@danceiny/gotry 0.0.1-rc.21 → 0.0.1-rc.24

package/dist/src/z3-shared.js

@@ -1,18 +1,284 @@
+/**
+ * Z3 WASM 运行时单例(README Known limitations「Z3 WASM race」的根治面)。
+ *
+ * 历史:engine/journey/unified 三模块各自 `init().Context('main')`:
+ *   - 一进程内并存 2-3 份独立 WASM 实例(内存放大;系统压力下 2GB 堆分配失败的 OOM 形态);
+ *   - 候选求解用 Promise.all 并发多候选共享同一 Context,z3-solver 的 async API
+ *     (Asyncify)不允许并发 unwind,交错即栈损坏 → `memory access out of bounds`
+ *     (run-all §1 重试止血的真因;rc.4 曾试统一单例但残留自建 Context 触发 mismatch 被回滚)。
+ *
+ * #227 补充:
+ *   - getZ3 必须在第一个 await 之前缓存 Promise,否则冷启动并发会创建多个 Context 对象;
+ *   - z3-solver 5.2.0 high-level FinalizationRegistry 的 cleanup 直接调用 low-level
+ *     `dec_ref`/`*_dec_ref`,不经过 GoTry `withZ3`。V8 判定对象不可达的时机保持不变;
+ *     GoTry 只在 Z3 会话活跃时把实际 native cleanup 推迟到会话 settle 后同步 drain,
+ *     防止 GC cleanup 与 check()/AST 构造并发碰同一 WASM heap。
+ *
+ * 现在的口径:三模块全部 import 本模块——单一 WASM 实例 + 单一 Context + 会话级
+ * 互斥(await chain 占链)。低层 cleanup 队列是局部包装,不替换全局 FinalizationRegistry,
+ * 不主动 free 仍可达对象;显式 release/GC finalizer 仍由 z3-solver 的所有权语义决定。
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+const MAX_DEFERRED_CLEANUPS = parseCleanupQueueLimit();
+const ASYNC_LOW_LEVEL_CALLS = new Set([
+    'simplify', 'simplify_ex', 'eval_smtlib2_string',
+    'tactic_apply', 'tactic_apply_ex',
+    'solver_check', 'solver_check_assumptions', 'solver_get_consequences', 'solver_cube',
+    'algebraic_roots', 'algebraic_eval',
+    'fixedpoint_query', 'fixedpoint_query_relations', 'fixedpoint_query_from_lvl',
+    'optimize_check', 'polynomial_subresultants',
+]);
+const nestedSession = new AsyncLocalStorage();
+const cleanupWrappedFunctions = new Set();
+const asyncWrappedFunctions = new Set();
+const nativeCleanupCalls = {};
+const deferredCleanupCalls = {};
+const drainedCleanupCalls = {};
+const deferredCleanups = [];
+const nativeIdleWaiters = [];
 let z3Promise = null;
+let z3SessionActive = false;
+let activeNativeCalls = 0;
+let z3Poisoned = null;
+let maxDeferredQueueDepth = 0;
+const lifecycleStats = {
+    initAttempts: 0,
+    contextsCreated: 0,
+    concurrentDecRefEnabled: 0,
+    sessionsStarted: 0,
+    sessionsSettled: 0,
+};
+/** 求解互斥链:后到会话排队等前一会话完全 settle(成败皆放行,不吞异常) */
 let chain = Promise.resolve();
+function incCounter(counters, name) {
+    counters[name] = (counters[name] ?? 0) + 1;
+}
+function parseCleanupQueueLimit() {
+    const raw = process.env.GOTRY_Z3_CLEANUP_QUEUE_LIMIT ?? '2000000';
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value <= 0)
+        throw new Error(`GOTRY_Z3_CLEANUP_QUEUE_LIMIT must be a positive integer: ${raw}`);
+    return value;
+}
+function poisonZ3(error, fatalNative = false) {
+    const err = error instanceof Error ? error : new Error(String(error));
+    if (!z3Poisoned)
+        z3Poisoned = { error: err, fatalNative };
+    else
+        z3Poisoned.fatalNative = z3Poisoned.fatalNative || fatalNative;
+    return err;
+}
+function poisonMessage() {
+    return z3Poisoned ? z3Poisoned.error.message : null;
+}
+function hasFatalNativePoison() {
+    return z3Poisoned ? z3Poisoned.fatalNative : false;
+}
+function callNativeCleanup(name, invoke, fromDrain) {
+    try {
+        invoke();
+        if (fromDrain)
+            incCounter(drainedCleanupCalls, name);
+        return null;
+    }
+    catch (error) {
+        const err = poisonZ3(error, isFatalZ3Error(error));
+        // This wrapper can be reached from z3-solver's FinalizationRegistry cleanup.
+        // Never throw from the cleanup call-site; surface the poison at the next controlled withZ3 entry.
+        return err;
+    }
+}
+function deferNativeCleanup(cleanup) {
+    deferredCleanups.push(cleanup);
+    incCounter(deferredCleanupCalls, cleanup.name);
+    if (deferredCleanups.length > maxDeferredQueueDepth)
