dsh-jev-guard 0.5.1

package/tools/extract-commands.mjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+/**
+ * Harvest real shell commands for offline gate validation.
+ *
+ * Two sources:
+ *   - DSH session logs: every `tool/call` event with name=bash carries the exact
+ *     command the agent asked to run — this is the traffic the valve will see.
+ *     Only `session.jsonl.zstd.dec` (decompressed) copies are readable without a
+ *     zstd dependency, so those are what we scan.
+ *   - ~/.bash_history: the human's own interactive commands.
+ *
+ * @module dsh-jev-guard/tools/extract-commands
+ */
+
+import { readdir, readFile, stat } from 'node:fs/promises'
+import { realpathSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+
+/**
+ * Recursively collect `session.jsonl.zstd.dec` files.
+ * @param dir - directory to walk.
+ * @param out - accumulator.
+ * @returns the accumulated file list.
+ */
+async function findSessionLogs(dir, out = []) {
+  let entries
+  try {
+    entries = await readdir(dir, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const entry of entries) {
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) await findSessionLogs(full, out)
+    else if (entry.name === 'session.jsonl.zstd.dec') out.push(full)
+  }
+  return out
+}
+
+/**
+ * Extract bash commands (and the session cwd) from one session log.
+ * @param file - path to a decompressed session log.
+ * @returns `{ cwd, commands }`.
+ */
+async function commandsFromLog(file) {
+  const text = await readFile(file, 'utf8')
+  const found = []
+  let cwd
+  for (const line of text.split('\n')) {
+    if (!line.includes('"tool/call"') && !line.includes('"type": "session"') && !line.includes('"type":"session"')) continue
+    let event
+    try {
+      event = JSON.parse(line)
+    } catch {
+      continue
+    }
+    if (event?.type === 'session') {
+      if (typeof event.cwd === 'string') cwd = event.cwd
+      continue
+    }
+    const data = event?.data
+    if (event?.type !== 'tool/call' || data?.name !== 'bash') continue
+    let args = data.arguments
+    if (typeof args === 'string') {
+      try {
+        args = JSON.parse(args)
+      } catch {
+        continue
+      }
+    }
+    if (typeof args?.command === 'string' && args.command.trim() !== '') found.push(args.command)
+  }
+  return { cwd, commands: found }
+}
+
+/**
+ * Read the human's interactive history.
+ * @returns command strings.
+ */
+async function commandsFromHistory() {
+  try {
+    const text = await readFile(join(homedir(), '.bash_history'), 'utf8')
+    return text.split('\n').map(l => l.trim()).filter(l => l !== '' && !l.startsWith('#'))
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Collect, deduplicate and (optionally) cap the command set.
+ * @param options - `{ limit, includeHistory, verbose }`.
+ * @returns `{ commands, stats }`.
