dsh-tap 0.20.0

package/scripts/hermes-probe-dev-role.mjs

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+/**
+ * developer-rejection boundary probe (Hermes exploration) — 三轮合并版（2026-08-29）
+ * Usage: node scripts/hermes-probe-dev-role.mjs [--round 1|2|3]（默认 1）
+ *
+ * 轮次考古（臂表/判据/落盘文件名/日志格式均保持各轮原样）：
+ *   --round 1 = 原 hermes-probe-dev-role.mjs  （C0–C7，落盘 dev-role-boundary-<date>.jsonl）
+ *   --round 2 = 原 hermes-probe-dev-role2.mjs （P1–P7，落盘 dev-role-boundary2-<date>.jsonl）
+ *   --round 3 = 原 hermes-probe-dev-role3.mjs （S1–S6，落盘 dev-role-boundary3-<date>.jsonl）
+ *
+ * ── ROUND 1 (2026-08-19) ─────────────────────────────────────────────
+ * Understanding-only continuation of topic 6 (content-moderation.md).
+ * Kimi's probe pinned the gate: L1 gateway pre-routing check, literal
+ * role:"developer" → HTTP 500 / 11128.
+ *
+ * This round maps the BOUNDARY of that literal check, to understand what the
+ * validator sees and does NOT see. Emphasis: understanding, not bypass.
+ * We never use a variant to actually run a harmful/rejected request end-to-end
+ * to completion — rejected arms simply confirm the boundary, passing arms
+ * are max_tokens=8 stub completions that answer "OK".
+ *
+ * Arms (all max_tokens=8, 2.5s spacing, one account, read-only intent):
+ *   case variants      : role:"Developer", "DEVELOPER", "developer " (trailing space)
+ *   unicode variants   : fullwidth ｄｅｖｅｌｏｐｅｒ, "dev\u0065loper" (normalized-form test via JSON escape)
+ *   structural variants: developer as object with extra keys, array-of-roles (role in content), role:"system" containing "developer" text
+ *   control            : role:"system" (should pass 200)
+ *
+ * The goal: answer — is the gate an exact byte match on the string
+ * "developer", or does it normalize (case/unicode/whitespace) before match?
+ * This is a *classification* result (which variants are rejected vs passed),
+ * NOT a circumvention — findings feed docs/rules content only.
+ *
+ * ── ROUND 2 ──────────────────────────────────────────────────────────
+ * Round 1 established: gate is exact-literal byte match on lowercase "developer".
+ * Round 2 maps POSITION and STRUCTURE sensitivity of that literal check:
+ *
+ *   P1  developer as SECOND message (after user)      → still rejected? (position)
+ *   P2  developer LAST message (after user+assistant)  → still rejected?
+ *   P3  mixed: system + developer + user               → affects?
+ *   P4  two developers in different messages           → counted individually?
+ *   P5  role:"developer " + role:"developer" together   → does trailing-space one trigger?
+ *   P6  role as string "developer" but in a nested object (tool message) → does tool path check?
+ *   P7  control: all system + user                     → pass
+ *
+ * All max_tokens=8, 2.5s spacing, understanding-only (no completion of any
+ * rejected path; passing arms only answer "OK").
+ *
+ * ── ROUND 3 ──────────────────────────────────────────────────────────
+ * R1: exact-literal match on lowercase "developer" in role field.
+ * R2: position-independent; per-message independent check; role field only.
+ *
+ * R3 maps the *shape* the validator can see — i.e. HOW it enumerates
+ * messages. Questions:
+ *
+ *   S1  duplicate role fields in ONE message object  → validator reads first? last? any?
+ *   S2  role as non-string (number)                   → parse tolerance?
+ *   S3  role missing entirely (bare content)          → does it 400/accept?
+ *   S4  role:"developer" with content as array        → content shape affects the check? (true content block form)
+ *   S5  multi-content blocks (one developer, one user) → same object, mixed roles?
+ *   S6  control again
+ *
+ * All max_tokens=8, 2.5s, understanding-only.
