@alipay/alipay-aipay 1.2.2 → 1.5.0

package/skill/references/onboarding/modules/scripts/download_key_tool.sh

@@ -0,0 +1,157 @@
+#!/bin/bash
+
+set -u
+umask 077
+
+MANUAL_URL="https://opendocs.alipay.com/isv/02kipk"
+DEST_DIR="${1:-}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RENDERER="${SCRIPT_DIR}/../../../normal/scripts/render_customer_message.mjs"
+
+manual_fallback_message() {
+  echo "未能完成自动下载，可能是当前环境不支持、无法访问下载源、本地目录不可写或安装包校验未通过。请访问支付宝开放平台手动下载支付宝开放平台密钥工具："
+  echo
+  echo "$MANUAL_URL"
+  echo
+  echo "仅向 Agent 提供【应用公钥】，应用私钥请自行妥善保管。"
+}
+
+render_fallback() {
+  if command -v node >/dev/null 2>&1 && [ -f "$RENDERER" ]; then
+    printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=download_key_tool.sh node "$RENDERER" key_tool.download.fallback --variant DEFAULT && return 0
+  fi
+  manual_fallback_message
+}
+
+render_downloaded() {
+  local target_file="$1"
+  local message_input
+  if command -v node >/dev/null 2>&1 && [ -f "$RENDERER" ]; then
+    message_input=$(node -e 'process.stdout.write(JSON.stringify({downloadPath: process.argv[1]}))' "$target_file") \
+      && printf '%s' "$message_input" | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=download_key_tool.sh node "$RENDERER" key_tool.download.result --variant DOWNLOADED \
+      && return 0
+  fi
+  render_fallback
+}
+
+fail_download() {
+  render_fallback
+  exit 0
+}
+
+is_windows_reparse_point() {
+  local path="$1" powershell_rc
+  case "$(uname -s 2>/dev/null || true)" in MINGW*|MSYS*|CYGWIN*) ;; *) return 1 ;; esac
+  command -v powershell.exe >/dev/null 2>&1 || return 0
+  env "ALIPAY_AIPAY_REPARSE_PATH=$path" powershell.exe -NoProfile -NonInteractive -Command '
+    try {
+      $item = Get-Item -LiteralPath $env:ALIPAY_AIPAY_REPARSE_PATH -Force -ErrorAction Stop
+    } catch {
+      exit 2
+    }
+    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { exit 0 } else { exit 1 }
+  ' >/dev/null 2>&1
+  powershell_rc=$?
+  [ "$powershell_rc" -eq 0 ] && return 0
+  [ "$powershell_rc" -eq 1 ] && return 1
+  return 0
+}
+
+OS_NAME="${ALIPAY_AIPAY_TEST_OS:-$(uname -s 2>/dev/null || true)}"
+case "$OS_NAME" in
+  Darwin) PLATFORM="mac"; EXT="dmg" ;;
+  MINGW*|MSYS*|CYGWIN*|Windows_NT) PLATFORM="win"; EXT="exe" ;;
+  *) fail_download "UNSUPPORTED_OS" ;;
+esac
+
+if [ -z "$DEST_DIR" ]; then
+  DEST_DIR="${HOME:-}/Downloads"
+fi
+[ -n "$DEST_DIR" ] && [ -d "$DEST_DIR" ] && [ -w "$DEST_DIR" ] && [ ! -L "$DEST_DIR" ] || fail_download "DEST_DIR_UNAVAILABLE"
+! is_windows_reparse_point "$DEST_DIR" || fail_download "DEST_DIR_UNAVAILABLE"
+command -v curl >/dev/null 2>&1 || fail_download "DEPENDENCY_MISSING"
+command -v node >/dev/null 2>&1 || fail_download "DEPENDENCY_MISSING"
+
+CURRENT_URL="https://ideservice.alipay.com/ide/getPluginUrl.htm?clientType=assistant&platform=${PLATFORM}&channelType=WEB"
+PART_FILE=$(mktemp "${DEST_DIR}/.alipay-key-tool.XXXXXX.part") || fail_download "DEST_DIR_UNAVAILABLE"
+HEADER_FILE=$(mktemp "${DEST_DIR}/.alipay-key-tool.XXXXXX.headers") || { rm -f "$PART_FILE"; fail_download "DEST_DIR_UNAVAILABLE"; }
+chmod 600 "$PART_FILE" "$HEADER_FILE" 2>/dev/null || true
+cleanup_download() { rm -f "$PART_FILE" "$HEADER_FILE"; }
+trap cleanup_download EXIT INT TERM
+
+REDIRECTS=0
+while true; do
+  : > "$PART_FILE"
+  : > "$HEADER_FILE"
+  curl --silent --show-error --connect-timeout 10 --max-time 120 --dump-header "$HEADER_FILE" --output "$PART_FILE" --max-redirs 0 "$CURRENT_URL" 2>/dev/null
