@itpay/cli 2.0.36 → 2.0.37

package/dist/src/state/config.js

@@ -12,8 +12,8 @@ import { DeviceAuthority } from "./device_authority.js";
 import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
-export const CLI_VERSION = "2.0.36";
-export const API_CONTRACT_REVISION = "sha256:20986f3d7a770f9c696c0576f3ae4898f0d23a519bd489c1727382a16270fab2";
+export const CLI_VERSION = "2.0.37";
+export const API_CONTRACT_REVISION = "sha256:b97025ee4e6f7539757d6aedbe193dd65b3a0f84f1111f678abb5e757065f888";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";
 const OPERATION_JOURNAL_FILENAME = "operations.json";

package/dist/src/state/device_authority.js

@@ -1,5 +1,5 @@
 import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign, } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 const PROTECTED_PATHS = ["/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault"];
@@ -292,10 +292,12 @@ async function withFileLock(path, run) {
     catch (error) {
         throw asDeviceStatePathError(error, "prepare_lock") ?? error;
     }
+    const ownerToken = randomUUID();
     let acquired = false;
     for (let attempt = 0; attempt < 200; attempt += 1) {
         try {
-            mkdirSync(path, { mode: 0o700 });
+            writeFileSync(path, ownerToken, { encoding: "utf8", flag: "wx", mode: 0o600 });
+            chmodSync(path, 0o600);
             acquired = true;
             break;
         }
@@ -305,7 +307,7 @@ async function withFileLock(path, run) {
                 throw asDeviceStateError(error, "acquire_lock") ?? error;
             try {
                 if (Date.now() - statSync(path).mtimeMs > 30_000)
-                    removeLock(path, "remove_stale_lock");
+                    moveLockAside(path, "stale", "remove_stale_lock");
             }
             catch (statError) {
                 if (statError.code !== "ENOENT") {
@@ -321,19 +323,33 @@ async function withFileLock(path, run) {
         return await run();
     }
     finally {
-        removeLock(path, "release_lock");
+        releaseLock(path, ownerToken);
     }
 }
-function removeLock(path, operation) {
+function releaseLock(path, ownerToken) {
     try {
-        if (statSync(path).isDirectory())
-            rmdirSync(path);
-        else
-            unlinkSync(path);
+        if (readFileSync(path, "utf8") !== ownerToken)
+            return;
+        moveLockAside(path, "released", "release_lock");
     }
     catch (error) {
         if (error.code !== "ENOENT")
-            throw asDeviceStateError(error, operation) ?? error;
+            throw asDeviceStateError(error, "release_lock") ?? error;
+    }
+}
+function moveLockAside(path, suffix, operation) {
+    try {
+        renameSync(path, `${path}.${suffix}`);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return;
+        if (code === "EEXIST" || code === "ENOTEMPTY") {
+            renameSync(path, `${path}.${suffix}.${randomUUID()}`);
+            return;
+        }
+        throw asDeviceStateError(error, operation) ?? error;
     }
 }
 function asDeviceStateError(error, operation) {

package/docs/cli-reference/commands/device.md

@@ -14,6 +14,14 @@ itpay --agent-type <agent_type> device recover --confirm-backend-reset --json
 
 命令只作用于当前官方 Backend 的 Device registration，并保留本地 Ed25519 私钥、Cart 和业务资源。默认是 `https://app.itpay.ai`；显式测试可使用准确的 `ITPAY_BACKEND_URL=https://dev.itpay.ai`。该命令不访问 Backend、不自动创建新身份；返回的只读 `services list` 会保留同一 Backend，是重新登记入口。
 
+同一台电脑上的多个 Local Agent Type 共享本地 Device key，但各自使用独立 Agent
+Instance。CLI 只在原子更新 Device state 时使用短期本地锁；释放和 stale recovery
+通过 rename 完成，不依赖 Host 删除文件，因此 WorkBuddy 等 sandbox 的
+safe-delete/trash shim 不应阻断正常命令。该锁不在 Backend，不会让另一台电脑或
+另一个 Buyer 等待。遇到本地锁错误时不得删除 `~/.itpay-v3/device`、切换 Agent
+Type 或执行 `device recover`；应保留身份并重试原命令一次，持续失败时报告
+`device_state_unwritable` 或 lock timeout。
+
 缺少确认参数返回 `backend_reset_confirmation_required`。普通 session 失效由 CLI 自动续期；revoked、quota、权限或未知 Backend 故障不得使用本命令。所有 Agent Type 使用相同输入和输出合同。
 
 ## 参数

package/docs/cli-reference/commands/feedback/submit.md

@@ -73,6 +73,9 @@ Markdown：
 
 没有用户评论时省略 Summary，但仍保存 Context。只写用户明确内容和已知安全上下文；禁止 Token、Session、联系方式、内部身份、
 Provider 响应、Vault payload、完整命令输出、stack trace 或环境变量。
+CLI 不读取或上传 Host 对话、WorkBuddy/ZCode sandbox 日志或其他本地 Agent
+记录。用户自愿提供本地证据时，Agent 也只能提炼与本单有关的安全摘要，不能把原始
+日志作为 Feedback note 上传。
 
 ## 成功 JSON
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.0.36",
+  "version": "2.0.37",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {