@itpay/cli 2.1.65 → 2.1.66
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -20
- package/dist/src/main.js +5931 -5552
- package/dist/src/state/config.js +1 -1
- package/docs/cli-reference/api.md +19 -44
- package/docs/cli-reference/commands/setup.md +12 -0
- package/package.json +2 -2
- package/skills/itpay/SKILL.md +12 -2
- package/skills/itpay-api/SKILL.md +27 -18
package/dist/src/state/config.js
CHANGED
|
@@ -1,54 +1,29 @@
|
|
|
1
|
-
#
|
|
1
|
+
# API Hub CLI
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Use the same installation launcher and absolute --profile selector for every call.
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
Set the actual ITPAY_HUB_URL for the approved environment and preserve actual Agent Type, launcher and ITPAY_STATE_DIR across commands. Default source configuration is loopback when no URL is supplied; do not assume it points at production. `api connect` uses browser OAuth/PKCE. `api credentials import` reads an authorized ItPay key from stdin; never put a key/token in argv/chat or borrow Services credentials. `api doctor` is a read-only diagnostic, not a routine prerequisite. Credentials are endpoint-scoped; changing the account/resource is not a recovery technique.
|
|
8
|
-
|
|
9
|
-
## Registered commands
|
|
10
|
-
|
|
11
|
-
| Command | Use / important flags |
|
|
5
|
+
|Command|Behavior|
|
|
12
6
|
|---|---|
|
|
13
|
-
|
|
|
14
|
-
|
|
|
15
|
-
|
|
|
16
|
-
|
|
|
17
|
-
|
|
|
18
|
-
|
|
|
19
|
-
|
|
|
20
|
-
|
|
|
21
|
-
|
|
|
22
|
-
| `api topup <sku_id>` | Explicit user-requested cash top-up; --payer-currency, --for-intent, --channel, --mode, --json. SKU/channel must be advertised and permitted. |
|
|
23
|
-
| `api topup-status <topup_id>` | Original top-up fact; --json, not new top-up. |
|
|
24
|
-
| `api admin <action>` | Scoped administration only, current role/key required; --input - or private @file; --json. Not normal consumer discovery. |
|
|
25
|
-
|
|
26
|
-
Group options `--host`/`--target` describe real trusted payment presentation, not permission escalation. Shared global flags come from root help, not Services-specific JSON.
|
|
27
|
-
|
|
28
|
-
## Safe continuation
|
|
29
|
-
|
|
30
|
-
Inspect all conditions/effects and publication before running. Ordinary API budget does not approve a purchase or external write. `--max-charge` is scale6 atoms, not yuan/fen. Read the returned complete envelope directly, not through an ad hoc parser. An accepted/unknown request must keep its original ID and input; use tasks/resume/status, not repeat run under a new key. Use terminal/pending_stage/next.read_only rather than an outer result object or execution status alone. Honor bounded waits and current recovery conditions; unknown lookup is not a recharge instruction. An intent resume requires confirmed normal authorization and permission to continue; tasks --refresh and run-status only read. Explicitly export ITPAY_STATE_DIR and privately verify the actual profile/consumer before an authorized isolated run; merely using a shell variable for log filenames does not configure the CLI.
|
|
31
|
-
|
|
32
|
-
The current local candidate includes this reference and the independent API Skill. Read it with `itpay skill show itpay-api --json`; its full original is in result.content. This read never connects, registers a Services device or writes identity. The API Skill ignores ITPAY_CLI_SKILLS_DIR (a Services-only override); missing or mismatched package content fails without falling back to Services. This is local candidate verification, not an npm channel update or natural Agent acceptance.
|
|
33
|
-
|
|
34
|
-
## Entry selection
|
|
35
|
-
|
|
36
|
-
For a new task, prefer the official pinned ItPay CLI when execution is permitted and available in the current host. Install only through the host-permitted official installation path when authorized. Services tasks use the Services Skill; API tasks use the independent API Skill and `itpay api`. CLI calls HTTP APIs directly, never MCP transport. Without permitted CLI capability, use the corresponding ItPay-hosted user Services MCP or Hub MCP and only its actually available tools; ordinary users do not self-host another MCP. Platform-required workflows and explicit connection tests follow the actual available capability. Entry selection never authorizes a permission bypass: preserve the original identity, entry, request/run and current grant after acceptance or an unknown result. Continue across entries only when the owner explicitly supports recovery under the same actual authority; CLI errors never license a substitute transaction or raw HTTP workaround.
