@heybox/hb-sdk 0.8.3-alpha.2 → 0.8.3-alpha.4

package/dist/cli-chunks/{dev-Dazm6mjQ.cjs → dev-5lkHU1uv.cjs}

@@ -1,24 +1,24 @@
 'use strict';
 
-var context = require('./context-DAdousk7.cjs');
+var context = require('./context-DoVGwJek.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
+var runtimePermissionEnv = require('./runtime-permission-env-C0clU7_f.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
 var promises = require('node:dns/promises');
 var node_http = require('node:http');
 var node_module = require('node:module');
-var runtimePermissionEnv = require('./runtime-permission-env-v9THnMre.cjs');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-Cscd6hCr.cjs');
+var index = require('./index-Ol4wxcob.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-UhAizNH0.cjs');
+var session = require('./session-2vOGqgeA.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-C0fvgvWp.cjs');
-var version = require('./version-B-iUWMkU.cjs');
+var projectVite = require('./project-vite-P09pYZoU.cjs');
+var version = require('./version-CF6ilsAH.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1160,14 +1160,15 @@ function createDevSessionRoutes(options) {
             }
             try {
                 const payload = await readJsonRequestBody(request);
-                const runtimePermissions = context.createMobileDevSessionRuntimePermissions(await options.readDevContext());
+                const context$1 = await options.readDevContext();
+                const runtimePermissions = context.createMobileDevSessionRuntimePermissions(context$1);
                 const validated = validateDevSessionCreatePayload(payload, options.allowedMiniUrlOrigins, runtimePermissions);
                 reapExpiredDevSessions(devSessions, expiredDevSessions, options.now());
                 const replacedTokens = findDevSessionTokensForOrigin(devSessions, validated.miniUrlOrigin);
                 if (devSessions.size - replacedTokens.length >= MAX_ACTIVE_DEV_SESSIONS) {
                     throw createBrowserDevHostError(429, 'DEV_SESSION_LIMIT_REACHED', 'active Dev Session limit reached');
                 }
-                const expiresAt = options.now() + DEV_SESSION_TTL_MS;
+                const expiresAt = Math.min(options.now() + DEV_SESSION_TTL_MS, context$1.expiresAt ?? Infinity);
                 const token = createDevSessionToken(devSessions);
                 const snapshot = {
                     schema_version: MINI_PROGRAM_DEV_SESSION_SCHEMA_VERSION,
@@ -1175,6 +1176,7 @@ function createDevSessionRoutes(options) {
                     expires_at: expiresAt,
                     mini_url_origin: validated.miniUrlOrigin,
                     runtime_permissions: validated.runtimePermissions,
+                    ...createContextFields(context$1),
                 };
                 devSessions.set(token, {
                     expiresAt,
@@ -1225,10 +1227,28 @@ function createDevSessionRoutes(options) {
                 writeDevSessionCorsResponse(response, resolved.status);
                 return;
             }
-            writeDevSessionCorsResponse(response, request.method === 'OPTIONS' ? 204 : 200, request.method === 'GET' ? resolved.session.serialized : undefined);
+            // 同一个不可猜测引用读取当前 CLI 快照，让 Host 可检测撤权与 revision 变化。
+            const context$1 = request.method === 'GET' ? options.readCurrentDevContext?.() : undefined;
+            const serialized = context$1 ? JSON.stringify({ ...JSON.parse(resolved.session.serialized),
+                ...createContextFields(context$1),
+                expires_at: Math.min(resolved.session.expiresAt, context$1.expiresAt ?? Infinity),
+                runtime_permissions: context.createMobileDevSessionRuntimePermissions(context$1) }) : undefined;
+            writeDevSessionCorsResponse(response, request.method === 'OPTIONS' ? 204 : 200, request.method === 'GET' ? serialized ?? resolved.session.serialized : undefined);
         },
     };
 }
+function createContextFields(context) {
+    return {
+        local_dev_grant: context.localDevGrant,
+        context_revision: context.contextRevision,
+        declared_permissions: context.declaredPermissions,
