@danceiny/gotry 0.0.1-rc.19 → 0.0.1-rc.21

package/dist/src/benchmark-environment-bridge.js

@@ -1,12 +1,19 @@
 import { accessSync, constants, lstatSync, readFileSync, statSync } from 'node:fs';
 import { getuid } from 'node:process';
 import { isAbsolute } from 'node:path';
-import { defineTool } from '@deepseek-ai/dsh-tools';
+import { assertSupportedJsonSchema, validateJsonSchemaValue, ToolArgsError } from '@deepseek-ai/dsh-tools';
 import { validateTerminalOutputConfig } from './benchmark-agent-conformance.js';
-const SCHEMA_VERSION = 'gotry_benchmark_environment_bridge_v2';
+const SCHEMA_VERSION = 'gotry_benchmark_environment_bridge_v4';
+export const BENCHMARK_TOOL_RESULT_SCHEMA_VERSION = 'gotry_benchmark_tool_result_v1';
+export const BENCHMARK_DOMAIN_RECOVERIES = [
+    'none',
+    'retry_same',
+    'revise_arguments',
+    'choose_alternative'
+];
 const IDENTIFIER = /^[A-Za-z][A-Za-z0-9_.-]*$/;
+const RECOVERIES = new Set(BENCHMARK_DOMAIN_RECOVERIES);
 const CONFIG_KEYS = [
-    'allowed_tools',
     'argv_prefix',
     'cwd',
     'enabled',
@@ -15,14 +22,32 @@ const CONFIG_KEYS = [
     'max_output_bytes',
     'schema_version',
     'terminal_output',
-    'timeout_ms'
-];
-const OPTIONAL_CONFIG_KEYS = [
-    'allowed_output_keys'
+    'timeout_ms',
+    'tools'
 ];
+const INPUT_SCHEMA_MAX_BYTES = 16 * 1024;
+const INPUT_SCHEMA_MAX_DEPTH = 8;
+const INPUT_SCHEMA_MAX_NODES = 256;
+const INPUT_SCHEMA_MAX_PROPERTIES = 256;
+const INPUT_SCHEMA_MAX_ENUM_VALUES = 256;
+const INPUT_SCHEMA_MAX_DESCRIPTION_LENGTH = 512;
+const INPUT_SCHEMA_TYPES = new Set([
+    'string',
+    'number',
+    'integer',
+    'boolean',
+    'null',
+    'array',
+    'object'
+]);
 function plainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function deepFreezeJson(value) {
+    if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+    for (const child of Object.values(value))deepFreezeJson(child);
+    return Object.freeze(value);
+}
 function existingExecutable(value) {
     if (typeof value !== 'string' || !isAbsolute(value)) return false;
     try {
@@ -41,13 +66,121 @@ function existingDirectory(value) {
         return false;
     }
 }
-function identifiers(value) {
-    return Array.isArray(value) && value.length > 0 && value.length <= 64 && new Set(value).size === value.length && value.every((item)=>typeof item === 'string' && item.length > 0 && IDENTIFIER.test(item));
+function identifiers(value, allowEmpty = false) {
+    return Array.isArray(value) && (allowEmpty || value.length > 0) && value.length <= 64 && new Set(value).size === value.length && value.every((item)=>typeof item === 'string' && item.length > 0 && IDENTIFIER.test(item));
+}
+function exactKeys(value, allowed) {
+    return Object.keys(value).every((key)=>allowed.includes(key));
+}
+function validDescription(value, required = false) {
+    if (value === undefined) return !required;
+    return typeof value === 'string' && (!required || value.trim().length > 0) && value.length <= INPUT_SCHEMA_MAX_DESCRIPTION_LENGTH && !/[\u0000-\u001f\u007f]/.test(value);
 }
-function allowedOutputKeys(value, allowedTools) {
+function scalarMatches(type, value) {
+    if (type === 'string') return typeof value === 'string' && value.length <= 512;
+    if (type === 'number') return typeof value === 'number' && Number.isFinite(value);
+    if (type === 'integer') return typeof value === 'number' && Number.isSafeInteger(value);
+    if (type === 'boolean') return typeof value === 'boolean';
+    return type === 'null' && value === null;
+}
+function validInputSchema(value) {
     if (!plainObject(value)) return false;
-    const keys = Object.keys(value);