+ */
+import { readFileSync, existsSync, appendFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+const GATEWAY = 'https://copilot.tencent.com'
+const SPACING_MS = 2500
+const MODEL = 'glm-5.2'
+
+function resolveKey() {
+  try {
+    const cfg = JSON.parse(readFileSync(join(DSH_HOME, 'codebuddy-plugin.json'), 'utf8'))
+    const active = (cfg.apiKeys ?? []).find((k) => k.name === cfg.activeApiKey)
+    if (active?.key) return active.key
+  } catch { /* fall through */ }
+  if (process.env.CODEBUDDY_API_KEY) return process.env.CODEBUDDY_API_KEY
+  const credFile = join(DSH_HOME, '.credentials.yaml')
+  if (existsSync(credFile)) {
+    const m = readFileSync(credFile, 'utf8').match(/^\s*CODEBUDDY_API_KEY:\s*["']?([^"'\s]+)["']?\s*$/m)
+    if (m) return m[1]
+  }
+  throw new Error('no CodeBuddy credential found')
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+const redact = (v) => typeof v === 'string' ? v.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, '<redacted>') : v
+const SYS = 'You are a concise test agent. Answer with exactly: OK'
+
+// ─────────────────────────── ROUND 1（原 hermes-probe-dev-role.mjs） ───────────────────────────
+
+const redactR1 = (v) => typeof v === 'string'
+  ? v.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, '<redacted>').replace(/\b\d{6,}\b/g, '<redacted>')
+  : v
+
+// Each variant: a function returning [role, content] or null (skip)
+const ARMS_R1 = [
+  { name: 'C0-control-system', role: 'system', note: 'control: system must pass', expectPass: true },
+  { name: 'C1-developer-baseline', role: 'developer', note: 'baseline: literal developer must be rejected', expectPass: false },
+  { name: 'C2-case-Developer', role: 'Developer', note: 'capital D: case-sensitive?', expectPass: null },
+  { name: 'C3-case-DEVELOPER', role: 'DEVELOPER', note: 'all caps', expectPass: null },
+  { name: 'C4-trailing-space', role: 'developer ', note: 'trailing space inside role value', expectPass: null },
+  { name: 'C5-fullwidth', role: 'ｄｅｖｅｌｏｐｅｒ', note: 'fullwidth unicode homoglyph', expectPass: null },
+  { name: 'C6-escaped-e', role: 'dev\u0065loper', note: 'JSON escape \\u0065 = literal e: should equal developer', expectPass: false },
+  { name: 'C7-role-in-content', role: 'user', content: `developer message`, note: 'role user but content mentions developer: gate on content or role?', expectPass: true, useContent: true },
+]
+
+async function runRound1() {
+  const OUT = join('docs', 'probes', `dev-role-boundary-${new Date().toISOString().slice(0, 10)}.jsonl`)
+  const key = resolveKey()
+  const results = []
+  for (const arm of ARMS_R1) {
+    const role = arm.useContent ? 'user' : arm.role
+    const content = arm.useContent
+      ? (arm.content || `developer: ${SYS}`)
+      : SYS
+    const messages = [{ role, content }]
+    const body = {
+      model: MODEL,
+      stream: true,
+      max_tokens: 8,
+      messages,
+    }
+    try {
+      const started = Date.now()
+      const resp = await fetch(`${GATEWAY}/v2/chat/completions`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Authorization': `Bearer ${key}`,
+          'User-Agent': 'CLI/unknown CodeBuddy/2.136.0',
+        },
+        body: JSON.stringify(body),
+      })
+      const text = await resp.text()
+      const ms = Date.now() - started
+      let code = null, msg = null
+      try { const j = JSON.parse(text); code = j.code; msg = j.msg } catch { /* sse */ }
+      const raw = text.slice(0, 200)
+      const entry = {
+        type: 'probe',
+        at: new Date().toISOString(),
+        name: arm.name,
+        role: role,
+        expectPass: arm.expectPass,