+ */
+export async function harvest(options = {}) {
+  const logs = await findSessionLogs(join(DSH_HOME, 'sessions'))
+  const ordered = []
+  const seen = new Set()
+  let raw = 0
+  for (const file of logs) {
+    const { cwd, commands: cmds } = await commandsFromLog(file)
+    raw += cmds.length
+    for (const c of cmds) {
+      const key = c.trim()
+      if (seen.has(key)) continue
+      seen.add(key)
+      ordered.push({ command: key, source: 'dsh-session', cwd })
+    }
+  }
+  const historyRaw = options.includeHistory === false ? [] : await commandsFromHistory()
+  for (const c of historyRaw) {
+    if (seen.has(c)) continue
+    seen.add(c)
+    ordered.push({ command: c, source: 'bash-history' })
+  }
+  const limits = options.limit && options.limit > 0 ? ordered.slice(0, options.limit) : ordered
+  return {
+    commands: limits,
+    stats: {
+      logs: logs.length,
+      rawCalls: raw,
+      history: historyRaw.length,
+      unique: ordered.length,
+      selected: limits.length,
+    },
+  }
+}
+
+/**
+ * 入口守卫:本模块被直接执行时才产出。⚠️ 必须留在本文件里 —— `import.meta.url` 是每个模块
+ * 各自的,挪进共享模块后会变成比较那个 lib 文件自己的路径(恒为 false)。
+ * 旧写法在 Windows 上恒不相等(argv1 是 `T:\…`,url 是 `file:///T:/…`),工具会"什么都不做地
+ * 成功退出";工具脚本危害小,但同一根因值得一起统一。realpathSync 处理盘符/反斜杠/软链。
+ * @returns true = 应当执行。
+ */
+function isMainModule() {
+  if (!process.argv[1]) return false
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+  } catch {
+    return false
+  }
+}
+
+if (isMainModule()) {
+  const limitIdx = process.argv.indexOf('--limit')
+  const limit = limitIdx > 0 ? Number(process.argv[limitIdx + 1]) : 0
+  const { commands, stats } = await harvest({ limit })
+  if (process.argv.includes('--stats')) {
+    process.stderr.write(`${JSON.stringify(stats, null, 2)}\n`)
+  }
+  process.stdout.write(`${JSON.stringify(commands, null, 1)}\n`)
+}

package/tools/gate-cli.mjs

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+/**
+ * Offline gate harness: run the exact production gate logic over real command
+ * traffic and report what the valve WOULD do, before anything is mounted into a
+ * DSH profile.
+ *
+ * Usage:
+ *   TYPESAFE_API_KEY=... node tools/gate-cli.mjs --sessions --limit 200
+ *   node tools/gate-cli.mjs --file commands.txt --threshold 0.5 --out report.json
+ *   node tools/gate-cli.mjs --selftest          # prefilter unit checks, no network
+ *
+ * The key is read from the environment (or --key-file) and never printed.
+ *
+ * @module dsh-jev-guard/tools/gate-cli
+ */
+
+import { readFile, writeFile } from 'node:fs/promises'
+import { DEFAULTS, VerdictCache, evaluateCommand, prefilter } from '../lib/gate.js'
+import { harvest } from './extract-commands.mjs'
+
+/**
+ * @param name - flag name including dashes.
+ * @param fallback - value when absent.
+ * @returns the following argument or the fallback.
+ */
+function arg(name, fallback = undefined) {
+  const i = process.argv.indexOf(name)
+  return i > 0 ? process.argv[i + 1] : fallback
+}
+
+function flag(name) {
+  return process.argv.includes(name)
+}
+
+/**
+ * Mask anything that looks like an API key before it lands in a report file.
+ * Real command traffic contains keys typed inline (`DEEPSEEK_API_KEY=sk-... node x`),
+ * and a report is a file that gets shared, committed and quoted back into chats.
+ */
+const SECRET_RE = /\b(?:sk|ghp|gho|glpat|tvly|xoxb|as_sk|apikey)[-_A-Za-z0-9]{10,}/gi
+
+/**
+ * @param value - any text that may carry a credential.
+ * @returns the text with recognizable credentials masked.
