@xiashe/cli 0.1.8 → 0.1.10

package/README.md

@@ -17,20 +17,40 @@ node packages/xiashe-cli/bin/xiashe.mjs login --email you@example.com --password
 xiashe skills list
 xiashe skills install copywriting --connection MaxClaw-1 --watch
 xiashe agent issue --name "Local WorkBuddy"
-xiashe agent connect --token "<token>" --name "Local WorkBuddy"
+xiashe agent connect --token "<token>" --name "Local WorkBuddy" --transport npx
 xiashe agent run --ack
 xiashe chat send --chat "New Chat" --content "帮我处理这个文件" --file ./report.pdf --agent "Local WorkBuddy"
-xiashe skills publish draft . --source xiashe --registry-public-skill-id "<registry.skillId>"
+xiashe skills publish draft . --source xiashe
 xiashe skills publish doctor "<submission-id>"
 xiashe skills publish submit "<submission-id>"
+xiashe payment doctor
+# After the Agent shows the Skill and purpose and the user explicitly agrees:
+xiashe payment pay --resource-url "https://<actions-site>/payment/alipay-ai-collect?orderId=<id>" --intent-summary "使用付费 Skill：<name>" --confirm
+xiashe payment status --resource-url "https://<actions-site>/payment/alipay-ai-collect?orderId=<id>"
 ```
 
 Local state is stored in `~/.xiashe/config.json`.
 
+`skills publish draft` reads `.xiashe/xiashe.skill.json` when present. If the local CLI is not signed in, it can create or reuse the XiaShe Store draft with that registry public token; creator login is only required when the registry token is missing or rejected.
+
 `xiashe agent run --ack` is the recommended lightweight receiver for shell-capable Agents. It sends cheap heartbeats and only lists/executes work when the backend reports pending tasks or transfers. Default cadence is about 30s while idle, 10s while work is active, and up to 2 minutes after long idle periods.
 
+Supported transport labels are `a2a`, `mcp`, `http`, `npx`, `claw`, and `manual`. The label is advisory for routing and diagnostics; the runtime token, task lease, ack, and complete events remain the source of truth.
+
 Production defaults:
 
 - Convex: `https://api.xiashe.chat`
 - Actions: `https://actions.xiashe.chat`
 - Relay: `https://relay.xiashe.chat`
+
+## Alipay AI Pay local bridge
+
+`xiashe payment` is the shell-capable Agent path for Alipay AI Pay. It delegates only to the official local `alipay-bot` supplied by `@alipay/agent-payment`; it does not implement or expose `Payment-Needed` / `Payment-Proof` itself.
+
+- `xiashe payment doctor` checks whether the local wallet is enabled.
+- `xiashe payment pay` requires an HTTPS AI-Collect resource URL, a visible purchase-purpose summary, and `--confirm`. The command then waits for the user to approve in Alipay App.
+- `xiashe payment status` returns a normalized status only. No wallet protocol payload or proof is printed.
+
+An Agent must never add `--confirm` before the user has explicitly agreed to the displayed purpose. If the wallet is unavailable, obtain permission before running the official `@alipay/agent-payment` setup, then run `payment doctor` again.
+
+For a clean Codex Task, the XiaShe MCP response provides a version-pinned ephemeral command such as `npx -y @xiashe/cli@0.1.10 payment doctor`. No global `xiashe` installation is required for that path.

