dsh-context-compression-improved 0.2.1 → 0.3.1

package/scripts/{packed-install-e2e.ts → packed-install-e2e.mjs}

@@ -1,12 +1,9 @@
-/* eslint-disable @typescript-eslint/no-explicit-any, @typescript-eslint/ban-ts-comment -- standalone E2E test script; DSH internal types unavailable */
-// @ts-nocheck
-// internals and cordis augmented services outside the scripts tsconfig scope.
 import { createHash } from 'node:crypto'
 import { spawn } from 'node:child_process'
 import { createReadStream } from 'node:fs'
 import { copyFile, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from 'node:fs/promises'
 import { readFileSync } from 'node:fs'
-import { createServer, IncomingMessage, ServerResponse, Server } from 'node:http'
+import { createServer } from 'node:http'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
@@ -17,43 +14,21 @@ const root = fileURLToPath(new URL('..', import.meta.url))
 // Release mode (default) is fail-closed: the upgrade leg and the official
 // clean-harness lifecycle must both run to green or the gate exits non-zero.
 // Set DSH_E2E_MODE=dev for an offline smoke with explicit skip markers.
-const e2eMode: 'dev' | 'release' = process.env.DSH_E2E_MODE === 'dev' ? 'dev' : 'release'
+const e2eMode = process.env.DSH_E2E_MODE === 'dev' ? 'dev' : 'release'
 const packages = [
   { directory: join(root, 'packages/selector') },
 ]
-const officialHostPackages = [
-  '@deepseek-ai/cordis@4.0.1',
-  '@deepseek-ai/cordis-plugin-group@1.0.1',
-  '@deepseek-ai/cordis-plugin-include@1.0.6',
-  '@deepseek-ai/cordis-plugin-loader@1.0.2',
-  '@deepseek-ai/dsh-agent@0.1.1-rc.2',
-  '@deepseek-ai/dsh-agent-loop@0.1.1-rc.2',
-  '@deepseek-ai/dsh-agent-loop-testkit@0.1.1-rc.2',
-  '@deepseek-ai/dsh-agent-presets@0.1.1-rc.2',
-  '@deepseek-ai/dsh-commands@0.1.1-rc.2',
-  '@deepseek-ai/dsh-command-compact@0.1.1-rc.2',
-  '@deepseek-ai/dsh-compaction-basic@0.1.1-rc.2',
-  '@deepseek-ai/dsh-llm@0.1.1-rc.2',
-  '@deepseek-ai/dsh-session@0.1.1-rc.2',
-  '@deepseek-ai/dsh-scope@0.1.1-rc.2',
-  '@deepseek-ai/dsh-settings@0.1.1-rc.2',
-  '@deepseek-ai/dsh-system-prompt@0.1.1-rc.2',
-  '@deepseek-ai/dsh-token-meter@0.1.1-rc.2',
-  '@deepseek-ai/dsh-tools@0.1.1-rc.2',
-]
-
-// On Windows npm and pnpm only exist as .cmd shims, which Node refuses to
-// spawn directly, so those two are routed through the shell.
-const spawnTool = (command: string, args: string[], options?: Record<string, unknown>) => spawn(
-  command,
-  args,
-  process.platform === 'win32' && (command === 'npm' || command === 'pnpm')
-    ? { ...options, shell: true }
-    : options,
-)
+// The full @deepseek-ai/* host closure (pinned in the workspace root manifest,
+// currently 0.1.5-rc.2): auto-installed peers must all resolve from the mock
+// registry, so the list must cover every peer the packed plugins and the
+// official packages declare.
+const rootManifest = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'))
+const officialHostPackages = Object.entries(rootManifest.devDependencies)
+  .filter(([name]) => name.startsWith('@deepseek-ai/'))
+  .map(([name, version]) => `${name}@${version}`)
 
-const run = (command: string, args: string[], options: Record<string, unknown> = {}): Promise<void> => new Promise((resolve, reject) => {
-  const child = spawnTool(command, args, { stdio: 'inherit', ...options })
+const run = (command, args, options = {}) => new Promise((resolve, reject) => {
+  const child = spawn(command, args, { stdio: 'inherit', shell: process.platform === 'win32', ...options })
   child.once('error', reject)
   child.once('exit', (code, signal) => {
     if (code === 0) resolve()
@@ -61,14 +36,14 @@ const run = (command: string, args: string[], options: Record<string, unknown> =
   })
 })
 
-const capture = (command: string, args: string[], options: Record<string, unknown> = {}): Promise<{ stdout: string; stderr: string }> => new Promise((resolve, reject) => {
-  const child = spawnTool(command, args, { ...options, stdio: ['ignore', 'pipe', 'pipe'] })
+const capture = (command, args, options = {}) => new Promise((resolve, reject) => {
+  const child = spawn(command, args, { shell: process.platform === 'win32', ...options, stdio: ['ignore', 'pipe', 'pipe'] })
   let stdout = ''
   let stderr = ''
-  child.stdout!.setEncoding('utf8')
-  child.stderr!.setEncoding('utf8')
-  child.stdout!.on('data', (chunk: string) => { stdout += chunk })
-  child.stderr!.on('data', (chunk: string) => { stderr += chunk })
+  child.stdout.setEncoding('utf8')
+  child.stderr.setEncoding('utf8')
+  child.stdout.on('data', chunk => { stdout += chunk })
+  child.stderr.on('data', chunk => { stderr += chunk })
   child.once('error', reject)
   child.once('exit', (code, signal) => {
     if (code === 0) resolve({ stdout, stderr })
@@ -80,26 +55,19 @@ const capture = (command: string, args: string[], options: Record<string, unknow
   })
 })
 
