dsh-xray 0.10.0 → 0.10.2

package/README.md

@@ -18,7 +18,7 @@
 </p>
 
 <p align="center">
-  <a href="./README.zh.md">🇨🇳 中文文档</a>
+  <a href="./docs/README.zh.md">🇨🇳 中文文档</a>
 </p>
 
 ---
@@ -66,6 +66,7 @@ The cost view answers the question no other tool asks: **who put this in my cont
 - **By-plugin rollup** — each plugin's per-request context tax: sections + schemas + tokens + share, ranked.
 - **Entry inspection** — `/xray/api/entry` returns any entry's live text with a chars/tokens ruler. Computed per request, never persisted.
 - **Skill cost** — a dedicated view prices every skill twice: its catalog line (resident on every request once any model-invocable skill exists) and its body (billed per load). Pricing only — toggling belongs to the ecosystem's skill managers.
+- **Per-request ledger** — one classified bill per LLM call: system / tool schemas / history / tool results (aggregated per tool), a **Δprev** growth column, and prefix-stability markers (⚡ system+tools byte-identical to the previous request — KV-cache-friendly; ✂ prefix broken). Compaction and title calls are tagged apart from chat. Only counts, names, and hashes are kept — never message text.
 - **Explained UI** — every view opens with a one-line "what am I looking at"; terms carry plain-language tooltips; the whole tab is localized (English / 中文) through the host locale service.
 
 The same data flows through three surfaces: the **X-Ray tab** (native GUI), the standalone **`/xray` page** (works even when the client-module pipeline it diagnoses is broken), and the **CLI**.
@@ -210,6 +211,7 @@ Diagnostic imaging for a running composition — complementary to [dsh-doctor](h
 | --- | --- |
 | Context-tax attribution & entry inspection | 💰 Optimization |
 | Skill cost (catalog line + body pricing) | 💰 Optimization |
+| Per-request ledger (Δprev, prefix stability) | 💰 Optimization |
 | Layer attribution | 🔍 Inspection |
 | Declared vs. actual diff | 🔍 Inspection |
 | Conflict detection | 🔍 Inspection |

package/{README.zh.md → docs/README.zh.md}

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="./assets/hero.svg" width="100%" alt="dsh-xray — 给你的 DeepSeek Harness 拍 X 光">
+  <img src="../assets/hero.svg" width="100%" alt="dsh-xray — 给你的 DeepSeek Harness 拍 X 光">
 </p>
 
 <p align="center">
@@ -17,14 +17,14 @@
 </p>
 
 <p align="center">
-  <a href="./README.md">English</a>
+  <a href="../README.md">English</a>
 </p>
 
 ---
 
 你挂载的每个插件都在悄悄向每次 LLM 请求收费:prompt sections、工具 schema、token。dsh-xray 以 **与 Chat / Trajectory 并列的 X 光标签页** 长在你运行中的 harness 里,把这份账单逐项摊开——按插件、按条目,直到具体到每一个字:
 
-![X 光标签页:每个插件的每请求上下文税,已归因并排序](./assets/tab-cost.webp)
+![X 光标签页:每个插件的每请求上下文税,已归因并排序](../assets/tab-cost.webp)
 
 展开插件看它注册了什么;点击任何条目,读它注入每次请求的原文:
 
@@ -32,12 +32,12 @@
 <tr>
 <td width="50%">
 
-![插件展开为其注册的条目](./assets/tab-expand.webp)
+![插件展开为其注册的条目](../assets/tab-expand.webp)
 
 </td>
 <td width="50%">
 
-![~184 token 背后的原文,附字符/token 标尺](./assets/tab-entry.webp)
+![~184 token 背后的原文,附字符/token 标尺](../assets/tab-entry.webp)
 
