shopping-cli 3.0.2__tar.gz → 3.2.0__tar.gz

{shopping_cli-3.0.2/shopping_cli.egg-info → shopping_cli-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shopping-cli
-Version: 3.0.2
+Version: 3.2.0
 Summary: Standalone local-commerce AI consultation marketplace runtime
 License:                                  Apache License
                                    Version 2.0, January 2004

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "shopping-cli"
-version = "3.0.2"
+version = "3.2.0"
 description = "Standalone local-commerce AI consultation marketplace runtime"
 readme = "README.md"
 requires-python = ">=3.11"

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/__init__.py

@@ -1,3 +1,3 @@
 """Standalone shopping-cli consultation runtime."""
 
-VERSION = "3.0.2"
+VERSION = "3.2.0"

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/agents/merchant_daemon.py

@@ -180,11 +180,15 @@ class _PidFileLock:
 
     def __enter__(self) -> "_PidFileLock":
         self.lock_path.parent.mkdir(parents=True, exist_ok=True)
+        # 审查 P3-03：与日志/stop 文件对齐 0600（此前 0644）；os.open 的
+        # mode 只在新建时生效，已存在的遗留文件也显式 chmod（同
+        # _open_log_append 的 P2-07 模式）。
         self._fd = os.open(
             str(self.lock_path),
             os.O_RDWR | os.O_CREAT,
-            0o644,
+            0o600,
         )
+        os.chmod(self.lock_path, 0o600)
         if fcntl is not None:
             try:
                 fcntl.flock(self._fd, fcntl.LOCK_EX)

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/api/fastapi_routes.py

@@ -226,12 +226,21 @@ def register_fastapi_routes(app: Any, db_path: str | Path) -> None:
         return _update_product(db_path, sku, api_auth.payload_with_auth(payload, authorization))
 
     @app.get("/v1/merchant/listings/projections")
-    def merchant_listing_projections(merchant_id: str = "") -> dict[str, Any]:
-        return _list_listing_projections(db_path, {"merchant_id": merchant_id})
+    def merchant_listing_projections(
+        merchant_id: str = "",
+        authorization: str = AUTHORIZATION_HEADER,
+    ) -> dict[str, Any]:
+        # 审查 P2-B：handoff_destination 仅向所属商户本人开放（owner 判定在 handler）
+        return _list_listing_projections(
+            db_path, {"merchant_id": merchant_id}, api_auth.payload_with_auth({}, authorization)
+        )
 
     @app.get("/v1/merchant/listings/{sku}/projection")
-    def merchant_listing_projection(sku: str) -> dict[str, Any]:
-        return _get_listing_projection(db_path, sku)
+    def merchant_listing_projection(
+        sku: str,
+        authorization: str = AUTHORIZATION_HEADER,
+    ) -> dict[str, Any]:
+        return _get_listing_projection(db_path, sku, api_auth.payload_with_auth({}, authorization))
 
     @app.post("/v1/merchant/erp/sync")
     def merchant_erp_sync(

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/api/handlers/catalog.py

@@ -29,7 +29,6 @@ from .common import (
 )
 from shopping_cli.core import catalog_views
 
-
 def health(db_path: str | Path) -> dict[str, Any]:
     profile = deployment_profile_from()
     checks: dict[str, Any] = production_config_checks()
@@ -320,6 +319,7 @@ def create_product(
             tags=payload.get("tags") or [],
             description=str(payload.get("description") or ""),
             delivery_attributes=payload.get("delivery_attributes") or [],
+            handoff_destination=str(payload.get("handoff_destination") or ""),
         )
         return {"ok": True, "product": product}
 
@@ -346,6 +346,9 @@ def update_product(
             tags=payload.get("tags") if "tags" in payload else None,
             description=payload.get("description"),
             delivery_attributes=payload.get("delivery_attributes") if "delivery_attributes" in payload else None,
+            handoff_destination=payload.get("handoff_destination")
+            if "handoff_destination" in payload
+            else None,
         )
         return {"ok": True, "product": product}
 

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/api/handlers/conversations.py