-interface CaptureOutcome {
-  code: number | null
-  signal: NodeJS.Signals | null
-  stdout: string
-  stderr: string
-}
-
-const captureOutcome = (command: string, args: string[], options: Record<string, unknown> = {}): Promise<CaptureOutcome> => new Promise((resolve, reject) => {
-  const child = spawnTool(command, args, { ...options, stdio: ['ignore', 'pipe', 'pipe'] })
+const captureOutcome = (command, args, options = {}) => new Promise((resolve, reject) => {
+  const child = spawn(command, args, { shell: process.platform === 'win32', ...options, stdio: ['ignore', 'pipe', 'pipe'] })
   let stdout = ''
   let stderr = ''
-  child.stdout!.setEncoding('utf8')
-  child.stderr!.setEncoding('utf8')
-  child.stdout!.on('data', (chunk: string) => { stdout += chunk })
-  child.stderr!.on('data', (chunk: string) => { stderr += chunk })
+  child.stdout.setEncoding('utf8')
+  child.stderr.setEncoding('utf8')
+  child.stdout.on('data', chunk => { stdout += chunk })
+  child.stderr.on('data', chunk => { stderr += chunk })
   child.once('error', reject)
   child.once('exit', (code, signal) => resolve({ code, signal, stdout, stderr }))
 })
 
-const allocateLoopbackPort = (): Promise<number> => new Promise((resolve, reject) => {
+const allocateLoopbackPort = () => new Promise((resolve, reject) => {
   const server = createServer()
   server.once('error', reject)
   server.listen(0, '127.0.0.1', () => {
@@ -112,19 +80,14 @@ const allocateLoopbackPort = (): Promise<number> => new Promise((resolve, reject
   })
 })
 
-const assert = (condition: unknown, message: string): asserts condition => {
+const assert = (condition, message) => {
   if (!condition) throw new Error(`packed Host smoke: ${message}`)
 }
 
-interface Violation {
-  label: string
-  pattern: RegExp
-}
-
-async function scanPublishedTree(packageRoot: string) {
+async function scanPublishedTree(packageRoot) {
   const pending = [packageRoot]
-  const violations: string[] = []
-  const forbidden: Violation[] = [
+  const violations = []
+  const forbidden = [
     { label: 'developer absolute path', pattern: /(?:\/home\/|[A-Za-z]:\\Users\\)/u },
     { label: 'OpenAI-style secret', pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/u },
     { label: 'NPM token', pattern: /\bnpm_[A-Za-z0-9]{20,}\b/u },
@@ -132,7 +95,7 @@ async function scanPublishedTree(packageRoot: string) {
     { label: 'assigned DeepSeek API key', pattern: /DEEPSEEK_API_KEY\s*=\s*[^\s"']+/u },
   ]
   while (pending.length > 0) {
-    const directory = pending.pop()!
+    const directory = pending.pop()
     for (const entry of await readdir(directory, { withFileTypes: true })) {
       const path = join(directory, entry.name)
       if (entry.isDirectory()) {
@@ -150,9 +113,9 @@ async function scanPublishedTree(packageRoot: string) {
   if (violations.length > 0) throw new Error(`packed content scan failed:\n${violations.join('\n')}`)
 }
 
-async function runPackedHostSmoke(consumerRoot: string) {
+async function runPackedHostSmoke(consumerRoot) {
   const consumerRequire = createRequire(join(consumerRoot, 'package.json'))
-  const load = async (specifier: string) => import(pathToFileURL(consumerRequire.resolve(specifier)).href)
+  const load = async specifier => import(pathToFileURL(consumerRequire.resolve(specifier)).href)
   const [
     cordis,
     groupModule,
@@ -167,6 +130,7 @@ async function runPackedHostSmoke(consumerRoot: string) {
     scopeModule,
     settingsModule,
     systemPromptModule,
+    sessionProjectionModule,
     tokenMeterModule,
     toolsModule,
     selectorModule,
@@ -184,10 +148,11 @@ async function runPackedHostSmoke(consumerRoot: string) {
     load('@deepseek-ai/dsh-scope'),
     load('@deepseek-ai/dsh-settings'),
     load('@deepseek-ai/dsh-system-prompt'),
+    load('@deepseek-ai/dsh-session-projection'),
     load('@deepseek-ai/dsh-token-meter'),
     load('@deepseek-ai/dsh-tools'),
     load('dsh-context-compression-improved'),
-  ]) as any[]
+  ])
 