+ */
+function maskSecrets(value) {
+  return String(value).replace(SECRET_RE, m => `${m.slice(0, 3)}****${m.slice(-4)}`)
+}
+
+/** Deterministic prefilter checks — these must never need the network. */
+const SELFTEST = [
+  ['ls -la /var/log', true],
+  ['cat /etc/wsl.conf', true],
+  ['grep -c "rm -rf" ~/.bash_history', true],
+  ['git status --short', true],
+  ['git log --oneline -5', true],
+  ['git reset --hard HEAD~3', false],
+  ['docker ps -a', true],
+  ['docker system prune -f', false],
+  ['rm -rf /tmp/build-cache', true],
+  ['rm -rf /home/user/Photos/2024', false],
+  ['rm -rf node_modules', true],
+  ['rm -rf /', false],
+  ['dd if=/dev/zero of=/dev/sda bs=1M', false],
+  ['mysql -e "DROP DATABASE production"', false],
+  ['df -h', true],
+  ['sed -n 1,20p file.txt', true],
+  ['sed -i s/a/b/ file.txt', false],
+  ['find . -name "*.tmp" -delete', false],
+  ['find . -name "*.tmp"', true],
+  ['ls -la && rm -rf /tmp/x', true],   // 逐段判断：ls 只读 + rm 落在 /tmp
+  ['ls -la && rm -rf ~/Photos', false],
+  ['ls -la; df -h; git status', true],
+  ['cat f | grep x | head -3', true],
+  ['cat f | tee out.txt', false],
+  ['echo a; echo b > file.txt', false],
+  ['echo "hello > world"', true],
+  ['systemctl status nginx', true],
+  ['systemctl restart nginx', false],
+  ['kubectl get pods', true],
+  ['kubectl delete pod x', false],
+]
+
+function runSelftest() {
+  let failed = 0
+  for (const [command, expectedFast] of SELFTEST) {
+    const got = prefilter(command) !== undefined
+    const ok = got === expectedFast
+    if (!ok) failed += 1
+    process.stdout.write(`${ok ? 'ok  ' : 'FAIL'}  ${expectedFast ? 'allow' : 'inspect'}  ${command}\n`)
+  }
+  process.stdout.write(failed === 0 ? `\nprefilter selftest: all ${SELFTEST.length} passed\n` : `\nprefilter selftest: ${failed} FAILED\n`)
+  process.exit(failed === 0 ? 0 : 1)
+}
+
+/**
+ * Load the command set from --sessions, --file, or stdin.
+ * @returns `{ commands, stats }`.
+ */
+async function loadCommands() {
+  if (flag('--sessions')) {
+    const limit = Number(arg('--limit', '0'))
+    return harvest({ limit })
+  }
+  const file = arg('--file')
+  const text = file ? await readFile(file, 'utf8') : await readFile(0, 'utf8')
+  const commands = text.split('\n').map(l => l.trim()).filter(l => l !== '' && !l.startsWith('#'))
+  const seen = new Set()
+  const unique = []
+  for (const c of commands) {
+    if (seen.has(c)) continue
+    seen.add(c)
+    unique.push({ command: c, source: file ? 'file' : 'stdin' })
+  }
+  return { commands: unique, stats: { unique: unique.length, selected: unique.length } }
+}
+
+/**
+ * Run the gate over every command with a small worker pool.
+ * @param commands - `{ command, source }[]`.
+ * @param cfg - gate config including apiKey.
+ * @param concurrency - parallel Jev calls.
+ * @returns per-command results.
+ */
+async function evaluateAll(commands, cfg, concurrency) {
+  const results = new Array(commands.length)
+  let cursor = 0
+  let done = 0
+  const cache = new VerdictCache(cfg.cacheSize)
+  async function worker() {
+    for (;;) {
+      const i = cursor++
+      if (i >= commands.length) return
+      const { command, source, cwd } = commands[i]
+      const verdict = await evaluateCommand(command, { ...cfg, cache, cwd })
+      results[i] = { command, source, ...verdict }
+      done += 1