 </td>
 </tr>
@@ -56,7 +56,7 @@
 ---
 
 <p align="center">
-  <img src="./assets/section-context-tax.svg" width="100%" alt="上下文税">
+  <img src="../assets/section-context-tax.svg" width="100%" alt="上下文税">
 </p>
 
 cost 视图回答一个别的工具都不问的问题:**这段上下文是谁放进来的、花掉我多少?**
@@ -65,6 +65,7 @@ cost 视图回答一个别的工具都不问的问题:**这段上下文是谁放
 - **按插件汇总** —— 每个插件的每请求上下文税:sections + schemas + tokens + 占比,排序呈现。
 - **条目原文查看** —— `/xray/api/entry` 返回任意条目的实时文本,附字符/token 标尺。按请求现算,绝不落盘。
 - **skill 成本** —— 专属视图为每个 skill 计两笔价:catalog 行(只要存在模型可调用的 skill 就随每次请求常驻)与正文(每次加载计费)。只计价——启停归生态里的 skill 管理器。
+- **逐请求账单** —— 每次 LLM 调用一张分类账单:system / 工具 schema / 历史 / 工具结果(按工具聚合),**Δprev** 增量列,前缀稳定性标记(⚡ system+工具与上一请求逐字节一致——KV 缓存友好;✂ 前缀击穿)。compaction 与标题生成单独标注。只存计数、名字和 hash——绝不存消息正文。
 - **界面自解释** —— 每个视图开头一句"你在看什么";术语带白话提示;整个标签页通过宿主 locale 服务双语呈现(English / 中文)。
 
 同一份数据流经三个界面:**X 光标签页**(原生 GUI)、独立 **`/xray` 页面**(连它所诊断的 client-module 加载链路挂了都能用)、以及 **CLI**。
@@ -72,7 +73,7 @@ cost 视图回答一个别的工具都不问的问题:**这段上下文是谁放
 ---
 
 <p align="center">
-  <img src="./assets/section-cli.svg" width="100%" alt="CLI 命令">
+  <img src="../assets/section-cli.svg" width="100%" alt="CLI 命令">
 </p>
 
 ```sh
@@ -87,14 +88,14 @@ npx dsh-xray shadow      # 被多个插件同时提供的服务
 npx dsh-xray audit       # 对 out-of-tree 插件做敏感触点静态扫描
 ```
 
-![dsh-xray 演示](./docs/demo.svg)
+![dsh-xray 演示](./demo.svg)
 
 `attribute`、`conflicts`、`snapshot` 是纯静态的——dsh 起不来时照样能跑。所有命令支持 `--profile <name>`(默认 `web`)和 `--json`;`diff` 与 `health` 在漂移/不健康时退出码 `1`,可直接进 CI。
 
 ---
 
 <p align="center">
-  <img src="./assets/section-features.svg" width="100%" alt="能力">
+  <img src="../assets/section-features.svg" width="100%" alt="能力">
 </p>
 
 <table>
@@ -135,7 +136,7 @@ npx dsh-xray audit       # 对 out-of-tree 插件做敏感触点静态扫描
 ---
 
 <p align="center">
-  <img src="./assets/section-agent.svg" width="100%" alt="Agent 工具">
+  <img src="../assets/section-agent.svg" width="100%" alt="Agent 工具">
 </p>
 
 挂载进树后,dsh-xray 注册 `xray_composition` 工具(`view: summary | deps | health | cost | shadow`),agent 可以自答:
@@ -147,7 +148,7 @@ npx dsh-xray audit       # 对 out-of-tree 插件做敏感触点静态扫描
 ---
 
 <p align="center">
-  <img src="./assets/section-safety.svg" width="100%" alt="安全立场">
+  <img src="../assets/section-safety.svg" width="100%" alt="安全立场">
 </p>
 
 **dsh-xray 只读,不执行。**
@@ -156,12 +157,12 @@ npx dsh-xray audit       # 对 out-of-tree 插件做敏感触点静态扫描
 - CLI **从不执行**插件代码(`audit` 是对源码文本的模式扫描)
 - 挂载的插件只写 `$DSH_HOME/xray/` 目录——条目原文实时返回,**绝不落盘**
 - entry 端点只返回组合层文本,**绝不返回会话消息**
-- 详见 [SECURITY.md](./SECURITY.md)
+- 详见 [SECURITY.md](../SECURITY.md)
 