   class MemorySettings extends settingsModule.SettingsProvider {
     writable = true
@@ -215,46 +180,48 @@ async function runPackedHostSmoke(consumerRoot: string) {
   const runtime = new cordis.Context()
   try {
     runtime.baseUrl = `${pathToFileURL(presetRoot).href}/`
-    await runtime.plugin(loaderModule.default)
+    await runtime.plugin(loaderModule.default).await()
     runtime.loader.builtins.include = includeModule.default
     runtime.loader.builtins.group = groupModule.default
-    await runtime.plugin(llmModule.default)
-    await runtime.plugin(sessionModule.default)
-    await runtime.plugin(systemPromptModule.default, { persona: '' })
-    await runtime.plugin(toolsModule.default)
-    await runtime.plugin(agentModule.default)
-    await runtime.plugin(agentLoopModule.default, { agents: [] })
-    await runtime.plugin(commandsModule.default)
-    await runtime.plugin(tokenMeterModule.default)
-    await runtime.plugin(MemorySettings)
+    await runtime.plugin(llmModule.default).await()
+    await runtime.plugin(sessionModule.default).await()
+    await runtime.plugin(systemPromptModule.default, { personaPrefix: '' }).await()
+    await runtime.plugin(toolsModule.default).await()
+    await runtime.plugin(agentModule.default).await()
+    await runtime.plugin(agentLoopModule.default, { agents: [] }).await()
+    await runtime.plugin(commandsModule.default).await()
+    await runtime.plugin(sessionProjectionModule.default).await()
+    await runtime.plugin(tokenMeterModule.default).await()
+    await runtime.plugin(MemorySettings).await()
     await runtime.plugin(presetsModule.default, {
       default: 'standard',
       roots: [{ path: presetRoot, trust: 'system' }],
+      includeShippedRoot: false,
       includeUserRoot: false,
-    })
+    }).await()
     await runtime.plugin({
-      apply: (selectorCtx: any) => selectorModule.apply(selectorCtx, { presetOverlay: true }),
+      apply: selectorCtx => selectorModule.apply(selectorCtx, { presetOverlay: true }),
     }).await()
 
-    const createAgent = async (sessionId: string, preset: string) => {
+    const createAgent = async (sessionId, preset) => {
       const handle = await runtime.agents.create({
         sessionId: sessionModule.SessionId(sessionId),
-        setup: async (agentCtx: any) => void await runtime.agentPresets.mount(agentCtx, preset),
+        setup: async agentCtx => void await runtime.agentPresets.mount(agentCtx, preset),
       })
       return handle.agent
     }
-    const hasRetrieve = (agent: any) => runtime.tools.get(
+    const hasRetrieve = agent => runtime.tools.get(
       'context_compression_retrieve',
       scopeModule.scopeOf(agent.ctx),
     ) !== undefined
-    const hasCompact = (agent: any) => runtime.commands.list(agent)
-      .some((command: any) => command.name === 'compact')
-    const hasCompleteStack = (agent: any) =>
+    const hasCompact = agent => runtime.commands.list(agent)
+      .some(command => command.name === 'compact')
+    const hasCompleteStack = agent =>
       runtime.agentPresets.serviceFor(agent, 'toolResultPruner') !== undefined
       && runtime.agentPresets.serviceFor(agent, 'compaction') !== undefined
       && hasRetrieve(agent)
       && hasCompact(agent)
-    const hasNoStack = (agent: any) =>
+    const hasNoStack = agent =>
       runtime.agentPresets.serviceFor(agent, 'toolResultPruner') === undefined
       && runtime.agentPresets.serviceFor(agent, 'compaction') === undefined
       && !hasRetrieve(agent)
@@ -278,7 +245,7 @@ async function runPackedHostSmoke(consumerRoot: string) {
     const parent = await createAgent('packed-host-parent', 'standard')
     const childHandle = await runtime.agents.create({
       sessionId: sessionModule.SessionId('packed-host-child'),
-      setup: (childCtx: any) => void runtime.agentPresets.composeFrom(childCtx, parent.ctx),
+      setup: childCtx => void runtime.agentPresets.composeFrom(childCtx, parent.ctx),
     })
     const child = childHandle.agent
     const original = Symbol.for('cordis.original')
@@ -290,14 +257,14 @@ async function runPackedHostSmoke(consumerRoot: string) {
       'parent or child pruner is missing')
     assert(parentCompaction !== undefined && childCompaction !== undefined,
       'parent or child compaction engine is missing')
-    assert(Object.is((childPruner as any)[original], (parentPruner as any)[original]),
+    assert(Object.is(childPruner[original], parentPruner[original]),
       'child did not inherit the parent pruner instance')
-    assert(Object.is((childCompaction as any)[original], (parentCompaction as any)[original]),
+    assert(Object.is(childCompaction[original], parentCompaction[original]),
       'child did not inherit the parent compaction instance')
     assert(hasRetrieve(child) && hasCompact(child),
       'child lacks the inherited retrieve tool or compact command')
 
-    const namespace = settingsModule.settingsNamespace('context-compression')
+    const namespace = 'context-compression'
     const settings = runtime.settings.get(namespace)
     assert(settings.custom.history.trigger === 500_000,
       'packed Host did not expose the 500000 History default')
@@ -318,24 +285,19 @@ async function runPackedHostSmoke(consumerRoot: string) {
   }
 }
 
