@danceiny/gotry 0.2.0-rc.27 → 0.2.0-rc.29

package/dist/capabilities/provider-detail-sanitize.js

@@ -0,0 +1,64 @@
+/**
+ * Provider fault-detail sanitizer (shared, pure, zero imports).
+ *
+ * A provider's failure text is a LABEL for operators, never a channel for a
+ * provider response body. Any string that may reach the evidence/verdict surface
+ * passes through `sanitizeFaultDetail` first: markup, credential assignments and
+ * URLs are redacted, whitespace is collapsed, and the result is length-bounded.
+ * `faultDetailLeak` is the mechanical check a gate (or a test) can run over a
+ * string that is about to be exposed.
+ *
+ * Extracted so that exactly one implementation serves both
+ * `ts/capabilities/route-provider-conformance.ts` (the #429 conformance gate,
+ * which re-exports it) and `ts/capabilities/ground-transfer.ts` (the live
+ * product path, issue #429 GAP-429-3 fix). Keeping it in its own file means the
+ * conformance gate itself stays free of product callers.
+ *
+ * Deliberately pure: zero imports, zero IO, zero network, zero clock.
+ *
+ * @module capabilities/provider-detail-sanitize
+ */
+/** Default bound for a provider fragment embedded in a gate refusal. */
+export const FAULT_DETAIL_MAX_CHARS = 120;
+const DETAIL_SCRUB_PATTERNS = [
+    { re: /<[^>]*>/g, label: 'markup' },
+    { re: /\b(?:cookie|set-cookie|authorization|api[_-]?key|token|secret|password|passwd|sid)\s*[:=]\s*\S+/gi, label: 'credential' },
+    { re: /\bbearer\s+[A-Za-z0-9._-]{8,}/gi, label: 'credential' },
+    { re: /https?:\/\/\S+/gi, label: 'url' },
+];
+/**
+ * Sanitize a provider fault detail.
+ *
+ * `maxChars` lets a caller keep its own historical bound (ground-transfer keeps
+ * 400 so no existing `fallbackReason` text changes); `emptyPlaceholder` lets a
+ * caller keep its own historical empty-case wording.
+ */
+export function sanitizeFaultDetail(detail, options) {
+    const maxChars = options?.maxChars ?? FAULT_DETAIL_MAX_CHARS;
+    const placeholder = options?.emptyPlaceholder ?? '(no detail)';
+    let text = typeof detail === 'string' ? detail : '';
+    for (const { re, label } of DETAIL_SCRUB_PATTERNS)
+        text = text.replace(re, `[${label}-redacted]`);
+    text = text.replace(/\s+/g, ' ').trim();
+    if (text.length > maxChars)
+        text = `${text.slice(0, maxChars - 1)}…`;
+    return text === '' ? placeholder : text;
+}
+/**
+ * Mechanical leak check for any string about to reach the evidence surface.
+ *
+ * Shape-only by design: it looks for provider-response-body tells (markup,
+ * credential assignments, URLs) and deliberately does NOT bound length — the
+ * length bound belongs to `sanitizeFaultDetail`, which caps the PROVIDER
+ * fragment, whereas a gate's own refusal explanation is host-authored prose and
+ * may legitimately be longer.
+ */
+export function faultDetailLeak(detail) {
+    if (/<[^>]*>/.test(detail))
+        return 'fault detail carries markup (a provider response body must never reach the evidence surface)';
+    if (/\b(?:cookie|authorization|api[_-]?key|token|secret|password|passwd|sid)\s*[:=]\s*\S+/i.test(detail))
+        return 'fault detail carries a credential assignment';
+    if (/https?:\/\//i.test(detail))
+        return 'fault detail carries a URL';
+    return null;
+}

package/dist/capabilities/route-provider-conformance.js

@@ -0,0 +1,341 @@
+/**
+ * D-39 live-route provider CONFORMANCE contract v1 (issue #429 contract slice,
+ * SIMULATED-TRIGGER DRILL — default OFF, zero callers, trigger flag frozen false,
+ * provider registry frozen EMPTY).
+ *
+ * ⚠ Evidence boundary: this is the conformance GATE any future live-route adapter
+ * must pass, exercised here against a MOCK adapter only. #429's trigger is, per
+ * path, "a named product use case + the actual data provider and access boundary +
+ * reviewable authority/freshness/coverage evidence"; it has NOT fired for any path.
