@itpay/cli 2.1.33 → 2.1.34

package/dist/src/commands/checkout_handoff.js

@@ -61,7 +61,7 @@ export function buildCheckoutHandoff(input) {
         handoff,
         instruction: input.plan?.localSimulation
             ? `本地实验：铁路与地图查询真实，授权、通知和交易模拟，不会扣款。在本机打开 handoff.url 模拟付款入口，金额 ${input.amount}；仅本机桌面可达。${workBuddyAction ? "按 handoff.agent_action 原样打开一次。" : "展示原入口。"}等待用户操作后读取同一 Checkout；不创建替代订单，用户声明不证明模拟付款已确认。`
-            : checkoutHandoffInstruction(input.agentType, input.platform, input.amount, Boolean(mobileUrl)),
+            : `先展示官方入口，再做非必要记忆或日志；保留必需安全检查和宿主权限。${checkoutHandoffInstruction(input.agentType, input.platform, input.amount, Boolean(mobileUrl))}`,
     };
 }
 function checkoutHandoffInstruction(agentType, platform, amount, hasMobileLink) {

package/dist/src/commands/install.js

@@ -12,6 +12,7 @@ export const INSTALL_AGENT_TYPES = [
     "kimi-code",
     "openclaw",
 ];
+export const CODEX_WAIT_GUIDANCE = "Codex 宿主等待：保留完整工具返回，按实际返回的会话句柄及当前宿主续读工具收取最终输出，不要只取 stdout。若使用 functions.exec 包装，可用 text(await tools.exec_command(...))；内层有 session_id 时用 write_stdin，外层返回运行 cell 时才用 wait。没有该包装时按宿主实际工具操作。先收取最终输出，再执行 CLI 业务 next；不要重复提交。";
 const INSTRUCTIONS = {
     "codex-desktop": "在 Codex Desktop 中始终传这个 Agent Type；付款时把返回的二维码和链接实际展示到当前对话。",
     "codex-cli": "在 Codex CLI 中始终传这个 Agent Type；付款交接只应显示在用户可见终端。",
@@ -48,7 +49,7 @@ export function runInstall(target, options = {}) {
             ...installDefinition(normalized),
             default_api: DEFAULT_BASE_URL,
         },
-        instruction: INSTRUCTIONS[normalized],
+        instruction: INSTRUCTIONS[normalized] + (normalized.startsWith("codex-") ? ` ${CODEX_WAIT_GUIDANCE}` : ""),
         next: {
             command: `itpay --agent-type ${normalized} readyz --json`,
             reason: "验证当前官方 ItPay API 的可用性",

