@alipay/alipay-aipay 1.5.2 → 1.5.4

package/skill/references/onboarding/modules/scripts/ar_sign_apply.sh

@@ -221,6 +221,7 @@ if [ "$RETRY_RC" -eq 75 ]; then
   RECONCILE_OUTPUT=$(bash "${SCRIPT_DIR}/query_sign_status.sh" --sales-code "$SALES_CODE" --product-type "$PRODUCT_TYPE" 2>&1 || true)
   RECONCILED_STATUS=$(printf '%s\n' "$RECONCILE_OUTPUT" | sed -n 's/^ALIPAY_AIPAY_INTERNAL:SIGN_STATUS=//p' | tail -1)
   if [ "$RECONCILED_STATUS" = "SIGN_SUBMITTED" ] || [ "$RECONCILED_STATUS" = "SIGNED_EFFECTIVE" ]; then
+    emit_control "SIGN_APPLY_RESULT=SUCCESS"
     case "$PRODUCT_TYPE" in
       aipay) emit_control "FLOW:AI_PAY_SIGN_CONTINUE" ;;
       webpay) emit_control "FLOW:PC_WEB_SIGN_CONTINUE" ;;
@@ -229,14 +230,17 @@ if [ "$RETRY_RC" -eq 75 ]; then
     exit 0
   fi
   echo "❌ 签约提交响应不明且现有查询无法排除传播延迟，结果标记为 UNKNOWN，禁止自动重复提交"
+  emit_control "SIGN_APPLY_RESULT=UNKNOWN"
   exit 1
 elif [ "$RETRY_RC" -ne 0 ]; then
   echo "❌ 签约提交因明确未发送的网络异常在自动重试两次后仍未恢复"
+  emit_control "SIGN_APPLY_RESULT=FAILED"
   exit 1
 fi
 
 # 错误检测（先于业务解析，handle_error 内部会自动解包信封）
 if ! handle_error "$RESULT"; then
+  emit_control "SIGN_APPLY_RESULT=FAILED"
   exit 1
 fi
 
@@ -247,6 +251,7 @@ SUCCESS=$(echo "$BUSINESS" | jq -r '.success // false')
 if [ "$SUCCESS" = "true" ]; then
   emit_control "✅ 签约提交成功"
   emit_control "SIGN_APPLY_STATUS=SUBMITTED"
+  emit_control "SIGN_APPLY_RESULT=SUCCESS"
   # 签约提交成功后无需等待审核，立即推进后续步骤
   # AI 按量付费: 继续 5.2 服务注册 → 5.3 应用发布
   # AI 网页应用收款/AI 移动应用收款: 继续 5.3 应用发布
@@ -263,5 +268,6 @@ else
   ERROR_MSG=$(echo "$BUSINESS" | jq -r '.error.message // .errorMessage // "未知错误"')
   ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
   echo "❌ 签约提交失败: $ERROR_MSG"
+  emit_control "SIGN_APPLY_RESULT=FAILED"
   exit 1
 fi

package/skill/references/onboarding/modules/scripts/auth.sh

@@ -14,7 +14,7 @@
 #   init:     AUTH_FLOW:SKIP | AUTH_FLOW:READY_TO_OPEN | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:RETRY_WITH_NETWORK | AUTH_FLOW:FAILED
 #   wait:     AUTH_FLOW:AUTH_SUCCESS | AUTH_FLOW:PENDING | AUTH_FLOW:EXPIRED | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:CONTEXT_MISMATCH | AUTH_FLOW:RETRY_WITH_NETWORK | AUTH_FLOW:FAILED
 #   confirm:  AUTH_FLOW:AUTH_SUCCESS | AUTH_FLOW:PENDING | AUTH_FLOW:EXPIRED | AUTH_FLOW:SCOPE_MISMATCH | AUTH_FLOW:MCC_MISMATCH | AUTH_FLOW:CONTEXT_MISMATCH | AUTH_FLOW:RETRY_WITH_NETWORK | AUTH_FLOW:FAILED
-#   mismatch: logout 可确认成功后调用 auth init 重新生成授权链接；上下文冲突时输出 AUTH_FLOW:CONTEXT_MISMATCH 且不 logout；无法确认 CLI 结果时输出 AUTH_FLOW:RETRY_WITH_NETWORK
+#   mismatch: logout 后置条件可确认后调用 auth init 重新生成授权链接；上下文冲突时输出 AUTH_FLOW:CONTEXT_MISMATCH 且不 logout；无法确认 CLI 结果时输出 AUTH_FLOW:RETRY_WITH_NETWORK；仍处于登录态时输出 AUTH_FLOW:LOGOUT_STILL_LOGGED_IN
 #   stdout:   仅登记对客正文；AUTH_FLOW/状态/查询复用标记写入 stderr
 #=============================================================================
 