 ---
 
 <p align="center">
-  <img src="./assets/section-install.svg" width="100%" alt="安装">
+  <img src="../assets/section-install.svg" width="100%" alt="安装">
 </p>
 
 两种用法,彼此独立:
@@ -200,7 +201,7 @@ npx dsh-xray health                               # 读取运行时快照
 ---
 
 <p align="center">
-  <img src="./assets/section-capabilities.svg" width="100%" alt="能力总表">
+  <img src="../assets/section-capabilities.svg" width="100%" alt="能力总表">
 </p>
 
 对运行中组合树的诊断成像——与 [dsh-doctor](https://www.npmjs.com/package/dsh-doctor)(救援与恢复)互补。
@@ -209,6 +210,7 @@ npx dsh-xray health                               # 读取运行时快照
 | --- | --- |
 | 上下文税归因 & 条目原文查看 | 💰 优化 |
 | skill 成本(catalog 行 + 正文计价) | 💰 优化 |
+| 逐请求账单(Δprev、前缀稳定性) | 💰 优化 |
 | 层归因 | 🔍 检视 |
 | 声明 vs 实际 diff | 🔍 检视 |
 | 冲突检测 | 🔍 检视 |
@@ -223,4 +225,4 @@ npx dsh-xray health                               # 读取运行时快照
 
 ## 许可
 
-[MIT](./LICENSE)
+[MIT](../LICENSE)

package/lib/client.js

@@ -189,6 +189,10 @@ window.__ModuleLoader__.load({
       'requests.none': 'no requests observed yet — send one agent message first',
       'requests.session': 'session {id} ({n} request(s))',
       'requests.chat': 'chat',
+      'requests.copyId': 'copy call id',
+      'requests.copied': 'copied',
+      'tip.copyId':
+        "Opaque id of this tool's largest result in this request — find the call in the Trajectory tab",
       'entry.loading': 'loading entry…',
       'entry.stats': '{chars} chars · ~{tokens} tokens ({estimator})',
       'entry.close': 'close',
@@ -304,6 +308,9 @@ window.__ModuleLoader__.load({
       'requests.none': '尚未观测到请求——先发送一条 agent 消息',
       'requests.session': '会话 {id}({n} 个请求)',
       'requests.chat': 'chat',
+      'requests.copyId': '复制 call id',
+      'requests.copied': '已复制',
+      'tip.copyId': '该工具在本请求中最大结果的不透明 id——在 Trajectory 标签页中定位那次调用',
       'entry.loading': '正在加载条目…',
       'entry.stats': '{chars} 字符 · 约 {tokens} tokens({estimator})',
       'entry.close': '关闭',
@@ -433,6 +440,56 @@ window.__ModuleLoader__.load({
       return h(Table, { t, headers: ['plugin', 'sections', 'tools', 'tokens', 'share', ''], rows });
     }
 
