v0.2.0-rc.31

Why this release. FlyAI setup required a terminal command, and generated files were hard to find again. This release puts configuration in the native Plugins → GoTry panel and adds a GoTry artifacts tab to the native right workbench (#651, #653). The extension manifest stays paired at 0.2.0.31; its behavior is unchanged.

What's New (since rc.30)

• Visual FlyAI configuration — open the console, enter a masked key, verify and save, refresh status or clear configuration. Environment-provided keys are read-only. Failed verification and cancellation preserve the previous key; secret values never enter model tools or status responses.
• Native artifact workbench — browse history, handoff tickets and workspace files with search, pagination and native previews. Successful bounded renders produce file delivery cards. No additional Artifacts plugin is required, and browsing does not call a model.
• Truthful extension diagnostics and terminal setup — doctor distinguishes an installed extension from a connected browser session. The terminal setup shares the bounded verifier and propagates cancellation cleanly (#652).

Installation

Run npx @danceiny/gotry@0.2.0-rc.31 web (Node ≥ 22.15). Once latest points to this version, npx @danceiny/gotry web is equivalent; pin the exact version if your registry mirror lags.

Acceptance boundary

Full-stack regression and installed-package browser checks cover saving, rejected-key preservation, clearing, artifact browsing and native delivery with isolated state and controlled upstream responses. These checks do not establish acceptance with a real FlyAI account. Publication is established only by a passing registry pull-back receipt.

---

Added

• add native FlyAI setup and artifact workbench… (#653)

Fixed

• 避免商店扩展误报并降低 FlyAI 配置门槛… (#652)

Documentation

• align version baselines with verified rc.30 publish… (#650)

v0.2.0-rc.30

Why this release. A deep-planning turn could hit its deadline, reject the draft write, and save only an open handoff ticket, while the final reply still promised a created file and a background planner (#647). This release ties those promises to the actual write result and native job lifecycle, and makes the draft and final deliverable openable. The version remains paired with the extension manifest (0.2.0.30, enforced by extension-tests); the extension's behavior is unchanged.

What's New (since rc.29)

Fixes

• Deadline handoffs preserve the real draft result — the pending draft write runs once before the turn converges. A failed write stays a failure; the native present tool can display a file that was actually created.
• Background planning has an owned native job — persistent hosts start a session-owned job and record its id. One-shot or executor-less launches remain queued. The planner keeps the original working directory, user answers and bounded evidence; repeated handoffs reuse the ticket. Startup failure, execution failure, timeout, cancellation and completion settle durably. Settlement waits for the full managed process range to exit; a cleanup-observation error explicitly reports that cleanup could not be confirmed. Stderr is not a successful planning deliverable.
• Drafts and results can be opened and found again — native file cards and side-panel preview expose the actual files, and the final result can be listed or read through GoTry artifacts by its ticket id.

Release tooling (not in the npm package)

• OIDC publishes the tarball as a file path (#645) — npm receives an explicit relative file path rather than interpreting the bare path as a git shorthand before the identity exchange.
• Pull-back receipts preserve the publication route (#644) — the docs follow-up records the workflow and its run URL when the workflow published the package.

Installation

Run npx @danceiny/gotry@0.2.0-rc.30 web (Node ≥ 22.15). Once latest points to this version, npx @danceiny/gotry web is equivalent; pin the exact version if your registry mirror lags.

Acceptance boundary

The handoff regression and isolated browser checks use synthetic model and planner responses with real native jobs, managed processes, notifications and file presentation. Installed real-session acceptance for #647 still requires loading the fix; the original unexecuted ticket remains unexecuted.

---

Fixed

• 对齐后台执行状态与可打开交付物… (#648)
• the pull-back receipt records which route published the version… (#644)
• the OIDC publish step hands npm the tarball as a file path… (#645)

Documentation

• rc.29 is published and pulled back… (#646)

v0.2.0-rc.29

Why this release. rc.28 turned a solver crash into an explicit solver_error instead of a false "your trip is infeasible" (#620). That left the bundled Yunnan pack ending in a solver_error instead of a plan: its yn0 leg (Kunming → Lijiang after the 8.4 landing) has no calibrated buffer or transfer minutes, and only the founder can supply those (#635). The pack now solves over its four attached legs and keeps yn0 as advisory. The release also finishes the Chrome Web Store rename inside the product: doctor, the setup and wizard text and the tool descriptions now say Stai Travel Bridge, the name the listing has carried since it went live on 2026-10-04. The version stays paired with the extension manifest (0.2.0.29, enforced by extension-tests); the extension's behavior is unchanged.

