@heybox/hb-sdk 0.8.1-alpha.7 → 0.8.1-alpha.9

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。内部集成、实现策略和审查证据不在此维护。
 
+## 0.8.1-alpha.9
+
+- `hb-sdk dev` 浏览器调试台（Browser Dev Host）现在按当前 SDK 实际版本校验握手；开发者需升级 `@heybox/hb-sdk` 到 0.8.1-alpha.9 或更高版本后再进行本地调试，旧版本 SDK 页面会被拒绝启动。
+
+## 0.8.1-alpha.8
+
+- 手机 Dev Session 仅使用当前版本声明与平台批准结果求交后的有效权限；两者均允许 `useOfficialDomain: true` 时，真机扫码调试可访问官方域名，本地调试状态不能扩大该权限。
+- 创建手机调试会话前会刷新远端批准结果；读取失败时拒绝签发新会话，已创建会话仍按短期有效期自动失效。
+- 保持升级或回滚 CLI 时的新旧调试页兼容，并继续拒绝官方账号敏感路径、敏感请求头和自动重定向。
+
 ## 0.8.1-alpha.7
 
 - `network.request` 已标记为废弃，但仍可调用，目前没有替代接口。请移除 `withCredentials`；旧版 SDK 的 wire 字段由 Runtime 兼容忽略。Mobile 对官方 HTTPS 默认端口目标自动携带 Native Cookie，第三方不自动携带。需要第三方会话时可显式提供应用 `Cookie` 或 `Authorization`；Web Host 受浏览器 Fetch 限制，不支持显式 `Cookie`。`Origin`、`Referer`、`User-Agent` 由 Host 管理，路由/分帧/逐跳请求头不能由小程序设置。
@@ -34,7 +44,6 @@
 
 - 目标平台声明统一迁移到 `package.json#heybox.platforms`；`miniappManifest()` 恢复无参调用，并在构建时将该声明写入 `dist/manifest.json`。
 - `hb-sdk dev`、`hb-sdk build` 和普通 `hb-sdk remote deploy` 会拒绝缺失或非法的平台声明；build/deploy 也会拒绝与项目配置不一致的 Manifest。已有项目升级时需把原 Vite 参数中的 `platforms` 移入 `package.json#heybox`。
-
 ## 0.8.1-alpha.2
 
 - 新增 `environment.getInfo()` 与 `environment.getInfoSync()`，用于读取运行模式、小黑盒 App 版本、canonical 小程序 ID/版本、操作系统和 SDK 版本的冻结快照。

package/README.md

@@ -355,7 +355,7 @@ hb-sdk remote deploy --release-note "本次更新说明"
 
 右上角的桌面图标与二维码按钮使用相同样式。点击桌面图标后选择小黑盒正式版或 Debug 版，选择会立即请求客户端打开当前本地页面并在本地记忆，不需要二次确认。桌面端只接受无凭据的 `http://127.0.0.1:<port>`，拒绝 `localhost`、IPv6 和 LAN 地址，不提供地址选择或手工 URL；手机二维码继续独立选择局域网地址。入口仅在项目已绑定且本地调试启动票有效时可用，统一 URI 只携带 `mini_program_id` 和 `mini_url`，启动票继续由 detail 从同源 `launch.json` 发现并交给后端验证。浏览器无法确认客户端是否真正打开，因此调试台只记录“已请求打开”，不会自动切换正式版或 Debug 版。
 
-浏览器调试入口不要求 CLI 登录或项目绑定；需要账号或远端配置的能力会按当前可用上下文返回结果或明确失败。调试台不提供权限修改入口，远端权限快照始终是 Runtime 的规范输入。手机验收统一从右上角二维码入口进入，选择手机可达的局域网网卡后扫码；二维码使用 `open_inapp` 与 `heybox://` `openWindow` 包装的短链。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
+浏览器调试入口不要求 CLI 登录或项目绑定；需要账号或远端配置的能力会按当前可用上下文返回结果或明确失败。调试台不提供权限修改入口，远端权限快照始终是 Runtime 的规范输入。手机 Dev Session 只使用当前版本声明与平台批准结果求交后的有效权限；两者均允许 `useOfficialDomain: true` 时会保留官方域名权限，浏览器端不能本地覆盖。手机验收统一从右上角二维码入口进入，选择手机可达的局域网网卡后扫码；二维码使用 `open_inapp` 与 `heybox://` `openWindow` 包装的短链。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
 
