@heybox/hb-sdk 0.7.4-alpha.5 → 0.7.4

package/dist/index.cjs.js

@@ -672,7 +672,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.5';
+    : '0.7.4';
 
 const DEFAULT_TIMEOUT = 10000;
 const HANDSHAKE_RETRY_INTERVAL = 250;

package/dist/index.esm.js

@@ -668,7 +668,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.5';
+    : '0.7.4';
 
 const DEFAULT_TIMEOUT = 10000;
 const HANDSHAKE_RETRY_INTERVAL = 250;

package/dist/vite.cjs.js

@@ -8,7 +8,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.5';
+    : '0.7.4';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -5,7 +5,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.7.4-alpha.5';
+    : '0.7.4';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.7.4-alpha.5",
+  "version": "0.7.4",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -56,7 +56,8 @@
     "@msgpack/msgpack": "^3.1.3",
     "parse5": "^7.3.0",
     "undici": "^7.28.0",
-    "@heybox/hb-sdk-protocol": "0.7.4-alpha.5"
+    "ws": "^8.18.0",
+    "@heybox/hb-sdk-protocol": "0.7.4"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -71,6 +72,7 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@heybox/hb-types": "^1.0.1",
+    "@playwright/test": "^1.55.1",
     "@vitejs/plugin-vue2": "^2.3.3",
     "@rollup/plugin-typescript": "^11.1.6",
     "@types/ejs": "^3.1.5",
@@ -78,6 +80,7 @@
     "@types/node": "24.10.1",
     "@types/qrcode": "^1.5.6",
     "@types/semver": "^7.7.1",
+    "@types/ws": "^8.5.13",
     "@vitest/coverage-v8": "^3.2.4",
     "commander": "^12.1.0",
     "cos-nodejs-sdk-v5": "2.15.4",
@@ -98,7 +101,10 @@
     "vite": "^8.0.12",
     "vitest": "^3.2.4",
     "@heybox/hb-api": "~1.25.20",
-    "@heybox/hb-sdk-runtime": "~0.7.4-alpha.5"
+    "@heybox/hb-sdk-runtime": "~0.7.4",
+    "@heybox/runtime-transport-fetch": "~0.2.0",
+    "@heybox/runtime-policy": "~0.2.0",
+    "@heybox/runtime": "~0.2.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -129,13 +135,14 @@
     ]
   },
   "scripts": {
-    "dev": "vite",
+    "dev": "vite --config vite.browser-dev-host.config.ts",
     "build:package": "nx exec -- sh -c \"pnpm run clean && pnpm run build:lib:bundle && pnpm run build:cli:bundle && pnpm run build:templates && pnpm run build:types\"",
     "build:watch": "pnpm run build:lib -w & pnpm run build:types -w",
     "build:hb-api-contract": "pnpm --dir ../hb-api run build:lib",
-    "build:lib": "pnpm run build:hb-api-contract && pnpm run build:lib:bundle",
+    "build:hb-sdk-protocol": "pnpm --filter @heybox/hb-sdk-protocol run build:package",
+    "build:lib": "pnpm run build:hb-sdk-protocol && pnpm run build:hb-api-contract && pnpm run build:lib:bundle",
     "build:lib:bundle": "rollup -c rollup.config.ts  --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}'",
-    "build:cli": "pnpm run build:hb-api-contract && pnpm run build:cli:bundle",
+    "build:cli": "pnpm run build:hb-sdk-protocol && pnpm run build:hb-api-contract && pnpm run build:cli:bundle",
     "build:cli:bundle": "rollup -c rollup.config.ts --environment HB_SDK_BUILD:cli --configPlugin 'typescript={\"tsconfig\":\"tsconfig.build.json\"}' && pnpm run build:browser-dev-host",
     "build:browser-dev-host": "node scripts/copy-browser-dev-host.cjs",
     "build:templates": "node scripts/copy-cli-templates.cjs",
@@ -149,7 +156,7 @@
     "test:types": "pnpm run test:types:characterization && pnpm run test:types:browser-dev-host",
     "test:e2e:browser-dev-host": "pnpm run build:browser-dev-host && NODE_OPTIONS='--conditions=heybox' vitest run --config vitest.browser-dev-host-e2e.config.ts",
     "test:unit:coverage": "NODE_OPTIONS='--conditions=heybox' vitest run --coverage",
-    "test:vite": "pnpm run build:hb-api-contract && vitest run --config vitest.vite.config.ts",
+    "test:vite": "pnpm run build:hb-sdk-protocol && pnpm run build:hb-api-contract && vitest run --config vitest.vite.config.ts",
     "test:watch": "NODE_OPTIONS='--conditions=heybox' vitest",
     "changelog:draft": "node scripts/changelog-draft.cjs",
     "check:changelog": "node scripts/check-changelog.cjs",

