@danceiny/gotry 0.0.1-rc.15 → 0.0.1-rc.17

package/dist/src/tool-budget.js

@@ -0,0 +1,136 @@
+import { randomUUID } from 'node:crypto';
+export const TOOL_BUDGET_SOFT_CALL = 16;
+export const TOOL_BUDGET_HARD_CALL = 18;
+export const TOOL_BUDGET_EXHAUSTED = 'TOOL_BUDGET_EXHAUSTED';
+export function toolBudgetDecision(callNumber) {
+    if (callNumber > TOOL_BUDGET_HARD_CALL) {
+        return {
+            kind: 'deny',
+            reason: `${TOOL_BUDGET_EXHAUSTED}: maximum ${TOOL_BUDGET_HARD_CALL} real tool dispatches per agent turn reached; provide a final answer using existing results`
+        };
+    }
+    return {
+        kind: 'allow',
+        softSignal: callNumber === TOOL_BUDGET_SOFT_CALL,
+        exhaustsBudget: callNumber === TOOL_BUDGET_HARD_CALL
+    };
+}
+export function createToolBudgetState() {
+    let calls = 0;
+    return {
+        nextCall () {
+            calls += 1;
+            return {
+                ...toolBudgetDecision(calls),
+                callNumber: calls
+            };
+        }
+    };
+}
+function convergenceContext(code, text) {
+    return {
+        id: randomUUID(),
+        role: 'user',
+        content: [
+            {
+                type: 'text',
+                text: `${code}: ${text}`
+            }
+        ],
+        source: {
+            kind: 'plugin',
+            plugin: 'gotry-tool-budget'
+        }
+    };
+}
+function exhaustionResult(reason) {
+    return {
+        isError: true,
+        error: {
+            message: reason,
+            info: {
+                name: 'ToolBudgetError',
+                code: TOOL_BUDGET_EXHAUSTED
+            }
+        },
+        content: [
+            {
+                type: 'text',
+                text: reason
+            }
+        ],
+        additionalContexts: [
+            convergenceContext(TOOL_BUDGET_EXHAUSTED, 'No more tool dispatches are permitted in this turn. Produce the final answer from existing results.')
+        ]
+    };
+}
+export function installToolBudget(ctx) {
+    if (typeof ctx.on !== 'function') return;
+    const budgetByAgent = new Map();
+    const softExecutions = new Map();
+    const pendingFinalOnly = new Map();
+    const finalOnlyDisposers = new Map();
+    const clearAgent = (agentId)=>{
+        budgetByAgent.delete(agentId);
+        for (const [token, owner] of softExecutions){
+            if (owner === agentId) softExecutions.delete(token);
+        }
+        pendingFinalOnly.delete(agentId);
+        finalOnlyDisposers.get(agentId)?.();
+        finalOnlyDisposers.delete(agentId);
+    };
+    const enterFinalOnly = (agent)=>{
+        const agentId = String(agent.id);
+        if (finalOnlyDisposers.has(agentId)) return;
+        const globalTools = ctx.tools;
+        const scopedTools = agent.ctx?.tools;
+        if (typeof globalTools.schemas !== 'function' || typeof scopedTools?.restrict !== 'function') return;
+        const inheritedNames = globalTools.schemas().map((schema)=>schema.name).filter((name)=>name !== 'run_code');
+        if (inheritedNames.length === 0) return;
+        finalOnlyDisposers.set(agentId, scopedTools.restrict({
+            deny: inheritedNames
+        }));
+    };
+    ctx.on('session/event', (subject, event)=>{
+        const agentId = String(subject.id);
+        if (event.type === 'turn/start' || event.type === 'turn/end') {
+            clearAgent(agentId);
+            return;
+        }
+        if (event.type === 'step/end') {
+            const agent = pendingFinalOnly.get(agentId);
+            if (agent) {
+                pendingFinalOnly.delete(agentId);
+                enterFinalOnly(agent);
+            }
+        }
+    });
+    ctx.on('session/disposed', (subject)=>clearAgent(String(subject.id)));
+    ctx.on('tools/execute', (exec, next)=>{
+        if (!exec.agent) return next();
+        const agentId = String(exec.agent.id);
+        const state = budgetByAgent.get(agentId) ?? createToolBudgetState();
+        budgetByAgent.set(agentId, state);
+        const decision = state.nextCall();
+        if (decision.kind === 'deny') {
+            pendingFinalOnly.set(agentId, exec.agent);
+            return Promise.resolve(exhaustionResult(decision.reason));
+        }
+        if (decision.softSignal) softExecutions.set(exec.token, agentId);
+        if (decision.exhaustsBudget) pendingFinalOnly.set(agentId, exec.agent);
+        return next();
+    });
+    ctx.on('tools/post-execute', (exec, _result, next)=>{
+        if (!softExecutions.delete(exec.token)) return next();
+        return next().then((decision)=>({
+                ...decision,
+                additionalContexts: [
+                    ...decision.additionalContexts ?? [],
+                    convergenceContext('TOOL_BUDGET_SOFT', 'Tool call 16 reached. Converge now and produce the final answer from gathered evidence.')
+                ]
+            }));
+    });
+}
+
+
+//# sourceURL=ts/src/tool-budget.ts

