dsh-context-compression-improved 0.1.1 → 0.2.0

package/packages/selector/tests/subagent-cache-reuse.host.spec.ts

@@ -0,0 +1,250 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import AgentLoop from '@deepseek-ai/dsh-agent-loop'
+import { mountAgentLoopTestDependencies } from '@deepseek-ai/dsh-agent-loop-testkit'
+import { createUserMessage, type GenerateOptions } from '@deepseek-ai/dsh-llm'
+import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import SubagentRuntime from '@deepseek-ai/dsh-subagent'
+import * as Fork from '@deepseek-ai/dsh-subagent-fork-in-process'
+import * as Spawn from '@deepseek-ai/dsh-subagent-spawn-in-process'
+import TokenMeter from '@deepseek-ai/dsh-token-meter'
+import { PublicMockAdapter, publicTextResponse } from './support/mock-adapter.ts'
+import {
+  assessReusablePrefix,
+  buildSafeCacheAuditRecord,
+  fingerprintStablePrefix,
+  type JsonValue,
+  type StablePrefixEnvelope,
+} from './support/cache-prefix-audit.js'
+
+const SYSTEM = 'You are a terse assistant in an isolated parent-child cache-prefix test. '
+  + 'Follow the latest user instruction literally. Answer in one short sentence. '
+  + 'Do not use markdown, tools, timestamps, random identifiers, environment values, '
+  + 'or unstated facts. This deliberately long stable persona supplies enough repeated '
+  + 'context for the provider cache while remaining identical for parent and child requests.'
+
+const PARENT_TEXT = 'Remember that the stable test phrase is cobalt-heron-42 and repeat it once.'
+const CHILD_TEXT = 'Repeat the stable test phrase once more.'
+const SPAWN_TEXT = 'Answer only with the word fresh.'
+
+let ctx: Context | undefined
+
+afterEach(async () => {
+  await ctx?.fiber.dispose()
+  ctx = undefined
+})
+
+const jsonValue = (value: unknown): JsonValue => JSON.parse(JSON.stringify(value)) as JsonValue
+
+const envelope = (options: GenerateOptions, messageCount = options.messages.length): StablePrefixEnvelope => ({
+  provider: options.provider,
+  model: options.model,
+  system: options.system ?? null,
+  tools: jsonValue(options.tools ?? []) as JsonValue[],
+  messages: jsonValue(options.messages.slice(0, messageCount)) as JsonValue[],
+})
+
+async function liveHarness(requests: Map<string, GenerateOptions[]>): Promise<Context> {
+  const created = new Context()
+  await mountAgentLoopTestDependencies(created, { systemPrompt: { persona: SYSTEM } })
+  await created.plugin(TokenMeter)
+  await created.plugin(AgentLoop, { agents: [] })
+  await created.plugin(SubagentRuntime)
+  await created.plugin(Fork, { providerName: 'fork' })
+  await created.plugin(Spawn, { providerName: 'spawn' })
+  await created.plugin(LlmDeepSeek)
+  created.on('llm/stream', (options, next) => {
+    const sessionId = String(options.sessionId)
+    requests.set(sessionId, [...(requests.get(sessionId) ?? []), options])
+    return next()
+  })
+  return created
+}
+
+async function keylessHarness(requests: Map<string, GenerateOptions[]>): Promise<Context> {
+  const created = new Context()
+  await mountAgentLoopTestDependencies(created, { systemPrompt: { persona: SYSTEM } })
+  await created.plugin(AgentLoop, { agents: [] })
+  await created.plugin(SubagentRuntime)
+  await created.plugin(Fork, { providerName: 'fork' })
+  await created.plugin(Spawn, { providerName: 'spawn' })
+  created.llm.registerAdapter(['mock'], new PublicMockAdapter([
+    publicTextResponse('cobalt-heron-42'),
+    publicTextResponse('cobalt-heron-42'),
+    publicTextResponse('fresh'),
+  ]))
+  created.on('llm/stream', (options, next) => {
+    const sessionId = String(options.sessionId)
+    requests.set(sessionId, [...(requests.get(sessionId) ?? []), options])
+    return next()
+  })