package/dist/src/commands/services.js

@@ -1381,6 +1381,29 @@ function railBookingEnvelope(model) {
         recovery: [],
     };
 }
+// Public summaries and saved details use the same evidenced units and scopes.
+function railJourneyFacts(card) {
+    const offer = card.representative_offer;
+    const metrics = card.representative_metrics;
+    const minor = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+    const time = (value) => typeof value === "string" ? Date.parse(/(?:Z|[+-]\d{2}:\d{2})$/.test(value) ? value.replace(" ", "T") : `${value.replace(" ", "T")}+08:00`) : NaN;
+    const start = time(card.rides?.[0]?.departure), end = time(card.rides?.at(-1)?.arrival);
+    return {
+        rail_fare_fen: minor(offer?.fare_minor), service_fee_fen: minor(offer?.service_fee_minor),
+        rail_payable_fen: minor(offer?.rail_payable_minor), currency: offer?.currency ?? null,
+        price_basis: "铁路应付参考额=铁路票价+各票段服务费；不含未知地面费用，以新报价为准。",
+        rail_duration_minutes: Number.isFinite(start) && Number.isFinite(end) && end >= start ? Math.round((end - start) / 60000) : null,
+        door_to_door_minutes: metrics?.duration_basis === "door_to_door" ? minor(metrics.door_to_door_min) : null,
+        ...(metrics?.duration_basis !== "door_to_door" ? { ground_time_note: "接驳未完整核验，不能把铁路时长称为门到门时间。" } : {}),
+        estimated_trip_total: metrics?.estimated_total_cost ?? null,
+        estimate_basis: "仅是已核验费用范围的估算，不是含全部地面费用的实付额。",
+    };
+}
+function publicBookingSupport(card) {
+    if (card.booking_support !== "separate_legs_only")
+        return card.booking_support;
+    return card.qualification_status === "eligible" && card.ticket_plans?.some(plan => plan.qualification_status === "eligible" && plan.booking_input) ? "journey" : "read_only";
+}
 function compactRailJourney(card, serviceExecutionID, snapshotID) {
     if (!card.journey_id)
         throw new Error("saved journey has no stable ID");
@@ -1399,14 +1422,6 @@ function compactRailJourney(card, serviceExecutionID, snapshotID) {
         leg_index: raw.leg_index, seat_type: raw.seat_type, seat_name: raw.seat_name,
         availability: raw.availability_text, remaining: raw.inventory_exact === true ? raw.remaining : null,
     }));
-    const railwayTime = (value) => {
-        if (typeof value !== "string")
-            return NaN;
-        const time = value.replace(" ", "T");
-        return Date.parse(/(?:Z|[+-]\d{2}:\d{2})$/.test(time) ? time : `${time}Z`);
-    };
-    const start = railwayTime(rides[0]?.departure);
-    const end = railwayTime(rides.at(-1)?.arrival);
     return {
         journey_ref: card.journey_id,
         ...(card.profile_refs?.balanced ? { profile_ref: card.profile_refs.balanced } : {}),
@@ -1423,6 +1438,8 @@ function compactRailJourney(card, serviceExecutionID, snapshotID) {
                 required_input: ["file", "真实席别选择及人数"] },
         } : {}),
         ...(ticketSeats.length ? { seats: ticketSeats } : {}),
+        booking_support: publicBookingSupport(card),
+        ...(publicBookingSupport(card) === "read_only" ? { purchase_recovery: { command: `itpay services next ${serviceExecutionID} --json`, reason: "历史快照无整程凭据；读取同一执行合法准备路径，不拆单" } } : {}),
         ticket_plan_refs: (card.ticket_plans ?? []).map(plan => plan.ticket_plan_ref),
         transfer_wait_minutes: card.transfer_wait_minutes ?? [],
         ground_summary: card.ground_summary ?? null,
@@ -1430,13 +1447,11 @@ function compactRailJourney(card, serviceExecutionID, snapshotID) {
         availability: card.availability ?? "unknown",
         qualification_status: card.qualification_status ?? "unknown",
         ...(card.qualification_reasons?.length ? { qualification_reasons: card.qualification_reasons } : {}),
-        ...(offer ? { rail_payable_fen: offer.rail_payable_minor, currency: offer.currency } : { rail_payable_fen: null }),
-        estimated_trip_total: metrics?.estimated_total_cost ?? null,
+        ...railJourneyFacts(card),
         cost_basis: metrics?.cost_basis ?? "unknown",
         duration_basis: metrics?.duration_basis ?? "unknown",
         timezone: "Asia/Shanghai",
         ...(card.risk_notes?.length ? { risk_notes: card.risk_notes } : {}),
-        rail_duration_minutes: Number.isFinite(start) && Number.isFinite(end) && end >= start ? Math.round((end - start) / 60000) : null,
