dsh-engram 0.9.0 → 0.9.2

package/lib/context-gc.js

@@ -660,6 +660,25 @@ export function buildContextGcSummary(report, context, { turns, narrative }) {
   return parts.join("\n");
 }
 
+/**
+ * Services `BasicCompactionEngine` reads straight off `this.ctx`:
+ * `tokenMeter.measure()` on every pressure check, `sessions.flush()` on a manual
+ * compaction, `llm.resolveModelInfo()` for the model's context window.
+ *
+ * These are declared by the backend's own `static inject`, and that static only
+ * takes effect when the class is loaded as a PLUGIN. Until this fix the mount
+ * used `new Engine(ctx)` — no loader, no fiber, no provisioning — so the first
+ * `this.ctx.tokenMeter` threw `cannot get property "tokenMeter" without inject`
+ * out of cordis's context proxy. The engine's own
+ * `ctx?.on(...)` listeners kept working (events are root-wide), which is why the
+ * breakage looked like "compaction silently does nothing" on one backend
+ * version and "model switch rejected" on another (issues #12/#13).
+ *
+ * Mounted through `ctx.plugin(Engine)` the loader provisions exactly this list
+ * on the engine's own fiber, so the reads resolve for real.
+ */
+const ENGINE_INJECT = ["llm", "tokenMeter", "sessions"];
+
 /**
  * Load a mountable compaction engine CLASS for the host/preset plane.
  *
@@ -669,6 +688,11 @@ export function buildContextGcSummary(report, context, { turns, narrative }) {
  * base `compaction-basic` row was disabled by the profile patch, so the
  * `compaction` service never disappears while dsh-engram is installed.
  *
+ * Both subclasses take the ctx they are given (a plugin mount passes the
+ * fiber's own context — the one with {@link ENGINE_INJECT} provisioned) and
+ * fall back to the captured `ctx` so a plain `new Engine()` still works where
+ * no loader is available.
+ *
  * Returns `null` when `@deepseek-ai/dsh-compaction-basic` is not importable
  * (graceful — the host keeps whatever compaction it still has).
  */
@@ -680,14 +704,61 @@ export async function loadCompactionEngine(ctx, config = {}, deps = {}, { mode =
     // the shipped default LLM summarizer), so when the base row was disabled
     // by the profile patch the `compaction` service still exists.
     return class DefaultCompactionEngine extends mod.BasicCompactionEngine {
-      constructor() {
-        super(ctx, { auto: true, ...config });
+      static inject = [...ENGINE_INJECT];
+      constructor(engineCtx = ctx) {
+        super(engineCtx, { auto: true, ...config });
       }
     };
   }
   return loadContextGcEngine(ctx, config, deps);
 }
 
