@heybox/hb-sdk 0.6.7-alpha.2 → 0.6.8-alpha.0

package/dist/cli-chunks/{build-CQmYxfxm.cjs → build-BfhZ07Qv.cjs}

@@ -3,10 +3,10 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var index$1 = require('./index-BQm5XmMC.cjs');
-var runtimeGate = require('./runtime-gate-B2MQf1vc.cjs');
-var index = require('./index-CQnkS0Z8.cjs');
-var projectVite = require('./project-vite-D9_v57vp.cjs');
+var index$1 = require('./index-v4-6fbXX.cjs');
+var runtimeGate = require('./runtime-gate-DfMJQGH9.cjs');
+var index = require('./index-BMhV2-vd.cjs');
+var projectVite = require('./project-vite-WP6NzC3p.cjs');
 require('node:module');
 require('path');
 require('os');

package/dist/cli-chunks/{context-ChkYWwH_.cjs → context-CqoGNt7d.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var session = require('./session-BjtjhtPg.cjs');
-var index = require('./index-BQm5XmMC.cjs');
+var session = require('./session-9A8AY7YK.cjs');
+var index = require('./index-v4-6fbXX.cjs');
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');

package/dist/cli-chunks/{create-CC5r_8bL.cjs → create-us7swTbU.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-CQnkS0Z8.cjs');
+var index = require('./index-BMhV2-vd.cjs');
 require('node:module');
 require('os');
 require('readline');

package/dist/cli-chunks/{dev-CD-38TgO.cjs → dev-Bf49EoR8.cjs}

@@ -9,9 +9,9 @@ var node_http = require('node:http');
 var node_crypto = require('node:crypto');
 var undici = require('undici');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CQnkS0Z8.cjs');
-var projectVite = require('./project-vite-D9_v57vp.cjs');
-var context = require('./context-ChkYWwH_.cjs');
+var index = require('./index-BMhV2-vd.cjs');
+var projectVite = require('./project-vite-WP6NzC3p.cjs');
+var context = require('./context-CqoGNt7d.cjs');
 var fs$1 = require('node:fs/promises');
 require('node:process');
 require('node:buffer');
@@ -28,10 +28,10 @@ require('events');
 require('stream');
 require('buffer');
 require('util');
-require('./session-BjtjhtPg.cjs');
+require('./session-9A8AY7YK.cjs');
 require('fs');
 require('constants');
-require('./index-BQm5XmMC.cjs');
+require('./index-v4-6fbXX.cjs');
 
 class Locked extends Error {
 	constructor(port) {
@@ -1259,7 +1259,7 @@ function cloneDefaultPermissionState() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.2';
+    : '0.6.8-alpha.0';
 
 class DevPermissionOverrideStoreError extends Error {
     code;

