@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.32

package/README.md

@@ -153,7 +153,7 @@ Trust is structural, not promised:
 ## Project Status and Roadmap
 Current boundary: deterministic planning and evidence-bound read capabilities are available; booking and real-user acceptance remain outside the shipped claim. See the [architecture](docs/architecture.md) and [roadmap](docs/roadmap.md).
 
-**v0.2.0-rc.30** on npm (`latest`). Pre-1.0: the core loop works end to end; evaluation is still at deterministic contracts and validators, with no external scores or uplift claims. External W2A events are contract-only and inert; no real sensor bridge or consumer is active yet.
+**v0.2.0-rc.31** on npm (`latest`). Pre-1.0: the core loop works end to end; evaluation is still at deterministic contracts and validators, with no external scores or uplift claims. External W2A events are contract-only and inert; no real sensor bridge or consumer is active yet.
 
 **Working today**
 
@@ -209,7 +209,7 @@ Documents ship as bilingual pairs (`x.md` English + `x.zh-CN.md` 中文); diverg
 
 **Built with**: DeepSeek Harness 0.2.0-rc.2 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 · OpenFlights · TypeScript
 
-**Version baseline: `v0.2.0-rc.30` (npm `latest`).** Verification gates: `scripts/run-all-tests.sh`; release flow: `scripts/publish-npm.sh`.
+**Version baseline: `v0.2.0-rc.31` (npm `latest`).** Verification gates: `scripts/run-all-tests.sh`; release flow: `scripts/publish-npm.sh`.
 
 <a href="https://www.star-history.com/?repos=danceiny%2Fgotry&type=date&legend=top-left">
  <picture>

package/README.zh-CN.md

@@ -155,7 +155,7 @@ npx @danceiny/gotry "我想从深圳休整两天,预算 3000"   # headless 一
 ## 状态与路线图
 当前边界：确定性规划与有证据边界的只读能力已经可用；预订与真实用户验收仍不属于当前交付声明。见[架构权威文档](docs/architecture.zh-CN.md)与[路线图](docs/roadmap.zh-CN.md)。
 
-npm `latest`：**v0.2.0-rc.30**。未到 1.0：核心链路已端到端可用；评测仍停留在确定性合同与校验器阶段，无外部分数、无 uplift 声明。外部 W2A 事件仍是合同层、默认 inert；尚无真实 sensor 桥或 consumer 激活。
+npm `latest`：**v0.2.0-rc.31**。未到 1.0：核心链路已端到端可用；评测仍停留在确定性合同与校验器阶段，无外部分数、无 uplift 声明。外部 W2A 事件仍是合同层、默认 inert；尚无真实 sensor 桥或 consumer 激活。
 
 **今天可用**
 
@@ -211,7 +211,7 @@ AI agent：[`AGENTS.md`](AGENTS.zh-CN.md) 是绑定契约——入场先清扫
 
 **Built with**: DeepSeek Harness 0.2.0-rc.2 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 · OpenFlights · TypeScript
 
-**版本基线：`v0.2.0-rc.30`（npm `latest`）。** 验证闸：`scripts/run-all-tests.sh`；发布流程：`scripts/publish-npm.sh`。
+**版本基线：`v0.2.0-rc.31`（npm `latest`）。** 验证闸：`scripts/run-all-tests.sh`；发布流程：`scripts/publish-npm.sh`。
 
 <a href="https://www.star-history.com/?repos=danceiny%2Fgotry&type=date&legend=top-left">
  <picture>

package/bin/gotry-bootstrap.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * gotry 外部依赖自举(founder 2026-08-29 指令:安装 gotry 时按上游本身的方式装好外部依赖):
- *   hbcli(hotelbyte-cli)  → npm 优先(staicli@npmjs;Node ≥ 20),原生二进制 install.sh 兜底
+ *   hbcli(hotelbyte-cli)  → 官方版本钉扎的原生 install.sh(npm 发布暂落后)
  *   agent-reach            → 官方 pip 安装 git+ upstream(包内 .venv,与 z3-solver 同址原则)
  *   flyai                  → 无需安装(npx 每次自拉 @fly-ai/flyai-cli)
  *   dsh-better-sidebar     → dsh 宿主层插件市场组件(dshmarket.com #1 UI,18.9 万周装):
@@ -62,6 +62,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { createHash } from 'node:crypto'
 import { checkExtensionStatus } from './gotry-extension-status.js'
+import { HBCLI_RELEASE_VERSION, HBCLI_INSTALL_CMD } from './gotry-hbcli-release.js'
 
 // ── FlyAI 凭据面(纯 JS 内联;与 ts/capabilities/flyai-config.ts 成对维护,
 // 口径以官方 @fly-ai/flyai-cli 1.0.16 解包事实为准。bootstrap 由 inner 以
@@ -164,24 +165,24 @@ function verifySecureModeInline(dir, file) {
 