@@ -37,6 +37,28 @@ require_command node || exit 1
 require_command mktemp || exit 1
 umask 077
 
+auth_product_type_from_sales_code() {
+  case "$1" in
+    "I1080300001000160457") printf 'aipay' ;;
+    "I1080300001000041203") printf 'webpay' ;;
+    "I1080300001000041313") printf 'apppay' ;;
+    *) return 1 ;;
+  esac
+}
+
+create_auth_sign_reuse_receipt() {
+  local sign_status="$1" sign_flow="$2" product_type payload encoded
+  product_type=$(auth_product_type_from_sales_code "$SALES_CODE") || return 1
+  payload=$(jq -cn \
+    --arg productType "$product_type" \
+    --arg salesCode "$SALES_CODE" \
+    --arg signStatus "$sign_status" \
+    --arg flow "$sign_flow" \
+    '{schema_ver:1,product_type:$productType,sales_code:$salesCode,sign_status:$signStatus,flow:$flow}') || return 1
+  encoded=$(printf '%s' "$payload" | jq -rR '@base64' | tr '+/' '-_' | tr -d '=\n') || return 1
+  printf 'AIPAY_SIGN_REUSE_V1.%s' "$encoded"
+}
+
 # ─── 授权状态文件（用于独立执行 confirm/mismatch 时兜底恢复非敏感参数）────
 AUTH_STATE_OWNER="$(id -u 2>/dev/null || printf '%s' "${USER:-unknown}" | tr -c 'A-Za-z0-9_-' '_')"
 AUTH_STATE_BASE="${TMPDIR:-/tmp}"
@@ -159,6 +181,14 @@ save_auth_state() {
   }
 }
 
+save_auth_state_after_page_delivery() {
+  if save_auth_state; then
+    return 0
+  fi
+  emit_control "AUTH_STATE:SAVE_FAILED"
+  return 0
+}
+
 load_auth_state() {
   if ! validate_auth_state_file; then
     echo "❌ 缺少授权上下文（请传入 --sales-code/--mcc-code，或先执行 auth.sh init）"
@@ -315,6 +345,26 @@ auth_cli_environment_failure() {
   emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
 }
 
+handle_auth_cli_result() {
+  local cli_result="$1" error_type
+  error_type=$(detect_error "$cli_result")
+  if handle_error "$cli_result"; then
+    return 0
+  fi
+  case "$error_type" in
+    MCP_AUTH_ERROR|AUTH_MISMATCH)
+      # error_handler.sh already emitted the unique recovery marker.
+      ;;
+    MCP_SERVICE_ERROR|SERVICE_UNSTABLE)
+      emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
+      ;;
+    *)
+      emit_control "AUTH_FLOW:FAILED"
+      ;;
+  esac
+  return 1
+}
+
 wait_for_effective_whoami() {
   local action="$1"
   local max_attempts=3
@@ -332,10 +382,7 @@ wait_for_effective_whoami() {
       auth_cli_environment_failure "$action"
       return 1
     }
-    if ! handle_error "$AUTH_WHOAMI_RESULT"; then
-      emit_control "AUTH_FLOW:FAILED"
-      return 1
-    fi
+    handle_auth_cli_result "$AUTH_WHOAMI_RESULT" || return 1
 
     logged_in=$(echo "$AUTH_WHOAMI_RESULT" | jq -r '.data.logged_in // false')
     is_expired=$(echo "$AUTH_WHOAMI_RESULT" | jq -r '.data.is_expired // false')
@@ -364,18 +411,6 @@ run_json_command() {
   exit_code=$?
   stderr_output=$(cat "$stderr_file")
 
-  if json_payload=$(extract_json_payload "$stdout"); then
-    rm -f "$stderr_file"
-    printf '%s' "$json_payload"
-    return 0
-  fi
-
-  if json_payload=$(extract_json_payload "$stderr_output"); then
-    rm -f "$stderr_file"
-    printf '%s' "$json_payload"
-    return 0
-  fi
-
   combined_output=$(printf '%s\n%s' "$stdout" "$stderr_output")
   if json_payload=$(extract_json_payload "$combined_output"); then
     rm -f "$stderr_file"
@@ -395,7 +430,7 @@ validate_current_authorization() {
   local logged_in is_expired granted_scope required_scope
   local scope_match mcc_verify_result mcc_verify_unwrapped mcc_match mcc_raw retry_rc
   local mcc_error_type mcc_error_code mcc_success
-  local mismatch_type sign_status_output
+  local mismatch_type sign_status_output sign_status_marker sign_flow_marker sign_reuse_receipt
   local granted_scope_item required_scope_item required_scope_found
   local -a granted_scope_items required_scope_items
 
