@heybox/hb-sdk 0.8.1-alpha.6 → 0.8.1-alpha.8

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。内部集成、实现策略和审查证据不在此维护。
 
+## 0.8.1-alpha.8
+
+- 手机 Dev Session 仅使用当前版本声明与平台批准结果求交后的有效权限；两者均允许 `useOfficialDomain: true` 时，真机扫码调试可访问官方域名，本地调试状态不能扩大该权限。
+- 创建手机调试会话前会刷新远端批准结果；读取失败时拒绝签发新会话，已创建会话仍按短期有效期自动失效。
+- 保持升级或回滚 CLI 时的新旧调试页兼容，并继续拒绝官方账号敏感路径、敏感请求头和自动重定向。
+
+## 0.8.1-alpha.7
+
+- `network.request` 已标记为废弃，但仍可调用，目前没有替代接口。请移除 `withCredentials`；旧版 SDK 的 wire 字段由 Runtime 兼容忽略。Mobile 对官方 HTTPS 默认端口目标自动携带 Native Cookie，第三方不自动携带。需要第三方会话时可显式提供应用 `Cookie` 或 `Authorization`；Web Host 受浏览器 Fetch 限制，不支持显式 `Cookie`。`Origin`、`Referer`、`User-Agent` 由 Host 管理，路由/分帧/逐跳请求头不能由小程序设置。
+
 ## 0.8.1-alpha.6
 
 - 修复远端权限快照包含未知权限且 `config` 为 `null` 时，`hb-sdk remote info` 把已批准的网络权限和官方域名配置误判为未批准的问题。
@@ -30,7 +40,6 @@
 
 - 目标平台声明统一迁移到 `package.json#heybox.platforms`；`miniappManifest()` 恢复无参调用，并在构建时将该声明写入 `dist/manifest.json`。
 - `hb-sdk dev`、`hb-sdk build` 和普通 `hb-sdk remote deploy` 会拒绝缺失或非法的平台声明；build/deploy 也会拒绝与项目配置不一致的 Manifest。已有项目升级时需把原 Vite 参数中的 `platforms` 移入 `package.json#heybox`。
-
 ## 0.8.1-alpha.2
 
 - 新增 `environment.getInfo()` 与 `environment.getInfoSync()`，用于读取运行模式、小黑盒 App 版本、canonical 小程序 ID/版本、操作系统和 SDK 版本的冻结快照。

package/README.md

@@ -258,12 +258,12 @@ SDK 还提供 `getHandshakeState()` / `onHandshakeStateChange()` 管理持久握
 - `auth.login()`、`user.getInfo()` 和 `user.getSteamGameList()` 的可用性不由 `network` 决定；它们分别要求 `userInfo` 或 `steamLibrary`，并继续遵循各自的用户授权和数据规则。
 - `user.revokeAuthorization()` 在两种网络模式下都要求可信用户手势；成功后必须停止使用并清理业务缓存的旧身份、资料和服务端会话。
 - `on()` 返回取消监听函数，组件卸载或页面销毁时需要调用。
-- 业务网络请求使用 `network.request()`，不要依赖浏览器原生网络出口。
+- 现有业务网络请求仍使用 `network.request()`；该 API 已标记废弃，但目前没有替代调用入口，不要依赖浏览器原生网络出口。
 - 公开 `network.request()` 与 `network.download()` 均使用 no-follow redirect policy；3xx 不会在 Host 内静默跳转。
 - `network.request()` 不能访问平台保留的 runtime auth 与 OpenAPI 内部路径；页面不得持有或交换服务端应用凭据。
 - `network.request` 不支持 `multipart/form-data`；App Host 仅支持 form（`application/x-www-form-urlencoded`）与 JSON。表单请用 `URLSearchParams#toString()` 作为 `data`，文件上传请走专用上传能力。
 - 新 PC 开放持久 sandbox、单文件/目录 picker、精确 File 保存与公网 `network.download()`；多选和小黑盒域名流式下载暂不支持。Mobile、Web 与 Browser Dev Host 仍未开放这些 primitive。
-- 新 PC 支持 `network.request`，但会忽略 `withCredentials`；它不改变请求路由或凭据行为。其他平台继续遵循各自的 Host 语义。
+- `withCredentials` 不再是支持的配置字段，也不会进入新 SDK、协议或 Host contract；旧 SDK 构建产物的 wire 字段仅由 Runtime 兼容忽略。Mobile 对官方 HTTPS 默认端口目标自动启用 Native Cookie，第三方关闭；应用可显式提供 `Cookie`、`Authorization` 等请求头。`Origin`、`Referer`、`User-Agent` 由 Host 接管；`Host`、分帧及逐跳请求头由传输层管理，不能由小程序设置。Web Host 使用浏览器 Fetch，无法发送显式 `Cookie` 等浏览器禁止的头，会返回 `REQUEST_UNSUPPORTED`；需要第三方 Cookie 会话时请在支持原始请求头的 Mobile/PC Host 验收。
 - 新 PC 不支持振动、分享菜单和截图分享；`navigation.openAppPage` 仅支持 `game_detail`，用户/帖子详情会明确失败。调用平台相关能力时应处理 `METHOD_FORBIDDEN` 或 `REQUEST_UNSUPPORTED`。
 - picker 必须来自可信用户手势；取消选择返回 `FILE_PICKER_CANCELLED`。`saveFile()` 只接受 `suggestedName`，不接受 `accept`。
 - `pickFiles()` / `pickDirectory()` 默认只读；`pickFiles()` 仅在显式传入 `multiple: true` 时允许 Host 返回多个文件。要写入或作为下载目标时显式请求 `mode: 'readwrite'`。
@@ -355,7 +355,7 @@ hb-sdk remote deploy --release-note "本次更新说明"
 