package/skill/SKILL.md

@@ -10,7 +10,7 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 ## Step 1: Classify the task
 
 1. If the task is workshop mini-program business code, use the root package import path `@heybox/hb-sdk`.
-2. If the task is new protocol or `@heybox/hb-sdk-runtime` graph maintenance, import wire contracts directly from `@heybox/hb-sdk-protocol`. Existing released Host consumers continue to use the compatibility entry `@heybox/hb-sdk/protocol` until the synchronized hard cut is published.
+2. If the task is new protocol or `@heybox/hb-sdk-runtime` graph maintenance, import wire contracts directly from `@heybox/hb-sdk-protocol`. Existing released Host consumers continue to use the compatibility entry `@heybox/hb-sdk/protocol` until they are explicitly migrated.
 3. If the task is project scaffolding, local startup, production build, browser Mock, device debugging, CLI login, Agent Skill diagnosis, or CLI troubleshooting, use the `hb-sdk` CLI workflow.
 4. If the task is reviewing a mini-program for submission, listing, audit, publishing, content compliance, data/privacy compliance, runtime quality, or icon/cover design requirements, use the online publishing rules workflow.
 5. If the task asks for direct login-state extraction, cookies, tokens, raw Heybox client protocols, or internal hb-sdk package paths, refuse that approach and use the public SDK or CLI boundary instead.
@@ -55,13 +55,13 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 ## Step 5: Use CLI workflows
 
 1. Use `hb-sdk create <project-name>` to scaffold a workshop mini-program.
-2. Use `hb-sdk dev` for browser, Mac App, or mobile App debugging. These entries remain available without CLI login or project binding, but managed capabilities are denied by default.
-3. Use `--port`, `--browser-dev-host-port`, and `--no-open` when the default local ports or browser opening behavior need to be controlled.
+2. Use `hb-sdk dev` for Browser Mock, Mac App, or Mobile App debugging. It requires an active CLI login, a bound Mini-program, and an available remote Dev Context; it must stop before starting Vite or any debugging service when a prerequisite is missing. Mobile uses the `open_inapp` and `heybox://` `openWindow` wrapper with a LAN short URL, then opens `heybox-mini-dev://sandbox` with the complete launch context.
+3. Treat debugging-page permission overrides as local development behavior; overrides do not change remote permissions. Use `--port`, `--browser-dev-host-port`, and `--no-open` to control local endpoints and browser opening. Select a Mobile network interface the device can reach. `launch.json` is a LAN discovery document, not authentication, encryption, signing, or HMAC protection.
 4. Use `hb-sdk build [--env <name>] [--verbose]` as the recommended production build entry. It directly owns the Vite build, always cleans and writes `dist/`, and works without CLI login, project binding, or network access.
 5. Keep `miniappManifest()` explicitly enabled in `vite.config.ts`; `hb-sdk build` must fail when the required Manifest or Runtime gate output is missing.
 6. Keep project typechecking in `scripts.build`, for example `vue-tsc --noEmit && hb-sdk build`; `hb-sdk build` does not run typechecking or invoke `scripts.build` itself.
 7. Existing projects may continue to use `vite build`; do not auto-migrate them. Do not invent `--mode`, `--json`, config, or output-directory flags for `hb-sdk build`.
-8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` only for development and publishing commands. This login does not change `auth.login()`, `user.getInfo()`, or the mini-program user's authorization state.
+8. Use `hb-sdk login`, `hb-sdk login status`, and `hb-sdk login clear` for development, publishing, and Browser Mock Host `heybox-session` requests. Mini-program code must still call `auth.login()`; the debug page only confirms authorization. Do not paste CLI credentials into page JavaScript. Phone debugging continues to use the App login.
 9. Use `hb-sdk remote entity current` to confirm the current developer account and `hb-sdk remote entity switch <entity-id>` to change it before remote operations.
 10. Use `hb-sdk remote create` to create and bind a mini-program; use `hb-sdk remote bind <mini-program-id>` to bind an existing manageable mini-program.
 11. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for remote inspection and preview management.
@@ -90,7 +90,7 @@ For workshop mini-program business code:
 For CLI and local development:
 