+    /** Expandable tool-results cell: unfolds top tools with the opaque call
+     * id of each tool's largest result — the manual bridge to Trajectory
+     * until the host exposes a requestInspect write-side. */
+    function ResultsCell({ tokens, rows, t }) {
+      const [open, setOpen] = react.useState(false);
+      const [copied, setCopied] = react.useState(null);
+      if (!rows?.length) return h('span', { className: 'xray-num' }, String(tokens));
+      return h(
+        react.Fragment,
+        null,
+        h(
+          'button',
+          { className: 'xray-entry-link xray-num', onClick: () => setOpen(!open) },
+          `${open ? '▾' : '▸'} ${tokens}`,
+        ),
+        open
+          ? h(
+              'div',
+              { style: { marginTop: 4 } },
+              rows.map((row) =>
+                h(
+                  'div',
+                  { key: row.name, style: { whiteSpace: 'nowrap' } },
+                  h('span', { className: 'xray-muted' }, `${row.name} ~${row.tokens} `),
+                  row.topCallId
+                    ? h(
+                        'button',
+                        {
+                          className: 'xray-entry-link',
+                          title: t('tip.copyId'),
+                          onClick: () => {
+                            try {
+                              navigator.clipboard.writeText(String(row.topCallId));
+                              setCopied(row.name);
+                              setTimeout(() => setCopied(null), 1500);
+                            } catch {
+                              /* clipboard unavailable: the id is still visible */
+                            }
+                          },
+                        },
+                        copied === row.name ? t('requests.copied') : t('requests.copyId'),
+                      )
+                    : null,
+                ),
+              ),
+            )
+          : null,
+      );
+    }
+
     /** Raw-text inspector: fetches one entry's live text on open. Fetched per
      * view, never cached — the text IS the audit artifact. */
     function EntryModal({ target, onClose, t }) {
@@ -775,10 +832,6 @@ window.__ModuleLoader__.load({
                       'delta',
                     ],
                     rows: session.requests.map((r) => {
-                      const top = (r.toolResultRows ?? [])
-                        .slice(0, 3)
-                        .map((row) => `${row.name} ~${row.tokens}`)
-                        .join(', ');
                       return Row(`${session.sessionId}/${r.seq}`, [
                         { cls: 'xray-num', text: String(r.seq) },
                         { cls: 'xray-muted', text: new Date(r.at).toTimeString().slice(0, 8) },
@@ -789,7 +842,7 @@ window.__ModuleLoader__.load({
                         { cls: 'xray-num', text: String(r.system) },
                         { cls: 'xray-num', text: String(r.toolSchemas) },
                         { cls: 'xray-num', text: String(r.history) },
-                        h('span', { className: 'xray-num', title: top }, String(r.toolResults)),
+                        h(ResultsCell, { tokens: r.toolResults, rows: r.toolResultRows, t }),
                         r.prefixStable === null ? '—' : r.prefixStable ? '⚡' : '✂',
                         {
                           cls: 'xray-num',

package/lib/collect/requests.js

@@ -57,7 +57,7 @@ function classify(options) {
   let historyMessages = 0;
   let userMessages = 0;
   let assistantMessages = 0;
-  const toolResults = new Map(); // tool name -> {count, chars}
+  const toolResults = new Map(); // tool name -> {count, chars, topCallId, topChars}
   for (const message of options.messages ?? []) {
     const content = message.content ?? [];
     for (const block of content) {
@@ -68,15 +68,21 @@ function classify(options) {
     const chars = content.reduce((sum, block) => sum + blockChars(block), 0);
     if (isToolResult) {
       let name = 'unknown';
+      let callId = null;
       for (const block of content) {
         if (block?.type === 'tool-result') {
+          callId = block.toolCallId ?? null;
           name = callNames.get(block.toolCallId) ?? 'unknown';
           break;
         }
       }
-      const row = toolResults.get(name) ?? { count: 0, chars: 0 };
+      const row = toolResults.get(name) ?? { count: 0, chars: 0, topCallId: null, topChars: -1 };
       row.count += 1;
       row.chars += chars;
+      if (chars > row.topChars) {
+        row.topChars = chars;
+        row.topCallId = callId;
+      }
       toolResults.set(name, row);
     } else {
       historyChars += chars;
@@ -90,6 +96,9 @@ function classify(options) {
       name,
       count: row.count,
       tokens: estimateTokens(' '.repeat(row.chars)),
+      // Opaque provider call id of this tool's LARGEST result — paste it
+      // into Trajectory to find the culprit call. No text is retained.
+      topCallId: row.topCallId,
     }))
     .sort((a, b) => b.tokens - a.tokens);
   const toolResultTokens = toolResultRows.reduce((sum, r) => sum + r.tokens, 0);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-xray",
-  "version": "0.10.0",
-  "description": "X-ray for your DeepSeek Harness — see what's actually loaded, why, and what it costs you.",
+  "version": "0.10.2",
+  "description": "X-ray for your DeepSeek Harness — diagnostics for what's actually loaded, why, and what it costs: per-plugin context-tax attribution, per-request token ledger, skill catalog pricing, dependency cascades.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alloevil/dsh-xray.git"
@@ -24,7 +24,6 @@
     "bin",
     "cordis.patch.yml",
     "README.md",
-    "README.zh.md",
     "docs",
     "assets"
   ],