dsh-wisp 0.6.0 → 1.25.1

package/tools/audit-log.mjs

@@ -0,0 +1,245 @@
+/* ============================================================================
+   audit-log.mjs — 生成过程审计日志（哈希链）
+
+   为什么要它：Maker 代理的登记表（.maker/assets/generated-assets.json）只记
+   **工具名 / 提示词 / 时间 / 产物路径**，**不记参数** —— 而 generate_image 与
+   batch_generate_images 是允许传可选 reference_images 的。所以"没喂参考图"这件事，
+   代理那边证不了。
+
+   这个日志把两类东西分开记，谁强谁弱一目了然：
+
+     registry  代理自己写的、独立于本插件的证据：这次调用用的是哪个工具、什么时间、
+                产物落在哪。（**edit_image 是唯一能做图生图的工具**，所以工具名是硬证据。）
+     declared  本次调用发出去的参数（含 reference_images 是否为空）。**这是自我声明**，
+                强度不如上面那条 —— 但它被写进哈希链，事后改不了，而且写在调用之前。
+
+   每条记录还带**入包素材的相对路径与 sha256** —— 于是"这个入包文件 = 那次纯文生图调用的
+   产物，且此后没被改过"可以在任何机器上复查。
+
+   USAGE
+     node tools/audit-log.mjs --verify                 校验链 + 重算产物哈希
+     node tools/audit-log.mjs --declare <manifest>     生成前：登记将要发出的参数
+     node tools/audit-log.mjs --confirm <manifest>     生成后：并入代理登记表 + 记产物哈希
+     node tools/audit-log.mjs --backfill --since <ISO> 回溯：只凭代理登记表补录（标注来源）
+
+   manifest（JSON 数组）：
+     [{ "name": "ds2_idle", "prompt": "……", "skin": "deepsea", "mood": "idle",
+        "params": { "model": "gpt", "resolution": "4K", "target_size": "2048x3072",
+                    "reference_images": [] } }]
+   ========================================================================== */
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { dirname, join, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = resolve(dirname(fileURLToPath(import.meta.url)), '..')          // 包根
+const LOG_DIR = join(here, 'audit')
+const LOG_PATH = join(LOG_DIR, 'generation-audit.jsonl')
+const REGISTRY = process.env.WISP_MAKER_REGISTRY || 'F:/孤屿/.maker/assets/generated-assets.json'
+
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex')
+const fileHash = (p) => (existsSync(p) ? sha256(readFileSync(p)) : null)
+const rel = (p) => {
+  const r = relative(here, p)
+  return r.startsWith('..') ? p : r.split('\\').join('/')
+}
+const args = process.argv.slice(2)
+const flag = (name) => args.includes(name)
+const valueOf = (name) => {
+  const i = args.indexOf(name)
+  return i >= 0 && i + 1 < args.length ? args[i + 1] : null
+}
+
+const readLog = () => {
+  if (!existsSync(LOG_PATH)) return []
+  return readFileSync(LOG_PATH, 'utf8')
+    .split('\n')
+    .filter((l) => l.trim() !== '')
+    .map((l) => JSON.parse(l))
+}
+
+/* 链：每条记录的 hash 覆盖自身全部字段（含 prev）。改任何一条都会断链。 */
+const chainHash = (entry) => {
+  const { hash, ...rest } = entry
+  return sha256(JSON.stringify(rest))
+}
+const append = (entry) => {
+  const log = readLog()
+  const prev = log.length === 0 ? 'genesis' : log[log.length - 1].hash
+  const full = { index: log.length, prev, ...entry }
+  full.hash = chainHash(full)
+  if (!existsSync(LOG_DIR)) mkdirSync(LOG_DIR, { recursive: true })
+  appendFileSync(LOG_PATH, JSON.stringify(full) + '\n', 'utf8')
+  return full
+}
+
+const readRegistry = () => {
+  if (!existsSync(REGISTRY)) return null
+  const json = JSON.parse(readFileSync(REGISTRY, 'utf8'))
+  const list = Array.isArray(json) ? json : Object.values(json)
+  return list.filter((e) => e && typeof e.name === 'string')
+}
+
