@heybox/hb-sdk 0.8.1-alpha.3 → 0.8.1-alpha.7

package/dist/cli-chunks/{runtime-permission-env-XAZFauvZ.cjs → runtime-permission-env-BN43V7d0.cjs}

@@ -2,7 +2,8 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version = require('./version-BGzCIQhE.cjs');
+var version = require('./version-DbDVL6vm.cjs');
+require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
 var re = {exports: {}};
@@ -2799,6 +2800,7 @@ const MINI_PROGRAM_PERMISSION_KEYS = [
     'clipboard',
     'leaderboard',
     'network',
+    'companion',
 ];
 const MINI_PROGRAM_PERMISSION_CATALOG = [
     {
@@ -2911,6 +2913,29 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         methods: ['network.request', 'network.download'],
         conditions: ['声明后仍需平台批准，并继续执行网络安全策略。'],
     },
+    {
+        key: 'companion',
+        name: '桌面辅助应用',
+        description: '下载、准备并运行随当前小程序版本发布的受管桌面程序。',
+        access: 'platform-approval',
+        risk: 'high',
+        config: {},
+        methods: [
+            'companion.getInfo',
+            'companion.getPreparationStatus',
+            'companion.prepare',
+            'companion.cancelPreparation',
+            'companion.getActiveSession',
+            'companion.launch',
+            'companion.session.write',
+            'companion.session.closeStdin',
+            'companion.session.terminate',
+            'companion.session.ackOutput',
+            'companion.openAttachment',
+            'companion.showNotification',
+        ],
+        conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
+    },
 ];
 new Set(MINI_PROGRAM_PERMISSION_KEYS);
 
@@ -2919,7 +2944,7 @@ function isManagedMiniProgramRuntimePermissionKey(key) {
     return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
 }
 function parseMiniProgramRuntimePermissions(snapshot) {
-    if (!isRecord$2(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
+    if (!isRecord$4(snapshot) || snapshot.schema_version !== 1 || !Array.isArray(snapshot.entries)) {
         return { valid: false, permissions: {} };
     }
     if (snapshot.revision !== undefined && (typeof snapshot.revision !== 'number' || !Number.isInteger(snapshot.revision) || snapshot.revision < 0)) {
@@ -2928,7 +2953,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
     const seenKeys = new Set();
     const permissions = {};
     for (const rawEntry of snapshot.entries) {
-        if (!isRecord$2(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
+        if (!isRecord$4(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
             return { valid: false, permissions: {} };
         }
         const inputKey = rawEntry.key.trim();
@@ -2938,13 +2963,13 @@ function parseMiniProgramRuntimePermissions(snapshot) {
         }
         seenKeys.add(key);
         if (!isManagedMiniProgramRuntimePermissionKey(key)) {
-            if (!isRecord$2(rawEntry.config))
-                return { valid: false, permissions: {} };
+            // 未知权限必须忽略，不能让 config:null / 缺字段把已认识的批准一起否掉。
+            // 服务端会对无 config 的 message 字段输出 null（Rylai EmitUnpopulated）。
             continue;
         }
         if (key === 'network') {
             const config = rawEntry.config;
-            if (!isRecord$2(config) || typeof config.useOfficialDomain !== 'boolean') {
+            if (!isRecord$4(config) || typeof config.useOfficialDomain !== 'boolean') {
                 return { valid: false, permissions: {} };
             }
             permissions[key] = {
@@ -2954,7 +2979,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
             };
             continue;
         }
-        if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord$2(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
+        if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord$4(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
             return { valid: false, permissions: {} };
         }
         permissions[key] = {
@@ -2965,7 +2990,7 @@ function parseMiniProgramRuntimePermissions(snapshot) {
     }
     return { valid: true, permissions };
 }
-function isRecord$2(value) {