 /**
  * 官方 CLI 首次运行可能先创建 ~/.flyai 为 0755(并写入 0600 device-id)。
- * 仅对当前用户拥有、且本身不是 symlink 的 .flyai 目录收紧权限；.gotry
- * 仍由 atomicWriteJsonInline 严格要求预先存在时就是 0700，不走此兼容路径。
+ * 仅对当前用户拥有、且本身不是 symlink 的目录收紧权限。
+ * 回执所在 .gotry 同样兼容 doctor/runtime 创建的既有 0755 目录。
  */
-function prepareFlyaiConfigDirInline() {
-  const dir = dirname(flyaiConfigFile())
+function preparePrivateDirInline(file = flyaiConfigFile()) {
+  const dir = dirname(file)
   try {
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 })
     const entry = lstatSync(dir)
-    if (entry.isSymbolicLink()) return { ok: false, error: '.flyai 目录是符号链接,拒绝写入' }
-    if (!entry.isDirectory()) return { ok: false, error: '.flyai 路径不是目录,拒绝写入' }
+    if (entry.isSymbolicLink()) return { ok: false, error: '配置目录是符号链接,拒绝写入' }
+    if (!entry.isDirectory()) return { ok: false, error: '配置路径不是目录,拒绝写入' }
     if (typeof process.getuid === 'function' && entry.uid !== process.getuid()) {
-      return { ok: false, error: '.flyai 目录不属于当前用户,拒绝写入' }
+      return { ok: false, error: '配置目录不属于当前用户,拒绝写入' }
     }
     if ((entry.mode & 0o777) !== 0o700) chmodSync(dir, 0o700)
     const after = lstatSync(dir)
-    if (after.isSymbolicLink() || !after.isDirectory()) return { ok: false, error: '.flyai 目录状态发生变化,拒绝写入' }
-    if (typeof process.getuid === 'function' && after.uid !== process.getuid()) return { ok: false, error: '.flyai 目录所有者发生变化,拒绝写入' }
-    return verifySecureModeInline(dir, flyaiConfigFile())
+    if (after.isSymbolicLink() || !after.isDirectory()) return { ok: false, error: '配置目录状态发生变化,拒绝写入' }
+    if (typeof process.getuid === 'function' && after.uid !== process.getuid()) return { ok: false, error: '配置目录所有者发生变化,拒绝写入' }
+    return verifySecureModeInline(dir, file)
   } catch (e) {
     return { ok: false, error: e.message }
   }
@@ -291,7 +292,7 @@ async function runSetupFlyai() {
       if (Object.keys(next).length === 0) {
         rmSync(flyaiConfigFile(), { force: true })
       } else {
-        const configDir = prepareFlyaiConfigDirInline()
+        const configDir = preparePrivateDirInline()
         if (!configDir.ok) { say(`[gotry-setup] 清除写入失败,旧配置保留:${configDir.error}`); return 1 }
         const w = atomicWriteJsonInline(flyaiConfigFile(), next)
         if (!w.ok) { say(`[gotry-setup] 清除写入失败,旧配置保留:${w.error}`); return 1 }
@@ -349,7 +350,7 @@ async function runSetupFlyai() {
     return 1
   }
   const hadConfigFile = existsSync(flyaiConfigFile())
-  const configDir = prepareFlyaiConfigDirInline()
+  const configDir = preparePrivateDirInline()
   if (!configDir.ok) {
     say(`[gotry-setup] ✗ 配置目录不安全,旧配置保留:${configDir.error}`)
     return 1
@@ -380,7 +381,8 @@ async function runSetupFlyai() {
     endpointDebug: epAfter.debug,
     at: new Date().toISOString(),
   }
-  const receiptWrite = atomicWriteJsonInline(flyaiVerificationFile(), receipt)
+  const receiptDir = preparePrivateDirInline(flyaiVerificationFile())
+  const receiptWrite = receiptDir.ok ? atomicWriteJsonInline(flyaiVerificationFile(), receipt) : receiptDir
   if (!receiptWrite.ok) {
     const rollback = hadConfigFile
       ? atomicWriteJsonInline(flyaiConfigFile(), before.data)
@@ -480,9 +482,6 @@ const WIZARD_DRY_RUN = process.argv.includes('--dry-run')
 const EXT_FROM_ARG = (process.argv.find((a) => a.startsWith('--extension-from=')) ?? '').split('=')[1]
 const EXTENSION_FROM = EXT_FROM_ARG === 'github' || EXT_FROM_ARG === 'bundled' ? EXT_FROM_ARG : process.env.GOTRY_EXTENSION_SOURCE === 'github' ? 'github' : 'bundled'
 
-// hbcli 安装通道:npm 优先(staicli@npmjs 双轨;显式 registry 防 bnpm 404),install.sh 兜底
-const HBCLI_NPM_INSTALL_CMD = 'npm install -g staicli --registry=https://registry.npmjs.org/'
-const HBCLI_INSTALL_CMD = HBCLI_NPM_INSTALL_CMD
 const REACH_INSTALL_URL = 'git+https://github.com/Panniantong/Agent-Reach.git'
 
 let activeInstallerChild = null
@@ -631,11 +630,8 @@ function classifyHbcliWhoami(out) {
 
 const say = (s) => console.log(s)
 
