@danceiny/gotry 0.2.0-rc.27 → 0.2.0-rc.29

package/README.md

@@ -153,7 +153,7 @@ Trust is structural, not promised:
 ## Project Status and Roadmap
 Current boundary: deterministic planning and evidence-bound read capabilities are available; booking and real-user acceptance remain outside the shipped claim. See the [architecture](docs/architecture.md) and [roadmap](docs/roadmap.md).
 
-**v0.0.1-rc.24** on npm (`latest`). Pre-1.0: the core loop works end to end; evaluation is still at deterministic contracts and validators, with no external scores or uplift claims. External W2A events are contract-only and inert; no real sensor bridge or consumer is active yet.
+**v0.2.0-rc.28** on npm (`latest`). Pre-1.0: the core loop works end to end; evaluation is still at deterministic contracts and validators, with no external scores or uplift claims. External W2A events are contract-only and inert; no real sensor bridge or consumer is active yet.
 
 **Working today**
 
@@ -209,7 +209,7 @@ Documents ship as bilingual pairs (`x.md` English + `x.zh-CN.md` 中文); diverg
 
 **Built with**: DeepSeek Harness 0.2.0-rc.2 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 · OpenFlights · TypeScript
 
-**Version baseline: `v0.0.1-rc.24` (npm `latest`).** Verification gates: `scripts/run-all-tests.sh`; release flow: `scripts/publish-npm.sh`.
+**Version baseline: `v0.2.0-rc.28` (npm `latest`).** Verification gates: `scripts/run-all-tests.sh`; release flow: `scripts/publish-npm.sh`.
 
 <a href="https://www.star-history.com/?repos=danceiny%2Fgotry&type=date&legend=top-left">
  <picture>

package/README.zh-CN.md

@@ -155,7 +155,7 @@ npx @danceiny/gotry "我想从深圳休整两天,预算 3000"   # headless 一
 ## 状态与路线图
 当前边界：确定性规划与有证据边界的只读能力已经可用；预订与真实用户验收仍不属于当前交付声明。见[架构权威文档](docs/architecture.zh-CN.md)与[路线图](docs/roadmap.zh-CN.md)。
 
-npm `latest`：**v0.0.1-rc.24**。未到 1.0：核心链路已端到端可用；评测仍停留在确定性合同与校验器阶段，无外部分数、无 uplift 声明。外部 W2A 事件仍是合同层、默认 inert；尚无真实 sensor 桥或 consumer 激活。
+npm `latest`：**v0.2.0-rc.28**。未到 1.0：核心链路已端到端可用；评测仍停留在确定性合同与校验器阶段，无外部分数、无 uplift 声明。外部 W2A 事件仍是合同层、默认 inert；尚无真实 sensor 桥或 consumer 激活。
 
 **今天可用**
 
@@ -211,7 +211,7 @@ AI agent：[`AGENTS.md`](AGENTS.zh-CN.md) 是绑定契约——入场先清扫
 
 **Built with**: DeepSeek Harness 0.2.0-rc.2 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 · OpenFlights · TypeScript
 
-**版本基线：`v0.0.1-rc.24`（npm `latest`）。** 验证闸：`scripts/run-all-tests.sh`；发布流程：`scripts/publish-npm.sh`。
+**版本基线：`v0.2.0-rc.28`（npm `latest`）。** 验证闸：`scripts/run-all-tests.sh`；发布流程：`scripts/publish-npm.sh`。
 
 <a href="https://www.star-history.com/?repos=danceiny%2Fgotry&type=date&legend=top-left">
  <picture>

package/bin/gotry-bootstrap.js

@@ -634,6 +634,42 @@ function probe(cmd, args, timeoutMs = 10_000) {
   })
 }
 
+/**
+ * 探测命令 stdout,失败(spawn 错误/非零退出/超时)返回 null。
+ * 在 'close' 而非 'exit' 结算:'exit' 触发时 stdout 管道可能还没读完,输出会丢成空串
+ * (与 ts/capabilities/doctor.ts 的 probeStdout 同一处修复,#622)。
+ */
+function probeStdout(cmd, args, timeoutMs = 10_000) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'ignore'] })
+    let out = ''
+    let done = false
+    const timer = setTimeout(() => {
+      if (!done) { done = true; try { child.kill('SIGKILL') } catch { /* ignore */ } resolve(null) }
+    }, timeoutMs)
+    child.on('error', () => { if (!done) { done = true; clearTimeout(timer); resolve(null) } })
+    child.stdout?.on('data', (d) => { out += d.toString() })
+    child.on('close', (code) => { if (!done) { done = true; clearTimeout(timer); resolve(code === 0 ? out.trim() : null) } })
+  })
+}
+
+/**
+ * 按 `hbcli --json auth whoami` 的输出判凭证(hotelbyte-cli 三档 api_key/portal/customer 任一
+ * configured 即有效),不看退出码——whoami 没有凭证时也退 0,按退出码判会把「没登录」报成「凭证有效」(#623)。
+ * 与工具层 ts/capabilities/doctor.ts 同语义:输出不可解析(超旧版/异常)保守视为有效;取不到输出(null)视为未确认。
+ * 两处实现的一致性由 bootstrap-tests 的 CLI↔工具层对拍守住。
+ */
+function classifyHbcliWhoami(out) {
+  if (out === null) return { ok: false, customer: false }
+  try {
+    const w = JSON.parse(out)
+    const customer = !!w?.customer?.configured
+    return { ok: !!(w?.api_key?.configured || w?.portal?.configured || customer), customer }
+  } catch {
+    return { ok: true, customer: false }
+  }
+}
+
 const say = (s) => console.log(s)
 