+  return created
+}
+
+describe('parent/child prefix behavior (keyless full-loop E2E)', () => {
+  it('runs parent, fork, and spawn through the real loop and session providers', async () => {
+    const requests = new Map<string, GenerateOptions[]>()
+    ctx = await keylessHarness(requests)
+    const parent = ctx.agentLoop.create(SessionId('cache-parent-keyless-e2e'), {
+      provider: 'mock',
+      model: 'mock',
+    })
+    parent.followup(createUserMessage({
+      content: [{ type: 'text', text: PARENT_TEXT }],
+      source: { kind: 'user' },
+    }))
+    await parent.whenIdle()
+    const parentEvents = parent.session.events.slice()
+    const parentRequest = requests.get(String(parent.id))?.at(-1)
+    expect(parentRequest).toBeDefined()
+
+    const forkRun = await ctx.subagents.start('fork', {
+      prompt: [{ type: 'text', text: CHILD_TEXT }],
+      parent,
+      signal: new AbortController().signal,
+    })
+    await forkRun.result
+    const forkChild = forkRun.localAgent
+    const forkRequest = requests.get(String(forkRun.id))?.at(-1)
+    expect(forkChild).toBeDefined()
+    expect(forkRequest).toBeDefined()
+    if (forkChild === undefined || forkRequest === undefined || parentRequest === undefined) {
+      throw new Error('keyless fork did not publish its complete evidence')
+    }
+    expect(forkChild.session.header.seedLength).toBe(parentEvents.length)
+    expect(forkChild.session.events.slice(0, parentEvents.length)).toEqual(parentEvents)
+    const parentStable = envelope(parentRequest)
+    const forkStablePrefix = envelope(forkRequest, parentRequest.messages.length)
+    expect(fingerprintStablePrefix(forkStablePrefix)).toBe(fingerprintStablePrefix(parentStable))
+    expect(Object.isFrozen(forkRequest)).toBe(true)
+
+    const spawnRun = await ctx.subagents.start('spawn', {
+      prompt: [{ type: 'text', text: SPAWN_TEXT }],
+      parent,
+      signal: new AbortController().signal,
+    })
+    await spawnRun.result
+    const spawnChild = spawnRun.localAgent
+    const spawnRequest = requests.get(String(spawnRun.id))?.at(-1)
+    expect(spawnChild?.session.header.seedLength).toBeUndefined()
+    expect(spawnRequest).toBeDefined()
+    expect(JSON.stringify(spawnRequest?.messages)).not.toContain(PARENT_TEXT)
+    expect(assessReusablePrefix({
+      mode: 'spawn',
+      inheritsParentContext: false,
+      parent: parentStable,
+      child: envelope(spawnRequest!),
+    })).toEqual({ eligible: false, reason: 'spawn-does-not-inherit' })
+
+    const safeRecord = buildSafeCacheAuditRecord({
+      fingerprint: fingerprintStablePrefix(parentStable),
+      estimatedSharedPrefixTokens: Math.ceil(JSON.stringify(parentStable).length / 4),
+      parentSessionId: String(parent.session.header.id),
+      childSessionId: String(forkChild.session.header.id),
+      mode: 'fork',
+      eligible: true,
+      reason: 'identical-fork-prefix',
+    })
+    expect(safeRecord.confirmationStatus).toBe('unconfirmed')
+    expect(JSON.stringify(safeRecord)).not.toContain(PARENT_TEXT)
+
+    await spawnRun.dispose()
+    await forkRun.dispose()
+  })
+})
+
+describe.skipIf(!process.env.DEEPSEEK_API_KEY)('parent/child natural cache-prefix reuse (real DeepSeek API)', () => {
+  it('preserves the fork prefix, separates spawn, and records only official usage evidence', async () => {
+    const requests = new Map<string, GenerateOptions[]>()
+    ctx = await liveHarness(requests)
+    const parent = ctx.agentLoop.create(SessionId('cache-parent-e2e'), {
+      provider: 'deepseek-official',
+      model: 'deepseek-v4-flash',
+    })
+    parent.followup(createUserMessage({
+      content: [{ type: 'text', text: PARENT_TEXT }],
+      source: { kind: 'user' },