What's New (since rc.28)

Fixes

• The bundled Yunnan pack solves again (#635) — yn0 moves from legs to a new advisory_legs section of data/yunnan-pack.json, with its reason stated: its buffer, origin-transfer and destination-transfer minutes are real-world facts only the founder can calibrate, and nothing is invented in their place. No reader consumes advisory_legs, so the parser, the solver and the kernel-pinned files are untouched. Before, solveUnified on this pack returned solver_error (solver_input_not_integer); the product's own pure-TypeScript solveChoiceSegment entry was never affected. Once the three minutes exist, putting yn0 back into legs is the whole change. A test now audits every shipped pack for the three integer fields, and the persona dry run's Yunnan row is feasible.
• One name for the extension: Stai Travel Bridge (#637) — after the listing was renamed, the setup and wizard lines, the needs-extension summaries, the doctor item label and the channel and tool descriptions still said "GoTry Session Bridge". They now say what the Chrome Web Store shows. The store link and the extension's identity are unchanged. A script that matches the old doctor label text must use the new one.

Release tooling (not in the npm package)

• The npm release is one verified command (#641) — scripts/publish-npm.sh runs a preflight that lists every blocker before the first approval click. "Published" is gated on a registry pull-back receipt, and the GitHub Release and the docs follow-up both read that receipt. CI can be dispatched on a tag, so a tag commit whose push run was cancelled can still carry its own proof. The procedure is docs/ops/npm-release-runbook.md.
• A publish workflow for npm Trusted Publishing (#642) — .github/workflows/npm-publish.yml is dispatch-only and rehearses by default. It lets a release run with no approval click and no npm credential, and the job that holds the identity runs nothing installed after checkout. It needs a one-time Trusted Publisher setting on npmjs.com, and until a real run has passed, the command above stays the path of record.

Housekeeping

• Five more trackers closed as deferred (#20, #136, #137, #142, #272) — closed as not planned on 2026-10-05: M4–M6 are not the product's core capability for now, and the Booking Copilot acceptance waits for a logged-in Dida browser window and an authorized UAT deploy. Closing is not acceptance: every gate stays unmet, and the authority docs carry each resume trigger and the acceptance that carries over (#639).
• README, user guide and roadmap baselines follow rc.28 (#640) — rc.28 is recorded as published and pulled back from the registry.

Installation

Run npx @danceiny/gotry@0.2.0-rc.29 web (Node ≥ 22.15). Once latest points to this version, npx @danceiny/gotry web is equivalent; pin the exact version if your registry mirror lags.

---

Fixed

• the yunnan pack's uncalibrated yn0 leg becomes advisory… (#638)

Documentation

• rc.28 is published and pulled back… (#640)
• defer #20/#136/#137/#142/#272 — the authority docs carry the closed state… (#639)

Chore

• publish through npm Trusted Publishing from a tag-dispatched workflow, so a release needs no founder click and holds no… (#642)
• make the npm release one verified command… (#641)
• 用户可见名随 CWS listing 统一为 Stai Travel Bridge… (#637)

v0.2.0-rc.28

Why this release. The rc.27 pull-back and the simulated-trigger drills turned up real defects. npx @danceiny/gotry doctor reported an hbcli without credentials as "credentials valid" on every machine with hbcli installed (#623); on the ground-transfer path a provider's raw error text could reach tool results unredacted, and a route provider that contradicted its own mode or resolved origin/destination was still bound as the airport transfer (#429); a solver crash could reach a traveller as "your trip is infeasible" (#620); and the tenant ledger leaked raw SQLite contention errors to callers (#619). All of them are fixed here. The release also lands the session dual-zone memory (default off) and the M3 capture and persona-simulation harness (synthetic only). The version stays paired with the extension manifest (0.2.0.28, enforced by extension-tests); the extension itself is unchanged.

