@alipay/alipay-aipay 1.6.2-beta → 1.6.2-beta2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alipay/alipay-aipay",
-  "version": "1.6.2-beta",
+  "version": "1.6.2-beta2",
   "description": "支付宝 AI 付 Skill 安装包 - 优先安装 Agent Skill，并在 macOS/Linux 后台准备用户级 CLI 工具",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -5,27 +5,23 @@ description: >-
   触发关键词："AI支付"、"接支付宝"、"一站式接支付宝"、"接个支付"、"开发支付"、"402收款"、"AI按量付费"、"AI网页应用收款"、"AI移动应用收款"、"按量付费"、"快捷收款"、"快捷收单"、"网站支付"、"APP 支付"、"产品开通"、"商家开通"、"签约入驻"等。
 ---
 
-# 支付宝 AI 付 Skill 启动器
+本文件只负责在加载业务规则前确定本轮实际使用的 Skill 版本。禁止在完成下列启动协议前读取 `references/runtime-entry.md`、flow、模块、消息目录或业务脚本。
 
-本文件只负责在加载业务规则前确定本轮实际使用的 Skill 版本。禁止在完成下列启动协议前读取 `references/runtime-entry.md`、任一 flow、模块、消息目录或业务脚本。
-
-## 前置版本检查
-
-本次 Agent 对话首次使用 `alipay-aipay` 时，先把本文件所在目录解析为规范化绝对路径 `<SKILL_DIR>`，记录一次性事实 `ALIPAY_AIPAY_SELF_UPDATE_CHECKED=true`，再执行以下单条命令。`<SKILL_DIR>` 是执行时替换的路径占位符；禁止用 shell 变量赋值、命令替换或依赖特定 shell：
+首次使用 `alipay-aipay`：解析本文件目录为规范化绝对 `<SKILL_DIR>`，记录 `ALIPAY_AIPAY_SELF_UPDATE_CHECKED=true`，执行单命令；`<SKILL_DIR>` 是占位符，禁止用 shell 变量赋值、命令替换或依赖特定 shell：
 
 ```text
 node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" self-update check --skill-dir "<SKILL_DIR>"
 ```
 
-`SKILL_DIR` 必须绑定刚触发且正在执行本命令的 Skill 规范化绝对路径，不得换成 Agent 启动目录、用户项目目录、用户 Home、npm 包源码根或另一份 Skill 副本。`VERSION` 缺失/非法或 `references/runtime-entry.md` 缺失时由本命令尝试精确修复；命令失败或 marker 无法唯一解析时按 `SELF_UPDATE:CHECK_FAILED`。
+`SKILL_DIR` 只绑定当前 Skill，禁止换成 Agent 启动目录、用户项目、Home、npm 源码根或其他副本。`VERSION` 缺失/非法或入口缺失由命令修复；失败或 marker 不唯一按 `SELF_UPDATE:CHECK_FAILED`。
 
-stderr 只允许出现以下一个内部终态；不得向用户展示 marker 或 npm/npx 原始输出：
+stderr 只允许一个内部终态，禁止展示 marker 或 npm/npx 原始输出：
 
-- `SELF_UPDATE:UPDATED=<合法 SemVer>`：当前 Skill 目录已原子切换到新版。
+- `SELF_UPDATE:UPDATED=<合法 SemVer>`：已切换新版。
 - `SELF_UPDATE:CURRENT=<合法 SemVer>`：继续当前版本。
-- `SELF_UPDATE:RETRY_WITH_NETWORK`：registry 或安装阶段网络不可达；可申请联网后原样重试本命令一次。
-- `SELF_UPDATE:SKIPPED_NETWORK_RESTRICTED|CHECK_FAILED|INSTALL_FAILED|VERIFY_FAILED`：静默继续当前可用版本，不重试、不申请权限。
+- `SELF_UPDATE:RETRY_WITH_NETWORK`：可取权后原样重试一次。
+- `SELF_UPDATE:SKIPPED_NETWORK_RESTRICTED|CHECK_FAILED|INSTALL_FAILED|VERIFY_FAILED`：继续当前可用版本。
 