+/* 代理登记表里最后一次以该 name 开头的调用 */
+const registryFor = (registry, name) => {
+  const hits = registry.filter((e) => e.name === name || e.name.startsWith(name + '_'))
+  if (hits.length === 0) return null
+  return hits.sort((a, b) => String(a.createdAt).localeCompare(String(b.createdAt)))[hits.length - 1]
+}
+
+/* ------------------------------------------------------------------ verify */
+/* 导出给 verify-wisp.mjs 用：同一条检查，不起子进程，也不重复实现一遍。 */
+export function verifyAudit(root = here) {
+  const log = readLog()
+  const problems = []
+  let prev = 'genesis'
+  for (const e of log) {
+    if (e.prev !== prev) problems.push('第 ' + e.index + ' 条断链（prev 不匹配）')
+    if (chainHash(e) !== e.hash) problems.push('第 ' + e.index + ' 条内容被改动（hash 不匹配）')
+    prev = e.hash
+  }
+  const assets = log.filter((e) => e.kind === 'confirm' && e.output && e.output.path)
+  for (const e of assets) {
+    const p = resolve(root, e.output.path)
+    if (!existsSync(p)) { problems.push(e.output.path + ' 不见了'); continue }
+    if (fileHash(p) !== e.output.sha256) problems.push(e.output.path + ' 的哈希与记录不符')
+  }
+  const img2img = log.filter((e) => e.registry && e.registry.tool === 'edit_image')
+  const declaredNone = log.filter((e) => e.kind === 'declare' && e.declared
+    && Array.isArray(e.declared.reference_images) && e.declared.reference_images.length === 0)
+  return { entries: log.length, assets, problems, img2img, declaredNone: declaredNone.length,
+    backfilled: log.filter((e) => e.source === 'registry-backfill').length }
+}
+
+if (flag('--verify')) {
+  const res = verifyAudit(here)
+  const log = readLog()
+  let bad = 0
+  let missing = 0
+  let prev = 'genesis'
+  for (const e of log) {
+    if (e.prev !== prev) { console.log(`  ✗ 第 ${e.index} 条断链（prev 不匹配）`); bad++ }
+    if (chainHash(e) !== e.hash) { console.log(`  ✗ 第 ${e.index} 条内容被改动（hash 不匹配）`); bad++ }
+    prev = e.hash
+  }
+  const assets = res.assets
+  for (const e of assets) {
+    const p = resolve(here, e.output.path)
+    if (!existsSync(p)) { console.log(`  ✗ ${e.output.path} 不见了`); missing++; continue }
+    if (fileHash(p) !== e.output.sha256) { console.log(`  ✗ ${e.output.path} 的哈希与记录不符`); bad++ }
+  }
+  const img2img = log.filter((e) => e.registry && e.registry.tool === 'edit_image')
+  const unknown = log.filter((e) => e.registry && e.registry.tool && !['generate_image', 'batch_generate_images', 'edit_image'].includes(e.registry.tool))
+  console.log(`  记录 ${log.length} 条（declare ${log.filter((e) => e.kind === 'declare').length} / confirm ${assets.length} / backfill ${log.filter((e) => e.source === 'registry-backfill').length}）`)
+  console.log(`  覆盖入包素材 ${assets.length} 个，全部存在且哈希一致：${missing === 0 && bad === 0 ? '是' : '否'}`)
+  console.log(`  代理登记表显示使用过 edit_image（图生图）的条目：${img2img.length}`)
+  if (img2img.length > 0) for (const e of img2img) console.log(`    ⚠ ${e.name}  ${e.registry.createdAt}`)
+  if (unknown.length > 0) console.log(`  ⚠ 未识别的工具名：${unknown.map((e) => e.registry.tool).join(', ')}`)
+  console.log(bad === 0 && missing === 0 ? '  AUDIT OK' : `  AUDIT FAILED（${bad + missing} 个问题）`)
+  process.exit(bad + missing === 0 ? 0 : 1)
+}
+
+/* --------------------------------------------------------- declare/confirm */
