[BUG] dsh web 启动到打印 URL 约 18s，其中约 9.3s 来自 client-modules 每次启动重复 8 次全量重建组合包

[LeeKai233]

环境

• dsh 0.1.5-rc.1（npm 全局安装）、node v26.7.0、Windows
• profile：默认 web（安装目录：<npm-global>/node_modules/@deepseek-ai/dsh）

现象

dsh web 从执行到打印 dsh web: http://127.0.0.1:... 需要 17–20 s（热缓存）；重启后首次（冷缓存）实测 34 s / 56 s。

根因：@deepseek-ai/dsh-client-modules 一次启动把组合包重建了 8 次

用 NODE_OPTIONS 注入预载模块统计 compose()，实测一次启动执行 8 次（t≈4.9 / 5.0 / 6.4 / 7.8 / 9.7 / 12.4 / 14.6 / 16.9 s）：

• 构造期先对空表 compose() 一次，随后 flush() 再组合一次；
• 之后每个 client 插件激活都会触发一次 queueMicrotask flush，脏集每变化一次就全量重建。

每次 compose() 的输入与代价：

• 65 个 client.js 共 10.66 MB；其中 dsh-client-ui-sidebar-documentpreview/lib/client.js 单文件 6.89 MB（内联 PDF.js，占 65%）；
• 发布包内没有任何 .map，因此每个包都走 identitySectionMap()：newlineCount() 用 for (const char of value) 逐字符遍历（合计 129,526 行），再用 Array.from({ length }).join(';') 生成逐行 mappings，并把整份源码放进 sourcesContent（生成的 map JSON 约 12 MB）；
• 除批次组合包外，还对每个 record 单独 buildCombo([record]) 一次（又处理约 22.7 MB），而浏览器正常启动只请求批次 URL；
• buildCombo() 先把 10.7 MB 拼成一个大字符串再 Buffer.from()。

CPU profile（19.3 s 采样窗口）自耗时：

位置	自耗时
buildCombo	2,991 ms
newlineCount	2,122 ms
identitySectionMap	1,875 ms
utf8Write（大字符串 → Buffer）	2,284 ms
合计	≈9.3 s（约占整个启动 48%）

对照：把同等工作量在同一台机器上单独跑一遍只要 0.93 s —— 这 9.3 s 主要是重复劳动，不是机器慢。

复现与测量方法

1. 统计 compose() 次数：用 NODE_OPTIONS 注入一个 data:text/javascript 预载模块，通过 module.registerHooks() 的 load hook 重写 dsh-client-modules/lib/index.js，把 compose() { 替换为带计数器与时间戳的版本：

   $probe = 'import { registerHooks } from "node:module";
   registerHooks({ load(url, ctx, next) {
     const out = next(url, ctx)
     if (typeof url === "string" && url.includes("dsh-client-modules/lib/index.js")) {
       const src = out.source.toString().replace("compose() {",
         "compose() { console.error(\"[compose] t=\"+Math.round(performance.now()));")
       return { ...out, source: src }
     }
     return out
   } })'
   $env:NODE_OPTIONS = "--import=data:text/javascript," + [uri]::EscapeDataString($probe)
   node <npm-global>/node_modules/@deepseek-ai/dsh/lib/bin.js web --no-open --port 0

2. 定位耗时：node --cpu-prof --cpu-prof-dir <dir> .../lib/bin.js web --no-open --port 0，再把 .cpuprofile 按 callFrame 聚合自耗时。

3. 端到端对照：切换新旧实现各启动一次，抓取 /plugins/??...&rev=... 批次 URL 与单包 URL（含 .map）的 sha1 与 rev。

建议的修复（已在本地验证）

1. newlineCount() 改用 indexOf('\n', i + 1) 循环；
2. identitySectionMap() 的 mappings 用 ';AACA'.repeat(lines - 1) 生成，去掉 Array.from；
3. compose() 不再对每个 record 立即 buildCombo，改为首次请求该 URL 时按 rev 记忆化生成（新增 recordArtifact()，响应体改为惰性 build()）；
4. 激活期只组合一次：构造期同步扫描后 compose() 一次，internal/plugin 的延迟 flush 由微任务改为宏任务合并，一次激活突发只重算一次（8 → 2）；
5. buildCombo() 用 Buffer.concat 组装脚本，避免 10.7 MB 字符串中转。

