@itpay/cli 2.1.50 → 2.1.53

package/dist/src/state/config.js

@@ -1,5 +1,5 @@
-const CLI_VERSION = "2.1.50";
-const API_CONTRACT_REVISION = "sha256:5cae7a0566708ad8a6379ebb364b09ce7b0e792e97e21fd9eeb6972445be2028";
+const CLI_VERSION = "2.1.53";
+const API_CONTRACT_REVISION = "sha256:f98390e6d06858a3fc6a79d09f4f6549d853a09abce1c2ba4bbdb19257e006c2";
 export {
   API_CONTRACT_REVISION,
   CLI_VERSION

package/docs/agent/buyer/install-and-setup.json

@@ -24,12 +24,19 @@
     "zcode",
     "doubao work",
     "kimi code",
-    "openclaw"
+    "openclaw",
+    "dot",
+    "muse",
+    "ITPAY_STATE_DIR",
+    "readonly HOME",
+    "cloud"
   ],
   "current_flow": [
-    "Use the authorized setup link’s channel/Backend and one host-permitted persistent npm tool location or global prefix. Retain that callable entry and actual Agent Type; no floating npx or project dependency edits.",
+    "Use the authorized channel/Backend and host-permitted tool prefix/cache/state directories. Use real dot or muse in those hosts, never codex spoofing. Retain one launcher and its Backend, Agent Type and ITPAY_STATE_DIR for every next/recovery command. Do not change HOME.",
     "Run itpay setup --agent-type <actual_type> --json once after installation/upgrade. setup_ready means device preparation; login_required can be a valid separate account status.",
     "Read itpay skill show itpay --json and enable that exact package Skill via the host mechanism. Record the actual path and limitation if the host cannot enable it.",
-    "Do not repeat setup, installation or login for ordinary tasks. A nonzero install is not ready; keep the actual error and follow its current recovery."
+    "Do not repeat setup, installation or login for ordinary tasks. A nonzero install is not ready; keep the actual error and follow its current recovery.",
+    "ITPAY_STATE_DIR selects the private state directory; choose an allowed directory before first enrollment and preserve it. If an existing identity lacks its key or becomes inaccessible, recover access; never rotate identity to regain quota.",
+    "Check install prefix, npm cache, state and receipt writes independently. A writable directory is not proof of persistence across sessions. setup reports Skill readability separately from writing, host discovery and version; do not reinstall during normal tasks."
   ]
 }