-除 `RETRY_WITH_NETWORK` 的一次原样重试外，只完整读取同一 `SKILL_DIR` 的 `references/runtime-entry.md`，在当前上下文记录 `ALIPAY_AIPAY_RUNTIME_ENTRY_LOADED=true` 和规范化路径，再按原请求路由。`UPDATED` 后先废弃旧 loaded 事实，禁止继续读取更新前版本的任何业务文档；其他终态同样不再读取本启动器或 `self-update.md` 补充规则。
+除 `RETRY_WITH_NETWORK` 外，只完整读取同一 `SKILL_DIR` 的 `references/runtime-entry.md`，记录 `ALIPAY_AIPAY_RUNTIME_ENTRY_LOADED=true` 和路径，再路由。`UPDATED` 后废弃旧 loaded 事实，禁止继续读取更新前版本的任何业务文档；其他终态同样不再读取本启动器或 `self-update.md` 补充规则。
 
-同一对话后续确认、补材料、候选选择、恢复、中断继续、重复触发和 Full Process 衔接，两项事实存在、路径未变且入口规则仍在时，跳过版本检查和入口重读。仅 `UPDATED`、路径变化或上下文压缩导致规则不可用时重读并刷新；事实不落盘。
+同一对话后续确认、补材料、候选、恢复、中断继续、重复触发和 Full Process 衔接，两项事实存在且路径未变时跳过版本检查和入口重读；仅 `UPDATED`、路径变化或上下文压缩导致规则不可用时重读并刷新；事实不落盘。

package/skill/VERSION

@@ -1 +1 @@
-1.6.2-beta
+1.6.2-beta2

package/skill/references/normal/scripts/telemetry.mjs

@@ -18,6 +18,7 @@ const syncLogCode = '1005';
 const syncLogMsg = 'alipay_aipay_skill_event';
 const syncLogYuyanID = '180020010001290755';
 const uploadTimeoutMs = 2500;
+const terminalForegroundUploadTimeoutMs = 1200;
 const outboxFlushLimit = 50;
 const outboxClaimTtlMs = 5 * 60 * 1000;
 const outboxMaxRecords = 1000;
@@ -119,6 +120,14 @@ function safeDimension(value, fallback = 'unknown', maxLength = 80) {
   return trimmed.slice(0, maxLength);
 }
 
+function failedResult(error, code = 'REQUEST_ERROR', message = 'request error') {
+  return {
+    ok: false,
+    error_code: safeDimension(error?.code || error?.name || code, code, 80),
+    error_message: safeDimension(error?.message || message, message, 240)
+  };
+}
+
 function normalizeSwitch(value) {
   return String(value || '').trim().toLowerCase();
 }
@@ -224,8 +233,21 @@ function ensurePrivateDir(dir) {
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   try {
     fs.chmodSync(dir, 0o700);
+  } catch {}
+}
+
+function writePrivateJson(file, value) {
+  try {
+    ensurePrivateDir(path.dirname(file));
+    const tempPath = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.tmp`);
+    fs.writeFileSync(tempPath, `${JSON.stringify(value)}\n`, { mode: 0o600 });
+    try {
+      fs.chmodSync(tempPath, 0o600);
+    } catch {}
+    fs.renameSync(tempPath, file);
+    return true;
   } catch {
-    // chmod is best-effort on Windows.
+    return false;
   }
 }
 
@@ -273,21 +295,7 @@ function recordLocalTelemetryFailure(errorCode, message, env = process.env) {
 }
 
 function writeRunState(state, env = process.env) {
-  try {
-    const statePath = runStatePath(env);
-    ensurePrivateDir(path.dirname(statePath));
-    const tempPath = path.join(path.dirname(statePath), `.${path.basename(statePath)}.${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, `${JSON.stringify(state)}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, statePath);
-    return true;
-  } catch {
-    return false;
-  }
+  return writePrivateJson(runStatePath(env), state);
 }
 
 function outboxFilename(event) {
@@ -296,36 +304,31 @@ function outboxFilename(event) {
   return `${timestamp}-${eventID}.json`;
 }
 
-export function enqueueMetricEvent(event, env = process.env) {
+function writeOutboxRecord(event, env = process.env) {
   try {
-    if (!event) return false;
+    if (!event) return '';
     const dir = outboxDir(env);
     ensurePrivateDir(dir);
     const filename = outboxFilename(event);
     const finalPath = path.join(dir, filename);
-    const tempPath = path.join(dir, `.${filename}.${process.pid}.tmp`);
-    const record = {
+    if (!writePrivateJson(finalPath, {
       schema_ver: 1,
       created_at: Date.now(),
       event
-    };
-    fs.writeFileSync(tempPath, `${JSON.stringify(record)}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, finalPath);
+    })) return '';
     pruneOutbox(env);
-    return true;
+    return finalPath;
   } catch {
-    return false;
+    return '';
   }
 }
 