@@ -74,7 +74,9 @@ def append_conversation_message(db_path: str | Path, conversation_id: str, paylo
 def close_conversation(db_path: str | Path, conversation_id: str, payload: dict[str, Any]) -> dict[str, Any]:
     with db_session(db_path) as conn:
         conversation = conversation_summary(conn, conversation_id)
-        sender = str(payload.get("sender") or "operator")
+        # 审查 S-H1：sender 缺省不得是 "operator"——商家用自己 token 不带
+        # sender 关会话会被误记为 operator。缺省回落到最诚实的 "merchant"。
+        sender = str(payload.get("sender") or "merchant")
         if sender in {"buyer", "buyer_cli"}:
             token_service.require_buyer_conversation_token(conn, conversation, _payload_token(payload))
         elif sender == "merchant":

shopping_cli-3.2.0/shopping_cli/api/handlers/listings_projection.py

@@ -0,0 +1,68 @@
+"""Listing 投影只读 API（shopping-cli v0.3 §14；Merchant Kiwi-compatible）。
+
+- GET /v1/merchant/listings/projections —— 可发布投影列表（public-only）；
+- GET /v1/merchant/listings/{sku}/projection —— 单条投影。
+
+公开读免鉴权（沿用 products 现状）；发布动作只经 CLI 不进 API（评审：
+写面保持 push-first 单向，API 不暴露发布副作用）。
+
+handoff_destination 是商家私有成交入口（审查 P2-B）：匿名/非本人读一律
+剥离；仅持商品所属商户本人有效 token 的调用保留（kiwi merchant agent
+发布/成交取数路径）。
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from shopping_cli.api.handlers.catalog import _owner_merchant_from_payload
+from shopping_cli.core.errors import NotFoundError, ValidationError
+from shopping_cli.db.session import db_session
+from shopping_cli.listings.projection import (
+    ProjectionError,
+    list_publishable_listings,
+    project_product_listing,
+)
+
+
+def list_listing_projections(
+    db_path: str | Path, query: dict[str, Any], payload: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    """GET /v1/merchant/listings/projections —— 可发布投影（public-only）。
+
+    必须带 ``merchant_id`` 过滤（审查 P3-01：无过滤的匿名枚举会暴露全部
+    商家的可发布投影）；匿名或 token 不属于该商户本人时剥离
+    handoff_destination（审查 P2-B）。
+    """
+    merchant_id = str(query.get("merchant_id") or "").strip()
+    if not merchant_id:
+        raise ValidationError("merchant_id is required")
+    with db_session(db_path) as conn:
+        owner = _owner_merchant_from_payload(conn, payload)
+        is_owner = bool(owner and owner == merchant_id)
+        # 审查 S-M3：私有剥离收进投影层（include_private）——此前调用方手动
+        # pop，CLI --format json 路径漏剥。
+        projections = list_publishable_listings(
+            conn, merchant_id=merchant_id, include_private=is_owner
+        )
+        return {"ok": True, "results": projections, "count": len(projections)}
+
+
+def get_listing_projection(db_path: str | Path, sku: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
+    """GET /v1/merchant/listings/{sku}/projection —— 单条投影。"""
+    sku = str(sku).strip()
+    if not sku:
+        raise ValidationError("sku is required")
+    with db_session(db_path) as conn:
+        row = conn.execute("select merchant_id from products where sku = ?", (sku,)).fetchone()
+        owner = _owner_merchant_from_payload(conn, payload)
+        is_owner = bool(
+            owner and row is not None and owner == str(row["merchant_id"] or "")
+        )
+        try:
+            # 审查 S-M3：私有剥离收进投影层（include_private）。
+            projection = project_product_listing(conn, sku, include_private=is_owner)
+        except ProjectionError as exc:
+            raise NotFoundError(str(exc)) from exc
+        return {"ok": True, "projection": projection}

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/api/handlers/negotiation.py

@@ -6,15 +6,51 @@ fallback ASGI router dispatch here, so no business logic is duplicated.
 
 from __future__ import annotations
 
+import os
+import threading
+import time
 from pathlib import Path
 from typing import Any
 
 from shopping_cli.api import auth as api_auth
 from shopping_cli.api.handlers.common import positive_whole_int, require_field
 from shopping_cli.core import negotiation as protocol
+from shopping_cli.core.errors import RateLimitError
 from shopping_cli.db.session import db_session
 from shopping_cli.services import negotiation as negotiation_service
 