+ * No real routing provider is contacted (`consultRouteProvider` refuses before
+ * touching an adapter while the trigger is false), no dependency is added, and the
+ * accepted narrow path of #341 (explicit-coordinate destination driving estimate
+ * with static price evidence) is untouched. Nothing here claims provider
+ * availability or an M4/M5/M6 Exit.
+ *
+ * What it owns: the single admission gate `admitRouteFact` — a provider outcome
+ * becomes a route fact only if the provider's OWN claims (mode, evidence class,
+ * echoed origin/destination, freshness, fare authority) match the declared use
+ * case. Every mismatch is a typed refusal whose detail is sanitized, and a refusal
+ * always leaves the static fallback and its original price label intact.
+ *
+ * Frozen upstream constraints (READ-ONLY reuse):
+ *  - docs/architecture.md D-39 + §10: each wider path needs its own named use case,
+ *    source, freshness contract, access boundary and real-data proof; read-only
+ *    routing authorizes no write path;
+ *  - ts/capabilities/ground-transfer.ts (#341/#364/#382): the accepted narrow shape
+ *    — per-direction isolation, host observation time (never a provider publication
+ *    timestamp), `trafficStatus: 'not-live-route-estimate'`, and the static
+ *    `priceCny` + `[静态包:估算]` label that a route fact never replaces;
+ *  - ts/capabilities/fx-contract.ts (#344): the trigger-gated, frozen-empty
+ *    registry seam and the "stale/miss/error never masquerades as current" rule.
+ *
+ * Layering: this module performs zero network, cache, timer, clock or filesystem
+ * work, and its ONLY import is the pure sibling sanitizer
+ * `provider-detail-sanitize.ts` (shared with the live ground-transfer path so one
+ * implementation serves both). It imports nothing from the kernel evaluate/solve
+ * layer (`src/model.ts`, `src/unified.ts`), and no product file imports it. Any
+ * future adapter's network/cache work stays on the capability side of that line;
+ * the focused suite asserts the import surface mechanically.
+ *
+ * Only the real trigger can supply: the provider identity and licence, actual
+ * coverage/freshness measurements, a separately authoritative fare source, and an
+ * authorized minimal real path recorded at an exact source SHA.
+ *
+ * @module capabilities/route-provider-conformance
+ */
+import { FAULT_DETAIL_MAX_CHARS, faultDetailLeak, sanitizeFaultDetail } from './provider-detail-sanitize.js';
+/** Re-exported so the conformance gate stays the single API surface for callers. */
+export { FAULT_DETAIL_MAX_CHARS, faultDetailLeak, sanitizeFaultDetail };
+export const ROUTE_PROVIDER_CONFORMANCE_SCHEMA = 'gotry_route_provider_conformance.v1';
+/**
+ * D-39 wider-path trigger gate, frozen false. Each path (live traffic, transit,
+ * rail, fare, address resolution) is admitted independently; flipping this is a
+ * per-path founder decision with a named use case and a real provider.
+ */
+export const D39_LIVE_ROUTE_TRIGGER_FIRED = false;
+/** Transport modes. A provider may never relabel one as another, in either direction. */
+export const ROUTE_MODES = ['driving', 'transit', 'rail', 'walking', 'cycling'];
+/** Evidence classes, weakest first. A declared class must match EXACTLY. */
+export const ROUTE_EVIDENCE_CLASSES = ['static_estimate', 'route_estimate', 'live_traffic'];
+/** Access boundaries. A read-only routing admission never implies a write path. */
+export const ROUTE_ACCESS_BOUNDARIES = ['read_only_public', 'licensed_read_only', 'supplier_transaction'];
+/** Fault modes every candidate provider must be probed against before admission. */
+export const ROUTE_PROVIDER_FAULT_MODES = [
+    'unavailable',
+    'stale',
+    'mismatched_direction',
+    'mode_relabel',
+    'estimate_as_live_traffic',
+    'challenge',
+    'rate_limited',
+    'partial_result',
+];
+/** Conformance clauses. A future adapter is admissible only if ALL of them pass. */
+export const ROUTE_CONFORMANCE_CLAUSES = [
+    /** the response must echo the requested origin/destination; the swapped pair is a different fact */
+    'direction_binding',
+    /** the provider's own mode claim must equal the use case's mode */
+    'mode_isolation',
+    /** the provider's own evidence class must equal the use case's (no escalation, no shortfall) */
+    'evidence_class_isolation',
+    /** a provider outside the freshness contract is stale, never current */
+    'freshness_contract',
+    /** every admitted fact names its source identity and access boundary */
+    'source_identity',
+    /** every fault mode fails closed with a typed code — never a silent degrade */
+    'fault_fail_closed',
+    /** a refusal leaves the static fallback minutes, price and original label untouched */
+    'static_fallback_preserved',
+    /** a route provider is never a fare authority unless the use case declares a separate one */
+    'fare_authority_separate',
+    /** fault details are sanitized: no provider response body, markup, cookie or token */
+    'fault_detail_sanitized',
+];
+function fail(code, detail) {
+    return { ok: false, code, detail };
+}
+function pass(value) {
+    return { ok: true, value };
+}
+/** Runtime provider registry, frozen EMPTY. A non-empty value is a founder decision. */
+export const ADMITTED_LIVE_ROUTE_PROVIDERS = [];
+// ---------------------------------------------------------------------------
+// Detail sanitization: see ./provider-detail-sanitize.ts (shared with the live
+// ground-transfer path; re-exported above so this gate stays the single API).
