@alipay/alipay-aipay 1.2.2 → 1.4.9

package/skill/references/onboarding/modules/scripts/app.sh

@@ -3,24 +3,28 @@
 # 脚本名称: app.sh
 # 功能描述: 应用发布全流程 - 查询/复用 + 创建 + 公钥设置 + 提交审核
 # 调用位置: list 用于 Step 3.1 前置资源查询；其他命令用于 Step 5.3 应用发布
-# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME
+# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME/PLATFORM_ID
 #          list/create 可传 --application-type，未传时按 --product-type/--sales-code 或兼容环境变量推断
 # 用法:
 #   app list [--product-type <type> --sales-code <code> --application-type <type>]   - 查询已有应用并判断复用/新建
 #   app create [--product-type <type> --sales-code <code> --application-type <type>] [--mobile-platform IOS|ANDROID|ALL ...] - 创建新应用
-#   app key    <appId> <publicKey>       - 设置应用公钥
+#   app key    --defer-open <appId> <publicKey> - 设置应用公钥
+#   app open-key-page <appId>            - 打开上一次生成的公钥确认页
 #   app verify-key <appId> [publicKey]   - 确认应用公钥已设置
+#   app verify-key-and-audit <appId> [publicKey] - 复用最终密钥查询结果并提交审核
 #   app audit  <appId>                   - 提交应用审核
 #   app reuse  <appId>                   - 复用已有应用（查询安全密钥）
 # 返回值:
-#   list:   FLOW:CREATE_NEW | FLOW:SELECT | FLOW:PENDING_APPLICATIONS | FLOW:ERROR
-#   create: 成功输出 APP_ID=xxx；失败 exit 1，返回结构异常时同时输出 FLOW:ERROR
+#   list:   stdout 成功时为空；stderr 输出带统一内部前缀的候选 JSON、FLOW 和候选 ID
+#   create: 成功在 stderr 输出 APP_ID=xxx；失败 exit 1，返回结构异常时同时输出 FLOW:ERROR
 #   key:    输出 confirmPageUrl
 #   audit:  输出审核结果
-#   reuse:  FLOW:REUSE_SUCCESS | FLOW:REUSE_NO_KEY | FLOW:ERROR
+#   reuse:  stderr 输出 FLOW:REUSE_SUCCESS | FLOW:REUSE_NO_KEY | FLOW:ERROR
 #=============================================================================
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RENDERER="${SCRIPT_DIR}/../../../normal/scripts/render_customer_message.mjs"
+CANDIDATE_RUNNER="${SCRIPT_DIR}/../../../normal/scripts/onboarding_message_runner.mjs"
 
 # 一次性 source error_handler（含 unwrap_mcp）
 if [ -f "${SCRIPT_DIR}/error_handler.sh" ]; then
@@ -29,8 +33,80 @@ else
   echo "❌ 缺少错误处理脚本: ${SCRIPT_DIR}/error_handler.sh"
   exit 1
 fi
+source "${SCRIPT_DIR}/network_retry.sh"
 
 require_command jq || exit 1
+require_command node || exit 1
+
+APP_KEY_STATE_OWNER="$(id -u 2>/dev/null || printf '%s' "${USER:-unknown}" | tr -c 'A-Za-z0-9_-' '_')"
+APP_KEY_STATE_BASE="${TMPDIR:-/tmp}"
+APP_KEY_STATE_BASE="${APP_KEY_STATE_BASE%/}"
+if [ -n "${ALIPAY_APP_KEY_STATE_FILE:-}" ]; then
+  APP_KEY_STATE_FILE="$ALIPAY_APP_KEY_STATE_FILE"
+  APP_KEY_STATE_DIR="$(dirname "$APP_KEY_STATE_FILE")"
+  APP_KEY_STATE_DIR_MANAGED=false
+else
+  APP_KEY_STATE_DIR="${APP_KEY_STATE_BASE}/alipay-aipay-app-key-${APP_KEY_STATE_OWNER}"
+  APP_KEY_STATE_FILE="${APP_KEY_STATE_DIR}/key-page-state.json"
+  APP_KEY_STATE_DIR_MANAGED=true
+fi
+
+app_key_secure_mode() {
+  local target="$1" expected="$2" mode
+  if mode=$(stat -f '%Lp' "$target" 2>/dev/null); then
+    :
+  elif mode=$(stat -c '%a' "$target" 2>/dev/null); then
+    :
+  else
+    return 1
+  fi
+  [ "$mode" = "$expected" ]
+}
+
+prepare_app_key_state_dir() {
+  if [ "$APP_KEY_STATE_DIR_MANAGED" = true ]; then
+    if [ -L "$APP_KEY_STATE_DIR" ] || { [ -e "$APP_KEY_STATE_DIR" ] && [ ! -d "$APP_KEY_STATE_DIR" ]; }; then
+      echo "❌ 公钥确认页临时目录不安全，已停止" >&2
+      return 1
+    fi
+    mkdir -p "$APP_KEY_STATE_DIR" || return 1
+    chmod 700 "$APP_KEY_STATE_DIR" 2>/dev/null || return 1
+    app_key_secure_mode "$APP_KEY_STATE_DIR" 700 || return 1
+  else
+    [ -d "$APP_KEY_STATE_DIR" ] && [ ! -L "$APP_KEY_STATE_DIR" ] || {
+      echo "❌ 指定的公钥确认页状态目录不可用或不安全，已停止" >&2
+      return 1
+    }
+  fi
+}
+
+validate_app_key_state_file() {
+  [ -f "$APP_KEY_STATE_FILE" ] && [ ! -L "$APP_KEY_STATE_FILE" ] || return 1
+  chmod 600 "$APP_KEY_STATE_FILE" 2>/dev/null || return 1
+  app_key_secure_mode "$APP_KEY_STATE_FILE" 600
+}
+
+save_app_key_page_state() {
+  local temp_state
+  require_command mktemp || return 1
+  prepare_app_key_state_dir || return 1
+  if [ -L "$APP_KEY_STATE_FILE" ] || { [ -e "$APP_KEY_STATE_FILE" ] && [ ! -f "$APP_KEY_STATE_FILE" ]; }; then
+    echo "❌ 公钥确认页状态路径不是安全的普通文件，已停止" >&2
+    return 1
+  fi
+  temp_state=$(mktemp "${APP_KEY_STATE_DIR}/.key-page-state.XXXXXX") || return 1
+  chmod 600 "$temp_state" 2>/dev/null || { rm -f "$temp_state"; return 1; }
+  jq -n \
+    --arg appId "$APP_ID" \
+    --arg confirmPageUrl "$CONFIRM_PAGE_URL" \
+    '{appId:$appId,confirmPageUrl:$confirmPageUrl}' > "$temp_state" || { rm -f "$temp_state"; return 1; }
+  mv "$temp_state" "$APP_KEY_STATE_FILE" || { rm -f "$temp_state"; return 1; }
+  validate_app_key_state_file || {
+    rm -f "$APP_KEY_STATE_FILE"
+    echo "❌ 无法确认公钥确认页状态文件权限为 0600，已停止" >&2
+    return 1
+  }
+}
 
