@heybox/hb-sdk 0.9.0-alpha.0 → 0.9.0-alpha.10

package/CHANGELOG.md

@@ -2,6 +2,76 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.0-alpha.10 - 2026-10-10
+
+### 行为调整
+
+- 支持方向控制的宿主在 `navigation.openAppPage({ target: 'mini_program' })` 跳转前，先恢复竖屏、非全屏；恢复失败时不打开目标，并返回方向错误。返回后需要横屏的页面应在 `show` 事件中重新调用 `viewport.setDisplay()`。
+
+### 问题修复
+
+- 修复跨小程序跳转超时或 SDK 销毁后仍可能打开目标的问题；恢复竖屏阶段增加截止时间，并向宿主传播取消。旧宿主没有方向能力时继续允许跳转。
+
+## 0.9.0-alpha.9 - 2026-10-10
+
+### 问题修复
+
+- 改善全屏退出入口在黑色背景下不易发现、提示收起过快的问题，增加短暂动画引导和浅色描边。
+- 减少收起后的遮挡，竖屏保留更窄的边缘入口，并支持系统减少动态效果设置；公开 SDK API 和退出操作保持不变。
+
+## 0.9.0-alpha.7 - 2026-10-09
+
+### 文档与工具
+
+- 浏览器调试台支持横竖屏与全屏模拟，页面随设备旋转，全屏时隐藏胶囊和状态栏并保留安全区。
+- 退出全屏按钮跟随模拟屏幕，退出后恢复竖屏展示。
+
+## 0.9.0-alpha.6 - 2026-10-09
+
+### 问题修复
+
+- 修复手机扫码调试切换到非默认局域网网卡后，二维码持续刷新、难以扫码的问题。
+
+## 0.9.0-alpha.5 - 2026-10-09
+
+### 文档与工具
+
+- 补齐网络超时与重试、Steam 授权、生命周期事件和展示操作的 API 说明，修正 Companion 退出订阅示例。
+- 为发布资料、Manifest 和浏览器预览工具补充参数、返回值、校验边界与资源释放说明，并纳入 API Reference。
+
+## 0.9.0-alpha.4 - 2026-10-08
+
+### 行为调整
+
+- `user.getSteamGameList()` 在支持完整文件能力的 Host 上复用持久化结果；文件能力不可用时保留内存缓存并正常回退请求。
+
+### 问题修复
+
+- 修复缓存存储故障、账号绑定变化和缓存治理异常影响 Steam 查询的问题。
+
+## 0.9.0-alpha.3 - 2026-10-08
+
+### 行为调整
+
+- Companion ZIP 使用 artifact 协议 v2 复用已验证内容，并在服务端异步完成校验后再提交审核；中断部署可重新执行续接。
+
+## 0.9.0-alpha.2 - 2026-10-07
+
+### 问题修复
+
+- 恢复手机真机调试时由开发机转发 `network.request()`，请求中的 `localhost` 指向开发机。
+- 本地代理保留调用方提供的应用层请求头和上游响应头，不自动携带黑盒登录态。
+
+## 0.9.0-alpha.1 - 2026-10-07
+
+> 影响级别：常规
+> 开发者动作：Android 扫码调试用户升级至 `0.9.0-alpha.1` 后重新运行 `hb-sdk dev`。
+> 兼容范围：公开 SDK API 不变；补齐真实客户端扫码调试启动协议中的小程序身份字段，保留原有兼容字段。
+
+### 问题修复
+
+- 修复 CLI 扫码启动协议缺少 `user_miniprogram_id`，导致 Android 1.3.396 调试容器可能无法使用原生桥接能力的问题。
+
 ## 0.9.0-alpha.0 - 2026-10-06
 
 > 影响级别：常规

package/README.md

@@ -26,6 +26,8 @@ npm run dev
 
 脚手架已包含 SDK、Vite 配置和常用开发命令。浏览器调试通过后，再从调试台的二维码入口使用手机小黑盒 APP 验收。
 
+手机二维码的短链先打开普通中间页，再进入专用 dev-shell。最终 `openWindow` 协议会把 CLI 校验后的用户小程序字符串 ID（UUID）写入根字段 `user_miniprogram_id`；原生不会从 URL 查询参数补读，也不能用传统小程序数字 ID 代替。匿名调试不生成小程序 ID，原生未开放的横屏能力仍返回 `supported: false`。入口排查与验证记录见 [Android 396 入口审计](./docs/android-396-launch-identity.md)。
+
 当前 `0.8` 已发布为稳定版本，创建命令使用 `@latest`。
 
