@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/src/booking-surface/tenancy.js

@@ -0,0 +1,188 @@
+/**
+ * Multi-tenant seam of the Booking Copilot surface (AaaS A2, docs/rfc/aaas-rfc.md §4.4; threats S-1 to S-4, S-10, S-13, S-14).
+ *
+ * One request becomes one `TurnScope` here and nowhere else:
+ *
+ *   authenticate -> deriveSeamTenant -> quotas.admitTurn -> router.openTenant -> a runtime over the tenant's guarded ledger
+ *
+ * The tenant comes from the authenticated caller only. The body, the headers, the tool arguments and the model's output
+ * are never inputs to it, and the scope carries no method that takes a tenant. Everything the surface keeps between
+ * requests (planner sessions, single-flight decisions) is keyed by the scope, so two tenants whose task handles and
+ * request keys collide still never meet. The shared, single-ledger form of the surface (today's deployment) does not
+ * use this module and behaves exactly as before.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { assertSeamTenant, deriveSeamTenant, InvalidPrincipalError, SeamError, seamTenantKey, UnknownOrganizationError } from '../tenant-seam/seam.js';
+import { QuotaExceededError } from '../tenant-seam/quotas.js';
+import { InvalidTenantIdError, ReplicaAtCapacityError, RouterClosedError, TenantDrainingError, TenantStateError } from '../tenant-state/errors.js';
+import { derivePromptCachePartition } from '../tenant-state/ids.js';
+import { BookingCopilotTaskRuntime } from './runtime.js';
+/** One planner shared by every tenant. Sessions are still keyed by tenant here, but the planner's own files are shared: for fixtures. */
+export function sharedPlannerProvider(factory) {
+    return { forTenant: async () => factory, close: async () => undefined };
+}
+/** The handle and the ledger it exposes disagree with the tenant the seam derived: a wiring bug that must never serve a request. */
+export class TenantBindingError extends SeamError {
+    constructor() {
+        super('GOTRY_SEAM_TENANT_MISMATCH', 'the opened ledger does not belong to the derived tenant');
+    }
+}
+const invocations = new AsyncLocalStorage();
+function ledgerBytes(handle) {
+    return handle.run((ledger) => {
+        const pages = ledger.db.pragma('page_count', { simple: true });
+        const size = ledger.db.pragma('page_size', { simple: true });
+        return pages * size;
+    });
+}
+export class BookingTenancy {
+    ingressMode;
+    options;
+    planners = new Map();
+    constructor(options) {
+        if (typeof options.authenticator?.authenticate !== 'function')
+            throw new Error('booking_copilot_tenancy_authenticator_required');
+        if (typeof options.keyring?.keyFor !== 'function')
+            throw new Error('booking_copilot_tenancy_keyring_required');
+        if (!options.router || !options.quotas || !options.planners)
+            throw new Error('booking_copilot_tenancy_incomplete');
+        if (options.ingressBinding !== undefined && typeof options.ingressBinding.bind !== 'function')
+            throw new Error('booking_copilot_ingress_binding_invalid');
+        this.options = options;
+        this.ingressMode = options.ingressBinding ? 'bff-ingress-binding' : 'bff-bound-turn-only';
+    }
+    /** The authenticated caller of a request, or `null`. The only place a credential is read. */
+    async authenticate(request) {
+        return this.options.authenticator.authenticate(request);
+    }
+    /**
+     * Derives the tenant, admits the turn, and opens the tenant's guarded ledger.
+     *
+     * @throws QuotaExceededError before any lease or file is touched, when the turn is over a limit
+     * @throws InvalidTenantIdError | InvalidPrincipalError | UnknownOrganizationError for a caller the seam cannot place
+     * @throws TenantStateError subclasses when the tenant cannot be served here now (owned elsewhere, draining, store down)
+     */
+    async beginTurn(caller) {
+        const { quotas, router } = this.options;
+        const tenant = deriveSeamTenant(caller, this.options.keyring);
+        const permit = quotas.admitTurn(tenant);
+        try {
+            const handle = await router.openTenant(tenant.organization, tenant.ledgerTenant);
+            // Defense in depth: the handle, and the ledger inside it, must be exactly the tenant the seam derived.
+            if (handle.organization !== tenant.organization || handle.ledgerTenant !== tenant.ledgerTenant || handle.ledger.tenant !== tenant.ledgerTenant)
+                throw new TenantBindingError();
+            quotas.observeLedgerBytes(tenant, ledgerBytes(handle));
+            const plannerFactory = await this.plannerFor(tenant);
+            const key = seamTenantKey(tenant);
+            const runtime = new BookingCopilotTaskRuntime(handle.ledger, this.options.runtime);
+            const binding = this.options.ingressBinding;
+            return {
+                key,
+                runtime,
+                plannerFactory,
+                ingress: binding ? { binding, principal: { subject: caller.subject, scope: caller.scope } } : null,
+                sessionKey: (taskId) => `${key}\u0000${taskId}`,
+                flightKey: (parts) => JSON.stringify([key, ...parts]),
+                runDecision: (work) => handle.runAsync(work),
+                isTenantFault: (error) => error instanceof TenantStateError,
+                release: () => permit.release(),
+            };
+        }
+        catch (error) {
+            permit.release();
+            throw error;
+        }
+    }
+    /**
+     * Hands every tenant back and stops the planners. The tenancy owns the router and the planner provider it was given:
+     * a graceful handoff per tenant (drain, final snapshot, release), then the planners. Resolves when done; a tenant whose
+     * final snapshot could not be flushed is reported, because its last writes are then only as durable as the last snapshot.