-    return keys.length > 0 && keys.length <= 64 && keys.every((tool)=>allowedTools.includes(tool) && identifiers(value[tool]));
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    } catch  {
+        return false;
+    }
+    if (Buffer.byteLength(serialized, 'utf8') > INPUT_SCHEMA_MAX_BYTES) return false;
+    const pending = [
+        {
+            node: value,
+            depth: 0
+        }
+    ];
+    const seen = new Set();
+    let nodes = 0;
+    let properties = 0;
+    let enumValues = 0;
+    while(pending.length > 0){
+        const { node, depth } = pending.pop();
+        if (seen.has(node) || ++nodes > INPUT_SCHEMA_MAX_NODES || depth > INPUT_SCHEMA_MAX_DEPTH) return false;
+        seen.add(node);
+        if (!INPUT_SCHEMA_TYPES.has(String(node.type)) || !validDescription(node.description)) return false;
+        if (node.type === 'object') {
+            if (!exactKeys(node, [
+                'type',
+                'description',
+                'properties',
+                'required',
+                'additionalProperties'
+            ]) || !plainObject(node.properties) || !Array.isArray(node.required) || node.additionalProperties !== false) return false;
+            const propertyEntries = Object.entries(node.properties);
+            properties += propertyEntries.length;
+            if (properties > INPUT_SCHEMA_MAX_PROPERTIES || propertyEntries.some(([key, child])=>!IDENTIFIER.test(key) || !plainObject(child))) return false;
+            const required = node.required;
+            if (required.length > propertyEntries.length || new Set(required).size !== required.length || required.some((key)=>typeof key !== 'string' || !Object.hasOwn(node.properties, key))) return false;
+            for (const [, child] of propertyEntries)pending.push({
+                node: child,
+                depth: depth + 1
+            });
+            continue;
+        }
+        if (node.type === 'array') {
+            if (!exactKeys(node, [
+                'type',
+                'description',
+                'items'
+            ]) || !plainObject(node.items)) return false;
+            pending.push({
+                node: node.items,
+                depth: depth + 1
+            });
+            continue;
+        }
+        if (!exactKeys(node, [
+            'type',
+            'description',
+            'enum',
+            'const'
+        ]) || Object.hasOwn(node, 'enum') && Object.hasOwn(node, 'const')) return false;
+        if (Object.hasOwn(node, 'const') && !scalarMatches(String(node.type), node.const)) return false;
+        if (Object.hasOwn(node, 'enum')) {
+            if (!Array.isArray(node.enum) || node.enum.length === 0 || node.enum.length > 64) return false;
+            enumValues += node.enum.length;
+            if (enumValues > INPUT_SCHEMA_MAX_ENUM_VALUES || new Set(node.enum).size !== node.enum.length || node.enum.some((item)=>!scalarMatches(String(node.type), item))) return false;
+        }
+    }
+    return value.type === 'object';
+}
+function toolDescriptors(value) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > 64) return false;
+    const names = new Set();
+    return value.every((item)=>{
+        if (!plainObject(item)) return false;
+        const keys = Object.keys(item).sort();
+        const required = [
+            'description',
+            'domain_outcomes',
+            'input_schema',
+            'name'
+        ];
+        if (JSON.stringify(keys) !== JSON.stringify([
+            ...required,
+            'output_keys'
+        ].sort())) return false;
+        if (typeof item.name !== 'string' || !IDENTIFIER.test(item.name) || names.has(item.name)) return false;
+        names.add(item.name);