 /** hbcli 最低版本(可用 GOTRY_MIN_HBCLI_VERSION 覆盖)。
@@ -664,7 +700,7 @@ async function hbcliVersion(bin) {
     const timer = setTimeout(() => { if (!done) { done = true; try { child.kill('SIGKILL') } catch { /* ignore */ } resolve(null) } }, 10_000)
     child.on('error', () => { if (!done) { done = true; clearTimeout(timer); resolve(null) } })
     child.stdout?.on('data', (d) => { out += d.toString() })
-    child.on('exit', (code) => { if (!done) { done = true; clearTimeout(timer); resolve(code === 0 ? parseVersion(out.trim()) : null) } })
+    child.on('close', (code) => { if (!done) { done = true; clearTimeout(timer); resolve(code === 0 ? parseVersion(out.trim()) : null) } })
   })
 }
 
@@ -855,7 +891,7 @@ async function doctorChecks() {
   // 扩展
   const extManifest = join(homedir(), '.gotry', 'extension', 'manifest.json')
   const extOk = existsSync(extManifest)
-  items.push({ label: 'GoTry Session Bridge 扩展', ok: extOk, level: extOk ? 'ok' : 'missing', detail: extOk ? `已就位(${extManifest})` : '未安装——影响面:gotry_session_search / gotry_session_login(账号会话通道)不可用;携程机票/酒店实时检索、12306 余票、Dida 实时报价都依赖此通道。其它工具(机票 FlyAI、酒店 hbcli、地图、天气等)不受影响', fix: extOk ? undefined : '在 Chrome 应用商店一键安装(自动更新): https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd' })
+  items.push({ label: 'Stai Travel Bridge 扩展', ok: extOk, level: extOk ? 'ok' : 'missing', detail: extOk ? `已就位(${extManifest})` : '未安装——影响面:gotry_session_search / gotry_session_login(账号会话通道)不可用;携程机票/酒店实时检索、12306 余票、Dida 实时报价都依赖此通道。其它工具(机票 FlyAI、酒店 hbcli、地图、天气等)不受影响', fix: extOk ? undefined : '在 Chrome 应用商店一键安装(自动更新): https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd' })
   // agent-reach(.venv 装在包内)
   const venvPython = join(repoRoot, '.venv/bin/python')
   const reachBin = join(repoRoot, '.venv/bin/agent-reach')
@@ -872,8 +908,15 @@ async function doctorChecks() {
     if (v && !versionAtLeast(v, MIN_HBCLI_VERSION)) {
       items.push({ label: 'hbcli(酒店实时源)', ok: false, level: 'missing', detail: `版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——trade.* / search/checkAvail 会 401(issue #142)`, fix: 'npm install -g staicli --registry=https://registry.npmjs.org/' })
     } else {
-      const whoami = await probe(hbBin === 'hbcli(PATH)' ? 'hbcli' : hbBin, ['auth', 'whoami'])
-      items.push({ label: 'hbcli(酒店实时源)', ok: whoami, level: whoami ? 'ok' : 'degraded', detail: whoami ? `已安装且凭证有效(${hbBin}, v${v ? v.join('.') : '?'})` : '二进制在,但凭证未配置/失效——酒店检索将降级静态包(非实时)', fix: whoami ? undefined : 'hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo(快速试用沙箱;正式 key 向 HotelByte 申请)' })
+      // 凭证按 whoami 的 JSON 三档判定,不再看退出码(#623:whoami 无凭证也退 0,旧判法恒报「凭证有效」)
+      const cred = classifyHbcliWhoami(await probeStdout(hbBin === 'hbcli(PATH)' ? 'hbcli' : hbBin, ['--json', 'auth', 'whoami']))
+      items.push({
+        label: 'hbcli(酒店实时源)', ok: cred.ok, level: cred.ok ? 'ok' : 'degraded',
+        detail: cred.ok
+          ? `已安装且凭证有效(${hbBin}, v${v ? v.join('.') : '?'}${cred.customer ? ',customer 档在用(客户邮箱验证码登录)' : ''})`
+          : '二进制在,但凭证未配置/失效——酒店检索将降级静态包(非实时)',
+        fix: cred.ok ? undefined : 'hbcli auth customer-send-code --email you@mail.com 收码后 hbcli auth customer-login --email you@mail.com --code <收件码>(客户邮箱验证码登录,新邮箱即注册,需 npm staicli ≥ 0.0.4);B 端租户注册走 hbcli auth register(先 auth send-code);或 hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo(快速试用沙箱;正式 key 向 HotelByte 申请)',
+      })
     }
   } else {
     items.push({ label: 'hbcli(酒店实时源)', ok: false, level: 'missing', detail: '未安装——酒店检索降级静态包(公开渠道估算,非实时,仅覆盖内置场景)', fix: 'npx @danceiny/gotry doctor --fix' })
@@ -1121,7 +1164,7 @@ function classifyDoctorGap(item, opts = {}) {
     return installerEnabled('hbcli', env) && autoSupported ? 'auto' : 'unavailable'
   }
   if (label.startsWith('dsh-better-sidebar')) return installerEnabled('sidebar', env) && autoSupported ? 'auto' : 'unavailable'
-  if (label.startsWith('GoTry Session Bridge')) return 'user-action' // 浏览器商店一键装
+  if (label.startsWith('Stai Travel Bridge')) return 'user-action' // 浏览器商店一键装
   if (label.startsWith('FlyAI')) return 'user-action' // 上游控制台申请 key
   if (label.startsWith('dsh-calendar')) return 'user-action' // profile cordis.patch.yml 配置
   if (label.startsWith('dsh-map-tools')) return 'unavailable' // 随包 vendor,缺失即重装 gotry
@@ -1400,7 +1443,7 @@ function copyExtensionDir(srcDir, dstDir) {
 