实测（同一台机器，热缓存）：

	修复前	修复后
compose() 次数	8	2
到打印 URL	17.0 s / 18.3 s	8.2 s / 9.4 s
批次 / 单包 / .map 字节	—	sha1 与 rev 完全一致

验证：packages/client/modules 测试 82/82 通过（含新增的「一次激活突发只重算一次」回归测试）、tsc -b 通过、oxlint 0 警告 0 错误、tsdown 打包成功。第 4 点改变了 flush 的粒度，原来的 microtask 契约与 README/注释已同步更新，并调整了一个等待微任务的既有测试。

补：仓库 PR 与 Issues 均已关闭（CONTRIBUTING 也说明暂不接受外部 PR），因此在此反馈。

完整 diff（基于 master @ aa8262e，可直接 apply）

```diff
diff --git a/packages/client/modules/README.md b/packages/client/modules/README.md
index dad3cd2..b39d65c 100644
--- a/packages/client/modules/README.md
+++ b/packages/client/modules/README.md
@@ -65,7 +65,7 @@ Executing a plugin bundle only registers its factory; every module-body side eff

Incremental composition

-The Node half scans incrementally per package — no full-rescan path. Every internal/plugin emission marks the fiber's entry name dirty; a microtask flush reconciles each dirty name against the live loader entries, and the activation pass seeds the same dirty set and flushes synchronously, so first scan and steady state share one implementation. Package metadata is cached per Loader specifier and owning-tree base URL until restart, while the resolved manifest package name identifies the browser module. Distinct active Loader sources resolving to one package name are rejected; removing the conflict promotes the remaining source without requiring its fiber to restart. Bundle content changes reach the graph only through rebuilt() (the HMR hook).
+The Node half scans incrementally per package — no full-rescan path. Every internal/plugin emission marks the fiber's entry name dirty; a coalesced flush reconciles each dirty name against the live loader entries, and the activation pass seeds the same dirty set, scans it synchronously, and composes once, so first scan and steady state share one implementation. Package metadata is cached per Loader specifier and owning-tree base URL until restart, while the resolved manifest package name identifies the browser module. Distinct active Loader sources resolving to one package name are rejected; removing the conflict promotes the remaining source without requiring its fiber to restart. Bundle content changes reach the graph only through rebuilt() (the HMR hook).

The Node half snapshots each client bundle and available source map before publication. It groups resources into /plugins/??...&rev=... combo URLs, with one bootstrap combo for the modules row and one or more application combos for the other rows; each phase is partitioned before a URL exceeds 3 KiB. Every combo map is Indexed Source Map v3 and uses an authored section when available or an identity section for the packaged bundle. Initial per-plugin revisions use process nonces, so startup does not hash every plugin; HMR hashes only an artifact reported as changed. Advertised responses are immutable, and an unknown combination or revision returns 404.

diff --git a/packages/client/modules/README.zh.md b/packages/client/modules/README.zh.md
index ef7a01d..fef107d 100644
--- a/packages/client/modules/README.zh.md
+++ b/packages/client/modules/README.zh.md
@@ -65,7 +65,7 @@ application combo 脚本在启动时仅注册一次插件 factory；模块主体

增量组合

-Node 半侧逐包增量扫描——没有全量重扫路径。每次发出 internal/plugin 事件时，系统都会把该 fiber 的 entry 名标脏；微任务 flush 会把每个脏名与当前 loader 条目对账，激活 pass 会初始化同一个脏集合并同步 flush，因此首次扫描与稳态共用同一实现。包元数据按 Loader specifier 与所属 tree base URL 缓存至重启，解析出的 manifest（元数据清单）包名作为浏览器模块身份。若不同的 active Loader source 解析到同一包名，组合会失败；移除冲突来源后，剩余来源无需重启 fiber 即可接替。bundle 内容变更只能通过 rebuilt()（HMR 钩子）进入图。
+Node 半侧逐包增量扫描——没有全量重扫路径。每次发出 internal/plugin 事件时，系统都会把该 fiber 的 entry 名标脏；合并后的 flush 会把每个脏名与当前 loader 条目对账，激活 pass 会初始化同一个脏集合并同步扫描、随后只组合一次，因此首次扫描与稳态共用同一实现。包元数据按 Loader specifier 与所属 tree base URL 缓存至重启，解析出的 manifest（元数据清单）包名作为浏览器模块身份。若不同的 active Loader source 解析到同一包名，组合会失败；移除冲突来源后，剩余来源无需重启 fiber 即可接替。bundle 内容变更只能通过 rebuilt()（HMR 钩子）进入图。

Node 半侧会在发布前快照每个客户端 bundle 及其现有 source map。它把资源分组到 /plugins/??...&rev=... combo URL：modules row 使用一个 bootstrap combo，其余 row 使用一个或多个 application combo；每个阶段都会在 URL 超过 3 KiB 之前分区。每个 combo map 都是 Indexed Source Map v3，并在可用时使用作者提供的 section，否则为已打包 bundle 生成 identity section。初始逐插件 revision 使用进程 nonce，所以启动时不哈希每个插件；HMR 只哈希被报告为已变化的产物。已公告响应不可变；未知组合或 revision 返回 404。

diff --git a/packages/client/modules/src/index.ts b/packages/client/modules/src/index.ts
index c823657..9e1e7a8 100644
--- a/packages/client/modules/src/index.ts
+++ b/packages/client/modules/src/index.ts
@@ -11,15 +11,15 @@
*

• Scanning is incremental per package — there is no full-rescan code path.
• Every cordis internal/plugin emission (fiber construction/disposal) marks

