@alipay/alipay-aipay 1.2.2 → 1.5.0

package/skill/references/onboarding/modules/scripts/auth.sh

@@ -3,15 +3,19 @@
 # 脚本名称: auth.sh
 # 功能描述: 登录授权全流程 - 检查状态 + 执行登录 + 授权确认 + scope/MCC 校验 + 重新授权
 # 调用位置: Step 3 登录授权
-# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME；必要时可用 DEV_TOOL_NAME 环境变量覆盖
+# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME/PLATFORM_ID；必要时可用 DEV_TOOL_NAME 环境变量覆盖
 # 用法:
-#   auth init   --scope <scope> --sales-code <code> --mcc-code <code> [--product-name <name> --mcc-name <name>]
+#   auth init   --defer-open --scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>
+#   auth open   [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]
 #   auth confirm [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]
-#   auth mismatch [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]
+#   auth wait [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]
+#   auth mismatch --defer-open [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]
 # 返回值:
-#   init:     AUTH_FLOW:SKIP | AUTH_FLOW:READY | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:FAILED
-#   confirm:  AUTH_FLOW:AUTH_SUCCESS | AUTH_FLOW:PENDING | AUTH_FLOW:EXPIRED | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:FAILED
-#   mismatch: 执行一次 logout 后调用 auth init 重新生成授权链接（不输出 FLOW 标记，由 auth init 输出 AUTH_FLOW:READY）
+#   init:     AUTH_FLOW:SKIP | AUTH_FLOW:READY_TO_OPEN | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:RETRY_WITH_NETWORK | AUTH_FLOW:FAILED
+#   wait:     AUTH_FLOW:AUTH_SUCCESS | AUTH_FLOW:PENDING | AUTH_FLOW:EXPIRED | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:CONTEXT_MISMATCH | AUTH_FLOW:RETRY_WITH_NETWORK | AUTH_FLOW:FAILED
+#   confirm:  AUTH_FLOW:AUTH_SUCCESS | AUTH_FLOW:PENDING | AUTH_FLOW:EXPIRED | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:CONTEXT_MISMATCH | AUTH_FLOW:RETRY_WITH_NETWORK | AUTH_FLOW:FAILED
+#   mismatch: logout 可确认成功后调用 auth init 重新生成授权链接；上下文冲突时输出 AUTH_FLOW:CONTEXT_MISMATCH 且不 logout；无法确认 CLI 结果时输出 AUTH_FLOW:RETRY_WITH_NETWORK
+#   stdout:   仅登记对客正文；AUTH_FLOW/状态/查询复用标记写入 stderr
 #=============================================================================
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -23,22 +27,113 @@ else
   echo "❌ 缺少错误处理脚本: ${SCRIPT_DIR}/error_handler.sh"
   exit 1
 fi
+source "${SCRIPT_DIR}/network_retry.sh"
+source "${SCRIPT_DIR}/sign_status_parser.sh"
+RENDERER="${SCRIPT_DIR}/../../../normal/scripts/render_customer_message.mjs"
 
 require_command jq || exit 1
 require_command alipay-cli || exit 1
+require_command node || exit 1
 require_command mktemp || exit 1
+umask 077
 
 # ─── 授权状态文件（用于独立执行 confirm/mismatch 时兜底恢复非敏感参数）────
 AUTH_STATE_OWNER="$(id -u 2>/dev/null || printf '%s' "${USER:-unknown}" | tr -c 'A-Za-z0-9_-' '_')"
-AUTH_STATE_DIR="${TMPDIR:-/tmp}"
-AUTH_STATE_DIR="${AUTH_STATE_DIR%/}"
-AUTH_STATE_FILE="${ALIPAY_AUTH_STATE_FILE:-${AUTH_STATE_DIR}/.alipay_auth_state_${AUTH_STATE_OWNER}.json}"
+AUTH_STATE_BASE="${TMPDIR:-/tmp}"
+AUTH_STATE_BASE="${AUTH_STATE_BASE%/}"
+if [ -n "${ALIPAY_AUTH_STATE_FILE:-}" ]; then
+  AUTH_STATE_FILE="$ALIPAY_AUTH_STATE_FILE"
+  AUTH_STATE_DIR="$(dirname "$AUTH_STATE_FILE")"
+  AUTH_STATE_DIR_MANAGED=false
+else
+  AUTH_STATE_DIR="${AUTH_STATE_BASE}/alipay-aipay-auth-${AUTH_STATE_OWNER}"
+  AUTH_STATE_FILE="${AUTH_STATE_DIR}/state.json"
+  AUTH_STATE_DIR_MANAGED=true
+fi
+
+secure_mode() {
+  local target="$1" expected="$2" mode
+  if mode=$(stat -f '%Lp' "$target" 2>/dev/null); then
+    :
+  elif mode=$(stat -c '%a' "$target" 2>/dev/null); then
+    :
+  else
+    return 1
+  fi
+  [ "$mode" = "$expected" ]
+}
+
+prepare_auth_state_dir() {
+  if [ "$AUTH_STATE_DIR_MANAGED" = true ]; then
+    if [ -L "$AUTH_STATE_DIR" ] || { [ -e "$AUTH_STATE_DIR" ] && [ ! -d "$AUTH_STATE_DIR" ]; }; then
+      echo "❌ 授权临时目录不安全，已停止" >&2
+      return 1
+    fi
+    mkdir -p "$AUTH_STATE_DIR" || return 1
+    chmod 700 "$AUTH_STATE_DIR" 2>/dev/null || return 1
+    secure_mode "$AUTH_STATE_DIR" 700 || return 1
+  else
+    [ -d "$AUTH_STATE_DIR" ] && [ ! -L "$AUTH_STATE_DIR" ] || {
+      echo "❌ 指定的授权状态目录不可用或不安全，已停止" >&2
+      return 1
+    }
+  fi
+}
+
+validate_auth_state_file() {
+  [ -f "$AUTH_STATE_FILE" ] && [ ! -L "$AUTH_STATE_FILE" ] || return 1
+  chmod 600 "$AUTH_STATE_FILE" 2>/dev/null || return 1
+  secure_mode "$AUTH_STATE_FILE" 600
+}
 