+/**
+ * Start the engine as a cordis PLUGIN, so the loader provisions the injects its
+ * backend declared (`llm`/`tokenMeter`/`sessions`) on a fiber of its own.
+ *
+ * A ctx without `plugin` (unit-test fakes, vendored hosts) gets the direct
+ * construction fallback: the engine then only sees what that ctx already
+ * exposes — the shape the unit-test fakes still construct directly.
+ */
+async function mountEngine(ctx, Engine) {
+  if (typeof ctx?.plugin !== "function") {
+    new Engine();
+    return;
+  }
+  // Refuse a second provider up front. cordis would reject it too, but only
+  // from inside the fiber — which logs a startup error for a case this module
+  // handles by design (the base `compaction-basic` row still enabled).
+  if (ctx.get?.("compaction") !== void 0) {
+    throw new Error('service "compaction" has already been registered — keeping the existing compaction service');
+  }
+  // The loader activates the fiber asynchronously, and `fiber.await()` is NOT a
+  // readiness signal: with an inject still missing the fiber never starts, yet
+  // await() resolves immediately (no in-flight lifecycle work). So the engine
+  // itself reports construction — which is exactly when the injects were
+  // provisioned and the `compaction` service registered. A rejected inject set
+  // leaves this pending, the honest state for a host that lacks the services.
+  let settle;
+  const mounted = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
+  });
+  class MountedEngine extends Engine {
+    constructor(engineCtx) {
+      try {
+        super(engineCtx);
+      } catch (error) {
+        // Construction refused (duplicate provider, bad config): surface it to
+        // the caller and rethrow so cordis marks the fiber failed.
+        settle.reject(error);
+        throw error;
+      }
+      settle.resolve(true);
+    }
+  }
+  ctx.plugin(MountedEngine);
+  await mounted;
+}
+
 /**
  * Mount the compaction engine onto `ctx` — THE shared entry both planes use
  * (host plane: the main engram plugin's `apply`; preset plane: the
@@ -700,9 +771,17 @@ export async function loadCompactionEngine(ctx, config = {}, deps = {}, { mode =
  * reaches engram/ESR state for pointer classification — the caller supplies
  * its own lazy-domain binding.
  *
- * Fully contained: an unimportable backend or a duplicate `compaction`
- * provider (cordis refuses second registration) only warns and returns null —
- * the host keeps whatever compaction it already has, never a crash.
+ * The engine is mounted AS A PLUGIN (`ctx.plugin(Engine)`), never with
+ * `new Engine(ctx)`: only the loader creates the fiber that provisions the
+ * backend's `llm`/`tokenMeter`/`sessions` injects. The host plane mounts from a
+ * fiber that injects just `tools`, so constructing directly left the engine
+ * reading services its ctx was not allowed to see (issues #12/#13).
+ *
+ * Fully contained: an unimportable backend, a missing service, or a duplicate
+ * `compaction` provider (cordis refuses second registration) only warns and
+ * returns null — the host keeps whatever compaction it already has, never a
+ * crash. A host that never provides the three services leaves the mount fiber
+ * pending, so callers that report status must bound their own wait.
  *
  * @returns {Promise<Function|null>} the mounted engine class, or null.
  */
@@ -723,10 +802,11 @@ export async function mountCompactionEngine(ctx, config = {}, deps = {}) {
     return null;
   }
   try {
-    new Engine();
+    await mountEngine(ctx, Engine);
   } catch (error) {
-    // Duplicate `compaction` provider (base row not disabled) or constructor
-    // refusal: keep whatever is already registered, never crash the host.
+    // Duplicate `compaction` provider (base row not disabled), a rejected
+    // plugin load, or constructor refusal: keep whatever is already
+    // registered, never crash the host.
     ctx?.logger?.warn?.(
       `engram context-gc mount skipped (${error instanceof Error ? error.message : String(error)}) — keeping the existing compaction service`,
     );
@@ -767,8 +847,11 @@ export async function loadContextGcEngine(ctx, config = {}, deps = {}) {
   const engineConfig = { auto: true, ...config };
 
   return class ContextGcEngine extends Basic {
-    constructor() {
-      super(ctx, engineConfig);
+    /** Declared for the loader: these are read as `this.ctx.<name>` below. */
+    static inject = [...ENGINE_INJECT];
+    /** `ctx.plugin(Engine)` passes the fiber's ctx; `new Engine()` uses the captured one. */
+    constructor(engineCtx = ctx) {
+      super(engineCtx, engineConfig);
       this.gcDeps = deps;
       /** Last credit computed by `_contextGc`, surfaced in the attempt log. */
       this.gcLastCredit = void 0;

package/lib/esrModel.mjs

@@ -1,6 +1,29 @@
 // <autogenerated by client/build-model.mjs — do not edit directly>
 // Compiles client/src/esrModel.ts for the node test runner.
 
