dsh-xray 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -0
- package/README.zh.md +8 -0
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# dsh-xray
|
|
2
2
|
|
|
3
|
+
[](https://www.npmjs.com/package/dsh-xray)
|
|
4
|
+
[](https://github.com/alloevil/dsh-xray/actions/workflows/check.yml)
|
|
5
|
+
[](./LICENSE)
|
|
6
|
+
|
|
3
7
|
X-ray for your [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) — see what's actually loaded, why, and what it costs you.
|
|
4
8
|
|
|
5
9
|
[中文](./README.zh.md)
|
|
@@ -28,6 +32,10 @@ All commands take `--profile <name>` (default `web`) and `--json`. `diff` exits
|
|
|
28
32
|
|
|
29
33
|
Mounted in the tree, dsh-xray registers an `xray_composition` tool (`view: summary | deps | health | cost | shadow`), so an agent can answer "what capabilities do I have / what plugin provides X / why is Y unavailable" about itself.
|
|
30
34
|
|
|
35
|
+
## Safety stance
|
|
36
|
+
|
|
37
|
+
dsh-xray reads; it never runs. Loader `!!js` expressions in patch files are parsed as opaque markers and never evaluated, the CLI never executes plugin code (`audit` is a pattern scan over source text), and the mounted plugin writes only under `$DSH_HOME/xray/`. See [SECURITY.md](./SECURITY.md).
|
|
38
|
+
|
|
31
39
|
## Capabilities
|
|
32
40
|
|
|
33
41
|
Diagnostic imaging for a running composition — complementary to [dsh-doctor](https://www.npmjs.com/package/dsh-doctor) (rescue & recovery).
|
package/README.zh.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# dsh-xray
|
|
2
2
|
|
|
3
|
+
[](https://www.npmjs.com/package/dsh-xray)
|
|
4
|
+
[](https://github.com/alloevil/dsh-xray/actions/workflows/check.yml)
|
|
5
|
+
[](./LICENSE)
|
|
6
|
+
|
|
3
7
|
给 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 拍 X 光——看清到底加载了什么、为什么在那、以及它悄悄花掉了你什么。
|
|
4
8
|
|
|
5
9
|
[English](./README.md)
|
|
@@ -28,6 +32,10 @@ npx dsh-xray audit # 对 out-of-tree 插件做敏感触点静态扫描
|
|
|
28
32
|
|
|
29
33
|
挂载进树后,dsh-xray 注册 `xray_composition` 工具(`view: summary | deps | health | cost | shadow`),agent 可以自答"我有哪些能力 / 哪个插件提供 X / 为什么 Y 不可用"。
|
|
30
34
|
|
|
35
|
+
## 安全立场
|
|
36
|
+
|
|
37
|
+
dsh-xray 只读不执行。patch 文件里的 loader `!!js` 表达式解析为不透明标记、绝不求值;CLI 从不执行插件代码(`audit` 是对源码文本的模式扫描);挂载的插件只写 `$DSH_HOME/xray/` 目录。详见 [SECURITY.md](./SECURITY.md)。
|
|
38
|
+
|
|
31
39
|
## 能力
|
|
32
40
|
|
|
33
41
|
对运行中组合树的诊断成像——与 [dsh-doctor](https://www.npmjs.com/package/dsh-doctor)(救援与恢复)互补。
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dsh-xray",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.1",
|
|
4
4
|
"description": "X-ray for your DeepSeek Harness — see what's actually loaded, why, and what it costs you.",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -54,6 +54,7 @@
|
|
|
54
54
|
"engines": {
|
|
55
55
|
"node": ">=22"
|
|
56
56
|
},
|
|
57
|
+
"packageManager": "pnpm@10.28.2",
|
|
57
58
|
"publishConfig": {
|
|
58
59
|
"registry": "https://registry.npmjs.org/",
|
|
59
60
|
"access": "public"
|