         ...(card.observed_at ? { observed_at: card.observed_at } : {}),
         detail: { command: `itpay services read-result ${serviceExecutionID} --snapshot ${snapshotID} --journey ${card.journey_id} --json`,
             reason: card.qualification_status === "eligible" ? "读取此完整线路的席别、报价和购买条件" : "读取此线路的铁路事实和不可购买原因" },
@@ -1449,7 +1464,8 @@ function compactRailTicketPlan(raw, journeyEligible) {
     return {
         ticket_plan_ref: raw.ticket_plan_ref,
         passengers: raw.passenger_count ?? (Array.isArray(raw.ticket_offers) ? raw.ticket_offers[0]?.passengers : null) ?? null,
-        purchase_support: raw.purchase_support ?? "none",
+        purchase_support: raw.purchase_support === "separate_legs_only" ? "read_only" : raw.purchase_support ?? "none",
+        ...(legs.length > 1 && !raw.booking_input ? { booking_unavailable: "这份快照只有历史铁路事实，没有完整整程购买凭据；不能拆腿或拼接其他快照凭据。读取同一执行当前状态，按其购买准备或过期恢复动作继续。" } : {}),
         qualification_status: raw.qualification_status ?? "unknown",
         qualification_reasons: raw.qualification_reasons ?? [],
         rail_amount_fen: raw.rail_amount_fen ?? null,
@@ -1498,21 +1514,23 @@ function railJourneySummary(card, serviceExecutionID, snapshotID) {
         route: (card.route_names?.length ? card.route_names : card.route ?? []).join("→"),
         ...(trains.length ? { trains } : {}),
         ...(first?.departure || last?.arrival ? { time: `${first?.departure ?? ""}–${last?.arrival ?? ""}` } : {}),
-        ...(offer ? { price: formatMoney(offer.rail_payable_minor, offer.currency) } : { price: "unknown" }),
+        ...(offer && typeof offer.rail_payable_minor === "number" ? { price: formatMoney(offer.rail_payable_minor, offer.currency) } : { price: "unknown" }),
+        ...railJourneyFacts(card),
         ...(metrics ? { calculation_scope: {
                 origin: metrics.origin_scope ?? "legacy_unknown", destination: metrics.destination_scope ?? "legacy_unknown",
                 duration_basis: metrics.duration_basis ?? "legacy_unknown", arrival_basis: metrics.arrival_basis ?? "legacy_unknown",
                 cost_basis: metrics.cost_basis ?? "legacy_unknown",
-                duration_minutes: metrics.door_to_door_min ?? null,
+                duration_minutes: metrics.duration_basis === "door_to_door" ? metrics.door_to_door_min ?? null : railJourneyFacts(card).rail_duration_minutes,
             } } : {}),
         ...(card.decision_role ? { decision_role: card.decision_role } : {}),
         ...(card.explanation?.length ? { explanation: card.explanation } : {}),
         ...(card.reason_codes?.length ? { reason_codes: card.reason_codes } : {}),
         ...(card.tradeoff_codes?.length ? { tradeoff_codes: card.tradeoff_codes } : {}),
         ...(card.recommended_profile ? { recommended_profile: card.recommended_profile,
-            price_basis: "price为默认购票方案参考价；推荐对应的席别、接驳及总价以recommended_profile为准，按其中ticket_plan_ref/offer_refs查看并确认后下单。" } : {}),
+            recommended_price_basis: "推荐席别及已核验接驳估算以recommended_profile为准；按其ticket_plan_ref/offer_refs读取完整方案，新报价确认后下单。" } : {}),
         availability: card.availability,
-        booking_support: card.booking_support,
+        booking_support: publicBookingSupport(card),
+        ...(publicBookingSupport(card) === "read_only" ? { purchase_recovery: { command: `itpay services next ${serviceExecutionID} --json`, reason: "历史快照无整程凭据；读取同一执行当前合法购买准备路径，不拆单" } } : {}),
         ...(card.observed_at ? { observed_at: card.observed_at } : {}),
         ...(card.risk_notes?.length ? { risk_notes: card.risk_notes } : {}),
         ...(card.booking_support === "single_leg"
@@ -1585,7 +1603,7 @@ function railPlanningEnvelope(model) {
         ...(plan.notices?.length ? { notices: plan.notices } : {}),
         ...(plan.recommendation ? { recommendation: railJourneySummary(plan.recommendation, se, plan.catalog_snapshot_id ?? plan.snapshot_id) } : {}),
         ...(cards.length ? { journeys: cards } : {}),
-        ...(plan.snapshot_id ? { full_result: { command: `itpay services read-result ${se} --snapshot ${plan.snapshot_id} --json`, meaning: "读取已保存的完整目录；推荐和journeys仅是摘要" } } : {}),
+        ...((plan.catalog_snapshot_id ?? plan.snapshot_id) ? { full_result: { command: `itpay services read-result ${se} --snapshot ${plan.catalog_snapshot_id ?? plan.snapshot_id} --json`, meaning: "读取已保存的完整目录；推荐和journeys仅是摘要" } } : {}),