 parse_app_context_args() {
   while [[ $# -gt 0 ]]; do
@@ -73,7 +149,7 @@ validate_mobile_platform_args() {
     fi
     if [ "$APP_APPLICATION_TYPE" = "MOBILEAPP" ]; then
       echo "❌ 创建 MOBILEAPP 必须传 --mobile-platform IOS|ANDROID|ALL" >&2
-      echo "📋 IOS 需同时传 --bundle-id；ANDROID 需同时传 --app-package 和 --app-sign；ALL 需三项都传" >&2
+      echo "📋 IOS 需同时传 --bundle-id；ANDROID 需同时传 --app-package 和 --app-sign；ALL 需三项都传；HarmonyOS 移动应用不支持通过 Skill 创建" >&2
       return 1
     fi
     return 0
@@ -112,7 +188,7 @@ validate_mobile_platform_args() {
       fi
       ;;
     *)
-      echo "❌ --mobile-platform 参数值无效: ${MOBILE_PLATFORM}（仅支持 IOS|ANDROID|ALL）" >&2
+      echo "❌ --mobile-platform 参数值无效: ${MOBILE_PLATFORM}（仅支持 IOS|ANDROID|ALL；HarmonyOS 移动应用需前往支付宝开放平台控制台创建）" >&2
       return 1
       ;;
   esac
@@ -213,9 +289,15 @@ query_security_key() {
     REQUEST_JSON=$(jq -n --arg appId "$APP_ID" '{request:{appId:$appId}}')
   fi
 
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call apprelease.queryApplicationSecurityKey \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT read application_security_key -- alipay-cli mcp call apprelease.queryApplicationSecurityKey \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 应用安全密钥查询因网络或服务异常在自动重试两次后仍未恢复"
+    return 1
+  fi
 
   if ! handle_error "$RESULT"; then
     return 1
@@ -226,6 +308,7 @@ query_security_key() {
 
   if [ "$SUCCESS" != "true" ]; then
     ERROR_MSG=$(echo "$SECURITY_BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
+    ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
     echo "❌ 查询安全密钥失败: $ERROR_MSG"
     return 1
   fi
@@ -235,9 +318,15 @@ query_application_info() {
   local APP_ID="$1"
 
   REQUEST_JSON=$(jq -n --arg appId "$APP_ID" '{request:{appId:$appId}}')
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call apprelease.queryApplicationInfo \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT read application_info -- alipay-cli mcp call apprelease.queryApplicationInfo \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 应用信息查询因网络或服务异常在自动重试两次后仍未恢复"
+    return 1
+  fi
 
   if ! handle_error "$RESULT"; then
     return 1
@@ -248,6 +337,7 @@ query_application_info() {
 
   if [ "$SUCCESS" != "true" ]; then
     ERROR_MSG=$(echo "$APPLICATION_INFO_BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
+    ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
     echo "❌ 查询应用信息失败: $ERROR_MSG"
     return 1
   fi
@@ -324,20 +414,20 @@ write_alipay_public_key() {
   fi
 
   while [ "$ATTEMPT" -le "$MAX_ATTEMPTS" ]; do
-    if { mkdir -p "${HOME}/.config" && printf '%s\n' "$ALIPAY_PUBLIC_KEY" > "$KEY_FILE"; } 2>/dev/null; then
+    if { mkdir -p "${HOME}/.config" && chmod 700 "${HOME}/.config" && (umask 077; printf '%s\n' "$ALIPAY_PUBLIC_KEY" > "$KEY_FILE") && chmod 600 "$KEY_FILE"; } 2>/dev/null; then
       return 0
     fi
 
     if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
-      echo "⚠️ 支付宝公钥文件写入失败，正在重试（${ATTEMPT}/${MAX_ATTEMPTS}）..."
+      emit_control "⚠️ 支付宝公钥文件写入失败，正在重试（${ATTEMPT}/${MAX_ATTEMPTS}）..."
       sleep 1
     fi
     ATTEMPT=$((ATTEMPT + 1))
   done
 