 /** 会话检索扩展(issue #21 方案 C):包内 extension/ → ~/.gotry/extension 幂等落位 + 一次性加载指引 */
 async function setupExtension() {
-  say('[gotry-setup] GoTry Session Bridge 扩展(会话检索数据面 issue #21;一次性安装,替代逐连接弹窗)')
+  say('[gotry-setup] Stai Travel Bridge 扩展(会话检索数据面 issue #21;一次性安装,替代逐连接弹窗)')
   const srcDir = join(repoRoot, 'extension')
   const srcManifest = join(srcDir, 'manifest.json')
   if (!existsSync(srcManifest)) {
@@ -1422,7 +1465,7 @@ async function setupExtension() {
     return { ok: false }
   }
   say(`  ✓ 已落位 ${dstDir}(v${srcVersion};manifest 带固定 key,unpacked 扩展 ID 恒为 olpgkofjhhiiiahdkkbcninhjmegghfe)`)
-  say('  推荐(免下面三步):Chrome 应用商店一键安装 GoTry Session Bridge(自动更新): https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd')
+  say('  推荐(免下面三步):Chrome 应用商店一键安装 Stai Travel Bridge(自动更新): https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd')
   say('  本地加载(每台浏览器一次,约 30 秒):Chrome 打开 chrome://extensions → 右上角开启「开发者模式」→「加载已解压的扩展程序」→ 选择 ~/.gotry/extension')
   say('  获取/更新本地通道扩展可走 GitHub Releases:npx @danceiny/gotry setup --extension-from=github(自动下载校验落位;手动下载: github.com/Danceiny/gotry/releases 标签 ext-*)')
   say('  装好即生效,零系统弹窗;扩展卡片开关=总闸(与 gotry 授权闸 sessionAccess 双重控制)')
@@ -1435,7 +1478,7 @@ async function setupExtension() {
  * 任何失败显式降级 bundled 包内副本——安装外部产物永远不挡 gotry 本体。
  */
 async function setupExtensionFromGithub() {
-  say('[gotry-setup] GoTry Session Bridge 扩展 · GitHub Releases 下载通道(dist-manifest → tar.gz → SHA256 → key 钉扎)')
+  say('[gotry-setup] Stai Travel Bridge 扩展 · GitHub Releases 下载通道(dist-manifest → tar.gz → SHA256 → key 钉扎)')
   const destDir = join(homedir(), '.gotry', 'extension')
   const cliScript = join(repoRoot, 'ts', 'scripts', 'extension-distribution-cli.ts')
   const releaseBase = process.env.GOTRY_EXTENSION_RELEASE_BASE // 镜像/测试基址覆盖;缺省 GitHub 官方
@@ -1466,7 +1509,7 @@ async function setupExtensionFromGithub() {
   if (r && r.ok) {
     if (r.action === 'installed') {
       say(`  ✓ 已从 GitHub Releases 落位 ${destDir}(v${r.version}${r.previousVersion ? `,旧 v${r.previousVersion}` : ''})`)
-      say('  已装过旧版的浏览器:chrome://extensions → GoTry Session Bridge 卡片 → 「重新加载」一次即生效(新装跳过)。')
+      say('  已装过旧版的浏览器:chrome://extensions → Stai Travel Bridge 卡片 → 「重新加载」一次即生效(新装跳过)。')
       return { ok: true }
     }
     // up-to-date(check-only 下远端更新也会走到这里,只报告不落盘)
@@ -1685,7 +1728,7 @@ if (WIZARD) {
     }
     say('')
     say('[gotry-wizard] ────────────────────────────────')
-    say('[gotry-wizard] GoTry Session Bridge 是浏览器的事——在 Chrome 应用商店一键装:')
+    say('[gotry-wizard] Stai Travel Bridge 是浏览器的事——在 Chrome 应用商店一键装:')
     say('[gotry-wizard]   https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd')
     say('[gotry-wizard] 装好即生效;装完后我会自动检测到(下方探活等待,最长 120s)。')
     say('[gotry-wizard] 全过程 gotry 不动你的剪贴板、不开你的 Chrome、不弹任何面板。')
@@ -1706,7 +1749,7 @@ if (WIZARD) {
   }
 