+        platforms: context.platforms,
+        dev_session_id: context.devSessionId,
+        local_dev_launch_token: context.localDevLaunchToken,
+        mini_program_id: context.miniProgramId,
+        companion_manifest_sha256: context.companionManifestSha256,
+    };
+}
 function validateDevSessionCreatePayload(payload, allowedMiniUrlOrigins, runtimePermissions) {
     if (!isRecord$2(payload) || Object.keys(payload).some((key) => !['mini_url_origin', 'runtime_permissions'].includes(key))) {
         throw new TypeError('Dev Session body is invalid');
@@ -1950,8 +1970,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-Dazm6mjQ.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-Dazm6mjQ.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-5lkHU1uv.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-5lkHU1uv.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -2182,6 +2202,7 @@ function createBrowserDevHostServer(root, runtime) {
         lookupHostname: runtime.lookupHostname,
         now: runtime.now,
         readDevContext: runtime.readMobileDevSessionContext,
+        readCurrentDevContext: runtime.readDevContext,
         onCreated: ({ expiresAt, miniUrlOrigin, token }, request) => {
             const origin = new URL(readRequestOrigin(request));
             const hostname = origin.hostname.startsWith('[') && origin.hostname.endsWith(']') ? origin.hostname.slice(1, -1) : origin.hostname;
@@ -2790,7 +2811,7 @@ function createBrowserDevHostChannelServer(server, options) {
 }
 async function readBrowserDevHostChannelSnapshot(runtime, cookieHeader) {
     const status = await readAccountStatus(runtime, cookieHeader);
-    const permissions = context.createBrowserDevPermissionState(runtime.readDevContext());
+    const permissions = context.createBrowserDevPermissionState(context.resolveBrowserFakeContext(runtime.readDevContext()));
     return {
         account: {
             revision: status.revision,
@@ -11049,7 +11070,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-BPF3ML9J.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-DUvvFi-Z.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15031,7 +15052,9 @@ function tryHandleMiniProgramDevLaunchRequest(request, response, readSource) {
     catch {
         return false;
     }
-    if (requestUrl.pathname !== MINI_PROGRAM_DEV_LAUNCH_PATH || requestUrl.search !== '') {
+    const contextSource = /^\/__hb_sdk__\/dev-context\/[a-f0-9]{64}$/.test(requestUrl.pathname) ? readSource() : undefined;
+    const isContext = contextSource?.devContextPath !== undefined && requestUrl.pathname === contextSource.devContextPath;
+    if ((!isContext && requestUrl.pathname !== MINI_PROGRAM_DEV_LAUNCH_PATH) || requestUrl.search !== '') {
         return false;
     }
     if (!isAllowedLaunchOrigin(request.headers.origin)) {
@@ -15056,7 +15079,11 @@ function tryHandleMiniProgramDevLaunchRequest(request, response, readSource) {
         writeLaunchResponse(response, 204);
         return true;
     }
-    writeLaunchResponse(response, 200, JSON.stringify(createLaunchSnapshot(readSource(), origin)));
+    const source = contextSource ?? readSource();
+    const snapshot = createLaunchSnapshot(source, origin);
+    writeLaunchResponse(response, 200, JSON.stringify(isContext
+        ? { ...snapshot, revision: source.devContext?.contextRevision ?? 0, mini_url_origin: origin.origin }
+        : snapshot));
     return true;
 }
 function createLaunchSnapshot(source, requestOrigin) {
@@ -15076,6 +15103,13 @@ function createLaunchSnapshot(source, requestOrigin) {
         snapshot.dev_session_id = source.devSessionId;
     if (source.expiresAt)
         snapshot.expires_at = source.expiresAt;
+    const context = source.devContext;
+    if (context) {
+        snapshot.context_revision = context.contextRevision;
+        snapshot.local_dev_grant = context.localDevGrant;
+        snapshot.declared_permissions = context.declaredPermissions;
+        snapshot.platforms = context.platforms;
+    }
     const companionManifestSha256 = source.companionManifestSha256?.trim();
     if (companionManifestSha256)
         snapshot.companion_manifest_sha256 = companionManifestSha256;
