@alipay/alipay-aipay 1.4.9 → 1.5.0

package/skill/references/normal/scripts/integration_message_runner.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -15,9 +16,9 @@ const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const inspectorPath = path.join(scriptDir, 'project_route_inspector.sh');
 
 const productVariants = {
-  aipay: { variant: 'AIPAY', productName: '按量付费' },
-  webpay: { variant: 'WEBPAY', productName: '网站支付' },
-  apppay: { variant: 'APPPAY', productName: 'APP 支付' }
+  aipay: { variant: 'AIPAY', productName: 'AI 按量付费' },
+  webpay: { variant: 'WEBPAY', productName: 'AI 网页应用收款' },
+  apppay: { variant: 'APPPAY', productName: 'AI 移动应用收款' }
 };
 const currentProjectAliases = new Set(['.', './', '当前项目', '当前目录', '这个项目', '这个仓库', '这里']);
 const projectMarkerNames = [
@@ -75,6 +76,12 @@ const aipayPaymentValidationMarker = 'Payment-Validation';
 const aipayPaymentVerifyMarker = 'alipay\\.aipay\\.agent\\.payment\\.verify|AlipayAipayAgentPaymentVerify(Request|Model|Response)|alipay_aipay_agent_payment_verify_response';
 const aipayFulfillmentConfirmMarker = 'alipay\\.aipay\\.agent\\.fulfillment\\.confirm|AlipayAipayAgentFulfillmentConfirm(Request|Model|Response)|alipay_aipay_agent_fulfillment_confirm_response';
 const aipayMarker = `${aipayPaymentNeededMarker}|${aipayPaymentProofMarker}|${aipayPaymentVerifyMarker}|${aipayFulfillmentConfirmMarker}`;
+const internalPrefix = 'ALIPAY_AIPAY_INTERNAL:';
+const receiptKinds = Object.freeze({
+  startConfirmation: 'integration-start-confirmation',
+  checklist: 'integration-checklist-scope',
+  a2mExecution: 'integration-a2m-execution'
+});
 
 function parseArgs(argv) {
   const command = argv[2];
@@ -84,7 +91,9 @@ function parseArgs(argv) {
     if (!key.startsWith('--')) throw new Error(`未知参数 ${key}`);
     const value = argv[index + 1];
     if (value === undefined || value.startsWith('--')) throw new Error(`参数 ${key} 缺少取值`);
-    args[key.slice(2)] = value;
+    const name = key.slice(2);
+    if (Object.prototype.hasOwnProperty.call(args, name)) throw new Error(`参数 ${key} 重复`);
+    args[name] = value;
     index += 1;
   }
   return { command, args };
@@ -452,6 +461,54 @@ function sourceFiles(projectPath) {
   return files.sort((left, right) => left.localeCompare(right));
 }
 
+function projectSnapshotFingerprint(projectPath) {
+  if (!path.isAbsolute(projectPath) || !isReadableDirectory(projectPath)) {
+    throw new Error('项目快照路径必须是可访问的绝对目录');
+  }
+  const canonicalPath = fs.realpathSync(projectPath);
+  const tracked = new Set(sourceFiles(canonicalPath));
+  for (const name of [...projectMarkerNames, '.alipay-sandbox.json', '.gitignore']) {
+    const candidate = path.join(canonicalPath, name);
+    try {
+      if (fs.statSync(candidate).isFile() && !fs.lstatSync(candidate).isSymbolicLink()) tracked.add(candidate);
+    } catch {
+      // Missing optional project facts do not enter the snapshot.