@@ -412,10 +447,7 @@ validate_current_authorization() {
     }
   fi
 
-  if ! handle_error "$whoami_result"; then
-    emit_control "AUTH_FLOW:FAILED"
-    return 1
-  fi
+  handle_auth_cli_result "$whoami_result" || return 1
 
   logged_in=$(echo "$whoami_result" | jq -r '.data.logged_in // false')
   is_expired=$(echo "$whoami_result" | jq -r '.data.is_expired // false')
@@ -461,12 +493,12 @@ validate_current_authorization() {
     retry_rc=$?
     if [ "$retry_rc" -ne 0 ]; then
       echo "❌ 授权 MCC 校验因网络或服务异常在自动重试两次后仍未恢复"
-      emit_control "AUTH_FLOW:FAILED"
+      emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
       return 1
     fi
     mcc_verify_result=$(extract_json_payload "$mcc_raw") || {
       echo "❌ alipay-cli mcp call ar-query.queryArInfosBySalesProd 未返回合法 JSON"
-      emit_control "AUTH_FLOW:FAILED"
+      emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
       return 1
     }
 
@@ -494,6 +526,11 @@ validate_current_authorization() {
     if [ "$mcc_match" = "true" ] && sign_status_output=$(emit_sign_status_from_business "$mcc_verify_unwrapped" "$SALES_CODE" 2>/dev/null); then
       printf '%s\n' "$sign_status_output" \
         | while IFS= read -r marker; do emit_control "$marker"; done
+      sign_status_marker=$(printf '%s\n' "$sign_status_output" | awk -F= '/^SIGN_STATUS=/{print $2; exit}')
+      sign_flow_marker=$(printf '%s\n' "$sign_status_output" | awk '/^FLOW:/{print; exit}')
+      if [ -n "$sign_status_marker" ] && [ -n "$sign_flow_marker" ] && sign_reuse_receipt=$(create_auth_sign_reuse_receipt "$sign_status_marker" "$sign_flow_marker"); then
+        emit_control "AUTH_SIGN_REUSE_RECEIPT=${sign_reuse_receipt}"
+      fi
       emit_control "AUTH_SIGN_QUERY_REUSABLE=true"
     fi
   fi
@@ -564,10 +601,7 @@ auth_init() {
     auth_cli_environment_failure "登录状态检查"
     return 1
   }
-  if ! handle_error "$CHECK_RESULT"; then
-    emit_control "AUTH_FLOW:FAILED"
-    return 1
-  fi
+  handle_auth_cli_result "$CHECK_RESULT" || return 1
   LOGGED_IN=$(echo "$CHECK_RESULT" | jq -r '.data.logged_in // false')
   IS_EXPIRED=$(echo "$CHECK_RESULT" | jq -r '.data.is_expired // false')
 
@@ -576,13 +610,17 @@ auth_init() {
       # 后端查询没有权威 MCC 字段，旧状态变化时不能把现有登录误判为当前上下文已授权。
       DEVICE_CODE=""
       BROWSER_URL=""
-      save_auth_state || return 1
+      if ! save_auth_state; then
+        emit_control "AUTH_STATE:SAVE_FAILED"
+      fi
       emit_control "AUTH_FLOW:${AUTH_INIT_CONTEXT_MISMATCH_TYPE}"
       return 1
     fi
     validate_current_authorization "$CHECK_RESULT" || return 1
     DEVICE_CODE=""
-    save_auth_state || return 1
+    if ! save_auth_state; then
+      emit_control "AUTH_STATE:SAVE_FAILED"
+    fi
     emit_control "✅ 当前登录及授权范围有效，可继续后续流程"
     emit_control "AUTH_FLOW:SKIP"
     return 0
@@ -593,16 +631,15 @@ auth_init() {
     auth_cli_environment_failure "授权登录发起"
     return 1
   }
-  if ! handle_error "$LOGIN_RESULT"; then
-    emit_control "AUTH_FLOW:FAILED"
-    return 1
-  fi
+  handle_auth_cli_result "$LOGIN_RESULT" || return 1
   LOGIN_STATUS=$(echo "$LOGIN_RESULT" | jq -r '.data.status // ""')
 
   if [ "$LOGIN_STATUS" = "already_logged_in" ]; then
     validate_current_authorization || return 1
     DEVICE_CODE=""
-    save_auth_state || return 1
+    if ! save_auth_state; then
+      emit_control "AUTH_STATE:SAVE_FAILED"
+    fi
     emit_control "✅ 当前登录及授权范围有效，可继续后续流程"
     emit_control "AUTH_FLOW:SKIP"
     return 0
@@ -630,10 +667,7 @@ auth_init() {
     return 1
   }
 
