@itpay/cli 2.1.41 → 2.1.45

package/docs/agent/buyer/service-feedback.json

@@ -7,7 +7,7 @@
   "purpose": "Finish the original order outcome first, then persist safe process context and any explicit human rating or comment without exposing commands or internal identifiers.",
   "when_to_use": [
     "The human asks to rate a service, leave feedback, report a blocker, or says how many stars the experience deserves.",
-    "A paid result has actually been delivered and the CLI instruction requires a safe Agent postmortem.",
+    "A paid result has actually been delivered and the CLI instruction offers an optional safe Agent postmortem.",
     "A paid service failed and its order, delivery, and refund path have already been explained or recovered."
   ],
   "intent_routing": {
@@ -27,10 +27,11 @@
   "agent_rules": [
     "A rating is optional. Normalize an explicit 1-5 rating to an integer; sentiment never implies a score. Preserve an explicit human comment without inventing one.",
     "Run every command yourself. Speak to the human only about the service, their rating, whether feedback was recorded, and any original order rights.",
-    "Submit one baseline Agent postmortem after the outcome. Do not pressure the human for a score; an empty repeat is a no-op, while a later explicit rating or comment updates the same feedback.",
+    "Optionally submit one baseline Agent postmortem after presenting the outcome; it never blocks delivery. Do not pressure the human for a score; an empty repeat is a no-op, while a later explicit rating or comment updates the same feedback.",
     "Use only the human's own words plus safe order context. Never upload the conversation, prompt, diagnostics, contact details, tokens, internal identities, provider responses, or purchased payload.",
     "A successful feedback submission does not promise a reply, resolution, refund, or order change.",
-    "If submission outcome is unknown, stop and explain that recording could not be confirmed; never retry automatically."
+    "If submission outcome is unknown, stop and explain that recording could not be confirmed; never retry automatically.",
+    "Feedback follows a real outcome within the user’s authorization; never submit private raw logs, credentials, tokens or traveler identity."
   ],
   "human_language": {
     "success": "Your feedback has been recorded. Thank you.",

package/docs/cli-reference/agent-types.md

@@ -1,6 +1,6 @@
 # Agent Type And Host Contract
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 `--agent-type` 表示哪类运行时在运行 CLI，用于 Agent 实例归属和定制 instruction。`--host` 表示输出展示在哪里；`--target` 只是在某些 Host 中指定 chat/channel/open ID。三者不可混用，窗口、任务和对话也不是身份。
 
@@ -16,6 +16,7 @@
 | `claude-code-cli` | `terminal` | 在用户可见终端输出二维码和官方链接，不声称已在桌面对话展示。 |
 | `workbuddy` | `plain-chat` | 返回完整渲染的 HTML Card Link 和可原样执行的 `present_files` action；立即打开 Card Link，不返回或检查本地图片路径。 |
 | `zcode` | `plain-chat` | 返回完整渲染的官方 URL；立即用 ZCode 内置浏览器打开，不只粘贴文字链接，也不返回或重建二维码图片。 |
+| `doubao-work` | `plain-chat` | 同时返回手机直达收银台链接和官方二维码图片链接；在豆包工作对话中明确标注两者，说明金额后停止等待。 |
 | `kimi-code` | `terminal` | 使用标准 CLI 引导，在用户可见终端渲染二维码和付款链接。 |
 | `openclaw` | 无；必须显式传入 | `--host telegram` 使用 OpenClaw 原生 `message` action；其他入口返回标准 HTTPS 二维码和付款链接。 |
 
@@ -34,6 +35,7 @@
 - OpenClaw 的 IM Host 必须提供 `--target`。缺失时在任何 Checkout 创建前返回 `target_required`。
 - `kimi-code` 是 CLI 型 Agent，复用 `terminal` Host 和现有 CLI 展示，不增加 Kimi 专属交易协议。
 - `zcode` 使用 `plain-chat` Host 和官方 URL-only handoff。Agent 必须自行在 ZCode 内置浏览器打开 URL；只有内置浏览器确实不可用时才向用户展示同一个可点击链接。
+- `doubao-work` 使用 `plain-chat` Host。它虽运行在云电脑中，仍走 Local Device Authority；不得改走 MCP 或创建第二套身份。Checkout 和 Vault 授权必须同时展示 `handoff.url` 与 `handoff.qr_image_url`。
 - session 失效时 CLI 只续期并重试原请求一次；再次失败立即返回。revoked v2 Device 不自动换身份。
 - 同一 Device 首次登记新的 Agent Type 时，CLI 只使用本地已登记且 Backend 仍接受的既有 Agent Instance 完成签名登记；被撤销的 Instance 会被跳过且不会恢复。若没有任何既有 Instance 可用，CLI 必须停止，不得重新登记 Device、旋转私钥或借用其他 Backend。
 