+    }))
+    await parent.whenIdle()
+    const parentEvents = parent.session.events.slice()
+    const parentRequest = requests.get(String(parent.id))?.at(-1)
+    expect(parentRequest).toBeDefined()
+
+    const forkRun = await ctx.subagents.start('fork', {
+      prompt: [{ type: 'text', text: CHILD_TEXT }],
+      parent,
+      signal: new AbortController().signal,
+    })
+    await forkRun.result
+    const forkChild = forkRun.localAgent
+    expect(forkChild).toBeDefined()
+    if (forkChild === undefined) throw new Error('fork did not publish a local agent')
+    const forkRequest = requests.get(String(forkRun.id))?.at(-1)
+    expect(forkRequest).toBeDefined()
+    expect(forkChild.session.header).toMatchObject({
+      parentSession: parent.session.header.id,
+      seedLength: parentEvents.length,
+    })
+    expect(forkChild.session.events.slice(0, parentEvents.length)).toEqual(parentEvents)
+
+    const parentStable = envelope(parentRequest!)
+    const forkStablePrefix = envelope(forkRequest!, parentRequest!.messages.length)
+    expect(assessReusablePrefix({
+      mode: 'fork',
+      inheritsParentContext: true,
+      parent: parentStable,
+      child: forkStablePrefix,
+    })).toEqual({ eligible: true, reason: 'identical-fork-prefix' })
+    expect(fingerprintStablePrefix(parentStable)).toBe(fingerprintStablePrefix(forkStablePrefix))
+    expect(Object.isFrozen(forkRequest)).toBe(true)
+
+    const measurement = ctx.tokenMeter.measure(forkChild.session)
+    const usage = measurement.baseline.kind === 'usage' ? measurement.baseline.usage : undefined
+    const cacheMissTokens = usage === undefined
+      ? undefined
+      : usage.inputTokens + (usage.cacheWriteTokens ?? 0)
+    const observedPromptTokens = usage === undefined
+      ? undefined
+      : cacheMissTokens! + (usage.cacheReadTokens ?? 0)
+    const record = buildSafeCacheAuditRecord({
+      fingerprint: fingerprintStablePrefix(parentStable),
+      estimatedSharedPrefixTokens: Math.ceil(JSON.stringify(parentStable).length / 4),
+      parentSessionId: String(parent.session.header.id),
+      childSessionId: String(forkChild.session.header.id),
+      mode: 'fork',
+      eligible: true,
+      reason: 'identical-fork-prefix',
+      ...(usage?.cacheReadTokens === undefined ? {} : { cacheReadTokens: usage.cacheReadTokens }),
+      ...(cacheMissTokens === undefined ? {} : { cacheMissTokens }),
+      ...(observedPromptTokens === undefined ? {} : { observedPromptTokens }),
+    })
+    expect(JSON.stringify(record)).not.toContain(PARENT_TEXT)
+    expect(JSON.stringify(record)).not.toContain(CHILD_TEXT)
+    console.info(`SUBAGENT_CACHE_E2E ${JSON.stringify(record)}`)
+
+    const spawnRun = await ctx.subagents.start('spawn', {
+      prompt: [{ type: 'text', text: SPAWN_TEXT }],
+      parent,
+      signal: new AbortController().signal,
+    })
+    await spawnRun.result
+    const spawnChild = spawnRun.localAgent
+    expect(spawnChild).toBeDefined()
+    if (spawnChild === undefined) throw new Error('spawn did not publish a local agent')
+    const spawnRequest = requests.get(String(spawnRun.id))?.at(-1)
+    expect(spawnChild.session.header.parentSession).toBe(parent.session.header.id)
+    expect(spawnChild.session.header.seedLength).toBeUndefined()
+    expect(spawnRequest).toBeDefined()
+    expect(JSON.stringify(spawnRequest!.messages)).not.toContain(PARENT_TEXT)
+    expect(assessReusablePrefix({
+      mode: 'spawn',
+      inheritsParentContext: false,
+      parent: parentStable,
+      child: envelope(spawnRequest!),
+    })).toEqual({ eligible: false, reason: 'spawn-does-not-inherit' })
+
+    await spawnRun.dispose()
+    await forkRun.dispose()
+  }, 180_000)
+})