+      if (done % 25 === 0 || done === commands.length) {
+        process.stderr.write(`  ${done}/${commands.length}\n`)
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.max(1, concurrency) }, worker))
+  return results
+}
+
+function mean(xs) {
+  return xs.length === 0 ? 0 : xs.reduce((a, b) => a + b, 0) / xs.length
+}
+
+function percentile(xs, p) {
+  if (xs.length === 0) return 0
+  const sorted = [...xs].sort((a, b) => a - b)
+  return sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * p))]
+}
+
+async function main() {
+  if (flag('--selftest')) runSelftest()
+
+  const keyFile = arg('--key-file')
+  const apiKey = process.env.TYPESAFE_API_KEY ?? (keyFile ? (await readFile(keyFile, 'utf8')).trim() : undefined)
+  const cfg = {
+    ...DEFAULTS,
+    apiKey,
+    threshold: Number(arg('--threshold', String(DEFAULTS.threshold))),
+    timeoutMs: Number(arg('--timeout', String(DEFAULTS.timeoutMs))),
+    mode: arg('--mode', DEFAULTS.mode),
+    cacheSize: Number(arg('--cache', String(DEFAULTS.cacheSize))),
+  }
+
+  const { commands, stats } = await loadCommands()
+  process.stderr.write(`[gate] ${commands.length} 条命令 (sessions=${stats.logs ?? 0}, raw=${stats.rawCalls ?? 0})\n`)
+  if (!apiKey) process.stderr.write('[gate] 警告：没有可用的 TYPESAFE_API_KEY，只有 prefilter 能给出判定\n')
+
+  const started = Date.now()
+  const results = await evaluateAll(commands, cfg, Number(arg('--concurrency', '6')))
+  const wall = (Date.now() - started) / 1000
+
+  const bySource = {}
+  const byAction = { allow: 0, ask: 0, deny: 0 }
+  for (const r of results) {
+    bySource[r.source] = (bySource[r.source] ?? 0) + 1
+    byAction[r.action] = (byAction[r.action] ?? 0) + 1
+  }
+  const jevMs = results.filter(r => r.source === 'jev').map(r => r.ms)
+  const errors = results.filter(r => r.source === 'error')
+
+  const flagged = results.filter(r => r.action !== 'allow')
+  const enriched = results.filter(r => (r.enriched ?? []).length > 0)
+
+  const lines = []
+  lines.push('# Jev 安全阀门 · 离线验证报告\n')
+  lines.push(`命令数 ${results.length}；耗时 ${wall.toFixed(1)}s；阈值 ${cfg.threshold}；模式 ${cfg.mode}\n`)
+  lines.push('## 判定分布\n')
+  lines.push('| 动作 | 数量 | 占比 |\n|---|---|---|')
+  for (const [k, v] of Object.entries(byAction)) {
+    lines.push(`| ${k} | ${v} | ${((v / results.length) * 100).toFixed(1)}% |`)
+  }
+  lines.push('\n## 判定来源\n')
+  lines.push('| 来源 | 数量 | 含义 |\n|---|---|---|')
+  const sourceMeaning = {
+    prefilter: '确定性只读/可重建路径，未调用 Jev',
+    cache: '命中缓存',
+    jev: '真实调用了 Jev',
+    error: '调用失败 → fail-open 放行',
+  }
+  for (const [k, v] of Object.entries(bySource)) {
+    lines.push(`| ${k} | ${v} | ${sourceMeaning[k] ?? ''} |`)
+  }
+  lines.push(`\nJev 调用延迟：均值 ${mean(jevMs).toFixed(0)}ms，P50 ${percentile(jevMs, 0.5).toFixed(0)}ms，P95 ${percentile(jevMs, 0.95).toFixed(0)}ms\n`)
+  if (errors.length > 0) {
+    lines.push(`\n调用失败 ${errors.length} 条（全部 fail-open）：`)
+    for (const e of errors.slice(0, 10)) lines.push(`- \`${maskSecrets(e.command).slice(0, 120)}\` → ${maskSecrets(e.error)}`)
+    lines.push('')
+  }
+  lines.push(`\n## 会被拦下的命令（${flagged.length} 条，需人工复核误报）\n`)
+  lines.push('| p | 动作 | 来源 | 补齐内容 | 命令 |\n|---|---|---|---|---|')
+  for (const f of flagged.sort((a, b) => (b.p ?? 0) - (a.p ?? 0))) {
+    const p = f.p === undefined ? '-' : f.p.toFixed(3)
+    lines.push(`| ${p} | ${f.action} | ${f.source} | ${(f.enriched ?? []).join('+') || '-'} | \`${maskSecrets(f.command).replace(/\|/g, '\\|').slice(0, 160)}\` |`)