-  echo "⚠️ 已获取到 RSA2 支付宝公钥，但本地文件写入失败: $KEY_FILE"
-  echo "📋 这不是公钥查询失败；当前流程会继续，但后续集成时需要手动配置支付宝公钥。"
-  echo "📋 可检查本地目录权限或设置 HOME 后重新执行导出。"
+  emit_control "⚠️ 已获取到 RSA2 支付宝公钥，但本地文件写入失败: $KEY_FILE"
+  emit_control "📋 这不是公钥查询失败；当前流程会继续，但后续集成时需要手动配置支付宝公钥。"
+  emit_control "📋 可检查本地目录权限或设置 HOME 后重新执行导出。"
   return 1
 }
 
@@ -345,42 +435,50 @@ ensure_rsa2_application_key_ready() {
   local APP_ID="$1"
   local PUBLIC_KEY="${2:-}"
   local ATTEMPT=1
-  local MAX_ATTEMPTS="${APP_KEY_VERIFY_RETRIES:-6}"
-  local INTERVAL_SECONDS="${APP_KEY_VERIFY_INTERVAL_SECONDS:-5}"
+  local MAX_ATTEMPTS=20
+  local INTERVAL_SECONDS=2
+  KEY_VERIFY_RESULT=""
 
-  if ! [[ "$MAX_ATTEMPTS" =~ ^[1-9][0-9]*$ ]]; then
-    MAX_ATTEMPTS=6
+  if [ "${ALIPAY_AIPAY_RECOVERY_QUERY_ONCE:-0}" = "1" ]; then
+    MAX_ATTEMPTS=1
   fi
 
-  if ! [[ "$INTERVAL_SECONDS" =~ ^[0-9]+$ ]]; then
-    INTERVAL_SECONDS=5
+  if [ "${ALIPAY_AIPAY_TEST_MODE:-0}" = "1" ] && [[ "${APP_KEY_VERIFY_INTERVAL_SECONDS:-}" =~ ^[0-9]+$ ]]; then
+    INTERVAL_SECONDS="$APP_KEY_VERIFY_INTERVAL_SECONDS"
   fi
 
   while [ "$ATTEMPT" -le "$MAX_ATTEMPTS" ]; do
-    query_security_key "$APP_ID" "$PUBLIC_KEY" || return 1
+    if ! query_security_key "$APP_ID" "$PUBLIC_KEY"; then
+      KEY_VERIFY_RESULT="QUERY_FAILED"
+      return 1
+    fi
 
     RSA2_KEY_INFO=$(extract_rsa2_application_key_info)
 
     if is_rsa2_application_key_ready "$RSA2_KEY_INFO"; then
+      KEY_VERIFY_RESULT="CONFIRMED"
       return 0
     fi
 
     if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
-      echo "⏳ 支付宝侧尚未确认到应用公钥生效，正在重试（${ATTEMPT}/${MAX_ATTEMPTS}）..."
+      emit_control "KEY_POLL_PENDING=${ATTEMPT}/${MAX_ATTEMPTS}"
       sleep "$INTERVAL_SECONDS"
     fi
 
     ATTEMPT=$((ATTEMPT + 1))
   done
 
-  echo "❌ 应用公钥尚未确认，请先完成公钥设置确认"
+  KEY_VERIFY_RESULT="PENDING"
   return 1
 }
 
-verify_key_and_export_alipay_public_key() {
-  local APP_ID="$1"
+render_key_pending() {
+  printf '%s' '{}' \
+    | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=app.sh node "$RENDERER" application.key.pending --variant DEFAULT
+}
 
-  query_security_key "$APP_ID" || return 1
+export_alipay_public_key_from_security_business() {
+  local APP_ID="$1"
 
   RSA2_KEY_INFO=$(extract_rsa2_application_key_info)
   RSA2_ALIPAY_KEY_INFO=$(extract_rsa2_alipay_key_info)
@@ -397,17 +495,24 @@ verify_key_and_export_alipay_public_key() {
   fi
 
   if write_alipay_public_key "$APP_ID" "$ALIPAY_PUBLIC_KEY"; then
-    echo "✅ 已确认应用公钥并导出支付宝公钥"
-    echo "支付宝公钥保存路径: ~/.config/${APP_ID}-alipayPublicKey.keytext"
-    echo "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=EXPORTED"
-    echo "ALIPAY_PUBLIC_KEY_FILE=~/.config/${APP_ID}-alipayPublicKey.keytext"
+    emit_control "✅ 已确认应用公钥并导出支付宝公钥"
+    emit_control "支付宝公钥保存路径: ~/.config/${APP_ID}-alipayPublicKey.keytext"
+    emit_control "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=EXPORTED"
+    emit_control "ALIPAY_PUBLIC_KEY_FILE=~/.config/${APP_ID}-alipayPublicKey.keytext"
   else
-    echo "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=MANUAL_CONFIGURATION_REQUIRED"
+    emit_control "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=MANUAL_CONFIGURATION_REQUIRED"
   fi
 
   return 0
 }
 
+verify_key_and_export_alipay_public_key() {
+  local APP_ID="$1"
+
+  query_security_key "$APP_ID" || return 1
+  export_alipay_public_key_from_security_business "$APP_ID"
+}
+
 # ─── app list: 查询已有应用 ──────────────────────────────────────────────────
 app_list() {
   parse_app_context_args "$@" || {
@@ -417,9 +522,16 @@ app_list() {
   APP_APPLICATION_TYPE=$(resolve_application_type) || exit 1
   REQUEST_JSON=$(jq -n --arg applicationType "$APP_APPLICATION_TYPE" '{request:{appTypes:[$applicationType]}}')
 