 右上角的桌面图标与二维码按钮使用相同样式。点击桌面图标后选择小黑盒正式版或 Debug 版，选择会立即请求客户端打开当前本地页面并在本地记忆，不需要二次确认。桌面端只接受无凭据的 `http://127.0.0.1:<port>`，拒绝 `localhost`、IPv6 和 LAN 地址，不提供地址选择或手工 URL；手机二维码继续独立选择局域网地址。入口仅在项目已绑定且本地调试启动票有效时可用，统一 URI 只携带 `mini_program_id` 和 `mini_url`，启动票继续由 detail 从同源 `launch.json` 发现并交给后端验证。浏览器无法确认客户端是否真正打开，因此调试台只记录“已请求打开”，不会自动切换正式版或 Debug 版。
 
-浏览器调试入口不要求 CLI 登录或项目绑定；需要账号或远端配置的能力会按当前可用上下文返回结果或明确失败。调试台不提供权限修改入口，远端权限快照始终是 Runtime 的规范输入。手机验收统一从右上角二维码入口进入，选择手机可达的局域网网卡后扫码；二维码使用 `open_inapp` 与 `heybox://` `openWindow` 包装的短链。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
+浏览器调试入口不要求 CLI 登录或项目绑定；需要账号或远端配置的能力会按当前可用上下文返回结果或明确失败。调试台不提供权限修改入口，远端权限快照始终是 Runtime 的规范输入。手机 Dev Session 只使用当前版本声明与平台批准结果求交后的有效权限；两者均允许 `useOfficialDomain: true` 时会保留官方域名权限，浏览器端不能本地覆盖。手机验收统一从右上角二维码入口进入，选择手机可达的局域网网卡后扫码；二维码使用 `open_inapp` 与 `heybox://` `openWindow` 包装的短链。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
 
 远端提交前需要完成 CLI 登录和小程序绑定。完整的登录、绑定、预览、版本与发布流程见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)。
 

