@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.32

package/ts/src/gotry-web-api.ts

@@ -12,11 +12,16 @@ import {
   removeFlyaiVerification, resolveFlyaiEndpoint, resolveFlyaiKey, saveFlyaiKey,
   sha256Hex, writeFlyaiVerification,
 } from '../capabilities/flyai-config.ts'
+import {
+  hbcliCredentialPath, hbcliSetupStatus, readHbcliCredentials, removeHbcliVerification,
+  verifyHbcliCandidate, withHbcliCredentials, withoutHbcliCredentials, writeHbcliCredentials, writeHbcliVerification,
+} from '../capabilities/hbcli-config.ts'
 
 interface WebOptions {
   stateRoot: string
   homeDir?: string
   env?: NodeJS.ProcessEnv
+  hbcliBin?: string
   workspaceForSession: (sessionId: string) => Promise<string | undefined>
 }
 
@@ -47,6 +52,7 @@ async function readInput(request: Request): Promise<Record<string, unknown> | Re
 export function createGotryWebHandlers(options: WebOptions) {
   const homeDir = options.homeDir ?? homedir(), env = options.env ?? process.env
   const paths = { homeDir, env }, configPath = flyaiConfigPath(homeDir)
+  const hbPaths = { homeDir, env, hbcliBin: options.hbcliBin }
   let mutations: Promise<unknown> = Promise.resolve()
   const status = () => {
     const current = resolveFlyaiKey(paths), endpoint = resolveFlyaiEndpoint(paths), receipt = readFlyaiVerification(homeDir)
@@ -92,7 +98,48 @@ export function createGotryWebHandlers(options: WebOptions) {
     }
     return json(status())
   }
+  async function mutateHbcli(input: Record<string, unknown>, signal: AbortSignal): Promise<Response> {
+    if (signal.aborted) return rejection('操作已取消。', 409)
+    if (!hbcliSetupStatus(hbPaths).writable) return rejection('当前凭证来自环境变量，或本机配置不可安全写入。', 409)
+    const before = readHbcliCredentials(hbPaths)
+    if (!before.ok) return rejection('原配置损坏，已保留原文件，请先修复。', 409)
+    if (input.action === 'clear') {
+      if (!writeHbcliCredentials(withoutHbcliCredentials(before.data), hbPaths)) return rejection('无法清除配置，请检查本机文件及权限。', 409)
+      removeHbcliVerification(homeDir)
+      return json(hbcliSetupStatus(hbPaths))
+    }
+    const appKey = typeof input.appKey === 'string' ? input.appKey.trim() : ''
+    const appSecret = typeof input.appSecret === 'string' ? input.appSecret.trim() : ''
+    if ([appKey, appSecret].some(value => !value || value.length > 2048 || /[\r\n\0]/.test(value))) return rejection('请填写 HotelByte 提供的 App Key 和 App Secret。')
+    const verified = await verifyHbcliCandidate(appKey, appSecret, hbPaths, signal)
+    if (signal.aborted || verified.verdict === 'error' || verified.verdict === 'cancelled') {
+      return json({ ok: false, error: verified.error ?? '验证已取消，旧配置保留。' }, 422)
+    }
+    const current = readHbcliCredentials(hbPaths)
+    if (!hbcliSetupStatus(hbPaths).writable || !current.ok || current.bytes !== before.bytes) return rejection('配置在验证期间发生变化，请重新读取后再试。', 409)
+    const next = withHbcliCredentials(before.data, appKey, appSecret)
+    if (!writeHbcliCredentials(next, hbPaths)) return rejection('安全保存失败，旧配置保留，请检查本机权限。', 409)
+    if (!writeHbcliVerification(next, verified.verdict, hbPaths)) {
+      const restored = before.bytes === undefined
+        ? (() => { try { rmSync(hbcliCredentialPath(hbPaths)); return true } catch { return false } })()
+        : writeHbcliCredentials(before.data, hbPaths)
+      return rejection(restored ? '验证回执保存失败，旧配置已恢复。' : '验证回执保存失败，请检查本机文件。', 409)
+    }
+    return json(hbcliSetupStatus(hbPaths))
+  }
   return {
+    async hbcli(request: Request): Promise<Response> {
+      if (request.method === 'GET') return json(hbcliSetupStatus(hbPaths))
+      if (request.method !== 'POST') return rejection('不支持此操作。', 405)
+      const input = await readInput(request)
+      if (input instanceof Response) return input
+      if (!['save', 'clear'].includes(String(input.action))
+        || Object.keys(input).some(key => !['action', 'appKey', 'appSecret'].includes(key))
