@alipay/alipay-aipay 1.2.2 → 1.5.0

package/skill/references/onboarding/modules/scripts/query_sign_status.sh

@@ -3,13 +3,13 @@
 # 脚本名称: query_sign_status.sh
 # 功能描述: 查询签约状态并根据结果判断后续流程
 # 调用位置: Step 3.1 状态与资源查询
-# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME；需传入 --sales-code，或兼容使用 SALES_CODE 环境变量
+# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME/PLATFORM_ID；需传入 --sales-code，或兼容使用 SALES_CODE 环境变量
 # 用法: bash query_sign_status.sh --sales-code <code> [--product-type aipay|webpay|apppay]
-# 返回值: 输出签约状态判断结果和处理建议
+# 返回值: 在 stderr 输出签约状态控制信号；stdout 只保留受控错误正文
 #           SIGN_STATUS=NOT_SIGNED | SIGN_STATUS=SIGNED_EFFECTIVE | SIGN_STATUS=SIGN_SUBMITTED | SIGN_STATUS=OTHER_STATUS
-#           按量付费:   FLOW:AI_PAY_NOT_SIGNED | FLOW:AI_PAY_SIGNED
-#           网站支付:   FLOW:PC_WEB_NOT_SIGNED  | FLOW:PC_WEB_SIGNED
-#           APP支付:    FLOW:APP_NOT_SIGNED     | FLOW:APP_SIGNED
+#           AI 按量付费:   FLOW:AI_PAY_NOT_SIGNED | FLOW:AI_PAY_SIGNED
+#           AI 网页应用收款:   FLOW:PC_WEB_NOT_SIGNED  | FLOW:PC_WEB_SIGNED
+#           AI 移动应用收款:    FLOW:APP_NOT_SIGNED     | FLOW:APP_SIGNED
 #=============================================================================
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -21,6 +21,8 @@ else
   echo "❌ 缺少错误处理脚本: ${SCRIPT_DIR}/error_handler.sh"
   exit 1
 fi
+source "${SCRIPT_DIR}/network_retry.sh"
+source "${SCRIPT_DIR}/sign_status_parser.sh"
 
 require_command jq || exit 1
 require_command alipay-cli || exit 1
@@ -69,27 +71,18 @@ if [ "$PRODUCT_TYPE" != "unknown" ] && [ "$PRODUCT_TYPE" != "$EXPECTED_PRODUCT_T
   exit 1
 fi
 
-emit_signed_flow() {
-  case "$SALES_CODE" in
-    "I1080300001000041203")
-      echo "FLOW:PC_WEB_SIGNED"
-      # 网站支付已生效或已提交：Step 4 只处理应用决策，Step 5 跳过签约提交
-      ;;
-    "I1080300001000041313")
-      echo "FLOW:APP_SIGNED"
-      # APP支付已生效或已提交：Step 4 只处理应用决策，Step 5 跳过签约提交
-      ;;
-    "I1080300001000160457")
-      echo "FLOW:AI_PAY_SIGNED"
-      # 按量付费已生效或已提交：Step 4 处理服务/应用决策，Step 5 跳过签约提交
-      ;;
-  esac
-}
+init_alipay_cli_product "$EXPECTED_PRODUCT_TYPE" || exit 1
 
 # 查询签约状态
-RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call ar-query.queryArInfosBySalesProd \
+export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+run_network_retry RESULT read query_sign_status -- alipay-cli mcp call ar-query.queryArInfosBySalesProd \
   -d "{\"request\":{\"salesProductCodes\":[\"${SALES_CODE}\"]},\"ctx\":{}}" \
-  --json 2>/dev/null)
+  --json
+RETRY_RC=$?
+if [ "$RETRY_RC" -ne 0 ]; then
+  echo "❌ 签约状态查询因网络或服务异常在自动重试两次后仍未恢复"
+  exit 1
+fi
 
