@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/scripts/mutation-check.js

@@ -0,0 +1,153 @@
+/**
+ * Mutation check runner (AaaS A2, docs/rfc/aaas-rfc.md §8.3: "falsification tests that must fail against a
+ * deliberately broken guard").
+ *
+ * A mutation list names a suite and a set of source edits. For each edit the runner clones the source trees into a
+ * scratch directory, breaks exactly one guard there, runs the suite, and requires it to fail. A suite that stays
+ * green under a broken guard proves nothing about that guard, so a surviving mutation fails the run. The list's
+ * unmutated baseline must pass first, otherwise "red" would only mean the harness is broken.
+ *
+ * The working tree is never edited: mutations happen in the clone, so a run can sit beside other work. A mutation file must
+ * name a path inside the clone (no absolute path, no `..`, nothing under node_modules, which is shared with the real tree).
+ *
+ * A mutation is "killed" only when the suite fails for a reason about behaviour. A suite that times out, and an edit that
+ * does not even load (syntax or module errors), prove nothing about the guard, so both fail the run as well.
+ *
+ *   cd ts && npx tsx scripts/mutation-check.ts scripts/tenant-seam-mutations.json [--only <id>] [--keep] [--scratch <dir>]
+ *
+ * List format: { "suite": "scripts/x-tests.ts", "timeoutMs"?: number,
+ *               "mutations": [{ "id", "file" (relative to ts/), "find" (must occur exactly once), "replace", "note"? }] }
+ */
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const TS_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const REPO_ROOT = resolve(TS_ROOT, '..');
+const SKIP = new Set(['node_modules', '.git', 'dsh-runtime', 'gotry-state']);
+function argValue(args, flag) {
+    const at = args.indexOf(flag);
+    return at >= 0 ? args[at + 1] : undefined;
+}
+function cloneTrees(scratch) {
+    const copy = (from, to) => {
+        cpSync(from, to, { recursive: true, filter: (source) => !SKIP.has(basename(source)) });
+    };
+    const tsClone = join(scratch, 'ts');
+    copy(TS_ROOT, tsClone);
+    for (const dir of ['schemas', 'data']) {
+        if (existsSync(join(REPO_ROOT, dir)))
+            copy(join(REPO_ROOT, dir), join(scratch, dir));
+    }
+    // Installed packages are shared, not copied: the suites only read them.
+    symlinkSync(join(TS_ROOT, 'node_modules'), join(tsClone, 'node_modules'));
+    if (existsSync(join(REPO_ROOT, 'node_modules')))
+        symlinkSync(join(REPO_ROOT, 'node_modules'), join(scratch, 'node_modules'));
+    return tsClone;
+}
+/** An edit that does not load says nothing about a guard: `tsx` reports these, not an assertion. */
+const BROKEN_EDIT = /SyntaxError|TransformError|Transform failed|ERR_MODULE_NOT_FOUND|ERR_UNKNOWN_FILE_EXTENSION|Unexpected token/;
+class ListError extends Error {
+}
+/** The file a mutation edits, which must be inside the scratch clone and never in the shared node_modules. */
+function mutationTarget(tsClone, file) {
+    const parts = file.split(/[\\/]/);
+    if (isAbsolute(file) || parts.includes('..') || parts.includes('node_modules'))
+        throw new ListError(`mutation file "${file}" must be a relative path inside ts/ and not under node_modules`);
+    const path = resolve(tsClone, file);
+    if (!path.startsWith(tsClone + sep))
+        throw new ListError(`mutation file "${file}" leaves the clone`);
+    if (!existsSync(path))
+        throw new ListError(`mutation file "${file}" does not exist`);
+    return path;
+}
+function runSuite(tsClone, suite, timeoutMs) {
+    const result = spawnSync(process.execPath, [join(tsClone, 'node_modules', 'tsx', 'dist', 'cli.mjs'), suite], {
+        cwd: tsClone,
+        encoding: 'utf8',
+        timeout: timeoutMs,
+        env: { ...process.env, GOTRY_SESSION_LIVE: '0', GOTRY_HBCLI_LIVE: '0', GOTRY_HOTELBYTE_SKILLS_LIVE: '0' },
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    const timedOut = result.error?.code === 'ETIMEDOUT';
+    return { status: result.status, output: `${result.stdout ?? ''}${result.stderr ?? ''}`, timedOut };
+}
+function lastLines(text, count) {
+    return text.trim().split('\n').slice(-count).join('\n');
+}
+const args = process.argv.slice(2);
+const listPath = args.find((arg) => !arg.startsWith('--') && arg !== argValue(args, '--only') && arg !== argValue(args, '--scratch'));
+if (!listPath) {
+    console.error('usage: mutation-check.ts <mutation-list.json> [--only <id>] [--keep] [--scratch <dir>]');
+    process.exit(2);
+}
+const list = JSON.parse(readFileSync(resolve(TS_ROOT, listPath), 'utf8'));
+const only = argValue(args, '--only');
+const timeoutMs = list.timeoutMs ?? 180_000;
+function run() {
+    const scratch = mkdtempSync(join(argValue(args, '--scratch') ?? tmpdir(), 'gotry-mutation-'));
+    try {
+        const tsClone = cloneTrees(scratch);
+        // Every target is checked before anything runs, so a bad list fails at once and leaves no half-run behind.