+    }
+  }
+  const hash = crypto.createHash('sha256');
+  hash.update(`project=${canonicalPath}\n`);
+  for (const file of [...tracked].sort((left, right) => left.localeCompare(right))) {
+    const stat = fs.statSync(file);
+    const relative = path.relative(canonicalPath, file);
+    hash.update(`${relative}\0${stat.size}\0`);
+    if (path.basename(file) === '.alipay-sandbox.json') {
+      hash.update(`${stat.mtimeMs}\n`);
+    } else {
+      hash.update(fs.readFileSync(file));
+      hash.update('\n');
+    }
+  }
+  return hash.digest('hex');
+}
+
+function encodeReceipt(payload) {
+  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
+}
+
+function decodeReceipt(value, expectedKind) {
+  if (typeof value !== 'string' || !value) throw new Error('缺少 receipt');
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+  } catch {
+    throw new Error('receipt 不是合法编码');
+  }
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) || payload.schema_ver !== 1 || payload.kind !== expectedKind) {
+    throw new Error('receipt 类型或版本非法');
+  }
+  return payload;
+}
+
 function scanPattern(files, pattern) {
   const regex = new RegExp(pattern);
   for (const file of files) {
@@ -484,9 +541,9 @@ function scanProjectRoute(productType, projectPath, projectSelection) {
   const files = sourceFiles(projectPath);
   const otherProducts = [];
 
-  if (scanPattern(files, webpayMarker) && productType !== 'webpay') otherProducts.push('网站支付');
-  if (scanPattern(files, apppayMarker) && productType !== 'apppay') otherProducts.push('APP 支付');
-  if (scanPattern(files, aipayMarker) && productType !== 'aipay') otherProducts.push('按量付费');
+  if (scanPattern(files, webpayMarker) && productType !== 'webpay') otherProducts.push('AI 网页应用收款');
+  if (scanPattern(files, apppayMarker) && productType !== 'apppay') otherProducts.push('AI 移动应用收款');
+  if (scanPattern(files, aipayMarker) && productType !== 'aipay') otherProducts.push('AI 按量付费');
 
   const otherProductsText = otherProducts.length > 0 ? otherProducts.join(',') : '无';
   let integrationStatus;
@@ -600,7 +657,7 @@ function normalizeLanguage(input) {
   throw new Error('服务端语言非法，仅支持 Java、Python、Node.js、C#、PHP');
 }
 
-function runStartConfirm(args) {
+function startConfirmationFacts(args) {
   const productType = required(args, 'product-type');
   const mapping = productVariants[productType];
   if (!mapping) throw new Error('product-type 非法，仅支持 aipay、webpay、apppay');
@@ -632,18 +689,163 @@ function runStartConfirm(args) {
     throw new Error('项目检查结果缺少必要事实字段');
   }
 
-  return renderMessage('integration.start.confirm', mapping.variant, {
+  return {
+    productType,
+    variant: mapping.variant,
     productName,
-    projectPath,
-    projectOriginLabel: route.projectOriginLabel,
-    integrationStatus: route.integrationStatus,
-    otherProducts: route.otherProducts,
+    projectPath: fs.realpathSync(projectPath),
+    projectSelection,
     language,
     framework,
+    route,
+    projectFingerprint: projectSnapshotFingerprint(projectPath)
+  };
+}
+
+function confirmationReceipt(facts) {
+  return encodeReceipt({
+    schema_ver: 1,
+    kind: receiptKinds.startConfirmation,
+    product_type: facts.productType,
+    product_name: facts.productName,
+    project_path: facts.projectPath,
+    project_selection: facts.projectSelection,
+    language: facts.language,