+        if (!validDescription(item.description, true) || !validInputSchema(item.input_schema)) return false;
+        if (!Array.isArray(item.domain_outcomes) || item.domain_outcomes.length > 64) return false;
+        const outcomeKeys = new Set();
+        if (!item.domain_outcomes.every((outcome)=>plainObject(outcome) && JSON.stringify(Object.keys(outcome).sort()) === JSON.stringify([
+                'code',
+                'recovery',
+                'status'
+            ]) && (outcome.status === 'miss' || outcome.status === 'error') && typeof outcome.code === 'string' && IDENTIFIER.test(outcome.code) && typeof outcome.recovery === 'string' && RECOVERIES.has(outcome.recovery) && !outcomeKeys.has(outcome.code) && (outcomeKeys.add(outcome.code), true))) return false;
+        return identifiers(item.output_keys);
+    });
 }
 function argvPrefix(value) {
     return Array.isArray(value) && value.length > 0 && value.length <= 32 && value.every((item)=>typeof item === 'string' && item.length > 0 && item.length <= 256 && !item.includes('\0') && !item.includes('\r') && !item.includes('\n'));
@@ -69,14 +202,7 @@ function validate(value) {
     const baseKeys = [
         ...CONFIG_KEYS
     ].sort();
-    const extendedKeys = [
-        ...CONFIG_KEYS,
-        ...OPTIONAL_CONFIG_KEYS
-    ].sort();
-    if (!plainObject(value) || ![
-        baseKeys,
-        extendedKeys
-    ].some((keys)=>JSON.stringify(configKeys) === JSON.stringify(keys)) || value.schema_version !== SCHEMA_VERSION || value.enabled !== true || !existingExecutable(value.executable) || !existingDirectory(value.cwd) || !argvPrefix(value.argv_prefix) || !identifiers(value.allowed_tools) || !validBound(value.timeout_ms, 120_000) || !validBound(value.max_output_bytes, 10 * 1024 * 1024) || !validateTerminalOutputConfig(value.terminal_output) || !exactIsolation(value.isolation) || Object.hasOwn(value, 'allowed_output_keys') && !allowedOutputKeys(value.allowed_output_keys, value.allowed_tools)) return false;
+    if (!plainObject(value) || JSON.stringify(configKeys) !== JSON.stringify(baseKeys) || value.schema_version !== SCHEMA_VERSION || value.enabled !== true || !existingExecutable(value.executable) || !existingDirectory(value.cwd) || !argvPrefix(value.argv_prefix) || !toolDescriptors(value.tools) || !validBound(value.timeout_ms, 120_000) || !validBound(value.max_output_bytes, 10 * 1024 * 1024) || !validateTerminalOutputConfig(value.terminal_output) || !exactIsolation(value.isolation)) return false;
     return true;
 }
 export function loadBenchmarkEnvironmentConfig(path) {
@@ -87,7 +213,7 @@ export function loadBenchmarkEnvironmentConfig(path) {
         if (typeof getuid !== 'function' || metadata.uid !== getuid()) return null;
         if ((metadata.mode & 0o022) !== 0) return null;
         const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        return validate(parsed) ? parsed : null;
+        return validate(parsed) ? deepFreezeJson(parsed) : null;
     } catch  {
         return null;
     }
@@ -116,6 +242,48 @@ const FORBIDDEN_OUTPUT_KEY_FRAGMENTS = [
     'reward',
     'score'
 ];
+export const BRIDGE_ERROR_CONTRACT = Object.freeze({
+    invalid_action: {
+        recoverable: true,
+        remedy: 'action 只允许 tools、call 或 errors'
+    },
+    disallowed_tool: {
+        recoverable: true,
+        remedy: '先 action=tools 列出 allowed_tools 清单,再从清单内选工具'
+    },
+    invalid_arguments: {
+        recoverable: true,
+        remedy: 'arguments 必须是可序列化 JSON 对象(≤64KB、深度≤12);收窄后重试'
+    },
+    timed_out: {
+        recoverable: true,
+        remedy: '上游超时;可原样重试一次或换其他工具'
+    },
+    output_truncated: {
+        recoverable: true,
+        remedy: '输出超出上限;让被调工具收窄查询范围后重试'
+    },
+    invalid_json: {