   if (process.platform === 'win32') {
-    say('[gotry-setup] GoTry Session Bridge 扩展:推荐 Chrome 应用商店一键安装 https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd ;本地通道:手动把包内 extension/ 目录拷到 %USERPROFILE%\\.gotry\\extension,再在 chrome://extensions 开发者模式「加载已解压的扩展程序」')
+    say('[gotry-setup] Stai Travel Bridge 扩展:推荐 Chrome 应用商店一键安装 https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd ;本地通道:手动把包内 extension/ 目录拷到 %USERPROFILE%\\.gotry\\extension,再在 chrome://extensions 开发者模式「加载已解压的扩展程序」')
     process.exit(AUTO ? 0 : 1)
   }
   if (AUTO && (process.env.CI || process.env.GOTRY_SETUP_SKIP === '1')) {
@@ -1717,7 +1760,7 @@ if (WIZARD) {
   const results = []
   // gotry 自留面只剩扩展是否就位;hbcli/agent-reach/dsh-better-sidebar 由各自宿主生态自管。
   if (process.env.GOTRY_SETUP_EXTENSION !== '0') results.push(await (EXTENSION_FROM === 'github' ? setupExtensionFromGithub() : setupExtension()))
-  else say('[gotry-setup] GoTry Session Bridge 扩展:GOTRY_SETUP_EXTENSION=0 跳过')
+  else say('[gotry-setup] Stai Travel Bridge 扩展:GOTRY_SETUP_EXTENSION=0 跳过')
   const failed = results.filter((r) => !r.ok).length
   if (failed > 0) {
     say(`[gotry-setup] ${failed} 项未就绪——gotry 本体不受影响;可稍后重跑: npx @danceiny/gotry setup`)
@@ -1741,4 +1784,5 @@ export {
   classifyDoctorGap, buildOnboardingPlan, onboardingSkipReason,
   runOnboardingFix, promptOnboarding, renderClassifiedPlan, runOnboarding, orchestrateWebLaunch,
   doctorFixAutoSupported, platformAutoUnavailableReason, installerEnabled,
+  classifyHbcliWhoami,
 }

package/data/yunnan-pack.json

@@ -29,33 +29,6 @@
     ]
   },
   "legs": [
-    {
-      "id": "yn0",
-      "note": "昆明→丽江(衔接 8.4 FD582 KMG 11:25 落地后,下午转飞丽江;M-1 工作窗口外)",
-      "date": "8.4 下午",
-      "services": [
-        {
-          "id": "MU5819",
-          "dep": "14:30",
-          "arr": "15:35",
-          "price_cny": 520,
-          "price_note": "东航,1h5m 直飞"
-        },
-        {
-          "id": "8L9662",
-          "dep": "16:40",
-          "arr": "17:45",
-          "price_cny": 480,
-          "price_note": "祥鹏,1h5m 直飞"
-        }
-      ],
-      "evidence": [
-        {
-          "tag": "[demo-reconcil:已]",
-          "note": "8.4 FD582 → 11:25 KMG → 当天转飞丽江(已挖)"
-        }
-      ]
-    },
     {
       "id": "yn1",
       "note": "深圳→丽江(直飞,丽江进大理出的开口程第一段)",
@@ -153,6 +126,36 @@
       "weekday": "any"
     }
   ],
+  "advisory_legs": [
+    {
+      "id": "yn0",
+      "advisory_reason": "本段缺 buffer_min / origin_transfer_min / dest_transfer_min 三个真值,待 founder 校准(flights_2026.json 的 f3 evidence 早已写明:yn0 衔接仍写,引擎层不挂接)。替它填数等于编造真实世界的事实(ADR-10 翻译不造数),所以只记录、不挂接引擎;三个整数补齐后把整段搬回 legs 即可参与求解(issue #635)。",
+      "note": "昆明→丽江(衔接 8.4 FD582 KMG 11:25 落地后,下午转飞丽江;M-1 工作窗口外)",
+      "date": "8.4 下午",
+      "services": [
+        {
+          "id": "MU5819",
+          "dep": "14:30",
+          "arr": "15:35",
+          "price_cny": 520,
+          "price_note": "东航,1h5m 直飞"
+        },
+        {
+          "id": "8L9662",
+          "dep": "16:40",
+          "arr": "17:45",
+          "price_cny": 480,
+          "price_note": "祥鹏,1h5m 直飞"
+        }
+      ],
+      "evidence": [
+        {
+          "tag": "[demo-reconcil:已]",
+          "note": "8.4 FD582 → 11:25 KMG → 当天转飞丽江(已挖)"
+        }
+      ]
+    }
+  ],
   "stays": [
     {
       "id": "yns1",

