@heybox/hb-sdk 0.9.1-alpha.2 → 0.9.1-alpha.4

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 本文件随 `@heybox/hb-sdk` npm 包公开分发，只记录外部小程序开发者可观察到的变化。
 
+## 0.9.1-alpha.4 - 2026-10-14
+
+### 新增能力
+
+- 预留 `hbSDK.device.executeProtocol()`（暂不对外开放）：在获得平台批准的 `appProtocol` 权限后执行任意小黑盒协议，支持完整协议字符串与 JSON 协议对象；返回 `Promise<void>`，成功只表示已投递，不转发协议业务返回值或回调。
+- 预留最高危险等级权限 `appProtocol`（暂不对外开放，不提供开发者申请入口）：批准后该入口可执行任意协议，并绕过其他 SDK 能力权限及其专用授权流程；该总授权只作用于 `device.executeProtocol()`，其他 SDK 方法仍执行各自权限与授权规则。
+- `hb-sdk dev` 支持为已声明但未获线上批准的 `appProtocol` 生成当前 Dev Session 的本地临时授权；浏览器调试台记录协议类型并以 Mock 投递成功，不模拟真实协议效果。
+
+### 问题修复
+
+- 协议执行收到取消后停止尚未投递的后续动作；调用超时或 SDK 销毁时通知 Host 取消，已投递的系统动作不会撤销。
+- 协议对象中的函数、Symbol 等无法发送的参数统一返回 `INVALID_PARAMS`，保留原始原因供排查。
+
+### 文档与工具
+
+- 权限指南、API Reference、CLI 调试说明与 `hb-sdk remote permission apply` 同步 `appProtocol` 与 `device.executeProtocol`。
+
+## 0.9.1-alpha.3 - 2026-10-14
+
+### 问题修复
+
+- 修复设置 `--service-tag` 后提交小程序时文件上传失败的问题。
+
 ## 0.9.1-alpha.2
 
 ### 文档与工具

package/dist/cli-chunks/{build-BrxETAg-.cjs → build-BZg2rHkW.cjs}

@@ -3,13 +3,13 @@
 var fs$1 = require('node:fs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-AT-04rSn.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-eiq8vE62.cjs');
 require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-GQWWSNNP.cjs');
-var index = require('./index-Bdo2T9uy.cjs');
-var projectVite = require('./project-vite-BU-kVQwl.cjs');
-require('./version-CDYLTzyb.cjs');
+var runtimeGate = require('./runtime-gate-CR0dRMpQ.cjs');
+var index = require('./index-BGh-Izf8.cjs');
+var projectVite = require('./project-vite-BVDIeoHB.cjs');
+require('./version-DYFkOykv.cjs');
 require('node:async_hooks');
 require('node:module');
 require('path');

package/dist/cli-chunks/{context-DxBK07jO.cjs → context-YrzmEOau.cjs}

@@ -3,10 +3,10 @@
 var node_crypto = require('node:crypto');
 var fs = require('node:fs/promises');
 var path = require('node:path');
-var runtimePermissionEnv = require('./runtime-permission-env-AT-04rSn.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-eiq8vE62.cjs');
 var fs$1 = require('node:fs');
 var sharp = require('sharp');
-var session = require('./session-B_C7uQDa.cjs');
+var session = require('./session-Dz1cGg0E.cjs');
 
 async function inspectBasicInfoImage(bytes, sourcePath, kind) {
     const inspected = await inspectDecodedBasicInfoImage(bytes, kind);
@@ -345,8 +345,8 @@ function resolveBrowserFakeContext(context, now = Date.now()) {
             runtimePermissions: context.runtimePermissions,
             revision: parsed.grant.revision,
             eligiblePermissionKeys: context.platforms?.some((platform) => ['windows', 'macos', 'linux'].includes(platform))
-                ? ['network', 'companion']
-                : ['network'],
+                ? ['network', 'companion', 'appProtocol']
+                : ['network', 'appProtocol'],
         }),
     };
 }