+        const targets = list.mutations.map((mutation) => ({ mutation, path: mutationTarget(tsClone, mutation.file) }));
+        const baseline = runSuite(tsClone, list.suite, timeoutMs);
+        if (baseline.status !== 0) {
+            console.error(`baseline FAILED (exit ${baseline.status}${baseline.timedOut ? ', timed out' : ''}) — mutation results would mean nothing\n${lastLines(baseline.output, 20)}`);
+            return 2;
+        }
+        console.log(`baseline ok: ${list.suite}`);
+        let killed = 0;
+        let failed = 0;
+        for (const { mutation, path } of targets) {
+            if (only && mutation.id !== only)
+                continue;
+            const original = readFileSync(path, 'utf8');
+            const occurrences = original.split(mutation.find).length - 1;
+            if (occurrences !== 1)
+                throw new ListError(`${mutation.id}: "find" occurs ${occurrences} times in ${mutation.file} (need exactly 1)`);
+            writeFileSync(path, original.replace(mutation.find, () => mutation.replace));
+            let outcome;
+            try {
+                outcome = runSuite(tsClone, list.suite, timeoutMs);
+            }
+            finally {
+                writeFileSync(path, original);
+            }
+            const label = `${mutation.id} ${mutation.file}${mutation.note ? ` — ${mutation.note}` : ''}`;
+            if (outcome.status === 0) {
+                failed += 1;
+                console.log(`SURVIVED ${label}`);
+            }
+            else if (outcome.timedOut) {
+                failed += 1;
+                console.log(`TIMEOUT  ${label}\n           the suite hung under this edit (${timeoutMs} ms): that is not a kill`);
+            }
+            else if (BROKEN_EDIT.test(outcome.output)) {
+                failed += 1;
+                console.log(`BROKEN   ${label}\n           the edited file does not load: ${(outcome.output.split('\n').find((line) => BROKEN_EDIT.test(line)) ?? '').trim().slice(0, 140)}`);
+            }
+            else {
+                killed += 1;
+                const reason = outcome.output.split('\n').find((line) => /AssertionError|Error:|FAIL|not ok/.test(line)) ?? `exit ${outcome.status}`;
+                console.log(`killed   ${label}\n           ${reason.trim().slice(0, 160)}`);
+            }
+        }
+        console.log(`${killed} killed, ${failed} not killed (survived, hung or did not load)`);
+        return failed === 0 ? 0 : 1;
+    }
+    catch (error) {
+        if (error instanceof ListError) {
+            console.error(error.message);
+            return 2;
+        }
+        throw error;
+    }
+    finally {
+        if (args.includes('--keep'))
+            console.log(`scratch kept: ${scratch}`);
+        else
+            rmSync(scratch, { recursive: true, force: true });
+    }
+}
+process.exit(run());

package/dist/scripts/nightly-evidence.js

@@ -32,6 +32,7 @@ import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { createMockLlm } from '../src/mock-llm.js';
 import { createOpenAICompatLlm } from '../src/dsh-llm.js';
+import { loadPriceTable, priceRunCost } from '../src/llm-price-table.js';
 import { newState, runTurn } from '../src/loop.js';
 import { solveUnified } from '../src/unified.js';
 import { realtimeSolvePort } from '../src/realtime-pricing.js';
@@ -50,9 +51,6 @@ function canonical(value) {
 function sha256Of(value) {
     return createHash('sha256').update(canonical(value)).digest('hex');
 }
-function round6(value) {
-    return Number(value.toFixed(6));
-}
 export function loadPromptSet(path) {
     const raw = JSON.parse(readFileSync(path, 'utf8'));
     if (raw['schema_version'] !== 'gotry_m3_nightly_prompt_set_v1') {
@@ -64,114 +62,9 @@ export function loadPromptSet(path) {
     }
     return { schema_version: 'gotry_m3_nightly_prompt_set_v1', description: raw['description'], turns: turns };
 }
-function assertPriceEntry(label, value) {
-    const entry = typeof value === 'object' && value !== null ? value : null;
-    if (!entry)
-        throw new Error(`${label} must be an object`);
-    for (const field of ['input_cache_miss_usd_per_1m_peak', 'input_cache_hit_usd_per_1m_peak', 'output_usd_per_1m_peak']) {
-        const num = entry[field];
-        if (typeof num !== 'number' || !Number.isFinite(num) || num < 0) {
-            throw new Error(`${label}.${field} must be a non-negative finite number`);
-        }
-    }
-    return value;
-}
-export function loadPriceTable(path) {
-    const raw = JSON.parse(readFileSync(path, 'utf8'));
-    const schemaVersion = raw['schema_version'];
-    if (schemaVersion === 'gotry_llm_price_table_v2') {
-        return loadPriceTableV2(raw);
-    }
-    if (schemaVersion === 'gotry_llm_price_table_v1') {
-        return loadPriceTableV1(raw);
-    }
-    throw new Error(`price table schema_version must be gotry_llm_price_table_v1 or _v2, got: ${String(schemaVersion)}`);
-}
-function loadPriceTableV1(raw) {