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call apprelease.queryApplicationList \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT read application_list -- alipay-cli mcp call apprelease.queryApplicationList \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 应用列表查询因网络或服务异常在自动重试两次后仍未恢复"
+    emit_control "FLOW:ERROR"
+    exit 1
+  fi
 
   # 错误检测
   if ! handle_error "$RESULT"; then
@@ -432,8 +544,9 @@ app_list() {
 
   if [ "$SUCCESS" != "true" ]; then
     ERROR_MSG=$(echo "$BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
+    ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
     echo "❌ 查询应用列表失败: $ERROR_MSG"
-    echo "FLOW:ERROR"
+    emit_control "FLOW:ERROR"
     exit 1
   fi
 
@@ -448,78 +561,56 @@ app_list() {
   ' 2>/dev/null)
   if [ -z "$APP_LIST" ] || ! echo "$APP_LIST" | jq -e 'type == "array"' >/dev/null 2>&1; then
     echo "❌ 应用列表返回结构异常，无法解析应用列表"
-    echo "FLOW:ERROR"
+    emit_control "FLOW:ERROR"
     exit 1
   fi
   APP_COUNT=$(echo "$APP_LIST" | jq 'length')
+  APP_CANDIDATES=$(echo "$APP_LIST" | jq -c '[.[] | {
+    appId: ((.appId // "未知") | tostring),
+    appName: ((.appName // "未知") | tostring),
+    status: ((.status // "未知") | tostring)
+  }]')
+  ONLINE_APPS=$(echo "$APP_LIST" | jq -r '[.[] | select(.status == "ON_LINE")]')
+  NON_ONLINE_APPS=$(echo "$APP_LIST" | jq -r '[.[] | select(.status != "ON_LINE")]')
+  ONLINE_COUNT=$(echo "$ONLINE_APPS" | jq 'length')
+  NON_ONLINE_COUNT=$(echo "$NON_ONLINE_APPS" | jq 'length')
+  ONLINE_COUNT=${ONLINE_COUNT:-0}
+  NON_ONLINE_COUNT=${NON_ONLINE_COUNT:-0}
+
+  if [ "$ONLINE_COUNT" -gt 0 ] && ! echo "$ONLINE_APPS" | jq -e '
+    all(.[];
+      ((.appId | type) == "string") and
+      (.appId | length > 0) and
+      ((.appId | test("[\u0000-\u001f\u007f]") | not))
+    )
+  ' >/dev/null 2>&1; then
+    echo "❌ 应用列表返回结构异常：可复用候选 appId 缺失或包含控制字符"
+    emit_control "FLOW:ERROR"
+    exit 1
+  fi
+
+  if ! printf '%s' "$APP_CANDIDATES" \
+    | node "$CANDIDATE_RUNNER" application-candidates --application-type "$APP_APPLICATION_TYPE" >/dev/null 2>&1; then
+    echo "❌ 应用候选事实安全校验失败"
+    emit_control "FLOW:ERROR"
+    exit 1
+  fi
+  emit_control_field "APP_CANDIDATES_JSON" "$APP_CANDIDATES" || {
+    echo "❌ 应用候选事实包含非法控制字符"
+    emit_control "FLOW:ERROR"
+    exit 1
+  }
+  emit_control_field "APPLICATION_TYPE" "$APP_APPLICATION_TYPE" || exit 1
 