 # 错误检测
 if ! handle_error "$RESULT"; then
@@ -99,54 +92,10 @@ fi
 # 解包 MCP 信封后解析业务字段
 BUSINESS=$(unwrap_mcp "$RESULT")
 
-# 只有明确返回数组才可判断签约状态；缺少字段必须阻断，避免误判为未签约
-AR_LIST=$(echo "$BUSINESS" | jq -c '
-  if (.resultObj | type) == "object" and (.resultObj.arInfoList | type) == "array" then
-    .resultObj.arInfoList
-  else
-    null
-  end
-' 2>/dev/null)
-if [ -z "$AR_LIST" ] || ! echo "$AR_LIST" | jq -e 'type == "array"' >/dev/null 2>&1; then
+# 只有明确返回数组才可判断签约状态；缺少字段必须阻断，避免误判为未签约。
+if ! SIGN_STATUS_OUTPUT=$(emit_sign_status_from_business "$BUSINESS" "$SALES_CODE"); then
   echo "❌ 签约状态返回结构异常，无法解析 arInfoList"
   exit 1
 fi
-AR_COUNT=$(echo "$AR_LIST" | jq 'length')
-
-if [ "$AR_COUNT" -eq 0 ]; then
-  echo "📋 签约状态: 未签约 (NOT_SIGNED)；继续 Step 4 一次性资料与资源决策"
-  echo "SIGN_STATUS=NOT_SIGNED"
-
-  case "$SALES_CODE" in
-    "I1080300001000041203")
-      echo "FLOW:PC_WEB_NOT_SIGNED"
-      # 网站支付未签约：需先采集 3 张网站截图，再进入 Step 5 签约
-      ;;
-    "I1080300001000041313")
-      echo "FLOW:APP_NOT_SIGNED"
-      # APP支付未签约：需先采集 APP 名称和 3 张APP界面截图，再进入 Step 5 签约
-      ;;
-    "I1080300001000160457")
-      echo "FLOW:AI_PAY_NOT_SIGNED"
-      # 按量付费未签约：Step 4 无需页面图片，但仍完成服务/应用决策
-      ;;
-  esac
-else
-  # AR_LIST 已在上方确认为数组
-  HAS_EFFECTIVE=$(echo "$AR_LIST" | jq -r '[.[] | select(.arStatus == "02")] | length')
-  HAS_SUBMITTED=$(echo "$AR_LIST" | jq -r '[.[] | select(.arStatus == "01")] | length')
-
-  if [ "$HAS_EFFECTIVE" -gt 0 ]; then
-    echo "✅ 签约已生效；无需签约材料，继续 Step 4 资源决策"
-    echo "SIGN_STATUS=SIGNED_EFFECTIVE"
-    emit_signed_flow
-  elif [ "$HAS_SUBMITTED" -gt 0 ]; then
-    echo "📋 已提交签约（待生效），无需重复提交签约，继续推进后续步骤"
-    echo "SIGN_STATUS=SIGN_SUBMITTED"
-    emit_signed_flow
-  else
-    echo "📋 其他签约状态；保留已取得的只读结果并将签约分支标记为待核验"
-    echo "SIGN_STATUS=OTHER_STATUS"
-    echo "FLOW:OTHER_STATUS"
-  fi
-fi
+printf '%s\n' "$SIGN_STATUS_OUTPUT" \
+  | while IFS= read -r marker; do emit_control "$marker"; done

package/skill/references/onboarding/modules/scripts/service.sh

@@ -3,18 +3,19 @@
 # 脚本名称: service.sh
 # 功能描述: 服务市场注册 - 查询已有服务 + 创建/修改服务
 # 调用位置: list 用于 Step 3.1 前置资源查询；save/validate 用于 Step 5.2 服务市场注册
-# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME；必要时可用 DEV_TOOL_NAME 环境变量覆盖
+# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME/PLATFORM_ID；必要时可用 DEV_TOOL_NAME 环境变量覆盖
 # 用法:
 #   service list                                       - 查询已有服务列表
 #   service save  --name <n> --desc <d> --url <u> --pricing <p> --schema <json> [--service-id <id>]
 #   service validate --name <n> --desc <d> --url <u> --pricing <p> --schema <json>
 # 返回值:
-#   list:     输出服务列表 + FLOW:CREATE_NEW | FLOW:SELECT
-#   save:     输出 ✅/❌ + serviceId（无 FLOW 标记，由 Agent 根据退出码判断）
-#   validate: 输出 ✅/❌ + 校验详情（退出码 0=通过, 1=失败）
+#   list:     stdout 成功时为空；stderr 输出带统一内部前缀的候选 JSON、SERVICE_CANDIDATE_ID 和 FLOW
+#   save:     stderr 输出实际解析到的 SERVICE_ID（不接受 Agent 自填）
+#   validate: stderr 输出规范化结果（退出码 0=通过, 1=失败）
 #=============================================================================
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CANDIDATE_RUNNER="${SCRIPT_DIR}/../../../normal/scripts/onboarding_message_runner.mjs"
 
