@danceiny/gotry 0.0.1-rc.20 → 0.0.1-rc.21

package/dist/src/booking-surface/dsh-planner.js

@@ -384,9 +384,11 @@ function recoverFinalResponseDecision(response, task) {
         }).slice(0, 600));
         return null;
     }
-    repairPlannerFactRefs(action);
+    const repairedRefs = repairPlannerFactRefs(action);
+    const repairedValidation = validateBookingReadAction(action);
+    if (!repairedValidation.ok) return null;
     try {
-        assertPlannerSafeRefs(action);
+        assertPlannerSafeRefs(action, repairedRefs);
     } catch (error) {
         console.error('[booking-copilot] finalResponse recovery rejected (unsafe ref):', JSON.stringify({
             actionId: action.actionId,
@@ -411,10 +413,17 @@ function recoverFinalResponseDecision(response, task) {
 const PLANNER_SAFE_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:._-]*$/;
 function repairPlannerFactRefs(action) {
     const factRefs = action.factRefs;
-    if (!Array.isArray(factRefs)) return;
-    action.factRefs = factRefs.map((ref)=>typeof ref === 'string' ? ref.replace(/#/g, ':').replace(/[^A-Za-z0-9:._-]/g, '.') : ref);
+    const repairedRefs = new Set();
+    if (!Array.isArray(factRefs)) return repairedRefs;
+    action.factRefs = factRefs.map((ref)=>{
+        if (typeof ref !== 'string' || PLANNER_SAFE_REF_PATTERN.test(ref)) return ref;
+        const alias = `modelref:${createHash('sha256').update(ref, 'utf8').digest('hex')}`;
+        repairedRefs.add(alias);
+        return alias;
+    });
+    return repairedRefs;
 }
-function assertPlannerSafeRefs(action) {
+function assertPlannerSafeRefs(action, repairedRefs) {
     const actionId = action.actionId;
     if (typeof actionId !== 'string' || !PLANNER_SAFE_REF_PATTERN.test(actionId)) {
         throw new Error(`planner_invalid_action:unsafe_action_id:${String(actionId).slice(0, 60)}`);
@@ -422,7 +431,7 @@ function assertPlannerSafeRefs(action) {
     const factRefs = action.factRefs;
     if (Array.isArray(factRefs)) {
         for (const ref of factRefs){
-            if (typeof ref !== 'string' || !PLANNER_SAFE_REF_PATTERN.test(ref)) {
+            if (typeof ref !== 'string' || !PLANNER_SAFE_REF_PATTERN.test(ref) || ref.startsWith('modelref:') && !repairedRefs.has(ref) || ref.length > 512) {
                 throw new Error(`planner_invalid_action:unsafe_fact_ref:${String(ref).slice(0, 60)}`);
             }
         }
@@ -483,8 +492,15 @@ function parseToolDecision(event, task) {
         }).slice(0, 1200));
         throw new Error(`planner_invalid_action:${validation.errors.join('; ')}`);
     }
-    repairPlannerFactRefs(decision.action);
-    assertPlannerSafeRefs(decision.action);
+    const repairedRefs = repairPlannerFactRefs(decision.action);
+    const repairedValidation = validateBookingReadAction(decision.action);
+    if (!repairedValidation.ok) {
+        console.error(`[booking-copilot] repaired action rejected:`, JSON.stringify({
+            errors: repairedValidation.errors.slice(0, 8)
+        }).slice(0, 800));
+        throw new Error(`planner_invalid_action:${repairedValidation.errors.join('; ')}`);
+    }
+    assertPlannerSafeRefs(decision.action, repairedRefs);
     const action = decision.action;
     const capability = TOOL_TO_CAPABILITY.get(name);
     if (!capability || !actionsForEmbeddedCapability(capability).includes(action.kind)) {