+# 审查 S-M2：merchant/agent/negotiation/human-review 端点此前均无限流——已泄露/
+# 低熵 token 的滥用无节流。对磋商决策提交（写路径，追加磋商消息）加 per-owner
+# 固定窗口限流：进程内（单进程部署前提，与 ERP sync 限流同款）。env 可覆盖
+# （调用时读取，便于测试注入）。
+_NEGOTIATION_DECISION_WINDOW_SECONDS = 60
+_DECISION_RATE_LIMIT_DEFAULT_PER_MINUTE = 600
+_decision_buckets: dict[str, tuple[float, int]] = {}
+_decision_buckets_lock = threading.Lock()
+
+
+def _decision_rate_limit_per_minute() -> int:
+    raw = os.environ.get("SHOPPING_NEGOTIATION_DECISION_RATE_LIMIT_PER_MINUTE", "")
+    try:
+        value = int(raw)
+    except ValueError:
+        return _DECISION_RATE_LIMIT_DEFAULT_PER_MINUTE
+    return value if value > 0 else _DECISION_RATE_LIMIT_DEFAULT_PER_MINUTE
+
+
+def _enforce_decision_rate_limit(owner_id: str) -> None:
+    limit = _decision_rate_limit_per_minute()
+    now = time.monotonic()
+    with _decision_buckets_lock:
+        window_start, count = _decision_buckets.get(owner_id, (0.0, 0))
+        if now - window_start >= _NEGOTIATION_DECISION_WINDOW_SECONDS:
+            window_start, count = now, 0
+        if count >= limit:
+            raise RateLimitError(
+                f"negotiation decision rate limit exceeded ({limit}/minute)"
+            )
+        _decision_buckets[owner_id] = (window_start, count + 1)
+
 
 def _actor(conn: Any, payload: dict[str, Any]) -> negotiation_service.NegotiationActor:
     return negotiation_service.require_negotiation_actor(conn, api_auth.payload_token(payload))
@@ -60,6 +96,8 @@ def get_snapshot(db_path: str | Path, payload: dict[str, Any], query: dict[str,
 def submit_decision(db_path: str | Path, payload: dict[str, Any]) -> dict[str, Any]:
     with db_session(db_path) as conn:
         actor = _actor(conn, payload)
+        # 审查 S-M2：per-owner 固定窗口限流（决策提交=磋商消息追加，滥用最直接）。
+        _enforce_decision_rate_limit(actor.owner_id)
         policy_result = negotiation_service.submit_decision(
             conn,
             actor,

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/api/idempotency.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 import json
+import os
 import sqlite3
 from datetime import datetime
 from typing import Any
@@ -15,6 +16,11 @@ from shopping_cli.db.session import decode_json, encode_json, now_iso
 
 DEFAULT_BUYER_BOOTSTRAP_RATE_LIMIT_PER_MINUTE = 60
 BUYER_BOOTSTRAP_RATE_LIMIT_WINDOW_SECONDS = 60
+# 审查 S-M1：保留桶（sentinel buyer_id）承载共享 token 的全局硬上限——
+# buyer_id 完全客户端声明，轮换即可绕过单买家限流；全局桶任何请求都计数。
+BUYER_BOOTSTRAP_GLOBAL_BUCKET = "__global__"
+# 全局硬上限 = 单买家上限 × 该倍数（轮换 buyer_id 无法越过的兜底）。
+DEFAULT_BUYER_BOOTSTRAP_GLOBAL_LIMIT_MULTIPLIER = 100
 MAX_IDEMPOTENCY_KEY_LENGTH = 160
 MAX_SQLITE_INTEGER = 2**63 - 1
 
@@ -87,6 +93,41 @@ def rate_limit_window_start(current: datetime) -> str:
     return datetime.fromtimestamp(window_epoch).replace(microsecond=0).isoformat()
 
