@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/scripts/gotry-web-api-tests.js

@@ -29,11 +29,16 @@ else process.stdout.write(JSON.stringify({data:{itemList:[]}}));
     });
     const status = () => handlers.flyai(new Request('http://localhost/api/gotry/flyai')).then((r) => r.json());
     assert.deepEqual(await status(), { ok: true, configured: false, verified: false, writable: true, source: 'none', endpoint: 'https://flyai.open.fliggy.com/mcp', endpointDebug: false });
+    mkdirSync(join(home, '.gotry'), { mode: 0o755 });
+    chmodSync(join(home, '.gotry'), 0o755);
+    writeFileSync(join(home, '.gotry', 'doctor-report.md'), 'existing report');
     let response = await handlers.flyai(request('save', 'sk-good-candidate-1234'));
     assert.equal(response.status, 200);
     let body = await response.json();
     assert.equal(body.ok, true);
     assert.equal(body.verified, true);
+    assert.equal(statSync(join(home, '.gotry')).mode & 0o777, 0o700);
+    assert.equal(readFileSync(join(home, '.gotry', 'doctor-report.md'), 'utf8'), 'existing report');
     assert.equal(body.source, 'config');
     assert.ok(!JSON.stringify(body).includes('sk-good-candidate'));
     const config = join(home, '.flyai/config.json'), receipt = join(home, '.gotry/flyai-verification.json');

package/dist/scripts/gotry-web-client-tests.js

@@ -6,7 +6,8 @@ import vm from 'node:vm';
 const registrations = [], slots = [], tabs = [];
 const source = readFileSync(join(import.meta.dirname, '../../client/client.js'), 'utf8');
 vm.runInNewContext(source, { window: { __ModuleLoader__: { load: (r) => registrations.push(r) } }, console, fetch, AbortController });
-const react = { createElement: (type, props, ...children) => ({ type, props, children }) };
+const react = { createElement: (type, props, ...children) => ({ type, props, children }),
+    useState: (value) => [value, () => { }], useRef: (value) => ({ current: value }), useEffect: () => { } };
 const primitives = { SettingsForm: () => { }, SettingsSecretField: () => { }, Button: () => { }, Input: () => { }, Tag: () => { }, FileTypeIcon: () => { } };
 const plugin = registrations[0].factory((name) => name === 'react' ? react : primitives);
 const context = {
@@ -19,6 +20,24 @@ const context = {
 };
 plugin.apply(context);
 assert.ok(slots.some(s => s.definition.name === 'plugins.item' && s.definition.id === 'gotry'), 'Plugins must contain a directly visible GoTry configuration entry');
+const settings = slots.find(s => s.definition.name === 'plugins.item' && s.definition.id === 'gotry');
+const nodes = [];
+function visit(node) {
+    if (!node || typeof node !== 'object')
+        return;
+    nodes.push(node);
+    if (typeof node.type === 'function')
+        visit(node.type(node.props));
+    for (const child of node.children ?? [])
+        visit(child);
+}
+visit(settings.component({ t: (key) => key }));
+assert.ok(nodes.some(n => n.props?.['data-gotry-flyai-settings'] === ''), 'existing FlyAI configuration remains available');
+assert.ok(nodes.some(n => n.props?.['data-gotry-hbcli-settings'] === ''), 'HotelByte configuration must be visible in the same page');
+for (const id of ['gotry-flyai-key', 'gotry-hbcli-key', 'gotry-hbcli-secret']) {
+    assert.ok(nodes.some(n => n.type === primitives.SettingsSecretField && n.props?.id === id && n.props?.text === ''), `${id} must use an empty confidential field`);
+}
+assert.ok(nodes.some(n => n.type === 'a' && n.props?.href === 'https://hotelbyte.com/zh/guides/sandbox-verification'));
 assert.ok(tabs.some(t => t.kind === 'gotry-artifacts' && t.guide?.length), 'right Sidebar must contain an always discoverable GoTry artifacts page');
 assert.ok(slots.some(s => s.definition.name === 'sidebar.right.pane.tab' && s.definition.key === '@danceiny/gotry:artifacts'));
 const pkg = JSON.parse(readFileSync(join(import.meta.dirname, '../../package.json'), 'utf8'));