package/packages/selector/tests/support/cache-prefix-audit.ts

@@ -0,0 +1,105 @@
+import { createHash } from 'node:crypto'
+
+const CACHE_PREFIX_AUDIT_VERSION = 'dsh-prefix-audit-v1' as const
+
+type JsonPrimitive = boolean | number | string | null
+export type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue }
+
+export interface StablePrefixEnvelope {
+  provider: string
+  model: string
+  system: JsonValue
+  tools: JsonValue[]
+  messages: JsonValue[]
+}
+
+export interface PrefixAssessmentInput {
+  mode: 'fork' | 'spawn'
+  inheritsParentContext: boolean
+  parent: StablePrefixEnvelope
+  child: StablePrefixEnvelope
+}
+
+export interface CacheUsage {
+  cacheReadTokens: number
+  cacheMissTokens: number
+  observedPromptTokens: number
+}
+
+export interface SafeCacheAuditInput {
+  fingerprint: string
+  estimatedSharedPrefixTokens: number
+  parentSessionId: string
+  childSessionId: string
+  mode: 'fork' | 'spawn'
+  eligible: boolean
+  reason: string
+  cacheReadTokens?: number
+  cacheMissTokens?: number
+  observedPromptTokens?: number
+}
+
+const canonicalize = (value: unknown): unknown => {
+  if (Array.isArray(value)) return value.map(canonicalize)
+  if (value === null || typeof value !== 'object') return value
+
+  return Object.fromEntries(
+    Object.entries(value as Record<string, unknown>)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => [key, canonicalize(item)]),
+  )
+}
+
+const canonicalJson = (value: unknown): string => JSON.stringify(canonicalize(value))
+
+export const fingerprintStablePrefix = (envelope: StablePrefixEnvelope): string => {
+  const payload = canonicalJson({ auditVersion: CACHE_PREFIX_AUDIT_VERSION, envelope })
+  return createHash('sha256').update(payload, 'utf8').digest('hex')
+}
+
+export const assessReusablePrefix = (
+  input: PrefixAssessmentInput,
+): { eligible: boolean; reason: 'identical-fork-prefix' | 'spawn-does-not-inherit' | 'stable-prefix-mismatch' } => {
+  if (input.mode === 'spawn' || !input.inheritsParentContext) {
+    return { eligible: false, reason: 'spawn-does-not-inherit' }
+  }
+  if (canonicalJson(input.parent) !== canonicalJson(input.child)) {
+    return { eligible: false, reason: 'stable-prefix-mismatch' }
+  }
+  return { eligible: true, reason: 'identical-fork-prefix' }
+}
+
+export const validateCacheUsage = (usage: CacheUsage): boolean => (
+  Number.isSafeInteger(usage.cacheReadTokens)
+  && Number.isSafeInteger(usage.cacheMissTokens)
+  && Number.isSafeInteger(usage.observedPromptTokens)
+  && usage.cacheReadTokens >= 0
+  && usage.cacheMissTokens >= 0
+  && usage.observedPromptTokens >= 0
+  && usage.cacheReadTokens + usage.cacheMissTokens === usage.observedPromptTokens
+)
+
+export const buildSafeCacheAuditRecord = (input: SafeCacheAuditInput) => ({
+  auditVersion: CACHE_PREFIX_AUDIT_VERSION,
+  fingerprint: input.fingerprint,
+  estimatedSharedPrefixTokens: input.estimatedSharedPrefixTokens,
+  parentSessionId: input.parentSessionId,
+  childSessionId: input.childSessionId,
+  mode: input.mode,
+  eligible: input.eligible,
+  reason: input.reason,
+  cacheReadTokens: input.cacheReadTokens ?? null,
+  cacheMissTokens: input.cacheMissTokens ?? null,
+  observedPromptTokens: input.observedPromptTokens ?? null,
+  confirmationStatus: input.cacheReadTokens !== undefined
+    && input.cacheMissTokens !== undefined
+    && input.observedPromptTokens !== undefined
+    && input.cacheReadTokens > 0
+    && validateCacheUsage({
+      cacheReadTokens: input.cacheReadTokens,
+      cacheMissTokens: input.cacheMissTokens,
+      observedPromptTokens: input.observedPromptTokens,
+    })
+    ? 'confirmed'
+    : 'unconfirmed',
+})