package/docs/agent/buyer/purchase.json

@@ -0,0 +1,126 @@
+{
+  "schema_version": "itp.agent_doc.v1",
+  "role": "buyer",
+  "product_scope": "itpay public Buyer CLI",
+  "topic": "purchase",
+  "title": "购买确认与价格策略",
+  "purpose": "读取当前 review 的 allowed_modes、confirmation_schema 和完整模板，补充缺失真实同意后准备官方入口。",
+  "search_terms": [
+    "purchase",
+    "price_policy",
+    "exact",
+    "capped",
+    "confirm_on_official_page",
+    "购买",
+    "价格上限",
+    "官方页确认"
+  ],
+  "contract_version": "itpay.purchase-confirmation.v1",
+  "confirmation_schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "itpay.purchase-confirmation.v1",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+      "review_ref",
+      "request_key",
+      "user_approved",
+      "user_answer",
+      "price_policy"
+    ],
+    "properties": {
+      "review_ref": {
+        "type": "string",
+        "minLength": 1
+      },
+      "request_key": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 200,
+        "pattern": "^(?=[\\s\\S]{1,200}$)(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){1})[\\s\\S]{200})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){2})[\\s\\S]{199})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){3})[\\s\\S]{198})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){4})[\\s\\S]{197})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){5})[\\s\\S]{196})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){6})[\\s\\S]{195})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){7})[\\s\\S]{194})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){8})[\\s\\S]{193})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){9})[\\s\\S]{192})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){10})[\\s\\S]{191})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){11})[\\s\\S]{190})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){12})[\\s\\S]{189})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){13})[\\s\\S]{188})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){14})[\\s\\S]{187})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){15})[\\s\\S]{186})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){16})[\\s\\S]{185})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){17})[\\s\\S]{184})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){18})[\\s\\S]{183})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){19})[\\s\\S]{182})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){20})[\\s\\S]{181})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){21})[\\s\\S]{180})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){22})[\\s\\S]{179})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){23})[\\s\\S]{178})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){24})[\\s\\S]{177})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){25})[\\s\\S]{176})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){26})[\\s\\S]{175})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){27})[\\s\\S]{174})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){28})[\\s\\S]{173})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){29})[\\s\\S]{172})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){30})[\\s\\S]{171})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){31})[\\s\\S]{170})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){32})[\\s\\S]{169})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){33})[\\s\\S]{168})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){34})[\\s\\S]{167})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){35})[\\s\\S]{166})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){36})[\\s\\S]{165})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){37})[\\s\\S]{164})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){38})[\\s\\S]{163})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){39})[\\s\\S]{162})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){40})[\\s\\S]{161})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){41})[\\s\\S]{160})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){42})[\\s\\S]{159})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){43})[\\s\\S]{158})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){44})[\\s\\S]{157})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){45})[\\s\\S]{156})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){46})[\\s\\S]{155})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){47})[\\s\\S]{154})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){48})[\\s\\S]{153})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){49})[\\s\\S]{152})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){50})[\\s\\S]{151})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){51})[\\s\\S]{150})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){52})[\\s\\S]{149})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){53})[\\s\\S]{148})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){54})[\\s\\S]{147})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){55})[\\s\\S]{146})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){56})[\\s\\S]{145})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){57})[\\s\\S]{144})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){58})[\\s\\S]{143})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){59})[\\s\\S]{142})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){60})[\\s\\S]{141})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){61})[\\s\\S]{140})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){62})[\\s\\S]{139})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){63})[\\s\\S]{138})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){64})[\\s\\S]{137})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){65})[\\s\\S]{136})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){66})[\\s\\S]{135})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){67})[\\s\\S]{134})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){68})[\\s\\S]{133})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){69})[\\s\\S]{132})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){70})[\\s\\S]{131})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){71})[\\s\\S]{130})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){72})[\\s\\S]{129})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){73})[\\s\\S]{128})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){74})[\\s\\S]{127})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){75})[\\s\\S]{126})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){76})[\\s\\S]{125})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){77})[\\s\\S]{124})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){78})[\\s\\S]{123})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){79})[\\s\\S]{122})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){80})[\\s\\S]{121})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){81})[\\s\\S]{120})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){82})[\\s\\S]{119})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){83})[\\s\\S]{118})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){84})[\\s\\S]{117})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){85})[\\s\\S]{116})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){86})[\\s\\S]{115})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){87})[\\s\\S]{114})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){88})[\\s\\S]{113})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){89})[\\s\\S]{112})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){90})[\\s\\S]{111})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){91})[\\s\\S]{110})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){92})[\\s\\S]{109})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){93})[\\s\\S]{108})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){94})[\\s\\S]{107})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){95})[\\s\\S]{106})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){96})[\\s\\S]{105})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){97})[\\s\\S]{104})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){98})[\\s\\S]{103})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){99})[\\s\\S]{102})(?!(?=(?:[^𐀀-􏿿]*[𐀀-􏿿]){100})[\\s\\S]{101})[\\s\\S]+$",
+        "x-itpay-length-unit": "utf16"
+      },
+      "user_approved": {
+        "const": true
+      },
+      "user_answer": {
+        "type": "string",
+        "minLength": 1,
+        "pattern": "\\S"
+      },
+      "price_policy": {
+        "oneOf": [
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "mode",
+              "currency",
+              "amount_minor"
+            ],
+            "properties": {
+              "mode": {
+                "const": "exact"
+              },
+              "currency": {
+                "type": "string",
+                "minLength": 1
+              },
+              "amount_minor": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 9007199254740991
+              }
+            }
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "mode",
+              "currency",
+              "maximum_minor"
+            ],
+            "properties": {
+              "mode": {
+                "const": "capped"
+              },
+              "currency": {
+                "type": "string",
+                "minLength": 1
+              },
+              "maximum_minor": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 9007199254740991
+              }
+            }
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "mode",
+              "currency"
+            ],
+            "properties": {
+              "mode": {
+                "const": "confirm_on_official_page"
+              },
+              "currency": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "instructions": [
+    "先读取当前 review；allowed_modes 是此 owner 的实际保证，语法接受不等于该业务支持。",
+    "exact 使用 amount_minor；capped 使用 maximum_minor；confirm_on_official_page 不带金额。金额为最小货币单位的非负安全整数。",
+    "保留原 request_key；结果未知读取原购买，不换 key 重放。",
+    "技术字段由 Agent 按模板修正；仅补缺少的真实业务决定。宿主原生批准独立保留。"
+  ]
+}

package/docs/cli-reference/agent-types.md

@@ -1,9 +1,11 @@
 # Agent Type And Host Contract
 
-Agent Type 表示真实运行宿主；host 是展示媒介，target 是该媒介所需的当前可信消息目标。窗口、任务和聊天不是独立身份，不临时换类型或借另一 Backend 的授权。
+Agent Type 表示真实宿主类型；执行位置（本机/云端/unknown）单独判断，host 是展示媒介，target 是该媒介所需的当前可信消息目标。窗口、任务和聊天不是独立身份，不临时换类型或借另一 Backend 的授权。
 
 | Agent Type | 默认 host |
 |---|---|
+| dot | plain-chat |
+| muse | plain-chat |
 | codex-desktop | codex |
 | codex-cli | terminal |
 | claude-code-desktop | claude-code |
@@ -25,3 +27,7 @@ commerce 命令使用真实 --agent-type 或 ITPAY_AGENT_TYPE；所有返回命
 WorkBuddy 的 present_files、ZCode 浏览器、OpenClaw message 只在该宿主实际可用时使用，不猜工具、不重复安装。OpenClaw target 是原生chat目标，不自行加 telegram: 前缀。授权 callback 只允许读取同一状态，不能证明付款或授权成功。
 
