@danceiny/gotry 0.0.1-rc.16 → 0.0.1-rc.17

package/bin/gotry-runtime-resolution.js

@@ -0,0 +1,50 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+export const REQUIRED_BENCHMARK_DSH_VERSION = '0.1.2-alpha.3'
+
+export function readDshPackage(bin) {
+  try {
+    const packageJson = join(dirname(dirname(bin)), 'package.json')
+    const metadata = JSON.parse(readFileSync(packageJson, 'utf8'))
+    return typeof metadata.version === 'string' ? { bin, version: metadata.version } : null
+  } catch {
+    return null
+  }
+}
+
+export function resolveDshPackage(resolver) {
+  try {
+    return readDshPackage(resolver.resolve('@deepseek-ai/dsh/lib/bin.js'))
+  } catch {
+    return null
+  }
+}
+
+export function supportsNodeVersion(version) {
+  const match = /^(\d+)\.(\d+)/.exec(version)
+  if (!match) return false
+  const major = Number(match[1])
+  const minor = Number(match[2])
+  return major > 22 || (major === 22 && minor >= 15)
+}
+
+export function selectDshRuntime({ repoRoot, rootResolver, benchmark }) {
+  const root = resolveDshPackage(rootResolver)
+  if (root) return { ...root, source: 'root' }
+  if (benchmark) return null
+
+  const vendoredBin = join(repoRoot, 'ts/dsh-runtime/node_modules/@deepseek-ai/dsh/lib/bin.js')
+  if (!existsSync(vendoredBin)) return null
+  const vendored = readDshPackage(vendoredBin)
+  return vendored ? { ...vendored, source: 'legacy-vendored' } : null
+}
+
+export function benchmarkRuntimeSupported(runtime) {
+  return runtime?.version === REQUIRED_BENCHMARK_DSH_VERSION
+}
+
+export function selectDshCwd({ repoRoot, invocationCwd, sourceCheckoutMode, benchmark }) {
+  if (sourceCheckoutMode && !benchmark) return join(repoRoot, 'ts/dsh-runtime')
+  return invocationCwd
+}

package/bin/gotry.js

@@ -17,7 +17,7 @@ if [ -z "$conf" ] || [ ! -x "$conf" ]; then
 fi
 if [ -z "$conf" ] || [ ! -x "$conf" ]; then
   cat >&2 <<'EOF'
-gotry: node not found in PATH. Install Node 22+:
+gotry: node not found in PATH. Install Node 22.15+:
   macOS:  brew install node@22  (or use nvm)
   Linux:  https://nodejs.org/
 

package/cordis.gotry-patch.yml

@@ -18,7 +18,8 @@
     # 工具,结构化澄清卡);解析失败整块剔除
 
 # 注:insert 里 dsh-map-tools 的 name 是占位符,bin/gotry-inner.js 运行时重写为
-# 绝对路径(repo=vendored runtime;npm=依赖解析,裸包名绕 exports 子路径限制);
+# 绝对路径(source/package 优先依赖解析;legacy vendor 仅作兼容解析,裸包名绕
+# exports 子路径限制);
 # 依赖缺失时该条目整块剔除,不挡启动。地图/路线/POI 工具,零 key 走 OSRM/OSRM。
 
 # GoTry 成品人格:行为契约=产品语义
@@ -101,3 +102,6 @@
       **交付任何含可下单事实的行程产物(markdown 文件或长方案)前,必须调
       gotry_fact_gate**;闸 blocked 时逐条修正为可回溯事实或降级措辞,
       不得宣称「已验证方案」。
+      (21)工具循环收敛:第 16 次工具调用收到 TOOL_BUDGET_SOFT 提示后立即整理并给出最终答复;
+      每个对话轮次最多允许 18 次真实工具派发,第 19 次起收到结构化 TOOL_BUDGET_EXHAUSTED
+      拒绝结果且不得再调用工具。达到闸值后只能基于已有结果输出最终答复,不得重试或改调其他工具。

package/dist/capabilities/agent-reach-deep.js

@@ -169,4 +169,4 @@ export async function githubSearch(q) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/agent-reach-deep.ts
+//# sourceURL=ts/capabilities/agent-reach-deep.ts