-  # Step 6: 保存参数到状态文件（供 confirm/mismatch 使用）
-  save_auth_state || return 1
-
-  # Step 7: 有效期转换（对非数字做防护）
+  # Step 6: 有效期转换（对非数字做防护）
   if [[ "$EXPIRES_IN" =~ ^[0-9]+$ ]] && [ "$EXPIRES_IN" -ge 60 ]; then
     EXPIRES_MIN=$((EXPIRES_IN / 60))
     EXPIRES_DISPLAY="${EXPIRES_MIN} 分钟"
@@ -643,7 +677,7 @@ auth_init() {
     EXPIRES_DISPLAY="10 分钟"
   fi
 
-  # Step 8: 由统一目录渲染授权信息；独立 open 动作在消息发出后打开。
+  # Step 7: 由统一目录渲染授权信息；独立 open 动作在消息发出后打开。
   DISPLAY_CODE="${VERIFICATION_CODE:-（请查看支付宝授权页面）}"
   MESSAGE_INPUT=$(printf '%s\n' "$PRODUCT_NAME" "$DEVICE_CODE" "$MCC_CODE" "$MCC_NAME" "$DISPLAY_CODE" "$EXPIRES_DISPLAY" "$BROWSER_URL" | jq -Rs '
     split("\n") as $v | {productName:$v[0],deviceCode:$v[1],mccCode:$v[2],mccName:$v[3],verificationCode:$v[4],expiresDisplay:$v[5],officialUrl:$v[6]}
@@ -653,6 +687,8 @@ auth_init() {
     emit_control "AUTH_FLOW:FAILED"
     exit 1
   fi
+  # Step 8: 页面 stdout 已经安全送达时，状态文件只用于 opener 便利；保存失败不得生成第二个授权页或截断 wait。
+  save_auth_state_after_page_delivery
   echo ""
   emit_control "AUTH_FLOW:READY_TO_OPEN"
 }
@@ -661,12 +697,11 @@ auth_open() {
   local saved_device saved_url validate_input open_status open_helper
 
   restore_auth_context_or_state "$@" || exit 1
-  saved_device=$(jq -r '.deviceCode // ""' "$AUTH_STATE_FILE")
-  saved_url=$(jq -r '.authorizationUrl // ""' "$AUTH_STATE_FILE")
+  saved_device=$(jq -r '.deviceCode // ""' "$AUTH_STATE_FILE" 2>/dev/null || printf '')
+  saved_url=$(jq -r '.authorizationUrl // ""' "$AUTH_STATE_FILE" 2>/dev/null || printf '')
   if [ -z "$saved_device" ] || [ -z "$saved_url" ]; then
-    echo "❌ 缺少待打开的授权页面上下文，请重新执行 auth.sh init --defer-open"
-    emit_control "AUTH_FLOW:FAILED"
-    return 1
+    emit_control "AUTH_OPEN:LINK_ONLY"
+    return 0
   fi
 
   validate_input=$(jq -n \
@@ -740,12 +775,31 @@ auth_confirm() {
   elif [ "$OUTER_SUCCESS" = "true" ] || [ "$DATA_STATUS" = "logged_in" ] || [ "$DATA_STATUS" = "already_logged_in" ] || [ "$DATA_STATUS" = "completed" ]; then
     :
   else
-    if handle_error "$LOGIN_COMPLETE_RESULT"; then
-      echo "❌ 授权确认失败：返回结果未包含可识别的完成状态"
+    if ! handle_auth_cli_result "$LOGIN_COMPLETE_RESULT"; then
+      cleanup_auth_state
+      return 1
     fi
+    wait_for_effective_whoami "授权完成确认状态复核"
+    whoami_rc=$?
+    if [ "$whoami_rc" -eq 2 ]; then
+      AUTH_CONFIRM_RESULT="PENDING"
+      if [ "${AUTH_POLLING:-false}" != "true" ]; then
+        if ! printf '%s' '{}' | ALIPAY_AIPAY_RENDERER_MANAGED_CALLER=auth.sh node "$RENDERER" auth.pending --variant DEFAULT; then
+          emit_control "AUTH_FLOW:FAILED"
+          return 1
+        fi
+        emit_control "AUTH_FLOW:PENDING"
+      fi
+      return 0
+    elif [ "$whoami_rc" -ne 0 ]; then
+      return 1
+    fi
+    validate_current_authorization "$AUTH_WHOAMI_RESULT" || return 1
     cleanup_auth_state
-    emit_control "AUTH_FLOW:FAILED"
-    return 1
+    AUTH_CONFIRM_RESULT="AUTH_SUCCESS"
+    emit_control "✅ 授权确认成功（本机 CLI 登录态、scope 与 MCC 授权有效性均已通过）"
+    emit_control "AUTH_FLOW:AUTH_SUCCESS"
+    return 0
   fi
 