         ...(!hasEligible && ["paused", "complete", "expired"].includes(expansion) && plan.query_input && plan.catalog_snapshot_id ? { new_query_template: {
                 command: "itpay services run itpay-rail-smart --input-json <file> --json",
                 executable: false,
@@ -1603,7 +1621,7 @@ function railPlanningEnvelope(model) {
             if (plan.search?.reason === "ground_evidence_required") {
                 return {
                     status: "awaiting_input", result,
-                    instruction: "已查到铁路班次，但具体地址的接驳或出站证据不足，无法验证到达时限；剩余站对未继续查询，不能说没有车。向用户说明已查范围，并请其补充准确起终点地址或可验证的接驳/出站信息；取得新事实后再按其要求重新规划，不要默认扩大铁路搜索。",
+                    instruction: `已查到铁路班次，但具体地址的接驳或出站证据不足，${plan.query_input?.arrive_before || plan.query_input?.arrive_by ? "无法验证用户要求的到达时限" : "尚不能核验相应地点条件或门到门时间"}；剩余站对未继续查询，不能说没有车。说明已查范围和缺失事实，请补充准确起终点地址或可验证的接驳/出站信息；补齐后按原要求规划，不默认扩大搜索。`,
                     next: null, recovery: [],
                 };
             }
@@ -2566,8 +2584,19 @@ export async function runServicesRun(backend, config, serviceID, input, options
                     : reason === "stored_selection_inconsistent" ? "服务端凭据与已存目录不一致，补参数无法修复。停止购买并提供诊断标识 stored_selection_inconsistent；不猜字段、不重新创建购买。"
                         : "购买凭据未通过校验，原因尚未确定且没有安全自动恢复。停止，不把推测报成原因或追加隐藏字段。", inputInvalid ? [{ command: "itpay services list --json", reason: "定位原查询并读取当前完整购买模板" }, { command: "itpay docs show rail-booking --json", reason: "读取正式输入约束" }] : [], undefined, { service_id: serviceID, ...(id ? { service_execution_id: id } : {}), ...(reason ? { reason } : {}), execution_created: Boolean(id) });
         }
-        if (cause instanceof HttpError && ["rail_journey_selection_required", "rail_selection_expired"].includes(cause.code ?? "")) {
-            throw new CommandContractError(cause.code, cause.message, "整程必须使用原查询当前完整 ticket plan 的 selections 模板；手填 legs 只兼容单腿。选择过期时说明缺少当前有效凭据，按用户决定取得完整方案，不拆单、不拼腿、不擅自换站或日期。", [{ command: "itpay services list --json", reason: "找回原查询并读取其完整方案模板" }, { command: "itpay docs show rail-booking --json", reason: "读取正式整程输入合同" }], undefined, { service_id: serviceID, ...(id ? { service_execution_id: id } : {}) });
+        if (cause instanceof HttpError && cause.code === "rail_selection_expired") {
+            const expiry = cause.payload?.selection_expiry;
+            const bookingID = expiry?.booking_execution_id ?? id;
+            const refreshInput = !bookingID && expiry?.safe_new_query && ["itpay-rail-smart", "itpay-rail-exact"].includes(expiry.query_service_id) ? expiry.query_input : undefined;
+            const refresh = refreshInput !== undefined;
+            throw new CommandContractError(cause.code, cause.message, refresh ? "刚才余票信息已过时，按原条件刷新一次真实库存（可能消耗查询额度）；不需要重复批准同条件查票。有价格、库存或条款变化再确认；不复用旧库存、不换站或日期。"
+                : bookingID ? "保留原购买执行，先读取订单与付款事实；不要重新查票、创建替代购买或重复付款。"
+                    : "旧选择凭据已过期，历史详情不能续期；缺少完整原查询条件或安全购买状态证据，停止自动刷新。", bookingID ? [{ command: `itpay services next ${bookingID} --json`, reason: "核对原购买执行和付款状态" }] : [], refreshInput && expiry ? { schema_version: "itpay.interaction.v1", stage: "input_required", input_template: {
+                    command: `itpay services run ${expiry.query_service_id} --input-json <file> --json`, input: refreshInput, required_input: ["file"], executable: false,
+                } } : undefined, { service_id: serviceID, ...(bookingID ? { service_execution_id: bookingID } : {}), ...(expiry ? { selection_expiry: expiry } : {}) });
+        }
+        if (cause instanceof HttpError && cause.code === "rail_journey_selection_required") {
+            throw new CommandContractError(cause.code, cause.message, "整程必须使用原查询当前完整 ticket plan 的 selections 模板；手填 legs 只兼容单腿。缺少整程模板时读取原方案；不拆单、不拼腿、不擅自换站或日期。", [{ command: "itpay services list --json", reason: "找回原查询并读取其完整方案模板" }, { command: "itpay docs show rail-booking --json", reason: "读取正式整程输入合同" }], undefined, { service_id: serviceID, ...(id ? { service_execution_id: id } : {}) });
         }
         if (cause instanceof HttpError && cause.code === "rail_seat_code_invalid" && id) {
             throw new CommandContractError(cause.code, cause.message, "席别必须使用原查询 booking_template.seat_choices 中与名称对应的代码，不能填“二等座”等显示名。用原 selection token 与真实人数修正输入，继续同一booking execution；若只是代码写法修正且车次、席别名称、人数等购买条件未变，沿用用户已给的确认，不再重复询问。", [{ command: `itpay services next ${id} --json`, reason: "读取同一booking当前状态后修正输入" }]);