 cleanup_auth_state() {
   rm -f "$AUTH_STATE_FILE"
 }
 
+reset_auth_state_for_init() {
+  local field current saved
+  AUTH_INIT_CONTEXT_MISMATCH_TYPE=""
+  [ -e "$AUTH_STATE_FILE" ] || [ -L "$AUTH_STATE_FILE" ] || return 0
+  if ! prepare_auth_state_dir || ! validate_auth_state_file; then
+    echo "❌ 授权状态文件不可用或不安全，已停止"
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  fi
+
+  # 新上下文通过机器校验后才读取旧状态；只记录差异类型，不复用旧 deviceCode。
+  if jq -e 'type == "object"' "$AUTH_STATE_FILE" >/dev/null 2>&1; then
+    for field in salesCode scope productName mccCode mccName; do
+      case "$field" in
+        salesCode) current="$SALES_CODE" ;;
+        scope) current="$SCOPE" ;;
+        productName) current="$PRODUCT_NAME" ;;
+        mccCode) current="$MCC_CODE" ;;
+        mccName) current="$MCC_NAME" ;;
+      esac
+      saved=$(jq -r --arg field "$field" '.[$field] // ""' "$AUTH_STATE_FILE")
+      if [ "$current" != "$saved" ]; then
+        case "$field" in
+          salesCode|scope|productName) AUTH_INIT_CONTEXT_MISMATCH_TYPE="SCOPE_MISMATCH" ;;
+          *) [ -n "$AUTH_INIT_CONTEXT_MISMATCH_TYPE" ] || AUTH_INIT_CONTEXT_MISMATCH_TYPE="MCC_MISMATCH" ;;
+        esac
+      fi
+    done
+  else
+    # 无法证明旧状态属于当前产品上下文时，已有登录也必须重新授权。
+    AUTH_INIT_CONTEXT_MISMATCH_TYPE="SCOPE_MISMATCH"
+  fi
+  cleanup_auth_state
+}
+
 save_auth_state() {
+  local temp_state
+  prepare_auth_state_dir || return 1
+  if [ -L "$AUTH_STATE_FILE" ] || { [ -e "$AUTH_STATE_FILE" ] && [ ! -f "$AUTH_STATE_FILE" ]; }; then
+    echo "❌ 授权状态路径不是安全的普通文件，已停止" >&2
+    return 1
+  fi
+  temp_state=$(mktemp "${AUTH_STATE_DIR}/.auth-state.XXXXXX") || return 1
+  chmod 600 "$temp_state" 2>/dev/null || { rm -f "$temp_state"; return 1; }
   jq -n \
     --arg salesCode "$SALES_CODE" \
     --arg mccCode "$MCC_CODE" \
@@ -46,19 +141,26 @@ save_auth_state() {
     --arg productName "${PRODUCT_NAME:-}" \
     --arg mccName "${MCC_NAME:-}" \
     --arg deviceCode "${DEVICE_CODE:-}" \
+    --arg authorizationUrl "${BROWSER_URL:-}" \
     '{
       salesCode: $salesCode,
       mccCode: $mccCode,
       scope: $scope,
       productName: $productName,
       mccName: $mccName,
-      deviceCode: $deviceCode
-    }' > "$AUTH_STATE_FILE"
-  chmod 600 "$AUTH_STATE_FILE" 2>/dev/null || true
+      deviceCode: $deviceCode,
+      authorizationUrl: $authorizationUrl
+    }' > "$temp_state" || { rm -f "$temp_state"; return 1; }
+  mv "$temp_state" "$AUTH_STATE_FILE" || { rm -f "$temp_state"; return 1; }
+  validate_auth_state_file || {
+    cleanup_auth_state
+    echo "❌ 无法确认授权状态文件权限为 0600，已停止" >&2
+    return 1
+  }
 }
 
 load_auth_state() {
-  if [ ! -f "$AUTH_STATE_FILE" ]; then
+  if ! validate_auth_state_file; then
     echo "❌ 缺少授权上下文（请传入 --sales-code/--mcc-code，或先执行 auth.sh init）"
     return 1
   fi
@@ -75,6 +177,33 @@ load_auth_state() {
   [ -n "${MCC_NAME:-}" ] || MCC_NAME=$(jq -r '.mccName // ""' "$AUTH_STATE_FILE")
 }
 
+verify_context_against_auth_state() {
+  local field current saved
+  [ -e "$AUTH_STATE_FILE" ] || [ -L "$AUTH_STATE_FILE" ] || return 0
+  if ! validate_auth_state_file; then
+    echo "❌ 授权状态文件不可用或不安全，已停止"
+    return 1
+  fi
+  if ! jq -e . "$AUTH_STATE_FILE" >/dev/null 2>&1; then
+    echo "❌ 授权状态文件不是合法 JSON: $AUTH_STATE_FILE"
+    return 1
+  fi
+  for field in salesCode mccCode scope productName mccName; do
+    case "$field" in
+      salesCode) current="$SALES_CODE" ;;
+      mccCode) current="$MCC_CODE" ;;
+      scope) current="$SCOPE" ;;
+      productName) current="$PRODUCT_NAME" ;;
+      mccName) current="$MCC_NAME" ;;
+    esac
+    saved=$(jq -r --arg field "$field" '.[$field] // ""' "$AUTH_STATE_FILE")
+    if [ -n "$current" ] && [ -n "$saved" ] && [ "$current" != "$saved" ]; then
+      emit_control "AUTH_FLOW:CONTEXT_MISMATCH"
+      return 1
+    fi
+  done
+}
+
 parse_auth_context_args() {
   while [[ $# -gt 0 ]]; do
     case $1 in
@@ -109,13 +238,17 @@ restore_auth_context_or_state() {
     parse_auth_context_args "$@" || return 1
   fi
 