+  CURL_RC=$?
+  STATUS=$(awk '/^HTTP\// {code=$2; sub(/\r$/, "", code)} END {print code}' "$HEADER_FILE")
+  [ -n "$STATUS" ] || fail_download "NETWORK_UNAVAILABLE"
+  case "$STATUS" in
+    301|302|303|307|308)
+      [ "$REDIRECTS" -lt 5 ] || fail_download "UNTRUSTED_REDIRECT"
+      LOCATION=$(awk 'tolower($0) ~ /^location:/ {sub(/^[^:]*:[[:space:]]*/, ""); sub(/\r$/, ""); print; exit}' "$HEADER_FILE")
+      [ -n "$LOCATION" ] || fail_download "UNTRUSTED_REDIRECT"
+      if ! node -e '
+const [raw] = process.argv.slice(1); let u;
+try { u = new URL(raw); } catch { process.exit(1); }
+if (u.protocol !== "https:" || u.username || u.password || u.port) process.exit(1);
+if (!["ideservice.alipay.com", "mdn.alipayobjects.com"].includes(u.hostname)) process.exit(1);
+' "$LOCATION"; then fail_download "UNTRUSTED_REDIRECT"; fi
+      CURRENT_URL="$LOCATION"
+      REDIRECTS=$((REDIRECTS + 1))
+      ;;
+    200)
+      [ "$CURL_RC" -eq 0 ] || fail_download "NETWORK_UNAVAILABLE"
+      FINAL_HOST=$(node -e 'console.log(new URL(process.argv[1]).hostname)' "$CURRENT_URL" 2>/dev/null) || fail_download "UNTRUSTED_REDIRECT"
+      [ "$FINAL_HOST" = "mdn.alipayobjects.com" ] || fail_download "UNTRUSTED_REDIRECT"
+      break
+      ;;
+    *) fail_download "NETWORK_UNAVAILABLE" ;;
+  esac
+done
+
+DISPOSITION=$(awk 'tolower($0) ~ /^content-disposition:/ {sub(/\r$/, ""); print; exit}' "$HEADER_FILE")
+FILENAME=$(printf '%s' "$DISPOSITION" | sed -n 's/.*filename="\{0,1\}\([^";]*\)"\{0,1\}.*/\1/p')
+if [ -z "$FILENAME" ]; then
+  FILENAME=$(node -e '
+let url;
+try { url = new URL(process.argv[1]); } catch { process.exit(1); }
+process.stdout.write(url.searchParams.get("af_fileName") || "");
+' "$CURRENT_URL") || fail_download "INVALID_PACKAGE"
+fi
+case "$FILENAME" in ""|*/*|*\\*|.|..) fail_download "INVALID_PACKAGE" ;; esac
+if ! node -e '
+const name = process.argv[1] || "";
+if (/[\u0000-\u001f\u007f`|]/.test(name)) process.exit(1);
+' "$FILENAME"; then fail_download "INVALID_PACKAGE"; fi
+case "$FILENAME" in *.$EXT) ;; *) fail_download "INVALID_PACKAGE" ;; esac
+
+SIZE=$(wc -c < "$PART_FILE" | tr -d ' ')
+[ "$SIZE" -gt 0 ] || fail_download "INVALID_PACKAGE"
+CONTENT_LENGTH=$(awk 'tolower($0) ~ /^content-length:/ {sub(/\r$/, ""); sub(/^[^:]*:[[:space:]]*/, ""); print; exit}' "$HEADER_FILE")
+if [ -n "$CONTENT_LENGTH" ]; then
+  case "$CONTENT_LENGTH" in *[!0-9]*) fail_download "INVALID_PACKAGE" ;; esac
+  [ "$SIZE" -eq "$CONTENT_LENGTH" ] || fail_download "INVALID_PACKAGE"
+fi
+FIRST_NONSPACE=$(LC_ALL=C tr -d '[:space:]' < "$PART_FILE" | head -c 1)
+case "$FIRST_NONSPACE" in '<'|'{'|'[') fail_download "INVALID_PACKAGE" ;; esac
+if [ "$EXT" = "exe" ]; then
+  [ "$(head -c 2 "$PART_FILE")" = "MZ" ] || fail_download "INVALID_PACKAGE"
+else
+  LC_ALL=C grep -a -q 'koly' "$PART_FILE" || fail_download "INVALID_PACKAGE"
+fi
+
+TARGET_FILE="${DEST_DIR}/${FILENAME}"
+if [ -e "$TARGET_FILE" ] || [ -L "$TARGET_FILE" ]; then
+  BASE="${FILENAME%.*}"
+  TARGET_FILE="${DEST_DIR}/${BASE}-$(date +%Y%m%d%H%M%S)-$$.${EXT}"
+fi
+[ ! -e "$TARGET_FILE" ] && [ ! -L "$TARGET_FILE" ] || fail_download "DEST_DIR_UNAVAILABLE"
+ln "$PART_FILE" "$TARGET_FILE" || fail_download "DEST_DIR_UNAVAILABLE"
+rm -f "$PART_FILE"
+trap - EXIT INT TERM
+rm -f "$HEADER_FILE"
+[ -f "$TARGET_FILE" ] && [ ! -L "$TARGET_FILE" ] || fail_download "DEST_DIR_UNAVAILABLE"
+chmod 600 "$TARGET_FILE" 2>/dev/null || true
+render_downloaded "$TARGET_FILE"