What's New (since rc.27)

Fixes

• gotry doctor stops reporting an hbcli without credentials as "credentials valid" (#623) — the CLI judged by the exit code of hbcli auth whoami, which is 0 even when nothing is configured, so every machine with hbcli installed saw a false "valid" (14 of 14 runs on the published rc.27). It now parses the three-tier whoami JSON exactly as the tool-layer doctor does, settles its probes on close, and a parity test feeds the same fake hbcli to both implementations so they cannot drift apart again.
• doctor no longer intermittently reports an hbcli without credentials as ok — the credential probe settled on the child's exit event, which can fire before its stdout has been read; an empty read then fell into the "unparseable output counts as valid" branch. It now settles on close, and a deterministic regression test injects a child that exits before its data arrives. This also removes an intermittent red on the Node 22 CI job.
• Provider fault detail is scrubbed before it reaches tool results (#429) — a ground-transfer provider's error text (markup, credential-shaped strings) no longer flows verbatim into transfer_evidence; the fixed GROUND_TRANSFER_* messages pass through byte-identical.
• A route provider that contradicts its own request is refused instead of bound (#429 GAP-429-1/2) — a declared mode other than driving, or a resolved origin/destination more than about 11 m from the requested pair (or one that cannot be parsed), falls back to the static transfer estimate with its original price label and writes nothing to the cache; the wired driving tool declares neither, so its behaviour is unchanged.
• A solver crash is no longer reported as an infeasible trip (#620) — solveUnified validates every integer before it reaches Z3 and returns an explicit solver_error (solver_input_not_integer / solver_runtime_error) instead of a fake unsat_core: ['wasm_runtime_error'], and the traveller-facing text says the solver failed rather than that the trip is impossible. The root cause on the Yunnan pack is a data gap (leg yn0 has no buffer or transfer minutes), not a threading race, so that pack reports solver_error until its minutes are calibrated (#635).
• The tenant ledger no longer leaks raw SQLite contention errors (#619) — openDb installs busy_timeout before the WAL switch and creates or migrates the schema under BEGIN IMMEDIATE, every read-then-write ledger transaction takes the write lock up front, and an exhausted budget surfaces as the typed LedgerBusyError instead of a bare SQLITE_BUSY / SQLITE_BUSY_SNAPSHOT (the D-15 drill defects D15-1 and D15-2). Stored data, schema, idempotency keys, event shapes and single-writer behaviour are unchanged. The kernel manifest was re-pinned for state-ledger.ts and unified.ts with founder approval.
• A stalled LLM provider no longer hangs real-LLM runs (#618) — chat() ends any request that has not fully answered within GOTRY_LLM_TIMEOUT_MS (default 300 s), or whose caller AbortSignal fires, as a typed LlmRequestError (timeout / aborted) instead of waiting forever; usage accounting and the missing-usage fail-closed rule are unchanged.
• Offline switch for the realtime hbcli channel (#617) — GOTRY_HBCLI_LIVE=0 (also false / off) makes anythingSearch spawn no hbcli and degrade with [实时API:hbcli-anything@offline@…]; unset or any other value is unchanged (live when hbcli is available). nightly-evidence.ts --dry-run, persona-sim.ts, replay.ts, replay-async.ts and time-eval-tests.ts now default it to 0 (an explicit value is respected), so mock and dry-run paths no longer reach a live backend with the developer's stored credentials.
• Release script creates the GitHub Release with --verify-tag — scripts/publish-npm.sh passed the tag name as gh release create --target, which GitHub rejects (HTTP 422, target_commitish is invalid): the rc.27 publish succeeded on npm but its Release step failed and had to be created by hand. --verify-tag aborts if the tag is missing from the remote instead of silently creating one on main.
• Test hardening — the warmer-proof gate marker is published atomically (intermittent Node 24 failure) and the boot-budget proof allows a 50 ms early-fire tolerance on its 10 s handshake deadline (a Node 22 run measured 9999 ms).