+        note: arm.note,
+        status: resp.status,
+        code,
+        msg,
+        ms,
+        raw: redactR1(raw),
+      }
+      results.push(entry)
+      appendFileSync(OUT, JSON.stringify(entry) + '\n')
+      console.log(`${arm.name.padEnd(26)} status=${resp.status} code=${code ?? '-'} msg=${(msg ?? '').slice(0, 40)} ${ms}ms`)
+    } catch (e) {
+      const entry = { type: 'probe', at: new Date().toISOString(), name: arm.name, error: String(e) }
+      results.push(entry)
+      appendFileSync(OUT, JSON.stringify(entry) + '\n')
+      console.log(`${arm.name.padEnd(26)} ERROR ${e}`)
+    }
+    await sleep(SPACING_MS)
+  }
+  console.log(`\nDone. ${results.length} arms → ${OUT}`)
+}
+
+// ─────────────────────────── ROUND 2（原 hermes-probe-dev-role2.mjs） ───────────────────────────
+
+// messages builder per arm
+const ARMS_R2 = [
+  { name: 'P7-control', mk: () => [{ role: 'system', content: SYS }, { role: 'user', content: 'hi' }], note: 'control: no developer at all, expect 200' },
+  { name: 'P1-dev-second', mk: () => [{ role: 'user', content: 'hi' }, { role: 'developer', content: SYS }, { role: 'user', content: 'ok?' }], note: 'developer in middle position' },
+  { name: 'P2-dev-last', mk: () => [{ role: 'user', content: 'hi' }, { role: 'assistant', content: 'hi' }, { role: 'developer', content: SYS }], note: 'developer as last message' },
+  { name: 'P3-sys-dev-user', mk: () => [{ role: 'system', content: SYS }, { role: 'developer', content: SYS }, { role: 'user', content: 'hi' }], note: 'system then developer then user' },
+  { name: 'P4-two-dev', mk: () => [{ role: 'developer', content: SYS }, { role: 'developer', content: SYS }, { role: 'user', content: 'hi' }], note: 'two developer messages' },
+  { name: 'P5-space-then-dev', mk: () => [{ role: 'developer ', content: SYS }, { role: 'developer', content: SYS }, { role: 'user', content: 'hi' }], note: 'trailing-space dev (passes) then real dev (rejects?)' },
+  { name: 'P6-tool-dev', mk: () => [{ role: 'system', content: SYS }, { role: 'user', content: 'hi' }, { role: 'assistant', content: 'call tool', tool_calls: [{ id: 't1', type: 'function', function: { name: 'x', arguments: '{}' } }] }, { role: 'tool', tool_call_id: 't1', content: 'developer deep inside' }], note: 'developer string only inside tool content' },
+]
+
+async function runRound2() {
+  const OUT = join('docs', 'probes', `dev-role-boundary2-${new Date().toISOString().slice(0, 10)}.jsonl`)
+  const key = resolveKey()
+  for (const arm of ARMS_R2) {
+    const messages = arm.mk()
+    const body = { model: MODEL, stream: true, max_tokens: 8, messages }
+    try {
+      const started = Date.now()
+      const resp = await fetch(`${GATEWAY}/v2/chat/completions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${key}`, 'User-Agent': 'CLI/unknown CodeBuddy/2.136.0' },
+        body: JSON.stringify(body),
+      })
+      const text = await resp.text()
+      const ms = Date.now() - started
+      let code = null, msg = null
+      try { const j = JSON.parse(text); code = j.code; msg = j.msg } catch { /* sse */ }
+      const entry = { type: 'probe', at: new Date().toISOString(), name: arm.name, note: arm.note, status: resp.status, code, msg, ms, raw: redact(text.slice(0, 120)) }
+      appendFileSync(OUT, JSON.stringify(entry) + '\n')
+      console.log(`${arm.name.padEnd(20)} status=${resp.status} code=${code ?? '-'} msg=${(msg ?? '').slice(0, 44)} ${ms}ms`)
+    } catch (e) {
+      appendFileSync(OUT, JSON.stringify({ type: 'probe', at: new Date().toISOString(), name: arm.name, error: String(e) }) + '\n')