package/dist/cli-chunks/{build-B0X9pazW.cjs → build-BYWPo2MY.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DWSscWBT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Bvggu6mn.cjs');
 require('node:crypto');
 require('node:zlib');
 var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
-var index = require('./index-CDwwaNvP.cjs');
-var projectVite = require('./project-vite-CE7kyqxl.cjs');
-require('./version-D19lZmYN.cjs');
+var index = require('./index-Bc4AXYHM.cjs');
+var projectVite = require('./project-vite--h2M6eBb.cjs');
+require('./version-CccOA4so.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-DVfWZ6d1.cjs → context-B4tBsR6l.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-DWSscWBT.cjs');
-var session = require('./session-DZXRQ4Dp.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Bvggu6mn.cjs');
+var session = require('./session-5fnHlEGO.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
@@ -32,6 +32,14 @@ function createBrowserDevPermissionState(context) {
 function createBrowserDevRuntimePermissions(snapshot, state) {
     return createDevRuntimePermissions(snapshot, state, state.networkRequest.useOfficialDomain);
 }
+/** Mobile Dev Session 只接受线上远端权限快照，不读取 Browser 本地权限状态。 */
+function createMobileDevSessionRuntimePermissions(context) {
+    if (context.source !== 'remote') {
+        return { schema_version: 1, entries: [] };
+    }
+    const state = createBrowserDevPermissionState(context);
+    return createDevRuntimePermissions(context.runtimePermissions, state, state.networkRequest.useOfficialDomain);
+}
 function cloneDefaultPermissionState() {
     return {
         networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
@@ -388,6 +396,7 @@ exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
 exports.createBrowserDevPermissionState = createBrowserDevPermissionState;
 exports.createBrowserDevRuntimePermissions = createBrowserDevRuntimePermissions;
 exports.createLocalDevLaunchToken = createLocalDevLaunchToken;
+exports.createMobileDevSessionRuntimePermissions = createMobileDevSessionRuntimePermissions;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;

package/dist/cli-chunks/{create-CyQWVxCA.cjs → create-Dct-INxs.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CDwwaNvP.cjs');
+var index = require('./index-Bc4AXYHM.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-DP7WtQOo.cjs → dev-6N5ruKiC.cjs}