-    const aliases = typeof raw['aliases'] === 'object' && raw['aliases'] !== null ? raw['aliases'] : {};
-    for (const [from, to] of Object.entries(aliases)) {
-        if (typeof to !== 'string')
-            throw new Error(`price table alias ${from} must map to a model name`);
-    }
-    const prices = {};
-    for (const [name, entry] of Object.entries(typeof raw['prices'] === 'object' && raw['prices'] !== null ? raw['prices'] : {})) {
-        prices[name] = assertPriceEntry(`price table entry ${name}`, entry);
-    }
-    return { schema_version: 'gotry_llm_price_table_v1', aliases, prices };
-}
-/** v2 reader:providers.<id>.models.<model> 平铺为统一的 aliases/prices 双表,外暴露 API 不变。
- *  lookup 规则:给定 model 名 →
- *    1. 若在 aliases 表中,跳到别名目标(qualified `providerId:model`);
- *    2. 否则直接以 qualified `providerId:model` 在 prices 中查找;
- *    3. 否则尝试裸 `model` 键(单 provider 时透明,如 MiniMax-M3 在 minimax:models 下唯一);
- *    4. 仍找不到 → fail-closed。 */
-function loadPriceTableV2(raw) {
-    const providersObj = typeof raw['providers'] === 'object' && raw['providers'] !== null ? raw['providers'] : null;
-    if (!providersObj)
-        throw new Error('price table v2 requires providers object');
-    const aliases = {};
-    const prices = {};
-    for (const [providerId, rawProvider] of Object.entries(providersObj)) {
-        const provider = assertProviderEntry(`price table provider ${providerId}`, rawProvider);
-        for (const [aliasName, target] of Object.entries(provider.aliases)) {
-            if (typeof target !== 'string')
-                throw new Error(`provider ${providerId} alias ${aliasName} must map to a model name`);
-            if (!provider.models[target]) {
-                throw new Error(`provider ${providerId} alias ${aliasName} -> ${target} has no entry; update data/llm-price-table.json via PR`);
-            }
-            aliases[aliasName] = target;
-        }
-        for (const [modelName, entry] of Object.entries(provider.models)) {
-            const qualified = `${providerId}:${modelName}`;
-            const validated = assertPriceEntry(`price table provider ${providerId} model ${modelName}`, entry);
-            if (prices[qualified])
-                throw new Error(`duplicate price table key ${qualified}`);
-            prices[qualified] = validated;
-            if (prices[modelName])
-                throw new Error(`duplicate price table key ${modelName} (across providers, disambiguate via aliases or qualified lookup)`);
-            prices[modelName] = validated;
-        }
-    }
-    return { schema_version: 'gotry_llm_price_table_v2', aliases, prices };
-}
-function assertProviderEntry(label, value) {
-    const entry = typeof value === 'object' && value !== null ? value : null;
-    if (!entry)
-        throw new Error(`${label} must be an object`);
-    const family = entry['family'];
-    if (typeof family !== 'string' || family.length === 0)
-        throw new Error(`${label}.family must be a non-empty string`);
-    const strategy = entry['price_strategy'];
-    if (strategy !== 'tiered_peak_offpeak' && strategy !== 'flat_no_offpeak') {
-        throw new Error(`${label}.price_strategy must be 'tiered_peak_offpeak' or 'flat_no_offpeak', got: ${String(strategy)}`);
-    }
-    const aliases = typeof entry['aliases'] === 'object' && entry['aliases'] !== null ? entry['aliases'] : {};
-    const models = typeof entry['models'] === 'object' && entry['models'] !== null ? entry['models'] : {};
-    return {
-        family,
-        price_strategy: strategy,
-        api_base: typeof entry['api_base'] === 'string' ? entry['api_base'] : undefined,
-        source_url: typeof entry['source_url'] === 'string' ? entry['source_url'] : undefined,
-        aliases,
-        models,
-    };
-}
-/** 换算单次运行成本(peak 保守上界:全部输入按 cache miss 峰价计,只高不低)。 */
-export function priceRunCost(model, usage, table) {
-    if (usage.responsesMissingUsage > 0) {
-        throw new Error(`usage provider omitted usage on ${usage.responsesMissingUsage} response(s) — cost unprovable, refusing to price (fail-closed)`);
-    }
-    const alias = table.aliases[model];
-    if (alias && !table.prices[alias])
-        throw new Error(`price table alias ${model} -> ${alias} has no entry; update data/llm-price-table.json via PR`);
-    const entry = table.prices[alias ?? model];
-    if (!entry)
-        throw new Error(`price table has no entry for model ${model}; update data/llm-price-table.json via PR (fail-closed, no guessed price)`);
-    const cost = (usage.inputCacheMissTokens * entry.input_cache_miss_usd_per_1m_peak
-        + usage.inputCacheHitTokens * entry.input_cache_hit_usd_per_1m_peak
-        + usage.outputTokens * entry.output_usd_per_1m_peak) / 1_000_000;
-    return round6(cost);
-}
+// The frozen price table (ADR-20) and its pricing function live in src/llm-price-table.ts so the AaaS quota meter prices
+// through the same code; they are re-exported here for the nightly producer and its callers.