 ### 接入已有项目
@@ -391,6 +393,14 @@ const launchData = hbSDK.share.getExtra();
 
 该目标无需权限声明或可信用户手势，只接受目标 `miniProgramId` 和可选 `extra`；不能指定版本、URL、scheme 或窗口样式。生产 Host 只解析当前用户可访问的公开发布版本，预览与本地开发目标仅由 Dev Host 提供。`extra` 不会继承源小程序当前的启动数据，省略时目标读取到 `undefined`，显式传 `null` 时读取到 `null`。调用成功只表示 Host 已接受开窗请求，不等待目标加载或 SDK 握手。
 
+支持方向控制的 Host 会在打开目标前先把当前容器恢复为竖屏、非全屏，等待宿主确认后再开窗，避免当前容器仍锁定横屏时展示新容器出现方向冲突。恢复会发出 `display_change`（`source: 'api'`）；恢复失败时不会打开目标，`openAppPage` 返回方向设置的错误码（如 `ORIENTATION_TIMEOUT`）。返回当前小程序后不会自动回到原方向，需要横屏的页面应在 `show` 事件中重新设置：
+
+```ts
+hbSDK.on('show', () => {
+  void hbSDK.viewport.setDisplay({ orientation: 'landscape' });
+});
+```
+
 ## 分享扩展数据
 
 `share.showShareMenu()` 的落地页固定为当前小程序的 `common_share`，不接受自定义 `url`。分享和复制链接可以携带小程序自行定义的页面状态：
@@ -454,6 +464,11 @@ hb-sdk remote deploy --release-note "本次更新说明"
 | `hb-sdk build`            | 执行生产构建与产物校验，不包含类型检查 |
 | `hb-sdk remote deploy`    | 构建、上传并提交当前版本审核           |
 
+`remote deploy` 要求服务端支持产物协议 v2，不会降级为旧上传流程。同一小程序已有相同 Companion ZIP 时，
+CLI 会复用已验证产物、跳过该 ZIP 的网络上传；Web 文件及发生变化的 ZIP 仍按当前版本上传。
+新 ZIP 使用会话专属凭证直传到以 SHA-256 命名的候选对象，强制禁止覆盖。服务端一次读取完成哈希和 ZIP 安全校验后直接引用，不再复制对象。CLI 轮询持久化 Finalize 状态并在全部 Companion ready 后提交审核；中断后重新执行 deploy 可续接，校验失败则使用新会话重传。
+每次部署仍会重新构建并计算本地产物摘要，审核与发布仍属于本次版本。
+
 `hb-sdk create` 默认生成可直接删除的 Vanilla JavaScript + Vite HelloWorld，只保留 SDK Toast 示例、三端 Manifest 和开发/构建/部署命令，不绑定业务框架或项目内测试工具。
 
 `hb-sdk dev` 会启动 Vue 3 Browser Dev Host。左侧诊断面板集中展示结构化日志、当前小程序作用域内的 Storage 快照和问题；日志区分 App、SDK、Network、Runtime、Host 来源，支持毫秒级时间、结果、耗时、重复计数、脱敏详情展开以及来源/级别筛选。右侧设备预览可在 iPhone 16 Pro Max（`440 x 956`）与 Pixel 9 Pro（`410 x 914`）间切换。切换预设只改变设备外框和 viewport，不会重新加载 iframe 或重启 Runtime；授权与操作弹窗、Toast、Loading 和振动反馈都限制在预览框内。
@@ -462,7 +477,7 @@ hb-sdk remote deploy --release-note "本次更新说明"
 
 右上角的桌面图标与二维码按钮使用相同样式。桌面图标只在该项目于 `package.json#heybox.platforms` 声明了桌面平台（`windows`、`macos` 或 `linux`）时展示，未声明桌面平台的项目不显示该入口。点击桌面图标后选择小黑盒正式版或 Debug 版，选择会立即请求客户端打开当前本地页面并在本地记忆，不需要二次确认。桌面端只接受无凭据的 `http://127.0.0.1:<port>`，拒绝 `localhost`、IPv6 和 LAN 地址，不提供地址选择或手工 URL；手机二维码继续独立选择局域网地址。入口在项目已绑定且本地调试启动票有效时可用，统一 URI 只携带 `mini_program_id` 和 `mini_url`，启动票继续由 detail 从同源 `launch.json` 发现并交给后端验证。浏览器无法确认客户端是否真正打开，因此调试台只记录“已请求打开”，不会自动切换正式版或 Debug 版。
 