package/bin/xiashe.mjs

@@ -34,7 +34,10 @@ const {
   postJson,
   mcpCall,
   decodeMcpToolResult,
-  nowIso
+  nowIso,
+  checkAlipayWallet,
+  payAlipay402Resource,
+  queryAlipay402Resource
 } = sdk;
 
 const EXIT_USAGE = 2;
@@ -75,7 +78,7 @@ Usage:
   ${c} skills publish release <submission-id>
 
   ${c} agent issue [--name <name>] [--kind <kind>] [--json]
-  ${c} agent connect --token <token> [--name <name>] [--kind <kind>] [--webhook-url <https-url>] [--webhook-token <secret>]
+  ${c} agent connect --token <token> [--name <name>] [--kind <kind>] [--transport a2a|mcp|http|npx|claw|manual] [--webhook-url <https-url>] [--webhook-token <secret>]
   ${c} agent heartbeat [--webhook-url <https-url>] [--webhook-token <secret>|--disable-webhook]
   ${c} agent list
   ${c} agent revoke --agent <id-or-name>
@@ -92,6 +95,10 @@ Usage:
   ${c} files upload <path>
   ${c} files list
 
+  ${c} payment doctor
+  ${c} payment pay --resource-url <https-url> --intent-summary <text> --confirm
+  ${c} payment status --resource-url <https-url>
+
   ${c} ops doctor
 
 Global flags:
@@ -580,17 +587,47 @@ async function cmdSkillPublish(flags, client, global) {
   if (action === 'draft' || action === 'create') {
     const skillDir = flags._[1] && !String(flags._[1]).startsWith('--') ? flags._[1] : '.';
     const draft = await inferPublishDraft(skillDir, flags, client);
+    const printableDraft = redactPublishDraft(draft);
     const result = await client.createSkillSubmissionDraft(draft);
     if (global.json) {
-      print({ ok: true, ...result, draft }, global);
+      print({ ok: true, ...result, draft: printableDraft }, global);
+      return;
+    }
+    if (result.reused) {
+      print(
+        [
+          `Reused existing Skill submission: ${result.submissionId}`,
+          `Status: ${result.status || 'existing'}`,
+          `Name: ${printableDraft.name}`,
+          `Registry: ${printableDraft.registryPublicSkillId || printableDraft.registryEntryId || 'attached'}`,
+          '',
+          'Duplicate XiaShe Store upload was skipped. Continue with registry/runtime verification and external platform preparation.'
+        ].join('\n'),
+        global
+      );
+      return;
+    }
+    if (result.searchable || result.skillCatalogId) {
+      print(
+        [
+          `Published searchable Skill listing: ${result.skillCatalogId || result.submissionId}`,
+          `Submission: ${result.submissionId}`,
+          `Name: ${printableDraft.name}`,
+          `Market: ${printableDraft.market}`,
+          `Source fingerprint: ${printableDraft.packageSha256 || 'not attached'}`,
+          '',
+          'No extra creator login is required. Continue with Red Skill upload and Agent Ack verification.'
+        ].join('\n'),
+        global
+      );
       return;
     }
     print(
       [
         `Created Skill submission draft: ${result.submissionId}`,
-        `Name: ${draft.name}`,
-        `Market: ${draft.market}`,
-        `Source fingerprint: ${draft.packageSha256}`,
+        `Name: ${printableDraft.name}`,
+        `Market: ${printableDraft.market}`,
+        `Source fingerprint: ${printableDraft.packageSha256}`,
         '',
         `Next: ${COMMAND_NAME} skills publish doctor ${result.submissionId}`,
         `Then: ${COMMAND_NAME} skills publish submit ${result.submissionId}`
@@ -620,7 +657,12 @@ async function cmdSkillPublish(flags, client, global) {
       print(result, global);
       return;
     }
-    print(`Submitted Skill for review: ${submissionId}`, global);
+    print(
+      result.searchable
+        ? `Published searchable Skill listing: ${result.skillCatalogId || submissionId}`
+        : `Submitted Skill for review: ${submissionId}`,
+      global
+    );
     return;
   }
   if (action === 'admin-list') {
@@ -660,6 +702,13 @@ async function cmdSkillPublish(flags, client, global) {