+        maxDeferredQueueDepth = deferredCleanups.length;
+    if (deferredCleanups.length > MAX_DEFERRED_CLEANUPS) {
+        poisonZ3(new Error(`Z3 cleanup queue overflow (${deferredCleanups.length}/${MAX_DEFERRED_CLEANUPS})`), false);
+    }
+}
+function beginNativeCall() {
+    activeNativeCalls += 1;
+}
+function finishNativeCall() {
+    activeNativeCalls -= 1;
+    if (activeNativeCalls < 0) {
+        activeNativeCalls = 0;
+        poisonZ3(new Error('Z3 native async call counter underflow'));
+    }
+    if (activeNativeCalls === 0) {
+        for (const resolve of nativeIdleWaiters.splice(0))
+            resolve();
+        if (!z3SessionActive && !hasFatalNativePoison())
+            drainDeferredCleanups();
+    }
+}
+async function waitForNativeIdle() {
+    if (activeNativeCalls === 0)
+        return;
+    await new Promise(resolve => nativeIdleWaiters.push(resolve));
+}
+function trackNativePromise(name, promise) {
+    return promise.then(value => value, error => {
+        if (isFatalZ3Error(error))
+            poisonZ3(error, true);
+        throw error;
+    }).finally(() => finishNativeCall());
+}
+function drainDeferredCleanups() {
+    let firstError = null;
+    while (deferredCleanups.length > 0) {
+        const cleanup = deferredCleanups.pop();
+        const err = callNativeCleanup(cleanup.name, cleanup.invoke, true);
+        if (!err)
+            continue;
+        if (!firstError)
+            firstError = err;
+        if (hasFatalNativePoison()) {
+            deferredCleanups.push(cleanup);
+            break;
+        }
+    }
+    return firstError;
+}
+function installZ3RuntimeGuards(Z3) {
+    for (const name of Object.keys(Z3)) {
+        if (ASYNC_LOW_LEVEL_CALLS.has(name)) {
+            const original = Z3[name];
+            if (typeof original === 'function' && !original.__gotryNativeAsyncWrapped) {
+                const wrapped = (...args) => {
+                    beginNativeCall();
+                    let result;
+                    try {
+                        result = original(...args);
+                    }
+                    catch (error) {
+                        if (isFatalZ3Error(error))
+                            poisonZ3(error, true);
+                        finishNativeCall();
+                        throw error;
+                    }
+                    if (result instanceof Promise)
+                        return trackNativePromise(name, result);
+                    finishNativeCall();
+                    return result;
+                };
+                Object.defineProperty(wrapped, '__gotryNativeAsyncWrapped', { value: true });
+                Z3[name] = wrapped;
+                asyncWrappedFunctions.add(name);
+            }
+        }
+        if (name !== 'dec_ref' && !name.endsWith('_dec_ref'))
+            continue;
+        const original = Z3[name];
+        if (typeof original !== 'function' || original.__gotryCleanupQueueWrapped)
+            continue;
+        const wrapped = (...args) => {
+            incCounter(nativeCleanupCalls, name);
+            const invoke = () => original(...args);
+            if (hasFatalNativePoison() || z3SessionActive || activeNativeCalls > 0) {
+                deferNativeCleanup({ name, args, invoke });
+                return undefined;
+            }
+            return callNativeCleanup(name, invoke, false);
+        };
+        Object.defineProperty(wrapped, '__gotryCleanupQueueWrapped', { value: true });
+        Z3[name] = wrapped;
+        cleanupWrappedFunctions.add(name);
+    }
+}
+/** Initialize one shared Context and install the local low-level cleanup queue. */
+export async function initZ3Context(loadInit) {
+    lifecycleStats.initAttempts += 1;