   # Step 3: 复用 init 的 scope + MCC 授权有效性校验
@@ -817,8 +871,6 @@ auth_wait() {
 
 # ─── auth mismatch: 授权范围不满足 → logout → 重新授权 ──────────────────────
 auth_mismatch() {
-  local logout_result logout_error_type
-
   if [ "${1:-}" = "--defer-open" ]; then
     shift
   else
@@ -847,16 +899,21 @@ auth_mismatch() {
     emit_control "AUTH_FLOW:FAILED"
     return 1
   fi
-  logout_result=$(run_json_command "alipay-cli logout --json" alipay-cli logout --json) || {
-    auth_cli_environment_failure "退出当前登录"
-    return 1
-  }
-  logout_error_type=$(detect_error "$logout_result")
-  if [ "$logout_error_type" != "SUCCESS" ]; then
-    echo "❌ 退出当前登录失败，已停止重新授权"
-    emit_control "AUTH_FLOW:FAILED"
-    return 1
-  fi
+  confirm_logout_postcondition
+  case "$ALIPAY_LOGOUT_POSTCONDITION" in
+    COMMAND_CONFIRMED_SUCCESS|POSTCONDITION_LOGGED_OUT)
+      ;;
+    STILL_LOGGED_IN)
+      render_logout_still_logged_in || return 1
+      emit_control "AUTH_FLOW:LOGOUT_STILL_LOGGED_IN"
+      return 1
+      ;;
+    *)
+      render_logout_unconfirmed || return 1
+      emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
+      return 1
+      ;;
+  esac
 
   # Step 3: 调用 auth init 执行登录 + 构建授权链接 + 输出唯一授权消息。
   # DEV_TOOL_NAME 已 export，子进程可继承。

package/skill/references/onboarding/modules/scripts/error_handler.sh

@@ -348,7 +348,7 @@ detect_error() {
   fi
 
   # 3. MCP 调用失败（网络/连接错误）
-  if echo "$UNWRAPPED" | grep -qiE "MCP 调用失败|connection refused|timeout|network error"; then
+  if echo "$UNWRAPPED" | grep -qiE "MCP 调用失败|connection refused|timeout|network[ _]error|网络连接失败"; then
     echo "MCP_SERVICE_ERROR"
     return
   fi
@@ -383,31 +383,156 @@ detect_error() {
   echo "SUCCESS"
 }
 