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// The admission gate
+// ---------------------------------------------------------------------------
+function parseInstant(value, label) {
+    if (typeof value !== 'string' || value.trim() === '')
+        return fail('bad_ts', `${label} must be a non-empty ISO-8601 instant, got ${JSON.stringify(value)}`);
+    if (/^\d{4}-\d{2}-\d{2}$/.test(value.trim()))
+        return fail('bad_ts', `${label} must carry a full time-of-day (date-only '${value}' cannot be aged)`);
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms))
+        return fail('bad_ts', `${label} is not a parseable ISO-8601 instant: ${JSON.stringify(value)}`);
+    return pass(new Date(ms).toISOString());
+}
+/** Map a provider fault to its typed refusal code (closed, total mapping). */
+const FAULT_CODE = {
+    unavailable: 'unavailable',
+    stale: 'stale',
+    mismatched_direction: 'direction_mismatch',
+    mode_relabel: 'mode_mismatch',
+    estimate_as_live_traffic: 'evidence_class_escalation',
+    challenge: 'challenge',
+    rate_limited: 'rate_limited',
+    partial_result: 'partial_result',
+};
+/**
+ * The single admission gate: a provider outcome becomes a route fact only if every
+ * declared claim matches the named use case. Each refusal is typed and sanitized;
+ * no refusal ever degrades into a weaker-but-accepted fact.
+ */
+export function admitRouteFact(useCase, descriptor, request, outcome, now) {
+    if (typeof useCase?.id !== 'string' || useCase.id.trim() === '')
+        return fail('binding_incomplete', 'use case id is mandatory: a path is admitted per NAMED product use case, never globally');
+    if (!ROUTE_MODES.includes(useCase.mode))
+        return fail('closed_set', `use case mode must be one of [${ROUTE_MODES.join('/')}], got ${JSON.stringify(useCase.mode)}`);
+    if (!ROUTE_EVIDENCE_CLASSES.includes(useCase.evidence_class))
+        return fail('closed_set', `use case evidence_class must be one of [${ROUTE_EVIDENCE_CLASSES.join('/')}], got ${JSON.stringify(useCase.evidence_class)}`);
+    if (!ROUTE_ACCESS_BOUNDARIES.includes(useCase.access_boundary))
+        return fail('closed_set', `use case access_boundary must be one of [${ROUTE_ACCESS_BOUNDARIES.join('/')}]`);
+    if (!Number.isFinite(useCase.freshness_max_age_s) || useCase.freshness_max_age_s <= 0)
+        return fail('binding_incomplete', 'use case freshness_max_age_s must be a positive number of seconds (a path without a freshness contract is not admitted)');
+    if (typeof descriptor?.id !== 'string' || descriptor.id.trim() === '')
+        return fail('binding_incomplete', 'provider descriptor id is mandatory (source identity)');
+    if (typeof descriptor.legal_basis !== 'string' || descriptor.legal_basis.trim() === '')
+        return fail('binding_incomplete', `provider ${descriptor.id} carries no legal_basis — admission requires a stated licence / access boundary`);
+    if (typeof descriptor.source_sha !== 'string' || descriptor.source_sha.trim() === '')
+        return fail('binding_incomplete', `provider ${descriptor.id} carries no source_sha — D-39 requires the exact reviewed source revision`);
+    if (descriptor.access_boundary !== useCase.access_boundary) {
+        return fail('closed_set', `provider ${descriptor.id} access boundary '${descriptor.access_boundary}' does not match use case '${useCase.id}' boundary '${useCase.access_boundary}' — a read-only routing admission never widens into a transaction boundary`);
+    }
+    if (typeof request?.origin !== 'string' || request.origin.trim() === '' || typeof request?.destination !== 'string' || request.destination.trim() === '') {
+        return fail('binding_incomplete', 'request origin and destination are mandatory (direction binding has nothing to bind otherwise)');
+    }
+    if (request.mode !== useCase.mode) {
+        return fail('mode_mismatch', `request mode '${request.mode}' contradicts use case '${useCase.id}' mode '${useCase.mode}'`);
+    }
+    if (!outcome?.ok) {
+        if (!ROUTE_PROVIDER_FAULT_MODES.includes(outcome?.fault)) {