+    const api = await loadInit();
+    installZ3RuntimeGuards(api.Z3);
+    const ctx = api.Context('main');
+    lifecycleStats.contextsCreated += 1;
+    if (typeof api.Z3.enable_concurrent_dec_ref !== 'function') {
+        throw new Error('z3-solver low-level API missing enable_concurrent_dec_ref; refusing unsafe Z3 context');
+    }
+    api.Z3.enable_concurrent_dec_ref(ctx.ptr);
+    lifecycleStats.concurrentDecRefEnabled += 1;
+    return ctx;
+}
 export async function getZ3() {
+    // 延迟到首次实际求解才加载:避免 dsh 加载 GoTry 模块时启动 WASM worker。
+    // Promise 必须在第一个 await 之前写入缓存,防冷启动并发创建多 Context。
     if (!z3Promise) {
-        const { init } = await import('z3-solver');
-        z3Promise = (async ()=>(await init()).Context('main'))();
+        z3Promise = (async () => {
+            const { init } = await import('z3-solver');
+            return initZ3Context(init);
+        })().catch(error => {
+            z3Promise = null;
+            throw error;
+        });
     }
     return z3Promise;
 }
+/** Z3 求解会话互斥门:全程独占 WASM 实例,防 Asyncify 并发 unwind(栈损坏根因)。 */
 export async function withZ3(label, session) {
+    const outer = nestedSession.getStore();
+    if (outer)
+        throw new Error(`nested withZ3 is forbidden (${outer} -> ${label})`);
     const z3 = await getZ3();
-    const turn = chain.then(()=>session(z3));
-    chain = turn.then(()=>undefined, ()=>undefined);
+    const turn = chain.then(() => nestedSession.run(label, () => runZ3Session(label, z3, session)));
+    // 链推进到本会话 settlement(吞掉的只是链上对前序错误的转发,异常仍从本会话返回值抛出)
+    chain = turn.then(() => undefined, () => undefined);
     return turn;
 }
-
-
-//# sourceURL=ts/src/z3-shared.ts
+async function runZ3Session(label, z3, session) {
+    if (poisonMessage())
+        throw new Error(`Z3 context is poisoned; refusing new solve (${poisonMessage()})`);
+    lifecycleStats.sessionsStarted += 1;
+    z3SessionActive = true;
+    let value;
+    let sessionFailed = false;
+    let sessionError;
+    let cleanupError = null;
+    try {
+        value = await session(z3);
+    }
+    catch (error) {
+        sessionFailed = true;
+        sessionError = error;
+    }
+    finally {
+        await waitForNativeIdle();
+        if (sessionFailed && isFatalZ3Error(sessionError))
+            poisonZ3(sessionError, true);
+        z3SessionActive = false;
+        cleanupError = hasFatalNativePoison() ? null : drainDeferredCleanups();
+        lifecycleStats.sessionsSettled += 1;
+    }
+    if (sessionFailed) {
+        if (cleanupError && typeof sessionError === 'object' && sessionError !== null) {
+            ;
+            sessionError.z3CleanupError = cleanupError;
+        }
+        throw sessionError;
+    }
+    if (cleanupError)
+        throw cleanupError;
+    if (poisonMessage())
+        throw new Error(`Z3 context is poisoned after ${label}; refusing result reuse (${poisonMessage()})`);
+    return value;
+}
+function isFatalZ3Error(error) {
+    const text = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+    return /memory access out of bounds|corrupted (?:its )?heap memory|RuntimeError: Aborted|abort\(Runtime error/i.test(text);
+}
+export function getZ3LifecycleStats() {
+    return {
+        ...lifecycleStats,
+        cleanupWrappedFunctions: [...cleanupWrappedFunctions].sort(),
+        asyncWrappedFunctions: [...asyncWrappedFunctions].sort(),
+        cleanupQueueLimit: MAX_DEFERRED_CLEANUPS,
+        activeNativeCalls,
+        nativeCleanupCalls: { ...nativeCleanupCalls },
+        deferredCleanupCalls: { ...deferredCleanupCalls },
+        drainedCleanupCalls: { ...drainedCleanupCalls },
+        maxDeferredQueueDepth,
+        currentDeferredQueueDepth: deferredCleanups.length,
+        poisoned: poisonMessage(),
+    };
+}