@@ -79,6 +81,7 @@ URL 内 credential 不得被提取、单独输出、记录或重建。
 | `claude-code-cli / terminal` | `url`；非 JSON 输出另外渲染终端二维码 |
 | `workbuddy / plain-chat` | `url, agent_action`（`present_files(files=[url])`，打开完整渲染的 HTML Card Link） |
 | `zcode / plain-chat` | `url`（立即用 ZCode 内置浏览器打开；不返回图片或平台私有 action） |
+| `doubao-work / plain-chat` | `url, qr_image_url`（`url` 是本机直接打开的首选入口；`qr_image_url` 是保存或由另一台设备扫码的备用入口） |
 | `kimi-code / terminal` | `url`；非 JSON 输出另外渲染终端二维码 |
 | `openclaw / telegram` | `url, qr_image_url, agent_action` |
 | `openclaw / other` | `url, qr_image_url` |
@@ -87,6 +90,8 @@ WorkBuddy instruction 必须要求 Agent 原样执行一次 `handoff.agent_actio
 
 ZCode instruction 必须明确要求 Agent 立即用内置浏览器打开 `handoff.url`，确认已发起打开后说明金额并停止。不得只把 URL 当作文字粘贴给用户，也不得下载、解析或重建二维码。只有内置浏览器明确不可用时，才把同一个 `handoff.url` 作为可点击链接展示。CLI 不猜测或输出 ZCode 私有工具调用 JSON。
 
+Doubao Work instruction 必须要求 Agent 在当前对话中展示两个有标签的官方入口：优先展示“手机直接打开收银台”对应的 `handoff.url`，再展示“二维码图片（保存或用另一台设备扫码）”对应的 `handoff.qr_image_url`。说明金额后停止等待；不得解析 URL 中的 credential、下载或重建二维码、调用 `pay`，也不得创建替代 Checkout。
+
 OpenClaw Telegram 的 `handoff.agent_action` 是可原样执行的原生 `message` tool action。`presentation` 只包含标准 `blocks.buttons`：`📱 手机点这儿支付` 使用扁平 `url`，`📋 已授权给我读` 使用扁平 `value=itp:grant_confirmed:<checkout_id>`；二维码单独使用 action 的 `media`。CLI `instruction` 必须要求 Agent 原样执行该 action，不得改写 Presentation、换用其他消息工具或声称普通文本回复等同于已发送按钮。收到授权 callback 后立即执行 `next.command` 查询同一 Checkout，再只跟随后端返回的同一 Execution grant 流程；callback 只携带 Checkout ID，不携带 display token，也不证明付款或 grant 已生效。OpenClaw `target` 使用原生 chat target（如 `5559456744` 或 `-1001234567890:topic:42`），不添加 `telegram:` 前缀。
 
 ### Purchased-content authorization
@@ -94,7 +99,7 @@ OpenClaw Telegram 的 `handoff.agent_action` 是可原样执行的原生 `messag
 `vault access` 使用相同字段集合，但不包含金额、Checkout ID、付款状态或付款
 查询命令。桌面 handoff 的 Markdown 标题和链接必须明确为“授权查看已购
 内容”；Terminal 显示授权二维码；WorkBuddy 用 `present_files` 打开完整
-`handoff.url`；ZCode 用内置浏览器打开完整 `handoff.url`；OpenClaw 使用返回的图片/原生 action。
+`handoff.url`；ZCode 用内置浏览器打开完整 `handoff.url`；Doubao Work 同时展示授权链接和官方二维码图片链接；OpenClaw 使用返回的图片/原生 action。
 