package/dist/capabilities/anything.js

@@ -19,6 +19,12 @@
  *   - miss: hbcli exit 0,但 candidates 为空(查无结果)
  *   - err:  hbcli exit ≠ 0 或超时(降级,降级产物 标 [实时API:hbcli-anything@error@ts])
  *
+ * 离线开关(issue #617;与会话通道 GOTRY_SESSION_LIVE 同形,方向相反以保持产品默认不变):
+ *   GOTRY_HBCLI_LIVE=0|false|off(不分大小写)→ 零 spawn、不碰凭据与后端,走同一条降级面
+ *   (verdict=error,证据标 [实时API:hbcli-anything@offline@ts]);未设或任何其他取值 = 与此前
+ *   完全一致(hbcli 可用即 live)。判定见 hbcliLiveEnabled;mock/dry-run harness(nightly-evidence --dry-run、
+ *   persona-sim、replay*)缺省把它置 0,operator 显式设置的值不覆盖。
+ *
  * 契约(与 hbcli/weather/opensky 同构,L4 不变量):
  *   - 永不抛错:网络/超时/解析失败一律降级返回;
  *   - 证据链标注:成功 [实时API:hbcli-anything@ts];失败 [实时API:hbcli-anything@error@ts];
@@ -84,6 +90,15 @@ function failureReason(r, cleanupError) {
         ? 'hbcli 未返回可判定结果(进程异常结束,本轮按降级处理)'
         : `hbcli 退出码 ${r.code},未返回可判定结果(本轮按降级处理)`) + suffix;
 }
+/**
+ * 实时 hbcli 通道是否开启(issue #617)。只有显式写 0 / false / off(不分大小写,忽略首尾空白)
+ * 才关闭;未设或任何其他取值都视为开启——终端用户依赖的实时源缺省不丢。调用时读取,
+ * 测试与 harness 可在进程内切换。
+ */
+export function hbcliLiveEnabled(env = process.env) {
+    const v = (env.GOTRY_HBCLI_LIVE ?? '').trim().toLowerCase();
+    return v !== '0' && v !== 'false' && v !== 'off';
+}
 /** Anything 通用搜索 — 任何搜索失败走降级;不抛错 */
 export async function anythingSearch(q) {
     const started = Date.now();
@@ -107,6 +122,17 @@ export async function anythingSearch(q) {
             latencyMs: 0, verdict: 'error', error: 'aborted by host signal',
         };
     }
+    // 离线开关:位置在入参校验与 pre-abort 之后,既有入参的既有结果/原因串逐字节不变;
+    // 关闭时与「未装配 hbcli」同形降级(ok:false / hbcli-anything-error / verdict:error + 人话原因,
+    // 无进程噪音,也不含 timeout 字样——效应层只重试 timeout 类),且不 spawn、不重试。
+    if (!hbcliLiveEnabled()) {
+        return {
+            ok: false, via: 'hbcli-anything-error',
+            evidence: `[实时API:hbcli-anything@offline@${ts}] GOTRY_HBCLI_LIVE switched off; live channel closed, zero spawn`,
+            latencyMs: Date.now() - started, verdict: 'error',
+            error: 'hbcli 实时通道已关闭(GOTRY_HBCLI_LIVE 离线开关;本轮按降级处理,未发起查询)',
+        };
+    }
     let r = { code: null, stdout: '', stderr: '', aborted: false, timedOut: false };
     for (let i = 0; i < candidates.length; i++) {
         r = await sh(candidates[i], args, { timeoutMs: q.timeoutMs ?? 12_000, env: process.env, signal: q.signal });

package/dist/capabilities/channel-registry.js

@@ -52,7 +52,7 @@ export const CHANNELS = [
         evidenceTag: '[会话:ctrip-flight@ts]',
         tier: 'session',
         efficiencyRank: 2,
-        setup: '一次性装 Session Bridge 扩展 + 授权卡 + (如需)官网登录',
+        setup: '一次性装 Stai Travel Bridge 扩展 + 授权卡 + (如需)官网登录',
         hint: 'kind=flight',
     },
     {
@@ -64,7 +64,7 @@ export const CHANNELS = [
         evidenceTag: '[会话:ctrip-hotel@ts]',
         tier: 'session',
         efficiencyRank: 2,
-        setup: '一次性装 Session Bridge 扩展 + 授权卡 + (如需)官网登录',
+        setup: '一次性装 Stai Travel Bridge 扩展 + 授权卡 + (如需)官网登录',
         hint: 'kind=hotel',
     },
     {
@@ -76,7 +76,7 @@ export const CHANNELS = [
         evidenceTag: '[会话:dida-portal@ts]',
         tier: 'session',
         efficiencyRank: 2,
-        setup: '一次性装 Session Bridge 扩展 + 授权卡 + hotel-be portal 自动登录跳板(dida 官网由人完成登录)',
+        setup: '一次性装 Stai Travel Bridge 扩展 + 授权卡 + hotel-be portal 自动登录跳板(dida 官网由人完成登录)',
         hint: 'kind=dida',
     },
     {
@@ -88,7 +88,7 @@ export const CHANNELS = [
         evidenceTag: '[会话:train-12306@ts]',
         tier: 'session',
         efficiencyRank: 2,
-        setup: '一次性装 Session Bridge 扩展(公开查询面,无需登录)',
+        setup: '一次性装 Stai Travel Bridge 扩展(公开查询面,无需登录)',
         hint: 'kind=train',
     },
     {