package/dist/scripts/gui-flight-live.js

@@ -0,0 +1,27 @@
+/**
+ * GUI 车道 live 验证入口(GOTRY_GUI_LIVE=1 显式 opt-in;默认 SKIP 不开窗口——
+ * 与 session-tests 的 GOTRY_SESSION_LIVE 测试纪律同构)。
+ * 匿名只读:gotry 自己的隔离 Chrome 窗口驱动携程 PC 表单,不登录、不下单。
+ */
+import { sessionFlightGuiSearch } from '../capabilities/session-search.js';
+const roll = new Date(Date.now() + 30 * 24 * 3600 * 1000);
+const dep = `${roll.getFullYear()}-${String(roll.getMonth() + 1).padStart(2, '0')}-${String(roll.getDate()).padStart(2, '0')}`;
+const rollBack = new Date(Date.now() + 34 * 24 * 3600 * 1000);
+const back = `${rollBack.getFullYear()}-${String(rollBack.getMonth() + 1).padStart(2, '0')}-${String(rollBack.getDate()).padStart(2, '0')}`;
+if (process.env.GOTRY_GUI_LIVE !== '1') {
+    console.log('SKIP - GOTRY_GUI_LIVE!=1(GUI 车道 live 验证未开;离线契约见 session-tests §L)');
+    process.exit(0);
+}
+console.log(`live #1 单程 上海→丽江 ${dep}`);
+const r1 = await sessionFlightGuiSearch({ from: '上海', to: '丽江', date: dep, timeoutMs: 120_000 });
+console.log(JSON.stringify({ ok: r1.ok, verdict: r1.verdict, options: r1.options?.length, calendar: r1.calendar?.length, calendarHead: r1.calendar?.slice(0, 5), listUrl: r1.listUrl, evidence: r1.evidence, error: r1.error?.slice(0, 900) }, null, 2));
+if (r1.verdict === 'hit')
+    console.log('  首条:', JSON.stringify(r1.options?.[0]));
+if (process.argv[2] === 'oneway')
+    process.exit(0);
+console.log(`live #2 往返 香港→迪拜 ${dep} / ${back}(等 31s 节律)`);
+await new Promise(r => setTimeout(r, 31_000));
+const r2 = await sessionFlightGuiSearch({ from: '香港', to: '迪拜', date: dep, backDate: back, timeoutMs: 120_000 });
+console.log(JSON.stringify({ ok: r2.ok, verdict: r2.verdict, options: r2.options?.length, calendar: r2.calendar?.length, calendarHead: r2.calendar?.slice(0, 5), listUrl: r2.listUrl, evidence: r2.evidence, error: r2.error?.slice(0, 900) }, null, 2));
+if (r2.verdict === 'hit')
+    console.log('  首条:', JSON.stringify(r2.options?.[0]));

package/dist/scripts/hbcli-tests.js

@@ -44,7 +44,7 @@ await writeFile(fallback, JSON.stringify({ meta: 'fake', stays: [{ id: 's1', not
 {
     const { writeFileSync, chmodSync } = await import('node:fs');
     const echoBin = join(tmp, 'hbcli-echo');
-    writeFileSync(echoBin, '#!/bin/sh\necho "ARGS:$@"; echo \'{}\' ');
+    writeFileSync(echoBin, '#!/bin/sh\necho "ARGS:$@"; echo \'{"list":[]}\' ');
     chmodSync(echoBin, 0o755);
     const re = await searchHotels({ destination: '普吉', adults: 2 }, { hbcliBin: echoBin });
     const argLine = JSON.stringify(re);