+// client/src/i18n/index.ts
+var DEFAULT_LOCALE = "en-US";
+var translate = (key) => key;
+var localeTag = DEFAULT_LOCALE;
+function activeLocale() {
+  return localeTag;
+}
+function format(text, params) {
+  return text.replace(
+    /\{(\w+)\}/g,
+    (match, name) => Object.prototype.hasOwnProperty.call(params, name) ? String(params[name]) : match
+  );
+}
+function stringParams(params) {
+  const out = {};
+  for (const [name, value] of Object.entries(params)) out[name] = String(value);
+  return out;
+}
+function tr(key, params) {
+  const text = params === void 0 ? translate(key) : translate(key, stringParams(params));
+  return params === void 0 ? text : format(text, params);
+}
+
 // client/src/esrModel.ts
 function taskGaps(t) {
   const gaps = [];
@@ -23,7 +46,7 @@ function shortAgent(a) {
   return bare.replace(/^session[-_]/i, "").replace(/^agent[-_]/i, "").slice(0, 14);
 }
 function fmtDateShort(ts) {
-  return ts ? new Date(ts).toLocaleDateString("zh-CN", { month: "short", day: "numeric" }) : "\u2013";
+  return ts ? new Date(ts).toLocaleDateString(activeLocale(), { month: "short", day: "numeric" }) : "\u2013";
 }
 function buildTasksMarkdown(tasks) {
   const esc = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\n/g, " ");
@@ -31,11 +54,7 @@ function buildTasksMarkdown(tasks) {
     const ev = `${t.artifact ? "artifact\u2713" : "artifact\u2717"} \xB7 ${t.evaluation ? "eval\u2713" : "eval\u2717"} \xB7 ${(t.memoryRefs?.length ?? 0) > 0 ? "ref\u2713" : "ref\u2717"}`;
     return `| ${t.state} | ${esc(t.name)} | ${esc(t.workspace.replace(/^.*[\\/]/, ""))} | ${esc(taskGaps(t).join(", ") || "\u2014")} | ${ev} | ${fmtDateShort(t.createdAt ?? 0)} |`;
   });
-  return `# ESR \u4EFB\u52A1\u5BFC\u51FA \xB7 ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}
-
-| \u72B6\u6001 | \u4EFB\u52A1 | \u5DE5\u4F5C\u533A | \u8BC1\u636E\u7F3A\u53E3 | \u8BC1\u636E | \u521B\u5EFA |
-|---|---|---|---|---|---|
-${rows.join("\n") || "(\u65E0\u4EFB\u52A1)"}`;
+  return tr("# ESR \u4EFB\u52A1\u5BFC\u51FA \xB7 {0}\n\n| \u72B6\u6001 | \u4EFB\u52A1 | \u5DE5\u4F5C\u533A | \u8BC1\u636E\u7F3A\u53E3 | \u8BC1\u636E | \u521B\u5EFA |\n|---|---|---|---|---|---|\n{1}", { "0": (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "1": rows.join("\n") || tr("(\u65E0\u4EFB\u52A1)") });
 }
 var POLL_MS = 2e4;
 export {