package/dist/cli-chunks/{create-D_Cwz_i7.cjs → create-fPvlqLbS.cjs}

@@ -5,7 +5,7 @@ var fs = require('node:fs/promises');
 var path = require('node:path');
 var require$$0 = require('fs');
 var require$$1 = require('path');
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 require('node:module');
 require('os');
 require('node:crypto');

package/dist/cli-chunks/{dev-CVqfVj4a.cjs → dev-X8_kbp78.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var session = require('./session-B_C7uQDa.cjs');
-var context = require('./context-DxBK07jO.cjs');
+var session = require('./session-Dz1cGg0E.cjs');
+var context = require('./context-YrzmEOau.cjs');
 var node_crypto = require('node:crypto');
 var fs = require('node:fs');
-var runtimePermissionEnv = require('./runtime-permission-env-AT-04rSn.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-eiq8vE62.cjs');
 var os = require('node:os');
 var path = require('node:path');
 var net = require('node:net');
@@ -13,12 +13,12 @@ var node_http = require('node:http');
 var node_module = require('node:module');
 var undici = require('undici');
 var fs$1 = require('node:fs/promises');
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 var require$$0$1 = require('crypto');
 var require$$0 = require('buffer');
 var browser = require('./browser-RAy8e8cV.cjs');
-var projectVite = require('./project-vite-BU-kVQwl.cjs');
-var version = require('./version-CDYLTzyb.cjs');
+var projectVite = require('./project-vite-BVDIeoHB.cjs');
+var version = require('./version-DYFkOykv.cjs');
 require('node:zlib');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1993,8 +1993,8 @@ const DEFAULT_CHANNEL_TRANSPORT = {
 };
 const IPV4_LOOPBACK_ADDRESSES = new net.BlockList();
 IPV4_LOOPBACK_ADDRESSES.addSubnet('127.0.0.0', 8, 'ipv4');
-const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CVqfVj4a.cjs', document.baseURI).href)))('ws');
-const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-CVqfVj4a.cjs', document.baseURI).href)))('parse5');
+const { WebSocket, WebSocketServer } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-X8_kbp78.cjs', document.baseURI).href)))('ws');
+const { parse: parseHtml } = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/dev-X8_kbp78.cjs', document.baseURI).href)))('parse5');
 const BROWSER_DEV_HOST_ROOT_CANDIDATES = [
     path.resolve(__dirname, 'devtools/browser-dev-host'),
     path.resolve(__dirname, '../devtools/browser-dev-host'),
@@ -11090,7 +11090,7 @@ function assertNodeRuntimeCapabilities(ctx, settings) {
 function createNodeRealtimeDriverRegistry() {
     const registry = createRuntimeRealtimeDriverRegistry();
     registry.registerLazy('node-websocket', async () => {
-        const mod = await Promise.resolve().then(function () { return require('./index.esm-Bl6toxrf.cjs'); });
+        const mod = await Promise.resolve().then(function () { return require('./index.esm-WYIrPjkF.cjs'); });
         return mod.createNodeWebSocketRuntimeDriver();
     });
     return registry;
@@ -15658,7 +15658,7 @@ async function runDevCommand(options, runtime = {}) {
         const grant = runtimePermissionEnv.createMiniProgramLocalDevGrant({ declaredPermissions: currentDevContext.declaredPermissions ?? {},
             runtimePermissions: currentDevContext.runtimePermissions, revision: contextRevision,
             eligiblePermissionKeys: currentCompanionManifestSha256 && runtimePermissionEnv.hasMiniappDesktopPlatform(currentDevContext.platforms)
-                ? ['network', 'companion'] : ['network'] });
+                ? ['network', 'companion', 'appProtocol'] : ['network', 'appProtocol'] });
         if (allowedTemporaryKeys)
             grant.entries = grant.entries.filter(entry => allowedTemporaryKeys.has(entry.key));
         const temporaryWarning = grant.entries.map(entry => entry.key).join('、');

package/dist/cli-chunks/{doctor-B__9PDSg.cjs → doctor-DdiucYs9.cjs}

@@ -3,7 +3,7 @@
 var fs = require('node:fs/promises');
 var os = require('node:os');
 var path = require('node:path');
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{index-Bdo2T9uy.cjs → index-BGh-Izf8.cjs}