 远端提交前需要完成 CLI 登录和小程序绑定。完整的登录、绑定、预览、版本与发布流程见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)。
 

package/dist/cli-chunks/{build-C8oN_Ms9.cjs → build-D8eh0bxZ.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-BN43V7d0.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-g_2W-HqP.cjs');
 require('node:crypto');
 require('node:zlib');
 var runtimeGate = require('./runtime-gate-BWb8QIcX.cjs');
-var index = require('./index-zNpZDWhc.cjs');
-var projectVite = require('./project-vite-couFw5bL.cjs');
-require('./version-DbDVL6vm.cjs');
+var index = require('./index-B2eLzOSD.cjs');
+var projectVite = require('./project-vite-C-r7_UvY.cjs');
+require('./version-Dox07wdq.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-DZkqvg9S.cjs → context-JfGWhXSD.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-BN43V7d0.cjs');
-var session = require('./session-C1R_39si.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-g_2W-HqP.cjs');
+var session = require('./session-CaNwlovY.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
@@ -32,6 +32,14 @@ function createBrowserDevPermissionState(context) {
 function createBrowserDevRuntimePermissions(snapshot, state) {
     return createDevRuntimePermissions(snapshot, state, state.networkRequest.useOfficialDomain);
 }
+/** Mobile Dev Session 只接受线上远端权限快照，不读取 Browser 本地权限状态。 */
+function createMobileDevSessionRuntimePermissions(context) {
+    if (context.source !== 'remote') {
+        return { schema_version: 1, entries: [] };
+    }
+    const state = createBrowserDevPermissionState(context);
+    return createDevRuntimePermissions(context.runtimePermissions, state, state.networkRequest.useOfficialDomain);
+}
 function cloneDefaultPermissionState() {
     return {
         networkRequest: { ...DEFAULT_PERMISSION_STATE.networkRequest },
@@ -388,6 +396,7 @@ exports.MiniProgramProjectBindingError = MiniProgramProjectBindingError;
 exports.createBrowserDevPermissionState = createBrowserDevPermissionState;
 exports.createBrowserDevRuntimePermissions = createBrowserDevRuntimePermissions;
 exports.createLocalDevLaunchToken = createLocalDevLaunchToken;
+exports.createMobileDevSessionRuntimePermissions = createMobileDevSessionRuntimePermissions;
 exports.createRemoteApiClientForEnvironment = createRemoteApiClientForEnvironment;
 exports.getBoundMiniProgram = getBoundMiniProgram;
 exports.readBoundMiniProgramId = readBoundMiniProgramId;

package/dist/cli-chunks/{create-CToSHRfO.cjs → create-BiqK-4fa.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-zNpZDWhc.cjs');
+var index = require('./index-B2eLzOSD.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CTA0lsLD.cjs → dev-u27Q6a-K.cjs}