-/** hbcli 最低版本(可用 GOTRY_MIN_HBCLI_VERSION 覆盖)。
- * 0.0.3 修了 portal-ticket fallback bug(issue #142):低于该版本的 hbcli
- * 会把 literal "stored-ticket" 当 bearer 发到 hotel-be,让 trade.* /
- * search/checkAvail 等 @permission: openapi 端点全部 401。 */
-const MIN_HBCLI_VERSION = process.env.GOTRY_MIN_HBCLI_VERSION ?? '0.0.3'
+/** hbcli 最低版本(可用 GOTRY_MIN_HBCLI_VERSION 覆盖)，与工具层 doctor 共用发布基线。 */
+const MIN_HBCLI_VERSION = process.env.GOTRY_MIN_HBCLI_VERSION ?? HBCLI_RELEASE_VERSION
 
 function parseVersion(v) {
   const m = String(v || '').match(/(\d+)\.(\d+)\.(\d+)/)
@@ -663,38 +659,53 @@ async function hbcliVersion(bin) {
   })
 }
 
-async function setupHbcli() {
-  say(`[gotry-setup] hbcli(hotelbyte-cli,可选酒店实时源;需 ≥ v${MIN_HBCLI_VERSION},低于会踩 issue #142 的 401)`)
-  const candidates = ['hbcli', join(homedir(), '.local/bin/hbcli'), join(homedir(), '.staicli/current/hbcli')]
-  const present = candidates.some((p) => existsSync(p)) && (await probe(candidates[0], ['version']) || await probe(candidates[1], ['version']) || await probe(candidates[2], ['version']))
-  const credFile = join(homedir(), '.staicli', 'credentials.json')
-  if (present) {
-    const hit = candidates.find((p) => existsSync(p)) || 'hbcli'
-    const v = await hbcliVersion(hit)
-    if (v && !versionAtLeast(v, MIN_HBCLI_VERSION)) {
-      say(`  ✗ 版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——@permission: openapi 端点(trade.* / search/checkAvail)会 401(issue #142)`)
-      say(`    升级: npm install -g staicli --registry=https://registry.npmjs.org/`)
-      return { ok: CHECK_ONLY ? true : false }
+async function setupHbcli(opts = {}) {
+  const home = opts.homeDir ?? homedir()
+  const staicliHome = opts.homeDir ? join(home, '.staicli') : process.env.STAICLI_HOME ?? join(home, '.staicli')
+  const checkOnly = opts.checkOnly ?? CHECK_ONLY
+  say(`[gotry-setup] hbcli(hotelbyte-cli,可选酒店实时源;需 ≥ v${MIN_HBCLI_VERSION})`)
+  const candidates = ['hbcli', join(home, '.local/bin/hbcli'), join(home, '.staicli/current/hbcli')]
+  const findInstalled = async () => {
+    for (const bin of candidates) {
+      const version = await hbcliVersion(bin)
+      if (version) return { bin, version }
     }
-    say(`  ✓ 已安装(v${v ? v.join('.') : '?'})`)
+    return null
+  }
+  const present = await findInstalled()
+  const credFile = join(staicliHome, 'credentials.json')
+  if (present && versionAtLeast(present.version, MIN_HBCLI_VERSION)) {
+    say(`  ✓ 已安装(v${present.version.join('.')})`)
     if (existsSync(credFile)) say('  ✓ 凭证已配置(自检: hbcli auth whoami)')
     else say('  ✗ 凭证未配置——酒店检索将用内置静态包(非实时),账号配置见下方指引')
-    if (CHECK_ONLY) say('  (--check-only 只报告,不安装)')
+    if (checkOnly) say('  (--check-only 只报告,不安装)')
     return { ok: true }
   }
-  if (CHECK_ONLY) { say('  ✗ 未安装(--check-only 只报告)'); return { ok: true } }
-  say(`  安装中(npm,staicli@npmjs): ${HBCLI_INSTALL_CMD}`)
-  const r = await run('bash', ['-c', HBCLI_INSTALL_CMD], { timeoutMs: 120_000 })
-  if (!r.ok) { say(`  ✗ 安装失败(${r.error})——不影响 gotry,酒店检索将用内置静态包;可稍后重试: npx @danceiny/gotry setup`); return { ok: false } }
-  const binDir = join(homedir(), '.local/bin')
-  if (!process.env.PATH.split(':').includes(binDir)) {
+  if (present) say(`  ✗ 版本过旧(v${present.version.join('.')} < v${MIN_HBCLI_VERSION})`)
+  else say('  ✗ 未安装或无法读取版本')
+  if (checkOnly) { say('  (--check-only 只报告,不安装)'); return { ok: true } }
+  say(`  ${present ? '升级' : '安装'}中(官方 staicli v${HBCLI_RELEASE_VERSION}): ${HBCLI_INSTALL_CMD}`)
+  const attemptInstall = opts.attemptInstall ?? ((command) => run('bash', ['-o', 'pipefail', '-c', command], {
+    timeoutMs: 120_000,
+    env: { ...process.env, HOME: home, STAICLI_HOME: staicliHome },
+  }))
+  const r = await attemptInstall(HBCLI_INSTALL_CMD)
+  if (!r.ok) { say(`  ✗ 安装失败(${r.error})——不影响 gotry,酒店检索将用内置静态包;可稍后重试: npx @danceiny/gotry doctor --fix`); return { ok: false, error: r.error } }
+  const installed = await findInstalled()
+  if (!installed || !versionAtLeast(installed.version, MIN_HBCLI_VERSION)) {
+    const error = `安装后当前候选路径仍未找到 hbcli ≥ v${MIN_HBCLI_VERSION}；检查 PATH 是否优先命中了旧版，以及 ${join(home, '.local/bin/hbcli')}`
+    say(`  ✗ ${error}`)
+    return { ok: false, error }
+  }
+  const binDir = join(home, '.local/bin')
+  if (!(process.env.PATH ?? '').split(':').includes(binDir)) {
     say(`  ⚠ ${binDir} 不在当前 PATH —— gotry 工具已内建候选路径回退,无需手动处理;其他程序可用: export PATH="${binDir}:$PATH"`)
   }
-  say('  ✓ 安装完成——账号配置(未配时酒店检索自动用静态包,非实时):')
-  say('    · 快速试用(官方沙箱演示账号): hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo')
-  say('    · 正式接入: 向 HotelByte 申请专属 appKey/appSecret 后用同一命令替换')
-  say('    · 门户账号(权限更大,酒店搜索无必要): hbcli auth login --username <email>')
-  say('  自检: hbcli auth whoami(api_key.configured=true 即就位)')
+  say(`  ✓ 安装完成(v${installed.version.join('.')})——已有凭证保留；账号配置:`)
+  say('    · 打开 插件 → GoTry → HotelByte，申请沙箱账号并验证保存 App Key/App Secret')
+  say('    · 申请入口: https://hotelbyte.com/zh/guides/sandbox-verification')
+  say('    · CLI 配置: hbcli auth set-credentials --app-key <appKey> --app-secret <appSecret>')
+  say('  自检: hbcli auth whoami；实际酒店搜索仍需账号开通可用供应商')
   return { ok: true }
 }
 