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "GoTry Session Bridge",
-  "version": "0.0.1.20",
+  "version": "0.0.1.21",
   "description": "GoTry 会话检索桥(issue #21):在你自己的登录态里只读嗅探检索回包(机票/酒店/火车)与登录票据 cookie 名;零凭证经手,登录在官网由你完成,检索只读不写。",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnuzBX8rT8+RZKEUip5VRA0cY056pExy9PNdN9YCiuY3dgglRbcIBhjuFJoR6EX3/MaUv82vJVyItRVrowXLTwDk4WZof0vwFgKL0zBK304PC46pUaAKTSu1PgXeL1+j5KTAGz/9a9+RnPdbj7jND5rM/MOmBHNPVPpp1NlwxRGIgF9OxHSOfXORcH4Iyte1aJSFUJbFtNS/DaE5D+KjyupPLyIqVN/dCiKnNsTCEHQB9ngeli665PFp76hkccHQQZ4sVuMLS4zBPcazUsp1kcnW+xsQoUATkODTCY+Pzk3zUVF1QOESTjRCVnbNi8tkO43RMRs2q63gX/3inFivcEwIDAQAB",
   "permissions": [
@@ -46,5 +46,5 @@
       "run_at": "document_start"
     }
   ],
-  "version_name": "0.0.1-rc.20"
+  "version_name": "0.0.1-rc.21"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danceiny/gotry",
-  "version": "0.0.1-rc.20",
+  "version": "0.0.1-rc.21",
   "description": "GoTry — 从出发到下一次出发的 AI 旅行 Agent(dsh 插件)。npm/源码入口共用锁定的 dsh runtime + README 安装路径。",
   "type": "module",
   "main": "ts/src/index.ts",
@@ -90,6 +90,7 @@
     "extension/",
     "ts/package.json",
     "ts/dsh-runtime/vendor/dsh-map-tools",
+    "ts/scripts/map-tools-vendor-package-proof.ts",
     "cordis.gotry-patch.yml",
     "README.md",
     "README.zh-CN.md",

package/ts/capabilities/session/health-watch.ts

@@ -155,8 +155,15 @@ export function startExtensionHealthWatch(opts: HealthWatchOptions = {}): Health
   const probe = opts.probe ?? (async () => {
     // 先确保桥存在 + keepBridge
     const bridge = await import('./extension-bridge.ts')
-    await bridge.getOrCreateSessionBridge({ keepBridge: opts.keepBridge === true })
-    return combinedProbe(opts, businessProbe)
+    const created = await bridge.getOrCreateSessionBridge({ keepBridge: opts.keepBridge === true, ports: opts.ports })
+    // The default path must keep scanning the canonical pool: another GoTry
+    // process may already own the extension-connected bridge. An explicit
+    // port override is an isolation boundary, so probe only the bridge that
+    // this process actually bound (including an ephemeral `0` request).
+    const probeOpts = created.ok && opts.ports
+      ? { ...opts, ports: [created.bridge.port] }
+      : opts
+    return combinedProbe(probeOpts, businessProbe)
   })
   const now = opts.now ?? Date.now
   const state: InternalState = { cancelled: false, readyCount: 0, resolveOutcome: null }

package/ts/package.json

@@ -18,19 +18,27 @@
     "better-sqlite3": "^13.0.3",
     "z3-solver": "^5.2.0"
   },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "playwright-core": "^1.62.1",
-    "puppeteer-core": "^25.9.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
-  },
   "overrides": {
+    "@deepseek-ai/dsh-agent": "0.1.2-alpha.3",
     "@deepseek-ai/dsh-brand": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-code-runtime": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-invariants": "0.1.2-alpha.3",
     "@deepseek-ai/dsh-llm": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-scope": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-system-prompt": "0.1.2-alpha.3",
     "@deepseek-ai/dsh-timeout": "0.1.2-alpha.3",
     "@deepseek-ai/dsh-typert-protocol": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-user-approval": "0.1.2-alpha.3",
     "@deepseek-ai/dsh-util-crypto": "0.1.2-alpha.3",
     "@deepseek-ai/dsh-util-values": "0.1.2-alpha.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "playwright-core": "^1.62.1",
+    "puppeteer-core": "^25.9.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
   }
 }

