@heybox/hb-sdk 0.9.6-alpha.2 → 0.9.6-alpha.4

package/dist/devtools/browser-dev-host/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#f4f5f7" />
     <title>小程序工坊调试台</title>
-    <script type="module" crossorigin src="/assets/index--xK6G3mS.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-DwX62DHx.js">
+    <script type="module" crossorigin src="/assets/index-DNgaNjCW.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/desktop-app-launch-c9mxCZ3M.js">
     <link rel="stylesheet" crossorigin href="/assets/index-DSTlrpnQ.css">
   </head>
   <body>

package/dist/index.cjs.js

@@ -7509,7 +7509,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.6-alpha.2';
+    : '0.9.6-alpha.4';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/index.esm.js

@@ -7505,7 +7505,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.6-alpha.2';
+    : '0.9.6-alpha.4';
 
 const RUNTIME_MODES = new Set(['production', 'preview', 'development', 'unknown']);
 const OPERATING_SYSTEM_NAMES = new Set(['android', 'ios', 'ohos', 'windows', 'macos', 'linux', 'unknown']);

package/dist/vite.cjs.js

@@ -10329,7 +10329,7 @@ async function ensureBasicInfoDirectory(rootPath, relative) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.6-alpha.2';
+    : '0.9.6-alpha.4';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。
@@ -20359,7 +20359,7 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
         return serialize(document);
     }
     const connectSources = Array.from(new Set([
-        options.hmrWebSocketUrl,
+        ...(options.hmrWebSocketUrls ?? []),
         ...(options.deviceLogUploadUrls ?? []),
     ].filter((source) => Boolean(source))));
     const content = connectSources.length > 0
@@ -20674,14 +20674,15 @@ const devSnapshotStores = devSnapshotRegistry[devSnapshotStoreKey];
  *   转换 Vite 编译脚本的 JavaScript 语法，保留更旧的自定义目标，拒绝 `esbuild: false`；注入 SDK 构建版本，且仅
  *   `vite serve` 注入开发日志编译常量。语法转换不处理原样复制或远端加载的脚本，不包含运行时 API polyfill，
  *   也不会更新已发布旧产物；
- * - `configResolved`：确认插件唯一性，记录真实 `root`、`build.outDir`、`serve|build` 命令和精确 HMR
- *   WebSocket 地址，并再次确认生产环境的语法兼容目标；直接 `vite build` 使用该实际 `outDir`，
+ * - `configResolved`：确认插件唯一性，记录真实 `root`、`build.outDir`、`serve|build` 命令和 HMR
+ *   配置，并再次确认生产环境的语法兼容目标；直接 `vite build` 使用该实际 `outDir`，
  *   `hb-sdk build` 则由 CLI 固定为 `dist/`；
  * - `configureServer`：为 `hb-sdk dev` 注册设备日志、本地小程序 Manifest 与 Companion Manifest/ZIP
  *   中间件；敏感路由只接受数值 loopback socket/Host、`GET|HEAD` 和 CLI 注入的独立短期令牌，快照在
  *   配置重载时按 digest 保留，并在服务真正关闭时清理；
  * - `transformIndexHtml`：校验 HTML URL/标签策略，注入 Runtime Gate；默认注入平台 CSP，serve 时
- *   `connect-src` 只开放解析出的 HMR WebSocket，并额外注入调试日志 bootstrap；
+ *   `connect-src` 按实际监听入口与显式 HMR 配置放行精确 WebSocket 地址，关闭 HMR 时不添加该许可，
+ *   并额外注入调试日志 bootstrap；
  * - `buildEnd`：记住更早的 Rollup/Vite 错误，避免 `closeBundle` 的二次产物错误遮盖根因；
  * - `closeBundle`：serve 时直接完成；build 时复检最终 HTML，要求整个输出树只有根 `index.html`，再于
  *   `build.outDir` 写入 `manifest.json`，并把 Companion 目录打包成
@@ -20744,7 +20745,7 @@ function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
-    let hmrWebSocketUrl;
+    let resolvedConfig;
     let configuredDeviceLogUploadUrls = [];
     let devServer;
     let metadataWarningsShown = false;
@@ -20796,7 +20797,7 @@ function miniappManifest() {
                         environment.build.target = resolveMiniappBuildTargets(environment.build.target);
                 }
             }
-            hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
+            resolvedConfig = resolved;
             configuredDeviceLogUploadUrls = resolveConfiguredDeviceLogUploadUrls(resolved);
         },
         configureServer(server) {
@@ -21120,7 +21121,8 @@ function miniappManifest() {
                 ...(command === 'serve'
                     ? {
                         deviceLogUploadUrls: Array.from(new Set([...configuredDeviceLogUploadUrls, ...resolveViteDeviceLogUploadUrls(devServer?.resolvedUrls)])),
-                        hmrWebSocketUrl,
+                        // resolvedUrls 在 listen 后才包含实际端口与所有可访问网卡，不能在 configResolved 固化。
+                        hmrWebSocketUrls: resolveHmrWebSocketUrls(resolvedConfig, devServer),
                     }
                     : {}),
                 skipPlatformCsp,
@@ -21376,16 +21378,45 @@ function resolveSdkVersion() {
     }
     return packageJson.version;
 }
-function resolveHmrWebSocketUrl(resolved) {
+function resolveHmrWebSocketUrls(resolved, server) {
+    if (!resolved)
+        return [];
     const hmr = resolved.server.hmr;
     if (hmr === false)
-        return undefined;
+        return [];
     const options = typeof hmr === 'object' ? hmr : {};
-    const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
-    const configuredHost = options.host ?? resolved.server.host;
-    const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
-    const port = options.clientPort ?? options.port ?? resolved.server.port;
-    return `${protocol}://${host}${port ? `:${port}` : ''}`;
+    const urls = [...(server?.resolvedUrls?.local ?? []), ...(server?.resolvedUrls?.network ?? [])];
+    if (urls.length === 0) {
+        const configuredHost = resolved.server.host;
+        const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' && configuredHost !== '::'
+            ? configuredHost : '127.0.0.1';
+        const address = server?.httpServer?.address();
+        const port = address && typeof address !== 'string' ? address.port : resolved.server.port;
+        const url = createDeviceLogUploadUrl(resolved.server.https ? 'https' : 'http', host, port);
+        if (url)
+            urls.push(url);
+    }
+    return Array.from(new Set(urls.flatMap((url) => {
+        try {
+            const source = new URL(url);
+            if (source.protocol !== 'http:' && source.protocol !== 'https:')
+                return [];
+            const protocol = options.protocol || (source.protocol === 'https:' ? 'wss' : 'ws');
+            const host = options.host || source.hostname;
+            const normalizedHost = host.startsWith('[') || !host.includes(':') ? host : `[${host}]`;
+            // 与 Vite client 一致：显式 clientPort/port 优先，否则从加载入口推导。
+            const port = options.clientPort || options.port || source.port;
+            const endpoint = new URL(`${protocol}://${normalizedHost}${port ? `:${port}` : ''}`);
+            if (!['ws:', 'wss:'].includes(endpoint.protocol) || endpoint.hostname.includes('*')
+                || ['0.0.0.0', '[::]'].includes(endpoint.hostname) || endpoint.username || endpoint.password
+                || endpoint.pathname !== '/' || endpoint.search || endpoint.hash)
+                return [];
+            return [endpoint.origin];
+        }
+        catch {
+            return [];
+        }
+    })));
 }
 function resolveConfiguredDeviceLogUploadUrls(resolved) {
     if (resolved.command !== 'serve')