New, default-off or synthetic-only

• Session dual-zone memory mechanism (#255, default off) — six log-type event kinds on the existing events table (zero new tables; the kernel-pinned state-ledger.ts is untouched), a capture seam, a scope-keyed read-back variable session_zone_brief, owner-confirmed promotion routed through the existing motivation/timeline/companion gates, state-cli export views hot-context.jsonl and notebook.json, and an opt-in observation face with three metrics whose thresholds are frozen before any data. The sessionZones switch defaults to off and is inert when off; the value claim stays closed (no real usage yet), and the shipped persona does not reference the new variable until the founder decides.
• M3 cohort capture CLI and LLM persona simulation harness (#22, synthetic only) — an operator-driven capture path for invited, consented seed participants that writes the scorer's gotry_m3_cohort_record_v1 (the first producer of those records), and a persona-simulation harness that rehearses the funnel offline or with a real LLM under a budget gate. Simulated runs are labeled synthetic_fixture, enrolled as test_or_staff, and can never contribute to M3/M4 evidence; the M3 gate is unchanged (an admitted real 50–200 seed-user set is still required).
• Simulated-trigger drills for the dormant trigger-gated trackers (#82, #275, #422, #340, #339, #429; fixture level; the trackers have since been closed as deferred) — default-off, zero-caller contract mechanisms for transaction-outcome-versus-estimate projection (#340), city×scenario tiering with an empty registry (#339) and a route-provider conformance gate (#429); drill suites for the inert W2A sensor path (#82), concurrent writers, crash/reopen and online backup on the tenant ledger (#275) and the dsh SDK descendant-cleanup re-baseline on 0.2.0-rc.2 (#422, gap confirmed); and an opt-in, read-only measurement probe for the external Anything path (#276/#345). Every result is labeled simulated_trigger_drill or fixture_contract and none satisfies a trigger.

Housekeeping

• Eight dormant trigger-watch issues closed as deferred (#82, #275, #422, #340, #339, #429, #276, #345) — none of their triggers has fired, and the simulated-trigger drills satisfy none of them; leaving them open as a standing backlog was unhealthy. Closed as not planned, not completed: each trigger condition now lives in its authority document (architecture D-15 / §10 / D-39, decisions-needed, memory-design §2, data-sources), and a new issue opens when a real trigger appears.

Installation

Run npx @danceiny/gotry@0.2.0-rc.28 web (Node ≥ 22.15). Once latest points to this version, npx @danceiny/gotry web is equivalent; pin the exact version if your registry mirror lags.

---

---

Added

• cohort capture CLI + synthetic-only LLM persona simulation harness (#22)… (#614)
• session dual-zone memory P4-2..P4-4… (#613)

Fixed

• cross-process contention must not reach the caller as a raw SQLITE_BUSY… (#634)
• a solver crash is reported as solver_error, not as an infeasible trip — Z3 integer-input gate… (#633)
• GOTRY_HBCLI_LIVE=0 switches the realtime hbcli channel off… (#632)
• dsh-llm chat() gets a request-level timeout and honours a caller AbortSignal… (#631)
• refuse a provider answer that contradicts its own mode or resolved origin/destination instead of binding it (#429 GAP-42… (#630)
• the boot-budget proof needs an early-fire tolerance on the 10 s handshake deadline (Node 22 CI measured 9999 ms)… (#629)
• exempt CHANGELOG.md from the G5 guard's naming surfaces… (#628)
• the CLI judges hbcli credentials from the whoami JSON, not its exit code… (#626)
• create the GitHub Release with --verify-tag… (#625)
• publish the warmer-proof gate marker atomically; the proof JSON.parses each marker as soon as the directory lists it, so… (#616)
• settle the hbcli stdout probe on 'close', not 'exit'… (#622)

Documentation

• eight dormant trigger-watch issues are closed as deferred… (#627)
• rc.27 is published and pulled back… (#624)

Tests

• simulated-trigger drills for the dormant trackers + GAP-429-3 provider-fault scrub (#82 #275 #422 #340 #3...

v0.2.0-rc.27

Why this release. The published latest (0.0.1-rc.24) cannot start gotry web on a clean machine: its pinned DSH runtime (0.1.5-rc.1) fails at startup with user patch-layer watching requires the Cordis HMR service (#600). This release moves the whole DSH family to 0.2.0-rc.2 (279 packages, #610), which no longer contains that startup path. The founder confirmed the release on 2026-10-04. The version stays paired with the Stai Travel Bridge extension version 0.2.0.27 (extension-version invariant).