package/ts/scripts/map-tools-vendor-package-proof.ts

@@ -0,0 +1,268 @@
+/**
+ * Package proof for issue #202.
+ *
+ * The full suite passes the executable from its clean tarball install; focused
+ * runs pack/unpack locally and attach the already-installed root closure. Both
+ * paths load the plugin from the artifact, never from the checkout vendor path.
+ * No map provider or paid endpoint is contacted; inline-coordinate geocoding is
+ * asserted with fetch disabled.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import assert from 'node:assert/strict'
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const upstreamLicenseSha256 = 'b6bbb0c73a02cf8d2c304e9f208b41c32f0a810fabe366986e2b14ac3338f618'
+const upstreamVendorFileCount = 32
+const upstreamVendorAggregateSha256 = 'd82a38adace8bfe574dcecb4222da5c994a1b9e8792f78dc2dad3a7f50c9925a'
+const expectedTools = [
+  'map_bicycling_route',
+  'map_driving_route',
+  'map_geocode',
+  'map_poi_search',
+  'map_reverse_geocode',
+  'map_transit_route',
+  'map_walking_route',
+]
+
+function sha256(path: string): string {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function vendorAggregate(root: string): { count: number; sha256: string } {
+  const files: string[] = []
+  const walk = (directory: string) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const path = join(directory, entry.name)
+      if (entry.isDirectory()) walk(path)
+      else files.push(path.slice(root.length + 1).replaceAll('\\', '/'))
+    }
+  }
+  walk(root)
+  files.sort()
+  const digest = createHash('sha256')
+  for (const relative of files) {
+    digest.update(relative)
+    digest.update('\0')
+    digest.update(readFileSync(join(root, relative)))
+    digest.update('\0')
+  }
+  return { count: files.length, sha256: digest.digest('hex') }
+}
+
+function assertAlpha3LockClosure(): { packages: number; version: string } {
+  const manifest = JSON.parse(readFileSync(join(repoRoot, 'ts/package.json'), 'utf8')) as {
+    dependencies?: Record<string, string>
+  }
+  assert.equal(manifest.dependencies?.['dsh-map-tools'], undefined, 'external map-tools dependency must stay removed')
+
+  const lock = JSON.parse(readFileSync(join(repoRoot, 'ts/package-lock.json'), 'utf8')) as {
+    packages?: Record<string, { version?: string; dependencies?: Record<string, string> }>
+  }
+  assert.equal(lock.packages?.['']?.dependencies?.['dsh-map-tools'], undefined, 'lock root must not resolve external map-tools')
+  assert.equal(lock.packages?.['node_modules/dsh-map-tools'], undefined, 'lock must not carry external map-tools')
+  const dshEntries = Object.entries(lock.packages ?? {}).filter(([path]) =>
+    /(?:^|\/)node_modules\/@deepseek-ai\/(?:dsh|dsh-[^/]+)$/.test(path),
+  )
+  assert.ok(dshEntries.length >= 10, 'expected dsh-tools peer closure in the ts lock')
+  for (const [path, entry] of dshEntries) {
+    assert.equal(entry.version, '0.1.2-alpha.3', `${path} drifted outside the alpha.3 closure`)
+  }
+  return { packages: dshEntries.length, version: '0.1.2-alpha.3' }
+}
+
+function findPackageRoot(entry: string): string {
+  let cursor = dirname(entry)
+  for (;;) {
+    const manifestPath = join(cursor, 'package.json')
+    if (existsSync(manifestPath)) {
+      const manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as { name?: string }
+      if (manifest.name === '@danceiny/gotry') return cursor
+    }
+    const parent = dirname(cursor)
+    if (parent === cursor) throw new Error(`cannot locate @danceiny/gotry package root from ${entry}`)
+    cursor = parent
+  }
+}
+
+function assertBinTargetsPackage(binPath: string, expectedTarget: string): void {
+  const resolvedExpectedTarget = realpathSync(expectedTarget)
+  if (realpathSync(binPath) === resolvedExpectedTarget) return
+
+  // pnpm writes an executable shell shim instead of a symlink. Its final
+  // machine-readable marker is safer to verify than accepting any occurrence
+  // of the package path in an otherwise unrelated executable.
+  const shim = readFileSync(binPath, 'utf8')