+            return fail('closed_set', `provider fault must be one of [${ROUTE_PROVIDER_FAULT_MODES.join('/')}], got ${JSON.stringify(outcome?.fault)} — an unclassified failure is not a degrade licence`);
+        }
+        return fail(FAULT_CODE[outcome.fault], `provider ${descriptor.id} fault '${outcome.fault}': ${sanitizeFaultDetail(outcome.detail)}`);
+    }
+    const response = outcome.response;
+    if (typeof response?.provider_id !== 'string' || response.provider_id.trim() === '')
+        return fail('binding_incomplete', 'response provider_id is mandatory (source identity per fact)');
+    if (response.provider_id !== descriptor.id) {
+        return fail('binding_incomplete', `response provider_id '${response.provider_id}' does not match the admitted descriptor '${descriptor.id}' — a fact may not be attributed to a provider that did not produce it`);
+    }
+    if (!ROUTE_MODES.includes(response.mode)) {
+        return fail('closed_set', `response mode must be one of [${ROUTE_MODES.join('/')}], got ${JSON.stringify(response.mode)} — a response without an explicit mode claim may not be labelled by the request`);
+    }
+    if (response.mode !== useCase.mode) {
+        return fail('mode_mismatch', `provider ${descriptor.id} returned mode '${response.mode}' for a '${useCase.mode}' use case — ${response.mode} must never be relabelled as ${useCase.mode} (nor the reverse)`);
+    }
+    if (!ROUTE_EVIDENCE_CLASSES.includes(response.evidence_class)) {
+        return fail('closed_set', `response evidence_class must be one of [${ROUTE_EVIDENCE_CLASSES.join('/')}], got ${JSON.stringify(response.evidence_class)}`);
+    }
+    if (response.evidence_class !== useCase.evidence_class) {
+        const providerRank = ROUTE_EVIDENCE_CLASSES.indexOf(response.evidence_class);
+        const useCaseRank = ROUTE_EVIDENCE_CLASSES.indexOf(useCase.evidence_class);
+        return providerRank > useCaseRank
+            ? fail('evidence_class_escalation', `provider ${descriptor.id} claims '${response.evidence_class}' for a '${useCase.evidence_class}' use case — an estimate must never be presented as ${response.evidence_class}`)
+            : fail('evidence_class_shortfall', `provider ${descriptor.id} delivered '${response.evidence_class}' for a '${useCase.evidence_class}' use case — a weaker class may not fill a stronger promise`);
+    }
+    if (response.echoed_origin !== request.origin || response.echoed_destination !== request.destination) {
+        return fail('direction_mismatch', `provider ${descriptor.id} routed ${response.echoed_origin}→${response.echoed_destination} but the ${request.direction} request was ${request.origin}→${request.destination} — direction binding is verified against the RESPONSE, not assumed from the request`);
+    }
+    const distance = response.distance_m;
+    const duration = response.duration_s;
+    if (typeof distance !== 'number' || !Number.isFinite(distance) || distance < 0
+        || typeof duration !== 'number' || !Number.isFinite(duration) || duration < 0
+        || (distance > 0 && duration === 0)) {
+        return fail('partial_result', `provider ${descriptor.id} returned an incomplete or self-contradictory route (distance_m=${String(distance)}, duration_s=${String(duration)}); a positive distance cannot be covered in zero time`);
+    }
+    const nowParsed = parseInstant(now, 'gate clock now');
+    if (!nowParsed.ok)
+        return nowParsed;
+    const observedAt = parseInstant(response.observed_at, 'response observed_at (host observation instant)');
+    if (!observedAt.ok)
+        return observedAt;
+    if (observedAt.value > nowParsed.value) {
+        return fail('bad_ts', `observed_at ${observedAt.value} postdates the gate clock ${nowParsed.value} — a provider publication timestamp is not a host observation instant`);
+    }
+    const ageS = (Date.parse(nowParsed.value) - Date.parse(observedAt.value)) / 1000;
+    if (ageS > useCase.freshness_max_age_s) {
+        return fail('stale', `observation is ${ageS}s old, beyond the '${useCase.id}' freshness contract of ${useCase.freshness_max_age_s}s — stale never masquerades as current`);
+    }
+    let fare = null;
+    if (response.fare !== undefined) {