+     */
+    async close() {
+        const failures = [];
+        try {
+            await this.options.planners.close();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        const unflushed = await this.options.router.close().catch((error) => { failures.push(error); return []; });
+        if (unflushed.length > 0)
+            failures.push(new Error(`booking_copilot_tenant_handoff_unflushed:${unflushed.length}`));
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, 'booking_copilot_tenancy_close_failed');
+    }
+    plannerFor(tenant) {
+        const seam = assertSeamTenant(tenant);
+        const key = seamTenantKey(seam);
+        let planner = this.planners.get(key);
+        if (!planner) {
+            const { quotas, planners, router } = this.options;
+            const organizationKey = this.options.keyring.keyFor(seam.organization);
+            if (organizationKey === null)
+                throw new UnknownOrganizationError();
+            planner = planners.forTenant({
+                tenantRoot: router.tenantRootOf(seam.organization, seam.ledgerTenant),
+                cachePartition: derivePromptCachePartition(organizationKey, seam.ledgerTenant),
+                reportUsage: (model, usage) => {
+                    const meter = invocations.getStore();
+                    if (!meter || meter.tenantKey !== key)
+                        return;
+                    try {
+                        quotas.recordLlmUsage(seam, model, usage);
+                        meter.reported = true;
+                    }
+                    catch {
+                        // An unpriced model or malformed counts leave the invocation unproven: it is charged the worst case below.
+                    }
+                },
+            }).then((inner) => (task) => this.metered(inner(task), seam, key));
+            planner.catch(() => this.planners.delete(key));
+            this.planners.set(key, planner);
+        }
+        return planner;
+    }
+    /** Wraps a planner session so that every invocation is charged: what it reported, or the worst case if it reported nothing. */
+    metered(session, tenant, key) {
+        const { quotas } = this.options;
+        return {
+            next: async (input) => {
+                const meter = { tenantKey: key, reported: false };
+                try {
+                    return await invocations.run(meter, () => session.next(input));
+                }
+                finally {
+                    if (!meter.reported)
+                        quotas.chargeUnprovenInvocation(tenant);
+                }
+            },
+            ...(session.close ? { close: () => session.close() } : {}),
+        };
+    }
+}
+/** The typed HTTP answer for a failure raised before the response stream starts. Bodies carry codes, scopes and hints only. */
+export function tenantRejection(error) {
+    if (error instanceof QuotaExceededError) {
+        return {
+            status: 429,
+            body: { error: { code: 'quota_exceeded', scope: error.scope, dimension: error.dimension, retryAfterSeconds: error.retryAfterSeconds } },
+            retryAfterSeconds: error.retryAfterSeconds,
+        };
+    }
+    if (error instanceof InvalidTenantIdError || error instanceof InvalidPrincipalError)
+        return { status: 403, body: { error: { code: 'invalid_principal' } } };
+    if (error instanceof UnknownOrganizationError)
+        return { status: 403, body: { error: { code: 'organization_not_served' } } };
+    if (error instanceof RouterClosedError)
+        return { status: 503, body: { error: { code: 'booking_copilot_shutting_down' } } };
+    if (error instanceof TenantDrainingError)
+        return { status: 503, body: { error: { code: 'tenant_draining' } }, retryAfterSeconds: 1 };
+    // A full replica frees a slot only when some tenant is handed off, so retrying it soon is not a useful hint; the request belongs on another replica.
+    if (error instanceof ReplicaAtCapacityError)
+        return { status: 503, body: { error: { code: 'tenant_unavailable' } } };
+    if (error instanceof TenantStateError && !(error instanceof SeamError))
+        return { status: 503, body: { error: { code: 'tenant_unavailable' } }, retryAfterSeconds: 1 };
+    return { status: 500, body: { error: { code: 'tenant_seam_failure' } } };
+}

package/dist/src/gotry-web-api.js

@@ -4,6 +4,7 @@ import { isAbsolute } from 'node:path';
 import { verifyFlyaiCandidate } from '../../bin/gotry-flyai-verification.js';
 import { listArtifacts } from '../capabilities/artifacts.js';
 import { atomicWriteJson, clearFlyaiKey, displayEndpoint, endpointFingerprint, flyaiConfigPath, isPlaceholderFlyaiKey, maskFlyaiKey, readFlyaiConfig, readFlyaiVerification, removeFlyaiVerification, resolveFlyaiEndpoint, resolveFlyaiKey, saveFlyaiKey, sha256Hex, writeFlyaiVerification, } from '../capabilities/flyai-config.js';
+import { hbcliCredentialPath, hbcliSetupStatus, readHbcliCredentials, removeHbcliVerification, verifyHbcliCandidate, withHbcliCredentials, withoutHbcliCredentials, writeHbcliCredentials, writeHbcliVerification, } from '../capabilities/hbcli-config.js';
