fix: support network throttle bypass origins

[originalix]

Summary

• Add a public bypassUrlOrigins configuration to @onekeyfe/react-native-network-throttle.
• Exclude exact matching origins from latency, upload, and download throttling on iOS and Android.
• Publish 3.0.82-alpha.0 through the next npm dist-tag for OneKeyHQ/app-monorepo#12831.

Intent & Context

The host app's weak-network development setting should affect remote network requests without delaying Metro bundles and development assets. The native interception behavior belongs in this package rather than a patch-package override in the app repository.

Root Cause

The native interceptors treated every React Native HTTP(S) request as throttleable. When Metro served the JavaScript bundle or assets over HTTP, those local development resources received the same latency and bandwidth limits as remote API traffic.

Design Decisions

• Match a canonical scheme, host, and effective port instead of bypassing all localhost or private-network traffic.
• Register origins additively for the lifetime of the native process. The app's main and bg JavaScript runtimes initialize independently but use the same underlying native throttle state, so one runtime must not clear origins registered by the other.
• Return an empty origin list when new JavaScript runs against an older native binary, preserving native-vs-JS compatibility.
• Bypass all three throttle dimensions for matching requests: latency, upload throughput, and download throughput.

Changes Detail

• Extend the TypeScript config and normalize older native responses.
• Add thread-safe exact-origin registration and bypass checks to Android OkHttp interception.
• Add synchronized exact-origin registration and bypass checks to the iOS URL protocol.
• Document the process-level additive semantics and add public API tests.

Risk Assessment

• Risk Level: Medium
• Affected Platforms: iOS and Android
• Risk Areas: URL canonicalization, shared process state, and native-vs-JavaScript version skew.

Test plan

• Package Jest tests.
• Package ESLint.
• Package TypeScript check.
• Package build with React Native Builder Bob.
• Android compile from the consuming app with the published package.
• iOS target build from the consuming app with the published package.
• npm publish workflow: https://github.com/OneKeyHQ/app-modules/actions/runs/31492563399

[originalix]

P2: [Android bypass policy does not follow redirects]

When this URL redirects across origins, this check evaluates only the initial request. ThrottleInterceptor is installed as an OkHttp application interceptor, so chain.proceed() follows redirects without invoking this bypass check again.

As a result, a request starting on a bypassed origin can redirect to a non-bypassed origin and still skip all throttling; the reverse direction can keep throttling a bypassed target. Please evaluate the bypass set for each network exchange or redirect target, and cover redirects both into and out of bypassed origins.

[originalix]

Automated code review found blocking issues

@originalix

Reviewed commit dd06256523ce. This report always reflects the latest reviewed changes.

Review summary

The PR extends the React Native network-throttle configuration path with additive, process-lifetime HTTP(S) origin bypasses. JavaScript normalizes configuration returned by older native binaries, while iOS and Android canonicalize origins, store them in native shared state, expose them through the existing bridge, and consult them before applying latency or bandwidth throttling.

What needs attention: Correct Android redirect handling so every effective request origin receives the intended bypass decision, then cover cross-origin redirects with native behavior tests.

Issues to address

• P2 · Android bypass policy does not follow redirects
  • Impact: OkHttp application interceptors run once around a logical call, including redirects. Because the interceptor checks only the initial request URL, a request beginning on a bypassed origin can redirect to a non-bypassed origin and still avoid all throttling; the inverse path can continue throttling a bypassed target. This violates the exact-origin contract and differs from the redirect-aware iOS URL-loading path.
  • Suggested action: Evaluate the bypass set for each OkHttp network exchange or redirect target, and add tests for redirects both into and out of bypassed origins.

Validation gaps

git diff --check completed without errors. The targeted Jest, TypeScript, and lint commands could not execute because the workspace has no Yarn node_modules state file. The added tests cover JavaScript compatibility and forwarding, but there are no native tests for origin canonicalization, default ports, or cross-origin redirects.