 # 一次性 source error_handler（含 unwrap_mcp）
 if [ -f "${SCRIPT_DIR}/error_handler.sh" ]; then
@@ -23,10 +24,67 @@ else
   echo "❌ 缺少错误处理脚本: ${SCRIPT_DIR}/error_handler.sh"
   exit 1
 fi
+source "${SCRIPT_DIR}/network_retry.sh"
 
 require_command jq || exit 1
 require_command alipay-cli || exit 1
 require_command awk || exit 1
+require_command node || exit 1
+init_alipay_cli_product aipay || exit 1
+
+SERVICE_LIST_PAGE_LIMIT=10
+SERVICE_CREATE_LIMIT=10
+
+normalize_service_pricing() {
+  local raw="$1"
+  local pricing_pattern='^ *([0-9]+([.][0-9]+)?) *(元(/次)?)? *$'
+  SERVICE_PRICING_NORMALIZED=""
+  case "$raw" in *$'\n'*|*$'\r'*|*$'\t'*) return 1 ;; esac
+  if [[ "$raw" =~ $pricing_pattern ]]; then
+    SERVICE_PRICING_NORMALIZED="${BASH_REMATCH[1]}"
+    return 0
+  fi
+  return 1
+}
+
+validate_service_fields() {
+  # 1. 服务名称：长度 1-50 字符
+  if [ -z "$SERVICE_NAME" ] || [ ${#SERVICE_NAME} -gt 50 ]; then
+    echo "❌ 服务名称长度需在 1-50 字符之间（当前长度: ${#SERVICE_NAME}）"
+    exit 1
+  fi
+
+  # 2. 服务描述：长度 1-500 字符
+  if [ -z "$SERVICE_DESC" ] || [ ${#SERVICE_DESC} -gt 500 ]; then
+    echo "❌ 服务描述长度需在 1-500 字符之间（当前长度: ${#SERVICE_DESC}）"
+    exit 1
+  fi
+
+  # 3. 服务地址：有效 URL
+  if [ -z "$RESOURCE_URL" ] || ! [[ "$RESOURCE_URL" =~ ^https?:// ]]; then
+    echo "❌ 请提供有效的 URL 地址（以 http:// 或 https:// 开头）"
+    exit 1
+  fi
+
+  # 4. 服务单价：提交值统一规范化为纯数字，模板负责追加“元/次”。
+  if [ -z "$PRICING" ] || ! normalize_service_pricing "$PRICING"; then
+    echo "❌ 服务单价格式不正确，请输入金额（如 0.03、0.03元或 0.03 元/次）"
+    exit 1
+  fi
+  PRICING="$SERVICE_PRICING_NORMALIZED"
+  PRICING_VALID=$(awk -v p="$PRICING" 'BEGIN { if (p + 0 >= 0.01) print "true"; else print "false" }')
+  if [ "$PRICING_VALID" = "false" ]; then
+    echo "❌ 服务单价最低为 0.01 元"
+    exit 1
+  fi
+
+  # 5. schemaUrl 在本流程中承载序列化后的 JSON 请求示例，不是 URL。
+  # CLI 接收原始 JSON；save 分支通过 jq --arg 将其安全写入字符串字段。
+  if [ -z "$SCHEMA_URL" ] || ! echo "$SCHEMA_URL" | jq . >/dev/null 2>&1; then
+    echo "❌ 请提供有效的 JSON 格式请求示例"
+    exit 1
+  fi
+}
 
 # ─── service list: 查询已有服务 ──────────────────────────────────────────────
 fetch_service_page() {
@@ -39,9 +97,15 @@ fetch_service_page() {
     --argjson offset "$OFFSET" \
     '{request:{limit:$limit,offset:$offset}}')
 