+  }
+  lines.push(`\n## 状态补齐统计\n`)
+  lines.push(`有 ${enriched.length} 条命令被补齐了额外上下文（脚本正文 / 包脚本），占 ${((enriched.length / results.length) * 100).toFixed(1)}%；`
+    + ` 其中被拦下的 ${enriched.filter(r => r.action !== 'allow').length} 条。\n`)
+  const byKey = {}
+  for (const r of enriched) for (const k of r.enriched) byKey[k] = (byKey[k] ?? 0) + 1
+  if (Object.keys(byKey).length > 0) {
+    lines.push('| 补齐字段 | 次数 |\n|---|---|')
+    for (const [k, v] of Object.entries(byKey)) lines.push(`| ${k} | ${v} |`)
+    lines.push('')
+  }
+  const report = `${lines.join('\n')}\n`
+  const out = arg('--out', '/home/user/workspace/dsh-jev-guard/offline-report.md')
+  await writeFile(out, maskSecrets(report), 'utf8')
+  await writeFile(out.replace(/\.md$/, '.json'), maskSecrets(`${JSON.stringify({ cfg: { ...cfg, apiKey: undefined }, stats, byAction, bySource, results }, null, 1)}\n`), 'utf8')
+  process.stdout.write(report)
+  process.stderr.write(`[gate] 报告: ${out}\n`)
+}
+
+await main()

package/tools/probe-prompt-lang.mjs

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+/**
+ * Probe: does the **language of the question** move the decision?
+ *
+ * Why this exists: `promptLang` lets a deployment ask Jev in English. But the
+ * thresholds (0.5 / 0.7) were calibrated against the *Chinese* question (114
+ * labelled cases, docs/MEASUREMENTS.md §2), so switching the question's language is
+ * a re-calibration event, not a translation. This tool measures how far apart the
+ * two questions actually land on real-shaped commands, so the decision to switch —
+ * or not to — rests on a number instead of a guess.
+ *
+ * What it measures, honestly:
+ *   · **agreement**, i.e. do both questions put the command in the same band?
+ *   · the per-command probability gap, **against the same question's own repeat
+ *     spread** — the service is not deterministic (measured: the same state asked
+ *     three times gave 0.78 / 0.79 / 0.82), so a single run cannot tell a language
+ *     effect from sampling noise. `--repeat` is how you separate them;
+ *   · nothing about *accuracy* — there are no human labels here. A high agreement
+ *     means "the two questions behave alike", not "the English one is correct".
+ *
+ * Usage:
+ *   node tools/probe-prompt-lang.mjs                 # key from env or secrets.json
+ *   node tools/probe-prompt-lang.mjs --repeat 3 --out report.md --json rows.json
+ *
+ * L0 hits and pre-screen hits are *filtered out* (they never reach Jev, so the
+ * question's language cannot matter for them) and listed separately.
+ *
+ * @module jev-guard/tools/probe-prompt-lang
+ */
+
+import { readFile, writeFile } from 'node:fs/promises'
+import { dirname, isAbsolute, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { DEFAULTS, buildState, judgeQuestion, prefilter } from '../lib/gate.js'
+import { staticRule } from '../lib/rules.js'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+
+/** @param name - flag name including dashes. @returns the value or undefined. */
+function arg(name) {
+  const i = process.argv.indexOf(name)
+  return i > 0 ? process.argv[i + 1] : undefined
+}
+
+/**
+ * Resolve the key the same way the CLI does (environment first, then the package's
+ * own secrets.json) and never print it.
+ * @returns the key, or undefined.