package/lib/index.js

@@ -18,7 +18,6 @@
  * `search_sessions` FTS fallback.
  */
 
-import { resolve as resolvePath } from "node:path";
 import { openEngramDomain } from "./store.js";
 import { registerTools } from "./tools.js";
 import { makeCaptureHandler } from "./capture.js";
@@ -561,7 +560,12 @@ export function apply(ctx, config) {
     let block = "";
     let pendingRecall = false;
     try {
-      const workspace = resolvePath(cwd);
+      // Read paths MUST key the store exactly like the write paths do — on
+      // win32 `workspaceKey` lowercases the whole key (drive letters are
+      // uppercase by default), so a raw `resolve(cwd)` here finds zero rows
+      // and freezes an empty [ENGRAM]/[RESUME] block for the whole session
+      // (issue #10, and the missing [RESUME] in #9).
+      const workspace = wk(cwd);
       // Anchor revalidation (v0.7-C): a bounded stat pass at session start.
       // Stale rows are tagged (for the GUI/GC) and excluded from the render
       // below via memoryIsStale — never deleted, still re-fetchable.
@@ -659,7 +663,7 @@ export function apply(ctx, config) {
     let snapshot = esrSnapshotCache.get(session);
     if (snapshot === void 0) {
       try {
-        snapshot = buildEsrSnapshot(opened, resolvePath(cwd), resolved, { sessionId: session.id });
+        snapshot = buildEsrSnapshot(opened, wk(cwd), resolved, { sessionId: session.id });
       } catch (error) {
         log?.warn?.(`engram esr render failed: ${String(error)}`);
         return "";
@@ -673,7 +677,7 @@ export function apply(ctx, config) {
     }
     let block = "";
     try {
-      block = buildFrozenEsrBlock(opened, resolvePath(cwd), resolved, {
+      block = buildFrozenEsrBlock(opened, wk(cwd), resolved, {
         recorder,
         sessionId: session.id,
         holder,
@@ -792,6 +796,22 @@ export function apply(ctx, config) {
         service.compactionStatus.host = "unavailable";
         flushStatus();
       });
+    // The engine is mounted as a plugin so the loader provisions its
+    // `llm`/`tokenMeter`/`sessions` injects (issues #12/#13). A host that never
+    // provides them leaves that fiber pending forever, which would keep
+    // `hostSettled` false and the status file unwritten — the same "wiring run
+    // that never finished" the web plane's timer below exists to avoid. Bound
+    // the wait and report the missing deps instead of staying silent.
+    const hostStatusTimer = setTimeout(() => {
+      if (hostSettled) return;
+      hostSettled = true;
+      service.compactionStatus.host = "unavailable";
+      ctx?.logger?.warn?.(
+        "engram context-gc: compaction mount still pending after 15s — this host does not provide llm/tokenMeter/sessions to the engine; the host keeps its own compaction",
+      );
+      flushStatus();
+    }, 15_000);
+    hostStatusTimer.unref?.();
 
     // Web-plane auto-wiring (Context GC): web sessions resolve `compaction`
     // inside the agent preset's own realm, which a profile patch cannot reach.

package/lib/mental.js

@@ -17,6 +17,42 @@ import { hashText } from "./util.js";
 
 const DEFAULT_MAX_AGE_MS = 10 * 60 * 1000;
 
+/**
+ * Standing-answer copy. The language is a RENDER parameter, not a cache key:
+ * the cached row and the `esr_model` tool keep their default (zh) copy, while
+ * the GUI asks the route for its active language. Russian is the language this
+ * client currently ships.
+ */
+const COPY = {
+  zh: {
+    allWorkspaces: "全部工作区",
+    heading: "常驻摘要",
+    tasks: (active, ready, stable) => `- 任务：${active} 进行中（${ready} 就绪）· ${stable} 已闭环`,
+    graph: (nodes, links) => `- 实体图：${nodes} 节点 · ${links} 链接`,
+    observation: (n, evidence) => `- 观测：${n} 条信念（累计 ${evidence} 证据）`,
+    memories: (n, kindHist) => `- 记忆：${n} 条${kindHist ? `（${kindHist}）` : ""}`,
+    topBeliefs: "重点信念：",
+    risks: "未闭环风险：",
+    riskLine: (name, gaps, ageDays) => `- ${name} · ${gaps} · ${ageDays}天`,
+  },
+  ru: {
+    allWorkspaces: "Все пространства",
+    heading: "постоянная сводка",
+    tasks: (active, ready, stable) => `- Задачи: ${active} в работе (${ready} готовы) · закрыто: ${stable}`,
+    graph: (nodes, links) => `- Граф сущностей: узлов ${nodes} · связей ${links}`,
+    observation: (n, evidence) => `- Наблюдения: ${n} · доказательств всего: ${evidence}`,
+    memories: (n, kindHist) => `- Память: ${n}${kindHist ? ` (${kindHist})` : ""}`,
+    topBeliefs: "Ключевые убеждения:",
+    risks: "Незакрытые риски:",
+    riskLine: (name, gaps, ageDays) => `- ${name} · ${gaps} · ${ageDays} дн.`,
+  },
+};
+
+/** Copy table for a render language; unknown languages fall back to the source language. */
+function copyFor(lang) {
+  return COPY[lang] ?? COPY.zh;
+}
+
 /** Escape a name for markdown (pipes/newlines). */
 function mdCell(value) {
   return String(value ?? "")
@@ -29,10 +65,11 @@ function mdCell(value) {
  * Aggregate the workspace into a standing-answer markdown blob. Purely derives
  * from already-indexed data — safe to run on every read.
  */
-export function compileSummary(domain, ws, { now = Date.now() } = {}) {
+export function compileSummary(domain, ws, { now = Date.now(), lang = "zh" } = {}) {
+  const L = copyFor(lang);
   const summary = domain.summarize();
   const scope = ws && summary.workspaces[ws] ? { ...summary.workspaces[ws] } : { ...summary.totals };
-  const label = ws ? String(ws).replace(/^.*[\\/]/, "") : "全部工作区";
+  const label = ws ? String(ws).replace(/^.*[\\/]/, "") : L.allWorkspaces;
 