package/dist/src/tool-packet.js

@@ -9,4 +9,4 @@ export function interpretArgs(args, stringKey) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/tool-packet.ts
+//# sourceURL=ts/src/tool-packet.ts

package/dist/src/travel-slots.js

@@ -141,4 +141,4 @@ export function scoreExtraction(expected, actual) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/travel-slots.ts
+//# sourceURL=ts/src/travel-slots.ts

package/dist/src/travel-timeline.js

@@ -75,4 +75,4 @@ export function timelineGapsForVerified(timeline, verifiedWishes) {
 export { ymd };
 
 
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/travel-timeline.ts
+//# sourceURL=ts/src/travel-timeline.ts

package/dist/src/unified.js

@@ -588,4 +588,4 @@ function renderCandidateMarkdown(req, verdicts, recommended) {
 export { minToHhmm };
 
 
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/unified.ts
+//# sourceURL=ts/src/unified.ts

package/dist/src/wish-pool.js

@@ -24,4 +24,4 @@ export function pickNudgeWish(pool, ctx) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/wish-pool.ts
+//# sourceURL=ts/src/wish-pool.ts

package/dist/src/z3-shared.js

@@ -15,4 +15,4 @@ export async function withZ3(label, session) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/z3-shared.ts
+//# sourceURL=ts/src/z3-shared.ts

