@heybox/hb-sdk 0.7.3 → 0.7.4-alpha.4

package/dist/cli-chunks/{dev-_tBlQ2WO.cjs → dev-j7W9R7ew.cjs}

@@ -6,15 +6,15 @@ var path = require('node:path');
 var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
-var context = require('./context-DNQEI7m7.cjs');
+var context = require('./context-DTr3hRTv.cjs');
 var node_crypto = require('node:crypto');
 var undici = require('undici');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CIucOD2H.cjs');
-var projectVite = require('./project-vite-ESaxoAE1.cjs');
+var index = require('./index-CyEqCbeu.cjs');
+var projectVite = require('./project-vite-BUY9DgYo.cjs');
 var fs$1 = require('node:fs/promises');
 var runtimePermissionEnv = require('./runtime-permission-env-D-8_jPG3.cjs');
-require('./session-C9KHqijL.cjs');
+require('./session-BUjFX2U2.cjs');
 require('fs');
 require('constants');
 require('stream');
@@ -197,12 +197,12 @@ async function getPorts(options) {
 }
 
 /** Dev Shell 读取局域网 Dev Session endpoint 的 query 参数。 */
-/** Mock Host 创建和读取 Dev Session 的固定路径。 */
+/** Browser Dev Host 创建和读取 Dev Session 的固定路径。 */
 const MINI_PROGRAM_DEV_CONTEXT_PATH = '/__hb_sdk__/dev-context';
 /** Dev Session 当前使用的 schema 版本。 */
 const MINI_PROGRAM_DEV_SESSION_SCHEMA_VERSION = 1;
 
-const MOCK_HOST_JSON_BODY_LIMIT = 1024 * 1024;
+const BROWSER_DEV_HOST_JSON_BODY_LIMIT = 1024 * 1024;
 function readJsonRequestBody(request) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -210,8 +210,8 @@ function readJsonRequestBody(request) {
         request.on('data', (chunk) => {
             const buffer = Buffer.from(chunk);
             size += buffer.byteLength;
-            if (size > MOCK_HOST_JSON_BODY_LIMIT) {
-                reject(createMockHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'mock network proxy request body too large'));
+            if (size > BROWSER_DEV_HOST_JSON_BODY_LIMIT) {
+                reject(createBrowserDevHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'Browser Dev Host network proxy request body too large'));
                 request.destroy();
                 return;
             }
@@ -219,7 +219,7 @@ function readJsonRequestBody(request) {
         });
         request.on('error', reject);
         request.on('aborted', () => {
-            reject('mock network proxy request aborted');
+            reject('Browser Dev Host network proxy request aborted');
         });
         request.on('end', () => {
             const rawBody = Buffer.concat(chunks).toString('utf8');
@@ -231,7 +231,7 @@ function readJsonRequestBody(request) {
                 resolve(JSON.parse(rawBody));
             }
             catch {
-                reject(createMockHostError(400, 'INVALID_JSON', 'mock network proxy received invalid JSON'));
+                reject(createBrowserDevHostError(400, 'INVALID_JSON', 'Browser Dev Host network proxy received invalid JSON'));
             }
         });
     });
@@ -267,16 +267,16 @@ function isRecord$1(value) {
 function isObjectLike(value) {
     return (typeof value === 'object' || typeof value === 'function') && value !== null;
 }
-function createMockHostError(status, code, message) {
+function createBrowserDevHostError(status, code, message) {
     const error = new Error(message);
     error.code = code;
     error.status = status;
     return error;
 }
-function readMockHostErrorStatus(error) {
+function readBrowserDevHostErrorStatus(error) {
     return isObjectLike(error) && typeof error.status === 'number' ? error.status : 500;
 }
-function toMockHostErrorPayload(error) {
+function toBrowserDevHostErrorPayload(error) {
     if (isObjectLike(error) && typeof error.code === 'string' && typeof error.message === 'string') {
         return {
             code: error.code,
@@ -284,7 +284,7 @@ function toMockHostErrorPayload(error) {
         };
     }
     return {
-        code: 'MOCK_NETWORK_ERROR',
+        code: 'BROWSER_DEV_HOST_NETWORK_ERROR',
         message: readErrorMessage(error),
     };
 }
@@ -297,7 +297,7 @@ function readErrorMessage(error) {
  *
  * @remarks
  * 放在 `core` 而非 `modules/network`：无错误类型依赖，供 SDK 错误文案、
- * modules observability、devtools Mock Host / proxy 共用，并满足 boundary
+ * modules observability、devtools Browser Dev Host / proxy 共用，并满足 boundary
  *（devtools 不得直接 import runtime capability modules）。
  */
 /** 敏感字段名：header / query / body key 共用。 */
@@ -360,10 +360,13 @@ function redactSensitivePairsInRawText(text) {
     });
 }
 
-const MAX_MOCK_NETWORK_REDIRECTS = 5;
-const MAX_MOCK_NETWORK_REQUEST_BODY = 2 * 1024 * 1024;
-const MAX_MOCK_NETWORK_RESPONSE_BODY = 5 * 1024 * 1024;
-async function handleMockNetworkProxy(request, response, fetchImpl, lookupHostname, cors = false) {
+const MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS = 5;
+const MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY = 2 * 1024 * 1024;
+const MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY = 5 * 1024 * 1024;
+const DENIED_NETWORK_TARGETS = createDeniedNetworkTargets();
+const CREDENTIAL_HEADER_RE = /^(?:authentication-info|authorization|cookie|cookie2|proxy-authenticate|proxy-authentication-info|proxy-authorization|set-cookie|set-cookie2|www-authenticate|pkey|x-pkey|x-access-token|x-auth-token|x-api-key)$/i;
+async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lookupHostname, options) {
+    const cors = options.cors === true;
     if (request.method === 'OPTIONS') {
         writeNetworkJsonResponse(response, 204, undefined, cors);
         return;
@@ -371,24 +374,29 @@ async function handleMockNetworkProxy(request, response, fetchImpl, lookupHostna
     if (request.method !== 'POST') {
         writeNetworkJsonResponse(response, 405, {
             code: 'METHOD_NOT_ALLOWED',
-            message: 'mock network proxy only supports POST',
+            message: 'Browser Dev Host network proxy only supports POST',
         }, cors);
         return;
     }
     try {
         const payload = await readJsonRequestBody(request);
-        const result = await requestMockNetwork(payload, fetchImpl, lookupHostname);
+        const requestAbort = new AbortController();
+        if (request.aborted)
+            requestAbort.abort();
+        else
+            request.once('aborted', () => requestAbort.abort());
+        const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal);
         if (typeof result.status === 'number' && (result.status < 200 || result.status >= 300)) {
-            logMockNetworkProxyDiagnostic('http_status', payload, result);
+            logBrowserDevHostNetworkProxyDiagnostic('http_status', payload, result);
         }
         writeNetworkJsonResponse(response, 200, result, cors);
     }
     catch (error) {
-        logMockNetworkProxyDiagnostic('proxy_error', undefined, undefined, error);
-        writeNetworkJsonResponse(response, readMockHostErrorStatus(error), toMockHostErrorPayload(error), cors);
+        logBrowserDevHostNetworkProxyDiagnostic('proxy_error', undefined, undefined, error);
+        writeNetworkJsonResponse(response, readBrowserDevHostErrorStatus(error), toBrowserDevHostErrorPayload(error), cors);
     }
 }
-function logMockNetworkProxyDiagnostic(phase, payload, result, error) {
+function logBrowserDevHostNetworkProxyDiagnostic(phase, payload, result, error) {
     try {
         const consoleRef = typeof console === 'undefined' ? undefined : console;
         const logger = consoleRef?.warn || consoleRef?.error || consoleRef?.log;
@@ -415,7 +423,7 @@ function logMockNetworkProxyDiagnostic(phase, payload, result, error) {
             detail.message = sanitizeDiagnosticMessage(readErrorMessage(error));
         }
         const summaryUrl = typeof detail.url === 'string' ? detail.url : '';
-        logger.call(consoleRef, '[hb-sdk][mock-network]', `${phase}${summaryUrl ? ` ${summaryUrl}` : ''}`, detail);
+        logger.call(consoleRef, '[hb-sdk][browser-dev-host][network]', `${phase}${summaryUrl ? ` ${summaryUrl}` : ''}`, detail);
     }
     catch {
         // ignore diagnostic failures
@@ -428,59 +436,65 @@ function writeNetworkJsonResponse(response, status, body, cors) {
     }
     writeJsonResponse(response, status, body);
 }
-const MOCK_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
-async function requestMockNetwork(payload, fetchImpl, lookupHostname) {
+const BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
+async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal) {
     if (!isRecord$1(payload) || typeof payload.url !== 'string' || !payload.url.trim()) {
-        throw createMockHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是非空字符串');
+        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是非空字符串');
     }
