@itpay/cli 2.1.55 → 2.1.56

package/dist/src/main.js

@@ -7673,6 +7673,46 @@ var require_commander = __commonJS({
   }
 });
 
+// src/state/agent_type.ts
+function declaredAgentType(env = process.env, argv = process.argv) {
+  if (env.ITPAY_AGENT_TYPE) return canonicalAgentType(env.ITPAY_AGENT_TYPE);
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === "--agent-type") return canonicalAgentType(argv[index + 1]);
+    if (value?.startsWith("--agent-type=")) return canonicalAgentType(value.slice("--agent-type=".length));
+  }
+  return void 0;
+}
+__name(declaredAgentType, "declaredAgentType");
+function canonicalAgentType(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized) return void 0;
+  return normalized === "codex" ? "codex-desktop" : normalized;
+}
+__name(canonicalAgentType, "canonicalAgentType");
+function qualifyItPayCommand(command, agentType) {
+  if (!agentType || !/^[a-z0-9-]+$/.test(agentType)) return command;
+  if (!command.startsWith("itpay ") || /^itpay\s+--agent-type(?:=|\s)/.test(command)) return command;
+  return `itpay --agent-type ${agentType} ${command.slice("itpay ".length)}`;
+}
+__name(qualifyItPayCommand, "qualifyItPayCommand");
+var AgentTypeRequiredError = class extends Error {
+  static {
+    __name(this, "AgentTypeRequiredError");
+  }
+  code = "agent_type_required";
+  constructor() {
+    super("Declare the actual Agent Type with --agent-type or ITPAY_AGENT_TYPE; no authorization request was sent");
+    this.name = "AgentTypeRequiredError";
+  }
+};
+function requireAgentType(value) {
+  const type = canonicalAgentType(value);
+  if (!type) throw new AgentTypeRequiredError();
+  return type;
+}
+__name(requireAgentType, "requireAgentType");
+
 // src/services/shared/purchase_contract.generated.ts
 var purchaseContract = {
   "version": "itpay.purchase-confirmation.v1",
@@ -7991,30 +8031,6 @@ function resolveOutput(sink) {
 }
 __name(resolveOutput, "resolveOutput");
 
-// src/state/agent_type.ts
-function declaredAgentType(env = process.env, argv = process.argv) {
-  if (env.ITPAY_AGENT_TYPE) return canonicalAgentType(env.ITPAY_AGENT_TYPE);
-  for (let index = 0; index < argv.length; index += 1) {
-    const value = argv[index];
-    if (value === "--agent-type") return canonicalAgentType(argv[index + 1]);
-    if (value?.startsWith("--agent-type=")) return canonicalAgentType(value.slice("--agent-type=".length));
-  }
-  return void 0;
-}
-__name(declaredAgentType, "declaredAgentType");
-function canonicalAgentType(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) return void 0;
-  return normalized === "codex" ? "codex-desktop" : normalized;
-}
-__name(canonicalAgentType, "canonicalAgentType");
-function qualifyItPayCommand(command, agentType) {
-  if (!agentType || !/^[a-z0-9-]+$/.test(agentType)) return command;
-  if (!command.startsWith("itpay ") || /^itpay\s+--agent-type(?:=|\s)/.test(command)) return command;
-  return `itpay --agent-type ${agentType} ${command.slice("itpay ".length)}`;
-}
-__name(qualifyItPayCommand, "qualifyItPayCommand");
-
 // src/state/config.ts
 import { CLI_VERSION, API_CONTRACT_REVISION } from "./state/config.js";
 import { CLI_VERSION as CLI_VERSION2, API_CONTRACT_REVISION as API_CONTRACT_REVISION2 } from "./state/config.js";
@@ -8608,7 +8624,7 @@ var DeviceAuthority = class {
     return this.pending;
   }
   cache(privateKey, agentType = this.requestedAgentType) {
-    if (!agentType) throw new Error("agent type is required for ItPay commerce; pass --agent-type <type> or set ITPAY_AGENT_TYPE");
+    agentType = requireAgentType(agentType);
     return new DeviceSessionCache(resolve(dirname2(this.statePath), "sessions"), {
       backend: this.backendKey,
       agentType,
@@ -8661,9 +8677,8 @@ var DeviceAuthority = class {
   }
   async prepareAuthorization(options) {
     checkAuthorizationBudget(options);
+    const agentType = requireAgentType(this.requestedAgentType);
     const state = this.readState();
-    const agentType = this.requestedAgentType;
-    if (!agentType) throw new Error("agent type is required for ItPay commerce; pass --agent-type <type> or set ITPAY_AGENT_TYPE");
     let privateKey;
     checkAuthorizationBudget(options);
     try {
@@ -9262,7 +9277,7 @@ function writeCommandEnvelope(value, options = {}) {
   if (options.plainResult) {
     for (const line of options.plainResult) {
       const command = line.match(/^(\s*(?:command|reader|entry): )(itpay .*)$/);
-      out(`${command ? command[1] + qualifyBackendCommand(qualifyItPayCommand(command[2], agentType)) : line}
+      out(`${command ? command[1] + qualifyCommand(command[2], agentType) : line}
 `);
     }
   } else {
@@ -9314,17 +9329,17 @@ function qualifyEnvelope(value, agentType) {
     ..."handoff" in value && value.handoff ? { handoff: qualifyCommandsDeep(value.handoff, agentType) } : {},
     ..."interaction" in value && value.interaction ? { interaction: qualifyCommandsDeep(value.interaction, agentType) } : {},
     ..."communication" in value && value.communication ? { communication: qualifyCommandsDeep(value.communication, agentType) } : {},
-    next: value.next ? { ...value.next, command: qualifyBackendCommand(qualifyItPayCommand(value.next.command, agentType)) } : null,
+    next: value.next ? { ...value.next, command: qualifyCommand(value.next.command, agentType) } : null,
     recovery: value.recovery.map((action) => ({
       ...action,
-      command: qualifyBackendCommand(qualifyItPayCommand(action.command, agentType))
+      command: qualifyCommand(action.command, agentType)
     }))
   };
 }
 __name(qualifyEnvelope, "qualifyEnvelope");
 function qualifyCommandsDeep(value, agentType) {
   if (typeof value === "string") {
-    return value.startsWith("itpay ") ? qualifyBackendCommand(qualifyItPayCommand(value, agentType)) : value;
+    return value.startsWith("itpay ") ? qualifyCommand(value, agentType) : value;
   }
   if (Array.isArray(value)) return value.map((item) => qualifyCommandsDeep(item, agentType));
   if (value && typeof value === "object") {
@@ -9397,6 +9412,11 @@ function printErrorRecovery(error, output) {
   }
 }
 __name(printErrorRecovery, "printErrorRecovery");
+function qualifyCommand(command, agentType) {
+  const qualified = qualifyBackendCommand(qualifyItPayCommand(command, agentType));
+  return command.startsWith("itpay ") && process.env.ITPAY_STATE_DIR ? `ITPAY_STATE_DIR=${shellArgument(process.env.ITPAY_STATE_DIR)} ${qualified}` : qualified;
+}
+__name(qualifyCommand, "qualifyCommand");
 