   fail(`Unknown skills publish command: ${action}`, EXIT_USAGE);
 }
 
+function redactPublishDraft(draft) {
+  const clean = { ...draft };
+  delete clean._registryPublicToken;
+  delete clean.registryPublicToken;
+  return clean;
+}
+
 async function watchSkillJob(client, connectionId, jobId, global) {
   const deadline = Date.now() + Number(global.watchTimeoutMs || 180_000);
   let latest = null;
@@ -1092,6 +1141,33 @@ async function cmdFiles(sub, args, global) {
   fail(`Unknown files command: ${sub}`, EXIT_USAGE);
 }
 
+async function cmdPayment(sub, args, global) {
+  const flags = parseFlags(args);
+  if (sub === 'doctor' || sub === 'wallet' || sub === 'wallet-status') {
+    const result = await checkAlipayWallet({ timeoutMs: global.timeoutMs });
+    print(result, global);
+    return;
+  }
+  if (sub === 'pay') {
+    const resourceUrl = requireArg(flags['resource-url'] || flags.resourceUrl || flags.r, '--resource-url');
+    const intentSummary = requireArg(flags['intent-summary'] || flags.intentSummary || flags.i, '--intent-summary');
+    const result = await payAlipay402Resource({
+      resourceUrl,
+      intentSummary,
+      confirm: flags.confirm === true
+    }, { timeoutMs: global.timeoutMs });
+    print(result, global);
+    return;
+  }
+  if (sub === 'status') {
+    const resourceUrl = requireArg(flags['resource-url'] || flags.resourceUrl || flags.r, '--resource-url');
+    const result = await queryAlipay402Resource({ resourceUrl }, { timeoutMs: global.timeoutMs });
+    print(result, global);
+    return;
+  }
+  fail(`Usage: ${COMMAND_NAME} payment doctor|pay|status`, EXIT_USAGE);
+}
+
 async function cmdOps(sub, args, global) {
   const flags = parseFlags(args);
   const { client } = await makeClient(global);
@@ -1221,6 +1297,10 @@ async function inferPublishDraft(skillDir, flags, client) {
   const packageJson = await readJson(path.join(root, 'package.json'));
   const skillMd = await readSmallText(path.join(root, 'SKILL.md'));
   const readme = await readSmallText(path.join(root, 'README.md'));
+  const registryManifest =
+    await readJson(path.join(root, '.xiashe', 'xiashe.skill.json')) ||
+    await readJson(path.join(root, 'xiashe.skill.json'));
+  const registry = registryManifest?.registry || {};
   const text = `${skillMd}\n\n${readme}`;
   const digest = await hashPublishDirectory(root);
   const name = flags.name || packageJson?.name || firstHeading(text) || path.basename(root);
@@ -1251,7 +1331,8 @@ async function inferPublishDraft(skillDir, flags, client) {
     category: flags.category || undefined,
     tags: parseCsv(flags.tags),
     registryEntryId: flags['registry-entry'] || flags.registryEntryId || undefined,
-    registryPublicSkillId: flags['registry-public-skill-id'] || flags.registryPublicSkillId || undefined,
+    registryPublicSkillId: flags['registry-public-skill-id'] || flags.registryPublicSkillId || registry.skillId || undefined,
+    _registryPublicToken: flags['registry-public-token'] || flags.registryPublicToken || registry.publicToken || undefined,
     packageSha256: digest.sha256
   };
 }
@@ -1301,6 +1382,7 @@ async function main() {
     if (command === 'agent' || command === 'agents') return await cmdAgent(sub, args, global);
     if (command === 'chat' || command === 'chats') return await cmdChat(sub, args, global);
     if (command === 'files' || command === 'file') return await cmdFiles(sub, args, global);
+    if (command === 'payment' || command === 'payments') return await cmdPayment(sub, args, global);
     if (command === 'ops') return await cmdOps(sub, args, global);
     fail(`Unknown command: ${command}\n\n${usage()}`, EXIT_USAGE);
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "bin": {
     "xiashe": "bin/xiashe.mjs"
@@ -10,7 +10,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@xiashe/sdk": "0.1.7"
+    "@xiashe/sdk": "0.1.10"
   },
   "engines": {
     "node": ">=20"