-  if [ -z "$SALES_CODE" ] || [ -z "$MCC_CODE" ]; then
+  verify_context_against_auth_state || return 1
+  if [ -e "$AUTH_STATE_FILE" ] || [ -L "$AUTH_STATE_FILE" ]; then
+    load_auth_state || return 1
+  elif [ -z "$SALES_CODE" ] || [ -z "$MCC_CODE" ] || [ -z "$PRODUCT_NAME" ] || [ -z "$MCC_NAME" ]; then
     load_auth_state || return 1
   fi
 
   if [ -z "$SCOPE" ]; then
     SCOPE=$(get_scope "$SALES_CODE")
   fi
+  validate_auth_context || return 1
 }
 
 # ─── 共用：根据 salesCode 获取 scope ─────────────────────────────────────────
@@ -128,27 +261,97 @@ get_scope() {
   esac
 }
 
+validate_auth_context() {
+  local context_json
+  context_json=$(jq -n \
+    --arg productName "$PRODUCT_NAME" \
+    --arg salesCode "$SALES_CODE" \
+    --arg scope "$SCOPE" \
+    --arg mccCode "$MCC_CODE" \
+    --arg mccName "$MCC_NAME" \
+    '{productName:$productName,salesCode:$salesCode,scope:$scope,mccCode:$mccCode,mccName:$mccName}') || return 1
+  if ! printf '%s' "$context_json" | node "$RENDERER" --validate-authorization-context >/dev/null; then
+    echo "❌ 授权上下文校验失败：产品、产品码、scope 或 MCC 不匹配当前固定规则"
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  fi
+  init_alipay_cli_product_from_sales_code "$SALES_CODE" || {
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  }
+}
+
+build_authorization_url() {
+  local input_json platform_value
+  platform_value="${DEV_TOOL_NAME:-}"
+  [ "$platform_value" = "unknown" ] && platform_value=""
+  input_json=$(jq -n \
+    --arg productName "$PRODUCT_NAME" \
+    --arg salesCode "$SALES_CODE" \
+    --arg scope "$SCOPE" \
+    --arg mccCode "$MCC_CODE" \
+    --arg mccName "$MCC_NAME" \
+    --arg deviceCode "$DEVICE_CODE" \
+    --arg platform "$platform_value" \
+    '{productName:$productName,salesCode:$salesCode,scope:$scope,mccCode:$mccCode,mccName:$mccName,deviceCode:$deviceCode,platform:$platform}') || return 1
+  printf '%s' "$input_json" | node "$RENDERER" --build-authorization-url
+}
+
 extract_json_payload() {
   local raw="$1"
-  local line_count start candidate
+  local analysis status
+  analysis=$(extract_unique_json "$raw") || return 1
+  status=$(printf '%s' "$analysis" | jq -r '.status // "none"' 2>/dev/null)
+  [ "$status" = "ok" ] || return 1
+  printf '%s' "$analysis" | jq -ce '.value | select(type == "object")' 2>/dev/null
+}
 
-  if printf '%s' "$raw" | jq -e . >/dev/null 2>&1; then
-    printf '%s' "$raw"
-    return 0
+auth_cli_environment_failure() {
+  local action="$1"
+  echo "❌ ${action} 未能在当前 Agent 执行环境取得可确认结果，已停止。"
+  echo "📋 这通常表示当前执行环境缺少联网权限、CLI wrapper 混入输出，或 stdout/stderr 无法唯一解析。"
+  echo "📋 这不代表支付宝业务失败，也不能据此判断用户本机 logout/login 失败。"
+  echo "📋 Agent 应申请可联网权限后重试同一条 auth.sh 命令；不要要求用户手动 logout/login 代替本轮事实。"
+  emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
+}
+
+wait_for_effective_whoami() {
+  local action="$1"
+  local max_attempts=3
+  local interval_seconds=2
+  local attempt=1
+  local logged_in is_expired
+
+  AUTH_WHOAMI_RESULT=""
+  if [ "${ALIPAY_AIPAY_TEST_MODE:-0}" = "1" ] && [[ "${AUTH_WHOAMI_RECHECK_INTERVAL_SECONDS:-}" =~ ^[0-9]+$ ]]; then
+    interval_seconds="$AUTH_WHOAMI_RECHECK_INTERVAL_SECONDS"
   fi
 
-  line_count=$(printf '%s\n' "$raw" | wc -l | tr -d ' ')
-  start=1
-  while [ "$start" -le "$line_count" ]; do
-    candidate=$(printf '%s\n' "$raw" | sed -n "${start},\$p")
-    if printf '%s' "$candidate" | jq -e . >/dev/null 2>&1; then
-      printf '%s' "$candidate"
+  while [ "$attempt" -le "$max_attempts" ]; do
+    AUTH_WHOAMI_RESULT=$(run_json_command "alipay-cli whoami --json" alipay-cli whoami --json) || {
+      auth_cli_environment_failure "$action"
+      return 1
+    }
+    if ! handle_error "$AUTH_WHOAMI_RESULT"; then
+      emit_control "AUTH_FLOW:FAILED"
+      return 1
+    fi
+
+    logged_in=$(echo "$AUTH_WHOAMI_RESULT" | jq -r '.data.logged_in // false')
+    is_expired=$(echo "$AUTH_WHOAMI_RESULT" | jq -r '.data.is_expired // false')
+    if [ "$logged_in" = "true" ] && [ "$is_expired" != "true" ]; then
       return 0
     fi
-    start=$((start + 1))
+
+    emit_control "AUTH_WHOAMI_RECHECK=${attempt}/${max_attempts}"
+    if [ "$attempt" -lt "$max_attempts" ]; then
+      sleep "$interval_seconds"
+    fi
+    attempt=$((attempt + 1))
   done
 