-  RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call a2a-pay-service.discoverBazaarServicesForMcp \
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT read service_list_page -- alipay-cli mcp call a2a-pay-service.discoverBazaarServicesForMcp \
     -d "$REQUEST_JSON" \
-    --json 2>/dev/null)
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -ne 0 ]; then
+    echo "❌ 服务列表当前分页因网络或服务异常在自动重试两次后仍未恢复"
+    return 1
+  fi
 
   if ! handle_error "$RESULT"; then
     return 1
@@ -54,6 +118,7 @@ fetch_service_page() {
     BUSINESS_MESSAGE=$(echo "$BUSINESS" | jq -r '
       .subMsg // .data.subMsg // .msg // .data.msg // "未知错误"
     ' 2>/dev/null)
+    BUSINESS_MESSAGE=$(sanitize_customer_error_text "$BUSINESS_MESSAGE")
     echo "❌ 查询服务列表失败: ${BUSINESS_CODE} / ${BUSINESS_MESSAGE}"
     return 1
   fi
@@ -103,7 +168,7 @@ fetch_service_page() {
 }
 
 fetch_service_list() {
-  local LIMIT=20
+  local LIMIT="$SERVICE_LIST_PAGE_LIMIT"
   local OFFSET=0
   local EXPECTED_TOTAL=""
   local PAGE_COUNT
@@ -155,9 +220,13 @@ fetch_service_list() {
   done
 
   if ! echo "$SERVICE_LIST" | jq -e '
-    all(.[]; ((.serviceId | type) == "string") and (.serviceId | length > 0))
+    all(.[];
+      ((.serviceId | type) == "string") and
+      (.serviceId | length > 0) and
+      ((.serviceId | test("[\u0000-\u001f\u007f]") | not))
+    )
   ' >/dev/null 2>&1; then
-    echo "❌ 服务列表返回结构异常：存在缺少 serviceId 的候选服务"
+    echo "❌ 服务列表返回结构异常：候选 serviceId 缺失或包含控制字符"
     return 1
   fi
 
@@ -169,40 +238,31 @@ service_list() {
     exit 1
   fi
 
+  SERVICE_CANDIDATES=$(echo "$SERVICE_LIST" | jq -c '[.[] | {
+    serviceId: .serviceId,
+    serviceName: ((.serviceName // "未知") | tostring),
+    serviceDesc: ((.serviceDesc // "无描述") | tostring),
+    pricing: ((.metadata.pricing // .pricing // "未知") | tostring),
+    serviceStatus: ((.serviceStatus // .status // "未知") | tostring),
+    resourceUrl: ((.resourceUrl // "未知") | tostring)
+  }]')
+  if ! printf '%s' "$SERVICE_CANDIDATES" | node "$CANDIDATE_RUNNER" service-candidates >/dev/null 2>&1; then
+    echo "❌ 服务候选事实安全校验失败"
+    emit_control "FLOW:ERROR"
+    exit 1
+  fi
+  if ! emit_control_field "SERVICE_CANDIDATES_JSON" "$SERVICE_CANDIDATES"; then
+    echo "❌ 服务候选事实包含非法控制字符"
+    emit_control "FLOW:ERROR"
+    exit 1
+  fi
+
   if [ "$SERVICE_COUNT" -eq 0 ] || [ "$SERVICE_LIST" = "[]" ] || [ -z "$SERVICE_LIST" ]; then
-    echo "📋 暂无已有服务；记录新建候选分支，等待 Step 4 统一决策"
-    echo "FLOW:CREATE_NEW"
+    emit_control "FLOW:CREATE_NEW"
   else
-    echo "📋 发现您已有以下服务："
-    echo ""
-    echo "| 序号 | 服务ID | 服务名称 | 描述 | 价格 | 实际状态 | 服务地址 |"
-    echo "|------|--------|----------|------|------|----------|----------|"
-
-    for i in $(seq 0 $((SERVICE_COUNT-1))); do
-      SERVICE=$(echo "$SERVICE_LIST" | jq ".[$i]")
-      SERVICE_ID=$(echo "$SERVICE" | jq -r '.serviceId // "未知"')
-      SERVICE_NAME=$(echo "$SERVICE" | jq -r '.serviceName // "未知"')
-      SERVICE_DESC=$(echo "$SERVICE" | jq -r '.serviceDesc // "无描述"')
-      PRICING=$(echo "$SERVICE" | jq -r '.pricing // "未知"')
-      SERVICE_STATUS=$(echo "$SERVICE" | jq -r '.serviceStatus // .status // "未知"')
-      RESOURCE_URL=$(echo "$SERVICE" | jq -r '.resourceUrl // "未知"')
-
-      case "$SERVICE_STATUS" in
-        "ACTIVE") STATUS_CN="已上线" ;;
-        "PENDING") STATUS_CN="审核中" ;;
-        "REJECTED") STATUS_CN="审核拒绝" ;;
-        *) STATUS_CN="$SERVICE_STATUS" ;;
-      esac
-
-      echo "| $((i+1)) | $SERVICE_ID | $SERVICE_NAME | $SERVICE_DESC | ${PRICING}元/次 | $STATUS_CN | $RESOURCE_URL |"
-    done
-
-    echo ""
-    echo "请选择："
-    echo "  • 输入序号 (1-${SERVICE_COUNT}) 复用对应服务"
-    echo "  • 输入\"新建\"创建新服务"
-    echo "  • 输入\"修改 + serviceId\"修改已有服务"
-    echo "FLOW:SELECT"
+    echo "$SERVICE_LIST" | jq -r '.[] | "SERVICE_CANDIDATE_ID=" + .serviceId' \
+      | while IFS= read -r marker; do emit_control "$marker"; done
+    emit_control "FLOW:SELECT"
   fi
 }
 