 1. Do not print, persist in templates, or pass through pkey, cookies, tokens, or private credentials.
-2. Do not use `hb-sdk login` as a workaround for `auth.login()` or mini-program user authorization.
+2. Do not skip `auth.login()` in mini-program code. Browser Mock may reuse the Node `hb-sdk login` session for Host network requests, but the page must still call `auth.login()` and handle the authorization dialog. Never paste CLI credentials into page JavaScript.
 3. Use the built-in local debugging page instead of creating another browser Mock.
 4. Keep the Vite `miniappManifest()` plugin enabled.
 5. Treat permission changes made in the `hb-sdk dev` debugging page as local debugging overrides, not online configuration changes. Use the page's reset action to return to the remote baseline.
@@ -98,7 +98,7 @@ For CLI and local development:
 
 For host/runtime/protocol-maintenance code:
 
-1. Treat `@heybox/hb-sdk-protocol` as the wire contract owner; existing consumers continue to use the public compatibility entry `@heybox/hb-sdk/protocol` until the synchronized hard cut is released.
+1. Use `@heybox/hb-sdk-protocol` as the direct wire-contract owner for new Host/Runtime/protocol work. Preserve `@heybox/hb-sdk/protocol` only for existing compatibility consumers until they are explicitly migrated.
 2. Keep raw protocol details inside the host/runtime boundary; do not leak them into app-facing SDK examples or workshop mini-program business code.
 3. Preserve compatibility with existing SDK clients.
 

package/skill/references/api-protocol.md

@@ -14,7 +14,7 @@
 - [Generated reference index](#generated-reference-index)
 ## Host/runtime-only warning
 
-Use `@heybox/hb-sdk/protocol` only for parent-container runtime, bridge-server, protocol-contract, or `@heybox/hb-sdk-runtime` integration tasks. Iframe mini-program business code must use root SDK APIs and must not construct bridge envelopes, nonce handling, or raw `postMessage` flows.
+New parent-container Host, `@heybox/hb-sdk-runtime`, bridge-server, and protocol-contract maintenance must import wire contracts directly from `@heybox/hb-sdk-protocol`. Use `@heybox/hb-sdk/protocol` only for explicitly retained existing compatibility consumers. Iframe mini-program business code must use root SDK APIs and must not construct bridge envelopes, nonce handling, or raw `postMessage` flows.
 
 ## Public protocol entrypoint
 

package/skill/references/api-root.md

@@ -24,7 +24,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.7.4-alpha.5`
+- Version at generation time: `0.7.4`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`

package/skill/references/cli.md

@@ -104,9 +104,11 @@ CLI 会启动页面服务并自动打开本地调试页。调试页会展示小
 
 <img src="https://static.max-c.com/static/heybox/webapp/heybox-docs/docs-hb_sdk/assets/local-preview-debug-page.png" alt="hb-sdk 本地调试页、浏览器 Mock 和真机调试入口" style="width: 100%; max-width: 860px;" />
 