+    framework: facts.framework,
+    project_fingerprint: facts.projectFingerprint,
+    route: {
+      project_origin: facts.route.projectOrigin,
+      project_origin_label: facts.route.projectOriginLabel,
+      integration_status: facts.route.integrationStatus,
+      evidence: facts.route.evidence,
+      other_products: facts.route.otherProducts
+    }
+  });
+}
+
+function renderStartConfirmation(facts) {
+  return renderMessage('integration.start.confirm', facts.variant, {
+    productName: facts.productName,
+    projectPath: facts.projectPath,
+    projectOriginLabel: facts.route.projectOriginLabel,
+    integrationStatus: facts.route.integrationStatus,
+    otherProducts: facts.route.otherProducts,
+    language: facts.language,
+    framework: facts.framework,
     nextFlow: 'integration'
   });
 }
 
+export function createStartConfirmation(args) {
+  const facts = startConfirmationFacts(args);
+  return { message: renderStartConfirmation(facts), receipt: confirmationReceipt(facts) };
+}
+
+export function validateStartConfirmationReceipt(receipt) {
+  const saved = decodeReceipt(receipt, receiptKinds.startConfirmation);
+  const facts = startConfirmationFacts({
+    'product-type': saved.product_type,
+    'product-name': saved.product_name,
+    'project-path': saved.project_path,
+    'project-selection': saved.project_selection,
+    language: saved.language,
+    framework: saved.framework
+  });
+  const currentReceipt = confirmationReceipt(facts);
+  if (currentReceipt === receipt) return { valid: true, receipt, productType: saved.product_type };
+  return {
+    valid: false,
+    receipt: currentReceipt,
+    message: renderStartConfirmation(facts),
+    productType: saved.product_type
+  };
+}
+
+export function createChecklistScopeReceipt(projectPath) {
+  const canonicalPath = fs.realpathSync(required({ projectPath }, 'projectPath'));
+  return encodeReceipt({
+    schema_ver: 1,
+    kind: receiptKinds.checklist,
+    project_path: canonicalPath,
+    project_fingerprint: projectSnapshotFingerprint(canonicalPath)
+  });
+}
+
+function validateChecklistScopeReceipt(receipt, expectedProjectPath) {
+  const payload = decodeReceipt(receipt, receiptKinds.checklist);
+  const canonicalExpectedPath = fs.realpathSync(expectedProjectPath);
+  return payload.project_path === canonicalExpectedPath
+    && projectSnapshotFingerprint(canonicalExpectedPath) === payload.project_fingerprint;
+}
+
+function a2mExecutionFacts(args) {
+  const projectPath = fs.realpathSync(required(args, 'project-path'));
+  if (!isReadableDirectory(projectPath)) throw new Error('A2M 联调项目路径不可访问');
+  const method = required(args, 'http-method').toUpperCase();
+  if (!['GET', 'POST'].includes(method)) throw new Error('http-method 仅支持 GET 或 POST');
+  let serviceUrl;
+  try {
+    serviceUrl = new URL(required(args, 'service-url'));
+  } catch {
+    throw new Error('service-url 不是合法 URL');
+  }
+  if (!['http:', 'https:'].includes(serviceUrl.protocol) || serviceUrl.username || serviceUrl.password || serviceUrl.hash) {
+    throw new Error('service-url 只允许不含凭据和 fragment 的 HTTP(S) URL');
+  }
+  let requestBodyHash = '';
+  const requestBodyFile = args['request-body-file'];
+  if (method === 'POST') {
+    if (!requestBodyFile || !path.isAbsolute(requestBodyFile)) throw new Error('POST 必须传入绝对 --request-body-file');