+export function enqueueMetricEvent(event, env = process.env) {
+  return Boolean(writeOutboxRecord(event, env));
+}
+
 function safeRunId(value) {
   if (typeof value !== 'string' || !value.trim()) return '';
-  // Run IDs also participate in state keys and param4 matching, so keep them separator-free.
   return /[\u0000-\u001f\u007f,^=]/u.test(value) ? '' : value;
 }
 
@@ -441,6 +444,7 @@ export function stageMetricEvent(stage, context = {}, nowMs = Date.now(), env =
     schema_ver: 2,
     event_id: crypto.randomUUID(),
     skill: 'alipay-aipay',
+    skill_version: skillVersionFromDisk(),
     run_id: runId,
     stage: rule.stage,
     timestamp: nowMs,
@@ -745,15 +749,20 @@ function modelFromEnv(env = process.env) {
 
 function skillVersionFromDisk() {
   try {
-    const raw = fs.readFileSync(path.join(skillRoot(), 'VERSION'), 'utf8').trim();
-    const match = raw.match(/^v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/);
-    if (match) return `v${match[1]}`;
-  } catch {
-    // fall through
-  }
+    return normalizeSkillVersion(fs.readFileSync(path.join(skillRoot(), 'VERSION'), 'utf8')) || 'unknown';
+  } catch {}
   return 'unknown';
 }
 
+function normalizeSkillVersion(value) {
+  const match = String(value || '').trim().match(/^v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/);
+  return match ? `v${match[1]}` : '';
+}
+
+function skillVersionFromEvent(event) {
+  return normalizeSkillVersion(event?.skill_version) || skillVersionFromDisk();
+}
+
 function isLocalSkillCheckout() {
   try {
     return fs.existsSync(path.join(skillRoot(), '../.git'));
@@ -792,15 +801,11 @@ function machineCodeRaw(env = process.env) {
       const match = output.match(/MachineGuid\s+REG_SZ\s+([^\s\r\n]+)/);
       if (match?.[1]) return match[1];
     }
-  } catch {
-    // fall through
-  }
+  } catch {}
   try {
     const hostname = os.hostname();
     if (hostname) return `hostname:${hostname}`;
-  } catch {
-    // fall through
-  }
+  } catch {}
   return '';
 }
 
@@ -811,7 +816,7 @@ function machineUserID(env = process.env) {
   return `machine_${hash}`;
 }
 
-function monitorEnv(env = process.env) {
+function monitorEnv(env = process.env, skillVersion = skillVersionFromDisk()) {
   switch (normalizeSwitch(env.AIPAY_BUILD_ENV)) {
     case 'dev':
       return 'DEV';
@@ -822,7 +827,6 @@ function monitorEnv(env = process.env) {
     default:
       break;
   }
-  const skillVersion = skillVersionFromDisk();
   if (/^v?\d+\.\d+\.\d+-/.test(skillVersion)) return 'PRE';
   if (skillVersion !== 'unknown' && !isLocalSkillCheckout()) return 'PROD';
   return 'DEV';
@@ -830,7 +834,7 @@ function monitorEnv(env = process.env) {
 
 export function buildSyncLogReport(event, env = process.env) {
   if (!event) return null;
-  const skillVersion = skillVersionFromDisk();
+  const skillVersion = skillVersionFromEvent(event);
   const item = {
     code: syncLogCode,
     msg: syncLogMsg,
@@ -848,7 +852,7 @@ export function buildSyncLogReport(event, env = process.env) {
   return {
     item,
     options: {
-      Env: monitorEnv(env),
+      Env: monitorEnv(env, skillVersion),
       SprintID: skillVersion,
       UserID: machineUserID(env),
       YuyanID: syncLogYuyanID
@@ -971,8 +975,8 @@ export function sendSyncLogReportDetailed(report, { timeoutMs = uploadTimeoutMs
             status_code: statusCode || undefined,
             error_code: ok ? undefined : statusCode > 0 ? `HTTP_${statusCode}` : 'NO_HTTP_STATUS',
             error_message: ok ? undefined : statusCode > 0
-              ? `sync log endpoint returned ${statusCode}`
-              : 'sync log endpoint returned no HTTP status'
+              ? `http ${statusCode}`
+              : 'no http status'
           });
         });
       });
@@ -980,18 +984,10 @@ export function sendSyncLogReportDetailed(report, { timeoutMs = uploadTimeoutMs
         finish({ ok: false, error_code: 'ETIMEDOUT', error_message: 'request timeout' });
         req.destroy();
       });
-      req.on('error', (error) => finish({
-        ok: false,
-        error_code: safeDimension(error?.code || error?.name || 'REQUEST_ERROR', 'REQUEST_ERROR', 80),
-        error_message: safeDimension(error?.message || 'request error', 'request error', 240)
-      }));
+      req.on('error', (error) => finish(failedResult(error)));
       req.end(body);
     } catch (error) {
-      finish({
-        ok: false,
-        error_code: safeDimension(error?.code || error?.name || 'REQUEST_ERROR', 'REQUEST_ERROR', 80),
-        error_message: safeDimension(error?.message || 'request error', 'request error', 240)
-      });
+      finish(failedResult(error));
     }
   });
 }
@@ -1001,14 +997,25 @@ export async function sendSyncLogReport(report, { timeoutMs = uploadTimeoutMs }
   return result.ok;
 }
 