+        if (useCase.fare_authority === 'none') {
+            return fail('fare_not_authoritative', `provider ${descriptor.id} offered a fare for use case '${useCase.id}' which declares no fare authority — the static price and its original label stand until a separately authoritative fare exists`);
+        }
+        const f = response.fare;
+        if (typeof f.amount !== 'string' || f.amount.trim() === '' || typeof f.currency !== 'string' || f.currency.trim() === '' || typeof f.authority !== 'string' || f.authority.trim() === '') {
+            return fail('binding_incomplete', 'an admitted fare needs amount, currency and a named authority');
+        }
+        if (f.authority === descriptor.id || f.authority === response.provider_id) {
+            return fail('fare_not_authoritative', `a route provider ('${descriptor.id}') is never its own fare authority — '${useCase.id}' requires a separately authoritative fare source`);
+        }
+        fare = { amount: f.amount, currency: f.currency, authority: f.authority };
+    }
+    return pass(Object.freeze({
+        schema: ROUTE_PROVIDER_CONFORMANCE_SCHEMA,
+        use_case_id: useCase.id,
+        direction: request.direction,
+        origin: request.origin,
+        destination: request.destination,
+        mode: useCase.mode,
+        evidence_class: useCase.evidence_class,
+        provider_id: descriptor.id,
+        access_boundary: descriptor.access_boundary,
+        source_sha: descriptor.source_sha,
+        distance_m: distance,
+        duration_s: duration,
+        duration_min: Math.round(duration / 60),
+        observed_at: observedAt.value,
+        age_s: ageS,
+        fare,
+    }));
+}
+/**
+ * The only entry point to a live route adapter. While `D39_LIVE_ROUTE_TRIGGER_FIRED`
+ * is false this refuses BEFORE touching the adapter, so zero routing providers are
+ * contacted (the fetch-spy zero-call proof in run-all §87).
+ */
+export async function consultRouteProvider(adapter, useCase, request, 
+/** `now` is MANDATORY: this module reads no clock, so the caller injects one. */
+options) {
+    const triggerFired = options?.triggerFired ?? D39_LIVE_ROUTE_TRIGGER_FIRED;
+    if (!triggerFired) {
+        return fail('trigger_deferred', `D-39 path trigger has not fired for use case '${String(useCase?.id)}' (#429: a named product use case + the actual provider and access boundary + reviewable authority/freshness/coverage evidence); zero routing providers contacted, static fallback stands`);
+    }
+    const registry = options?.registry ?? ADMITTED_LIVE_ROUTE_PROVIDERS;
+    if (!registry.some(d => d.id === adapter?.descriptor?.id)) {
+        return fail('provider_not_admitted', `provider '${String(adapter?.descriptor?.id)}' is not in the admitted registry (admitted: [${registry.map(d => d.id).join('/') || 'none'}]); admitting one is a per-path founder decision with a legal_basis and source_sha`);
+    }
+    const outcome = await adapter.fetchRoute(request, { signal: options?.signal ?? new AbortController().signal });
+    return admitRouteFact(useCase, adapter.descriptor, request, outcome, options.now);
+}
+/**
+ * Mechanical check: after a refusal, the static fallback must be unchanged —
+ * same mode, same minutes, same price and the SAME original price label. Returns
+ * a violation string, or null.
+ */
+export function staticFallbackViolation(before, after) {
+    if (before.mode !== after.mode)
+        return `static fallback mode changed '${before.mode}' → '${after.mode}'`;
+    if (before.minutes !== after.minutes)
+        return `static fallback minutes changed ${before.minutes} → ${after.minutes}: a refused route fact must not touch the static estimate`;
+    if (before.priceCny !== after.priceCny)
+        return `static fallback priceCny changed ${before.priceCny} → ${after.priceCny}: a route fact never supplies a price`;
+    if (before.priceEvidence !== after.priceEvidence)
+        return `static price label changed '${before.priceEvidence}' → '${after.priceEvidence}': the original label stands until a separately authoritative fare exists`;
+    return null;
+}
+/**
+ * Run the conformance probes and report per clause.