+const manifestPath = valueOf('--declare') || valueOf('--confirm')
+const isDeclare = flag('--declare')
+
+if (manifestPath) {
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  if (!Array.isArray(manifest) || manifest.length === 0) {
+    console.error('manifest 必须是非空数组'); process.exit(1)
+  }
+  const registry = readRegistry()
+  const at = new Date().toISOString()
+
+  for (const item of manifest) {
+    if (typeof item.name !== 'string' || typeof item.prompt !== 'string') {
+      console.error(`manifest 项缺 name/prompt：${JSON.stringify(item).slice(0, 80)}`); process.exit(1)
+    }
+    const params = item.params || {}
+    /* 自我声明里也必须照实写：这一项为空才说明没传参考图 */
+    const refs = params.reference_images
+    if (refs !== undefined && (!Array.isArray(refs) || refs.length !== 0)) {
+      console.error(`✗ ${item.name} 声明了参考图 —— 本项目的规则是不喂参考图。拒绝记录。`)
+      process.exit(1)
+    }
+
+    if (isDeclare) {
+      append({
+        kind: 'declare',
+        source: 'manifest',
+        at,
+        name: item.name,
+        promptSha256: sha256(item.prompt),
+        promptPreview: item.prompt.slice(0, 60),
+        declared: {
+          model: params.model ?? null,
+          resolution: params.resolution ?? null,
+          target_size: params.target_size ?? null,
+          reference_images: [],
+        },
+      })
+      continue
+    }
+
+    /* confirm：并入代理登记表，并记下入包素材的哈希 */
+    const rec = registry ? registryFor(registry, item.name) : null
+    const skin = item.skin
+    const mood = item.mood
+    const assetPath = skin && mood ? join(here, 'assets', skin, mood + '.webp') : null
+    const master = rec && rec.absolutePath ? rec.absolutePath : null
+    append({
+      kind: 'confirm',
+      source: 'manifest+registry',
+      at,
+      name: item.name,
+      skin: skin ?? null,
+      mood: mood ?? null,
+      registry: rec
+        ? { tool: rec.tool, createdAt: rec.createdAt, localPath: rec.localPath ?? null }
+        : { tool: null, createdAt: null, localPath: null, note: '登记表里没找到这次调用' },
+      master: master ? { path: rel(master), sha256: fileHash(master) } : null,
+      output: assetPath && existsSync(assetPath)
+        ? { path: rel(assetPath), sha256: fileHash(assetPath), bytes: statSync(assetPath).size }
+        : null,
+      promptMatchesRegistry: rec ? sha256(item.prompt) === sha256(rec.prompt ?? '') : null,
+    })
+  }
+  console.log(`${isDeclare ? 'declare' : 'confirm'}：写入 ${manifest.length} 条 → ${rel(LOG_PATH)}`)
+  process.exit(0)
+}
+
+/* -------------------------------------------------------------- backfill */
+if (flag('--backfill')) {
+  const since = valueOf('--since') || '1970-01-01T00:00:00Z'
+  const registry = readRegistry()
+  if (!registry) { console.error(`读不到代理登记表：${REGISTRY}`); process.exit(1) }
+  const SKIN_OF = { ds2: 'deepsea', cl2: 'classic', ng2: 'night', pj2: 'pajama', canon: 'canon' }
+  const MOODS = ['idle', 'happy', 'sleepy', 'work', 'attn', 'poked', 'proud']
+  let n = 0
+  for (const rec of registry) {
+    if (String(rec.createdAt) < since) continue
+    const [head, mood] = String(rec.name).split('_')
+    const skin = SKIN_OF[head]
+    if (!skin || !MOODS.includes(mood)) continue