-async function runOfficialCloneCliSmoke(
-  referenceRoot: string,
-  registry: string,
-  upgradeFrom: string | undefined,
-  candidateVersion: string,
-) {
+async function runOfficialCloneCliSmoke(referenceRoot, registry, upgradeFrom, candidateVersion) {
   const clone = await realpath(referenceRoot)
-  const git = async (...args: string[]) => (await capture('git', args, { cwd: clone })).stdout.trim()
+  const git = async (...args) => (await capture('git', args, { cwd: clone })).stdout.trim()
   const before = {
     tag: await git('describe', '--tags', '--exact-match'),
     commit: await git('rev-parse', 'HEAD'),
     tree: await git('rev-parse', 'HEAD^{tree}'),
     status: await git('status', '--porcelain'),
   }
-  assert(before.tag === 'dsh-v0.1.1-rc.2', `official clone tag is ${before.tag}`)
-  assert(before.commit === 'b150a551b8d465e31e418e1b2eaf5e79bbb7d28e',
+  assert(before.tag === 'dsh-v0.1.5-rc.2', `official clone tag is ${before.tag}`)
+  assert(before.commit === 'fb2c4b9e698e30edb738bca4cf0618587db7d203',
     `official clone commit is ${before.commit}`)
-  assert(before.tree === '53915efe4e2126cc7779b73dfc8a3bcec5318c44',
+  assert(before.tree === 'bd7dd6d90010a35d3d6ff9f12c1f6207d5b6fe38',
     `official clone tree is ${before.tree}`)
   assert(before.status === '', 'official clone is dirty before CLI smoke')
 
@@ -344,12 +306,13 @@ async function runOfficialCloneCliSmoke(
   const dshHome = join(temporaryRoot, 'dsh-home')
   let added = false
   const environment = { ...process.env, DSH_HOME: dshHome }
-  const dsh = (...args: string[]) => run('pnpm', ['dsh', ...args], { cwd: worktree, env: environment })
+  const dsh = (...args) => run('pnpm', ['dsh', ...args], { cwd: worktree, env: environment })
   const dumpConfig = () => capture('pnpm', ['dsh', '--profile', 'web', '--dump-config'], {
     cwd: worktree,
     env: environment,
   }).then(captured => captured.stdout)
 
+  /** Installed manifest of the profile-resolved plugin package. */
   const profilePackages = () => {
     const profileRoot = join(dshHome, 'profiles/web')
     const profileRequire = createRequire(join(profileRoot, 'package.json'))
@@ -357,25 +320,45 @@ async function runOfficialCloneCliSmoke(
     return {
       profileRoot,
       selectorPath,
-      selector: JSON.parse(readFileSync(selectorPath, 'utf8')) as Record<string, any>,
+      selector: JSON.parse(readFileSync(selectorPath, 'utf8')),
     }
   }
 
+  /**
+   * Peers a headless official profile can never provide: pure web-host UI
+   * packages supplied by the web app, not the CLI installation. The list is
+   * REVIEWED and exact — any OTHER unresolved selector peer fails the gate,
+   * and every web/client peer is still import-verified from the built
+   * client libraries below.
+   */
   const WEB_ONLY_HEADLESS_UNRESOLVED_PEERS = [
     '@deepseek-ai/dsh-client-ui-primitives',
     '@deepseek-ai/dsh-client-ui-slots',
   ]
 
+  /**
+   * Verify every web/client peer exists as a BUILT artifact resolvable from
+   * the packages that depend on it. Executable loading of the client stack
+   * happens under the web bundler, not bare Node (the UI packages ship CSS
+   * modules only a bundler can import): that load leg is the `build:web`
+   * step of the worktree's `pnpm run build` above, which fails closed when
+   * the client graph is broken.
+   */
   const proveBuiltClientPeersLoad = async () => {
     const clientPeers = [
       '@deepseek-ai/dsh-client-locale',
-      '@deepseek-ai/dsh-client-runtime',
+      '@deepseek-ai/dsh-client-store',
       '@deepseek-ai/dsh-client-ui-primitives',
       '@deepseek-ai/dsh-client-ui-settings',
       '@deepseek-ai/dsh-client-ui-slots',
       '@deepseek-ai/dsh-client-ui-workspace',
       'react',
     ]
+    // pnpm's isolated layout keeps each package's dependents in ITS own
+    // node_modules, so anchor resolution at the packages that actually
+    // depend on the client stack: the web-app bundle (locale, store,
+    // ui-settings, ui-workspace), the client-locale package (react,
+    // ui-primitives, ui-slots), and the web app.
     const anchors = JSON.stringify([
       join(worktree, 'packages/bundle/web-app/package.json'),
       join(worktree, 'packages/client/locale/package.json'),
@@ -398,6 +381,15 @@ async function runOfficialCloneCliSmoke(
     return clientPeers.length
   }
 