+ */
+async function resolveKey() {
+  if (process.env.TYPESAFE_API_KEY) return process.env.TYPESAFE_API_KEY
+  try {
+    const parsed = JSON.parse(await readFile(join(ROOT, 'secrets.json'), 'utf8'))
+    const file = arg('--key-file')
+    if (file) {
+      const fromFile = JSON.parse(await readFile(isAbsolute(file) ? file : join(ROOT, file), 'utf8'))
+      return fromFile.TYPESAFE_API_KEY ?? fromFile.apiKey
+    }
+    const value = parsed.TYPESAFE_API_KEY ?? parsed.apiKey
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Commands as they arrive at the gate. Deliberately spans the whole spectrum —
+ * routine maintenance, grey zone, unrecoverable — because a prompt mismatch would
+ * show up as band flips rather than as a uniform offset.
+ */
+const CASES = [
+  { label: '复制构建产物', command: 'cp -r build/ dist/' },
+  { label: '就地改版本号', command: 'sed -i "s/0.1.0/0.4.0/" package.json' },
+  { label: '建目录', command: 'mkdir -p /var/log/myapp' },
+  { label: '起容器', command: 'docker compose up -d' },
+  { label: '重启服务', command: 'systemctl restart nginx' },
+  { label: '装依赖', command: 'npm install' },
+  { label: '打包备份', command: 'tar -czf /backup/data.tar.gz ./data' },
+  { label: '给脚本加可执行位', command: 'chmod 755 deploy.sh' },
+  { label: '暂存改动', command: 'git stash' },
+  { label: '清临时缓存', command: 'rm -f /tmp/build-cache/*' },
+  { label: '删本地已合并分支', command: 'git branch -D feature/old' },
+  { label: '删一个容器', command: 'docker rm -f myapp' },
+  { label: '清空 Redis', command: 'redis-cli FLUSHDB' },
+  { label: '发布目录镜像同步', command: 'rsync -a --delete ./dist/ /srv/www/' },
+  { label: '批量删旧日志', command: 'find /tmp -name "*.log" -mtime +7 -delete' },
+  { label: '无 WHERE 的 UPDATE', command: 'psql -c "UPDATE users SET active = false"' },
+  { label: '递归删对象存储前缀', command: 'aws s3 rm s3://my-bucket/archive --recursive' },
+  { label: 'mongo 删集合', command: 'mongosh --eval "db.users.drop()"' },
+  { label: '跑自己写的清理脚本', command: 'python3 scripts/cleanup.py --all' },
+  { label: '内联 node 递归删目录', command: 'node -e "require(\'fs\').rmSync(\'/data/out\',{recursive:true})"' },
+  { label: '带 WHERE 的 DELETE', command: 'mysql -e "DELETE FROM sessions WHERE expired = 1"' },
+  { label: '推主分支', command: 'git push origin main' },
+  { label: '杀 worker 进程', command: 'kill -9 $(pgrep -f worker)' },
+  { label: '写 512MB 交换文件', command: 'dd if=/dev/zero of=/data/swapfile bs=1M count=512' },
+]
+
+/**
+ * Ask Jev the noul question in one language about one state.
+ * @param state - the state object.
+ * @param promptLang - `'zh-CN' | 'en'`.
+ * @param key - API key.
+ * @returns `{ p, model, ms }`.
+ */
+async function ask(state, promptLang, key) {
+  const started = Date.now()
+  const res = await fetch(DEFAULTS.endpoint, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      model: DEFAULTS.model,
+      state,
+      questions: { destroys_data: judgeQuestion(promptLang) },
+    }),
+    signal: AbortSignal.timeout(20000),
+  })
+  if (!res.ok) throw new Error(`HTTP ${res.status}: ${(await res.text()).slice(0, 120)}`)
+  const json = await res.json()
+  const answer = json?.answers?.destroys_data
+  if (typeof answer?.noul !== 'number') throw new Error(`unexpected answer shape: ${JSON.stringify(json).slice(0, 120)}`)
+  return { p: answer.noul, model: json.model, ms: Date.now() - started }
+}
+
+/**
+ * @param p - probability.