@@ -8,17 +8,17 @@ var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
 var node_module = require('node:module');
-var context = require('./context-DVfWZ6d1.cjs');
-var runtimePermissionEnv = require('./runtime-permission-env-DWSscWBT.cjs');
+var context = require('./context-B4tBsR6l.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Bvggu6mn.cjs');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-CDwwaNvP.cjs');
+var index = require('./index-Bc4AXYHM.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-DZXRQ4Dp.cjs');
+var session = require('./session-5fnHlEGO.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-CE7kyqxl.cjs');
-var version = require('./version-D19lZmYN.cjs');
+var projectVite = require('./project-vite--h2M6eBb.cjs');
+var version = require('./version-CccOA4so.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -623,10 +623,100 @@ function readErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 
+const PATHNAME_MAX_DECODE_ROUNDS = 4;
+const OFFICIAL_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
+const DENIED_REQUEST_HEADERS = new Set([
+    'connection',
+    'content-length',
+    'host',
+    'keep-alive',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+/** 任意 origin 都不得通过公开 network.request 访问的 Runtime 私有路径。 */
+const PUBLIC_NETWORK_PROTECTED_PATH_PREFIXES = ['/user_miniprogram/runtime/auth', '/user_miniprogram/openapi/v1'];
+/** 官方 origin 上会签发、恢复或校验账号 credential 的私有路径。 */
+const PUBLIC_NETWORK_OFFICIAL_ACCOUNT_SENSITIVE_PATH_PREFIXES = [
+    '/account/restore_login',
+    '/account/check_login',
+    '/account/login',
+    '/account/get_login_code',
+    '/account/login_code',
+    '/account/get_qrcode_url',
+    '/account/qr_state',
+    '/account/google_2fa_verify',
+    '/account/open/login',
+    '/account/captcha',
+    '/account/get_verify_code',
+    '/account/send_verify_code',
+    '/account/verify_code',
+];
+/** 判断公开网络能力是否命中 Runtime 或官方账号敏感路径。 */
+function isProtectedMiniProgramNetworkPath(pathname, official) {
+    const normalized = normalizePublicNetworkPathname(pathname);
+    if (normalized === null)
+        return true;
+    if (matchesPathPrefix(normalized, PUBLIC_NETWORK_PROTECTED_PATH_PREFIXES))
+        return true;
+    return official && matchesPathPrefix(normalized, PUBLIC_NETWORK_OFFICIAL_ACCOUNT_SENSITIVE_PATH_PREFIXES);
+}
+/** 使用 Runtime 唯一的官方域名分类规则判断请求目标。 */
+function isOfficialMiniProgramNetworkUrl(url) {
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+    return OFFICIAL_ROOT_DOMAINS.some((rootDomain) => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+}
+/** 判断公开网络能力是否禁止调用方设置该请求头。 */
+function isForbiddenMiniProgramNetworkRequestHeader(name) {
+    const normalized = name.trim().toLowerCase();
+    return DENIED_REQUEST_HEADERS.has(normalized) || /^(?:x-heybox|x-xhh)-(?:access-token|auth|authorization|pkey|session|token)$/.test(normalized);
+}
+function normalizePublicNetworkPathname(pathname) {
+    let decoded = pathname;
+    for (let round = 0; round < PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return null;
+        }
+        if (next === decoded)
+            return normalizeDecodedPathname(decoded);
+        decoded = next;
+    }
+    try {
+        if (decodeURIComponent(decoded) !== decoded)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return normalizeDecodedPathname(decoded);
+}
+function matchesPathPrefix(pathname, prefixes) {
+    return prefixes.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+function normalizeDecodedPathname(pathname) {
+    const segments = [];
+    for (const segment of pathname.replace(/\\/g, '/').split('/')) {
+        if (!segment || segment === '.')
+            continue;
+        if (segment === '..')
+            segments.pop();
+        else
+            segments.push(segment);
+    }
+    return `/${segments.join('/')}`;
+}
+
 const MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY = 2 * 1024 * 1024;
 const MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY = 5 * 1024 * 1024;
 const DENIED_NETWORK_TARGETS = createDeniedNetworkTargets();
-const CREDENTIAL_HEADER_RE$1 = /^(?:authentication-info|authorization|cookie|cookie2|proxy-authenticate|proxy-authentication-info|proxy-authorization|set-cookie|set-cookie2|www-authenticate|pkey|x-pkey|x-access-token|x-auth-token|x-api-key)$/i;
+const CREDENTIAL_RESPONSE_HEADER_RE = /^(?:authentication-info|authorization|cookie|cookie2|proxy-authenticate|proxy-authentication-info|proxy-authorization|set-cookie|set-cookie2|www-authenticate|pkey|x-pkey|x-access-token|x-auth-token|x-api-key)$/i;
+const HOST_CONTROLLED_REQUEST_HEADERS = new Set(['origin', 'referer', 'user-agent']);
 async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lookupHostname, options) {
     const cors = options.cors === true;
     if (request.method === 'OPTIONS') {
@@ -645,7 +735,7 @@ async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lo
         payload = await readJsonRequestBody(request);
         const requestAbort = createBrowserDevHostRequestAbortScope(request, response);
         try {
-            const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal);
+            const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal, options.permission);
             if (typeof result.status === 'number' && (result.status < 200 || result.status >= 300)) {
                 logBrowserDevHostNetworkProxyDiagnostic('http_status', payload, result);
             }
@@ -701,11 +791,12 @@ function writeNetworkJsonResponse(response, status, body, cors) {
     writeJsonResponse(response, status, body);
 }
 const BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
-async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal) {
+async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal, permission) {
     if (!isRecord$2(payload) || typeof payload.url !== 'string' || !payload.url.trim()) {
         throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是非空字符串');
     }
     const url = createBrowserDevHostNetworkUrl(payload.url, payload.params);
+    assertMiniProgramNetworkPolicy(url, permission);
     const method = typeof payload.method === 'string' && payload.method.trim() ? payload.method.trim().toUpperCase() : 'GET';
     const headers = normalizeBrowserDevHostNetworkHeaders(payload.headers);
     assertSupportedBrowserDevHostNetworkRequestShape(headers, payload.data);
@@ -738,7 +829,7 @@ async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname,
             data: contentType.includes('application/json') ? safeJsonParse(text) : text,