+      console.log(`${arm.name.padEnd(20)} ERROR ${e}`)
+    }
+    await sleep(SPACING_MS)
+  }
+  console.log(`\nDone → ${OUT}`)
+}
+
+// ─────────────────────────── ROUND 3（原 hermes-probe-dev-role3.mjs） ───────────────────────────
+
+// raw body per arm (we need raw object control for structural probes)
+const ARMS_R3 = [
+  { name: 'S6-control', mk: () => ({ messages: [{ role: 'system', content: SYS }, { role: 'user', content: 'hi' }] }), note: 'control' },
+  { name: 'S1-dup-role', mk: () => ({ messages: [{ role: 'developer', role2: 'user', content: SYS }, { role: 'user', content: 'hi' }] }), note: 'two role-ish keys in one object' },
+  { name: 'S2-role-number', mk: () => ({ messages: [{ role: 1, content: SYS }, { role: 'user', content: 'hi' }] }), note: 'role as integer' },
+  { name: 'S3-no-role', mk: () => ({ messages: [{ content: SYS }, { role: 'user', content: 'hi' }] }), note: 'message without any role field' },
+  { name: 'S4-dev-array', mk: () => ({ messages: [{ role: 'developer', content: [{ type: 'text', text: SYS }] }, { role: 'user', content: 'hi' }] }), note: 'developer with content as array of blocks' },
+  { name: 'S5-mixed-blocks', mk: () => ({ messages: [{ role: 'user', content: [{ type: 'text', text: SYS }] }], extra: { role: 'developer' } }), note: 'developer only in top-level extra (not messages array)' },
+]
+
+async function runRound3() {
+  const OUT = join('docs', 'probes', `dev-role-boundary3-${new Date().toISOString().slice(0, 10)}.jsonl`)
+  const key = resolveKey()
+  for (const arm of ARMS_R3) {
+    const base = arm.mk()
+    const body = { model: MODEL, stream: true, max_tokens: 8, ...base }
+    try {
+      const started = Date.now()
+      const resp = await fetch(`${GATEWAY}/v2/chat/completions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${key}`, 'User-Agent': 'CLI/unknown CodeBuddy/2.136.0' },
+        body: JSON.stringify(body),
+      })
+      const text = await resp.text()
+      const ms = Date.now() - started
+      let code = null, msg = null
+      try { const j = JSON.parse(text); code = j.code; msg = j.msg } catch { /* sse */ }
+      const entry = { type: 'probe', at: new Date().toISOString(), name: arm.name, note: arm.note, status: resp.status, code, msg, ms, raw: redact(text.slice(0, 120)) }
+      appendFileSync(OUT, JSON.stringify(entry) + '\n')
+      console.log(`${arm.name.padEnd(18)} status=${resp.status} code=${code ?? '-'} msg=${(msg ?? '').slice(0, 44)} ${ms}ms`)
+    } catch (e) {
+      appendFileSync(OUT, JSON.stringify({ type: 'probe', at: new Date().toISOString(), name: arm.name, error: String(e) }) + '\n')
+      console.log(`${arm.name.padEnd(18)} ERROR ${e}`)
+    }
+    await sleep(SPACING_MS)
+  }
+  console.log(`\nDone → ${OUT}`)
+}
+
+// ─────────────────────────── 轮次调度 ───────────────────────────
+
+function argValue(flag) {
+  const i = process.argv.indexOf(flag)
+  return i > 0 ? process.argv[i + 1] : null
+}
+const ROUNDS = { 1: runRound1, 2: runRound2, 3: runRound3 }
+const ROUND = argValue('--round') ?? '1'
+if (process.argv.includes('--help') || !ROUNDS[ROUND]) {
+  console.log('Usage: node scripts/hermes-probe-dev-role.mjs [--round 1|2|3]（默认 1；轮次对应见文件头注释）')
+  process.exit(process.argv.includes('--help') ? 0 : 1)
+}
+ROUNDS[ROUND]().catch((e) => { console.error(e); process.exit(1) })

package/scripts/measure-latency.mjs

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+/**
+ * Latency measurement + error reproduction for 识图 (bridge aggregation) and
+ * /agenttool search — item 2 tooling. Repeatable by construction: fixed
+ * payloads, fixed iteration count, every iteration appended as JSONL.