 const json = (value, status = 200) => Response.json(value, { status, headers: { 'cache-control': 'no-store' } });
 const rejection = (error, status = 400) => json({ ok: false, error }, status);
 const BODY_LIMIT = 8192;
@@ -40,6 +41,7 @@ async function readInput(request) {
 export function createGotryWebHandlers(options) {
     const homeDir = options.homeDir ?? homedir(), env = options.env ?? process.env;
     const paths = { homeDir, env }, configPath = flyaiConfigPath(homeDir);
+    const hbPaths = { homeDir, env, hbcliBin: options.hbcliBin };
     let mutations = Promise.resolve();
     const status = () => {
         const current = resolveFlyaiKey(paths), endpoint = resolveFlyaiEndpoint(paths), receipt = readFlyaiVerification(homeDir);
@@ -99,7 +101,65 @@ export function createGotryWebHandlers(options) {
         }
         return json(status());
     }
+    async function mutateHbcli(input, signal) {
+        if (signal.aborted)
+            return rejection('操作已取消。', 409);
+        if (!hbcliSetupStatus(hbPaths).writable)
+            return rejection('当前凭证来自环境变量，或本机配置不可安全写入。', 409);
+        const before = readHbcliCredentials(hbPaths);
+        if (!before.ok)
+            return rejection('原配置损坏，已保留原文件，请先修复。', 409);
+        if (input.action === 'clear') {
+            if (!writeHbcliCredentials(withoutHbcliCredentials(before.data), hbPaths))
+                return rejection('无法清除配置，请检查本机文件及权限。', 409);
+            removeHbcliVerification(homeDir);
+            return json(hbcliSetupStatus(hbPaths));
+        }
+        const appKey = typeof input.appKey === 'string' ? input.appKey.trim() : '';
+        const appSecret = typeof input.appSecret === 'string' ? input.appSecret.trim() : '';
+        if ([appKey, appSecret].some(value => !value || value.length > 2048 || /[\r\n\0]/.test(value)))
+            return rejection('请填写 HotelByte 提供的 App Key 和 App Secret。');
+        const verified = await verifyHbcliCandidate(appKey, appSecret, hbPaths, signal);
+        if (signal.aborted || verified.verdict === 'error' || verified.verdict === 'cancelled') {
+            return json({ ok: false, error: verified.error ?? '验证已取消，旧配置保留。' }, 422);
+        }
+        const current = readHbcliCredentials(hbPaths);
+        if (!hbcliSetupStatus(hbPaths).writable || !current.ok || current.bytes !== before.bytes)
+            return rejection('配置在验证期间发生变化，请重新读取后再试。', 409);
+        const next = withHbcliCredentials(before.data, appKey, appSecret);
+        if (!writeHbcliCredentials(next, hbPaths))
+            return rejection('安全保存失败，旧配置保留，请检查本机权限。', 409);
+        if (!writeHbcliVerification(next, verified.verdict, hbPaths)) {
+            const restored = before.bytes === undefined
+                ? (() => { try {
+                    rmSync(hbcliCredentialPath(hbPaths));
+                    return true;
+                }
+                catch {
+                    return false;
+                } })()
+                : writeHbcliCredentials(before.data, hbPaths);
+            return rejection(restored ? '验证回执保存失败，旧配置已恢复。' : '验证回执保存失败，请检查本机文件。', 409);
+        }
+        return json(hbcliSetupStatus(hbPaths));
+    }
     return {
+        async hbcli(request) {
+            if (request.method === 'GET')
+                return json(hbcliSetupStatus(hbPaths));
+            if (request.method !== 'POST')
+                return rejection('不支持此操作。', 405);
+            const input = await readInput(request);
+            if (input instanceof Response)
+                return input;
+            if (!['save', 'clear'].includes(String(input.action))
+                || Object.keys(input).some(key => !['action', 'appKey', 'appSecret'].includes(key))
+                || (input.action === 'clear' && ('appKey' in input || 'appSecret' in input)))
+                return rejection('请求无效。');
+            const operation = mutations.then(() => mutateHbcli(input, request.signal)).catch(() => rejection('操作失败，未能确认保存，请重新读取状态。', 500));
+            mutations = operation.then(() => undefined);
+            return operation;
+        },
         async flyai(request) {
             if (request.method === 'GET')
                 return json(status());
@@ -137,12 +197,12 @@ export function createGotryWebHandlers(options) {
         },
     };
 }
-export function registerGotryWebApi(ctx, stateRoot) {
+export function registerGotryWebApi(ctx, stateRoot, hbcliBin) {
     if (typeof ctx.inject !== 'function')
         return;
     ctx.inject(['connection', 'sessions'], scope => {
         const connection = scope.get('connection');
-        const handlers = createGotryWebHandlers({ stateRoot, workspaceForSession: async (sessionId) => {
+        const handlers = createGotryWebHandlers({ stateRoot, hbcliBin, workspaceForSession: async (sessionId) => {
                 const id = sessionId;
                 const live = scope.sessions.get(id)?.header;
                 const stored = live ? undefined : await scope.get('sessionPersistence')?.stat(sessionId);
@@ -152,6 +212,8 @@ export function registerGotryWebApi(ctx, stateRoot) {
         // it. Exact routes have one body mode, so reads and bounded writes differ.