+        recoverable: true,
+        remedy: '上游输出不是合法 JSON;重试一次或换工具'
+    },
+    invalid_output: {
+        recoverable: true,
+        remedy: '上游输出结构不符;重试或换工具'
+    },
+    runner_failed: {
+        recoverable: true,
+        remedy: '上游进程非零退出;可重试一次,持续失败换工具'
+    },
+    spawn_failed: {
+        recoverable: false,
+        remedy: '可执行文件不可用——环境问题,调用方不可恢复'
+    },
+    forbidden_output: {
+        recoverable: false,
+        remedy: '输出含未授权键(策略边界)——不可恢复,换工具或放弃'
+    }
+});
 function inspectOutput(value) {
     const pending = [
         {
@@ -152,7 +320,8 @@ function inspectAllowedOutput(value, allowedKeys) {
     const pending = [
         {
             value,
-            depth: 0
+            depth: 0,
+            coveredByDeclaredKey: false
         }
     ];
     let nodes = 0;
@@ -162,16 +331,21 @@ function inspectAllowedOutput(value, allowedKeys) {
         if (Array.isArray(current.value)) {
             for (const child of current.value)pending.push({
                 value: child,
-                depth: current.depth + 1
+                depth: current.depth + 1,
+                coveredByDeclaredKey: current.coveredByDeclaredKey
             });
             continue;
         }
-        if (!plainObject(current.value)) continue;
+        if (!plainObject(current.value)) {
+            if (!current.coveredByDeclaredKey) return false;
+            continue;
+        }
         for (const [key, child] of Object.entries(current.value)){
             if (!allowed.has(key)) return false;
             pending.push({
                 value: child,
-                depth: current.depth + 1
+                depth: current.depth + 1,
+                coveredByDeclaredKey: true
             });
         }
     }
@@ -211,56 +385,14 @@ function serializedArguments(value) {
         };
     }
 }
-export const BRIDGE_ERROR_CONTRACT = Object.freeze({
-    invalid_action: {
-        recoverable: true,
-        remedy: 'action 只允许 tools 或 call'
-    },
-    disallowed_tool: {
-        recoverable: true,
-        remedy: '先 action=tools 列出 allowed_tools 清单,再从清单内选工具'
-    },
-    invalid_arguments: {
-        recoverable: true,
-        remedy: 'arguments 必须是可序列化 JSON 对象(≤64KB、深度≤12);收窄后重试'
-    },
-    timed_out: {
-        recoverable: true,
-        remedy: '上游超时;可原样重试一次或换其他工具'
-    },
-    output_truncated: {
-        recoverable: true,
-        remedy: '输出超出上限;让被调工具收窄查询范围后重试'
-    },
-    invalid_json: {
-        recoverable: true,
-        remedy: '上游输出不是合法 JSON;重试一次或换工具'
-    },
-    invalid_output: {
-        recoverable: true,
-        remedy: '上游输出结构不符(如原始字符串);重试或换工具'
-    },
-    runner_failed: {
-        recoverable: true,
-        remedy: '上游进程非零退出;可重试一次,持续失败换工具'
-    },
-    spawn_failed: {
-        recoverable: false,
-        remedy: '可执行文件不可用——环境问题,调用方不可恢复'
-    },
-    forbidden_output: {
-        recoverable: false,
-        remedy: '输出含未授权键(策略边界)——不可恢复,换工具或放弃'
-    }
-});
 export function registerBenchmarkEnvironmentBridge(path, register, subprocess) {
     const bridge = loadBenchmarkEnvironmentConfig(path);
     if (!bridge) throw new Error('benchmark environment bridge configuration unavailable');
     if (!subprocess) throw new Error('benchmark environment bridge subprocess unavailable');
-    register(defineTool({
-        name: 'gotry_benchmark_environment',
-        description: 'When a prompt asks to run agent_env.cli, use action=call here with the mapped tool; arbitrary shell is not exposed. ' + 'Recoverable domain-error contract: every failure returns { ok:false, error:<code>, ... } from a closed vocabulary; ' + 'call action=errors to fetch the per-code recoverable flag and remedy before retrying.',
-        parameters: {