+ *
+ * Paths measured:
+ *   vision-aggregate : POST {bridge}/v2/chat/completions, stream absent, with
+ *                      image content — the describe-image shape; the caller
+ *                      waits for the FULL upstream stream (bridge aggregates).
+ *   vision-stream    : same payload with stream:true — TTFB/total split
+ *                      separates upstream generation time from bridge work.
+ *   search           : makeSearchProvider().search() — the production
+ *                      /agenttool/v1/search code path (credentials included).
+ *   search-direct    : (mock mode) raw fetch to the gateway, bypassing the
+ *                      provider — isolates provider-side overhead.
+ *
+ * Modes:
+ *   --mock  (default) mock gateway + the real bridge on ephemeral ports.
+ *           No credentials needed; quantifies bridge/provider overhead
+ *           against a controlled upstream delay.
+ *   --real  live gateway: search resolves the key from
+ *           ~/.dsh/codebuddy-plugin.json; vision goes through the already
+ *           running dsh bridge (--bridge-port, default 3901).
+ *
+ * Options: --iters N (20) · --out PATH (/tmp/codebuddy-latency.jsonl)
+ *          --bridge-port N (3901) · --model ID · --query STR
+ *          --upstream-delay MS (mock, 300) · --stream-drip MS (mock, 25)
+ *
+ * Records: {ts, mode, path, iter, ok, ms, ttfbMs?, bytesIn, status, err?}.
+ * Summary (min/p50/p95/max per path) is printed and appended to the file.
+ */
+
+import { createServer } from 'node:http'
+import { appendFileSync, mkdtempSync, readFileSync } from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)))
+
+// ------------------------------------------------------------------ args
+const args = process.argv.slice(2)
+const opt = (name, dflt) => {
+  const i = args.indexOf(`--${name}`)
+  return i >= 0 ? args[i + 1] : dflt
+}
+const MODE = args.includes('--real') ? 'real' : 'mock'
+const ITERS = Number(opt('iters', 20))
+const OUT = opt('out', '/tmp/codebuddy-latency.jsonl')
+const BRIDGE_PORT = Number(opt('bridge-port', 3901))
+const UPSTREAM_DELAY = Number(opt('upstream-delay', 300))
+const STREAM_DRIP = Number(opt('stream-drip', 25))
+const QUERY = opt('query', '腾讯 CodeBuddy 是什么')
+const MODEL = opt('model', MODE === 'real' ? 'deepseek-v4-flash' : 'm1')
+
+// 1x1 red PNG — valid image, tiny upload.
+const RED_PNG_DATA_URL =
+  'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg=='
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+const records = []
+function record(rec) {
+  records.push(rec)
+  appendFileSync(OUT, JSON.stringify(rec) + '\n')
+}
+
+// ------------------------------------------------------------------ mock gateway
+function startMockGateway() {
+  const server = createServer((req, res) => {
+    let raw = ''
+    req.on('data', (c) => (raw += c))
+    req.on('end', () => {
+      if (req.url.endsWith('/chat/completions')) {
+        setTimeout(() => {
+          res.writeHead(200, { 'Content-Type': 'text/event-stream' })
+          const chunks = ['a red ', 'dot on ', 'a white ', 'background.']