-function outboxFiles(env = process.env) {
+function outboxFiles(env = process.env, { targetFile = '', limit = 0 } = {}) {
   try {
     const dir = outboxDir(env);
     recoverStaleOutboxClaims(env);
     pruneOutbox(env);
-    return outboxRecordEntries(dir)
+    if (targetFile) {
+      const resolved = path.resolve(String(targetFile));
+      const basename = path.basename(resolved);
+      return path.dirname(resolved) === path.resolve(dir)
+        && basename.endsWith('.json')
+        && !basename.startsWith('.')
+        && fs.existsSync(resolved)
+        ? [resolved]
+        : [];
+    }
+    const files = outboxRecordEntries(dir)
       .sort((left, right) => left.name.localeCompare(right.name))
       .map((entry) => entry.file);
+    return limit > 0 ? files.slice(0, limit) : files;
   } catch {
     return [];
   }
@@ -1022,9 +1029,7 @@ function outboxRecordEntries(dir) {
       let mtimeMs = 0;
       try {
         mtimeMs = fs.statSync(file).mtimeMs;
-      } catch {
-        // The file may have been claimed or removed concurrently.
-      }
+      } catch {}
       return { file, name, mtimeMs };
     })
     .filter((entry) => entry.mtimeMs > 0);
@@ -1038,9 +1043,7 @@ function pruneOutbox(env = process.env, nowMs = Date.now()) {
       if (nowMs - entry.mtimeMs <= outboxMaxAgeMs) continue;
       try {
         fs.unlinkSync(entry.file);
-      } catch {
-        // A concurrent flush may have claimed it first.
-      }
+      } catch {}
     }
     entries = outboxRecordEntries(dir);
     const overflow = entries.length - outboxMaxRecords;
@@ -1051,13 +1054,9 @@ function pruneOutbox(env = process.env, nowMs = Date.now()) {
       .forEach((entry) => {
         try {
           fs.unlinkSync(entry.file);
-        } catch {
-          // Best-effort local retention cap.
-        }
+        } catch {}
       });
-  } catch {
-    // Pruning is best-effort and must not affect the customer flow.
-  }
+  } catch {}
 }
 
 function recoverStaleOutboxClaims(env = process.env, nowMs = Date.now()) {
@@ -1073,13 +1072,9 @@ function recoverStaleOutboxClaims(env = process.env, nowMs = Date.now()) {
       try {
         if (fs.existsSync(originalPath)) fs.unlinkSync(claimedPath);
         else fs.renameSync(claimedPath, originalPath);
-      } catch {
-        // Leave the claim for a later recovery attempt.
-      }
+      } catch {}
     }
-  } catch {
-    // Recovery is best-effort.
-  }
+  } catch {}
 }
 
 function claimOutboxFile(file) {
@@ -1116,26 +1111,7 @@ function readOutboxRecord(file) {
 }
 
 function writeUploadStatus(status, env = process.env) {
-  try {
-    const statusPath = uploadStatusPath(env);
-    ensurePrivateDir(path.dirname(statusPath));
-    const next = {
-      schema_ver: 1,
-      updated_at: Date.now(),
-      ...status
-    };
-    const tempPath = path.join(path.dirname(statusPath), `.${path.basename(statusPath)}.${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, `${JSON.stringify(next)}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, statusPath);
-    return true;
-  } catch {
-    return false;
-  }
+  return writePrivateJson(uploadStatusPath(env), { schema_ver: 1, updated_at: Date.now(), ...status });
 }
 