package/packages/selector/tests/support/mock-adapter.ts

@@ -0,0 +1,37 @@
+import type {
+  GenerateOptions,
+  LlmResolvedModelInfo,
+  StreamChunk,
+} from '@deepseek-ai/dsh-llm'
+import { LlmAdapter } from '@deepseek-ai/dsh-llm'
+
+/** Minimal scripted adapter using only the published LLM test surface. */
+export class PublicMockAdapter extends LlmAdapter {
+  constructor(private readonly script: StreamChunk[][]) {
+    super()
+  }
+
+  override resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo> {
+    return Promise.resolve({ provider, id: model, name: model })
+  }
+
+  async * stream(options: GenerateOptions): AsyncIterable<StreamChunk> {
+    const chunks = this.script.shift()
+    if (chunks === undefined) throw new Error('PublicMockAdapter: script exhausted')
+    for (const chunk of chunks) {
+      if (options.signal?.aborted === true) throw new Error('aborted')
+      yield chunk
+    }
+  }
+}
+
+/** One deterministic text response for the concrete AgentLoop. */
+export function publicTextResponse(text: string): StreamChunk[] {
+  return [
+    { type: 'block-start', index: 0, blockType: 'text' },
+    { type: 'text-delta', index: 0, text },
+    { type: 'block-end', index: 0, block: { type: 'text', text } },
+    { type: 'usage', usage: { inputTokens: 10, outputTokens: text.length } },
+    { type: 'finish', reason: { kind: 'stop' } },
+  ]
+}

package/packages/selector/tests/support/ui-primitives.tsx

@@ -0,0 +1,34 @@
+import type { ReactNode } from 'react'
+
+interface MenuItem {
+  id: string
+  label: ReactNode
+}
+
+interface MenuProps {
+  anchor: ReactNode
+  items: readonly MenuItem[]
+  onSelect: (id: string) => void
+  open: boolean
+}
+
+export function IconChevronDownOutline14({ className }: { className?: string }) {
+  return <span aria-hidden="true" className={className}>⌄</span>
+}
+
+export function Menu({ anchor, items, onSelect, open }: MenuProps) {
+  return (
+    <>
+      {anchor}
+      {open ? (
+        <div role="menu">
+          {items.map(item => (
+            <button key={item.id} role="menuitem" type="button" onClick={() => { onSelect(item.id) }}>
+              {item.label}
+            </button>
+          ))}
+        </div>
+      ) : null}
+    </>
+  )
+}

package/packages/selector/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib",
+    "composite": true,
+    "declaration": true,
+    "declarationMap": false
+  },
+  "include": ["src"]
+}