-  return 1
+  emit_control "AUTH_WHOAMI_NOT_EFFECTIVE"
+  return 2
 }
 
 run_json_command() {
@@ -157,7 +360,7 @@ run_json_command() {
   local stderr_file stdout stderr_output combined_output exit_code json_payload
 
   stderr_file="$(mktemp "${TMPDIR:-/tmp}/alipay_auth_stderr.XXXXXX")" || return 1
-  stdout=$(PLATFORM="${DEV_TOOL_NAME}" "$@" 2>"$stderr_file")
+  stdout=$(PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}" PRODUCT="${PRODUCT:-}" "$@" 2>"$stderr_file")
   exit_code=$?
   stderr_output=$(cat "$stderr_file")
 
@@ -180,16 +383,7 @@ run_json_command() {
     return 0
   fi
 
-  echo "❌ ${label} 未返回合法 JSON" >&2
-  echo "📋 退出码: ${exit_code}" >&2
-  if [ -n "$stderr_output" ]; then
-    echo "📋 错误输出：" >&2
-    printf '%s\n' "$stderr_output" >&2
-  fi
-  if [ -n "$stdout" ]; then
-    echo "📋 标准输出：" >&2
-    printf '%s\n' "$stdout" >&2
-  fi
+  echo "❌ ${label} 未返回可唯一解析的合法 JSON（退出码: ${exit_code}）；原始输出已隐藏，请申请联网权限后重试同一条 auth.sh 命令" >&2
   rm -f "$stderr_file"
   return 1
 }
@@ -199,26 +393,27 @@ run_json_command() {
 validate_current_authorization() {
   local whoami_result="${1:-}"
   local logged_in is_expired granted_scope required_scope
-  local scope_match mcc_verify_result mcc_verify_unwrapped mcc_match
+  local scope_match mcc_verify_result mcc_verify_unwrapped mcc_match mcc_raw retry_rc
   local mcc_error_type mcc_error_code mcc_success
-  local granted_scope_item
-  local -a granted_scope_items
+  local mismatch_type sign_status_output
+  local granted_scope_item required_scope_item required_scope_found
+  local -a granted_scope_items required_scope_items
 
   if [ -z "$SALES_CODE" ] || [ -z "$MCC_CODE" ]; then
     echo "❌ 缺少授权校验参数"
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
 
   if [ -z "$whoami_result" ]; then
     whoami_result=$(run_json_command "alipay-cli whoami --json" alipay-cli whoami --json) || {
-      echo "AUTH_FLOW:FAILED"
+      auth_cli_environment_failure "登录状态复核"
       return 1
     }
   fi
 
   if ! handle_error "$whoami_result"; then
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
 
@@ -226,40 +421,52 @@ validate_current_authorization() {
   is_expired=$(echo "$whoami_result" | jq -r '.data.is_expired // false')
   if [ "$logged_in" != "true" ] || [ "$is_expired" = "true" ]; then
     echo "❌ 当前登录状态无效或已过期"
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
 
   granted_scope=$(echo "$whoami_result" | jq -r '.data.scope // empty')
-  case "$SALES_CODE" in
-    "I1080300001000041203") required_scope="fast_instant_trade_pay:write" ;;
-    "I1080300001000041313") required_scope="auth_alipay_apppay:write" ;;
-    "I1080300001000160457") required_scope="machine_pay:write" ;;
-    *)
-      echo "❌ 未知产品码: $SALES_CODE"
-      echo "AUTH_FLOW:FAILED"
-      return 1
-      ;;
-  esac
+  required_scope=$(get_scope "$SALES_CODE")
+  if [ -z "$required_scope" ] || [ "$SCOPE" != "$required_scope" ]; then
+    echo "❌ 当前产品的固定 scope 上下文无效"
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  fi
 
-  scope_match="false"
+  scope_match="true"
   IFS=',' read -r -a granted_scope_items <<< "$granted_scope"
-  for granted_scope_item in "${granted_scope_items[@]}"; do
-    granted_scope_item="${granted_scope_item#"${granted_scope_item%%[![:space:]]*}"}"
-    granted_scope_item="${granted_scope_item%"${granted_scope_item##*[![:space:]]}"}"
-    if [ "$granted_scope_item" = "$required_scope" ]; then
-      scope_match="true"
+  IFS=',' read -r -a required_scope_items <<< "$required_scope"
+  for required_scope_item in "${required_scope_items[@]}"; do
+    required_scope_found="false"
+    for granted_scope_item in "${granted_scope_items[@]}"; do
+      granted_scope_item="${granted_scope_item#"${granted_scope_item%%[![:space:]]*}"}"
+      granted_scope_item="${granted_scope_item%"${granted_scope_item##*[![:space:]]}"}"
+      if [ "$granted_scope_item" = "$required_scope_item" ]; then
+        required_scope_found="true"
+        break
+      fi
+    done
+    if [ "$required_scope_found" != "true" ]; then
+      scope_match="false"
       break
     fi
   done
 
   mcc_match="true"
   if [ "$scope_match" = "true" ]; then
-    mcc_verify_result=$(run_json_command "alipay-cli mcp call ar-query.queryArInfosBySalesProd" \
-      alipay-cli mcp call ar-query.queryArInfosBySalesProd \
+    export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+    run_network_retry mcc_raw read authorization_mcc_check -- alipay-cli mcp call ar-query.queryArInfosBySalesProd \
       -d "{\"request\":{\"salesProductCodes\":[\"${SALES_CODE}\"]},\"ctx\":{}}" \
-      --json) || {
-      echo "AUTH_FLOW:FAILED"
+      --json
+    retry_rc=$?
+    if [ "$retry_rc" -ne 0 ]; then
+      echo "❌ 授权 MCC 校验因网络或服务异常在自动重试两次后仍未恢复"
+      emit_control "AUTH_FLOW:FAILED"
+      return 1
+    fi
+    mcc_verify_result=$(extract_json_payload "$mcc_raw") || {
+      echo "❌ alipay-cli mcp call ar-query.queryArInfosBySalesProd 未返回合法 JSON"
+      emit_control "AUTH_FLOW:FAILED"
       return 1
     }
 