package/extension/README.md

@@ -4,6 +4,7 @@
 
 ## 它做什么 / 不做什么
 
+- ✅ 检索范围(2026-09-09 起):携程机票/酒店、12306 余票、**Dida 供应商门户实时价**(`portal.dida.com`;站点 job 经桥按站点 capability 路由,扩展只被动嗅探页面自身请求)。
 - ✅ 检索:你(或 agent)发起会话检索时,后台标签页打开携程机票列表页,被动嗅探页面自己发出的 `batchSearch` 响应,文本回传给本机的 gotry。收尾自动关闭自己开的标签。
 - ✅ 登录检查:只读登录票据 cookie 的**名字**(cticket/uid/uname/passport),判断「是否已登录」这个布尔事实。
 - ✅ 登录引导:把登录入口页**置前台**打开,登录由你在携程官网完成。
@@ -26,7 +27,7 @@
 不经商店审核,版本化 tarball + SHA256 校验,与 npm 发版节奏解耦,更新比商店快:
 
 ```bash
-npx gotry setup --extension-from=github   # 自动下载校验并落位 ~/.gotry/extension
+npx @danceiny/gotry setup --extension-from=github   # 自动下载校验并落位 ~/.gotry/extension
 ```
 
 (或手动:从 [github.com/Danceiny/gotry/releases](https://github.com/Danceiny/gotry/releases) 标签 `ext-*` 下载 `gotry-session-bridge.tar.gz` 解压到任意固定位置。)
@@ -36,7 +37,7 @@ npx gotry setup --extension-from=github   # 自动下载校验并落位 ~/.gotry
 ### 方式三:npm 包内副本本地加载(离线确定性)
 
 ```bash
-npx gotry setup   # 把包内扩展落位到 ~/.gotry/extension
+npx @danceiny/gotry setup   # 把包内扩展落位到 ~/.gotry/extension
 ```
 
 再按方式二的 `chrome://extensions` 三步加载该目录。
@@ -47,4 +48,4 @@ npx gotry setup   # 把包内扩展落位到 ~/.gotry/extension
 
 - 商店版扩展 ID 固定为 `oeajpiccmonococjcegddlooeeohlbgd`(商店用自己的签名 key,与 unpacked 版 ID 不同,二者都是同一扩展,本机 gotry 桥双通道同信);
 - 本地加载(unpacked)版扩展 ID 应为固定的 `olpgkofjhhiiiahdkkbcninhjmegghfe`(manifest 带 `key`,跨机器稳定)——若不一致,说明 manifest 被改动过,不要加载;
-- gotry 侧运行 `npx gotry` 后发起一次会话检索,扩展图标应出现(无需点击);桥状态可看 `curl http://127.0.0.1:8791/status`(仅本机回环)。
+- gotry 侧运行 `npx @danceiny/gotry` 后发起一次会话检索,扩展图标应出现(无需点击);桥状态可看 `curl http://127.0.0.1:8791/status`(仅本机回环)。

package/extension/background.js

@@ -10,6 +10,15 @@
  *       cookie-names → chrome.cookies 只读票据 cookie **名字**(值即取即弃,永不离开扩展——红线)。
  *   - 物理只读(ReadGuard 扩展车道形态):本 SW 绝不向站点发任何请求——检索请求由站点自己的
  *     页面代码发出,我们只「导航 + 被动转发 NETWORK_HINTS 命中响应」;写不是被禁止的行为,是不存在的原语。
+ *
+ * 桥地址(2026-09-11,founder 定案:执行环境=浏览器客户端,服务端零 Chrome):
+ *   扩展**完全不暴露任何配置**给员工。hotel-be portal 在员工已登录的页面里通过
+ *   content-bridge.js 派发 `gotry-join` 消息({bridgeUrl, token}),SW 缓存到
+ *   `joinTicket` 模块变量;员工从未看见 URL / token / API host 等技术字眼。
+ *   SW 进程重启(约每 30s 节律)→ ticket 丢失 → 下次员工打开 portal 页面自动重发 → 静默恢复。
+ *
+ *   桌面形态(loopback 端口池)保留向后兼容:无 join ticket 时回退到 127.0.0.1 探测,
+ *   这是 gotry 桌面开发场景(gotry CLI 同机形态),与员工日常产品路径无关。
  */
 
