dshbase
EN

插件目录 / Developer / dsh-xray

dsh-xray

已验证 · 实测可装 alloevil

✓ 持续维护 3 位贡献者 基于 1 个官方 DSH 包

查看 GitHub ↗ ← 返回插件目录

2Stars
0Forks
0未关闭 issue
JavaScript语言
2026-08-21最近推送
跨平台平台

功能简介

给 Harness 组合树拍 X 光：把 dump-config 的每一行归因到引入它的层（bundle / profile patch / home patch / repository 源），diff 抓出被 dsh 静默跳过的 orphan patch 行和装了没生效的插件，deps 给出服务依赖图与停用级联，cost 估算 prompt sections + tool schemas 的 token 占用；另有 /xray Web 面板和 xray_composition agent 自省工具。静态命令在 dsh 起不来时也能跑；只读设计。

✅
我们的评价
可用 — 实测通过，早期项目

给 Harness 组合树拍 X 光：把 dump-config 的每一行归因到引入它的层（bundle / profile patch / home patch / repository 源），diff 抓出被 dsh 静默跳过的 orphan patch 行和装了没生效的插件，deps 给出服务依赖图与停用级联，cost 估算 prompt sections + tool schemas 的 token 占用；另有 /xray Web 面板和 xray_composition agent 自省工具。静态命令在 dsh 起不来时也能跑；只读设计。 实测能干净安装、正常启动。早期项目，但功能可用。

「已验证」表示我们的自动化 CI 在干净 profile 里实际执行了 dsh plugin add 并启动成功——仅此而已。功能描述与版本兼容性均为作者声明。这不是安全审计，也不代表对第三方代码的背书。

README

dsh-xray — X-ray for your DeepSeek Harness

npm CI license OpenSSF Scorecard coverage JavaScript

X-ray for your DeepSeek Harness — see what's actually loaded, why, and what it costs you.

🇨🇳 中文文档

dsh-xray demo

The Problem

dsh --dump-config shows you the composed tree. The plugin panel shows you a flat list. Neither tells you why a plugin is there, what breaks if you disable it, or what it silently costs you.

dsh-xray does.

Static commands work even when dsh cannot boot; deps/health/cost/shadow and the agent tool need the plugin mounted.

CLI Commands 

npx dsh-xray attribute   # which layer introduced each row, and who patched it since
npx dsh-xray conflicts   # rows whose fields have multiple writers, and who wins
npx dsh-xray diff        # declared (static layers) vs actual (dump-config) tree
npx dsh-xray snapshot    # content-addressed lockfile of the effective composition
npx dsh-xray deps [svc]  # service dependency graph: providers, consumers, disable-cascade
npx dsh-xray health      # plugin lifecycle health: failed fibers, pending injects, transitions
npx dsh-xray cost        # context cost: prompt sections + tool schemas, estimated tokens
npx dsh-xray shadow      # services provided by multiple plugins
npx dsh-xray audit       # static scan of out-of-tree plugins for sensitive touchpoints

Features

🔍 Layer Attribution

Which layer introduced each active plugin: kernel bundle, profile dependency, cordis.patch.yml insert, or repository source.

📊 Declared vs. Actual Diff

Installed-but-inactive, uninstalled-but-lingering patch rows — all surfaced.

⚡ Conflict Detection

Plugins patching the same config row, and which one silently wins.

📸 Composition Snapshot

Export the effective composition as a lockfile; reproduce it elsewhere.

🌐 Service Dependency Graph

Who provides and consumes each service; what cascades if you disable X.

💊 Runtime Health

Per-plugin fiber lifecycle state, startup failures, transition history.

🤖 Agent Self-Introspection

The xray_composition tool lets agents inspect their own capability set.

🖥️ Web Panel

Mounted in dsh web, the plugin serves a zero-dependency panel at /xray — summary, health, deps (with the disable-cascade table), cost, and shadow views, live from the running composition. JSON endpoints under /xray/api/* serve the same data.

The /xray panel: deps view with the disable-cascade table

What every request actually carries — prompt sections observed at assembly, blended with tool schemas:

$ npx dsh-xray cost
~1625 tokens: 1 tool schema(s) ~121 + 19 prompt section(s) ~1504

# prompt sections (observed at last assembly):
app:web-surface                  ~248     15.3%   ████████
tool:goal                        ~184     11.3%   ██████
tool:ralph                       ~109     6.7%    ███
harness:source                   ~94      5.8%    ███
...

And when a patch row targets an id that doesn't exist (dsh skips it silently), diff catches it:

🛡️ Capability Audit

Heuristic static scan: network egress, shell, filesystem, env, eval.

Agent Tool

Mounted in the tree, dsh-xray registers an xray_composition tool (view: summary | deps | health | cost | shadow), so an agent can answer:

"What capabilities do I have?" / "What plugin provides X?" / "Why is Y unavailable?"

— about itself.

Safety Stance

dsh-xray reads; it never runs.

  • Loader !!js expressions in patch files are parsed as opaque markers and never evaluated
  • The CLI never executes plugin code (audit is a pattern scan over source text)
  • The mounted plugin writes only under $DSH_HOME/xray/
  • See SECURITY.md

Install 

dsh plugin --profile web add dsh-xray

All commands take --profile <name> (default web) and --json.

Command Behavior
diff Exits 1 when the trees disagree
health Exits 1 when any plugin is unhealthy
attribute, conflicts, snapshot Fully static — work even when dsh cannot start
deps, health Read runtime snapshot at $DSH_HOME/xray/runtime.json

Capabilities

Diagnostic imaging for a running composition — complementary to dsh-doctor (rescue & recovery).

Feature Category
Layer attribution 🔍 Inspection
Declared vs. actual diff 🔍 Inspection
Conflict detection 🔍 Inspection
Composition snapshot 📦 Export
Service dependency graph 🌐 Runtime
Runtime health 🌐 Runtime
Agent self-introspection 🤖 AI
Capability audit 🛡️ Security
Service shadowing 🌐 Runtime
Context cost 💰 Optimization

License

MIT

安装

🧩 让 Agent 自动装（推荐）

装一次目录插件，之后本站所有插件都能让 DeepSeek Harness 自动找、自动装：

dsh plugin add dshbase-catalog

然后对 agent 说「帮我装 dsh-xray」，它会在目录里找到并自动安装。文档：dshbase-catalog · 已验证场景包。

Web profile：

dsh plugin --profile web add dsh-xray

Headless（CLI）profile：

dsh plugin --profile headless add dsh-xray

包信息

npm：dsh-xray · 版本 0.6.0 · 实测环境 dsh 0.1.0-rc.6

实测报告

端到端验证通过：dsh 0.1.0-rc.6 上 L1 安装 + L2 加载 + L3 运行问答。

安全：尚未扫描——我们的每日静态扫描将很快覆盖它。

分享徽章

Developer 里更多

petdex

✅ 已验证 · ★3941

dsh-anchored-standard

✅ 已验证 · ★3692

modlens

✅ 已验证 · ★3436

EchoBird

✅ 已验证 · ★3100

brooks-lint

✅ 已验证 · ★1397

awesome-dsh-plugins

✅ 已验证 · ★1290

浏览全部 1887 个插件 →