-# ─── MCP 认证错误处理 ──────────────────────────────────────────────────────
-handle_mcp_auth_error() {
-  local LOGOUT_RESULT LOGOUT_EXIT_CODE LOGOUT_ERROR_TYPE LOGOUT_ERROR_MSG
-  local LOGOUT_ANALYSIS LOGOUT_PARSE_STATUS
-
-  emit_control "AUTH_FLOW:AUTH_REQUIRED"
-  render_error_message error.mcp.auth START '{}' || return 1
-  LOGOUT_RESULT=$(PLATFORM=${DEV_TOOL_NAME:-unknown} PLATFORM_ID="${PLATFORM_ID:-}" alipay-cli logout --json 2>&1)
-  LOGOUT_EXIT_CODE=$?
-  LOGOUT_ERROR_TYPE=$(detect_error "$LOGOUT_RESULT")
-  LOGOUT_ANALYSIS=$(extract_unique_json "$LOGOUT_RESULT" 2>/dev/null || echo '{"status":"none"}')
-  LOGOUT_PARSE_STATUS=$(echo "$LOGOUT_ANALYSIS" | jq -r '.status // "none"' 2>/dev/null)
-
-  if [ "$LOGOUT_EXIT_CODE" -ne 0 ] || [ "$LOGOUT_ERROR_TYPE" != "SUCCESS" ]; then
-    if [ "$LOGOUT_PARSE_STATUS" != "ok" ] || [ "$LOGOUT_ERROR_TYPE" = "MCP_SERVICE_ERROR" ] || [ "$LOGOUT_ERROR_TYPE" = "SERVICE_UNSTABLE" ]; then
-      render_error_message error.mcp.auth LOGOUT_UNCONFIRMED '{}' || return 1
+extract_captured_json() {
+  local RAW="$1"
+  local ANALYSIS STATUS
+  ANALYSIS=$(extract_unique_json "$RAW" 2>/dev/null || echo '{"status":"none"}')
+  STATUS=$(echo "$ANALYSIS" | jq -r '.status // "none"' 2>/dev/null)
+  [ "$STATUS" = "ok" ] || return 1
+  echo "$ANALYSIS" | jq -ce '.value | select(type == "object")' 2>/dev/null
+}
+
+run_alipay_cli_json_capture() {
+  local stderr_file stdout stderr_output combined_output
+
+  ALIPAY_CLI_JSON_CAPTURE=""
+  ALIPAY_CLI_JSON_EXIT_CODE=0
+  stderr_file="$(mktemp "${TMPDIR:-/tmp}/alipay_cli_capture_stderr.XXXXXX")" || return 1
+  stdout=$(PLATFORM="${DEV_TOOL_NAME:-unknown}" PLATFORM_ID="${PLATFORM_ID:-}" PRODUCT="${PRODUCT:-}" "$@" 2>"$stderr_file")
+  ALIPAY_CLI_JSON_EXIT_CODE=$?
+  stderr_output=$(cat "$stderr_file")
+  rm -f "$stderr_file"
+
+  combined_output=$(printf '%s\n%s' "$stdout" "$stderr_output")
+  if ALIPAY_CLI_JSON_CAPTURE=$(extract_captured_json "$combined_output"); then
+    return 0
+  fi
+
+  ALIPAY_CLI_JSON_CAPTURE=""
+  return 1
+}
+
+confirm_logout_postcondition() {
+  local logout_error_type whoami_error_type whoami_state
+  local logout_result_state attempt=1
+  local max_attempts=3
+  local interval_seconds=3
+
+  ALIPAY_LOGOUT_POSTCONDITION=""
+  ALIPAY_LOGOUT_ERROR_MESSAGE=""
+
+  if [ "${ALIPAY_AIPAY_TEST_MODE:-0}" = "1" ]; then
+    interval_seconds=0
+  fi
+
+  while [ "$attempt" -le "$max_attempts" ]; do
+    logout_result_state="UNCONFIRMED"
+    if run_alipay_cli_json_capture alipay-cli logout --json; then
+      logout_error_type=$(detect_error "$ALIPAY_CLI_JSON_CAPTURE")
+      if [ "$ALIPAY_CLI_JSON_EXIT_CODE" -eq 0 ] && [ "$logout_error_type" = "SUCCESS" ]; then
+        ALIPAY_LOGOUT_POSTCONDITION="COMMAND_CONFIRMED_SUCCESS"
+        return 0
+      fi
+      ALIPAY_LOGOUT_ERROR_MESSAGE=$(sanitize_customer_error_text "$(extract_error_message "$ALIPAY_CLI_JSON_CAPTURE")")
+      case "$logout_error_type" in
+        MCP_SERVICE_ERROR|SERVICE_UNSTABLE)
+          logout_result_state="RETRYABLE"
+          ;;
+        SUCCESS)
+          # A success payload paired with a non-zero exit code cannot prove the command result.
+          logout_result_state="UNCONFIRMED"
+          ;;
+        *)
+          logout_result_state="EXPLICIT_FAILURE"
+          ;;
+      esac
     else
-      LOGOUT_ERROR_MSG=$(sanitize_customer_error_text "$(extract_error_message "$LOGOUT_RESULT")")
-      MESSAGE_INPUT=$(jq -cn --arg errorMessage "$LOGOUT_ERROR_MSG" '{errorMessage:$errorMessage}')
-      render_error_message error.mcp.auth LOGOUT_FAILED "$MESSAGE_INPUT" || return 1
+      ALIPAY_LOGOUT_ERROR_MESSAGE="退出命令未返回可唯一解析结果"
+    fi
+
+    if ! run_alipay_cli_json_capture alipay-cli whoami --json; then
+      ALIPAY_LOGOUT_POSTCONDITION="UNCONFIRMED"
+      return 1
+    fi
+
+    whoami_error_type=$(detect_error "$ALIPAY_CLI_JSON_CAPTURE")
+    if [ "$ALIPAY_CLI_JSON_EXIT_CODE" -ne 0 ] || [ "$whoami_error_type" != "SUCCESS" ]; then
+      ALIPAY_LOGOUT_POSTCONDITION="UNCONFIRMED"
+      return 1
     fi
+
+    whoami_state=$(echo "$ALIPAY_CLI_JSON_CAPTURE" | jq -r '
+      if (.data | type) != "object" then "UNCONFIRMED"
+      elif (.data.logged_in? | type) == "boolean" and .data.logged_in == false then "LOGGED_OUT"
+      elif (.data.is_expired? | type) == "boolean" and .data.is_expired == true then "LOGGED_OUT"
+      elif (.data.logged_in? | type) == "boolean" and .data.logged_in == true and
+           ((.data | has("is_expired") | not) or ((.data.is_expired? | type) == "boolean" and .data.is_expired == false)) then "STILL_LOGGED_IN"
+      else "UNCONFIRMED"
+      end
+    ' 2>/dev/null)
+    if [ "$whoami_state" = "LOGGED_OUT" ]; then
+      ALIPAY_LOGOUT_POSTCONDITION="POSTCONDITION_LOGGED_OUT"
+      return 0
+    fi
+    if [ "$whoami_state" != "STILL_LOGGED_IN" ] || [ "$logout_result_state" != "EXPLICIT_FAILURE" ]; then
+      ALIPAY_LOGOUT_POSTCONDITION="UNCONFIRMED"
+      return 1
+    fi
+
+    if [ "$attempt" -eq "$max_attempts" ]; then
+      ALIPAY_LOGOUT_POSTCONDITION="STILL_LOGGED_IN"
+      return 1
+    fi
+    sleep "$interval_seconds"
+    attempt=$((attempt + 1))
+  done
+}
+
+render_logout_unconfirmed() {
+  render_error_message error.mcp.auth LOGOUT_UNCONFIRMED '{}'
+}
+
+render_logout_still_logged_in() {
+  local message input
+  message="${ALIPAY_LOGOUT_ERROR_MESSAGE:-退出命令未能使当前登录态失效}"
+  input=$(jq -cn --arg errorMessage "$message" '{errorMessage:$errorMessage}')
+  render_error_message error.mcp.auth LOGOUT_FAILED "$input"
+}
+
+# ─── MCP 认证错误处理 ──────────────────────────────────────────────────────
+handle_mcp_auth_error() {
+  render_error_message error.mcp.auth START '{}' || {
+    emit_control "AUTH_FLOW:FAILED"
+    return 1
+  }
+  if [ "${ALIPAY_AIPAY_SUPPRESS_AUTH_LOGOUT:-}" = "1" ]; then
+    emit_control "AUTH_FLOW:AUTH_REQUIRED"
     return 1
   fi
-
-  render_error_message error.mcp.auth LOGOUT_SUCCESS '{}' || return 1
+  confirm_logout_postcondition
+  case "$ALIPAY_LOGOUT_POSTCONDITION" in
+    COMMAND_CONFIRMED_SUCCESS|POSTCONDITION_LOGGED_OUT)
+      render_error_message error.mcp.auth LOGOUT_SUCCESS '{}' || {
+        emit_control "AUTH_FLOW:FAILED"
+        return 1
+      }
+      emit_control "AUTH_FLOW:AUTH_REQUIRED"
+      ;;
+    STILL_LOGGED_IN)
+      render_logout_still_logged_in || {
+        emit_control "AUTH_FLOW:FAILED"
+        return 1
+      }
+      emit_control "AUTH_FLOW:LOGOUT_STILL_LOGGED_IN"
+      ;;
+    *)
+      render_logout_unconfirmed || {
+        emit_control "AUTH_FLOW:FAILED"
+        return 1
+      }
+      emit_control "AUTH_FLOW:RETRY_WITH_NETWORK"
+      ;;
+  esac
 }
 