package/dist/capabilities/agent-reach.js

@@ -201,4 +201,4 @@ export async function reachStatus(timeoutMs = 90_000) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/agent-reach.ts
+//# sourceURL=ts/capabilities/agent-reach.ts

package/dist/capabilities/anything.js

@@ -136,4 +136,4 @@ export const _ = {
 };
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/anything.ts
+//# sourceURL=ts/capabilities/anything.ts

package/dist/capabilities/artifacts.js

@@ -214,4 +214,4 @@ export async function readArtifact(opts) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/artifacts.ts
+//# sourceURL=ts/capabilities/artifacts.ts

package/dist/capabilities/effect.js

@@ -290,4 +290,4 @@ export function selectInterpreter(env, opts = {}) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/effect.ts
+//# sourceURL=ts/capabilities/effect.ts

package/dist/capabilities/fact-log.js

@@ -38,4 +38,4 @@ export async function loadFactRegistry(stateRoot) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/fact-log.ts
+//# sourceURL=ts/capabilities/fact-log.ts

package/dist/capabilities/flyai.js

@@ -1,4 +1,7 @@
 import { spawn } from 'node:child_process';
+import { closeSync, openSync, readFileSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 export function parseFlyaiItemList(stdout) {
     let start = -1;
     let depth = 0;
@@ -40,11 +43,17 @@ export function parseFlyaiItemList(stdout) {
     throw new Error(sawIncompleteObject ? 'incomplete FlyAI JSON object' : 'no complete FlyAI itemList JSON object');
 }
 function sh(cmd, args, opts) {
+    const outFile = join(tmpdir(), `gotry-flyai-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.out`);
+    const outFd = openSync(outFile, 'w');
     const child = spawn(cmd, args, {
         env: process.env,
-        cwd: process.cwd()
+        cwd: process.cwd(),
+        stdio: [
+            'ignore',
+            outFd,
+            'pipe'
+        ]
     });
-    let stdout = '';
     let stderr = '';
     let error;
     const timer = setTimeout(()=>{
@@ -53,9 +62,6 @@ function sh(cmd, args, opts) {
         } catch  {}
     }, opts.timeoutMs);
     return new Promise((resolve)=>{
-        child.stdout?.on('data', (d)=>{
-            stdout += d.toString();
-        });
         child.stderr?.on('data', (d)=>{
             stderr += d.toString();
         });
@@ -64,6 +70,14 @@ function sh(cmd, args, opts) {
         });
         child.on('close', (code)=>{
             clearTimeout(timer);
+            closeSync(outFd);
+            let stdout = '';
+            try {
+                stdout = readFileSync(outFile, 'utf8');
+            } catch  {}
+            try {
+                unlinkSync(outFile);
+            } catch  {}
             resolve({
                 code: code ?? -1,
                 stdout,
@@ -233,4 +247,4 @@ function parseHotelItems(items) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/flyai.ts
+//# sourceURL=ts/capabilities/flyai.ts

package/dist/capabilities/hbcli.js

@@ -221,4 +221,4 @@ export async function checkAvail(query, opts = {}) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/hbcli.ts
+//# sourceURL=ts/capabilities/hbcli.ts

package/dist/capabilities/incident-log.js

@@ -97,4 +97,4 @@ if (import.meta.url === `file://${fileURLToPath(import.meta.url)}` && process.ar
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/incident-log.ts
+//# sourceURL=ts/capabilities/incident-log.ts

package/dist/capabilities/model-override.js

@@ -0,0 +1,18 @@
+export const MODEL_OVERRIDE_ENV = 'GOTRY_LLM_MODEL';
+export function installModelOverride(ctx, env = process.env) {
+    const model = env[MODEL_OVERRIDE_ENV];
+    if (!model || typeof ctx.on !== 'function') return false;
+    ctx.on('agent/request', async (_payload, next)=>{
+        const resolved = await next();
+        const { reasoningEffort: _inherited, ...rest } = resolved;
+        return {
+            ...rest,
+            provider: 'deepseek-official',
+            model
+        };
+    });
+    return true;
+}
+
+
+//# sourceURL=ts/capabilities/model-override.ts