 
+def _buyer_bootstrap_global_limit_multiplier() -> int:
+    """全局硬上限倍数（env 可覆盖，测试注入用；非法/非正回退缺省）。"""
+    raw = os.environ.get("SHOPPING_BUYER_BOOTSTRAP_GLOBAL_LIMIT_MULTIPLIER", "")
+    try:
+        value = int(raw)
+    except ValueError:
+        return DEFAULT_BUYER_BOOTSTRAP_GLOBAL_LIMIT_MULTIPLIER
+    return value if value > 0 else DEFAULT_BUYER_BOOTSTRAP_GLOBAL_LIMIT_MULTIPLIER
+
+
+def _bump_window(
+    conn: Any,
+    token_hash: str,
+    bucket: str,
+    window_start: str,
+    limit: int,
+    current: datetime,
+    label: str,
+) -> None:
+    """给 (token_hash, bucket, window) 计数 +1；超过 limit 抛 RateLimitError。"""
+    cursor = conn.execute(
+        """
+        insert into buyer_bootstrap_rate_limits(token_hash, buyer_id, window_start, request_count, updated_at)
+        values (?, ?, ?, 1, ?)
+        on conflict(token_hash, buyer_id, window_start) do update set
+            request_count = buyer_bootstrap_rate_limits.request_count + 1,
+            updated_at = excluded.updated_at
+        where buyer_bootstrap_rate_limits.request_count < ?
+        """,
+        (token_hash, bucket, window_start, current.isoformat(), limit),
+    )
+    if cursor.rowcount != 1:
+        raise RateLimitError(f"{label} rate limit exceeded ({limit}/minute)")
+
+
 def enforce_buyer_bootstrap_rate_limit(
     conn: Any,
     bootstrap_token_hash: str,
@@ -124,19 +165,24 @@ def enforce_buyer_bootstrap_rate_limit(
     except sqlite3.OperationalError:
         # 清理失败不影响限流本身（fail-safe 方向；下次再试）
         pass
-    cursor = conn.execute(
-        """
-        insert into buyer_bootstrap_rate_limits(token_hash, buyer_id, window_start, request_count, updated_at)
-        values (?, ?, ?, 1, ?)
-        on conflict(token_hash, buyer_id, window_start) do update set
-            request_count = buyer_bootstrap_rate_limits.request_count + 1,
-            updated_at = excluded.updated_at
-        where buyer_bootstrap_rate_limits.request_count < ?
-        """,
-        (bootstrap_token_hash, buyer_id, rate_limit_window_start(current), current.isoformat(), limit),
+    window_start = rate_limit_window_start(current)
+    # 单买家窗口（买家维度预算隔离）
+    _bump_window(
+        conn, bootstrap_token_hash, buyer_id, window_start, limit, current, "buyer bootstrap"
+    )
+    # 全局硬上限（审查 S-M1）：同一 token 的全部请求（无论 buyer_id）都计入
+    # 保留桶——buyer_id 完全客户端声明、轮换即可绕过单买家限流，全局桶轮换
+    # 无法绕过。
+    global_limit = limit * _buyer_bootstrap_global_limit_multiplier()
+    _bump_window(
+        conn,
+        bootstrap_token_hash,
+        BUYER_BOOTSTRAP_GLOBAL_BUCKET,
+        window_start,
+        global_limit,
+        current,
+        "buyer bootstrap global",
     )
-    if cursor.rowcount != 1:
-        raise RateLimitError(f"buyer bootstrap rate limit exceeded ({limit}/minute)")
 
 
 def idempotency_row(

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/api/route_table.py

@@ -88,16 +88,18 @@ def _get_product(db_path: str | Path, sku: str, payload: dict[str, Any] | None =
     return catalog_handlers.get_product(db_path, sku, payload)
 
 
-def _list_listing_projections(db_path: str | Path, query: dict[str, Any]) -> dict[str, Any]:
-    return listings_projection_handlers.list_listing_projections(db_path, query)
+def _list_listing_projections(
+    db_path: str | Path, query: dict[str, Any], payload: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    return listings_projection_handlers.list_listing_projections(db_path, query, payload)
 
 
 def _sync_erp(db_path: str | Path, payload: dict[str, Any]) -> dict[str, Any]:
     return erp_handlers.sync_erp(db_path, payload)
 
 
-def _get_listing_projection(db_path: str | Path, sku: str) -> dict[str, Any]:
-    return listings_projection_handlers.get_listing_projection(db_path, sku)
+def _get_listing_projection(db_path: str | Path, sku: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
+    return listings_projection_handlers.get_listing_projection(db_path, sku, payload)
 
 
 def _search_products(db_path: str | Path, query: dict[str, Any], payload: dict[str, Any] | None = None) -> dict[str, Any]:
@@ -402,12 +404,12 @@ _ROUTE_TABLE: tuple[RouteEntry, ...] = (
     RouteEntry(
         {"GET"},
         "/v1/merchant/listings/projections",
-        lambda db_path, payload, query, **kw: _list_listing_projections(db_path, query or {}),
+        lambda db_path, payload, query, **kw: _list_listing_projections(db_path, query or {}, payload),
     ),
     RouteEntry(
         {"GET"},
         "/v1/merchant/listings/{sku}/projection",
-        lambda db_path, payload, query, sku: _get_listing_projection(db_path, sku),
+        lambda db_path, payload, query, sku: _get_listing_projection(db_path, sku, payload),
     ),
     RouteEntry(
         {"POST"},