 'use strict'
@@ -34,6 +43,13 @@ const SITES = {
     domain: '12306.cn',
     ticketNames: [],
   },
+  // Dida 供应商门户(2026-09-09 实装;hotel-be portal integration 迁移线):
+  // 员工登录态(HttpOnly 会话 cookie 只读名字,值即取即弃);检索走 portal.dida.com
+  // 后台标签 + 被动嗅探 portal-webapi 实时价
+  'dida-portal': {
+    domain: 'dida.com',
+    ticketNames: ['CN_M_DidaTravel'],
+  },
 }
 
 /** 检索 URL 白名单(per-site;search job 只允许开各自站点域,其余一律拒) */
@@ -41,31 +57,71 @@ const SITE_SEARCH_PREFIXES = {
   'ctrip-flight': 'https://flights.ctrip.com/',
   'ctrip-hotel': 'https://hotels.ctrip.com/',
   'train-12306': 'https://kyfw.12306.cn/',
+  'dida-portal': 'https://portal.dida.com/',
 }
 
+/**
+ * join ticket:由 hotel-be portal 通过 content-bridge 派发,SW 缓存;
+ * 模块级变量,SW 重启即清空(下次 portal 页派发即恢复,无需持久化)。
+ * 形态:{ bridgeUrl, token, issuedAt, expiresAt }
+ */
+let joinTicket = null
 let activePort = null
 let polling = false
 
+function isJoinFresh(t) {
+  if (!t || typeof t.bridgeUrl !== 'string' || !t.bridgeUrl) return false
+  if (t.expiresAt && Number.isFinite(Date.parse(t.expiresAt)) && Date.parse(t.expiresAt) < Date.now()) return false
+  return true
+}
+
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms))
 }
 
-async function detectPort() {
+async function detectBridge() {
+  // 远程 join ticket 优先:portal 派发则连远程
+  if (isJoinFresh(joinTicket)) {
+    try {
+      const r = await fetch(`${joinTicket.bridgeUrl.replace(/\/+$/, '')}/health`, {
+        headers: { authorization: `Bearer ${joinTicket.token ?? ''}`, 'x-gotry-bridge': 'v1' },
+      })
+      if (r.ok) return true
+    } catch { /* 远程暂不可达;若也无可用 loopback 则继续重试 */ }
+  }
+  // 桌面形态兜底:loopback 端口池扫描
   for (const p of BRIDGE_PORTS) {
     try {
       const r = await fetch(`http://127.0.0.1:${p}/health`, { headers: { 'x-gotry-bridge': 'v1' } })
-      if (r.ok) return p
+      if (r.ok) { activePort = p; return true }
     } catch { /* 无人监听,试下一个端口 */ }
   }
-  return null
+  return false
+}
+
+function bridgeBase() {
+  if (isJoinFresh(joinTicket)) return joinTicket.bridgeUrl.replace(/\/+$/, '')
+  return activePort != null ? `http://127.0.0.1:${activePort}` : null
+}
+
+function bridgeHeaders(withJson) {
+  const h = { 'x-gotry-bridge': 'v1' }
+  if (withJson) h['content-type'] = 'application/json'
+  if (isJoinFresh(joinTicket) && joinTicket.token) h['authorization'] = `Bearer ${joinTicket.token}`
+  return h
 }
 
 async function postResult(jobId, result) {
-  if (activePort == null || !jobId) return
+  const base = bridgeBase()
+  if (base == null || !jobId) return
+  // 远程桥挂载在 gotry-backend 精确路由内核上,jobId 走 query;loopback 独立桥保持路径式
+  const url = isJoinFresh(joinTicket)
+    ? `${base}/results?jobId=${encodeURIComponent(jobId)}`
+    : `${base}/results/${encodeURIComponent(jobId)}`
   try {
-    await fetch(`http://127.0.0.1:${activePort}/results/${encodeURIComponent(jobId)}`, {
+    await fetch(url, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', 'x-gotry-bridge': 'v1' },
+      headers: bridgeHeaders(true),
       body: JSON.stringify(result),
     })
   } catch { /* 桥可能已退场;Node 侧超时兜底 */ }
@@ -81,6 +137,41 @@ async function ticketNames(site) {
     .filter((n) => conf.ticketNames.includes(n))
 }
 