   if [ "$APP_COUNT" -eq 0 ]; then
-    echo "📋 暂无 ${APP_APPLICATION_TYPE} 应用；记录新建候选分支，等待 Step 4 统一决策"
-    echo "FLOW:CREATE_NEW"
+    emit_control "FLOW:CREATE_NEW"
   else
-    # 实际返回的状态字段值是 "ON_LINE"（带下划线）
-    ONLINE_APPS=$(echo "$APP_LIST" | jq -r '[.[] | select(.status == "ON_LINE")]')
-    NON_ONLINE_APPS=$(echo "$APP_LIST" | jq -r '[.[] | select(.status != "ON_LINE")]')
-    ONLINE_COUNT=$(echo "$ONLINE_APPS" | jq 'length')
-    NON_ONLINE_COUNT=$(echo "$NON_ONLINE_APPS" | jq 'length')
-    ONLINE_COUNT=${ONLINE_COUNT:-0}
-    NON_ONLINE_COUNT=${NON_ONLINE_COUNT:-0}
-
     if [ "$ONLINE_COUNT" -eq 0 ]; then
-      echo "📋 当前已有以下尚未上线的 ${APP_APPLICATION_TYPE} 应用："
-      echo ""
-      echo "| 应用ID | 应用名称 | 实际状态 |"
-      echo "|--------|----------|----------|"
-      for i in $(seq 0 $((NON_ONLINE_COUNT-1))); do
-        APP=$(echo "$NON_ONLINE_APPS" | jq ".[$i]")
-        APP_ID=$(echo "$APP" | jq -r '.appId // "未知"')
-        APP_NAME=$(echo "$APP" | jq -r '.appName // "未知"')
-        APP_STATUS=$(echo "$APP" | jq -r '.status // "未知"')
-        echo "| $APP_ID | $APP_NAME | $APP_STATUS |"
-      done
-      echo ""
-      echo "以上应用当前不可复用。请等待应用上线，或在了解现有应用状态后明确选择新建。"
-      echo "FLOW:PENDING_APPLICATIONS"
+      emit_control "FLOW:PENDING_APPLICATIONS"
     else
-      echo "📋 发现您已有以下上线 ${APP_APPLICATION_TYPE} 应用："
-      echo ""
-      echo "| 序号 | 应用ID | 应用名称 | 状态 |"
-      echo "|------|--------|----------|------|"
-
-      for i in $(seq 0 $((ONLINE_COUNT-1))); do
-        APP=$(echo "$ONLINE_APPS" | jq ".[$i]")
-        APP_ID=$(echo "$APP" | jq -r '.appId // "未知"')
-        APP_NAME=$(echo "$APP" | jq -r '.appName // "未知"')
-        echo "| $((i+1)) | $APP_ID | $APP_NAME | 已上线 |"
-      done
-
-      if [ "$NON_ONLINE_COUNT" -gt 0 ]; then
-        echo ""
-        echo "另有以下尚未上线的同类型应用，当前不可复用："
-        echo ""
-        echo "| 应用ID | 应用名称 | 实际状态 |"
-        echo "|--------|----------|----------|"
-        for i in $(seq 0 $((NON_ONLINE_COUNT-1))); do
-          APP=$(echo "$NON_ONLINE_APPS" | jq ".[$i]")
-          APP_ID=$(echo "$APP" | jq -r '.appId // "未知"')
-          APP_NAME=$(echo "$APP" | jq -r '.appName // "未知"')
-          APP_STATUS=$(echo "$APP" | jq -r '.status // "未知"')
-          echo "| $APP_ID | $APP_NAME | $APP_STATUS |"
-        done
-        echo ""
-        echo "新建前请结合以上状态避免重复创建。"
-      fi
-
-      echo ""
-      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      echo "  请选择操作："
-      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      echo ""
-      echo "  【复用】输入序号 (1-$ONLINE_COUNT) → 复用对应应用"
-      echo "  【新建】输入 \"新建\" → 创建新应用"
-      echo ""
-      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      echo "FLOW:SELECT"
+      echo "$ONLINE_APPS" | jq -r '.[] | select((.appId // "") != "") | "APP_CANDIDATE_ID=" + .appId' \
+        | while IFS= read -r marker; do emit_control "$marker"; done
+      emit_control "FLOW:SELECT"
     fi
   fi
 }
@@ -537,9 +628,20 @@ app_create() {
     exit 1
   }
 
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call apprelease.createApplication \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT write application_create -- alipay-cli mcp call apprelease.createApplication \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -eq 75 ]; then
+    echo "❌ 应用创建响应不明；现有应用列表无法把同类型新应用唯一归属于本次创建，结果标记为 UNKNOWN，禁止自动重复创建"
+    emit_control "FLOW:ERROR"
+    exit 1
+  elif [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 应用创建因明确未发送的网络异常在自动重试两次后仍未恢复"
+    emit_control "FLOW:ERROR"
+    exit 1
+  fi
 
   # 错误检测
   if ! handle_error "$RESULT"; then
@@ -552,16 +654,17 @@ app_create() {
 
   if [ "$SUCCESS" = "true" ]; then
     APP_ID=$(echo "$BUSINESS" | jq -r '.resultObj.appId // .data.appId // empty')
-    if [ -z "$APP_ID" ]; then
+    if ! validate_control_value "$APP_ID"; then
       echo "❌ 应用创建返回成功，但未解析到 appId，禁止进入公钥设置流程"
-      echo "FLOW:ERROR"
+      emit_control "FLOW:ERROR"
       exit 1
     fi
-    echo "✅ 应用创建成功"
-    echo "APPLICATION_TYPE=$APP_APPLICATION_TYPE"
-    echo "APP_ID=$APP_ID"
+    emit_control "✅ 应用创建成功"
+    emit_control_field "APPLICATION_TYPE" "$APP_APPLICATION_TYPE" || exit 1
+    emit_control_field "APP_ID" "$APP_ID" || exit 1
   else
     ERROR_MSG=$(echo "$BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
+    ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
     echo "❌ 应用创建失败: $ERROR_MSG"
     exit 1
   fi
@@ -569,9 +672,17 @@ app_create() {
 
 # ─── app key: 设置应用公钥 ───────────────────────────────────────────────────
 app_key() {
+  if [ "${1:-}" = "--defer-open" ]; then
+    shift
+  else
+    echo "❌ 参数格式错误：app key 必须使用 --defer-open，确保先展示公钥确认说明和链接，再自动打开页面"
+    echo "用法: bash app.sh key --defer-open <appId> <publicKey>"
+    exit 1
+  fi
+
   if [ "$#" -ne 2 ] || [[ "${1:-}" == --* ]]; then
-    echo "❌ 参数格式错误：key 使用位置参数 <appId> <publicKey>，不支持 --app-id 等未定义选项"
-    echo "用法: bash app.sh key <appId> <publicKey>"
+    echo "❌ 参数格式错误：key 使用位置参数 <appId> <publicKey>"
+    echo "用法: bash app.sh key --defer-open <appId> <publicKey>"
     exit 1
   fi
 
@@ -580,7 +691,11 @@ app_key() {
 
   if [ -z "$APP_ID" ] || [ -z "$PUBLIC_KEY" ]; then
     echo "❌ 请提供 appId 和 publicKey"
-    echo "用法: bash app.sh key <appId> <publicKey>"
+    echo "用法: bash app.sh key --defer-open <appId> <publicKey>"
+    exit 1
+  fi
+  if ! validate_control_value "$APP_ID"; then
+    echo "❌ appId 包含非法控制字符"
     exit 1
   fi
 