@@ -15086,6 +15120,8 @@ function createLaunchSnapshot(source, requestOrigin) {
     if (storedContextUrl) {
         snapshot.dev_context_url = projectStoredDevContextUrl(storedContextUrl, requestOrigin.hostname);
     }
+    if (source.devContextPath)
+        snapshot.dev_context_url = new URL(source.devContextPath, requestOrigin).toString();
     if (runtimePermissionEnv.parseMiniProgramRuntimePermissions(source.runtimePermissions).valid && source.runtimePermissions) {
         snapshot.runtime_permissions = JSON.parse(JSON.stringify(source.runtimePermissions));
     }
@@ -15154,9 +15190,6 @@ async function runDevCommand(options, runtime = {}) {
     const logger = runtime.logger ?? index.createCliLogger();
     const fetchImpl = runtime.fetchImpl ?? fetch;
     const openUrl = runtime.openExternalUrl ?? browser.openExternalUrl;
-    if (!(await session.readHeyboxAuthSession({ env: runtime.env }))) {
-        throw new Error('hb-sdk dev 需要 CLI 登录态。请先运行 hb-sdk login。');
-    }
     const networkInterfaceSnapshot = (runtime.networkInterfaces ?? os.networkInterfaces)();
     const getPortImpl = runtime.getPort ?? getPorts;
     const appPort = await selectAvailablePort({
@@ -15174,6 +15207,7 @@ async function runDevCommand(options, runtime = {}) {
     const companionArtifactAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const miniProgramManifestAccessToken = (runtime.randomBytes ?? node_crypto.randomBytes)(32).toString('base64url');
     const devSessionId = node_crypto.randomBytes(16).toString('hex');
+    const devContextPath = `/__hb_sdk__/dev-context/${node_crypto.randomBytes(32).toString('hex')}`;
     const miniProgramPlatforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
     const { context: devLaunchContext, miniProgram } = await loadDevLaunchContext({
         env: runtime.env,
@@ -15183,19 +15217,42 @@ async function runDevCommand(options, runtime = {}) {
         timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
     });
     let currentDevContext = devLaunchContext;
-    let launchRuntimePermissions = context.createBrowserDevRuntimePermissions(devLaunchContext.runtimePermissions, context.createBrowserDevPermissionState(devLaunchContext));
+    let contextRevision = 1;
+    let launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(devLaunchContext);
     const mobileDevContextUrlsByOrigin = new Map();
     let currentCompanionManifestSha256;
     let currentLocalDevLaunchToken = devLaunchContext.localDevLaunchToken;
     let currentExpiresAt;
+    let refreshDevCsp;
+    let lastTemporaryWarning = '';
     let tokenSession;
+    const updateLocalContext = (allowedTemporaryKeys) => {
+        const grant = runtimePermissionEnv.createMiniProgramLocalDevGrant({ declaredPermissions: currentDevContext.declaredPermissions ?? {},
+            runtimePermissions: currentDevContext.runtimePermissions, revision: contextRevision,
+            eligiblePermissionKeys: currentCompanionManifestSha256 && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms)
+                ? ['network', 'companion'] : ['network'] });
+        if (allowedTemporaryKeys)
+            grant.entries = grant.entries.filter(entry => allowedTemporaryKeys.has(entry.key));
+        const temporaryWarning = grant.entries.map(entry => entry.key).join('、');
+        if (temporaryWarning && temporaryWarning !== lastTemporaryWarning)
+            logger.warn(`本地临时权限：${temporaryWarning}；线上未批准，发布后不可用。`);
+        lastTemporaryWarning = temporaryWarning;
+        currentDevContext = { ...currentDevContext, localDevGrant: grant, contextRevision, devSessionId,
+            companionManifestSha256: currentCompanionManifestSha256,
+            expiresAt: currentExpiresAt ?? Date.now() + 24 * 60 * 60 * 1000 };
+        launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(currentDevContext);
+        refreshDevCsp?.();
+    };
+    updateLocalContext();
     const readLaunchSource = () => ({
+        devContext: currentDevContext,
+        devContextPath,
         companionArtifactAccessToken,
         companionManifestSha256: currentCompanionManifestSha256,
         devContextUrlsByMiniUrlOrigin: mobileDevContextUrlsByOrigin,