• • the fiber's entry name dirty; a microtask flush reconciles each dirty name

• • the fiber's entry name dirty; a coalesced flush reconciles each dirty name
  • against the live loader entries. The activation pass seeds the same dirty

• • set with all current entries and flushes synchronously, so first scan and
• • steady state share one implementation. Package metadata (including the
• • negative "not a client package" verdict) is cached per Loader specifier and
• • owning-tree base URL until restart. The manifest package name identifies
• • the browser module; distinct active Loader sources for that package are a
• • composition error. Bundle content changes reach the graph only through
• • {@link ClientModuleRegistry.rebuilt}.

• • set with all current entries, scans it synchronously, and composes once, so
• • first scan and steady state share one implementation. Package metadata
• • (including the negative "not a client package" verdict) is cached per Loader
• • specifier and owning-tree base URL until restart. The manifest package name
• • identifies the browser module; distinct active Loader sources for that
• • package are a composition error. Bundle content changes reach the graph only
• • through {@link ClientModuleRegistry.rebuilt}.
  • @module @deepseek-ai/dsh-client-modules
    */

@@ -296,8 +296,10 @@ function comboSource(record: WebPluginRecord): ComboSource {
}

/** Stamp a combo script's absolute indexed-map URL onto its executable bytes. */
-function comboScript(input: string, sourceMapUrl?: string): Buffer {

• return Buffer.from(sourceMapUrl === undefined ? input : ${input}//# sourceMappingURL=${sourceMapUrl}\n)
  +function comboScript(input: string | Buffer, sourceMapUrl?: string): Buffer {

• const body = Buffer.isBuffer(input) ? input : Buffer.from(input)
• if (sourceMapUrl === undefined) return body
• return Buffer.concat([body, Buffer.from(//# sourceMappingURL=${sourceMapUrl}\n)])
  }

/** Parse an optional source-map artifact; missing maps do not prevent plugin execution. /
@@ -328,7 +330,11 @@ function sourceMapSnapshot(clientPath: string): WebPluginRecord['sourceMap'] {
/* Count generated lines while assembling indexed-map section offsets. */
function newlineCount(value: string): number {
let count = 0

• for (const char of value) if (char === '\n') count += 1

• let index = value.indexOf('\n')
• while (index !== -1) {
• count += 1
• index = value.indexOf('\n', index + 1)
• }
  return count
  }

@@ -354,8 +360,8 @@ function comboSectionMap(record: WebPluginRecord): Record<string, unknown> {

/** Map each generated line to the same line in a bundled JavaScript source. */
function identitySectionMap(source: string, sourceUrl: string): Record<string, unknown> {

• const mappings = Array.from({ length: newlineCount(source) }, (_, index) => index === 0 ? 'AAAA' : 'AACA')
• .join(';')

• const lines = newlineCount(source)
• const mappings = lines === 0 ? '' : lines === 1 ? 'AAAA' : AAAA${';AACA'.repeat(lines - 1)}
  return {
  version: 3,
  names: [],
  @@ -367,7 +373,7 @@ function identitySectionMap(source: string, sourceUrl: string): Record<string, u

/** Concatenate one or more factory registrations and compose their maps as indexed sections. */
function buildCombo(records: readonly WebPluginRecord[], revision?: string): ComboArtifact {

• let source = ''

• const chunks: Buffer[] = []
  const sections: { offset: { line: number; column: 0 }; map: Record<string, unknown> }[] = []
  let line = 0
  for (const record of records) {
  @@ -377,16 +383,16 @@ function buildCombo(records: readonly WebPluginRecord[], revision?: string): Com
  : comboSectionMap(record)
  sections.push({ offset: { line, column: 0 }, map: section })
  const bundle = ${prepared.source};\n

• source += bundle

• chunks.push(Buffer.from(bundle))
  line += newlineCount(bundle)
  }
  const sourceMap = Buffer.from(${JSON.stringify({ version: 3, file: 'client.js', sections })}\n)

• const sourceBytes = Buffer.from(source)

• const sourceBytes = Buffer.concat(chunks)
  const rev = revision ?? framedHash('combo', [sourceBytes, sourceMap])
  const entries = records.map(record => record.entry.id)
  const url = comboUrl(entries, rev)
  const sourceMapUrl = comboUrl(entries, rev, true)

• return { url, rev, entries, script: comboScript(source, sourceMapUrl), sourceMap, sourceMapUrl }

• return { url, rev, entries, script: comboScript(sourceBytes, sourceMapUrl), sourceMap, sourceMapUrl }
  }

/** Add initial-load scheduling metadata to a combo artifact. */
@@ -515,6 +521,16 @@ window.ModuleLoader={