package/dist/capabilities/doctor.js

@@ -52,10 +52,17 @@ function probe(bin, args, timeoutMs = 8_000) {
         } });
     });
 }
-/** 探测命令 stdout(--version),失败返回 null */
-function probeStdout(bin, args, timeoutMs = 8_000) {
+/**
+ * 探测命令 stdout(--version),失败返回 null。
+ *
+ * 在 'close' 而非 'exit' 结算:'exit' 触发时 stdout 管道可能还没读完(Node 文档明言),
+ * 秒退进程的输出会丢成空串,而空串走「不可解析 = 保守视为有效」分支,把无凭证的 hbcli
+ * 报成 ok。'close' 在 stdio 全部关闭后才触发;超时仍由下方定时器兜底。
+ * `spawnImpl` 仅供测试注入假子进程以确定性复现「exit 先于 data」的次序。
+ */
+export function probeStdout(bin, args, timeoutMs = 8_000, spawnImpl = spawn) {
     return new Promise((resolveProbe) => {
-        const child = spawn(bin, args, { stdio: ['ignore', 'pipe', 'ignore'], env: process.env });
+        const child = spawnImpl(bin, args, { stdio: ['ignore', 'pipe', 'ignore'], env: process.env });
         let out = '';
         let done = false;
         const timer = setTimeout(() => {
@@ -74,7 +81,7 @@ function probeStdout(bin, args, timeoutMs = 8_000) {
             resolveProbe(null);
         } });
         child.stdout?.on('data', (d) => { out += d.toString(); });
-        child.on('exit', (code) => { if (!done) {
+        child.on('close', (code) => { if (!done) {
             done = true;
             clearTimeout(timer);
             resolveProbe(code === 0 ? out.trim() : null);
@@ -117,14 +124,14 @@ export async function runDoctorChecks(opts = {}) {
     items.push(nodeOk(nodeVersion)
         ? { id: 'node', label: 'Node 运行时', status: 'ok', detail: `Node ${nodeVersion}(≥22.15)` }
         : { id: 'node', label: 'Node 运行时', status: 'missing', detail: `Node ${nodeVersion} 过旧(gotry 需 ≥22.15)`, fix: '升级 Node.js 至 22.15+(https://nodejs.org)' });
-    // 1. GoTry Session Bridge 扩展(账号会话通道的传输层;装在哪由 bootstrap setup 管理)
+    // 1. Stai Travel Bridge 扩展(账号会话通道的传输层;装在哪由 bootstrap setup 管理)
     //    D-24 自适应(#117):离线只能探测本地 unpacked 通道;商店版无本地文件面——
     //    missing detail 明示「商店版用户可忽略本项」,不再把商店版用户误导成本地通道缺失
     const extManifest = join(home, '.gotry', 'extension', 'manifest.json');
     items.push(existsSync(extManifest)
-        ? { id: 'extension', label: 'GoTry Session Bridge 扩展', status: 'ok', detail: `已就位(本地通道:${extManifest})` }
+        ? { id: 'extension', label: 'Stai Travel Bridge 扩展', status: 'ok', detail: `已就位(本地通道:${extManifest})` }
         : {
-            id: 'extension', label: 'GoTry Session Bridge 扩展', status: 'missing',
+            id: 'extension', label: 'Stai Travel Bridge 扩展', status: 'missing',
             detail: '本地通道未落位(~/.gotry/extension/manifest.json 不存在)。影响面:gotry_session_search / gotry_session_login(账号会话通道)不可用;携程机票/酒店实时检索、12306 余票、Dida 实时报价都依赖此通道。其它工具(机票 FlyAI、酒店 hbcli、地图、天气等)不受影响。若你已从 Chrome 商店安装(自动更新,商店版 ID oeajpicc…),本项可忽略——会话检索可用性以运行时为准(gotry_session_search 的 verdict)。若未安装:应用商店一键装即可',
             fix: '在 Chrome 应用商店一键安装(自动更新): https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd',
         });

package/dist/capabilities/effect.js

@@ -9,7 +9,7 @@
  *     断路器,per-效应策略表)→ 渠道 handler(现能力层函数,零改写);
  *   - mock  解译器 makeMockInterpreter:夹具回放(CI/本地无网确定性);
  *   - 浏览器解译 = SESSION_* 效应(用户本人登录态的扩展桥车道,2026-08-29 起默认传输:
- *     MV3 GoTry Session Bridge + 本地桥长轮询,零系统弹窗;ReadGuard+授权闸不变,
+ *     MV3 Stai Travel Bridge + 本地桥长轮询,零系统弹窗;ReadGuard+授权闸不变,
  *     非 CUA 视觉点击——本仓已按零 Python 依赖与 a11y/DOM 优先判死后者,
  *     docs/design/effect-interpreter.md §4)。
  *