package/packages/selector/tsdown.client.config.ts

@@ -0,0 +1,102 @@
+import { createHash } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import { basename, dirname, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'tsdown'
+import { transform } from 'lightningcss'
+
+const PLUGIN_ID = 'dsh-context-compression-improved'
+const SELECTOR_ROOT = dirname(fileURLToPath(import.meta.url))
+const CSS_PREFIX = '\0dsh-context-compression-css:'
+const CSS_SUFFIX = '.mjs'
+const CLIENT_EXTERNALS = new Set([
+  'react',
+  'react/jsx-runtime',
+  '@deepseek-ai/dsh-client-ui-primitives',
+])
+const cssFiles = new Map<string, string>()
+
+function stableCssFileId(file: string): string {
+  const id = relative(SELECTOR_ROOT, file).replaceAll('\\', '/')
+  if (id === '..' || id.startsWith('../')) {
+    throw new Error(`CSS module is outside the selector package: ${id}`)
+  }
+  return id
+}
+
+function styleModule(file: string, css: string, classMap: Readonly<Record<string, string>>): string {
+  const tagId = `${PLUGIN_ID}/${basename(file)}`
+  return [
+    `const css = ${JSON.stringify(css)};`,
+    `const tagId = ${JSON.stringify(tagId)};`,
+    'if (typeof document !== "undefined" && document.querySelector(`style[data-plugin-css="${tagId}"]`) === null) {',
+    '  const tag = document.createElement("style");',
+    `  tag.dataset.plugin = ${JSON.stringify(PLUGIN_ID)};`,
+    '  tag.dataset.pluginCss = tagId;',
+    '  tag.textContent = css;',
+    '  document.head.appendChild(tag);',
+    '}',
+    `export default ${JSON.stringify(classMap)};`,
+  ].join('\n')
+}
+
+export default defineConfig({
+  name: `${PLUGIN_ID}/client`,
+  entry: { client: 'src/client/index.ts' },
+  outDir: 'lib',
+  format: 'cjs',
+  platform: 'browser',
+  target: 'es2023',
+  dts: false,
+  clean: false,
+  fixedExtension: false,
+  hash: false,
+  sourcemap: false,
+  deps: {
+    neverBundle: specifier => CLIENT_EXTERNALS.has(specifier),
+    alwaysBundle: specifier => !CLIENT_EXTERNALS.has(specifier),
+  },
+  define: {
+    'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV ?? 'production'),
+    'import.meta.env.MODE': JSON.stringify(process.env.NODE_ENV ?? 'production'),
+    'import.meta.env': JSON.stringify({ MODE: process.env.NODE_ENV ?? 'production' }),
+  },
+  plugins: [{
+    name: 'dsh-context-compression-css-inline',
+    resolveId(source: string, importer: string | undefined) {
+      if (!source.endsWith('.module.css')) return null
+      const file = importer === undefined ? source : resolve(dirname(importer), source)
+      const digest = createHash('sha256').update(stableCssFileId(file)).digest('hex').slice(0, 12)
+      const id = `${CSS_PREFIX}${digest}-${basename(file)}${CSS_SUFFIX}`
+      cssFiles.set(id, file)
+      return id
+    },
+    async load(id: string) {
+      const file = cssFiles.get(id)
+      if (file === undefined) return null
+      this.addWatchFile(file)
+      const source = await readFile(file)
+      const stableFile = stableCssFileId(file)
+      const result = transform({
+        // lightningcss includes filename in CSS Modules hashes. A package-
+        // relative identity keeps reviewed tarballs byte-for-byte stable when
+        // the repository is cloned or moved to a different absolute path.
+        filename: stableFile,
+        code: source,
+        cssModules: { pattern: '[hash]_[local]' },
+        minify: true,
+      })
+      const classMap: Record<string, string> = {}
+      for (const [local, value] of Object.entries(result.exports ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
+        classMap[local] = value.name
+      }
+      return styleModule(file, result.code.toString(), classMap)
+    },
+  }],
+  outputOptions: {
+    entryFileNames: 'client.js',
+    banner: `window.__ModuleLoader__.load({ id: ${JSON.stringify(PLUGIN_ID)}, factory: (require) => {`,
+    intro: 'var module = { exports: {} }; var exports = module.exports;',
+    footer: 'return module.exports; } });',
+  },
+})

package/packages/selector/tsdown.config.ts

@@ -0,0 +1,20 @@
+import { defineConfig } from 'tsdown'
+
+export default defineConfig({
+  entry: {
+    index: 'src/index.ts',
+    pruner: 'src/pruner.ts',
+    invariant: 'src/invariant.ts',
+    // This ESM face supplies client.d.ts. The sequential client build then
+    // overwrites only client.js with the Harness lazy-CJS artifact.
+    client: 'src/client/index.ts',
+  },
+  format: 'esm',
+  dts: true,
+  clean: true,
+  outDir: 'lib',
+  fixedExtension: false,
+  hash: false,
+  sourcemap: false,
+  deps: { neverBundle: true },
+})