-    const url = createMockNetworkUrl(payload.url, payload.params);
+    const url = createBrowserDevHostNetworkUrl(payload.url, payload.params);
     const method = typeof payload.method === 'string' && payload.method.trim() ? payload.method.trim().toUpperCase() : 'GET';
-    const headers = normalizeMockNetworkHeaders(payload.headers);
-    assertSupportedMockNetworkRequestShape(headers, payload.data);
-    const body = createMockNetworkBody(method, payload.data, headers);
+    const headers = normalizeBrowserDevHostNetworkHeaders(payload.headers);
+    assertSupportedBrowserDevHostNetworkRequestShape(headers, payload.data);
+    const body = createBrowserDevHostNetworkBody(method, payload.data, headers);
     const controller = new AbortController();
+    const onRequestAbort = () => controller.abort(requestSignal.reason);
+    requestSignal.addEventListener('abort', onRequestAbort, { once: true });
+    if (requestSignal.aborted)
+        onRequestAbort();
     const timeout = Number(payload.timeout) > 0 ? Number(payload.timeout) : 10000;
     const timer = setTimeout(() => controller.abort(), timeout);
     const pinnedTargets = new Map();
     const dispatcher = createPinnedNetworkDispatcher(pinnedTargets);
     try {
-        const response = await fetchMockNetworkWithRedirects({
+        const response = await fetchBrowserDevHostNetworkWithRedirects({
             body,
             dispatcher,
             fetchImpl,
             headers,
             lookupHostname,
+            allowedHttpOrigins,
             method,
             pinnedTargets,
             signal: controller.signal,
             url,
         });
         const contentType = response.headers.get('content-type') || '';
-        const text = await readLimitedMockNetworkResponse(response);
+        const text = await readLimitedBrowserDevHostNetworkResponse(response);
         return {
             data: contentType.includes('application/json') ? safeJsonParse(text) : text,
             status: response.status,
             statusText: response.statusText,
-            headers: Object.fromEntries(response.headers.entries()),
+            headers: Object.fromEntries([...response.headers.entries()].filter(([name]) => !isCredentialHeader(name))),
         };
     }
     catch (error) {
         if (isObjectLike(error) && typeof error.status === 'number') {
             throw error;
         }
-        throw createMockHostError(502, 'MOCK_NETWORK_REQUEST_FAILED', error instanceof Error && error.name === 'AbortError' ? `network.request timeout after ${timeout}ms` : readErrorMessage(error));
+        throw createBrowserDevHostError(502, 'BROWSER_DEV_HOST_NETWORK_REQUEST_FAILED', error instanceof Error && error.name === 'AbortError' ? `network.request timeout after ${timeout}ms` : readErrorMessage(error));
     }
     finally {
+        requestSignal.removeEventListener('abort', onRequestAbort);
         clearTimeout(timer);
         await dispatcher.close();
     }
 }
-async function fetchMockNetworkWithRedirects(options) {
+async function fetchBrowserDevHostNetworkWithRedirects(options) {
     let url = options.url;
     let method = options.method;
     let body = options.body;
-    for (let redirectCount = 0; redirectCount <= MAX_MOCK_NETWORK_REDIRECTS; redirectCount += 1) {
-        const pinnedTarget = await resolveMockNetworkTarget(url, options.lookupHostname);
+    for (let redirectCount = 0; redirectCount <= MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS; redirectCount += 1) {
+        const pinnedTarget = await resolveBrowserDevHostNetworkTarget(url, options.lookupHostname, options.allowedHttpOrigins);
         options.pinnedTargets.set(createPinnedNetworkTargetKey(url), pinnedTarget);
         const response = await options.fetchImpl(url.toString(), {
             body,
@@ -497,24 +511,31 @@ async function fetchMockNetworkWithRedirects(options) {
         if (!location) {
             return response;
         }
-        if (redirectCount === MAX_MOCK_NETWORK_REDIRECTS) {
-            throw createMockHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
+        if (redirectCount === MAX_BROWSER_DEV_HOST_NETWORK_REDIRECTS) {
+            throw createBrowserDevHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
         }
         await response.body?.cancel();
-        url = new URL(location, url);
+        const redirectedUrl = new URL(location, url);
+        if (redirectedUrl.origin !== url.origin) {
+            throw createBrowserDevHostError(403, 'NETWORK_REDIRECT_DENIED', 'network.request 不允许跨 origin redirect');
+        }
+        url = redirectedUrl;
         if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === 'POST')) {
             method = 'GET';
             body = undefined;
         }
     }
-    throw createMockHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
+    throw createBrowserDevHostError(502, 'TOO_MANY_REDIRECTS', 'network.request redirect limit exceeded');
 }
-async function resolveMockNetworkTarget(url, lookupHostname) {
+async function resolveBrowserDevHostNetworkTarget(url, lookupHostname, allowedHttpOrigins) {
     if (!['http:', 'https:'].includes(url.protocol)) {
-        throw createMockHostError(403, 'NETWORK_TARGET_DENIED', 'network.request redirect 仅支持 HTTP(S) URL');
+        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request redirect 仅支持 HTTP(S) URL');
     }
     if (url.username || url.password) {
-        throw createMockHostError(403, 'NETWORK_TARGET_DENIED', 'network.request URL 不允许包含凭据');
+        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request URL 不允许包含凭据');
+    }
+    if (url.protocol === 'http:' && !allowedHttpOrigins.has(url.origin)) {
+        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request HTTP 仅允许已声明的本地开发 origin');
     }
     const hostname = normalizeNetworkHostname(url.hostname);
     const addressFamily = net.isIP(hostname);
@@ -522,8 +543,64 @@ async function resolveMockNetworkTarget(url, lookupHostname) {
     if (!addresses.length) {
         throw new Error('network.request target DNS lookup returned no addresses');
     }
+    if (url.protocol === 'https:' && addresses.some(({ address, family }) => isDeniedNetworkAddress(address, family))) {
+        throw createBrowserDevHostError(403, 'NETWORK_TARGET_DENIED', 'network.request 目标地址不允许访问');
+    }
     return addresses[0];
 }
+function createDeniedNetworkTargets() {
+    const list = new net.BlockList();
+    for (const [network, prefix] of [
+        ['0.0.0.0', 8],
+        ['10.0.0.0', 8],
+        ['100.64.0.0', 10],
+        ['127.0.0.0', 8],
+        ['169.254.0.0', 16],
+        ['172.16.0.0', 12],
+        ['192.0.0.0', 24],
+        ['192.0.2.0', 24],
+        ['192.168.0.0', 16],
+        ['198.18.0.0', 15],
+        ['198.51.100.0', 24],
+        ['203.0.113.0', 24],
+        ['224.0.0.0', 4],
+        ['240.0.0.0', 4],
+    ]) {
+        list.addSubnet(network, prefix, 'ipv4');
+    }
+    for (const [network, prefix] of [
+        ['::', 128],
+        ['::1', 128],
+        ['64:ff9b::', 96],
+        ['64:ff9b:1::', 48],
+        ['2001::', 32],
+        ['2001:10::', 28],
+        ['2001:20::', 28],
+        ['2001:db8::', 32],
+        ['2002::', 16],
+        ['fc00::', 7],
+        ['fe80::', 10],
+        ['ff00::', 8],
+    ]) {
+        list.addSubnet(network, prefix, 'ipv6');
+    }
+    return list;
+}
+function isDeniedNetworkAddress(address, family) {
+    const normalized = normalizeNetworkHostname(address);
+    if (family === 4 || net.isIP(normalized) === 4)
+        return DENIED_NETWORK_TARGETS.check(normalized, 'ipv4');
+    if (family === 6 || net.isIP(normalized) === 6) {
+        if (normalized.toLowerCase().startsWith('::ffff:'))
+            return true;
+        return DENIED_NETWORK_TARGETS.check(normalized, 'ipv6');
+    }
+    return true;
+}
+function isCredentialHeader(name) {
+    const normalized = name.trim().toLowerCase();
+    return CREDENTIAL_HEADER_RE.test(normalized) || normalized.startsWith('x-heybox-') || normalized.startsWith('x-xhh-');
+}
 function createPinnedNetworkDispatcher(pinnedTargets) {
     const connect = undici.buildConnector({});
     return new undici.Agent({
@@ -548,7 +625,7 @@ function createPinnedNetworkTargetKey(url) {
 function normalizeNetworkHostname(hostname) {
     return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
 }
-async function readLimitedMockNetworkResponse(response) {
+async function readLimitedBrowserDevHostNetworkResponse(response) {
     if (!response.body) {
         return '';
     }
@@ -561,24 +638,24 @@ async function readLimitedMockNetworkResponse(response) {
             break;
         }