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
## Original OAuth connection recovery
|
|
40
|
-
|
|
41
|
-
`itpay api recover-connection --json` is an explicit, noninteractive identity operation. It uses only the selected original profile's refresh proof, verifies the authority-issued original buyer/client/resource/consumer at the server, then checks `/v1/me` before committing that same binding. It never creates a connection, grant, run, continuation, hold or charge. Existing `api connect` refuses to replace a saved profile. Account equality or a client-family prefix is not original-connection proof.
|
|
7
|
+
|api categories|Real categories, including empty shelves.|
|
|
8
|
+
|api list [--category <id/slug/label>] [--query <text>] [--limit <1..100>] [--cursor <cursor>]|The website's saleable products, filtered before pagination.|
|
|
9
|
+
|api show <operation_id>|Purpose, price, JSON example and result TTL. Saves this installation's displayed publication.|
|
|
10
|
+
|api call <operation_id> --input <JSON/@file/->|After consent, submit using the shown price and publication.|
|
|
11
|
+
|api call --pending <request_id>|Read and, when eligible, continue this installation's original request. Each wait round is at most 120 seconds.|
|
|
12
|
+
|api status <request_id>|Read-only original receipt, result and charge.|
|
|
13
|
+
|api wallet|Account available/held money, selected credential kind/masked account and official proactive top-up URL.|
|
|
14
|
+
|api wallet --usage|Current Key/Consumer gross/net/refunded/held usage; runs include failures.|
|
|
15
|
+
|api wallet --transactions|Scoped charge/refund rows with limit/truncation; owner_billing_url opens full account history.|
|
|
42
16
|
|
|
43
|
-
|
|
17
|
+
All support --json. Installation uses setup --api-prefix. Connection uses api connect, connect continue, connect status and connect restart. Explicit rejection of refresh returns the original profile's connect --request command. Immediately follow the emitted waiting command. Successful reconnection returns status of the same original request, which can then return call --pending.
|
|
44
18
|
|
|
45
|
-
|
|
19
|
+
Show purpose, price and TTL before obtaining consent. A publication change requires reading the original receipt and showing the new price. A network-unknown write permits only original status reads. A failed call is called free of charge only when captured and held are both confirmed zero. Source result expiry does not remove fee facts.
|
|
46
20
|
|
|
47
|
-
|
|
21
|
+
The developer credentials import, admin and doctor commands are outside the six business commands. Services/cart/buy/checkout keep their separate authority and entry points.
|
|
48
22
|
|
|
23
|
+
A `price_changed` receipt includes `current_price` (CNY, scale 6, atoms) and verified original captured/held facts. When both are zero, the next command is show; explicit new-price consent is required before a new call. The ended original remains readable with status and has no stale funding handoff.
|
|
49
24
|
|
|
50
|
-
###
|
|
25
|
+
### API Key
|
|
51
26
|
|
|
52
|
-
`itpay api
|
|
27
|
+
Use a secret manager to inject ITPAY_HUB_KEY or pipe a private secret source to `itpay api credentials import --json`. Never pass the secret in argv or chat. With --profile, import into that same installation; an explicit environment Key remains selected. It does not need OAuth. Saved OAuth and Key remain private; the last explicit import/connect selects the credential, while a Key environment override selects that Key. Supplying both environment bearer and Key is an error. Requests remain isolated by original credential; neither a new Key nor OAuth can take over old requests.
|
|
53
28
|
|
|
54
|
-
|
|
29
|
+
Check `wallet` identity.account_hint and credential_kind; matching hints identify the same wallet, not the same consumer. Invalid/revoked Key or insufficient Key scope points to the official /me/keys page, without OAuth fallback. Hub MCP accepts Key only through its existing X-ItPay-Key protocol header; normal ChatGPT MCP uses OAuth. Do not paste a Key into chat or put it in a Bearer field. Services identity is independent.
|
|
@@ -1,3 +1,9 @@
|
|
|
1
|
+
# Task-driven Agent entry
|
|
2
|
+
|
|
3
|
+
For a new task use `itpay agent --surface api|services --task @/absolute/private-task.txt --json`. It selects this actual host's independent profile, saves the original task, prepares only the requested path, emits its official authorization link and waits up to120s. The Agent supplies its own --agent-type when runtime signals are absent; the person does not choose a type. For buffered tool output add --buffered, show the returned link and immediately execute next. Pending is not connected. Resume after any next reply with agent and no task; explicit new intent uses --new-task, retaining prior receipts. Existing accepted requests keep their original profile/commands; never copy them into a new host profile. Read the returned connected original task and same-package Skill; original API requests go to status first.