 付款与已购内容授权是不同事实：付款入口交付后停止，只有服务端核实才称付款成功；内容授权完成后只恢复原 reader，不反复创建 vault access。完整官方URL可向当前用户展示，但不提取、单独记录或重建其中凭据。host不能改变金额、订单、额度、资格、权限或同意范围。
+
+Dot/Muse 保持真实类型，不用 codex-desktop 兼容冒充。受限目录使用 ITPAY_STATE_DIR，后续同一 launcher 保留 Backend/type/state；可写不代表跨会话持久。云浏览器成功打开不证明用户已看见页面，未知显示能力仍为 unknown。
+
+Hermes 使用真实 `hermes`，默认以 plain-chat 如实交付；不冒充其他宿主或承诺未知显示能力。

package/docs/cli-reference/conventions.md

@@ -167,3 +167,5 @@ Instruction 只回答当前最重要的一件事：
 - 是否需要邮箱来自 `delivery_email_required`。
 - 是否可直接给 Agent 来自 `agent_visible` / `delivery_mode`。
 - 下一步来自 Service Execution read model，不由 CLI 猜业务流程。
+
+Personal Agent 候选的 V4 测试 Backend 为精确 origin `https://app-test.itpay.ai`，只有配套版本、公开路由与准入核对完成后才能使用。显式设置后所有 continuation 保持该 origin；不回落旧 V3 dev，不允许任意子域、路径、凭据或不同端口。默认生产地址和 latest 不变。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.50",
+  "version": "2.1.53",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -84,7 +84,8 @@
     "docs/cli-reference/conventions.md",
     "docs/cli-reference/index.md",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "docs/agent/buyer/purchase.json"
   ],
   "publishConfig": {
     "access": "public",
@@ -140,5 +141,5 @@
     "url": "git+https://github.com/itpay-ai/cli.git"
   },
   "itpayBundleFormat": "buyer-esm-v1",
-  "gitHead": "cab917ff7daa326b07aa354f43233b674a9afcfb"
+  "gitHead": "c43b2eab1fccd95e5ab577db4b91ecc91350591d"
 }

package/skills/itpay/SKILL.md

@@ -7,6 +7,12 @@ description: Find or buy ItPay services, plan or book railway travel, read purch
 
 Use the installed `itpay` entry yourself. Understand the human’s complete goal and constraints; preserve the actual Agent Type, Backend and device identity. Installation preparation belongs to `install-and-setup`; after setup, ordinary tasks need no repeated installation, readyz or login checks.
 
+If this Skill is supplied with `references/itpay-cli-invocation.md`, read it once and bind every logical `itpay` command to that bundle’s wrapper. Do not switch to a global executable or install another CLI to repair a bundled task. The same canonical Skill and Buyer documentation apply to the pinned package.
+
+## Runtime and state
+
+Use real `dot` or `muse` in those hosts; never impersonate codex-desktop. Keep the same permitted launcher, Backend, Agent Type and private `ITPAY_STATE_DIR` through every continuation. npm prefix/cache, receipt and state must all use host-permitted paths; do not change HOME, clear identity or rotate keys to recover quota. Current write access does not prove cross-session persistence. Skill readability, writing, host discovery and version are separate facts; normal tasks need no reinstall. Cloud execution and user-visible presentation are separate; unknown visibility remains unknown.
+
 ## One current flow
 
 Understand → query → read complete results → select under delegation → obtain only missing genuine consent → prepare one official page → show it immediately → read the original order.
@@ -27,7 +33,7 @@ Collect the complete output and exit of the same host command/session before con
 
 Selection under delegation is not price or terms approval. Read the full current purchase summary: object, all legs/quantity, actual seats, price policy and terms. Reuse explicit human consent only when it covers those unchanged facts; otherwise ask once for the missing consent or material change. Never invent approval, identity or a human answer, and never sign arbitrary human-only actions as an Agent.
 
-Write the complete returned flat purchase confirmation file with its server references and request key. Run the returned `services purchase --input-json` command; the service coordinates confirmation, quote, scope approval and Checkout. Unknown price requires a real exact price, budget cap or explicitly approved official-page confirmation policy. Preparing a page does not request or prove payment. A material change requires the current returned template, not reuse of a stale confirmation.
+Write the complete returned flat purchase confirmation file with its server references and request key. Use only the current review’s `allowed_modes` and `confirmation_schema`, then run the returned `services purchase --input-json` command; the service coordinates confirmation, quote, scope approval and Checkout. Unknown price requires a real exact price, budget cap or explicitly approved official-page confirmation policy. Preparing a page does not request or prove payment; order and inventory effects must follow actual owner facts. Native host approval is separate from conversational business consent. A material change requires the current returned template, not reuse of a stale confirmation.
 
 ## Show the official entry