         size += value.byteLength;
-        if (size > MAX_MOCK_NETWORK_RESPONSE_BODY) {
+        if (size > MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY) {
             await reader.cancel();
-            throw createMockHostError(502, 'NETWORK_RESPONSE_TOO_LARGE', 'network.request response body too large');
+            throw createBrowserDevHostError(502, 'NETWORK_RESPONSE_TOO_LARGE', 'network.request response body too large');
         }
         chunks.push(value);
     }
     return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString('utf8');
 }
-function createMockNetworkUrl(input, params) {
+function createBrowserDevHostNetworkUrl(input, params) {
     let url;
     try {
         url = new URL(input);
     }
     catch {
-        throw createMockHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是合法 URL');
+        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是合法 URL');
     }
     if (!['http:', 'https:'].includes(url.protocol)) {
-        throw createMockHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request 仅支持 HTTP(S) URL');
+        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request 仅支持 HTTP(S) URL');
     }
     if (isRecord$1(params)) {
         Object.entries(params).forEach(([key, value]) => {
@@ -589,25 +666,25 @@ function createMockNetworkUrl(input, params) {
     }
     return url;
 }
-function normalizeMockNetworkHeaders(headers) {
+function normalizeBrowserDevHostNetworkHeaders(headers) {
     const normalized = new Headers();
     if (!isRecord$1(headers)) {
         return normalized;
     }
     Object.entries(headers).forEach(([key, value]) => {
-        if (isSensitiveMockNetworkHeader(key)) {
-            throw createMockHostError(400, 'INVALID_NETWORK_REQUEST', `network.request 不允许设置敏感请求头: ${key}`);
+        if (isSensitiveBrowserDevHostNetworkHeader(key)) {
+            throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', `network.request 不允许设置敏感请求头: ${key}`);
         }
-        if (typeof value === 'string' && !isBlockedMockNetworkHeader(key)) {
+        if (typeof value === 'string' && !isBlockedBrowserDevHostNetworkHeader(key)) {
             normalized.set(key, value);
         }
     });
     return normalized;
 }
-function isSensitiveMockNetworkHeader(key) {
+function isSensitiveBrowserDevHostNetworkHeader(key) {
     return ['authorization', 'cookie', 'proxy-authorization'].includes(key.toLowerCase());
 }
-function isBlockedMockNetworkHeader(key) {
+function isBlockedBrowserDevHostNetworkHeader(key) {
     return [
         'connection',
         'content-length',
@@ -624,10 +701,10 @@ function isBlockedMockNetworkHeader(key) {
 /**
  * 与 App Host 对齐：Mock 不再放行 multipart，避免“本地成功、上线失败”。
  */
-function assertSupportedMockNetworkRequestShape(headers, data) {
+function assertSupportedBrowserDevHostNetworkRequestShape(headers, data) {
     const contentType = headers.get('content-type') || '';
     if (contentType.toLowerCase().includes('multipart/form-data') || looksLikeMultipartBody(data)) {
-        throw createMockHostError(400, 'INVALID_NETWORK_REQUEST', MOCK_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE);
+        throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE);
     }
 }
 function looksLikeMultipartBody(data) {
@@ -637,13 +714,13 @@ function looksLikeMultipartBody(data) {
     const trimmed = data.trimStart();
     return trimmed.startsWith('--') && /content-disposition\s*:\s*form-data/i.test(data);
 }
-function createMockNetworkBody(method, data, headers) {
+function createBrowserDevHostNetworkBody(method, data, headers) {
     if (data === undefined || method === 'GET' || method === 'HEAD') {
         return undefined;
     }
     const body = typeof data === 'string' ? data : JSON.stringify(data);
-    if (Buffer.byteLength(body) > MAX_MOCK_NETWORK_REQUEST_BODY) {
-        throw createMockHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'network.request data exceeds 2097152 bytes');
+    if (Buffer.byteLength(body) > MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY) {
+        throw createBrowserDevHostError(413, 'REQUEST_ENTITY_TOO_LARGE', 'network.request data exceeds 2097152 bytes');
     }
     if (typeof data === 'string') {
         return body;
@@ -691,7 +768,7 @@ function createDevSessionRoutes(options) {
                 reapExpiredDevSessions(devSessions, expiredDevSessions, options.now());
                 revokeDevSessionForOrigin(devSessions, validated.miniUrlOrigin);
                 if (devSessions.size >= MAX_ACTIVE_DEV_SESSIONS) {
-                    throw createMockHostError(429, 'DEV_SESSION_LIMIT_REACHED', 'active Dev Session limit reached');
+                    throw createBrowserDevHostError(429, 'DEV_SESSION_LIMIT_REACHED', 'active Dev Session limit reached');
                 }
                 const expiresAt = options.now() + DEV_SESSION_TTL_MS;
                 const token = createDevSessionToken(devSessions);
@@ -712,7 +789,7 @@ function createDevSessionRoutes(options) {
                 writeJsonResponse(response, 201, result);
             }
             catch (error) {
-                const status = readMockHostErrorStatus(error);
+                const status = readBrowserDevHostErrorStatus(error);
                 writeJsonResponse(response, status === 500 ? 400 : status, {
                     code: 'INVALID_DEV_SESSION',
                     message: readErrorMessage(error),
@@ -802,7 +879,10 @@ async function handleTokenNetworkProxy(request, response, token, runtime) {
         });
         return;
     }
-    await handleMockNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, true);
+    await handleBrowserDevHostNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, {
+        allowedHttpOrigins: new Set([resolved.session.miniUrlOrigin]),
+        cors: true,
+    });
 }
 function resolveDevSession(token, devSessions, expiredDevSessions, now) {
     const session = devSessions.get(token);
@@ -866,6 +946,355 @@ function writeDevSessionCorsResponse(response, status, serializedBody) {
     response.end(serializedBody ?? '');
 }
 
+const LOGIN_CLIENT = 'hb-sdk-browser-dev-host';
+const LOGIN_ENVIRONMENT = 'development';
+const LOGIN_CALLBACK_PATH = '/session/callback';
+const SESSION_COOKIE_NAME = 'hb_sdk_browser_dev_session';
+const LOGIN_INTENT_TTL_MS = 5 * 60 * 1000;
+const SESSION_TTL_MS = 8 * 60 * 60 * 1000;
+class BrowserDevSessionInvalidatedError extends Error {
+    code = 'BROWSER_DEV_SESSION_INVALIDATED';
+    constructor() {
+        super('Browser Dev Host session is no longer valid');
+        this.name = 'BrowserDevSessionInvalidatedError';
+    }
+}
+class BrowserDevSessionError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'BrowserDevSessionError';
+    }
+}
+function createBrowserDevHostSessionController(options = {}) {
+    const now = options.now ?? Date.now;
+    const randomBytes = options.randomBytes ?? node_crypto.randomBytes;
+    const loginIntents = new Map();
+    const sessions = new Map();
+    const revisionListeners = new Set();
+    let revision = 0;
+    return {
+        csrfToken: createOpaqueValue(randomBytes, 32),
+        async createLoginIntent(input) {
+            const service = options.loginService;
+            if (!service) {
+                throw new BrowserDevSessionError(503, 'LOGIN_SERVICE_UNAVAILABLE', 'Browser Dev Host login service is unavailable');
+            }
+            reapExpiredState();
+            const state = createUniqueValue(loginIntents, randomBytes);
+            const verifier = createOpaqueValue(randomBytes, 32);
+            const redirectUri = `${normalizeOrigin(input.origin)}${LOGIN_CALLBACK_PATH}`;
+            const returnPath = normalizeReturnPath(input.returnPath);
+            const codeChallenge = node_crypto.createHash('sha256').update(verifier).digest('base64url');
+            loginIntents.set(state, {
+                expiresAt: now() + LOGIN_INTENT_TTL_MS,
+                redirectUri,
+                returnPath,
+                verifier,
+            });
+            try {
+                const result = await service.createAuthorizationUrl({
+                    client: LOGIN_CLIENT,
+                    codeChallenge,
+                    codeChallengeMethod: 'S256',
+                    environment: LOGIN_ENVIRONMENT,
+                    redirectUri,
+                    state,
+                });
+                const authorizationUrl = normalizeAuthorizationUrl(result.authorizationUrl, {
+                    codeChallenge,
+                    redirectUri,
+                    state,
+                });
+                return { authorizationUrl, state };
+            }