+/** dida 推荐流多回包分类(与 Node 侧 mergeDidaRatesBodies 对账,run-all §38 防漂移断言守住) */
+function classifyDidaSniff(url) {
+  if (/SearchHomepageRecommendHotels/i.test(url)) return 'hotels'
+  if (/SearchHomepageRecommendPrices/i.test(url)) return 'recommendPrices'
+  if (/HotelPriceAPI\/SearchRealTime/i.test(url)) return 'realtime'
+  return null
+}
+
+/** multiCollect(dida 推荐流):hotels+recommendPrices 齐即结算;超时带回已见分桶(诚实缺桶) */
+function waitSniffMulti(tabId, timeoutMs) {
+  return new Promise((resolve) => {
+    const bodies = {}
+    let settled = false
+    let title = ''
+    const finish = () => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      chrome.runtime.onMessage.removeListener(handler)
+      resolve({ ok: true, kind: 'search', bodies, title, timeout: !(bodies.hotels && bodies.recommendPrices) })
+    }
+    const handler = (msg, sender) => {
+      if (!sender || !sender.tab || sender.tab.id !== tabId) return
+      if (msg && msg.type === 'gotry-page') { title = String(msg.title ?? title); return }
+      if (msg && msg.type === 'gotry-sniff') {
+        const cls = classifyDidaSniff(String(msg.url ?? ''))
+        if (cls && !bodies[cls]) bodies[cls] = String(msg.body ?? '')
+        if (bodies.hotels && bodies.recommendPrices) finish()
+      }
+    }
+    const timer = setTimeout(finish, Math.max(Number(timeoutMs) || 30_000, 5_000))
+    chrome.runtime.onMessage.addListener(handler)
+  })
+}
+
 /** 后台标签等嗅探回包;超时带回页标题(供 Node 侧 CHALLENGE_RE 判定),收尾关自己的标签 */
 function waitSniff(tabId, timeoutMs) {
   return new Promise((resolve) => {
@@ -93,14 +184,14 @@ function waitSniff(tabId, timeoutMs) {
         settled = true
         clearTimeout(timer)
         chrome.runtime.onMessage.removeListener(handler)
-        resolve({ ok: true, kind: 'search', body: String(msg.body ?? ''), title })
+        resolve({ ok: true, kind: 'search', body: String(msg.body ?? ''), url: String(msg.url ?? ''), title })
       }
     }
     const timer = setTimeout(() => {
       if (settled) return
       settled = true
       chrome.runtime.onMessage.removeListener(handler)
-      resolve({ ok: false, kind: 'search', timeout: true, title })
+      resolve({ ok: false, kind: 'search', timeout: true, url: '', title })
     }, Math.max(Number(timeoutMs) || 30_000, 5_000))
     chrome.runtime.onMessage.addListener(handler)
   })
@@ -136,7 +227,9 @@ async function handleJob(job) {
         return
       }
       const tab = await chrome.tabs.create({ url: job.url, active: false })
-      const result = await waitSniff(tab.id, job.timeoutMs)
+      const result = job.multiCollect
+        ? await waitSniffMulti(tab.id, job.timeoutMs)
+        : await waitSniff(tab.id, job.timeoutMs)
       await chrome.tabs.remove(tab.id).catch(() => { /* 用户先关了,无妨 */ })
       await postResult(jobId, result)
       return
@@ -152,12 +245,14 @@ async function loop() {
   polling = true
   try {
     for (;;) {
-      if (activePort == null) activePort = await detectPort()
-      if (activePort == null) { await sleep(RETRY_MS); continue }
+      if (bridgeBase() == null) {
+        const up = await detectBridge()
+        if (!up) { await sleep(RETRY_MS); continue }
+      }
       try {
-        const r = await fetch(`http://127.0.0.1:${activePort}/jobs`, {
+        const r = await fetch(`${bridgeBase()}/jobs`, {
           method: 'POST',
-          headers: { 'content-type': 'application/json', 'x-gotry-bridge': 'v1' },
+          headers: bridgeHeaders(true),
           body: JSON.stringify({
             extensionVersion: chrome.runtime.getManifest().version,
             capabilities: Object.keys(SITES),
@@ -172,8 +267,24 @@ async function loop() {
   }
 }
 