+export { loadPriceTable, priceRunCost };
 /** 记录构建(确定性:同内容同 executed_at => 同 run_key)。写入前由消费方 parseNightlyRun 校验。 */
 export function buildNightlyRunRecord(input) {
     const { schema_version, executed_at, real_llm, prompt_set_sha256, output_sha256, cost_usd } = input;

package/dist/scripts/session-tests.js

@@ -20,7 +20,9 @@ import { buildEntryUrl, parseBatchSearch, parseBatchSearchResult } from '../capa
 import { buildHotelEntryUrl, parseCtripHotelList, looksLikeHotelListBody } from '../capabilities/session/adapters/ctrip-hotel.js';
 import { buildTrainEntryUrl, hasRecognizedAvailableSeat, parseLeftTicketQuery, parseLeftTicketQueryResult, resolveTrainQueryTelecodes, STATION_TELECODES, validateTrainQueryResponseUrl } from '../capabilities/session/adapters/rail-12306.js';
 import { buildDidaEntryUrl, parseDidaRates, parseDidaSearchCache, looksLikeDidaRatesBody } from '../capabilities/session/adapters/dida-portal.js';
-import { sessionFlightSearch, sessionHotelSearch, sessionTrainSearch, sessionDidaSearch, trainStationUnresolvedHint, hotelCityUnresolvedHint, didaLoginHint, __resetRateLimiterForTest, __setTrainSessionTransportForTest, classifyTransportFailure } from '../capabilities/session-search.js';
+import { sessionFlightSearch, sessionFlightGuiSearch, sessionHotelSearch, sessionTrainSearch, sessionDidaSearch, trainStationUnresolvedHint, hotelCityUnresolvedHint, flightCityUnresolvedHint, didaLoginHint, __resetRateLimiterForTest, __setTrainSessionTransportForTest, classifyTransportFailure } from '../capabilities/session-search.js';
+import { planFlightGuiActions, assertGuiPlanSafe, runFlightGuiSearch, parseLowestPriceCalendar, __setGuiDriverForTest } from '../capabilities/session/gui-flight.js';
+import { planHotelGuiActions, assertHotelPlanSafe, runHotelGuiSearch, __setHotelDriverForTest } from '../capabilities/session/gui-hotel.js';
 import { flyaiSearch } from '../capabilities/flyai.js';
 import { createConsentGate } from '../capabilities/session-consent.js';
 import { sessionLogin, pollTicketNames, LOGIN_TARGETS } from '../capabilities/session-login.js';
@@ -145,6 +147,16 @@ assert(e1.ok === true && e1.url === 'https://flights.ctrip.com/online/list/onewa
 const e2 = buildEntryUrl('乌兰巴托', '丽江', '2026-10-01');
 assert(e2.ok === false && e2.unresolved?.[0] === '乌兰巴托', '词表外城市 unresolved 逐字保留(不猜)');
 assert(buildEntryUrl('上海', '丽江', '十月一号').ok === false, '非法日期拒绝');
+const internationalEntry = buildEntryUrl('迪拜', '香港', '2026-12-01', { fromCode: 'DXB', toCode: 'HKG' });
+assert(internationalEntry.ok && internationalEntry.url?.includes('oneway-dxb-hkg') === true, '显式供应商城市码不受内置表限制');
+assert(!buildEntryUrl('迪拜', '香港', '2026-12-01', { fromCode: '../dxb', toCode: 'HKG' }).ok, '显式城市码拒绝 URL 注入');
+// 实测校准抽查(2026-10-14 list 页实证:合法组合 200+title 航线名,非法组合 302)
+const e3 = buildEntryUrl('香港', '迪拜', '2026-12-06');
+assert(e3.ok === true && e3.url === 'https://flights.ctrip.com/online/list/oneway-hkg-dxb?depdate=2026-12-06', '香港/迪拜=实测校准入缓存表(hkg/dxb)', e3);
+const e4 = buildEntryUrl('乌兰巴托', '丽江', '2026-10-01', { fromCode: 'ubn' });
+assert(e4.ok === true && e4.url === 'https://flights.ctrip.com/online/list/oneway-ubn-ljg?depdate=2026-10-01', '显式三字码逃生口(形状合格即成行)', e4);
+assert(buildEntryUrl('乌兰巴托', '丽江', '2026-10-01', { fromCode: 'UBN!' }).ok === false, '显式码形状不合格不得进 URL');
+assert(flightCityUnresolvedHint(['乌兰巴托']).includes('fromCityCode'), '机票 unresolved 指引带显式码逃生口');
 // D. DOM 提交件过滤
 console.log('D. isSubmitText(DOM 提交件黑名单)');
 assert(isSubmitText('立即下单') && isSubmitText('去支付') && isSubmitText('提交订单'), '下单/支付/提交 命中');
@@ -153,9 +165,9 @@ assert(!isSubmitText('搜索') && !isSubmitText('筛选'), '搜索/筛选 不误
 console.log('E. 节律闸(≥30s 间隔)');
 __resetRateLimiterForTest();
 const r1 = await sessionFlightSearch({ from: '乌兰巴托', to: '丽江', date: '2026-10-01' });
-const r2 = await sessionFlightSearch({ from: '上海', to: '丽江', date: '2026-10-01' });
+const r2 = await sessionFlightSearch({ from: '另一个未知城市', to: '丽江', date: '2026-10-01' });
 assert(r1.verdict === 'error' && /unresolved/.test(r1.error ?? ''), '首次调用:词表外 → error(unresolved)');
-assert(r2.verdict === 'cooldown', '30s 内二次调用 → cooldown,不发起导航');
+assert(r2.verdict === 'error', '城市解析失败不占用库存检索节律额度，不误报 cooldown');
 __resetRateLimiterForTest();
 // F. transport 失败分类 + live FlyAI 官方通道
 console.log('F. transport verdict + flyaiSearch(live,飞猪官方,无 key;GOTRY_SESSION_LIVE=0 跳过)');