   let tasks = [];
   try {
@@ -53,7 +90,7 @@ export function compileSummary(domain, ws, { now = Date.now() } = {}) {
     if (gaps.length === 0) ready += 1;
     else {
       const ageDays = Math.max(0, Math.floor((now - (t.createdAt ?? now)) / 86400000));
-      risky.push(`- ${mdCell(t.name)} · ${gaps.join("/")} · ${ageDays}天`);
+      risky.push(L.riskLine(mdCell(t.name), gaps.join("/"), ageDays));
     }
   }
   const stable = tasks.filter((t) => t.state === "stable").length;
@@ -77,18 +114,18 @@ export function compileSummary(domain, ws, { now = Date.now() } = {}) {
   }
 
   const lines = [
-    `## ${label} · 常驻摘要`,
-    `- 任务：${active.length} 进行中（${ready} 就绪）· ${stable} 已闭环`,
-    `- 实体图：${scope.nodes ?? 0} 节点 · ${scope.links ?? 0} 链接`,
-    `- 观测：${obs.length} 条信念（累计 ${obsEvidence} 证据）`,
-    `- 记忆：${scope.memories ?? 0} 条${kindHist ? `（${kindHist}）` : ""}`,
+    `## ${label} · ${L.heading}`,
+    L.tasks(active.length, ready, stable),
+    L.graph(scope.nodes ?? 0, scope.links ?? 0),
+    L.observation(obs.length, obsEvidence),
+    L.memories(scope.memories ?? 0, kindHist),
   ];
   if (topObs.length > 0) {
-    lines.push("", "重点信念：");
+    lines.push("", L.topBeliefs);
     for (const o of topObs) lines.push(`- ${mdCell(o.text)} — ×${o.proof?.count ?? 0}`);
   }
   if (risky.length > 0) {
-    lines.push("", "未闭环风险：");
+    lines.push("", L.risks);
     lines.push(...risky.slice(0, 5));
   }
   return lines.join("\n");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-engram",
   "description": "Minimalist long-term memory for DeepSeek Harness, distilling symbolic-index + pi-esr ideas: zero-LLM auto-capture, a symbolic [ENGRAM] index with progressive disclosure, and an ESR-lite evidence-closure protocol (esr_task / esr_node / esr_close / esr_link). Real agent-behaviour telemetry (usage rollup + /stats) and a deterministic offline recall benchmark (npm run eval). Hot path is model-free; storage on ctx.storageDomain; web memory viewer, observability panel and config card through DSH's native settings slots.",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "packageManager": "pnpm@11.22.0",
   "license": "MIT",
   "repository": {
@@ -46,6 +46,9 @@
     "dsh-engram:doctor": "node scripts/dsh-engram.mjs doctor",
     "eval": "node eval/recall-bench.mjs",
     "gate:audit": "node eval/gate-audit.mjs",
+    "host:probe": "node scripts/host-mount-probe.mjs",
+    "i18n:check": "node tools/i18n/wrap.mjs --check",
+    "i18n:wrap": "node tools/i18n/wrap.mjs",
     "playbook:audit": "node eval/playbook-audit.mjs",
     "prepublishOnly": "node scripts/prepublish-check.mjs",
     "quality:ab": "node eval/quality-ab.mjs",