 # ─── MCP 服务不可用处理 ────────────────────────────────────────────────────

package/skill/references/onboarding/modules/scripts/service.sh

@@ -351,6 +351,7 @@ service_save() {
   if [ "$RETRY_RC" -eq 75 ]; then
     if [ -z "$SERVICE_ID" ]; then
       echo "❌ 服务创建响应不明；现有查询无法把同名候选唯一归属于本次创建，结果标记为 UNKNOWN，禁止自动重复创建"
+      emit_control "SERVICE_SAVE_RESULT=UNKNOWN"
       exit 1
     fi
     if fetch_service_list; then
@@ -365,11 +366,13 @@ service_save() {
       if [ "$MATCH_COUNT" -eq 1 ]; then
         emit_control "✅ 服务修改已由列表查询核验成功"
         emit_control "📋 服务ID: $SERVICE_ID"
+        emit_control "SERVICE_SAVE_RESULT=SUCCESS"
         emit_control_field "SERVICE_ID" "$SERVICE_ID" || return 1
         return 0
       fi
     fi
     echo "❌ 服务修改响应不明且现有列表无法排除传播延迟，结果标记为 UNKNOWN，禁止自动重复修改"
+    emit_control "SERVICE_SAVE_RESULT=UNKNOWN"
     exit 1
   elif [ "$RETRY_RC" -ne 0 ]; then
     if [ -z "$SERVICE_ID" ]; then
@@ -377,11 +380,13 @@ service_save() {
     else
       echo "❌ 服务修改因明确未发送的网络异常在自动重试两次后仍未恢复"
     fi
+    emit_control "SERVICE_SAVE_RESULT=FAILED"
     exit 1
   fi
 