+  assert.ok(Buffer.byteLength(shim, 'utf8') <= 32_768, 'clean-install gotry shim is unexpectedly large')
+  const lines = shim.trimEnd().split(/\r?\n/)
+  const markers = lines.filter(line => line.startsWith('# cmd-shim-target='))
+  assert.equal(markers.length, 1, 'pnpm gotry shim must contain exactly one target marker')
+  assert.equal(lines.at(-1), markers[0], 'pnpm gotry shim target marker must be the final line')
+  const markerTarget = markers[0].slice('# cmd-shim-target='.length)
+  assert.ok(isAbsolute(markerTarget), 'pnpm gotry shim target must be absolute')
+  assert.equal(
+    realpathSync(markerTarget),
+    resolvedExpectedTarget,
+    'GOTRY_MAP_TOOLS_E2E_BIN shim must target this installed GoTry package',
+  )
+}
+
+function prepareProofPackage(cleanInstalledBin?: string): { packageRoot: string; proofRoot?: string } {
+  if (cleanInstalledBin) {
+    const binPath = resolve(cleanInstalledBin)
+    assert.equal(basename(binPath), 'gotry', 'clean-install executable must use the gotry bin name')
+    assert.equal(basename(dirname(binPath)), '.bin', 'clean-install executable must come from node_modules/.bin')
+    assert.equal(basename(dirname(dirname(binPath))), 'node_modules', 'clean-install executable must come from a consumer install')
+    const consumerRoot = dirname(dirname(dirname(binPath)))
+    const packageMain = createRequire(join(consumerRoot, 'package.json')).resolve('@danceiny/gotry')
+    const packageRoot = findPackageRoot(packageMain)
+    const installedManifest = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8')) as {
+      name?: string
+      bin?: string | Record<string, string>
+    }
+    assert.equal(installedManifest.name, '@danceiny/gotry', 'clean-install executable must belong to GoTry')
+    const declaredBin = typeof installedManifest.bin === 'string'
+      ? installedManifest.bin
+      : installedManifest.bin?.gotry
+    assert.equal(declaredBin, 'bin/gotry-inner.js', 'installed package must declare the production gotry bin')
+    assertBinTargetsPackage(binPath, join(packageRoot, declaredBin))
+    return { packageRoot }
+  }
+
+  const proofRoot = mkdtempSync(join(repoRoot, '.tmp-map-tools-proof-'))
+  try {
+    const packOutput = execFileSync('npm', [
+      'pack', '--ignore-scripts', '--json', '--pack-destination', proofRoot,
+    ], { cwd: repoRoot, encoding: 'utf8' })
+    const packInfo = JSON.parse(packOutput) as Array<{ filename: string }>
+    assert.equal(packInfo.length, 1, 'npm pack must produce one artifact')
+    const tarball = join(proofRoot, packInfo[0].filename)
+    assert.ok(existsSync(tarball), `packed artifact missing: ${tarball}`)
+    const unpackRoot = join(proofRoot, 'unpacked')
+    mkdirSync(unpackRoot)
+    execFileSync('tar', ['-xzf', tarball, '-C', unpackRoot])
+    const packageRoot = join(unpackRoot, 'package')
+    symlinkSync(join(repoRoot, 'node_modules'), join(packageRoot, 'node_modules'), process.platform === 'win32' ? 'junction' : 'dir')
+    return { packageRoot, proofRoot }
+  } catch (error) {
+    rmSync(proofRoot, { recursive: true, force: true })
+    throw error
+  }
+}
+
+const cleanInstalledBin = process.env.GOTRY_MAP_TOOLS_E2E_BIN
+const { packageRoot, proofRoot } = prepareProofPackage(cleanInstalledBin)
+
+try {
+  const lockedDsh = assertAlpha3LockClosure()
+  const vendorRoot = join(packageRoot, 'ts/dsh-runtime/vendor/dsh-map-tools')
+  const requiredFiles = [
+    'LICENSE',
+    'package.json',
+    'cordis.patch.yml',
+    'lib/index.js',
+    'lib/settings-ns.js',
+    'lib/config.js',
+    'lib/tools/geocode.js',
+    'lib/tools/routes.js',
+    'lib/tools/poi.js',
+  ]
+  for (const relative of requiredFiles) {
+    assert.ok(existsSync(join(vendorRoot, relative)), `required vendor file missing: ${relative}`)
+  }
+  const vendorTree = vendorAggregate(vendorRoot)
+  assert.equal(vendorTree.count, upstreamVendorFileCount, 'vendored payload file count drifted')
+  assert.equal(vendorTree.sha256, upstreamVendorAggregateSha256, 'vendored payload aggregate drifted')
+  const vendorPackage = JSON.parse(readFileSync(join(vendorRoot, 'package.json'), 'utf8')) as {