@@ -167,7 +179,10 @@ if (process.env.GOTRY_SESSION_LIVE === '0') {
     console.log('  SKIP - GOTRY_SESSION_LIVE=0(离线门禁不调用 FlyAI 外部实时端点)');
 }
 else {
-    fr = await flyaiSearch({ kind: 'flight', origin: '上海', destination: '丽江', depDate: '2026-10-01' });
+    // 滚动未来日期(硬编码日期跨日假红的教训:过去日期会被上游「出发日期非法」业务失败拒绝)
+    const roll = new Date(Date.now() + 30 * 24 * 3600 * 1000);
+    const rollingDepDate = `${roll.getFullYear()}-${String(roll.getMonth() + 1).padStart(2, '0')}-${String(roll.getDate()).padStart(2, '0')}`;
+    fr = await flyaiSearch({ kind: 'flight', origin: '上海', destination: '丽江', depDate: rollingDepDate });
     const sentinelBlocked = fr.verdict === 'error' && /sentinel|block|trial limit/i.test(fr.error ?? '');
     if (sentinelBlocked) {
         console.log('  WARN - 飞猪上游限流(Sentinel 2026-08-28 / trial-limit 429 2026-08-31 实测,配额未文档化)——降级合同验证通过,跳过 hit 断言');
@@ -540,8 +555,8 @@ console.log('K. 酒店适配器(buildHotelEntryUrl/走形解析/形状嗅探/城
     __resetRateLimiterForTest();
     const e1 = await sessionHotelSearch({ to: '不在码表的城市' });
     assert(e1.ok === false && e1.verdict === 'error' && /city=/.test(e1.error ?? ''), '未收录城市 → error + cityId 指引', e1);
-    const e2 = await sessionHotelSearch({ to: '上海' });
-    assert(e2.ok === false && e2.verdict === 'cooldown', '节律闸:同站点 30s 内第二调 → cooldown(不发起导航)', e2);
+    const e2 = await sessionHotelSearch({ to: '另一个未知酒店城市' });
+    assert(e2.ok === false && e2.verdict === 'error', '酒店城市解析失败不占用库存节律额度', e2);
 }
 // L. 火车会话面(2026-09-03 实装,12306 公开查询面)纯函数:entry URL/管道行解析/电报码指引/闸面
 console.log('L. 火车适配器(buildTrainEntryUrl/parseLeftTicketQuery/电报码指引/节律闸)');
@@ -854,6 +869,196 @@ console.log('M. Dida 门户(entry 守域 + 信封走形 + 闸面)');
     assert(q2.ok === false && q2.verdict === 'cooldown', '节律闸:30s 内二调 → cooldown', q2);
     assert(typeof didaLoginHint() === 'string' && /自动登录/.test(didaLoginHint()), '登录指引指向 hotel-be portal 跳板(账密永不经 gotry)');
 }
+// L. 携程机票 GUI 车道(2026-10-14):规划器/安全白名单/假 driver 全流程/readback 硬闸
+{
+    console.log('L. GUI 车道(规划器 + 安全闸 + 假 driver)');
+    const planOw = planFlightGuiActions({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(planOw.some(a => a.t === 'clickTripTab' && a.trip === 'oneway') && !planOw.some(a => a.t === 'setDate' && a.which === 'back'), '单程规划:显式点单程 tab(页面默认往返态)/无回程日期');
+    const planRt = planFlightGuiActions({ from: '香港', to: '迪拜', date: '2026-12-06', backDate: '2026-12-13' });
+    assert(planRt.some(a => a.t === 'clickTripTab' && a.trip === 'roundtrip') && planRt.some(a => a.t === 'setDate' && a.which === 'back'), '往返规划:往返 tab + 回程日期(不知 URL 形状也能搜)');
+    const rb = planRt.find(a => a.t === 'readback');
+    assert(!!rb && rb.t === 'readback' && rb.expect.legs[0]?.back === '2026-12-13', 'readback 期望含回程日期(legs 形状)');
+    // 安全白名单:闭集外/提交件文本/非固定入口/坏日期/坏按键全拒
+    assert(!assertGuiPlanSafe([{ t: 'goto', url: 'https://evil.example.com/' }]).ok, '安全闸:非固定入口 URL 拒绝');
+    assert(!assertGuiPlanSafe([{ t: 'typeCity', which: 'from', text: '立即下单' }]).ok, '安全闸:城市位提交件文本拒绝(写面红线)');
+    assert(!assertGuiPlanSafe([{ t: 'setDate', which: 'dep', ymd: '十二月六号' }]).ok, '安全闸:非 YMD 日期拒绝');
+    assert(!assertGuiPlanSafe([{ t: 'press', key: 'Meta' }]).ok, '安全闸:按键白名单外拒绝');
+    assert(assertGuiPlanSafe(planRt).ok, '合法规划全过');
+    // 假 driver:表单内存模型 + 可编程回包
+    const FIXTURE = JSON.stringify({ data: { flightItineraryList: [{
+                    flightSegments: [{ airlineName: 'Spring Airlines', duration: 215, flightList: [{ flightNo: '9C6617', departureAirportName: '浦东', arrivalAirportName: '三义', departureDateTime: '2027-05-02 17:05:00', arrivalDateTime: '2027-05-02 20:40:00' }] }],
+                    priceList: [{ adultPrice: 1790 }],
+                }] } });
+    // live 实测形状(2026-10-14 GUI 捕获,382 条之一):顶层 priceList,/Date(ms+0800)/ 日期,price>0 才可售
+    const CAL_FIXTURE = JSON.stringify({ responseStatus: { Ack: 'Success' }, priceList: [
+            { departDate: '/Date(1791993600000+0800)/', price: 0 }, // 无价日(过滤)
+            { departDate: '/Date(1792080000000+0800)/', price: 880 }, // 2027-05-02? 由断言锚定实际换算
+            { departDate: '/Date(1792166400000+0800)/', price: 1020 },
+            { departDate: '/Date(1792252800000+0800)/', price: 760 },
+        ] });
+    const makeFakeDriver = (opts = {}) => {
+        const state = { clickedSearch: false, drives: 0, form: { from: '', to: '', dep: '', back: '' } };