What's New (since rc.24)

• First-run fix — a clean-machine npx @danceiny/gotry web boots again on the 0.2.0-rc.2 DSH closure; the previous closure crashed at startup in clean-machine runs of the web profile.
• Itinerary artifacts — deck renderer and static export bundle with a real QR matrix, product entries gotry_itinerary_deck_render and gotry_itinerary_render (HTML), host-owned Lavish review tools, artifact list paging with literal metadata search, the share-contract layer and the one-tap session-link contract (contract level, default off).
• Realtime and session retrieval — FlyAI: all public search kinds, safe setup checks, bounded process cleanup, fail-closed on malformed or terminated results; independent searches now run in parallel with bounded cancellation. Dida: city-plus-date query chain, destination driving, portal-delivered one-time login auto-fill, English room names. Session bridge: extension client binding for login-check-then-search, job-failure classification instead of false needs-login, redacted transport shapes for drift diagnosis, job ledger and event uplink.
• Embedded Booking Copilot planner — typed-decision and authority hardening, search-invalidation receipts, deployable turn deadlines, warm start and stall budgets; the planner's own process start has its own tight budget and error type, so a startup failure is no longer reported as a model timeout.
• Memory and recall — recall tick scheduler and why-now cards; tenant-ledger repair control plane (apply and rollback with receipts); the session dual-zone memory partition contract (P4-1, inert and default off).
• Observability — structured verdict logs and planner/backend startup-stage markers on the service runtime; boot diagnostics keep the ordered stage records (#511).
• Capability onboarding — plain-language failure reasons when a channel such as hbcli is missing, a first-contact prompt that states the impact, a bilingual onboarding doc.
• hbcli — customer email-code two-step login tool surface.
• Inert, default-off contracts — the external-event (W2A) seam, the Money/FX fact contract and the offline administrative-atlas loader. None activates a live path.
• Stai Travel Bridge is live on the Chrome Web Store (0.2.0.27, #346/#537) — v0.2.0.26 was rejected on 2026-09-26 because the listing metadata did not match the observed behavior; the listing was renamed Stai Travel Bridge and v0.2.0.27 was resubmitted on 2026-09-30. The public store page and the store update endpoint both serve 0.2.0.27 (pulled back 2026-10-04). The installed-extension checks — desktop connection, employee-portal join and Dida login — remain open under #346.

Previously queued items (carried from the former Unreleased list)