-未登录或未绑定小程序时，浏览器、Mac 和手机调试入口仍然可用，但受管能力会默认拒绝。登录并绑定后，调试页才能根据当前小程序的线上配置提示差异。
+`hb-sdk dev` 不支持匿名调试。启动前必须先运行 `hb-sdk login`，并通过 `hb-sdk remote create` 或 `hb-sdk remote bind <mini-program-id>` 绑定当前项目；未登录、未绑定或远端 Dev Context 不可用时，CLI 会在启动 Vite 和调试服务前终止。
 
-`hb-sdk dev` 会在启动 Vite 前读取远端权限。只有远端权限快照有效且 `network.request.status=enabled` 时才跳过平台 CSP；`useOfficialDomain` 不参与该判定。未登录、未绑定、读取失败、非法快照或仅在 Dev Context 中开启本地权限覆盖时都继续注入 CSP。
+`hb-sdk dev` 会在启动 Vite 前读取远端权限。只有远端权限快照有效且 `network.request.status=enabled` 时才跳过平台 CSP；`useOfficialDomain` 不参与该判定。本地 Dev Context 权限覆盖不会改变 CSP 决策。
+
+当前调试链路不要求升级 Android、iOS 或 Mac 客户端。Browser Mock 会自动在实时与兼容链路间切换；Mobile 使用 `open_inapp`/`openWindow` 包裹的 LAN 短链接二维码（先开普通 H5 跳转页，再进入小程序并关闭中间页）；PC/Mac 行为保持不变。
 
 ### 2. 先用浏览器 Mock 验收
 
@@ -116,18 +118,13 @@ CLI 会启动页面服务并自动打开本地调试页。调试页会展示小
 - SDK 初始化与用户身份授权流程
 - 生命周期、Storage 和排行榜等能力
 
-Dev Context 中调整的权限只影响当前本地调试，不会修改线上配置。调试页会区分线上基线与本地覆盖；恢复初始权限后重新按远端配置验收。
-
-切换权限后 Mobile App 二维码会自动重生成；旧二维码失效时按调试页提示重新扫码。工坊小程序默认不能进行网络请求，网络权限暂未开放申请；不要把本地调试结果当成线上能力。
+调试页中调整的权限只影响当前本地调试，不会修改线上配置；切换权限后 Mobile App 会重生成二维码。Debug/Ad-Hoc 的本地增强不可用、过期或读取失败时继续使用原生 Host。恢复初始权限后重新按远端配置验收；工坊小程序默认不能进行网络请求，网络权限暂未开放申请，不要把本地结果当成线上能力。
 
 ### 3. 再用 Mac 或手机真机验收
 
-需要确认真实客户端表现时，从调试页选择一种方式：
-
-- 点击「在 Mac 版 APP 中启动」。
-- 在「Mobile App」区域选择局域网网卡，再用手机小黑盒 APP 扫码。
+需要确认真实客户端表现时，可以使用调试页提供的 Mac 启动入口；手机验收则在「Mobile App」区域选择局域网网卡，再用手机小黑盒 APP 扫码。
 
-手机与电脑需要处于同一局域网。二维码默认使用 HTTPS `open_inapp` 包装链接；需要二维码直接编码裸 `heybox://` 协议时，以 `hb-sdk dev --raw-protocol` 启动。二维码无法访问时，先确认选择了正确的 **Network** 网卡。发布前至少完成一次真实客户端验收。
+手机与电脑需要处于同一局域网。二维码走 HTTPS `open_inapp` 与 `heybox://` `openWindow`，其中 `webview.url` 是局域网短链 `http://<lan-ip>:<browser-dev-host-port>/l/<token>`。短链返回跳转页：先打开带 `mini_url`、小程序身份、启动票、SDK 版本和局域网 Dev Context 的完整 `heybox-mini-dev://sandbox` 协议，约 500ms 后再发 `closeWindow` 关掉中间页。权限、网卡或启动票变化时调试页会刷新二维码并轮换 Dev Session。多网卡时选择手机实际可达的 **Network**。发布前至少完成一次真实客户端验收。
 
