@danceiny/gotry 0.0.1-rc.21 → 0.0.1-rc.24

package/dist/src/backend/kernel.js

@@ -0,0 +1,91 @@
+/**
+ * gotry-backend 内核(2026-09-10,founder 口径:「我只允许一个 gotry 包装出来的服务」)。
+ *
+ * 形态:一个 HTTP 服务面 + 模块注册表。模块(gotry 能力单元)以 {method,path,handle}
+ * 精确路由表挂载,内核只做分发/404/异常隔离——鉴权、探活、schema 校验全部归模块
+ * 自持(模块行为即其独立部署形态的行为,挂载前后逐字一致)。
+ * 现有模块:booking-copilot(booking surface 能力)、session-search(账号会话检索)。
+ * gotry-a2a 是本服务的 A2A 协议端口,不是独立服务(迁移归部署收敛批次)。
+ */
+import { createServer } from 'node:http';
+export function createBackendServer(options) {
+    const table = new Map();
+    for (const module of options.modules) {
+        for (const route of module.routes) {
+            const key = `${route.method} ${route.path}`;
+            if (table.has(key))
+                throw new Error(`gotry_backend_route_conflict: ${key}`);
+            table.set(key, route);
+        }
+    }
+    const server = createServer(async (req, res) => {
+        const urlPath = (req.url ?? '').split('?')[0];
+        const route = table.get(`${req.method} ${urlPath}`);
+        if (!route) {
+            res.statusCode = 404;
+            res.setHeader('content-type', 'application/json');
+            res.end(JSON.stringify({ error: { code: 'not_found' } }));
+            return;
+        }
+        try {
+            await route.handle(req, res);
+        }
+        catch (error) {
+            // 模块内部异常不拖垮服务面;若响应已开头只能断连(调用方超时语义兜底)
+            if (!res.headersSent) {
+                res.statusCode = 500;
+                res.setHeader('content-type', 'application/json');
+                res.end(JSON.stringify({ error: { code: 'gotry_backend_module_error', module: route ? 'module' : 'kernel' } }));
+            }
+            else {
+                res.destroy();
+            }
+            process.stderr.write(`[gotry-backend] module=${moduleErrorName(options.modules, route)} route=${req.method} ${urlPath} failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+    });
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.port ?? 0, options.host ?? '127.0.0.1', () => {
+            server.off('error', reject);
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : (options.port ?? 0);
+            resolve({
+                server,
+                port,
+                moduleNames: options.modules.map((m) => m.name),
+                close: () => new Promise((done, fail) => server.close((error) => error ? fail(error) : done())),
+            });
+        });
+    });
+}
+function moduleErrorName(modules, route) {
+    if (!route)
+        return 'unknown';
+    for (const m of modules) {
+        if (m.routes.includes(route))
+            return m.name;
+    }
+    return 'unknown';
+}
+/** 关闭全部模块 + 服务面(单模块 close 失败不阻断其余回收,最后聚合抛出) */
+export async function closeBackend(handle, modules) {
+    const errors = [];
+    for (const module of modules) {
+        if (!module.close)
+            continue;
+        try {
+            await module.close();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    try {
+        await handle.close();
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    if (errors.length > 0)
+        throw new AggregateError(errors, 'gotry_backend_close_failed');
+}

package/dist/src/backend/modules/booking-copilot.js

@@ -0,0 +1,55 @@
+/**
+ * booking-copilot 模块(gotry-backend 的能力单元之一;booking surface 能力)。
+ *
+ * 组装 = startup.ts 同款(ensureLedger → TaskRuntime → dsh planner),路由挂载 =
+ * server.ts 摘出的 bookingCopilotTrafficHandler(与独立部署形态逐字一致:
+ * POST /a2a/booking-copilot/turn + GET /healthz|/status 探活,Bearer apiKey,
+ * schema 头校验)。ingress 固定 bound-turn-only(注入 seam 是部署级组合,本模块不携带)。
+ */
+import { mkdirSync } from 'node:fs';
+import { ensureLedger } from '../../state-ledger.js';