+          let i = 0
+          const drip = () => {
+            if (i < chunks.length) {
+              res.write(`data: {"id":"mock","choices":[{"index":0,"delta":{"content":${JSON.stringify(chunks[i++])}}}]}\n\n`)
+              setTimeout(drip, STREAM_DRIP)
+            } else {
+              res.end('data: {"id":"mock","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":10,"completion_tokens":4,"total_tokens":14}}\n\ndata: [DONE]\n\n')
+            }
+          }
+          drip()
+        }, UPSTREAM_DELAY)
+        return
+      }
+      setTimeout(() => {
+        res.writeHead(200, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ code: 0, results: [{ url: 'https://example.com', title: 'x', snippet: 'y' }] }))
+      }, UPSTREAM_DELAY)
+    })
+  })
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port }))
+  })
+}
+
+async function freePort() {
+  const probe = createServer()
+  await new Promise((r) => probe.listen(0, '127.0.0.1', r))
+  const { port } = probe.address()
+  await new Promise((r) => probe.close(r))
+  return port
+}
+
+// ------------------------------------------------------------------ probes
+function visionPayload(stream) {
+  return {
+    model: MODEL,
+    ...(stream ? { stream: true } : {}),
+    messages: [
+      {
+        role: 'user',
+        content: [
+          { type: 'text', text: 'Describe this image in one short sentence.' },
+          { type: 'image_url', image_url: { url: RED_PNG_DATA_URL } },
+        ],
+      },
+    ],
+  }
+}
+
+async function probeVision(bridgeBase, stream, iter) {
+  const t0 = Date.now()
+  let ttfbMs = null
+  try {
+    const res = await fetch(`${bridgeBase}/v2/chat/completions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(visionPayload(stream)),
+    })
+    ttfbMs = Date.now() - t0
+    const text = await res.text()
+    const ms = Date.now() - t0
+    const ok = res.status === 200 && (stream ? text.includes('[DONE]') : text.includes('chat.completion'))
+    record({
+      ts: t0, mode: MODE, path: stream ? 'vision-stream' : 'vision-aggregate',
+      iter, ok, ms, ttfbMs, bytesIn: text.length, status: res.status,
+      ...(ok ? {} : { err: text.slice(0, 300) }),
+    })
+  } catch (err) {
+    record({ ts: t0, mode: MODE, path: stream ? 'vision-stream' : 'vision-aggregate', iter, ok: false, ms: Date.now() - t0, err: String(err?.message ?? err) })
+  }
+}
+
+async function probeSearch(searchFn, iter, path = 'search') {
+  const t0 = Date.now()
+  try {
+    const out = await searchFn()
+    record({ ts: t0, mode: MODE, path, iter, ok: true, ms: Date.now() - t0, bytesIn: JSON.stringify(out).length, status: 200 })
+  } catch (err) {
+    // The error text IS the evidence: keep it verbatim (gateway code/msg or
+    // the network-layer cause chain).
+    record({ ts: t0, mode: MODE, path, iter, ok: false, ms: Date.now() - t0, err: String(err?.message ?? err) })
+  }
+}
+
+// ------------------------------------------------------------------ stats
+function summarize(pathFilter) {
+  const rows = records.filter((r) => r.path === pathFilter)
+  const oks = rows.filter((r) => r.ok).map((r) => r.ms).sort((a, b) => a - b)
+  const fails = rows.filter((r) => !r.ok)
+  const pct = (p) => (oks.length ? oks[Math.min(oks.length - 1, Math.floor((p / 100) * oks.length))] : null)
+  const ttfbs = rows.filter((r) => r.ok && r.ttfbMs != null).map((r) => r.ttfbMs).sort((a, b) => a - b)
+  const line = {
+    kind: 'summary', mode: MODE, path: pathFilter, n: rows.length, failed: fails.length,
+    min: oks[0] ?? null, p50: pct(50), p95: pct(95), max: oks[oks.length - 1] ?? null,
+    ttfbP50: ttfbs.length ? ttfbs[Math.floor(ttfbs.length / 2)] : null,
+  }
+  appendFileSync(OUT, JSON.stringify(line) + '\n')
+  console.log(`  ${pathFilter.padEnd(18)} n=${String(line.n).padStart(3)} fail=${line.failed} min=${line.min} p50=${line.p50} p95=${line.p95} max=${line.max}${line.ttfbP50 != null ? ` ttfbP50=${line.ttfbP50}` : ''}`)
+  for (const f of fails.slice(0, 5)) console.log(`    fail#${f.iter} ${f.ms}ms :: ${f.err}`)
+}
+
+// ------------------------------------------------------------------ main
+async function main() {
+  // Env must be set BEFORE importing index.js — it captures DSH_HOME at
+  // module load (verify-bridge.mjs does the same).