package/dist/capabilities/opensky.js

@@ -71,4 +71,4 @@ export async function verifyFlight(query) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/opensky.ts
+//# sourceURL=ts/capabilities/opensky.ts

package/dist/capabilities/resilience.js

@@ -87,4 +87,4 @@ export class CircuitBreaker {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/resilience.ts
+//# sourceURL=ts/capabilities/resilience.ts

package/dist/capabilities/session/action-cache.js

@@ -117,4 +117,4 @@ export function actionCachePath(stateRoot) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/action-cache.ts
+//# sourceURL=ts/capabilities/session/action-cache.ts

package/dist/capabilities/session/adapters/ctrip-flight.js

@@ -80,4 +80,4 @@ export function parseBatchSearch(body) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/adapters/ctrip-flight.ts
+//# sourceURL=ts/capabilities/session/adapters/ctrip-flight.ts

package/dist/capabilities/session/adapters/meituan-local.js

@@ -70,4 +70,4 @@ export function extractListings(entries, opts = {}) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/adapters/meituan-local.ts
+//# sourceURL=ts/capabilities/session/adapters/meituan-local.ts

package/dist/capabilities/session/benchmark.js

@@ -250,4 +250,4 @@ export function evaluateDoubleSource(input) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/benchmark.ts
+//# sourceURL=ts/capabilities/session/benchmark.ts

package/dist/capabilities/session/extension-bridge.js

@@ -10,6 +10,13 @@ export const BRIDGE_PORTS = [
 export const BRIDGE_PROTOCOL = 'session-bridge.v1';
 export const EXTENSION_ID = 'olpgkofjhhiiiahdkkbcninhjmegghfe';
 export const EXTENSION_ORIGIN = `chrome-extension://${EXTENSION_ID}`;
+export const EXTENSION_ID_STORE = 'oeajpiccmonococjcegddlooeeohlbgd';
+export const EXTENSION_ORIGIN_STORE = `chrome-extension://${EXTENSION_ID_STORE}`;
+export const EXTENSION_STORE_URL = `https://chromewebstore.google.com/detail/gotry-session-bridge/${EXTENSION_ID_STORE}`;
+export const EXTENSION_ORIGINS = [
+    EXTENSION_ORIGIN,
+    EXTENSION_ORIGIN_STORE
+];
 export const EXTENSION_CONNECTED_WINDOW_MS = 45_000;
 export const JOBS_LONG_POLL_MS = 20_000;
 export const DEFAULT_EXTENSION_WAIT_MS = 6_000;
@@ -52,7 +59,7 @@ export async function createSessionBridge(opts = {}) {
     const ports = opts.ports ?? [
         ...BRIDGE_PORTS
     ];
-    const extensionOrigin = opts.extensionOrigin ?? EXTENSION_ORIGIN;
+    const extensionOrigins = new Set(opts.extensionOrigins ?? EXTENSION_ORIGINS);
     const now = opts.now ?? Date.now;
     const queue = [];
     const inFlight = new Map();
@@ -75,7 +82,8 @@ export async function createSessionBridge(opts = {}) {
         const urlPath = (req.url ?? '').split('?')[0];
         const origin = req.headers.origin;
         const isPost = req.method === 'POST';
-        if (isPost && origin !== extensionOrigin) {
+        const originTrusted = typeof origin === 'string' && extensionOrigins.has(origin);
+        if (isPost && !originTrusted) {
             res.statusCode = 403;
             res.setHeader('content-type', 'application/json');
             res.end(JSON.stringify({
@@ -84,7 +92,7 @@ export async function createSessionBridge(opts = {}) {
             }));
             return;
         }
-        if (origin === extensionOrigin) {
+        if (originTrusted) {
             lastSeenAt = now();
         }
         const finish = (code, body)=>{
@@ -108,7 +116,8 @@ export async function createSessionBridge(opts = {}) {
                 extensionConnected: extensionConnected(),
                 lastSeenMsAgo: lastSeenAt > 0 ? now() - lastSeenAt : null,
                 queued: queue.length,
-                inFlight: inFlight.size
+                inFlight: inFlight.size,
+                parked: parked.length
             });
             return;
         }
@@ -127,6 +136,7 @@ export async function createSessionBridge(opts = {}) {
                     job: null
                 });
             }, JOBS_LONG_POLL_MS);
+            if (!opts.keepBridge) parkTimer.unref();
             parked.push({
                 res,
                 timer: parkTimer
@@ -170,6 +180,9 @@ export async function createSessionBridge(opts = {}) {
             error: 'unknown endpoint'
         });
     });
+    server.on('connection', (socket)=>{
+        if (!opts.keepBridge) socket.unref();
+    });
     function resolveJob(jobId, parsed) {
         const inFlightHit = inFlight.get(jobId);
         if (inFlightHit) {
@@ -254,7 +267,7 @@ export async function createSessionBridge(opts = {}) {
                         settle({
                             ok: false,
                             reason: 'extension-not-connected',
-                            summary: 'GoTry Session Bridge 扩展未连接(未安装或已停用)。一次性安装:npx gotry setup 查看指引 → chrome://extensions 开发者模式「加载已解压的扩展程序」指向 ~/.gotry/extension'
+                            summary: `GoTry Session Bridge 扩展未连接(未安装或已停用)。一次性安装(装完零弹窗):推荐 Chrome 应用商店一键装(自动更新) ${EXTENSION_STORE_URL} ;或 npx gotry setup 落位后 chrome://extensions 开发者模式「加载已解压的扩展程序」指向 ~/.gotry/extension`
                         });
                     }
                 }, 250);
@@ -342,4 +355,4 @@ export function __setSessionBridgeForTest(bridge) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/extension-bridge.ts
+//# sourceURL=ts/capabilities/session/extension-bridge.ts

