@heybox/hb-sdk 0.6.7-alpha.0 → 0.6.7-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (26) hide show
  1. package/README.md +3 -3
  2. package/dist/cli-chunks/{build-mTmtBJbp.cjs → build-CQmYxfxm.cjs} +25 -29
  3. package/dist/cli-chunks/{context-wI8oXc58.cjs → context-ChkYWwH_.cjs} +23 -122
  4. package/dist/cli-chunks/{create-DEwECU7u.cjs → create-CC5r_8bL.cjs} +1 -1
  5. package/dist/cli-chunks/{dev-BZ7FJEeZ.cjs → dev-CD-38TgO.cjs} +110 -21
  6. package/dist/cli-chunks/{doctor-DbJQPPs2.cjs → doctor-43yEfVr0.cjs} +1 -1
  7. package/dist/cli-chunks/{index-UecHob74.cjs → index-BM6oH2Hs.cjs} +3 -3
  8. package/dist/cli-chunks/{runtime-permission-env-BSs4uCNa.cjs → index-BQm5XmMC.cjs} +0 -71
  9. package/dist/cli-chunks/{index-Df14XqmW.cjs → index-CQnkS0Z8.cjs} +14 -14
  10. package/dist/cli-chunks/{login-BzSUtgRH.cjs → login-BmisXAdp.cjs} +2 -2
  11. package/dist/cli-chunks/{project-vite-D2Hx7XPp.cjs → project-vite-D9_v57vp.cjs} +1 -1
  12. package/dist/cli-chunks/{remote-BZiSfXOm.cjs → remote-BXtT6M2f.cjs} +22 -40
  13. package/dist/cli-chunks/{runtime-gate--rPXjiG6.cjs → runtime-gate-B2MQf1vc.cjs} +3 -3
  14. package/dist/cli-chunks/{session-CqycMFvy.cjs → session-BjtjhtPg.cjs} +1 -1
  15. package/dist/cli.cjs +1 -1
  16. package/dist/devtools/mock-host/main.js +187 -21
  17. package/dist/index.cjs.js +1 -1
  18. package/dist/index.esm.js +1 -1
  19. package/dist/vite.cjs.js +50 -28
  20. package/dist/vite.esm.js +50 -28
  21. package/package.json +1 -1
  22. package/skill/references/api-root.md +7 -9
  23. package/skill/skill.json +4 -4
  24. package/types/vite/html-policy.d.ts +0 -1
  25. package/types/vite/index.d.ts +1 -0
  26. package/types/vite/runtime-permission-env.d.ts +0 -9
package/skill/references/api-root.md CHANGED
@@ -19,7 +19,7 @@
19
19
  ## Package metadata
20
20
 
21
21
  - Package: `@heybox/hb-sdk`
22
- - Version at generation time: `0.6.7-alpha.0`
22
+ - Version at generation time: `0.6.7-alpha.2`
23
23
  - Public root export: `@heybox/hb-sdk`
24
24
  - Protocol export: `@heybox/hb-sdk/protocol`
25
25
  - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -204,7 +204,6 @@ import { HB_SDK_VERSION } from '../core/version';
204
204
  import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
205
205
  import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
206
206
  import { enforceMiniappHtmlPolicy } from './html-policy';
207
- import { shouldSkipMiniappPlatformCspFromEnv } from './runtime-permission-env';
208
207
 
209
208
  type MiniappManifestPlugin = {
210
209
  name: string;
@@ -233,6 +232,7 @@ interface MiniappManifestResolvedConfig {
233
232
  };
234
233
  server: {
235
234
  host?: string | boolean;
235
+ https?: boolean | Record<string, unknown>;
236
236
  port?: number;
237
237
  hmr?:
238
238
  | boolean
@@ -249,7 +249,6 @@ const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
249
249
  const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
250
250
 
251
251
  export function miniappManifest(): MiniappManifestPlugin {
252
- const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
253
252
  let root = process.cwd();
254
253
  let outDir = 'dist';
255
254
  let command: 'build' | 'serve' = 'build';
@@ -282,7 +281,6 @@ export function miniappManifest(): MiniappManifestPlugin {
282
281
  transformIndexHtml(html) {
283
282
  return enforceMiniappHtmlPolicy(html, {
284
283
  ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
285
- skipPlatformCsp,
286
284
  });
287
285
  },
288
286
  async closeBundle() {
@@ -308,7 +306,7 @@ export function miniappManifest(): MiniappManifestPlugin {
308
306
  if (!htmlFiles.includes(indexHtmlPath)) {
309
307
  throw new Error('构建产物必须包含入口 dist/index.html');
310
308
  }
311
- writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
309
+ writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
312
310
 
