@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/scripts/booking-copilot-dsh-planner-proof-tests.js

@@ -782,6 +782,54 @@ const invalidThenValidDecision = await invalidThenValid.plannerFactory(task).nex
 });
 assertRuntimeMaterializedOperation(invalidThenValidDecision, 'search.run', {}, task, 'a schema-rejected call may be superseded by the later unique typed success in the same run');
 await invalidThenValid.close();
+let schemaRepairRuns = 0;
+const schemaRejectedThenRepaired = await createDshEmbeddedBookingPlanner({
+    runPort: {
+        async run() {
+            schemaRepairRuns += 1;
+            if (schemaRepairRuns === 1) {
+                return {
+                    finalResponse: '',
+                    events: [
+                        toolCall('booking_search_hotels', invalidCallArguments, 'call-schema-rejected'),
+                        toolResult('call-schema-rejected', true, 'INVALID_ARGS'),
+                    ],
+                };
+            }
+            return { finalResponse: '', events: successfulToolEvents('booking_search_hotels', JSON.stringify({ decision: { kind: 'operation', action: searchRun, intent: { target: 'search.results' } } }), 'call-schema-repaired') };
+        },
+        async close() { },
+    },
+});
+const schemaRepairedDecision = await schemaRejectedThenRepaired.plannerFactory(task).next({
+    task,
+    turn: { schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId: 'dsh-schema-repair', workspace, request: { text: 'Find hotels' } },
+});
+assertRuntimeMaterializedOperation(schemaRepairedDecision, 'search.run', {}, task, 'one schema-shaped rejection is retried once and the repaired call is accepted');
+assert.equal(schemaRepairRuns, 2, 'schema rejection consumes a bounded retry attempt');
+await schemaRejectedThenRepaired.close();
+let repeatedSchemaRejectionRuns = 0;
+const repeatedSchemaRejections = await createDshEmbeddedBookingPlanner({
+    runPort: {
+        async run() {
+            repeatedSchemaRejectionRuns += 1;
+            return {
+                finalResponse: '',
+                events: [
+                    toolCall('booking_search_hotels', invalidCallArguments, 'call-repeated-schema-rejection'),
+                    toolResult('call-repeated-schema-rejection', true, 'INVALID_ARGS'),
+                ],
+            };
+        },
+        async close() { },
+    },
+});
+await assert.rejects(repeatedSchemaRejections.plannerFactory(task).next({
+    task,
+    turn: { schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId: 'dsh-repeated-schema-rejection', workspace, request: { text: 'Find hotels' } },
+}), /planner_invalid_typed_decision/, 'a schema-invalid repair must fail closed');
+assert.equal(repeatedSchemaRejectionRuns, 2, 'a turn gets only one schema repair retry even if the repair is rejected again');
+await repeatedSchemaRejections.close();
 const invalidWithoutSchemaRejection = await createDshEmbeddedBookingPlanner({
     runPort: {
         async run() {
@@ -1718,8 +1766,8 @@ const invalidCrossRun = await createDshEmbeddedBookingPlanner({
 await assert.rejects(invalidCrossRun.plannerFactory(task).next({
     task,
     turn: { schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId: 'dsh-cross-run-invalid', workspace, request: { text: 'Find hotels' } },
-}), /planner_invalid_tool_arguments/, 'a schema-invalid call cannot be washed into a valid action by a later provider run');
-assert.equal(invalidCrossRunRuns, 1, 'event-authority schema errors fail closed without a correction run');
+}), /planner_booking_intent_required/, 'a schema-invalid call gets one repair run, but a still-invalid repaired payload cannot become a valid action');
+assert.equal(invalidCrossRunRuns, 2, 'one bounded schema-repair retry, not an unbounded correction loop');
 await invalidCrossRun.close();
 const confirmedTask = {
     ...task,
@@ -2179,6 +2227,85 @@ assert.notDeepEqual(bootRejectResult, { testDeadline: true }, 'an expired handsh
 assert.equal(bootRejectResult[0]?.error?.code, 'PLANNER_BOOT_TIMEOUT', 'an expired local handshake is typed as a boot timeout');
 assert.equal(bootRejectPortClosed, 1, 'an expired handshake closes its owned run port');
 await bootRejectPlanner.close();
+// A cold first boot that exceeds the local handshake budget must not fail the
+// turn while deadline headroom remains: the failed boot warmed the OS page
+// cache, so one fresh-port retry converges (Danceiny/gotry#660). The retry
+// must not consume a provider attempt, and the failed port must be closed.