+import { BookingCopilotTaskRuntime } from '../../booking-surface/runtime.js';
+import { buildDshPlannerEnvironment, createDshEmbeddedBookingPlanner, } from '../../booking-surface/dsh-planner.js';
+import { bookingCopilotTrafficHandler, runtimeIdentity, } from '../../booking-surface/server.js';
+import { resolveBookingCopilotStartupConfig } from '../../booking-surface/startup.js';
+export async function startBookingCopilotModule(env = process.env) {
+    const config = resolveBookingCopilotStartupConfig(env);
+    mkdirSync(config.stateRoot, { recursive: true });
+    const ledger = ensureLedger(config.stateRoot);
+    let planner;
+    try {
+        planner = await createDshEmbeddedBookingPlanner({ stateRoot: config.stateRoot, env: buildDshPlannerEnvironment(env) });
+    }
+    catch (error) {
+        try {
+            ledger.close();
+        }
+        catch { /* 聚合首错优先 */ }
+        throw error;
+    }
+    const traffic = bookingCopilotTrafficHandler({
+        apiKey: config.apiKey,
+        composition: {
+            runtime: new BookingCopilotTaskRuntime(ledger),
+            plannerFactory: planner.plannerFactory,
+            ingressMode: 'bff-bound-turn-only',
+        },
+        maxBodyBytes: 1_000_000,
+        ...(config.artifactId !== undefined ? { artifactId: config.artifactId } : {}),
+        ingressMode: 'bff-bound-turn-only',
+        runningIdentity: runtimeIdentity(),
+    });
+    const respond = (req, res) => traffic(req, res);
+    return {
+        name: 'booking-copilot',
+        routes: [
+            { method: 'POST', path: '/a2a/booking-copilot/turn', handle: respond },
+            { method: 'GET', path: '/healthz', handle: respond },
+            { method: 'GET', path: '/status', handle: respond },
+        ],
+        async close() {
+            await planner.close();
+            ledger.close();
+        },
+    };
+}

package/dist/src/backend/modules/booking-executor.js

@@ -0,0 +1,124 @@
+/**
+ * booking-executor 模块(gotry-backend 能力单元;M1 预订链执行面骨架)。
+ *
+ * 红线(设计文档 §7 / WriteGate):
+ *   - 本模块只提供「只读观察 + 截图存证」;填单/提交原语**不存在**——写动作由
+ *     后续确认门放行后的受控执行器实现,当前骨架刻意不建。
+ *   - 观察对象 = dida 页面自己的预订入口(按钮文本与数量),不读取任何凭据/Cookie 值。
+ *
+ * 路由(鉴权:Bearer GOTRY_BACKEND_BOOKING_API_KEY;缺 key = fail-closed 503):
+ *   POST /v1/booking/observe → 打开供应商页面,观察预订入口并截图存证
+ *
+ * 观察器可注入(测试/未来多供应商扩展);缺省实现 = CDP 只读观察
+ * (openSession,ReadGuard 照常生效)。
+ */
+import { mkdirSync } from 'node:fs';
+import { openSession } from '../../../capabilities/session/transport.js';
+function sendJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json');
+    res.end(JSON.stringify(body));
+}
+async function readBody(req, cap = 32 * 1024) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > cap) {
+                reject(new Error(`body 超 ${cap} 字节上限`));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+/** 缺省观察器:CDP 打开页面 → 读预订入口按钮 → 截图存证(只读;零提交原语) */
+export async function defaultObserve(req, evidenceDir) {
+    const t = await openSession({ mode: 'cdp', guard: true, newPage: true, closeOwnPage: true });
+    if (!t.ok)
+        throw new Error(`会话主机 Chrome 不可达: ${t.summary}`);
+    try {
+        await t.page.goto(req.entryUrl ?? 'https://portal.dida.com/hotel/find', { waitUntil: 'domcontentloaded', timeout: 30_000 });
+        const entryPoints = (await t.page.evaluate(() => {
+            return Array.from(document.querySelectorAll('button'))
+                .filter((b) => b.textContent != null && b.textContent.includes('预订'))
+                .slice(0, 10)
+                .map((b) => ({ text: (b.textContent ?? '').trim().slice(0, 40), tag: 'button' }));
+        }));
+        mkdirSync(evidenceDir, { recursive: true });