+/**
+ * portal content-bridge 派发入口(2026-09-11):hotel-be portal 在员工已登录的
+ * 页面里通过 content-bridge.js 发 `gotry-join` 消息,SW 静默接收并缓存 ticket。
+ * 员工从未看见这些消息;任何外部源都可发,但 ticket 必须由 hotel-be 后端签发,
+ * Node 侧通过 Bearer 鉴权校验 ticket 内 token 才认账。
+ */
+chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
+  if (msg && msg.type === 'gotry-join' && msg.ticket && typeof msg.ticket.bridgeUrl === 'string') {
+    joinTicket = msg.ticket
+    activePort = null
+    sendResponse && sendResponse({ ok: true })
+    return false
+  }
+  return false
+})
+
 // SW 冷启动 + 闹钟兜底双保险;loop() 幂等
 if (chrome.runtime.onStartup) chrome.runtime.onStartup.addListener(() => { void loop() })
 chrome.alarms.create('gotry-bridge-poll', { periodInMinutes: 0.5 })
 chrome.alarms.onAlarm.addListener((a) => { if (a.name === 'gotry-bridge-poll') void loop() })
-void loop()
+void loop()

package/extension/content-bridge.js

@@ -6,11 +6,26 @@
  * Service Worker(onMessage 按 sender.tab.id 归属到对应 search job)。
  *
  * 附带页标题快报(gotry-page):SW 在嗅探超时/挑战判定(CHALLENGE_RE)时用它。
+ *
+ * Join 投递(2026-09-11,hotelbyte 产品定案):hotel-be portal 在员工已登录的
+ * 页面里挂一段 `window.__gotryJoinTicket = {...}` 即可,本脚本负责:
+ *   - 页面派发 ticket → SW 静默接收(员工全程不接触 URL/token);
+ *   - ticket 未注入 → 静默 no-op(扩展安静等下次 portal 页加载);
+ *   - portal 自己负责派发的合规性(token 由 portal 后端签发,扩展不验签,
+ *     Node 侧 gotry-backend 经 Bearer 校验——信任链在 hotel-be ↔ gotry-backend 之间)。
  */
 ;(function () {
   if (window.__gotrySniffBridge) return
   window.__gotrySniffBridge = true
 
+  function dispatchJoinTicket() {
+    try {
+      var t = window.__gotryJoinTicket
+      if (!t || typeof t.bridgeUrl !== 'string' || !t.bridgeUrl) return
+      chrome.runtime.sendMessage({ type: 'gotry-join', ticket: t }).catch(function () { /* SW 重启中 */ })
+    } catch { /* 不抛 */ }
+  }
+
   window.addEventListener('gotry-ctrip-sniff', function (ev) {
     try {
       var d = (ev && ev.detail) || {}
@@ -33,9 +48,16 @@
       }).catch(function () { /* SW 侧无等待者,常态丢弃 */ })
     } catch { /* 环境异常不抛 */ }
   }
+  // 页面派发新票据时重取(2026-09-11,hotel-be 侧 C16 落地配套):
+  // portal 的票据是**异步**取回的(fetch bridgeTicket),通常晚于 DOMContentLoaded,
+  // 上面那次一次性读取会错过;hotel-be 每次写入/刷新 window.__gotryJoinTicket 都会
+  // 在 window 上派发该事件 → 这里重取一次即可(不需要轮询,也不引入任何配置面)。
+  window.addEventListener('gotry-join-ticket-available', dispatchJoinTicket)
+
   if (document.readyState === 'loading') {
-    window.addEventListener('DOMContentLoaded', sendPage, { once: true })
+    window.addEventListener('DOMContentLoaded', function () { sendPage(); dispatchJoinTicket() }, { once: true })
   } else {
     sendPage()
+    dispatchJoinTicket()
   }
 })()