-`hb-sdk dev` 在未登录、未绑定或远端不可用时仍启动 Browser Mock；真实手机/PC 入口须有有效启动票。CLI 自动从本地声明生成普通 `network` / `companion` 的临时批准缺口，不提供第二套权限开关或申请按钮。真实 Host 每次打开会话确认临时权限，拒绝后仍可按线上批准基线打开；官方域名始终只认声明与线上批准的交集。CLI 连续失联约 30 秒、期限或快照变化会销毁旧 Runtime，并清理临时 Companion 进程树；恢复后重新确认。手机验收统一从右上角二维码进入并选择可达的局域网网卡。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
+`hb-sdk dev` 在未登录、未绑定或远端不可用时仍启动 Browser Mock；真实手机/PC 入口须有有效启动票。CLI 自动从本地声明生成普通 `network` / `companion` 的临时批准缺口，不提供第二套权限开关或申请按钮。真实 Host 每次打开会话确认临时权限，拒绝后仍可按线上批准基线打开；官方域名始终只认声明与线上批准的交集。真机 Dev Session 的公开 `network.request()` 通过开发机的 HTTP 代理转发，因此 HTTPS `localhost` 指向开发机；代理不管理独立租约，不判断黑盒域名或改写应用层凭据。正式版本和 Runtime 私有请求仍走 Host 网络。CLI 连续失联约 30 秒、期限或快照变化会销毁旧 Runtime，并清理临时 Companion 进程树；恢复后重新确认。手机验收统一从右上角二维码进入并选择可达的局域网网卡。完整操作见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)，实现与安全边界由 [Runtime Host 迁移](./docs/runtime-host-migration.md) 维护。
 
 远端提交前需要完成 CLI 登录和小程序绑定。完整的登录、绑定、预览、版本与发布流程见 [CLI 指南](https://docs.xiaoheihe.cn/hb_sdk/guide/cli)。
 

package/dist/cli-chunks/{build-Dv5vWsBh.cjs → build-CT6E9KRd.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DR89buKQ.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-GH_vWEVx.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-DkTbgx4d.cjs');
-var index = require('./index-Dd_eGaDz.cjs');
-var projectVite = require('./project-vite-ckDtbYtt.cjs');
-require('./version-CJ7rfbl-.cjs');
+var runtimeGate = require('./runtime-gate-CNBf6Zkh.cjs');
+var index = require('./index-CYxcLlON.cjs');
+var projectVite = require('./project-vite-tMo1gavS.cjs');
+require('./version-DA6v9R62.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-B15FzPf9.cjs → context--dJRx4eH.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-DR89buKQ.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-GH_vWEVx.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-BiT-5VHK.cjs');
+var session = require('./session-DrhTp-x-.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);

package/dist/cli-chunks/{create-BtZUsxJd.cjs → create-D6SiqyyQ.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-Dd_eGaDz.cjs');
+var index = require('./index-CYxcLlON.cjs');
 require('node:module');
 require('os');
 require('node:crypto');