@@ -245,14 +305,19 @@ service_save() {
     echo "用法（修改）: bash service.sh save --service-id <id> --name <name> --desc <desc> --url <url> --pricing <pricing> --schema <json>"
     exit 1
   fi
+  if [ -n "$SERVICE_ID" ] && ! validate_control_value "$SERVICE_ID"; then
+    echo "❌ serviceId 包含非法控制字符"
+    exit 1
+  fi
+  validate_service_fields
 
   if [ -z "$SERVICE_ID" ]; then
     # 创建新服务（不传 serviceId）
     if ! fetch_service_list; then
       exit 1
     fi
-    if [ "$SERVICE_COUNT" -ge 20 ]; then
-      echo "❌ 已达到服务数量上限（20个），无法创建新服务"
+    if [ "$SERVICE_COUNT" -ge "$SERVICE_CREATE_LIMIT" ]; then
+      echo "❌ 已达到服务数量上限（${SERVICE_CREATE_LIMIT}个），无法创建新服务"
       echo "📋 您当前已有 $SERVICE_COUNT 个服务，请选择复用已有服务或修改已有服务"
       exit 1
     fi
@@ -265,9 +330,6 @@ service_save() {
       --arg schemaUrl "$SCHEMA_URL" \
       '{request:{serviceName:$serviceName,serviceDesc:$serviceDesc,resourceUrl:$resourceUrl,pricing:$pricing,schemaUrl:$schemaUrl}}')
 
-    RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call a2a-pay-service.saveBazaarServiceForMcp \
-      -d "$REQUEST_JSON" \
-      --json 2>/dev/null)
   else
     # 修改已有服务（必须传入 serviceId + 所有字段）
     REQUEST_JSON=$(jq -n \
@@ -279,9 +341,43 @@ service_save() {
       --arg schemaUrl "$SCHEMA_URL" \
       '{request:{serviceId:$serviceId,serviceName:$serviceName,serviceDesc:$serviceDesc,resourceUrl:$resourceUrl,pricing:$pricing,schemaUrl:$schemaUrl}}')
 
-    RESULT=$(export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call a2a-pay-service.saveBazaarServiceForMcp \
-      -d "$REQUEST_JSON" \
-      --json 2>/dev/null)
+  fi
+
+  export PLATFORM="${DEV_TOOL_NAME}" PLATFORM_ID="${PLATFORM_ID:-}"
+  run_network_retry RESULT write service_save -- alipay-cli mcp call a2a-pay-service.saveBazaarServiceForMcp \
+    -d "$REQUEST_JSON" \
+    --json
+  RETRY_RC=$?
+  if [ "$RETRY_RC" -eq 75 ]; then
+    if [ -z "$SERVICE_ID" ]; then
+      echo "❌ 服务创建响应不明；现有查询无法把同名候选唯一归属于本次创建，结果标记为 UNKNOWN，禁止自动重复创建"
+      exit 1
+    fi
+    if fetch_service_list; then
+      MATCH_COUNT=$(echo "$SERVICE_LIST" | jq --arg id "$SERVICE_ID" --arg name "$SERVICE_NAME" --arg desc "$SERVICE_DESC" --arg url "$RESOURCE_URL" --arg pricing "$PRICING" --arg schema "$SCHEMA_URL" '
+        [.[] | select(
+          .serviceId == $id and .serviceName == $name and .serviceDesc == $desc and
+          .resourceUrl == $url and
+          ((.metadata.pricing // .pricing) | tostring) == $pricing and
+          (.metadata.schema_url // .schemaUrl) == $schema
+        )] | length
+      ')
+      if [ "$MATCH_COUNT" -eq 1 ]; then
+        emit_control "✅ 服务修改已由列表查询核验成功"
+        emit_control "📋 服务ID: $SERVICE_ID"
+        emit_control_field "SERVICE_ID" "$SERVICE_ID" || return 1
+        return 0
+      fi
+    fi
+    echo "❌ 服务修改响应不明且现有列表无法排除传播延迟，结果标记为 UNKNOWN，禁止自动重复修改"
+    exit 1
+  elif [ "$RETRY_RC" -ne 0 ]; then
+    if [ -z "$SERVICE_ID" ]; then
+      echo "❌ 服务创建因明确未发送的网络异常在自动重试两次后仍未恢复"
+    else
+      echo "❌ 服务修改因明确未发送的网络异常在自动重试两次后仍未恢复"
+    fi
+    exit 1
   fi
 