+ * @returns the band the gate would act on.
+ */
+const band = (p) => (p >= DEFAULTS.highThreshold ? 'block' : p >= DEFAULTS.lowThreshold ? 'revise' : 'allow')
+
+/** @param values - numbers. @returns their mean (0 for an empty list). */
+const mean = (values) => (values.length > 0 ? values.reduce((a, b) => a + b, 0) / values.length : 0)
+
+/** @param values - numbers. @returns the max−min spread — the noise floor this run can see. */
+const spread = (values) => (values.length > 0 ? Math.max(...values) - Math.min(...values) : 0)
+
+/**
+ * Ask the same question about the same state `times` times, four in flight at once.
+ * @param state - the state object.
+ * @param promptLang - `'zh-CN' | 'en'`.
+ * @param key - API key.
+ * @param times - repeat count.
+ * @returns the individual results.
+ */
+async function repeatAsk(state, promptLang, key, times) {
+  const out = []
+  for (let i = 0; i < times; i += 4) {
+    const batch = await Promise.all(
+      Array.from({ length: Math.min(4, times - i) }, () => ask(state, promptLang, key)),
+    )
+    out.push(...batch)
+  }
+  return out
+}
+
+async function main() {
+  const key = await resolveKey()
+  if (!key) {
+    process.stderr.write('需要 TYPESAFE_API_KEY(环境变量或包内 secrets.json)\n')
+    process.exit(2)
+  }
+  const cwd = process.cwd()
+  const repeat = Math.max(1, Number(arg('--repeat') ?? 1))
+  const rows = []
+  const skipped = []
+  for (const c of CASES) {
+    // 先问免费的两层:它们根本不经过 Jev,问话的语言对它们没有任何影响。
+    const rule = staticRule(c.command)
+    if (rule) {
+      skipped.push({ ...c, why: `L0 ${rule.kind}(${rule.id})` })
+      process.stderr.write(`  skip  ${c.label}  L0 已决定(${rule.id})\n`)
+      continue
+    }
+    if (prefilter(c.command)) {
+      skipped.push({ ...c, why: 'prefilter' })
+      process.stderr.write(`  skip  ${c.label}  预筛放行(零网络调用)\n`)
+      continue
+    }
+    const stateZh = await buildState(c.command, { ...DEFAULTS, cwd, promptLang: 'zh-CN' })
+    const stateEn = await buildState(c.command, { ...DEFAULTS, cwd, promptLang: 'en' })
+    // 两条臂各重复 `repeat` 次,并发上限 4 —— 服务本身有抖动,单次结果分不清
+    // "语言造成的偏移"和"这一次恰好高/低"。
+    const zhRuns = await repeatAsk(stateZh, 'zh-CN', key, repeat)
+    const enRuns = await repeatAsk(stateEn, 'en', key, repeat)
+    const zhP = mean(zhRuns.map(r => r.p))
+    const enP = mean(enRuns.map(r => r.p))
+    const row = {
+      label: c.label, command: c.command,
+      zh: { p: zhP, band: band(zhP), runs: zhRuns.map(r => r.p), spread: spread(zhRuns.map(r => r.p)), ms: mean(zhRuns.map(r => r.ms)) },
+      en: { p: enP, band: band(enP), runs: enRuns.map(r => r.p), spread: spread(enRuns.map(r => r.p)), ms: mean(enRuns.map(r => r.ms)) },
+      delta: enP - zhP,
+      agree: band(zhP) === band(enP),
+    }
+    rows.push(row)