+        const screenshotPath = `${evidenceDir}/observe-${Date.now()}.png`;
+        await t.page.screenshot({ path: screenshotPath });
+        return {
+            ok: true,
+            supplier: req.supplier,
+            entryUrl: req.entryUrl ?? 'https://portal.dida.com/hotel/find',
+            entryPoints,
+            screenshotPath,
+            observedAt: new Date().toISOString(),
+        };
+    }
+    finally {
+        await t.close();
+    }
+}
+export function startBookingExecutorModule(options) {
+    const authorized = (req, res) => {
+        const key = options.apiKey();
+        const auth = String(req.headers.authorization ?? '');
+        if (!key) {
+            sendJson(res, 503, { ok: false, error: 'GOTRY_BACKEND_BOOKING_API_KEY 未配置(fail-closed)' });
+            return false;
+        }
+        if (auth !== `Bearer ${key}`) {
+            sendJson(res, 403, { ok: false, error: 'forbidden' });
+            return false;
+        }
+        return true;
+    };
+    const observe = options.observe ?? (async (req) => defaultObserve(req, '/tmp/booking-evidence'));
+    async function handleObserve(req, res) {
+        let parsed;
+        try {
+            parsed = JSON.parse(await readBody(req));
+        }
+        catch {
+            sendJson(res, 400, { ok: false, error: 'body 不是 JSON' });
+            return;
+        }
+        const supplier = (parsed.supplier ?? '').trim();
+        if (supplier !== 'dida-portal') {
+            sendJson(res, 400, { ok: false, error: `未知供应商通道 ${supplier || '(空)'}` });
+            return;
+        }
+        const entryUrl = (parsed.entryUrl ?? '').trim() || 'https://portal.dida.com/hotel/find';
+        if (!/^https:\/\/portal\.dida\.com\//.test(entryUrl)) {
+            sendJson(res, 400, { ok: false, error: 'entry URL 必须落在 https://portal.dida.com/ 域内' });
+            return;
+        }
+        try {
+            const result = await observe({ supplier, entryUrl });
+            sendJson(res, 200, result);
+        }
+        catch (e) {
+            sendJson(res, 502, { ok: false, error: `观察失败: ${e instanceof Error ? e.message.slice(0, 200) : String(e)}` });
+        }
+    }
+    return {
+        name: 'booking-executor',
+        routes: [
+            {
+                method: 'POST',
+                path: '/v1/booking/observe',
+                handle: (req, res) => {
+                    if (!authorized(req, res))
+                        return;
+                    void handleObserve(req, res);
+                },
+            },
+        ],
+    };
+}

package/dist/src/backend/modules/session-search.js

@@ -0,0 +1,194 @@
+/**
+ * session-search 模块(gotry-backend 的能力单元之一;账号会话检索,hotel-be portal
+ * 聚合工作台 M0)。travel agent 能力全部落 gotry——本模块是「一个 gotry 服务」里的
+ * 会话检索面,hotel-be 只做网关包装与上下文拼接。
+ *
+ * 执行环境(2026-09-11 founder 定案):**浏览器客户端**,服务端零 Chrome
+ * (headless 易风控 + 资源开销大,双双出局)。本模块内嵌桥作业队列
+ * (createBridgeJobQueue)并挂载桥协议端点;管理员浏览器里的 GoTry Session
+ * Bridge 扩展经 bearer 鉴权远程连入,长轮询取活,在自己浏览器的登录态里
+ * 被动嗅探 dida 回包。登录也在管理员自己浏览器完成(login/open 让扩展把
+ * dida 登录页置前台打开,人过验证码)——零 Xvfb、零 noVNC、零 SSH 隧道。
+ *
+ * 路由(鉴权:Bearer GOTRY_BACKEND_SESSION_API_KEY;缺 key = fail-closed 503):
+ *   GET  /v1/session/status         → 扩展在线态 + 各供应商登录态(票据 cookie 名级;值零过手)
+ *   POST /v1/session/search         → 会话面检索(dida:multiCollect 嗅探推荐流双接口)
+ *   POST /v1/session/login/open     → 让扩展在管理员浏览器置前台打开 dida 登录入口页
+ *   GET  /v1/session/bridge/health  → 桥健康(扩展启动探测)
+ *   GET  /v1/session/bridge/status  → 桥诊断(队列/在线态快照)
+ *   POST /v1/session/bridge/jobs    → 扩展长轮询取活(hold ≤20s)
+ *   POST /v1/session/bridge/results → 扩展回包(?jobId=;内核只支持精确路由)
+ *
+ * 红线继承:登录在供应商官网由人完成;challenged 即停;节律闸在 sessionDidaSearch