         localDevLaunchToken: currentLocalDevLaunchToken,
         devSessionId,
-        expiresAt: currentExpiresAt,
+        expiresAt: currentDevContext.expiresAt,
         miniProgramId: devLaunchContext.miniProgramId,
         runtimePermissions: launchRuntimePermissions,
         sdkVersion: version.HB_SDK_VERSION,
@@ -15234,11 +15291,21 @@ async function runDevCommand(options, runtime = {}) {
         return true;
     });
     const vite = await runDevStartupTask(logger, '正在加载项目 Vite', () => projectVite.loadProjectVite(projectRoot), '已加载项目 Vite');
-    const appServer = await runDevStartupTask(logger, '正在创建 Vite 开发服务器', () => runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(devLaunchContext.runtimePermissions), () => withCompanionArtifactAccessTokenEnv(companionArtifactAccessToken, () => withMiniProgramManifestAccessTokenEnv(miniProgramManifestAccessToken, () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions, launchPlugin)), runtime.env), runtime.env), runtime.env), runtime.env), '已创建 Vite 开发服务器');
+    const appServer = await runDevStartupTask(logger, '正在创建 Vite 开发服务器', () => runtimePermissionEnv.withMiniappPlatformCspEnv(context.shouldSkipMiniappPlatformCsp(devLaunchContext.runtimePermissions) || currentDevContext.localDevGrant?.entries.some(entry => entry.key === 'network') === true, () => withCompanionArtifactAccessTokenEnv(companionArtifactAccessToken, () => withMiniProgramManifestAccessTokenEnv(miniProgramManifestAccessToken, () => withManagedDevOutputEnv(() => vite.createServer(createViteServerOptions(projectRoot, resolvedOptions, launchPlugin)), runtime.env), runtime.env), runtime.env), runtime.env), '已创建 Vite 开发服务器');
     await runDevStartupTask(logger, '正在启动 Vite 开发服务器', () => appServer.listen(appPort), 'Vite 开发服务器已启动');
+    let skipDevCsp = context.shouldSkipMiniappPlatformCsp(currentDevContext.runtimePermissions) || currentDevContext.localDevGrant?.entries.some(entry => entry.key === 'network') === true;
+    refreshDevCsp = () => {
+        const next = context.shouldSkipMiniappPlatformCsp(currentDevContext.runtimePermissions) || currentDevContext.localDevGrant?.entries.some(entry => entry.key === 'network') === true;
+        if (next === skipDevCsp || !appServer.restart)
+            return;
+        skipDevCsp = next;
+        void runtimePermissionEnv.withMiniappPlatformCspEnv(next, () => withCompanionArtifactAccessTokenEnv(companionArtifactAccessToken, () => withMiniProgramManifestAccessTokenEnv(miniProgramManifestAccessToken, () => appServer.restart(), runtime.env), runtime.env), runtime.env)
+            .catch(() => logger.warn('开发服务器权限配置刷新失败，请重新运行 hb-sdk dev'));
+    };
     const appUrl = await runDevStartupTask(logger, '正在探测小程序入口', () => resolveViteAppUrl(appServer, resolvedOptions, fetchImpl), '已确定小程序入口');
     const buildLanAddresses = () => createLanAddressCandidates({
         appUrl,
+        devContextPath,
         devContextUrlsByMiniUrlOrigin: mobileDevContextUrlsByOrigin,
         hmrHost: resolvedOptions.hmrHost,
         interfaces: networkInterfaceSnapshot,
@@ -15272,28 +15339,18 @@ async function runDevCommand(options, runtime = {}) {
                 });
             },
             readMobileDevSessionContext: async () => {
-                try {
-                    const refreshed = await loadDevLaunchContext({
-                        env: runtime.env,
-                        fetchImpl,
-                        logger,
-                        projectRoot,
-                        timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS,
-                    });
-                    currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
-                    launchRuntimePermissions = context.createMobileDevSessionRuntimePermissions(currentDevContext);
-                    browserDevHost.updateBootstrap({
-                        devContext: currentDevContext,
-                        miniProgram: refreshed.miniProgram,
-                    });
-                    return currentDevContext;
-                }
-                catch (error) {
-                    currentDevContext = { source: 'anonymous' };
-                    launchRuntimePermissions = { schema_version: 1, entries: [] };