+    name?: string
+    version?: string
+    license?: string
+  }
+  assert.equal(vendorPackage.name, 'dsh-map-tools')
+  assert.equal(vendorPackage.version, '0.5.1')
+  assert.equal(vendorPackage.license, 'MIT')
+  assert.equal(sha256(join(vendorRoot, 'LICENSE')), upstreamLicenseSha256, 'upstream MIT license changed')
+
+  const packageRequire = createRequire(join(packageRoot, 'package.json'))
+  const dshTools = JSON.parse(readFileSync(packageRequire.resolve('@deepseek-ai/dsh-tools/package.json'), 'utf8')) as { version: string }
+  const dshSettings = JSON.parse(readFileSync(packageRequire.resolve('@deepseek-ai/dsh-settings/package.json'), 'utf8')) as { version: string }
+  assert.equal(dshTools.version, '0.1.2-alpha.3')
+  assert.equal(dshSettings.version, '0.1.2-alpha.3')
+  const settingsApi = await import(pathToFileURL(packageRequire.resolve('@deepseek-ai/dsh-settings')).href) as {
+    SettingsProvider?: { prototype?: { installSection?: unknown } }
+  }
+  assert.equal(
+    typeof settingsApi.SettingsProvider?.prototype?.installSection,
+    'function',
+    'real alpha.3 SettingsProvider.installSection API must be present',
+  )
+
+  const plugin = await import(pathToFileURL(join(vendorRoot, 'lib/index.js')).href)
+  const registered: Array<Record<string, unknown>> = []
+  const settingsCalls: unknown[][] = []
+  const context = {
+    tools: {
+      register(tool: Record<string, unknown>) {
+        registered.push(tool)
+        return () => undefined
+      },
+    },
+    effect(effect: () => (() => void) | void) {
+      effect()
+    },
+    inject(dependencies: string[], callback: (scope: Record<string, unknown>) => void) {
+      if (dependencies.includes('settings')) {
+        callback({ settings: { installSection: (...args: unknown[]) => { settingsCalls.push(args) } } })
+      } else if (dependencies.includes('webServer')) {
+        callback({ webServer: { register: () => undefined } })
+      } else {
+        throw new Error(`unexpected dependency injection: ${dependencies.join(',')}`)
+      }
+    },
+  }
+  plugin.apply(context, {
+    provider: 'osm', amapKey: '', timeoutMs: 1000, maxQps: 2,
+    defaultMode: 'driving', language: 'zh',
+  })
+  assert.deepEqual(registered.map(tool => tool.name).sort(), expectedTools, 'exactly seven map tools must register')
+  assert.equal(settingsCalls.length, 1, 'alpha.3 settings section must be installed once')
+  assert.equal(settingsCalls[0][1], 'dsh-map-tools', 'settings namespace must be stable')
+  assert.equal(typeof settingsCalls[0][4], 'object', 'alpha.3 installSection hooks must be supplied')
+
+  const originalFetch = globalThis.fetch
+  globalThis.fetch = (async () => { throw new Error('network forbidden by package proof') }) as typeof fetch
+  try {
+    const geocode = registered.find(tool => tool.name === 'map_geocode')
+    assert.ok(geocode, 'map_geocode must be registered')
+    const result = await (geocode.execute as (args: unknown, execution: unknown) => Promise<unknown>)(
+      { address: '116.397428,39.90923' },
+      { signal: new AbortController().signal },
+    ) as { provider?: string; location?: number[] }
+    assert.equal(result.provider, 'inline')
+    assert.deepEqual(result.location, [116.397428, 39.90923])
+  } finally {
+    globalThis.fetch = originalFetch
+  }
+
+  console.log(JSON.stringify({
+    proof: 'map-tools-vendor-package',
+    status: 'PASS',
+    artifactMode: cleanInstalledBin ? 'clean-installed-tarball' : 'packed-unpacked-focused',
+    vendored: {
+      sourcePackage: 'dsh-map-tools@0.5.1',
+      licenseSha256: upstreamLicenseSha256, vendorFileCount: vendorTree.count,
+      vendorAggregateSha256: vendorTree.sha256,
+    },
+    artifactVendor: vendorRoot,
+    dshClosure: { tools: dshTools.version, settings: dshSettings.version, ...lockedDsh },
+    tools: registered.map(tool => tool.name).sort(),
+    inlineCoordinate: { provider: 'inline', network: 'forbidden' },
+  }, null, 2))
+} finally {
+  if (proofRoot) rmSync(proofRoot, { recursive: true, force: true })
+}