   # 错误检测
   if ! handle_error "$RESULT"; then
+    emit_control "SERVICE_SAVE_RESULT=FAILED"
     exit 1
   fi
 
@@ -418,10 +423,12 @@ service_save() {
 
     if ! validate_control_value "$NEW_SERVICE_ID"; then
       echo "❌ 服务创建返回成功，但未解析到 serviceId，禁止继续后续流程"
+      emit_control "SERVICE_SAVE_RESULT=UNKNOWN"
       exit 1
     fi
     emit_control "✅ 服务${OPERATION}成功"
     emit_control "📋 服务ID: $NEW_SERVICE_ID"
+    emit_control "SERVICE_SAVE_RESULT=SUCCESS"
     emit_control_field "SERVICE_ID" "$NEW_SERVICE_ID" || exit 1
   else
     OPERATION="创建"
@@ -437,8 +444,10 @@ service_save() {
       ' 2>/dev/null)
       ERROR_MSG=$(sanitize_customer_error_text "$ERROR_MSG")
       echo "❌ 服务${OPERATION}失败: ${BUSINESS_CODE} / ${ERROR_MSG}"
+      emit_control "SERVICE_SAVE_RESULT=FAILED"
     else
       echo "❌ 服务${OPERATION}返回结构异常，无法确认操作结果"
+      emit_control "SERVICE_SAVE_RESULT=UNKNOWN"
     fi
     exit 1
   fi

package/skill/references/onboarding/modules/scripts/upload_screenshots.sh

@@ -33,6 +33,7 @@ case "$PRODUCT_TYPE" in
   *) echo "❌ 截图上传仅支持 webpay|apppay"; exit 1 ;;
 esac
 init_alipay_cli_product "$PRODUCT_TYPE" || exit 1
+export ALIPAY_AIPAY_SUPPRESS_AUTH_LOGOUT=1
 
 HOME_IMG="${1:-}"
 SHOP_IMG="${2:-}"
@@ -83,7 +84,7 @@ wait
 # 解析图片引用值（兼容 file upload 返回 fileKey 或 URL 字段）
 parse_image_ref() {
   local RAW=$(cat "$1")
-  if ! handle_error "$RAW" >/dev/null; then
+  if [ "$(detect_error "$RAW")" != "SUCCESS" ]; then
     return 1
   fi
   # alipay-cli file upload 可能返回 MCP 信封，先解包
@@ -120,7 +121,15 @@ PAY_REF=$(parse_image_ref "$TMP_PAY")
 # 校验上传结果（含认证错误检测）
 check_upload_error() {
   local RAW=$(cat "$1")
+  local ERROR_TYPE
+  ERROR_TYPE=$(detect_error "$RAW")
+  if [ "$ERROR_TYPE" = "MCP_AUTH_ERROR" ] && [ "${UPLOAD_AUTH_ERROR_SEEN:-false}" = "true" ]; then
+    return 1
+  fi
   if ! handle_error "$RAW"; then
+    if [ "$ERROR_TYPE" = "MCP_AUTH_ERROR" ]; then
+      UPLOAD_AUTH_ERROR_SEEN=true
+    fi
     return 1
   fi
   return 0

package/skill/references/onboarding/modules/service-registration.md

@@ -29,7 +29,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" service validate --name
 - 修改：必须传当前候选完整 `serviceId` 和全部五项资料；保存前使用 `onboarding.write.confirm/SERVICE_UPDATE_ONLY` 绑定当前登录会话、脱敏主体、产品、动作、目标与参数，并等待当前摘要后的明确肯定回复；`1` 只是兼容快捷输入。
 - 任何目标、参数、主体或会话变化都使旧修改确认失效。创建不得进入修改确认。
 
-保存写操作调用 `a2a-pay-service.saveBazaarServiceForMcp`。明确 `NOT_SENT` 才能自动重试；`MAYBE_SENT` 时用列表按 `serviceId` 和完整五项资料核验，不能靠同名服务猜测。创建结果未解析到实际 `serviceId` 时禁止宣称完成。
+保存写操作调用 `a2a-pay-service.saveBazaarServiceForMcp`。明确 `NOT_SENT` 才能自动重试；`MAYBE_SENT` 时用列表按 `serviceId` 和完整五项资料核验，不能靠同名服务猜测。创建结果未解析到实际 `serviceId` 时禁止宣称完成。脚本必须输出 `SERVICE_SAVE_RESULT=SUCCESS|FAILED|UNKNOWN`；`UNKNOWN` 只表示禁止自动重复保存并进入服务分支待办，不清除其他分支事实。
 
 成功结果只用登记 renderer：