fix: require exact ERP account identity

tools/erp-account-identity.test.mjs

@@ -0,0 +1,31 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import test from 'node:test';
+
+const require = createRequire(import.meta.url);
+const identity = require('../chrome-extension/ltjt-order-assistant/erp-account-identity.js');
+
+test('ERP account identity comparison accepts only normalized exact equality', () => {
+  assert.equal(identity.exactErpAccountIdentityMatch('测试AI员工账号', '  测试ai员工账号  '), true);
+  assert.equal(identity.exactErpAccountIdentityMatch('ＥＲＰ-01', 'erp-01'), true);
+  assert.equal(identity.exactErpAccountIdentityMatch('测试 AI', '测试   ai'), true);
+});
+
+test('ERP account identity comparison rejects substrings and blank identities', () => {
+  assert.equal(identity.exactErpAccountIdentityMatch('测试', '测试ai员工账号'), false);
+  assert.equal(identity.exactErpAccountIdentityMatch('admin', 'erp-admin-01'), false);
+  assert.equal(identity.exactErpAccountIdentityMatch('', ''), false);
+  assert.equal(identity.exactErpAccountIdentityMatch('employee', ''), false);
+});
+
+test('ERP session probe reads the unique login label and never matches against whole-page text', () => {
+  const background = readFileSync(
+    new URL('../chrome-extension/ltjt-order-assistant/background.js', import.meta.url),
+    'utf8'
+  );
+  assert.match(background, /document\.querySelectorAll\('#Lable_UserName'\)/u);
+  assert.match(background, /accountNodes\.length === 1/u);
+  assert.match(background, /exactErpAccountIdentityMatch/u);
+  assert.doesNotMatch(background, /bodyText\.includes\(expectedAccount\)/u);
+});

tools/lifecycle-contract.test.mjs

@@ -1318,7 +1318,7 @@ test('passenger explicit server success is terminal without a post-save row requ
   assert.doesNotMatch(passengerBranch, /passengerRequery|verifyLifecycleOperation/);
   assert.doesNotMatch(background, /attemptAutomaticPassengerReconciliation/);
   assert.match(background, /名单已取得 ERP 明确成功响应，按业务规则确认录入成功/);
-  assert.match(platformApp, /REQUIRED_EXTENSION_VERSION = '0\.5\.167'/);
+  assert.match(platformApp, /REQUIRED_EXTENSION_VERSION = '0\.5\.168'/);
 });
 
 test('uncertain lifecycle writes can only converge through a read-only plugin requery', async () => {
@@ -1525,7 +1525,7 @@ test('lifecycle execution keeps the MV3 worker alive until the durable task sett
   assert.match(background, /arrangement_resource_candidate_data_missing/);
 });
 
-test('extension 0.5.167 keeps reload dormant unless its durable execution state is fully idle', async () => {
+test('extension 0.5.168 keeps reload dormant unless its durable execution state is fully idle', async () => {
   const [background, bridge] = await Promise.all([
     readFile(new URL('../chrome-extension/ltjt-order-assistant/background.js', import.meta.url), 'utf8'),
     readFile(new URL('../chrome-extension/ltjt-order-assistant/business-bridge.js', import.meta.url), 'utf8')
@@ -1964,7 +1964,7 @@ test('delete guard distinguishes independent, shared child, and shared parent ro
   for (const operation of operations) assert.equal(plans.validateOperation(operation).ok, true, plans.validateOperation(operation).blockers.join('; '));
 
   const mapping = JSON.parse(await readFile(new URL('../mappings/lifecycle.mapping.json', import.meta.url), 'utf8'));
-  assert.equal(mapping.current_extension_version, '0.5.167');
+  assert.equal(mapping.current_extension_version, '0.5.168');
   assert.equal(
     mapping.updates.order_update_independent.field_mapped_pending_live_validation['pax.child_no_bed'],
     'ertrenshu'
@@ -2333,8 +2333,9 @@ test('schema and browser adapters contain the v2 safety fields and no confirm ov
   assert.match(background, /if \(report\.manual_review_required === true\) return 'execution_uncertain'/);
   assert.match(background, /async function readErpSessionStatus/);
   assert.match(background, /message\?\.type === 'LTJT_ERP_SESSION_STATUS'/);
-  assert.match(background, /account_matched: Boolean\(expectedAccount\) && bodyText\.includes\(expectedAccount\)/);
-  assert.doesNotMatch(background, /bodyText\.includes\('测试ai员工账号'\)/);
+  assert.match(background, /document\.querySelectorAll\('#Lable_UserName'\)/);
+  assert.match(background, /erpAccountIdentity\.exactErpAccountIdentityMatch/);
+  assert.doesNotMatch(background, /bodyText\.includes\(expectedAccount\)/);
   assert.match(background, /lifecycle_preflight_ambiguous/);
   assert.match(background, /lifecycle_frame_discovery_retry_exhausted/);
   assert.match(background, /lifecycleFrameDiscoveryOnly/);
@@ -2347,10 +2348,10 @@ test('schema and browser adapters contain the v2 safety fields and no confirm ov
   assert.match(inpage, /`ys_danweiid\$\{index\}`, resolvedCustomerId/);
   assert.doesNotMatch(inpage, /product_customer_source_region|sourceRegionCheck|source_reference/);
   assert.doesNotMatch(teamBatchInpage, /product_customer_source_region|sourceRegionCheck/);
-  assert.equal(extensionManifest.version, '0.5.167');
-  assert.match(inpage, /version: '0\.5\.167'/);
-  assert.match(teamBatchInpage, /version: '0\.5\.167'/);
-  assert.match(platformApp, /REQUIRED_EXTENSION_VERSION = '0\.5\.167'/);
+  assert.equal(extensionManifest.version, '0.5.168');
+  assert.match(inpage, /version: '0\.5\.168'/);
+  assert.match(teamBatchInpage, /version: '0\.5\.168'/);
+  assert.match(platformApp, /REQUIRED_EXTENSION_VERSION = '0\.5\.168'/);
   assert.match(inpage, /function strictIsoDate\(value\)/);
   assert.match(inpage, /const startDate = strictIsoDate\(controlCanonicalValue\(form, 'riqi0'\)\)/);
   assert.match(inpage, /const endDate = strictIsoDate\(controlCanonicalValue\(form, 'riqis0'\)\)/);