package/scripts/host-mount-probe.mjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+/**
+ * 宿主面 compaction 挂载的真机探针（issues #12/#13 的回归证据）。
+ *
+ * 单测的「真 cordis + 真 backend」已经能复现那条缝，但它证明不了「真 dsh 宿主会把
+ * llm/tokenMeter/sessions 供给到引擎自己的 fiber 上」。这个脚本把那次一次性验证
+ * 固化成一条命令：
+ *
+ *   1. `npm pack` 本仓库（或 --tgz 指定的 tarball）
+ *   2. 在 mkdtemp 出来的 DSH_HOME 里，用 `--from-default-profile web` 造一个一次性
+ *      profile，`dsh plugin add` 装上被测 tarball
+ *   3. 再装一个只做一件事的探针插件：boot 后 8s 调
+ *      `ctx.compaction.compactIfNeeded(agent, "pressure")`，把结果写进 JSON
+ *   4. `dsh --profile probe --patch <overlay> --port <n> --no-open` 起真宿主
+ *   5. 读 JSON、杀进程、按结果给退出码
+ *
+ * 用法：
+ *   node scripts/host-mount-probe.mjs                 # 本仓库，默认配置
+ *   node scripts/host-mount-probe.mjs --gc            # gcReplacesCompaction: true
+ *   node scripts/host-mount-probe.mjs --tgz old.tgz   # 对照：装上旧 tarball 应复现报错
+ *   node scripts/host-mount-probe.mjs --port 3199 --keep
+ *
+ * 退出码：0 = pressure 路径跑通；1 = 引擎报了 inject 错；2 = 没拿到读数（boot 失败）。
+ * 不联网、不调模型：只 boot 宿主，不跑任何会话。
+ */
+
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const DSH_BIN = process.env.PROBE_DSH_BIN || "dsh";
+
+function arg(name, fallback = undefined) {
+  const i = process.argv.indexOf(name);
+  return i === -1 ? fallback : process.argv[i + 1] ?? fallback;
+}
+const GC_MODE = process.argv.includes("--gc");
+const KEEP = process.argv.includes("--keep");
+const PORT = Number(arg("--port", "3199"));
+const TGZ = arg("--tgz");
+const WAIT_MS = Number(arg("--wait", "60000"));
+
+function sh(cmd, args, opts = {}) {
+  return execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], ...opts });
+}
+
+function packRepo(dest) {
+  mkdirSync(dest, { recursive: true });
+  const out = sh("npm", ["pack", "--pack-destination", dest], { cwd: ROOT });
+  const name = out.trim().split("\n").at(-1).trim();
+  return join(dest, name);
+}
+
+/** The probe plugin: no config, no deps, one timer, one write. */
+const PROBE_SOURCE = `import fs from "node:fs";
+export const name = "engram-host-probe";
+export const inject = ["compaction"];
+const OUT = process.env.PROBE_OUT;
+export function apply(ctx) {
+  const timer = setTimeout(async () => {
+    const result = { at: new Date().toISOString(), pid: process.pid };
+    try {
+      const status = JSON.parse(fs.readFileSync(process.env.DSH_HOME + "/engram/context-gc.status.json", "utf8"));
+      result.host = status.host;
+      result.config = status.config;
+    } catch (error) { result.statusError = String(error?.message ?? error); }
+    try {
+      // Enough of the Session surface for the real token meter to fold an empty
+      // log: it walks \`seq\` through \`eventAt()\` and lazily builds projection
+      // cells through \`snapshotEvents()\`. Without these it throws before the
+      // engine ever reads its own ctx, which would prove nothing.
+      const agent = {
+        session: {
+          id: "probe-session",
+          header: { id: "probe-session", cwd: "/tmp" },
+          inheritedEventCount: 0,
+          seq: 0,
+          messages: [],
+          events: [],
+          eventAt: () => void 0,
+          snapshotEvents: () => [],
+          requestHeader: () => ({ config: { provider: "deepseek-official", model: "deepseek-flash" } }),
+        },
+        options: {},