• Persistent default departure city (#338, 2026-09-10) — gotry_motivation_save accepts a typed homeCity with optional/explicit exact homeCityEvidence binding (a single non-empty evidence may be omitted; multiple require explicit); the ledger persists homeCityPreference { value, evidence, updated_at } and reads it back as a soft default via {{motivation_brief}}. An explicit current-turn departure city takes precedence; explicit null clears the active default.
• Artifact views enter the M4 queue (issue #285, 2026-09-10) — gotry_artifacts_list/read persist standard presentationMeta at the Host layer and output the fields required by SearchPathsResultView/ReadResultView plus FileLocation; the published ./client adapter renders custom list/read keyed cards in DSH Web via window.__ModuleLoader__.load keyed on the runtime block (wire name tool.call.toolview, key = gotry_artifacts_list / gotry_artifacts_read, see client/client.js), with clickable paths, first line showing source + full path + line-number preview + source identity + content version; the workspace/sidebar file tree remains an additional preview surface. Read-scope whitelist = stateRoot root + session dsh working directory (excluding node_modules/.git); extension whitelist = text types; cross-root / symlink escape / missing file / oversize file (>2MB) uniformly return ok:false + error + hint. This layer is read-only; the WriteGate red line is not involved. Acceptance evidence = scripts/artifacts-capability-tests.ts 12 isolated-fixture proofs + scripts/dsh-artifact-web-e2e.ts fresh-profile Web list→select/open→read→edit→updated-read proof (covering the changed-file notice with correct preview after rewrite, and update visibility after reload) + smoke §15/§15b. Delivered via PR #305 / destination 48c794c58b02d543be01f3bec98a056447dfeb85.
• M4→M6 public delivery and debt ledger (#270) — architecture debt rows uniformly point to a public tracker or concrete trigger conditions; D-12/D-16/D-24 archived; the issue→Draft PR→exact-head review→merge/destination receipt becomes the general public delivery contract. Local/fixture evidence still does not constitute real admission for #20/#136/#137.
• DSH runtime closure migrated to 0.1.5-alpha.1 (#268) — precisely migrated the root-pinned DSH runtime dependency from 0.1.2-alpha.3 (216-package closure) to 0.1.5-alpha.1 (230-package closure). The target version is pinned exactly, never following the mutable alpha dist-tag (currently pointing at 0.1.5-alpha.2). 230 = 15 additions (dsh-api-workspace-files/dsh-client-file-upload/dsh-client-resources/dsh-client-ui-open-in-app/dsh-client-ui-sidebar-files/dsh-client-ui-sidebar-right/dsh-client-ui-sidebar-textpreview/dsh-host-open-in-app/dsh-http-proxy/dsh-package-manifest/dsh-session-format/dsh-session-format-catalog/dsh-session-format-v0-to-v1/dsh-session-format-v1-to-v2/dsh-session-format-v2-to-v3) + removal of dsh-tool-subagent-report; the add/remove set is confirmed by regenerated npm and pnpm lockfiles. ts/package.json overrides expanded from 14 to 230, pinning the full peer closure at 0.1.5-alpha.1 and preventing the ^0.1.5-alpha.1 caret from drifting transitive peers to 0.1.5-alpha.2. Added failing-precondition contract test dsh-target-closure-proof.ts (reads the repo's actual state; must fail on the starting 216/alpha.3 closure, must pass after migration), wired into run-all §23b. API audit (tsc --noEmit + smoke + map-tools clean-tarball proof) reproduced no target incompatibility: the SettingsProvider.prototype.installSection seam, the 7 map_* tools, settings watch/reload/dispose, Session V3 one-way migration, and the agent/session/inbox/steer seams all survive on 0.1.5-alpha.1, with no behavior change. Historical 0.1.2-alpha.3 evidence is retained in old §9/roadmap/stage1/release-notes entries, not batch-replaced; settings behavior unchanged. These deterministic proofs do not constitute M5/M6 admission. (Later superseded: the closure is now 0.2.0-rc.2.)
• TS strict install closure (#202) — on top of rc.20, which already shipped the MIT dsh-map-tools in the package, completed the exact overrides for the alpha.3 peer closure so that a bare npm ci in ts/ no longer depends on --legacy-peer-deps; added clean-tarball fail-closed proof.

Installation

Run npx @danceiny/gotry@0.2.0-rc.27 web (Node ≥ 22.15). Once latest points to this version, npx @danceiny/gotry web is equivalent; pin the exact version if your registry mirror lags.

dist-tag plan

TAG=latest ./scripts/publish-npm.sh, with the tag passed explicitly (#50①). The compatibility rc tag stays on 0.0.1-rc.20; whether to retire it remains an owner decision.