@@ -589,9 +704,18 @@ app_key() {
     --arg publicKey "$PUBLIC_KEY" \
     '{request:{appId:$appId,signType:"RSA2",publicKey:$publicKey}}')
 
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call apprelease.createKeyConfirmPage \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT write application_key_confirm_page -- alipay-cli mcp call apprelease.createKeyConfirmPage \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -eq 75 ]; then
+    echo "❌ 公钥确认页生成响应不明，结果标记为 UNKNOWN；不得自动生成第二个页面"
+    exit 1
+  elif [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 公钥确认页因明确未发送的网络异常在自动重试两次后仍未恢复"
+    exit 1
+  fi
 
   # 错误检测
   if ! handle_error "$RESULT"; then
@@ -606,50 +730,101 @@ app_key() {
     CONFIRM_PAGE_URL=$(echo "$BUSINESS" | jq -r '.resultObj.confirmPageUrl // empty')
 
     if [ -n "$CONFIRM_PAGE_URL" ]; then
-      echo "📋 应用公钥设置中..."
-      echo ""
-      echo "请点击以下链接确认公钥设置："
-      echo ""
-      echo "提示：无法跳链时，请复制下方链接到网页浏览器打开。"
-      echo "[点击确认公钥设置]($CONFIRM_PAGE_URL)"
-      echo ""
-      echo "链接有效期为10分钟。"
-      echo ""
-      echo "确认完成后，请告诉我\"好了\"继续后续流程。"
+      RENDERER="${SCRIPT_DIR}/../../../normal/scripts/render_customer_message.mjs"
+      save_app_key_page_state || exit 1
+      MESSAGE_INPUT=$(printf '%s\n' "$APP_ID" "$CONFIRM_PAGE_URL" | jq -Rs '
+        split("\n") as $v | {appId:$v[0],officialUrl:$v[1]}
+      ')
+      if ! printf '%s' "$MESSAGE_INPUT" | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=app.sh node "$RENDERER" application.key.page --variant READY; then
+        echo "❌ 公钥确认页已生成，但标准消息无法安全输出；结果保持待核验，禁止自动生成第二个页面"
+        exit 1
+      fi
+      emit_control "KEY_PAGE:READY_TO_OPEN"
     else
-      echo "❌ 未获取到确认页面链接，请重试"
+      echo "❌ 公钥确认页响应缺少 confirmPageUrl，结果标记为 UNKNOWN；不得自动生成第二个页面"
       exit 1
     fi
   else
     ERROR_MSG=$(echo "$BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
+    ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
     echo "❌ 公钥设置失败: $ERROR_MSG"
     exit 1
   fi
 }
 
-# ─── app audit: 提交应用审核 ─────────────────────────────────────────────────
-app_audit() {
+app_open_key_page() {
+  local APP_ID="$1" SAVED_APP_ID CONFIRM_PAGE_URL MESSAGE_INPUT OPEN_HELPER OPEN_STATUS
+
   if [ "$#" -ne 1 ] || [[ "${1:-}" == --* ]]; then
-    echo "❌ 参数格式错误：audit 使用位置参数 <appId>，不支持 --app-id 等未定义选项"
-    echo "用法: bash app.sh audit <appId>"
+    echo "❌ 参数格式错误：open-key-page 使用位置参数 <appId>，不支持 --app-id 等未定义选项"
+    echo "用法: bash app.sh open-key-page <appId>"
+    exit 1
+  fi
+  if ! validate_control_value "$APP_ID"; then
+    echo "❌ appId 包含非法控制字符"
     exit 1
   fi
+  if ! validate_app_key_state_file; then
+    echo "❌ 缺少待打开的公钥确认页上下文，请重新执行 app.sh key --defer-open <appId> <publicKey>"
+    emit_control "FLOW:ERROR"
+    return 1
+  fi
+  if ! jq -e . "$APP_KEY_STATE_FILE" >/dev/null 2>&1; then
+    echo "❌ 公钥确认页状态文件不是合法 JSON，已停止"
+    emit_control "FLOW:ERROR"
+    return 1
+  fi
 
-  APP_ID="$1"
+  SAVED_APP_ID=$(jq -r '.appId // ""' "$APP_KEY_STATE_FILE")
+  CONFIRM_PAGE_URL=$(jq -r '.confirmPageUrl // ""' "$APP_KEY_STATE_FILE")
+  if [ "$SAVED_APP_ID" != "$APP_ID" ] || [ -z "$CONFIRM_PAGE_URL" ]; then
+    echo "❌ 当前 appId 与已生成的公钥确认页上下文不一致，已停止打开"
+    emit_control "FLOW:ERROR"
+    return 1
+  fi
 
-  if [ -z "$APP_ID" ]; then
-    echo "❌ 请提供 appId"
-    echo "用法: bash app.sh audit <appId>"
-    exit 1
+  MESSAGE_INPUT=$(printf '%s\n' "$APP_ID" "$CONFIRM_PAGE_URL" | jq -Rs '
+    split("\n") as $v | {appId:$v[0],officialUrl:$v[1]}
+  ')
+  if ! printf '%s' "$MESSAGE_INPUT" | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=app.sh node "$RENDERER" application.key.page --variant READY >/dev/null; then
+    echo "❌ 公钥确认页 URL 校验失败，已停止打开"
+    emit_control "FLOW:ERROR"
+    return 1
   fi
 