@@ -269,7 +476,7 @@ validate_current_authorization() {
       mcc_match="false"
     elif [ "$mcc_error_type" != "SUCCESS" ]; then
       echo "❌ MCC 校验失败"
-      echo "AUTH_FLOW:FAILED"
+      emit_control "AUTH_FLOW:FAILED"
       return 1
     fi
 
@@ -282,37 +489,32 @@ validate_current_authorization() {
     elif echo "$mcc_verify_unwrapped" | grep -qi "mccCode.*is not auth"; then
       mcc_match="false"
     fi
+
+    # 同一请求也是 Step 3.1 的签约查询；仅在完整结构可由共享解析器证明时输出可复用事实。
+    if [ "$mcc_match" = "true" ] && sign_status_output=$(emit_sign_status_from_business "$mcc_verify_unwrapped" "$SALES_CODE" 2>/dev/null); then
+      printf '%s\n' "$sign_status_output" \
+        | while IFS= read -r marker; do emit_control "$marker"; done
+      emit_control "AUTH_SIGN_QUERY_REUSABLE=true"
+    fi
   fi
 
   if [ "$scope_match" = "true" ] && [ "$mcc_match" = "true" ]; then
-    echo "✅ 授权范围校验通过（scope + MCC）"
+    emit_control "✅ 授权范围校验通过（scope + MCC 授权有效性）"
     return 0
   fi
 
-  echo ""
-  echo "⚠️ 授权范围不满足"
   if [ "$scope_match" != "true" ]; then
-    echo "📋 原因：scope 权限不满足"
-    echo "🤖 需要权限: $required_scope"
-    echo "🤖 已授权 scope: $granted_scope"
-  fi
-  if [ "$mcc_match" != "true" ]; then
-    echo "📋 原因：经营类目未授权"
-    echo "🤖 当前类目: $MCC_CODE"
-  fi
-
-  echo ""
-  echo "📋 必须通过 auth.sh mismatch 退出当前登录并重新授权"
-  if [ "$scope_match" != "true" ]; then
-    echo "AUTH_FLOW:SCOPE_MISMATCH"
+    mismatch_type="SCOPE_MISMATCH"
   else
-    echo "AUTH_FLOW:MCC_MISMATCH"
+    mismatch_type="MCC_MISMATCH"
   fi
+  emit_control "AUTH_FLOW:${mismatch_type}"
   return 1
 }
 
 # ─── auth init: 检查登录状态 + 执行登录 + 构建授权链接 + 输出授权信息 ────────
 auth_init() {
+  local DEFER_OPEN=false
   SCOPE=""
   SALES_CODE=""
   MCC_CODE=""
@@ -321,6 +523,8 @@ auth_init() {
 
   while [[ $# -gt 0 ]]; do
     case $1 in
+      --defer-open)
+        DEFER_OPEN=true; shift ;;
       --scope)
         [ $# -ge 2 ] || { echo "❌ 缺少参数值: $1"; exit 1; }
         SCOPE="$2"; shift 2 ;;
@@ -340,40 +544,57 @@ auth_init() {
     esac
   done
 
-  if [ -z "$SCOPE" ] || [ -z "$SALES_CODE" ] || [ -z "$MCC_CODE" ]; then
+  if [ -z "$SCOPE" ] || [ -z "$SALES_CODE" ] || [ -z "$MCC_CODE" ] || [ -z "$PRODUCT_NAME" ] || [ -z "$MCC_NAME" ]; then
     echo "❌ 缺少必填参数"
-    echo "用法: bash auth.sh init --scope <scope> --sales-code <code> --mcc-code <code> [--product-name <name> --mcc-name <name>]"
+    echo "用法: bash auth.sh init --defer-open --scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>"
     exit 1
   fi
+  if [ "$DEFER_OPEN" != true ]; then
+    echo "❌ 参数格式错误：auth init 必须使用 --defer-open，确保先展示授权说明和链接，再自动打开页面"
+    echo "用法: bash auth.sh init --defer-open --scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>"
+    exit 1
+  fi
+  validate_auth_context || return 1
+  emit_stage_metric_async "onboarding.auth.start" "$PRODUCT_NAME"
+  # 新 init 表示按已确认上下文重建授权链路；只在机器校验通过后替换旧短时状态。
+  reset_auth_state_for_init || return 1
 
   # Step 1: 检查登录状态
   CHECK_RESULT=$(run_json_command "alipay-cli whoami --json" alipay-cli whoami --json) || {
-    echo "AUTH_FLOW:FAILED"
+    auth_cli_environment_failure "登录状态检查"
     return 1
   }
   if ! handle_error "$CHECK_RESULT"; then
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
   LOGGED_IN=$(echo "$CHECK_RESULT" | jq -r '.data.logged_in // false')
   IS_EXPIRED=$(echo "$CHECK_RESULT" | jq -r '.data.is_expired // false')
 
   if [ "$LOGGED_IN" = "true" ] && [ "$IS_EXPIRED" = "false" ]; then
+    if [ -n "$AUTH_INIT_CONTEXT_MISMATCH_TYPE" ]; then
+      # 后端查询没有权威 MCC 字段，旧状态变化时不能把现有登录误判为当前上下文已授权。
+      DEVICE_CODE=""
+      BROWSER_URL=""
+      save_auth_state || return 1
+      emit_control "AUTH_FLOW:${AUTH_INIT_CONTEXT_MISMATCH_TYPE}"
+      return 1
+    fi
     validate_current_authorization "$CHECK_RESULT" || return 1
     DEVICE_CODE=""
-    save_auth_state
-    echo "✅ 当前登录及授权范围有效，可继续后续流程"
-    echo "AUTH_FLOW:SKIP"
+    save_auth_state || return 1
+    emit_control "✅ 当前登录及授权范围有效，可继续后续流程"
+    emit_control "AUTH_FLOW:SKIP"
     return 0
   fi
 