|
|
4
|
+
|
|
5
|
+
This entry is available in the development candidate from https://dev.itpay.ai/agent, not implicitly the fixed/npm package. First-batch Services and Hub remain independently authorized. Legacy setup below remains a diagnostic/compatibility path.
|
|
6
|
+
|
|
1
7
|
# `itpay setup`
|
|
2
8
|
|
|
3
9
|
Use the host's permitted persistent npm installation or a normal global install. Fix that exact executable for all commands; installation location does not change the device identity directory.
|
|
@@ -13,3 +19,9 @@ Run once after installation or upgrade. Unsupported/missing type and unavailable
|
|
|
13
19
|
For testing set `ITPAY_BACKEND_URL=https://dev.itpay.ai` on every invocation; production defaults to app.itpay.ai. Do not switch environments to hide failure. `install`, `readyz` and `auth status` remain diagnostic/compatibility commands, not a required initialization chain.
|
|
14
20
|
|
|
15
21
|
Reuse the existing launcher and permitted state directory across chats; a new chat is not a new identity. A genuinely separate identity requires explicit authorization. New tasks prefer the permitted, available official CLI; otherwise use the corresponding hosted MCP. Do not require cloud hosts to attempt installation. Accepted, payment-pending and unknown tasks preserve their original entry and references.
|
|
22
|
+
|
|
23
|
+
API installations use `itpay setup --api-prefix <absolute-directory> --json`.
|
|
24
|
+
The returned private selector is supplied to `itpay api --profile <selector>`;
|
|
25
|
+
its dedicated launcher selects it automatically. This does not create API authority.
|
|
26
|
+
|
|
27
|
+
Agent options: `--reconnect` is reserved for an explicit user request to reconnect this same Agent and account after denial/revocation; `--task <text|@file>` saves the original request; `--surface api|services` selects its owner; `--request <id>` refers only to a local request in this same selected profile; `--wait <0..120>` bounds a wait round; `--buffered` returns the link before a separate wait call; `--new-task` records a genuinely new intent while preserving prior receipts; `--json` emits progress frames; `--help` describes this entry. Resume with no `--task` to keep the saved original.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@itpay/cli",
|
|
3
|
-
"version": "2.1.
|
|
3
|
+
"version": "2.1.66",
|
|
4
4
|
"description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -148,5 +148,5 @@
|
|
|
148
148
|
"services",
|
|
149
149
|
"api"
|
|
150
150
|
],
|
|
151
|
-
"gitHead": "
|
|
151
|
+
"gitHead": "f0a951df3d1152e1255523d647f4602ee5b76659"
|
|
152
152
|
}
|
package/skills/itpay/SKILL.md
CHANGED
|
@@ -5,9 +5,11 @@ description: Find or buy ItPay services, plan or book railway travel, read purch
|
|
|
5
5
|
|
|
6
6
|
# ItPay
|
|
7
7
|
|
|
8
|
+
Development acceptance uses the official @itpay/cli@2.1.66 release. Check the actual launcher with --version before testing; if older, read https://dev.itpay.ai/agent and rerun its installer in the same tool prefix, preserving the original profile, account and requests. Direct old binaries do not automatically update. Production latest remains separate.
|
|
9
|
+
|
|
8
10
|
展示本人登录、办理或付款入口时，只使用工具返回的官方 HTML 卡、由同一 HTML 截图的官方图片和原官方链接。图片失败或宿主不能展示图片时，给出原链接、用途、当前状态、本人需做的动作及原任务 next；不得自行编码、重画、裁剪二维码，也不得换单或重建授权。
|
|
9
11
|
|
|
10
|
-
For a new task, prefer the official pinned ItPay CLI when execution is permitted and available in the current host. This does not require a cloud host to try installing software. Route by the requested deliverable, not by the word "query": API calls, structured data (including company fields), and developer tasks use the API Skill and `itpay api
|
|
12
|
+
For a new task, prefer the official pinned ItPay CLI when execution is permitted and available in the current host. This does not require a cloud host to try installing software. Route by the requested deliverable, not by the word "query": API calls, structured data (including company fields), and developer tasks use the API Skill and `itpay api list`; service handling, purchased reports, delivery and aftercare use the Services Skill and its declared service contract. Install only through the host-permitted official installation path when authorized. Services tasks use the Services Skill; API tasks use the independent API Skill and `itpay api`. CLI calls HTTP APIs directly, never MCP transport. Without permitted CLI capability, use the corresponding ItPay-hosted user Services MCP or Hub MCP and only its actually available tools; ordinary users do not self-host another MCP. Platform-required workflows and explicit connection tests follow the actual available capability. Entry selection never authorizes a permission bypass: preserve the original identity, entry, request/run and current grant after acceptance, while waiting for payment/fulfillment/aftercare, or after an unknown result. Continue across entries only when the owner explicitly supports recovery under the same actual authority; CLI errors never license a substitute transaction or raw HTTP workaround.