• already-loaded entries aggregates into one loud throw (FAILED fiber; the
• boot activation audit reports it).
  /
  +/*

• • One servable /plugins response. A batch combo is materialized during
• • composition because its revision is derived from its own bytes; a per-record
• • artifact is deferred until its URL is requested, so a recomposition does not
• • rebuild every bundle a browser never asks for.
• */
  +type BundleResponse =
• | { body: Buffer; contentType: string }
• | { build: () => Buffer; contentType: string }

export class ClientModuleRegistry extends Service {
static inject = ['loader']

@@ -528,10 +544,12 @@ export class ClientModuleRegistry extends Service {
private readonly dirty = new Set()
private readonly initialRevisionNonce = randomBytes(8).toString('hex')
private nextInitialRevision = 0

• private responses = new Map<string, { body: Buffer; contentType: string }>()
• private batchResponses = new Map<string, { body: Buffer; contentType: string }>()

• private responses = new Map<string, BundleResponse>()
• private batchResponses = new Map<string, BundleResponse>()
  /** One prior graph generation covers a request racing the HMR recomposition that replaced its URL. */

• private previousBatchResponses = new Map<string, { body: Buffer; contentType: string }>()

• private previousBatchResponses = new Map<string, BundleResponse>()
• /** Per-record artifacts materialized on demand, keyed by entry id and revision. */
• private readonly recordArtifacts = new Map<string, ComboArtifact>()
  private flushQueued = false
  private composed: WebBootGraph

@@ -550,7 +568,9 @@ export class ClientModuleRegistry extends Service {
this.dirty.add(entryName)
if (this.flushQueued) return
this.flushQueued = true

•  queueMicrotask(() => {
  

•  // A macrotask, not a microtask: the activation burst delivers one
  

•  // dirty event per plugin, and each recomposition rebuilds every combo.
  

•  setImmediate(() => {
     this.flushQueued = false
     this.flush((err) => { ctx.logger.warn(err) })
   })
  

@@ -560,12 +580,14 @@ export class ClientModuleRegistry extends Service {
// current entries, flushed synchronously (nothing async between subscribe,
// seed, and flush).
for (const entry of ctx.loader.entries()) this.dirty.add(entry.options.name)

• this.composed = this.compose()
  const failures: Error[] = []
• this.flush(err => failures.push(err))

• // Validation stays synchronous (a broken package must still fail

• // activation); composition runs once, over the whole seeded set.

• this.flush(err => failures.push(err), true)
  if (failures.length > 0) {
  throw new ClientPackageCompositionError(failures)
  }

• this.composed = this.compose()

  const registerWebCarrier = (webCtx: Context): void => {
  webCtx.effect(
  @@ -709,15 +731,16 @@ export class ClientModuleRegistry extends Service {
  contentType: 'application/json; charset=utf-8',
  })
  }

• const responses = new Map(batchResponses)

• const responses = new Map<string, BundleResponse>(batchResponses)
  for (const record of this.table.values()) {

•  const artifact = buildCombo([record], record.entry.rev)
  

•  responses.set(artifact.url, {
  

•    body: artifact.script,
  

•  // Deferred: a browser fetches a per-record URL only to reload one bundle,
  

•  // while every recomposition would otherwise rebuild all of them.
  

•  responses.set(comboUrl([record.entry.id], record.entry.rev), {
  

•    build: () => this.recordArtifact(record, 'script'),
     contentType: 'text/javascript; charset=utf-8',
   })
  

•  responses.set(artifact.sourceMapUrl, {
  

•    body: artifact.sourceMap,
  

•  responses.set(comboUrl([record.entry.id], record.entry.rev, true), {
  

•    build: () => this.recordArtifact(record, 'map'),
     contentType: 'application/json; charset=utf-8',
   })
  

  }
  @@ -976,7 +999,12 @@ export class ClientModuleRegistry extends Service {
  return true
  }

• private flush(onError: (err: Error) => void): void {

• /**
• • @PARAM onError - sink for per-entry and composition failures.
• • @PARAM validateOnly - scan the dirty set without recomposing; the
• • activation pass composes once after every seeded entry is processed.
• */
• private flush(onError: (err: Error) => void, validateOnly = false): void {
  let changed = false
  for (const entryName of [...this.dirty]) {
  this.dirty.delete(entryName)
  @@ -988,7 +1016,7 @@ export class ClientModuleRegistry extends Service {
  onError(error instanceof Error ? error : new Error(String(error)))
  }
  }

• if (!changed) return

• if (!changed || validateOnly) return
  let composed: WebBootGraph
  try {