package/dist/cli-chunks/{doctor-43yEfVr0.cjs → doctor-CzETlRvH.cjs}

@@ -4,7 +4,7 @@ var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-CQnkS0Z8.cjs');
+var index = require('./index-BMhV2-vd.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -33,7 +33,7 @@ async function runDoctorCommand(runtime = {}) {
 }
 async function getDoctorResult(runtime = {}) {
     const currentSdkVersion = await readCurrentSdkVersion(runtime.packageJsonFiles);
-    const localSkillJsonPath = resolveLocalSkillJsonPath(runtime);
+    const localSkillJsonPath = await resolveLocalSkillJsonPath(runtime);
     let remoteSkill;
     try {
         remoteSkill = await fetchRemoteSkill(runtime);
@@ -165,13 +165,31 @@ async function readCurrentSdkVersion(packageJsonCandidates = PACKAGE_JSON_CANDID
     }
     throw new Error('未能读取 @heybox/hb-sdk 当前版本号');
 }
-function resolveLocalSkillJsonPath(runtime) {
+async function resolveLocalSkillJsonPath(runtime) {
     if (runtime.localSkillJsonPath) {
         return runtime.localSkillJsonPath;
     }
+    const projectSkillJsonPath = await findProjectSkillJsonPath(runtime.cwd ?? process.cwd());
+    if (projectSkillJsonPath) {
+        return projectSkillJsonPath;
+    }
     const codexHome = runtime.codexHome ?? runtime.env?.CODEX_HOME ?? process.env.CODEX_HOME ?? path.join(os.homedir(), '.codex');
     return path.join(codexHome, 'skills', index.HB_SDK_SKILL_NAME, 'skill.json');
 }
+async function findProjectSkillJsonPath(startDir) {
+    let current = path.resolve(startDir);
+    while (true) {
+        const skillJsonPath = path.join(current, '.agents', 'skills', index.HB_SDK_SKILL_NAME, 'skill.json');
+        if ((await pathExists(path.join(current, 'package.json'))) && (await pathExists(skillJsonPath))) {
+            return skillJsonPath;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
 async function pathExists(filePath) {
     try {
         await fs.access(filePath, fs$1.constants.F_OK);

package/dist/cli-chunks/{index-CQnkS0Z8.cjs → index-BMhV2-vd.cjs}

@@ -234,19 +234,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BMhV2-vd.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BMhV2-vd.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BMhV2-vd.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BMhV2-vd.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-CQnkS0Z8.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BMhV2-vd.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13347,7 +13347,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.6.7-alpha.2';
+const BUILT_CLI_VERSION = '0.6.8-alpha.0';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13680,35 +13680,35 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BmisXAdp.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-Cb5ShNVQ.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BmisXAdp.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-Cb5ShNVQ.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BmisXAdp.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-Cb5ShNVQ.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-CQmYxfxm.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-BfhZ07Qv.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-CC5r_8bL.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-us7swTbU.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CD-38TgO.cjs'); });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-Bf49EoR8.cjs'); });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-43yEfVr0.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-CzETlRvH.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BXtT6M2f.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-Co84uKvV.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-BM6oH2Hs.cjs → index-Cd37cCQM.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-CQnkS0Z8.cjs');
+var index$2 = require('./index-BMhV2-vd.cjs');
 var require$$0$2 = require('fs');
 var require$$2$1 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$3 = require('assert');
 var require$$4$2 = require('events');
 var require$$1$1 = require('util');
-var index$3 = require('./index-BQm5XmMC.cjs');
+var index$3 = require('./index-v4-6fbXX.cjs');
 var require$$0$5 = require('net');
 var require$$0$4 = require('url');
 var require$$2$2 = require('http');

package/dist/cli-chunks/{index-BQm5XmMC.cjs → index-v4-6fbXX.cjs}

@@ -2839,18 +2839,45 @@ function getMiniappUploadKey(input) {
 }
 function validateUploadPaths(items, options) {
     const limit = options.maxLength;
+    const uploadKeys = new Set();
     for (const item of items) {
+        const relativePath = String(item.relativePath ?? '');
+        const normalizedRelativePath = normalizeRelativePath(relativePath);
+        const invalidReason = getInvalidUploadPathReason(normalizedRelativePath);
+        if (invalidReason) {
+            return `构建产物文件路径不合法（${invalidReason}）：${JSON.stringify(relativePath)}`;
+        }
         const key = getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
-            relativePath: item.relativePath,
+            relativePath: normalizedRelativePath,
         });
+        if (uploadKeys.has(key)) {
+            return `构建产物文件路径重复，无法上传到同一位置：${JSON.stringify(relativePath)}`;
+        }
+        uploadKeys.add(key);
         if (key.length > limit) {
-            return `文件路径过长，请缩短构建产物文件名或目录层级：${item.relativePath}`;
+            return `文件路径过长，请缩短构建产物文件名或目录层级：${relativePath}`;
         }
     }
     return undefined;
 }
+function getInvalidUploadPathReason(relativePath) {
+    const segments = relativePath.replace(/\\/g, '/').split('/');
+    if (segments.some((segment) => !segment)) {
+        return '包含空路径段';
+    }
+    if (segments.some((segment) => segment === '.')) {
+        return '包含当前目录';
+    }
+    if (segments.some((segment) => segment === '..')) {
+        return '包含上级目录';
+    }
+    if (/[\u0000-\u001F\u007F]/.test(relativePath)) {
+        return '包含控制字符';
+    }
+    return undefined;
+}
 function validateUploadTotalSize(items, options = {}) {
     const limit = options.limitBytes ?? MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES;
     const total = items.reduce((sum, item) => {