package/skill/references/onboarding/modules/scripts/error_handler.sh

@@ -9,15 +9,22 @@
 
 ERROR_HANDLER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 COMMON_SCRIPT="${ERROR_HANDLER_DIR}/../../../normal/scripts/common.sh"
+ERROR_RENDERER="${ERROR_HANDLER_DIR}/../../../normal/scripts/render_customer_message.mjs"
 if [ -f "$COMMON_SCRIPT" ]; then
   # shellcheck source=/dev/null
   source "$COMMON_SCRIPT"
-  init_dev_tool_name
+  init_alipay_cli_context
 else
   echo "❌ 缺少公共脚本: $COMMON_SCRIPT"
   return 1 2>/dev/null || exit 1
 fi
 
+render_error_message() {
+  local MESSAGE_ID="$1" VARIANT="$2" INPUT_JSON="$3"
+  printf '%s' "$INPUT_JSON" \
+    | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=error_handler.sh node "$ERROR_RENDERER" "$MESSAGE_ID" --variant "$VARIANT"
+}
+
 # ─── MCP 信封解包 ──────────────────────────────────────────────────────────
 # alipay-cli mcp call 返回 MCP 协议信封：
 #   { "content": [ { "text": "<业务JSON>", "type": "text" } ] }
@@ -104,6 +111,27 @@ extract_unique_json() {
   ' 2>/dev/null
 }
 
+# 对客错误详情只保留受限单行文本。解析和错误分类仍使用原始值，
+# 但任何疑似凭据、临时 URL 或密钥内容都不能进入普通终端输出。
+sanitize_customer_error_text() {
+  local VALUE="${1:-}" NORMALIZED
+  NORMALIZED=$(printf '%s' "$VALUE" | tr '\000-\037\177' ' ' | awk '{$1=$1; print}')
+  if [ -z "$NORMALIZED" ]; then
+    echo "未知错误"
+    return
+  fi
+  if printf '%s' "$NORMALIZED" | grep -qiE '\{\{|\}\}|<INTERNAL_'; then
+    echo "错误详情包含内部标记或模板占位符，已隐藏"
+    return
+  fi
+  if printf '%s' "$NORMALIZED" | grep -qiE \
+    'https?://|verification_url|device[_-]?code|authorization:[[:space:]]*bearer|payment-proof|-----BEGIN|private[_ -]?key|public[_ -]?key|["'\'']?(password|passwd|secret|api[_-]?key|access[_-]?token)["'\'']?[[:space:]]*[:=]|(^|[^[:alnum:]_])token[=:]'; then
+    echo "错误详情包含临时链接或敏感字段，已隐藏"
+    return
+  fi
+  printf '%s' "$NORMALIZED" | cut -c1-1000
+}
+
 unwrap_mcp() {
   local RAW="$1"
   if [ -z "$RAW" ]; then
@@ -120,7 +148,6 @@ unwrap_mcp() {
       ;;
     ambiguous)
       echo "CLI 输出包含多个 JSON 候选，无法唯一解析"
-      echo "$RAW"
       return
       ;;
     *)
@@ -308,7 +335,7 @@ detect_error() {
   # 先解包 MCP 信封，再进行错误检测
   local UNWRAPPED=$(unwrap_mcp "$CLI_RESULT")
 