+let bootRetryFirstClosed = 0;
+let bootRetrySecondRuns = 0;
+let bootRetrySecondClosed = 0;
+let bootRetryPortIndex = 0;
+const bootRetryPlanner = await createDshEmbeddedBookingPlanner({
+    runPortFactory: () => {
+        bootRetryPortIndex += 1;
+        if (bootRetryPortIndex === 1) {
+            return {
+                run: () => Promise.reject(new Error('HARNESS_BOOT_TIMEOUT')),
+                async close() { bootRetryFirstClosed += 1; },
+                bootObservation: () => undefined,
+            };
+        }
+        return {
+            async run() {
+                bootRetrySecondRuns += 1;
+                return {
+                    finalResponse: '',
+                    events: successfulToolEvents('booking_search_hotels', JSON.stringify({ kind: 'search.run', input: {}, intent: { target: 'search.results' } }), 'call-boot-retry'),
+                };
+            },
+            async close() { bootRetrySecondClosed += 1; },
+        };
+    },
+    turnTimeoutMs: 30_000,
+});
+const bootRetryResult = await resolveWithin(bootRetryPlanner.plannerFactory(bootTimeoutTask).next({ task: bootTimeoutTask, turn: bootTimeoutTurn }), 250);
+assert.notDeepEqual(bootRetryResult, { testDeadline: true }, 'a retried boot stays inside the turn deadline');
+assert.equal(bootRetryResult[0]?.kind, 'operation', 'a fresh-port retry after a cold boot timeout produces the operation decision');
+assert.equal(bootRetryResult[0]?.action?.kind, 'search.run', 'the retried decision carries the capability action');
+assert.equal(bootRetryFirstClosed, 1, 'the failed boot port is closed by the retry');
+assert.ok(bootRetrySecondRuns >= 1, 'the fresh port actually ran the provider request');
+await bootRetryPlanner.close();
+// A fresh-port retry must never run on the port it just retired. A factory
+// that returns one shared instance hands the closed port back, and running it
+// rejects untyped out of next() (the #669 readiness-proof crash). Such a retry
+// cannot be funded, so each retry branch settles exactly as it does when the
+// deadline cannot fund one. These fakes reject like the real port once closed.
+let sharedBootFactoryCalls = 0;
+let sharedBootCloses = 0;
+const sharedBootPort = {
+    run: () => Promise.reject(new Error(sharedBootCloses > 0 ? 'booking_planner_run_port_closed' : 'HARNESS_BOOT_TIMEOUT')),
+    async close() { sharedBootCloses += 1; },
+    bootObservation: () => undefined,
+};
+const sharedBootPlanner = await createDshEmbeddedBookingPlanner({
+    runPortFactory: () => { sharedBootFactoryCalls += 1; return sharedBootPort; },
+    turnTimeoutMs: 30_000,
+});
+const sharedBootResult = await resolveWithin(sharedBootPlanner.plannerFactory(bootTimeoutTask).next({ task: bootTimeoutTask, turn: bootTimeoutTurn }), 250);
+assert.notDeepEqual(sharedBootResult, { testDeadline: true }, 'a refused boot retry settles inside the turn deadline');
+assert.equal(sharedBootResult[0]?.error?.code, 'PLANNER_BOOT_TIMEOUT', 'a boot retry handed its own retired port settles as the typed boot timeout');
+assert.equal(sharedBootFactoryCalls, 2, 'the boot retry asked the factory for a fresh port once');
+assert.equal(sharedBootCloses, 1, 'the retired port is closed exactly once and never run again');
+await sharedBootPlanner.close();
+let sharedStallFactoryCalls = 0;
+let sharedStallCloses = 0;
+const sharedStallPort = {
+    run: () => sharedStallCloses > 0
+        ? Promise.reject(new Error('booking_planner_run_port_closed'))
+        : new Promise((_resolve) => undefined),
+    async close() { sharedStallCloses += 1; },
+};
+const sharedStallPlanner = await createDshEmbeddedBookingPlanner({
+    runPortFactory: () => { sharedStallFactoryCalls += 1; return sharedStallPort; },
+    turnTimeoutMs: 30_000,
+    stallSoftBudgetMs: 20,
+});
+const sharedStallResult = await resolveWithin(sharedStallPlanner.plannerFactory(bootTimeoutTask).next({ task: bootTimeoutTask, turn: bootTimeoutTurn }), 500);
+assert.notDeepEqual(sharedStallResult, { testDeadline: true }, 'a refused stall retry settles inside the turn deadline');
+assert.equal(sharedStallResult[0]?.error?.code, 'PLANNER_PROVIDER_TIMEOUT', 'a stall retry handed its own retired port settles as the typed provider timeout');
+assert.equal(sharedStallFactoryCalls, 2, 'the stall retry asked the factory for a fresh port once');
+assert.equal(sharedStallCloses, 1, 'the stalled port is closed exactly once and never run again');
+await sharedStallPlanner.close();
 let taskAClosed = 0;
 let taskARuns = 0;
 let taskBRuns = 0;

package/dist/scripts/booking-copilot-dsh-readiness-proof.js

@@ -157,11 +157,15 @@ try {
     // The local boot budget must govern its own phase. With a model-stall budget
     // wider than the boot budget, only the explicit initialize deadline can
     // settle this turn inside the asserted window; the SDK's 10s fallback or the
-    // 13.3s stall budget would both land later and fail the bound below.
+    // 16s stall budget would both land later and fail the bound below.