-                    browserDevHost.updateBootstrap({ devContext: currentDevContext });
-                    throw error;
+                if (currentDevContext.source === 'remote') {
+                    const refreshed = await loadDevLaunchContext({ env: runtime.env, fetchImpl, logger, projectRoot,
+                        timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS });
+                    if (refreshed.context.source === 'remote' && refreshed.context.miniProgramId === currentDevContext.miniProgramId) {
+                        if (JSON.stringify(currentDevContext.runtimePermissions) !== JSON.stringify(refreshed.context.runtimePermissions))
+                            contextRevision++;
+                        currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
+                        updateLocalContext();
+                        browserDevHost.updateBootstrap({ devContext: currentDevContext });
+                    }
                 }
+                return currentDevContext;
             },
             port: options.browserDevHostPort ?? DEFAULT_BROWSER_DEV_HOST_PORT,
             root: runtime.browserDevHostRoot,
@@ -15313,24 +15370,30 @@ async function runDevCommand(options, runtime = {}) {
             logger,
             manifestUrl: new URL(COMPANION_DEV_MANIFEST_PATH, appUrl).toString(),
             companionArtifactAccessToken,
-            companionApproved: hasCompanionApproval(devLaunchContext.runtimePermissions),
+            companionDeclared: currentDevContext.declaredPermissions?.companion?.enabled === true && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms),
             miniProgramId: devLaunchContext.miniProgramId,
             refreshPermissions: async () => {
                 const refreshed = await loadDevLaunchContext({ env: runtime.env, fetchImpl, logger, projectRoot,
                     timeoutMs: runtime.devContextTimeoutMs ?? DEFAULT_DEV_CONTEXT_TIMEOUT_MS });
                 if (refreshed.context.miniProgramId !== devLaunchContext.miniProgramId)
                     throw new Error('项目绑定已变更，请重新启动调试');
-                devLaunchContext.runtimePermissions = refreshed.context.runtimePermissions;
-                currentDevContext = withCurrentLocalDevLaunchToken(devLaunchContext, currentLocalDevLaunchToken);
-                launchRuntimePermissions = context.createBrowserDevRuntimePermissions(devLaunchContext.runtimePermissions, context.createBrowserDevPermissionState(devLaunchContext));
+                if (refreshed.context.source !== 'remote')
+                    throw new Error('远端权限刷新暂不可用');
+                if (JSON.stringify(currentDevContext.runtimePermissions) !== JSON.stringify(refreshed.context.runtimePermissions))
+                    contextRevision++;
+                currentDevContext = withCurrentLocalDevLaunchToken(refreshed.context, currentLocalDevLaunchToken);
+                updateLocalContext();
                 browserDevHost.updateBootstrap({ devContext: currentDevContext });
-                return hasCompanionApproval(devLaunchContext.runtimePermissions);
+                return currentDevContext.declaredPermissions?.companion?.enabled === true && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms);
             },
             onToken: (localDevLaunchToken, companionManifestSha256, expiresAt) => {
-                currentExpiresAt = expiresAt;
+                if (currentCompanionManifestSha256 !== companionManifestSha256 || Boolean(currentLocalDevLaunchToken) !== Boolean(localDevLaunchToken))
+                    contextRevision++;
+                currentExpiresAt = expiresAt ?? (currentLocalDevLaunchToken ? Date.now() : undefined);
                 currentCompanionManifestSha256 = companionManifestSha256;
                 currentLocalDevLaunchToken = localDevLaunchToken;
                 currentDevContext = withCurrentLocalDevLaunchToken(currentDevContext, localDevLaunchToken);
+                updateLocalContext();
                 browserDevHost.updateBootstrap({
                     devContext: currentDevContext,
                     lanAddresses: buildLanAddresses(),