@@ -856,7 +867,7 @@ async function doctorChecks() {
   const reachOk = existsSync(reachBin)
   const reachLevel = reachOk ? 'ok' : existsSync(venvPython) ? 'degraded' : 'missing'
   items.push({ label: 'Agent Reach(网页/社媒读取)', ok: reachOk, level: reachLevel, detail: reachOk ? `已安装(${reachBin})` : reachLevel === 'degraded' ? '.venv 在但缺 agent-reach 包——gotry_agent_reach / gotry_web_search 读页会失败' : '未装配——gotry_agent_reach / gotry_web_search(读网页)/ gotry_video_subtitle / gotry_github_search 全部不可用', fix: reachOk ? undefined : 'npx @danceiny/gotry doctor --fix' })
-  // hbcli(裸名靠 PATH 探测;绝对路径 existsSync;版本 < MIN_HBCLI_VERSION 视为 missing,见 issue #142)
+  // hbcli(裸名靠 PATH 探测;绝对路径 existsSync;版本 < MIN_HBCLI_VERSION 需要升级)
   let hbBin = ''
   for (const p of ['hbcli', join(homedir(), '.local/bin/hbcli'), join(homedir(), '.staicli/current/hbcli')]) {
     if (p === 'hbcli') { if (await probe(p, ['version'])) { hbBin = 'hbcli(PATH)'; break } } else if (existsSync(p)) { hbBin = p; break }
@@ -864,7 +875,7 @@ async function doctorChecks() {
   if (hbBin) {
     const v = await hbcliVersion(hbBin)
     if (v && !versionAtLeast(v, MIN_HBCLI_VERSION)) {
-      items.push({ label: 'hbcli(酒店实时源)', ok: false, level: 'missing', detail: `版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——trade.* / search/checkAvail 会 401(issue #142)`, fix: 'npm install -g staicli --registry=https://registry.npmjs.org/' })
+      items.push({ label: 'hbcli(酒店实时源)', ok: false, level: 'missing', detail: `版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——请升级到支持当前认证与酒店配置的版本`, fix: HBCLI_INSTALL_CMD })
     } else {
       // 凭证按 whoami 的 JSON 三档判定,不再看退出码(#623:whoami 无凭证也退 0,旧判法恒报「凭证有效」)
       const cred = classifyHbcliWhoami(await probeStdout(hbBin === 'hbcli(PATH)' ? 'hbcli' : hbBin, ['--json', 'auth', 'whoami']))
@@ -873,7 +884,7 @@ async function doctorChecks() {
         detail: cred.ok
           ? `已安装且凭证有效(${hbBin}, v${v ? v.join('.') : '?'}${cred.customer ? ',customer 档在用(客户邮箱验证码登录)' : ''})`
           : '二进制在,但凭证未配置/失效——酒店检索将降级静态包(非实时)',
-        fix: cred.ok ? undefined : 'hbcli auth customer-send-code --email you@mail.com 收码后 hbcli auth customer-login --email you@mail.com --code <收件码>(客户邮箱验证码登录,新邮箱即注册,需 npm staicli ≥ 0.0.4);B 端租户注册走 hbcli auth register(先 auth send-code);或 hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo(快速试用沙箱;正式 key 向 HotelByte 申请)',
+        fix: cred.ok ? undefined : 'hbcli auth customer-send-code --email you@mail.com 收码后 hbcli auth customer-login --email you@mail.com --code <收件码>(客户邮箱验证码登录,新邮箱即注册);B 端租户注册走 hbcli auth register(先 auth send-code);或在 插件 → GoTry → HotelByte 配置沙箱 App Key/App Secret',
       })
     }
   } else {
@@ -1130,8 +1141,7 @@ function classifyDoctorGap(item, opts = {}) {
   const autoSupported = doctorFixAutoSupported(platform)
   if (label.startsWith('Agent Reach')) return installerEnabled('reach', env) && autoSupported ? 'auto' : 'unavailable'
   // hbcli:二进制缺失(missing)= auto(setupHbcli 装;win32 → unavailable,上游无 win 安装面);
-  // 凭证未配(degraded)= user-action(平台无关);旧版本(missing,安装器不自动升级)= auto 分桶
-  // 但安装会失败 → 结果兜底 unavailable,诚实不冒充。
+  // 凭证未配(degraded)= user-action(平台无关);旧版本(missing)= auto，同安装器升级后复检。
   if (label.startsWith('hbcli')) {
     if (item.level === 'degraded') return 'user-action'
     return installerEnabled('hbcli', env) && autoSupported ? 'auto' : 'unavailable'
@@ -1753,7 +1763,7 @@ if (process.argv[1] && process.argv[1].endsWith('gotry-bootstrap.js')) {
 }
 