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/cli.py

@@ -65,6 +65,7 @@ from shopping_cli.cli_conversation_commands import (
 )
 from shopping_cli.cli_erp_commands import cmd_erp_sync
 from shopping_cli.cli_listing_commands import cmd_listing_projections_list
+from shopping_cli.cli_adapter_commands import cmd_adapters_list, cmd_import_csv_excel
 from shopping_cli.config import ConfigError, DEFAULT_DB_PATH, validate_production_config
 from shopping_cli.core.catalog import require_merchant
 from shopping_cli.core.conversations import merchant_conversations
@@ -854,6 +855,23 @@ def build_parser() -> argparse.ArgumentParser:
     erp_sync.add_argument("--format", choices=["text", "json"], default="text")
     erp_sync.set_defaults(func=cmd_erp_sync)
 
+    # ── adapters（Issue 14 / §6.3：Adapter SDK 注册表）────────────────────
+    adapters = subparsers.add_parser("adapters", help="Registered data source adapters (Adapter SDK)")
+    adapters_sub = adapters.add_subparsers(dest="adapters_command", required=True)
+    adapters_list = adapters_sub.add_parser("list", help="List registered adapters")
+    adapters_list.add_argument("--format", choices=["text", "json"], default="text")
+    adapters_list.set_defaults(func=cmd_adapters_list)
+
+    # ── import-csv-excel（Issue 14 / §6.3：首条接入路径）─────────────────
+    import_csv = subparsers.add_parser(
+        "import-csv-excel", help="Import product facts from CSV / Excel (.xlsx) into the local store"
+    )
+    import_csv.add_argument("--file", required=True, help="Path to .csv / .tsv / .xlsx file")
+    import_csv.add_argument("--merchant", default="", dest="merchant", help="Owning merchant id (required, FK guard)")
+    import_csv.add_argument("--allowed-merchant", default="", dest="allowed_merchant", help="Tenant boundary: only rows of this merchant are written")
+    import_csv.add_argument("--format", choices=["text", "json"], default="text")
+    import_csv.set_defaults(func=cmd_import_csv_excel)
+
     # ── listings（shopping-cli v0.3 §14：PublicListingProjection 只读预览）───
     listings = subparsers.add_parser("listings", help="Product-first listing projections (read-only preview)")
     listings_sub = listings.add_subparsers(dest="listings_command", required=True)

shopping_cli-3.2.0/shopping_cli/cli_adapter_commands.py

@@ -0,0 +1,49 @@
+"""Adapter SDK CLI（Issue 14 / §6.3）。
+
+``shopping adapters list``            —— 列出已注册数据源适配器
+``shopping import-csv-excel ...``     —— 运行 CSV/Excel 适配器（首条接入路径）
+"""
+
+from __future__ import annotations
+
+import argparse
+
+from shopping_cli.cli_common import db_path_from_args, emit
+from shopping_cli.data_sources import csv_excel_source  # noqa: F401  # 导入即注册适配器
+from shopping_cli.data_sources.adapter import (
+    AdapterError,
+    SyncContext,
+    registered_adapters,
+    run,
+)
+from shopping_cli.db.session import db_session
+
+
+def cmd_adapters_list(args: argparse.Namespace) -> None:
+    """列出已注册适配器（Adapter SDK 注册表）。"""
+    emit(
+        [{"name": a.name, "description": a.description} for a in registered_adapters().values()],
+        args.format,
+    )
+
+
+def cmd_import_csv_excel(args: argparse.Namespace) -> None:
+    """运行 CSV/Excel 适配器导入本地 products 表。"""
+    db_path = db_path_from_args(args)
+    merchant_id = str(args.merchant or "").strip() or str(args.default_merchant or "").strip()
+    if not merchant_id:
+        raise SystemExit("--merchant is required (FK 归属防护)")
+    with db_session(db_path) as conn:
+        ctx = SyncContext(
+            conn=conn,
+            default_merchant_id=merchant_id,
+            allowed_merchant_id=str(args.allowed_merchant or "").strip(),
+            config={"path": args.file},
+        )
+        report = run("csv_excel", ctx)
+    emit(report.as_dict(), args.format)
+    if report.errors or report.conflicts:
+        raise SystemExit(
+            f"csv_excel import completed with {len(report.errors)} errors and "
+            f"{len(report.conflicts)} conflicts (see report above)"
+        )

