@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/scripts/extension-tests.js

@@ -699,7 +699,7 @@ async function main() {
             __resetRateLimiterForTest();
             const cookiePoll = claimOnce(lane.port, null);
             await waitForParkedCount(lane.port, 1);
-            const search = sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-12-01', timeoutMs: 3_000 });
+            const search = sessionFlightSearch({ from: '上海', to: '丽江', fromCityCode: 'SHA', toCityCode: 'LJG', date: '2026-12-01', timeoutMs: 3_000 });
             const cookieClaim = await cookiePoll;
             assert.equal(cookieClaim.job?.kind, 'cookie-names');
             // 商店版先候在桥上；它不得接走另一 Origin 已验证登录态后的 search。
@@ -751,7 +751,7 @@ async function main() {
             __resetRateLimiterForTest();
             const cookiePoll = claimOnce(lane.port, null, undefined, ['ctrip-flight'], EXTENSION_ORIGIN, clientA);
             await waitForParkedCount(lane.port, 1);
-            const search = sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-12-01', timeoutMs: 3_000, auditPath: shapeAudit });
+            const search = sessionFlightSearch({ from: '上海', to: '丽江', fromCityCode: 'SHA', toCityCode: 'LJG', date: '2026-12-01', timeoutMs: 3_000, auditPath: shapeAudit });
             const cookieClaim = await cookiePoll;
             assert.equal(cookieClaim.job?.kind, 'cookie-names');
             otherPoll = claimOnce(lane.port, (job) => {
@@ -820,7 +820,7 @@ async function main() {
         })();
         try {
             __resetRateLimiterForTest();
-            const result = await sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-12-01', timeoutMs: 3_000 });
+            const result = await sessionFlightSearch({ from: '上海', to: '丽江', fromCityCode: 'SHA', toCityCode: 'LJG', date: '2026-12-01', timeoutMs: 3_000 });
             assert.equal(result.verdict, 'error');
             assert.equal(result.transportShape, 'sniff_timeout');
             assert.match(result.error ?? '', /嗅探超时|未收到.*回包/);
@@ -859,7 +859,7 @@ async function main() {
             })();
             try {
                 __resetRateLimiterForTest();
-                const result = await sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-12-01', timeoutMs: 3_000 });
+                const result = await sessionFlightSearch({ from: '上海', to: '丽江', fromCityCode: 'SHA', toCityCode: 'LJG', date: '2026-12-01', timeoutMs: 3_000 });
                 assert.equal(result.verdict, 'error');
                 assert.equal(result.transportShape, failedKind === 'search' ? 'search_job_unavailable' : 'precheck_unavailable');
                 assert.doesNotMatch(JSON.stringify(result), /PRIVATE_ROUTE_DATE_COOKIE_VALUE/);
@@ -882,12 +882,18 @@ async function main() {
         const blockers = [];
         try {
             for (const port of [8791, 8792, 8793, 8794, 8795]) {
-                const s = createServer().listen(port, '127.0.0.1');
-                await new Promise((r) => s.once('listening', () => r()));
-                blockers.push({ close: () => new Promise((r) => s.close(() => r())) });
+                const s = createServer();
+                const owned = await new Promise((resolve, reject) => {
+                    s.once('listening', () => resolve(true));
+                    s.once('error', (error) => error.code === 'EADDRINUSE' ? resolve(false) : reject(error));
+                    s.listen(port, '127.0.0.1');
+                });
+                // An active user bridge already occupies this port; never stop it.
+                if (owned)
+                    blockers.push({ close: () => new Promise((r) => s.close(() => r())) });
             }
             await __resetSessionBridgeForTest();
-            const r = await sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-12-01' });
+            const r = await sessionFlightSearch({ from: '上海', to: '丽江', fromCityCode: 'SHA', toCityCode: 'LJG', date: '2026-12-01' });
             assert.equal(r.verdict, 'error', `端口池全占应 error(环境故障),实 ${r.verdict}:${r.error}`);
             assert.ok(r.error?.includes('端口池'), '错误面必须点明端口池环境问题');
             assert.ok(!r.error?.includes('一次性安装'), 'error 路径不应诱导用户去装扩展');