+  /**
+   * Prove the plugin actually loads in the official profile: pnpm's peers
+   * check cannot see the healed profiles/node_modules fallback by design, so
+   * the release gate resolves and imports instead. Fail-closed parts: every
+   * RUNTIME peer (the engine surface the headless host must provide) and the
+   * selector's node entry with a callable apply(). The selector's remaining
+   * unresolved peers must equal the REVIEWED web-only whitelist above —
+   * anything else (a newly missing host dependency) fails immediately.
+   */
   const provePluginLoads = async () => {
     const { profileRoot, selector } = profilePackages()
     const selectorPeers = Object.keys(selector.peerDependencies ?? {})
@@ -431,7 +423,7 @@ async function runOfficialCloneCliSmoke(
       throw new Error(`official profile failed to load the plugin and its engine peers:\n${outcome.stdout}\n${outcome.stderr}`)
     }
     const unresolved = JSON.parse(marker.slice('LOAD_OK '.length))
-    const unexpected = unresolved.filter((peer: string) => !WEB_ONLY_HEADLESS_UNRESOLVED_PEERS.includes(peer))
+    const unexpected = unresolved.filter(peer => !WEB_ONLY_HEADLESS_UNRESOLVED_PEERS.includes(peer))
     if (unexpected.length > 0) {
       throw new Error(`selector peers failed to resolve headless outside the reviewed web-only whitelist: ${unexpected.join(', ')}`)
     }
@@ -443,7 +435,18 @@ async function runOfficialCloneCliSmoke(
     }
   }
 
-  const runProfileBootProbe = async (phase: string, expectSeeded: boolean) => {
+  /**
+   * Boot the official profile FOR REAL through the CLI's own profile-boot
+   * path — not --dump-config, which composes YAML without booting or
+   * executing plugins. The probe mounts the full bundle tree (selector
+   * included), then proves: the settings service resolves the registered
+   * document (before the upgrade: the previous release's schema defaults;
+   * after: the seeded savings/73 document parsed with the INSTALLED runtime),
+   * the AgentPresets service composed the selector's standing overlay, and
+   * the overlay's generated composition exists with the deterministic
+   * identity filename. Any failure exits non-zero.
+  */
+  const runProfileBootProbe = async (phase, expectSeeded) => {
     const profilePort = await allocateLoopbackPort()
     const { profileRoot } = profilePackages()
     const settingsProof = expectSeeded
@@ -457,6 +460,9 @@ async function runOfficialCloneCliSmoke(
         '  }',
       ]
       : [
+        // The previous release predates the autoCompact section and the
+        // public parser; prove its OWN schema resolved the registered
+        // namespace into a complete supported document instead.
         "  if (raw?.profile !== 'balanced' || raw?.custom?.version !== 3) {",
         "    throw new Error('boot probe: previous-release settings defaults did not resolve: ' + JSON.stringify(raw))",
         '  }',
@@ -470,6 +476,10 @@ async function runOfficialCloneCliSmoke(
       `const worktree = String.raw\`${worktree}\``,
       `const profileRoot = String.raw\`${join(profileRoot, 'package.json')}\``,
       'const bootModule = await import(pathToFileURL(join(worktree, \'apps/cli/src/profile-boot.ts\')).href)',
+      // Import the workspace packages from their source trees (pinned, like
+      // the profile-boot path above): the probe runs under tsx, and their
+      // lib/ artifacts are only produced by the full release build, not the
+      // library faces.
       "const appBoot = await import(pathToFileURL(join(worktree, 'packages/boot/app-boot/src/index.ts')).href)",
       "const settingsModule = await import(pathToFileURL(join(worktree, 'packages/settings/settings/src/index.ts')).href)",
       'const preBootStores = new Set(await readdir(tmpdir()))',
@@ -482,7 +492,7 @@ async function runOfficialCloneCliSmoke(
       'try {',
       "  const settings = ctx.get('settings')",
       "  if (settings === undefined) throw new Error('boot probe: settings service missing')",
-      "  const raw = settings.get(settingsModule.settingsNamespace('context-compression'))",
+      "  const raw = settings.get('context-compression')",
       ...settingsProof,
       "  const presets = ctx.get('agentPresets')",
       "  if (presets === undefined) throw new Error('boot probe: agentPresets service missing')",
@@ -490,6 +500,8 @@ async function runOfficialCloneCliSmoke(
       '  if (key?.agentPreset !== \'standard\') {',
       "    throw new Error('boot probe: standing key did not compose the default preset: ' + JSON.stringify(key))",
       '  }',
+      // Only stores CREATED BY THIS BOOT count: stale leftovers from earlier
+      // runs or concurrent harnesses must never satisfy the overlay proof.
       '  const generated = []',
       "  for (const entry of await readdir(tmpdir(), { withFileTypes: true })) {",
       '    if (!entry.isDirectory() || preBootStores.has(entry.name)) continue',
@@ -498,7 +510,7 @@ async function runOfficialCloneCliSmoke(
       '    try {',
       '      children = await readdir(join(tmpdir(), entry.name))',
       '    } catch {',
-      '      continue',
+      '      continue // a concurrent process disposed its store mid-scan',
       '    }',
       "    for (const child of children) {",
       "      if (/^standard-[0-9a-f]{24}\\.agent\\.cordis\\.yml$/u.test(child)) generated.push(child)",
@@ -526,6 +538,7 @@ async function runOfficialCloneCliSmoke(
     return JSON.parse(marker.slice('BOOT_PROBE_OK '.length))
   }
 
+  /** Seed real user settings through the plugin's own public surface. */
   const seedSettings = async () => {
     const { profileRoot } = profilePackages()
     const settingsPath = join(dshHome, 'settings.yaml')
@@ -558,7 +571,8 @@ async function runOfficialCloneCliSmoke(
     return settingsPath
   }
 