+      };
+      const out = await ctx.compaction.compactIfNeeded(agent, "pressure", new AbortController().signal);
+      result.pressure = { ok: true, result: out ?? null };
+    } catch (error) {
+      result.pressure = { ok: false, error: String(error?.message ?? error), stack: String(error?.stack ?? "").split("\\n").slice(0, 6) };
+    }
+    fs.writeFileSync(OUT, JSON.stringify(result, null, 1));
+  }, 8000);
+  ctx.effect(() => () => clearTimeout(timer));
+}
+`;
+
+const PROBE_PKG = JSON.stringify(
+  { name: "dsh-engram-host-probe", version: "1.0.0", private: true, type: "module", main: "index.js", files: ["index.js"] },
+  null,
+  1,
+);
+
+function packProbe(dest) {
+  const src = join(dest, "probe-src");
+  mkdirSync(src, { recursive: true });
+  writeFileSync(join(src, "index.js"), PROBE_SOURCE);
+  writeFileSync(join(src, "package.json"), PROBE_PKG);
+  const out = sh("npm", ["pack", "--pack-destination", dest], { cwd: src });
+  return join(dest, out.trim().split("\n").at(-1).trim());
+}
+
+function overlay(file, gc) {
+  writeFileSync(
+    file,
+    [
+      "# one-off overlay: the probe row, plus the GC-mode config when asked",
+      gc ? "- id: engram\n  config:\n    gcReplacesCompaction: true" : "# (default config)",
+      "- insert:\n    - id: engram-host-probe\n      name: dsh-engram-host-probe",
+      "",
+    ].join("\n"),
+  );
+}
+
+const home = mkdtempSync(join(tmpdir(), "engram-host-probe-"));
+const outFile = join(home, "probe.json");
+const env = { ...process.env, DSH_HOME: home, PROBE_OUT: outFile };
+let child;
+let exitCode = 2;
+
+try {
+  const tgz = TGZ ? resolve(TGZ) : packRepo(join(home, "pkg"));
+  if (!existsSync(tgz)) throw new Error(`tarball not found: ${tgz}`);
+  console.log(`plugin: ${tgz}`);
+
+  sh(DSH_BIN, ["--profile", "probe", "--from-default-profile", "web", "--dump-config"], { env });
+  sh(DSH_BIN, ["plugin", "--profile", "probe", "add", tgz], { env, stdio: ["ignore", "pipe", "inherit"] });
+  sh(DSH_BIN, ["plugin", "--profile", "probe", "add", packProbe(join(home, "probe-tgz"))], {
+    env,
+    stdio: ["ignore", "pipe", "inherit"],
+  });
+
+  const patch = join(home, "probe.patch.yml");
+  overlay(patch, GC_MODE);
+
+  console.log(`booting dsh ${GC_MODE ? "(gcReplacesCompaction: true) " : ""}on :${PORT} …`);
+  child = spawn(
+    DSH_BIN,
+    ["--profile", "probe", "--patch", patch, "--port", String(PORT), "--no-open"],
+    { env, detached: true, stdio: ["ignore", "pipe", "pipe"] },
+  );
+  let log = "";
+  child.stdout.on("data", (d) => (log += d));
+  child.stderr.on("data", (d) => (log += d));
+
+  const deadline = Date.now() + WAIT_MS;
+  while (Date.now() < deadline && !existsSync(outFile)) {
+    await new Promise((r) => setTimeout(r, 1500));
+  }
+
+  if (!existsSync(outFile)) {
+    console.error(`no reading after ${WAIT_MS}ms — host log tail:\n${log.slice(-2000)}`);
+  } else {
+    const result = JSON.parse(readFileSync(outFile, "utf8"));
+    console.log(JSON.stringify(result, null, 1));
+    exitCode = result.pressure?.ok === true ? 0 : 1;
+  }
+} finally {
+  if (child?.pid) {
+    try {
+      process.kill(-child.pid, "SIGTERM");
+    } catch {}
+  }
+  if (!KEEP) rmSync(home, { recursive: true, force: true });
+  else console.log(`kept ${home}`);
+}
+
+process.exit(exitCode);