@seasonkoh/webaz 0.1.5 → 0.1.6

package/dist/layer1-agent/L1-1-mcp-server/server.js

@@ -590,23 +590,24 @@ function handleUpdateOrder(args) {
     const notes = args.notes ?? '';
     const evidenceDesc = args.evidence_description ?? '';
     // 验证订单存在且该用户是参与方
-    const order = db
+    let order = db
         .prepare('SELECT * FROM orders WHERE id = ?')
         .get(orderId);
     if (!order)
         return { error: `订单不存在：${orderId}` };
+    // 物流首次操作：先绑定再做参与方检查
+    if ((action === 'pickup' || action === 'transit') &&
+        !order.logistics_id &&
+        user.role === 'logistics') {
+        db.prepare('UPDATE orders SET logistics_id = ? WHERE id = ?').run(user.id, orderId);
+        order = db.prepare('SELECT * FROM orders WHERE id = ?').get(orderId);
+    }
     const isParticipant = order.buyer_id === user.id ||
         order.seller_id === user.id ||
         order.logistics_id === user.id;
     if (!isParticipant && user.role !== 'arbitrator') {
         return { error: '你不是这笔订单的参与方，无法操作' };
     }
-    // 如果是物流首次操作，绑定物流方
-    if ((action === 'pickup' || action === 'transit') &&
-        order.logistics_id === null &&
-        user.role === 'logistics') {
-        db.prepare('UPDATE orders SET logistics_id = ? WHERE id = ?').run(user.id, orderId);
-    }
     // action → 状态映射
     const actionMap = {
         accept: 'accepted',

package/dist/pwa/server.js

@@ -208,7 +208,9 @@ app.get('/api/orders/:id', (req, res) => {
     if (!statusInfo)
         return void res.status(404).json({ error: '订单不存在' });
     const order = statusInfo.order;
-    if (order.buyer_id !== user.id && order.seller_id !== user.id && order.logistics_id !== user.id && user.role !== 'arbitrator') {
+    const isLogisticsPickup = user.role === 'logistics' &&
+        !order.logistics_id && order.status === 'shipped';
+    if (order.buyer_id !== user.id && order.seller_id !== user.id && order.logistics_id !== user.id && user.role !== 'arbitrator' && !isLogisticsPickup) {
         return void res.status(403).json({ error: '无权查看此订单' });
     }
     const product = db.prepare('SELECT title, price, images FROM products WHERE id = ?').get(order.product_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seasonkoh/webaz",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Agent-native decentralized commerce protocol. Humans and AI agents trade on the same protocol via MCP tools.",
   "main": "dist/mcp.js",
   "bin": {