313
311
  const manifestPath = path.join(outputRoot, 'manifest.json');
314
312
  mkdirSync(path.dirname(manifestPath), { recursive: true });
@@ -351,7 +349,7 @@ function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
351
349
  const hmr = resolved.server.hmr;
352
350
  if (hmr === false) return undefined;
353
351
  const options = typeof hmr === 'object' ? hmr : {};
354
- const protocol = options.protocol ?? 'ws';
352
+ const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
355
353
  const configuredHost = options.host ?? resolved.server.host;
356
354
  const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
357
355
  const port = options.clientPort ?? options.port ?? resolved.server.port;
@@ -386,11 +384,11 @@ export default defineConfig({
386
384
 
387
385
  工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
388
386
 
389
- 插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
387
+ 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 和 dev 都会把平台 CSP 插入 `<head>` 首位，已有 CSP 始终原样保留；两份策略按浏览器交集生效。平台 CSP 在脚本、样式、图片、字体和媒体指令中放行 `xiaoheihe.cn`、`max-c.com`、`debugmode.cn`、`maxjia.com` 的 HTTPS 根域及子域；入口 HTML 中相应资源标签也可使用这些官方 HTTPS URL。
390
388
 
391
- 平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
389
+ 平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；`connect-src` 始终为 `'none'`，dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。需要宿主授权的业务网络请求仍应使用 `network.request()`。
392
390
 
393
- meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
391
+ meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、非官方外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
394
392
 
395
393
  失败与警告语义：
396
394
 
package/skill/skill.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "hb-sdk",
3
- "skillVersion": "0.6.7-alpha.0+skill.26a52bf0d5a2",
3
+ "skillVersion": "0.6.7-alpha.2+skill.ed2b204ea04c",
4
4
  "sdk": {
5
5
  "package": "@heybox/hb-sdk",
6
- "version": "0.6.7-alpha.0",
7
- "compatibility": "0.6.7-alpha.0"
6
+ "version": "0.6.7-alpha.2",
7
+ "compatibility": "0.6.7-alpha.2"
8
8
  },
9
9
  "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
10
- "integrity": "sha256-26a52bf0d5a26384040083f70d6898d429686d68686b77baed736bbfe9accb62"
10
+ "integrity": "sha256-ed2b204ea04c904a30c99cfc1c4a60833dde694b9a5974bbc885f2b751224e68"
11
11
  }
package/types/vite/html-policy.d.ts CHANGED
@@ -1,5 +1,4 @@
1
1
  export declare const PRODUCTION_CSP: string;
2
2
  export declare function enforceMiniappHtmlPolicy(html: string, options?: {
3
3
  hmrWebSocketUrl?: string;
4
- skipPlatformCsp?: boolean;
5
4
  }): string;
package/types/vite/index.d.ts CHANGED
@@ -22,6 +22,7 @@ interface MiniappManifestResolvedConfig {
22
22
  };
23
23
  server: {
24
24
  host?: string | boolean;
25
+ https?: boolean | Record<string, unknown>;
25
26
  port?: number;
26
27
  hmr?: boolean | {
27
28
  clientPort?: number;
package/types/vite/runtime-permission-env.d.ts DELETED
@@ -1,9 +0,0 @@
1
- export declare const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = "HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN";
2
- export declare const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = "HB_SDK_RUNTIME_PERMISSION_CONTEXT";
3
- export declare function shouldSkipMiniappPlatformCspFromEnv(env?: NodeJS.ProcessEnv): boolean;
4
- export declare function createMiniappPlatformCspEnv(env: NodeJS.ProcessEnv, skipPlatformCsp: boolean): {
5
- HB_SDK_RUNTIME_PERMISSION_CONTEXT: string;
6
- HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN: string;
7
- TZ?: string | undefined;
8
- };
9
- export declare function withMiniappPlatformCspEnv<T>(skipPlatformCsp: boolean, action: () => Promise<T>, env?: NodeJS.ProcessEnv): Promise<T>;