-  # 1. 优先检测 MCP 认证错误（HTTP 401）
+  # 1. 优先检测 MCP 认证错误
   if echo "$UNWRAPPED" | grep -qiE "HTTP 401|Authorization is empty|非法的认证信息"; then
     echo "MCP_AUTH_ERROR"
     return
@@ -333,9 +360,7 @@ detect_error() {
   fi
 
   if ! echo "$UNWRAPPED" | jq -e . >/dev/null 2>&1; then
-    local FIRST_LINE
-    FIRST_LINE=$(printf "%s" "$UNWRAPPED" | sed -n '1p')
-    echo "CLI_ERROR:${FIRST_LINE:-CLI 返回非 JSON 内容}"
+    echo "CLI_ERROR:CLI 返回非 JSON 内容，原始输出已隐藏"
     return
   fi
 
@@ -361,44 +386,28 @@ detect_error() {
 # ─── MCP 认证错误处理 ──────────────────────────────────────────────────────
 handle_mcp_auth_error() {
   local LOGOUT_RESULT LOGOUT_EXIT_CODE LOGOUT_ERROR_TYPE LOGOUT_ERROR_MSG
+  local LOGOUT_ANALYSIS LOGOUT_PARSE_STATUS
 
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "🔐 未登录或授权已过期"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
-  echo "❌ 当前登录状态已失效，无法继续操作"
-  echo ""
-  echo "📋 原因：MCP 调用返回认证错误（HTTP 401）"
-  echo "📋 说明：Authorization is empty（认证信息为空）"
-  echo ""
-  echo "🔄 正在退出当前登录..."
-  LOGOUT_RESULT=$(PLATFORM=${DEV_TOOL_NAME:-unknown} alipay-cli logout --json 2>&1)
+  emit_control "AUTH_FLOW:AUTH_REQUIRED"
+  render_error_message error.mcp.auth START '{}' || return 1
+  LOGOUT_RESULT=$(PLATFORM=${DEV_TOOL_NAME:-unknown} PLATFORM_ID="${PLATFORM_ID:-}" alipay-cli logout --json 2>&1)
   LOGOUT_EXIT_CODE=$?
   LOGOUT_ERROR_TYPE=$(detect_error "$LOGOUT_RESULT")
+  LOGOUT_ANALYSIS=$(extract_unique_json "$LOGOUT_RESULT" 2>/dev/null || echo '{"status":"none"}')
+  LOGOUT_PARSE_STATUS=$(echo "$LOGOUT_ANALYSIS" | jq -r '.status // "none"' 2>/dev/null)
 
   if [ "$LOGOUT_EXIT_CODE" -ne 0 ] || [ "$LOGOUT_ERROR_TYPE" != "SUCCESS" ]; then
-    echo ""
-    echo "❌ 退出当前登录失败，已停止重新授权"
-    if echo "$LOGOUT_RESULT" | jq -e . >/dev/null 2>&1; then
-      LOGOUT_ERROR_MSG=$(extract_error_message "$LOGOUT_RESULT")
-      echo "📋 错误信息：$LOGOUT_ERROR_MSG"
-    elif [ -n "$LOGOUT_RESULT" ]; then
-      echo "📋 错误信息：$LOGOUT_RESULT"
+    if [ "$LOGOUT_PARSE_STATUS" != "ok" ] || [ "$LOGOUT_ERROR_TYPE" = "MCP_SERVICE_ERROR" ] || [ "$LOGOUT_ERROR_TYPE" = "SERVICE_UNSTABLE" ]; then
+      render_error_message error.mcp.auth LOGOUT_UNCONFIRMED '{}' || return 1
+    else
+      LOGOUT_ERROR_MSG=$(sanitize_customer_error_text "$(extract_error_message "$LOGOUT_RESULT")")
+      MESSAGE_INPUT=$(jq -cn --arg errorMessage "$LOGOUT_ERROR_MSG" '{errorMessage:$errorMessage}')
+      render_error_message error.mcp.auth LOGOUT_FAILED "$MESSAGE_INPUT" || return 1
     fi
-    echo "📋 请先重试退出登录；确认退出成功后再重新授权。"
     return 1
   fi
 