+            catch (error) {
+                loginIntents.delete(state);
+                if (error instanceof BrowserDevSessionError)
+                    throw error;
+                throw new BrowserDevSessionError(502, 'LOGIN_SERVICE_ERROR', 'Browser Dev Host login service failed');
+            }
+        },
+        async completeLogin(input) {
+            const service = options.loginService;
+            if (!service) {
+                throw new BrowserDevSessionError(503, 'LOGIN_SERVICE_UNAVAILABLE', 'Browser Dev Host login service is unavailable');
+            }
+            reapExpiredState();
+            const intent = loginIntents.get(input.state);
+            if (!intent || intent.redirectUri !== `${normalizeOrigin(input.origin)}${LOGIN_CALLBACK_PATH}`) {
+                throw new BrowserDevSessionError(400, 'INVALID_LOGIN_STATE', 'Browser Dev Host login state is invalid');
+            }
+            loginIntents.delete(input.state);
+            if (!input.code || input.code.length > 4096) {
+                throw new BrowserDevSessionError(400, 'INVALID_LOGIN_CODE', 'Browser Dev Host login code is invalid');
+            }
+            let exchanged;
+            try {
+                exchanged = await service.exchangeCode({
+                    client: LOGIN_CLIENT,
+                    code: input.code,
+                    codeVerifier: intent.verifier,
+                    environment: LOGIN_ENVIRONMENT,
+                    redirectUri: intent.redirectUri,
+                });
+            }
+            catch {
+                throw new BrowserDevSessionError(502, 'LOGIN_EXCHANGE_FAILED', 'Browser Dev Host login exchange failed');
+            }
+            const userId = normalizeUserId(exchanged.userId);
+            const credential = normalizeCredential(exchanged.credential);
+            const sessionId = createUniqueValue(sessions, randomBytes);
+            const expiresAt = now() + SESSION_TTL_MS;
+            const expiryTimer = setTimeout(() => {
+                if (sessions.delete(sessionId))
+                    broadcastRevision(revisionListeners, ++revision);
+            }, Math.max(0, expiresAt - now()));
+            expiryTimer.unref?.();
+            sessions.set(sessionId, {
+                credential,
+                expiresAt,
+                expiryTimer,
+                userId,
+            });
+            broadcastRevision(revisionListeners, ++revision);
+            return {
+                redirectPath: intent.returnPath,
+                setCookie: createSessionCookie(sessionId),
+            };
+        },
+        readStatus(cookieHeader) {
+            reapExpiredState();
+            const session = readSession(cookieHeader, sessions);
+            return session ? { authenticated: true, revision, userId: session.userId } : { authenticated: false, revision };
+        },
+        logout(cookieHeader) {
+            const sessionId = readSessionId(cookieHeader);
+            const session = sessionId ? sessions.get(sessionId) : undefined;
+            if (sessionId && session) {
+                clearTimeout(session.expiryTimer);
+                sessions.delete(sessionId);
+                broadcastRevision(revisionListeners, ++revision);
+            }
+            return { clearCookie: clearSessionCookie(), revision };
+        },
+        async request(cookieHeader, request, signal) {
+            const service = options.loginService;
+            const sessionId = readSessionId(cookieHeader);
+            const session = sessionId ? sessions.get(sessionId) : undefined;
+            if (!service || !session || now() >= session.expiresAt) {
+                if (sessionId && sessions.delete(sessionId))
+                    broadcastRevision(revisionListeners, ++revision);
+                throw new BrowserDevSessionError(401, 'SESSION_UNAUTHENTICATED', 'Browser Dev Host session is unauthenticated');
+            }
+            assertAuthenticatedRequest(request);
+            try {
+                const result = await service.request({ credential: session.credential, request, signal: signal ?? new AbortController().signal });
+                if (containsCredentialOrSensitiveResponse(result, session.credential)) {
+                    clearTimeout(session.expiryTimer);
+                    sessions.delete(sessionId);
+                    broadcastRevision(revisionListeners, ++revision);
+                    throw new BrowserDevSessionError(502, 'CREDENTIAL_EGRESS_BLOCKED', 'Browser Dev Host blocked a sensitive response');
+                }
+                return result;
+            }
+            catch (error) {
+                if (error instanceof BrowserDevSessionError)
+                    throw error;
+                if (error instanceof BrowserDevSessionInvalidatedError || readErrorCode(error) === 'BROWSER_DEV_SESSION_INVALIDATED') {
+                    clearTimeout(session.expiryTimer);
+                    sessions.delete(sessionId);
+                    broadcastRevision(revisionListeners, ++revision);
+                    throw new BrowserDevSessionError(401, 'SESSION_INVALIDATED', 'Browser Dev Host session was invalidated');
+                }
+                throw new BrowserDevSessionError(502, 'AUTHENTICATED_REQUEST_FAILED', 'Browser Dev Host authenticated request failed');
+            }
+        },
+        onAccountRevision(listener) {
+            revisionListeners.add(listener);
+            return () => revisionListeners.delete(listener);
+        },
+        dispose() {
+            loginIntents.clear();
+            for (const session of sessions.values())
+                clearTimeout(session.expiryTimer);
+            sessions.clear();
+            revisionListeners.clear();
+        },
+    };
+    function reapExpiredState() {
+        const removedSession = reapExpired(loginIntents, sessions, now());
+        if (removedSession)
+            broadcastRevision(revisionListeners, ++revision);
+    }
+}
+function createOpaqueValue(randomBytes, size) {
+    return randomBytes(size).toString('base64url');
+}
+function createUniqueValue(map, randomBytes) {
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+        const value = createOpaqueValue(randomBytes, 32);
+        if (!map.has(value))
+            return value;
+    }
+    throw new BrowserDevSessionError(500, 'RANDOM_VALUE_COLLISION', 'Browser Dev Host could not allocate a random value');
+}
+function normalizeOrigin(value) {
+    const url = new URL(value);
+    if (url.origin !== value || url.protocol !== 'http:') {
+        throw new BrowserDevSessionError(400, 'INVALID_LOGIN_ORIGIN', 'Browser Dev Host login origin is invalid');
+    }
+    return url.origin;
+}
+function normalizeReturnPath(value) {
+    if (!value.startsWith('/') || value.startsWith('//') || value.includes('#') || /[\r\n]/.test(value)) {
+        throw new BrowserDevSessionError(400, 'INVALID_RETURN_PATH', 'Browser Dev Host login return path is invalid');
+    }
+    const url = new URL(value, 'http://127.0.0.1');
+    if (url.origin !== 'http://127.0.0.1' || url.pathname === LOGIN_CALLBACK_PATH) {
+        throw new BrowserDevSessionError(400, 'INVALID_RETURN_PATH', 'Browser Dev Host login return path is invalid');
+    }
+    return `${url.pathname}${url.search}`;
+}
+function normalizeAuthorizationUrl(value, expected) {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' ||
+        [...url.searchParams.keys()].some(isSensitiveQueryKey) ||
+        url.searchParams.get('state') !== expected.state ||
+        url.searchParams.get('code_challenge') !== expected.codeChallenge ||
+        url.searchParams.get('code_challenge_method') !== 'S256' ||
+        url.searchParams.get('redirect_uri') !== expected.redirectUri ||
+        url.searchParams.get('client_id') !== LOGIN_CLIENT ||
+        url.searchParams.get('environment') !== LOGIN_ENVIRONMENT) {
+        throw new BrowserDevSessionError(502, 'INVALID_AUTHORIZATION_URL', 'Browser Dev Host authorization URL is invalid');
+    }
+    return url.toString();
+}
+function isSensitiveQueryKey(key) {
+    const normalized = key.toLowerCase().replaceAll('_', '-');
+    return (normalized === 'credential' ||
+        normalized === 'cookie' ||
+        normalized === 'pkey' ||
+        normalized === 'token' ||
+        normalized.endsWith('-token') ||
+        normalized === 'authorization');
+}
+function normalizeUserId(value) {
+    const userId = typeof value === 'string' ? value.trim() : '';
+    if (!userId || userId.length > 256) {
+        throw new BrowserDevSessionError(502, 'INVALID_LOGIN_USER', 'Browser Dev Host login user is invalid');