-  const proveSettingsPreserved = async (settingsPath: string) => {
+  /** Read the seeded settings back through the upgraded plugin's parser. */
+  const proveSettingsPreserved = async (settingsPath) => {
     const { profileRoot } = profilePackages()
     const script = [
       "const { readFileSync } = require('node:fs')",
@@ -587,8 +601,15 @@ async function runOfficialCloneCliSmoke(
     await run('git', ['worktree', 'add', '--detach', worktree, before.commit], { cwd: clone })
     added = true
     await run('pnpm', ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: worktree })
+    // A source checkout ships no built artifacts (install above skips
+    // prepare scripts). The boot probes run the REAL web profile —
+    // dsh-base + dsh-web-app, the only bundle that mounts agent-presets and
+    // therefore the selector's preset overlay — so build both library faces
+    // AND the web frontend; the healed profiles/node_modules fallback also
+    // symlinks the CLI's own workspace packages.
     await run('pnpm', ['run', 'build'], { cwd: worktree })
 
+    // Real lifecycle: start on the published previous release.
     if (upgradeFrom === undefined) throw new Error('release gate requires the previous published release for the official lifecycle')
     await dsh('plugin', '--profile', 'web', 'add',
       `dsh-context-compression-improved@${upgradeFrom}`, '--registry', registry)
@@ -597,14 +618,24 @@ async function runOfficialCloneCliSmoke(
       throw new Error(`official lifecycle started on ${String(beforeUp.selector.version)}, expected ${upgradeFrom}`)
     }
 
+    // Boot the profile once on the previous release. This asserts the added
+    // bundle layer is live before any update and heals
+    // $DSH_HOME/profiles/node_modules — the shared-module fallback the
+    // plugin's harness peers resolve through in every later raw-node proof.
     const addedDump = await dumpConfig()
     assert(addedDump.includes('context-compression-selector-bundle'),
       'official post-add dump lacks the selector Bundle layer')
 
+    // Real profile start on the previous release, BEFORE seeding: the
+    // previous-release schema predates the autoCompact section, so this probe
+    // proves its own defaults resolve; the seeded document is asserted by the
+    // post-up probe through the upgraded runtime.
     const postAddBoot = await runProfileBootProbe('post-add', false)
 
     const settingsPath = await seedSettings()
 
+    // Standard update command moves the one install-facing package; assert the
+    // version it lands before anything else runs.
     await dsh('plugin', '--profile', 'web', 'up',
       'dsh-context-compression-improved@latest', '--registry', registry)
     const afterUp = profilePackages()
@@ -621,6 +652,8 @@ async function runOfficialCloneCliSmoke(
     assert(upDump.match(/context-compression-selector-bundle/gu)?.length === 1,
       'official post-up dump contains more than one selector Bundle layer')
 
+    // pnpm's peers check is informational: plugin peers resolve through the
+    // healed profiles/node_modules fallback, which pnpm cannot see by design.
     const peers = await captureOutcome('pnpm', ['peers', 'check'], {
       cwd: join(dshHome, 'profiles/web'),
       env: environment,
@@ -642,7 +675,7 @@ async function runOfficialCloneCliSmoke(
       commit: before.commit,
       tree: before.tree,
       status: 'clean',
-      install: 'single-package',
+      install: 'entry-package-only',
       upgrade: {
         from: upgradeFrom,
         to: candidateVersion,
@@ -674,24 +707,13 @@ const comparisonRoot = fixedArtifactRoot === undefined
   ? undefined
   : await mkdtemp(join(tmpdir(), 'dsh-selector-rebuild-'))
 const consumerRoot = await mkdtemp(join(tmpdir(), 'dsh-selector-consumer-'))
-let server: Server | undefined
+let server
 
 try {
-  const registryPackages = new Map<string, {
-    filename: string
-    manifest: Record<string, any>
-    tarball: string
-    sha1: string
-    sha256?: string
-    integrity: string
-  }>()
-  const previousVersions = new Map<string, {
-    filename: string
-    manifest: Record<string, any>
-    tarball: string
-    sha1: string
-    integrity: string
-  }>()
+  const registryPackages = new Map()
+  // Published previous-release metadata served alongside the packed candidate
+  // so the upgrade leg can install the real shipped release first.
+  const previousVersions = new Map()
   // The predecessor is whatever the registry actually offers. This used to be
   // the pinned literal '0.1.0-beta.2', which only ever existed under this
   // package's pre-rename name, so it could never resolve under the current one.
@@ -710,13 +732,8 @@ try {
         break
       }
       if (!packumentResponse.ok) throw new Error(`packument responded ${packumentResponse.status}`)
-      const packument = await packumentResponse.json() as {
-        versions?: Record<string, unknown>
-        time?: Record<string, string>
-      }
-      const localVersion = JSON.parse(
-        await readFile(join(packages[0].directory, 'package.json'), 'utf8'),
-      ).version as string
+      const packument = await packumentResponse.json()
+      const localVersion = JSON.parse(await readFile(join(packages[0].directory, 'package.json'), 'utf8')).version
       const times = packument.time ?? {}
       // Publication order, not semver order: the version a user would be
       // upgrading from is the most recently published one that is not the
@@ -732,7 +749,7 @@ try {
       previousRelease = earlier[0]
       const response = await fetch(`https://registry.npmjs.org/${name}/${previousRelease}`)
       if (!response.ok) throw new Error(`packument responded ${response.status}`)
-      const manifest = await response.json() as Record<string, any>
+      const manifest = await response.json()
       const tarballResponse = await fetch(manifest.dist.tarball)
       if (!tarballResponse.ok) throw new Error(`tarball responded ${tarballResponse.status}`)
       const bytes = Buffer.from(await tarballResponse.arrayBuffer())
@@ -760,7 +777,7 @@ try {
     predecessorFound = true
   }
   for (const descriptor of packages) {
-    const manifest = JSON.parse(await readFile(join(descriptor.directory, 'package.json'), 'utf8')) as Record<string, any>
+    const manifest = JSON.parse(await readFile(join(descriptor.directory, 'package.json'), 'utf8'))
     if (fixedArtifactRoot === undefined) {
       await run('npm', ['pack', '--pack-destination', artifactRoot, descriptor.directory], { cwd: root })
     }
@@ -787,13 +804,13 @@ try {
     })
   }
 