package/dist/cli-chunks/{dev-tAThflC6.cjs → dev-CoWE5lyA.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var context = require('./context-B15FzPf9.cjs');
+var context = require('./context--dJRx4eH.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-DR89buKQ.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-GH_vWEVx.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -12,13 +12,13 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-Dd_eGaDz.cjs');
+var index = require('./index-CYxcLlON.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
-var session = require('./session-BiT-5VHK.cjs');
+var session = require('./session-DrhTp-x-.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-ckDtbYtt.cjs');
-var version = require('./version-CJ7rfbl-.cjs');
+var projectVite = require('./project-vite-tMo1gavS.cjs');
+var version = require('./version-DA6v9R62.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1871,7 +1871,8 @@ function createMiniProgramDevShellOpenWindowPayload(appUrl, options) {
         protocol_type: 'openWindow',
         full_screen: true,
         mini_program: '1',
-        ...(miniProgramId ? { mini_program_id: miniProgramId } : {}),
+        // 保留既有调试入口字段，同时通过 user_miniprogram_id 传递用户小程序字符串 ID（UUID）；原生不会从 URL 补读。
+        ...(miniProgramId ? { mini_program_id: miniProgramId, user_miniprogram_id: miniProgramId } : {}),
         navigation_bar: { title: '' },
         webview: { url: devShellUrl, pull: false, refresh: false },
     };
@@ -1992,8 +1993,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-tAThflC6.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-tAThflC6.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CoWE5lyA.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CoWE5lyA.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -5065,9 +5066,9 @@ const DEFAULT_RUNTIME_SANITIZE_MAX_DEPTH = 6;
  */
 const DEFAULT_RUNTIME_SANITIZE_MAX_ARRAY_LENGTH = 50;
 /**
- * 默认最大字符串长度。
+ * 默认不限制字符串长度，避免截断诊断 JSON 或错误现场。
  */
-const DEFAULT_RUNTIME_SANITIZE_MAX_STRING_LENGTH = 2000;
+const DEFAULT_RUNTIME_SANITIZE_MAX_STRING_LENGTH = Number.POSITIVE_INFINITY;
 /**
  * 判断未知值是否为普通对象。
  *
@@ -9448,10 +9449,6 @@ const MAX_DEPTH = 6;
  * 最大数组长度。
  */
 const MAX_ARRAY_LENGTH = 50;
-/**
- * 最大字符串长度。
- */
-const MAX_STRING_LENGTH = 2000;
 /**
  * 安全序列化错误对象。
  *
@@ -9493,7 +9490,7 @@ function sanitizeTelemetryValue(value, key = '', depth = 0, seen = new WeakSet()
         return value;
     }
     if (typeof value === 'string') {
-        return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH)}...` : value;
+        return value;
     }
     if (typeof value === 'bigint') {
         return value.toString();
@@ -11092,7 +11089,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-Bw3R5BAL.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-07KOgDkI.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -14007,6 +14004,19 @@ function readHeyboxWebV4BrowserFingerprint() {
         }
     }
 }
+const signingBrowserFingerprints = new WeakMap();
+/** 默认签名在同一文档中复用环境种子，避免上下文异步释放期间再次大量创建 WebGL。 */
+function readSigningBrowserFingerprint() {
+    if (typeof document === 'undefined' || typeof navigator === 'undefined') {
+        return readHeyboxWebV4BrowserFingerprint();
+    }
+    const cached = signingBrowserFingerprints.get(document);
+    if (cached?.navigator === navigator)
+        return cached.value;
+    const value = readHeyboxWebV4BrowserFingerprint();
+    signingBrowserFingerprints.set(document, { navigator, value });
+    return value;
+}
 /**
  * 根据 pathname、时间和 nonce 计算 Web V4 hkey。
  *
@@ -14039,7 +14049,7 @@ function createHeyboxWebV4Params(pathname, options = {}) {
     const now = options.now?.() ?? Date.now();
     const time = Math.floor(now / 1000);
     const random = options.random?.() ?? Math.random();
-    const readFingerprint = options.browserFingerprint ?? readHeyboxWebV4BrowserFingerprint;
+    const readFingerprint = options.browserFingerprint ?? readSigningBrowserFingerprint;
     const fingerprint = readFingerprint();
     const nonceSeed = `${time + now}${random.toString()}${fingerprint}${fingerprint}`;
     const nonce = createMd5Hex(nonceSeed).toUpperCase();
@@ -15201,6 +15211,196 @@ function writeLaunchResponse(response, status, origin, body) {
     response.end(body ?? '');
 }
 