package/dist/cli-chunks/{login-BmisXAdp.cjs → login-Cb5ShNVQ.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-BjtjhtPg.cjs');
+var session = require('./session-9A8AY7YK.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-CQnkS0Z8.cjs');
+var index = require('./index-BMhV2-vd.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-D9_v57vp.cjs → project-vite-WP6NzC3p.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-CQnkS0Z8.cjs');
+var index = require('./index-BMhV2-vd.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-BXtT6M2f.cjs → remote-Co84uKvV.cjs}

@@ -1,15 +1,15 @@
 'use strict';
 
 var promises = require('node:readline/promises');
-var index = require('./index-CQnkS0Z8.cjs');
-var session = require('./session-BjtjhtPg.cjs');
+var index = require('./index-BMhV2-vd.cjs');
+var session = require('./session-9A8AY7YK.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
-var index$1 = require('./index-BQm5XmMC.cjs');
-var runtimeGate = require('./runtime-gate-B2MQf1vc.cjs');
-var context = require('./context-ChkYWwH_.cjs');
+var index$1 = require('./index-v4-6fbXX.cjs');
+var runtimeGate = require('./runtime-gate-DfMJQGH9.cjs');
+var context = require('./context-CqoGNt7d.cjs');
 require('node:module');
 require('path');
 require('os');
@@ -191,7 +191,7 @@ async function createDefaultCosClient(uploadToken) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-BM6oH2Hs.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-Cd37cCQM.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -342,12 +342,14 @@ async function runDeployCommand(options, runtime = {}) {
             autoPublish,
         }, runtime, apiBaseUrl, projectRoot, logger);
         const pm = detectPackageManager(projectRoot);
-        const buildMode = env.HB_SDK_ENV?.trim();
+        const platform = runtime.platform ?? process.platform;
+        const buildMode = validateBuildMode(env.HB_SDK_ENV?.trim(), platform);
         logger.info(`开始构建: ${pm} ${createBuildArgs(pm, buildMode).join(' ')}`);
         await runBuildScript(pm, projectRoot, runtime.spawn ?? childProcess.spawn, {
             env,
             mode: buildMode,
             outputMode: options.buildOutputMode ?? 'inherit',
+            platform,
             stderr: runtime.stderr,
         });
         logger.success('构建完成');
@@ -536,9 +538,14 @@ async function runBuildScript(pm, cwd, spawnImpl, options) {
     await new Promise((resolve, reject) => {
         const pipeStdoutToStderr = options.outputMode === 'stderr';
         const buildArgs = createBuildArgs(pm, options.mode);
-        const child = spawnImpl(pm, buildArgs, {
+        const isWindows = options.platform === 'win32';
+        const [executable, args] = isWindows
+            ? createWindowsBuildCommand(pm, buildArgs)
+            : [pm, buildArgs];
+        const child = spawnImpl(executable, args, {
             cwd,
             env: { ...process.env, ...options.env },
+            ...(isWindows ? { shell: false, windowsVerbatimArguments: true } : {}),
             stdio: pipeStdoutToStderr ? ['inherit', 'pipe', 'inherit'] : 'inherit',
         });
         if (pipeStdoutToStderr) {
@@ -557,6 +564,19 @@ async function runBuildScript(pm, cwd, spawnImpl, options) {
         });
     });
 }
+function createWindowsBuildCommand(pm, buildArgs) {
+    const command = `${pm}.cmd ${buildArgs.map(escapeWindowsCommandArgument).join(' ')}`;
+    return ['cmd.exe', ['/d', '/s', '/c', `"${command}"`]];
+}
+function validateBuildMode(mode, platform) {
+    if (platform === 'win32' && mode && !/^[A-Za-z0-9._-]+$/.test(mode)) {
+        throw new Error('Windows 下 HB_SDK_ENV 仅支持字母、数字、点、下划线和连字符');
+    }
+    return mode;
+}
+function escapeWindowsCommandArgument(argument) {
+    return `"${argument}"`;
+}
 function createBuildArgs(pm, mode) {
     return ['run', 'build', ...(mode ? [...(pm === 'npm' ? ['--'] : []), '--mode', mode] : [])];
 }