package/dist/src/commands/skill.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { CODEX_WAIT_GUIDANCE } from "./install.js";
 import { declaredAgentType } from "../state/agent_type.js";
 import { CommandContractError, writeCommandEnvelope } from "./guidance.js";
 const commandDir = dirname(fileURLToPath(import.meta.url));
@@ -19,6 +20,8 @@ export function runSkillShow(name, options = {}) {
     }
     validateSkill(content);
     const agentType = options.agentType ?? declaredAgentType();
+    if (agentType?.startsWith("codex-"))
+        content += `\n## Codex command continuation\n\n${CODEX_WAIT_GUIDANCE}\n`;
     const envelope = {
         status: "shown",
         result: { skill: ITPAY_SKILL, content },

package/dist/src/main.js

@@ -155,7 +155,7 @@ function reportCLIError(error, contract) {
             reason: "检查锁持有者；只回收已退出进程留下的锁，不改变设备身份",
         }] : [];
     const authorizationInstruction = stateError
-        ? "当前运行环境无法写入 owner-only Device 状态；请保持同一 Node、CLI 和 Agent Type，在允许持久写入 ~/.itpay-v3 的执行环境中重试。不要手工创建 lock、删除 identity 或换运行时碰运气。"
+        ? `当前运行环境无法写入 owner-only Device 状态；受阻路径 ${stateError.blockedPath ?? "~/.itpay-v3"}，操作 ${stateError.operation}（${stateError.causeCode}）。保持同一 Node、CLI 和 Agent Type，修复该路径持久写权限后重试原命令；不要手工创建 lock、删除 identity、随意更换 HOME 或换运行时。`
         : lockError
             ? "另一个进程仍在更新本地身份。执行 recovery 检查；若持有者仍活跃，等待后继续原任务，不要删除锁或重建身份。"
             : error instanceof HttpError && error.code === "agent_device_session_required"

package/dist/src/state/config.js

@@ -15,7 +15,7 @@ import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
 export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
-export const CLI_VERSION = "2.1.33";
+export const CLI_VERSION = "2.1.34";
 export const API_CONTRACT_REVISION = "sha256:80d69dbad36debbe4bdfbe468127a934c87b657e7795f369bb04de54863da476";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";

package/dist/src/state/device_authority.js

@@ -308,11 +308,13 @@ export class DeviceAuthorizationError extends Error {
 export class DeviceStateError extends Error {
     operation;
     causeCode;
+    blockedPath;
     code = "device_state_unwritable";
-    constructor(operation, causeCode) {
+    constructor(operation, causeCode, blockedPath) {
         super(`ItPay device state operation failed: ${operation} (${causeCode})`);
         this.operation = operation;
         this.causeCode = causeCode;
+        this.blockedPath = blockedPath;
         this.name = "DeviceStateError";
     }
 }
@@ -462,11 +464,11 @@ function moveLockAside(path, suffix, operation) {
 function asDeviceStateError(error, operation) {
     const code = error.code;
     return code === "EACCES" || code === "EPERM" || code === "EROFS" || code === "ENOTDIR" || code === "EISDIR"
-        ? new DeviceStateError(operation, code)
+        ? new DeviceStateError(operation, code, error.path)
         : undefined;
 }
 function asDeviceStatePathError(error, operation) {
     const code = error.code;
-    return code === "EEXIST" ? new DeviceStateError(operation, code) : asDeviceStateError(error, operation);
+    return code === "EEXIST" ? new DeviceStateError(operation, code, error.path) : asDeviceStateError(error, operation);
 }
 import { stateDir } from "./config.js";