+    const parameters = deepFreezeJson({
+        type: 'object',
+        description: 'Flat benchmark bridge wire: choose an action, then provide the mapped tool and its arguments.',
+        properties: {
             action: {
                 type: 'string',
                 enum: [
@@ -268,23 +400,31 @@ export function registerBenchmarkEnvironmentBridge(path, register, subprocess) {
                     'call',
                     'errors'
                 ],
-                required: true,
-                description: 'tools=列出可调工具;call=执行被映射工具;errors=拉取可恢复错误契约表'
+                description: 'tools=列出可调工具;call=执行工具;errors=拉取错误契约'
             },
             tool: {
                 type: 'string',
-                description: '被调工具名(必须在 allowed_tools 清单内;action=call 时必填)'
+                enum: bridge.tools.map((item)=>item.name),
+                description: 'action=call 时选择的冻结工具名'
             },
             arguments: {
                 type: 'object',
                 additionalProperties: true,
-                description: '传给被调工具的参数对象(action=call 时可选;≤64KB、深度≤12)'
+                description: 'action=call 时传给工具的参数对象'
             }
         },
+        required: [
+            'action'
+        ],
+        additionalProperties: false
+    });
+    assertSupportedJsonSchema(parameters);
+    const definition = {
+        name: 'gotry_benchmark_environment',
+        description: 'When a prompt asks to run agent_env.cli, use action=call here with the mapped tool; arbitrary shell is not exposed.',
+        parameters,
         output: {
-            schema: {
-                type: 'json'
-            },
+            schema: {},
             render: (_args, value)=>[
                     {
                         type: 'text',
@@ -293,33 +433,56 @@ export function registerBenchmarkEnvironmentBridge(path, register, subprocess) {
                 ]
         },
         async execute (args) {
-            const action = args?.action;
-            if (action === 'errors') return jsonObject({
-                ok: true,
-                errors: BRIDGE_ERROR_CONTRACT
-            });
-            if (action === 'tools') return jsonObject({
-                ok: true,
-                tools: bridge.allowed_tools
-            });
-            if (action !== 'call') return jsonObject({
-                ok: false,
-                error: 'invalid_action'
-            });
+            const violations = validateJsonSchemaValue(parameters, args, 'arguments');
+            if (violations.length > 0) throw new ToolArgsError(violations);
             const query = args;
-            if (typeof query.tool !== 'string' || !bridge.allowed_tools.includes(query.tool)) {
+            const tool = query.tool;
+            const descriptor = bridge.tools.find((item)=>item.name === tool);
+            const keys = Object.keys(query);
+            if (query.action === 'tools') {
+                if (keys.length !== 1) throw new ToolArgsError([
+                    'arguments: tools action accepts no tool or arguments'
+                ]);
+                return jsonObject({
+                    ok: true,
+                    tools: bridge.tools
+                });
+            }
+            if (query.action === 'errors') {
+                if (keys.length !== 1) throw new ToolArgsError([
+                    'arguments: errors action accepts no tool or arguments'
+                ]);
+                return jsonObject({
+                    ok: true,
+                    errors: BRIDGE_ERROR_CONTRACT
+                });
+            }
+            if (query.action !== 'call') {
+                return jsonObject({
+                    ok: false,
+                    error: 'invalid_action'