+        const page = {
+            async goto() { },
+            async clickTripTab() { },
+            async typeCity(which, text) { state.form[which] = text; },
+            async pickSuggest(which, text) { state.form[which] = `${text}(SHA)`; /* 站点补全归一化形态 */ },
+            async setDate(which, ymd) { state.form[which === 'dep' ? 'dep' : 'back'] = ymd; },
+            async press() { },
+            async clickSearch() { state.clickedSearch = true; },
+            async visibleFormText() { return Object.values({ ...state.form, ...opts.formOverride }).concat(['上海', '丽江']).join(' | '); },
+            async cityFieldValues() { const f = { ...state.form, ...opts.formOverride }; return { from: f.from ?? '', to: f.to ?? '' }; },
+            async pageText() { return opts.challenge ? '请输入验证码 拖动滑块' : '机票预订'; },
+            async currentUrl() { return opts.listUrl ?? 'https://flights.ctrip.com/online/channel/domestic'; },
+            async waitForHumanLogin() { return opts.loginResult ?? false; },
+            async waitForApiCapture() {
+                state.drives += 1;
+                const first = state.drives === 1;
+                const itinerary = first
+                    ? (opts.apiBody === undefined ? { url: 'https://flights.ctrip.com/international/search/api/search/batchSearch', body: FIXTURE } : opts.apiBody ? { url: 'x', body: opts.apiBody } : null)
+                    : (opts.afterLoginBody ? { url: 'x', body: opts.afterLoginBody } : null);
+                const calendar = first && opts.calendarBody ? { url: 'https://m.ctrip.com/restapi/soa2/15380/bjjson/FlightIntlAndInlandLowestPriceSearch', body: opts.calendarBody } : null;
+                const probe = first && opts.loginProbe ? { url: 'x', body: '{"data":null,"needUserLogin":true}' } : undefined;
+                return (itinerary || calendar || probe) ? { ...(itinerary ? { itinerary } : {}), ...(calendar ? { calendar } : {}), ...(probe ? { loginProbe: probe } : {}) } : null;
+            },
+        };
+        return { driver: { open: async () => page, close: async () => { } }, state };
+    };
+    __setGuiDriverForTest(() => makeFakeDriver().driver);
+    const g1 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(g1.ok === true && g1.verdict === 'hit' && g1.anonymous === true && (g1.options?.length ?? 0) === 1, '假 driver 全流程 → hit(anonymous 标注)', g1);
+    assert(/\[会话:ctrip-flight-gui@/.test(g1.evidence) && /transport=gui/.test(g1.evidence), 'GUI 证据链 [会话:ctrip-flight-gui@ts]');
+    assert(g1.options?.[0]?.flightNo === '9C6617' && g1.options?.[0]?.price === 1790, '既有 batchSearch 解析器复用(结构化选项)');
+    // #661/#662:匿名绑定面——无行程回包、仅有低价日历 → hit + 日历数据 + listUrl 透传
+    const calDriver = makeFakeDriver({ apiBody: null, calendarBody: CAL_FIXTURE, listUrl: 'https://flights.ctrip.com/online/list/roundtrip-sha-ljg?depdate=2027-05-02&retdate=2027-05-09' });
+    __setGuiDriverForTest(() => calDriver.driver);
+    const g5 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02', backDate: '2027-05-09' });
+    assert(g5.ok === true && g5.verdict === 'hit' && (g5.options?.length ?? 0) === 0, '日历绑定:无行程回包时日历即 hit(#661)', g5);
+    assert((g5.calendar?.length ?? 0) === 3 && g5.calendar?.[0]?.date === '2026-10-16' && g5.calendar?.[0]?.price === 880 && g5.calendar?.[2]?.price === 760, '日历数据 /Date(ms)/→date 与 price>0 解析(#662,无价日过滤)', g5.calendar);
+    const calDup = parseLowestPriceCalendar(JSON.stringify({ priceList: [
+            { departDate: '/Date(1792080000000+0800)/', price: 900 }, { departDate: '/Date(1792080000000+0800)/', price: 700 },
+        ] }));
+    assert(calDup.length === 1 && calDup[0]?.price === 700, '往返双程同日双价 → 按日聚合取最低', calDup);
+    assert(g5.listUrl === 'https://flights.ctrip.com/online/list/roundtrip-sha-ljg?depdate=2027-05-02&retdate=2027-05-09', 'listUrl 回传(#663 URL 教师)', g5.listUrl);
+    assert(/低价日历/.test(g5.evidence), '日历证据链标注');
+    assert(parseLowestPriceCalendar('not json').length === 0 && parseLowestPriceCalendar('{"data":{"unknownShape":1}}').length === 0, '日历 parser 形状闸:未知形状空数组(不发明价格)');
+    const mixed = makeFakeDriver({ calendarBody: CAL_FIXTURE });
+    __setGuiDriverForTest(() => mixed.driver);
+    const g6 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert((g6.options?.length ?? 0) === 1 && (g6.calendar?.length ?? 0) === 3 && /calendar=3天/.test(g6.evidence), '行程+日历双槽并存(行程优先结算,日历随行)', g6);