   # Step 2: 执行登录
   LOGIN_RESULT=$(run_json_command "alipay-cli login --non-interactive --scope" alipay-cli login --non-interactive --scope "$SCOPE" --json) || {
-    echo "AUTH_FLOW:FAILED"
+    auth_cli_environment_failure "授权登录发起"
     return 1
   }
   if ! handle_error "$LOGIN_RESULT"; then
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
   LOGIN_STATUS=$(echo "$LOGIN_RESULT" | jq -r '.data.status // ""')
@@ -381,9 +602,9 @@ auth_init() {
   if [ "$LOGIN_STATUS" = "already_logged_in" ]; then
     validate_current_authorization || return 1
     DEVICE_CODE=""
-    save_auth_state
-    echo "✅ 当前登录及授权范围有效，可继续后续流程"
-    echo "AUTH_FLOW:SKIP"
+    save_auth_state || return 1
+    emit_control "✅ 当前登录及授权范围有效，可继续后续流程"
+    emit_control "AUTH_FLOW:SKIP"
     return 0
   fi
 
@@ -396,30 +617,21 @@ auth_init() {
   # Step 4: 参数校验
   if [ -z "$DEVICE_CODE" ] || [ -z "$SALES_CODE" ] || [ -z "$MCC_CODE" ]; then
     echo "❌ 授权链接参数不完整，无法生成授权链接"
-    echo "📋 deviceCode: ${DEVICE_CODE:-空}"
-    echo "📋 productCode: ${SALES_CODE:-空}"
-    echo "📋 mccCode: ${MCC_CODE:-空}"
+    [ -n "$DEVICE_CODE" ] || echo "📋 缺少字段: deviceCode"
+    [ -n "$SALES_CODE" ] || echo "📋 缺少字段: productCode"
+    [ -n "$MCC_CODE" ] || echo "📋 缺少字段: mccCode"
     exit 1
   fi
 
-  # Step 5: 构建并校验授权链接（禁止使用 CLI 返回的 verification_url）
-  BROWSER_URL="https://aipay.alipay.com/cli-auth?deviceCode=${DEVICE_CODE}&productCode=${SALES_CODE}&mccCode=${MCC_CODE}"
-  if [ -n "${DEV_TOOL_NAME:-}" ] && [ "$DEV_TOOL_NAME" != "unknown" ]; then
-    AUTH_PLATFORM=$(jq -nr --arg value "$DEV_TOOL_NAME" '$value|@uri')
-    BROWSER_URL="${BROWSER_URL}&platform=${AUTH_PLATFORM}"
-  fi
-  if [[ "$BROWSER_URL" != https://aipay.alipay.com/cli-auth\?* ]] ||
-     [[ "$BROWSER_URL" != *"deviceCode=${DEVICE_CODE}"* ]] ||
-     [[ "$BROWSER_URL" != *"productCode=${SALES_CODE}"* ]] ||
-     [[ "$BROWSER_URL" != *"mccCode=${MCC_CODE}"* ]] ||
-     [[ "$BROWSER_URL" == *"opengw.alipay.com/oauth/device"* ]]; then
+  # Step 5: 由统一校验器编码、构建并逐字段校验授权链接。
+  BROWSER_URL=$(build_authorization_url) || {
     echo "❌ 授权链接构建失败，缺少必要参数或误用了 CLI verification_url，已停止。"
     echo "📋 正确格式: https://aipay.alipay.com/cli-auth?deviceCode=...&productCode=...&mccCode=..."
-    exit 1
-  fi
+    return 1
+  }
 
   # Step 6: 保存参数到状态文件（供 confirm/mismatch 使用）
-  save_auth_state
+  save_auth_state || return 1
 
   # Step 7: 有效期转换（对非数字做防护）
   if [[ "$EXPIRES_IN" =~ ^[0-9]+$ ]] && [ "$EXPIRES_IN" -ge 60 ]; then
@@ -431,35 +643,56 @@ auth_init() {
     EXPIRES_DISPLAY="10 分钟"
   fi
 
-  # Step 8: 输出授权信息
-  echo ""
-  echo "🔐 支付宝授权登录"
-  echo ""
-  echo "📋 授权信息"
-  echo ""
-  echo "| 项目 | 信息 |"
-  echo "|------|------|"
-  echo "| 产品类型 | ${PRODUCT_NAME:-按量付费} |"
-  echo "| 经营类目 | ${MCC_NAME:-${MCC_CODE}} (${MCC_CODE}) |"
-  if [ -n "$VERIFICATION_CODE" ]; then
-    echo "| 确认码 | ${VERIFICATION_CODE} |"
-  else
-    echo "| 确认码 | （请查看支付宝授权页面） |"
+  # Step 8: 由统一目录渲染授权信息；独立 open 动作在消息发出后打开。
+  DISPLAY_CODE="${VERIFICATION_CODE:-（请查看支付宝授权页面）}"
+  MESSAGE_INPUT=$(printf '%s\n' "$PRODUCT_NAME" "$DEVICE_CODE" "$MCC_CODE" "$MCC_NAME" "$DISPLAY_CODE" "$EXPIRES_DISPLAY" "$BROWSER_URL" | jq -Rs '
+    split("\n") as $v | {productName:$v[0],deviceCode:$v[1],mccCode:$v[2],mccName:$v[3],verificationCode:$v[4],expiresDisplay:$v[5],officialUrl:$v[6]}
+  ')
+  if ! printf '%s' "$MESSAGE_INPUT" | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.page --variant READY; then
+    cleanup_auth_state
+    emit_control "AUTH_FLOW:FAILED"
+    exit 1
   fi
-  echo "| 授权链接有效期 | ${EXPIRES_DISPLAY} |"
-  echo ""
-  echo "⚠️ 安全提示：请核对授权页面显示的确认码是否与上方一致，如不一致，请勿授权，立即停止操作！"
   echo ""
-  echo "提示：无法跳链时，请复制下方链接到网页浏览器打开。"
-  echo "🌐 授权链接：[点击跳转进行授权](${BROWSER_URL})"
-  echo ""
-  echo "请在完成授权后告诉我\"好了\"继续后续流程。"
-  echo ""
-  echo "AUTH_FLOW:READY"
+  emit_control "AUTH_FLOW:READY_TO_OPEN"
+}
+
+auth_open() {
+  local saved_device saved_url validate_input open_status open_helper
+
+  restore_auth_context_or_state "$@" || exit 1
+  saved_device=$(jq -r '.deviceCode // ""' "$AUTH_STATE_FILE")
+  saved_url=$(jq -r '.authorizationUrl // ""' "$AUTH_STATE_FILE")
+  if [ -z "$saved_device" ] || [ -z "$saved_url" ]; then
+    echo "❌ 缺少待打开的授权页面上下文，请重新执行 auth.sh init --defer-open"
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  fi
+
+  validate_input=$(jq -n \
+    --arg productName "$PRODUCT_NAME" \
+    --arg salesCode "$SALES_CODE" \
+    --arg scope "$SCOPE" \
+    --arg mccCode "$MCC_CODE" \
+    --arg mccName "$MCC_NAME" \
+    --arg deviceCode "$saved_device" \
+    --arg officialUrl "$saved_url" \
+    '{productName:$productName,salesCode:$salesCode,scope:$scope,mccCode:$mccCode,mccName:$mccName,deviceCode:$deviceCode,officialUrl:$officialUrl}') || return 1
+  if ! printf '%s' "$validate_input" | node "$RENDERER" --validate-authorization-context >/dev/null; then
+    echo "❌ 授权页面上下文校验失败，已停止打开"
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  fi
+
+  open_helper="${SCRIPT_DIR}/../../../normal/scripts/open_official_url.sh"
+  open_status=$(printf '%s\n' "$saved_url" | bash "$open_helper" authorization)
+  case "$open_status" in OPENED|OPEN_FAILED|GUI_UNAVAILABLE|LINK_ONLY) ;; *) open_status="OPEN_FAILED" ;; esac
+  emit_control "AUTH_OPEN:${open_status}"
 }
 