package/ts/src/benchmark-agent-conformance.ts

@@ -25,9 +25,35 @@ const MAX_TERMINAL_BYTES = 1024 * 1024
 const BENCHMARK_TOOL_RESULT_SCHEMA_VERSION = 'gotry_benchmark_tool_result_v1'
 const BENCHMARK_DOMAIN_RECOVERIES = new Set(['none', 'retry_same', 'revise_arguments', 'choose_alternative'])
 
+// Round 12(issue #215):terminal body schema 是「无数据值的 closed 结构合同」——
+// 只允许结构关键字(type/properties/required/additionalProperties/items),enum/
+// const/example/default 等可夹带数据值的注解面一律禁止,对象必须 additionalProperties:
+// false,大小/深度/节点数有界。校验语义 fail-closed:不补键、不删多余键、不转类型。
+const TERMINAL_BODY_SCHEMA_MAX_BYTES = 16 * 1024
+const TERMINAL_BODY_SCHEMA_MAX_DEPTH = 8
+const TERMINAL_BODY_SCHEMA_MAX_NODES = 256
+const TERMINAL_BODY_SCHEMA_MAX_PROPERTIES = 256
+const TERMINAL_BODY_SCALAR_TYPES = new Set(['string', 'number', 'integer', 'boolean', 'null'])
+const TERMINAL_BODY_VALUE_MAX_NODES = 10_000
+const TERMINAL_BODY_VALUE_MAX_DEPTH = 24
+
+/** Structural-only, closed JSON schema for the terminal body (no data-bearing keywords). */
+export type TerminalBodySchema = {
+  type: 'object'
+  properties: Record<string, TerminalBodySchema>
+  required: string[]
+  additionalProperties: false
+} | {
+  type: 'array'
+  items: TerminalBodySchema
+} | {
+  type: 'string' | 'number' | 'integer' | 'boolean' | 'null'
+}
+
 export interface TerminalOutputConfig {
   tag: string
   max_bytes: number
+  body_schema: TerminalBodySchema
 }
 