 // src/services/shared/purchase.ts
 function purchaseEnvelope(state) {
@@ -17861,7 +17881,7 @@ var AuthRequestError = class extends Error {
   }
 };
 function authStatusUnknown(sessionID, error, failureStage = "authorization_status_read") {
-  if (error instanceof HttpError && error.status < 500 || error instanceof AuthRequestError && error.httpStatus < 500 || error instanceof DeviceAuthorizationError || error instanceof DeviceStateError)
+  if (error instanceof HttpError && error.status < 500 || error instanceof AuthRequestError && error.httpStatus < 500 || error instanceof DeviceAuthorizationError || error instanceof DeviceStateError || error instanceof AgentTypeRequiredError)
     throw error;
   const hostFailure = error && typeof error === "object" && "code" in error && (error.code === "CODEBUDDY_BROKER_DENY" || error.code === "CODEBUDDY_BROKER_OUTCOME_UNKNOWN");
   const failure = error instanceof HttpTransportError ? { category: error.code, attempts: error.attempts, source: "network_transport" } : error instanceof HttpError || error instanceof AuthRequestError ? { category: "http_server_error", http_status: error instanceof HttpError ? error.status : error.httpStatus, source: "http_response" } : hostFailure ? { category: "host_operation_unavailable", source: "host_broker" } : { category: "authorization_status_unavailable", source: "unclassified" };
@@ -17919,7 +17939,7 @@ async function accountAuth(action, baseURL, env, fetcher, backend, readOnlyStatu
       if (current.status === "authenticated")
         return authenticatedEnvelope(env, current.phone_verified === true);
     } catch (error) {
-      if (error instanceof AuthRequestError)
+      if (error instanceof AuthRequestError || error instanceof AgentTypeRequiredError)
         throw error;
       return authStatusUnknown(readOnlyStatus ? void 0 : readAuthState(baseURL, env, purpose)?.sessionID, error, "account_binding_probe");
     }
@@ -19409,7 +19429,7 @@ __name(installDefinition, "installDefinition");
 import { createHash as createHash9 } from "node:crypto";
 