+    const rbDriver = makeFakeDriver({ formOverride: { dep: '2027-05-03' } }); // 日期被「改回」→ readback 必须拦
+    __setGuiDriverForTest(() => rbDriver.driver);
+    const g2 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(g2.ok === false && g2.verdict === 'error' && /readback 硬闸/.test(g2.error ?? ''), 'readback 硬闸:日期不符 → 终止,不发起搜索', g2);
+    assert(rbDriver.state.clickedSearch === false, 'readback 拦截后搜索按钮零点击(绝不搜错日期)');
+    const cityDriver = makeFakeDriver({ formOverride: { from: '北京(BJS)' } }); // 城市打进别的框(live 实测形态)
+    __setGuiDriverForTest(() => cityDriver.driver);
+    const g2b = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(g2b.ok === false && /城市框未确认/.test(g2b.error ?? '') && cityDriver.state.clickedSearch === false, 'readback 逐字段:城市框错位(全局框假阳)→ 终止', g2b);
+    __setGuiDriverForTest(() => makeFakeDriver({ challenge: true }).driver);
+    const g3 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(g3.ok === false && g3.verdict === 'challenged', '风控页 → challenged(不重试不绕过)', g3);
+    __setGuiDriverForTest(() => makeFakeDriver({ apiBody: null }).driver);
+    const g4 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(g4.ok === false && g4.verdict === 'error' && /嗅探超时/.test(g4.error ?? ''), '回包超时 → 结构化 error', g4);
+    // 编排面:节律闸同站同桶 + 回程日期校验
+    __resetRateLimiterForTest();
+    __setGuiDriverForTest(() => makeFakeDriver().driver);
+    const s1 = await sessionFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(s1.ok === true && s1.verdict === 'hit', 'sessionFlightGuiSearch 编排 → hit');
+    const s2 = await sessionFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02' });
+    assert(s2.ok === false && s2.verdict === 'cooldown', 'GUI 与 bridge 同站同桶:30s 内二调 → cooldown');
+    __resetRateLimiterForTest();
+    const s3 = await sessionFlightGuiSearch({ from: '上海', to: '丽江', date: '2027-05-02', backDate: '2027-05-01' });
+    assert(s3.ok === false && s3.verdict === 'error' && /回程日期/.test(s3.error ?? ''), '回程早于去程 → 参数闸拒绝');
+    // bridge 往返(#663 解锁):URL 形状由 GUI 教师实测定稿;回程≤去程仍参数闸拒绝
+    __resetRateLimiterForTest();
+    const s4 = await sessionFlightSearch({ from: '上海', to: '丽江', date: '2027-05-02', backDate: '2027-05-01' });
+    assert(s4.ok === false && s4.verdict === 'error' && /回程日期/.test(s4.error ?? ''), 'bridge 回程早于去程 → 参数闸拒绝', s4);
+    const rtUrl = buildEntryUrl('香港', '迪拜', '2026-11-13', {}, '2026-11-17');
+    assert(rtUrl.ok === true && rtUrl.url === 'https://flights.ctrip.com/online/list/round-hkg0-dxb0?depdate=2026-11-13_2026-11-17&cabin=y_s&adult=1&child=0&infant=0', '往返 URL=GUI 教师实证形状(round-{code}0)', rtUrl);
+    __setGuiDriverForTest(null);
+    // N. GUI 登录态配对 + 多程(2026-10-15,#661/#663/#664 余尾收口)
+    {
+        console.log('N. 登录态配对(interactiveLogin)+ 多程规划');
+        // 多程规划:multi tab + 逐段(城市×2+日期)动作 + legs readback
+        const planMc = planFlightGuiActions({ from: '', to: '', date: '', legs: [
+                { from: '香港', to: '迪拜', date: '2026-12-06' },
+                { from: '迪拜', to: '上海', date: '2026-12-10' },
+            ] });
+        assert(planMc.some(a => a.t === 'clickTripTab' && a.trip === 'multi'), '多程规划:点 multi tab');
+        assert(planMc.filter(a => a.t === 'setDate').length === 2 && planMc.some(a => a.t === 'setDate' && a.seg === 2), '多程规划:逐段日期(seg 维度)');
+        assert(!assertGuiPlanSafe([{ t: 'typeCity', which: 'from', text: '香港', seg: 4 }]).ok, '安全闸:seg 闭集(1–3)外拒绝');
+        // 登录配对(机票):首驾只有日历+needUserLogin 探测 → 等人登录 → 重驾拿行程 → anonymous=false
+        const loginDriver = makeFakeDriver({ apiBody: null, calendarBody: CAL_FIXTURE, loginProbe: true, loginResult: true, afterLoginBody: FIXTURE });
+        __setGuiDriverForTest(() => loginDriver.driver);
+        const n1 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2026-11-13', interactiveLoginMs: 60_000 });
+        assert(n1.ok === true && (n1.options?.length ?? 0) === 1 && n1.anonymous === false, '登录配对(机票):探测→等人登录→重驾→行程明细 hit,anonymous=false', n1);
+        assert(/本人已在本窗口官方页登录/.test(n1.evidence), '登录态证据链标注');
+        // 登录等待超时:needs-login 终态(不冒充成功)
+        const timeoutDriver = makeFakeDriver({ apiBody: null, calendarBody: CAL_FIXTURE, loginProbe: true, loginResult: false });
+        __setGuiDriverForTest(() => timeoutDriver.driver);
+        const n2 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2026-11-13', interactiveLoginMs: 60_000 });