+    const assetPath = join(here, 'assets', skin, mood + '.webp')
+    append({
+      kind: 'confirm',
+      source: 'registry-backfill',
+      at: new Date().toISOString(),
+      name: rec.name,
+      skin, mood,
+      registry: { tool: rec.tool, createdAt: rec.createdAt, localPath: rec.localPath ?? null },
+      master: rec.absolutePath ? { path: rel(rec.absolutePath), sha256: fileHash(rec.absolutePath) } : null,
+      output: existsSync(assetPath) ? { path: rel(assetPath), sha256: fileHash(assetPath), bytes: statSync(assetPath).size } : null,
+      /* 回溯条目**没有**自我声明的参数（那时还没这个日志），如实标注 */
+      declared: null,
+      note: '回溯补录：只有代理登记表的事实，没有当次自我声明的参数',
+    })
+    n++
+  }
+  console.log(`backfill：补录 ${n} 条 → ${rel(LOG_PATH)}`)
+  process.exit(0)
+}
+
+console.log(readFileSync(fileURLToPath(import.meta.url), 'utf8').split('USAGE')[1].split('=====')[0].trim())

package/tools/bundle-cost.mjs

@@ -0,0 +1,105 @@
+/* ============================================================================
+   bundle-cost.mjs — 包体积到底值多少钱？
+
+   背景：这个插件曾经在冒烟里有一条"包体不得超过 4 MB（后来 6 MB）"的守卫。
+   那条红线是我为了"别让它悄悄变胖"自己拍的数，不是任何真实约束 —— 有人问
+   "包体哪来的上限"，才把它量清楚：解析代价是 1.45 ms/MB 量级，次线性，
+   再加一整套皮肤约 +1.6 ms。红线因此删掉，改成"记录体积 + 量代价"。
+
+   做法：拿真实的 lib/client.js，追加等量字符串字面量（精灵图的 base64 也是字符串
+   字面量，所以负担同源），逐个体积在真实 Chromium 里计时。
+
+   RUN
+     node tools/bundle-cost.mjs
+
+   浏览器是可选依赖：找不到就以 0 退出并说明原因（同 tools/smoke.mjs）。
+   ========================================================================== */
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+
+function findPlaywright() {
+  /* 与 tools/smoke.mjs、tools/perf.mjs 保持同一套解析顺序：
+     profile → 本包 → 开发机检出。Playwright 是可选依赖，找不到就跳过（不是失败）。 */
+  const bases = [
+    process.env.DSH_PROFILE_DIR ? join(process.env.DSH_PROFILE_DIR, 'package.json') : null,
+    join(here, 'package.json'),
+    'E:/deepseek-harness/package.json',
+  ].filter((p) => p && existsSync(p))
+  for (const base of bases) {
+    for (const spec of ['playwright-core', 'playwright', 'playwright-chromium']) {
+      try {
+        const mod = createRequire(base)(spec)
+        if (mod && mod.chromium) return { chromium: mod.chromium, from: `${base} → ${spec}` }
+      } catch (e) { /* 试下一个 */ }
+    }
+  }
+  const roots = [process.env.DSH_PROFILE_DIR ? join(process.env.DSH_PROFILE_DIR, '..') : null, here, 'E:/deepseek-harness'].filter(Boolean)
+  for (const root of roots) {
+    const pnpm = join(root, 'node_modules', '.pnpm')
+    if (!existsSync(pnpm)) continue
+    for (const entry of readdirSync(pnpm)) {
+      if (!/^playwright(-core)?@/.test(entry)) continue
+      const pkg = join(pnpm, entry, 'node_modules', 'playwright-core')
+      if (!existsSync(pkg)) continue
+      try {
+        const mod = createRequire(pkg)(pkg)
+        if (mod && mod.chromium) return { chromium: mod.chromium, from: pkg }
+      } catch (e) { /* 下一个版本 */ }
+    }
+  }
+  return null
+}
+
+const playwright = findPlaywright()
+if (!playwright) {
+  console.log('bundle-cost: 未找到 Playwright —— 跳过测量（这不是失败）')
+  process.exit(0)
+}
+
+const bundle = readFileSync(join(here, 'lib', 'client.js'), 'utf8')
+const baseMb = Buffer.byteLength(bundle) / 1048576