+ * 内;本模块再加单飞锁(同供应商串行,防并发打站点)。桥端点在 bearer 之上再强制
+ * Origin ∈ 扩展白名单(网页跨域请求必带邪恶 Origin,双保险)。
+ */
+import { sessionDidaSearch } from '../../../capabilities/session-search.js';
+import { DIDA_LOGIN_COOKIE_NAMES, DIDA_SITE_DOMAIN } from '../../../capabilities/session/adapters/dida-portal.js';
+import { createBridgeJobQueue } from '../../../capabilities/session/extension-bridge.js';
+import { extensionCookieNames, extensionOpenLogin, classifyBridgeFailure } from '../../../capabilities/session/extension-channel.js';
+function sendJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json');
+    res.end(JSON.stringify(body));
+}
+async function readBody(req, cap = 64 * 1024) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > cap) {
+                reject(new Error(`body 超 ${cap} 字节上限`));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+const locks = new Map();
+async function withLock(key, fn) {
+    const prev = locks.get(key) ?? Promise.resolve();
+    const next = prev.catch(() => undefined).then(fn);
+    locks.set(key, next);
+    try {
+        return await next;
+    }
+    finally {
+        if (locks.get(key) === next)
+            locks.delete(key);
+    }
+}
+export function startSessionSearchModule(options) {
+    const search = options.search ?? sessionDidaSearch;
+    const queue = options.jobQueue ?? createBridgeJobQueue();
+    const authorized = (req, res) => {
+        const key = options.apiKey();
+        const auth = String(req.headers.authorization ?? '');
+        if (!key) {
+            sendJson(res, 503, { ok: false, error: 'GOTRY_BACKEND_SESSION_API_KEY 未配置(fail-closed)' });
+            return false;
+        }
+        if (auth !== `Bearer ${key}`) {
+            sendJson(res, 403, { ok: false, error: 'forbidden' });
+            return false;
+        }
+        return true;
+    };
+    async function handleStatus(res) {
+        const checkedAt = new Date().toISOString();
+        if (!queue.extensionConnected()) {
+            sendJson(res, 200, {
+                ok: true,
+                suppliers: [{ supplier: 'dida-portal', loggedIn: false, reason: 'extension-not-connected', detail: '会话执行环境=管理员浏览器扩展(GoTry Session Bridge);扩展未连接桥——在管理员浏览器安装扩展并配置本服务桥地址' }],
+                bridge: queue.stats(),
+                checkedAt,
+            });
+            return;
+        }
+        const login = await extensionCookieNames({ site: 'dida-portal', domain: DIDA_SITE_DOMAIN, ticketNames: DIDA_LOGIN_COOKIE_NAMES, timeoutMs: 20_000 }, queue);
+        if (!login.ok) {
+            const verdict = classifyBridgeFailure(login.kind);
+            sendJson(res, 200, { ok: true, suppliers: [{ supplier: 'dida-portal', loggedIn: false, reason: verdict, detail: login.summary }], bridge: queue.stats(), checkedAt });
+            return;
+        }
+        sendJson(res, 200, {
+            ok: true,
+            suppliers: [{ supplier: 'dida-portal', loggedIn: login.tickets.length > 0, tickets: login.tickets, ...(login.tickets.length === 0 ? { reason: 'needs-login' } : {}) }],
+            bridge: queue.stats(),
+            checkedAt,
+        });
+    }
+    async function handleSearch(req, res) {
+        let parsed;
+        try {
+            parsed = JSON.parse(await readBody(req));
+        }
+        catch {
+            sendJson(res, 400, { ok: false, error: 'body 不是 JSON' });
+            return;
+        }
+        const supplier = (parsed.supplier ?? '').trim();
+        if (supplier !== 'dida-portal') {
+            sendJson(res, 400, { ok: false, error: `未知供应商通道 ${supplier || '(空)'}(M0 仅 dida-portal)` });
+            return;
+        }
+        try {
+            const result = await withLock(supplier, () => search({