 export {
-  setupSidebar, sidebarInstalled,
+  setupHbcli, setupSidebar, sidebarInstalled,
   classifyDoctorGap, buildOnboardingPlan, onboardingSkipReason,
   runOnboardingFix, promptOnboarding, renderClassifiedPlan, runOnboarding, orchestrateWebLaunch,
   doctorFixAutoSupported, platformAutoUnavailableReason, installerEnabled,

package/bin/gotry-hbcli-release.d.ts

@@ -0,0 +1,3 @@
+export const HBCLI_RELEASE_VERSION: string
+export const HBCLI_INSTALL_URL: string
+export const HBCLI_INSTALL_CMD: string

package/bin/gotry-hbcli-release.js

@@ -0,0 +1,4 @@
+/** Official stable hbcli baseline. npm's staicli@latest still points to 0.0.3. */
+export const HBCLI_RELEASE_VERSION = '0.0.4'
+export const HBCLI_INSTALL_URL = `https://github.com/hotelbyte-com/docs/releases/download/staicli-v${HBCLI_RELEASE_VERSION}/install.sh`
+export const HBCLI_INSTALL_CMD = `curl -fsSL --connect-timeout 15 --max-time 60 ${HBCLI_INSTALL_URL} | bash -s -- --version ${HBCLI_RELEASE_VERSION}`

package/client/client.js

@@ -26,6 +26,15 @@ window.__ModuleLoader__.load({
         saved: 'Verified and saved.', clear: 'Clear local key', cleared: 'Local key cleared. Anonymous trial is now active.',
         retry: 'Refresh status', source: 'Source', config: 'Local configuration', env: 'Environment variable',
         'env-debug': 'Debug environment variable', none: 'Shared trial',
+        hbcli: 'HotelByte · sandbox', appKey: 'App Key', appSecret: 'App Secret',
+        hbHint: 'Use the credentials supplied with your sandbox account. They never enter the conversation.',
+        hbRegistration: 'Apply for a sandbox account', hbUnconfigured: 'Sandbox API credentials are not configured', hbConfigured: 'Sandbox API credentials configured',
+        hbReadOnly: 'Credentials come from the launch environment, or the local configuration cannot be safely written.',
+        hbSaveFailed: 'Credentials were not saved; the previous configuration is retained.',
+        hbSaved: 'Credentials saved and the read-only hotel query completed.', hbClear: 'Clear local sandbox credentials',
+        hbCleared: 'Local sandbox API credentials cleared.', hbNoSuppliers: 'Saved · no available suppliers configured',
+        hbNoSuppliersHint: 'HotelByte must enable suppliers for your account. This result does not mean the destination has no rooms.',
+        hbMiss: 'Query verified · no hotels in this check', hbProbeHint: 'Verification makes one read-only Shanghai hotel query for tomorrow, one night and two adults.',
         artifacts: 'GoTry artifacts', artifactsHint: 'Browse saved itineraries and planning deliveries',
         search: 'Search artifacts', searchPlaceholder: 'Title or filename', refresh: 'Refresh',
         empty: 'No saved artifacts in this workspace.', noMatches: 'No matching artifacts.', noSession: 'Open a conversation to browse its workspace.',
@@ -43,6 +52,15 @@ window.__ModuleLoader__.load({
         saved: '验证通过，已保存。', clear: '清除本机 Key', cleared: '本机 Key 已清除，已恢复匿名试用。',
         retry: '重新读取状态', source: '来源', config: '本机配置', env: '环境变量',
         'env-debug': '调试环境变量', none: '共享试用',
+        hbcli: 'HotelByte（沙箱）', appKey: 'App Key', appSecret: 'App Secret',
+        hbHint: '填写开通沙箱账号后取得的凭证，内容不会进入对话。',
+        hbRegistration: '申请沙箱账号', hbUnconfigured: '尚未配置沙箱 API 凭证', hbConfigured: '已配置沙箱 API 凭证',
+        hbReadOnly: '当前凭证来自启动环境变量，或本机配置无法安全写入。',
+        hbSaveFailed: '新凭证未保存，旧配置已保留。',
+        hbSaved: '凭证已保存，只读酒店查询已完成。', hbClear: '清除本机沙箱凭证',
+        hbCleared: '本机沙箱 API 凭证已清除。', hbNoSuppliers: '已保存 · 未配置可用供应商',
+        hbNoSuppliersHint: '请联系 HotelByte 开通当前账号的供应商。这次结果不能判断目的地无房。',
+        hbMiss: '查询通道已验证 · 本次未返回酒店', hbProbeHint: '验证会只读查询上海明天入住的一晚酒店，两位成人。',
         artifacts: 'GoTry 产物', artifactsHint: '查看已保存行程和规划交付物',
         search: '搜索产物', searchPlaceholder: '标题或文件名', refresh: '刷新',
         empty: '这个工作区尚无已保存产物。', noMatches: '没有匹配的产物。', noSession: '打开一个对话后即可查看其工作区产物。',
@@ -59,10 +77,12 @@ window.__ModuleLoader__.load({
       return value
     }
 