@@ -8,17 +8,17 @@ var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
 var node_module = require('node:module');
-var context = require('./context-DZkqvg9S.cjs');
-var runtimePermissionEnv = require('./runtime-permission-env-BN43V7d0.cjs');
+var context = require('./context-JfGWhXSD.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-g_2W-HqP.cjs');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-zNpZDWhc.cjs');
+var index = require('./index-B2eLzOSD.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-C1R_39si.cjs');
+var session = require('./session-CaNwlovY.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-couFw5bL.cjs');
-var version = require('./version-DbDVL6vm.cjs');
+var projectVite = require('./project-vite-C-r7_UvY.cjs');
+var version = require('./version-Dox07wdq.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -623,15 +623,100 @@ function readErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 
+const PATHNAME_MAX_DECODE_ROUNDS = 4;
+const OFFICIAL_ROOT_DOMAINS = ['xiaoheihe.cn', 'max-c.com', 'debugmode.cn', 'maxjia.com'];
+const DENIED_REQUEST_HEADERS = new Set([
+    'connection',
+    'content-length',
+    'host',
+    'keep-alive',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+/** 任意 origin 都不得通过公开 network.request 访问的 Runtime 私有路径。 */
+const PUBLIC_NETWORK_PROTECTED_PATH_PREFIXES = ['/user_miniprogram/runtime/auth', '/user_miniprogram/openapi/v1'];
+/** 官方 origin 上会签发、恢复或校验账号 credential 的私有路径。 */
+const PUBLIC_NETWORK_OFFICIAL_ACCOUNT_SENSITIVE_PATH_PREFIXES = [
+    '/account/restore_login',
+    '/account/check_login',
+    '/account/login',
+    '/account/get_login_code',
+    '/account/login_code',
+    '/account/get_qrcode_url',
+    '/account/qr_state',
+    '/account/google_2fa_verify',
+    '/account/open/login',
+    '/account/captcha',
+    '/account/get_verify_code',
+    '/account/send_verify_code',
+    '/account/verify_code',
+];
+/** 判断公开网络能力是否命中 Runtime 或官方账号敏感路径。 */
+function isProtectedMiniProgramNetworkPath(pathname, official) {
+    const normalized = normalizePublicNetworkPathname(pathname);
+    if (normalized === null)
+        return true;
+    if (matchesPathPrefix(normalized, PUBLIC_NETWORK_PROTECTED_PATH_PREFIXES))
+        return true;
+    return official && matchesPathPrefix(normalized, PUBLIC_NETWORK_OFFICIAL_ACCOUNT_SENSITIVE_PATH_PREFIXES);
+}
+/** 使用 Runtime 唯一的官方域名分类规则判断请求目标。 */
+function isOfficialMiniProgramNetworkUrl(url) {
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+    return OFFICIAL_ROOT_DOMAINS.some((rootDomain) => hostname === rootDomain || hostname.endsWith(`.${rootDomain}`));
+}
+/** 判断公开网络能力是否禁止调用方设置该请求头。 */
+function isForbiddenMiniProgramNetworkRequestHeader(name) {
+    const normalized = name.trim().toLowerCase();
+    return DENIED_REQUEST_HEADERS.has(normalized) || /^(?:x-heybox|x-xhh)-(?:access-token|auth|authorization|pkey|session|token)$/.test(normalized);
+}
+function normalizePublicNetworkPathname(pathname) {
+    let decoded = pathname;
+    for (let round = 0; round < PATHNAME_MAX_DECODE_ROUNDS; round += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return null;
+        }
+        if (next === decoded)
+            return normalizeDecodedPathname(decoded);
+        decoded = next;
+    }
+    try {
+        if (decodeURIComponent(decoded) !== decoded)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return normalizeDecodedPathname(decoded);
+}
+function matchesPathPrefix(pathname, prefixes) {
+    return prefixes.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+function normalizeDecodedPathname(pathname) {
+    const segments = [];
+    for (const segment of pathname.replace(/\\/g, '/').split('/')) {
+        if (!segment || segment === '.')
+            continue;
+        if (segment === '..')
+            segments.pop();
+        else
+            segments.push(segment);
+    }
+    return `/${segments.join('/')}`;
+}
+
 const MAX_BROWSER_DEV_HOST_NETWORK_REQUEST_BODY = 2 * 1024 * 1024;
 const MAX_BROWSER_DEV_HOST_NETWORK_RESPONSE_BODY = 5 * 1024 * 1024;
 const DENIED_NETWORK_TARGETS = createDeniedNetworkTargets();
 const CREDENTIAL_RESPONSE_HEADER_RE = /^(?:authentication-info|authorization|cookie|cookie2|proxy-authenticate|proxy-authentication-info|proxy-authorization|set-cookie|set-cookie2|www-authenticate|pkey|x-pkey|x-access-token|x-auth-token|x-api-key)$/i;
 const HOST_CONTROLLED_REQUEST_HEADERS = new Set(['origin', 'referer', 'user-agent']);
-const TRANSPORT_CONTROLLED_REQUEST_HEADERS = new Set([
-    'connection', 'content-length', 'host', 'keep-alive', 'proxy-connection',
-    'te', 'trailer', 'transfer-encoding', 'upgrade',