+function isRecord$4(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
@@ -2978,7 +3003,7 @@ function parseMiniappPermissions(value, options) {
         }
         return { declared: false };
     }
-    if (!isRecord$1(value)) {
+    if (!isRecord$3(value)) {
         throw new Error(`${sourceLabel} 必须是 JSON 对象`);
     }
     const knownKeys = new Set(MINIAPP_PERMISSION_KEYS);
@@ -2992,7 +3017,7 @@ function parseMiniappPermissions(value, options) {
             continue;
         const declaration = value[key];
         const itemLabel = `${sourceLabel}.${key}`;
-        if (!isRecord$1(declaration))
+        if (!isRecord$3(declaration))
             throw new Error(`${itemLabel} 必须是 JSON 对象`);
         const definition = MINI_PROGRAM_PERMISSION_CATALOG.find((item) => item.key === key);
         if (!definition)
@@ -3028,7 +3053,7 @@ function getMissingPermissionsWarning(sourceLabel = 'package.json#heybox.permiss
 }
 function composeMiniappRuntimePermissions(local, approvals) {
     const parsedApprovals = parseMiniProgramRuntimePermissions(approvals);
-    const approvalRevision = isRecord$1(approvals) && Number.isInteger(approvals.revision) ? approvals.revision : undefined;
+    const approvalRevision = isRecord$3(approvals) && Number.isInteger(approvals.revision) ? approvals.revision : undefined;
     const views = [];
     const entries = [];
     for (const definition of MINI_PROGRAM_PERMISSION_CATALOG) {
@@ -3042,9 +3067,22 @@ function composeMiniappRuntimePermissions(local, approvals) {
         }
         const approval = parsedApprovals.valid ? parsedApprovals.permissions[definition.key] : undefined;
         const approved = approval?.status === 'enabled';
+        const effective = declared && approved;
+        if (definition.key !== 'network') {
+            views.push({
+                key: definition.key,
+                access: definition.access,
+                declared,
+                approved,
+                effective,
+            });
+            if (declared) {
+                entries.push({ key: definition.key, status: effective ? 'enabled' : 'disabled', config: {} });
+            }
+            continue;
+        }
         const requestedOfficialDomain = declaration?.enabled === true && 'useOfficialDomain' in declaration && declaration.useOfficialDomain;
         const approvedOfficialDomain = approval?.config.useOfficialDomain === true;
-        const effective = declared && approved;
         const effectiveOfficialDomain = effective && (local.declared ? requestedOfficialDomain : true) && approvedOfficialDomain;
         views.push({
             key: definition.key,
@@ -3065,7 +3103,7 @@ function composeMiniappRuntimePermissions(local, approvals) {
         views,
     };
 }
-function isRecord$1(value) {
+function isRecord$3(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
@@ -3106,13 +3144,69 @@ function validateMiniappManifestForDeploy(manifest) {
         sdkVersion,
         sourceLabel: 'manifest.permissions',
     });
+    const companions = validateGeneratedCompanions(manifest.companions);
     return {
         version,
         sdkVersion,
         platforms: validateMiniappPlatforms(manifest.platforms, 'manifest.platforms'),
         ...(permissions.permissions === undefined ? {} : { permissions: permissions.permissions }),
+        ...(companions === undefined ? {} : { companions }),
     };
 }
+function validateGeneratedCompanions(value) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord$2(value) || Object.keys(value).length === 0)
+        throw new Error('manifest.companions 必须是非空对象');
+    for (const [alias, definition] of Object.entries(value)) {
+        if (!/^[a-z][a-z0-9-]{0,31}$/.test(alias) ||
+            !isRecord$2(definition) ||
+            typeof definition.displayName !== 'string' ||
+            !definition.displayName ||
+            Array.from(definition.displayName).length > 120 ||
+            !Array.isArray(definition.capabilities) ||
+            definition.capabilities.some((capability) => capability !== 'stdio' && capability !== 'attachments' && capability !== 'notifications') ||