 export type TerminalOutputValue =
@@ -80,13 +106,113 @@ function plainObject(value: unknown): value is Record<string, unknown> {
 export function validateTerminalOutputConfig(value: unknown): value is TerminalOutputConfig {
   if (!plainObject(value)) return false
   const keys = Object.keys(value).sort()
-  return JSON.stringify(keys) === JSON.stringify(['max_bytes', 'tag'])
+  return JSON.stringify(keys) === JSON.stringify(['body_schema', 'max_bytes', 'tag'])
     && typeof value.tag === 'string'
     && IDENTIFIER.test(value.tag)
     && typeof value.max_bytes === 'number'
     && Number.isInteger(value.max_bytes)
     && value.max_bytes >= 1
     && value.max_bytes <= MAX_TERMINAL_BYTES
+    && validateTerminalBodySchema(value.body_schema)
+}
+
+/** Accept only the closed structural dialect: exact keyword sets per node, bounded size. */
+export function validateTerminalBodySchema(value: unknown): value is TerminalBodySchema {
+  let serialized: string
+  try {
+    serialized = JSON.stringify(value)
+  } catch {
+    return false
+  }
+  if (typeof serialized !== 'string' || Buffer.byteLength(serialized, 'utf8') > TERMINAL_BODY_SCHEMA_MAX_BYTES) return false
+  const pending: Array<{ node: unknown; depth: number }> = [{ node: value, depth: 0 }]
+  const seen = new Set<object>()
+  let nodes = 0
+  let properties = 0
+  while (pending.length > 0) {
+    const { node, depth } = pending.pop()!
+    if (!plainObject(node) || seen.has(node) || ++nodes > TERMINAL_BODY_SCHEMA_MAX_NODES || depth > TERMINAL_BODY_SCHEMA_MAX_DEPTH) return false
+    seen.add(node)
+    const type = node.type
+    if (type === 'object') {
+      if (!exactKeys(node, ['type', 'properties', 'required', 'additionalProperties'])
+        || !plainObject(node.properties)
+        || !Array.isArray(node.required)
+        || node.additionalProperties !== false) return false
+      const entries = Object.entries(node.properties)
+      properties += entries.length
+      if (properties > TERMINAL_BODY_SCHEMA_MAX_PROPERTIES
+        || entries.some(([key, child]) => key.length === 0 || key.length > 64 || !plainObject(child))) return false
+      if (node.required.length > entries.length
+        || new Set(node.required).size !== node.required.length
+        || node.required.some(key => typeof key !== 'string' || !Object.hasOwn(node.properties as Record<string, unknown>, key))) return false
+      for (const [, child] of entries) pending.push({ node: child, depth: depth + 1 })
+      continue
+    }
+    if (type === 'array') {
+      if (!exactKeys(node, ['type', 'items']) || !plainObject(node.items)) return false
+      pending.push({ node: node.items, depth: depth + 1 })
+      continue
+    }
+    if (typeof type !== 'string' || !TERMINAL_BODY_SCALAR_TYPES.has(type) || !exactKeys(node, ['type'])) return false
+  }
+  return plainObject(value) && value.type === 'object'
+}
+
+function exactKeys(value: Record<string, unknown>, allowed: readonly string[]): boolean {
+  return Object.keys(value).every(key => allowed.includes(key))
+}
+
+/** Strict structural validation: exact keys, exact types, no coercion, no autofix. */
+export function validateTerminalBodyValue(value: unknown, schema: TerminalBodySchema): boolean {
+  const pending: Array<{ value: unknown; schema: TerminalBodySchema; depth: number }> = [{ value, schema, depth: 0 }]
+  let nodes = 0
+  while (pending.length > 0) {
+    const current = pending.pop()!
+    if (++nodes > TERMINAL_BODY_VALUE_MAX_NODES || current.depth > TERMINAL_BODY_VALUE_MAX_DEPTH) return false
+    const { schema: node } = current
+    if (node.type === 'object') {
+      const record = current.value
+      if (!plainObject(record)) return false
+      const properties = node.properties as Record<string, TerminalBodySchema>
+      for (const key of node.required) {
+        if (!Object.hasOwn(record, key)) return false
+      }
+      for (const [key, child] of Object.entries(record)) {
+        const childSchema = properties[key]
+        if (!childSchema) return false
+        pending.push({ value: child, schema: childSchema, depth: current.depth + 1 })
+      }
+      continue
+    }
+    if (node.type === 'array') {
+      if (!Array.isArray(current.value)) return false
+      for (const item of current.value) pending.push({ value: item, schema: node.items, depth: current.depth + 1 })
+      continue
+    }
+    if (node.type === 'string') { if (typeof current.value !== 'string') return false; continue }
+    if (node.type === 'boolean') { if (typeof current.value !== 'boolean') return false; continue }
+    if (node.type === 'null') { if (current.value !== null) return false; continue }
+    if (node.type === 'integer') { if (typeof current.value !== 'number' || !Number.isSafeInteger(current.value)) return false; continue }
+    if (typeof current.value !== 'number' || !Number.isFinite(current.value)) return false
+  }
+  return true
+}
+
+/** Deterministic single-source structural outline projected into system prompt and correction alike. */
+export function terminalSchemaOutline(schema: TerminalBodySchema): string {
+  const render = (node: TerminalBodySchema, depth: number): string => {
+    if (depth > TERMINAL_BODY_SCHEMA_MAX_DEPTH) return '…'
+    if (node.type === 'object') {
+      const properties = node.properties as Record<string, TerminalBodySchema>
+      const required = new Set(node.required)
+      const parts = Object.entries(properties).map(([key, child]) => `${required.has(key) ? '' : '?'}${key}:${render(child, depth + 1)}`)
+      return `object{${parts.join(',')}}`
+    }
+    if (node.type === 'array') return `array<${render(node.items, depth + 1)}>`
+    return node.type
+  }
+  return render(schema, 0)
 }
 