 ### 浏览器 Mock 的边界
 
@@ -135,17 +132,16 @@ Dev Context 中调整的权限只影响当前本地调试，不会修改线上
 
 ### 常用参数
 
-| 参数                 | 用途                                      |
-| -------------------- | ----------------------------------------- |
-| `--port <port>`      | 指定页面开发服务端口。                    |
-| `--browser-dev-host-port <port>` | 指定 Browser Dev Host 端口。               |
-| `--raw-protocol`     | 让手机二维码直接编码裸 `heybox://` 协议。 |
-| `--no-open`          | 启动后不自动打开浏览器。                  |
-| `--verbose`          | 出现问题时输出更详细的诊断信息。          |
+| 参数                             | 用途                                                          |
+| -------------------------------- | ------------------------------------------------------------- |
+| `--port <port>`                  | 指定页面开发服务端口。                                        |
+| `--browser-dev-host-port <port>` | 指定 Browser Dev Host 端口。                                  |
+| `--no-open`                      | 启动后不自动打开浏览器。                                      |
+| `--verbose`                      | 出现问题时输出更详细的诊断信息。                              |
 
-Use `hb-sdk dev` to open the local debugging page. The "在 Mac 版 APP 中启动" button opens the page in the Mac App; the "Mobile App" QR code opens it in the phone App after a LAN interface is selected. These entries remain available without CLI login or project binding, but managed capabilities are denied by default. The phone and computer must be on the same LAN. If an embedded browser cannot open the App, use the system browser.
+Use `hb-sdk dev` to open the local debugging page after CLI login and project binding are complete. Missing login, binding, or remote Dev Context stops before Vite and the debugging services start. The "Mobile App" QR code opens it in the phone App after a LAN interface is selected. The phone and computer must be on the same LAN.
 
-The default CLI does not configure the external one-time-code/PKCE service required for Browser Dev Host user login. In that state the page disables login and reports the missing prerequisite while other local debugging entries remain available. Never substitute CLI login state, cross-site cookies, mock identity, or credential-bearing URLs for this service.
+Browser Mock uses the Node `hb-sdk login` session to send Host `heybox-session` requests. Mini-program code must still call `auth.login()`; the debug page only shows an authorization dialog. Never copy pkey, cookies, tokens, or credential-bearing URLs into page JavaScript or logs. Phone debugging continues to use the App login, not the CLI session.
 
 ## Production build
 
@@ -252,7 +248,7 @@ Agent rules:
 
 ## CLI 登录态
 
-CLI 登录态只用于开发工具和远端管理，不等同于小程序内的用户登录态，也不会改变 `auth.login()`、`user.getInfo()` 或开发者服务端会话。
+CLI 登录态用于开发工具、远端管理，以及 Browser Dev Host 代发 `heybox-session` 请求。这份 CLI 登录态不会改变 `auth.login()` 的授权码流程；调试页只弹出授权确认。不要把 pkey、Cookie 或 token 写进页面、URL 或日志。
 
 ```bash
 hb-sdk login status

package/skill/references/examples.md

@@ -108,9 +108,9 @@ try {
 ### Host/runtime protocol import
 
 ```ts
-import { NETWORK_REQUEST_METHOD, type NetworkRequestPayload } from '@heybox/hb-sdk/protocol';
+import { NETWORK_REQUEST_METHOD, type NetworkRequestPayload } from '@heybox/hb-sdk-protocol';
 