+    }
+    return userId;
+}
+function createSessionCookie(sessionId) {
+    return `${SESSION_COOKIE_NAME}=${sessionId}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}`;
+}
+function clearSessionCookie() {
+    return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`;
+}
+function readSessionId(cookieHeader) {
+    if (!cookieHeader)
+        return undefined;
+    for (const item of cookieHeader.split(';')) {
+        const separator = item.indexOf('=');
+        if (separator < 0 || item.slice(0, separator).trim() !== SESSION_COOKIE_NAME)
+            continue;
+        const value = item.slice(separator + 1).trim();
+        return /^[A-Za-z0-9_-]{43}$/.test(value) ? value : undefined;
+    }
+    return undefined;
+}
+function readSession(cookieHeader, sessions) {
+    const sessionId = readSessionId(cookieHeader);
+    return sessionId ? sessions.get(sessionId) : undefined;
+}
+function reapExpired(loginIntents, sessions, now) {
+    let removedSession = false;
+    for (const [state, intent] of loginIntents)
+        if (now >= intent.expiresAt)
+            loginIntents.delete(state);
+    for (const [sessionId, session] of sessions) {
+        if (now >= session.expiresAt) {
+            clearTimeout(session.expiryTimer);
+            sessions.delete(sessionId);
+            removedSession = true;
+        }
+    }
+    return removedSession;
+}
+function assertAuthenticatedRequest(request) {
+    if (!request || typeof request !== 'object' || !request.target || typeof request.target !== 'object') {
+        throw new BrowserDevSessionError(400, 'INVALID_AUTHENTICATED_REQUEST', 'Browser Dev Host authenticated request is invalid');
+    }
+    const serialized = JSON.stringify(request);
+    if (serialized === undefined || serialized.length > 2 * 1024 * 1024) {
+        throw new BrowserDevSessionError(413, 'AUTHENTICATED_REQUEST_TOO_LARGE', 'Browser Dev Host authenticated request is too large');
+    }
+    if (containsSensitiveKey(request, new Set(), 0)) {
+        throw new BrowserDevSessionError(400, 'INVALID_AUTHENTICATED_REQUEST', 'Browser Dev Host authenticated request is invalid');
+    }
+}
+function containsCredentialOrSensitiveResponse(value, credential) {
+    if (value === credential)
+        return true;
+    if (typeof credential === 'string' && credential.length >= 8) {
+        try {
+            if (JSON.stringify(value)?.includes(credential))
+                return true;
+        }
+        catch {
+            return true;
+        }
+    }
+    return containsSensitiveKey(value, new Set(), 0);
+}
+function normalizeCredential(value) {
+    if (typeof value !== 'string' || value.length < 16 || value.length > 16 * 1024) {
+        throw new BrowserDevSessionError(502, 'INVALID_LOGIN_CREDENTIAL', 'Browser Dev Host login credential is invalid');
+    }
+    return value;
+}
+function containsSensitiveKey(value, seen, depth) {
+    if (depth > 16 || value === null || typeof value !== 'object')
+        return false;
+    if (seen.has(value))
+        return false;
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.some((item) => containsSensitiveKey(item, seen, depth + 1));
+    for (const [key, child] of Object.entries(value)) {
+        const normalized = key.toLowerCase().replaceAll('_', '-');
+        if (normalized === 'credential' ||
+            normalized === 'cookie' ||
+            normalized === 'set-cookie' ||
+            normalized === 'pkey' ||
+            normalized === 'token' ||
+            normalized.endsWith('-token') ||
+            normalized === 'authorization') {
+            return true;
+        }
+        if (containsSensitiveKey(child, seen, depth + 1))
+            return true;
+    }
+    return false;
+}
+function readErrorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
+}
+function broadcastRevision(listeners, revision) {
+    for (const listener of listeners) {
+        try {
+            listener(revision);
+        }
+        catch {
+            // 观察者失败不能阻断 vault 失效。
+        }
+    }
+}
+
 async function selectAvailablePort(options) {
     const maxAttempts = options.maxAttempts ?? 20;
     const port = await options.getPort({
@@ -882,30 +1311,36 @@ function createPortCandidates(startPort, count) {
 }
 
 const MINI_PROGRAM_URL_QUERY_PARAM$1 = 'mini_url';
-const MOCK_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
-const MOCK_NETWORK_PROXY_PATH = '/__hb_sdk_mock_network__';
+const BROWSER_DEV_HOST_BOOTSTRAP_PATH = '/__hb_sdk_bootstrap__';
+const BROWSER_DEV_HOST_NETWORK_PATH = '/__hb_sdk__/network';
 const DEV_PERMISSIONS_PATH = '/__hb_sdk__/dev-permissions';
 const DEV_LISTEN_HOST$1 = '0.0.0.0';
 const LOCAL_DEV_URL_HOST$1 = '127.0.0.1';
-const MOCK_HOST_ROOT_CANDIDATES = [
-    path.resolve(__dirname, 'devtools/mock-host'),
-    path.resolve(__dirname, '../devtools/mock-host'),
-    path.resolve(__dirname, '../../devtools/mock-host'),
-    path.resolve(__dirname, '../../../devtools/mock-host'),
+const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
+    path.resolve(__dirname, 'devtools/browser-dev-host'),
+    path.resolve(__dirname, '../devtools/browser-dev-host'),
+    path.resolve(__dirname, '../../devtools/browser-dev-host'),
+    path.resolve(__dirname, '../../../devtools/browser-dev-host'),
 ];
-async function startMiniProgramMockHostServer(options) {
-    const root = options.root ?? resolveMiniProgramMockHostRoot(options.rootCandidates);
-    assertCompleteMiniProgramMockHostRoot(root);
+async function startBrowserDevHostServer(options) {
+    const root = options.root ?? resolveBrowserDevHostRoot(options.rootCandidates);
+    assertCompleteMiniProgramBrowserDevHostRoot(root);
+    const sessionController = createBrowserDevHostSessionController({
+        loginService: options.loginService,
+        now: options.now,
+    });
     const bootstrap = {
+        csrfToken: sessionController.csrfToken,
         defaultLanAddressId: options.defaultLanAddressId,
         devContext: options.devContext,
         lanAddresses: options.lanAddresses ?? [],
+        loginAvailable: options.loginService !== undefined,
         macAppProtocol: options.macAppProtocol,
         nativeAppLaunchUnavailableReason: options.nativeAppLaunchUnavailableReason,
         runtimePermissions: options.runtimePermissions,
     };
-    let bootstrapJson = serializeMockHostBootstrap(bootstrap);
-    const server = createMiniProgramMockHostServer(root, {
+    let bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
+    const serverRuntime = createBrowserDevHostServer(root, {
         appUrl: options.appUrl,
         allowedMiniUrlOrigins: new Set((options.lanAddresses ?? []).map(({ appUrl }) => new URL(appUrl).origin)),
         readBootstrapJson: () => bootstrapJson,
@@ -914,12 +1349,15 @@ async function startMiniProgramMockHostServer(options) {
         lookupHostname: options.lookupHostname ?? (async (hostname) => promises.lookup(hostname, { all: true, verbatim: true })),
         now: options.now ?? Date.now,
         permissionController: options.permissionController,
+        sessionController,
     });
+    const server = serverRuntime.server;
     const port = await listenHttpServer(server, {
         port: options.port,
     }, options.getPort ?? getPorts);
     return {
         close: () => new Promise((resolve) => {
+            serverRuntime.dispose();
             server.close(() => resolve());
         }),
         updateBootstrap: (next) => {
@@ -931,56 +1369,57 @@ async function startMiniProgramMockHostServer(options) {
                 delete bootstrap.macAppProtocol;
             else if (next.macAppProtocol !== undefined)
                 bootstrap.macAppProtocol = next.macAppProtocol;
-            bootstrapJson = serializeMockHostBootstrap(bootstrap);
+            bootstrapJson = serializeBrowserDevHostBootstrap(bootstrap);
         },
-        networkUrls: createMiniProgramMockHostNetworkUrls({
+        networkUrls: createBrowserDevHostNetworkUrls({
+            appUrl: options.appUrl,
             lanAddresses: options.lanAddresses,
             port,
         }),
         port,
         root,
         server,
-        url: createMiniProgramMockHostUrlWithHost({
+        url: createBrowserDevHostUrlWithHost({
             appUrl: options.appUrl,
             host: LOCAL_DEV_URL_HOST$1,
             port,
         }),
     };
 }
-function resolveMiniProgramMockHostRoot(candidates = MOCK_HOST_ROOT_CANDIDATES) {
-    const found = candidates.find(isCompleteMiniProgramMockHostRoot);
+function resolveBrowserDevHostRoot(candidates = BROWSER_DEV_HOST_ROOT_CANDIDATES) {
+    const found = candidates.find(isCompleteMiniProgramBrowserDevHostRoot);