   # 错误检测
@@ -320,12 +416,13 @@ service_save() {
       ')
     fi
 
-    if [ -z "$NEW_SERVICE_ID" ]; then
+    if ! validate_control_value "$NEW_SERVICE_ID"; then
       echo "❌ 服务创建返回成功，但未解析到 serviceId，禁止继续后续流程"
       exit 1
     fi
-    echo "✅ 服务${OPERATION}成功"
-    echo "📋 服务ID: $NEW_SERVICE_ID"
+    emit_control "✅ 服务${OPERATION}成功"
+    emit_control "📋 服务ID: $NEW_SERVICE_ID"
+    emit_control_field "SERVICE_ID" "$NEW_SERVICE_ID" || exit 1
   else
     OPERATION="创建"
     if [ -n "$SERVICE_ID" ]; then
@@ -338,7 +435,8 @@ service_save() {
         .data.subMsg // .data.msg // .subMsg // .msg //
         .error.message // .errorMessage // "未知错误"
       ' 2>/dev/null)
-      echo "❌ 服务${OPERATION}失败: ${BUSINESS_CODE} / ${ERROR_MSG:-未知错误}"
+      ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
+      echo "❌ 服务${OPERATION}失败: ${BUSINESS_CODE} / ${ERROR_MSG}"
     else
       echo "❌ 服务${OPERATION}返回结构异常，无法确认操作结果"
     fi
@@ -375,43 +473,10 @@ service_validate() {
     esac
   done
 
-  # 1. 服务名称：长度 1-50 字符
-  if [ -z "$SERVICE_NAME" ] || [ ${#SERVICE_NAME} -gt 50 ]; then
-    echo "❌ 服务名称长度需在 1-50 字符之间（当前长度: ${#SERVICE_NAME}）"
-    exit 1
-  fi
-
-  # 2. 服务描述：长度 1-500 字符
-  if [ -z "$SERVICE_DESC" ] || [ ${#SERVICE_DESC} -gt 500 ]; then
-    echo "❌ 服务描述长度需在 1-500 字符之间（当前长度: ${#SERVICE_DESC}）"
-    exit 1
-  fi
-
-  # 3. 服务地址：有效 URL
-  if [ -z "$RESOURCE_URL" ] || ! [[ "$RESOURCE_URL" =~ ^https?:// ]]; then
-    echo "❌ 请提供有效的 URL 地址（以 http:// 或 https:// 开头）"
-    exit 1
-  fi
-
-  # 4. 服务单价：数字格式，>= 0.01
-  if [ -z "$PRICING" ] || ! [[ "$PRICING" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then
-    echo "❌ 服务单价格式不正确，请输入数字（如 0.01、1.00）"
-    exit 1
-  fi
-  PRICING_VALID=$(awk -v p="$PRICING" 'BEGIN { if (p + 0 >= 0.01) print "true"; else print "false" }')
-  if [ "$PRICING_VALID" = "false" ]; then
-    echo "❌ 服务单价最低为 0.01 元"
-    exit 1
-  fi
-
-  # 5. schemaUrl 在本流程中承载序列化后的 JSON 请求示例，不是 URL。
-  # CLI 接收原始 JSON；save 分支通过 jq --arg 将其安全写入字符串字段。
-  if [ -z "$SCHEMA_URL" ] || ! echo "$SCHEMA_URL" | jq . >/dev/null 2>&1; then
-    echo "❌ 请提供有效的 JSON 格式请求示例"
-    exit 1
-  fi
+  validate_service_fields
 
-  echo "✅ 服务信息校验通过"
+  emit_control "✅ 服务信息校验通过"
+  emit_control_field "SERVICE_PRICING" "$PRICING" || exit 1
 }
 