-// Host/runtime integration only. Do not use this in iframe business code.
+// New Host/runtime integration only. Existing released consumers may retain @heybox/hb-sdk/protocol until explicitly migrated.
 export function canHandleNetwork(method: string): method is typeof NETWORK_REQUEST_METHOD {
   return method === NETWORK_REQUEST_METHOD;
 }

package/skill/references/safety-boundaries.md

@@ -36,4 +36,4 @@
 - Do not build raw `postMessage` bridge flows in iframe business code.
 - Do not fetch deployed `dist/manifest.json` from business code; it is a build artifact for the release pipeline, not a CDN runtime asset.
 - Do not import from internal hb-sdk implementation paths; only use documented package entrypoints.
-- Browser Dev Host user login must stay fail-closed when its external one-time-code/PKCE service is unavailable. Never reuse CLI login state or expose credentials to browser JavaScript, URLs, logs, or serializable errors.
+- Browser Dev Host may use the Node `hb-sdk login` session to send Host `heybox-session` requests. Never expose pkey, cookies, tokens, or credential-bearing URLs to browser JavaScript, page UI, or logs. Mini-program code must still call `auth.login()`.

package/skill/references/smoke-evaluation.md

@@ -9,7 +9,7 @@ Use this template when evaluating whether an agent followed the hb-sdk skill.
 ## Expected evidence
 
 - [ ] Uses `@heybox/hb-sdk` root imports for iframe business code.
-- [ ] Uses `@heybox/hb-sdk/protocol` only for host/runtime/protocol tasks.
+- [ ] Uses `@heybox/hb-sdk-protocol` directly for new host/runtime/protocol work and reserves `@heybox/hb-sdk/protocol` for existing compatibility consumers.
 - [ ] Uses `hb-sdk create`, `hb-sdk dev`, or `hb-sdk login` correctly for CLI tasks.
 - [ ] Uses `getHandshakeState()` plus `onHandshakeStateChange()` for gesture-gated control state, enables only on `status === 'ready'`, and cleans up the subscription.
 - [ ] Treats the non-replayed `ready` lifecycle event as an edge notification that may repeat after a duplicate handshake, never as current state.

package/skill/scripts/sync-references.mjs

@@ -345,7 +345,7 @@ files.set(
     ['Generated reference index', 'generated-reference-index'],
   ])}## Host/runtime-only warning
 
-Use \`@heybox/hb-sdk/protocol\` only for parent-container runtime, bridge-server, protocol-contract, or \`@heybox/hb-sdk-runtime\` integration tasks. Iframe mini-program business code must use root SDK APIs and must not construct bridge envelopes, nonce handling, or raw \`postMessage\` flows.
+New parent-container Host, \`@heybox/hb-sdk-runtime\`, bridge-server, and protocol-contract maintenance must import wire contracts directly from \`@heybox/hb-sdk-protocol\`. Use \`@heybox/hb-sdk/protocol\` only for explicitly retained existing compatibility consumers. Iframe mini-program business code must use root SDK APIs and must not construct bridge envelopes, nonce handling, or raw \`postMessage\` flows.
 
 ## Public protocol entrypoint
 
@@ -406,9 +406,9 @@ Agent rules:
 
 ${cliDevSection}
 
-Use \`hb-sdk dev\` to open the local debugging page. The "在 Mac 版 APP 中启动" button opens the page in the Mac App; the "Mobile App" QR code opens it in the phone App after a LAN interface is selected. These entries remain available without CLI login or project binding, but managed capabilities are denied by default. The phone and computer must be on the same LAN. If an embedded browser cannot open the App, use the system browser.
+Use \`hb-sdk dev\` to open the local debugging page after CLI login and project binding are complete. Missing login, binding, or remote Dev Context stops before Vite and the debugging services start. The "Mobile App" QR code opens it in the phone App after a LAN interface is selected. The phone and computer must be on the same LAN.
 
-The default CLI does not configure the external one-time-code/PKCE service required for Browser Dev Host user login. In that state the page disables login and reports the missing prerequisite while other local debugging entries remain available. Never substitute CLI login state, cross-site cookies, mock identity, or credential-bearing URLs for this service.
+Browser Mock uses the Node \`hb-sdk login\` session to send Host \`heybox-session\` requests. Mini-program code must still call \`auth.login()\`; the debug page only shows an authorization dialog. Never copy pkey, cookies, tokens, or credential-bearing URLs into page JavaScript or logs. Phone debugging continues to use the App login, not the CLI session.
 