+                });
+            }
+            if (keys.length !== 3 || !Object.hasOwn(query, 'tool') || !Object.hasOwn(query, 'arguments')) {
+                throw new ToolArgsError([
+                    'arguments: call action requires exactly tool and arguments'
+                ]);
+            }
+            if (typeof tool !== 'string' || !descriptor) {
                 return jsonObject({
                     ok: false,
                     error: 'disallowed_tool'
                 });
             }
-            if (query.arguments !== undefined && !plainObject(query.arguments)) {
+            if (!plainObject(query.arguments)) {
                 return jsonObject({
                     ok: false,
                     error: 'invalid_arguments'
                 });
             }
-            const callArguments = query.arguments === undefined ? {} : query.arguments;
+            const callArguments = query.arguments;
+            const argumentViolations = validateJsonSchemaValue(descriptor.input_schema, callArguments, 'arguments');
+            if (argumentViolations.length > 0) throw new ToolArgsError(argumentViolations);
             const serialized = serializedArguments(callArguments);
             if (serialized.reason) return jsonObject({
                 ok: false,
@@ -352,7 +515,7 @@ export function registerBenchmarkEnvironmentBridge(path, register, subprocess) {
                         bridge.executable,
                         ...bridge.argv_prefix,
                         'call',
-                        query.tool,
+                        tool,
                         serialized.json
                     ],
                     cwd: bridge.cwd,
@@ -402,13 +565,36 @@ export function registerBenchmarkEnvironmentBridge(path, register, subprocess) {
                     ok: false,
                     error: 'invalid_output'
                 });
-                const visibleResult = parsed.result ?? parsed;
+                if (parsed.schema_version !== BENCHMARK_TOOL_RESULT_SCHEMA_VERSION || typeof parsed.status !== 'string') {
+                    return jsonObject({
+                        ok: false,
+                        error: 'invalid_output'
+                    });
+                }
+                if (parsed.status === 'miss' || parsed.status === 'error') {
+                    if (typeof parsed.code !== 'string' || typeof parsed.recovery !== 'string' || !descriptor.domain_outcomes.some((outcome)=>outcome.status === parsed.status && outcome.code === parsed.code && outcome.recovery === parsed.recovery)) return jsonObject({
+                        ok: false,
+                        error: 'invalid_output'
+                    });
+                    if (Object.keys(parsed).sort().join(',') !== 'code,recovery,schema_version,status') return jsonObject({
+                        ok: false,
+                        error: 'invalid_output'
+                    });
+                    return jsonObject({
+                        ok: true,
+                        outcome: parsed
+                    });
+                }
+                if (parsed.status !== 'ok' || !Object.hasOwn(parsed, 'result') || Object.keys(parsed).sort().join(',') !== 'result,schema_version,status') return jsonObject({
+                    ok: false,
+                    error: 'invalid_output'
+                });
+                const visibleResult = parsed.result;
                 if (!plainObject(visibleResult) && !Array.isArray(visibleResult)) return jsonObject({
                     ok: false,
                     error: 'invalid_output'
                 });
