✨ feat: 添加微信小程序调试工具和完整参数参考文档

.codex/skills/shz-pc-debug/references/authenticated-api.md

@@ -1,25 +1,25 @@
-# Protected API Calls in the Test Environment
+# 测试环境中的受保护接口调用
 
-## Use this workflow only when needed
+## 仅在需要时使用此流程
 
-Use this workflow only when the user explicitly asks to call a protected API and identifies the test role, endpoint, and purpose. Default to test endpoints and a read-only request. Require separate explicit user approval for any protected request that creates, updates, deletes, submits, publishes, or otherwise changes business data.
+只有当用户明确要求调用受保护接口，并说明测试角色、接口和用途时，才能使用此流程。默认使用测试接口和只读请求。任何会创建、更新、删除、提交、发布或以其他方式修改业务数据的受保护请求，都需要用户单独明确批准。
 
-## Obtain and handle the test Token
+## 获取和处理测试 Token
 
-1. Read [test-environment.md](test-environment.md) and select only the configured test account and role needed for the request.
-2. Locate the login request contract in project source or approved API documentation. Prefer source investigation over repeatedly opening Chrome DevTools.
-3. Perform a direct test-login request and capture its short-lived Token only into a process-scoped shell variable or equivalent in-memory credential store. Suppress login-response output that could reveal the Token.
-4. Use the Token only in the authorization header of the one or closely related user-requested test API calls. Do not request additional endpoints merely because the Token permits them.
-5. Clear the variable or in-memory credential immediately after the calls complete or fail.
+1. 阅读 [test-environment.md](test-environment.md)，只选择请求所需的已配置测试账号和角色。
+2. 在项目源代码或批准的 API 文档中定位登录请求契约。优先调查源代码，避免反复打开 Chrome DevTools。
+3. 直接发起测试登录请求，并且只将短生命周期 Token 保存到进程范围的 shell 变量或等效的内存凭据存储中。抑制可能泄露 Token 的登录响应输出。
+4. 只在用户请求的一个或一组密切相关的测试 API 调用的授权请求头中使用 Token。不得仅因为 Token 允许访问就请求额外接口。
+5. 请求成功或失败后立即清除变量或内存凭据。
 
-Never obtain a Token by reading browser cookies, local storage, session storage, or browser-exposed credentials. Never copy a Token from Chrome DevTools into another tool. Never print, log, persist, commit, screenshot, or report a Token or authorization header.
+不得通过读取浏览器 cookies、local storage、session storage 或浏览器暴露的凭据获取 Token。不得将 Token 从 Chrome DevTools 复制到其他工具。不得打印、记录、持久化、提交、截图或报告 Token 或授权请求头。
 
-## Choose the right tool
+## 选择正确的工具
 
-- Use Chrome DevTools for page interaction, DOM/UI failures, one representative request when the browser contract is unknown, and final visual verification.
-- Use a narrow direct HTTP client for the explicitly requested protected API call after the endpoint and contract are known. This avoids the overhead of repeatedly driving Chrome DevTools.
-- Do not use page JavaScript to make direct API requests or to access credentials.
+- 使用 Chrome DevTools 进行页面交互、DOM/UI 故障检查、浏览器契约未知时的一个代表性请求捕获以及最终视觉验证。
+- 在已知接口和契约后，使用范围狭窄的直接 HTTP 客户端调用用户明确要求的受保护接口，避免反复驱动 Chrome DevTools 的开销。
+- 不得使用页面 JavaScript 直接发起 API 请求或访问凭据。
 
-## Report safely
+## 安全报告
 
-Report the test environment, selected role, endpoint path, HTTP method, status code, duration, and a redacted response summary. Omit the login payload, Token, authorization header, cookies, and personally identifiable fields not needed to establish the result.
+报告测试环境、所选角色、接口路径、HTTP 方法、状态码、耗时以及脱敏后的响应摘要。省略登录负载、Token、授权请求头、cookies 以及与证明结果无关的个人身份信息。