-]);
 async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lookupHostname, options) {
     const cors = options.cors === true;
     if (request.method === 'OPTIONS') {
@@ -650,7 +735,7 @@ async function handleBrowserDevHostNetworkProxy(request, response, fetchImpl, lo
         payload = await readJsonRequestBody(request);
         const requestAbort = createBrowserDevHostRequestAbortScope(request, response);
         try {
-            const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal);
+            const result = await requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, options.allowedHttpOrigins, requestAbort.signal, options.permission);
             if (typeof result.status === 'number' && (result.status < 200 || result.status >= 300)) {
                 logBrowserDevHostNetworkProxyDiagnostic('http_status', payload, result);
             }
@@ -706,11 +791,12 @@ function writeNetworkJsonResponse(response, status, body, cors) {
     writeJsonResponse(response, status, body);
 }
 const BROWSER_DEV_HOST_NETWORK_MULTIPART_UNSUPPORTED_MESSAGE = 'network.request 不支持 multipart/form-data。App Host 客户端代发仅支持 application/x-www-form-urlencoded（form）与 application/json；请将 data 编码为 form 字符串（例如 new URLSearchParams({...}).toString()）并设置 Content-Type: application/x-www-form-urlencoded。文件上传请使用专用上传能力，勿手写 multipart boundary。';
-async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal) {
+async function requestBrowserDevHostNetwork(payload, fetchImpl, lookupHostname, allowedHttpOrigins, requestSignal, permission) {
     if (!isRecord$2(payload) || typeof payload.url !== 'string' || !payload.url.trim()) {
         throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', 'network.request url 必须是非空字符串');
     }
     const url = createBrowserDevHostNetworkUrl(payload.url, payload.params);
+    assertMiniProgramNetworkPolicy(url, permission);
     const method = typeof payload.method === 'string' && payload.method.trim() ? payload.method.trim().toUpperCase() : 'GET';
     const headers = normalizeBrowserDevHostNetworkHeaders(payload.headers);
     assertSupportedBrowserDevHostNetworkRequestShape(headers, payload.data);
@@ -913,8 +999,8 @@ function normalizeBrowserDevHostNetworkHeaders(headers) {
         return normalized;
     }
     Object.entries(headers).forEach(([key, value]) => {
-        if (TRANSPORT_CONTROLLED_REQUEST_HEADERS.has(key.trim().toLowerCase())) {
-            throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', `network.request 请求头由 Host 传输层管理: ${key}`);
+        if (isForbiddenMiniProgramNetworkRequestHeader(key)) {
+            throw createBrowserDevHostError(400, 'INVALID_NETWORK_REQUEST', `network.request 不允许设置敏感请求头: ${key}`);
         }
         if (typeof value === 'string' && !isHostManagedRequestHeader(key)) {
             normalized.set(key, value);
@@ -926,6 +1012,17 @@ function isHostManagedRequestHeader(name) {
     const normalized = name.trim().toLowerCase();
     return HOST_CONTROLLED_REQUEST_HEADERS.has(normalized);
 }
+function assertMiniProgramNetworkPolicy(url, permission) {
+    if (!permission)
+        return;
+    const official = isOfficialMiniProgramNetworkUrl(url);
+    if (official && !permission.useOfficialDomain) {
+        throw createBrowserDevHostError(403, 'PERMISSION_DENIED', '当前小程序暂不支持访问官方域名');
+    }
+    if (isProtectedMiniProgramNetworkPath(url.pathname, official)) {
+        throw createBrowserDevHostError(403, 'PERMISSION_DENIED', 'network.request 不允许访问 Runtime 或账号敏感接口');
+    }
+}
 /**
  * 与 App Host 对齐：Mock 不再放行 multipart，避免“本地成功、上线失败”。
  */
@@ -1063,7 +1160,8 @@ function createDevSessionRoutes(options) {
             }
             try {
                 const payload = await readJsonRequestBody(request);
-                const validated = validateDevSessionCreatePayload(payload, options.allowedMiniUrlOrigins);
+                const runtimePermissions = context.createMobileDevSessionRuntimePermissions(await options.readDevContext());
+                const validated = validateDevSessionCreatePayload(payload, options.allowedMiniUrlOrigins, runtimePermissions);
                 reapExpiredDevSessions(devSessions, expiredDevSessions, options.now());
                 const replacedTokens = findDevSessionTokensForOrigin(devSessions, validated.miniUrlOrigin);
                 if (devSessions.size - replacedTokens.length >= MAX_ACTIVE_DEV_SESSIONS) {
@@ -1082,6 +1180,7 @@ function createDevSessionRoutes(options) {
                     expiresAt,
                     miniUrlOrigin: validated.miniUrlOrigin,
                     networkRequestEnabled: validated.networkRequestEnabled,