+        || (input.action === 'clear' && ('appKey' in input || 'appSecret' in input))) return rejection('请求无效。')
+      const operation = mutations.then(() => mutateHbcli(input, request.signal)).catch(() => rejection('操作失败，未能确认保存，请重新读取状态。', 500))
+      mutations = operation.then(() => undefined)
+      return operation
+    },
     async flyai(request: Request): Promise<Response> {
       if (request.method === 'GET') return json(status())
       if (request.method !== 'POST') return rejection('不支持此操作。', 405)
@@ -121,11 +168,11 @@ export function createGotryWebHandlers(options: WebOptions) {
   }
 }
 
-export function registerGotryWebApi(ctx: Context, stateRoot: string): void {
+export function registerGotryWebApi(ctx: Context, stateRoot: string, hbcliBin?: string): void {
   if (typeof ctx.inject !== 'function') return
   ctx.inject(['connection', 'sessions'], scope => {
     const connection = scope.get('connection') as HostConnectionHandle
-    const handlers = createGotryWebHandlers({ stateRoot, workspaceForSession: async sessionId => {
+    const handlers = createGotryWebHandlers({ stateRoot, hbcliBin, workspaceForSession: async sessionId => {
       const id = sessionId as Parameters<typeof scope.sessions.get>[0]
       const live = scope.sessions.get(id)?.header
       const stored = live ? undefined : await scope.get('sessionPersistence')?.stat(sessionId)
@@ -135,6 +182,8 @@ export function registerGotryWebApi(ctx: Context, stateRoot: string): void {
     // it. Exact routes have one body mode, so reads and bounded writes differ.
     scope.effect(() => connection.fetch.register({ path: '/api/gotry/flyai', methods: ['GET'], requestBody: 'buffered', fetch: handlers.flyai }))
     scope.effect(() => connection.fetch.register({ path: '/api/gotry/flyai/write', methods: ['POST'], requestBody: 'streaming', fetch: handlers.flyai }))
+    scope.effect(() => connection.fetch.register({ path: '/api/gotry/hbcli', methods: ['GET'], requestBody: 'buffered', fetch: handlers.hbcli }))
+    scope.effect(() => connection.fetch.register({ path: '/api/gotry/hbcli/write', methods: ['POST'], requestBody: 'streaming', fetch: handlers.hbcli }))
     scope.effect(() => connection.fetch.register({ path: '/api/gotry/artifacts', methods: ['GET'], requestBody: 'buffered', fetch: handlers.artifacts }))
   })
 }

package/ts/src/index.ts

@@ -523,7 +523,7 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
   // 派生的后台规划会话:唯一出口 converge + 长 leash——前台转后台,后台
   // 必须产出最终交付物,不得再次 handoff(否则无限递归)。
   if (!rawBenchmarkEnvironmentConfigPath) {
-    registerGotryWebApi(ctx, config.stateRoot ?? '.')
+    registerGotryWebApi(ctx, config.stateRoot ?? '.', config.hbcliBin)
     registerArtifactDeliveries(ctx)
   }
   const handoffChild = process.env.GOTRY_HANDOFF_CHILD === '1'
@@ -1419,10 +1419,15 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
       const resp = itp.result
       const dir = await ensureStateDir(config.stateRoot)
       const isLive = resp.via === 'hbcli-realtime'
-      const evidence = isLive ? resp.evidence : '[静态包:估算]'
+      const staticStays = (resp.hotels as { stays?: unknown[] } | null)?.stays
+      const hasEstimate = Array.isArray(staticStays) && staticStays.length > 0
+      const liveList = (resp.hotels as { list?: unknown[] } | null)?.list
+      const verdict = isLive ? (liveList?.length ? 'hit' : 'miss') : hasEstimate ? 'estimated' : 'error'
+      const evidence = hasEstimate ? '[静态包:估算]' : resp.evidence
       await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `hotel_search:${resp.via}`).catch(() => {})
       const payload = {
-        ok: true,
+        ok: isLive || hasEstimate,
+        verdict,
         hotels: resp.hotels ?? null,
         evidence,
         destination: q.destination,
@@ -1430,6 +1435,7 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
