@xiashe/sdk 0.1.16 → 0.1.18

package/alipayWallet.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { execFile } from 'node:child_process';
-import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -10,6 +10,15 @@ const MAX_OUTPUT_BYTES = 32 * 1024;
 const SENSITIVE_OUTPUT = /payment[-_ ]?proof|payment[-_ ]?needed|seller_signature|runtimeToken|authorization\s*:/i;
 const SENSITIVE_USER_OUTPUT = /payment[-_ ]?proof|payment[-_ ]?needed|seller_signature|runtimeToken|authorization\s*:|trade[_ -]?no|交易(?:流水)?号|out[_ -]?shake|client[_ -]?session|payguard|validateclientparent|agentfamily/i;
 const DEFAULT_STATE_DIR = path.join(os.homedir(), '.xiashe', 'alipay-402');
+const OFFICIAL_MEDIA_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.webp']);
+const MAX_OFFICIAL_MEDIA_BYTES = 8 * 1024 * 1024;
+const SAFE_OFFICIAL_FAILURE_CODES = new Set([
+  'TRADE_PROGRESS_FAILED',
+  'PAYMENT_NEEDED_REJECTED',
+  'SYSTEM_ERROR',
+  'BUYER_IDENTITY_REJECTED',
+  'WALLET_NOT_READY'
+]);
 
 export class AlipayWalletError extends Error {
   constructor(code, message, options = {}) {
@@ -176,7 +185,11 @@ function paymentStatusFromOutput(stdout, stderr) {
   const output = `${stdout}\n${stderr}`;
   const completed = /支付(?:已)?成功|交易成功|支付已完成|payment\s+(?:was\s+)?(?:successful|completed)|(?:resource|资源).*(?:obtained|success|成功)/i.test(output);
   const pending = /支付待确认|等待.*确认|待确认|支付处理中|pending(?:\s+confirmation)?|waiting.*confirm/i.test(output);
-  const failed = /支付失败|交易失败|payment\s+failed/i.test(output);
+  // The official CLI sometimes returns a JSON error object with exit code 0.
+  // Treat an explicit unsuccessful result as failed so callers retain the
+  // normalized failure category instead of misleadingly reporting an unknown
+  // wallet state.
+  const failed = /支付失败|交易失败|payment\s+failed|"success"\s*:\s*false|"errorCode"\s*:/i.test(output);
   return {
     status: completed ? 'completed' : pending ? 'pending_confirmation' : failed ? 'failed' : 'unknown',
     credential: queryCredentialFromOutput(output),
@@ -189,14 +202,31 @@ function userVisibleWalletOutput(stdout, stderr) {
     .replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, '')
     .split(/\r?\n/)
     .map((line) => line.trim())
-    .filter((line) => line && !SENSITIVE_USER_OUTPUT.test(line))
+    .filter((line) => line && !line.startsWith('MEDIA:') && !SENSITIVE_USER_OUTPUT.test(line))
     .slice(0, 12);
   return lines.length ? lines.join('\n').slice(0, 1_200) : null;
 }
 
+/** Preserve only an image emitted by the official wallet in this invocation. */
+async function officialWalletMedia(stdout, stderr) {
+  const mediaLine = `${stdout}\n${stderr}`.split(/\r?\n/).find((line) => line.trim().startsWith('MEDIA:'));
+  if (!mediaLine) return null;
+  const candidate = mediaLine.slice(mediaLine.indexOf('MEDIA:') + 'MEDIA:'.length).trim();
+  if (!candidate || !path.isAbsolute(candidate) || !OFFICIAL_MEDIA_EXTENSIONS.has(path.extname(candidate).toLowerCase())) {
+    return null;
+  }
+  try {
+    const file = await stat(candidate);
+    return file.isFile() && file.size > 0 && file.size <= MAX_OFFICIAL_MEDIA_BYTES ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+
 function walletFailureCode(stdout, stderr, exitCode) {
   const output = `${stdout}\n${stderr}`;
   if (/TRADE_PROGRESS_FAILED/i.test(output)) return 'wallet_trade_progress_failed';
+  if (/payment[_ -]?needed[_ -]?rejected|账单.*(?:被拒绝|拒绝)|bill.*(?:rejected|denied)/i.test(output)) return 'payment_needed_rejected';
   if (/余额不足|insufficient\s+balance/i.test(output)) return 'insufficient_balance';
   if (/已过期|过期|expired/i.test(output)) return 'payment_expired';
   if (/钱包.*(?:未开启|未授权)|wallet.*(?:not\s+enabled|not\s+authorized)/i.test(output)) return 'wallet_not_ready';
@@ -207,6 +237,81 @@ function walletFailureCode(stdout, stderr, exitCode) {
   return Number.isInteger(exitCode) && exitCode !== 0 ? 'official_cli_nonzero_exit' : 'official_cli_unclassified';
 }
 