+    // The 24s deadline funds the fresh-port boot retry (#669) with margin, but
+    // this factory hands back its one shared port, which the boot timeout has
+    // just retired: the planner must refuse to run on it and settle typed.
     phase = 'boot_budget_bound';
     const budgetGate = gate('boot-budget');
     port = await createRealRunPort({ stateRoot: root, env, dshBin: budgetGate.dshBin, maxTokens: 512 });
-    planner = await createDshEmbeddedBookingPlanner({ runPortFactory: () => port, turnTimeoutMs: 20_000 });
+    let budgetPortRequests = 0;
+    planner = await createDshEmbeddedBookingPlanner({ runPortFactory: () => { budgetPortRequests += 1; return port; }, turnTimeoutMs: 24_000 });
     const budgetAt = Date.now();
     const budgetResultPromise = planner.plannerFactory(task).next({ turn, task });
     await until(() => existsSync(budgetGate.marker), 3_000, 'boot-budget runtime never entered startup gate');
@@ -169,14 +173,15 @@ try {
     const budgetResult = await bounded(budgetResultPromise, 15_000, 'boot budget did not settle the turn');
     const budgetElapsedMs = Date.now() - budgetAt;
     assert.equal(budgetResult[0]?.kind === 'error' && budgetResult[0].error.code, 'PLANNER_BOOT_TIMEOUT');
+    assert.equal(budgetPortRequests, 2, 'the funded boot retry asked for a fresh port and was handed back the retired one');
     assert.ok(budgetElapsedMs >= PLANNER_BOOT_BUDGET_MS, `the boot budget must be consumed before it fires (${budgetElapsedMs}ms)`);
-    assert.ok(budgetElapsedMs < PLANNER_BOOT_BUDGET_MS + 6_000, `the local boot budget, not the 13.3s stall budget, must settle this turn (${budgetElapsedMs}ms)`);
+    assert.ok(budgetElapsedMs < PLANNER_BOOT_BUDGET_MS + 6_000, `the local boot budget, not the 16s stall budget, must settle this turn (${budgetElapsedMs}ms)`);
     assert.equal(requests.length, 1, 'a blocked handshake makes no provider request');
     await bounded(planner.close(), 3_000, 'boot-budget tree cleanup exceeded budget');
     planner = undefined;
     port = undefined;
     assert.ok(!alive(budgetPids.pid) && !alive(budgetPids.workerPid), 'boot-budget runtime and worker both reaped');
-    console.log('DSH READINESS BOOT BUDGET:', JSON.stringify({ budgetMs: PLANNER_BOOT_BUDGET_MS, elapsedMs: budgetElapsedMs, code: 'PLANNER_BOOT_TIMEOUT', providerRequests: 0, treeReaped: true }));
+    console.log('DSH READINESS BOOT BUDGET:', JSON.stringify({ budgetMs: PLANNER_BOOT_BUDGET_MS, elapsedMs: budgetElapsedMs, code: 'PLANNER_BOOT_TIMEOUT', providerRequests: 0, retryRefused: true, treeReaped: true }));
     phase = 'initialize_failure';
     const failedMarker = join(root, 'failed-start.json');
     const failedBin = join(root, 'failed-dsh.mjs');
@@ -191,6 +196,49 @@ try {
     port = undefined;
     assert.ok(!alive(failed.pid) && !alive(failed.workerPid), 'failed runtime and worker both reaped');
     console.log('DSH READINESS FAILURE CLASSIFICATION:', JSON.stringify({ exitCode: failed.exitCode, signal: failed.signal, error: 'HARNESS_START_FAILED', rawStderrExposed: false, providerRequests: 0, treeReaped: true }));
+    // A cold first boot that exceeds the local budget is retried on a fresh
+    // runtime while the deadline still funds a viable run (#669). The first
+    // runtime stays blocked before initialize; the second is released up front,
+    // so it completes initialize and reaches the provider, which never answers.
+    // The 24s deadline funds the retry with margin on a slow host, and the 9s
+    // stall budget ends the stalled second run before a third boot fits.
+    phase = 'boot_retry_fresh_port';
+    const retryCold = gate('retry-cold');
+    const retryWarm = gate('retry-warm');
+    writeFileSync(retryWarm.release, 'release');
+    const retryPorts = [];
+    planner = await createDshEmbeddedBookingPlanner({
+        runPortFactory: async () => {
+            const dshBin = (retryPorts.length === 0 ? retryCold : retryWarm).dshBin;
+            const created = await createRealRunPort({ stateRoot: root, env, dshBin, maxTokens: 512 });
+            retryPorts.push(created);
+            return created;
+        },
+        turnTimeoutMs: 24_000,
+        stallSoftBudgetMs: 9_000,
+    });
+    const requestsBeforeRetry = requests.length;
+    const retryAt = Date.now();
+    const retryResultPromise = planner.plannerFactory(task).next({ turn, task });
+    await until(() => existsSync(retryCold.marker), 3_000, 'cold retry runtime never entered startup gate');
+    const coldRetryPids = retryCold.pids();
+    evidence = { ...coldRetryPids, providerRequests: requests.length };
+    await until(() => existsSync(retryWarm.marker), 15_000, 'the boot timeout never retried on a fresh runtime');
+    const retriedAfterMs = Date.now() - retryAt;
+    const warmRetryPids = retryWarm.pids();
+    assert.ok(retriedAfterMs >= PLANNER_BOOT_BUDGET_MS, `the retry waits for the local boot budget (${retriedAfterMs}ms)`);
+    assert.ok(retriedAfterMs < PLANNER_BOOT_BUDGET_MS + 6_000, `the local boot budget, not the SDK fallback, triggers the retry (${retriedAfterMs}ms)`);
+    assert.ok(!alive(coldRetryPids.pid) && !alive(coldRetryPids.workerPid), 'the timed-out runtime is reaped before the fresh one starts');
+    await until(() => requests.length === requestsBeforeRetry + 1, 10_000, 'the fresh runtime never reached the provider');
+    const retryResult = await bounded(retryResultPromise, 20_000, 'the retried turn did not settle');
+    const retryElapsedMs = Date.now() - retryAt;
+    assert.equal(retryResult[0]?.kind === 'error' && retryResult[0].error.code, 'PLANNER_PROVIDER_TIMEOUT', 'a retried boot that reached a stalled provider is a provider timeout, not a boot timeout');
+    assert.equal(retryPorts.length, 2, 'exactly one fresh-port retry');
+    assert.equal(requests.length, requestsBeforeRetry + 1, 'only the fresh runtime made a provider request');
+    await bounded(planner.close(), 3_000, 'boot-retry tree cleanup exceeded budget');
+    planner = undefined;
+    assert.ok(!alive(warmRetryPids.pid) && !alive(warmRetryPids.workerPid), 'the fresh runtime and worker are reaped on close');
+    console.log('DSH READINESS BOOT RETRY:', JSON.stringify({ budgetMs: PLANNER_BOOT_BUDGET_MS, retriedAfterMs, elapsedMs: retryElapsedMs, code: 'PLANNER_PROVIDER_TIMEOUT', ports: retryPorts.length, providerRequests: 1, treeReaped: true }));
     // Opt-in distribution run: boot fresh runtimes back to back so the local
     // initialize budget can be set from measured percentiles instead of a guess.