 授权 handoff 展示后 `next=null`。用户明确表示已完成时，Agent只重新执行
 产生授权要求的原始 `vault list`、`orders` 或 `vault read`，不得再次执行

package/docs/cli-reference/commands/aftercare.md

@@ -0,0 +1,15 @@
+# `itpay aftercare`
+
+Railway manual refund/change intake; ordinary service refunds retain `itpay refund`.
+
+```sh
+itpay aftercare list --order <order_id> --json
+itpay aftercare create --order <order_id> --input-json <file> --json
+itpay aftercare get <case_id> --json
+itpay aftercare respond <case_id> --input-json <file> --json
+itpay aftercare cancel <case_id> --input-json <file> --json
+```
+
+`list` returns the complete current JSON templates, original safe journey and available ticket targets. Indices start at zero. Use user-selected targets; do not guess supplier IDs or money. Only real scope consent sets `user_confirmed_scope=true`.
+
+`get` shows original immutable request, history, supplier facts and separate money state. Pending/manual intake does not authorize financial execution. A current change proposal must be explicitly accepted using its returned revision; the original purchase consent is insufficient. Fees are coordinated manually, with no automatic payment link. Cancellation cannot undo supplier or money operations already started. Platform content locks remain; safe remaining-ticket status is a separate authorized read.

package/docs/cli-reference/commands/auth.md

@@ -0,0 +1,96 @@
+# Account login
+
+`itpay auth` binds the enrolled Agent Device to a real ItPay account through an official authorization handoff. It is used by Path A (trial exhausted → log in → keep querying) and any time a command returns `login_required`. Path B purchases do **not** require running `itpay auth login` first — account authentication can happen inside the protected checkout instead.
+
+## Syntax
+
+```bash
+itpay auth login  [--json]
+itpay auth status [--json]
+```
+
+Both commands require an enrolled Agent Device and use the current `--agent-type` and Backend (`ITPAY_BACKEND_URL`). The Agent never receives an account bearer token; binding reuses the stable device-account ownership mechanism.
+
+## `itpay auth login`
+
+Creates one official authorization request bound to this Backend, Device and Agent Instance, then stops. Repeating `auth login` while a valid request is open returns the same request — it does not rotate the QR code or create parallel sessions.
+
+```json
+{
+  "status": "auth_pending",
+  "result": {
+    "dashboard_auth_session_id": "das_...",
+    "expires_at": "2026-09-20T12:34:56Z",
+    "methods": ["phone", "email", "alipay", "wechat"]
+  },
+  "handoff": {
+    "url": "https://dev.itpay.ai/signin?dashboard_auth_session_id=das_...&start_token=...",
+    "qr_local_path": "...",
+    "qr_image_url": "...",
+    "markdown": "..."
+  },
+  "instruction": "把官方授权页或二维码交给用户。用户在页面内选择手机号验证码、邮箱或钱包完成登录；不要替用户输入手机号或验证码。",
+  "next": {
+    "command": "itpay auth status --json",
+    "reason": "用户完成页面登录后确认绑定",
+    "poll_after_ms": 5000
+  },
+  "recovery": []
+}
+```
+
+- `handoff.url` is the official sign-in page carrying this authorization request. The page offers phone-code verification, email verification, and wallet options — the user chooses; the Agent must not deep-link a single wallet and call it universal authorization.
+- The URL's `start_token` is valid only inside the official page handoff. Never log it, echo it in chat, or send it to another host.
+- When the user already finished login before `auth login` runs, the command returns `authenticated` directly.
+
+## `itpay auth status`
+
+Polls the open authorization request, then performs the device binding. Safe to run repeatedly and concurrently: only the requester Device/Instance can complete the binding.
+
+```json
+{
+  "status": "auth_pending",
+  "result": { "dashboard_auth_session_id": "das_...", "expires_at": "..." },
+  "instruction": "用户仍在官方页面完成登录；保留当前 handoff，不要生成新二维码。",
+  "next": { "command": "itpay auth status --json", "poll_after_ms": 5000 },
+  "recovery": []
+}
+```
+
+```json
+{
+  "status": "authenticated",
+  "result": {
+    "buyer_id": "buyer_...",
+    "bound": true,
+    "query_quota": [
+      { "service_id": "itpay-rail-exact", "policy": "free_registered", "remaining": null },
+      { "service_id": "itpay-rail-smart", "policy": "free_registered", "remaining": null }
+    ]
+  },
+  "instruction": "登录与绑定已完成，告知用户可继续之前的查询；已注册账号查询不消耗试用次数，仍受正常限流。",
+  "next": { "command": "itpay services run <service_id> --execution <pending_execution_id> --json", "reason": "恢复被额度暂停的原查询" },
+  "recovery": []
+}
+```
+
+Terminal and error states:
+
+| `status` | Meaning | Agent action |
+| --- | --- | --- |
+| `authenticated` | Device bound to a real account | Resume the original intent (a quota-blocked execution, the user's request) unchanged |
+| `auth_pending` | User has not finished the page | Keep the same handoff; poll with `poll_after_ms` |
+| `auth_expired` | Session expired before completion | Offer to start `itpay auth login` again; prior query input is still preserved server-side |
+| `login_required` | No open request, not bound | Run `itpay auth login` |
+| `auth_cancelled` / `auth_denied` | User declined or closed the page | Respect the refusal; do not silently re-open; the pending query stays resumable |
+| `auth_session_missing` | Saved authorization session no longer exists (404/410) | `auth status` stays read-only; an explicit `auth login` may create one new official session |
+| `auth_status_unknown` | Transport or temporary server failure while reading status | Keep the same saved session and reread later; do not open a second login |
+
+## Rules
+
+- The human's phone number and SMS code are entered only on the official page — never through chat or CLI input. A `buyer_id`, a typed phone string, or a passenger phone is **not** proof of phone verification.
+- Verified email OR verified mainland phone both establish a valid login; the user picks on the page. Phone verification is not a prerequisite for registered free search — a verified email alone is sufficient.
+- Login never grants Vault content, passenger history, or another Agent's authority. Other devices/platforms enroll and authorize separately.
+- After `authenticated`, server-side identity is re-read; an anonymous execution blocked at the quota step resumes with `services run <service> --execution <id> --json` — no new execution, no re-asked itinerary.
+- Refusing or cancelling login deletes nothing: saved results and purchase options remain usable.
+- Seller authoring uses `itpay sell auth` separately.