package/docs/agent/buyer/rail-booking.json

@@ -11,7 +11,7 @@
   "goal_and_overview": {
     "route": "Understand endpoints and constraints → 2–4 line route brief → Exact or Smart → read enough saved results for the goal → select under delegation → missing real consent only → official payment entry; show and stop.",
     "query_vs_booking": "Exact/Smart returns a query execution and saved evidence. Booking creates a separate execution from a server-issued selection; it is not a repeated search.",
-    "comparison": "If the human only asked to compare, answer from the results and stop. A clear purchase delegation permits selection under their rules, subject to required human terms."
+    "comparison": "If the human only asked to compare, answer within the searched scope and stop without a buy-or-not question. Reuse already-read unchanged Skill/docs in this context; do not repeat install/readyz/docs at each step. A clear purchase delegation permits selection under their rules, subject to required human terms."
   },
   "flow_at_a_glance": [
     {
@@ -36,7 +36,7 @@
       "step": "read Smart result",
       "command": "itpay services read-result <query_execution_id> --snapshot <snapshot_id> --json",
       "returns": "same-snapshot journeys and detail.command. Single-leg detail returns a selection action: use human only for a real user pick, agent for delegated selection; its result supplies booking credentials. Transfer detail returns the complete ordered selections template for one ticket plan; do not turn it into separate purchases.",
-      "next": "If current eligible options and full connections satisfy the request, answer or continue under delegation. Separate leg purchases have no joint guarantee."
+      "next": "If current eligible options and full connections satisfy the request, answer or continue under delegation. Selecting a journey does not lock inventory; preserve whole-journey purchase. No unsupported ground distance/time estimates."
     },
     {
       "step": "book",
@@ -54,7 +54,7 @@
       "step": "checkout",
       "command": "use the returned next or handoff for the same booking execution",
       "returns": "an official protected payment entry",
-      "next": "do not infer paid or issued from the handoff"
+      "next": "show the official entry using the current host immediately before optional memory/log writing, then stop; retain necessary safety/permissions, do not infer paid or issued"
     },
     {
       "step": "aftercare",
@@ -64,7 +64,7 @@
     }
   ],
   "understand_before_search": [
-    "Preserve full administrative names, original endpoint meaning, date, party size, deadlines and station locks. Ask the human only if a genuine ambiguity changes the destination or constraints.",
+    "Preserve full administrative names, original endpoint meaning, date, party size, deadlines and station locks. Ask only for a missing date or genuine ambiguity changing the destination/constraints; no preference means do not pre-ask station, seat or departure time.",
     "Before the first railway query, leave one 2–4 line conclusion brief in conversation or existing route-brief.txt (choose one, no Backend upload or private reasoning): Origin: full original meaning; station/area/place; evidence from user/context/reliable knowledge/actual lookup; unknown facts. Destination: the same. Journey: date, given party size/deadlines; credible station pair or transfer direction and evidence; Exact/Smart choice and one-sentence reason. Never replace this with “understood”, or write it after querying as pre-query evidence. Reuse it while waiting, reading, quoting or buying; update only changed endpoints/scope/date. With existing results, serve the facts rather than restart for a missing ceremony; missing prior evidence remains unobserved.",
     "Only clear reliable route knowledge can directly support a candidate. A merely possible/probable transfer or “a long trip should transfer” is unknown: first make one targeted lookup on 12306 or 同程, with 携程 only if needed. Stop once a credible direct station pair or transfer direction is established; do not collect complete external timetables, prices or inventory. Remembered trains still require ItPay to verify the actual date and stock.",
     "12306 https://kyfw.12306.cn/ is the official date/station/train reference; claim a date verified only after reading that date result. 同程 https://www.ly.com/mergeTrain/huochepiao helps identify station pairs and transfer directions. 携程 https://trains.ctrip.com/ is an optional supplement for transfer routes. Knowledge, search snippets and historical timetables do not prove current operation, inventory, price or purchase credentials.",
@@ -108,7 +108,7 @@
     },
     "result": "Read the resolved station pair or area scope, observed coverage, complete compact train rows, fare/inventory evidence and stable references. The recommendation card is not the full catalog. Unknown cost and unverified address ground facts remain unknown. Eligible means usable, not equally preferable. Prefer existing default_layer, roles, dominance and tradeoffs; show at most three meaningful representatives. A same-arrival, earlier-departing and more expensive dominated option stays in the saved catalog rather than taking the first screen.",