         scope.effect(() => connection.fetch.register({ path: '/api/gotry/flyai', methods: ['GET'], requestBody: 'buffered', fetch: handlers.flyai }));
         scope.effect(() => connection.fetch.register({ path: '/api/gotry/flyai/write', methods: ['POST'], requestBody: 'streaming', fetch: handlers.flyai }));
+        scope.effect(() => connection.fetch.register({ path: '/api/gotry/hbcli', methods: ['GET'], requestBody: 'buffered', fetch: handlers.hbcli }));
+        scope.effect(() => connection.fetch.register({ path: '/api/gotry/hbcli/write', methods: ['POST'], requestBody: 'streaming', fetch: handlers.hbcli }));
         scope.effect(() => connection.fetch.register({ path: '/api/gotry/artifacts', methods: ['GET'], requestBody: 'buffered', fetch: handlers.artifacts }));
     });
 }

package/dist/src/index.js

@@ -432,7 +432,7 @@ export function apply(ctx, config, seams = {}) {
     // 派生的后台规划会话:唯一出口 converge + 长 leash——前台转后台,后台
     // 必须产出最终交付物,不得再次 handoff(否则无限递归)。
     if (!rawBenchmarkEnvironmentConfigPath) {
-        registerGotryWebApi(ctx, config.stateRoot ?? '.');
+        registerGotryWebApi(ctx, config.stateRoot ?? '.', config.hbcliBin);
         registerArtifactDeliveries(ctx);
     }
     const handoffChild = process.env.GOTRY_HANDOFF_CHILD === '1';
@@ -1305,10 +1305,15 @@ export function apply(ctx, config, seams = {}) {
             const resp = itp.result;
             const dir = await ensureStateDir(config.stateRoot);
             const isLive = resp.via === 'hbcli-realtime';
-            const evidence = isLive ? resp.evidence : '[静态包:估算]';
+            const staticStays = resp.hotels?.stays;
+            const hasEstimate = Array.isArray(staticStays) && staticStays.length > 0;
+            const liveList = resp.hotels?.list;
+            const verdict = isLive ? (liveList?.length ? 'hit' : 'miss') : hasEstimate ? 'estimated' : 'error';
+            const evidence = hasEstimate ? '[静态包:估算]' : resp.evidence;
             await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `hotel_search:${resp.via}`).catch(() => { });
             const payload = {
-                ok: true,
+                ok: isLive || hasEstimate,
+                verdict,
                 hotels: resp.hotels ?? null,
                 evidence,
                 destination: q.destination,
@@ -1316,6 +1321,7 @@ export function apply(ctx, config, seams = {}) {
                 latency_ms: Date.now() - started,
                 summary: resp.summary,
                 error: resp.error,
+                ...(verdict !== 'hit' ? await routingField('search-hotel', 'hbcli-hotel') : {}),
                 ...(dateNotes.length ? { date_notes: dateNotes } : {}),
             };
             return JSON.parse(JSON.stringify(payload));
@@ -1342,13 +1348,14 @@ export function apply(ctx, config, seams = {}) {
                 };
             }
             const h = r.hotels;
-            const liveCount = Array.isArray(h) ? h.length : 0;
+            const liveList = h?.list;
+            const liveCount = Array.isArray(liveList) ? liveList.length : 0;
             // 静态包是 {meta, stays} 对象而非数组(issue #24:此前计数恒 0 → UI 显示「无结果」)
             const stays = !Array.isArray(h) && h && typeof h === 'object' ? h.stays : undefined;
             const staticCount = Array.isArray(stays) ? stays.length : 0;
             const tag = r.via === 'hbcli-realtime'
-                ? (liveCount ? `实时 ${liveCount} 家` : '实时')
-                : staticCount ? `静态包 ${staticCount} 块` : (liveCount ? `${liveCount} 家` : '无结果');
+                ? `实时 ${liveCount} 家`
+                : staticCount ? `静态包 ${staticCount} 块` : '查询未完成';
             return {
                 card: 'generic',
                 title: `酒店:${r.destination ?? ''} ${tag}`,
@@ -1731,8 +1738,9 @@ export function apply(ctx, config, seams = {}) {
         description: routed('gotry_session_search', 'Search on the USER\'S OWN browser session (Ctrip kind="flight"(default)/"hotel"; 12306 kind="train" — public query face, no login needed). '
             + 'Consent gate: the FIRST call in a session asks the user via the runtime approval card; once granted it holds for the session, a refusal revokes it for the session (no repeat prompting). '
             + 'Transport: Stai Travel Bridge browser extension (one-time install) — the agent side never talks to Chrome debugging, ZERO system dialogs; read-only by construction (the extension never issues requests; it only passively forwards the site\'s own search responses; agent NEVER touches credentials/captcha; on captcha it stops and returns challenged). '