-# ─── auth confirm: 授权确认 + scope 校验 + MCC 校验 ──────────────────────────
+# ─── auth confirm: 授权确认 + scope 校验 + MCC 授权有效性校验 ────────────────
 auth_confirm() {
+  AUTH_CONFIRM_RESULT=""
   # 优先使用显式传入的非敏感上下文；未传时再从状态文件兜底恢复。
   restore_auth_context_or_state "$@" || exit 1
 
@@ -474,51 +707,126 @@ auth_confirm() {
 
   # Step 1: 执行授权确认
   LOGIN_COMPLETE_RESULT=$(run_json_command "alipay-cli login --complete --json" alipay-cli login --complete --json) || {
-    echo "AUTH_FLOW:FAILED"
+    auth_cli_environment_failure "授权完成确认"
     return 1
   }
 
   # Step 2: 判断授权结果
-  # alipay-cli login --complete 返回：外层 .success + .data.status
+  # alipay-cli login --complete: success=true/logged_in 表示可进入 whoami 门禁；
+  # authorization_pending/auth_expired 可能出现在 .error.code、.data.error.code 或 status 中。
   OUTER_SUCCESS=$(echo "$LOGIN_COMPLETE_RESULT" | jq -r '.success // false')
   DATA_STATUS=$(echo "$LOGIN_COMPLETE_RESULT" | jq -r '.data.status // ""')
-  ERROR_CODE=$(echo "$LOGIN_COMPLETE_RESULT" | jq -r '.data.error.code // ""')
-
-  if [ "$OUTER_SUCCESS" = "true" ] || [ "$DATA_STATUS" = "already_logged_in" ] || [ "$DATA_STATUS" = "completed" ]; then
-    echo "✅ 授权确认成功"
-  elif [ "$ERROR_CODE" = "authorization_pending" ]; then
-    echo "⏳ 尚未完成授权，请在手机上确认授权后再次告诉我"
-    echo "AUTH_FLOW:PENDING"
+  ERROR_CODE=$(echo "$LOGIN_COMPLETE_RESULT" | jq -r '.error.code // .data.error.code // ""')
+
+  if [ "$ERROR_CODE" = "authorization_pending" ] || [ "$DATA_STATUS" = "authorization_pending" ] || [ "$DATA_STATUS" = "pending" ]; then
+    AUTH_CONFIRM_RESULT="PENDING"
+    if [ "${AUTH_POLLING:-false}" != "true" ]; then
+      if ! printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.pending --variant DEFAULT; then
+        emit_control "AUTH_FLOW:FAILED"
+        return 1
+      fi
+      emit_control "AUTH_FLOW:PENDING"
+    fi
     return 0
-  elif [ "$ERROR_CODE" = "auth_expired" ]; then
-    echo "⏰ 授权链接已过期（有效期为10分钟），需要重新生成"
+  elif [ "$ERROR_CODE" = "auth_expired" ] || [ "$DATA_STATUS" = "auth_expired" ] || [ "$DATA_STATUS" = "expired" ]; then
+    AUTH_CONFIRM_RESULT="EXPIRED"
     cleanup_auth_state
-    echo "AUTH_FLOW:EXPIRED"
+    if ! printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.expired --variant DEFAULT; then
+      emit_control "AUTH_FLOW:FAILED"
+      return 1
+    fi
+    emit_control "AUTH_FLOW:EXPIRED"
     return 0
+  elif [ "$OUTER_SUCCESS" = "true" ] || [ "$DATA_STATUS" = "logged_in" ] || [ "$DATA_STATUS" = "already_logged_in" ] || [ "$DATA_STATUS" = "completed" ]; then
+    :
   else
     if handle_error "$LOGIN_COMPLETE_RESULT"; then
       echo "❌ 授权确认失败：返回结果未包含可识别的完成状态"
     fi
     cleanup_auth_state
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
 