@@ -15352,6 +15415,44 @@ async function runDevCommand(options, runtime = {}) {
             },
         });
     }
+    const packagePath = path.join(projectRoot, 'package.json');
+    const onDeclarationChange = () => {
+        try {
+            const previouslyTemporary = new Set(currentDevContext.localDevGrant?.entries.map(entry => entry.key));
+            const local = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
+            const platforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(projectRoot);
+            contextRevision++;
+            currentDevContext = { ...currentDevContext, declaredPermissions: local.permissions ?? {}, platforms,
+                runtimePermissions: runtimePermissionEnv.composeMiniappRuntimePermissions(local, currentDevContext.runtimePermissions).runtimePermissions };
+            // 新声明必须重新取得远端基线；已有票据期间只允许删除，不因刷新失败扩权。
+            currentCompanionManifestSha256 = undefined;
+            updateLocalContext(currentDevContext.source === 'remote' ? previouslyTemporary : undefined);
+            tokenSession?.refresh();
+            browserDevHost.updateBootstrap({ devContext: currentDevContext, miniProgramSupportsDesktop: runtimePermissionEnv.hasMiniappDesktopPlatform(platforms) });
+        }
+        catch {
+            contextRevision++;
+            currentDevContext = { ...currentDevContext, declaredPermissions: {}, localDevGrant: undefined,
+                contextRevision, platforms: [], localDevLaunchToken: undefined, expiresAt: undefined,
+                runtimePermissions: { schema_version: 1, entries: [] }, warning: '本地权限声明无效，调试权限已撤销' };
+            launchRuntimePermissions = { schema_version: 1, entries: [] };
+            currentCompanionManifestSha256 = undefined;
+            currentLocalDevLaunchToken = undefined;
+            currentExpiresAt = undefined;
+            refreshDevCsp?.();
+            tokenSession?.refresh();
+            browserDevHost.updateBootstrap({
+                devContext: currentDevContext,
+                devReadiness: {
+                    browser: { state: 'ready' },
+                    mobile: { state: 'blocked', reason: '本地权限声明无效，已撤销真实客户端调试' },
+                    companion: { state: 'blocked', reason: '本地权限声明无效，已撤销真实客户端调试' },
+                },
+            });
+        }
+    };
+    fs.watchFile(packagePath, { interval: 500, persistent: false }, onDeclarationChange);
+    closers.push(() => fs.unwatchFile(packagePath, onDeclarationChange));
     logger.success('Web / Browser Fake 调试已就绪');
     logger.info(`调试页：${browserDevHost.url}`);
     logger.info(`小程序地址：${appUrl}`);
@@ -15364,9 +15465,9 @@ async function runDevCommand(options, runtime = {}) {
 }
 function withCurrentLocalDevLaunchToken(context, localDevLaunchToken) {
     return {
-        source: context.source,
+        ...context,
         ...(context.miniProgramId ? { miniProgramId: context.miniProgramId } : {}),
-        ...(localDevLaunchToken ? { localDevLaunchToken } : {}),
+        localDevLaunchToken,
         ...(context.runtimePermissions !== undefined ? { runtimePermissions: context.runtimePermissions } : {}),
         ...(context.warning ? { warning: context.warning } : {}),
     };
@@ -15378,10 +15479,19 @@ function runDevStartupTask(logger, text, action, successText) {
     return logger.task(text, () => action(), { successText });
 }
 async function loadDevLaunchContext(options) {
+    // 声明错误始终阻断；远端不可用只影响真实 Host。
+    const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(options.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
+    const platforms = runtimePermissionEnv.readMiniappPlatformsFromPackageJson(options.projectRoot);
+    if (!localPermissions.declared)
+        options.logger.warn(runtimePermissionEnv.getMissingPermissionsWarning());
+    const anonymous = (warning) => ({ context: { source: 'anonymous', warning,
+            declaredPermissions: localPermissions.permissions ?? {}, platforms,
+            runtimePermissions: runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, undefined).runtimePermissions }, miniProgram: null });
+    if (!(await session.readHeyboxAuthSession({ env: options.env })))
+        return anonymous('尚未登录 CLI，真实手机和 PC 调试不可用');