+/**
+ * The official wallet can return useful machine error codes alongside protocol
+ * material. Expose only a small allow-list: arbitrary vendor output can carry
+ * credentials, URLs, trade identifiers, or PayGuard internals.
+ */
+function safeOfficialFailureCode(stdout, stderr) {
+  const output = `${stdout}\n${stderr}`;
+  const candidate = output.match(/(?:"(?:errorCode|code)"|\b(?:errorCode|code)\b)\s*[:=]\s*["']?([A-Z][A-Z0-9_]{2,80})/i)?.[1]?.toUpperCase() || '';
+  return SAFE_OFFICIAL_FAILURE_CODES.has(candidate) ? candidate : null;
+}
+
+function paymentFailureDiagnosis(failureCode, stdout, stderr) {
+  const officialCode = safeOfficialFailureCode(stdout, stderr);
+  const base = {
+    code: failureCode,
+    stage: 'official_wallet_trade_creation',
+    nextStep: '不要重复付款；保留诊断代码和本次 attemptId 以便定位。'
+  };
+  if (failureCode === 'payment_needed_rejected') {
+    return {
+      ...base,
+      stage: 'alipay_bill_validation',
+      nextStep: '核对支付宝平台中该 APPID 的应用公钥、service_id、收款方 2088 seller_id 和线上接入状态；修复后必须创建新订单再测试。',
+      ...(officialCode ? { officialCode } : {})
+    };
+  }
+  if (failureCode === 'wallet_runtime_not_supported') {
+    return {
+      ...base,
+      stage: 'agent_runtime_identity',
+      nextStep: '当前运行时没有通过支付宝 Agent 身份校验；请换用已被官方钱包识别并已授权的本地 Agent 运行时。',
+      ...(officialCode ? { officialCode } : {})
+    };
+  }
+  if (failureCode === 'buyer_identity_rejected') {
+    return {
+      ...base,
+      stage: 'buyer_identity_validation',
+      nextStep: '支付宝钱包的买家身份未通过校验；完成钱包授权后，用同一受支持运行时创建新订单。',
+      ...(officialCode ? { officialCode } : {})
+    };
+  }
+  if (failureCode === 'wallet_not_ready') {
+    return {
+      ...base,
+      stage: 'wallet_authorization',
+      nextStep: '支付宝钱包未完成授权或未启用；先完成官方钱包授权，再创建新订单。',
+      ...(officialCode ? { officialCode } : {})
+    };
+  }
+  if (failureCode === 'wallet_network_error') {
+    return {
+      ...base,
+      stage: 'wallet_network',
+      nextStep: '钱包或网络请求没有完成；先检查网络，再创建新订单。',
+      ...(officialCode ? { officialCode } : {})
+    };
+  }
+  return {
+    ...base,
+    ...(officialCode ? { officialCode } : {})
+  };
+}
+
+function paymentFailureUserVisible(diagnosis) {
+  const lines = [
+    '支付宝付款未创建可确认交易。',
+    `诊断代码：${diagnosis.code}`,
+    `失败阶段：${diagnosis.stage}`,
+    ...(diagnosis.officialCode ? [`官方返回代码：${diagnosis.officialCode}`] : []),
+    `下一步：${diagnosis.nextStep}`
+  ];
+  return lines.join('\n');
+}
+
 function paymentMessage(status) {
   if (status === 'completed') return '支付宝钱包显示本次付款已完成；正在由服务端确认权益。';
   if (status === 'pending_confirmation') return '支付宝已发起本次付款确认；请打开支付宝 App 完成确认，然后运行 status。';
@@ -221,6 +326,9 @@ function paymentFailureMessage(failureCode) {
   if (failureCode === 'wallet_runtime_not_supported') {
     return '当前 Agent 运行环境不支持支付宝 AI付；未授予付费 Skill 权益。';
   }
+  if (failureCode === 'payment_needed_rejected') {
+    return '支付宝端拒绝了本次付款账单，未创建交易、未扣款。请确认该 APPID 已在支付宝完成 AI按量付费的服务注册、密钥配置、技术集成确认与线上验证前置步骤；若这些均已完成，请提交支付宝问题反馈并附上本次发生时间。';
+  }
   return '支付宝官方钱包没有生成可确认的付款状态；未授予付费 Skill 权益。';
 }
 