package/dist/cli-chunks/{runtime-gate-B2MQf1vc.cjs → runtime-gate-DfMJQGH9.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BQm5XmMC.cjs');
+var index = require('./index-v4-6fbXX.cjs');
 
 function isValidMiniappManifestVersion(version) {
     return getMiniappManifestVersionError(version) === undefined;

package/dist/cli-chunks/{session-BjtjhtPg.cjs → session-9A8AY7YK.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-CQnkS0Z8.cjs');
+var index = require('./index-BMhV2-vd.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-CQnkS0Z8.cjs');
+var index = require('./cli-chunks/index-BMhV2-vd.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');

package/dist/index.cjs.js

@@ -325,7 +325,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.2';
+    : '0.6.8-alpha.0';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/index.esm.js

@@ -321,7 +321,7 @@ function createMessageId() {
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.2';
+    : '0.6.8-alpha.0';
 
 /**
  * 判断未知数据是否符合小程序 bridge 消息信封。

package/dist/miniapp-publish.cjs.js

@@ -2863,18 +2863,45 @@ function getMiniappUploadKey(input) {
 }
 function validateUploadPaths(items, options) {
     const limit = options.maxLength ?? ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
+    const uploadKeys = new Set();
     for (const item of items) {
+        const relativePath = String(item.relativePath ?? '');
+        const normalizedRelativePath = normalizeRelativePath(relativePath);
+        const invalidReason = getInvalidUploadPathReason(normalizedRelativePath);
+        if (invalidReason) {
+            return `构建产物文件路径不合法（${invalidReason}）：${JSON.stringify(relativePath)}`;
+        }
         const key = getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
-            relativePath: item.relativePath,
+            relativePath: normalizedRelativePath,
         });
+        if (uploadKeys.has(key)) {
+            return `构建产物文件路径重复，无法上传到同一位置：${JSON.stringify(relativePath)}`;
+        }
+        uploadKeys.add(key);
         if (key.length > limit) {
-            return `文件路径过长，请缩短构建产物文件名或目录层级：${item.relativePath}`;
+            return `文件路径过长，请缩短构建产物文件名或目录层级：${relativePath}`;
         }
     }
     return undefined;
 }
+function getInvalidUploadPathReason(relativePath) {
+    const segments = relativePath.replace(/\\/g, '/').split('/');
+    if (segments.some((segment) => !segment)) {
+        return '包含空路径段';
+    }
+    if (segments.some((segment) => segment === '.')) {
+        return '包含当前目录';
+    }
+    if (segments.some((segment) => segment === '..')) {
+        return '包含上级目录';
+    }
+    if (/[\u0000-\u001F\u007F]/.test(relativePath)) {
+        return '包含控制字符';
+    }
+    return undefined;
+}
 function validateUploadTotalSize(items, options = {}) {
     const limit = options.limitBytes ?? MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES;
     const total = items.reduce((sum, item) => {