 function readUploadStatus(env = process.env) {
@@ -1161,21 +1137,7 @@ function readPermissionedFlushState(env = process.env, nowMs = Date.now()) {
 }
 
 function writePermissionedFlushState(state, env = process.env) {
-  try {
-    const statePath = permissionedFlushStatePath(env);
-    ensurePrivateDir(path.dirname(statePath));
-    const tempPath = path.join(path.dirname(statePath), `.${path.basename(statePath)}.${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, `${JSON.stringify({ schema_ver: 1, ...state })}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, statePath);
-    return true;
-  } catch {
-    return false;
-  }
+  return writePrivateJson(permissionedFlushStatePath(env), { schema_ver: 1, ...state });
 }
 
 function networkUploadFailure(status) {
@@ -1227,12 +1189,13 @@ export function permissionedFlushDecision(env = process.env, nowMs = Date.now(),
 
 export async function flushOutbox(env = process.env, {
   limit = outboxFlushLimit,
+  targetFile = '',
   timeoutMs = uploadTimeoutMs,
   sender = sendSyncLogReportDetailed
 } = {}) {
   const result = { attempted: 0, sent: 0, retained: 0, invalid: 0 };
   if (!telemetryUploadEnabled(env)) return result;
-  const files = outboxFiles(env).slice(0, Math.max(0, limit));
+  const files = outboxFiles(env, { targetFile, limit });
   for (const file of files) {
     const claimedFile = claimOutboxFile(file);
     if (!claimedFile) continue;
@@ -1241,9 +1204,7 @@ export async function flushOutbox(env = process.env, {
       result.invalid += 1;
       try {
         fs.unlinkSync(claimedFile);
-      } catch {
-        // best-effort cleanup.
-      }
+      } catch {}
       continue;
     }
     const report = record.report?.item && record.report?.options ? record.report : buildSyncLogReport(record.event, env);
@@ -1251,9 +1212,7 @@ export async function flushOutbox(env = process.env, {
       result.invalid += 1;
       try {
         fs.unlinkSync(claimedFile);
-      } catch {
-        // best-effort cleanup.
-      }
+      } catch {}
       continue;
     }
     result.attempted += 1;
@@ -1262,18 +1221,13 @@ export async function flushOutbox(env = process.env, {
       const rawSendResult = await sender(report, { timeoutMs });
       sendResult = typeof rawSendResult === 'boolean' ? { ok: rawSendResult } : rawSendResult;
     } catch (error) {
-      sendResult = {
-        ok: false,
-        error_code: safeDimension(error?.code || error?.name || 'SENDER_THROW', 'SENDER_THROW', 80),
-        error_message: safeDimension(error?.message || 'sender threw', 'sender threw', 240)
-      };
+      sendResult = failedResult(error, 'SENDER_THROW', 'sender threw');
     }
     if (sendResult?.ok) {
       result.sent += 1;
       try {
         fs.unlinkSync(claimedFile);
       } catch {
-        // If delete fails, keep the record for a later retry.
         result.retained += 1;
         releaseOutboxClaim(claimedFile);
       }
@@ -1318,7 +1272,7 @@ function spawnOutboxFlush(env = process.env) {
       writeUploadStatus({
         status: 'spawn_failed',
         error_code: safeDimension(error?.code || error?.name || 'UPLOAD_SPAWN_FAILED', 'UPLOAD_SPAWN_FAILED', 80),
-        error_message: safeDimension(error?.message || 'failed to start background telemetry uploader', 'failed to start background telemetry uploader', 240)
+        error_message: safeDimension(error?.message || 'upload spawn failed', 'upload spawn failed', 240)
       }, env);
     });
     child.unref();
@@ -1327,7 +1281,32 @@ function spawnOutboxFlush(env = process.env) {
     writeUploadStatus({
       status: 'spawn_failed',
       error_code: 'UPLOAD_SPAWN_FAILED',
-      error_message: 'failed to start background telemetry uploader'
+      error_message: 'upload spawn failed'
+    }, env);
+    return false;
+  }
+}
+
+function foregroundFlushTerminalOutboxFile(file, env = process.env) {
+  if (!telemetryUploadEnabled(env) || !file) return false;
+  const parsed = parseNonNegativeInteger(env.ALIPAY_AIPAY_TELEMETRY_TERMINAL_FLUSH_TIMEOUT_MS);
+  const timeoutMs = parsed && parsed > 0 ? Math.min(parsed, 30000) : terminalForegroundUploadTimeoutMs;
+  try {
+    execFileSync(process.execPath, [scriptPath(), 'flush-outbox-worker'], {
+      stdio: 'ignore',
+      timeout: timeoutMs + 800,
+      env: {
+        ...env,
+        ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: String(timeoutMs),
+        ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE: file
+      }
+    });
+    return true;
+  } catch (error) {
+    writeUploadStatus({
+      status: 'failed',
+      error_code: safeDimension(error?.code || error?.signal || error?.name || 'TERMINAL_FLUSH_FAILED', 'TERMINAL_FLUSH_FAILED', 80),
+      error_message: 'terminal flush failed'
     }, env);
     return false;
   }
@@ -1335,10 +1314,15 @@ function spawnOutboxFlush(env = process.env) {
 