package/dist/capabilities/session/extension-channel.js

@@ -1,5 +1,5 @@
-import { getOrCreateSessionBridge } from './extension-bridge.js';
-export const NEEDS_EXTENSION_HINT = '需要一次性安装 GoTry Session Bridge 浏览器扩展(约 30 秒,装完零弹窗):跑 npx gotry setup 拿指引,' + '或在 chrome://extensions 开发者模式「加载已解压的扩展程序」指向 ~/.gotry/extension';
+import { getOrCreateSessionBridge, EXTENSION_STORE_URL } from './extension-bridge.js';
+export const NEEDS_EXTENSION_HINT = '需要一次性安装 GoTry Session Bridge 浏览器扩展(装完零弹窗):' + `推荐 Chrome 应用商店一键安装(自动更新) ${EXTENSION_STORE_URL} ;` + '免审核、版本更新更快的 GitHub 通道:npx gotry setup --extension-from=github(自动下载落位 ~/.gotry/extension;' + '手动下载 github.com/Danceiny/gotry/releases 标签 ext-* 的 gotry-session-bridge.tar.gz),' + '再在 chrome://extensions 开发者模式「加载已解压的扩展程序」指向解压目录';
 export function classifyBridgeFailure(kind) {
     return kind === 'extension-not-connected' ? 'needs-extension' : 'error';
 }
@@ -90,4 +90,4 @@ export async function extensionSearchJob(q) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/extension-channel.ts
+//# sourceURL=ts/capabilities/session/extension-channel.ts