     "waiting": "Use the same execution and returned bounded wait command. next is a read; background work may still proceed. Do not resubmit, sleep/get/events repeatedly, or reread the whole guide.",
-    "followup": "Read the saved result for the original execution. Smart: itpay services read-result <execution_id> --snapshot <snapshot_id> --json. Exact: use its returned saved-result reader. Read the relevant same-snapshot pages first; unread does not mean nonexistent. Do not automatically enumerate every theoretical combination. For a new Smart query, restore the original area/place/station intent, passengers, deadlines and preferences; an Exact pair is verified evidence, not proof of user station locks. Only a user-locked station change or scope expansion needs new consent. After a changed endpoint or date, supply the original intent and a same-owner reuse_from reference to an unexpired snapshot; unchanged resolved endpoints and matching fresh station-pair facts may be reused. Date change never reuses old inventory. Preference, party-size or deadline changes within the same scope use refine_preferences on the existing plan. Planning deadline does not erase saved facts; an old selection token is not refreshed by rereading. Change to a named station: kind station with matching text/code. Original-station vicinity: kind place with verified station text, remove station_code, resolve normally or use verified POI/coordinates (existing 30 km/5 candidates). Whole city only with explicit consent: kind area with full administrative name, remove POI/location/station_code. Preserve date, passengers, time limits and preferences; refuse cross-owner reuse. The public Smart input does not expose overnight layover. A home or specific address remains the destination; nearby railway stations are candidates, never implicit station locks. Report the rail arrival station separately from any unknown last-mile connection. Preserve the endpoint brief; update only affected facts. A terminal location failure follows its explicit complete new-query template only after new evidence."
+    "followup": "Read the saved result for the original execution. Smart: itpay services read-result <execution_id> --snapshot <snapshot_id> --json. Exact: use its returned saved-result reader. Read the relevant same-snapshot pages first; unread does not mean nonexistent. Do not automatically enumerate every theoretical combination. For a new Smart query, restore the original area/place/station intent, passengers, deadlines and preferences; an Exact pair is verified evidence, not proof of user station locks. Only a user-locked station change or scope expansion needs new consent. After a changed endpoint or date, supply the original intent and a same-owner reuse_from reference to an unexpired snapshot; unchanged resolved endpoints and matching fresh station-pair facts may be reused. Date change never reuses old inventory. Preference, party-size or deadline changes within the same scope use refine_preferences on the existing plan. Planning deadline does not erase saved facts; an old selection token is not refreshed by rereading. For expiry, use only the server safe fresh-query template once within the original authorization, preserving all conditions and omitting reuse_from; it may consume query quota. Existing or unknown purchases resume the same booking/order, never new queries. Refresh does not guarantee inventory or original price; confirm materially changed terms. Change to a named station: kind station with matching text/code. Original-station vicinity: kind place with verified station text, remove station_code, resolve normally or use verified POI/coordinates (existing 30 km/5 candidates). Whole city only with explicit consent: kind area with full administrative name, remove POI/location/station_code. Preserve date, passengers, time limits and preferences; refuse cross-owner reuse. The public Smart input does not expose overnight layover. A home or specific address remains the destination; nearby railway stations are candidates, never implicit station locks. Report the rail arrival station separately from any unknown last-mile connection. Preserve the endpoint brief; update only affected facts. A terminal location failure follows its explicit complete new-query template only after new evidence."
   },
   "select_and_book": {
     "delegation": "Apply existing seat/price/delegation rules. Exact fastest requires enough coverage to compare the station-pair candidates; without ordering/coverage evidence the first page is not proof. Smart can present up to three eligible representatives once full connections meet the goal, or continue under delegation; no routine full-catalog or all-seat paging. If an unapproved seat choice changes the price, combine that decision and missing terms into one question. Do not default to second class or require a three-tier menu. No match does not permit loosening conditions.",