-                const outputKeys = bridge.allowed_output_keys && Object.hasOwn(bridge.allowed_output_keys, query.tool) ? bridge.allowed_output_keys[query.tool] : undefined;
-                if (outputKeys && !inspectAllowedOutput(visibleResult, outputKeys)) return jsonObject({
+                if (!inspectAllowedOutput(visibleResult, descriptor.output_keys)) return jsonObject({
                     ok: false,
                     error: 'forbidden_output'
                 });
@@ -429,12 +615,11 @@ export function registerBenchmarkEnvironmentBridge(path, register, subprocess) {
                 clearTimeout(timer);
             }
         }
-    }));
+    };
+    register(definition);
     return Object.freeze({
         toolName: 'gotry_benchmark_environment',
-        allowedTools: Object.freeze([
-            ...bridge.allowed_tools
-        ]),
+        allowedTools: Object.freeze(bridge.tools.map((item)=>item.name)),
         terminal: Object.freeze({
             ...bridge.terminal_output
         })

package/dist/src/booking-surface/dsh-planner.js

@@ -384,9 +384,11 @@ function recoverFinalResponseDecision(response, task) {
         }).slice(0, 600));
         return null;
     }
-    repairPlannerFactRefs(action);
+    const repairedRefs = repairPlannerFactRefs(action);
+    const repairedValidation = validateBookingReadAction(action);
+    if (!repairedValidation.ok) return null;
     try {
-        assertPlannerSafeRefs(action);
+        assertPlannerSafeRefs(action, repairedRefs);
     } catch (error) {
         console.error('[booking-copilot] finalResponse recovery rejected (unsafe ref):', JSON.stringify({
             actionId: action.actionId,
@@ -411,10 +413,17 @@ function recoverFinalResponseDecision(response, task) {
 const PLANNER_SAFE_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:._-]*$/;
 function repairPlannerFactRefs(action) {
     const factRefs = action.factRefs;
-    if (!Array.isArray(factRefs)) return;
-    action.factRefs = factRefs.map((ref)=>typeof ref === 'string' ? ref.replace(/#/g, ':').replace(/[^A-Za-z0-9:._-]/g, '.') : ref);
+    const repairedRefs = new Set();
+    if (!Array.isArray(factRefs)) return repairedRefs;
+    action.factRefs = factRefs.map((ref)=>{
+        if (typeof ref !== 'string' || PLANNER_SAFE_REF_PATTERN.test(ref)) return ref;
+        const alias = `modelref:${createHash('sha256').update(ref, 'utf8').digest('hex')}`;
+        repairedRefs.add(alias);
+        return alias;
+    });
+    return repairedRefs;
 }
-function assertPlannerSafeRefs(action) {
+function assertPlannerSafeRefs(action, repairedRefs) {
     const actionId = action.actionId;
     if (typeof actionId !== 'string' || !PLANNER_SAFE_REF_PATTERN.test(actionId)) {
         throw new Error(`planner_invalid_action:unsafe_action_id:${String(actionId).slice(0, 60)}`);
@@ -422,7 +431,7 @@ function assertPlannerSafeRefs(action) {
     const factRefs = action.factRefs;
     if (Array.isArray(factRefs)) {
         for (const ref of factRefs){
-            if (typeof ref !== 'string' || !PLANNER_SAFE_REF_PATTERN.test(ref)) {
+            if (typeof ref !== 'string' || !PLANNER_SAFE_REF_PATTERN.test(ref) || ref.startsWith('modelref:') && !repairedRefs.has(ref) || ref.length > 512) {
                 throw new Error(`planner_invalid_action:unsafe_fact_ref:${String(ref).slice(0, 60)}`);
             }
         }
@@ -483,8 +492,15 @@ function parseToolDecision(event, task) {
         }).slice(0, 1200));
         throw new Error(`planner_invalid_action:${validation.errors.join('; ')}`);
     }
-    repairPlannerFactRefs(decision.action);
-    assertPlannerSafeRefs(decision.action);
+    const repairedRefs = repairPlannerFactRefs(decision.action);
+    const repairedValidation = validateBookingReadAction(decision.action);