package/dist/scripts/hbcli-upgrade-tests.js

@@ -0,0 +1,107 @@
+/** hbcli dependency baseline and installer upgrade checks. All homes/binaries are isolated. */
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runDoctorChecks } from '../capabilities/doctor.js';
+const root = mkdtempSync(join(tmpdir(), 'gotry-hbcli-upgrade-test-'));
+const home = join(root, 'home');
+const bin = join(home, '.local/bin/hbcli');
+const credentials = join(home, '.staicli/credentials.json');
+const originalCredentials = '{"openapi:uat":{"appKey":"fixture","appSecret":"fixture"},"portal:prod":{"ticket":"preserve"}}';
+mkdirSync(join(home, '.local/bin'), { recursive: true });
+mkdirSync(join(home, '.staicli'), { recursive: true });
+mkdirSync(join(root, 'empty-path'));
+writeFileSync(credentials, originalCredentials, { mode: 0o600 });
+const writeVersion = (version) => writeFileSync(bin, `#!/bin/sh\ncase "$*" in\n *version*) echo '${version}';;\n *whoami*) echo '{"api_key":{"configured":true}}';;\nesac\n`, { mode: 0o755 });
+const previousPath = process.env.PATH;
+try {
+    process.env.PATH = join(root, 'empty-path');
+    writeVersion('0.0.3');
+    const old = (await runDoctorChecks({ homeDir: home, repoRoot: root, env: {}, extensionPorts: [] })).items.find(i => i.id === 'hbcli');
+    assert.equal(old.status, 'missing', '0.0.3 must be upgraded even when credentials are configured');
+    assert.match(old.detail, /0\.0\.4/);
+    assert.match(old.fix ?? '', /staicli-v0\.0\.4\/install\.sh/);
+    assert.match(old.fix ?? '', /--version 0\.0\.4/);
+    assert.doesNotMatch(old.detail, /会 401/, 'an old dependency version alone does not prove an authentication failure');
+    console.log('1. doctor rejects the old baseline and gives the pinned official upgrade');
+    const { setupHbcli } = await import(new URL('../../bin/gotry-bootstrap.js', import.meta.url).href);
+    let installs = 0;
+    const install = async (command) => {
+        installs++;
+        assert.match(command, /staicli-v0\.0\.4\/install\.sh/);
+        assert.match(command, /--version 0\.0\.4/);
+        writeVersion('0.0.4');
+        return { ok: true };
+    };
+    assert.equal((await setupHbcli({ homeDir: home, attemptInstall: install })).ok, true);
+    assert.equal(installs, 1, 'old binary must enter the installer instead of returning an upgrade hint');
+    assert.equal(readFileSync(credentials, 'utf8'), originalCredentials, 'upgrading does not rewrite credentials');
+    const current = (await runDoctorChecks({ homeDir: home, repoRoot: root, env: {}, extensionPorts: [] })).items.find(i => i.id === 'hbcli');
+    assert.equal(current.status, 'ok');
+    console.log('2. old binary upgrades and is rechecked; existing credentials are preserved');
+    assert.equal((await setupHbcli({ homeDir: home, attemptInstall: install })).ok, true);
+    writeVersion('0.0.5');
+    assert.equal((await setupHbcli({ homeDir: home, attemptInstall: install })).ok, true);
+    assert.equal(installs, 1, 'current and newer versions must not be reinstalled or downgraded');
+    console.log('3. current/newer binaries remain installed without downgrade');
+    writeVersion('0.0.3');
+    await setupHbcli({ homeDir: home, checkOnly: true, attemptInstall: install });
+    assert.equal(installs, 1, 'check-only cannot run an installer');
+    assert.equal((await setupHbcli({ homeDir: home, attemptInstall: async () => ({ ok: false, error: 'fixture failure' }) })).ok, false);
+    assert.equal(readFileSync(credentials, 'utf8'), originalCredentials);
+    console.log('4. check-only and failed installation preserve the existing configuration');
+    assert.equal((await setupHbcli({ homeDir: home, attemptInstall: async () => ({ ok: true }) })).ok, false, 'installer exit success without the required binary is not a successful upgrade');
