dsh-xray 0.3.1 → 0.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +43 -0
  2. package/README.zh.md +43 -0
  3. package/package.json +11 -3
package/README.md CHANGED
@@ -28,6 +28,49 @@ npx dsh-xray audit # static scan of out-of-tree plugins for sensitive touc
28
28
 
29
29
  All commands take `--profile <name>` (default `web`) and `--json`. `diff` exits `1` when the trees disagree; `health` exits `1` when any plugin is unhealthy. `attribute`, `conflicts`, and `snapshot` are fully static: they work even when dsh cannot start. `deps` and `health` read the runtime snapshot the mounted plugin maintains at `$DSH_HOME/xray/runtime.json`.
30
30
 
31
+ ## What it looks like
32
+
33
+ Every row of the booted tree, attributed to the layer that introduced it — and who patched it since:
34
+
35
+ ```console
36
+ $ npx dsh-xray attribute
37
+ # 130 rows in profile "web"
38
+
39
+ timer @deepseek-ai/dsh-base
40
+ hmr @deepseek-ai/dsh-base ← patched by @deepseek-ai/dsh-web-app [disabled]
41
+ llm @deepseek-ai/dsh-base
42
+ session-query-sqlite @deepseek-ai/dsh-base ← patched by @deepseek-ai/dsh-web-app
43
+ ...
44
+ ```
45
+
46
+ What breaks if you disable a provider — computed from the live service store, not guesses:
47
+
48
+ ```console
49
+ $ npx dsh-xray deps
50
+ # disable-cascade (transitive consumers of each provider):
51
+ Loader → 5 plugin(s): AgentPresets, ClientModuleRegistry, Hmr, Include, PluginInventoryGateway
52
+ TimerService → 1 plugin(s): Hmr
53
+ SessionProjectionRegistry → 1 plugin(s): SessionProjectionCache
54
+ ```
55
+
56
+ Which fields have multiple writers, and who silently wins:
57
+
58
+ ```console
59
+ $ npx dsh-xray conflicts
60
+ session-query-sqlite
61
+ .config: @deepseek-ai/dsh-base → @deepseek-ai/dsh-web-app (winner: @deepseek-ai/dsh-web-app)
62
+ tool-bash
63
+ .disabled: @deepseek-ai/dsh-base → @deepseek-ai/dsh-web-app (winner: @deepseek-ai/dsh-web-app)
64
+ ```
65
+
66
+ And when a patch row targets an id that doesn't exist (dsh skips it silently), `diff` catches it:
67
+
68
+ ```console
69
+ $ npx dsh-xray diff
70
+ orphan overrides (silently skipped) (1)
71
+ no-such-row in ~/.dsh/profiles/web/cordis.patch.yml
72
+ ```
73
+
31
74
  ## Agent tool
32
75
 
33
76
  Mounted in the tree, dsh-xray registers an `xray_composition` tool (`view: summary | deps | health | cost | shadow`), so an agent can answer "what capabilities do I have / what plugin provides X / why is Y unavailable" about itself.
package/README.zh.md CHANGED
@@ -28,6 +28,49 @@ npx dsh-xray audit # 对 out-of-tree 插件做敏感触点静态扫描
28
28
 
29
29
  所有命令支持 `--profile <name>`(默认 `web`)和 `--json`。`diff` 在两棵树不一致时退出码 `1`;`health` 在有插件不健康时退出码 `1`。`attribute`、`conflicts`、`snapshot` 是纯静态的:dsh 起不来时照样能跑。`deps` 和 `health` 读取已挂载插件维护在 `$DSH_HOME/xray/runtime.json` 的运行时快照。
30
30
 
31
+ ## 长什么样
32
+
33
+ 启动树的每一行,归因到引入它的层——以及之后谁 patch 过它:
34
+
35
+ ```console
36
+ $ npx dsh-xray attribute
37
+ # 130 rows in profile "web"
38
+
39
+ timer @deepseek-ai/dsh-base
40
+ hmr @deepseek-ai/dsh-base ← patched by @deepseek-ai/dsh-web-app [disabled]
41
+ llm @deepseek-ai/dsh-base
42
+ session-query-sqlite @deepseek-ai/dsh-base ← patched by @deepseek-ai/dsh-web-app
43
+ ...
44
+ ```
45
+
46
+ 停用一个 provider 会连带瘫掉什么——从真实服务存储算出来,不是猜的:
47
+
48
+ ```console
49
+ $ npx dsh-xray deps
50
+ # disable-cascade (transitive consumers of each provider):
51
+ Loader → 5 plugin(s): AgentPresets, ClientModuleRegistry, Hmr, Include, PluginInventoryGateway
52
+ TimerService → 1 plugin(s): Hmr
53
+ SessionProjectionRegistry → 1 plugin(s): SessionProjectionCache
54
+ ```
55
+
56
+ 哪些字段有多个写者、谁静默赢了:
57
+
58
+ ```console
59
+ $ npx dsh-xray conflicts
60
+ session-query-sqlite
61
+ .config: @deepseek-ai/dsh-base → @deepseek-ai/dsh-web-app (winner: @deepseek-ai/dsh-web-app)
62
+ tool-bash
63
+ .disabled: @deepseek-ai/dsh-base → @deepseek-ai/dsh-web-app (winner: @deepseek-ai/dsh-web-app)
64
+ ```
65
+
66
+ patch 行指向不存在的 id 时(dsh 静默跳过),`diff` 能抓到:
67
+
68
+ ```console
69
+ $ npx dsh-xray diff
70
+ orphan overrides (silently skipped) (1)
71
+ no-such-row in ~/.dsh/profiles/web/cordis.patch.yml
72
+ ```
73
+
31
74
  ## Agent 工具
32
75
 
33
76
  挂载进树后,dsh-xray 注册 `xray_composition` 工具(`view: summary | deps | health | cost | shadow`),agent 可以自答"我有哪些能力 / 哪个插件提供 X / 为什么 Y 不可用"。
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-xray",
3
- "version": "0.3.1",
3
+ "version": "0.3.2",
4
4
  "description": "X-ray for your DeepSeek Harness — see what's actually loaded, why, and what it costs you.",
5
5
  "repository": {
6
6
  "type": "git",
@@ -32,7 +32,8 @@
32
32
  "test": "node --test tests/*.spec.js",
33
33
  "lint": "biome check .",
34
34
  "format": "biome check --write .",
35
- "check": "biome check . && node --test tests/*.spec.js"
35
+ "check": "biome check . && node --test tests/*.spec.js",
36
+ "coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 tests/*.spec.js"
36
37
  },
37
38
  "keywords": [
38
39
  "dsh-plugin",
@@ -41,7 +42,14 @@
41
42
  "cordis",
42
43
  "diagnostics",
43
44
  "introspection",
44
- "plugin-tree"
45
+ "plugin-tree",
46
+ "dependency-graph",
47
+ "observability",
48
+ "audit",
49
+ "security-scan",
50
+ "token-cost",
51
+ "lockfile",
52
+ "troubleshooting"
45
53
  ],
46
54
  "dsh": {
47
55
  "bundle": {