@@ -235,19 +235,19 @@ function requireArgument () {
 
 var command = {};
 
-const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bdo2T9uy.cjs', document.baseURI).href)));
+const require$5 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BGh-Izf8.cjs', document.baseURI).href)));
 function __require$4() { return require$5("node:events"); }
 
-const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bdo2T9uy.cjs', document.baseURI).href)));
+const require$4 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BGh-Izf8.cjs', document.baseURI).href)));
 function __require$3() { return require$4("node:child_process"); }
 
-const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bdo2T9uy.cjs', document.baseURI).href)));
+const require$3 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BGh-Izf8.cjs', document.baseURI).href)));
 function __require$2() { return require$3("node:path"); }
 
-const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bdo2T9uy.cjs', document.baseURI).href)));
+const require$2 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BGh-Izf8.cjs', document.baseURI).href)));
 function __require$1() { return require$2("node:fs"); }
 
-const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-Bdo2T9uy.cjs', document.baseURI).href)));
+const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli-chunks/index-BGh-Izf8.cjs', document.baseURI).href)));
 function __require() { return require$1("node:process"); }
 
 var help = {};
@@ -13554,7 +13554,7 @@ function getPathname(pathWithQuery) {
 }
 
 const CLI_VERSION_PLACEHOLDER = ['__HB', 'SDK', 'CLI', 'VERSION__'].join('_');
-const BUILT_CLI_VERSION = '0.9.1-alpha.2';
+const BUILT_CLI_VERSION = '0.9.1-alpha.4';
 const PACKAGE_JSON_CANDIDATES = [
     path.resolve(__dirname, '..', '..', 'package.json'),
     path.resolve(__dirname, '..', 'package.json'),
@@ -13753,7 +13753,7 @@ function installRemoteCommands(program, handlers, resolveLogger) {
     const permission = addRemotePublicOptions(remote.command('permission').description('申请平台权限并查看审核状态'));
     addRemotePublicOptions(permission.command('list').description('查看平台权限及最近申请状态')).action(createRemoteAction(handlers, resolveLogger, 'permission:list'));
     addRemotePublicOptions(permission.command('apply').description('提交平台权限申请')
-        .argument('<key>', 'network 或 companion')
+        .argument('<key>', 'network、companion 或 appProtocol')
         .requiredOption('--reason <text>', '申请理由，不超过 500 字')
         .option('--domains <domains>', 'network 访问域名，多个用逗号分隔')).action(createRemoteAction(handlers, resolveLogger, 'permission:apply', (command, key) => {
         const options = readCommandOptionsWithAncestors(command);
@@ -13922,39 +13922,39 @@ function createCommandLoggerResolver(options) {
     };
 }
 const defaultClearLoginStatus = async (...args) => {
-    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-BOk8eomf.cjs'); });
+    const { clearLoginStatus } = await Promise.resolve().then(function () { return require('./login-DWmNuhWc.cjs'); });
     return clearLoginStatus(...args);
 };
 const defaultLoginToHeybox = async (...args) => {
-    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-BOk8eomf.cjs'); });
+    const { loginToHeybox } = await Promise.resolve().then(function () { return require('./login-DWmNuhWc.cjs'); });
     return loginToHeybox(...args);
 };
 const defaultPrintLoginStatus = async (...args) => {
-    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-BOk8eomf.cjs'); });
+    const { printLoginStatus } = await Promise.resolve().then(function () { return require('./login-DWmNuhWc.cjs'); });
     return printLoginStatus(...args);
 };
 const defaultRunBuildCommand = async (...args) => {
-    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-BrxETAg-.cjs'); });
+    const { runBuildCommand } = await Promise.resolve().then(function () { return require('./build-BZg2rHkW.cjs'); });
     return runBuildCommand(...args);
 };
 const defaultRunCreateCommand = async (...args) => {
-    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-D_Cwz_i7.cjs'); });
+    const { runCreateCommand } = await Promise.resolve().then(function () { return require('./create-fPvlqLbS.cjs'); });
     return runCreateCommand(...args);
 };
 const defaultRunDevCommand = async (...args) => {
-    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-CVqfVj4a.cjs'); }).then(function (n) { return n.dev; });
+    const { runDevCommand } = await Promise.resolve().then(function () { return require('./dev-X8_kbp78.cjs'); }).then(function (n) { return n.dev; });
     return runDevCommand(...args);
 };
 const defaultRunDoctorCommand = async (...args) => {
-    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-B__9PDSg.cjs'); });
+    const { runDoctorCommand } = await Promise.resolve().then(function () { return require('./doctor-DdiucYs9.cjs'); });
     return runDoctorCommand(...args);
 };
 const defaultRunSkillInstallCommand = async (...args) => {
-    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-mwRSQNYa.cjs'); });
+    const { runSkillInstallCommand } = await Promise.resolve().then(function () { return require('./skill-DC3cfPj2.cjs'); });
     return runSkillInstallCommand(...args);
 };
 const defaultRunRemoteCommand = async (...args) => {
-    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BbB3_uFH.cjs'); });
+    const { runRemoteCommand } = await Promise.resolve().then(function () { return require('./remote-BHJFxXyc.cjs'); });
     return runRemoteCommand(...args);
 };
 function resolveStandaloneLogger(options, verbose) {