-  # Step 3: 复用 init 的 scope + MCC 校验
-  WHOAMI_RESULT=$(run_json_command "alipay-cli whoami --json" alipay-cli whoami --json) || {
-    echo "AUTH_FLOW:FAILED"
+  # Step 3: 复用 init 的 scope + MCC 授权有效性校验
+  wait_for_effective_whoami "授权后登录状态复核"
+  whoami_rc=$?
+  if [ "$whoami_rc" -eq 2 ]; then
+    AUTH_CONFIRM_RESULT="PENDING"
+    if [ "${AUTH_POLLING:-false}" != "true" ]; then
+      if ! printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.pending --variant DEFAULT; then
+        emit_control "AUTH_FLOW:FAILED"
+        return 1
+      fi
+      emit_control "AUTH_FLOW:PENDING"
+    fi
+    return 0
+  elif [ "$whoami_rc" -ne 0 ]; then
     return 1
-  }
-  validate_current_authorization "$WHOAMI_RESULT" || return 1
+  fi
+  validate_current_authorization "$AUTH_WHOAMI_RESULT" || return 1
   cleanup_auth_state
-  echo "AUTH_FLOW:AUTH_SUCCESS"
+  AUTH_CONFIRM_RESULT="AUTH_SUCCESS"
+  emit_control "✅ 授权确认成功（本机 CLI 登录态、scope 与 MCC 授权有效性均已通过）"
+  emit_control "AUTH_FLOW:AUTH_SUCCESS"
   return 0
 }
 
+# ─── auth wait: 授权页打开后有限轮询确认状态 ────────────────────────────────
+auth_wait() {
+  local attempt=1
+  local max_attempts=12
+  local interval_seconds=5
+
+  if [ "${ALIPAY_AIPAY_TEST_MODE:-0}" = "1" ] && [[ "${AUTH_CONFIRM_POLL_INTERVAL_SECONDS:-}" =~ ^[0-9]+$ ]]; then
+    interval_seconds="$AUTH_CONFIRM_POLL_INTERVAL_SECONDS"
+  fi
+
+  while [ "$attempt" -le "$max_attempts" ]; do
+    AUTH_POLLING=true
+    if ! auth_confirm "$@"; then
+      AUTH_POLLING=false
+      return 1
+    fi
+    AUTH_POLLING=false
+
+    case "$AUTH_CONFIRM_RESULT" in
+      AUTH_SUCCESS|EXPIRED)
+        return 0
+        ;;
+      PENDING)
+        emit_control "AUTH_POLL_PENDING=${attempt}/${max_attempts}"
+        if [ "$attempt" -eq "$max_attempts" ]; then
+          if ! printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.pending --variant DEFAULT; then
+            emit_control "AUTH_FLOW:FAILED"
+            return 1
+          fi
+          emit_control "AUTH_FLOW:PENDING"
+          return 0
+        fi
+        sleep "$interval_seconds"
+        ;;
+      *)
+        emit_control "AUTH_FLOW:FAILED"
+        return 1
+        ;;
+    esac
+    attempt=$((attempt + 1))
+  done
+}
+
 # ─── auth mismatch: 授权范围不满足 → logout → 重新授权 ──────────────────────
 auth_mismatch() {
   local logout_result logout_error_type
 
+  if [ "${1:-}" = "--defer-open" ]; then
+    shift
+  else
+    echo "❌ 参数格式错误：auth mismatch 必须使用 --defer-open，确保重新授权时先展示说明和链接，再自动打开页面"
+    echo "用法: bash auth.sh mismatch --defer-open [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]"
+    return 1
+  fi
+
   # 优先使用显式传入的非敏感上下文；未传时再从状态文件兜底恢复。
   restore_auth_context_or_state "$@" || exit 1
 
@@ -535,26 +843,25 @@ auth_mismatch() {
   fi
 
   # Step 2: mismatch 是授权不匹配恢复路径中唯一执行 logout 的入口。
-  echo "⚠️ 授权范围不满足，正在退出当前登录并准备重新授权..."
+  if ! printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.mismatch --variant DEFAULT; then
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  fi
   logout_result=$(run_json_command "alipay-cli logout --json" alipay-cli logout --json) || {
-    echo "❌ 退出当前登录失败，已停止重新授权"
-    echo "AUTH_FLOW:FAILED"
+    auth_cli_environment_failure "退出当前登录"
     return 1
   }
   logout_error_type=$(detect_error "$logout_result")
   if [ "$logout_error_type" != "SUCCESS" ]; then
     echo "❌ 退出当前登录失败，已停止重新授权"
-    echo "AUTH_FLOW:FAILED"
+    emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
-  echo "✅ 已退出当前登录"
-
-  # Step 3: 调用 auth init 执行登录 + 构建授权链接 + 输出授权信息
-  # DEV_TOOL_NAME 已 export，子进程可继承
-  echo "📋 请重新扫码授权，新的授权将包含正确的权限范围"
-  echo ""
 
+  # Step 3: 调用 auth init 执行登录 + 构建授权链接 + 输出唯一授权消息。
+  # DEV_TOOL_NAME 已 export，子进程可继承。
   auth_init \
+    --defer-open \
     --scope "$SCOPE" \
     --sales-code "$SALES_CODE" \
     --mcc-code "$MCC_CODE" \
@@ -572,16 +879,26 @@ case "${1:-}" in
     shift
     auth_confirm "$@"
     ;;
+  open)
+    shift
+    auth_open "$@"
+    ;;
+  wait)
+    shift
+    auth_wait "$@"
+    ;;
   mismatch)
     shift
     auth_mismatch "$@"
     ;;
   *)
-    echo "用法: bash auth.sh <init|confirm|mismatch> [参数...]"
+    echo "用法: bash auth.sh <init|open|wait|confirm|mismatch> [参数...]"
     echo ""
-    echo "  auth init    --scope <scope> --sales-code <code> --mcc-code <code> [--product-name <name> --mcc-name <name>]"
+    echo "  auth init    --defer-open --scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>"
+    echo "  auth open    [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]"
+    echo "  auth wait    [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]"
     echo "  auth confirm [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]"
-    echo "  auth mismatch [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]"
+    echo "  auth mismatch --defer-open [--scope <scope> --sales-code <code> --mcc-code <code> --product-name <name> --mcc-name <name>]"
     exit 1
     ;;
 esac