-  verify_key_and_export_alipay_public_key "$APP_ID" || exit 1
+  OPEN_HELPER="${SCRIPT_DIR}/../../../normal/scripts/open_official_url.sh"
+  OPEN_STATUS=$(printf '%s\n' "$CONFIRM_PAGE_URL" | bash "$OPEN_HELPER" public-key-confirmation)
+  case "$OPEN_STATUS" in OPENED|OPEN_FAILED|GUI_UNAVAILABLE|LINK_ONLY) ;; *) OPEN_STATUS="OPEN_FAILED" ;; esac
+  emit_control "KEY_OPEN:${OPEN_STATUS}"
+}
 
+submit_application_audit() {
+  local APP_ID="$1"
   REQUEST_JSON=$(jq -n --arg appId "$APP_ID" '{request:{appId:$appId}}')
 
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call apprelease.submitApplicationAudit \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT write application_audit -- alipay-cli mcp call apprelease.submitApplicationAudit \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -eq 75 ]; then
+    if query_application_info "$APP_ID"; then
+      ACTUAL_STATUS=$(extract_application_status)
+      case "$ACTUAL_STATUS" in
+        AUDITING|ON_LINE)
+          emit_control "✅ 应用审核提交已由应用信息查询核验成功"
+          emit_control_field "APP_ID" "$APP_ID" || return 1
+          emit_control "FLOW:AUDIT_SUBMITTED"
+          return 0
+          ;;
+      esac
+    fi
+    echo "❌ 应用提审响应不明且现有状态无法排除传播延迟，结果标记为 UNKNOWN，禁止自动重复提审"
+    exit 1
+  elif [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 应用提审因明确未发送的网络异常在自动重试两次后仍未恢复"
+    exit 1
+  fi
 
   # 错误检测
   if ! handle_error "$RESULT"; then
@@ -661,16 +836,32 @@ app_audit() {
   SUCCESS=$(echo "$BUSINESS" | jq -r '.success // false')
 
   if [ "$SUCCESS" = "true" ]; then
-    echo "✅ 应用审核提交成功"
-    echo "APP_ID=$APP_ID"
-    echo "FLOW:AUDIT_SUBMITTED"
+    emit_control "✅ 应用审核提交成功"
+    emit_control_field "APP_ID" "$APP_ID" || return 1
+    emit_control "FLOW:AUDIT_SUBMITTED"
   else
     ERROR_MSG=$(echo "$BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
+    ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
     echo "❌ 提交审核失败: $ERROR_MSG"
     exit 1
   fi
 }
 
+# ─── app audit: 提交应用审核 ─────────────────────────────────────────────────
+app_audit() {
+  if [ "$#" -ne 1 ] || [[ "${1:-}" == --* ]]; then
+    echo "❌ 参数格式错误：audit 使用位置参数 <appId>，不支持 --app-id 等未定义选项"
+    echo "用法: bash app.sh audit <appId>"
+    exit 1
+  fi
+
+  APP_ID="$1"
+  [ -n "$APP_ID" ] || { echo "❌ 请提供 appId"; echo "用法: bash app.sh audit <appId>"; exit 1; }
+  validate_control_value "$APP_ID" || { echo "❌ appId 包含非法控制字符"; exit 1; }
+  verify_key_and_export_alipay_public_key "$APP_ID" || exit 1
+  submit_application_audit "$APP_ID"
+}
+
 # ─── app verify-key: 确认应用公钥已设置 ─────────────────────────────────────
 app_verify_key() {
   if [ "$#" -lt 1 ] || [ "$#" -gt 2 ] || [[ "${1:-}" == --* ]]; then
@@ -687,17 +878,54 @@ app_verify_key() {
     echo "用法: bash app.sh verify-key <appId> [publicKey]"
     exit 1
   fi
+  validate_control_value "$APP_ID" || { echo "❌ appId 包含非法控制字符"; exit 1; }
 
   if ensure_rsa2_application_key_ready "$APP_ID" "$PUBLIC_KEY"; then
-    echo "✅ 应用公钥已确认"
-    echo "APP_ID=$APP_ID"
-    echo "FLOW:KEY_CONFIRMED"
+    emit_control "✅ 应用公钥已确认"
+    emit_control_field "APP_ID" "$APP_ID" || exit 1
+    emit_control "FLOW:KEY_CONFIRMED"
   else
-    echo "FLOW:KEY_NOT_CONFIRMED"
+    if [ "$KEY_VERIFY_RESULT" = "PENDING" ]; then
+      if ! render_key_pending; then
+        emit_control "FLOW:ERROR"
+        exit 1
+      fi
+      emit_control "FLOW:KEY_NOT_CONFIRMED"
+    else
+      emit_control "FLOW:ERROR"
+    fi
     exit 1
   fi
 }
 
+app_verify_key_and_audit() {
+  if [ "$#" -lt 1 ] || [ "$#" -gt 2 ] || [[ "${1:-}" == --* ]]; then
+    echo "❌ 参数格式错误：verify-key-and-audit 使用位置参数 <appId> [publicKey]，不支持 --app-id 等未定义选项"
+    echo "用法: bash app.sh verify-key-and-audit <appId> [publicKey]"
+    exit 1
+  fi
+
+  APP_ID="$1"
+  PUBLIC_KEY="${2:-}"
+  [ -n "$APP_ID" ] || { echo "❌ 请提供 appId"; exit 1; }
+  validate_control_value "$APP_ID" || { echo "❌ appId 包含非法控制字符"; exit 1; }
+
+  if ! ensure_rsa2_application_key_ready "$APP_ID" "$PUBLIC_KEY"; then
+    if [ "$KEY_VERIFY_RESULT" = "PENDING" ]; then
+      if ! render_key_pending; then
+        emit_control "FLOW:ERROR"
+        exit 1
+      fi
+      emit_control "FLOW:KEY_NOT_CONFIRMED"
+    else
+      emit_control "FLOW:ERROR"
+    fi
+    exit 1
+  fi
+  export_alipay_public_key_from_security_business "$APP_ID" || exit 1
+  submit_application_audit "$APP_ID"
+}
+
 # ─── app reuse: 复用已有应用（查询安全密钥） ──────────────────────────────────
 app_reuse() {
   if [ "$#" -ne 1 ] || [[ "${1:-}" == --* ]]; then
@@ -713,16 +941,17 @@ app_reuse() {
     echo "用法: bash app.sh reuse <appId>"
     exit 1
   fi
+  validate_control_value "$APP_ID" || { echo "❌ appId 包含非法控制字符"; exit 1; }
 