+            new Set(definition.capabilities).size !== definition.capabilities.length ||
+            !isRecord$2(definition.targets) ||
+            Object.keys(definition.targets).length === 0)
+            throw new Error(`manifest.companions.${alias} 不合法`);
+        for (const [target, artifact] of Object.entries(definition.targets)) {
+            if (isRecord$2(artifact) && artifact.elevation === 'required') {
+                throw new Error(`manifest.companions.${alias}.targets.${target}.elevation V1 仅支持 none，暂不支持管理员权限启动`);
+            }
+            if ((target !== 'windows-x64' && target !== 'macos-arm64') ||
+                !isRecord$2(artifact) ||
+                artifact.path !== `companions/${alias}/${target}.zip` ||
+                !Number.isSafeInteger(artifact.size) ||
+                Number(artifact.size) <= 0 ||
+                typeof artifact.sha256 !== 'string' ||
+                !/^[a-f0-9]{64}$/.test(artifact.sha256) ||
+                !isRecord$2(artifact.entrypoint) ||
+                (artifact.entrypoint.kind !== 'executable' && artifact.entrypoint.kind !== 'app-bundle') ||
+                typeof artifact.entrypoint.path !== 'string' ||
+                !artifact.entrypoint.path ||
+                artifact.elevation !== 'none' ||
+                !isValidGeneratedCompanionArgs(artifact.args)) {
+                throw new Error(`manifest.companions.${alias}.targets.${target} 不合法`);
+            }
+        }
+    }
+    return value;
+}
+function isValidGeneratedCompanionArgs(value) {
+    if (!Array.isArray(value) || value.length > 64)
+        return false;
+    let totalBytes = 0;
+    for (const arg of value) {
+        if (typeof arg !== 'string' || /[\u0000\r\n]/.test(arg))
+            return false;
+        const bytes = Buffer.byteLength(arg, 'utf8');
+        if (bytes > 1024)
+            return false;
+        totalBytes += bytes;
+    }
+    return totalBytes <= 16_384;
+}
 function validateMiniappPlatforms(platforms, sourceLabel = 'platforms') {
     if (!Array.isArray(platforms) || platforms.length === 0) {
         throw new Error(`${sourceLabel} 必须是非空平台数组`);
@@ -3147,6 +3241,9 @@ function validateSdkVersion(version, sourceLabel = 'sdkVersion') {
 function isManifestRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function isRecord$2(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 function getMiniappManifestVersionError(version) {
     if (typeof version !== 'string' || version.trim() === '') {
         return `必须是合法 SemVer：${String(version)}`;
@@ -3178,6 +3275,8 @@ const MINIAPP_UPLOAD_SCOPE = 'activity';
 const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES = 100 * 1024 * 1024;
+/** Phase 0 尚未冻结；当前仅作为可单点替换、可测试的保守临时上限。 */
+const MINIAPP_COMPANION_UPLOAD_TEMPORARY_SIZE_LIMIT_BYTES = 2 * 1024 * 1024 * 1024;
 const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = '/mall/developer/user_miniprogram/access_status';
 const DEVELOPER_ENTITY_LIST_API_PATH = '/mall/developer/entity/list';
 const DEVELOPER_ENTITY_SWITCH_API_PATH = '/mall/developer/entity/switch';
@@ -3237,6 +3336,18 @@ function validateUploadTotalSize(items, options = {}) {
     }
     return undefined;
 }
+function validateMiniappUploadSizeBudgets(items, options = {}) {
+    const companionItems = items.filter((item) => normalizeRelativePath(item.relativePath).startsWith('companions/'));
+    const webItems = items.filter((item) => !normalizeRelativePath(item.relativePath).startsWith('companions/'));
+    const webError = validateUploadTotalSize(webItems, { limitBytes: options.webLimitBytes ?? MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES });
+    if (webError)
+        return webError;
+    const companionTotal = companionItems.reduce((sum, item) => sum + (Number.isFinite(item.size) && item.size > 0 ? item.size : 0), 0);
+    const companionLimit = options.companionLimitBytes ?? MINIAPP_COMPANION_UPLOAD_TEMPORARY_SIZE_LIMIT_BYTES;
+    if (companionTotal > companionLimit)
+        return 'Companion 归档总大小超过当前 2GiB 临时上限，请缩减归档后重新 deploy';
+    return undefined;