         latency_ms: Date.now() - started,
         summary: resp.summary,
         error: resp.error,
+        ...(verdict !== 'hit' ? await routingField('search-hotel', 'hbcli-hotel') : {}),
         ...(dateNotes.length ? { date_notes: dateNotes } : {}),
       } as never
       return JSON.parse(JSON.stringify(payload)) as never
@@ -1456,13 +1462,14 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
         }
       }
       const h = r.hotels
-      const liveCount = Array.isArray(h) ? h.length : 0
+      const liveList = (h as { list?: unknown[] } | null)?.list
+      const liveCount = Array.isArray(liveList) ? liveList.length : 0
       // 静态包是 {meta, stays} 对象而非数组(issue #24:此前计数恒 0 → UI 显示「无结果」)
       const stays = !Array.isArray(h) && h && typeof h === 'object' ? (h as { stays?: unknown[] }).stays : undefined
       const staticCount = Array.isArray(stays) ? stays.length : 0
       const tag = r.via === 'hbcli-realtime'
-        ? (liveCount ? `实时 ${liveCount} 家` : '实时')
-        : staticCount ? `静态包 ${staticCount} 块` : (liveCount ? `${liveCount} 家` : '无结果')
+        ? `实时 ${liveCount} 家`
+        : staticCount ? `静态包 ${staticCount} 块` : '查询未完成'
       return {
         card: 'generic',
         title: `酒店:${r.destination ?? ''} ${tag}`,
@@ -1859,8 +1866,9 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
       'Search on the USER\'S OWN browser session (Ctrip kind="flight"(default)/"hotel"; 12306 kind="train" — public query face, no login needed). '
       + 'Consent gate: the FIRST call in a session asks the user via the runtime approval card; once granted it holds for the session, a refusal revokes it for the session (no repeat prompting). '
       + 'Transport: Stai Travel Bridge browser extension (one-time install) — the agent side never talks to Chrome debugging, ZERO system dialogs; read-only by construction (the extension never issues requests; it only passively forwards the site\'s own search responses; agent NEVER touches credentials/captcha; on captcha it stops and returns challenged). '
-      + 'kind="flight": from/to 中文城市名 + date YYYY-MM-DD — sniffs the site search API for structured options. Evidence [会话:ctrip-flight@ts]. '
-      + 'kind="hotel": to=目的地中文, cityId? = the numeric city= in a hotels.ctrip.com list URL (web-search it when the destination is outside the built-in city table), checkIn?/checkOut? (YYYY-MM-DD), adults?; hotel prices are the user\'s real logged-in prices. Evidence [会话:ctrip-hotel@ts]. '
+      + 'kind="flight": from/to city or airport names (Chinese/English) + date YYYY-MM-DD; unknown names resolve from supplier metadata, ambiguous names require confirmation; optional fromCityCode/toCityCode are explicit Ctrip three-letter codes — sniffs the site search API for structured options. '
+      + 'ui?="bridge" (default; the user\'s own logged-in session, real member prices) | "gui" (gotry opens its OWN isolated anonymous Chrome window and drives the Ctrip PC search form — roundtrip via backDate? and ANY city by construction: the site\'s own autocomplete resolves cities; anonymous public prices, NOT logged-in prices; verdicts carry anonymous=true; result-binding iteration tracked in #661). Evidence [会话:ctrip-flight@ts] / [会话:ctrip-flight-gui@ts]. '
+      + 'kind="hotel": to=destination name, country? for same-name disambiguation; cityId? = explicit numeric city= from a Ctrip hotel list URL; otherwise resolves from the hotel destination service, checkIn?/checkOut? (YYYY-MM-DD), adults?; hotel prices are the user\'s real logged-in prices. Evidence [会话:ctrip-hotel@ts]. '
       + 'kind="dida": Dida supplier-portal realtime hotel rates on the employee\'s own logged-in session (hotel-be portal integration line) — no from/to needed; the portal find page\'s own requests are sniffed passively. Rates carry ratePlanId/referenceNo for the server-side booking chain. Evidence [会话:dida-portal@ts]. '