-            + 'kind="flight": from/to 中文城市名 + date YYYY-MM-DD — sniffs the site search API for structured options. Evidence [会话:ctrip-flight@ts]. '
-            + 'kind="hotel": to=目的地中文, cityId? = the numeric city= in a hotels.ctrip.com list URL (web-search it when the destination is outside the built-in city table), checkIn?/checkOut? (YYYY-MM-DD), adults?; hotel prices are the user\'s real logged-in prices. Evidence [会话:ctrip-hotel@ts]. '
+            + 'kind="flight": from/to city or airport names (Chinese/English) + date YYYY-MM-DD; unknown names resolve from supplier metadata, ambiguous names require confirmation; optional fromCityCode/toCityCode are explicit Ctrip three-letter codes — sniffs the site search API for structured options. '
+            + 'ui?="bridge" (default; the user\'s own logged-in session, real member prices) | "gui" (gotry opens its OWN isolated anonymous Chrome window and drives the Ctrip PC search form — roundtrip via backDate? and ANY city by construction: the site\'s own autocomplete resolves cities; anonymous public prices, NOT logged-in prices; verdicts carry anonymous=true; result-binding iteration tracked in #661). Evidence [会话:ctrip-flight@ts] / [会话:ctrip-flight-gui@ts]. '
+            + 'kind="hotel": to=destination name, country? for same-name disambiguation; cityId? = explicit numeric city= from a Ctrip hotel list URL; otherwise resolves from the hotel destination service, checkIn?/checkOut? (YYYY-MM-DD), adults?; hotel prices are the user\'s real logged-in prices. Evidence [会话:ctrip-hotel@ts]. '
             + 'kind="dida": Dida supplier-portal realtime hotel rates on the employee\'s own logged-in session (hotel-be portal integration line) — no from/to needed; the portal find page\'s own requests are sniffed passively. Rates carry ratePlanId/referenceNo for the server-side booking chain. Evidence [会话:dida-portal@ts]. '
             + 'kind="train": from/to/date(YYYY-MM-DD) + fromStationTelecode?/toStationTelecode? (three-letter codes in the kyfw query URL, for cities outside the built-in table) — 12306 left-ticket query (public face): train codes, times, durations, seat availability; the list API carries NO prices (prices live on the 12306 page). Evidence [会话:train-12306@ts]. '
             + 'verdict needs-login = call gotry_session_login (opens the Ctrip login entry in the user\'s own foreground tab — no terminal, no credentials through GoTry); '
@@ -1745,15 +1753,22 @@ export function apply(ctx, config, seams = {}) {
         // execute 内归一后走原条件闸,结构化报错不崩。flyai 因 kind required 仍在宿主权即拒。
         parameters: {
             kind: { type: 'string', enum: ['flight', 'hotel', 'train', 'dida'], description: '默认 flight 机票;hotel 携程酒店(用户登录态真实价);train 12306 余票(公开面);dida 供应商门户实时价(员工登录态)' },
-            from: { type: 'string', description: '出发城市中文(词表内),如 上海——kind=flight|train 必填' },
+            from: { type: 'string', description: '出发城市名（机票支持中英文及机场名，自动解析），如 上海——kind=flight|train 必填' },
             to: { type: 'string', description: '到达城市中文——kind=flight|train 必填;kind=hotel 时为目的地(必填)' },
             date: { type: 'string', description: '出发日期 YYYY-MM-DD——kind=flight|train 必填,须为今天或未来' },
-            cityId: { type: 'integer', description: '携程酒店 city= 数字,仅 kind=hotel;目的地码表外时 web 搜 hotels.ctrip.com list URL 取 city=' },
+            fromCityCode: { type: 'string', description: '显式携程出发城市／机场三字码，仅 kind=flight；同名城市确认后使用' },
+            toCityCode: { type: 'string', description: '显式携程到达城市／机场三字码，仅 kind=flight；同名城市确认后使用' },
+            cityId: { type: 'integer', description: '显式携程酒店 city= 数字，仅 kind=hotel；未提供时自动解析酒店目的地，不能使用机票城市码' },
+            country: { type: 'string', description: '目的地国家中英文，仅 kind=hotel；用于同名城市消歧，例如 阿联酋' },
             checkIn: { type: 'string', description: '入住日 YYYY-MM-DD,仅 kind=hotel 可选' },
             checkOut: { type: 'string', description: '退房日 YYYY-MM-DD,仅 kind=hotel 可选' },
             adults: { type: 'integer', description: '成人数,仅 kind=hotel 可选' },
             fromStationTelecode: { type: 'string', description: '出发站三位电报码,仅 kind=train;城市码表外时填(kyfw 查询页 URL 里)' },
             toStationTelecode: { type: 'string', description: '到达站三位电报码,仅 kind=train,同上' },
+            backDate: { type: 'string', description: '回程日期 YYYY-MM-DD,仅 kind=flight;存在即往返检索——须 ui=gui(GUI 车道站点表单原生往返;bridge 车道不知往返 URL 形状,不猜)' },
+            ui: { type: 'string', enum: ['bridge', 'gui'], description: 'kind=flight|hotel:bridge(默认,用户登录态被动嗅探)|gui(gotry 隔离匿名窗口驱动 PC 表单——flight 往返/多程/任意城市原生+低价日历;hotel 任意目的地原生;匿名公开价)' },
+            legs: { type: 'string', description: '多程段 JSON 数组,仅 kind=flight+ui=gui:[{"from":"香港","to":"迪拜","date":"2026-12-06"},{"from":"迪拜","to":"上海","date":"2026-12-10"}](2–3 段)' },