+  if (MODE === 'mock') {
+    process.env.DSH_HOME = mkdtempSync(join(tmpdir(), 'dsh-latency-'))
+    process.env.CODEBUDDY_API_KEY = 'ck_latency_test_key'
+  }
+  const { apply, Config, makeSearchProvider } = await import(new URL('../index.js', import.meta.url).href)
+  const AUTH_MODE_OVERRIDE = opt('auth-mode', null) // real mode: e.g. --auth-mode api-key
+
+  if (MODE === 'mock') {
+    const { server, port: gwPort } = await startMockGateway()
+    const bridgePort = await freePort()
+    const ctx = {
+      inject: (_deps, cb) => cb({ webServer: { register() {} } }),
+      web: { registerSearchProvider: () => () => {}, registerFetchProvider: () => () => {} },
+      on: () => {},
+    }
+    apply(ctx, { baseURL: `http://127.0.0.1:${gwPort}`, bridgePort })
+    await sleep(250)
+    const bridgeBase = `http://127.0.0.1:${bridgePort}`
+    const settings = () => Config({ baseURL: `http://127.0.0.1:${gwPort}` })
+    const provider = makeSearchProvider(settings)
+
+    console.log(`[mock] upstream delay ${UPSTREAM_DELAY}ms + drip ${STREAM_DRIP}ms/chunk, ${ITERS} iters per path`)
+    for (let i = 0; i < ITERS; i++) {
+      await probeVision(bridgeBase, false, i)
+      await probeVision(bridgeBase, true, i)
+      await probeSearch(() => provider.search({ query: QUERY }), i)
+      await probeSearch(
+        () => fetch(`http://127.0.0.1:${gwPort}/agenttool/v1/search`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ck_latency_test_key' },
+          body: JSON.stringify({ query: QUERY, type: 'text2text', max_results: 5 }),
+        }).then(async (r) => {
+          if (!r.ok) throw new Error(`HTTP ${r.status}`)
+          return r.json()
+        }),
+        i,
+        'search-direct',
+      )
+    }
+    server.close()
+  } else {
+    // real: vision through the running dsh bridge, search direct to gateway
+    const settingsFile = join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'codebuddy-plugin.json')
+    const settings = () => Config({
+      ...JSON.parse(readFileSync(settingsFile, 'utf8')),
+      ...(AUTH_MODE_OVERRIDE ? { authMode: AUTH_MODE_OVERRIDE } : {}),
+    })
+    const provider = makeSearchProvider(settings)
+    const bridgeBase = `http://127.0.0.1:${BRIDGE_PORT}`
+    console.log(`[real] bridge :${BRIDGE_PORT}, model ${MODEL}, ${ITERS} iters per path`)
+    for (let i = 0; i < ITERS; i++) {
+      await probeVision(bridgeBase, false, i)
+      await probeVision(bridgeBase, true, i)
+      await probeSearch(() => provider.search({ query: QUERY }), i)
+    }
+  }
+
+  console.log('\nsummary (ms):')
+  summarize('vision-aggregate')
+  summarize('vision-stream')
+  summarize('search')
+  if (MODE === 'mock') summarize('search-direct')
+  const totalFails = records.filter((r) => !r.ok).length
+  console.log(`\n${records.length} records → ${OUT} (${totalFails} failures)`)
+  process.exit(0)
+}
+
+main().catch((err) => {
+  console.error(`measure-latency crashed: ${err.stack ?? err.message}`)
+  process.exit(1)
+})