+console.log(`真实包: ${baseMb.toFixed(2)} MB（lib/client.js）\n`)
+
+const chromeCandidates = [
+  process.env.WISP_CHROME,
+  process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, 'ms-playwright', 'chromium-1234', 'chrome-win64', 'chrome.exe') : null,
+  '/usr/bin/chromium',
+  '/usr/bin/google-chrome',
+].filter(Boolean)
+const executablePath = chromeCandidates.find((p) => existsSync(p))
+const browser = await playwright.chromium.launch({ headless: true, executablePath })
+
+console.log('目标体积   实际体积   解析+执行   每 MB')
+const rows = []
+for (const target of [baseMb, 8, 16, 24]) {
+  const extra = Math.max(0, Math.round((target - baseMb) * 1048576))
+  const src = extra > 0 ? `${bundle}\n;globalThis.__pad = "${'x'.repeat(extra)}";\n` : bundle
+  const page = await browser.newPage()
+  await page.setContent('<!doctype html><html><head></head><body></body></html>')
+  const ms = await page.evaluate((code) => {
+    window.__ML = { def: null }
+    window.__ModuleLoader__ = { load: (d) => { window.__ML.def = d } }
+    const t0 = performance.now()
+    new Function(code)()
+    window.__ML.def.factory(() => ({}))
+    return performance.now() - t0
+  }, src)
+  await page.close()
+  const mb = Buffer.byteLength(src) / 1048576
+  rows.push({ mb, ms })
+  console.log(`${String(target).padStart(6)} MB  ${mb.toFixed(2).padStart(8)} MB  ${ms.toFixed(1).padStart(8)} ms  ${(ms / mb).toFixed(2)} ms/MB`)
+}
+
+const first = rows[0]
+const last = rows[rows.length - 1]
+const slope = (last.ms - first.ms) / (last.mb - first.mb)
+console.log('')
+console.log(`  从 ${first.mb.toFixed(1)} MB 到 ${last.mb.toFixed(1)} MB：${first.ms.toFixed(1)} → ${last.ms.toFixed(1)} ms`)
+console.log(`  斜率约 ${slope.toFixed(2)} ms/MB（次线性）`)
+console.log(`  再加一整套皮肤（约 +1.1 MB）的解析代价约为 ${(1.1 * slope).toFixed(1)} ms`)
+await browser.close()

package/tools/pack-check.mjs

@@ -0,0 +1,78 @@
+/* ============================================================================
+   pack-check.mjs — 打包自足性检查：`npm pack` → 解包 → **从解出的副本**跑预检与重建。
+
+   为什么需要它：「这个包能不能被别人装走」不能靠"我看过 files[] 了"来回答 ——
+   文档指向包外、tools/ 少声明一个、素材没打进去，全都要真的解出副本才暴露。
+   （这个检查第一次跑就抓到了 README 里指向开发机绝对路径的死引用。）
+
+   RUN
+     node tools/pack-check.mjs
+
+   npm 与 tar 都是可选依赖：找不到就以 0 退出并说明原因。
+   ========================================================================== */
+
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const isWin = process.platform === 'win32'
+const npm = isWin ? 'npm.cmd' : 'npm'
+const run = (cmd, args, opts = {}) => spawnSync(cmd, args, { encoding: 'utf8', shell: isWin, ...opts })
+
+if (run(npm, ['--version']).status !== 0) {
+  console.log('pack-check: 未找到 npm —— 跳过打包检查（这不是失败）')
+  process.exit(0)
+}
+
+let failures = 0
+const check = (cond, label, detail = '') => {
+  console.log(`  ${cond ? 'PASS' : 'FAIL'}  ${label}${detail ? '  — ' + detail : ''}`)
+  if (!cond) failures++
+}
+
+const work = mkdtempSync(join(tmpdir(), 'wisp-pack-'))
+try {
+  console.log('== 打包 ==')
+  const packed = run(npm, ['pack', '--pack-destination', work], { cwd: here })
+  const tgz = readdirSync(work).find((f) => f.endsWith('.tgz'))
+  check(packed.status === 0 && tgz !== undefined, 'npm pack succeeds',