package/dist/scripts/fixtures/tenant-runaway-worker-fixture.mjs

@@ -0,0 +1,73 @@
+// A worker for the managed port's JSON-lines protocol that misbehaves on request (AaaS threat S-17 drill).
+// Every runaway mode bounds itself, so a governor that fails costs a red test and not a dead machine.
+import { spawn } from 'node:child_process'
+import { writeFileSync } from 'node:fs'
+import { createInterface } from 'node:readline'
+
+const MIB = 1024 * 1024
+
+if (process.env.TENANT_FIXTURE_PID_FILE) writeFileSync(process.env.TENANT_FIXTURE_PID_FILE, String(process.pid))
+// TENANT_FIXTURE_NO_LIFECYCLE=1: a worker that never says who it is, so nothing can attach a governor to it.
+if (process.env.TENANT_FIXTURE_NO_LIFECYCLE !== '1') {
+  // TENANT_FIXTURE_LIE_PID=1: it names a process that is not its own, so a sampler that trusts it would watch nothing.
+  const reported = process.env.TENANT_FIXTURE_LIE_PID === '1' ? 2_147_000_000 : process.pid
+  process.stdout.write(`${JSON.stringify({ lifecycle: 'worker_started', workerPid: reported, parentPid: process.ppid })}\n`)
+}
+
+const hold = []
+const input = createInterface({ input: process.stdin, crlfDelay: Infinity })
+
+function reply(value) {
+  process.stdout.write(`${JSON.stringify(value)}\n`)
+}
+
+input.on('line', (line) => {
+  const request = JSON.parse(line)
+  // TENANT_FIXTURE_MODE lets a planner, which sends its own prompt text, drive the same behavior.
+  const mode = process.env.TENANT_FIXTURE_MODE ?? request.prompt
+  if (mode === 'ok') {
+    reply({ id: request.id, ok: true, result: { finalResponse: 'ok', events: [{
+      nodeOptions: process.env.NODE_OPTIONS ?? null,
+      execArgv: process.execArgv,
+      ambient: { LLM_BASE_URL: process.env.LLM_BASE_URL ?? null, LLM_API_KEY: process.env.LLM_API_KEY ?? null, DEEPSEEK_API_KEY: process.env.DEEPSEEK_API_KEY ?? null, DEEPSEEK_BASE_URL: process.env.DEEPSEEK_BASE_URL ?? null },
+    }], notifications: [] } })
+  } else if (mode === 'memory') {
+    // Off-heap memory: the V8 heap cap cannot see a Buffer, so only the process-tree sampler can stop this one.
+    let total = 0
+    const timer = setInterval(() => {
+      hold.push(Buffer.alloc(16 * MIB, 1))
+      total += 16 * MIB
+      if (total >= 1536 * MIB) clearInterval(timer)
+    }, 10)
+  } else if (mode === 'memory-in-child') {
+    // The runaway is a descendant, not the worker: the tree is what is limited.
+    const child = spawn(process.execPath, ['-e', `
+      const hold = []; let total = 0
+      const timer = setInterval(() => { hold.push(Buffer.alloc(${16 * MIB}, 1)); total += ${16 * MIB}; if (total >= ${1536 * MIB}) clearInterval(timer) }, 10)
+    `], { stdio: 'ignore' })
+    reply({ id: request.id, ok: true, result: { finalResponse: 'spawned', events: [{ childPid: child.pid }], notifications: [] } })
+  } else if (mode === 'cpu') {
+    // Blocks this thread's event loop; the check comes from outside. Gives up by itself after 30 s.
+    const end = Date.now() + 30_000
+    while (Date.now() < end) { /* spin */ }
+  } else if (mode === 'heap') {
+    // JS heap growth: the V8 ceiling in NODE_OPTIONS must end this long before the machine notices.
+    const objects = []
+    while (process.memoryUsage().heapUsed < 900 * MIB) objects.push({ filler: 'x'.repeat(1000) })
+    reply({ id: request.id, ok: true, result: { finalResponse: 'heap-not-limited', events: [], notifications: [] } })
+  } else if (mode === 'flood') {
+    // One line that never ends, written as fast as the pipe takes it, up to 256 MiB.
+    const chunk = 'x'.repeat(64 * 1024)
+    let written = 0
+    const write = () => {
+      while (written < 256 * MIB) {
+        written += chunk.length
+        if (!process.stdout.write(chunk)) { process.stdout.once('drain', write); return }
+      }
+    }
+    write()
+  }
+})
+
+process.on('SIGTERM', () => process.exit(143))
+setInterval(() => {}, 1_000)

package/dist/scripts/flight-malformed-tests.js

@@ -90,7 +90,7 @@ async function main() {
         const expectVerdict = async (label, body, title, expected, extra) => {
             __resetRateLimiterForTest();
             testCase = { body, title };
-            const r = await sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-12-01', timeoutMs: 5_000 });
+            const r = await sessionFlightSearch({ from: '上海', to: '丽江', fromCityCode: 'SHA', toCityCode: 'LJG', date: '2026-12-01', timeoutMs: 5_000 });
             await check(label, () => {
                 assert.equal(r.verdict, expected, `verdict 期望 ${expected},实 ${r.verdict} (${r.error ?? ''})`);
                 if (extra)