package/dist/cli-chunks/{index-26VGAsFk.cjs → index-BdbwsefW.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var index$2 = require('./index-Bdo2T9uy.cjs');
+var index$2 = require('./index-BGh-Izf8.cjs');
 var require$$0$3 = require('fs');
 var require$$0$2 = require('crypto');
 var require$$1$2 = require('path');
 var require$$0$5 = require('assert');
 var require$$0$4 = require('events');
 var require$$1$1 = require('util');
-var runtimePermissionEnv = require('./runtime-permission-env-AT-04rSn.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-eiq8vE62.cjs');
 var require$$0$7 = require('net');
 var require$$0$6 = require('url');
 var require$$2$1 = require('http');

package/dist/cli-chunks/{index.esm-Bl6toxrf.cjs → index.esm-WYIrPjkF.cjs}

@@ -11,8 +11,8 @@ var require$$0$4 = require('url');
 var require$$0 = require('zlib');
 var require$$0$1 = require('buffer');
 var require$$1 = require('util');
-var index = require('./index-Bdo2T9uy.cjs');
-var dev = require('./dev-CVqfVj4a.cjs');
+var index = require('./index-BGh-Izf8.cjs');
+var dev = require('./dev-X8_kbp78.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');
@@ -23,12 +23,12 @@ require('node:crypto');
 require('readline');
 require('tty');
 require('assert');
-require('./session-B_C7uQDa.cjs');
+require('./session-Dz1cGg0E.cjs');
 require('fs');
 require('constants');
-require('./context-DxBK07jO.cjs');
-require('./runtime-permission-env-AT-04rSn.cjs');
-require('./version-CDYLTzyb.cjs');
+require('./context-YrzmEOau.cjs');
+require('./runtime-permission-env-eiq8vE62.cjs');
+require('./version-DYFkOykv.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:os');
@@ -42,7 +42,7 @@ require('node:buffer');
 require('node:url');
 require('node:util');
 require('node:child_process');
-require('./project-vite-BU-kVQwl.cjs');
+require('./project-vite-BVDIeoHB.cjs');
 require('node:zlib');
 
 var bufferUtil = {exports: {}};

package/dist/cli-chunks/{login-BOk8eomf.cjs → login-DWmNuhWc.cjs}

@@ -3,9 +3,9 @@
 var promises = require('node:readline/promises');
 var node_crypto = require('node:crypto');
 var node_http = require('node:http');
-var session = require('./session-B_C7uQDa.cjs');
+var session = require('./session-Dz1cGg0E.cjs');
 var browser = require('./browser-RAy8e8cV.cjs');
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 require('node:path');
 require('fs');
 require('constants');

package/dist/cli-chunks/{project-vite-BU-kVQwl.cjs → project-vite-BVDIeoHB.cjs}

@@ -5,7 +5,7 @@ var fs$1 = require('node:fs/promises');
 var node_module = require('node:module');
 var path = require('node:path');
 var node_url = require('node:url');
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 
 function findProjectRoot(startDir) {
     let current = path.resolve(startDir);