+}
 function shouldUploadDistFile(relativePath) {
     const normalized = normalizeRelativePath(relativePath);
     if (!normalized) {
@@ -3335,6 +3446,7 @@ function resolveMiniappUploadSessionFiles(localFiles, serverFiles, uploadedKeys)
     }
     const mappings = new Map();
     const serverSizes = new Map();
+    const serverHashes = new Map();
     const knownKeys = new Set();
     for (const serverFile of serverFiles) {
         const relativePath = normalizeMiniappArtifactRelativePath(serverFile.relative_path);
@@ -3352,8 +3464,13 @@ function resolveMiniappUploadSessionFiles(localFiles, serverFiles, uploadedKeys)
         if (!Number.isSafeInteger(size) || size < 0) {
             throw new Error(`上传会话返回文件大小异常：${relativePath}`);
         }
+        const sha256 = String(serverFile.sha256 || '');
+        if (!/^[a-f0-9]{64}$/.test(sha256)) {
+            throw new Error(`上传会话返回文件 SHA-256 异常：${relativePath}`);
+        }
         mappings.set(relativePath, key);
         serverSizes.set(relativePath, size);
+        serverHashes.set(relativePath, sha256);
         knownKeys.add(key);
     }
     const files = preparedFiles.map((file) => {
@@ -3364,6 +3481,9 @@ function resolveMiniappUploadSessionFiles(localFiles, serverFiles, uploadedKeys)
         if (serverSizes.get(file.relativePath) !== file.size) {
             throw new Error(`上传会话文件大小与本地构建不一致：${file.relativePath}`);
         }
+        if (!('sha256' in file) || serverHashes.get(file.relativePath) !== file.sha256) {
+            throw new Error(`上传会话文件 SHA-256 与本地构建不一致：${file.relativePath}`);
+        }
         return { file, key };
     });
     const completed = new Set();
@@ -3380,6 +3500,41 @@ function resolveMiniappUploadSessionFiles(localFiles, serverFiles, uploadedKeys)
         uploadedKeys: [...completed],
     };
 }
+/** 校验 Manifest 中所有 Companion 归档都精确属于当前上传 receipt。 */
+function validateMiniappCompanionFileReceipts(companions, files) {
+    const companionFiles = new Map(files.filter((file) => file.relativePath.startsWith('companions/')).map((file) => [file.relativePath, file]));
+    if (companions === undefined) {
+        if (companionFiles.size > 0)
+            throw new Error('dist 包含未被 manifest.companions 引用的 Companion 归档');
+        return;
+    }
+    if (!isRecord$1(companions))
+        throw new Error('manifest.companions 必须是对象');
+    const referenced = new Set();
+    for (const definition of Object.values(companions)) {
+        if (!isRecord$1(definition) || !isRecord$1(definition.targets))
+            throw new Error('manifest.companions targets 不合法');
+        for (const artifact of Object.values(definition.targets)) {
+            if (!isRecord$1(artifact) || typeof artifact.path !== 'string' || typeof artifact.size !== 'number' || typeof artifact.sha256 !== 'string') {
+                throw new Error('manifest.companions artifact 不合法');
+            }
+            const file = companionFiles.get(artifact.path);
+            if (!file)
+                throw new Error(`manifest.companions 引用的归档不在当前上传 receipt：${artifact.path}`);
+            if (file.size !== artifact.size)
+                throw new Error(`Companion 归档大小与 manifest 不一致：${artifact.path}`);
+            if (file.sha256 !== artifact.sha256)
+                throw new Error(`Companion 归档 SHA-256 与 manifest 不一致：${artifact.path}`);
+            referenced.add(artifact.path);
+        }
+    }
+    const extra = [...companionFiles.keys()].find((relativePath) => !referenced.has(relativePath));
+    if (extra)
+        throw new Error(`Companion 归档未被 manifest.companions 引用：${extra}`);
+}
+function isRecord$1(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 function normalizeMiniappArtifactRelativePath(relativePath) {
     const value = String(relativePath || '');
     if (!value) {
@@ -3502,10 +3657,12 @@ function readMiniappPackageJson(root, requireVersion) {
     catch (error) {
         throw new Error(`@heybox/hb-sdk 解析 package.json 失败：${formatReason(error)}`);
     }
-    return { packageJson, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