-  echo ""
-  echo "✅ 已退出登录状态"
-  echo ""
-  echo "📌 请重新执行登录授权流程："
-  echo "   1. 我会生成授权链接"
-  echo "   2. 您使用支付宝扫码授权"
-  echo "   3. 授权成功后继续当前操作"
-  echo ""
-  echo "📌 产品、MCC 和授权范围未变化时，沿用已有确认立即重新生成授权链接；发生变化时先重新确认受影响内容。"
+  render_error_message error.mcp.auth LOGOUT_SUCCESS '{}' || return 1
 }
 
 # ─── MCP 服务不可用处理 ────────────────────────────────────────────────────
@@ -406,57 +415,27 @@ handle_mcp_service_error() {
   local CLI_RESULT="$1"
   local UNWRAPPED=$(unwrap_mcp "$CLI_RESULT")
 
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "⚠️  MCP 服务暂时不可用"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
   if [ "${DEV_TOOL_NAME:-unknown}" != "unknown" ]; then
-    echo "❌ 当前命令需要访问支付宝服务，但当前 Agent 执行环境可能没有外网权限"
-    echo ""
-    echo "📋 处理方式："
-    echo "  - Agent 应申请可联网权限后重试同一条命令"
-    echo "  - 不要要求用户排查本机网络，也不要更换业务参数"
-    echo ""
-    echo "请授权 Agent 联网重试，或稍后重新执行当前命令。"
+    render_error_message error.mcp.service AGENT_NETWORK '{}'
     return
   fi
 
-  echo "❌ 无法连接到支付宝服务，请稍后重试"
-  echo ""
-  echo "📋 错误详情："
-  echo "$UNWRAPPED" | jq -r '.error.message // .errorMessage // .message // "未知错误"' 2>/dev/null || echo "$UNWRAPPED"
-  echo ""
-  echo "您可以："
-  echo "  1. 检查网络连接是否正常"
-  echo "  2. 等待几分钟后重新执行"
-  echo "  3. 联系技术支持获取帮助"
-  echo ""
-  echo "请回复「重试」重新尝试，或「退出」结束流程。"
+  local SERVICE_ERROR_MSG
+  SERVICE_ERROR_MSG=$(echo "$UNWRAPPED" | jq -r '.error.message // .errorMessage // .message // "未知错误"' 2>/dev/null) || SERVICE_ERROR_MSG="服务调用失败，原始输出已隐藏"
+  SERVICE_ERROR_MSG=$(sanitize_customer_error_text "$SERVICE_ERROR_MSG")
+  MESSAGE_INPUT=$(jq -cn --arg errorDetail "$SERVICE_ERROR_MSG" '{errorDetail:$errorDetail}')
+  render_error_message error.mcp.service GENERIC "$MESSAGE_INPUT"
 }
 
 # ─── 授权信息不匹配处理 ────────────────────────────────────────────────────
 handle_auth_mismatch() {
-  local CLI_RESULT="$1"
-  local UNWRAPPED=$(unwrap_mcp "$CLI_RESULT")
-
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "❌ 授权信息不匹配，需要重新授权"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-
-  if echo "$UNWRAPPED" | grep -qi "mccCode is not auth"; then
-    echo "📋 原因：经营类目未授权"
-  elif echo "$UNWRAPPED" | grep -qi "salesProductCodes is not auth"; then
-    echo "📋 原因：产品未授权"
-  elif echo "$UNWRAPPED" | grep -qi "scope is not auth"; then
-    echo "📋 原因：授权 scope 不满足"
+  local UNWRAPPED
+  UNWRAPPED=$(unwrap_mcp "${1:-}")
+  if echo "$UNWRAPPED" | grep -qiE "mccCode.*is not auth"; then
+    emit_control "AUTH_FLOW:MCC_MISMATCH"
+  else
+    emit_control "AUTH_FLOW:SCOPE_MISMATCH"
   fi
-
-  echo ""
-  echo ""
-  echo "⛔ 已停止当前操作和后续调用"
-  echo "📋 请调用 auth.sh mismatch；该命令会统一退出当前登录并使用正确范围重新授权"
 }
 