+                    useOfficialDomain: validated.useOfficialDomain,
                     serialized: JSON.stringify(snapshot),
                 });
                 try {
@@ -1130,7 +1229,7 @@ function createDevSessionRoutes(options) {
         },
     };
 }
-function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
+function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins, runtimePermissions) {
     if (!isRecord$2(payload) || Object.keys(payload).some((key) => !['mini_url_origin', 'runtime_permissions'].includes(key))) {
         throw new TypeError('Dev Session body is invalid');
     }
@@ -1150,18 +1249,16 @@ function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins) {
         !allowedMiniUrlOrigins.has(miniUrlOrigin.origin)) {
         throw new TypeError('mini_url_origin must be an allowed LAN origin');
     }
-    const parsedPermissions = runtimePermissionEnv.parseMiniProgramRuntimePermissions(payload.runtime_permissions);
+    const parsedPermissions = runtimePermissionEnv.parseMiniProgramRuntimePermissions(runtimePermissions);
     if (!parsedPermissions.valid) {
         throw new TypeError('runtime_permissions is invalid');
     }
     const networkPermission = parsedPermissions.permissions.network;
-    if (networkPermission?.config.useOfficialDomain !== false) {
-        throw new TypeError('Dev Session does not allow official domains');
-    }
     return {
         miniUrlOrigin: miniUrlOrigin.origin,
-        networkRequestEnabled: networkPermission.status === 'enabled',
-        runtimePermissions: JSON.parse(JSON.stringify(payload.runtime_permissions)),
+        networkRequestEnabled: networkPermission?.status === 'enabled',
+        useOfficialDomain: networkPermission?.status === 'enabled' && networkPermission.config.useOfficialDomain === true,
+        runtimePermissions: JSON.parse(JSON.stringify(runtimePermissions)),
     };
 }
 async function handleTokenNetworkProxy(request, response, token, runtime) {
@@ -1191,6 +1288,7 @@ async function handleTokenNetworkProxy(request, response, token, runtime) {
     await handleBrowserDevHostNetworkProxy(request, response, runtime.fetchImpl, runtime.lookupHostname, {
         allowedHttpOrigins: new Set([resolved.session.miniUrlOrigin]),
         cors: true,
+        permission: { useOfficialDomain: resolved.session.useOfficialDomain },
     });
 }
 function resolveDevSession(token, devSessions, expiredDevSessions, now) {
@@ -1852,8 +1950,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CTA0lsLD.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CTA0lsLD.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-u27Q6a-K.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-u27Q6a-K.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -1908,6 +2006,8 @@ async function startBrowserDevHostServer(options) {
         loginAvailable: options.loginService !== undefined,
         cliAuth: options.cliAuth,
         readDevContext: () => bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions },
+        readMobileDevSessionContext: options.readMobileDevSessionContext ??
+            (() => Promise.resolve(bootstrap.devContext ?? { source: 'anonymous', runtimePermissions: bootstrap.runtimePermissions })),
         readLanAddresses: () => bootstrap.lanAddresses,
         mobileLaunchRedirectRegistry,
         onMobileDevSessionCreated: options.onMobileDevSessionCreated,
@@ -2077,6 +2177,7 @@ function createBrowserDevHostServer(root, runtime) {
         fetchImpl: runtime.fetchImpl,
         lookupHostname: runtime.lookupHostname,
         now: runtime.now,
+        readDevContext: runtime.readMobileDevSessionContext,
         onCreated: ({ expiresAt, miniUrlOrigin, token }, request) => {
             const origin = new URL(readRequestOrigin(request));
             const hostname = origin.hostname.startsWith('[') && origin.hostname.endsWith(']') ? origin.hostname.slice(1, -1) : origin.hostname;
@@ -10944,7 +11045,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-CGoUW47e.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-CCDqeyc7.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15064,6 +15165,7 @@ async function runDevCommand(options, runtime = {}) {
         projectRoot,
         timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
     });
+    let currentDevContext = devLaunchContext;
     let launchRuntimePermissions = context.createBrowserDevRuntimePermissions(devLaunchContext.runtimePermissions, context.createBrowserDevPermissionState(devLaunchContext));
     const mobileDevContextUrlsByOrigin = new Map();