-    function FlyaiSettings(props) {
+    function SourceSettings(props) {
       var t = props.t
+      var hotelbyte = props.provider === 'hbcli', provider = hotelbyte ? 'hbcli' : 'flyai'
       var state = React.useState(null), status = state[0], setStatus = state[1]
       var draft = React.useState(''), key = draft[0], setKey = draft[1]
+      var secretDraft = React.useState(''), secret = secretDraft[0], setSecret = secretDraft[1]
       var noticeState = React.useState(''), notice = noticeState[0], setNotice = noticeState[1]
       var errorState = React.useState(''), error = errorState[0], setError = errorState[1]
       var busyState = React.useState(false), busy = busyState[0], setBusy = busyState[1]
@@ -72,7 +92,7 @@ window.__ModuleLoader__.load({
         var controller = new AbortController()
         lifetime.current = controller
         setError('')
-        webRequest('flyai', { signal: controller.signal }).then(function (value) {
+        webRequest(provider, { signal: controller.signal }).then(function (value) {
           if (!controller.signal.aborted) setStatus(value)
         }).catch(function () { if (!controller.signal.aborted) setError(t('failed')) })
         return function () { controller.abort(); lifetime.current = null }
@@ -82,14 +102,20 @@ window.__ModuleLoader__.load({
         var controller = lifetime.current
         activeRequest.current = true
         setBusy(true); setError(''); setNotice('')
-        var candidate = key
-        setKey('')
+        var candidate = key, candidateSecret = secret
+        setKey(''); setSecret('')
         try {
-          var value = await webRequest('flyai/write', { method: 'POST', signal: controller.signal,
-            headers: { 'content-type': 'application/json' }, body: JSON.stringify(action === 'save' ? { action: action, key: candidate } : { action: action }) })
-          if (!controller.signal.aborted) { setStatus(value); setNotice(t(action === 'save' ? 'saved' : 'cleared')) }
+          var payload = action === 'clear' ? { action: action } : hotelbyte
+            ? { action: action, appKey: candidate, appSecret: candidateSecret } : { action: action, key: candidate }
+          var value = await webRequest(provider + '/write', { method: 'POST', signal: controller.signal,
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload) })
+          if (!controller.signal.aborted) {
+            setStatus(value)
+            setNotice(hotelbyte && action === 'save' && value.verdict === 'no-suppliers' ? ''
+              : t(hotelbyte ? action === 'clear' ? 'hbCleared' : 'hbSaved' : action === 'save' ? 'saved' : 'cleared'))
+          }
         } catch (failure) {
-          if (!controller.signal.aborted) setError(failure.message || t('saveFailed'))
+          if (!controller.signal.aborted) setError(failure.message || t(hotelbyte ? 'hbSaveFailed' : 'saveFailed'))
         } finally {
           activeRequest.current = false
           if (!controller.signal.aborted) setBusy(false)
@@ -97,21 +123,32 @@ window.__ModuleLoader__.load({
       }
       if (props.view === 'summary') return t('description')
       var disabled = busy || !status?.writable
-      var stateLabel = !status ? t('loading') : !status.configured ? t('anonymous') : status.verified ? t('verified') : t('unverified')
-      return element('section', { 'data-gotry-flyai-settings': '', style: { display: 'grid', gap: '16px', maxWidth: '640px' } }, [
-        element('h3', { key: 'heading', style: { margin: 0 } }, t('flyai')),
-        element('div', { key: 'status', role: 'status', 'data-gotry-flyai-status': '', style: { display: 'grid', gap: '6px' } }, [
+      var stateLabel = !status ? t('loading') : !status.configured ? t(hotelbyte ? 'hbUnconfigured' : 'anonymous')
+        : hotelbyte && status.verdict === 'no-suppliers' ? t('hbNoSuppliers') : hotelbyte && status.verdict === 'miss' ? t('hbMiss')
+        : status.verified ? t('verified') : t('unverified')
+      var sectionProps = { style: { display: 'grid', gap: '16px', maxWidth: '640px' } }
+      sectionProps['data-gotry-' + provider + '-settings'] = ''
+      var statusProps = { key: 'status', role: 'status', style: { display: 'grid', gap: '6px' } }
+      statusProps['data-gotry-' + provider + '-status'] = ''
+      return element('section', sectionProps, [
+        element('h3', { key: 'heading', style: { margin: 0 } }, t(provider)),
+        element('div', statusProps, [
           element(UI.Tag, { key: 'badge', tone: status?.verified ? 'success' : 'neutral' }, stateLabel),
-          status ? element('span', { key: 'source', style: { fontSize: '12px', color: 'var(--dsw-alias-label-tertiary)' } }, t('source') + '：' + t(status.source)) : null,
+          status ? element('span', { key: 'source', style: { fontSize: '12px', color: 'var(--dsw-alias-label-tertiary)' } }, t('source') + '：' + t(hotelbyte && status.source === 'none' ? 'hbUnconfigured' : status.source)) : null,
           status?.endpointDebug ? element('span', { key: 'debug' }, t('debug') + '：' + status.endpoint) : null,
         ]),
-        element('a', { key: 'console', href: 'https://flyai.open.fliggy.com/console', target: '_blank', rel: 'noopener noreferrer' }, t('console')),
-        element(UI.SettingsForm, { key: 'form', labels: { unavailable: t('loading'), readOnly: t('readOnly'), saveFailed: t('saveFailed'), save: t('save'), saving: t('saving') },
-          state: { available: Boolean(status), writable: Boolean(status?.writable), dirty: key.trim().length > 0, invalid: false, saving: busy, failed: false },
-          onSave: function () { void write('save') }, onDiscard: function () { setKey('') } }, [
-          element(UI.SettingsSecretField, { key: 'key', id: 'gotry-flyai-key', label: t('key'), hint: t('keyHint'), text: key,
-            configured: Boolean(status?.configured), stateLabel: t(status?.configured ? 'configured' : 'anonymous'), disabled: disabled,
+        element('a', { key: 'console', href: hotelbyte ? 'https://hotelbyte.com/zh/guides/sandbox-verification' : 'https://flyai.open.fliggy.com/console', target: '_blank', rel: 'noopener noreferrer' }, t(hotelbyte ? 'hbRegistration' : 'console')),
+        hotelbyte ? element('p', { key: 'probe-hint', style: { margin: 0, fontSize: '12px' } }, t('hbProbeHint')) : null,
+        hotelbyte && status?.verdict === 'no-suppliers' ? element('p', { key: 'supplier-hint', role: 'status', style: { margin: 0 } }, t('hbNoSuppliersHint')) : null,
+        element(UI.SettingsForm, { key: 'form', labels: { unavailable: t('loading'), readOnly: t(hotelbyte ? 'hbReadOnly' : 'readOnly'), saveFailed: t(hotelbyte ? 'hbSaveFailed' : 'saveFailed'), save: t('save'), saving: t('saving') },
+          state: { available: Boolean(status), writable: Boolean(status?.writable), dirty: key.trim().length > 0 && (!hotelbyte || secret.trim().length > 0), invalid: false, saving: busy, failed: false },
+          onSave: function () { void write('save') }, onDiscard: function () { setKey(''); setSecret('') } }, [
+          element(UI.SettingsSecretField, { key: 'key', id: 'gotry-' + provider + '-key', label: t(hotelbyte ? 'appKey' : 'key'), hint: t(hotelbyte ? 'hbHint' : 'keyHint'), text: key,
+            configured: Boolean(status?.configured), stateLabel: t(status?.configured ? hotelbyte ? 'hbConfigured' : 'configured' : hotelbyte ? 'hbUnconfigured' : 'anonymous'), disabled: disabled,
             onEdit: function (value) { setKey(value); setError(''); setNotice('') } }),
+          hotelbyte ? element(UI.SettingsSecretField, { key: 'secret', id: 'gotry-hbcli-secret', label: t('appSecret'), text: secret,
+            configured: Boolean(status?.configured), stateLabel: t(status?.configured ? 'hbConfigured' : 'hbUnconfigured'), disabled: disabled,
+            onEdit: function (value) { setSecret(value); setError(''); setNotice('') } }) : null,
         ]),
         error ? element('p', { key: 'error', role: 'alert', style: { margin: 0, color: 'var(--dsw-alias-state-error-primary)' } }, error) : null,
         notice ? element('p', { key: 'notice', role: 'status', style: { margin: 0 } }, notice) : null,
@@ -119,11 +156,19 @@ window.__ModuleLoader__.load({
           element(UI.Button, { key: 'retry', type: 'button', variant: 'outline', disabled: busy,
             onClick: function () { setReload(function (value) { return value + 1 }) } }, t('retry')),
           status?.configured && status.writable ? element(UI.Button, { key: 'clear', type: 'button', disabled: busy,
-            onClick: function () { void write('clear') } }, t('clear')) : null,
+            onClick: function () { void write('clear') } }, t(hotelbyte ? 'hbClear' : 'clear')) : null,
         ]),
       ])
     }
 