package/docs/cli-reference/commands/buy.md

@@ -1,6 +1,6 @@
 # `itpay buy`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 
@@ -169,6 +169,7 @@ itpay buy \
 | `claude-code-cli` | `terminal` | `url` | 在用户可见终端展示；不能声称桌面对话已收到图片。 |
 | `workbuddy` | `plain-chat` | `url,agent_action` | 原样执行一次 `present_files(files=[url])`，在右侧打开完整渲染的 HTML Card Link，然后停止。 |
 | `zcode` | `plain-chat` | `url` | 立即用 ZCode 内置浏览器打开 URL；只有浏览器不可用时才展示同一个可点击链接。 |
+| `doubao-work` | `plain-chat` | `url,qr_image_url` | 展示“手机直接打开收银台”和“二维码图片（保存或用另一台设备扫码）”两个有标签的官方入口，说明金额后停止。 |
 | `kimi-code` | `terminal` | `url` | 使用标准 CLI 非 JSON 终端二维码和链接。 |
 | `openclaw` | 必须显式 | Telegram 返回 `url,qr_image_url,agent_action`；其他入口返回 `url,qr_image_url` | Telegram 执行原生 `message` action；其他入口直接展示图片和链接。 |
 

package/docs/cli-reference/commands/cart/add.md

@@ -1,6 +1,10 @@
 # `itpay cart add`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+
+## 服务报价的批准边界
+
+服务支持的 Quote/Cart/Checkout 共用服务端范围校验。缺少有效价格批准时返回完整 `approve_purchase` 模板，默认 `user_approved:false`；Agent 只在真实会话已同意当前主体、内容、价格或预算和条款时提交 true。选择候选或完成席别 review 不代替价格批准。同条件有效批准复用，已有 Checkout/未知付款先恢复原单，不补事后批准或创建替代订单。
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/clear.md

@@ -1,6 +1,6 @@
 # `itpay cart clear`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/index.md