package/extension/README.md

@@ -0,0 +1,50 @@
+# GoTry Session Bridge(浏览器扩展)
+
+一次性安装的会话检索数据面(issue #21 传输层方案 C,2026-08-29 founder 定案):在你**自己的** Chrome 登录态里,只读嗅探携程机票检索回包([会话:ctrip-flight]。gotry 不再需要逐连接弹 Chrome 权限框,也不需要开 `chrome://inspect` 远程调试。
+
+## 它做什么 / 不做什么
+
+- ✅ 检索:你(或 agent)发起会话检索时,后台标签页打开携程机票列表页,被动嗅探页面自己发出的 `batchSearch` 响应,文本回传给本机的 gotry。收尾自动关闭自己开的标签。
+- ✅ 登录检查:只读登录票据 cookie 的**名字**(cticket/uid/uname/passport),判断「是否已登录」这个布尔事实。
+- ✅ 登录引导:把登录入口页**置前台**打开,登录由你在携程官网完成。
+- ❌ **不读取、不存储、不回传任何 cookie 值,不接触密码/验证码**;
+- ❌ 不向任何站点发起请求(检索请求由站点页面自己发出,扩展只听不写);
+- ❌ 不动你已打开的任何标签页(只创建/关闭自己的检索标签;登录标签留给你)。
+
+## 安装(每台浏览器一次)
+
+### 方式一(推荐):Chrome 应用商店一键安装
+
+打开商店页点「添加至 Chrome」即可,零开发者模式、零手动加载,**自动更新**:
+
+**https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd**
+
+商店版经 Google 审核上架(2026-09-02),版本跟随商店发版节奏。
+
+### 方式二:GitHub Releases 本地加载(免审核,版本更新更快)
+
+不经商店审核,版本化 tarball + SHA256 校验,与 npm 发版节奏解耦,更新比商店快:
+
+```bash
+npx gotry setup --extension-from=github   # 自动下载校验并落位 ~/.gotry/extension
+```
+
+(或手动:从 [github.com/Danceiny/gotry/releases](https://github.com/Danceiny/gotry/releases) 标签 `ext-*` 下载 `gotry-session-bridge.tar.gz` 解压到任意固定位置。)
+
+然后在 Chrome 地址栏打开 `chrome://extensions` → 右上角开启「开发者模式」→ 点「加载已解压的扩展程序」选择该目录。
+
+### 方式三:npm 包内副本本地加载(离线确定性)
+
+```bash
+npx gotry setup   # 把包内扩展落位到 ~/.gotry/extension
+```
+
+再按方式二的 `chrome://extensions` 三步加载该目录。
+
+装好即生效,无任何系统弹窗。卸载/随时可停:扩展卡片上的开关即是总闸(仍受 gotry 授权闸 `sessionAccess` 双重控制)。
+
+## 自检
+
+- 商店版扩展 ID 固定为 `oeajpiccmonococjcegddlooeeohlbgd`(商店用自己的签名 key,与 unpacked 版 ID 不同,二者都是同一扩展,本机 gotry 桥双通道同信);
+- 本地加载(unpacked)版扩展 ID 应为固定的 `olpgkofjhhiiiahdkkbcninhjmegghfe`(manifest 带 `key`,跨机器稳定)——若不一致,说明 manifest 被改动过,不要加载;
+- gotry 侧运行 `npx gotry` 后发起一次会话检索,扩展图标应出现(无需点击);桥状态可看 `curl http://127.0.0.1:8791/status`(仅本机回环)。