     if (!found) {
-        throw createMissingMockHostError();
+        throw createMissingBrowserDevHostError();
     }
     return found;
 }
-function assertCompleteMiniProgramMockHostRoot(root) {
-    if (!isCompleteMiniProgramMockHostRoot(root)) {
-        throw createMissingMockHostError();
+function assertCompleteMiniProgramBrowserDevHostRoot(root) {
+    if (!isCompleteMiniProgramBrowserDevHostRoot(root)) {
+        throw createMissingBrowserDevHostError();
     }
 }
-function isCompleteMiniProgramMockHostRoot(root) {
+function isCompleteMiniProgramBrowserDevHostRoot(root) {
     return fs.existsSync(path.join(root, 'index.html')) && fs.existsSync(path.join(root, 'main.js'));
 }
-function createMissingMockHostError() {
-    return new Error('未找到完整的 hb-sdk mock host 静态产物。请先执行 @heybox/hb-sdk 的 build:mock-host。');
+function createMissingBrowserDevHostError() {
+    return new Error('未找到完整的 hb-sdk browser dev host 静态产物。请先执行 @heybox/hb-sdk 的 build:browser-dev-host。');
 }
-function createMiniProgramMockHostNetworkUrls(options) {
-    return (options.lanAddresses ?? []).map((address) => createMiniProgramMockHostUrlWithHost({
+function createBrowserDevHostNetworkUrls(options) {
+    return (options.lanAddresses ?? []).map((address) => createBrowserDevHostUrlWithHost({
         appUrl: address.appUrl,
         host: address.address,
         port: options.port,
     }));
 }
-function createMiniProgramMockHostUrlWithHost(options) {
+function createBrowserDevHostUrlWithHost(options) {
     const url = new URL(`http://${options.host}:${options.port}/`);
     url.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM$1, options.appUrl);
     return url.toString();
 }
-function serializeMockHostBootstrap(bootstrap) {
+function serializeBrowserDevHostBootstrap(bootstrap) {
     const serialized = JSON.stringify(bootstrap);
     if (serialized === undefined) {
-        throw new TypeError('Mock host bootstrap must be JSON serializable');
+        throw new TypeError('Browser Dev Host bootstrap must be JSON serializable');
     }
     const serializedBootstrap = JSON.parse(serialized);
     if (bootstrap.runtimePermissions !== undefined && !Object.prototype.hasOwnProperty.call(serializedBootstrap, 'runtimePermissions')) {
@@ -988,24 +1427,49 @@ function serializeMockHostBootstrap(bootstrap) {
     }
     return serialized;
 }
-function createMiniProgramMockHostServer(root, runtime) {
+function createBrowserDevHostServer(root, runtime) {
     const devSessionRoutes = createDevSessionRoutes({
         allowedMiniUrlOrigins: runtime.allowedMiniUrlOrigins,
         fetchImpl: runtime.fetchImpl,
         lookupHostname: runtime.lookupHostname,
         now: runtime.now,
     });
-    return node_http.createServer(async (request, response) => {
-        const requestUrl = new URL(request.url, 'http://localhost');
-        const pathname = decodeURIComponent(requestUrl.pathname);
-        const devSessionRoute = devSessionRoutes.match(pathname);
+    const eventStreams = new Set();
+    const unsubscribeRevision = runtime.sessionController.onAccountRevision((revision) => {
+        const data = JSON.stringify({ revision });
+        for (const stream of eventStreams)
+            stream.write(`event: account-invalidated\ndata: ${data}\n\n`);
+    });
+    const server = node_http.createServer(async (request, response) => {
         const loopbackPeer = runtime.isLoopbackPeer(request.socket.remoteAddress);
-        // Dev Session 需要允许手机局域网访问；其余 mock 页仍限制本机。
+        let requestUrl;
+        try {
+            requestUrl = new URL(request.url, 'http://localhost');
+        }
+        catch {
+            writeBadRequest(response);
+            return;
+        }
+        // LAN 只允许固定 token 路由；在任何 URI decode 前先完成窄匹配。
+        if (!loopbackPeer && !devSessionRoutes.match(requestUrl.pathname)) {
+            writeForbidden(response);
+            return;
+        }
+        let pathname;
+        try {
+            pathname = decodeURIComponent(requestUrl.pathname);
+        }
+        catch {
+            writeBadRequest(response);
+            return;
+        }
+        const devSessionRoute = devSessionRoutes.match(pathname);
+        // Dev Session 需要允许手机局域网访问；其余 Browser Dev Host 页面仍限制本机。
         if (!loopbackPeer && !devSessionRoute) {
             writeForbidden(response);
             return;
         }
-        if (isMockHostDocumentPath(pathname) && !requestUrl.searchParams.has(MINI_PROGRAM_URL_QUERY_PARAM$1)) {
+        if (isBrowserDevHostDocumentPath(pathname) && !requestUrl.searchParams.has(MINI_PROGRAM_URL_QUERY_PARAM$1)) {
             const targetUrl = new URL(requestUrl);
             targetUrl.pathname = '/';
             targetUrl.searchParams.set(MINI_PROGRAM_URL_QUERY_PARAM$1, runtime.appUrl);
@@ -1016,7 +1480,7 @@ function createMiniProgramMockHostServer(root, runtime) {
             response.end();
             return;
         }
-        if (pathname === MOCK_HOST_BOOTSTRAP_PATH) {
+        if (pathname === BROWSER_DEV_HOST_BOOTSTRAP_PATH) {
             if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
                 writeForbidden(response);
                 return;
@@ -1028,6 +1492,95 @@ function createMiniProgramMockHostServer(root, runtime) {
             writeSerializedJsonResponse(response, 200, runtime.readBootstrapJson());
             return;
         }
+        if (pathname === '/session/status') {
+            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
+                writeForbidden(response);
+                return;
+            }
+            if (request.method !== 'GET') {
+                writeMethodNotAllowed(response, 'GET');
+                return;
+            }
+            const status = runtime.sessionController.readStatus(request.headers.cookie);
+            writeJsonResponse(response, 200, {
+                authenticated: status.authenticated,
+                revision: status.revision,
+                ...(status.authenticated ? { user_id: status.userId } : {}),
+            });
+            return;
+        }
+        if (pathname === '/session/login-intent') {
+            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken) || request.method !== 'POST') {
+                if (request.method !== 'POST')
+                    writeMethodNotAllowed(response, 'POST');
+                else
+                    writeForbidden(response);
+                return;
+            }
+            await handleLoginIntent(request, response, runtime.sessionController);
+            return;
+        }
+        if (pathname === '/session/callback') {
+            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
+                writeForbidden(response);
+                return;
+            }
+            if (request.method !== 'GET') {
+                writeMethodNotAllowed(response, 'GET');
+                return;
+            }
+            await handleLoginCallback(request, response, requestUrl, runtime.sessionController);
+            return;
+        }
+        if (pathname === '/session/logout') {
+            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken) || request.method !== 'POST') {
+                if (request.method !== 'POST')
+                    writeMethodNotAllowed(response, 'POST');
+                else
+                    writeForbidden(response);
+                return;
+            }
+            const result = runtime.sessionController.logout(request.headers.cookie);
+            response.setHeader('set-cookie', result.clearCookie);
+            writeJsonResponse(response, 200, { revision: result.revision });
+            return;
+        }
+        if (pathname === '/session/request') {
+            if (!isValidSensitiveRequest(request, loopbackPeer, runtime.sessionController.csrfToken) || request.method !== 'POST') {
+                if (request.method !== 'POST')
+                    writeMethodNotAllowed(response, 'POST');
+                else
+                    writeForbidden(response);
+                return;
+            }
+            await handleAuthenticatedRequest(request, response, runtime.sessionController);
+            return;
+        }
+        if (pathname === '/session/events') {
+            if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
+                writeForbidden(response);
+                return;
+            }
+            if (request.method !== 'GET') {
+                writeMethodNotAllowed(response, 'GET');
+                return;
+            }
+            const status = runtime.sessionController.readStatus(request.headers.cookie);
+            if (!status.authenticated) {