+    function GoTrySettings(props) {
+      if (props.view === 'summary') return props.t('description')
+      return element('div', { style: { display: 'grid', gap: '32px' } }, [
+        element(SourceSettings, Object.assign({}, props, { key: 'flyai', provider: 'flyai' })),
+        element(SourceSettings, Object.assign({}, props, { key: 'hbcli', provider: 'hbcli' })),
+      ])
+    }
+
     function ArtifactBrowser(props) {
       var t = props.t, info = props.useTabInfo(), sessionId = props.sessionId
       var cwd = props.useSessions(function (sessions) { return sessions.byId[sessionId]?.cwd })
@@ -367,7 +412,7 @@ window.__ModuleLoader__.load({
         var t = scope.locale.bind(ns)
         scope.effect(function () { return scope.locale.register(ns, webLocale) })
         scope.slots.inject('plugins.item', function () {
-          return scope.slots.register({ name: 'plugins.item', id: 'gotry', order: 50, label: function () { return t('title') }, locale: ns }, FlyaiSettings)
+          return scope.slots.register({ name: 'plugins.item', id: 'gotry', order: 50, label: function () { return t('title') }, locale: ns }, GoTrySettings)
         })
         scope.inject(['sidebarRightTabs'], function (sidebar) {
           sidebar.effect(function () { return sidebar.sidebarRightTabs.register({ id: '@danceiny/gotry:artifacts', kind: 'gotry-artifacts',

