xianyu-hunter-hermes-skill/skill/xianyu-hunter-monitor/references/web-qr-source-and-hermes-optimize-2026-05.md

Web QR login source labeling + Hermes optimize handoff (2026-05)

Trigger

BOSS corrected two UX/architecture problems in the local xianyu-hunter Web dashboard:

1. The login modal must not present a direct login.taobao.com screenshot as if it were a pure “闲鱼二维码”. Goofish/闲鱼 may legitimately redirect to Taobao/Alibaba unified login, but the UI must say this honestly and start from goofish.com first.
2. “任务智能润色” should call Hermes Agent to generate the task configuration, not the project’s old internal chatCompletion / AI API config path.

Implemented local flow

Files in /Users/chick/.Hermes/workspace/research/xianyu-hunter:

• lib/login.mjs
  • getLoginQr() opens https://www.goofish.com/ first.
  • If the official flow redirects to login.taobao.com / havanaone, the API returns qrSource: "淘宝/阿里统一登录" and qrUrl.
  • It prefers screenshotting a QR-like element (canvas, QR images, qrcode containers, iframe descendants) over whole-body screenshots.
  • It logs the true source instead of calling the screenshot “闲鱼二维码” unconditionally.
• public/index.html / public/app.js
  • Login panel now displays QR source and explains that Taobao/Alibaba unified login is an official redirected login chain.
  • Help copy says it starts from 闲鱼官网 and no longer disguises Taobao screenshots as Xianyu QR.
• lib/hermes_optimizer.mjs
  • Spawns Hermes CLI (HERMES_BIN default /Users/chick/.local/bin/hermes) with a JSON-only prompt.
  • Sanitizes returned task fields and falls back to local deterministic rules on failure.
• server.mjs
  • /api/tasks/optimize imports optimizeTaskWithHermes and buildLocalOptimizedTask and no longer imports/calls chatCompletion.

Verification commands

cd /Users/chick/.Hermes/workspace/research/xianyu-hunter
node --check server.mjs && node --check lib/login.mjs && node --check lib/hermes_optimizer.mjs && node --check public/app.js

# If old behavior still appears, kill the actual stale PID on port 3000; xianyu_ops stop may say no-recorded-server.
lsof -tiTCP:3000 -sTCP:LISTEN | xargs kill
node tools/xianyu_ops.mjs start --port 3000

curl -sS -X POST http://127.0.0.1:3000/api/tasks/optimize \
  -H 'Content-Type: application/json' \
  -d '{"product":"e3-1245v3 cpu","budget":"150左右","currentRequirements":"只看CPU本体，排除主板套装/散热器/坏件/维修/求购"}' | python3 -m json.tool
# Expect: source == "hermes" when Hermes CLI is available.

curl -sS -X POST http://127.0.0.1:3000/api/login/qr \
  -H 'Content-Type: application/json' -d '{}' | python3 -m json.tool
# Expect: qrSource/qrUrl present. If already logged in, qrImage may be empty and logs say no scan is needed.

Pitfall

After code edits, port 3000 may still be served by a stale Node PID that was not recorded in .runtime. If /api/tasks/optimize still returns an old warning such as “AI 未配置：请先在控制台设置 API 密钥和模型”, kill the real listening PID with lsof -tiTCP:3000 -sTCP:LISTEN | xargs kill and restart.