 # ─── 入口分发 ────────────────────────────────────────────────────────────────

package/skill/references/onboarding/modules/scripts/sign_status_parser.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+emit_signed_flow() {
+  case "$1" in
+    "I1080300001000041203") echo "FLOW:PC_WEB_SIGNED" ;;
+    "I1080300001000041313") echo "FLOW:APP_SIGNED" ;;
+    "I1080300001000160457") echo "FLOW:AI_PAY_SIGNED" ;;
+    *) return 1 ;;
+  esac
+}
+
+emit_sign_status_from_business() {
+  local business="$1"
+  local sales_code="$2"
+  local ar_list ar_count has_effective has_submitted
+
+  case "$sales_code" in
+    "I1080300001000041203"|"I1080300001000041313"|"I1080300001000160457") ;;
+    *) return 1 ;;
+  esac
+
+  ar_list=$(printf '%s' "$business" | jq -c '
+    if (.resultObj | type) == "object" and (.resultObj.arInfoList | type) == "array" then
+      .resultObj.arInfoList
+    else
+      null
+    end
+  ' 2>/dev/null) || return 1
+  [ -n "$ar_list" ] && printf '%s' "$ar_list" | jq -e 'type == "array"' >/dev/null 2>&1 || return 1
+  ar_count=$(printf '%s' "$ar_list" | jq 'length') || return 1
+
+  if [ "$ar_count" -eq 0 ]; then
+    echo "📋 签约状态: 未签约 (NOT_SIGNED)；进入 Step 4 签约材料类别"
+    echo "SIGN_STATUS=NOT_SIGNED"
+    case "$sales_code" in
+      "I1080300001000041203") echo "FLOW:PC_WEB_NOT_SIGNED" ;;
+      "I1080300001000041313") echo "FLOW:APP_NOT_SIGNED" ;;
+      "I1080300001000160457") echo "FLOW:AI_PAY_NOT_SIGNED" ;;
+    esac
+    return 0
+  fi
+
+  has_effective=$(printf '%s' "$ar_list" | jq -r '[.[] | select(.arStatus == "02")] | length') || return 1
+  has_submitted=$(printf '%s' "$ar_list" | jq -r '[.[] | select(.arStatus == "01")] | length') || return 1
+  if [ "$has_effective" -gt 0 ]; then
+    echo "✅ 签约已生效；无需签约材料，继续 Step 4 资源决策"
+    echo "SIGN_STATUS=SIGNED_EFFECTIVE"
+    emit_signed_flow "$sales_code"
+  elif [ "$has_submitted" -gt 0 ]; then
+    echo "📋 已提交签约（待生效），无需重复提交签约，继续推进后续步骤"
+    echo "SIGN_STATUS=SIGN_SUBMITTED"
+    emit_signed_flow "$sales_code"
+  else
+    echo "📋 其他签约状态；保留已取得的只读结果并将签约分支标记为待核验"
+    echo "SIGN_STATUS=OTHER_STATUS"
+    echo "FLOW:OTHER_STATUS"
+  fi
+}

package/skill/references/onboarding/modules/scripts/upload_screenshots.sh

@@ -2,10 +2,10 @@
 #=============================================================================
 # 脚本名称: upload_screenshots.sh
 # 功能描述: 并行上传截图文件并解析可用于签约的图片引用值
-# 调用位置: Step 4 一次性资料与资源决策
-# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME；需传入3个文件路径
-# 用法: bash upload_screenshots.sh "$HOME_IMG" "$SHOP_IMG" "$PAY_IMG"
-# 返回值: 输出上传结果和图片引用值
+# 调用位置: Step 4 签约材料类别
+# 调用前置: 脚本通过 error_handler.sh 间接初始化 DEV_TOOL_NAME/PLATFORM_ID；需传入产品类型和3个文件路径
+# 用法: bash upload_screenshots.sh --product-type <webpay|apppay> "$HOME_IMG" "$SHOP_IMG" "$PAY_IMG"
+# 返回值: stdout 仅输出上传结果；stderr 输出图片引用值控制信号
 #=============================================================================
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -22,16 +22,28 @@ require_command jq || exit 1
 require_command alipay-cli || exit 1
 require_command mktemp || exit 1
 