+    tgz ?? String(packed.stderr ?? '').slice(0, 160))
+  if (!tgz) { process.exit(1) }
+  check(statSync(join(work, tgz)).size > 1024, 'the tarball is not empty',
+    `${Math.round(statSync(join(work, tgz)).size / 1024)} KB`)
+
+  console.log('\n== 解包 ==')
+  const extract = join(work, 'x')
+  mkdirSync(extract, { recursive: true })
+  const untar = run('tar', ['-xzf', join(work, tgz), '-C', extract])
+  check(untar.status === 0, 'tar extracts the tarball', String(untar.stderr ?? '').slice(0, 160))
+  const root = join(extract, 'package')
+  check(existsSync(join(root, 'package.json')), 'it extracts to a package root', root)
+  if (!existsSync(join(root, 'package.json'))) { process.exit(1) }
+
+  console.log('\n== 发布子集是否自足 ==')
+  for (const required of ['lib/index.js', 'lib/client.js', 'cordis.patch.yml', 'assets']) {
+    check(existsSync(join(root, required)), `${required} ships`, '')
+  }
+
+  console.log('\n== 从解出的副本跑预检 ==')
+  const verify = run('node', [join(root, 'verify-wisp.mjs')])
+  const passed = (String(verify.stdout ?? '').match(/^\s+PASS/gm) ?? []).length
+  const failed = (String(verify.stdout ?? '').match(/^\s+FAIL/gm) ?? []).length
+  check(verify.status === 0 && failed === 0 && passed > 0,
+    'the published subset verifies on its own', `${passed} passed, ${failed} failed`)
+
+  console.log('\n== 从解出的副本重建 ==')
+  const build = run('node', [join(root, 'build.mjs')])
+  const inlined = (String(build.stdout ?? '').match(/base64 inlined\s+([\d.]+) KB/) ?? [])[1]
+  check(build.status === 0, 'the shipped art is enough to rebuild the bundle',
+    inlined ? `${inlined} KB inlined` : String(build.stderr ?? '').slice(0, 160))
+
+  console.log(`\n${failures === 0 ? '=== PACK OK ===' : '=== PACK FAILED ==='}`)
+  process.exit(failures === 0 ? 0 : 1)
+} finally {
+  rmSync(work, { recursive: true, force: true })
+}

package/tools/perf.mjs

@@ -0,0 +1,186 @@
+/* ============================================================================
+   perf.mjs — 性能探针：README 的「性能」一节就是用它量的。
+
+   为什么要有这个脚本：那张表里的数字必须**可复现**，否则它只是"我说过"。
+   计数与耗时都靠**包装原生 querySelector/querySelectorAll** 得到，不靠估算。
+
+   RUN
+     node tools/perf.mjs
+     node tools/perf.mjs --quick     # 只测稳态，跳过交替重复的帧测量
+
+   浏览器是**可选依赖**：找不到就以 0 退出并说明原因（同 tools/smoke.mjs）。
+   ========================================================================== */
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const argv = process.argv.slice(2)
+const quick = argv.includes('--quick')
+
+function findPlaywright() {
+  const bases = [
+    process.env.DSH_PROFILE_DIR ? join(process.env.DSH_PROFILE_DIR, 'package.json') : null,
+    join(here, 'package.json'),
+    'E:/deepseek-harness/package.json',
+  ].filter((p) => p && existsSync(p))
+  for (const base of bases) {
+    for (const spec of ['playwright-core', 'playwright', 'playwright-chromium']) {
+      try {
+        // 必须**真的**拿到 chromium 才算命中：require 成功但导出里没有它的情况是存在的，
+        // 那种情况下直接返回会让调用处拿到 undefined.chromium。
+        const mod = createRequire(base)(spec)
+        if (mod && mod.chromium) return { chromium: mod.chromium, from: base + ' → ' + spec }
+      } catch (e) { /* 试下一个 */ }
+    }
+  }