+// SDK/Runtime 限制 2 MiB 请求正文；JSON 转义最多放大 6 倍，另留 1 MiB 元数据预算。
+const MAX_REQUEST_ENVELOPE_BYTES = 2 * 1024 * 1024 * 6 + 1024 * 1024;
+const MAX_RESPONSE_BYTES = 32 * 1024 * 1024;
+const HOP_BY_HOP_HEADERS = new Set([
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+/** dev server 的 HTTP 转发入口，不读取小程序权限或管理代理租约。 */
+function createMiniProgramDevNetworkProxy(options) {
+    const controllers = new Set();
+    return {
+        async handle(request, response) {
+            const contextPath = options.readContextPath();
+            if (!contextPath || request.url !== `${contextPath}/network`)
+                return false;
+            if (request.method === 'OPTIONS') {
+                writeResponse(response, 204);
+                return true;
+            }
+            if (request.method !== 'POST') {
+                writeResponse(response, 405, { code: 'METHOD_NOT_ALLOWED' });
+                return true;
+            }
+            const scope = createBrowserDevHostRequestAbortScope(request, response);
+            const controller = new AbortController();
+            const abort = () => controller.abort();
+            scope.signal.addEventListener('abort', abort, { once: true });
+            if (scope.signal.aborted)
+                abort();
+            controllers.add(controller);
+            let timer;
+            try {
+                const payload = await readJsonRequestBody(request, {
+                    maxBytes: MAX_REQUEST_ENVELOPE_BYTES,
+                    destroyOnLimit: false,
+                });
+                if (!isRecord$2(payload) || typeof payload.url !== 'string') {
+                    throw createBrowserDevHostError(400, 'INVALID_REQUEST', '代理请求需要 URL');
+                }
+                let url;
+                try {
+                    url = new URL(payload.url);
+                }
+                catch {
+                    throw createBrowserDevHostError(400, 'INVALID_REQUEST', '代理请求 URL 无效');
+                }
+                if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+                    throw createBrowserDevHostError(400, 'INVALID_REQUEST', '代理只支持 HTTP(S)');
+                }
+                if (isRecord$2(payload.params)) {
+                    for (const [key, value] of Object.entries(payload.params)) {
+                        if (value !== null && value !== undefined)
+                            url.searchParams.set(key, String(value));
+                    }
+                }
+                const headers = stripHopByHopHeaders(new Headers(payload.headers));
+                // Node 根据实际目标与编码后的 body 生成传输头。
+                headers.delete('host');
+                headers.delete('content-length');
+                const method = typeof payload.method === 'string' ? payload.method.toUpperCase() : 'GET';
+                const body = encodeBody(method, payload.data, payload.bodyEncoding, headers);
+                const timeout = typeof payload.timeout === 'number' && Number.isFinite(payload.timeout) && payload.timeout > 0 ? payload.timeout : 10_000;
+                timer = setTimeout(abort, timeout);
+                const upstream = await options.fetchImpl(url.href, {
+                    body,
+                    headers,
+                    method,
+                    redirect: 'manual',
+                    signal: controller.signal,
+                });
+                const text = await readResponseText(upstream);
+                let data = text;
+                try {
+                    data = JSON.parse(text);
+                }
+                catch {
+                    /* 与真机 Native transport 一致，非 JSON 响应保留原文。 */
+                }
+                const responseHeaders = stripHopByHopHeaders(upstream.headers);
+                // fetch 已解压响应，原编码与长度不再描述返回的数据。
+                responseHeaders.delete('content-encoding');
+                responseHeaders.delete('content-length');
+                writeResponse(response, 200, {
+                    data,
+                    headers: Object.fromEntries(responseHeaders),
+                    status: upstream.status,
+                    statusText: upstream.statusText,
+                });
+            }
+            catch (error) {
+                if (!response.destroyed) {
+                    writeResponse(response, readBrowserDevHostErrorStatus(error), toBrowserDevHostErrorPayload(error));
+                }
+            }
+            finally {
+                clearTimeout(timer);
+                controllers.delete(controller);
+                scope.signal.removeEventListener('abort', abort);
+                scope.dispose();
+            }
+            return true;
+        },
+        close() {
+            for (const controller of controllers)
+                controller.abort();
+        },
+    };
+}
+function stripHopByHopHeaders(input) {
+    const headers = new Headers(input);
+    const connectionHeaders = headers
+        .get('connection')
+        ?.split(',')
+        .map((name) => name.trim()) ?? [];
+    for (const name of [...HOP_BY_HOP_HEADERS, ...connectionHeaders]) {
+        if (name)
+            headers.delete(name);
+    }
+    return headers;
+}
+function encodeBody(method, data, encoding, headers) {
+    if (data === undefined || method === 'GET' || method === 'HEAD')
+        return undefined;
+    if (typeof data === 'string')
+        return data;
+    if (encoding === 'form') {
+        const pairs = [];
+        const append = (key, value) => {
+            if (value === undefined)
+                return;
+            if (Array.isArray(value))
+                value.forEach((item) => append(key, item));
+            else if (isRecord$2(value))
+                Object.entries(value).forEach(([child, item]) => append(`${key}[${child}]`, item));
+            else
+                pairs.push([key, value === null ? '' : String(value)]);
+        };
+        if (isRecord$2(data) || Array.isArray(data))
+            Object.entries(data).forEach(([key, value]) => append(key, value));
+        if (!headers.has('content-type'))
+            headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');
+        const encode = (value) => encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+        return pairs.map(([key, value]) => `${encode(key)}=${encode(value)}`).join('&');
+    }
+    if (!headers.has('content-type'))
+        headers.set('content-type', 'application/json');
+    return JSON.stringify(data);
+}
+async function readResponseText(response) {
+    if (!response.body)
+        return '';
+    const chunks = [];
+    const reader = response.body.getReader();
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_RESPONSE_BYTES) {
+                await reader.cancel();
+                throw createBrowserDevHostError(502, 'RESPONSE_TOO_LARGE', '代理响应超过大小限制');
+            }
+            chunks.push(value);
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function writeResponse(response, status, body) {
+    response.writeHead(status, {
+        'access-control-allow-headers': 'content-type',
+        'access-control-allow-methods': 'POST, OPTIONS',
+        'access-control-allow-origin': '*',
+        'access-control-allow-private-network': 'true',
+        'cache-control': 'no-store',
+        'content-type': 'application/json; charset=utf-8',
+    });
+    response.end(body === undefined ? '' : JSON.stringify(body));
+}
+
 const DEFAULT_APP_PORT = 5173;
 const DEFAULT_BROWSER_DEV_HOST_PORT = 5174;
 const DEFAULT_DEV_CONTEXT_TIMEOUT_MS = 3000;
@@ -15494,7 +15694,13 @@ async function runDevCommand(options, runtime = {}) {
         runtimePermissions: launchRuntimePermissions,
         sdkVersion: version.HB_SDK_VERSION,
     });
+    const networkProxy = createMiniProgramDevNetworkProxy({
+        fetchImpl,
+        readContextPath: () => devContextPath,
+    });
     const launchPlugin = createMiniProgramDevLaunchVitePlugin(readLaunchSource, async (request, response) => {
+        if (await networkProxy.handle(request, response))
+            return true;
         if (request.url !== MINI_PROGRAM_DEV_LAUNCH_PATH || request.headers[COMPANION_ARTIFACT_ACCESS_TOKEN_HEADER] === undefined)
             return false;
         response.setHeader('Cache-Control', 'no-store');
@@ -15552,7 +15758,10 @@ async function runDevCommand(options, runtime = {}) {
         viteNetworkUrls: appServer.resolvedUrls?.network ?? [],
     });
     const lanAddresses = buildLanAddresses();
-    const closers = [() => appServer.close()];
+    const closers = [
+        () => networkProxy.close(),
+        () => appServer.close(),
+    ];
     let browserDevHost;
     try {
         browserDevHost = await runDevStartupTask(logger, '正在启动浏览器调试页服务', () => startBrowserDevHostServer({