+            interactiveLogin: { type: 'boolean', description: '仅 ui=gui:登录墙命中时窗口停在携程官方登录页,等用户本人在窗口内完成登录(最多 6 分钟)后自动重查,拿登录态真实数据(行程明细/酒店真实价)。gotry 永不经手密码/验证码/cookie 值' },
         },
         output: { schema: { type: 'json' }, render: (_a, v) => [{ type: 'text', text: String(v.summary ?? JSON.stringify(v).slice(0, 600)) }] },
         async execute(args, _exec) {
@@ -1830,17 +1845,18 @@ export function apply(ctx, config, seams = {}) {
             }
             if (q.kind === 'hotel') {
                 if (!q.to) {
-                    return { ok: false, summary: 'kind=hotel 需要 to(目的地中文;城市码表外带 cityId=携程酒店 list 页 URL 里的 city= 数字)' };
+                    return { ok: false, summary: 'kind=hotel 需要 to（目的地名称）；自动解析城市，同名城市可带 country 或确认后的 cityId' };
                 }
                 const itp = await runSessionEffect({
-                    effect: 'SESSION_HOTEL_SEARCH',
+                    effect: q.ui === 'gui' ? 'SESSION_HOTEL_GUI_SEARCH' : 'SESSION_HOTEL_SEARCH',
                     params: {
-                        to: q.to, cityId: q.cityId, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults,
+                        to: q.to, country: q.country, cityId: q.cityId, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults,
+                        ...(q.ui === 'gui' && q.interactiveLogin ? { interactiveLoginMs: 360_000 } : {}),
                         auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
                     },
                 });
                 if (!itp.result)
-                    return declinedObservation('SESSION_HOTEL_SEARCH', itp.trace);
+                    return declinedObservation(q.ui === 'gui' ? 'SESSION_HOTEL_GUI_SEARCH' : 'SESSION_HOTEL_SEARCH', itp.trace);
                 const r = itp.result;
                 await noteChannel('session:ctrip-hotel', r.verdict);
                 // D-26(issue #118):exact-date 会话酒店 hit/miss 落账(摸底无档期不落;cooldown 是节律闸非结论,不落)
@@ -1862,14 +1878,46 @@ export function apply(ctx, config, seams = {}) {
                 }));
             }
             if (!q.from || !q.to || !q.date) {
-                return { ok: false, summary: '需要 from/to(中文城市名,词表内)与 date(YYYY-MM-DD);酒店/火车检索分别用 kind=hotel / kind=train' };
+                return { ok: false, summary: '需要 from/to（城市或机场名）与 date（YYYY-MM-DD）;酒店/火车检索分别用 kind=hotel / kind=train' };
             }
             // 效应解译层(ADR-18):SESSION 通道策略=永不重试/不熔断,节律闸在渠道内;
             // 解译器只做分发与证据拼装,verdict 语义(risk 型 needs-login/challenged)原样透传
+            // GUI 车道(2026-10-14):ui=gui → gotry 隔离匿名窗口驱动 PC 表单(往返 backDate/任意城市原生)。
+            if (q.ui !== undefined && q.ui !== 'bridge' && q.ui !== 'gui') {
+                return { ok: false, summary: 'kind=flight 的 ui 只接受 bridge(默认,登录态被动嗅探)|gui(隔离匿名窗口驱动表单)' };
+            }
+            // 多程段(仅 gui;严格形状闸——2–3 段、城市非空、日期 YMD、段内日期递增)
+            let legs;
+            if (q.legs !== undefined) {
+                if (q.ui !== 'gui')
+                    return { ok: false, summary: 'legs(多程)仅支持 ui=gui(GUI 车道驱动多程表单)' };
+                try {
+                    const parsed = JSON.parse(q.legs);
+                    if (!Array.isArray(parsed) || parsed.length < 2 || parsed.length > 3)
+                        throw new Error('段数须 2–3');
+                    legs = parsed.map((raw) => {
+                        const leg = raw;
+                        if (typeof leg.from !== 'string' || !leg.from.trim() || typeof leg.to !== 'string' || !leg.to.trim() || typeof leg.date !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(leg.date)) {
+                            throw new Error('每段须 {from,to,date(YYYY-MM-DD)}');
+                        }
+                        return { from: leg.from.trim(), to: leg.to.trim(), date: leg.date };
+                    });
+                    for (let i = 1; i < legs.length; i += 1) {
+                        if (legs[i].date <= legs[i - 1].date)
+                            throw new Error('段日期须递增');
+                    }
+                }
+                catch (e) {
+                    return { ok: false, summary: `legs 形状非法:${e.message}` };
+                }
+            }
             const itp = await runSessionEffect({
-                effect: 'SESSION_FLIGHT_SEARCH',
+                effect: q.ui === 'gui' ? 'SESSION_FLIGHT_GUI_SEARCH' : 'SESSION_FLIGHT_SEARCH',
                 params: {
-                    from: q.from, to: q.to, date: q.date,
+                    from: q.from, to: q.to, date: q.date, fromCityCode: q.fromCityCode, toCityCode: q.toCityCode,
+                    ...(q.backDate ? { backDate: q.backDate } : {}),