package/docs/agent/buyer/render-hosts.json

@@ -73,7 +73,7 @@
     }
   ],
   "agent_rules": [
-    "Agent Type is stable identity; Host is presentation and may be explicitly overridden.",
+    "Agent Type is stable identity; Host is presentation and may be explicitly overridden. Once the official handoff is available, show it on this host before optional memory/log work; retain necessary safety and permissions.",
     "A local QR path is not visible until a desktop Agent attaches or renders that file on the human-facing surface; WorkBuddy Checkout handoff uses its returned Card Link and mobile URL; auth login may separately return a local QR path.",
     "For workbuddy with plain-chat, execute handoff.agent_action exactly once; it calls present_files with handoff.url as the only files element and opens the rendered Card Link in the right-side browser, then send handoff.mobile_url so phone users can tap straight into Alipay or WeChat Pay.",
     "For zcode with plain-chat, open handoff.url in the built-in browser and also send handoff.mobile_url as the phone entry; do not only paste text, download or rebuild a QR, or invent a private browser-tool payload; when the built-in browser is unavailable show both clickable links.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.33",
+  "version": "2.1.34",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {

package/skills/itpay/SKILL.md

@@ -33,11 +33,26 @@ human the useful result or action, not the internal steps.
 - Selling: `itpay sell guide --json`, then `itpay sell status --json` and the
   packaged seller guide.
 
+Reuse the Skill and business documents already read in this context while their
+version is unchanged; do not repeat docs/install/readyz at every step. Keep initial
+installation and upgrade checks. For a comparison, ask only for a missing date or
+a genuine endpoint ambiguity, not optional station/seat/time preferences. Preserve
+area/place intent and human station locks; answer the comparison without forcing
+a purchase question. Fastest means within the searched scope; choosing a journey
+is not locking stock. Do not invent ground distances or travel times.
+
 If an ambiguous request could mean an earlier purchase or a new query, ask
 which one the human means before spending quota or starting a purchase.
 
 ## Follow one envelope
 
+If the host command is still running with temporarily empty stdout, preserve its
+complete tool return and continue reading the same session until final output and
+exit. Empty output is not a business failure. Do not submit again, background the
+command with `&`, or use process checks instead of collecting its result. Report
+host tool facts if continuation fails; do not guess a map failure. Collect the
+current command before following the CLI business `next`.
+
 Read `result` and status first, then `instruction` and the applicable `next`,
 `interaction`, `handoff` or `recovery`. Commands are executable only when all required
 arguments are present. Fill an `input_template` with unresolved values before
@@ -54,7 +69,11 @@ a template has not been submitted.
 
 Use the current execution or order for waiting and recovery; do not replay the supplier query. A
 saved result remains readable after the planning window, while a new purchase
-may require fresh inventory and quote evidence. Use the documented recovery
+may require fresh inventory and quote evidence. If the server returns a safe
+fresh-query template for an expired selection, query once with unchanged conditions
+within the original request; do not ask permission again or use reuse_from for old
+inventory. Existing or unknown purchases resume only the same execution/order.
+New prices, inventory or terms require necessary confirmation. Use the documented recovery
 for the actual error, preserving identity and existing orders. A terminal location query may start once from its complete new_query_template only after new evidence or necessary scope consent; preserve all unchanged conditions. If neither an applicable next, interaction, recovery nor complete new-query template is returned, stop: do not add undeclared fields, create another booking or report a guessed cause. A dependency
 wait preserves resolved endpoints; follow its recovery time and same-execution
 command. A partial search is not proof that no train exists. Distance alone does not prove a transfer is needed; an observed route through a station does not prove that station is mandatory.
@@ -69,9 +88,12 @@ may select under the human's delegation, but must not record itself as a human.
 ## Show the human
 
 Present the current result in ordinary language and make the returned official
-link or QR genuinely visible using the actual host's handoff. Keep internal
-IDs, tokens, command lines, raw envelopes and diagnostics out of human-facing
-messages. Traveler names, ID numbers, phones, verification codes and payment
+link or QR genuinely visible using the actual host's handoff before optional
+memory/log work; keep necessary safety checks and host permissions. Keep internal
+IDs, command lines, raw envelopes and diagnostics out of routine human-facing
+messages. When the human explicitly requests troubleshooting, provide commands,
+non-secret execution correlation IDs, redacted inputs/outputs and status. Never
+expose credentials, login/payment tokens or identity data. Traveler names, ID numbers, phones, verification codes and payment
 details belong only in the protected official page, never chat or local query
 input. A railway ticket plan uses one booking and one official payment entry for the whole journey, with separate issuance per leg. Raw legs support one-leg compatibility only; a multi-leg journey requires the returned complete selections template. A payment entry is not payment success; payment is not ticket issuance.
 Once the Order confirms payment, tell the human they must not pay again and