@@ -1,6 +1,6 @@
 # `itpay cart`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 命令范围
 

package/docs/cli-reference/commands/cart/next.md

@@ -1,6 +1,10 @@
 # `itpay cart next`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+
+## 服务报价的批准边界
+
+服务支持的 Quote/Cart/Checkout 共用服务端范围校验。缺少有效价格批准时返回完整 `approve_purchase` 模板，默认 `user_approved:false`；Agent 只在真实会话已同意当前主体、内容、价格或预算和条款时提交 true。选择候选或完成席别 review 不代替价格批准。同条件有效批准复用，已有 Checkout/未知付款先恢复原单，不补事后批准或创建替代订单。
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/remove.md

@@ -1,6 +1,6 @@
 # `itpay cart remove`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/show.md

@@ -1,6 +1,6 @@
 # `itpay cart show`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/catalog/index.md

@@ -1,6 +1,6 @@
 # `itpay catalog`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 命令范围
 

package/docs/cli-reference/commands/catalog/list.md

@@ -1,6 +1,6 @@
 # `itpay catalog list`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 
@@ -40,7 +40,7 @@ itpay catalog list [--json]
 
 ## 异常处理
 
-输出不得包含 snapshot、manifest 原文、compiled graph 或 Provider secret。服务为空时返回 `catalog_empty`，要求稍后重试，不猜服务 ID。
+输出不得包含 snapshot、manifest 原文、Arazzo workflow 或 Provider secret。服务为空时返回 `catalog_empty`，要求稍后重试，不猜服务 ID。
 
 ## Agent Type / Host
 

package/docs/cli-reference/commands/checkout.md

@@ -1,6 +1,6 @@
 # `itpay checkout`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 
@@ -13,7 +13,10 @@
 
 ```bash
 itpay checkout [--id <checkout_id>] [--token <display_token>]
-  [--host <host>] [--target <target>] [--locale <zh-CN|en>] [--json]
+  [--host <host>] [--target <target>] [--locale <zh-CN|en>]
+  [--present <auto|browser|image|link|none>] [--no-open] [--viewer <desktop|mobile|unknown>]
+  [--relay-option <ref>] [--confirm-relay] [--request-key <key>] [--relay-status <relay_id>]
+  [--json]
 ```
 
 省略 `--id/--token` 时只能使用本机保存的一组完整句柄；不得把其他 Checkout 的 token 拼接使用。
@@ -22,6 +25,12 @@ itpay checkout [--id <checkout_id>] [--token <display_token>]
 