 function scheduleSyncLogUpload(event, env = process.env) {
   if (!telemetryUploadEnabled(env)) return false;
-  if (!enqueueMetricEvent(event, env)) {
-    recordLocalTelemetryFailure('LOCAL_OUTBOX_WRITE_FAILED', 'failed to write local telemetry outbox', env);
+  const queuedFile = writeOutboxRecord(event, env);
+  if (!queuedFile) {
+    recordLocalTelemetryFailure('LOCAL_OUTBOX_WRITE_FAILED', 'outbox write failed', env);
     return false;
   }
+  if (event?.stage === 'run.terminal') {
+    foregroundFlushTerminalOutboxFile(queuedFile, env);
+    return true;
+  }
   return spawnOutboxFlush(env);
 }
 
@@ -1347,7 +1331,6 @@ function emitTelemetryError(error) {
     const message = safeDimension(error instanceof Error ? error.message : String(error), 'unknown', 240);
     process.stderr.write(`${internalPrefix}TELEMETRY_ERROR=${message}\n`);
   } catch {
-    // Telemetry must stay nonblocking.
   }
 }
 
@@ -1386,6 +1369,15 @@ export async function runTelemetryCli(argv = process.argv) {
       process.stderr.write(`${internalPrefix}TELEMETRY_UPLOAD_STATUS=${JSON.stringify(status)}\n`);
       return 0;
     }
+    if (command === 'permissioned-flush-status' && args._.length === 0) {
+      assertCliArgs(args, new Set(), 0);
+      const decision = permissionedFlushDecision(process.env, Date.now(), { markRequested: false });
+      process.stderr.write(`${internalPrefix}PERMISSIONED_FLUSH_STATUS=${JSON.stringify(decision)}\n`);
+      if (decision.needed) {
+        process.stderr.write(`${internalPrefix}PERMISSIONED_FLUSH_CANDIDATE=true\n`);
+      }
+      return 0;
+    }
     if (command === 'permissioned-flush-needed' && args._.length === 0) {
       assertCliArgs(args, new Set(), 0);
       const decision = permissionedFlushDecision(process.env, Date.now(), { markRequested: true });
@@ -1405,7 +1397,10 @@ export async function runTelemetryCli(argv = process.argv) {
       assertCliArgs(args, new Set(), 0);
       if (!telemetryEnabled(process.env)) return 0;
       const timeout = Number(process.env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || uploadTimeoutMs);
-      await flushOutbox(process.env, { timeoutMs: Number.isFinite(timeout) ? timeout : uploadTimeoutMs });
+      await flushOutbox(process.env, {
+        targetFile: process.env.ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE || '',
+        timeoutMs: Number.isFinite(timeout) ? timeout : uploadTimeoutMs
+      });
       return 0;
     }
     if (!telemetryEnabled(process.env)) return 0;