+        assert(n2.ok === false && n2.verdict === 'needs-login' && /登录等待超时/.test(n2.error ?? ''), '登录等待超时 → needs-login 终态', n2);
+        // 未授权等待(interactiveLoginMs 缺省):保持匿名日历面,不弹登录
+        const anonDriver = makeFakeDriver({ apiBody: null, calendarBody: CAL_FIXTURE, loginProbe: true });
+        __setGuiDriverForTest(() => anonDriver.driver);
+        const n3 = await runFlightGuiSearch({ from: '上海', to: '丽江', date: '2026-11-13' });
+        assert(n3.ok === true && (n3.calendar?.length ?? 0) === 3 && n3.anonymous === true, '未授权等待:保持匿名日历面(默认行为不变)', n3);
+        __setGuiDriverForTest(null);
+    }
+}
+// M. 携程酒店 GUI 车道(2026-10-14,#664 首片):规划/安全闸/readback/needs-login 边界
+{
+    console.log('M. 酒店 GUI 车道(规划器 + 安全闸 + 假 driver + 登录墙判语)');
+    const hp = planHotelGuiActions({ to: '迪拜', checkIn: '2026-12-06', checkOut: '2026-12-08' });
+    assert(hp.some(a => a.t === 'setDate' && a.which === 'in') && hp.some(a => a.t === 'setDate' && a.which === 'out'), '酒店规划:入住/退房成对');
+    assert(!assertHotelPlanSafe([{ t: 'typeCity', text: '立即下单' }]).ok, '安全闸:目的地位提交件文本拒绝');
+    assert(!assertHotelPlanSafe([{ t: 'goto', url: 'https://evil.example.com/' }]).ok, '安全闸:非固定入口拒绝');
+    const HOTEL_FIXTURE = JSON.stringify({ ResponseStatus: { Ack: 'Success' }, hotelList: [
+            { hotelName: '测试酒店', minPrice: 500, star: 4 },
+        ] });
+    const mkHotelDriver = (opts = {}) => {
+        const state = { clickedSearch: false, form: { to: '', in: '', out: '' }, url: 'https://hotels.ctrip.com/' };
+        const page = {
+            async goto() { },
+            async typeCity(text) { state.form.to = text; },
+            async pickSuggest(text) { state.form.to = `${text}(测试)`; },
+            async setDate(which, ymd) { state.form[which] = ymd; },
+            async press() { },
+            async clickSearch() { state.clickedSearch = true; if (opts.passportAfterSearch)
+                state.url = 'https://passport.ctrip.com/user/login?backurl=x'; },
+            async visibleFormText() {
+                const f = { ...state.form, ...opts.formOverride };
+                const cn = (ymd) => ymd ? `${Number(ymd.slice(5, 7))}月${Number(ymd.slice(8, 10))}日` : '';
+                return Object.values(f).concat(['上海', cn(f.in ?? ''), cn(f.out ?? '')]).join(' | ');
+            },
+            async destFieldValue() { return (opts.formOverride?.to ?? state.form.to) + '(测试)'; },
+            async pageText() { return '酒店预订'; },
+            async currentUrl() { return state.url; },
+            async waitForHumanLogin() { return false; },
+            async waitForApiBody() {
+                if (opts.passportAfterSearch)
+                    return null;
+                return opts.body === undefined ? { url: 'https://hotels.ctrip.com/hotels/api/list', body: HOTEL_FIXTURE } : opts.body ? { url: 'x', body: opts.body } : null;
+            },
+        };
+        return { driver: { open: async () => page, close: async () => { } }, state };
+    };
+    __setHotelDriverForTest(() => mkHotelDriver().driver);
+    const h1 = await runHotelGuiSearch({ to: '上海', checkIn: '2026-11-13', checkOut: '2026-11-15' });
+    assert(h1.ok === true && h1.verdict === 'hit' && h1.anonymous === true && (h1.hotels?.length ?? 0) >= 1, '酒店假 driver 全流程 → hit(匿名标注;本地化日期格式核对)', h1);
+    const hLogin = mkHotelDriver({ passportAfterSearch: true });
+    __setHotelDriverForTest(() => hLogin.driver);
+    const h2 = await runHotelGuiSearch({ to: '上海', checkIn: '2026-11-13', checkOut: '2026-11-15' });
+    assert(h2.ok === false && h2.verdict === 'needs-login' && /gotry_session_login/.test(h2.error ?? ''), '登录墙(passport 跳转)→ needs-login 判语(live 实证边界)', h2);
+    const hBadDate = mkHotelDriver({ formOverride: { in: '2026-11-20' } });
+    __setHotelDriverForTest(() => hBadDate.driver);
+    const h3 = await runHotelGuiSearch({ to: '上海', checkIn: '2026-11-13', checkOut: '2026-11-15' });
+    assert(h3.ok === false && /readback 硬闸/.test(h3.error ?? '') && hBadDate.state.clickedSearch === false, 'readback 硬闸:入住日期错位 → 零搜索点击', h3);
+    assert((await runHotelGuiSearch({ to: '上海', checkIn: '2026-11-15', checkOut: '2026-11-13' })).verdict === 'error', '退房早于入住 → 参数闸拒绝');
+    __setHotelDriverForTest(null);
+}
 if (process.env.GOTRY_SESSION_TEST_FORCE_FAILURE === '1') {
     assert(false, 'forced session failure propagation proof');
 }