package/dist/vite.esm.js

@@ -10326,7 +10326,7 @@ async function ensureBasicInfoDirectory(rootPath, relative) {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.6-alpha.2';
+    : '0.9.6-alpha.4';
 
 /**
  * iframe 与调试台页面的开发期 console 捕获转发。
@@ -20356,7 +20356,7 @@ function enforceMiniappHtmlPolicy(html, options = {}) {
         return serialize(document);
     }
     const connectSources = Array.from(new Set([
-        options.hmrWebSocketUrl,
+        ...(options.hmrWebSocketUrls ?? []),
         ...(options.deviceLogUploadUrls ?? []),
     ].filter((source) => Boolean(source))));
     const content = connectSources.length > 0
@@ -20671,14 +20671,15 @@ const devSnapshotStores = devSnapshotRegistry[devSnapshotStoreKey];
  *   转换 Vite 编译脚本的 JavaScript 语法，保留更旧的自定义目标，拒绝 `esbuild: false`；注入 SDK 构建版本，且仅
  *   `vite serve` 注入开发日志编译常量。语法转换不处理原样复制或远端加载的脚本，不包含运行时 API polyfill，
  *   也不会更新已发布旧产物；
- * - `configResolved`：确认插件唯一性，记录真实 `root`、`build.outDir`、`serve|build` 命令和精确 HMR
- *   WebSocket 地址，并再次确认生产环境的语法兼容目标；直接 `vite build` 使用该实际 `outDir`，
+ * - `configResolved`：确认插件唯一性，记录真实 `root`、`build.outDir`、`serve|build` 命令和 HMR
+ *   配置，并再次确认生产环境的语法兼容目标；直接 `vite build` 使用该实际 `outDir`，
  *   `hb-sdk build` 则由 CLI 固定为 `dist/`；
  * - `configureServer`：为 `hb-sdk dev` 注册设备日志、本地小程序 Manifest 与 Companion Manifest/ZIP
  *   中间件；敏感路由只接受数值 loopback socket/Host、`GET|HEAD` 和 CLI 注入的独立短期令牌，快照在
  *   配置重载时按 digest 保留，并在服务真正关闭时清理；
  * - `transformIndexHtml`：校验 HTML URL/标签策略，注入 Runtime Gate；默认注入平台 CSP，serve 时
- *   `connect-src` 只开放解析出的 HMR WebSocket，并额外注入调试日志 bootstrap；
+ *   `connect-src` 按实际监听入口与显式 HMR 配置放行精确 WebSocket 地址，关闭 HMR 时不添加该许可，
+ *   并额外注入调试日志 bootstrap；
  * - `buildEnd`：记住更早的 Rollup/Vite 错误，避免 `closeBundle` 的二次产物错误遮盖根因；
  * - `closeBundle`：serve 时直接完成；build 时复检最终 HTML，要求整个输出树只有根 `index.html`，再于
  *   `build.outDir` 写入 `manifest.json`，并把 Companion 目录打包成
@@ -20741,7 +20742,7 @@ function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
-    let hmrWebSocketUrl;
+    let resolvedConfig;
     let configuredDeviceLogUploadUrls = [];
     let devServer;
     let metadataWarningsShown = false;
@@ -20793,7 +20794,7 @@ function miniappManifest() {
                         environment.build.target = resolveMiniappBuildTargets(environment.build.target);
                 }
             }
-            hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
+            resolvedConfig = resolved;
             configuredDeviceLogUploadUrls = resolveConfiguredDeviceLogUploadUrls(resolved);
         },
         configureServer(server) {
@@ -21117,7 +21118,8 @@ function miniappManifest() {
                 ...(command === 'serve'
                     ? {
                         deviceLogUploadUrls: Array.from(new Set([...configuredDeviceLogUploadUrls, ...resolveViteDeviceLogUploadUrls(devServer?.resolvedUrls)])),
-                        hmrWebSocketUrl,
+                        // resolvedUrls 在 listen 后才包含实际端口与所有可访问网卡，不能在 configResolved 固化。
+                        hmrWebSocketUrls: resolveHmrWebSocketUrls(resolvedConfig, devServer),
                     }
                     : {}),
                 skipPlatformCsp,
@@ -21373,16 +21375,45 @@ function resolveSdkVersion() {
     }
     return packageJson.version;
 }
-function resolveHmrWebSocketUrl(resolved) {
+function resolveHmrWebSocketUrls(resolved, server) {
+    if (!resolved)
+        return [];
     const hmr = resolved.server.hmr;
     if (hmr === false)
-        return undefined;