+    return { packageJson, packageJsonPath, version: typeof packageJson.version === 'string' ? packageJson.version.trim() : '' };
 }
 function readMiniappHeyboxConfig(packageJson) {
-    if (packageJson.heybox !== undefined && !isRecord(packageJson.heybox)) {
+    if (packageJson.heybox === undefined)
+        return undefined;
+    if (!isRecord(packageJson.heybox)) {
         throw new Error('@heybox/hb-sdk 提示：package.json#heybox 必须是 JSON 对象');
     }
     return packageJson.heybox;
@@ -3520,6 +3677,13 @@ function formatReason(error) {
     return String(error);
 }
 
+Array.from({ length: 256 }, (_, value) => {
+    let crc = value;
+    for (let bit = 0; bit < 8; bit++)
+        crc = (crc >>> 1) ^ ((crc & 1) ? 0xedb88320 : 0);
+    return crc >>> 0;
+});
+
 const HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN_ENV = 'HB_SDK_RUNTIME_USE_OFFICIAL_DOMAIN';
 const HB_SDK_RUNTIME_PERMISSION_CONTEXT_ENV = 'HB_SDK_RUNTIME_PERMISSION_CONTEXT';
 const VERIFIED_RUNTIME_PERMISSION_CONTEXT = 'verified';
@@ -3630,7 +3794,8 @@ exports.resolveMiniappSdkVersion = resolveMiniappSdkVersion;
 exports.resolveMiniappUploadSessionFiles = resolveMiniappUploadSessionFiles;
 exports.shouldSkipMiniappPlatformCspFromEnv = shouldSkipMiniappPlatformCspFromEnv;
 exports.shouldUploadDistFile = shouldUploadDistFile;
+exports.validateMiniappCompanionFileReceipts = validateMiniappCompanionFileReceipts;
 exports.validateMiniappManifestForDeploy = validateMiniappManifestForDeploy;
 exports.validateMiniappUploadPathLengths = validateMiniappUploadPathLengths;
-exports.validateUploadTotalSize = validateUploadTotalSize;
+exports.validateMiniappUploadSizeBudgets = validateMiniappUploadSizeBudgets;
 exports.withMiniappPlatformCspEnv = withMiniappPlatformCspEnv;

package/dist/cli-chunks/{session-BnoHxzFq.cjs → session-C1R_39si.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-DCJN-V1y.cjs');
+var index = require('./index-zNpZDWhc.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli-chunks/{skill-CDEJtATn.cjs → skill-CVXOE5jH.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
+var version = require('./version-DbDVL6vm.cjs');
+var fs = require('node:fs/promises');
 var path = require('node:path');
-var version = require('./version-BGzCIQhE.cjs');
 var childProcess = require('node:child_process');
-var fs = require('node:fs/promises');
-var index = require('./index-DCJN-V1y.cjs');
+var index = require('./index-zNpZDWhc.cjs');
 require('node:module');
 require('node:fs');
 require('path');
@@ -17,26 +17,6 @@ require('stream');
 require('buffer');
 require('util');
 
-function installSkill(options) {
-    const binary = require.resolve('skills/bin/cli.mjs');
-    const args = ['add', path.join(options.packageRoot, 'skill'), '--copy'];
-    if (options.global)
-        args.push('--global');
-    if (options.allAgents)
-        args.push('--agent', '*');
-    else if (options.agents?.length)
-        args.push('--agent', ...options.agents);
-    if (options.force)
-        args.push('--force');
-    const env = { ...process.env, ...options.env, DISABLE_TELEMETRY: '1', DO_NOT_TRACK: '1' };
-    const run = options.spawnImpl ?? childProcess.spawn;
-    return new Promise((resolve, reject) => {
-        const child = run(process.execPath, [binary, ...args], { cwd: options.cwd, env, stdio: 'inherit' });
-        child.on('error', reject);
-        child.on('close', (code) => resolve({ code: code ?? 1 }));
-    });
-}
-
 async function findProjectPackageJson(cwd = process.cwd()) {
     let current = path.resolve(cwd);
     while (true) {
@@ -45,7 +25,45 @@ async function findProjectPackageJson(cwd = process.cwd()) {
             await fs.access(candidate);
             return candidate;
         }
-        catch { /* continue */ }
+        catch {
+            /* continue */
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function findSdkPackageRoot(startDir) {
+    let current = path.resolve(startDir);
+    while (true) {
+        const candidate = path.join(current, 'package.json');
+        try {
+            const pkg = JSON.parse(await fs.readFile(candidate, 'utf8'));