 # ─── 后端业务错误处理（完整透出错误信息） ──────────────────────────────────
@@ -465,75 +444,57 @@ handle_backend_error() {
   local ERROR_CODE="$2"
   local UNWRAPPED=$(unwrap_mcp "$CLI_RESULT")
 
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "❌ 业务处理失败"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
-  echo "📋 错误码：$ERROR_CODE"
-
   # 提取错误信息
   local ERROR_MSG=$(extract_error_message "$UNWRAPPED")
   local BIZ_TIPS=$(extract_biz_tips "$UNWRAPPED")
-  local NEED_RETRY=$(extract_need_retry "$UNWRAPPED")
   local ERROR_SCENE=$(extract_error_object_field "$UNWRAPPED" "errorScene")
   local ERROR_SPECIFIC=$(extract_error_object_field "$UNWRAPPED" "errorSpecific")
 
-  echo "📋 错误信息：$ERROR_MSG"
-
-  if [ -n "$ERROR_SCENE" ] || [ -n "$ERROR_SPECIFIC" ]; then
-    echo "📋 错误场景：${ERROR_SCENE:-未知} / ${ERROR_SPECIFIC:-未知}"
-  fi
+  ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
+  if [ -n "$ERROR_SCENE" ]; then ERROR_SCENE=$(sanitize_customer_error_text "$ERROR_SCENE"); fi
+  if [ -n "$ERROR_SPECIFIC" ]; then ERROR_SPECIFIC=$(sanitize_customer_error_text "$ERROR_SPECIFIC"); fi
 
   # 透出 checkedError 中的详细错误描述（如 ar-sign.apply 返回的字段级校验错误）
   local CHECKED_ERRORS=$(extract_checked_errors "$UNWRAPPED")
+  local CHECKED_ERRORS_JSON='[]'
   if [ -n "$CHECKED_ERRORS" ] && [ "$CHECKED_ERRORS" != "null" ] && [ "$CHECKED_ERRORS" != "[]" ]; then
-    echo ""
-    echo "📋 详细校验错误："
-    echo "$CHECKED_ERRORS" | jq -r '.[]? | .errorDesc // .message // . // empty' 2>/dev/null | while IFS= read -r line; do
-      [ -n "$line" ] && echo "  - $line"
-    done
+    while IFS= read -r line; do
+      if [ -n "$line" ]; then
+        line=$(sanitize_customer_error_text "$line")
+        CHECKED_ERRORS_JSON=$(jq -cn --argjson items "$CHECKED_ERRORS_JSON" --arg item "$line" '$items + [$item]')
+      fi
+    done < <(echo "$CHECKED_ERRORS" | jq -r '.[]? | .errorDesc // .message // . // empty' 2>/dev/null)
   fi
 
-  if [ -n "$BIZ_TIPS" ] && [ "$BIZ_TIPS" != "null" ] && [ "$BIZ_TIPS" != "" ]; then
-    echo ""
-    echo "💡 提示：$BIZ_TIPS"
+  if [ -n "$BIZ_TIPS" ] && [ "$BIZ_TIPS" != "null" ]; then
+    BIZ_TIPS=$(sanitize_customer_error_text "$BIZ_TIPS")
+  else
+    BIZ_TIPS=""
   fi
-
+  local APP_MAX="NO"
   if [ "$ERROR_CODE" = "APP_MAX_ERROR" ]; then
-    echo ""
-    echo "📌 处理建议：当前主体下应用数量已达到上限，无法继续新建应用。请优先复用已有上线应用；如必须新建，请前往支付宝开放平台处理应用配额或联系支付宝技术支持。"
-  fi
-
-  if [ "$NEED_RETRY" = "true" ]; then
-    echo ""
-    echo "🔄 此错误可重试，请回复「重试」重新执行"
+    APP_MAX="YES"
   fi
-
-  echo ""
-  echo "如需帮助，请联系技术支持并提供以上错误信息。"
+  MESSAGE_INPUT=$(jq -cn \
+    --arg errorCode "$(sanitize_customer_error_text "$ERROR_CODE")" \
+    --arg errorMessage "$ERROR_MSG" \
+    --arg errorScene "$ERROR_SCENE" \
+    --arg errorSpecific "$ERROR_SPECIFIC" \
+    --argjson checkedErrors "$CHECKED_ERRORS_JSON" \
+    --arg bizTips "$BIZ_TIPS" \
+    --arg appMax "$APP_MAX" \
+    '{errorCode:$errorCode,errorMessage:$errorMessage,errorScene:$errorScene,errorSpecific:$errorSpecific,checkedErrors:$checkedErrors,bizTips:$bizTips,appMax:$appMax}')
+  render_error_message error.backend DEFAULT "$MESSAGE_INPUT"
 }
 