+    const stat = fs.lstatSync(requestBodyFile);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('request-body-file 必须是普通文件且不能是符号链接');
+    requestBodyHash = crypto.createHash('sha256').update(fs.readFileSync(requestBodyFile)).digest('hex');
+  } else if (requestBodyFile !== undefined) {
+    throw new Error('GET 禁止传入 request-body-file');
+  }
+  return {
+    project_path: projectPath,
+    project_fingerprint: projectSnapshotFingerprint(projectPath),
+    service_url: serviceUrl.href,
+    http_method: method,
+    request_body_sha256: requestBodyHash
+  };
+}
+
+function a2mExecutionReceipt(facts, state = 'READY') {
+  return encodeReceipt({
+    schema_ver: 1,
+    kind: receiptKinds.a2mExecution,
+    state,
+    ...facts
+  });
+}
+
+export function guardA2mExecution(args) {
+  const facts = a2mExecutionFacts(args);
+  const priorReceipt = args['prior-receipt'];
+  if (!priorReceipt) return { decision: 'RUN', receipt: a2mExecutionReceipt(facts) };
+  const prior = decodeReceipt(priorReceipt, receiptKinds.a2mExecution);
+  const unchanged = ['project_path', 'project_fingerprint', 'service_url', 'http_method', 'request_body_sha256']
+    .every((key) => prior[key] === facts[key]);
+  if (!unchanged) return { decision: 'RUN', receipt: a2mExecutionReceipt(facts) };
+  if (prior.state === 'PASSED') return { decision: 'REUSE_PASSED', receipt: priorReceipt };
+  if (prior.state === 'FAILED') return { decision: 'BLOCK_UNCHANGED', receipt: priorReceipt };
+  return { decision: 'UNKNOWN_PREVIOUS_EXECUTION', receipt: priorReceipt };
+}
+
+export function completeA2mExecution(receipt, outcome) {
+  if (!['PASSED', 'FAILED', 'INTERRUPTED'].includes(outcome)) {
+    throw new Error('outcome 仅支持 PASSED、FAILED、INTERRUPTED');
+  }
+  const prior = decodeReceipt(receipt, receiptKinds.a2mExecution);
+  if (prior.state !== 'READY') throw new Error('A2M execution receipt 已经终态化');
+  const { schema_ver, kind, state, ...facts } = prior;
+  void schema_ver;
+  void kind;
+  void state;
+  return a2mExecutionReceipt(facts, outcome);
+}
+
 function runContextRequired(args) {
   return renderMessage('integration.context.required', 'DEFAULT', {
     missingItems: required(args, 'missing-items')
@@ -732,6 +934,11 @@ function checklistInputFromArgs(args) {
 async function runChecklistResult(args) {
   const variant = required(args, 'variant');
   if (!['AIPAY', 'WEBPAY', 'APPPAY'].includes(variant)) throw new Error('variant 非法，仅支持 AIPAY、WEBPAY、APPPAY');
+  const scopeReceipt = required(args, 'scope-receipt');
+  const projectPath = required(args, 'project-path');
+  if (!validateChecklistScopeReceipt(scopeReceipt, projectPath)) {
+    throw new Error('项目在当前 checklist 开始后发生变化；必须重新进入 checklist 阶段并重跑受影响检查');
+  }
   const input = checklistInputFromArgs(args) || await readStdin();
   const rendered = renderMessage('integration.checklist.result', variant, input);
   if (input.executionMode === '仅代码开发') {
@@ -751,7 +958,22 @@ async function main() {
     return;
   }
   if (command === 'start-confirm') {
-    console.log(runStartConfirm(args));
+    const result = createStartConfirmation(args);
+    console.log(result.message);
+    process.stderr.write(`${internalPrefix}PROJECT_CONFIRM_RECEIPT=${result.receipt}\n`);
+    return;
+  }
+  if (command === 'checklist-scope-receipt') {
+    process.stderr.write(`${internalPrefix}CHECKLIST_SCOPE_RECEIPT=${createChecklistScopeReceipt(required(args, 'project-path'))}\n`);