 // src/state/skill_identity.generated.ts
-var CANONICAL_SKILL_SHA256 = "9e36b56ef726cd1c7db603474fb977fa3cc5b84ef6b005d007e9f322ac534ce7";
+var CANONICAL_SKILL_SHA256 = "f4aaace4d39abd9c8f91307305f9ac0e2c8630802a545a3a555a89b45b670524";
 
 // src/commands/skill.ts
 import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
@@ -19574,12 +19594,18 @@ async function runSetup(backend, config, skillPath, options = {}) {
       device_status: "ready",
       account_status: account.status,
       skill_path: skillPath,
-      skill_version: CLI_VERSION2
+      skill_version: CLI_VERSION2,
+      ...account.status === "login_required" ? { account_action: {
+        optional: true,
+        condition: "\u4EC5\u5F53\u7528\u6237\u8981\u6C42\u767B\u5F55\u6216\u5F53\u524D\u529F\u80FD\u9700\u8981\u8D26\u53F7\u65F6\u4F7F\u7528\uFF1B\u514D\u8D39\u67E5\u8BE2\u4E0D\u5F3A\u5236\u7ED1\u5B9A\u3002",
+        command: "itpay auth login --json",
+        reason: "\u7531\u672C\u4EBA\u5B8C\u6210\u5B98\u65B9\u8D26\u53F7\u6388\u6743\uFF0C\u4E0D\u81EA\u52A8\u767B\u5F55"
+      } } : {}
     },
     instruction: account.status === "authenticated" ? "\u8BBE\u5907\u5DF2\u51C6\u5907\u597D\uFF0C\u5DF2\u6709\u8D26\u53F7\u6388\u6743\u53EF\u7EE7\u7EED\u4F7F\u7528\u3002\u8BFB\u53D6\u5E76\u542F\u7528\u4E0B\u65B9 Skill \u540E\uFF0C\u6309\u7528\u6237\u9700\u6C42\u5F00\u59CB\u3002" : "\u8BBE\u5907\u5DF2\u51C6\u5907\u597D\u3002\u8BFB\u53D6\u5E76\u542F\u7528\u4E0B\u65B9 Skill \u540E\u5373\u53EF\u5F00\u59CB\uFF1B\u9700\u8981\u8D26\u53F7\u7684\u529F\u80FD\u4F1A\u518D\u8BF7\u7528\u6237\u6388\u6743\u3002",
     next: null,
     recovery: []
-  }, options);
+  }, { ...options, ...config.agentType ? { agentType: config.agentType } : {} });
 }
 __name(runSetup, "runSetup");
 
@@ -21878,7 +21904,18 @@ function resolveCheckoutPresentationArgs(input) {
 }
 __name(resolveCheckoutPresentationArgs, "resolveCheckoutPresentationArgs");
 function reportCLIError(error, contract) {
-  const commandError = error instanceof CommandContractError ? error : void 0;
+  const commandError = error instanceof CommandContractError ? error : error instanceof AgentTypeRequiredError ? new CommandContractError(
+    error.code,
+    error.message,
+    "\u672C\u6B21\u6CA1\u6709\u53D1\u9001\u6388\u6743\u8BF7\u6C42\u3002Agent\u6CBF\u7528\u5B9E\u9645\u5BBF\u4E3B\u7C7B\u578B\u8865\u9F50 --agent-type \u6216 ITPAY_AGENT_TYPE\uFF0C\u4FDD\u7559\u539FBackend\u548C\u79C1\u6709\u72B6\u6001\u76EE\u5F55\uFF1B\u4E0D\u8981\u8BA9\u7528\u6237\u731C\u6280\u672F\u53C2\u6570\u3001\u6362\u8EAB\u4EFD\u6216\u65B0\u5EFA\u6388\u6743\u3002",
+    [],
+    void 0,
+    {
+      failure_stage: "local_agent_declaration",
+      request_sent: false,
+      input_template: { executable: false, required_field: "agent_type", source: "actual_host", preserve: ["Backend", "ITPAY_STATE_DIR", "device_identity"] }
+    }
+  ) : void 0;
   const backendOverrideError = error instanceof BackendOverrideError ? error : void 0;
   const deviceError = error instanceof DeviceAuthorizationError ? error : void 0;
   const stateError = error instanceof DeviceStateError ? error : void 0;

package/dist/src/state/config.js

@@ -1,4 +1,4 @@
-const CLI_VERSION = "2.1.55";
+const CLI_VERSION = "2.1.56";
 const API_CONTRACT_REVISION = "sha256:f20af3780a0e12a79a6ca9507ba65167a4018338495af66d87931e55619b618a";
 export {
   API_CONTRACT_REVISION,