+  const roots = [process.env.DSH_PROFILE_DIR ? join(process.env.DSH_PROFILE_DIR, '..') : null, here, 'E:/deepseek-harness'].filter(Boolean)
+  for (const root of roots) {
+    const pnpm = join(root, 'node_modules', '.pnpm')
+    if (!existsSync(pnpm)) continue
+    for (const entry of readdirSync(pnpm)) {
+      if (!/^playwright(-core)?@/.test(entry)) continue
+      const pkg = join(pnpm, entry, 'node_modules', 'playwright-core')
+      if (!existsSync(pkg)) continue
+      try {
+        const mod = createRequire(pkg)(pkg)
+        if (mod && mod.chromium) return { chromium: mod.chromium, from: pkg }
+      } catch (e) { /* 下一个版本 */ }
+    }
+  }
+  return null
+}
+
+const playwright = findPlaywright()
+if (!playwright) {
+  console.log('perf: 未找到 Playwright —— 跳过测量（这不是失败）')
+  process.exit(0)
+}
+
+const chromeCandidates = [
+  process.env.WISP_CHROME,
+  process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, 'ms-playwright', 'chromium-1234', 'chrome-win64', 'chrome.exe') : null,
+  '/usr/bin/chromium',
+  '/usr/bin/google-chrome',
+].filter(Boolean)
+const executablePath = chromeCandidates.find((p) => existsSync(p))
+const bundle = readFileSync(join(here, 'lib', 'client.js'), 'utf8')
+
+/* 页面上要有东西可查 —— 否则"查询很便宜"这句话没有意义 */
+const FILLER = `
+  const root = document.createElement('div')
+  for (let i = 0; i < 5000; i++) {
+    const row = document.createElement('div'); row.className = 'row'
+    const a = document.createElement('span'); a.textContent = 'message ' + i
+    row.appendChild(a); root.appendChild(row)
+  }
+  document.body.appendChild(root)
+`
+
+const browser = await playwright.chromium.launch({ headless: true, executablePath })
+
+const run = async (withPlugin, withComposer = false) => {
+  const page = await browser.newPage({ viewport: { width: 1600, height: 1000 } })
+  await page.setContent('<!doctype html><html><head></head><body></body></html>')
+  await page.evaluate(({ filler, withComposer }) => {
+    window.__q = { sel: 0, all: 0, selMs: 0, allMs: 0, deltas: [] }
+    const q1 = Document.prototype.querySelector
+    const q2 = Document.prototype.querySelectorAll
+    Document.prototype.querySelector = function (s) {
+      const t = performance.now()
+      const r = q1.call(this, s)
+      window.__q.sel++
+      window.__q.selMs += performance.now() - t
+      return r
+    }
+    Document.prototype.querySelectorAll = function (s) {
+      const t = performance.now()
+      const r = q2.call(this, s)
+      window.__q.all++
+      window.__q.allMs += performance.now() - t
+      return r
+    }
+    new Function(filler)()
+    if (withComposer) {
+      const box = document.createElement('textarea')
+      box.setAttribute('data-composer-input', '')
+      document.body.appendChild(box)
+    }
+    let last = performance.now()
+    const tick = () => {
+      const now = performance.now()
+      window.__q.deltas.push(now - last)
+      last = now
+      requestAnimationFrame(tick)
+    }
+    requestAnimationFrame(tick)
+  }, { filler: FILLER, withComposer })
+
+  let mountMs = null
+  if (withPlugin) {
+    mountMs = await page.evaluate((src) => {
+      window.__ML = { def: null }
+      window.__ModuleLoader__ = { load: (d) => { window.__ML.def = d } }