package/pnpm-workspace.yaml

@@ -0,0 +1,19 @@
+packages:
+  - packages/*
+
+linkWorkspacePackages: true
+
+peerDependencyRules:
+  allowedVersions:
+    typescript: ">=5 <7"
+
+allowBuilds:
+  esbuild: true
+  "@huggingface/tokenizers": true
+
+# GHSA-2883-xcg3-v3hh - js-yaml < 4.3.2 does not bound CPU use for empty merge
+# sources. @deepseek-ai/cordis-plugin-include and @deepseek-ai/dsh-agent-presets
+# both declare ranges that already allow the patch, yet keep resolving 4.3.1, so
+# the floor is pinned here instead of waiting on their next release.
+overrides:
+  js-yaml@<4.3.2: ^4.3.2

package/scripts/capture-profile-baseline.ts

@@ -0,0 +1,80 @@
+/**
+ * One-off baseline capture: freeze the resolvePolicy output for the pre-existing
+ * profiles (before 'tokenpilot-inspired' is added) into a JSON fixture used by
+ * tests/runtime/tokenpilot/profile-baseline.spec.ts as the backward-compat golden.
+ *
+ * Usage: node scripts-dist/capture-profile-baseline.js [baseline-file]
+ */
+import { writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+
+/** The slice of the built pruner entry this capture consumes. */
+interface PrunerRuntime {
+  resolveConfig: (input: Record<string, unknown>) => Record<string, unknown>
+  resolvePolicy: (
+    config: Record<string, unknown>,
+    profile: string,
+    custom: unknown,
+    options: Record<string, unknown>,
+  ) => Record<string, unknown>
+}
+
+/** One option matrix row. */
+interface OptionCase {
+  label: string
+  options: Record<string, unknown>
+}
+
+/** One custom-document matrix row. */
+interface CustomDocCase {
+  label: string
+  custom: unknown
+}
+
+/** The fixture shape `profile-baseline.spec.ts` reads back. */
+interface ProfileBaseline {
+  capturedAt: string
+  profiles: Record<string, Record<string, Record<string, unknown>>>
+}
+
+const require = createRequire(import.meta.url)
+const runtime = require('../packages/selector/lib/pruner.js') as PrunerRuntime
+
+const OLD_PROFILES: readonly string[] = [
+  'off',
+  'native',
+  'balanced',
+  'cache-strict',
+  'savings',
+  'adaptive',
+  'custom',
+]
+const baseConfig = runtime.resolveConfig({})
+const OPTION_CASES: readonly OptionCase[] = [
+  { label: 'defaults', options: {} },
+  { label: 'linkage', options: { contextWindowTokens: 128_000, autoCompactThresholdPercent: 80 } },
+]
+const CUSTOM_DOCS: readonly CustomDocCase[] = [
+  { label: 'default-custom', custom: undefined },
+]
+
+const snapshot: ProfileBaseline = { capturedAt: 'pre-tokenpilot-inspired', profiles: {} }
+for (const profile of OLD_PROFILES) {
+  const byCase: Record<string, Record<string, unknown>> = {}
+  snapshot.profiles[profile] = byCase
+  for (const optionCase of OPTION_CASES) {
+    for (const customCase of CUSTOM_DOCS) {
+      const key = `${optionCase.label}${customCase.label === 'default-custom' ? '' : `/${customCase.label}`}`
+      byCase[key] = runtime.resolvePolicy(
+        baseConfig,
+        profile,
+        customCase.custom,
+        optionCase.options,
+      )
+    }
+  }
+}
+
+const out = process.argv[2] ?? 'packages/selector/tests/runtime/fixtures/profile-baseline.json'
+writeFileSync(out, `${JSON.stringify(snapshot, null, 2)}\n`)
+console.log(`baseline written: ${out}`)