+        return [];
     const options = typeof hmr === 'object' ? hmr : {};
-    const protocol = options.protocol ?? (resolved.server.https ? 'wss' : 'ws');
-    const configuredHost = options.host ?? resolved.server.host;
-    const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' ? configuredHost : '127.0.0.1';
-    const port = options.clientPort ?? options.port ?? resolved.server.port;
-    return `${protocol}://${host}${port ? `:${port}` : ''}`;
+    const urls = [...(server?.resolvedUrls?.local ?? []), ...(server?.resolvedUrls?.network ?? [])];
+    if (urls.length === 0) {
+        const configuredHost = resolved.server.host;
+        const host = typeof configuredHost === 'string' && configuredHost !== '0.0.0.0' && configuredHost !== '::'
+            ? configuredHost : '127.0.0.1';
+        const address = server?.httpServer?.address();
+        const port = address && typeof address !== 'string' ? address.port : resolved.server.port;
+        const url = createDeviceLogUploadUrl(resolved.server.https ? 'https' : 'http', host, port);
+        if (url)
+            urls.push(url);
+    }
+    return Array.from(new Set(urls.flatMap((url) => {
+        try {
+            const source = new URL(url);
+            if (source.protocol !== 'http:' && source.protocol !== 'https:')
+                return [];
+            const protocol = options.protocol || (source.protocol === 'https:' ? 'wss' : 'ws');
+            const host = options.host || source.hostname;
+            const normalizedHost = host.startsWith('[') || !host.includes(':') ? host : `[${host}]`;
+            // 与 Vite client 一致：显式 clientPort/port 优先，否则从加载入口推导。
+            const port = options.clientPort || options.port || source.port;
+            const endpoint = new URL(`${protocol}://${normalizedHost}${port ? `:${port}` : ''}`);
+            if (!['ws:', 'wss:'].includes(endpoint.protocol) || endpoint.hostname.includes('*')
+                || ['0.0.0.0', '[::]'].includes(endpoint.hostname) || endpoint.username || endpoint.password
+                || endpoint.pathname !== '/' || endpoint.search || endpoint.hash)
+                return [];
+            return [endpoint.origin];
+        }
+        catch {
+            return [];
+        }
+    })));
 }
 function resolveConfiguredDeviceLogUploadUrls(resolved) {
     if (resolved.command !== 'serve')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.9.6-alpha.2",
+  "version": "0.9.6-alpha.4",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -77,7 +77,7 @@
     "undici": "^7.28.0",
     "ws": "^8.18.0",
     "sharp": "^0.34.5",
-    "@heybox/hb-sdk-protocol": "0.9.6-alpha.2"
+    "@heybox/hb-sdk-protocol": "0.9.6-alpha.4"
   },
   "peerDependencies": {
     "vite": ">=5"
@@ -129,13 +129,13 @@
     "vitest": "^3.2.4",
     "@ai-desktop/view-contract": "file:../hb-sdk-protocol/vendor/view-contract-2.2.2-6ac49bbf6410.tgz",
     "rollup-plugin-dts": "6.4.0",
+    "@heybox-domain/heybox-theme": "~0.1.0",
     "@heybox/hb-api": "~1.28.20",
+    "@heybox/hb-sdk-runtime": "~0.9.6-alpha.4",
     "@heybox-domain/heybox-vue3-ui": "~0.1.0",
-    "@heybox/hb-sdk-runtime": "~0.9.6-alpha.2",
-    "@heybox-domain/heybox-theme": "~0.1.0",
     "@heybox/runtime-policy": "~0.2.1",
-    "@heybox/runtime-transport-fetch": "~0.2.1",
-    "@heybox/runtime": "~0.2.1"
+    "@heybox/runtime": "~0.2.1",
+    "@heybox/runtime-transport-fetch": "~0.2.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skill/skill.json