     // Each sample is a new worker plus a new dsh home, so the page cache is the
@@ -235,4 +283,4 @@ finally {
     if (failedCleanup?.status === 'rejected')
         throw failedCleanup.reason;
 }
-console.log('BOOKING COPILOT DSH READINESS PROOF: real initialize, provider stall, cold timeout and process cleanup OK');
+console.log('BOOKING COPILOT DSH READINESS PROOF: real initialize, provider stall, cold timeout, boot retry and process cleanup OK');

package/dist/scripts/booking-copilot-gateway-chat-adapter-tests.js

@@ -0,0 +1,233 @@
+/**
+ * Proof tests for the gateway chat-completions LLM plugin
+ * (dsh-llm-gateway-chat.js): wire dialect against a mock OpenAI-style
+ * chat/completions server, patch wiring, and provider selection.
+ *
+ * Run: npx tsx scripts/booking-copilot-gateway-chat-adapter-tests.ts
+ */
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+// A string-typed specifier keeps TypeScript from resolving the undeclared JS
+// module; GatewayChatModule above is the surface this proof relies on.
+const GATEWAY_CHAT_MODULE = '../src/booking-surface/dsh-llm-gateway-chat.js';
+const { GatewayChatAdapter } = await import(GATEWAY_CHAT_MODULE);
+const { buildDshEmbeddedBookingPatch, resolveRealRunPortConfig } = await import('../src/booking-surface/dsh-planner.js');
+function chunksOf(chunks, type) {
+    return chunks.filter((chunk) => chunk.type === type);
+}
+function firstChunk(chunks, type) {
+    const [chunk] = chunksOf(chunks, type);
+    assert.ok(chunk, `expected a ${type} chunk`);
+    return chunk;
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+}
+function sse(res, frames) {
+    res.writeHead(200, { 'content-type': 'text/event-stream' });
+    for (const frame of frames)
+        res.write(frame);
+    res.end('data: [DONE]\n\n');
+}
+async function withMockServer(handler, run) {
+    const server = createServer(handler);
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    try {
+        const address = server.address();
+        assert.ok(address !== null && typeof address === 'object', 'mock server listens on a TCP port');
+        return await run(address.port);
+    }
+    finally {
+        server.close();
+    }
+}
+function adapterFor(port, captured) {
+    return new GatewayChatAdapter({
+        resolveConnection: () => ({ baseURL: `http://127.0.0.1:${port}/v1`, models: [] }),
+        resolveApiKey: async () => 'test-only-key',
+        providerName: 'Gateway Chat',
+        ...(captured !== undefined ? { __captured: captured } : {}),
+    });
+}
+// 1. A tool-calling stream translates to harness chunks: text block, tool-call
+//    accumulation across deltas, deferred block-ends, usage, and tool-calls finish.