|
|
11
13
|
|
|
12
14
|
Use the installed `itpay` entry yourself. Understand the human’s complete goal and constraints; preserve the actual Agent Type, Backend and device identity. Installation preparation belongs to `install-and-setup`; after setup, ordinary tasks need no repeated installation, readyz or login checks.
|
|
13
15
|
|
|
@@ -17,11 +19,17 @@ If this Skill is supplied with `references/itpay-cli-invocation.md`, read it onc
|
|
|
17
19
|
|
|
18
20
|
Use real `dot` or `muse` in those hosts; never impersonate codex-desktop. A new chat is not a new identity: reuse the existing permitted state directory. Choose a separate directory only for a genuinely separate, explicitly authorized identity. Keep the same permitted launcher/PATH, Backend, actual `ITPAY_AGENT_TYPE` (or explicit global `--agent-type`) and private `ITPAY_STATE_DIR` through every command and returned continuation, including auth login/status. Exported values can be inherited; a separate shell may need the same declarations again. A setup-only flag does not persist them. Missing declarations are technical input for the Agent to restore from its real host context, never a reason to guess another host or reset identity. npm prefix/cache, receipt and state must all use host-permitted paths; do not change HOME, clear identity or rotate keys to recover quota. Current write access does not prove cross-session persistence. Skill readability, writing, host discovery and version are separate facts; normal tasks need no reinstall. Cloud execution and user-visible presentation are separate; unknown visibility remains unknown.
|
|
19
21
|
|
|
22
|
+
## Task-driven preparation
|
|
23
|
+
|
|
24
|
+
Start with the user's requested task, not a separate setup conversation. For a new installation read https://dev.itpay.ai/agent; execute the official `agent --task @<private-task-file> --surface services --json` entry. The Agent supplies its own actual runtime type if detection needs it; the user never chooses a technical identity. A distinct host gets a distinct profile without overwriting old connections. Existing accepted workflows keep their original state directory and returned commands.
|
|
25
|
+
|
|
26
|
+
The entry saves the task before authorization, presents the official link and waits in the same call. If output is buffered, use `--buffered`, show the link and immediately execute its next wait command. The user need not say "done". A later arbitrary reply resumes `agent` without `--task`; read original pending work before creating anything. Only authenticated/connected means ready, never an exit code or pending. First-batch Hub and Services permissions remain separate and requested only by the task; do not claim a combined authorization has shipped.
|
|
27
|
+
|
|
20
28
|
## One current flow
|
|
21
29
|
|
|
22
30
|
Understand → query → read complete results → select under delegation → obtain only missing genuine consent → prepare one official page → show it immediately → read the original order.
|
|
23
31
|
|
|
24
|
-
For railway travel, read `itpay docs show rail-booking` once before the first query. That guide owns endpoint understanding, reliable route knowledge versus targeted lookup, the pre-query 2–4 line brief and Exact/Smart choice. Preserve full administrative/place names, dates, party size, station locks and deadlines. For other service handling or delivery tasks, use `itpay catalog list --json` and the selected published operation/template. This catalog covers Services only: absence here does not prove an API/data capability is unavailable. API tasks use the independent API Skill and `itpay api
|
|
32
|
+
For railway travel, read `itpay docs show rail-booking` once before the first query. That guide owns endpoint understanding, reliable route knowledge versus targeted lookup, the pre-query 2–4 line brief and Exact/Smart choice. Preserve full administrative/place names, dates, party size, station locks and deadlines. For other service handling or delivery tasks, use `itpay catalog list --json` and the selected published operation/template. This catalog covers Services only: absence here does not prove an API/data capability is unavailable. API tasks use the independent API Skill and `itpay api list`. For an existing execution, use its current reader; do not start another query.
|
|
25
33
|
|
|
26
34
|
For purchased content use `itpay vault list --json` (optionally `--query`); for orders use `itpay orders --json` or the returned order reader. Clarify only genuine ambiguity between a new request and an earlier purchase. Explicit multi-service Carts have their separate `cart-checkout` guide; they are not the normal service purchase route.