---

---

Added

• P4-1 会话双区记忆分区契约纯核(全离线)… (#609)
• 服务运行时补 verdict 结构化日志与 planner/backend 启动阶段标记… (#607)
• 客户邮箱验证码两步登录工具面——hotelbyte 注册支持跟进… (#605)
• one-tap 深链契约——schema 闭集签名 token + plan-it 行动卡(Phase E #580)… (64152dc)
• tick scheduler + 召回触发评估器 + why-now 卡(Phase D… (72cadce)
• deck bundle QR 真矩阵——qrcode 库渲染 + share_intent.generated(Phase B 切片 3b… (ed49d20)
• Share 契约层——adapters + HMAC token + consent + shareDeck 流程(Phase C… (60b9668)
• gotry try 离线 deck demo——零安装/零 LLM key/零 dsh 主机(Phase A… (2c97870)
• deck 静态导出 bundle——.html+manifest.json+qr.svg 占位(Phase B 切片 3a… (d926794)
• deck 产品入口 gotry_itinerary_deck_render + 落盘路径护栏(Phase B 切片 2… (6cec827)
• 行程 deck 渲染器切片 1——共享契约层 + 纯 deck 投影 + 反漂移锁(#564)… (0521d54)
• 首次接触 prompt 加影响面 + 能力 onboarding 双语文档(#559 B 步)… (7804ccb)
• dida 报价补卡片字段与多语言名(hotel-fe#3731)… (5e86063)
• dida 按城市+日期的查询链路 + 修挑战误判(酒店名含「验证」)… (6ad1f5f)
• dida 目的地搜索驱动——选目的地 + 用我们的日期重写落地 URL… (eee0312)
• 代填登录——portal 投递一次性凭据 → 扩展开登录页代填提交… (ab13222)
• expose safe setup checks and preserve credential boundaries… (891704e)
• wire all public search kinds… (41492a9)
• parallelize independent queries with bounded cancellation… (#523)
• 数据修复控制面——只读 inventory/显式映射迁移引擎/backup+幂等 journal+rollback(#254 工程段)… (f8cb94b)
• make the planner turn deadline deployable… (1422cd8)
• list paging + literal metadata search (issue #458)… (#459)
• expose host-owned itinerary review tools… (#456)
• local Lavish Editor session adapter (issue #443)… (#450)
• product generation entry gotry_itinerary_render (#442)… (#449)
• bounded pure itinerary HTML renderer (internal slice… (#445)
• discover HTML itinerary artifacts with safe source preview (#441)… (#444)
• external-event seam contract (untrusted sensor adapter… (#435)
• unavailable/...

Stai Travel Bridge ext-v0.2.0.27 — Chrome Web Store resubmission (renamed after metadata rejection)

CWS resubmission candidate for #346/#537.

• v0.2.0.26 (listing name Stai) was rejected 2026-09-26: content policy, 'provided metadata is irrelevant to the observed functionality' (ref Red Potassium).
• Founder decision 2026-09-30: rename listing to Stai Travel Bridge, resubmit, no appeal.
• Manifest: name 'Stai Travel Bridge', version 0.2.0.27 (version_name 0.2.0-rc.27); package.json 0.2.0-rc.27 (version-follows invariant).
• Built from exact main SHA ecfd4c8f4505e2b521cf0659fe372c7e34d921ff.
• zip SHA256: 65bdb8f37ae87386d3d710f18bf59c174d296fd2150a1ecbafb0d70e7bb7e347
• tarball SHA256: ef47564e610c4829299f923d341d4eebbea6f506ead5924ad93833a7132c1bfc
• Gates: artifact validator ok; §38 49/49 green; §43 159 pass / 0 fail.
• Listing copy / permission justifications / privacy disclosures carry over the corrected v0.2.0.26 versions (obsolete 'zero credentials handled' claims removed in #586).

Stai ext-v0.2.0.26 — Chrome Web Store submission package

Stai 0.2.0.26 is the versioned extension package prepared from main commit 3925d1a5963a32c8708d358d14ed70999580d967 for the existing Chrome Web Store item oeajpiccmonococjcegddlooeeohlbgd. This GitHub Release does not mean the store update has been approved or published.

This package includes the Dida and HotelByte portal bridge work already merged to main, the Stai name, accurate local/portal data-flow and one-time supplier-login disclosure, and removal of unused all-sites optional host permissions. The store zip omits the unpacked-channel signing key; the tarball retains it.

Validation: full repository regression passed locally and on Node 22/24 CI for PR #586; extension §38 passed 42 checks; the artifact validator passed on this exact main commit.

• Store zip SHA-256: 7c88b2e21a7546c99917b96ba16b37b5d6674f93ab9461dd26d12573af57e7a2
• Unpacked tarball SHA-256: 0dfada8fd00d7083e19bbec9d11dce82f2ff61c98606f35dc4a7f210962f17d8
• Tracking: #346 and #537 remain open until the Chrome Web Store update is reviewed, live, and verified.