  composed = this.compose()
  @@ -1004,6 +1032,22 @@ export class ClientModuleRegistry extends Service {
  this.notifyGraphChanged()
  }

• /**

• • Materialize one per-record artifact on first request.
• • @PARAM record - the record whose bundle is served.
• • @PARAM which - the executable script or its source map.
• • @returns the artifact bytes, built once per entry revision.

• */

• private recordArtifact(record: WebPluginRecord, which: 'script' | 'map'): Buffer {

• const key = ${record.entry.id}\u0000${record.entry.rev}

• let artifact = this.recordArtifacts.get(key)

• if (artifact === undefined) {

•  artifact = buildCombo([record], record.entry.rev)
  

•  this.recordArtifacts.set(key, artifact)
  

• }

• return which === 'map' ? artifact.sourceMap : artifact.script

• }

• private bundleResource(method: string | undefined, url: string): {
  status: number
  headers?: Record<string, string>
  @@ -1014,10 +1058,11 @@ export class ClientModuleRegistry extends Service {
  const resourceUrl = ${requestUrl.pathname}${requestUrl.search}
  const response = this.responses.get(resourceUrl) ?? this.previousBatchResponses.get(resourceUrl)
  if (response !== undefined) {

•  const body = 'body' in response ? response.body : response.build()
   return {
     status: 200,
     headers: { 'content-type': response.contentType, 'cache-control': IMMUTABLE_CACHE },
  

•    ...(method === 'HEAD' ? {} : { body: response.body }),
  

•    ...(method === 'HEAD' ? {} : { body }),
   }
  

  }
  // Anything else under /plugins (including unadvertised combinations and
  diff --git a/packages/client/modules/src/invariant.ts b/packages/client/modules/src/invariant.ts
  index 00e4e71..aac2072 100644
  --- a/packages/client/modules/src/invariant.ts
  +++ b/packages/client/modules/src/invariant.ts
  @@ -21,7 +21,7 @@ export const inject = ['invariants']
  • that just received the graph). Checked on every scan trigger (cordis
  • 'internal/plugin'): graph() and clientPath() read the same table object,
  • so the relation holds at any instant — no need to wait out the node half's

• • own microtask-debounced flush.

• • own coalesced flush.
    */
    const install: InvariantInstaller = (ctx, fail) => {
    ctx.on('internal/plugin', () => {
    diff --git a/packages/client/modules/tests/node-half.client.spec.ts b/packages/client/modules/tests/node-half.client.spec.ts
    index 4f06360..82fccea 100644
    --- a/packages/client/modules/tests/node-half.client.spec.ts
    +++ b/packages/client/modules/tests/node-half.client.spec.ts
    @@ -378,7 +378,7 @@ describe('client bundle activation', () => {

    entries.push(alias)
    emitLoaderEntryChange(context, alias)

• await Promise.resolve()

• await new Promise(resolve => setImmediate(resolve))
  expect(warning).toHaveBeenCalledWith(expect.objectContaining({
  message: expect.stringContaining(package ${packageName} resolves from multiple active Loader sources) as string,
  }))
  @@ -386,12 +386,34 @@ describe('client bundle activation', () => {

  entries.splice(entries.indexOf(packageName), 1)
  emitLoaderEntryChange(context, packageName)

• await Promise.resolve()

• await new Promise(resolve => setImmediate(resolve))
  expect(service.graph().entries.map(entry => entry.id)).toEqual([packageName])
  expect(service.graph().entries[0]!.rev).not.toBe(firstRevision)
  expect(service.clientPath(packageName)).toBe(clientPath)
  })

• it('coalesces a burst of activation events into one recomposition', async () => {

• const packageNames = ['@fixture/burst-a', '@fixture/burst-b', '@fixture/burst-c']

• for (const packageName of packageNames) writeBuiltPackage(packageName, {})

• // The generator closes over the array, so the burst arrives after construction.

• const entries: string[] = []

• const { context, service } = constructWithRoute(entries)

• const notifications: string[][] = []

• service.onGraphChanged(() => {

•  notifications.push(service.graph().entries.map(entry => entry.id).sort())
  

• })

• // One emission per arriving plugin: the activation pattern this coalescing

• // exists for. Every arrival recomposes before the change, one flush does.

• for (const packageName of packageNames) {

•  entries.push(packageName)
  

•  emitLoaderEntryChange(context, packageName)
  

• }

• await new Promise(resolve => setImmediate(resolve))

• expect(notifications).toEqual([[...packageNames].sort()])

• })

• it('uses owning-tree package resolution for an import-only Worker module loader', () => {
  const packageName = '@fixture/worker-loader'
  writeBuiltPackage(packageName, {})