     let currentCompanionManifestSha256;
@@ -15134,7 +15236,7 @@ async function runDevCommand(options, runtime = {}) {
     try {
         browserDevHost = await runDevStartupTask(logger, '正在启动浏览器调试页服务', () => startBrowserDevHostServer({
             appUrl,
-            devContext: devLaunchContext,
+            devContext: currentDevContext,
             fetchImpl,
             getPort: getPortImpl,
             defaultLanAddressId: lanAddresses[0]?.id,
@@ -15149,6 +15251,30 @@ async function runDevCommand(options, runtime = {}) {
                     lanAddresses: buildLanAddresses(),
                 });
             },
+            readMobileDevSessionContext: async () => {
+                try {
+                    const refreshed = await loadDevLaunchContext({
+                        env: runtime.env,
+                        fetchImpl,
+                        logger,
+                        projectRoot,
+                        timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
+                    });
+                    currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
+                    launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(currentDevContext);
+                    browserDevHost.updateBootstrap({
+                        devContext: currentDevContext,
+                        miniProgram: refreshed.miniProgram,
+                    });
+                    return currentDevContext;
+                }
+                catch (error) {
+                    currentDevContext = { source: 'anonymous' };
+                    launchRuntimePermissions = { schema_version: 1, entries: [] };
+                    browserDevHost.updateBootstrap({ devContext: currentDevContext });
+                    throw error;
+                }
+            },
             port: options.browserDevHostPort ?? DEFAULT_BROWSER_DEV_HOST_PORT,
             root: runtime.browserDevHostRoot,
             rootCandidates: runtime.browserDevHostRootCandidates,
@@ -15175,22 +15301,18 @@ async function runDevCommand(options, runtime = {}) {
                 if (refreshed.context.miniProgramId !== devLaunchContext.miniProgramId)
                     throw new Error('项目绑定已变更，请重新启动调试');
                 devLaunchContext.runtimePermissions = refreshed.context.runtimePermissions;
+                currentDevContext = withCurrentLocalDevLaunchToken(devLaunchContext, currentLocalDevLaunchToken);
                 launchRuntimePermissions = context.createBrowserDevRuntimePermissions(devLaunchContext.runtimePermissions, context.createBrowserDevPermissionState(devLaunchContext));
-                browserDevHost.updateBootstrap({ devContext: { ...devLaunchContext, localDevLaunchToken: currentLocalDevLaunchToken } });
+                browserDevHost.updateBootstrap({ devContext: currentDevContext });
                 return hasCompanionApproval(devLaunchContext.runtimePermissions);
             },
             onToken: (localDevLaunchToken, companionManifestSha256, expiresAt) => {
                 currentExpiresAt = expiresAt;
                 currentCompanionManifestSha256 = companionManifestSha256;
                 currentLocalDevLaunchToken = localDevLaunchToken;
-                const tokenContext = {
-                    source: 'remote',
-                    miniProgramId: devLaunchContext.miniProgramId,
-                    ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
-                    runtimePermissions: devLaunchContext.runtimePermissions,
-                };
+                currentDevContext = withCurrentLocalDevLaunchToken(currentDevContext, localDevLaunchToken);
                 browserDevHost.updateBootstrap({
-                    devContext: tokenContext,
+                    devContext: currentDevContext,
                     lanAddresses: buildLanAddresses(),
                 });
             },
@@ -15220,6 +15342,15 @@ async function runDevCommand(options, runtime = {}) {
     }
     installShutdownHandlers(closers, runtime.process ?? process);
 }
+function withCurrentLocalDevLaunchToken(context, localDevLaunchToken) {
+    return {
+        source: context.source,
+        ...(context.miniProgramId ? { miniProgramId: context.miniProgramId } : {}),
+        ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
+        ...(context.runtimePermissions !== undefined ? { runtimePermissions: context.runtimePermissions } : {}),
+        ...(context.warning ? { warning: context.warning } : {}),
+    };
+}
 function runDevStartupTask(logger, text, action, successText) {
     if (!logger.verbose) {
         return action();