+{
+    const requests = [];
+    const chunks = await withMockServer((req, res) => {
+        let body = '';
+        req.on('data', (c) => { body += c; });
+        req.on('end', () => {
+            requests.push(JSON.parse(body));
+            sse(res, [
+                'data: {"choices":[{"delta":{"role":"assistant","content":"Let me search"}}]}\n\n',
+                'data: {"choices":[{"delta":{"tool_calls":[{"index":0,"id":"call_1","function":{"name":"booking_search_hotels","arguments":"{\\"input\\":"}}]}}]}\n\n',
+                'data: {"choices":[{"delta":{"tool_calls":[{"index":0,"function":{"arguments":"{\\"destination\\":\\"Osaka\\"}"}}]}}]}\n\n',
+                'data: {"choices":[{"delta":{},"finish_reason":"tool_calls"}],"usage":{"prompt_tokens":100,"completion_tokens":20,"total_tokens":120,"prompt_tokens_details":{"cached_tokens":40},"completion_tokens_details":{"reasoning_tokens":5}}}\n\n',
+            ]);
+        });
+    }, async (port) => {
+        const out = [];
+        for await (const chunk of adapterFor(port).stream({
+            provider: 'gateway-chat',
+            model: 'deepseek-flash',
+            messages: [
+                { role: 'system', content: [{ type: 'text', text: 'planner system prompt' }] },
+                { role: 'user', content: [{ type: 'text', text: 'hotels in Osaka' }] },
+            ],
+            tools: [{ name: 'booking_search_hotels', description: 'search hotels', parameters: { type: 'object', properties: {} } }],
+            maxTokens: 16_384,
+        }))
+            out.push(chunk);
+        return out;
+    });
+    assert.equal(requests.length, 1);
+    assert.equal(requests[0].model, 'deepseek-flash');
+    assert.deepEqual(requests[0].messages.map((m) => m.role), ['system', 'user']);
+    assert.equal(requests[0].tools?.[0].type, 'function');
+    assert.equal(requests[0].tools?.[0].function.name, 'booking_search_hotels');
+    assert.equal(requests[0].stream, true);
+    assert.deepEqual(requests[0].stream_options, { include_usage: true });
+    // The harness profile runs the planner with thinking enabled at high effort
+    // (rc.1 wire parity); dropping these fields measurably degrades the model's
+    // adherence to the planner's intent rules.
+    assert.deepEqual(requests[0].thinking, { type: 'enabled' });
+    assert.equal(requests[0].reasoning_effort, 'high');
+    const kinds = chunks.map((c) => c.type);
+    assert.deepEqual(kinds, ['block-start', 'text-delta', 'block-start', 'tool-call-delta', 'tool-call-delta', 'block-end', 'block-end', 'usage', 'finish']);
+    const text = firstChunk(chunks, 'text-delta');
+    assert.equal(text.text, 'Let me search');
+    const toolDelta = chunksOf(chunks, 'tool-call-delta');
+    assert.equal(toolDelta[0].id, 'call_1');
+    assert.equal(toolDelta[0].name, 'booking_search_hotels');
+    assert.equal(toolDelta.map((c) => c.argumentsDelta).join(''), '{"input":{"destination":"Osaka"}');
+    const ends = chunksOf(chunks, 'block-end');
+    assert.equal(ends[0].block.type, 'text');
+    const toolBlock = ends[1].block;
+    assert.ok(toolBlock.type === 'tool-call', 'the second block closes the tool call');
+    assert.equal(toolBlock.arguments, '{"input":{"destination":"Osaka"}');
+    const usage = firstChunk(chunks, 'usage');
+    assert.equal(usage.usage.inputTokens, 60, 'cache reads subtract from prompt tokens');
+    assert.equal(usage.usage.outputTokens, 20);
+    assert.equal(usage.usage.totalTokens, 120);
+    assert.equal(usage.usage.cacheReadTokens, 40);
+    assert.equal(usage.usage.reasoningTokens, 5);
+    const finish = firstChunk(chunks, 'finish');
+    assert.deepEqual(finish.reason, { kind: 'tool-calls' });
+}
+// 2. Tool-result history round-trips as `role:"tool"` wire messages.
+{
+    const requests = [];
+    await withMockServer((req, res) => {
+        let body = '';
+        req.on('data', (c) => { body += c; });
+        req.on('end', () => {
+            requests.push(JSON.parse(body));
+            sse(res, [
+                'data: {"choices":[{"delta":{"content":"done"}}]}\n\n',
+                'data: {"choices":[{"delta":{},"finish_reason":"stop"}]}\n\n',
+            ]);
+        });
+    }, async (port) => {
+        const out = [];
+        for await (const chunk of adapterFor(port).stream({
+            provider: 'gateway-chat',
+            model: 'deepseek-flash',
+            reasoningEffort: 'off',
+            messages: [
+                { role: 'user', content: [{ type: 'text', text: 'hotels in Osaka' }] },
+                { role: 'assistant', content: [{ type: 'tool-call', id: 'call_9', name: 'booking_search_hotels', arguments: '{"input":{}}' }] },
+                { role: 'user', content: [{ type: 'tool-result', toolCallId: 'call_9', content: [{ type: 'text', text: '598 hotels' }] }] },
+            ],
+        }))
+            out.push(chunk);
+        return out;
+    });
+    assert.deepEqual(requests[0].thinking, { type: 'disabled' }, 'reasoningEffort=off maps to thinking disabled');
+    assert.equal(requests[0].reasoning_effort, undefined, 'off never crosses the wire as an effort');
+    const roles = requests[0].messages.map((m) => m.role);
+    assert.deepEqual(roles, ['user', 'assistant', 'tool']);
+    assert.equal(requests[0].messages[1].tool_calls?.[0].id, 'call_9');
+    assert.equal(requests[0].messages[2].tool_call_id, 'call_9');
+    assert.equal(requests[0].messages[2].content, '598 hotels');
+}
+// 3. HTTP failure statuses map to typed LlmError codes.
+{
+    await withMockServer((req, res) => {
+        res.writeHead(401, { 'content-type': 'application/json' });
+        res.end('{"error":"bad key"}');
+    }, async (port) => {
+        await assert.rejects(() => adapterFor(port).stream({ provider: 'gateway-chat', model: 'm', messages: [{ role: 'user', content: [{ type: 'text', text: 'x' }] }] }).next(), (error) => errorCode(error) === 'AUTH');
+    });
+}
+// 4. A stream that dies before [DONE] is STREAM_CLOSED, never a silent success.