+    rmSync(bin);
+    assert.equal((await setupHbcli({ homeDir: home, attemptInstall: install })).ok, true, 'missing binary uses the same pinned installer');
+    assert.equal(installs, 2);
+    console.log('5. post-install version is required; missing binary uses the same installer');
+    const shadowBin = join(root, 'empty-path/hbcli');
+    writeFileSync(shadowBin, '#!/bin/sh\necho 0.0.3\n', { mode: 0o755 });
+    const shadowed = await setupHbcli({ homeDir: home, attemptInstall: async () => ({ ok: true }) });
+    assert.equal(shadowed.ok, false, 'a newer fallback binary cannot hide an older binary selected by PATH');
+    assert.match(shadowed.error ?? '', /PATH/);
+    rmSync(shadowBin);
+    console.log('5b. PATH precedence is rechecked and shadowing is reported');
+    // Optional real release artifact proof: no supplier request and no ambient credentials.
+    const binary = process.env.HBCLI_RELEASE_BINARY;
+    if (binary) {
+        const { spawnSync } = await import('node:child_process');
+        const digests = {
+            'darwin-arm64': '0fe14ddeafda8287ac0cd5ab7e1ee88a180c1d46b75c120d2002c7f74f6d5b54',
+            'darwin-x64': '6a389403b170a5c68a6d73ad970bc75dfbd69a533d84d5a9a7ab76b4450a70ba',
+            'linux-arm64': '8fc87bec736d50ab63488c4c8fef62630ec147ac2ea7a05cc6e12e190bf2182c',
+            'linux-x64': '7c3f297e20131bc163a2c0040a8c4e438fc1cbd9179f80f48b81b3a6d4ee0b11',
+        };
+        assert.equal(createHash('sha256').update(readFileSync(binary)).digest('hex'), digests[`${process.platform}-${process.arch}`], 'binary must match the official staicli-v0.0.4 release asset digest');
+        const releaseHome = join(root, 'release-home');
+        mkdirSync(releaseHome);
+        const releaseEnv = { HOME: releaseHome, STAICLI_HOME: join(releaseHome, '.staicli'), PATH: previousPath ?? '' };
+        const run = (args) => {
+            const r = spawnSync(binary, args, { cwd: releaseHome, env: releaseEnv, encoding: 'utf8', timeout: 10_000 });
+            assert.equal(r.error, undefined);
+            assert.equal(r.status, 0, `release CLI command failed: ${args.join(' ')}`);
+            return r.stdout;
+        };
+        assert.equal(run(['--version']).trim(), '0.0.4');
+        const hotelHelp = run(['search', 'hotel-list', '--help']);
+        for (const flag of ['--destination-name', '--check-in', '--check-out', '--room-occupancies', '--page-size'])
+            assert.ok(hotelHelp.includes(flag));
+        for (const command of ['customer-send-code', 'customer-login', 'register'])
+            assert.ok(run(['auth', '--help']).includes(command));
+        run(['--json', '--env', 'uat', 'auth', 'set-credentials', '--app-key', 'fixture', '--app-secret', 'fixture']);
+        const stored = JSON.parse(readFileSync(join(releaseEnv.STAICLI_HOME, 'credentials.json'), 'utf8'));
+        assert.deepEqual(stored['openapi:uat'], { appKey: 'fixture', appSecret: 'fixture' }, 'GUI credential format matches the release CLI');
+        assert.equal(JSON.parse(run(['--json', '--env', 'uat', 'auth', 'whoami'])).api_key.configured, true);
+        assert.ok(!existsSync(join(home, '.staicli/versions')), 'real artifact proof stays in its isolated home');
+        console.log('6. official release digest/version, hotel flags, auth commands and GUI credential format verified offline');
+    }
+    else
+        console.log('6. SKIP real artifact proof: set HBCLI_RELEASE_BINARY to the downloaded official 0.0.4 binary');
+}
+finally {
+    process.env.PATH = previousPath;
+    rmSync(root, { recursive: true, force: true });
+}
+console.log('HBCLI UPGRADE TESTS: OK');