+                writeJsonResponse(response, 401, { code: 'SESSION_UNAUTHENTICATED' });
+                return;
+            }
+            response.writeHead(200, {
+                'cache-control': 'no-store',
+                connection: 'keep-alive',
+                'content-type': 'text/event-stream; charset=utf-8',
+                'x-accel-buffering': 'no',
+            });
+            response.write(`event: account-revision\ndata: ${JSON.stringify({ revision: status.revision })}\n\n`);
+            eventStreams.add(response);
+            request.once('close', () => eventStreams.delete(response));
+            return;
+        }
         if (pathname === DEV_PERMISSIONS_PATH && runtime.permissionController) {
             if (!loopbackPeer || !hasNumericLoopbackHost(request)) {
                 writeForbidden(response);
@@ -1037,7 +1590,9 @@ function createMiniProgramMockHostServer(root, runtime) {
                 writeJsonResponse(response, 200, await runtime.permissionController.get());
                 return;
             }
-            if ((request.method !== 'PUT' && request.method !== 'DELETE') || !hasValidMutationOrigin(request)) {
+            if ((request.method !== 'PUT' && request.method !== 'DELETE') ||
+                !hasValidMutationOrigin(request) ||
+                !hasValidCsrf(request, runtime.sessionController.csrfToken)) {
                 if (request.method !== 'PUT' && request.method !== 'DELETE') {
                     writeMethodNotAllowed(response, 'GET, PUT, DELETE');
                 }
@@ -1050,14 +1605,17 @@ function createMiniProgramMockHostServer(root, runtime) {
             return;
         }
         if (pathname === MINI_PROGRAM_DEV_CONTEXT_PATH) {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request) || !hasValidMutationOrigin(request)) {
-                writeForbidden(response);
-                return;
-            }
             if (request.method !== 'POST') {
                 writeMethodNotAllowed(response, 'POST');
                 return;
             }
+            if (!loopbackPeer ||
+                !hasNumericLoopbackHost(request) ||
+                !hasValidMutationOrigin(request) ||
+                !hasValidCsrf(request, runtime.sessionController.csrfToken)) {
+                writeForbidden(response);
+                return;
+            }
             await devSessionRoutes.create(request, response);
             return;
         }
@@ -1065,12 +1623,15 @@ function createMiniProgramMockHostServer(root, runtime) {
             await devSessionRoutes.handle(devSessionRoute, request, response);
             return;
         }
-        if (pathname === MOCK_NETWORK_PROXY_PATH) {
-            if (!loopbackPeer || !hasNumericLoopbackHost(request) || !hasValidMutationOrigin(request)) {
+        if (pathname === BROWSER_DEV_HOST_NETWORK_PATH) {
+            const csrfValid = request.method !== 'POST' || hasValidCsrf(request, runtime.sessionController.csrfToken);
+            if (!loopbackPeer || !hasNumericLoopbackHost(request) || !hasValidMutationOrigin(request) || !csrfValid) {
                 writeForbidden(response);
                 return;
             }
-            await handleMockNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname);
+            await handleBrowserDevHostNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, {
+                allowedHttpOrigins: new Set([runtime.appUrl, ...runtime.allowedMiniUrlOrigins].map((value) => new URL(value).origin)),
+            });
             return;
         }
         const targetPath = resolveStaticPath(root, pathname);
@@ -1097,38 +1658,131 @@ function createMiniProgramMockHostServer(root, runtime) {
             response.end('Not found');
         }
     });
+    return {
+        server,
+        dispose() {
+            unsubscribeRevision();
+            for (const stream of eventStreams)
+                stream.end();
+            eventStreams.clear();
+            runtime.sessionController.dispose();
+        },
+    };
+}
+async function handleLoginIntent(request, response, controller) {
+    try {
+        const payload = await readJsonRequestBody(request);
+        if (!isRecord$1(payload) || Object.keys(payload).some((key) => key !== 'return_path') || typeof payload.return_path !== 'string') {
+            throw new BrowserDevSessionError(400, 'INVALID_LOGIN_INTENT', 'Browser Dev Host login intent is invalid');
+        }
+        const result = await controller.createLoginIntent({
+            origin: readRequestOrigin(request),
+            returnPath: payload.return_path,
+        });
+        writeJsonResponse(response, 201, { authorization_url: result.authorizationUrl });
+    }
+    catch (error) {
+        writeSessionError(response, error);
+    }
+}
+async function handleLoginCallback(request, response, requestUrl, controller) {
+    try {
+        const keys = [...requestUrl.searchParams.keys()];
+        if (keys.some((key) => key !== 'code' && key !== 'state')) {
+            throw new BrowserDevSessionError(400, 'INVALID_LOGIN_CALLBACK', 'Browser Dev Host login callback is invalid');
+        }
+        const code = requestUrl.searchParams.get('code');
+        const state = requestUrl.searchParams.get('state');
+        if (!code || !state) {
+            throw new BrowserDevSessionError(400, 'INVALID_LOGIN_CALLBACK', 'Browser Dev Host login callback is invalid');
+        }
+        const result = await controller.completeLogin({
+            code,
+            origin: readRequestOrigin(request),
+            state,
+        });
+        response.writeHead(302, {
+            'cache-control': 'no-store',
+            location: result.redirectPath,
+            'referrer-policy': 'no-referrer',
+            'set-cookie': result.setCookie,
+        });
+        response.end();
+    }
+    catch (error) {
+        response.writeHead(302, {
+            'cache-control': 'no-store',
+            location: '/',
+            'referrer-policy': 'no-referrer',
+        });
+        response.end();
+    }
+}
+async function handleAuthenticatedRequest(request, response, controller) {
+    const abort = new AbortController();
+    request.once('aborted', () => abort.abort());
+    try {
+        const payload = await readJsonRequestBody(request);
+        const result = await controller.request(request.headers.cookie, payload, abort.signal);
+        writeJsonResponse(response, 200, result);
+    }
+    catch (error) {
+        writeSessionError(response, error);
+    }
+}
+function writeSessionError(response, error) {
+    const sessionError = error instanceof BrowserDevSessionError
+        ? error
+        : new BrowserDevSessionError(500, 'BROWSER_DEV_SESSION_ERROR', 'Browser Dev Host session request failed');
+    writeJsonResponse(response, sessionError.status, {
+        code: sessionError.code,
+        message: sessionError.message,
+    });
+}
+function readRequestOrigin(request) {
+    const host = request.headers.host;
+    if (!host)
+        throw new BrowserDevSessionError(400, 'INVALID_LOGIN_ORIGIN', 'Browser Dev Host login origin is invalid');
+    return `http://${host}`;
+}
+function isValidSensitiveRequest(request, loopbackPeer, csrfToken) {
+    return loopbackPeer && hasNumericLoopbackHost(request) && hasValidMutationOrigin(request) && hasValidCsrf(request, csrfToken);
+}
+function hasValidCsrf(request, csrfToken) {
+    const value = request.headers['x-hb-sdk-csrf'];
+    return typeof value === 'string' && value === csrfToken;
 }
 async function handleDevPermissionMutation(request, response, controller) {
     try {
         if (request.method === 'DELETE') {
             if (hasRequestBody(request)) {
                 if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-                    throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
+                    throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
                 }
                 const payload = await readJsonRequestBody(request);
                 if (!isRecord$1(payload) || Object.keys(payload).length > 0) {
-                    throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions reset body is invalid');
+                    throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions reset body is invalid');
                 }
             }
             writeJsonResponse(response, 200, await controller.reset());
             return;
         }
         if (!request.headers['content-type']?.toLowerCase().startsWith('application/json')) {
-            throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
+            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions body must be JSON');
