};
348
- const protocol = options.protocol ?? 'ws';
349
- const configuredHost = options.host ?? resolved.server.host;
350
- const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
351
- const port = options.clientPort ?? options.port ?? resolved.server.port;
352
- return `${protocol}://${host}${port ? `:${port}` : ''}`;
353
- }
354
328
  ```
355
329
 
356
330
  ## Manifest
@@ -380,9 +354,9 @@ export default defineConfig({
380
354
 
381
355
  工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
382
356
 
383
- 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
357
+ 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 和 dev 都不会注入平台 CSP；项目已有的 CSP 会原样保留。浏览器原生 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe 和表单等能力不再由 SDK 构建产物统一限制，是否可用由宿主环境、项目自身策略和审核规则共同决定；需要宿主授权的业务网络请求仍应使用 `network.request()`。
384
358
 
385
- meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
359
+ meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 仍会使 build 失败。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
386
360
 
387
361
  失败与警告语义：
388
362
 
package/skill/skill.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "hb-sdk",
3
- "skillVersion": "0.6.6-alpha.1+skill.2799351c9553",
3
+ "skillVersion": "0.6.6-alpha.2+skill.1b5ff79af27f",
4
4
  "sdk": {
5
5
  "package": "@heybox/hb-sdk",
6
- "version": "0.6.6-alpha.1",
7
- "compatibility": "0.6.6-alpha.1"
6
+ "version": "0.6.6-alpha.2",
7
+ "compatibility": "0.6.6-alpha.2"
8
8
  },
9
9
  "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
10
- "integrity": "sha256-2799351c9553f32af834bd0a53e6d016d647aafb275dff139ddd0dfaf2261321"
10
+ "integrity": "sha256-1b5ff79af27f9af02b914553b6e7324f66543861cce638c526c9158586ed5fb5"
11
11
  }
package/types/vite/html-policy.d.ts CHANGED
@@ -1,4 +1 @@
1
- export declare const PRODUCTION_CSP: string;
2
- export declare function enforceMiniappHtmlPolicy(html: string, options?: {
3
- hmrWebSocketUrl?: string;
4
- }): string;
1
+ export declare function enforceMiniappHtmlPolicy(html: string): string;
package/types/vite/index.d.ts CHANGED
@@ -20,16 +20,7 @@ interface MiniappManifestResolvedConfig {
20
20
  build: {
21
21
  outDir: string;
22
22
  };
23
- server: {
24
- host?: string | boolean;
25
- port?: number;
26
- hmr?: boolean | {
27
- clientPort?: number;
28
- host?: string;
29
- port?: number;
30
- protocol?: 'ws' | 'wss';
31
- };
32
- };
23
+ server: Record<string, unknown>;
33
24
  }
34
25
  export declare function miniappManifest(): MiniappManifestPlugin;
35
26
  export {};