+ *
+ * `admissible` is true only when every clause in `ROUTE_CONFORMANCE_CLAUSES` was
+ * probed AND passed: an unprobed clause is reported as unprobed and blocks
+ * admission, because "we never tested that" is not evidence of conformance.
+ */
+export function runRouteProviderConformance(useCase, descriptor, probes, now) {
+    const byClause = new Map();
+    for (const probe of probes) {
+        const slot = byClause.get(probe.clause) ?? { pass: true, count: 0, evidence: [] };
+        slot.count++;
+        const result = admitRouteFact(useCase, descriptor, probe.request, probe.outcome, now);
+        if (probe.expect === null) {
+            if (result.ok)
+                slot.evidence.push(`${probe.label}: admitted as expected`);
+            else {
+                slot.pass = false;
+                slot.evidence.push(`${probe.label}: expected admission, got refusal ${result.code} — ${result.detail}`);
+            }
+        }
+        else if (result.ok) {
+            slot.pass = false;
+            slot.evidence.push(`${probe.label}: expected refusal ${probe.expect}, got ADMISSION (a fault was silently accepted)`);
+        }
+        else if (result.code !== probe.expect) {
+            slot.pass = false;
+            slot.evidence.push(`${probe.label}: expected refusal ${probe.expect}, got ${result.code} — ${result.detail}`);
+        }
+        else {
+            const leak = faultDetailLeak(result.detail);
+            if (leak !== null) {
+                slot.pass = false;
+                slot.evidence.push(`${probe.label}: refused ${result.code} but the detail leaks — ${leak}`);
+            }
+            else {
+                slot.evidence.push(`${probe.label}: refused ${result.code} with a sanitized detail`);
+            }
+        }
+        byClause.set(probe.clause, slot);
+    }
+    const clauses = [];
+    const unprobed = [];
+    for (const clause of ROUTE_CONFORMANCE_CLAUSES) {
+        const slot = byClause.get(clause);
+        if (slot === undefined) {
+            unprobed.push(clause);
+            clauses.push({ clause, verdict: 'fail', probes: 0, evidence: ['clause was never probed — "untested" is not conformance'] });
+            continue;
+        }
+        clauses.push({ clause, verdict: slot.pass ? 'pass' : 'fail', probes: slot.count, evidence: Object.freeze([...slot.evidence]) });
+    }
+    return Object.freeze({
+        schema: ROUTE_PROVIDER_CONFORMANCE_SCHEMA,
+        use_case_id: useCase.id,
+        provider_id: descriptor.id,
+        admissible: unprobed.length === 0 && clauses.every(c => c.verdict === 'pass'),
+        clauses: Object.freeze([...clauses]),
+        unprobed: Object.freeze([...unprobed]),
+    });
+}

package/dist/capabilities/session/extension-bridge.js

@@ -58,17 +58,17 @@ export function localExtensionInstalled(home = homedir()) {
  * 影响面统一行:账号会话通道断 → 列表底部工具不提供;其余工具不受影响。
  * 纯函数(默认 HOME 可注入)。
  *
- * 双语对照:CN=本函数返回值;EN 权威见 docs/capability-onboarding.md「Session Bridge 安装」段。
+ * 双语对照:CN=本函数返回值;EN 权威见 docs/capability-onboarding.md「Stai Travel Bridge 安装」段。
  */
 const EXTENSION_IMPACT_LINE = '影响面:gotry_session_search / gotry_session_login(账号会话通道)不可用;携程机票/酒店实时检索、12306 余票、Dida 实时报价都依赖此通道。其它工具(机票 FlyAI、酒店 hbcli、地图、天气等)不受影响。';
 export function needsExtensionSummary(opts = {}) {
     const local = opts.localInstalled ?? localExtensionInstalled(opts.home);
     if (local) {
-        return 'GoTry Session Bridge 扩展未连接(未安装或已停用)。推荐 Chrome 应用商店一键装(自动更新) '
+        return 'Stai Travel Bridge 扩展未连接(未安装或已停用)。推荐 Chrome 应用商店一键装(自动更新) '
             + `${EXTENSION_STORE_URL} ;或 npx @danceiny/gotry setup 落位后 chrome://extensions 开发者模式「加载已解压的扩展程序」指向 ~/.gotry/extension。`
             + EXTENSION_IMPACT_LINE;
     }
-    return 'GoTry Session Bridge 扩展未连接。若你已从 Chrome 商店安装(自动更新):打开 Chrome 并确认扩展已启用即可自动连接,无需再装。'
+    return 'Stai Travel Bridge 扩展未连接。若你已从 Chrome 商店安装(自动更新):打开 Chrome 并确认扩展已启用即可自动连接,无需再装。'
         + `若尚未安装:应用商店一键装 ${EXTENSION_STORE_URL} (装完零弹窗,浏览器自己当安装器)。`
         + EXTENSION_IMPACT_LINE;
 }

package/dist/capabilities/session-search.js

@@ -2,7 +2,7 @@
  * 会话检索编排层(RFC §3.2):transport → adapter entry → networkHint 嗅探 → 解析 → ReadGuard → 证据链。
  *
  * 传输车道(2026-08-29 定案,RFC §2.2):**扩展桥为默认**——一次性安装的 MV3 扩展
- * (GoTry Session Bridge)在自己标签页被动嗅探 batchSearch,零 Chrome 系统弹窗;
+ * (Stai Travel Bridge)在自己标签页被动嗅探 batchSearch,零 Chrome 系统弹窗;
  *  cdp(attach 日常 Chrome,Chrome 144+ 每连接弹权限框)降为显式后备
  * (`GOTRY_SESSION_TRANSPORT=cdp` opt-in,诊断/测试用);persistent 仅测试。
  *

package/dist/scripts/anything-path-measure-tests.js

@@ -0,0 +1,133 @@
+/**
+ * Offline tests for the Anything-path measurement probe (issue #276 / #345 evidence probe).