         }
         const payload = await readJsonRequestBody(request);
         if (!isRecord$1(payload) || Object.keys(payload).length !== 1 || !Object.hasOwn(payload, 'runtime_permissions')) {
-            throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions update body is invalid');
+            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'Dev permissions update body is invalid');
         }
         const parsed = context.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
         if (!parsed.valid) {
-            throw createMockHostError(400, 'INVALID_DEV_PERMISSIONS', 'runtime_permissions is invalid');
+            throw createBrowserDevHostError(400, 'INVALID_DEV_PERMISSIONS', 'runtime_permissions is invalid');
         }
         const runtimePermissions = JSON.parse(JSON.stringify(payload.runtime_permissions));
         writeJsonResponse(response, 200, await controller.save(runtimePermissions));
     }
     catch (error) {
-        const errorStatus = readMockHostErrorStatus(error);
+        const errorStatus = readBrowserDevHostErrorStatus(error);
         const status = request.method === 'DELETE' && errorStatus === 500 ? 502 : errorStatus;
         writeJsonResponse(response, status, {
             code: request.method === 'DELETE' ? 'DEV_PERMISSIONS_RESET_FAILED' : 'DEV_PERMISSIONS_UPDATE_FAILED',
@@ -1150,6 +1804,10 @@ function writeForbidden(response) {
     response.writeHead(403, { 'cache-control': 'no-store' });
     response.end();
 }
+function writeBadRequest(response) {
+    response.writeHead(400, { 'cache-control': 'no-store' });
+    response.end();
+}
 function hasValidMutationOrigin(request) {
     const origin = request.headers.origin;
     const host = request.headers.host;
@@ -1180,7 +1838,7 @@ function hasNumericLoopbackHost(request) {
 function isLoopbackAddress(address) {
     return address === '::1' || address === '127.0.0.1' || address?.startsWith('127.') === true || address?.startsWith('::ffff:127.') === true;
 }
-function isMockHostDocumentPath(pathname) {
+function isBrowserDevHostDocumentPath(pathname) {
     return pathname === '/' || pathname === '/index.html';
 }
 function resolveStaticPath(root, pathname) {
@@ -1214,7 +1872,7 @@ async function listenHttpServer(server, options, getPortImpl) {
     const port = await selectAvailablePort({
         getPort: getPortImpl,
         host: DEV_LISTEN_HOST$1,
-        label: 'mock host',
+        label: 'browser dev host',
         startPort: options.port,
     });
     await new Promise((resolve, reject) => {
@@ -1347,7 +2005,7 @@ function createHeyboxProtocol(payload) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.3';
+    : '0.7.4-alpha.4';
 
 class DevPermissionOverrideStoreError extends Error {
     code;
@@ -1470,7 +2128,7 @@ function isNodeError(error) {
 }
 
 const DEFAULT_APP_PORT = 5173;
-const DEFAULT_MOCK_PORT = 5174;
+const DEFAULT_BROWSER_DEV_HOST_PORT = 5174;
 const DEFAULT_DEV_CONTEXT_TIMEOUT_MS = 3000;
 const DEV_LISTEN_HOST = '0.0.0.0';
 const LOCAL_DEV_URL_HOST = '127.0.0.1';
@@ -1537,9 +2195,9 @@ async function runDevCommand(options, runtime = {}) {
         viteNetworkUrls: appServer.resolvedUrls?.network ?? [],
     });
     const closers = [() => appServer.close()];
-    let mockHost;
+    let browserDevHost;
     try {
-        mockHost = await logger.task('正在启动 Mock runtime host', () => startMiniProgramMockHostServer({
+        browserDevHost = await logger.task('正在启动 Browser Dev Host', () => startBrowserDevHostServer({
             appUrl,
             devContext: devLaunchContext,
             fetchImpl,
@@ -1547,6 +2205,7 @@ async function runDevCommand(options, runtime = {}) {
             defaultLanAddressId: lanAddresses[0]?.id,
             lanAddresses,
             lookupHostname: runtime.lookupHostname,
+            loginService: runtime.loginService,
             macAppProtocol: createMacAppProtocol(appUrl, {
                 miniProgramId: devLaunchContext.miniProgramId,
                 localDevLaunchToken: devLaunchContext.localDevLaunchToken,
@@ -1554,17 +2213,17 @@ async function runDevCommand(options, runtime = {}) {
                 sdkVersion: HB_SDK_VERSION,
             }),
             permissionController,
-            port: options.mockPort ?? DEFAULT_MOCK_PORT,
-            root: runtime.mockHostRoot,
-            rootCandidates: runtime.mockHostRootCandidates,
+            port: options.browserDevHostPort ?? DEFAULT_BROWSER_DEV_HOST_PORT,
+            root: runtime.browserDevHostRoot,
+            rootCandidates: runtime.browserDevHostRootCandidates,
             runtimePermissions: devLaunchContext.runtimePermissions,
-        }), { successText: 'Mock runtime host 已启动' });
+        }), { successText: 'Browser Dev Host 已启动' });
     }
     catch (error) {
         await closeAll(closers);
         throw error;
     }
-    closers.push(() => mockHost.close());
+    closers.push(() => browserDevHost.close());
     if (devLaunchContext.source === 'remote' && devLaunchContext.miniProgramId) {
         const tokenSession = startLocalDevLaunchTokenSession({
             env: runtime.env,
@@ -1578,7 +2237,7 @@ async function runDevCommand(options, runtime = {}) {
                     ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
                     runtimePermissions: devLaunchContext.runtimePermissions,
                 };
-                mockHost.updateBootstrap({
+                browserDevHost.updateBootstrap({
                     devContext: tokenContext,
                     lanAddresses: createLanAddressCandidates({
                         appUrl,
@@ -1604,17 +2263,17 @@ async function runDevCommand(options, runtime = {}) {
         });
         closers.push(tokenSession.close);
     }
-    logger.success('Mock runtime host 已就绪');
-    logger.info(`Mock runtime host: ${mockHost.url}`);
+    logger.success('Browser Dev Host 已就绪');
+    logger.info(`Browser Dev Host: ${browserDevHost.url}`);
     logger.info(`Mini program URL: ${appUrl}`);
-    logger.info('Mac APP: use the button in Mock runtime host');
-    logger.info('Mobile APP: scan the QR code in Mock runtime host');
+    logger.info('Mac APP: use the button in Browser Dev Host');
+    logger.info('Mobile APP: scan the QR code in Browser Dev Host');
     if (devLaunchContext.source === 'anonymous') {
         logger.warn('当前使用匿名本地沙箱；真机调试可用，但不会携带远端小程序身份或权限。');
     }
     if (options.open !== false) {
         logger.debug('正在打开浏览器调试页');
-        void openUrl(mockHost.url);
+        void openUrl(browserDevHost.url);
     }
     installShutdownHandlers(closers, runtime.process ?? process);
 }
@@ -1625,7 +2284,7 @@ async function loadDevLaunchContext(options) {
         if (options.requireRemote) {
             throw new Error(anonymousReason);
         }
-        options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${anonymousReason}`);
+        options.logger.warn(`未读取到远端 Runtime 权限，Browser Dev Host 将默认拒绝受管能力：${anonymousReason}`);
         return {
             source: 'anonymous',
             warning: anonymousReason,
@@ -1655,7 +2314,7 @@ async function loadDevLaunchContext(options) {
             throw error;
         }
         options.logger.debug(`远端 dev context 失败详情：${index.readRedactedErrorMessage(error, { verbose: true })}`);
-        options.logger.warn(`未读取到远端 Runtime 权限，Mock runtime 将默认拒绝受管能力：${DEV_CONTEXT_UNAVAILABLE_WARNING}`);
+        options.logger.warn(`未读取到远端 Runtime 权限，Browser Dev Host 将默认拒绝受管能力：${DEV_CONTEXT_UNAVAILABLE_WARNING}`);
         return {
             source: 'anonymous',
             warning: DEV_CONTEXT_UNAVAILABLE_WARNING,
@@ -1677,7 +2336,7 @@ function createDevPermissionController(options) {
             source: devContext.source,
             ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
             ...(isRuntimePermissionsSnapshot(devContext.runtimePermissions) ? { remote_permissions: devContext.runtimePermissions } : {}),
-            ...(overrides ? { override_permissions: context.createMiniProgramMockRuntimePermissions(overrides) } : {}),
+            ...(overrides ? { override_permissions: context.createBrowserDevRuntimePermissions(overrides) } : {}),
             ...(error ? { persistence_error: error } : {}),
         };
     };
@@ -1714,7 +2373,7 @@ function createDevPermissionController(options) {
             return createConfiguration(undefined);
         },
         async save(runtimePermissions) {
-            const overrides = context.createMiniProgramMockPermissionState({
+            const overrides = context.createBrowserDevPermissionState({
                 runtimePermissions,
             });
             try {