+    return;
+  }
+  if (command === 'a2m-execution-guard') {
+    process.stderr.write(`${internalPrefix}A2M_EXECUTION=${JSON.stringify(guardA2mExecution(args))}\n`);
+    return;
+  }
+  if (command === 'a2m-execution-result') {
+    const receipt = completeA2mExecution(required(args, 'receipt'), required(args, 'outcome'));
+    process.stderr.write(`${internalPrefix}A2M_EXECUTION=${JSON.stringify({ decision: 'RECORDED', receipt })}\n`);
     return;
   }
   if (command === 'context-required') {
@@ -790,7 +1012,7 @@ async function main() {
     console.log(await runChecklistResult(args));
     return;
   }
-  throw new Error('用法: integration_message_runner.mjs <resolve-project|locate-projects|start-confirm|context-required|product-clarify|windows-sandbox-setup|local-acceptance-notice|a2m-test-start|service-not-ready|safety-closeout|windows-sandbox-summary|checklist-result> ...');
+  throw new Error('用法: integration_message_runner.mjs <resolve-project|locate-projects|start-confirm|checklist-scope-receipt|a2m-execution-guard|a2m-execution-result|context-required|product-clarify|windows-sandbox-setup|local-acceptance-notice|a2m-test-start|service-not-ready|safety-closeout|windows-sandbox-summary|checklist-result> ...');
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/skill/references/normal/scripts/interaction_reply.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const internalPrefix = 'ALIPAY_AIPAY_INTERNAL:';
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const catalogPath = path.resolve(scriptDir, '../json/customer-messages.json');
+const questionPattern = /[?？]|(?:吗|么|嘛|呢)$|是否|能否|可否|要不要|是不是|好了吗|完成了吗|为什么|为何|怎么|怎样|如何|什么意思|什么(?:方式|时候)?|哪个|哪种|何时|什么时候|多少|可不可以|能不能|行不行/u;
+const englishQuestionPattern = /\b(?:can|could|would|should|why|how|what|when|whether)\b/iu;
+const uncertaintyPattern = /可能|大概|也许|或许|不确定|说不好|看情况|再看看|考虑一下|好像|似乎|应该|有风险|有问题|担心|顾虑/u;
+const englishUncertaintyPattern = /\b(?:maybe|perhaps|probably|possibly|unsure)\b/iu;
+const rejectionPattern = /(?:不(?:是|需要|要|用|必|能|可|再)?|别|无(?:需|须|法))(?:再)?(?:继续|推进|执行|处理|开始|提交|确认|同意|允许|批准|创建|操作|往下|下一步|通过|完成)|不可以|不行|不同意|不确认|不允许|不批准|不通过|未确认|未完成|未通过|没(?:有)?完成|还没(?:有)?(?:好|完成|确认|准备)|拒绝|取消|停止|暂停|稍后|晚点|待会|等一下|等等|算了|否定/u;
+const englishRejectionPattern = /\b(?:no|nope|not|don't|do\s+not|stop|cancel|wait|change)\b/iu;
+const conditionalOrChangePattern = /如果|假如|要是|除非|只要|之后再|以后再|但是|不过|只是|前提|再说|(?:修改|调整|改一下|改成|换成|重选|重新选择)|先.{0,20}(?:再|然后)/u;
+const affirmativeIntentPattern = /继续|推进|执行|开始|确认(?:无误)?|确定|同意|允许|批准|可以|没(?:有)?问题|无异议|通过|(?:已经|已)(?:完成|好了)|完成(?:了)?|搞定(?:了)?|弄好了|处理好了|就这么办|往下(?:走|做)|下一步|按(?:此|这个|该|当前)(?:方案)?(?:做|办|执行|推进|处理)|照(?:此|这个|该|当前)(?:方案)?(?:做|办|执行|推进|处理)/u;
+const englishAffirmativeIntentPattern = /\b(?:ok(?:ay)?|yes|confirm(?:ed)?|continue|proceed|approve(?:d)?|go\s+ahead)\b/iu;
+const simpleAffirmativePattern = /^(?:行|行的|行吧)$/u;
+const englishAffirmativeReplies = new Set(['ok', 'okay', 'yes', 'y']);
+const safePrefixes = ['那么就', '那就', '麻烦', '烦请', '嗯嗯', '好的', '我们', '请', '那', '就', '嗯', '我'];
+const safeSuffixes = ['谢谢', '就行', '即可', '吧', '呀', '啊', '哈', '了'];
+
+function affirmativeReplies() {
+  const catalog = JSON.parse(fs.readFileSync(catalogPath, 'utf8'));
+  const replies = catalog.interactionReplySets?.affirmative;
+  if (!Array.isArray(replies) || replies.length === 0 || replies.some((reply) => typeof reply !== 'string' || !reply)) {