package/extension/background.js

@@ -0,0 +1,160 @@
+/**
+ * GoTry Session Bridge — MV3 Service Worker(RFC user-session-data-rfc.md §2.2 通道 C,2026-08-29 定案为 PRIMARY 传输)。
+ *
+ * 职责(与 Node 侧 session/extension-bridge.ts 配对,零构建纯 JS):
+ *   - 长轮询取活:POST /jobs(桥最多 hold 20s;每次响应/失败都重置 SW 30s 生命周期,任务秒级触达);
+ *     断线每 5s 重试,chrome.alarms(30s)兜底唤醒防 SW 悬挂。
+ *   - 三种 job:
+ *       search       → 后台标签打开 job.url(仅 flights.ctrip.com 白名单),等 content hook 嗅探回包,收尾关自己的标签;
+ *       open-login   → 置前台打开登录入口页(登录页纪律 #34),标签留给用户,绝不代关;
+ *       cookie-names → chrome.cookies 只读票据 cookie **名字**(值即取即弃,永不离开扩展——红线)。
+ *   - 物理只读(ReadGuard 扩展车道形态):本 SW 绝不向站点发任何请求——检索请求由站点自己的
+ *     页面代码发出,我们只「导航 + 被动转发 NETWORK_HINTS 命中响应」;写不是被禁止的行为,是不存在的原语。
+ */
+
+'use strict'
+
+const BRIDGE_PORTS = [8791, 8792, 8793, 8794, 8795]
+const RETRY_MS = 5_000
+
+/** 站点注册表(与 Node 侧 LOGIN_TARGETS/LOGIN_COOKIE_NAMES 对账,防漂移测试守住) */
+const SITES = {
+  'ctrip-flight': {
+    domain: 'ctrip.com',
+    ticketNames: ['cticket', 'uid', 'uname', 'passport'],
+  },
+}
+
+let activePort = null
+let polling = false
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+async function detectPort() {
+  for (const p of BRIDGE_PORTS) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${p}/health`, { headers: { 'x-gotry-bridge': 'v1' } })
+      if (r.ok) return p
+    } catch { /* 无人监听,试下一个端口 */ }
+  }
+  return null
+}
+
+async function postResult(jobId, result) {
+  if (activePort == null || !jobId) return
+  try {
+    await fetch(`http://127.0.0.1:${activePort}/results/${encodeURIComponent(jobId)}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-gotry-bridge': 'v1' },
+      body: JSON.stringify(result),
+    })
+  } catch { /* 桥可能已退场;Node 侧超时兜底 */ }
+}
+
+/** 只读票据 cookie 名单(只上报名;chrome.cookies 的值就地丢弃,不进任何结果对象) */
+async function ticketNames(site) {
+  const conf = SITES[site]
+  if (!conf) return []
+  const cookies = await chrome.cookies.getAll({ domain: conf.domain }).catch(() => [])
+  return (Array.isArray(cookies) ? cookies : [])
+    .map((c) => c.name)
+    .filter((n) => conf.ticketNames.includes(n))
+}
+
+/** 后台标签等嗅探回包;超时带回页标题(供 Node 侧 CHALLENGE_RE 判定),收尾关自己的标签 */
+function waitSniff(tabId, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false
+    let title = ''
+    const handler = (msg, sender) => {
+      if (!sender || !sender.tab || sender.tab.id !== tabId) return
+      if (msg && msg.type === 'gotry-page') { title = String(msg.title ?? title); return }
+      if (msg && msg.type === 'gotry-sniff' && !settled) {
+        settled = true
+        clearTimeout(timer)
+        chrome.runtime.onMessage.removeListener(handler)
+        resolve({ ok: true, kind: 'search', body: String(msg.body ?? ''), title })
+      }
+    }
+    const timer = setTimeout(() => {
+      if (settled) return
+      settled = true
+      chrome.runtime.onMessage.removeListener(handler)
+      resolve({ ok: false, kind: 'search', timeout: true, title })
+    }, Math.max(Number(timeoutMs) || 30_000, 5_000))
+    chrome.runtime.onMessage.addListener(handler)
+  })
+}
+
+async function handleJob(job) {
+  const jobId = job && job.jobId
+  if (typeof jobId !== 'string' || !jobId) return
+  const site = String((job && job.site) || '')
+  const conf = SITES[site]
+  try {
+    if (!conf) {
+      await postResult(jobId, { ok: false, error: `unknown site ${site}` })
+      return
+    }
+    if (job.kind === 'cookie-names') {
+      await postResult(jobId, { ok: true, kind: 'cookie-names', names: await ticketNames(site) })
+      return
+    }
+    if (job.kind === 'open-login') {
+      if (typeof job.url !== 'string' || !job.url.startsWith('https://')) {
+        await postResult(jobId, { ok: false, error: 'open-login 需要 https job.url' })
+        return
+      }
+      const tab = await chrome.tabs.create({ url: job.url, active: true })
+      await postResult(jobId, { ok: true, kind: 'open-login', opened: true, tabId: tab.id })
+      return
+    }
+    if (job.kind === 'search') {
+      if (typeof job.url !== 'string' || !job.url.startsWith('https://flights.ctrip.com/')) {
+        await postResult(jobId, { ok: false, error: `search 只允许 flights.ctrip.com 域(收到 ${String(job.url).slice(0, 80)})` })
+        return
+      }
+      const tab = await chrome.tabs.create({ url: job.url, active: false })
+      const result = await waitSniff(tab.id, job.timeoutMs)
+      await chrome.tabs.remove(tab.id).catch(() => { /* 用户先关了,无妨 */ })
+      await postResult(jobId, result)
+      return
+    }
+    await postResult(jobId, { ok: false, error: `unknown job kind ${String(job.kind)}` })
+  } catch (e) {
+    await postResult(jobId, { ok: false, error: String(e && e.message ? e.message : e).slice(0, 200) })
+  }
+}
+
+async function loop() {
+  if (polling) return
+  polling = true
+  try {
+    for (;;) {
+      if (activePort == null) activePort = await detectPort()
+      if (activePort == null) { await sleep(RETRY_MS); continue }
+      try {
+        const r = await fetch(`http://127.0.0.1:${activePort}/jobs`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', 'x-gotry-bridge': 'v1' },
+          body: JSON.stringify({
+            extensionVersion: chrome.runtime.getManifest().version,
+            capabilities: Object.keys(SITES),
+          }),
+        })
+        const data = await r.json().catch(() => ({ job: null }))
+        if (data && data.job) await handleJob(data.job)
+      } catch { activePort = null; await sleep(RETRY_MS) }
+    }
+  } finally {
+    polling = false
+  }
+}
+
+// SW 冷启动 + 闹钟兜底双保险;loop() 幂等
+if (chrome.runtime.onStartup) chrome.runtime.onStartup.addListener(() => { void loop() })
+chrome.alarms.create('gotry-bridge-poll', { periodInMinutes: 0.5 })
+chrome.alarms.onAlarm.addListener((a) => { if (a.name === 'gotry-bridge-poll') void loop() })
+void loop()