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/core/catalog.py

@@ -6,6 +6,7 @@ import math
 import re
 import sqlite3
 from typing import Any, Mapping
+from urllib.parse import urlparse
 
 from shopping_cli.core.errors import ConflictError, NotFoundError, ValidationError
 from shopping_cli.core.harness import append_audit_event
@@ -114,6 +115,27 @@ def _whole_int(value: Any, message: str) -> int:
 
 # safe_non_negative_int / safe_non_negative_float are imported from core.limits
 
+# 审查 P2-A：可无 ``://`` 出现的危险伪 scheme，一律拒绝（opaque 放行见下）。
+_BLOCKED_HANDOFF_SCHEMES = frozenset({"javascript", "data", "file", "vbscript", "blob"})
+
+
+def _validate_handoff_destination(value: str) -> None:
+    """handoff_destination 形态校验（审查 P2-A）。
+
+    空值允许；值呈现 URL 形态（含 ``://``）必须是合法 http/https origin，
+    拒绝其他一切 scheme；``javascript:``/``data:`` 等危险伪 scheme 即使
+    无 ``://`` 也拒绝；纯 opaque 引用串（chat-id、文档引用等）原样允许。
+    """
+    if not value:
+        return
+    parsed = urlparse(value)
+    scheme = parsed.scheme.lower()
+    if "://" in value:
+        if scheme not in ("http", "https") or not parsed.hostname:
+            raise ValidationError("handoff destination URL must be a valid http(s) origin")
+    elif scheme in _BLOCKED_HANDOFF_SCHEMES:
+        raise ValidationError(f"handoff destination scheme is not allowed: {scheme}")
+
 
 def _audit_catalog(conn: sqlite3.Connection, merchant_id: str, event: str, details: dict) -> None:
     """catalog 写操作审计（conversation_id=''——非会话域事件）。
@@ -329,6 +351,7 @@ def create_product(
     category = bounded_text(category, "product category", MAX_SHORT_TEXT_CHARS)
     currency = bounded_text(currency, "currency", 16)
     handoff_destination = bounded_text(handoff_destination, "handoff destination", MAX_PERSISTED_TEXT_CHARS)
+    _validate_handoff_destination(handoff_destination)
     if not merchant_id:
         raise ValidationError("merchant id is required")
     if not sku:
@@ -405,6 +428,7 @@ def update_product(
         handoff_destination = bounded_text(
             handoff_destination, "handoff destination", MAX_PERSISTED_TEXT_CHARS
         )
+        _validate_handoff_destination(handoff_destination)
     if price is not None:
         price = _price_with_precision(price, "--price must be finite")
     if stock is not None:
@@ -606,6 +630,7 @@ def _product_summary_from_search_row(row: sqlite3.Row) -> dict[str, Any]:
         "currency": row["currency"],
         "stock": _safe_non_negative_int(row["stock"]),
         "delivery_attributes": decode_json(row["delivery_attributes_json"], []),
+        "handoff_destination": row["handoff_destination"] or "",
         "merchant": merchant,
         "delivery": merchant["delivery"],
         "warnings": product_warnings(row, merchant),

{shopping_cli-3.0.2 → shopping_cli-3.2.0}/shopping_cli/core/catalog_views.py

@@ -21,10 +21,15 @@ def public_product_summary(product: dict[str, Any]) -> dict[str, Any]:
     出网精确 stock，可逐 SKU 枚举全平台库存）。需要精确库存的商家走
     merchant_product_summary（handler 层 owner 鉴权门）。
 
+    handoff_destination 是商家私有成交入口（谈判达成后由商家 Agent 点对点
+    交给买家），公开/匿名投影一律剥离（审查 P2-B），同款纪律参照
+    public_merchant_summary 剥离 contact；认证商家读走 merchant_product_summary。
+
     对已投影数据幂等：含 ``stock`` 时替换为 availability_hint；不含则保留
     已有 hint（审查 P1-02：幂等回放响应二次投影不丢失 in_stock）。
     """
     summary = dict(product)
+    summary.pop("handoff_destination", None)
     if "stock" in summary:
         stock = summary.pop("stock", None)
         summary["availability_hint"] = (