package/dist/miniapp-publish.esm.js

@@ -2861,18 +2861,45 @@ function getMiniappUploadKey(input) {
 }
 function validateUploadPaths(items, options) {
     const limit = options.maxLength ?? ACTIVITY_UPLOAD_KEY_MAX_LENGTH;
+    const uploadKeys = new Set();
     for (const item of items) {
+        const relativePath = String(item.relativePath ?? '');
+        const normalizedRelativePath = normalizeRelativePath(relativePath);
+        const invalidReason = getInvalidUploadPathReason(normalizedRelativePath);
+        if (invalidReason) {
+            return `构建产物文件路径不合法（${invalidReason}）：${JSON.stringify(relativePath)}`;
+        }
         const key = getMiniappUploadKey({
             miniProgramId: options.miniProgramId,
             version: options.version,
-            relativePath: item.relativePath,
+            relativePath: normalizedRelativePath,
         });
+        if (uploadKeys.has(key)) {
+            return `构建产物文件路径重复，无法上传到同一位置：${JSON.stringify(relativePath)}`;
+        }
+        uploadKeys.add(key);
         if (key.length > limit) {
-            return `文件路径过长，请缩短构建产物文件名或目录层级：${item.relativePath}`;
+            return `文件路径过长，请缩短构建产物文件名或目录层级：${relativePath}`;
         }
     }
     return undefined;
 }
+function getInvalidUploadPathReason(relativePath) {
+    const segments = relativePath.replace(/\\/g, '/').split('/');
+    if (segments.some((segment) => !segment)) {
+        return '包含空路径段';
+    }
+    if (segments.some((segment) => segment === '.')) {
+        return '包含当前目录';
+    }
+    if (segments.some((segment) => segment === '..')) {
+        return '包含上级目录';
+    }
+    if (/[\u0000-\u001F\u007F]/.test(relativePath)) {
+        return '包含控制字符';
+    }
+    return undefined;
+}
 function validateUploadTotalSize(items, options = {}) {
     const limit = options.limitBytes ?? MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES;
     const total = items.reduce((sum, item) => {

package/dist/vite.cjs.js

@@ -7,7 +7,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.2';
+    : '0.6.8-alpha.0';
 
 var re = {exports: {}};
 

package/dist/vite.esm.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.7-alpha.2';
+    : '0.6.8-alpha.0';
 
 var re = {exports: {}};
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.7-alpha.2",
+  "version": "0.6.8-alpha.0",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",
@@ -42,6 +42,8 @@
     "hb-sdk": "./bin/hb-sdk.cjs"
   },
   "files": [
+    "README.md",
+    "CHANGELOG.md",
     "bin",
     "dist",
     "skill",

package/skill/references/api-protocol.md

@@ -5,14 +5,12 @@
 ## Sources
 
 - packages/hb-sdk/src/protocol.ts
-- packages/hb-sdk/README.md
 - apps/docs/hb-sdk/reference/index.md
 
 ## Contents
 
 - [Host/runtime-only warning](#hostruntime-only-warning)
 - [Public protocol entrypoint](#public-protocol-entrypoint)
-- [Protocol context](#protocol-context)
 - [Generated reference index](#generated-reference-index)
 ## Host/runtime-only warning
 
@@ -191,14 +189,6 @@ export type {
 } from './modules/navigation';
 ```
 
-## Protocol context
-
-## SDK 与 Runtime
-
-`@heybox/hb-sdk` 跑在 iframe 内部，由外部小程序业务页面使用。`@heybox/hb-sdk-runtime` 跑在 iframe 外部，由黑盒宿主壳层使用，负责启动 iframe、注入 nonce、维护 bridge server、注册能力 handler、转发宿主生命周期与登录态变化。
-
-两者共享同一套 bridge 协议。协议字段、事件名或能力 payload 发生变化时，应按同一批次联动升级 SDK 与 runtime；不要只升级其中一侧后假定另一侧自动兼容。
-
 ## Generated reference index