-  server = createServer(async (request: IncomingMessage, response: ServerResponse) => {
+  server = createServer(async (request, response) => {
     try {
       const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1')
       const decodedPath = decodeURIComponent(requestUrl.pathname)
       for (const [name, descriptor] of registryPackages) {
         if (decodedPath === `/${name}`) {
-          const address = server!.address()
+          const address = server.address()
           if (address === null || typeof address === 'string') throw new Error('registry has no TCP address')
           const tarballUrl = `http://127.0.0.1:${address.port}/${name}/-/${descriptor.filename}`
           const version = {
@@ -850,22 +867,22 @@ try {
         method: request.method,
         headers: { accept: request.headers.accept ?? '*/*' },
       })
-      const headers: Record<string, string> = {}
+      const headers = {}
       for (const name of ['content-type', 'content-length', 'cache-control', 'etag', 'last-modified']) {
         const value = upstream.headers.get(name)
         if (value !== null) headers[name] = value
       }
       response.writeHead(upstream.status, headers)
       if (request.method === 'HEAD' || upstream.body === null) response.end()
-      else Readable.fromWeb(upstream.body as any).pipe(response)
+      else Readable.fromWeb(upstream.body).pipe(response)
     } catch (error) {
       response.writeHead(502, { 'content-type': 'text/plain' })
       response.end(error instanceof Error ? error.message : String(error))
     }
   })
-  await new Promise<void>((resolve, reject) => {
-    server!.once('error', reject)
-    server!.listen(0, '127.0.0.1', resolve)
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
   })
   const address = server.address()
   if (address === null || typeof address === 'string') throw new Error('registry has no TCP address')
@@ -876,8 +893,13 @@ try {
     version: '0.0.0',
     private: true,
   }, null, 2))
-  await writeFile(join(consumerRoot, 'pnpm-workspace.yaml'), 'packages: []\n')
+  // Stop pnpm's workspace walk-up: an ancestor with its own pnpm-workspace.yaml
+  // (e.g. a user home project) would otherwise absorb this consumer and land
+  // the install — and every resolution — outside the packed consumer.
+  await writeFile(join(consumerRoot, 'pnpm-workspace.yaml'), ['packages:', '  - .'].join(String.fromCharCode(10)))
   if (upgradeLeg === 'installed') {
+    // Real upgrade path: install the published previous release, then move to
+    // the packed candidate through the standard update command.
     await run('pnpm', [
       'add',
       `dsh-context-compression-improved@${previousRelease}`,
@@ -894,6 +916,7 @@ try {
       'dsh-context-compression-improved@latest',
       '--registry', registry,
     ], { cwd: consumerRoot })
+    // The up command must land the packed candidate version.
     const upgradedSelectorDir = await realpath(join(consumerRoot, 'node_modules/dsh-context-compression-improved'))
     const upgradedSelector = JSON.parse(await readFile(join(upgradedSelectorDir, 'package.json'), 'utf8'))
     const candidateVersion = registryPackages.get('dsh-context-compression-improved')?.manifest.version
@@ -917,22 +940,24 @@ try {
     throw new Error('packed package is not guarded by publishConfig.tag=latest')
   }
   for (const peer of ['@deepseek-ai/dsh-command-compact', '@deepseek-ai/dsh-compaction-basic']) {
-    if (selector.peerDependencies?.[peer] !== '>=0.1.1-rc.2 <0.2.0') {
+    if (selector.peerDependencies?.[peer] !== '>=0.1.5-rc.2 <0.2.0-0') {
       throw new Error(`packed selector has an invalid ${peer} peer range`)
     }
   }
-  const notice = await readFile(join(selectorDir, 'THIRD_PARTY_NOTICES.md'), 'utf8')
-  if (!notice.includes('Copyright (c) 2026 DeepSeek')) {
-    throw new Error(`${basename(selectorDir)} lacks the full DeepSeek Harness MIT notice`)
+  for (const directory of [selectorDir]) {
+    const notice = await readFile(join(directory, 'THIRD_PARTY_NOTICES.md'), 'utf8')
+    if (!notice.includes('Copyright (c) 2026 DeepSeek')) {
+      throw new Error(`${basename(directory)} lacks the full DeepSeek Harness MIT notice`)
+    }
+    await scanPublishedTree(directory)
   }
-  await scanPublishedTree(selectorDir)
 