package/skill/references/normal/telemetry.md

@@ -1,5 +1,4 @@
-- stage/Yuyan 低敏维度以 `scripts/telemetry.mjs` 与测试白名单为准；只含阶段、产品、根意图、时间戳、版本、宿主/模型、匿名机器哈希、run_id、终态计数。禁密钥、账号密码、订单/交易号、截图/凭证、用户输入、路径/URL、响应、命令输出/堆栈原文。遥测失败不影响业务；内部行 `ALIPAY_AIPAY_INTERNAL:`。
-- `start-run` 创建/复用 `run_id`；脚本继承 `PLATFORM_ID=<run_id>`，Agent 不手写环境前缀或 MCP payload。outbox 在系统临时目录，collector 2xx 后才删；维护/测试/Benchmark 禁上传。
-- run 复用：`root_intent + product_type` 判定复用/新建；`UNKNOWN` 补全产品仍复用同一 `run_id`。仅换产品、换根意图或已有终态才重建；“重新开始/重新走流程/作废本轮流程”但组合未变仍复用。`COZE_PROJECT_ID`、`MEOO_PROJECT_ID`、`VITE_APP_ID`/`PLATFORM_ID` 优先作新 run ID。`current-run-id` 只查看，不新建 run。
-- 计数：`user_input_count_total` 从触发当前 `run_id` 的用户消息起；`user_input_count_after_flow_start` 从方案送达并进入正式执行后的下一条用户消息起（`integration_only/full_process=integration.user_confirmed`，`onboarding_only=onboarding.user_confirmed`）。产品/MCC 澄清或选择、项目/语言/框架补齐、项目候选和方案本身只计 total；`full_process` 不因 Onboarding 重置。`flow_start_observed` 表示正式 flow start；用户 kill 未终态不补报。终态只加三项计数参数，不新增业务确认点、stage 或独立上报。`c4=ext_info`，计数合法且有 `root_intent` 才写 JSON，否则省略。
-- 补传：`telemetry upload-status` 只读。最近失败为网络错误（含 `ENOTFOUND|EAI_AGAIN|ETIMEDOUT`）且 outbox 积压时，执行 `telemetry permissioned-flush-needed`；仅 `PERMISSIONED_FLUSH_NEEDED=true` 时可申请最小权限执行 `telemetry flush-outbox`：HTTPS POST `https://collect.alipay.com/yuyan/`（`collect.alipay.com:443`，路径 `/yuyan/`）。说明：`是否允许 Agent 上报 Skill 使用过程的统计信息？只含产品类别、时间、Skill 版本、匿名设备标识、人机交互次数等用于帮助改善用户体验的非敏感信息，不会采集包含源代码、用户输入内容等任何敏感信息。` 同一 Agent 会话只请求一次，状态键抑制 12h。`flush-outbox` 后台补传；拒绝、失败或非 2xx 保留 outbox。collector 结果非业务条件。无 `inspect-outbox`、`--confirm-reviewed`、`alipay-cli whoami` 兜底。
+- 字段/测试白名单：stage/flow、产品、根意图、时间戳、Skill 版本、宿主/模型、匿名机器哈希、`run_id`、终态计数；禁密钥、账号密码、订单/交易号、截图/凭证、用户输入、路径/URL、响应、命令输出、堆栈原文。失败不影响业务；内部行 `ALIPAY_AIPAY_INTERNAL:`。
+- run：`start-run` 创建/复用 `run_id`，脚本继承 `PLATFORM_ID=<run_id>`；`root_intent + product_type` 判定复用/新建，`UNKNOWN` 补全产品仍复用同一 `run_id`；换产品/根意图/已终态/重新开始/重新走流程/作废本轮流程才新建。第三方 ID（`COZE_PROJECT_ID`、`MEOO_PROJECT_ID`、`VITE_APP_ID`/`PLATFORM_ID`）优先；`current-run-id` 只查看，不新建 run。outbox 落盘，collector 2xx 才删；维护/测试/Benchmark 禁上传。
+- 计数：`user_input_count_total` 自触发当前 run 的用户消息起；`user_input_count_after_flow_start` 自方案送达并进入正式执行后的下一条用户消息起。产品/MCC 澄清或选择、项目/语言/框架补齐、项目候选和方案本身只计 total；`full_process` 不因 Onboarding 重置。`flow_start_observed` 表示正式 flow start；用户 kill 未终态不补报。终态只追加计数，不新增确认点、stage 或独立上报。`run.terminal` 入队后以短超时前台 drain，仅当前 terminal 文件，避免流程最后的 detached worker 被宿主回收，不申请额外权限；失败仍保留 outbox。`c4=ext_info`，计数合法且有 `root_intent` 才写 JSON。
+- 补传：不为权限探测新增网络事件；实际低敏上传就是自然探测，宿主已允许访问 collector 时不额外申请权限。`upload-status`/`permissioned-flush-status` 只读；后者输出 `PERMISSIONED_FLUSH_CANDIDATE=true`（最近 `ENOTFOUND|EAI_AGAIN|ETIMEDOUT`、outbox 积压、12h 未请求）后执行 `permissioned-flush-needed` 预占窗口。唯一 `PERMISSIONED_FLUSH_NEEDED=true` 时才申请 `telemetry flush-outbox`；`flush-outbox` 后台补传：POST `https://collect.alipay.com/yuyan/`（`collect.alipay.com:443`，路径 `/yuyan/`）。说明：`是否允许 Agent 上报 Skill 使用过程的统计信息？只含产品类别、时间、Skill 版本、匿名设备标识、人机交互次数等用于帮助改善用户体验的非敏感信息，不会采集包含源代码、用户输入内容等任何敏感信息。` 同一 Agent 会话只请求一次；拒绝/失败/非 2xx 保留 outbox；collector 结果非业务条件；无 `inspect-outbox`、`--confirm-reviewed`、`alipay-cli whoami` 兜底。