package/dist/cli-chunks/{remote-BbB3_uFH.cjs → remote-BHJFxXyc.cjs}

@@ -1,18 +1,18 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-AT-04rSn.cjs');
-var context = require('./context-DxBK07jO.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-eiq8vE62.cjs');
+var context = require('./context-YrzmEOau.cjs');
 var promises = require('node:readline/promises');
-var index = require('./index-Bdo2T9uy.cjs');
-var session = require('./session-B_C7uQDa.cjs');
+var index = require('./index-BGh-Izf8.cjs');
+var session = require('./session-Dz1cGg0E.cjs');
 var childProcess = require('node:child_process');
 var fs = require('node:fs');
 var fs$1 = require('node:fs/promises');
 var path = require('node:path');
 var node_crypto = require('node:crypto');
 require('node:zlib');
-var runtimeGate = require('./runtime-gate-GQWWSNNP.cjs');
-require('./version-CDYLTzyb.cjs');
+var runtimeGate = require('./runtime-gate-CR0dRMpQ.cjs');
+require('./version-DYFkOykv.cjs');
 require('node:async_hooks');
 require('sharp');
 require('node:module');
@@ -57,6 +57,9 @@ async function postHeyboxApi(pathWithQuery, body, session$1, runtime) {
     const context = session.createHeyboxOpenPlatformRequestContext(session$1, pathWithQuery, {
         contentType: 'application/x-www-form-urlencoded',
     });
+    // CDN 使用共用上传服务，不随小程序服务的个人测试 tag 切换。
+    delete context.headers['x-rylai-service-tag'];
+    delete context.platformParams.special_tag;
     const response = await fetchImpl(session.createHeyboxApiUrl(runtime.baseUrl ?? context.baseUrl, pathWithQuery, context.platformParams), {
         method: 'POST',
         headers: context.headers,
@@ -318,7 +321,7 @@ function createDefaultCosClient(uploadToken, COS) {
     };
 }
 async function loadCosConstructor() {
-    const cosModule = await Promise.resolve().then(function () { return require('./index-26VGAsFk.cjs'); }).then(function (n) { return n.index; });
+    const cosModule = await Promise.resolve().then(function () { return require('./index-BdbwsefW.cjs'); }).then(function (n) { return n.index; });
     return cosModule.default;
 }
 function formatSize(bytes) {
@@ -1470,9 +1473,9 @@ async function remotePermissionList(options, context, runtime) {
 }
 async function remotePermissionApply(options, context, runtime) {
     const miniProgramId = requireBinding(context);
-    const key = requireNonEmpty(options.key, '请指定申请权限 network 或 companion');
-    if (key !== 'network' && key !== 'companion')
-        throw new Error('仅支持申请 network 或 companion 权限');
+    const key = requireNonEmpty(options.key, '请指定申请权限 network、companion 或 appProtocol');
+    if (key !== 'network' && key !== 'companion' && key !== 'appProtocol')
+        throw new Error('仅支持申请 network、companion 或 appProtocol 权限');
     const reason = requireNonEmpty(options.reason, '权限申请必须传 --reason');
     if (Array.from(reason).length > 500)
         throw new Error('申请理由不能超过 500 字');

package/dist/cli-chunks/{runtime-gate-GQWWSNNP.cjs → runtime-gate-CR0dRMpQ.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var runtimePermissionEnv = require('./runtime-permission-env-AT-04rSn.cjs');
+var runtimePermissionEnv = require('./runtime-permission-env-eiq8vE62.cjs');
 
 // Shorthands
 /**

package/dist/cli-chunks/{runtime-permission-env-AT-04rSn.cjs → runtime-permission-env-eiq8vE62.cjs}

@@ -2,7 +2,7 @@
 
 var fs = require('node:fs');
 var path = require('node:path');
-var version = require('./version-CDYLTzyb.cjs');
+var version = require('./version-DYFkOykv.cjs');
 require('node:crypto');
 var node_async_hooks = require('node:async_hooks');
 