       + 'kind="train": from/to/date(YYYY-MM-DD) + fromStationTelecode?/toStationTelecode? (three-letter codes in the kyfw query URL, for cities outside the built-in table) — 12306 left-ticket query (public face): train codes, times, durations, seat availability; the list API carries NO prices (prices live on the 12306 page). Evidence [会话:train-12306@ts]. '
       + 'verdict needs-login = call gotry_session_login (opens the Ctrip login entry in the user\'s own foreground tab — no terminal, no credentials through GoTry); '
@@ -1873,21 +1881,26 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
     // execute 内归一后走原条件闸,结构化报错不崩。flyai 因 kind required 仍在宿主权即拒。
     parameters: {
       kind: { type: 'string', enum: ['flight', 'hotel', 'train', 'dida'], description: '默认 flight 机票;hotel 携程酒店(用户登录态真实价);train 12306 余票(公开面);dida 供应商门户实时价(员工登录态)' },
-      from: { type: 'string', description: '出发城市中文(词表内),如 上海——kind=flight|train 必填' },
+      from: { type: 'string', description: '出发城市名（机票支持中英文及机场名，自动解析），如 上海——kind=flight|train 必填' },
       to: { type: 'string', description: '到达城市中文——kind=flight|train 必填;kind=hotel 时为目的地(必填)' },
       date: { type: 'string', description: '出发日期 YYYY-MM-DD——kind=flight|train 必填,须为今天或未来' },
-      cityId: { type: 'integer', description: '携程酒店 city= 数字,仅 kind=hotel;目的地码表外时 web 搜 hotels.ctrip.com list URL 取 city=' },
+      fromCityCode: { type: 'string', description: '显式携程出发城市／机场三字码，仅 kind=flight；同名城市确认后使用' },
+      toCityCode: { type: 'string', description: '显式携程到达城市／机场三字码，仅 kind=flight；同名城市确认后使用' },
+      cityId: { type: 'integer', description: '显式携程酒店 city= 数字，仅 kind=hotel；未提供时自动解析酒店目的地，不能使用机票城市码' },
+      country: { type: 'string', description: '目的地国家中英文，仅 kind=hotel；用于同名城市消歧，例如 阿联酋' },
       checkIn: { type: 'string', description: '入住日 YYYY-MM-DD,仅 kind=hotel 可选' },
       checkOut: { type: 'string', description: '退房日 YYYY-MM-DD,仅 kind=hotel 可选' },
       adults: { type: 'integer', description: '成人数,仅 kind=hotel 可选' },
       fromStationTelecode: { type: 'string', description: '出发站三位电报码,仅 kind=train;城市码表外时填(kyfw 查询页 URL 里)' },
       toStationTelecode: { type: 'string', description: '到达站三位电报码,仅 kind=train,同上' },
+      backDate: { type: 'string', description: '回程日期 YYYY-MM-DD,仅 kind=flight;存在即往返检索——须 ui=gui(GUI 车道站点表单原生往返;bridge 车道不知往返 URL 形状,不猜)' },
+      ui: { type: 'string', enum: ['bridge', 'gui'], description: 'kind=flight|hotel:bridge(默认,用户登录态被动嗅探)|gui(gotry 隔离匿名窗口驱动 PC 表单——flight 往返/任意城市原生+低价日历;hotel 任意目的地原生(cityId 码表不在主链路);匿名公开价)' },
     },
     output: { schema: { type: 'json' }, render: (_a, v) => [{ type: 'text', text: String((v as { summary?: string }).summary ?? JSON.stringify(v).slice(0, 600)) }] },
     async execute(args, _exec) {
       const selectedKind = resolveSessionSearchKind(args)
       if (!selectedKind.ok) return { ok: false, summary: selectedKind.reason } as const
-      const q = { ...unwrapQuery<{ kind?: string; from?: string; to?: string; date?: string; cityId?: number | string; checkIn?: string; checkOut?: string; adults?: number; fromStationTelecode?: string; toStationTelecode?: string }>(args), kind: selectedKind.kind }
+      const q = { ...unwrapQuery<{ kind?: string; from?: string; to?: string; date?: string; fromCityCode?: string; toCityCode?: string; cityId?: number | string; country?: string; checkIn?: string; checkOut?: string; adults?: number; fromStationTelecode?: string; toStationTelecode?: string; backDate?: string; ui?: string }>(args), kind: selectedKind.kind }
       const runSessionEffect = seams.effect ?? interpretEffect
       // ---- Dida 供应商门户(2026-09-09 实装;hotel-be portal integration 迁移线)----
       if (q.kind === 'dida') {
@@ -1955,16 +1968,16 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
       }
       if (q.kind === 'hotel') {
         if (!q.to) {
