npm - @heybox/hb-sdk - Versions diffs - 0.6.6-alpha.3 → 0.6.6-alpha.4 - Mend

@heybox/hb-sdk 0.6.6-alpha.3 → 0.6.6-alpha.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/skill/references/api-root.md CHANGED Viewed

@@ -19,7 +19,7 @@
 ## Package metadata
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.6-alpha.3`
+- Version at generation time: `0.6.6-alpha.4`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -204,6 +204,7 @@ import { HB_SDK_VERSION } from '../core/version';
 import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
+import { shouldSkipMiniappPlatformCspFromEnv } from './runtime-permission-env';
 type MiniappManifestPlugin = {
   name: string;
@@ -248,6 +249,7 @@ const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 export function miniappManifest(): MiniappManifestPlugin {
+  const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
   let root = process.cwd();
   let outDir = 'dist';
   let command: 'build' | 'serve' = 'build';
@@ -278,7 +280,10 @@ export function miniappManifest(): MiniappManifestPlugin {
       }
     },
     transformIndexHtml(html) {
-      return enforceMiniappHtmlPolicy(html, command === 'serve' ? { hmrWebSocketUrl } : undefined);
+      return enforceMiniappHtmlPolicy(html, {
+        ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
+        skipPlatformCsp,
+      });
     },
     async closeBundle() {
       // Rollup 在 buildStart/transform 失败后仍会调用 closeBundle。
@@ -303,7 +308,7 @@ export function miniappManifest(): MiniappManifestPlugin {
       if (!htmlFiles.includes(indexHtmlPath)) {
         throw new Error('构建产物必须包含入口 dist/index.html');
       }
-      writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
+      writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
       const manifestPath = path.join(outputRoot, 'manifest.json');
       mkdirSync(path.dirname(manifestPath), { recursive: true });
@@ -381,7 +386,9 @@ export default defineConfig({
 工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
-插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
+插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
+平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
 meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。

package/skill/skill.json CHANGED Viewed

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.6-alpha.3+skill.7940a3d57a8b",
+  "skillVersion": "0.6.6-alpha.4+skill.849ac4dd68e1",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.6-alpha.3",
-    "compatibility": "0.6.6-alpha.3"
+    "version": "0.6.6-alpha.4",
+    "compatibility": "0.6.6-alpha.4"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-7940a3d57a8b57fb3045378c068cc875bea2def32d926fcef19e0accad67901b"
+  "integrity": "sha256-849ac4dd68e1d39c13e686809d6a4e9c1bcfd90fbac899b45f43bd364db1fc68"
 }

package/types/vite/html-policy.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 export declare const PRODUCTION_CSP: string;
 export declare function enforceMiniappHtmlPolicy(html: string, options?: {
     hmrWebSocketUrl?: string;
+    skipPlatformCsp?: boolean;
 }): string;

package/types/vite/runtime-permission-env.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+export declare const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = "HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN";
+export declare const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = "HB_SDK_RUNTIME_PERMISSION_CONTEXT";
+export declare function shouldSkipMiniappPlatformCspFromEnv(env?: NodeJS.ProcessEnv): boolean;
+export declare function createMiniappPlatformCspEnv(env: NodeJS.ProcessEnv, skipPlatformCsp: boolean): {
+    HB_SDK_RUNTIME_PERMISSION_CONTEXT: string;
+    HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN: string;
+    TZ?: string | undefined;
+};
+export declare function withMiniappPlatformCspEnv<T>(skipPlatformCsp: boolean, action: () => Promise<T>, env?: NodeJS.ProcessEnv): Promise<T>;