+                entryUrl: parsed.query?.entryUrl,
+                timeoutMs: parsed.query?.timeoutMs,
+                auditPath: options.auditPath,
+                bridge: queue,
+            }));
+            if (result.verdict === 'cooldown') {
+                res.setHeader('retry-after', '30');
+                sendJson(res, 429, { ok: false, verdict: result.verdict, error: result.error, evidence: result.evidence });
+                return;
+            }
+            sendJson(res, 200, {
+                ok: result.ok,
+                verdict: result.verdict,
+                supplier,
+                rates: result.rates ?? [],
+                evidence: result.evidence,
+                latencyMs: result.latencyMs,
+                fetchedAt: new Date().toISOString(),
+                ...(result.error ? { error: result.error } : {}),
+            });
+        }
+        catch (e) {
+            sendJson(res, 500, { ok: false, error: `会话检索异常: ${e instanceof Error ? e.message.slice(0, 200) : String(e)}` });
+        }
+    }
+    async function handleLoginOpen(req, res) {
+        let parsed;
+        try {
+            parsed = JSON.parse(await readBody(req));
+        }
+        catch {
+            sendJson(res, 400, { ok: false, error: 'body 不是 JSON' });
+            return;
+        }
+        const supplier = (parsed.supplier ?? '').trim();
+        if (supplier !== 'dida-portal') {
+            sendJson(res, 400, { ok: false, error: `未知供应商通道 ${supplier || '(空)'}` });
+            return;
+        }
+        const url = (parsed.url ?? '').trim() || 'https://portal.dida.com/login';
+        if (!/^https:\/\/portal\.dida\.com\//.test(url)) {
+            sendJson(res, 400, { ok: false, error: '登录入口必须落在 https://portal.dida.com/ 域内(fail-closed)' });
+            return;
+        }
+        const outcome = await extensionOpenLogin({ site: supplier, url, timeoutMs: 20_000 }, queue);
+        if (!outcome.ok) {
+            const verdict = classifyBridgeFailure(outcome.kind);
+            sendJson(res, verdict === 'needs-extension' ? 503 : 502, { ok: false, verdict, error: outcome.summary });
+            return;
+        }
+        sendJson(res, 200, { ok: true, opened: true, url, note: '登录页已在会话所属浏览器置前台打开(验证码人过);gotry 永不经手密码/cookie 值' });
+    }
+    return {
+        name: 'session-search',
+        routes: [
+            { method: 'GET', path: '/v1/session/status', handle: (req, res) => { if (authorized(req, res))
+                    void handleStatus(res); } },
+            { method: 'POST', path: '/v1/session/search', handle: (req, res) => { if (authorized(req, res))
+                    void handleSearch(req, res); } },
+            { method: 'POST', path: '/v1/session/login/open', handle: (req, res) => { if (authorized(req, res))
+                    void handleLoginOpen(req, res); } },
+            // 桥协议端点:远程扩展经 bearer 鉴权连入;Origin 白名单在队列处理器内再校验一道
+            { method: 'GET', path: '/v1/session/bridge/health', handle: (req, res) => { if (authorized(req, res))
+                    queue.handleMountedRequest(req, res); } },
+            { method: 'GET', path: '/v1/session/bridge/status', handle: (req, res) => { if (authorized(req, res))
+                    queue.handleMountedRequest(req, res); } },
+            { method: 'POST', path: '/v1/session/bridge/jobs', handle: (req, res) => { if (authorized(req, res))
+                    queue.handleMountedRequest(req, res); } },
+            { method: 'POST', path: '/v1/session/bridge/results', handle: (req, res) => { if (authorized(req, res))
+                    queue.handleMountedRequest(req, res); } },
+        ],
+        close: () => queue.close(),
+    };
+}