+{
+    await withMockServer((req, res) => {
+        res.writeHead(200, { 'content-type': 'text/event-stream' });
+        res.write('data: {"choices":[{"delta":{"content":"partial"}}]}\n\n');
+        res.end();
+    }, async (port) => {
+        await assert.rejects(() => adapterFor(port).stream({ provider: 'gateway-chat', model: 'm', messages: [{ role: 'user', content: [{ type: 'text', text: 'x' }] }] }).next(), () => true).catch((error) => {
+            // first next() may surface the text-delta fine; the failure lands on the
+            // following tick — drain to the throw.
+        });
+        let saw = false;
+        try {
+            for await (const _chunk of adapterFor(port).stream({ provider: 'gateway-chat', model: 'm', messages: [{ role: 'user', content: [{ type: 'text', text: 'x' }] }] })) {
+                void _chunk;
+            }
+        }
+        catch (error) {
+            saw = errorCode(error) === 'STREAM_CLOSED';
+        }
+        assert.ok(saw, 'a truncated stream must surface STREAM_CLOSED');
+    });
+}
+// 4b. Exact model metadata satisfies the harness INVALID_MODEL_INFO gate
+//     (provider/id/name required) and prepareCall returns the { model } shape.
+{
+    const adapter = adapterFor(1);
+    const info = await adapter.resolveModel('gateway-chat', 'deepseek-flash');
+    assert.equal(info.provider, 'gateway-chat');
+    assert.equal(info.id, 'deepseek-flash');
+    assert.equal(info.name, 'deepseek-flash');
+    assert.ok(info.context.contextWindow > 0);
+    assert.ok(info.reasoning.efforts.some((e) => e.id === 'off'));
+    const prepared = await adapter.prepareCall('gateway-chat', 'deepseek-flash');
+    assert.equal(prepared.model.id, 'deepseek-flash');
+    assert.equal(typeof prepared.stream, 'function');
+}
+// 5. The patch renders both plugin inserts: the typed tools plugin and the
+//    gateway chat-completions LLM plugin.
+{
+    const patch = buildDshEmbeddedBookingPatch('/tools/plugin.js', '/llm/gateway.js');
+    assert.match(patch, /- id: gotry-embedded-booking\n/);
+    assert.match(patch, /name: '\/tools\/plugin\.js'/);
+    assert.match(patch, /- id: llm-gateway-chat\n/);
+    assert.match(patch, /name: '\/llm\/gateway\.js'/);
+    const minimal = buildDshEmbeddedBookingPatch('/tools/plugin.js');
+    assert.match(minimal, /gotry-embedded-booking/);
+    assert.doesNotMatch(minimal, /llm-gateway-chat/);
+}
+// 6. Provider selection: DEEPSEEK_PROVIDER rides the child env and selects the
+//    gateway route without an explicit option.
+{
+    const resolved = resolveRealRunPortConfig({
+        env: {
+            DEEPSEEK_API_KEY: 'k',
+            DEEPSEEK_BASE_URL: 'http://gw/v1',
+            DEEPSEEK_MODEL: 'deepseek-flash',
+            DEEPSEEK_PROVIDER: 'gateway-chat',
+        },
+    });
+    assert.equal(resolved.provider, 'gateway-chat');
+    assert.equal(resolved.childEnv.DEEPSEEK_PROVIDER, 'gateway-chat');
+    const fallback = resolveRealRunPortConfig({
+        env: {
+            DEEPSEEK_API_KEY: 'k',
+            DEEPSEEK_MODEL: 'deepseek-flash',
+        },
+    });
+    assert.equal(fallback.provider, 'deepseek-official');
+    assert.equal(fallback.childEnv.DEEPSEEK_PROVIDER, undefined);
+}
+console.log('BOOKING COPILOT GATEWAY CHAT ADAPTER PROOF: wire dialect/tool round-trip/status mapping/patch wiring/provider selection OK');

package/dist/scripts/booking-copilot-planner-live-probe.js

@@ -67,6 +67,7 @@ try {
             DEEPSEEK_API_KEY: apiKey,
             DEEPSEEK_BASE_URL: baseUrl,
             DEEPSEEK_MODEL: model,
+            ...(process.env.DEEPSEEK_PROVIDER ? { DEEPSEEK_PROVIDER: process.env.DEEPSEEK_PROVIDER } : {}),
         },
         // Match the UAT deployment deadline (planner-model-plane.yaml turnTimeoutMs).