package/extension/content-bridge.js

@@ -0,0 +1,41 @@
+/**
+ * GoTry Session Bridge — ISOLATED-world 桥(manifest 默认 world,document_start)。
+ *
+ * MAIN world(content-main.js)拿不到 chrome API;本脚本监听页面里的
+ * gotry-ctrip-sniff 自定义事件,把响应文本经 chrome.runtime.sendMessage 转发给
+ * Service Worker(onMessage 按 sender.tab.id 归属到对应 search job)。
+ *
+ * 附带页标题快报(gotry-page):SW 在嗅探超时/挑战判定(CHALLENGE_RE)时用它。
+ */
+;(function () {
+  if (window.__gotrySniffBridge) return
+  window.__gotrySniffBridge = true
+
+  window.addEventListener('gotry-ctrip-sniff', function (ev) {
+    try {
+      var d = (ev && ev.detail) || {}
+      if (!d.body) return
+      chrome.runtime.sendMessage({
+        type: 'gotry-sniff',
+        url: d.url,
+        body: d.body,
+        title: document.title || '',
+      }).catch(function () { /* SW 重启中,下一条嗅探再投 */ })
+    } catch { /* 不抛 */ }
+  })
+
+  function sendPage() {
+    try {
+      chrome.runtime.sendMessage({
+        type: 'gotry-page',
+        title: document.title || '',
+        url: location.href,
+      }).catch(function () { /* SW 侧无等待者,常态丢弃 */ })
+    } catch { /* 环境异常不抛 */ }
+  }
+  if (document.readyState === 'loading') {
+    window.addEventListener('DOMContentLoaded', sendPage, { once: true })
+  } else {
+    sendPage()
+  }
+})()