|
|
27
35
|
|
|
@@ -46,3 +54,5 @@ Show the verified official URL or supported QR/native action in the same turn be
|
|
|
46
54
|
Payment unknown/pending, human attention and terminal facts stop automatic actions. Read the original Checkout/order only; never rotate identity, bypass locks, change scope to evade failure, or rebuild an uncertain purchase. Verified payment is not fulfillment. Railway ticket state and money state are separate; use `orders-refunds` for current railway aftercare versus ordinary refunds. Actual refund success requires the authoritative result.
|
|
47
55
|
|
|
48
56
|
Tell the human useful route, amount, limits, official entry and next human action in ordinary language. Keep internal commands/IDs out of routine replies and never expose credentials, tokens, codes or traveler data. Optional safe feedback follows delivery and never delays it.
|
|
57
|
+
|
|
58
|
+
New task-driven installations use one official Agent connection page. Each business credential is prepared only when needed; API access does not require Services setup. Existing profiles keep their original authorization path. A denied or revoked connection stops; only an explicit user request permits `agent --reconnect` for the same Agent/account. Account connection never increases a transaction price, spending cap or budget.
|
|
@@ -1,41 +1,50 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: itpay-api
|
|
3
|
-
description:
|
|
3
|
+
description: Browse the shared API market, call a shown product with consent, and read the original request and wallet.
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
# ItPay API
|
|
7
7
|
|
|
8
|
-
|
|
8
|
+
Development acceptance uses the official @itpay/cli@2.1.66 release. Check the actual launcher with --version before testing; if older, read https://dev.itpay.ai/agent and rerun its installer in the same tool prefix, preserving the original profile, account and requests. Direct old binaries do not automatically update. Production latest remains separate.
|
|
9
9
|
|
|
10
|
-
|
|
10
|
+
Use the official pinned CLI when this host permits execution. API calls and structured data use this Skill. Services, purchased delivery and aftercare use the separate Services Skill. Keep this installation's original launcher, profile, endpoint and real Agent Type across chats. A new chat keeps its existing identity.
|
|
11
11
|
|
|
12
|
-
|
|
12
|
+
The API business commands are categories, list, show, call, status and wallet. Connection and installation are separate. Use the selected installation from setup --api-prefix. Follow every returned next.command exactly, including its absolute --profile selector. Never clear credentials, change accounts or create a substitute request to recover quota or an unknown result.
|
|
13
13
|
|
|
14
|
-
|
|
14
|
+
## Start from the user's task
|
|
15
15
|
|
|
16
|
-
|
|
16
|
+
Do not ask the user to prepare ItPay first. If no CLI is installed, read https://dev.itpay.ai/agent inside the actual execution environment. Run the official `agent --task @<private-task-file> --surface api --json` entry, supplying your own actual `--agent-type` only when runtime detection needs it. This prepares this host's independent profile and saves the task before connection. Existing legacy profiles and credentials are preserved; never adopt another host's identity. Explicit existing request/profile continuations keep their original launcher instead.
|
|
17
17
|
|
|
18
|
-
|
|
18
|
+
Show the returned official link immediately. The entry emits the link and waits in the same call; use `--buffered` if this host cannot display streaming output, then run the returned next command immediately. Do not ask for permission to initiate the requested connection or tell the user to report "done". Only the person approves in the official page. `pending` or exit 0 is not connected. If the host ends the turn, any next reply resumes `agent` without a new task argument. Follow the saved original request status before continuing; an explicitly new user intent uses `--new-task`, retaining the prior receipt. Never restart after denial/cancellation without a new explicit intent.
|
|
19
19
|
|
|
20
|
-
|
|
20
|
+
## Find and consent
|
|
21
21
|
|
|
22
|
-
|
|
22
|
+
Use categories to read the website's real categories, including empty ones. Use list with the returned category ID or its label, and optional query. Follow the returned cursor for more products. Ordinary public shelves show USGS and Frankfurter. Test products appear only for a server-authorized test account with the server switch enabled.
|
|
23
23
|
|
|
24
|
-
|
|
24
|
+
Use show <operation_id> to read purpose, exact price, example input and result retention. Explain those facts and obtain consent before call. USGS time fields use absolute UTC ISO timestamps. Replace the example interval with the current requested interval, preserve the minimum magnitude and limit at most 100. Results capped at the limit are not an exhaustive catalogue. Frankfurter is daily reference data with its own date, not a live trading quote.