package/dist/scripts/hbcli-web-setup-tests.js

@@ -0,0 +1,114 @@
+/** Native HotelByte configuration: isolated official credential format and a fixture CLI. */
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createGotryWebHandlers } from '../src/gotry-web-api.js';
+const root = mkdtempSync(join(tmpdir(), 'gotry-hbcli-web-'));
+try {
+    const home = join(root, 'home'), cli = join(root, 'hbcli-fixture');
+    mkdirSync(home);
+    writeFileSync(cli, `#!${process.execPath}
+const fs = require('node:fs'), path = require('node:path');
+const credentials = JSON.parse(fs.readFileSync(path.join(process.env.STAICLI_HOME, 'credentials.json')));
+const candidate = credentials['openapi:uat'];
+fs.writeFileSync(process.env.HBCLI_CAPTURE, JSON.stringify({ argv: process.argv.slice(2), root: process.env.STAICLI_HOME }));
+const reply = () => {
+  if (candidate.appKey === 'hbk-invalid') { process.stderr.write(candidate.appSecret); process.stdout.write(JSON.stringify({code:401,msg:candidate.appSecret})); }
+  else if (candidate.appKey === 'hbk-no-suppliers') process.stdout.write(JSON.stringify({code:300010002,msg:'no available suppliers configured'}));
+  else if (candidate.appKey === 'hbk-malformed') process.stdout.write('{}');
+  else process.stdout.write(JSON.stringify({list:[{id:123,name:{zh:'Fixture Hotel'},minPrice:{amount:680,currency:'CNY'}}]}));
+};
+if (candidate.appKey === 'hbk-pending') setTimeout(reply, 800); else reply();
+`, { mode: 0o700 });
+    const env = { PATH: process.env.PATH, HOME: home, GOTRY_HBCLI_BIN: cli, HBCLI_CAPTURE: join(root, 'capture.json') };
+    const handlers = createGotryWebHandlers({ homeDir: home, env, stateRoot: root, workspaceForSession: async () => root });
+    assert.equal(typeof handlers.hbcli, 'function', 'the native configuration page needs an hbcli handler');
+    const request = (action, appKey, signal) => new Request('http://localhost/api/gotry/hbcli/write', {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ action, ...(appKey ? { appKey, appSecret: 'hbs-fixture-secret' } : {}) }), signal,
+    });
+    const status = () => handlers.hbcli(new Request('http://localhost/api/gotry/hbcli')).then(r => r.json());
+    assert.equal((await status()).configured, false);
+    assert.equal(existsSync(env.HBCLI_CAPTURE), false, 'status must not invoke the CLI or contact a supplier');
+    const dir = join(home, '.staicli'), file = join(dir, 'credentials.json');
+    mkdirSync(dir, { mode: 0o755 });
+    writeFileSync(file, JSON.stringify({ 'portal:uat': { ticket: 'preserve-other-mode' }, 'openapi:prod': { appKey: 'preserve-prod' } }), { mode: 0o600 });
+    let response = await handlers.hbcli(request('save', 'hbk-valid'));
+    assert.equal(response.status, 200);
+    let body = await response.json();
+    assert.equal(body.configured, true);
+    assert.equal(body.verified, true);
+    assert.equal(body.verdict, 'hit');
+    assert.doesNotMatch(JSON.stringify(body), /hbk-valid|hbs-fixture-secret|preserve-other-mode/);
+    const saved = JSON.parse(readFileSync(file, 'utf8'));
+    assert.deepEqual(saved['openapi:uat'], { appKey: 'hbk-valid', appSecret: 'hbs-fixture-secret' });
+    assert.equal(saved['portal:uat'].ticket, 'preserve-other-mode');
+    assert.equal(saved['openapi:prod'].appKey, 'preserve-prod');
+    assert.equal(statSync(dir).mode & 0o777, 0o700);
+    assert.equal(statSync(file).mode & 0o777, 0o600);
+    const capture = JSON.parse(readFileSync(env.HBCLI_CAPTURE, 'utf8'));
+    assert.notEqual(capture.root, dir, 'verification must use a temporary credential root');
+    assert.ok(capture.argv.includes('hotel-list'));
+    assert.doesNotMatch(JSON.stringify(capture.argv), /hbk-valid|hbs-fixture-secret/, 'secrets must never be passed in argv');