package/skill/references/runtime-entry.md

@@ -48,7 +48,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" render <messageId> --va
 
 `full_process` 识别根意图后立即执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" telemetry start-run --root-intent full_process`；产品已唯一确定时追加 `--product-type <aipay|webpay|apppay>`。`integration_only` 和 `onboarding_only` 已由上表各自 bootstrap 包含同一次 `start-run`，不得重复执行本条 telemetry。命令创建/复用当前流程 `run_id`，并在遥测开启时记录 `run.intent_detected`：同一意图和产品继续复用，`UNKNOWN` 补全产品仍复用同一 `run_id`；明确换产品、换根意图或既有 run 已终态才重建。第三方平台项目 ID 仍优先固定为 `run_id`，不得被显式 run ID 或本地生成值覆盖。业务 stage 只由登记 runner/script 异步记录。
 
-遥测默认开启，`ALIPAY_AIPAY_TELEMETRY=0|false|off|no` 可关闭 `METRIC_EVENT`、outbox、上传和 flush；私有流程 run context 仍用于 `PLATFORM_ID` 和终态生命周期。落盘/网络/上传/flush 失败静默，不改变业务、消息或确认，stdout 为空且 stderr 内部行不对客。`integration_only` 由 checklist 终结；Onboarding 由 closeout 或登记的提前终止消息终结。Agent 按 `normal/telemetry.md` 维护本轮用户输入计数，并只在终态命令追加可选参数，不新增业务确认点或独立上报。after-flow 以方案后 `*.user_confirmed` 为起点；前置澄清和候选选择不计入。脚本始终以当前流程 `run_id` 为 `PLATFORM_ID`，Agent 不手写环境前缀或改 MCP payload；维护诊断、outbox、上传和 flush 细节只在 `normal/telemetry.md` 按需读取。
+遥测默认开启，`ALIPAY_AIPAY_TELEMETRY=0|false|off|no` 可关闭 `METRIC_EVENT`、outbox、上传和 flush；私有 run context 仍供 `PLATFORM_ID` 与终态生命周期使用。落盘/网络/上传/flush 失败静默，不改变业务、消息或确认，stdout 为空且 stderr 内部行不对客。`integration_only` 由 checklist 终结；Onboarding 由 closeout 或登记的提前终止消息终结。上报权限不新增专门网络探针，首次 `start-run` 及后续 stage 的实际低敏上传就是自然探测；宿主已允许访问 collector 时不额外申请权限，仅 `normal/telemetry.md` 的只读状态命令确认网络失败和 outbox 积压后，才允许一次补传权限申请。Agent 按 `normal/telemetry.md` 维护本轮用户输入计数，只在终态命令追加参数，不新增业务确认点或独立上报；入队后当前 `run.terminal` 文件做短超时前台 drain，失败仍保留 outbox 且不影响业务收口。after-flow 以方案后 `*.user_confirmed` 为起点；前置澄清和候选选择不计入。脚本始终以当前 `run_id` 为 `PLATFORM_ID`，Agent 不手写环境前缀或改 MCP payload；维护诊断、outbox、上传和 flush 细节只在 `normal/telemetry.md` 按需读取。
 
 三种入口均只在无法从已有产品名称或业务描述可靠确定唯一产品时执行 flow 登记的 `product-clarify` runner；不得推定或手写澄清。产品明确但 MCC 尚无检索输入时使用 `mcc-clarify`；已有经营描述后先按 Onboarding flow 读取一次当前 `<SKILL_DIR>/references/onboarding/modules/mcc-reference.md` 做 Agent 语义候选，再统一调用 `mcc-resolve-plan` 由 runner 复核、合并和渲染；用户直接提供当前表内完整 MCC 编码时可跳过 Agent 泛化并由 runner 精确校验。不得拆回 `mcc-search + mcc-candidates`、先旧检索失败后临时猜测，或为方案展示再拼 renderer 输入。