+    throw new Error('customer-messages affirmative 回复集合无效');
+  }
+  return new Set(replies.map(normalizeAffirmativeReply));
+}
+
+export function normalizeAffirmativeReply(value) {
+  if (typeof value !== 'string') return '';
+  return value
+    .normalize('NFKC')
+    .trim()
+    .replace(/[。！!]+$/gu, '')
+    .trim()
+    .toLowerCase();
+}
+
+export function isAffirmativeReply(value) {
+  const normalized = normalizeAffirmativeReply(value);
+  if (normalized === '') return false;
+  const replies = affirmativeReplies();
+  let compact = normalized.replace(/[\s,，.。!！、;；:：]+/gu, '');
+  const intentText = compact
+    .replace(/(?:不需要|无需|不用)(?:再)?(?:修改|调整|改动|改|确认)/gu, '无异议')
+    .replace(/没(?:有)?问题/gu, '无异议');
+  if (
+    questionPattern.test(intentText)
+    || englishQuestionPattern.test(normalized)
+    || uncertaintyPattern.test(intentText)
+    || englishUncertaintyPattern.test(normalized)
+    || rejectionPattern.test(intentText)
+    || englishRejectionPattern.test(normalized)
+    || conditionalOrChangePattern.test(intentText)
+  ) return false;
+  if (
+    replies.has(normalized)
+    || replies.has(compact)
+    || simpleAffirmativePattern.test(compact)
+    || affirmativeIntentPattern.test(compact)
+    || englishAffirmativeIntentPattern.test(normalized)
+  ) return true;
+
+  let changed = true;
+  while (changed && compact) {
+    changed = false;
+    for (const prefix of safePrefixes) {
+      if (compact.startsWith(prefix)) {
+        compact = compact.slice(prefix.length);
+        changed = true;
+        break;
+      }
+    }
+    for (const suffix of safeSuffixes) {
+      if (compact.endsWith(suffix)) {
+        compact = compact.slice(0, -suffix.length);
+        changed = true;
+        break;
+      }
+    }
+  }
+  if (compact === '') return false;
+  if (
+    replies.has(compact)
+    || simpleAffirmativePattern.test(compact)
+    || affirmativeIntentPattern.test(compact)
+    || englishAffirmativeIntentPattern.test(compact)
+  ) return true;
+
+  // Only collapse repeated Latin keystrokes after all negative/ambiguous guards.
+  const deduplicatedLatin = compact.replace(/([a-z])\1+/gu, '$1');
+  return englishAffirmativeReplies.has(deduplicatedLatin);
+}
+
+function parseArgs(argv) {
+  const command = argv[2];
+  const args = {};
+  for (let index = 3; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) throw new Error(`未知参数 ${token}`);
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('--')) throw new Error(`参数 ${token} 缺少取值`);
+    const name = token.slice(2);
+    if (Object.prototype.hasOwnProperty.call(args, name)) throw new Error(`参数 ${token} 重复`);
+    args[name] = value;
+    index += 1;
+  }
+  return { command, args };
+}
+
+function main() {
+  const { command, args } = parseArgs(process.argv);
+  if (command !== 'confirm' || typeof args.reply !== 'string' || !args.reply) {
+    throw new Error('用法: interaction_reply.mjs confirm --reply <用户原始回复>');
+  }
+  const decision = isAffirmativeReply(args.reply) ? 'CONFIRMED' : 'REJECTED';
+  process.stderr.write(`${internalPrefix}REPLY_DECISION=${decision}\n`);
+  if (decision === 'REJECTED') process.exitCode = 2;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(`${internalPrefix}REPLY_VALIDATION_ERROR=${String(error?.message || error).replace(/[\r\n]/gu, ' ')}\n`);
+    process.exitCode = 1;
+  }
+}