```

[Start-Gao]

根因已定位并单独发帖：#6391
与你这里的「一次启动重复 8 次全量重建」结论一致，补充两点：

引入提交：19444907「feat: electron 打包」(2026-08-28) 把 ClientModuleRegistry 的 static inject 从 ['webServer','loader'] 改成 ['loader']。旧写法事实上是一道「等 webServer 就绪（≈激活波次结束）才构造」的延迟闸门，所以只 compose 一次；首次进入发布的版本是 0.1.5-alpha.1。
单文件隔离佐证：在 0.1.5-rc.1 上只把 dsh-client-modules/lib/index.js 换回 0.1.2-rc.1（客户端图不变，12.6MB），启动 17.3s → 4.28s，compose 8 次 → 1 次。

另外 #6081 提出的「给 Web bundle 的 modules 行补回 webServer 激活边」很可能同时修掉这个启动耗时（恢复延迟构造），值得一起评估。

边界补充（#6391 讨论后加）： 上面提到的 #6081 那条激活边只在 Web 组合内成立 —— 桌面宿主没有 webServer 服务（apps/desktop-host/src/index.ts:302-306,经 clientModules.fetchBundle 供包）,把它上提到包里会让桌面端注册表永不构造。所以它能修掉 Web 侧的启动耗时,但不能当作根修;根修是让初始扫描等激活稳定 + 显式定义未就绪窗口语义（见 #6391）。