 # ─── MCP 服务不稳定处理 ────────────────────────────────────────────────────
 handle_service_unstable() {
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "⚠️  MCP 服务暂时不稳定"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
-  echo "当前无法继续执行，请稍后重试。"
-  echo ""
-  echo "您可以："
-  echo "  1. 等待几分钟后重新执行"
-  echo "  2. 检查网络连接是否正常"
-  echo "  3. 联系技术支持获取帮助"
-  echo ""
-  echo "请回复「重试」重新尝试，或「退出」结束流程。"
+  render_error_message error.service.unstable DEFAULT '{}'
 }
 
 # ─── 统一错误处理入口 ──────────────────────────────────────────────────────
 # 参数: $1 - CLI 执行结果文本（原始输出，含信封或不含）
-# 返回: 0=成功, 1=失败（需要用户干预）
+# 返回: 0=成功, 1=当前动作失败（由主流程判断恢复、阻断或继续独立分支）
 handle_error() {
   local CLI_RESULT="$1"
   local ERROR_TYPE=$(detect_error "$CLI_RESULT")
@@ -559,19 +520,29 @@ handle_error() {
       ;;
     "CLI_ERROR:"*)
       local MSG="${ERROR_TYPE#CLI_ERROR:}"
-      echo "❌ 命令执行失败：$MSG"
       # CLI_ERROR 也透出 bizTips 和 checkedError（如果有的话）
       local CLI_BIZ_TIPS=$(extract_biz_tips "$_UNWRAPPED")
-      if [ -n "$CLI_BIZ_TIPS" ] && [ "$CLI_BIZ_TIPS" != "null" ] && [ "$CLI_BIZ_TIPS" != "" ]; then
-        echo "💡 $CLI_BIZ_TIPS"
+      if [ -n "$CLI_BIZ_TIPS" ] && [ "$CLI_BIZ_TIPS" != "null" ]; then
+        CLI_BIZ_TIPS=$(sanitize_customer_error_text "$CLI_BIZ_TIPS")
+      else
+        CLI_BIZ_TIPS=""
       fi
       local CLI_CHECKED=$(extract_checked_errors "$_UNWRAPPED")
+      local CLI_CHECKED_JSON='[]'
       if [ -n "$CLI_CHECKED" ] && [ "$CLI_CHECKED" != "null" ] && [ "$CLI_CHECKED" != "[]" ]; then
-        echo "📋 详细校验错误："
-        echo "$CLI_CHECKED" | jq -r '.[]? | .errorDesc // .message // . // empty' 2>/dev/null | while IFS= read -r line; do
-          [ -n "$line" ] && echo "  - $line"
-        done
+        while IFS= read -r line; do
+          if [ -n "$line" ]; then
+            line=$(sanitize_customer_error_text "$line")
+            CLI_CHECKED_JSON=$(jq -cn --argjson items "$CLI_CHECKED_JSON" --arg item "$line" '$items + [$item]')
+          fi
+        done < <(echo "$CLI_CHECKED" | jq -r '.[]? | .errorDesc // .message // . // empty' 2>/dev/null)
       fi
+      MESSAGE_INPUT=$(jq -cn \
+        --arg errorMessage "$(sanitize_customer_error_text "$MSG")" \
+        --arg bizTips "$CLI_BIZ_TIPS" \
+        --argjson checkedErrors "$CLI_CHECKED_JSON" \
+        '{errorMessage:$errorMessage,bizTips:$bizTips,checkedErrors:$checkedErrors}')
+      render_error_message error.cli DEFAULT "$MESSAGE_INPUT"
       ;;
     "SUCCESS")
       return 0