GoTry Session Bridge ext-v0.2.0.25 · 2026-09-24 · portal 安装检测契约 + 商店恢复上架

GoTry Session Bridge ext-v0.2.0.25 · 2026-09-24

What's New

• portal 安装检测契约对齐 (hotel-fe#3802) — content-bridge 现给 <body> 打 data-portal-helper-installed="true"(旧 portal-helper 遗留契约,hotel-fe 安装横幅唯一检测面);document_start 下 body 未就绪时 DOMContentLoaded 兜底。此前任何版本装上,portal 横幅都不消失。
• 版本 0.0.1.24 → 0.2.0.25 — CWS 单调递增要求:商店现存 0.1.0,而仓库 0.0.1.N 倒挂无法上架(本次事故的根因之一);0.2.0.25 起恢复可更新。版本跟随主版本门禁(root package.json 0.2.0-rc.25,四段投影)。
• CWS 自动上架流水线 — 新增 .github/workflows/extension-publish.yml:push main 自动 pack(store.zip/tar.gz/版本清单);手动 dispatch dry_run=false 经 Chrome Web Store API 发布(founder 确认制)。一次性 OAuth 配置见 docs/extension-store-publish.md。
• 合同门禁加固 — ts/scripts/extension-tests.ts 增加安装检测断言(manifest/content-bridge 合同面 42 段)。

Install

npx @danceiny/gotry setup --extension-from=github

或商店:https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd (本版本提交审核中)

对应主线

• 主包: v0.2.0-rc.25(CLI 未发 npm,本次仅扩展 release)
• 仓库 HEAD: f96d9f8(合并 gotry#579)
• hotel-fe 配套: hotelbyte-com/hotel-fe#3818(横幅双入口:CWS + GitHub Releases)

Known limitations

• 商店审核需数小时到数天;审核通过前,装了商店 0.1.0 的用户在 portal 上仍会看到安装横幅 —— 请先用 GitHub Releases 路径。
• 自动上架流水线首次使用需配置 5 个 OAuth secrets(见 docs/extension-store-publish.md);首次自动上架前需配 5 个 OAuth secrets(见 docs/extension-store-publish.md),配置期间商店提交可先手动上传。

GoTry Session Bridge ext-v0.0.1.24 · 2026-09-12 · Session Bridge #380 切到浏览器

GoTry Session Bridge ext-v0.0.1.24 · 2026-09-12

What's New

• 执行环境迁到浏览器扩展 (#380) — 服务端不再开 Chrome；Session Bridge SW 持有桥面，扩展通过 chrome.storage + optional_host_permissions + hotel-be portal window.__gotryJoinTicket 注入持有桥配置。员工零配置：no options page、no chrome.storage 用户面。
• ctrip/dida host_permissions 保留 (founder reversal) — 早期为省事砍过、改靠 chrome.cookies 推断；founder 翻盘「不要贸然做这样的决定——星域 host_permissions 保留，显式授权链可审计」。
• 异步票据 gotry-join-ticket-available 事件重取 (bb45cf3) — portal 异步返回 join 票据（晚于 DOMContentLoaded）；之前的单次读会错过，dida 通道一直「等扩展」。content-bridge.js 现订阅 portal 派发的 gotry-join-ticket-available 事件，复用同一条 dispatch 路径重取；不轮询、不新增配置面。
• dida 通道 multi-collect — dida portal 注入两条并行推荐流（hotels + recommendPrices），扩展侧分桶后 mergeDidaRatesBodies 合并再结算。

Install

npx @danceiny/gotry setup --extension-from=github

对应主线

• 主包: v0.0.1-rc.24 (@danceiny/gotry npm latest)
• 仓库 HEAD: dae7d08 (含 #410 metrics-report 修复)

Known limitations

• Chrome Web Store 上架仍需 Google 审核；商店版 ID 不可预测（商店自派），本 release 的 gotry-session-bridge-store.zip 是商店提交用材料。

v0.0.1-rc.22

Fixed

• accept pre-parsed version array in bootstrap versionAtLeast… (79b0abe)