@heybox/hb-sdk 0.6.7-alpha.1 → 0.6.7-alpha.2

package/dist/vite.esm.js

@@ -1,11 +1,10 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
 import path from 'node:path';
-import { AsyncLocalStorage } from 'node:async_hooks';
 
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.1';
+    : '0.6.7-alpha.2';
 
 var re = {exports: {}};
 
@@ -11430,13 +11429,17 @@ function walk$1(node, visit) {
 
 const FORBIDDEN_RESOURCE_HINTS = new Set(['dns-prefetch', 'preconnect', 'prerender']);
 const RELATIVE_URL_BASE = new URL('https://heybox-relative.invalid/');
+const OFFICIAL_RESOURCE_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
+const OFFICIAL_RESOURCE_SOURCES = OFFICIAL_RESOURCE_ROOT_DOMAINS.flatMap(rootDomain => [
+    `https://${rootDomain}`,
+    `https://*.${rootDomain}`,
+]);
 const URL_ATTRIBUTES = {
     audio: ['src'],
     embed: ['src'],
     iframe: ['src'],
     img: ['src'],
     input: ['src'],
-    link: ['href'],
     object: ['data'],
     script: ['src'],
     source: ['src', 'srcset'],
@@ -11446,11 +11449,11 @@ const URL_ATTRIBUTES = {
 const PRODUCTION_CSP = [
     "default-src 'none'",
     "connect-src 'none'",
-    "script-src 'self' 'unsafe-inline'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: blob:",
-    "font-src 'self' data:",
-    "media-src 'self' blob:",
+    `script-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `style-src 'self' 'unsafe-inline' ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `img-src 'self' data: blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `font-src 'self' data: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
+    `media-src 'self' blob: ${OFFICIAL_RESOURCE_SOURCES.join(' ')}`,
     "manifest-src 'self'",
     "frame-src 'none'",
     "child-src 'none'",
@@ -11469,9 +11472,6 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
     removePlatformCspMarkers(document);
     walk(document, element => validateElement(element));
     injectMiniappRuntimeGate(document);
-    if (options.skipPlatformCsp) {
-        return serialize(document);
-    }
     const content = options.hmrWebSocketUrl
         ? PRODUCTION_CSP.replace("connect-src 'none'", `connect-src ${options.hmrWebSocketUrl}`)
         : PRODUCTION_CSP;
@@ -11508,19 +11508,25 @@ function validateElement(element) {
         if (forbidden) {
             throw new Error(`index.html 不允许 rel="${forbidden}"`);
         }
-        if (rels.includes('preload') || rels.includes('modulepreload')) {
+        if (rels.includes('stylesheet')) {
+            validateResourceUrl(attrs.get('href'), '<link rel="stylesheet" href>', false, true);
+        }
+        else if (rels.includes('preload') || rels.includes('modulepreload')) {
             validateRelativeUrl(attrs.get('href'), `<link rel="${rels.includes('modulepreload') ? 'modulepreload' : 'preload'}" href>`, false);
         }
+        else {
+            validateRelativeUrl(attrs.get('href'), '<link href>', false);
+        }
     }
     for (const attribute of URL_ATTRIBUTES[tagName] ?? []) {
         const value = attrs.get(attribute);
         if (attribute === 'srcset') {
             for (const candidate of (value ?? '').split(',').map(item => item.trim().split(/\s+/)[0]).filter(Boolean)) {
-                validateRelativeUrl(candidate, `<${tagName} ${attribute}>`, true);
+                validateResourceUrl(candidate, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
             }
         }
         else {
-            validateRelativeUrl(value, `<${tagName} ${attribute}>`, true);
+            validateResourceUrl(value, `<${tagName} ${attribute}>`, true, supportsOfficialResourceUrl(tagName, attribute));
         }
     }
 }
@@ -11535,16 +11541,43 @@ function removePlatformCspMarkers(node) {
     for (const child of node.childNodes)
         removePlatformCspMarkers(child);
 }
-function validateRelativeUrl(value, label, allowDataBlob) {
+function supportsOfficialResourceUrl(tagName, attribute) {
+    return ((tagName === 'script' && attribute === 'src') ||
+        (tagName === 'img' && attribute === 'src') ||
+        (tagName === 'source' && (attribute === 'src' || attribute === 'srcset')) ||
+        (tagName === 'audio' && attribute === 'src') ||
+        (tagName === 'track' && attribute === 'src') ||
+        (tagName === 'video' && (attribute === 'src' || attribute === 'poster')));
+}
+function validateResourceUrl(value, label, allowDataBlob, allowOfficialResourceUrl) {
     if (!value || value.startsWith('#'))
         return;
     const normalized = value.trim().toLowerCase();
     if (allowDataBlob && (normalized.startsWith('data:') || normalized.startsWith('blob:')))
         return;
+    if (allowOfficialResourceUrl && isOfficialResourceUrl(value))
+        return;
     if (!isRelativeUrl(value, normalized)) {
         throw new Error(`${label} 必须使用相对路径${allowDataBlob ? '或明确的 data:/blob: URL' : ''}：${value}`);
     }
 }
+function validateRelativeUrl(value, label, allowDataBlob) {
+    validateResourceUrl(value, label, allowDataBlob, false);
+}
+function isOfficialResourceUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            return false;
+        const hostname = url.hostname.toLowerCase();
+        if (hostname.endsWith('.'))
+            return false;
+        return OFFICIAL_RESOURCE_ROOT_DOMAINS.some(rootDomain => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+    }
+    catch {
+        return false;
+    }
+}
 function isRelativeUrl(value, normalized) {
     const browserNormalized = normalized.replace(/[\t\n\r]/g, '');
     if (browserNormalized.includes('\\') || browserNormalized.startsWith('//'))
@@ -11581,19 +11614,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
-const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
-const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
-new AsyncLocalStorage();
-Promise.resolve();
-function shouldSkipMiniappPlatformCspFromEnv(env = process.env) {
-    return env[HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV] === VERIFIED_RUNTIME_PERMISSION_CONTEXT && env[HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV] === '1';
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 function miniappManifest() {
-    const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11625,7 +11648,6 @@ function miniappManifest() {
         transformIndexHtml(html) {
             return enforceMiniappHtmlPolicy(html, {
                 ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
-                skipPlatformCsp,
             });
         },
         async closeBundle() {
@@ -11648,7 +11670,7 @@ function miniappManifest() {
             if (!htmlFiles.includes(indexHtmlPath)) {
                 throw new Error('构建产物必须包含入口 dist/index.html');
             }
-            writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
+            writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
             const manifestPath = path.join(outputRoot, 'manifest.json');
             mkdirSync(path.dirname(manifestPath), { recursive: true });
             writeFileSync(manifestPath, renderMiniappManifest({ version, sdkVersion }));
@@ -11690,7 +11712,7 @@ function resolveHmrWebSocketUrl(resolved) {
     if (hmr === false)
         return undefined;
     const options = typeof hmr === 'object' ? hmr : {};
-    const protocol = options.protocol ?? 'ws';
+    const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
     const configuredHost = options.host ?? resolved.server.host;
     const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
     const port = options.clientPort ?? options.port ?? resolved.server.port;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.7-alpha.1",
+  "version": "0.6.7-alpha.2",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.7-alpha.1`
+- Version at generation time: `0.6.7-alpha.2`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -204,7 +204,6 @@ import { HB_SDK_VERSION } from '../core/version';
 import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
-import { shouldSkipMiniappPlatformCspFromEnv } from './runtime-permission-env';
 