             status: response.status,
             statusText: response.statusText,
-            headers: Object.fromEntries([...response.headers.entries()].filter(([name]) => !isCredentialHeader$1(name))),
+            headers: Object.fromEntries([...response.headers.entries()].filter(([name]) => !isCredentialResponseHeader(name))),
         };
     }
     catch (error) {
@@ -833,9 +924,9 @@ function isDeniedNetworkAddress(address, family) {
     }
     return true;
 }
-function isCredentialHeader$1(name) {
+function isCredentialResponseHeader(name) {
     const normalized = name.trim().toLowerCase();
-    return CREDENTIAL_HEADER_RE$1.test(normalized) || normalized.startsWith('x-heybox-') || normalized.startsWith('x-xhh-');
+    return CREDENTIAL_RESPONSE_HEADER_RE.test(normalized) || normalized.startsWith('x-heybox-') || normalized.startsWith('x-xhh-');
 }
 function createPinnedNetworkDispatcher(pinnedTargets) {
     const connect = undici.buildConnector({});
@@ -908,31 +999,29 @@ function normalizeBrowserDevHostNetworkHeaders(headers) {
         return normalized;
     }
     Object.entries(headers).forEach(([key, value]) => {
-        if (isSensitiveBrowserDevHostNetworkHeader(key)) {
+        if (isForbiddenMiniProgramNetworkRequestHeader(key)) {
             throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', `network.request 不允许设置敏感请求头: ${key}`);
         }
-        if (typeof value === 'string' && !isBlockedBrowserDevHostNetworkHeader(key)) {
+        if (typeof value === 'string' && !isHostManagedRequestHeader(key)) {
             normalized.set(key, value);
         }
     });
     return normalized;
 }
-function isSensitiveBrowserDevHostNetworkHeader(key) {
-    return ['authorization', 'cookie', 'proxy-authorization'].includes(key.toLowerCase());
+function isHostManagedRequestHeader(name) {
+    const normalized = name.trim().toLowerCase();
+    return HOST_CONTROLLED_REQUEST_HEADERS.has(normalized);
 }
-function isBlockedBrowserDevHostNetworkHeader(key) {
-    return [
-        'connection',
-        'content-length',
-        'host',
-        'keep-alive',
-        'proxy-authenticate',
-        'proxy-authorization',
-        'te',
-        'trailer',
-        'transfer-encoding',
-        'upgrade',
-    ].includes(key.toLowerCase());
+function assertMiniProgramNetworkPolicy(url, permission) {
+    if (!permission)
+        return;
+    const official = isOfficialMiniProgramNetworkUrl(url);
+    if (official && !permission.useOfficialDomain) {
+        throw createBrowserDevHostError(403, 'PERMISSION_DENIED', '当前小程序暂不支持访问官方域名');
+    }
+    if (isProtectedMiniProgramNetworkPath(url.pathname, official)) {
+        throw createBrowserDevHostError(403, 'PERMISSION_DENIED', 'network.request 不允许访问 Runtime 或账号敏感接口');
+    }
 }
 /**
  * 与 App Host 对齐：Mock 不再放行 multipart，避免“本地成功、上线失败”。
@@ -1071,7 +1160,8 @@ function createDevSessionRoutes(options) {
             }
             try {
                 const payload = await readJsonRequestBody(request);
-                const validated = validateDevSessionCreatePayload(payload, options.allowedMiniUrlOrigins);
+                const runtimePermissions = context.createMobileDevSessionRuntimePermissions(await options.readDevContext());
+                const validated = validateDevSessionCreatePayload(payload, options.allowedMiniUrlOrigins, runtimePermissions);
                 reapExpiredDevSessions(devSessions, expiredDevSessions, options.now());
                 const replacedTokens = findDevSessionTokensForOrigin(devSessions, validated.miniUrlOrigin);
                 if (devSessions.size - replacedTokens.length >= MAX_ACTIVE_DEV_SESSIONS) {
@@ -1090,6 +1180,7 @@ function createDevSessionRoutes(options) {
                     expiresAt,
                     miniUrlOrigin: validated.miniUrlOrigin,
                     networkRequestEnabled: validated.networkRequestEnabled,
+                    useOfficialDomain: validated.useOfficialDomain,
                     serialized: JSON.stringify(snapshot),
                 });
                 try {
@@ -1138,7 +1229,7 @@ function createDevSessionRoutes(options) {
         },
     };
 }
-function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
+function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins, runtimePermissions) {
     if (!isRecord$2(payload) || Object.keys(payload).some((key) => !['mini_url_origin', 'runtime_permissions'].includes(key))) {
         throw new TypeError('Dev Session body is invalid');
     }
@@ -1158,18 +1249,16 @@ function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
         !allowedMiniUrlOrigins.has(miniUrlOrigin.origin)) {
         throw new TypeError('mini_url_origin must be an allowed LAN origin');
     }
-    const parsedPermissions = runtimePermissionEnv.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
+    const parsedPermissions = runtimePermissionEnv.parseMiniProgramRuntimePermissions(runtimePermissions);
     if (!parsedPermissions.valid) {
         throw new TypeError('runtime_permissions is invalid');
     }
     const networkPermission = parsedPermissions.permissions.network;
-    if (networkPermission?.config.useOfficialDomain !== false) {
-        throw new TypeError('Dev Session does not allow official domains');
-    }
     return {
         miniUrlOrigin: miniUrlOrigin.origin,
-        networkRequestEnabled: networkPermission.status === 'enabled',
-        runtimePermissions: JSON.parse(JSON.stringify(payload.runtime_permissions)),
+        networkRequestEnabled: networkPermission?.status === 'enabled',
+        useOfficialDomain: networkPermission?.status === 'enabled' && networkPermission.config.useOfficialDomain === true,
+        runtimePermissions: JSON.parse(JSON.stringify(runtimePermissions)),
     };
 }
 async function handleTokenNetworkProxy(request, response, token, runtime) {
@@ -1199,6 +1288,7 @@ async function handleTokenNetworkProxy(request, response, token, runtime) {
     await handleBrowserDevHostNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, {
         allowedHttpOrigins: new Set([resolved.session.miniUrlOrigin]),
         cors: true,
+        permission: { useOfficialDomain: resolved.session.useOfficialDomain },
     });
 }
 function resolveDevSession(token, devSessions, expiredDevSessions, now) {
@@ -1860,8 +1950,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DP7WtQOo.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-DP7WtQOo.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-6N5ruKiC.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-6N5ruKiC.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -1916,6 +2006,8 @@ async function startBrowserDevHostServer(options) {
