@xiashe/sdk 0.1.15 → 0.1.17

package/alipayWallet.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { execFile } from 'node:child_process';
-import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -10,6 +10,8 @@ const MAX_OUTPUT_BYTES = 32 * 1024;
 const SENSITIVE_OUTPUT = /payment[-_ ]?proof|payment[-_ ]?needed|seller_signature|runtimeToken|authorization\s*:/i;
 const SENSITIVE_USER_OUTPUT = /payment[-_ ]?proof|payment[-_ ]?needed|seller_signature|runtimeToken|authorization\s*:|trade[_ -]?no|交易(?:流水)?号|out[_ -]?shake|client[_ -]?session|payguard|validateclientparent|agentfamily/i;
 const DEFAULT_STATE_DIR = path.join(os.homedir(), '.xiashe', 'alipay-402');
+const OFFICIAL_MEDIA_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.webp']);
+const MAX_OFFICIAL_MEDIA_BYTES = 8 * 1024 * 1024;
 
 export class AlipayWalletError extends Error {
   constructor(code, message, options = {}) {
@@ -176,7 +178,11 @@ function paymentStatusFromOutput(stdout, stderr) {
   const output = `${stdout}\n${stderr}`;
   const completed = /支付(?:已)?成功|交易成功|支付已完成|payment\s+(?:was\s+)?(?:successful|completed)|(?:resource|资源).*(?:obtained|success|成功)/i.test(output);
   const pending = /支付待确认|等待.*确认|待确认|支付处理中|pending(?:\s+confirmation)?|waiting.*confirm/i.test(output);
-  const failed = /支付失败|交易失败|payment\s+failed/i.test(output);
+  // The official CLI sometimes returns a JSON error object with exit code 0.
+  // Treat an explicit unsuccessful result as failed so callers retain the
+  // normalized failure category instead of misleadingly reporting an unknown
+  // wallet state.
+  const failed = /支付失败|交易失败|payment\s+failed|"success"\s*:\s*false|"errorCode"\s*:/i.test(output);
   return {
     status: completed ? 'completed' : pending ? 'pending_confirmation' : failed ? 'failed' : 'unknown',
     credential: queryCredentialFromOutput(output),
@@ -189,14 +195,31 @@ function userVisibleWalletOutput(stdout, stderr) {
     .replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, '')
     .split(/\r?\n/)
     .map((line) => line.trim())
-    .filter((line) => line && !SENSITIVE_USER_OUTPUT.test(line))
+    .filter((line) => line && !line.startsWith('MEDIA:') && !SENSITIVE_USER_OUTPUT.test(line))
     .slice(0, 12);
   return lines.length ? lines.join('\n').slice(0, 1_200) : null;
 }
 
+/** Preserve only an image emitted by the official wallet in this invocation. */
+async function officialWalletMedia(stdout, stderr) {
+  const mediaLine = `${stdout}\n${stderr}`.split(/\r?\n/).find((line) => line.trim().startsWith('MEDIA:'));
+  if (!mediaLine) return null;
+  const candidate = mediaLine.slice(mediaLine.indexOf('MEDIA:') + 'MEDIA:'.length).trim();
+  if (!candidate || !path.isAbsolute(candidate) || !OFFICIAL_MEDIA_EXTENSIONS.has(path.extname(candidate).toLowerCase())) {
+    return null;
+  }
+  try {
+    const file = await stat(candidate);
+    return file.isFile() && file.size > 0 && file.size <= MAX_OFFICIAL_MEDIA_BYTES ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+
 function walletFailureCode(stdout, stderr, exitCode) {
   const output = `${stdout}\n${stderr}`;
   if (/TRADE_PROGRESS_FAILED/i.test(output)) return 'wallet_trade_progress_failed';
+  if (/payment[_ -]?needed[_ -]?rejected|账单.*(?:被拒绝|拒绝)|bill.*(?:rejected|denied)/i.test(output)) return 'payment_needed_rejected';
   if (/余额不足|insufficient\s+balance/i.test(output)) return 'insufficient_balance';
   if (/已过期|过期|expired/i.test(output)) return 'payment_expired';
   if (/钱包.*(?:未开启|未授权)|wallet.*(?:not\s+enabled|not\s+authorized)/i.test(output)) return 'wallet_not_ready';
@@ -216,11 +239,14 @@ function paymentMessage(status) {
 