 type MiniappManifestPlugin = {
   name: string;
@@ -233,6 +232,7 @@ interface MiniappManifestResolvedConfig {
   };
   server: {
     host?: string | boolean;
+    https?: boolean | Record<string, unknown>;
     port?: number;
     hmr?:
       | boolean
@@ -249,7 +249,6 @@ const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 
 export function miniappManifest(): MiniappManifestPlugin {
-  const skipPlatformCsp = shouldSkipMiniappPlatformCspFromEnv();
   let root = process.cwd();
   let outDir = 'dist';
   let command: 'build' | 'serve' = 'build';
@@ -282,7 +281,6 @@ export function miniappManifest(): MiniappManifestPlugin {
     transformIndexHtml(html) {
       return enforceMiniappHtmlPolicy(html, {
         ...(command === 'serve' ? { hmrWebSocketUrl } : {}),
-        skipPlatformCsp,
       });
     },
     async closeBundle() {
@@ -308,7 +306,7 @@ export function miniappManifest(): MiniappManifestPlugin {
       if (!htmlFiles.includes(indexHtmlPath)) {
         throw new Error('构建产物必须包含入口 dist/index.html');
       }
-      writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8'), { skipPlatformCsp }));
+      writeFileSync(indexHtmlPath, enforceMiniappHtmlPolicy(readFileSync(indexHtmlPath, 'utf8')));
 
       const manifestPath = path.join(outputRoot, 'manifest.json');
       mkdirSync(path.dirname(manifestPath), { recursive: true });
@@ -351,7 +349,7 @@ function resolveHmrWebSocketUrl(resolved: MiniappManifestResolvedConfig) {
   const hmr = resolved.server.hmr;
   if (hmr === false) return undefined;
   const options = typeof hmr === 'object' ? hmr : {};
-  const protocol = options.protocol ?? 'ws';
+  const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
   const configuredHost = options.host ?? resolved.server.host;
   const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
   const port = options.clientPort ?? options.port ?? resolved.server.port;
@@ -386,11 +384,11 @@ export default defineConfig({
 