+            if (pkg.name === '@heybox/hb-sdk')
+                return current;
+        }
+        catch {
+            /* continue */
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function readInstalledProjectSdkVersion(projectPackageJson) {
+    let current = path.dirname(projectPackageJson);
+    while (true) {
+        const candidate = path.join(current, 'node_modules', '@heybox', 'hb-sdk', 'package.json');
+        try {
+            const pkg = JSON.parse(await fs.readFile(candidate, 'utf8'));
+            if (pkg.name === '@heybox/hb-sdk' && typeof pkg.version === 'string' && pkg.version)
+                return pkg.version;
+        }
+        catch {
+            /* continue */
+        }
         const parent = path.dirname(current);
         if (parent === current)
             return undefined;
@@ -60,20 +78,58 @@ async function verifyProjectSdk(cwd, version) {
     const declared = pkg.dependencies?.['@heybox/hb-sdk'] ?? pkg.devDependencies?.['@heybox/hb-sdk'];
     if (!declared)
         throw new Error('项目缺少 @heybox/hb-sdk 依赖');
-    if (declared !== version && !String(declared).includes(version)) {
+    const declaredVersion = String(declared);
+    if (declaredVersion.startsWith('workspace:')) {
+        const installedVersion = await readInstalledProjectSdkVersion(file);
+        if (installedVersion === version)
+            return;
+        if (installedVersion) {
+            throw new Error(`项目 @heybox/hb-sdk 版本 ${declaredVersion}（实际 ${installedVersion}）与 CLI ${version} 不一致`);
+        }
+    }
+    if (declared !== version && !declaredVersion.includes(version)) {
         throw new Error(`项目 @heybox/hb-sdk 版本 ${declared} 与 CLI ${version} 不一致`);
     }
 }
 
+function installSkill(options) {
+    const binary = require.resolve('skills/bin/cli.mjs');
+    const args = ['add', path.join(options.packageRoot, 'skill'), '--copy'];
+    if (options.global)
+        args.push('--global');
+    if (options.allAgents)
+        args.push('--agent', '*');
+    else if (options.agents?.length)
+        args.push('--agent', ...options.agents);
+    if (options.force)
+        args.push('--force');
+    const env = { ...process.env, ...options.env, DISABLE_TELEMETRY: '1', DO_NOT_TRACK: '1' };
+    const run = options.spawnImpl ?? childProcess.spawn;
+    return new Promise((resolve, reject) => {
+        const child = run(process.execPath, [binary, ...args], { cwd: options.cwd, env, stdio: 'inherit' });
+        child.on('error', reject);
+        child.on('close', (code) => resolve({ code: code ?? 1 }));
+    });
+}
+
 async function runSkillInstallCommand(options = {}) {
     if (options.agent?.length && options.allAgents)
         throw new Error('--agent 与 --all-agents 互斥');
     const logger = options.logger ?? index.createCliLogger();
-    const packageRoot = options.packageRoot ?? path.resolve(__dirname, '../../..');
+    const packageRoot = options.packageRoot ?? (await findSdkPackageRoot(__dirname));
+    if (!packageRoot)
+        throw new Error('未找到 @heybox/hb-sdk 包目录');
     const cwd = options.cwd ?? process.cwd();
     if (!options.global)
         await verifyProjectSdk(cwd, version.HB_SDK_VERSION);
-    const result = await installSkill({ packageRoot, cwd, global: options.global, agents: options.agent, allAgents: options.allAgents, force: options.force });
+    const result = await installSkill({
+        packageRoot,
+        cwd,
+        global: options.global,
+        agents: options.agent,
+        allAgents: options.allAgents,
+        force: options.force,
+    });
     if (result.code !== 0)
         throw new Error(`Skill 安装失败（退出码 ${result.code}）`);
     logger.success('hb-sdk Skill 安装完成');

package/dist/cli-chunks/{version-BGzCIQhE.cjs → version-DbDVL6vm.cjs}

@@ -3,6 +3,6 @@
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.8.1-alpha.3';
+    : '0.8.1-alpha.7';
 
 exports.HB_SDK_VERSION = HB_SDK_VERSION;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-DCJN-V1y.cjs');
+var index = require('./cli-chunks/index-zNpZDWhc.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');