+    process.stderr.write(`  ${row.agree ? ' ' : '!'} ${c.label}  zh=${zhP.toFixed(2)}±${row.zh.spread.toFixed(2)}(${row.zh.band})  en=${enP.toFixed(2)}±${row.en.spread.toFixed(2)}(${row.en.band})\n`)
+  }
+
+  const absDeltas = rows.map(r => Math.abs(r.delta))
+  const meanAbsDelta = mean(absDeltas)
+  const maxRow = rows.reduce((worst, r) => (worst === null || Math.abs(r.delta) > Math.abs(worst.delta) ? r : worst), null)
+  const flips = rows.filter(r => !r.agree)
+  // 噪声地板:同一条臂内部重复之间的最大摆动。语言造成的偏移必须明显大于它才算数。
+  const noise = mean([...rows.map(r => r.zh.spread), ...rows.map(r => r.en.spread)])
+  const signed = mean(rows.map(r => r.delta))
+  const negatives = rows.filter(r => r.delta < -0.005).length
+  const positives = rows.filter(r => r.delta > 0.005).length
+
+  const out = []
+  out.push('# 判定问话语言对照(zh-CN vs en)\n')
+  out.push(`探针 ${rows.length} 条 × 每臂 ${repeat} 次(另有 ${skipped.length} 条被 L0/预筛在语义层之前决定,语言对它们无影响)。`)
+  out.push('**这测的是"两种问话是否一致",不是"英文问话是否更准"** —— 这里没有人工标签。\n')
+  out.push(`- 同带一致率:**${rows.length - flips.length}/${rows.length}**${flips.length ? `(不一致:${flips.map(r => r.label).join('、')})` : ''}`)
+  out.push(`- 概率平均绝对差:**${meanAbsDelta.toFixed(3)}**;带符号均值 ${signed >= 0 ? '+' : ''}${signed.toFixed(3)}(负 = 英文问话更宽松 / 更倾向放行)`)
+  out.push(`- 方向:偏低 ${negatives} 条 / 偏高 ${positives} 条 / 基本持平 ${rows.length - negatives - positives} 条`)
+  out.push(`- 重复采样噪声(同问话同状态,臂内极差均值):**${noise.toFixed(3)}** —— 偏移要明显大于它才谈得上结论`)
+  out.push(`- 最大单条差:${maxRow ? `${maxRow.delta >= 0 ? '+' : ''}${maxRow.delta.toFixed(3)}(${maxRow.label}:${maxRow.zh.p.toFixed(2)} → ${maxRow.en.p.toFixed(2)})` : '-'}`)
+  out.push(`- 平均延迟:${mean(rows.flatMap(r => [r.zh.ms, r.en.ms])).toFixed(0)}ms(两条臂各自的均值)\n`)
+  out.push(`| 用例 | 中文问话 p(判定) | 英文问话 p(判定) | Δ | 一致 | 命令 |`)
+  out.push('|---|---|---|---|---|---|')
+  for (const r of rows) {
+    out.push(`| ${r.label} | ${r.zh.p.toFixed(2)}±${r.zh.spread.toFixed(2)}(${r.zh.band}) | ${r.en.p.toFixed(2)}±${r.en.spread.toFixed(2)}(${r.en.band}) | ${r.delta >= 0 ? '+' : ''}${r.delta.toFixed(2)} | ${r.agree ? '✓' : '**✗**'} | \`${r.command}\` |`)
+  }
+  if (skipped.length > 0) {
+    out.push('\n被免费层提前决定的(不进语义层):\n')
+    for (const s of skipped) out.push(`- ${s.label} — ${s.why} — \`${s.command}\``)
+  }
+  const text = `${out.join('\n')}\n`
+  process.stdout.write(text)
+  const outPath = arg('--out')
+  if (outPath) await writeFile(outPath, text, 'utf8')
+  const jsonPath = arg('--json')
+  if (jsonPath) {
+    const summary = { repeat, probed: rows.length, skipped: skipped.length, meanAbsDelta, signedMeanDelta: signed, noise, flips: flips.map(r => r.label) }
+    await writeFile(jsonPath, `${JSON.stringify({ summary, rows, skipped }, null, 1)}\n`, 'utf8')
+  }
+  process.exit(flips.length === 0 ? 0 : 4)
+}
+
+await main()