 function invalidTerminal(): TerminalOutputValue {
@@ -116,7 +242,11 @@ export function parseBenchmarkTerminal(raw: string, config: TerminalOutputConfig
 
   try {
     const value: unknown = JSON.parse(body)
-    return plainObject(value) ? { ok: true, value } : invalidTerminal()
+    if (!plainObject(value)) return invalidTerminal()
+    // Round 12(#215):同一份 closed body schema 在接受终态前 fail-closed 校验——
+    // 结构不合法的终态永不进入正式计分链,不做任何 autofix。
+    if (!validateTerminalBodyValue(value, config.body_schema)) return invalidTerminal()
+    return { ok: true, value }
   } catch {
     return invalidTerminal()
   }
@@ -363,7 +493,7 @@ function requireDisposer(value: unknown, capability: string): Disposer {
 function correctionMessage(mode: Exclude<RetryMode, 'none'>, projection: BenchmarkBridgeProjection) {
   const text = mode === 'call'
     ? `BENCHMARK_CONFORMANCE_CALL: Execute exactly one native ${projection.toolName} action:"call" now. Describing an intended CLI, shell, or Python command does not execute it.`
-    : `BENCHMARK_CONFORMANCE_TERMINAL: Reuse the existing successful tool result. Do not call any tool. Reply only <${projection.terminal.tag}>{"result":"..."}</${projection.terminal.tag}> with one JSON object.`
+    : `BENCHMARK_CONFORMANCE_TERMINAL: Reuse the existing successful tool result. Do not call any tool. Reply only <${projection.terminal.tag}> with one JSON object matching exactly ${terminalSchemaOutline(projection.terminal.body_schema)} — no extra keys, no missing keys, exact types.`
   return createUserMessage({
     content: [{ type: 'text' as const, text }],
     source: { kind: 'plugin' as const, plugin: 'gotry-benchmark-agent-conformance' },
@@ -372,6 +502,7 @@ function correctionMessage(mode: Exclude<RetryMode, 'none'>, projection: Benchma
 
 function systemSection(projection: BenchmarkBridgeProjection): { name: string; text: string } {
   const allowed = projection.allowedTools.join(', ')
+  const outline = terminalSchemaOutline(projection.terminal.body_schema)
   return {
     name: 'benchmark:agent-conformance',
     text: [
@@ -379,7 +510,7 @@ function systemSection(projection: BenchmarkBridgeProjection): { name: string; t
       `- Translate every task instruction to use a CLI, shell, Python, or agent_env.cli into the native tool ${projection.toolName}; do not merely describe the intended command.`,
       `- Call it with exactly {"action":"call","tool":"<one of: ${allowed}>","arguments":{...}}.`,
       '- action:"tools" is discovery only and does not satisfy the required environment call.',
-      `- After a successful tool result, reply only <${projection.terminal.tag}>{...one JSON object...}</${projection.terminal.tag}> with no prose or code fence.`,
+      `- After a successful tool result, reply only <${projection.terminal.tag}> with one JSON object matching exactly ${outline} — no extra keys, no missing keys, exact types; no prose or code fence.`,
       '- If a terminal-format correction arrives, reuse the existing result and do not call the tool again.',
     ].join('\n'),
   }