         turnTimeoutMs: 45_000,

package/dist/scripts/booking-copilot-startup-proof-tests.js

@@ -68,7 +68,7 @@ const started = await startBookingCopilotFromEnvironment(trustedEnv, {
     ingressBinding: trustedBinding,
     principal: { subject: 'startup-bff', scope: 'booking:read' },
     async startServer(options) {
-        serverApiKey = options.apiKey;
+        serverApiKey = options.apiKey ?? '';
         serverArtifactId = options.artifactId ?? '';
         assert.equal(options.ingressMode, 'bff-ingress-binding');
         return {

package/dist/scripts/bootstrap-tests.js

@@ -103,12 +103,22 @@ assert.ok(!c7b.out.includes('下载通道'), '非法值不应进入 github 通
 console.log('7. 扩展分发 github 通道(不可达基址即时降级 + 非法值回落 bundled)OK');
 // 8. doctor 子命令(2026-09-02 迪拜 session 复盘:可选依赖不撒手——doctor 统一
 //    显示状态 + 精确补装指引;LLM key 显式让渡;报告落 gotry-state/doctor-report.md)
-const c8 = runBootstrap(['doctor'], {});
+const doctorHome = mkdtempSync(join(tmpdir(), 'gotry-doctor-home-'));
+let c8;
+try {
+    c8 = runBootstrap(['doctor'], { HOME: doctorHome, FLYAI_API_KEY: '', DEBUG_FLYAI_API_KEY: '', STAICLI_HOME: join(doctorHome, '.staicli'), HOTELBYTE_TOKEN: '' });
+}
+finally {
+    rmSync(doctorHome, { recursive: true, force: true });
+}
 assert.ok(c8.out.includes('[gotry-doctor]'), '应输出 [gotry-doctor] 标签');
 assert.ok(c8.out.includes('Agent Reach'), '体检应含 agent-reach 项');
 assert.ok(c8.out.includes('hbcli'), '体检应含 hbcli 项');
 assert.ok(c8.out.includes('FlyAI(飞猪官方检索'), '体检应含 flyai 项');
-assert.ok(c8.out.includes('匿名试用') || c8.out.includes('已配置,未验证'), '体检应明确 FlyAI 当前未验证/匿名降级面');
+// FlyAI 面三合法态(doctor.ts #521:configured≠verified):匿名试用 / 已配置,未验证 / 已验证。
+// 机器态依赖断言:本机配置并验证过 key 的环境(如 founder 机)doctor 输出「已验证 …」,
+// 两态断言会把健康态误判为红(2026-10-14 发版门禁实测)。
+assert.ok(c8.out.includes('匿名试用') || c8.out.includes('已配置,未验证') || c8.out.includes('已验证'), '体检应明确 FlyAI 当前状态(匿名试用/已配置,未验证/已验证)');
 assert.ok(c8.out.includes('LLM key'), '体检应含 LLM key 让渡说明(doctor 不管 key)');
 assert.ok(c8.out.includes('dsh-map-tools'), '体检应含 dsh-map-tools 项(#139;与 ts/capabilities/doctor.ts 两面成对)');
 assert.ok(c8.out.includes('dsh-tool-ask-user'), '体检应含 dsh-tool-ask-user 项(与 ts/capabilities/doctor.ts 两面成对)');
@@ -396,6 +406,7 @@ console.log('18. onboarding CLI 跳过(非 TTY / CI / GOTRY_SETUP_SKIP / GOTRY_O
     copyFileSync(join(repoRoot, 'bin', 'gotry-flyai-verification.js'), join(fixture, 'bin', 'gotry-flyai-verification.js'));
     copyFileSync(join(repoRoot, 'bin', 'gotry-process-liveness.js'), join(fixture, 'bin', 'gotry-process-liveness.js'));
     copyFileSync(join(repoRoot, 'bin', 'gotry-extension-status.js'), join(fixture, 'bin', 'gotry-extension-status.js'));
+    copyFileSync(join(repoRoot, 'bin', 'gotry-hbcli-release.js'), join(fixture, 'bin', 'gotry-hbcli-release.js'));
     copyFileSync(join(repoRoot, 'package.json'), join(fixture, 'package.json'));
     const vendorDir = join(fixture, 'ts', 'dsh-runtime', 'vendor');
     mkdirSync(vendorDir, { recursive: true });
@@ -647,6 +658,7 @@ function buildPkgFixture(tmpRoot) {
     copyFileSync(join(repoRoot, 'bin', 'gotry-bootstrap.js'), join(pkgBin, 'gotry-bootstrap.js'));
     copyFileSync(join(repoRoot, 'bin', 'gotry-flyai-verification.js'), join(pkgBin, 'gotry-flyai-verification.js'));
     copyFileSync(join(repoRoot, 'bin', 'gotry-extension-status.js'), join(pkgBin, 'gotry-extension-status.js'));
+    copyFileSync(join(repoRoot, 'bin', 'gotry-hbcli-release.js'), join(pkgBin, 'gotry-hbcli-release.js'));
     copyFileSync(join(repoRoot, 'bin', 'gotry-runtime-resolution.js'), join(pkgBin, 'gotry-runtime-resolution.js'));
     copyFileSync(join(repoRoot, 'bin', 'gotry-process-liveness.js'), join(pkgBin, 'gotry-process-liveness.js'));
     copyFileSync(join(repoRoot, 'cordis.gotry-patch.yml'), join(pkgRoot, 'cordis.gotry-patch.yml'));
@@ -1508,8 +1520,9 @@ console.log('23. result 通道排他写入(预存文件不被覆盖 + symlink
     assert.deepEqual(unit('not json'), { ok: true, customer: false }, '非 JSON(超旧版/异常)保守视为有效,与工具层同语义');
     assert.deepEqual(unit(''), { ok: true, customer: false }, '空输出同属不可解析,保守视为有效');