package/extension/content-main.js

@@ -24,11 +24,17 @@
   var HOTEL_HINT_RE = /hotels\.ctrip\.com\/(hotels\/api|domestic\/pc\/api)|GetHotelListBySOA|GetHotelListByCity|HotelSearch|hotelsearch|restapi\/soa2\/\d+\/fetchHotelList/i
   /** 火车(2026-09-03 实装):12306 余票查询 XHR(负载均衡变体 queryG/Z/A/U 全命中) */
   var TRAIN_HINT_RE = /leftTicket\/query/i
+  /** Dida 供应商门户(2026-09-09 实装):portal-webapi 实时价/价格监控
+   * (与 Node 侧 DIDA_NETWORK_HINTS 对账,run-all §38 防漂移断言守住) */
+  var DIDA_HINT_RE = /portal-webapi\.dida\.com\/HotelPriceAPI\/SearchRealTime|portal-webapi\.dida\.com\/HotelPriceAPI\/SearchMonitor|portal-webapi\.dida\.com\/HotelRecommendAPI\/SearchHomepageRecommendHotels|portal-webapi\.dida\.com\/HotelRecommendAPI\/SearchHomepageRecommendPrices|portal-webapi\.dida\.com\/PopularDestinationAPI\/SearchHotels|portal-webapi\.dida\.com\/PopularDestinationAPI\/SearchHotelPrices/i
+  /** 形状嗅探签名(dida 实时价信封;与 Node 侧 looksLikeDidaRatesBody 签名一致) */
+  var DIDA_BODY_SIG_RE = /"HotelPriceList"|"RatePlanList"/
   /** 形状嗅探(酒店页兜底;与 Node 侧 looksLikeHotelListBody 签名一致) */
   var HOTEL_BODY_SIG_RE = /"hotelList"|"hotelMatchInfos"|"hotelName"/
   var HOTEL_BODY_MAX = 2_000_000
   var isHotelPage = /(^|\.)hotels\.ctrip\.com$/.test(location.hostname)
   var isTrainPage = /(^|\.)12306\.cn$/.test(location.hostname)
+  var isDidaPage = /(^|\.)portal\.dida\.com$/.test(location.hostname)
 
   function dispatch(url, body) {
     try {
@@ -42,6 +48,9 @@
   function trainPageWants(url) {
     return isTrainPage && TRAIN_HINT_RE.test(url)
   }
+  function didaPageWants(url) {
+    return isDidaPage && DIDA_HINT_RE.test(url)
+  }
 
   var origFetch = window.fetch
   if (typeof origFetch === 'function') {
@@ -51,7 +60,7 @@
           var url = ''
           if (typeof input === 'string') url = input
           else if (input && typeof input.url === 'string') url = input.url
-          var urlHint = FLIGHT_HINT_RE.test(url) || hotelPageWants(url) || trainPageWants(url)
+          var urlHint = FLIGHT_HINT_RE.test(url) || hotelPageWants(url) || trainPageWants(url) || didaPageWants(url)
           var isPost = false
           try { isPost = String((init && init.method) || (input && input.method) || 'GET').toUpperCase() === 'POST' } catch { /* ignore */ }
           var capOk = true
@@ -63,7 +72,8 @@
             var clone = res.clone()
             clone.text().then(function (t) {
               try {
-                if (urlHint || (t.length <= HOTEL_BODY_MAX && HOTEL_BODY_SIG_RE.test(t))) dispatch(url, t)
+                var responseUrl = typeof res.url === 'string' ? res.url : ''
+                if (urlHint || (t.length <= HOTEL_BODY_MAX && HOTEL_BODY_SIG_RE.test(t)) || (t.length <= HOTEL_BODY_MAX && DIDA_BODY_SIG_RE.test(t))) dispatch(responseUrl, t)
               } catch { /* 嗅探失败不影响站点自身 */ }
             }).catch(function () { /* 流不可读则跳过 */ })
           }
@@ -85,14 +95,15 @@
     xhr.addEventListener('load', function () {
       try {
         if (!xhr.__gotryUrl) return
-        var urlHint = FLIGHT_HINT_RE.test(xhr.__gotryUrl) || hotelPageWants(xhr.__gotryUrl) || trainPageWants(xhr.__gotryUrl)
+        var urlHint = FLIGHT_HINT_RE.test(xhr.__gotryUrl) || hotelPageWants(xhr.__gotryUrl) || trainPageWants(xhr.__gotryUrl) || didaPageWants(xhr.__gotryUrl)
         if (!urlHint && !(isHotelPage && xhr.__gotryMethod === 'POST')) return
         var body = ''
         if (xhr.responseType === '' || xhr.responseType === 'text') body = xhr.responseText
         else if (xhr.responseType === 'json') body = JSON.stringify(xhr.response)
         else return
         if (!body) return
-        if (urlHint || (body.length <= HOTEL_BODY_MAX && HOTEL_BODY_SIG_RE.test(body))) dispatch(xhr.__gotryUrl, body)
+        var responseUrl = typeof xhr.responseURL === 'string' ? xhr.responseURL : ''
+        if (urlHint || (body.length <= HOTEL_BODY_MAX && HOTEL_BODY_SIG_RE.test(body)) || (body.length <= HOTEL_BODY_MAX && DIDA_BODY_SIG_RE.test(body))) dispatch(responseUrl, body)
       } catch { /* 嗅探失败不影响站点 */ }
     })
     return origSend.apply(this, arguments)