@xiashe/cli 0.1.29 → 0.1.31

package/README.md

@@ -26,8 +26,10 @@ xiashe skills publish submit "<submission-id>"
 # This checks only that the bridge CLI is present; it does not query a wallet.
 xiashe payment bridge-info
 # After the Agent shows the Skill and purpose and the user explicitly agrees:
-xiashe payment pay --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>" --intent-summary "使用付费 Skill：<name>" --confirm
+xiashe payment pay --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>" --intent-summary "使用付费 Skill：<name>" --session-id "<active-agent-session>" --confirm
 xiashe payment status --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>"
+# Only for an Alipay support-assisted read-only query. This is not out_trade_no or Payment-Proof.
+xiashe payment status --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>" --business-no "<32-digit outShakeNo with 8282 in positions 11–14>"
 ```
 
 Local state is stored in `~/.xiashe/config.json`.
@@ -48,11 +50,11 @@ Production defaults:
 
 `xiashe payment` is the shell-capable Agent path for Alipay AI Pay. It delegates only to the official local `alipay-bot` supplied by `@alipay/agent-payment`; it does not implement or expose `Payment-Needed` / `Payment-Proof` itself.
 
-- `xiashe payment bridge-info` checks only that the official buyer CLI can run. It does not check wallet authorization, merchant activation, or whether a transaction can be created. `payment doctor` remains a manual wallet-status diagnostic only.
-- `xiashe payment pay` requests the resource once, saves its exact 402 request in a private local file, and passes that file plus one stable session id to the official buyer CLI. It requires an HTTPS AI-Collect resource URL, a visible purchase-purpose summary, and `--confirm`.
-- `xiashe payment status` resumes the same local attempt with its official query credential and returns a normalized status only. No wallet protocol payload or proof is printed. A QR or confirmation image is exposed only as `officialMedia` when the official wallet emitted that image in the same invocation; the bridge never generates one itself.
+- `xiashe payment bridge-info` checks that the official buyer CLI can run and exposes the buyer-pay/status command contract required by the bridge. It does not check wallet authorization, merchant activation, or whether a transaction can be created. `payment doctor` remains a manual wallet-status diagnostic only.
+- `xiashe payment pay` requests the resource once, saves its exact 402 request in a private local file, and passes that file plus the current Agent business-session ID to the official buyer CLI. It requires an HTTPS AI-Collect resource URL, a visible purchase-purpose summary, `--session-id`, and `--confirm`; it never generates a replacement session ID.
+- `xiashe payment status` resumes the same local attempt with its official query credential and returns a normalized status only. If Alipay support provides the documented 32-digit `outShakeNo` (with `8282` in positions 11–14, sometimes called a business order number), use `--out-shake-no` or `--business-no` for one read-only status query; it is validated, never stored, and cannot create a payment or acknowledge fulfillment. No wallet protocol payload or proof is printed. A QR or confirmation image is exposed only as `officialMedia` when the official wallet emitted that image in the same invocation; the bridge never generates one itself.
 - `xiashe payment preflight` requests the seller resource once and validates the public field shape of its 402 bill without opening a wallet or creating a trade. It does not prove that Alipay accepts the seller signature, service binding, or merchant activation. `xiashe payment diagnose` is read-only. It reports the last stored safe diagnosis for that local attempt, including allow-listed official error/sub-codes, message, and request/trace identifiers when present, without contacting Alipay, replaying the resource, or exposing its local query credential.
 
 An Agent must never add `--confirm` before the user has explicitly agreed to the displayed purpose. If the wallet is unavailable, obtain permission before running the official `@alipay/agent-payment` setup, then run `payment doctor` again.
 
-For a clean Codex Task, the XiaShe MCP response provides a version-pinned ephemeral command such as `npx -y @xiashe/cli@0.1.24 payment bridge-info`. No global `xiashe` installation is required for that path. Run the supplied preflight command before requesting payment confirmation, then run the payment and status commands exactly as supplied in the foreground. The Agent must inspect bridge JSON instead of suppressing output or guessing status from shell text. Failed attempts include a redacted `diagnosis` object and `userVisible` next step; do not replace them with a generic payment-failed message.
+For a clean Codex Task, the XiaShe MCP response provides a version-pinned ephemeral command such as `npx -y @xiashe/cli@0.1.31 payment bridge-info`. No global `xiashe` installation is required for that path. Run the supplied preflight command before requesting payment confirmation, then run the payment and status commands exactly as supplied in the foreground. The Agent must inspect bridge JSON instead of suppressing output or guessing status from shell text. Failed attempts include a redacted `diagnosis` object and `userVisible` next step; do not replace them with a generic payment-failed message.

package/bin/xiashe.mjs

@@ -103,8 +103,8 @@ Usage:
 
   ${c} payment bridge-info|doctor
   ${c} payment preflight --resource-url <https-url>
-  ${c} payment pay --resource-url <https-url> --intent-summary <text> --confirm [--wallet-timeout-ms <ms>]
-  ${c} payment status --resource-url <https-url>
+  ${c} payment pay --resource-url <https-url> --intent-summary <text> --session-id <active-agent-session> --confirm [--wallet-timeout-ms <ms>]
+  ${c} payment status --resource-url <https-url> [--out-shake-no <32-digit-8282>|--business-no <32-digit-8282>]
   ${c} payment diagnose --resource-url <https-url>
   ${c} payment support-report --resource-url <https-url>
 
@@ -1208,9 +1208,11 @@ async function cmdPayment(sub, args, global) {
   if (sub === 'pay') {
     const resourceUrl = requireArg(flags['resource-url'] || flags.resourceUrl || flags.r, '--resource-url');
     const intentSummary = requireArg(flags['intent-summary'] || flags.intentSummary || flags.i, '--intent-summary');
+    const sessionId = requireArg(flags['session-id'] || flags.sessionId, '--session-id');
     const result = await payAlipay402Resource({
       resourceUrl,
       intentSummary,
+      sessionId,
       confirm: flags.confirm === true
     }, walletTimeoutMs ? { timeoutMs: walletTimeoutMs } : {});
     print(result, global);
@@ -1218,7 +1220,15 @@ async function cmdPayment(sub, args, global) {
   }
   if (sub === 'status') {
     const resourceUrl = requireArg(flags['resource-url'] || flags.resourceUrl || flags.r, '--resource-url');
-    const result = await queryAlipay402Resource({ resourceUrl }, { timeoutMs: global.timeoutMs });
+    const outShakeNo = flags['out-shake-no'] || flags.outShakeNo;
+    const businessNo = flags['business-no'] || flags.businessNo;
+    if (outShakeNo && businessNo && String(outShakeNo) !== String(businessNo)) {
+      fail('Use one matching --out-shake-no or --business-no value.', EXIT_USAGE);
+    }
+    const result = await queryAlipay402Resource({
+      resourceUrl,
+      ...(outShakeNo || businessNo ? { outShakeNo: outShakeNo || businessNo } : {})
+    }, { timeoutMs: global.timeoutMs });
     print(result, global);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/cli",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "type": "module",
   "bin": {
     "xiashe": "bin/xiashe.mjs"
@@ -10,7 +10,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@xiashe/sdk": "0.1.29"
+    "@xiashe/sdk": "0.1.31"
   },
   "engines": {
     "node": ">=20"