@@ -1,15 +1,15 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.9.6-alpha.2+skill.fe3b525ecac8",
+  "skillVersion": "0.9.6-alpha.4+skill.fe3b525ecac8",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.9.6-alpha.2",
-    "compatibility": "0.9.6-alpha.2"
+    "version": "0.9.6-alpha.4",
+    "compatibility": "0.9.6-alpha.4"
   },
   "distribution": {
     "type": "npm",
     "package": "@heybox/hb-sdk",
-    "version": "0.9.6-alpha.2",
+    "version": "0.9.6-alpha.4",
     "path": "skill"
   },
   "integrity": "sha256-fe3b525ecac8431e1774ee453864cf9ba58ff6897272e2356ceb17b621c8c427"

package/types/vite/index.d.ts

@@ -201,14 +201,15 @@ declare const HB_SDK_MINI_PROGRAM_MANIFEST_ACCESS_TOKEN_ENV = "HB_SDK_MINI_PROGR
  *   转换 Vite 编译脚本的 JavaScript 语法，保留更旧的自定义目标，拒绝 `esbuild: false`；注入 SDK 构建版本，且仅
  *   `vite serve` 注入开发日志编译常量。语法转换不处理原样复制或远端加载的脚本，不包含运行时 API polyfill，
  *   也不会更新已发布旧产物；
- * - `configResolved`：确认插件唯一性，记录真实 `root`、`build.outDir`、`serve|build` 命令和精确 HMR
- *   WebSocket 地址，并再次确认生产环境的语法兼容目标；直接 `vite build` 使用该实际 `outDir`，
+ * - `configResolved`：确认插件唯一性，记录真实 `root`、`build.outDir`、`serve|build` 命令和 HMR
+ *   配置，并再次确认生产环境的语法兼容目标；直接 `vite build` 使用该实际 `outDir`，
  *   `hb-sdk build` 则由 CLI 固定为 `dist/`；
  * - `configureServer`：为 `hb-sdk dev` 注册设备日志、本地小程序 Manifest 与 Companion Manifest/ZIP
  *   中间件；敏感路由只接受数值 loopback socket/Host、`GET|HEAD` 和 CLI 注入的独立短期令牌，快照在
  *   配置重载时按 digest 保留，并在服务真正关闭时清理；
  * - `transformIndexHtml`：校验 HTML URL/标签策略，注入 Runtime Gate；默认注入平台 CSP，serve 时
- *   `connect-src` 只开放解析出的 HMR WebSocket，并额外注入调试日志 bootstrap；
+ *   `connect-src` 按实际监听入口与显式 HMR 配置放行精确 WebSocket 地址，关闭 HMR 时不添加该许可，
+ *   并额外注入调试日志 bootstrap；
  * - `buildEnd`：记住更早的 Rollup/Vite 错误，避免 `closeBundle` 的二次产物错误遮盖根因；
  * - `closeBundle`：serve 时直接完成；build 时复检最终 HTML，要求整个输出树只有根 `index.html`，再于
  *   `build.outDir` 写入 `manifest.json`，并把 Companion 目录打包成