@@ -2965,6 +2965,7 @@ const MINI_PROGRAM_PERMISSION_KEYS = [
     'leaderboard',
     'network',
     'companion',
+    'appProtocol',
 ];
 const MINI_PROGRAM_PERMISSION_CATALOG = [
     {
@@ -3100,6 +3101,16 @@ const MINI_PROGRAM_PERMISSION_CATALOG = [
         ],
         conditions: ['声明后仍需平台批准，并继续执行可信用户手势、Host 能力和当前版本 Manifest 校验。'],
     },
+    {
+        key: 'appProtocol',
+        name: '应用协议执行',
+        description: '执行任意小黑盒客户端协议。',
+        access: 'platform-approval',
+        risk: 'high',
+        config: {},
+        methods: ['device.executeProtocol'],
+        conditions: ['最高危险权限：批准后该入口可执行任意协议，并绕过其他 SDK 能力权限及专用授权流程。'],
+    },
 ];
 new Set(MINI_PROGRAM_PERMISSION_KEYS);
 
@@ -3284,7 +3295,7 @@ function isRecord$2$1(value) {
 }
 
 /** 仅供开发工具和 Host 使用；新增权限必须单独评估，不能从平台审批目录自动推导。 */
-const LOCAL_DEV_GRANT_PERMISSION_KEYS = ['network', 'companion'];
+const LOCAL_DEV_GRANT_PERMISSION_KEYS = ['network', 'companion', 'appProtocol'];
 /**
  * 严格解析本地 grant。任何未知字段、重复权限或非法配置都拒绝整份输入。
  * 只校验数据合同；票据、身份、摘要、过期时间和 CLI lease 必须由 Host 另行验证。
@@ -3316,6 +3327,11 @@ function parseMiniProgramLocalDevGrant(value) {
                 return { valid: false };
             entries.push({ key: 'companion', status: 'enabled', config: {} });
         }
+        else if (entry.key === 'appProtocol') {
+            if (!hasExactFields(entry.config, []))
+                return { valid: false };
+            entries.push({ key: 'appProtocol', status: 'enabled', config: {} });
+        }
         else {
             return { valid: false };
         }
@@ -3331,7 +3347,7 @@ function createMiniProgramLocalDevGrant(options) {
     if (!Number.isSafeInteger(options.revision) || options.revision < 0)
         throw new Error('本地调试权限 revision 必须是非负安全整数');
     const approvals = parseMiniProgramRuntimePermissions(options.runtimePermissions);
-    const eligible = new Set(options.eligiblePermissionKeys ?? ['network']);
+    const eligible = new Set(options.eligiblePermissionKeys ?? ['network', 'appProtocol']);
     const entries = [];
     for (const key of LOCAL_DEV_GRANT_PERMISSION_KEYS) {
         if (!eligible.has(key) || options.declaredPermissions[key]?.enabled !== true)

package/dist/cli-chunks/{session-B_C7uQDa.cjs → session-Dz1cGg0E.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 var node_crypto = require('node:crypto');
 var path = require('node:path');
 var require$$0$2 = require('fs');

package/dist/cli-chunks/{skill-mwRSQNYa.cjs → skill-DC3cfPj2.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var version = require('./version-CDYLTzyb.cjs');
+var version = require('./version-DYFkOykv.cjs');
 var fs = require('node:fs/promises');
 var path = require('node:path');
 var childProcess = require('node:child_process');
-var index = require('./index-Bdo2T9uy.cjs');
+var index = require('./index-BGh-Izf8.cjs');
 require('node:module');
 require('node:fs');
 require('path');

package/dist/cli-chunks/{version-CDYLTzyb.cjs → version-DYFkOykv.cjs}

@@ -3,6 +3,6 @@
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.9.1-alpha.2';
+    : '0.9.1-alpha.4';
 
 exports.HB_SDK_VERSION = HB_SDK_VERSION;

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./cli-chunks/index-Bdo2T9uy.cjs');
+var index = require('./cli-chunks/index-BGh-Izf8.cjs');
 require('node:module');
 require('node:fs');
 require('node:fs/promises');