 `--locale` 默认 `zh-CN`，可显式使用 `en`。它只改变重新渲染的 Card 文案，不改变 Checkout、付款、授权或恢复状态。
 
+展示控制（display plane，不创建任何新的付款路径）：
+
+- `--present` 一次只选一种展示方式：`browser` 打开系统浏览器、`image` 展示官方二维码图片、`link` 给出可点击链接、`none` 只说明状态、`auto`（默认）按宿主能力选择一种。`--json` 下默认只返回展示计划而不执行打开；显式 `--present browser` 即是一次打开请求。`ITPAY_NO_BROWSER=1` 与 `--no-open` 都禁止打开浏览器。已付款、已退款或报价失效的 Checkout 不会发起任何展示动作，只读取原状态。
+- `--viewer` 告知用户正在看哪类设备：`mobile` 时不会把二维码当作同机可读方式；`desktop` 时才考虑打开浏览器。
+- 消息转发（relay）要求服务端已签发的脱敏联系人引用 `--relay-option`、稳定幂等键 `--request-key` 和显式人类同意 `--confirm-relay`，三者缺一不可；CLI 不自行发送短信或邮件。`--relay-status <relay_id>` 只读取一次既有转发结果，绝不重发。`--present` 与 relay 互斥。当前 Backend 未提供 relay 能力时会如实返回不可用。
+
 ## 等待付款输出
 
 ```json
@@ -77,6 +86,7 @@ token 缺失或不匹配时使用本机句柄恢复。只有请求的 Checkout
 | `claude-code-cli` | `url`；普通文本模式渲染终端二维码。 |
 | `workbuddy` | 返回 `url,agent_action`；原样执行一次 `present_files(files=[url])` 打开完整渲染的 HTML Card Link，不生成本地文件。 |
 | `zcode` | 返回 `url`；立即用 ZCode 内置浏览器打开，不只粘贴文字链接，也不生成或重建二维码文件。 |
+| `doubao-work` | 返回 `url,qr_image_url`；展示手机直达收银台链接和官方二维码图片链接，说明金额后停止。 |
 | `kimi-code` | `url`；普通文本模式渲染标准终端二维码。 |
 | `openclaw` | Telegram 为 `url,qr_image_url,agent_action`；instruction 强制原样执行 action。`📋 已授权给我读` callback 触发同一 Checkout 查询，再由 Backend 决定是否进入 grant 读取；其他显式 Host 为 `url,qr_image_url`。 |
 

package/docs/cli-reference/commands/device.md

@@ -1,63 +1,39 @@
-# `itpay device` / `itpay device recover`
+# `itpay device`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+`itpay` is the single public CLI entry point; `$itpay` is its user-facing Skill invocation.
 
-## 范围
+## Stable identity and ordinary recovery
 
-`itpay device` 只显示该命令组的帮助并退出，不访问 Backend、不读取或修改身份。当前唯一子命令是 `recover`。
+The original Ed25519 key stays at its existing location. Old `identity.json` v1/v2 is read-only compatibility data. Normal authorization does not acquire legacy locks, inspect processes, or create transition tickets/archives. Old lock files remain untouched.
 
-仅在运营明确确认当前 Backend 的 Device 登记数据库已重建或清空后，删除本地该 Backend 的 v2 registration：
+Each official Backend, actual Agent Type and current key fingerprint has its own atomic session cache. On a rejected session the CLI invalidates only that context, renews it, and retries the original request once. A second failure stops. Corrupt identity, missing original key, permission denial or unknown results never cause automatic key replacement. Do not delete identity, switch runtime/type or disable host protection.
 
-```bash
+## `itpay device recover`
+
+Only after an operator confirms the selected Backend registration database was reset:
+
+```sh
 itpay --agent-type <agent_type> device recover --confirm-backend-reset --json
 ```
 