 function paymentFailureMessage(failureCode) {
   if (failureCode === 'wallet_trade_progress_failed') {
-    return '支付宝钱包未能创建可确认的交易；未授予付费 Skill 权益。请在重新加载后的受支持 Agent 环境中重试。';
+    return '支付宝钱包未能创建可确认的交易；未授予付费 Skill 权益。官方钱包没有给出可归因的原因，不能据此判断为 Agent 不受支持、账单签名错误或已扣款；请勿重复付款。';
   }
   if (failureCode === 'wallet_runtime_not_supported') {
     return '当前 Agent 运行环境不支持支付宝 AI付；未授予付费 Skill 权益。';
   }
+  if (failureCode === 'payment_needed_rejected') {
+    return '支付宝端拒绝了本次付款账单，未创建交易、未扣款。请确认该 APPID 已在支付宝完成 AI按量付费的服务注册、密钥配置、技术集成确认与线上验证前置步骤；若这些均已完成，请提交支付宝问题反馈并附上本次发生时间。';
+  }
   return '支付宝官方钱包没有生成可确认的付款状态；未授予付费 Skill 权益。';
 }
 
@@ -268,6 +294,10 @@ function publicPaymentResult(state, status, diagnostic, options = {}) {
     message: failed ? paymentFailureMessage(failureCode) : paymentMessage(status),
     diagnostic,
     ...(options.userVisible ? { userVisible: options.userVisible } : {}),
+    ...(options.officialMedia ? { officialMedia: options.officialMedia } : {}),
+    ...(status === 'pending_confirmation'
+      ? { confirmation: { source: 'official_alipay_wallet', surface: 'app_or_official_media', required: true } }
+      : { confirmation: { source: 'official_alipay_wallet', required: false } }),
     ...(commandFailed ? { failureCode } : {})
   };
 }
@@ -341,6 +371,10 @@ export async function payAlipay402Resource(input, options = {}) {
 
   const walletInvocation = await runOfficialCli([
     '402-buyer-pay',
+    // The official buyer CLI accepts this long form of -s/-f/-r. The file
+    // name is intentionally private and random; the exact Payment-Needed
+    // content, original resource URL, and generated UUID session are what
+    // define the payment request.
     '--session-id', state.sessionId,
     '--file', state.paymentNeededPath,
     '--resource-url', resourceUrl,
@@ -349,6 +383,9 @@ export async function payAlipay402Resource(input, options = {}) {
   const result = paymentStatusFromOutput(walletInvocation.stdout, walletInvocation.stderr);
   const commandFailed = walletInvocation.exitCode !== 0 && result.status === 'unknown';
   const status = commandFailed ? 'wallet_command_failed' : result.status;
+  const officialMedia = ['pending_confirmation', 'completed'].includes(status)
+    ? await officialWalletMedia(walletInvocation.stdout, walletInvocation.stderr)
+    : null;
   state.status = status;
   state.queryCredential = result.credential;
   state.updatedAt = new Date().toISOString();
@@ -360,7 +397,8 @@ export async function payAlipay402Resource(input, options = {}) {
     failureCode: failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : undefined,
     userVisible: ['pending_confirmation', 'completed'].includes(status)
       ? userVisibleWalletOutput(walletInvocation.stdout, walletInvocation.stderr)
-      : null
+      : null,
+    officialMedia
   });
 }
 
@@ -374,6 +412,7 @@ export async function queryAlipay402Resource(input, options = {}) {
       status: 'no_active_payment',
       provider: 'alipay-agent-payment',
       walletInvoked: false,
+      confirmation: { source: 'official_alipay_wallet', required: false },
       message: '没有可查询的本地支付宝付款记录；请重新发起付款，不要把付款凭证粘贴到对话中。',
       diagnostic: 'payment_state_not_found'
     };
@@ -389,6 +428,9 @@ export async function queryAlipay402Resource(input, options = {}) {
   const result = paymentStatusFromOutput(walletInvocation.stdout, walletInvocation.stderr);
   const commandFailed = walletInvocation.exitCode !== 0 && result.status === 'unknown';
   const status = commandFailed ? 'wallet_command_failed' : result.status;
+  const officialMedia = ['pending_confirmation', 'completed'].includes(status)
+    ? await officialWalletMedia(walletInvocation.stdout, walletInvocation.stderr)
+    : null;
   state.status = status;
   state.queryCredential = result.credential || state.queryCredential;
   state.updatedAt = new Date().toISOString();
@@ -403,6 +445,7 @@ export async function queryAlipay402Resource(input, options = {}) {
     failureCode: failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : undefined,
     userVisible: ['pending_confirmation', 'completed'].includes(status)
       ? userVisibleWalletOutput(walletInvocation.stdout, walletInvocation.stderr)
-      : null
+      : null,
+    officialMedia
   });
 }

package/index.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { ConvexHttpClient } from 'convex/browser';
 import { anyApi as api } from 'convex/server';
 
-export const VERSION = '0.1.15';
+export const VERSION = '0.1.17';
 
 export const DEFAULTS = {
   cn: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/sdk",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "main": "index.mjs",
   "exports": {