@@ -259,6 +367,7 @@ function publicPaymentResult(state, status, diagnostic, options = {}) {
   const commandFailed = options.commandFailed === true;
   const failureCode = options.failureCode || 'official_cli_nonzero_exit';
   const failed = status === 'failed' || status === 'wallet_command_failed';
+  const diagnosis = failed ? options.diagnosis : null;
   return {
     ok: !failed,
     status,
@@ -267,7 +376,12 @@ function publicPaymentResult(state, status, diagnostic, options = {}) {
     walletInvoked: true,
     message: failed ? paymentFailureMessage(failureCode) : paymentMessage(status),
     diagnostic,
-    ...(options.userVisible ? { userVisible: options.userVisible } : {}),
+    ...(failed && diagnosis ? { userVisible: paymentFailureUserVisible(diagnosis), diagnosis } : {}),
+    ...(!failed && options.userVisible ? { userVisible: options.userVisible } : {}),
+    ...(options.officialMedia ? { officialMedia: options.officialMedia } : {}),
+    ...(status === 'pending_confirmation'
+      ? { confirmation: { source: 'official_alipay_wallet', surface: 'app_or_official_media', required: true } }
+      : { confirmation: { source: 'official_alipay_wallet', required: false } }),
     ...(commandFailed ? { failureCode } : {})
   };
 }
@@ -341,6 +455,10 @@ export async function payAlipay402Resource(input, options = {}) {
 
   const walletInvocation = await runOfficialCli([
     '402-buyer-pay',
+    // The official buyer CLI accepts this long form of -s/-f/-r. The file
+    // name is intentionally private and random; the exact Payment-Needed
+    // content, original resource URL, and generated UUID session are what
+    // define the payment request.
     '--session-id', state.sessionId,
     '--file', state.paymentNeededPath,
     '--resource-url', resourceUrl,
@@ -349,18 +467,24 @@ export async function payAlipay402Resource(input, options = {}) {
   const result = paymentStatusFromOutput(walletInvocation.stdout, walletInvocation.stderr);
   const commandFailed = walletInvocation.exitCode !== 0 && result.status === 'unknown';
   const status = commandFailed ? 'wallet_command_failed' : result.status;
+  const officialMedia = ['pending_confirmation', 'completed'].includes(status)
+    ? await officialWalletMedia(walletInvocation.stdout, walletInvocation.stderr)
+    : null;
   state.status = status;
   state.queryCredential = result.credential;
   state.updatedAt = new Date().toISOString();
   await writePaymentState(state, options);
   if (status === 'completed') await rm(paths.paymentNeededPath, { force: true });
   const failed = commandFailed || status === 'failed';
+  const failureCode = failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : undefined;
   return publicPaymentResult(state, status, result.diagnostic, {
     commandFailed: failed,
-    failureCode: failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : undefined,
+    failureCode,
+    diagnosis: failed ? paymentFailureDiagnosis(failureCode, walletInvocation.stdout, walletInvocation.stderr) : undefined,
     userVisible: ['pending_confirmation', 'completed'].includes(status)
       ? userVisibleWalletOutput(walletInvocation.stdout, walletInvocation.stderr)
-      : null
+      : null,
+    officialMedia
   });
 }
 
@@ -374,6 +498,7 @@ export async function queryAlipay402Resource(input, options = {}) {
       status: 'no_active_payment',
       provider: 'alipay-agent-payment',
       walletInvoked: false,
+      confirmation: { source: 'official_alipay_wallet', required: false },
       message: '没有可查询的本地支付宝付款记录；请重新发起付款，不要把付款凭证粘贴到对话中。',
       diagnostic: 'payment_state_not_found'
     };
@@ -389,6 +514,9 @@ export async function queryAlipay402Resource(input, options = {}) {
   const result = paymentStatusFromOutput(walletInvocation.stdout, walletInvocation.stderr);
   const commandFailed = walletInvocation.exitCode !== 0 && result.status === 'unknown';
   const status = commandFailed ? 'wallet_command_failed' : result.status;
+  const officialMedia = ['pending_confirmation', 'completed'].includes(status)
+    ? await officialWalletMedia(walletInvocation.stdout, walletInvocation.stderr)
+    : null;
   state.status = status;
   state.queryCredential = result.credential || state.queryCredential;
   state.updatedAt = new Date().toISOString();
@@ -398,11 +526,14 @@ export async function queryAlipay402Resource(input, options = {}) {
     await rm(paymentNeededPath, { force: true });
   }
   const failed = commandFailed || status === 'failed';
+  const failureCode = failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : undefined;
   return publicPaymentResult(state, status, result.diagnostic, {
     commandFailed: failed,
-    failureCode: failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : undefined,
+    failureCode,
+    diagnosis: failed ? paymentFailureDiagnosis(failureCode, walletInvocation.stdout, walletInvocation.stderr) : undefined,
     userVisible: ['pending_confirmation', 'completed'].includes(status)
       ? userVisibleWalletOutput(walletInvocation.stdout, walletInvocation.stderr)
-      : null
+      : null,
+    officialMedia
   });
 }

package/index.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { ConvexHttpClient } from 'convex/browser';
 import { anyApi as api } from 'convex/server';
 
-export const VERSION = '0.1.16';
+export const VERSION = '0.1.18';
 
 export const DEFAULTS = {
   cn: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/sdk",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "type": "module",
   "main": "index.mjs",
   "exports": {