+                    ...(legs ? { legs } : {}),
+                    ...(q.ui === 'gui' && q.interactiveLogin ? { interactiveLoginMs: 360_000 } : {}),
                     // ADR-15 收尾:ReadGuard 审计在生产工具路径同样落盘(此前仅测试传隔离 stateRoot 才有 JSONL)
                     auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
                 },
@@ -1882,8 +1930,12 @@ export function apply(ctx, config, seams = {}) {
             const avMapS = await loadAirlineAirportMap();
             await appendFacts(config.stateRoot ?? '.', factsFromSession({ origin: q.from, destination: q.to, date: q.date }, r, new Date().toISOString(), avMapS?.city_alias));
             const top = (r.options ?? []).slice(0, 8).map(o => `${o.flightNo} ${o.airline} ${o.depDateTime.slice(11, 16)}→${o.arrDateTime.slice(11, 16)} ¥${o.price}`);
+            const lane = q.ui === 'gui' ? `GUI 车道(携程,匿名公开价${q.backDate ? ',往返' : ''})` : '会话检索(携程,用户本人登录态)';
+            const cal = (r.calendar ?? []).slice(0, 14).map(d => `${d.date} ${d.price !== undefined ? `¥${d.price}` : (d.priceRaw ?? '?')}`);
+            const calBlock = cal.length > 0 ? `\n低价日历(匿名公开价,该航线哪些日期有票):\n${cal.join(' | ')}` : '';
+            const urlBlock = q.ui === 'gui' && r.listUrl ? `\nlistUrl(站点真实形状,#663 URL 教师):${r.listUrl.slice(0, 160)}` : '';
             const summary = r.verdict === 'hit'
-                ? `${q.from}→${q.to} ${q.date} 会话检索(携程,用户本人登录态)前 ${top.length} 条:\n${top.join('\n')}\n${r.evidence}`
+                ? `${q.from}→${q.to} ${q.date} ${lane}${(r.options ?? []).length > 0 ? ` 行情前 ${top.length} 条:\n${top.join('\n')}` : ''}${calBlock}${urlBlock}\n${r.evidence}`
                 : `会话检索未取回(${r.verdict}):${r.error ?? ''} ${r.evidence}`;
             return JSON.parse(JSON.stringify({
                 ...r, summary,

package/dist/src/llm-price-table.js

@@ -0,0 +1,148 @@
+/**
+ * The frozen LLM price table (ADR-20) and the one function that turns measured usage into dollars.
+ *
+ * Moved verbatim from `scripts/nightly-evidence.ts`, which re-exports it, so the nightly evidence producer, the
+ * persona simulation and the AaaS quota meter all price through the same code. Prices live in
+ * `data/llm-price-table.json` and change only by PR (never auto-applied). Pricing is a peak-conservative upper bound,
+ * an unknown model has no price, and usage a provider omitted is unprovable: both fail closed and never guess.
+ *
+ * Schema evolution (issue #49): `gotry_llm_price_table_v1` is DeepSeek only, with flat fields under `prices.<model>`;
+ * `gotry_llm_price_table_v2` is `providers.<id>.models.<model>`, provider-aware, and lets a provider without an
+ * off-peak column fill it with the peak price. `loadPriceTable` reads both.
+ */
+import { readFileSync } from 'node:fs';
+function round6(value) {
+    return Number(value.toFixed(6));
+}
+function assertPriceEntry(label, value) {
+    const entry = typeof value === 'object' && value !== null ? value : null;
+    if (!entry)
+        throw new Error(`${label} must be an object`);
+    for (const field of ['input_cache_miss_usd_per_1m_peak', 'input_cache_hit_usd_per_1m_peak', 'output_usd_per_1m_peak']) {
+        const num = entry[field];
+        if (typeof num !== 'number' || !Number.isFinite(num) || num < 0) {
+            throw new Error(`${label}.${field} must be a non-negative finite number`);
+        }
+    }
+    return value;
+}
+export function loadPriceTable(path) {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    const schemaVersion = raw['schema_version'];
+    if (schemaVersion === 'gotry_llm_price_table_v2') {
+        return loadPriceTableV2(raw);
+    }
+    if (schemaVersion === 'gotry_llm_price_table_v1') {
+        return loadPriceTableV1(raw);
+    }
+    throw new Error(`price table schema_version must be gotry_llm_price_table_v1 or _v2, got: ${String(schemaVersion)}`);
+}
+function loadPriceTableV1(raw) {
+    const aliases = typeof raw['aliases'] === 'object' && raw['aliases'] !== null ? raw['aliases'] : {};
+    for (const [from, to] of Object.entries(aliases)) {
+        if (typeof to !== 'string')
+            throw new Error(`price table alias ${from} must map to a model name`);
+    }
+    const prices = {};
+    for (const [name, entry] of Object.entries(typeof raw['prices'] === 'object' && raw['prices'] !== null ? raw['prices'] : {})) {
+        prices[name] = assertPriceEntry(`price table entry ${name}`, entry);
+    }
+    return { schema_version: 'gotry_llm_price_table_v1', aliases, prices };
+}
+/** v2 reader: providers.<id>.models.<model> flattened into one aliases/prices pair, so the exposed API does not change.