+ *
+ * Run: cd ts && npx tsx scripts/anything-path-measure-tests.ts
+ *
+ * Fully offline: the real hbcli runner is never used; a scripted fake runner stands in. The opt-in
+ * claim is executed, not asserted: with the environment flag missing, the fake runner must be
+ * called exactly zero times.
+ */
+import assert from 'node:assert/strict';
+import { CONCURRENCY, OPT_IN_ENV, fieldPresence, latencyStats, measure, measureIfOptedIn, percentile, scrub, } from './anything-path-measure.js';
+const tests = [];
+const test = (name, run) => tests.push({ name, run });
+const hotel = (extra = {}) => ({ type: 'hotel', hotel: { name: 'H', star: 4, address: 'a', ...extra } });
+const city = () => ({ type: 'city', region: { name: 'C', countryCode: 'CN', extra: '' } });
+/** A scripted runner: results come from a queue per call; also tracks max in-flight calls. */
+function scripted(script) {
+    let calls = 0;
+    let inFlight = 0;
+    let maxInFlight = 0;
+    const runner = async (args) => {
+        const index = calls++;
+        inFlight++;
+        maxInFlight = Math.max(maxInFlight, inFlight);
+        await new Promise((resolve) => setImmediate(resolve));
+        inFlight--;
+        return script(args, index);
+    };
+    return { runner, stats: () => ({ calls, maxInFlight }) };
+}
+test('opt-in gate: without the env flag nothing is spawned and nothing is measured', async () => {
+    const fake = scripted(() => ({ ok: true, ms: 1, candidates: [] }));
+    const result = await measureIfOptedIn({}, fake.runner);
+    assert.equal(result.state, 'waiting_external_evidence');
+    assert.equal(fake.stats().calls, 0, 'runner must not be called without opt-in');
+    const wrong = await measureIfOptedIn({ [OPT_IN_ENV]: 'true' }, fake.runner);
+    assert.equal(wrong.state, 'waiting_external_evidence', 'only the exact value 1 opts in');
+    assert.equal(fake.stats().calls, 0);
+});
+test('opt-in gate: GOTRY_UAT_READONLY=1 runs the whole measurement', async () => {
+    const fake = scripted(() => ({ ok: true, ms: 5, candidates: [city()] }));
+    const result = await measureIfOptedIn({ [OPT_IN_ENV]: '1' }, fake.runner);
+    assert.equal(result.state, 'measured');
+    assert.ok(fake.stats().calls > 0);
+});
+test('percentile: nearest-rank, empty sample is null, single sample is itself', () => {
+    assert.equal(percentile([], 50), null);
+    assert.equal(percentile([7], 95), 7);
+    const sample = Array.from({ length: 20 }, (_, i) => (i + 1) * 10);
+    assert.equal(percentile(sample, 50), 100);
+    assert.equal(percentile(sample, 95), 190);
+    assert.equal(percentile([30, 10, 20], 50), 20, 'input order must not matter');
+});
+test('latencyStats counts failures by reason and keeps their timings in the sample', () => {
+    const stats = latencyStats([
+        { ok: true, ms: 100, candidates: [] },
+        { ok: false, ms: 900, reason: 'exit_1', detail: '' },
+        { ok: false, ms: 50, reason: 'exit_1', detail: '' },
+        { ok: false, ms: 60_000, reason: 'timeout', detail: '' },
+    ]);
+    assert.equal(stats.calls, 4);
+    assert.equal(stats.errors, 3);
+    assert.deepEqual(stats.error_reasons, { exit_1: 2, timeout: 1 });
+    assert.equal(stats.max_ms, 60_000);
+});
+test('fieldPresence: empty strings, empty arrays and empty objects do not count as present', () => {
+    const presence = fieldPresence([
+        { name: 'a', rating: 4.5, photos: [], hours: {}, note: '' },