     const miniProgramId = await context.readBoundMiniProgramId(options.projectRoot);
-    if (!miniProgramId) {
-        throw new Error('hb-sdk dev 需要绑定小程序。请先运行 hb-sdk remote create 或 hb-sdk remote bind <mini-program-id>。');
-    }
+    if (!miniProgramId)
+        return anonymous('尚未绑定小程序，真实手机和 PC 调试不可用');
     let migratingProfile = false;
     try {
         const { detail, miniProgramId: verifiedMiniProgramId } = await runDevStartupTask(options.logger, '正在读取远端小程序权限', () => loadRemoteDevContextWithTimeout({
@@ -15398,15 +15508,16 @@ async function loadDevLaunchContext(options) {
         migratingProfile = false;
         if (migration.changed)
             options.logger.info('已迁移当前正式发布名称与图片，继续启动开发环境');
-        const localPermissions = runtimePermissionEnv.readMiniappPermissionsFromPackageJson(options.projectRoot, runtimePermissionEnv.resolveMiniappSdkVersion());
-        if (!localPermissions.declared)
-            options.logger.warn(runtimePermissionEnv.getMissingPermissionsWarning());
+        if (!runtimePermissionEnv.parseMiniProgramRuntimePermissions(detail.runtime_permissions).valid)
+            return anonymous('线上权限快照无效，真实手机和 PC 调试不可用');
         const effectivePermissions = runtimePermissionEnv.composeMiniappRuntimePermissions(localPermissions, detail.runtime_permissions).runtimePermissions;
         return {
             context: {
                 source: 'remote',
                 miniProgramId: verifiedMiniProgramId,
                 runtimePermissions: effectivePermissions,
+                declaredPermissions: localPermissions.permissions ?? {},
+                platforms,
             },
             miniProgram: createMiniProgramSummary(verifiedMiniProgramId, detail),
         };
@@ -15414,10 +15525,9 @@ async function loadDevLaunchContext(options) {
     catch (error) {
         if (migratingProfile)
             throw new Error(`版本资料配置失败：${index.readRedactedErrorMessage(error)}。请配置 heybox.name/icon/coverImages 后重试。`, { cause: error });
-        if (error instanceof context.MiniProgramProjectBindingError && error.code !== 'MINI_PROGRAM_UNBOUND') {
+        if (error instanceof context.MiniProgramProjectBindingError && error.code.startsWith('PACKAGE_JSON_'))
             throw error;
-        }
-        throw new Error('无法读取远端 Dev Context，请检查 CLI 登录态、项目绑定和网络后重试。', { cause: error });
+        return anonymous('未连接线上上下文，请检查 CLI 登录态、项目绑定和网络');
     }
 }
 function createMiniProgramSummary(miniProgramId, detail) {
@@ -15649,12 +15759,13 @@ function startLocalDevLaunchTokenSession(options) {
     let expirationTimer;
     let hasReportedTokenFailure = false;
     let refreshTimer;
-    let companionApproved = options.companionApproved;
+    let companionDeclared = options.companionDeclared;
     let permissionsRefreshAt = Date.now() + 30_000;
     let publishedToken;
     let publishedDigest;
     let ticket;
     let pending;
+    let refreshing = false;
     const getTicket = async (companionManifestSha256) => {
         if (closed)
             return undefined;
@@ -15678,24 +15789,27 @@ function startLocalDevLaunchTokenSession(options) {
         return promise;
     };
     const refresh = async () => {
+        if (refreshing || closed)
+            return;
+        refreshing = true;
         try {
             if (options.refreshPermissions && Date.now() >= permissionsRefreshAt) {
-                companionApproved = await options.refreshPermissions();
+                companionDeclared = await options.refreshPermissions();
                 permissionsRefreshAt = Date.now() + 30_000;
             }
             let manifest;
             let snapshotError;
             try {
-                manifest = await loadRemoteDevContextWithTimeout({
+                manifest = companionDeclared ? await loadRemoteDevContextWithTimeout({
                     fetchImpl: options.fetchImpl,
                     timeoutMs: options.timeoutMs,
                     load: fetchImpl => readCompanionManifest(options.manifestUrl, options.companionArtifactAccessToken, fetchImpl),
-                });
+                }) : undefined;
             }
             catch (error) {
                 snapshotError = error;