package/docs/agent/buyer/identity-and-sessions.json

@@ -25,7 +25,7 @@
   ],
   "current_flow": [
     "One verified supported identity can log in: phone is recommended, wallets follow, email is a separate choice. Bind another only on request or current service need.",
-    "Display the current official authorization entry; after completion use its same-task recovery command.",
+    "Display the current official authorization entry; after completion use its same-task recovery command. Retain the actual Agent Type, Backend, launcher/PATH and any custom private ITPAY_STATE_DIR for auth login/status, waiting, expired-request recovery and original-task recovery. A setup-only flag does not persist the type; exported values may be inherited. Do not start login automatically for free queries.",
     "Account merging requires proof of both accounts and explicit confirmation on the official page. Login permission is separate from purchase consent.",
     "Keep the device identity and actual Agent Type. Current errors supply an action or explicit stop; do not delete keys, change identity or repeat installation."
   ]

package/docs/agent/buyer/install-and-setup.json

@@ -33,10 +33,11 @@
   ],
   "current_flow": [
     "Use the authorized channel/Backend and host-permitted tool prefix/cache/state directories. Use real dot or muse in those hosts, never codex spoofing. Retain one launcher and its Backend, Agent Type and ITPAY_STATE_DIR for every next/recovery command. Do not change HOME.",
-    "Run itpay setup --agent-type <actual_type> --json once after installation/upgrade. setup_ready means device preparation; login_required can be a valid separate account status.",
+    "Declare the actual host type via ITPAY_AGENT_TYPE or the global --agent-type option, then run itpay setup --json once after installation/upgrade. Preserve that real declaration, launcher/PATH, Backend and any custom private ITPAY_STATE_DIR for all later commands. Exported values can be inherited by child processes; a new shell may need them again. A one-time setup flag is not persistent configuration. setup_ready means device preparation; login_required is a separate valid account status.",
     "Read itpay skill show itpay --json and enable that exact package Skill via the host mechanism. Record the actual path and limitation if the host cannot enable it.",
     "Do not repeat setup, installation or login for ordinary tasks. A nonzero install is not ready; keep the actual error and follow its current recovery.",
     "ITPAY_STATE_DIR selects the private state directory; choose an allowed directory before first enrollment and preserve it. If an existing identity lacks its key or becomes inaccessible, recover access; never rotate identity to regain quota.",
-    "Check install prefix, npm cache, state and receipt writes independently. A writable directory is not proof of persistence across sessions. setup reports Skill readability separately from writing, host discovery and version; do not reinstall during normal tasks."
+    "Check install prefix, npm cache, state and receipt writes independently. A writable directory is not proof of persistence across sessions. setup reports Skill readability separately from writing, host discovery and version; do not reinstall during normal tasks.",
+    "When login_required, the returned account_action is optional: use it only for a user-requested login or an account-required feature; do not auto-login or bind for free queries. Missing host declaration is technical input the Agent restores from actual context, not an unknown server authorization or a reason to ask the human to guess a type."
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.55",
+  "version": "2.1.56",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -140,6 +140,5 @@
     "type": "git",
     "url": "git+https://github.com/itpay-ai/cli.git"
   },
-  "itpayBundleFormat": "buyer-esm-v1",
-  "gitHead": "d2b0eaaafcd7918edb84f9d004cfa09652b914fa"
+  "itpayBundleFormat": "buyer-esm-v1"
 }

package/skills/itpay/SKILL.md

@@ -11,7 +11,7 @@ If this Skill is supplied with `references/itpay-cli-invocation.md`, read it onc
 
 ## Runtime and state
 
-Use real `dot` or `muse` in those hosts; never impersonate codex-desktop. Keep the same permitted launcher, Backend, Agent Type and private `ITPAY_STATE_DIR` through every continuation. npm prefix/cache, receipt and state must all use host-permitted paths; do not change HOME, clear identity or rotate keys to recover quota. Current write access does not prove cross-session persistence. Skill readability, writing, host discovery and version are separate facts; normal tasks need no reinstall. Cloud execution and user-visible presentation are separate; unknown visibility remains unknown.
+Use real `dot` or `muse` in those hosts; never impersonate codex-desktop. Keep the same permitted launcher/PATH, Backend, actual `ITPAY_AGENT_TYPE` (or explicit global `--agent-type`) and private `ITPAY_STATE_DIR` through every command and returned continuation, including auth login/status. Exported values can be inherited; a separate shell may need the same declarations again. A setup-only flag does not persist them. Missing declarations are technical input for the Agent to restore from its real host context, never a reason to guess another host or reset identity. npm prefix/cache, receipt and state must all use host-permitted paths; do not change HOME, clear identity or rotate keys to recover quota. Current write access does not prove cross-session persistence. Skill readability, writing, host discovery and version are separate facts; normal tasks need no reinstall. Cloud execution and user-visible presentation are separate; unknown visibility remains unknown.
 
 ## One current flow