package/dist/cli-chunks/{doctor-DRa_kjP1.cjs → doctor-ppQbhj7e.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-zNpZDWhc.cjs');
+var index = require('./index-B2eLzOSD.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-zNpZDWhc.cjs → index-B2eLzOSD.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-zNpZDWhc.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B2eLzOSD.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-zNpZDWhc.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B2eLzOSD.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-zNpZDWhc.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B2eLzOSD.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-zNpZDWhc.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B2eLzOSD.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-zNpZDWhc.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-B2eLzOSD.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13424,7 +13424,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.8.1-alpha.7';
+const BUILT_CLI_VERSION = '0.8.1-alpha.9';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13773,39 +13773,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-CCEPk2Ok.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BSySslS2.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-CCEPk2Ok.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BSySslS2.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-CCEPk2Ok.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BSySslS2.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-C8oN_Ms9.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-D8eh0bxZ.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CToSHRfO.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BiqK-4fa.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CTA0lsLD.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-u27Q6a-K.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DRa_kjP1.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-ppQbhj7e.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-CVXOE5jH.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-V_4EkY23.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DQ70o-Km.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-WvNfCBeJ.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-Bkl5YmtN.cjs → index-CtR3w1bw.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-zNpZDWhc.cjs');
+var index$2 = require('./index-B2eLzOSD.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-BN43V7d0.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-g_2W-HqP.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index.esm-CGoUW47e.cjs → index.esm-CCDqeyc7.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-zNpZDWhc.cjs');
-var dev = require('./dev-CTA0lsLD.cjs');
+var index = require('./index-B2eLzOSD.cjs');
+var dev = require('./dev-u27Q6a-K.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -27,11 +27,11 @@ require('node:os');
 require('node:net');
 require('node:dns/promises');
 require('node:http');
-require('./context-DZkqvg9S.cjs');
-require('./runtime-permission-env-BN43V7d0.cjs');
-require('./version-DbDVL6vm.cjs');
+require('./context-JfGWhXSD.cjs');
+require('./runtime-permission-env-g_2W-HqP.cjs');
+require('./version-Dox07wdq.cjs');
 require('node:async_hooks');
-require('./session-C1R_39si.cjs');
+require('./session-CaNwlovY.cjs');
 require('fs');
 require('constants');
 require('undici');
@@ -41,7 +41,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-couFw5bL.cjs');
+require('./project-vite-C-r7_UvY.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-CCEPk2Ok.cjs → login-BSySslS2.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-C1R_39si.cjs');
+var session = require('./session-CaNwlovY.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-zNpZDWhc.cjs');
+var index = require('./index-B2eLzOSD.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-couFw5bL.cjs → project-vite-C-r7_UvY.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-zNpZDWhc.cjs');
+var index = require('./index-B2eLzOSD.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);