         loginAvailable: options.loginService !== undefined,
         cliAuth: options.cliAuth,
         readDevContext: () => bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions },
+        readMobileDevSessionContext: options.readMobileDevSessionContext ??
+            (() => Promise.resolve(bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions })),
         readLanAddresses: () => bootstrap.lanAddresses,
         mobileLaunchRedirectRegistry,
         onMobileDevSessionCreated: options.onMobileDevSessionCreated,
@@ -2085,6 +2177,7 @@ function createBrowserDevHostServer(root, runtime) {
         fetchImpl: runtime.fetchImpl,
         lookupHostname: runtime.lookupHostname,
         now: runtime.now,
+        readDevContext: runtime.readMobileDevSessionContext,
         onCreated: ({ expiresAt, miniUrlOrigin, token }, request) => {
             const origin = new URL(readRequestOrigin(request));
             const hostname = origin.hostname.startsWith('[') && origin.hostname.endsWith(']') ? origin.hostname.slice(1, -1) : origin.hostname;
@@ -10952,7 +11045,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-B8pX0BrZ.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-DhXN7XjE.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15072,6 +15165,7 @@ async function runDevCommand(options, runtime = {}) {
         projectRoot,
         timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
     });
+    let currentDevContext = devLaunchContext;
     let launchRuntimePermissions = context.createBrowserDevRuntimePermissions(devLaunchContext.runtimePermissions, context.createBrowserDevPermissionState(devLaunchContext));
     const mobileDevContextUrlsByOrigin = new Map();
     let currentCompanionManifestSha256;
@@ -15142,7 +15236,7 @@ async function runDevCommand(options, runtime = {}) {
     try {
         browserDevHost = await runDevStartupTask(logger, '正在启动浏览器调试页服务', () => startBrowserDevHostServer({
             appUrl,
-            devContext: devLaunchContext,
+            devContext: currentDevContext,
             fetchImpl,
             getPort: getPortImpl,
             defaultLanAddressId: lanAddresses[0]?.id,
@@ -15157,6 +15251,30 @@ async function runDevCommand(options, runtime = {}) {
                     lanAddresses: buildLanAddresses(),
                 });
             },
+            readMobileDevSessionContext: async () => {
+                try {
+                    const refreshed = await loadDevLaunchContext({
+                        env: runtime.env,
+                        fetchImpl,
+                        logger,
+                        projectRoot,
+                        timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
+                    });
+                    currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
+                    launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(currentDevContext);
+                    browserDevHost.updateBootstrap({
+                        devContext: currentDevContext,
+                        miniProgram: refreshed.miniProgram,
+                    });
+                    return currentDevContext;
+                }
+                catch (error) {
+                    currentDevContext = { source: 'anonymous' };
+                    launchRuntimePermissions = { schema_version: 1, entries: [] };
+                    browserDevHost.updateBootstrap({ devContext: currentDevContext });
+                    throw error;
+                }
+            },
             port: options.browserDevHostPort ?? DEFAULT_BROWSER_DEV_HOST_PORT,
             root: runtime.browserDevHostRoot,
             rootCandidates: runtime.browserDevHostRootCandidates,
@@ -15183,22 +15301,18 @@ async function runDevCommand(options, runtime = {}) {
                 if (refreshed.context.miniProgramId !== devLaunchContext.miniProgramId)
                     throw new Error('项目绑定已变更，请重新启动调试');
                 devLaunchContext.runtimePermissions = refreshed.context.runtimePermissions;
+                currentDevContext = withCurrentLocalDevLaunchToken(devLaunchContext, currentLocalDevLaunchToken);
                 launchRuntimePermissions = context.createBrowserDevRuntimePermissions(devLaunchContext.runtimePermissions, context.createBrowserDevPermissionState(devLaunchContext));
-                browserDevHost.updateBootstrap({ devContext: { ...devLaunchContext, localDevLaunchToken: currentLocalDevLaunchToken } });
+                browserDevHost.updateBootstrap({ devContext: currentDevContext });
                 return hasCompanionApproval(devLaunchContext.runtimePermissions);
             },
             onToken: (localDevLaunchToken, companionManifestSha256, expiresAt) => {
                 currentExpiresAt = expiresAt;
                 currentCompanionManifestSha256 = companionManifestSha256;
                 currentLocalDevLaunchToken = localDevLaunchToken;
-                const tokenContext = {
-                    source: 'remote',
-                    miniProgramId: devLaunchContext.miniProgramId,
-                    ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
-                    runtimePermissions: devLaunchContext.runtimePermissions,
-                };
+                currentDevContext = withCurrentLocalDevLaunchToken(currentDevContext, localDevLaunchToken);
                 browserDevHost.updateBootstrap({
-                    devContext: tokenContext,
+                    devContext: currentDevContext,
                     lanAddresses: buildLanAddresses(),
                 });
             },
@@ -15228,6 +15342,15 @@ async function runDevCommand(options, runtime = {}) {
     }
     installShutdownHandlers(closers, runtime.process ?? process);
 }
+function withCurrentLocalDevLaunchToken(context, localDevLaunchToken) {
+    return {
+        source: context.source,
+        ...(context.miniProgramId ? { miniProgramId: context.miniProgramId } : {}),
+        ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
+        ...(context.runtimePermissions !== undefined ? { runtimePermissions: context.runtimePermissions } : {}),
+        ...(context.warning ? { warning: context.warning } : {}),
+    };
+}
 function runDevStartupTask(logger, text, action, successText) {
     if (!logger.verbose) {
         return action();