-命令只作用于当前官方 Backend 的 Device registration，并保留本地 Ed25519 私钥、Cart 和业务资源。默认是 `https://app.itpay.ai`；显式测试可使用准确的 `ITPAY_BACKEND_URL=https://dev.itpay.ai`。该命令不访问 Backend、不自动创建新身份；返回的只读 `services list` 会保留同一 Backend，是重新登记入口。
-
-同一台电脑上的多个 Local Agent Type 共享本地 Device key，但各自使用独立 Agent
-Instance。CLI 只在原子更新 Device state 时使用短期本地锁；释放和 stale recovery
-通过 rename 完成，不依赖 Host 删除文件，因此 WorkBuddy 等 sandbox 的
-safe-delete/trash shim 不应阻断正常命令。该锁不在 Backend，不会让另一台电脑或
-另一个 Buyer 等待。遇到本地锁错误时不得删除 `~/.itpay-v3/device`、切换 Agent
-Type 或执行 `device recover`；应保留身份并重试原命令一次，持续失败时报告
-`device_state_unwritable` 或 lock timeout。
-
-缺少确认参数返回 `backend_reset_confirmation_required`。普通 session 失效由 CLI 自动续期；revoked、quota、权限或未知 Backend 故障不得使用本命令。所有 Agent Type 使用相同输入和输出合同。
-
-## 参数
-
-| 参数 | 必填 | 说明 |
-|---|---:|---|
-| 全局 `--agent-type <agent_type>` | 是 | 当前真实且稳定的 Agent Type；必须位于 `device` 前。 |
-| `--confirm-backend-reset` | 是 | 确认运营已明确判定所选 Backend 的登记数据库被重建或清空。 |
-| `--json` | 否 | 输出稳定 JSON 信封；否则输出同一事实的简洁文本。 |
-
-## 标准输出
-
-```json
-{
-  "status": "backend_registration_removed",
-  "result": {
-    "backend": "https://app.itpay.ai",
-    "removed_agent_types": ["codex-desktop"],
-    "private_key_preserved": true,
-    "other_backend_registrations_preserved": true
-  },
-  "instruction": "只读列出 Service Executions，以同一私钥和 Agent Type 重新登记当前 Backend；不要删除 ~/.itpay-v3 或切换运行时。",
-  "next": {
-    "command": "itpay --agent-type codex-desktop services list --limit 1 --json",
-    "reason": "用无业务写入的签名请求重新登记当前 Backend"
-  },
-  "recovery": []
-}
+This invalidates the selected Backend's caches, preserves the key, old identity and other Backend contexts, and returns a same-Backend/type `auth status` command. It does not contact the Backend itself or authorize business. Missing type or confirmation fails before mutation. Do not use it for expiry, revocation, quota or an unconfirmed failure.
+
+Success status is `backend_cache_invalidated` or `backend_cache_absent`; `result.invalidated_agent_types` records the affected types. The next device check proves the original key to the selected Backend and reuses its authoritative Device/key/quota lineage. No token or private key appears in output.
+
+## `itpay device repair-lock`
+
+```sh
+itpay device repair-lock --json
 ```
 
-当前 Backend 已无本地登记时，`status` 为 `backend_registration_absent`、`removed_agent_types=[]`，其余合同不变。文本输出只包含 Backend、registration 状态、私钥保留和其他 Backend 保留四项，不输出私钥、公钥、Device ID、Agent Instance ID、session、token 或本地文件内容。
+Compatibility explanation only: status `device_legacy_lock_unmanaged`, lock_status `unmanaged`, identity preserved. No legacy file is read, moved or deleted. This does not claim a lock was repaired. Ordinary authorization needs no lock cleanup.
 
-缺少 Agent Type 返回 `agent_type_required`；缺少确认返回 `backend_reset_confirmation_required`。其他本地恢复失败返回 `device_recovery_failed`。所有失败都必须发生在删除 registration 前；本命令不得删除整把 Device identity、Cart、operation journal 或其他 Backend 登记。
+## `itpay device reset-key`
 
-## `itpay device status --json`
+This version does not support automatic device key reset. The command name and existing type/confirmation guards remain recognized:
 
-先核验当前 Backend 合同，再通过既有设备挑战与签名验证获取当前认证事实。首次可能登记设备及该宿主，后续复用同一私钥和登记，强制验证当前服务端状态而非只读取缓存。成功返回 `device_ready`、agent_type、expires_at、backend_url 与 account_binding=unavailable；不返回 token/私钥/签名，不读取业务或订单。不支持账号绑定读取不等于未登录，也不提供不存在的 auth login。
+```sh
+itpay --agent-type <agent_type> device reset-key --confirm-key-reset --json
+```
 
---json 输出标准 envelope；普通文本直接可读。合同、身份或网络故障停止本轮，next=null，不自动重建身份、登录或交易。
+It returns nonzero `device_key_reset_unavailable`, next=null, recovery=[]; the original identity is unchanged. Do not delete a key manually, install an older version to reset it, or present this command as a recovery action. Restoring safe explicit key replacement requires a separately reviewed implementation.

package/docs/cli-reference/commands/docs/index.md

@@ -1,6 +1,6 @@
 # `itpay docs`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 命令范围
 

package/docs/cli-reference/commands/docs/list.md

@@ -1,6 +1,6 @@
 # `itpay docs list`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/docs/search.md

@@ -1,6 +1,6 @@
 # `itpay docs search`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/docs/show.md

@@ -1,6 +1,6 @@
 # `itpay docs show`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/install.md

@@ -1,6 +1,6 @@
 # `itpay install`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 
@@ -8,7 +8,7 @@
 
 **上游：** 当前 npm CLI 或平台 bundle 已经可执行。
 
-**下游：** 使用真实 Agent Type 执行 `readyz`，随后读取完整 Skill 和 Catalog。
+**下游：** 先读取本包完整 Skill，使用真实 Agent Type 执行 `readyz`，再按返回的同 Backend/type 命令检查 `auth status`。authenticated 或成功 login_required 才证明设备访问可用；后者仍未登录，不自动发起授权或业务。
 
 ## 语法与参数
 
@@ -18,10 +18,10 @@ itpay install [target] [--json]
 
 | 参数 | 必填 | 说明 |
 | --- | --- | --- |
-| `target` | 否 | 八种正式 Agent Type 之一；省略或传 `list` 时列出全部。Host 名称不是合法 target。 |
+| `target` | 否 | 九种正式 Agent Type 之一；省略或传 `list` 时列出全部。Host 名称不是合法 target。 |
 | `--json` | 否 | 返回标准命令 envelope；推荐 Agent 使用。 |
 
-正式 target：`codex-desktop`、`codex-cli`、`claude-code-desktop`、`claude-code-cli`、`workbuddy`、`zcode`、`kimi-code`、`openclaw`。
+正式 target：`codex-desktop`、`codex-cli`、`claude-code-desktop`、`claude-code-cli`、`workbuddy`、`zcode`、`doubao-work`、`kimi-code`、`openclaw`。
 
 ## 指定 Agent Type 输出
 
@@ -77,7 +77,7 @@ OpenClaw 额外明确没有默认入口：
 
 ## 列表输出
 
-省略 target 或传 `list` 时返回八组运行时定义，不重复每种类型的完整 instruction：
+省略 target 或传 `list` 时返回九组运行时定义，不重复每种类型的完整 instruction：
 