   if query_application_info "$APP_ID"; then
     APP_STATUS=$(extract_application_status)
     if [ "$APP_STATUS" != "ON_LINE" ]; then
       echo "❌ 仅允许复用 ON_LINE（已上线）应用，当前应用状态: ${APP_STATUS:-未知}"
-      echo "FLOW:ERROR"
+      emit_control "FLOW:ERROR"
       exit 1
     fi
   else
-    echo "FLOW:ERROR"
+    emit_control "FLOW:ERROR"
     exit 1
   fi
 
@@ -732,27 +961,27 @@ app_reuse() {
     ALIPAY_PUBLIC_KEY=$(extract_alipay_public_key "$RSA2_ALIPAY_KEY_INFO")
 
     if ! is_rsa2_application_key_ready "$RSA2_KEY_INFO"; then
-      echo "⚠️ 未确认到已生效的 RSA2 应用公钥"
-      echo "FLOW:REUSE_NO_KEY"
+      emit_control "⚠️ 未确认到已生效的 RSA2 应用公钥"
+      emit_control "FLOW:REUSE_NO_KEY"
       exit 1
     elif [ -n "$ALIPAY_PUBLIC_KEY" ]; then
       if write_alipay_public_key "$APP_ID" "$ALIPAY_PUBLIC_KEY"; then
-        echo "✅ 已获取支付宝公钥"
-        echo "支付宝公钥保存路径: ~/.config/${APP_ID}-alipayPublicKey.keytext"
-        echo "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=EXPORTED"
-        echo "ALIPAY_PUBLIC_KEY_FILE=~/.config/${APP_ID}-alipayPublicKey.keytext"
+        emit_control "✅ 已获取支付宝公钥"
+        emit_control "支付宝公钥保存路径: ~/.config/${APP_ID}-alipayPublicKey.keytext"
+        emit_control "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=EXPORTED"
+        emit_control "ALIPAY_PUBLIC_KEY_FILE=~/.config/${APP_ID}-alipayPublicKey.keytext"
       else
-        echo "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=MANUAL_CONFIGURATION_REQUIRED"
+        emit_control "ALIPAY_PUBLIC_KEY_EXPORT_STATUS=MANUAL_CONFIGURATION_REQUIRED"
       fi
-      echo "APP_ID=$APP_ID"
-      echo "FLOW:REUSE_SUCCESS"
+      emit_control_field "APP_ID" "$APP_ID" || exit 1
+      emit_control "FLOW:REUSE_SUCCESS"
     else
       echo "❌ 已确认应用公钥生效，但未获取到 RSA2 支付宝公钥"
-      echo "FLOW:ERROR"
+      emit_control "FLOW:ERROR"
       exit 1
     fi
   else
-    echo "FLOW:ERROR"
+    emit_control "FLOW:ERROR"
     exit 1
   fi
 }
@@ -760,7 +989,7 @@ app_reuse() {
 # ─── 入口分发 ────────────────────────────────────────────────────────────────
 APP_COMMAND="${1:-}"
 case "$APP_COMMAND" in
-  list|create|key|verify-key|audit|reuse)
+  list|create|key|verify-key|verify-key-and-audit|audit|reuse)
     require_command alipay-cli || exit 1
     ;;
 esac
@@ -778,10 +1007,18 @@ case "$APP_COMMAND" in
     shift
     app_key "$@"
     ;;
+  open-key-page)
+    shift
+    app_open_key_page "$@"
+    ;;
   verify-key)
     shift
     app_verify_key "$@"
     ;;
+  verify-key-and-audit)
+    shift
+    app_verify_key_and_audit "$@"
+    ;;
   audit)
     shift
     app_audit "$@"
@@ -791,12 +1028,14 @@ case "$APP_COMMAND" in
     app_reuse "$@"
     ;;
   *)
-    echo "用法: bash app.sh <list|create|key|verify-key|audit|reuse> [参数...]"
+    echo "用法: bash app.sh <list|create|key|open-key-page|verify-key|verify-key-and-audit|audit|reuse> [参数...]"
     echo ""
     echo "  app list [--product-type <type> --sales-code <code> --application-type <type>]   - 查询已有应用"
     echo "  app create [--product-type <type> --sales-code <code> --application-type <type>] [--mobile-platform IOS|ANDROID|ALL ...] - 创建新应用"
-    echo "  app key    <appId> <pubKey> - 设置公钥"
+    echo "  app key    --defer-open <appId> <pubKey> - 设置公钥"
+    echo "  app open-key-page <appId>  - 打开已生成的公钥确认页"
     echo "  app verify-key <appId> [pubKey] - 确认公钥设置结果"
+    echo "  app verify-key-and-audit <appId> [pubKey] - 确认公钥并提交审核"
     echo "  app audit  <appId>          - 提交审核"
     echo "  app reuse  <appId>          - 复用应用"
     exit 1