     assert.deepEqual(unit(null), { ok: false, customer: false }, '取不到输出(非零退出/超时/spawn 失败)→ 未确认');
-    const fakeHbcli = (whoamiArm) => `#!/bin/sh\ncase "$*" in\n  *--version*) echo '0.0.4';;\n  *version*) echo '0.0.4';;\n  *whoami*) ${whoamiArm};;\nesac\n`;
+    const fakeHbcli = (whoamiArm, version = '0.0.4') => `#!/bin/sh\ncase "$*" in\n  *--version*) echo '${version}';;\n  *version*) echo '${version}';;\n  *whoami*) ${whoamiArm};;\nesac\n`;
     const cases = [
+        { name: 'old-version', version: '0.0.3', arm: `echo '${allFalse.replace('"api_key":{"configured":false}', '"api_key":{"configured":true}')}'`, expect: 'missing' },
         { name: 'allfalse', arm: `echo '${allFalse}'`, expect: 'degraded' },
         { name: 'customer', arm: `echo '${allFalse.replace('"customer":{"configured":false}', '"customer":{"configured":true}')}'`, expect: 'ok', customer: true },
         { name: 'apikey', arm: `echo '${allFalse.replace('"api_key":{"configured":false}', '"api_key":{"configured":true}')}'`, expect: 'ok' },
@@ -1527,12 +1540,12 @@ console.log('23. result 通道排他写入(预存文件不被覆盖 + symlink
                 mkdirSync(binDir);
                 mkdirSync(home);
                 symlinkSync(process.execPath, join(binDir, 'node'));
-                writeFileSync(join(binDir, 'hbcli'), fakeHbcli(c.arm), { mode: 0o755 });
+                writeFileSync(join(binDir, 'hbcli'), fakeHbcli(c.arm, c.version), { mode: 0o755 });
                 // CLI 面
                 const cli = runBootstrap(['doctor'], { HOME: home, PATH: binDir, FLYAI_API_KEY: '' });
                 const line = cli.out.split('\n').find((l) => l.includes('hbcli(酒店实时源)'));
                 assert.ok(line, `${c.name}: CLI doctor 应输出 hbcli 行\n${cli.out}`);
-                const cliLevel = line.includes('已安装且凭证有效') ? 'ok' : line.includes('二进制在,但凭证未配置/失效') ? 'degraded' : 'other';
+                const cliLevel = line.includes('已安装且凭证有效') ? 'ok' : line.includes('二进制在,但凭证未配置/失效') ? 'degraded' : line.includes('版本过旧') ? 'missing' : 'other';
                 assert.equal(cliLevel, c.expect, `${c.name}: CLI doctor 的 hbcli 结论应为 ${c.expect}\n${line}`);
                 if (c.customer)
                     assert.ok(line.includes('customer 档在用'), `${c.name}: CLI 应标注 customer 档在用\n${line}`);
@@ -1542,6 +1555,10 @@ console.log('23. result 通道排他写入(预存文件不被覆盖 + symlink
                 process.env.PATH = prevPath;
                 assert.equal(tool.status, c.expect, `${c.name}: 工具层 doctor 的 hbcli 结论应为 ${c.expect},实际 ${tool.status}`);
                 assert.equal(cliLevel, tool.status, `${c.name}: CLI 与工具层必须同结论(两份实现不得漂移)`);
+                if (c.expect === 'missing') {
+                    assert.match(cli.out, /staicli-v0\.0\.4\/install\.sh/, 'CLI 应提供当前官方版本的安装入口');
+                    assert.match(tool.fix ?? '', /staicli-v0\.0\.4\/install\.sh/, '工具层应提供相同升级入口');
+                }
             }
             finally {
                 process.env.PATH = prevPath;
@@ -1560,5 +1577,5 @@ console.log('23. result 通道排他写入(预存文件不被覆盖 + symlink
         catch { /* ignore */ }
     }
 }
-console.log('24. hbcli 凭证判定(CLI doctor 按 whoami 三档 JSON 判,不看退出码;与工具层 doctor 对拍 5 夹具同结论:全 false=degraded / customer·api_key=ok / 非 JSON=保守 ok / 非零退出=degraded)OK');
+console.log('24. hbcli 版本与凭证判定(CLI↔工具层 6 夹具同结论:旧版=missing / 全 false=degraded / customer·api_key=ok / 非 JSON=保守 ok / 非零退出=degraded)OK');
 console.log('BOOTSTRAP TESTS: 26/26 OK(扩展就位 + 跳过开关 / wizard --dry-run / wizard 真实 / 扩展分发通道 / doctor 体检面 / calendar setup 状态面 / 显式跳过 + auto 跳过 + 单项跳过 / 启动摘要 / sidebar 落盘状态复核 / onboarding 分类+计划+env opt-out+跳过原因+yes+partial-failure+幂等+prompt+CLI 跳过+--scan / 编排缝 orchestrateWebLaunch × 6 / prompt waiter failure deterministic process-group reap / waiter 原始错误 + cleanup timeout/failure handled / 临时安装包 spawned inner 21a TTY-eligible 真实 prompt→n→web + 摘要抑制 + 无残留 / 21b non-TTY 零 prompt / 21c POSIX 信号清理 SIGTERM→清 result+patch 目录 + 无残留子进程 / 21f yes-path installer 子树信号清理 / 21g yes-path timeout installer 子树清理 / 21d timeout 诊断 + 无残留 / 21e dsh-lifecycle 信号转发 / win32 平台边界 / result 通道排他写入 / hbcli 凭证判定 CLI↔工具层对拍)');