package/extension/content-main.js

@@ -0,0 +1,62 @@
+/**
+ * GoTry Session Bridge — MAIN-world 网络嗅探(manifest world:"MAIN",document_start)。
+ *
+ * MAIN world 没有 chrome.runtime,只负责:hook 站点自己的 fetch/XHR,把命中
+ * NETWORK_HINTS(batchSearch)的响应文本以 CustomEvent 派发到页面里;
+ * ISOLATED 侧的 content-bridge.js 监听事件并经 chrome.runtime 转发给 Service Worker。
+ *
+ * 只读被动转发:不修改请求、不重放、不伪造(§2.3 反模式红线)——响应由站点自己的
+ * 代码发出,我们只听。
+ */
+;(function () {
+  if (window.__gotrySniffInstalled) return
+  window.__gotrySniffInstalled = true
+
+  /** 与 Node 侧 adapters/ctrip-flight.ts NETWORK_HINTS 对账(run-all §38 防漂移断言) */
+  var HINT_RE = /search\/api\/search\/batchSearch/
+
+  function dispatch(url, body) {
+    try {
+      window.dispatchEvent(new CustomEvent('gotry-ctrip-sniff', { detail: { url: String(url), body: String(body) } }))
+    } catch { /* 页面环境异常不抛 */ }
+  }
+
+  var origFetch = window.fetch
+  if (typeof origFetch === 'function') {
+    window.fetch = function (input, init) {
+      return origFetch.apply(this, arguments).then(function (res) {
+        try {
+          var url = ''
+          if (typeof input === 'string') url = input
+          else if (input && typeof input.url === 'string') url = input.url
+          if (HINT_RE.test(url)) {
+            var clone = res.clone()
+            clone.text().then(function (t) { dispatch(url, t) }).catch(function () { /* 流不可读则跳过 */ })
+          }
+        } catch { /* 嗅探失败不影响站点自身 */ }
+        return res
+      })
+    }
+  }
+
+  var origOpen = XMLHttpRequest.prototype.open
+  var origSend = XMLHttpRequest.prototype.send
+  XMLHttpRequest.prototype.open = function (method, url) {
+    this.__gotryUrl = typeof url === 'string' ? url : String(url ?? '')
+    return origOpen.apply(this, arguments)
+  }
+  XMLHttpRequest.prototype.send = function () {
+    var xhr = this
+    xhr.addEventListener('load', function () {
+      try {
+        if (!xhr.__gotryUrl || !HINT_RE.test(xhr.__gotryUrl)) return
+        var body = ''
+        if (xhr.responseType === '' || xhr.responseType === 'text') body = xhr.responseText
+        else if (xhr.responseType === 'json') body = JSON.stringify(xhr.response)
+        else return
+        if (body) dispatch(xhr.__gotryUrl, body)
+      } catch { /* 嗅探失败不影响站点 */ }
+    })
+    return origSend.apply(this, arguments)
+  }
+})()

package/extension/manifest.json

@@ -0,0 +1,32 @@
+{
+  "manifest_version": 3,
+  "name": "GoTry Session Bridge",
+  "version": "0.1.0",
+  "description": "GoTry 会话检索桥(issue #21):在你自己的登录态里只读嗅探检索回包与登录票据 cookie 名;零凭证经手,登录在官网由你完成,检索只读不写。gotry 侧不再需要开启 Remote Debugging,也没有任何系统级权限弹窗。",
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnuzBX8rT8+RZKEUip5VRA0cY056pExy9PNdN9YCiuY3dgglRbcIBhjuFJoR6EX3/MaUv82vJVyItRVrowXLTwDk4WZof0vwFgKL0zBK304PC46pUaAKTSu1PgXeL1+j5KTAGz/9a9+RnPdbj7jND5rM/MOmBHNPVPpp1NlwxRGIgF9OxHSOfXORcH4Iyte1aJSFUJbFtNS/DaE5D+KjyupPLyIqVN/dCiKnNsTCEHQB9ngeli665PFp76hkccHQQZ4sVuMLS4zBPcazUsp1kcnW+xsQoUATkODTCY+Pzk3zUVF1QOESTjRCVnbNi8tkO43RMRs2q63gX/3inFivcEwIDAQAB",
+  "permissions": ["cookies", "alarms"],
+  "host_permissions": [
+    "http://127.0.0.1:8791/*",
+    "http://127.0.0.1:8792/*",
+    "http://127.0.0.1:8793/*",
+    "http://127.0.0.1:8794/*",
+    "http://127.0.0.1:8795/*",
+    "https://*.ctrip.com/*"
+  ],
+  "background": {
+    "service_worker": "background.js"
+  },
+  "content_scripts": [
+    {
+      "matches": ["https://flights.ctrip.com/*"],
+      "js": ["content-main.js"],
+      "run_at": "document_start",
+      "world": "MAIN"
+    },
+    {
+      "matches": ["https://flights.ctrip.com/*"],
+      "js": ["content-bridge.js"],
+      "run_at": "document_start"
+    }
+  ]
+}