+    if (!repairedValidation.ok) {
+        console.error(`[booking-copilot] repaired action rejected:`, JSON.stringify({
+            errors: repairedValidation.errors.slice(0, 8)
+        }).slice(0, 800));
+        throw new Error(`planner_invalid_action:${repairedValidation.errors.join('; ')}`);
+    }
+    assertPlannerSafeRefs(decision.action, repairedRefs);
     const action = decision.action;
     const capability = TOOL_TO_CAPABILITY.get(name);
     if (!capability || !actionsForEmbeddedCapability(capability).includes(action.kind)) {

package/dist/src/index.js

@@ -1599,14 +1599,17 @@ export function apply(ctx, config) {
             }
             const itpA = await interpretEffect({
                 effect: 'ANYTHING_SEARCH',
-                params: q
+                params: {
+                    ...q,
+                    hbcliBin: config.hbcliBin
+                }
             });
             if (!itpA.result) return declinedObservation('ANYTHING_SEARCH', itpA.trace);
             const r = itpA.result;
             const dir = await ensureStateDir(config.stateRoot);
             await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `anything:${r.via}`).catch(()=>{});
             const top5 = (r.hits ?? []).slice(0, 5);
-            const summary = r.verdict === 'hit' ? `${q.keyword} → hit (${r.hits?.length ?? 0} 候选项)\n${top5.map((h, i)=>`  ${i + 1}. [${h.type}] ${h.name}${h.latitude !== undefined && h.longitude !== undefined ? ` @ (${h.latitude.toFixed(3)},${h.longitude.toFixed(3)})` : ''}`).join('\n')}\n${r.evidence}` : r.verdict === 'miss' ? `${q.keyword} → miss (酒店-be 一切正常但无候选)\n${r.evidence}` : `${q.keyword} → unavailable (${r.error})\n${r.evidence}`;
+            const summary = r.verdict === 'hit' ? `${q.keyword} → hit (${r.hits?.length ?? 0} 候选项)\n${top5.map((h, i)=>`  ${i + 1}. [${h.type}] ${h.name}${h.star ? ` ${h.star}★` : ''}${h.latitude !== undefined && h.longitude !== undefined ? ` @ (${h.latitude.toFixed(3)},${h.longitude.toFixed(3)})` : ''}${h.hotelId ? ` hotelId=${h.hotelId}` : h.destinationId ? ` destinationId=${h.destinationId}` : ''}`).join('\n')}\n${r.evidence}` : r.verdict === 'miss' ? `${q.keyword} → miss (酒店-be 一切正常但无候选)\n${r.evidence}` : `${q.keyword} → unavailable (${r.error})\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
                 ok: r.ok,
                 verdict: r.verdict,

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "GoTry Session Bridge",
-  "version": "0.0.1.19",
+  "version": "0.0.1.21",
   "description": "GoTry 会话检索桥(issue #21):在你自己的登录态里只读嗅探检索回包(机票/酒店/火车)与登录票据 cookie 名;零凭证经手,登录在官网由你完成,检索只读不写。",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnuzBX8rT8+RZKEUip5VRA0cY056pExy9PNdN9YCiuY3dgglRbcIBhjuFJoR6EX3/MaUv82vJVyItRVrowXLTwDk4WZof0vwFgKL0zBK304PC46pUaAKTSu1PgXeL1+j5KTAGz/9a9+RnPdbj7jND5rM/MOmBHNPVPpp1NlwxRGIgF9OxHSOfXORcH4Iyte1aJSFUJbFtNS/DaE5D+KjyupPLyIqVN/dCiKnNsTCEHQB9ngeli665PFp76hkccHQQZ4sVuMLS4zBPcazUsp1kcnW+xsQoUATkODTCY+Pzk3zUVF1QOESTjRCVnbNi8tkO43RMRs2q63gX/3inFivcEwIDAQAB",
   "permissions": [
@@ -46,5 +46,5 @@
       "run_at": "document_start"
     }
   ],
-  "version_name": "0.0.1-rc.19"
+  "version_name": "0.0.1-rc.21"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danceiny/gotry",
-  "version": "0.0.1-rc.19",
+  "version": "0.0.1-rc.21",
   "description": "GoTry — 从出发到下一次出发的 AI 旅行 Agent(dsh 插件)。npm/源码入口共用锁定的 dsh runtime + README 安装路径。",
   "type": "module",
   "main": "ts/src/index.ts",
@@ -89,6 +89,8 @@
     "ts/capabilities/session/",
     "extension/",
     "ts/package.json",
+    "ts/dsh-runtime/vendor/dsh-map-tools",
+    "ts/scripts/map-tools-vendor-package-proof.ts",
     "cordis.gotry-patch.yml",
     "README.md",
     "README.zh-CN.md",