+    const previous = readFileSync(file, 'utf8');
+    for (const key of ['hbk-invalid', 'hbk-malformed']) {
+        response = await handlers.hbcli(request('save', key));
+        assert.equal(response.status, 422);
+        assert.doesNotMatch(await response.text(), /hbs-fixture-secret/);
+        assert.equal(readFileSync(file, 'utf8'), previous);
+    }
+    const lockedEnv = { ...env, HOTELBYTE_TOKEN: 'fixture-launch-token' };
+    const locked = createGotryWebHandlers({ homeDir: home, env: lockedEnv, stateRoot: root, workspaceForSession: async () => root });
+    assert.equal((await (await locked.hbcli(new Request('http://localhost/api/gotry/hbcli'))).json()).writable, false);
+    assert.equal((await locked.hbcli(request('save', 'hbk-valid'))).status, 409);
+    assert.equal(readFileSync(file, 'utf8'), previous);
+    const cancelled = new AbortController();
+    const pending = handlers.hbcli(request('save', 'hbk-pending', cancelled.signal));
+    setTimeout(() => cancelled.abort(), 100);
+    assert.equal((await pending).status, 422);
+    assert.equal(readFileSync(file, 'utf8'), previous);
+    const concurrent = handlers.hbcli(request('save', 'hbk-pending'));
+    setTimeout(() => writeFileSync(file, previous + '\n'), 150);
+    assert.equal((await concurrent).status, 409);
+    writeFileSync(file, previous);
+    const receiptDir = join(home, '.gotry'), receiptBackup = readFileSync(join(receiptDir, 'hbcli-verification.json'), 'utf8');
+    rmSync(receiptDir, { recursive: true });
+    writeFileSync(receiptDir, 'receipt storage unavailable');
+    assert.equal((await handlers.hbcli(request('save', 'hbk-other-valid'))).status, 409);
+    assert.equal(readFileSync(file, 'utf8'), previous, 'failed receipt storage must restore the previous credential data');
+    rmSync(receiptDir);
+    mkdirSync(receiptDir, { mode: 0o700 });
+    writeFileSync(join(receiptDir, 'hbcli-verification.json'), receiptBackup, { mode: 0o600 });
+    response = await handlers.hbcli(request('save', 'hbk-no-suppliers'));
+    body = await response.json();
+    assert.equal(response.status, 200);
+    assert.equal(body.configured, true);
+    assert.equal(body.verified, false, 'no suppliers is not a successful inventory query');
+    assert.equal(body.verdict, 'no-suppliers');
+    assert.equal((await status()).verdict, 'no-suppliers');
+    assert.equal((await handlers.hbcli(request('clear'))).status, 200);
+    assert.equal((await status()).configured, false);
+    const cleared = JSON.parse(readFileSync(file, 'utf8'));
+    assert.equal(cleared['openapi:uat'], undefined);
+    assert.equal(cleared['portal:uat'].ticket, 'preserve-other-mode');
+    assert.equal(cleared['openapi:prod'].appKey, 'preserve-prod');
+    writeFileSync(file, '{broken configuration');
+    assert.equal((await handlers.hbcli(request('save', 'hbk-valid'))).status, 409);
+    assert.equal(readFileSync(file, 'utf8'), '{broken configuration');
+    rmSync(dir, { recursive: true });
+    const outside = join(root, 'outside');
+    mkdirSync(outside);
+    symlinkSync(outside, dir, 'dir');
+    assert.equal((await handlers.hbcli(request('save', 'hbk-valid'))).status, 409);
+    assert.equal(existsSync(join(outside, 'credentials.json')), false);
+    rmSync(dir);
+    response = await handlers.hbcli(new Request('http://localhost/api/gotry/hbcli/write', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ action: 'save', appKey: 'x'.repeat(9000), appSecret: 'fixture' }),
+    }));
+    assert.equal(response.status, 413);
+    console.log('hbcli native Web setup: isolated verification, confidential responses, supplier status, cancellation, conflict, preservation, clear and file guards PASS');
+}
+finally {
+    rmSync(root, { recursive: true, force: true });
+}