|
|
25
25
|
|
|
26
|
-
|
|
26
|
+
After consent use call <operation_id> --input '<JSON object>' (or @file / stdin). The CLI uses this installation's shown publication and price, saves the original request and supplies its ID. It does not re-inspect or invent a cap. A missing display requires show first. A price/publication change receipt shows the server-verified current price/currency and original zero-capture/zero-hold facts when confirmed. Keep the original request read-only, then show the current product and obtain explicit consent to the new price before a new call. If those facts are unavailable, status the original request first. Do not reuse the old price for a replacement.
|
|
27
27
|
|
|
28
|
-
|
|
28
|
+
## Follow the original request
|
|
29
29
|
|
|
30
|
-
|
|
30
|
+
status <request_id> only reads the original result, receipt and charge. An unknown state remains unknown until the owner reports facts. A result whose body has expired still has its fee receipt. Never create a new call, recharge or claim failure from a missing result or a network timeout.
|
|
31
31
|
|
|
32
|
+
call --pending <request_id> is the returned continuation form for this installation's original request. It preserves the stored operation, input, publication and idempotency key. It first reads the original request, reads an existing run, and only continues an eligible original intent. It waits in rounds of at most 120 seconds. Follow its next command while the human completes the original official action. A terminal result or null next ends waiting. Do not invent a continuation for an unknown write.
|
|
32
33
|
|
|
33
|
-
|
|
34
|
+
If refresh is explicitly rejected, follow the returned connect --request command for the same profile. Immediately run the returned connect continue waiting command while the human approves the original official link. Keep -- before an opaque handle. Wrong-account approval stops. Once credentials are freshly verified and saved, the next command is status of the original request. Follow its call --pending only when continuation is actually required. Network-unknown refresh preserves the original state and does not authorize another login or business request.
|
|
34
35
|
|
|
35
|
-
|
|
36
|
+
## Wallet and payment
|
|
36
37
|
|
|
37
|
-
|
|
38
|
+
wallet reads available and held atoms and provides the official proactive top-up URL. For “what have I used”, use wallet --usage or wallet --transactions: these report only the current Consumer/Key scope, with truncation where applicable. Known requests still use status. Full account funding, holds and cash refunds use owner_billing_url in the normal owner browser; do not use Computer Use to expand machine scope. Wallet balance is shared account money, not this consumer's authorization cap. Insufficient balance uses the original intent's official top-up page and original call --pending wait command. Funding never increases an explicit spending cap.
|
|
38
39
|
|
|
39
|
-
|
|
40
|
+
Only open a top-up when the user authorized funding. N6.2 acceptance uses fakepass-platform-2, simulated, CNY and the advertised minimum ¥10 SKU. A page or callback does not prove wallet credit. Read the original server request and final charge. Do not create another payment or replacement intent.
|
|
40
41
|
|
|
41
|
-
|
|
42
|
+
Present only returned official links and branded cards or their official rendered images. Never reconstruct, crop or encode a payment QR, request credentials in chat, or expose tokens or private request bodies.
|
|
43
|
+
|
|
44
|
+
New task-driven installations use one official Agent connection page. Each business credential is prepared only when needed; API access does not require Services setup. Existing profiles keep their original authorization path. A denied or revoked connection stops; only an explicit user request permits `agent --reconnect` for the same Agent/account. Account connection never increases a transaction price, spending cap or budget.
|
|
45
|
+
|
|
46
|
+
## API Key access
|
|
47
|
+
|
|
48
|
+
A user may securely inject ITPAY_HUB_KEY or import the selected Key with api credentials import through private stdin. Never ask for it in chat, put it in argv/logs, or echo it. A Key authorizes API Hub only within its catalog, effects and spending grant. It does not authorize Services or payment writes. An explicit environment Key wins over a saved OAuth connection; importing a Key selects it while preserving OAuth privately. An explicit normal connect selects OAuth. Never switch credentials to resume an existing request: its original task namespace remains isolated.
|
|
49
|
+
|
|
50
|
+
For an API task with a selected Key, agent prepares only that API installation and reads its identity without OAuth. Read wallet identity.credential_kind and account_hint before work; all hosts in a shared-wallet test must show the same hint. If mismatched, stop that new task and have the owner select the intended Key or normally reconnect the intended account; keep all existing requests and do not revoke another host. Invalid/revoked Key or insufficient scope directs the owner to /me/keys and secure stdin import, never automatic OAuth fallback. A top-up URL is navigation, not a created top-up; /hub/mcp is a protocol connection URL, not a payment page.
|