-HOME_IMG="$1"
-SHOP_IMG="$2"
-PAY_IMG="$3"
+if [ "${1:-}" != "--product-type" ] || [ "$#" -lt 5 ]; then
+  echo "❌ 请先传入 --product-type webpay|apppay"
+  exit 1
+fi
+PRODUCT_TYPE="$2"
+shift 2
+case "$PRODUCT_TYPE" in
+  webpay|apppay) ;;
+  *) echo "❌ 截图上传仅支持 webpay|apppay"; exit 1 ;;
+esac
+init_alipay_cli_product "$PRODUCT_TYPE" || exit 1
+
+HOME_IMG="${1:-}"
+SHOP_IMG="${2:-}"
+PAY_IMG="${3:-}"
 
 # 校验参数
 if [ -z "$HOME_IMG" ] || [ -z "$SHOP_IMG" ] || [ -z "$PAY_IMG" ]; then
   echo "❌ 请提供 3 个截图文件路径"
-  echo "用法: bash upload_screenshots.sh <首页截图> <商品页截图> <支付页截图>"
-  echo "  网站支付：传入网站首页、商品页、支付页截图"
-  echo "  APP支付：传入APP首页、商品页、支付页截图"
+  echo "用法: bash upload_screenshots.sh --product-type <webpay|apppay> <首页截图> <商品页截图> <支付页截图>"
+  echo "  AI 网页应用收款：传入网站首页、商品页、支付页截图"
+  echo "  AI 移动应用收款：传入 APP 首页、商品页、支付页截图"
   exit 1
 fi
 
@@ -62,10 +74,10 @@ cleanup_upload_tmp() {
 }
 trap cleanup_upload_tmp EXIT
 
-# 并行上传 3 张截图
-export PLATFORM=${DEV_TOOL_NAME} && alipay-cli file upload "$HOME_IMG" -s payMerchantcodeSkill --json 2>/dev/null > "$TMP_HOME" &
-export PLATFORM=${DEV_TOOL_NAME} && alipay-cli file upload "$SHOP_IMG" -s payMerchantcodeSkill --json 2>/dev/null > "$TMP_SHOP" &
-export PLATFORM=${DEV_TOOL_NAME} && alipay-cli file upload "$PAY_IMG" -s payMerchantcodeSkill --json 2>/dev/null > "$TMP_PAY" &
+# 并行上传 3 张截图。PLATFORM_ID 与 PRODUCT 均由公共上下文初始化。
+PLATFORM="${DEV_TOOL_NAME:-unknown}" PLATFORM_ID="${PLATFORM_ID:-}" PRODUCT="${PRODUCT:-}" alipay-cli file upload "$HOME_IMG" -s payMerchantcodeSkill --json 2>/dev/null > "$TMP_HOME" &
+PLATFORM="${DEV_TOOL_NAME:-unknown}" PLATFORM_ID="${PLATFORM_ID:-}" PRODUCT="${PRODUCT:-}" alipay-cli file upload "$SHOP_IMG" -s payMerchantcodeSkill --json 2>/dev/null > "$TMP_SHOP" &
+PLATFORM="${DEV_TOOL_NAME:-unknown}" PLATFORM_ID="${PLATFORM_ID:-}" PRODUCT="${PRODUCT:-}" alipay-cli file upload "$PAY_IMG" -s payMerchantcodeSkill --json 2>/dev/null > "$TMP_PAY" &
 wait
 
 # 解析图片引用值（兼容 file upload 返回 fileKey 或 URL 字段）
@@ -143,10 +155,12 @@ if [ -n "$ERRORS" ]; then
   exit 1
 fi
 
+if ! validate_control_value "$HOME_REF" || ! validate_control_value "$SHOP_REF" || ! validate_control_value "$PAY_REF"; then
+  echo "❌ 截图上传返回的图片引用包含非法控制字符"
+  exit 1
+fi
+
 echo "✅ 截图上传成功"
-echo "  - 首页截图: $HOME_REF"
-echo "  - 商品页截图: $SHOP_REF"
-echo "  - 支付页截图: $PAY_REF"
-echo ""
-echo "# 更新对话上下文状态："
-echo "# collect_information = {\"screenshot\":[\"$HOME_REF\",\"$SHOP_REF\",\"$PAY_REF\"]}"
+emit_control_field "SCREENSHOT_HOME_REF" "$HOME_REF" || exit 1
+emit_control_field "SCREENSHOT_SHOP_REF" "$SHOP_REF" || exit 1
+emit_control_field "SCREENSHOT_PAY_REF" "$PAY_REF" || exit 1