package/dist/scripts/flyai-setup-tests.js

@@ -39,7 +39,7 @@ chmodSync(fakeVerifier, 0o700);
 // that the npm package exposes for `gotry setup ...` dispatch.
 const packageFixture = join(sandbox, 'package-shaped');
 mkdirSync(join(packageFixture, 'bin'), { recursive: true });
-for (const file of ['gotry-inner.js', 'gotry-bootstrap.js', 'gotry-flyai-verification.js', 'gotry-extension-status.js', 'gotry-process-liveness.js', 'gotry-runtime-resolution.js']) {
+for (const file of ['gotry-inner.js', 'gotry-bootstrap.js', 'gotry-hbcli-release.js', 'gotry-flyai-verification.js', 'gotry-extension-status.js', 'gotry-process-liveness.js', 'gotry-runtime-resolution.js']) {
     copyFileSync(join(repoRoot, 'bin', file), join(packageFixture, 'bin', file));
 }
 writeFileSync(join(packageFixture, 'package.json'), JSON.stringify({ type: 'module', version: 'test' }) + '\n');
@@ -133,7 +133,7 @@ assert.ok(symlinkRun.stdout.includes('配置目录不安全'));
 assert.ok(!existsSync(join(symlinkTarget, 'config.json')), 'symlink target must not receive credentials');
 console.log('1c. symlink .flyai rejected without following target OK');
 // The TypeScript config writer shares the same compatibility rule; the
-// verification receipt writer remains separately strict on ~/.gotry.
+// verification receipts use the same safe directory migration.
 const tsConfigHome = mkdtempSync(join(sandbox, 'ts-config-'));
 writeOfficialFlyaiDir(tsConfigHome, 'device-ts');
 const tsSave = saveFlyaiKey('sk-ts-config-key-1234', { homeDir: tsConfigHome, env: {} });
@@ -203,15 +203,30 @@ assert.notEqual(verifyFail.status, 0);
 assert.deepEqual(readFileSync(configPath(verifyFailHome)), verifyBefore);
 assert.ok(verifyFail.stdout.includes('配置未改动'));
 console.log('4. bad JSON + verifier failure preserve old config bytes/key OK');
+// Existing doctor/runtime state must be secured without losing its contents.
+const legacyHome = mkdtempSync(join(sandbox, 'legacy-receipt-'));
+mkdirSync(join(legacyHome, '.gotry'), { mode: 0o755 });
+chmodSync(join(legacyHome, '.gotry'), 0o755);
+writeFileSync(join(legacyHome, '.gotry', 'doctor-report.md'), 'existing report');
+const legacyRun = runPackageEntry(legacyHome, ['setup', 'flyai', '--stdin'], `${key}\n`);
+assert.equal(legacyRun.status, 0, legacyRun.stdout + legacyRun.stderr);
+assert.equal(mode(join(legacyHome, '.gotry')), 0o700);
+assert.equal(mode(receiptPath(legacyHome)), 0o600);
+assert.equal(readFileSync(join(legacyHome, '.gotry', 'doctor-report.md'), 'utf8'), 'existing report');
+console.log('5a. existing 0755 state directory secured without losing contents OK');
 // 5. receipt write failure is visible and rolls back the newly attempted key.
 const receiptFailHome = mkdtempSync(join(sandbox, 'receipt-fail-'));
 writeConfig(receiptFailHome, { FLYAI_API_KEY: oldKey, keep: 'yes' });
-mkdirSync(join(receiptFailHome, '.gotry'), { mode: 0o755 });
-chmodSync(join(receiptFailHome, '.gotry'), 0o755);
+const receiptTarget = join(receiptFailHome, 'outside-state');
+mkdirSync(receiptTarget, { mode: 0o755 });
+chmodSync(receiptTarget, 0o755);
+symlinkSync(receiptTarget, join(receiptFailHome, '.gotry'), 'dir');
 const receiptFail = run(receiptFailHome, ['setup', 'flyai', '--stdin'], `${key}\n`);
 assert.notEqual(receiptFail.status, 0);
 assert.ok(receiptFail.stdout.includes('验证回执写入失败'));
 assert.equal(JSON.parse(readFileSync(configPath(receiptFailHome), 'utf8')).FLYAI_API_KEY, oldKey);
+assert.equal(mode(receiptTarget), 0o755);
+assert.ok(!existsSync(join(receiptTarget, 'flyai-verification.json')));
 console.log('5. receipt write failure reports non-success and preserves old key OK');
 // The verifier may echo its input credentials. Public diagnostics must not.
 for (const failure of ['leak-403', 'leak-exit']) {