             }
-            const digest = manifest?.digest;
+            const digest = manifest?.artifacts.length ? manifest.digest : undefined;
             const issued = await getTicket(digest);
             if (!issued)
                 return;
@@ -15712,9 +15826,9 @@ function startLocalDevLaunchTokenSession(options) {
                 companion: snapshotError
                     ? { state: snapshotError instanceof Error && snapshotError.message.includes('artifact-updating') ? 'pending' : 'blocked', reason: safeCompanionFailureReason(snapshotError) }
                     : manifest?.artifacts.length
-                        ? companionApproved
+                        ? companionDeclared
                             ? { state: 'ready', digest, artifacts: manifest.artifacts, reason: '本地产物和启动票已就绪，PC 授权将在打开后验证' }
-                            : { state: 'blocked', reason: 'Companion 未获 COA 批准或本地权限声明未开启' }
+                            : { state: 'blocked', reason: 'Companion 本地权限或桌面平台声明未开启' }
                         : { state: 'not-configured', reason: '未配置本地 Companion 产物' },
             });
             if (snapshotError)
@@ -15739,6 +15853,9 @@ function startLocalDevLaunchTokenSession(options) {
             options.logger.debug(`本地调试凭证获取失败，详细原因：${index.readRedactedErrorMessage(error, { verbose: true })}`);
             schedule(options.timeoutMs);
         }
+        finally {
+            refreshing = false;
+        }
     };
     const schedule = (delayMs) => {
         refreshTimer = setTimeout(() => {
@@ -15763,6 +15880,13 @@ function startLocalDevLaunchTokenSession(options) {
     const ready = refresh();
     return {
         getTicket,
+        refresh: () => {
+            permissionsRefreshAt = 0;
+            publishedDigest = undefined;
+            if (refreshTimer)
+                clearTimeout(refreshTimer);
+            void refresh();
+        },
         ready,
         close: () => {
             closed = true;
@@ -15816,18 +15940,13 @@ function safeCompanionFailureReason(error) {
     if (/404|not found/i.test(message))
         return '调试接口尚未部署或当前登录环境不匹配';
     if (/403|forbidden|permission|授权|权限/i.test(message))
-        return 'Companion 授权未通过，请检查 COA 批准与开发者身份';
+        return 'Companion 本地授权未通过，请检查开发者身份与调试凭证';
     if (/401|登录/i.test(message))
         return 'CLI 登录态已失效，请重新登录';
     if (/manifest|快照|ZIP|ENOENT/i.test(message))
         return '本地 Companion ZIP 或 Manifest 校验失败，请检查产物与配置';
     return 'PC Companion 暂不可用，请检查网络、登录环境和调试接口';
 }
-function hasCompanionApproval(value) {
-    if (!value || typeof value !== 'object' || !('entries' in value) || !Array.isArray(value.entries))
-        return false;
-    return value.entries.some(entry => entry?.key === 'companion' && entry?.status === 'enabled');
-}
 async function readCompanionManifest(manifestUrl, companionArtifactAccessToken, fetchImpl) {
     try {
         const response = await fetchImpl(manifestUrl, {
@@ -15919,7 +16038,9 @@ function createLanAddressCandidates(options) {
             id,
             name,
         };
-        const lanDevContextUrl = readLanDevContextUrl(options.devContextUrlsByMiniUrlOrigin?.get(new URL(appUrl).origin), address);
+        const lanDevContextUrl = options.devContextPath
+            ? new URL(options.devContextPath, appUrl).toString()
+            : readLanDevContextUrl(options.devContextUrlsByMiniUrlOrigin?.get(new URL(appUrl).origin), address);
         // 真机 WebView 基址是 127.0.0.1 详情页，HTML 来自线上缓存；完整启动参数写进 sandbox query，
         // 作为 /l/<token> HTML 跳转页的目标；调试页二维码只编码这条短链。
         candidate.mobileAppQrPayload = createMobileAppQrPayload(appUrl, {

package/dist/cli-chunks/{doctor-Dqju9vZQ.cjs → doctor-DFt0LWou.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-Cscd6hCr.cjs');
+var index = require('./index-Ol4wxcob.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-ZxzVU017.cjs → index-CguXMrgP.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-Cscd6hCr.cjs');
+var index$2 = require('./index-Ol4wxcob.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-v9THnMre.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-C0clU7_f.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');