package/dist/capabilities/session/extension-distribution.js

@@ -0,0 +1,234 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const DIST_ASSET_TARBALL = 'gotry-session-bridge.tar.gz';
+export const DIST_ASSET_STORE_ZIP = 'gotry-session-bridge-store.zip';
+export const DIST_ASSET_MANIFEST = 'extension-dist-manifest.json';
+export const DEFAULT_RELEASE_BASE = 'https://github.com/Danceiny/gotry/releases';
+export function compareVersions(a, b) {
+    const pa = String(a).split('.').map((s)=>Number.parseInt(s, 10) || 0);
+    const pb = String(b).split('.').map((s)=>Number.parseInt(s, 10) || 0);
+    const n = Math.max(pa.length, pb.length);
+    for(let i = 0; i < n; i += 1){
+        const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (d !== 0) return d;
+    }
+    return 0;
+}
+export function distAssetUrls(releaseBase = DEFAULT_RELEASE_BASE) {
+    const base = releaseBase.replace(/\/+$/, '');
+    return {
+        tarball: `${base}/latest/download/${DIST_ASSET_TARBALL}`,
+        storeZip: `${base}/latest/download/${DIST_ASSET_STORE_ZIP}`,
+        manifest: `${base}/latest/download/${DIST_ASSET_MANIFEST}`
+    };
+}
+const SHA256_RE = /^[0-9a-f]{64}$/;
+export function parseDistManifest(raw) {
+    let obj;
+    try {
+        obj = JSON.parse(raw);
+    } catch  {
+        throw new Error('dist-manifest 不是合法 JSON');
+    }
+    const version = obj.version;
+    const tarball = obj.tarball;
+    const tarballSha256 = obj.tarballSha256;
+    const zip = obj.zip;
+    const zipSha256 = obj.zipSha256;
+    if (typeof version !== 'string' || !/^\d+\.\d+\.\d+$/.test(version)) throw new Error('dist-manifest.version 缺失或非 x.y.z');
+    if (tarball !== DIST_ASSET_TARBALL) throw new Error(`dist-manifest.tarball 资产名漂移(期望 ${DIST_ASSET_TARBALL})`);
+    if (zip !== DIST_ASSET_STORE_ZIP) throw new Error(`dist-manifest.zip 资产名漂移(期望 ${DIST_ASSET_STORE_ZIP})`);
+    if (typeof tarballSha256 !== 'string' || !SHA256_RE.test(tarballSha256)) throw new Error('dist-manifest.tarballSha256 非 64-hex');
+    if (typeof zipSha256 !== 'string' || !SHA256_RE.test(zipSha256)) throw new Error('dist-manifest.zipSha256 非 64-hex');
+    return {
+        version,
+        tarball,
+        tarballSha256,
+        zip,
+        zipSha256,
+        builtFromCommit: typeof obj.builtFromCommit === 'string' ? obj.builtFromCommit : undefined
+    };
+}
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export function readExtensionKey(extensionDir) {
+    const p = join(extensionDir, 'manifest.json');
+    if (!existsSync(p)) return undefined;
+    try {
+        const m = JSON.parse(readFileSync(p, 'utf8'));
+        return typeof m.key === 'string' ? m.key : undefined;
+    } catch  {
+        return undefined;
+    }
+}
+export function readExtensionVersion(extensionDir) {
+    const p = join(extensionDir, 'manifest.json');
+    if (!existsSync(p)) return undefined;
+    try {
+        const m = JSON.parse(readFileSync(p, 'utf8'));
+        return typeof m.version === 'string' ? m.version : undefined;
+    } catch  {
+        return undefined;
+    }
+}
+function runTar(args, spawnFn, timeoutMs) {
+    return new Promise((resolve)=>{
+        const child = spawnFn('tar', args, {
+            stdio: 'ignore'
+        });
+        let done = false;
+        const timer = setTimeout(()=>{
+            if (!done) {
+                done = true;
+                try {
+                    child.kill('SIGKILL');
+                } catch  {}
+                resolve({
+                    ok: false,
+                    error: `tar 超时(>${timeoutMs}ms)`
+                });
+            }
+        }, timeoutMs);
+        child.on('error', (e)=>{
+            if (!done) {
+                done = true;
+                clearTimeout(timer);
+                resolve({
+                    ok: false,
+                    error: `tar 不可用:${e.message}`
+                });
+            }
+        });
+        child.on('close', (code)=>{
+            if (!done) {
+                done = true;
+                clearTimeout(timer);
+                resolve(code === 0 ? {
+                    ok: true
+                } : {
+                    ok: false,