package/dist/scripts/hotel-date-gate-tests.js

@@ -30,7 +30,7 @@ function installRecordingFixture(tmp, name) {
     const logPath = join(tmp, `${name}.argv.log`);
     const fixturePath = join(tmp, name);
     writeFileSync(logPath, `${NO_SPAWN_SENTINEL}\n`);
-    writeFileSync(fixturePath, `#!/bin/sh\necho "$@" > '${logPath}'\necho '{}'\nexit 0\n`);
+    writeFileSync(fixturePath, `#!/bin/sh\necho "$@" > '${logPath}'\necho '{"list":[]}'\nexit 0\n`);
     chmodSync(fixturePath, 0o755);
     return { path: fixturePath, logPath };
 }

package/dist/scripts/hotel-result-tests.js

@@ -0,0 +1,169 @@
+/** Hotel retrieval must distinguish supplier/transport failures from an observed empty list.
+ * Isolated state and fixture CLIs only; no user profile, provider, or browser is accessed.
+ */
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { apply } from '../src/index.js';
+import { __resetEffectBreakersForTest, makeProductionInterpreter } from '../capabilities/effect.js';
+import { callHbcliJson, searchHotels } from '../capabilities/hbcli.js';
+import { sessionHotelSearch, __resetRateLimiterForTest } from '../capabilities/session-search.js';
+import { buildHotelEntryUrl } from '../capabilities/session/adapters/ctrip-hotel.js';
+import { __setSessionBridgeForTest, createSessionBridge, EXTENSION_ORIGIN } from '../capabilities/session/extension-bridge.js';
+const root = mkdtempSync(join(tmpdir(), 'gotry-hotel-result-'));
+let failed = 0;
+let passed = 0;
+async function check(label, fn) {
+    try {
+        await fn();
+        passed++;
+        console.log(`ok - ${label}`);
+    }
+    catch (e) {
+        failed++;
+        console.error(`FAIL - ${label}: ${e.message}`);
+    }
+}
+function fixture(name, text) {
+    const path = join(root, name);
+    writeFileSync(path, `#!${process.execPath}\nprocess.stdout.write(${JSON.stringify(text)});\n`, { mode: 0o700 });
+    return path;
+}
+const query = { destination: '长春', checkIn: '2026-12-05', checkOut: '2026-12-08', adults: 2 };
+const unavailable = fixture('no-suppliers', '{"code":300010002,"msg":"no available suppliers configured, please contact API seller manager"}');
+try {
+    await check('Harbin hotel entry preserves the exact dates and occupancy', async () => {
+        const r = buildHotelEntryUrl({ to: '哈尔滨', checkIn: '2026-12-09', checkOut: '2026-12-11', adults: 2 });
+        assert.equal(r.ok, true);
+        assert.equal(r.url, 'https://hotels.ctrip.com/hotels/list?city=5&checkin=2026-12-09&checkout=2026-12-11&adult=2');
+    });
+    for (const claimed of [false, true]) {
+        await check(`login precheck timeout identifies ${claimed ? 'claimed' : 'queued'} phase`, async () => {
+            const created = await createSessionBridge({ ports: [0] });
+            assert.equal(created.ok, true);
+            if (!created.ok)
+                return;
+            const bridge = created.bridge;
+            try {
+                await fetch(`http://127.0.0.1:${bridge.port}/health`, { headers: { origin: EXTENSION_ORIGIN } });
+                const pending = bridge.submit({ kind: 'cookie-names', site: 'ctrip-hotel' }, { timeoutMs: 100, extensionWaitMs: 1000 });
+                if (claimed) {
+                    const poll = await fetch(`http://127.0.0.1:${bridge.port}/jobs`, {
+                        method: 'POST', headers: { origin: EXTENSION_ORIGIN, 'content-type': 'application/json' },
+                        body: JSON.stringify({ capabilities: ['ctrip-hotel'] }),
+                    });
+                    assert.equal((await poll.json()).job.kind, 'cookie-names');
+                }
+                const result = await pending;
+                assert.equal(result.ok, false);
+                const failure = result;
+                assert.equal(failure.stage, claimed ? 'claimed' : 'queued');
+                assert.equal(failure.jobKind, 'cookie-names');
+                assert.match(failure.summary, /登录态检查/);
+                assert.doesNotMatch(failure.summary, /标签页无嗅探/);
+            }
+            finally {
+                await bridge.close();
+            }
+        });
+    }
+    await check('failed FlyAI flights cannot open the hotel circuit', async () => {
+        let hotelCalls = 0;
+        const interpret = makeProductionInterpreter({ breakers: new Map(), handlers: {
+                FLYAI_SEARCH: async (params) => {
+                    const kind = params.kind;
+                    if (kind === 'hotel') {
+                        hotelCalls++;
+                        return { ok: true, via: 'flyai', verdict: 'hit', hotels: [{ name: 'Fixture Hotel', price: 680 }] };
+                    }
+                    return { ok: false, via: 'flyai-error', verdict: 'error', retryable: false, upstreamHealth: 'unhealthy' };
+                },
+            } });
+        for (let i = 0; i < 3; i++)
+            await interpret({ effect: 'FLYAI_SEARCH', params: { kind: 'flight' } });
+        const blockedFlight = await interpret({ effect: 'FLYAI_SEARCH', params: { kind: 'flight' } });
+        assert.equal(blockedFlight.trace.declined, 'circuit-open');
+        const hotel = await interpret({ effect: 'FLYAI_SEARCH', params: { kind: 'hotel', destName: '长春', checkInDate: query.checkIn, checkOutDate: query.checkOut } });
+        assert.equal(hotel.trace.declined, undefined);
+        assert.equal(hotel.result?.verdict, 'hit');
+        assert.equal(hotelCalls, 1);
+        assert.equal((await interpret({ effect: 'FLYAI_SEARCH', params: { kind: 'flight' } })).trace.declined, 'circuit-open');
+    });
+    await check('exit 0 business error is not a realtime success', async () => {