package/dist/cli-chunks/{doctor-PE_MhGBX.cjs → doctor-IQ5wPkWD.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-Dd_eGaDz.cjs');
+var index = require('./index-CYxcLlON.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-Dd_eGaDz.cjs → index-CYxcLlON.cjs}

@@ -235,19 +235,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dd_eGaDz.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CYxcLlON.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dd_eGaDz.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CYxcLlON.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dd_eGaDz.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CYxcLlON.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dd_eGaDz.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CYxcLlON.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Dd_eGaDz.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CYxcLlON.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13554,7 +13554,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.0-alpha.0';
+const BUILT_CLI_VERSION = '0.9.0-alpha.10';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13913,39 +13913,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-5FPaFRi0.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BszmxuLI.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-5FPaFRi0.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BszmxuLI.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-5FPaFRi0.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BszmxuLI.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-Dv5vWsBh.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CT6E9KRd.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-BtZUsxJd.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-D6SiqyyQ.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-tAThflC6.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CoWE5lyA.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-PE_MhGBX.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-IQ5wPkWD.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-C5EoUf2T.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-NfC1c0iQ.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-DCHqFvmB.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-2oOP8M5C.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-CeA8xI0T.cjs → index-CnOLdO_-.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-Dd_eGaDz.cjs');
+var index$2 = require('./index-CYxcLlON.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-DR89buKQ.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-GH_vWEVx.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');