package/dist/cli-chunks/{doctor-D6l-ONq-.cjs → doctor-9HtdddBL.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CDwwaNvP.cjs');
+var index = require('./index-Bc4AXYHM.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-CDwwaNvP.cjs → index-Bc4AXYHM.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CDwwaNvP.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bc4AXYHM.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CDwwaNvP.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bc4AXYHM.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CDwwaNvP.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bc4AXYHM.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CDwwaNvP.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bc4AXYHM.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CDwwaNvP.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bc4AXYHM.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13424,7 +13424,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.8.1-alpha.6';
+const BUILT_CLI_VERSION = '0.8.1-alpha.8';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13773,39 +13773,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-Dt-FHzpL.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CTZgu8Q-.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-Dt-FHzpL.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CTZgu8Q-.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-Dt-FHzpL.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CTZgu8Q-.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-B0X9pazW.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-BYWPo2MY.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CyQWVxCA.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-Dct-INxs.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-DP7WtQOo.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-6N5ruKiC.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-D6l-ONq-.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-9HtdddBL.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-B8GWL2KT.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DrFEqmdD.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-Be6PeR-n.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-0hw42fDG.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-DvOPzPxS.cjs → index-Cl5cfUqJ.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-CDwwaNvP.cjs');
+var index$2 = require('./index-Bc4AXYHM.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-DWSscWBT.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-Bvggu6mn.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');