package/dist/capabilities/ground-transfer.js

@@ -13,14 +13,52 @@
  * layer. Cache, freshness, and fallback are isolated per direction so a
  * miss / error / stale / mismatch in one direction never borrows the
  * dynamic value of the other.
+ *
+ * A provider's OWN claims about its answer — declared `mode`, resolved
+ * origin/destination — are verified against the request whenever the provider
+ * makes them: a contradiction is refused with the conformance vocabulary
+ * (`mode_mismatch` / `direction_mismatch`) and falls back to the static estimate,
+ * so a transit duration is never bound as driving and a route between two other
+ * places is never bound as the airport transfer (issue #429 GAP-429-1/2). All
+ * three fields are OPTIONAL and absent means unverifiable: see
+ * `PublicMapDrivingRouteResult` for why absent is still accepted today.
+ *
+ * A provider failure becomes a `fallbackReason`, and `exposeGroundTransferEvidence`
+ * carries that text into the tool result and each matching verdict's
+ * `transfer_evidence`. It is therefore an EXPOSED surface: every provider-authored
+ * failure string passes through the shared `sanitizeFaultDetail` first, so markup,
+ * credential assignments and URLs from a provider response body can never reach it
+ * (issue #429 GAP-429-3). The historical 400-character bound and the historical
+ * empty-case wording are preserved, so existing `GROUND_TRANSFER_*` /
+ * `map_driving_route` reason strings are unchanged byte for byte.
  */
 import { ToolCallId } from '@deepseek-ai/dsh-llm';
+import { sanitizeFaultDetail } from './provider-detail-sanitize.js';
 export const GROUND_TRANSFER_MODE = 'driving';
 export const GROUND_TRANSFER_POSITION = 'destination';
 export const GROUND_TRANSFER_STATIC_MODE = 'taxi';
 export const GROUND_TRANSFER_STATIC_MODE_MISMATCH = 'ground_transfer_static_mode_mismatch';
 export const GROUND_TRANSFER_STATIC_PRICE_EVIDENCE = '[静态包:估算]';
 export const GROUND_TRANSFER_DEFAULT_MAX_AGE_S = 15 * 60;
+/**
+ * Refusal classifications for a provider that contradicts its own request. The
+ * two names are the #429 conformance gate's vocabulary verbatim
+ * (`RouteErrorCode`), reused here as the `<code>:<direction>:<detail>` reason
+ * prefix this module already uses for `map_driving_route_provider_error` and
+ * `stale_route_requery_error`. They are duplicated as literals on purpose: the
+ * gate must stay free of product callers, so nothing here imports it.
+ */
+export const GROUND_TRANSFER_ROUTE_MODE_MISMATCH = 'mode_mismatch';
+export const GROUND_TRANSFER_ROUTE_DIRECTION_MISMATCH = 'direction_mismatch';
+/**
+ * Tolerance for verifying a provider's echoed endpoint against the requested
+ * one: 1e-4 degrees ≈ 11 m of latitude. A provider legitimately snaps a
+ * coordinate to the nearest routable road node, so an exact string match would
+ * refuse honest answers; anything beyond this bound is a different place, not a
+ * snap. Deliberately tight — refusing falls back to the static estimate, which
+ * is the safe direction.
+ */
+export const GROUND_TRANSFER_ECHO_TOLERANCE_DEG = 1e-4;
 const GROUND_TRANSFER_CACHE_LIMIT = 32;
 function asRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
@@ -49,6 +87,50 @@ function coordinatePair(value) {
 function coordinateText(value) {
     return `${String(value.longitude)},${String(value.latitude)}`;
 }
+/** Parse a canonical `"lon,lat"` text back into a validated coordinate. */
+function coordinateFromText(value) {
+    const parts = value.split(',');
+    if (parts.length !== 2)
+        return null;
+    const [longitudeText, latitudeText] = parts;
+    if (longitudeText.trim() === '' || latitudeText.trim() === '')
+        return null;
+    return coordinate({ longitude: Number(longitudeText), latitude: Number(latitudeText) });
+}
+/**
+ * Does a provider's echoed endpoint name the place that was requested?
+ *
+ * Compared within `GROUND_TRANSFER_ECHO_TOLERANCE_DEG` so a road-node snap still
+ * matches. An echo that cannot be parsed is NOT a match: present-but-unverifiable
+ * fails closed rather than being accepted as the requested pair.
+ */
+function sameEndpoint(echoed, requested) {
+    const left = coordinateFromText(echoed);
+    const right = coordinateFromText(requested);
+    if (left === null || right === null)
+        return false;
+    return Math.abs(left.longitude - right.longitude) <= GROUND_TRANSFER_ECHO_TOLERANCE_DEG
+        && Math.abs(left.latitude - right.latitude) <= GROUND_TRANSFER_ECHO_TOLERANCE_DEG;
+}
+/**
+ * Normalize one of the provider's OWN optional claims into a comparable string.
+ *
+ * Absent (`undefined` / `null`) stays absent — that is the wired driving tool and
+ * its behaviour is unchanged. A present-but-unusable value is NOT dropped: it is
+ * carried as a non-empty string so the enforcement below can refuse it, because
+ * silently dropping a contradicting claim is exactly the relabel this seam
+ * forbids. A `{ longitude, latitude }` object is accepted as the canonical text.
+ */
+function declaredClaim(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === 'string')
+        return value.trim() === '' ? '(blank)' : value.trim();
+    const asCoordinate = coordinate(value);
+    if (asCoordinate !== null)
+        return coordinateText(asCoordinate);
+    return typeof value === 'object' ? JSON.stringify(value) : String(value);
+}
 function cacheKey(direction) {
     return JSON.stringify({
         mode: GROUND_TRANSFER_MODE,
@@ -66,9 +148,33 @@ function nowMs(clock) {
 function asOf(clock) {
     return new Date(nowMs(clock)).toISOString();
 }
+/** Historical bound for an exposed provider failure string (unchanged). */
+const GROUND_TRANSFER_FAULT_DETAIL_MAX_CHARS = 400;
+/**
+ * Normalize a provider failure into an exposable label. The text reaches the tool