 ## Production build
 
@@ -556,7 +556,7 @@ ${capabilityBoundaries}
 - Do not build raw \`postMessage\` bridge flows in iframe business code.
 - Do not fetch deployed \`dist/manifest.json\` from business code; it is a build artifact for the release pipeline, not a CDN runtime asset.
 - Do not import from internal hb-sdk implementation paths; only use documented package entrypoints.
-- Browser Dev Host user login must stay fail-closed when its external one-time-code/PKCE service is unavailable. Never reuse CLI login state or expose credentials to browser JavaScript, URLs, logs, or serializable errors.
+- Browser Dev Host may use the Node \`hb-sdk login\` session to send Host \`heybox-session\` requests. Never expose pkey, cookies, tokens, or credential-bearing URLs to browser JavaScript, page UI, or logs. Mini-program code must still call \`auth.login()\`.
 `,
 );
 
@@ -696,9 +696,9 @@ try {
 
 ${fenced(
   'ts',
-  `import { NETWORK_REQUEST_METHOD, type NetworkRequestPayload } from '@heybox/hb-sdk/protocol';
+  `import { NETWORK_REQUEST_METHOD, type NetworkRequestPayload } from '@heybox/hb-sdk-protocol';
 
-// Host/runtime integration only. Do not use this in iframe business code.
+// New Host/runtime integration only. Existing released consumers may retain @heybox/hb-sdk/protocol until explicitly migrated.
 export function canHandleNetwork(method: string): method is typeof NETWORK_REQUEST_METHOD {
   return method === NETWORK_REQUEST_METHOD;
 }`,

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.7.4-alpha.5+skill.6ae0dd3c4740",
+  "skillVersion": "0.7.4+skill.f8dd939f4173",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.7.4-alpha.5",
-    "compatibility": "0.7.4-alpha.5"
+    "version": "0.7.4",
+    "compatibility": "0.7.4"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-6ae0dd3c47408c7102d70dd1e6dfecf78e8466055dec3ab259fc800fb3ec9b59"
+  "integrity": "sha256-f8dd939f4173d20846ae7d62fbf6bc44227f8d9e186fc6a50e818a971a39213b"
 }

package/types/protocol/dev-session.d.ts

@@ -3,8 +3,12 @@ import type { MiniProgramRuntimePermissionsSnapshot } from './runtime-permission
 export declare const MINI_PROGRAM_DEV_CONTEXT_QUERY_PARAM = "dev_context_url";
 /** Browser Dev Host 创建和读取 Dev Session 的固定路径。 */
 export declare const MINI_PROGRAM_DEV_CONTEXT_PATH = "/__hb_sdk__/dev-context";
+/** 详情 H5 从 `mini_url` origin 发现其余启动参数的固定路径。 */
+export declare const MINI_PROGRAM_DEV_LAUNCH_PATH = "/__hb_sdk__/launch.json";
 /** Dev Session 当前使用的 schema 版本。 */
 export declare const MINI_PROGRAM_DEV_SESSION_SCHEMA_VERSION: 1;
+/** `launch.json` 当前使用的 schema 版本。 */
+export declare const MINI_PROGRAM_DEV_LAUNCH_SCHEMA_VERSION: 1;
 /** Browser Dev Host 创建 Dev Session 时接收的请求。 */
 export interface MiniProgramDevSessionCreatePayload {
     mini_url_origin: string;
@@ -23,3 +27,12 @@ export interface MiniProgramDevSessionSnapshot {
     mini_url_origin: string;
     runtime_permissions: MiniProgramRuntimePermissionsSnapshot;
 }
+/** 详情 H5 在只带 `mini_url` 启动后拉取的其余调试参数。 */
+export interface MiniProgramDevLaunchSnapshot {
+    schema_version: typeof MINI_PROGRAM_DEV_LAUNCH_SCHEMA_VERSION;
+    sdk_version?: string;
+    mini_program_id?: string;
+    local_dev_launch_token?: string;
+    dev_context_url?: string;
+    runtime_permissions?: MiniProgramRuntimePermissionsSnapshot;
+}