# Web QR login source labeling + Hermes optimize handoff (2026-05)

## Trigger

BOSS corrected two UX/architecture problems in the local xianyu-hunter Web dashboard:

1. The login modal must not present a direct `login.taobao.com` screenshot as if it were a pure “闲鱼二维码”. Goofish/闲鱼 may legitimately redirect to Taobao/Alibaba unified login, but the UI must say this honestly and start from `goofish.com` first.
2. “任务智能润色” should call Hermes Agent to generate the task configuration, not the project’s old internal `chatCompletion` / AI API config path.

## Implemented local flow

Files in `/Users/chick/.Hermes/workspace/research/xianyu-hunter`:

- `lib/login.mjs`
  - `getLoginQr()` opens `https://www.goofish.com/` first.
  - If the official flow redirects to `login.taobao.com` / `havanaone`, the API returns `qrSource: "淘宝/阿里统一登录"` and `qrUrl`.
  - It prefers screenshotting a QR-like element (`canvas`, QR images, qrcode containers, iframe descendants) over whole-body screenshots.
  - It logs the true source instead of calling the screenshot “闲鱼二维码” unconditionally.
- `public/index.html` / `public/app.js`
  - Login panel now displays QR source and explains that Taobao/Alibaba unified login is an official redirected login chain.
  - Help copy says it starts from 闲鱼官网 and no longer disguises Taobao screenshots as Xianyu QR.
- `lib/hermes_optimizer.mjs`
  - Spawns Hermes CLI (`HERMES_BIN` default `/Users/chick/.local/bin/hermes`) with a JSON-only prompt.
  - Sanitizes returned task fields and falls back to local deterministic rules on failure.
- `server.mjs`
  - `/api/tasks/optimize` imports `optimizeTaskWithHermes` and `buildLocalOptimizedTask` and no longer imports/calls `chatCompletion`.

## Verification commands

```bash
cd /Users/chick/.Hermes/workspace/research/xianyu-hunter
node --check server.mjs && node --check lib/login.mjs && node --check lib/hermes_optimizer.mjs && node --check public/app.js

# If old behavior still appears, kill the actual stale PID on port 3000; xianyu_ops stop may say no-recorded-server.
lsof -tiTCP:3000 -sTCP:LISTEN | xargs kill
node tools/xianyu_ops.mjs start --port 3000

curl -sS -X POST http://127.0.0.1:3000/api/tasks/optimize \
  -H 'Content-Type: application/json' \
  -d '{"product":"e3-1245v3 cpu","budget":"150左右","currentRequirements":"只看CPU本体，排除主板套装/散热器/坏件/维修/求购"}' | python3 -m json.tool
# Expect: source == "hermes" when Hermes CLI is available.

curl -sS -X POST http://127.0.0.1:3000/api/login/qr \
  -H 'Content-Type: application/json' -d '{}' | python3 -m json.tool
# Expect: qrSource/qrUrl present. If already logged in, qrImage may be empty and logs say no scan is needed.
```

## Pitfall

After code edits, port 3000 may still be served by a stale Node PID that was not recorded in `.runtime`. If `/api/tasks/optimize` still returns an old warning such as “AI 未配置：请先在控制台设置 API 密钥和模型”, kill the real listening PID with `lsof -tiTCP:3000 -sTCP:LISTEN | xargs kill` and restart.