dsh-xray 0.0.1

package/README.md

@@ -0,0 +1,33 @@
+# dsh-xray
+
+X-ray for your [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — see what's actually loaded, why, and what it costs you.
+
+[中文](./README.zh.md)
+
+> **Status: name reservation (0.0.1).** This version mounts as a no-op plugin. Features land starting at 0.1.0.
+
+`dsh --dump-config` shows you the composed tree. The plugin panel shows you a flat list. Neither tells you *why* a plugin is there, *what breaks* if you disable it, or *what it silently costs you*. dsh-xray does.
+
+## Planned capabilities
+
+Diagnostic imaging for a running composition — complementary to [dsh-doctor](https://www.npmjs.com/package/dsh-doctor) (rescue & recovery):
+
+- **Layer attribution** — which layer introduced each active plugin: kernel bundle, profile dependency, `cordis.patch.yml` insert, or repository source
+- **Declared vs. actual diff** — installed-but-inactive, uninstalled-but-lingering patch rows
+- **Service dependency graph** — who `inject`s whose service; what cascades if you disable X
+- **Runtime health** — per-plugin scope state: activation failures, stacks, load time, HMR reloads
+- **Capability audit** — what installed plugins actually touch: network egress, shell, filesystem, env; permission diff across updates
+- **Conflict detection** — plugins patching the same config row or registering the same command/tool, and which one silently wins
+- **Context cost** — tokens each plugin injects into agent context: tool schemas, prompt sections, skills
+- **Composition snapshot** — export the effective composition as a lockfile; reproduce it elsewhere
+- **Agent self-introspection** — expose the composition as a tool so agents know what capabilities they have
+
+## Install
+
+```sh
+dsh plugin --profile web add dsh-xray
+```
+
+## License
+
+MIT

package/README.zh.md

@@ -0,0 +1,33 @@
+# dsh-xray
+
+给 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 拍 X 光——看清到底加载了什么、为什么在那、以及它悄悄花掉了你什么。
+
+[English](./README.md)
+
+> **状态:占名版(0.0.1)。** 此版本以 no-op 插件形式挂载,功能从 0.1.0 开始落地。
+
+`dsh --dump-config` 只给你原始组合树,插件面板只给你平铺列表。它们都不回答:这个插件*为什么*在这、停用它会*连带瘫掉什么*、它在*悄悄消耗什么*。dsh-xray 回答这些。
+
+## 规划中的能力
+
+对运行中组合树的诊断成像——与 [dsh-doctor](https://www.npmjs.com/package/dsh-doctor)(救援与恢复)互补:
+
+- **来源归因** — 每个活跃插件来自哪一层:内核 bundle / profile 依赖 / `cordis.patch.yml` insert / repository 源
+- **声明 vs 实际 diff** — 装了但没生效、卸了但残留 patch 行
+- **服务依赖图** — 谁 `inject` 了谁的服务;停用 X 会级联影响什么
+- **运行时健康** — 每个插件的 scope 状态:激活失败与堆栈、加载耗时、HMR 重载次数
+- **能力审计** — 已装插件实际触碰什么:网络外发、shell、文件系统、环境变量;更新前后权限 diff
+- **冲突检测** — 多个插件 patch 同一配置行、注册同名命令/工具时,谁静默赢了
+- **上下文成本** — 每个插件往 agent 上下文注入多少 token:工具 schema、prompt 片段、skill 文档
+- **组合快照** — 把当前生效组合导出为 lockfile,异地一键复现
+- **Agent 自省** — 把组合信息暴露为 tool,让 agent 知道自己有哪些能力
+
+## 安装
+
+```sh
+dsh plugin --profile web add dsh-xray
+```
+
+## 许可证
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# dsh-xray bundle patch: mounts the xray plugin into the composed tree.
+- insert:
+    id: dsh-xray
+    name: dsh-xray
+    config: {}

package/lib/index.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const name = 'dsh-xray';
+
+/**
+ * dsh-xray — X-ray for your DeepSeek Harness.
+ *
+ * v0.0.1 is a name reservation. It mounts cleanly as a no-op plugin and
+ * logs its presence; introspection features land starting at 0.1.0:
+ * layer attribution, declared-vs-actual diff, service dependency graph,
+ * runtime health, capability audit, conflict detection, context cost.
+ */
+function apply(ctx) {
+  ctx.logger(name).info('dsh-xray 0.0.1 mounted (name reservation; features land in 0.1.0)');
+}
+
+module.exports = { name, apply };
+module.exports.default = module.exports;

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "dsh-xray",
+  "version": "0.0.1",
+  "description": "X-ray for your DeepSeek Harness — see what's actually loaded, why, and what it costs you.",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md"
+  ],
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "dsh",
+    "cordis",
+    "diagnostics",
+    "introspection",
+    "plugin-tree"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}