package/dist/capabilities/doctor.js

@@ -20,6 +20,7 @@ import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { checkExtensionStatus } from '../../bin/gotry-extension-status.js';
+import { HBCLI_RELEASE_VERSION, HBCLI_INSTALL_CMD } from '../../bin/gotry-hbcli-release.js';
 import { readLatestChannelEvents } from './channel-health.js';
 import { displayEndpoint, endpointFingerprint, readFlyaiVerification, resolveFlyaiEndpoint, resolveFlyaiKey, sha256Hex, } from './flyai-config.js';
 /** hbcli 已知安装位(与 capabilities/hbcli.ts hbcliBinCandidates 同清单) */
@@ -110,10 +111,8 @@ export function nodeOk(version) {
     const [maj = '0', min = '0'] = version.split('.');
     return Number(maj) > 22 || (Number(maj) === 22 && Number(min) >= 15);
 }
-/** hbcli 最低版本(可用 GOTRY_MIN_HBCLI_VERSION 覆盖)。0.0.3 修了 portal-ticket
- * fallback bug(issue #142)——低于该版本的 hbcli 会把 literal "stored-ticket"
- * 当 bearer 发到 hotel-be,让 trade.* / search/checkAvail 全部 401。 */
-const MIN_HBCLI_VERSION = process.env.GOTRY_MIN_HBCLI_VERSION ?? '0.0.3';
+/** hbcli 最低版本(可用 GOTRY_MIN_HBCLI_VERSION 覆盖)，与 CLI doctor 共用发布基线。 */
+const MIN_HBCLI_VERSION = process.env.GOTRY_MIN_HBCLI_VERSION ?? HBCLI_RELEASE_VERSION;
 /** 单项检查:全部只读、永不抛错;env/homeDir/repoRoot 可注入(测试确定性) */
 export async function runDoctorChecks(opts = {}) {
     const repoRoot = opts.repoRoot ? resolve(opts.repoRoot) : resolve(import.meta.dirname, '..', '..');
@@ -149,7 +148,7 @@ export async function runDoctorChecks(opts = {}) {
     }
     // 3. hbcli(酒店实时源;静态包自动降级,缺了不致命)
     //    裸名 'hbcli' 靠 PATH 解析(existsSync 对裸名是 cwd 相对,无意义)——先探测再落位
-    //    版本 < MIN_HBCLI_VERSION 视为 missing(issue #142:portal-ticket fallback 401)
+    //    版本 < MIN_HBCLI_VERSION 视为 missing，修复走版本钉扎的官方安装器
     let hbPresent = '';
     for (const p of hbcliCandidates(home)) {
         if (p !== 'hbcli' && existsSync(p)) {
@@ -167,8 +166,8 @@ export async function runDoctorChecks(opts = {}) {
         if (v && !versionAtLeast(v, MIN_HBCLI_VERSION)) {
             items.push({
                 id: 'hbcli', label: 'hbcli(酒店实时源)', status: 'missing',
-                detail: `版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——trade.* / search/checkAvail 会 401(issue #142)`,
-                fix: 'npm install -g staicli --registry=https://registry.npmjs.org/',
+                detail: `版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——请升级到支持当前认证与酒店配置的版本`,
+                fix: HBCLI_INSTALL_CMD,
             });
         }
         else {
@@ -194,7 +193,7 @@ export async function runDoctorChecks(opts = {}) {
                 : {
                     id: 'hbcli', label: 'hbcli(酒店实时源)', status: 'degraded',
                     detail: '二进制在,但凭证未配置/失效——酒店检索将降级静态包(非实时)',
-                    fix: 'hbcli auth customer-send-code --email you@mail.com 收码后 hbcli auth customer-login --email you@mail.com --code <收件码>(客户邮箱验证码登录,新邮箱即注册,需 npm staicli ≥ 0.0.4);B 端租户注册走 hbcli auth register(先 auth send-code);或 hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo(快速试用沙箱;正式 key 向 HotelByte 申请)',
+                    fix: 'hbcli auth customer-send-code --email you@mail.com 收码后 hbcli auth customer-login --email you@mail.com --code <收件码>(客户邮箱验证码登录,新邮箱即注册);B 端租户注册走 hbcli auth register(先 auth send-code);或在 插件 → GoTry → HotelByte 配置沙箱 App Key/App Secret',
                 });
         }
     }