+ * result via `exposeGroundTransferEvidence`, so it is scrubbed of markup,
+ * credential assignments and URLs before anything else (#429 GAP-429-3); the
+ * historical length bound and empty-case wording are preserved.
+ */
 function safeErrorMessage(value) {
     const message = value instanceof Error ? value.message : String(value);
-    return message.replace(/[\r\n]+/g, ' ').trim().slice(0, 400) || 'unknown provider error';
+    return sanitizeFaultDetail(message, {
+        maxChars: GROUND_TRANSFER_FAULT_DETAIL_MAX_CHARS,
+        emptyPlaceholder: 'unknown provider error',
+    });
+}
+/** Bound for a provider-authored claim quoted inside a refusal reason. */
+const GROUND_TRANSFER_CLAIM_DETAIL_MAX_CHARS = 120;
+/**
+ * A provider's own claim (mode / echoed endpoint / provider id) is provider-authored
+ * text, and a refusal reason reaches the tool result via
+ * `exposeGroundTransferEvidence`. Quote it only through the shared sanitizer.
+ */
+function safeClaim(value) {
+    return sanitizeFaultDetail(value, {
+        maxChars: GROUND_TRANSFER_CLAIM_DETAIL_MAX_CHARS,
+        emptyPlaceholder: '(absent)',
+    });
 }
 function staticCache(status = 'bypass') {
     return { status, ageS: null, asOf: null };
@@ -189,14 +295,58 @@ function parseRouteResult(value) {
         // zero minutes into the solver.
         || (distanceM > 0 && durationS === 0))
         throw new Error('map_driving_route returned an invalid public result');
+    // The provider's own claims are CARRIED, never dropped: `routeClaimRefusal`
+    // below checks them when they exist. Absent stays absent (the wired driving
+    // tool sends none of the three), and re-parsing an already-parsed result is
+    // idempotent because the carried values are already canonical.
+    const declaredMode = declaredClaim(record['mode']);
+    const resolvedOrigin = declaredClaim(record['resolvedOrigin']);
+    const resolvedDestination = declaredClaim(record['resolvedDestination']);
     return {
         provider,
         distanceM,
         durationS,
         ...(typeof record['polyline'] === 'string' ? { polyline: record['polyline'] } : {}),
         ...(Array.isArray(record['steps']) ? { steps: record['steps'] } : {}),
+        ...(declaredMode !== undefined ? { mode: declaredMode } : {}),
+        ...(resolvedOrigin !== undefined ? { resolvedOrigin } : {}),
+        ...(resolvedDestination !== undefined ? { resolvedDestination } : {}),
     };
 }
+/**
+ * Verify the provider's OWN claims against the request for this direction, and
+ * return a typed refusal when one contradicts it (#429 GAP-429-1/2).
+ *
+ * ABSENT = UNVERIFIABLE, and absent is ACCEPTED — not because an unverified
+ * answer is as good as a verified one, but because the only wired provider (the
+ * registered `map_driving_route` tool) is driving by construction and echoes no
+ * origin/destination, so for it nothing changes byte for byte. Any future
+ * non-driving or address-resolving adapter must supply these fields; the #429
+ * conformance gate already refuses an adapter that does not.
+ *
+ * PRESENT and contradicting = REFUSAL. The caller falls back to the static
+ * transfer estimate with its original price label, so a mislabelled or
+ * misrouted answer never reaches the solver.
+ */
+function routeClaimRefusal(direction, request, route) {
+    if (route.mode !== undefined && route.mode !== GROUND_TRANSFER_MODE) {
+        return {
+            code: GROUND_TRANSFER_ROUTE_MODE_MISMATCH,
+            detail: `provider ${safeClaim(route.provider)} returned mode '${safeClaim(route.mode)}' for a '${GROUND_TRANSFER_MODE}' request; a declared mode is never relabelled as ${GROUND_TRANSFER_MODE}; static transfer preserved`,
+        };
+    }
+    const { resolvedOrigin, resolvedDestination } = route;
+    if (resolvedOrigin === undefined && resolvedDestination === undefined)
+        return null;
+    if ((resolvedOrigin !== undefined && !sameEndpoint(resolvedOrigin, request.origin))
+        || (resolvedDestination !== undefined && !sameEndpoint(resolvedDestination, request.destination))) {
+        return {
+            code: GROUND_TRANSFER_ROUTE_DIRECTION_MISMATCH,
+            detail: `provider ${safeClaim(route.provider)} resolved ${safeClaim(resolvedOrigin ?? '(absent)')}>${safeClaim(resolvedDestination ?? '(absent)')} but the ${direction.direction} request was ${request.origin}>${request.destination}; direction binding is verified against the response, not assumed from the request; static transfer preserved`,
+        };
+    }
+    return null;
+}
 function buildRouteFact(direction, route, clock, cache) {
     return {
         direction: direction.direction,
@@ -272,6 +422,23 @@ async function resolveDirection(direction, staticMinutes, provider, clock, cache
             execution: context.execution,
         });
         const route = parseRouteResult(raw);
+        const refusal = routeClaimRefusal(direction, requestForProvider, route);
+        if (refusal !== null) {
+            // Fail closed: no fact is built and nothing is written to the cache, so a
+            // refused answer can never be served later as a cache hit. The static
+            // minutes, price and `[静态包:估算]` label are left untouched.
+            return {
+                applied: false,
+                direction: direction.direction,
+                staticMinutes,
+                provenance: 'static-transfer-pack',
+                asOf: null,
+                freshness: 'fallback',
+                cache: staticCache(cached ? 'stale' : 'bypass'),
+                evidenceClass: 'static_transfer_estimate',
+                fallbackReason: `${refusal.code}:${direction.direction}:${refusal.detail}`,
+            };
+        }
         const cacheInfo = {
             status: cached ? 'requery' : 'miss',
             ageS: 0,