+        { name: 'b', rating: null },
+        undefined,
+    ]);
+    assert.equal(presence.n, 2, 'undefined entries are not objects');
+    assert.deepEqual(presence.fields, { hours: '0/2', name: '2/2', note: '0/2', photos: '0/2', rating: '1/2' });
+});
+test('scrub: credential-looking material is redacted and the text is bounded', () => {
+    const scrubbed = scrub('401 Unauthorized: Bearer abc.def.ghi ticket=ST:12345 token: zzz api_key=k123 password hunter2');
+    assert.ok(!/abc\.def|12345|zzz|k123|hunter2/.test(scrubbed), `secret material survived: ${scrubbed}`);
+    assert.ok(scrubbed.length <= 160);
+    assert.ok(scrub('x'.repeat(1000)).length <= 160);
+});
+test('measure: aggregates a scripted run (types, place emptiness, presence, failures) deterministically', async () => {
+    const keywords = ['a', 'b', 'c', 'd', 'e', 'f', 'g'];
+    let n = 0;
+    const fake = scripted((args) => {
+        n++;
+        const placeOnly = args.includes('place');
+        if (placeOnly)
+            return { ok: true, ms: 10, candidates: [] };
+        if (n === 2)
+            return { ok: false, ms: 40, reason: 'exit_1', detail: 'boom' };
+        return { ok: true, ms: 20 + n, candidates: [city(), hotel(), hotel({ rating: 4.2 })] };
+    });
+    const fixedClock = () => new Date('2026-10-04T00:00:00.000Z');
+    const result = await measure(fake.runner, keywords, fixedClock);
+    assert.equal(result.measured_at, '2026-10-04T00:00:00.000Z');
+    assert.equal(result.sequential_mixed.calls, 7);
+    assert.equal(result.sequential_mixed.errors, 1);
+    assert.deepEqual(result.sequential_mixed.error_reasons, { exit_1: 1 });
+    assert.equal(result.sequential_place_only.errors, 0);
+    assert.equal(result.place_only_total_candidates, 0);
+    assert.equal(result.keywords_with_zero_place_results, '7/7');
+    assert.equal(result.place_object_field_presence.n, 0);
+    assert.deepEqual(Object.keys(result.mixed_candidates_by_type).sort(), ['city', 'hotel']);
+    assert.equal(result.mixed_candidates_by_type['city'], 6, 'one of seven mixed calls failed');
+    assert.equal(result.hotel_object_field_presence.fields['rating'], '6/12', 'half of the 12 hotel candidates carry a rating');
+    assert.equal(result.concurrent_mixed.concurrency, CONCURRENCY);
+    assert.equal(result.concurrent_mixed.calls, 7);
+});
+test('measure: the burst phase never exceeds the declared concurrency', async () => {
+    const keywords = Array.from({ length: 23 }, (_, i) => `k${i}`);
+    const fake = scripted(() => ({ ok: true, ms: 1, candidates: [] }));
+    await measure(fake.runner, keywords);
+    assert.ok(fake.stats().maxInFlight <= CONCURRENCY, `in-flight ${fake.stats().maxInFlight} exceeded ${CONCURRENCY}`);
+    assert.ok(fake.stats().maxInFlight > 1, 'burst phase must actually run concurrently');
+    assert.equal(fake.stats().calls, keywords.length * 3, 'mixed + place-only + burst');
+});
+let failed = 0;
+for (const { name, run } of tests) {
+    try {
+        await run();
+        console.log(`  ok   ${name}`);
+    }
+    catch (error) {
+        failed++;
+        console.error(`  FAIL ${name}`);
+        console.error(error);
+    }
+}
+if (failed > 0) {
+    console.error(`${failed} anything-path-measure test(s) failed`);
+    process.exit(1);
+}
+console.log(`anything-path-measure tests: ${tests.length} passed, 0 failed (offline: real hbcli runner never used)`);