 ```json
 {
@@ -90,6 +90,7 @@ OpenClaw 额外明确没有默认入口：
       { "agent_type": "claude-code-cli", "default_host": "terminal" },
       { "agent_type": "workbuddy", "default_host": "plain-chat" },
       { "agent_type": "zcode", "default_host": "plain-chat" },
+      { "agent_type": "doubao-work", "default_host": "plain-chat" },
       { "agent_type": "kimi-code", "default_host": "terminal" },
       {
         "agent_type": "openclaw",
@@ -120,8 +121,9 @@ OpenClaw 额外明确没有默认入口：
 | `codex-cli` | `terminal` | 只在用户可见终端展示付款交接。 |
 | `claude-code-desktop` | `claude-code` | 桌面对话必须实际展示二维码和付款链接。 |
 | `claude-code-cli` | `terminal` | 只在用户可见终端展示付款交接。 |
-| `workbuddy` | `plain-chat` | 会持久化 `~/.itpay-v3` 的 Bash 调用先设 Shell 工具参数 `dangerouslyDisableSandbox=true`；拒绝权限时停止。Checkout 原样执行返回的 `present_files` action，打开渲染后的 Card Link。 |
+| `workbuddy` | `plain-chat` | 为 `~/.itpay-v3` 申请正常持久化权限；拒绝时报告受阻操作。Checkout 原样执行返回的 `present_files` action，打开渲染后的 Card Link。 |
 | `zcode` | `plain-chat` | Checkout 或授权返回后立即用 ZCode 内置浏览器打开 `handoff.url`；只有浏览器不可用时才展示同一个可点击链接。 |
+| `doubao-work` | `plain-chat` | Checkout 或授权时同时展示 `handoff.url` 和 `handoff.qr_image_url` 两个有标签的官方入口；优先让手机直接打开链接，二维码供保存或另一台设备扫码。 |
 | `kimi-code` | `terminal` | 使用标准 CLI 流程和终端展示，不增加 Kimi 专属命令。 |
 | `openclaw` | 无 | 必须显式提供当前入口；Telegram 使用原生 action，其他入口展示标准二维码和链接。 |
 
@@ -140,7 +142,7 @@ OpenClaw 额外明确没有默认入口：
     "code": "unsupported_agent_type",
     "message": "unsupported install target: codex"
   },
-  "instruction": "target 只接受：codex-desktop, codex-cli, claude-code-desktop, claude-code-cli, workbuddy, zcode, kimi-code, openclaw。",
+  "instruction": "target 只接受：codex-desktop, codex-cli, claude-code-desktop, claude-code-cli, workbuddy, zcode, doubao-work, kimi-code, openclaw。",
   "next": null,
   "recovery": [
     {

package/docs/cli-reference/commands/next.md

@@ -1,6 +1,6 @@
 # `itpay next`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/order.md

@@ -1,6 +1,6 @@
 # `itpay order`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/pay.md

@@ -1,6 +1,6 @@
 # `itpay pay`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are `buy` and `sell`: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
 
 ## 范围与意义