+        const r = await callHbcliJson(['search', 'hotel-list', '--json'], { hbcliBin: unavailable });
+        assert.equal(r.exitCode, 0);
+        assert.equal(r.via, 'hbcli-error');
+        assert.match(r.error ?? '', /300010002/);
+        assert.match(r.evidence, /@error@/);
+    });
+    await check('supplier configuration error never says realtime zero inventory', async () => {
+        const r = await searchHotels(query, { hbcliBin: unavailable });
+        assert.equal(r.via, 'hbcli-error');
+        assert.match(r.summary, /300010002/);
+        assert.doesNotMatch(r.summary, /实时 0 家/);
+        assert.equal(r.hotels ?? null, null);
+    });
+    for (const [name, body] of [['garbage', 'not JSON'], ['missing-list', '{}'], ['bad-list', '{"list":{}}']]) {
+        await check(`${name} is an invalid observation, not empty inventory`, async () => {
+            const r = await searchHotels(query, { hbcliBin: fixture(name, body) });
+            assert.equal(r.via, 'hbcli-error');
+            assert.doesNotMatch(r.summary, /实时 0 家/);
+        });
+    }
+    await check('a recognized empty list remains a successful zero result', async () => {
+        const r = await searchHotels(query, { hbcliBin: fixture('empty', '{"list":[],"basic":{"sessionId":"fixture-session"}}') });
+        assert.equal(r.via, 'hbcli-realtime');
+        assert.match(r.summary, /实时 0 家/);
+    });
+    await check('registered hotel tool exposes failure and preserves error evidence', async () => {
+        __resetEffectBreakersForTest();
+        const tools = [];
+        const ctx = { tools: { register: (t) => tools.push(t) }, systemPrompt: { variable: () => () => '' }, on: () => () => { } };
+        apply(ctx, { stateRoot: root, timeoutMs: 1000, hbcliBin: unavailable, sessionAccess: 'off', benchmarkEnvironmentConfigPath: '' });
+        const tool = tools.find(t => t.name === 'gotry_hotel_search');
+        const r = await tool.execute(query, {});
+        assert.equal(r.ok, false);
+        assert.equal(r.verdict, 'error');
+        assert.match(r.evidence, /hbcli@error@/);
+        assert.doesNotMatch(r.evidence, /静态包/);
+        assert.doesNotMatch(JSON.stringify(tool.presentResult?.(query, r)), /无结果/);
+    });
+    // Use the actual session collector; replace only its external browser transport.
+    for (const [label, result, verdict] of [
+        ['sniff timeout', { ok: false, timeout: true, title: '酒店列表' }, 'error'],
+        ['invalid JSON', { ok: true, body: 'not JSON', title: '酒店列表' }, 'error'],
+        ['unrecognized JSON', { ok: true, body: '{"message":"upstream failed"}', title: '酒店列表' }, 'error'],
+        ['failed empty envelope', { ok: true, body: '{"code":500,"data":{"hotelList":[]}}', title: '酒店列表' }, 'error'],
+        ['failed Ctrip status', { ok: true, body: '{"ResponseStatus":{"Ack":"Failure"},"data":{"hotelList":[]}}', title: '酒店列表' }, 'error'],
+        ['invalid nonempty list', { ok: true, body: '{"data":{"hotelList":[{"unexpected":true}],"hotelMatchInfos":[]}}', title: '酒店列表' }, 'error'],
+        ['explicit empty list', { ok: true, body: '{"data":{"hotelList":[]}}', title: '酒店列表' }, 'miss'],
+        ['priced hotel', { ok: true, body: '{"data":{"hotelList":[{"hotelId":123,"hotelName":"Fixture Hotel","price":680}]}}', title: '酒店列表' }, 'hit'],
+        ['page challenge', { ok: false, timeout: true, challenge: true, title: '酒店列表' }, 'challenged'],
+    ]) {
+        await check(`Ctrip ${label} is classified without inventing empty inventory`, async () => {
+            __resetRateLimiterForTest();
+            const bridge = {
+                port: 0, extensionConnected: () => true, close: async () => { },
+                submit: async (job) => ({ ok: true, result: job.kind === 'cookie-names' ? { ok: true, names: ['cticket'] } : result }),
+            };
+            __setSessionBridgeForTest(bridge);
+            const r = await sessionHotelSearch({ to: '长春', cityId: 158, checkIn: query.checkIn, checkOut: query.checkOut });
+            assert.equal(r.verdict, verdict);
+            assert.equal(r.ok, verdict === 'hit' || verdict === 'miss');
+            if (verdict === 'error' || verdict === 'challenged')
+                assert.equal(r.hotels, undefined);
+            if (verdict === 'hit')
+                assert.equal(r.hotels?.[0]?.price, 680);
+        });
+    }
+}
+finally {
+    __setSessionBridgeForTest(null);
+    __resetRateLimiterForTest();
+    __resetEffectBreakersForTest();
+    rmSync(root, { recursive: true, force: true });
+}
+console.log(`hotel result tests: ${passed} passed, ${failed} failed`);
+if (failed)
+    process.exitCode = 1;

package/dist/scripts/issue-271-liveness-tests.js

@@ -302,7 +302,7 @@ function writeProductFixture(root, options = { writeTerminalOutput: false, mode:
     mkdirSync(presentDir, { recursive: true });
     writeFileSync(join(presentDir, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-tool-present', main: 'index.js' }));
     writeFileSync(join(presentDir, 'index.js'), 'module.exports = {}\n');
-    for (const file of ['gotry-inner.js', 'gotry-bootstrap.js', 'gotry-flyai-verification.js', 'gotry-extension-status.js', 'gotry-runtime-resolution.js', 'gotry-process-liveness.js']) {
+    for (const file of ['gotry-inner.js', 'gotry-bootstrap.js', 'gotry-hbcli-release.js', 'gotry-flyai-verification.js', 'gotry-extension-status.js', 'gotry-runtime-resolution.js', 'gotry-process-liveness.js']) {
         copyFileSync(join(repoRoot, 'bin', file), join(binDir, file));
     }
     copyFileSync(join(repoRoot, 'ts', 'capabilities', 'incident-log.ts'), join(tsCapabilitiesDir, 'incident-log.ts'));