+ *  Lookup for a model name:
+ *    1. an alias jumps to its target (qualified `providerId:model`);
+ *    2. otherwise the qualified `providerId:model` key is looked up in prices;
+ *    3. otherwise the bare `model` key (transparent with one provider, e.g. MiniMax-M3 is unique under minimax:models);
+ *    4. still not found: fail closed. */
+function loadPriceTableV2(raw) {
+    const providersObj = typeof raw['providers'] === 'object' && raw['providers'] !== null ? raw['providers'] : null;
+    if (!providersObj)
+        throw new Error('price table v2 requires providers object');
+    const aliases = {};
+    const prices = {};
+    for (const [providerId, rawProvider] of Object.entries(providersObj)) {
+        const provider = assertProviderEntry(`price table provider ${providerId}`, rawProvider);
+        for (const [aliasName, target] of Object.entries(provider.aliases)) {
+            if (typeof target !== 'string')
+                throw new Error(`provider ${providerId} alias ${aliasName} must map to a model name`);
+            if (!provider.models[target]) {
+                throw new Error(`provider ${providerId} alias ${aliasName} -> ${target} has no entry; update data/llm-price-table.json via PR`);
+            }
+            aliases[aliasName] = target;
+        }
+        for (const [modelName, entry] of Object.entries(provider.models)) {
+            const qualified = `${providerId}:${modelName}`;
+            const validated = assertPriceEntry(`price table provider ${providerId} model ${modelName}`, entry);
+            if (prices[qualified])
+                throw new Error(`duplicate price table key ${qualified}`);
+            prices[qualified] = validated;
+            if (prices[modelName])
+                throw new Error(`duplicate price table key ${modelName} (across providers, disambiguate via aliases or qualified lookup)`);
+            prices[modelName] = validated;
+        }
+    }
+    return { schema_version: 'gotry_llm_price_table_v2', aliases, prices };
+}
+function assertProviderEntry(label, value) {
+    const entry = typeof value === 'object' && value !== null ? value : null;
+    if (!entry)
+        throw new Error(`${label} must be an object`);
+    const family = entry['family'];
+    if (typeof family !== 'string' || family.length === 0)
+        throw new Error(`${label}.family must be a non-empty string`);
+    const strategy = entry['price_strategy'];
+    if (strategy !== 'tiered_peak_offpeak' && strategy !== 'flat_no_offpeak') {
+        throw new Error(`${label}.price_strategy must be 'tiered_peak_offpeak' or 'flat_no_offpeak', got: ${String(strategy)}`);
+    }
+    const aliases = typeof entry['aliases'] === 'object' && entry['aliases'] !== null ? entry['aliases'] : {};
+    const models = typeof entry['models'] === 'object' && entry['models'] !== null ? entry['models'] : {};
+    return {
+        family,
+        price_strategy: strategy,
+        api_base: typeof entry['api_base'] === 'string' ? entry['api_base'] : undefined,
+        source_url: typeof entry['source_url'] === 'string' ? entry['source_url'] : undefined,
+        aliases,
+        models,
+    };
+}
+/** Dollars for one run's measured usage (peak-conservative upper bound: the table's peak columns, never a guess). */
+export function priceRunCost(model, usage, table) {
+    if (usage.responsesMissingUsage > 0) {
+        throw new Error(`usage provider omitted usage on ${usage.responsesMissingUsage} response(s) — cost unprovable, refusing to price (fail-closed)`);
+    }
+    const alias = table.aliases[model];
+    if (alias && !table.prices[alias])
+        throw new Error(`price table alias ${model} -> ${alias} has no entry; update data/llm-price-table.json via PR`);
+    const entry = table.prices[alias ?? model];
+    if (!entry)
+        throw new Error(`price table has no entry for model ${model}; update data/llm-price-table.json via PR (fail-closed, no guessed price)`);
+    const cost = (usage.inputCacheMissTokens * entry.input_cache_miss_usd_per_1m_peak
+        + usage.inputCacheHitTokens * entry.input_cache_hit_usd_per_1m_peak
+        + usage.outputTokens * entry.output_usd_per_1m_peak) / 1_000_000;
+    return round6(cost);
+}
+function nonNegativeInteger(name, value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        throw new RangeError(`${name} must be a non-negative integer`);
+    return value;
+}
+/** `priceRunCost` for one measured usage report. Malformed counts are rejected rather than priced. */
+export function priceMeasuredUsage(model, usage, table) {
+    const inputTokens = nonNegativeInteger('inputTokens', usage.inputTokens);
+    const outputTokens = nonNegativeInteger('outputTokens', usage.outputTokens);
+    const cacheReadTokens = nonNegativeInteger('cacheReadTokens', usage.cacheReadTokens ?? 0);
+    const costUsd = priceRunCost(model, {
+        calls: 1,
+        inputTokens: inputTokens + cacheReadTokens,
+        outputTokens,
+        inputCacheHitTokens: cacheReadTokens,
+        inputCacheMissTokens: inputTokens,
+        responsesMissingUsage: 0,
+    }, table);
+    return { tokens: inputTokens + cacheReadTokens + outputTokens, costUsd };
+}
+/** Throws unless the table prices `model`. Used at composition time so an unpriced model stops the service before any spend. */
+export function assertModelPriced(model, table) {
+    priceRunCost(model, { calls: 0, inputTokens: 0, outputTokens: 0, inputCacheHitTokens: 0, inputCacheMissTokens: 0, responsesMissingUsage: 0 }, table);
+}

package/dist/src/tenant-seam/index.js

@@ -0,0 +1,8 @@
+/**
+ * The trusted seam of the AaaS line (docs/rfc/aaas-rfc.md §4.4): tenant derivation from the authenticated caller, and
+ * the quotas and metering that keep one tenant or organization from moving another's latency budget. Outside the kernel.
+ */
+export * from './quotas.js';
+export * from './seam.js';
+export * from './llm-broker.js';
+export * from './process-governor.js';