+                    error: `tar exit ${code}`
+                });
+            }
+        });
+    });
+}
+async function fetchBytes(url, fetchFn, timeoutMs) {
+    try {
+        const res = await fetchFn(url, {
+            signal: AbortSignal.timeout(timeoutMs)
+        });
+        if (!res.ok) return {
+            ok: false,
+            error: `HTTP ${res.status} ${url}`
+        };
+        const buf = new Uint8Array(await res.arrayBuffer());
+        return {
+            ok: true,
+            bytes: buf
+        };
+    } catch (e) {
+        return {
+            ok: false,
+            error: `下载失败 ${e.message}`
+        };
+    }
+}
+export async function installExtensionFromGithub(opts) {
+    const timeoutMs = opts.timeoutMs ?? 60_000;
+    const fetchFn = opts.fetch ?? fetch;
+    const spawnFn = opts.spawnFn ?? spawn;
+    const urls = distAssetUrls(opts.releaseBase);
+    const fail = (error)=>({
+            ok: false,
+            action: 'fallback-bundled',
+            error
+        });
+    const mRes = await fetchBytes(urls.manifest, fetchFn, timeoutMs);
+    if (!mRes.ok) return fail(mRes.error);
+    let manifest;
+    try {
+        manifest = parseDistManifest(new TextDecoder().decode(mRes.bytes));
+    } catch (e) {
+        return fail(`dist-manifest 校验失败:${e.message}`);
+    }
+    const previousVersion = readExtensionVersion(opts.destDir);
+    if (previousVersion != null && compareVersions(manifest.version, previousVersion) <= 0) {
+        return {
+            ok: true,
+            action: 'up-to-date',
+            version: manifest.version,
+            previousVersion
+        };
+    }
+    if (opts.checkOnly) {
+        return {
+            ok: true,
+            action: 'up-to-date',
+            version: manifest.version,
+            previousVersion
+        };
+    }
+    const tRes = await fetchBytes(urls.tarball, fetchFn, timeoutMs);
+    if (!tRes.ok) return fail(tRes.error);
+    const actual = sha256Hex(tRes.bytes);
+    if (actual !== manifest.tarballSha256) return fail(`SHA256 不符(期望 ${manifest.tarballSha256.slice(0, 12)}… 实得 ${actual.slice(0, 12)}…)`);
+    const incoming = `${opts.destDir}.incoming-${process.pid}-${Date.now()}`;
+    const tarPath = `${incoming}.tar.gz`;
+    try {
+        rmSync(incoming, {
+            recursive: true,
+            force: true
+        });
+        mkdirSync(incoming, {
+            recursive: true
+        });
+        writeFileSync(tarPath, tRes.bytes);
+        const ext = await runTar([
+            '-xzf',
+            tarPath,
+            '-C',
+            incoming,
+            '--strip-components',
+            '1'
+        ], spawnFn, timeoutMs);
+        if (!ext.ok) return fail(ext.error);
+        const incomingKey = readExtensionKey(incoming);
+        if (incomingKey == null) return fail('解压产物缺 manifest.json/key(非法包)');
+        if (opts.pinnedSourceDir) {
+            const pinnedKey = readExtensionKey(opts.pinnedSourceDir);
+            if (pinnedKey != null && incomingKey !== pinnedKey) return fail('扩展 key 漂移(通道产物与 bundled 不同 ID——拒绝安装,防端口池/host 权限漂移)');
+        }
+        const incomingVersion = readExtensionVersion(incoming);
+        if (incomingVersion !== manifest.version) return fail(`解压产物版本(${incomingVersion})与 dist-manifest(${manifest.version})不符`);
+        rmSync(opts.destDir, {
+            recursive: true,
+            force: true
+        });
+        cpSync(incoming, opts.destDir, {
+            recursive: true
+        });
+        return {
+            ok: true,
+            action: 'installed',
+            version: manifest.version,
+            previousVersion
+        };
+    } catch (e) {
+        return fail(`落位失败 ${e.message}`);
+    } finally{
+        rmSync(incoming, {
+            recursive: true,
+            force: true
+        });
+        rmSync(tarPath, {
+            force: true
+        });
+    }
+}
+
+
+//# sourceURL=ts/capabilities/session/extension-distribution.ts

package/dist/capabilities/session/extract.js

@@ -37,4 +37,4 @@ export function nameAffinity(a, b) {
 }
 
 
-//# sourceURL=/Users/bytedance/work/gotry-publish/ts/capabilities/session/extract.ts
+//# sourceURL=ts/capabilities/session/extract.ts