-          return { ok: false, summary: 'kind=hotel 需要 to(目的地中文;城市码表外带 cityId=携程酒店 list 页 URL 里的 city= 数字)' } as const
+          return { ok: false, summary: 'kind=hotel 需要 to（目的地名称）；自动解析城市，同名城市可带 country 或确认后的 cityId' } as const
         }
         const itp = await runSessionEffect({
-          effect: 'SESSION_HOTEL_SEARCH',
+          effect: q.ui === 'gui' ? 'SESSION_HOTEL_GUI_SEARCH' : 'SESSION_HOTEL_SEARCH',
           params: {
-            to: q.to, cityId: q.cityId, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults,
+            to: q.to, country: q.country, cityId: q.cityId, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults,
             auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
           },
         })
-        if (!itp.result) return declinedObservation('SESSION_HOTEL_SEARCH', itp.trace)
+        if (!itp.result) return declinedObservation(q.ui === 'gui' ? 'SESSION_HOTEL_GUI_SEARCH' : 'SESSION_HOTEL_SEARCH', itp.trace)
         const r = itp.result
         await noteChannel('session:ctrip-hotel', r.verdict)
         // D-26(issue #118):exact-date 会话酒店 hit/miss 落账(摸底无档期不落;cooldown 是节律闸非结论,不落)
@@ -1986,14 +1999,19 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
         })) as Record<string, never>
       }
       if (!q.from || !q.to || !q.date) {
-        return { ok: false, summary: '需要 from/to(中文城市名,词表内)与 date(YYYY-MM-DD);酒店/火车检索分别用 kind=hotel / kind=train' } as const
+        return { ok: false, summary: '需要 from/to（城市或机场名）与 date（YYYY-MM-DD）;酒店/火车检索分别用 kind=hotel / kind=train' } as const
       }
       // 效应解译层(ADR-18):SESSION 通道策略=永不重试/不熔断,节律闸在渠道内;
       // 解译器只做分发与证据拼装,verdict 语义(risk 型 needs-login/challenged)原样透传
+      // GUI 车道(2026-10-14):ui=gui → gotry 隔离匿名窗口驱动 PC 表单(往返 backDate/任意城市原生)。
+      if (q.ui !== undefined && q.ui !== 'bridge' && q.ui !== 'gui') {
+        return { ok: false, summary: 'kind=flight 的 ui 只接受 bridge(默认,登录态被动嗅探)|gui(隔离匿名窗口驱动表单)' } as const
+      }
       const itp = await runSessionEffect({
-        effect: 'SESSION_FLIGHT_SEARCH',
+        effect: q.ui === 'gui' ? 'SESSION_FLIGHT_GUI_SEARCH' : 'SESSION_FLIGHT_SEARCH',
         params: {
-          from: q.from, to: q.to, date: q.date,
+          from: q.from, to: q.to, date: q.date, fromCityCode: q.fromCityCode, toCityCode: q.toCityCode,
+          ...(q.backDate ? { backDate: q.backDate } : {}),
           // ADR-15 收尾:ReadGuard 审计在生产工具路径同样落盘(此前仅测试传隔离 stateRoot 才有 JSONL)
           auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
         },
@@ -2005,8 +2023,12 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
       const avMapS = await loadAirlineAirportMap()
       await appendFacts(config.stateRoot ?? '.', factsFromSession({ origin: q.from, destination: q.to, date: q.date }, r, new Date().toISOString(), avMapS?.city_alias))
       const top = (r.options ?? []).slice(0, 8).map(o => `${o.flightNo} ${o.airline} ${o.depDateTime.slice(11, 16)}→${o.arrDateTime.slice(11, 16)} ¥${o.price}`)
+      const lane = q.ui === 'gui' ? `GUI 车道(携程,匿名公开价${q.backDate ? ',往返' : ''})` : '会话检索(携程,用户本人登录态)'
+      const cal = (r.calendar ?? []).slice(0, 14).map(d => `${d.date} ${d.price !== undefined ? `¥${d.price}` : (d.priceRaw ?? '?')}`)
+      const calBlock = cal.length > 0 ? `\n低价日历(匿名公开价,该航线哪些日期有票):\n${cal.join(' | ')}` : ''
+      const urlBlock = q.ui === 'gui' && r.listUrl ? `\nlistUrl(站点真实形状,#663 URL 教师):${r.listUrl.slice(0, 160)}` : ''
       const summary = r.verdict === 'hit'
-        ? `${q.from}→${q.to} ${q.date} 会话检索(携程,用户本人登录态)前 ${top.length} 条:\n${top.join('\n')}\n${r.evidence}`
+        ? `${q.from}→${q.to} ${q.date} ${lane}${(r.options ?? []).length > 0 ? ` 行情前 ${top.length} 条:\n${top.join('\n')}` : ''}${calBlock}${urlBlock}\n${r.evidence}`
         : `会话检索未取回(${r.verdict}):${r.error ?? ''} ${r.evidence}`
       return JSON.parse(JSON.stringify({
         ...r, summary,