 工坊小程序构建产物只能在兼容的小黑盒 Runtime 中启动。普通浏览器直接打开时不会执行标准业务脚本，并会提示在小黑盒 APP 内打开。项目应使用标准 Vite module 入口。
 
-插件只接受单页应用：输出目录只能存在入口 `index.html`。`hb-sdk dev` 和 `hb-sdk remote deploy` 会读取绑定小程序的远端 Runtime 权限；仅当 `network.request` 已启用且 `useOfficialDomain=true` 时跳过平台 CSP，否则 build 会把平台 CSP 插入 `<head>` 首位。直接运行 `vite build`、匿名 dev、非法快照或远端权限读取失败时均继续注入。已有 CSP 始终原样保留；注入平台 CSP 时，两份策略按浏览器交集生效。
+插件只接受单页应用：输出目录只能存在入口 `index.html`。build 和 dev 都会把平台 CSP 插入 `<head>` 首位，已有 CSP 始终原样保留；两份策略按浏览器交集生效。平台 CSP 在脚本、样式、图片、字体和媒体指令中放行 `xiaoheihe.cn`、`max-c.com`、`debugmode.cn`、`maxjia.com` 的 HTTPS 根域及子域；入口 HTML 中相应资源标签也可使用这些官方 HTTPS URL。
 
-平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。跳过平台 CSP 时，这些能力不再由 SDK 构建产物统一限制，但需要宿主授权的业务网络请求仍应使用 `network.request()`。本地 Mock 权限覆盖不会改变构建 CSP，构建判定始终以远端权限快照为准。
+平台 CSP 会禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；`connect-src` 始终为 `'none'`，dev 只额外放行当前 Vite 的精确 HMR WebSocket 地址。需要宿主授权的业务网络请求仍应使用 `network.request()`。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、非官方外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev`、`hb-sdk build` 和手动 Vite build 都不请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.7-alpha.1+skill.00dab20ae3bc",
+  "skillVersion": "0.6.7-alpha.2+skill.ed2b204ea04c",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.7-alpha.1",
-    "compatibility": "0.6.7-alpha.1"
+    "version": "0.6.7-alpha.2",
+    "compatibility": "0.6.7-alpha.2"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-00dab20ae3bceff225037abb08cf86b24daee2d7b2002aa90e720492ef8b58f8"
+  "integrity": "sha256-ed2b204ea04c904a30c99cfc1c4a60833dde694b9a5974bbc885f2b751224e68"
 }

package/types/vite/html-policy.d.ts

@@ -1,5 +1,4 @@
 export declare const PRODUCTION_CSP: string;
 export declare function enforceMiniappHtmlPolicy(html: string, options?: {
     hmrWebSocketUrl?: string;
-    skipPlatformCsp?: boolean;
 }): string;

package/types/vite/index.d.ts

@@ -22,6 +22,7 @@ interface MiniappManifestResolvedConfig {
     };
     server: {
         host?: string | boolean;
+        https?: boolean | Record<string, unknown>;
         port?: number;
         hmr?: boolean | {
             clientPort?: number;

package/types/vite/runtime-permission-env.d.ts

@@ -1,9 +0,0 @@
-export declare const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = "HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN";
-export declare const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = "HB_SDK_RUNTIME_PERMISSION_CONTEXT";
-export declare function shouldSkipMiniappPlatformCspFromEnv(env?: NodeJS.ProcessEnv): boolean;
-export declare function createMiniappPlatformCspEnv(env: NodeJS.ProcessEnv, skipPlatformCsp: boolean): {
-    HB_SDK_RUNTIME_PERMISSION_CONTEXT: string;
-    HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN: string;
-    TZ?: string | undefined;
-};
-export declare function withMiniappPlatformCspEnv<T>(skipPlatformCsp: boolean, action: () => Promise<T>, env?: NodeJS.ProcessEnv): Promise<T>;