-  const productionLicenses: Record<string, string> = Object.fromEntries(await Promise.all([
+  const productionLicenses = Object.fromEntries(await Promise.all([
     ['dsh-context-compression-improved', selectorDir, 'MIT'],
     ['@huggingface/tokenizers', join(dirname(selectorDir), '@huggingface/tokenizers'), 'Apache-2.0'],
     ['js-yaml', join(dirname(selectorDir), 'js-yaml'), 'MIT'],
   ].map(async ([name, directory, expected]) => {
-    const resolved = await realpath(directory as string)
+    const resolved = await realpath(directory)
     const manifest = JSON.parse(await readFile(join(resolved, 'package.json'), 'utf8'))
     if (manifest.name !== name) throw new Error(`expected ${name}, found ${String(manifest.name)}`)
     if (manifest.license !== expected) {
@@ -948,7 +973,7 @@ try {
   }
   productionLicenses.argparse = argparse.license
 
-  const packedTokenizerArtifacts: Record<string, { bytes: number; sha256: string }> = {}
+  const packedTokenizerArtifacts = {}
   for (const artifactDir of ['deepseek-v4', 'deepseek-v4-vision-exp']) {
     const manifest = JSON.parse(await readFile(join(selectorDir, 'assets', artifactDir, 'manifest.json'), 'utf8'))
     const tokenizerBytes = await readFile(join(selectorDir, 'assets', artifactDir, 'tokenizer.json'))
@@ -964,9 +989,8 @@ try {
   if (!client.startsWith('window.__ModuleLoader__.load({')) throw new Error('packed client is not lazy-CJS')
   if (/(?:\/home\/|[A-Za-z]:\\Users\\)/u.test(client)) throw new Error('packed client leaks a developer path')
   const hostSmoke = await runPackedHostSmoke(consumerRoot)
-  // KEY CHANGE: copy compiled .js from scripts-dist/ instead of .mjs from scripts/
-  const installedComponentsScript = join(consumerRoot, 'packed-components-smoke.js')
-  await copyFile(join(root, 'scripts-dist/packed-components-smoke.js'), installedComponentsScript)
+  const installedComponentsScript = join(consumerRoot, 'packed-components-smoke.mjs')
+  await copyFile(join(root, 'scripts/packed-components-smoke.mjs'), installedComponentsScript)
   const installedComponentsOutput = await capture(process.execPath, [installedComponentsScript], {
     cwd: consumerRoot,
   })
@@ -1002,7 +1026,7 @@ try {
     && packedVisionSmoke.imageSession.exactRewriteIneligible === true
     && packedVisionSmoke.imageSession.originalIntact === true,
   'installed vision smoke did not prove estimate propagation and exact-only safety')
-  let officialCloneSmoke: any = null
+  let officialCloneSmoke = null
   const candidateVersion = registryPackages.get('dsh-context-compression-improved')?.manifest.version
   if (candidateVersion === undefined) throw new Error('packed candidate version is unknown')
   const previousForLifecycle = predecessorFound ? previousRelease : undefined
@@ -1019,10 +1043,13 @@ try {
       candidateVersion,
     )
   } else {
+    // Auto-provision a clean official checkout so the standard add → up →
+    // remove lifecycle runs without manual setup. Release mode fails closed;
+    // only dev mode may skip with an explicit marker.
     const cloneRoot = join(artifactRoot, 'official-clone')
     try {
       await run('git', [
-        'clone', '--depth', '1', '--branch', 'dsh-v0.1.1-rc.2',
+        'clone', '--depth', '1', '--branch', 'dsh-v0.1.5-rc.2',
         'https://github.com/deepseek-ai/deepseek-harness.git', cloneRoot,
       ])
       officialCloneSmoke = await runOfficialCloneCliSmoke(
@@ -1050,7 +1077,8 @@ try {
     upgradeLeg,
     artifactSource: fixedArtifactRoot === undefined ? 'fresh-pack' : artifactRoot,
     workspaceRebuildMatched: fixedArtifactRoot === undefined ? null : true,
-    plugin: selector.version,
+    selector: selector.version,
+    prunerEntry: 'dsh-context-compression-improved/pruner',
     productionLicenses,
     tokenizerArtifacts: packedTokenizerArtifacts,
     tokenizerBytes: tokenizer.length,
@@ -1065,7 +1093,7 @@ try {
     }])),
   }, null, 2))
 } finally {
-  if (server !== undefined) await new Promise<void>(resolve => server!.close(() => resolve()))
+  if (server !== undefined) await new Promise(resolve => server.close(resolve))
   if (comparisonRoot !== undefined) await rm(comparisonRoot, { recursive: true, force: true })
   if (ownsArtifactRoot) await rm(artifactRoot, { recursive: true, force: true })
   await rm(consumerRoot, { recursive: true, force: true })