package/skill/references/onboarding/modules/scripts/network_retry.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+
+# Source after error_handler.sh. This wrapper never changes MCP argv or business JSON.
+
+NETWORK_RETRY_CLASS=""
+NETWORK_DISPATCH_STATE=""
+NETWORK_ATTEMPTS=0
+
+network_retry_is_local_transport_error() {
+  printf '%s' "$1" | grep -Eqi \
+    'could not resolve host|name or service not known|nodename nor servname|connection refused|failed to connect|network access[^[:cntrl:]]*(denied|blocked)[^[:cntrl:]]*before connection'
+}
+
+network_retry_is_not_sent() {
+  printf '%s' "$1" | grep -Eqi \
+    'could not resolve host|name or service not known|nodename nor servname|connection refused|network access[^[:cntrl:]]*(denied|blocked)[^[:cntrl:]]*before connection'
+}
+
+run_network_retry() {
+  local result_var="$1" operation="$2" action_name="$3"
+  shift 3
+  [ "${1:-}" = "--" ] || { echo "NETWORK_RETRY_ERROR:缺少 -- 参数分隔符" >&2; return 64; }
+  shift
+  [ "$#" -gt 0 ] || { echo "NETWORK_RETRY_ERROR:缺少命令 argv" >&2; return 64; }
+  case "$operation" in read|write) ;; *) echo "NETWORK_RETRY_ERROR:operation 必须为 read 或 write" >&2; return 64 ;; esac
+
+  local max_retries="${NETWORK_RETRY_MAX_RETRIES:-2}"
+  local delay_seconds="${NETWORK_RETRY_DELAY_SECONDS:-3}"
+  local attempt=0 stdout_file stderr_file stdout stderr rc classification transient dispatch
+  stdout_file=$(mktemp "${TMPDIR:-/tmp}/alipay-aipay-stdout.XXXXXX") || return 1
+  stderr_file=$(mktemp "${TMPDIR:-/tmp}/alipay-aipay-stderr.XXXXXX") || { rm -f "$stdout_file"; return 1; }
+  chmod 600 "$stdout_file" "$stderr_file" 2>/dev/null || true
+  trap 'rm -f "$stdout_file" "$stderr_file"; trap - RETURN' RETURN
+
+  while true; do
+    attempt=$((attempt + 1))
+    : > "$stdout_file"
+    : > "$stderr_file"
+    "$@" >"$stdout_file" 2>"$stderr_file"
+    rc=$?
+    stdout=$(cat "$stdout_file")
+    stderr=$(cat "$stderr_file")
+    classification=""
+    transient=false
+    dispatch="MAYBE_SENT"
+
+    local stdout_is_business_json=false unwrapped_stdout=""
+    if [ -n "$stdout" ]; then
+      classification=$(detect_error "$stdout" 2>/dev/null || true)
+      unwrapped_stdout=$(unwrap_mcp "$stdout" 2>/dev/null || true)
+      if printf '%s' "$unwrapped_stdout" | jq -e . >/dev/null 2>&1; then
+        stdout_is_business_json=true
+      fi
+      # 合法业务 JSON 始终以 stdout 为准。普通启动日志会被 detect_error 归为
+      # CLI_ERROR；此时仍须检查 stderr，避免真实连接失败被非空 stdout 掩盖。
+      if [ "$stdout_is_business_json" != true ] && [ "$rc" -ne 0 ] && [ -n "$stderr" ]; then
+        classification=$(detect_error "$stderr" 2>/dev/null || true)
+      fi
+    elif [ -n "$stderr" ]; then
+      classification=$(detect_error "$stderr" 2>/dev/null || true)
+    fi
+
+    case "$classification" in
+      MCP_SERVICE_ERROR|SERVICE_UNSTABLE) transient=true ;;
+      *)
+        if [ "$stdout_is_business_json" != true ] && { [ "$rc" -ne 0 ] || [ -n "$stderr" ]; } && network_retry_is_local_transport_error "$stderr"; then
+          classification="LOCAL_TRANSPORT_ERROR"
+          transient=true
+        fi
+        ;;
+    esac
+
+    if network_retry_is_not_sent "$stderr"; then
+      dispatch="NOT_SENT"
+    fi
+
+    NETWORK_RETRY_CLASS="$classification"
+    NETWORK_DISPATCH_STATE="$dispatch"
+    NETWORK_ATTEMPTS="$attempt"
+    printf -v "$result_var" '%s' "$stdout"
+
+    if [ "$transient" != true ]; then
+      return 0
+    fi
+
+    if [ "$operation" = "write" ] && [ "$dispatch" != "NOT_SENT" ]; then
+      return 75
+    fi
+
+    if [ "$attempt" -gt "$max_retries" ]; then
+      echo "NETWORK_RETRY_EXHAUSTED:${action_name}:${classification}:${dispatch}:${attempt}" >&2
+      return 76
+    fi
+    sleep "$delay_seconds"
+  done
+}