+      const t0 = performance.now()
+      new Function(src)()
+      window.__ML.def.factory(() => ({})).apply({
+        get: (n) => (n === 'timer'
+          ? { timeout: (cb, ms) => { const i = setTimeout(cb, ms); return () => clearTimeout(i) }, interval: (cb, ms) => { const i = setInterval(cb, ms); return () => clearInterval(i) } }
+          : n === 'styles' ? { insert: (css) => { const s = document.createElement('style'); s.textContent = css; document.head.append(s); return () => s.remove() } } : undefined),
+        on: () => () => {}, effect: () => () => {},
+      }, { wander: false })
+      return performance.now() - t0
+    }, bundle)
+  }
+
+  await page.waitForTimeout(1200)
+  const t0 = await page.evaluate(() => {
+    window.__q.sel = 0; window.__q.all = 0; window.__q.selMs = 0; window.__q.allMs = 0; window.__q.deltas = []
+    return performance.now()
+  })
+  await page.waitForTimeout(10000)
+  const sample = await page.evaluate((startedAt) => {
+    const seconds = (performance.now() - startedAt) / 1000
+    const d = window.__q.deltas.filter((x) => x > 0 && x < 200)
+    return {
+      seconds: Number(seconds.toFixed(2)),
+      sel: window.__q.sel, all: window.__q.all,
+      selMs: window.__q.selMs, allMs: window.__q.allMs,
+      meanFrame: Number((d.length ? d.reduce((a, b) => a + b, 0) / d.length : 0).toFixed(3)),
+    }
+  }, t0)
+  await page.close()
+  return { mountMs, ...sample }
+}
+
+const per = (v, s) => Number((v / s).toFixed(2))
+const bare = await run(false)
+const wired = await run(true, true)
+const pessimistic = await run(true, false)
+
+console.log('== 10 秒静置（页面上有 5000 行合成会话记录）==')
+console.log(`无插件           帧间隔 ${bare.meanFrame} ms   querySelector ${per(bare.sel, bare.seconds)}/s   querySelectorAll ${per(bare.all, bare.seconds)}/s`)
+console.log(`挂载后·有输入框  帧间隔 ${wired.meanFrame} ms   querySelector ${per(wired.sel, wired.seconds)}/s   querySelectorAll ${per(wired.all, wired.seconds)}/s   ← 真实应用的形态`)
+console.log(`挂载后·无输入框  帧间隔 ${pessimistic.meanFrame} ms   querySelector ${per(pessimistic.sel, pessimistic.seconds)}/s   ← 最悲观：每轮都要探一次输入框钩子`)
+console.log('')
+console.log(`DOM 查询耗时 ${wired.selMs.toFixed(2)} ms 选中 + ${wired.allMs.toFixed(2)} ms 全量`)
+console.log(`            = ${per(wired.selMs + wired.allMs, wired.seconds)} ms/秒（占单核 ${(per(wired.selMs + wired.allMs, wired.seconds) / 10).toFixed(3)}%）`)
+console.log(`挂载一次性开销 ${wired.mountMs?.toFixed(1)} ms（含 ${(Buffer.byteLength(bundle) / 1024 / 1024).toFixed(1)} MB 包的解析）`)
+
+if (!quick) {
+  /* 帧开销必须**交替重复**测：单次差值里的噪声就有 0.1 ms 量级，一次测量说明不了任何事 */
+  console.log('\n== 帧间隔：交替重复 4 轮（每轮 6 秒静置）==')
+  const samples = { bare: [], wired: [] }
+  for (let i = 0; i < 4; i++) {
+    const which = i % 2 === 0 ? 'bare' : 'wired'
+    const r = await run(which === 'wired')
+    samples[which].push(r.meanFrame)
+    console.log(`  第 ${i + 1} 轮 ${which === 'bare' ? '无插件' : '挂载后'}  ${r.meanFrame} ms`)
+  }
+  const mean = (a) => Number((a.reduce((x, y) => x + y, 0) / a.length).toFixed(3))
+  console.log(`  均值：无插件 ${mean(samples.bare)} ms  vs  挂载后 ${mean(samples.wired)} ms  →  差 ${(mean(samples.wired) - mean(samples.bare)).toFixed(3)} ms`)
+}
+
+await browser.close()