request-frame-preview

Readme

# request-frame-preview

Preview and download the **exact request frame** that DeepSeek Harness sends to
the model for a session: the full system prompt, the tool declarations
(`tools`), and the wire message array (system → user / assistant /
tool-result in order), rebuilt from the session log.

A small DSH plugin with a host half (one read-only HTTP endpoint) and a browser
half (a "请求预览 / Request preview" button in the session header).

## Install

```sh
dsh plugin --profile web add request-frame-preview
```

or from a local checkout:

```sh
dsh plugin --profile web add /path/to/request-frame-preview
```

Restart `dsh web` (or let the plugin market restart it) so the bundle is
loaded. A **请求预览** button then appears in the session header utilities,
next to the built-in "Session log" button.

## What it does

Click the button to open an overlay showing, top to bottom:

1. **① system prompt** — message `#0` of the wire array (collapsed by default).
2. **② tools** — the tool declarations carried by the request, one
   `tool` row each; click a row to see its parameters.
3. **③ messages** — the wire message array from `#1` on, with `user`,
   `assistant`, `tool-result` chips, `tool_call_id`s, reasoning content and
   `tool_calls` expanded inline.

**下载 JSON / Download JSON** saves the whole frame (config + system + tools
with full parameter schemas + messages) as `dsh-request-<sessionId>.json`.

## How the data is produced

- Live session first: `requestHeader()` and `deriveMessages()` — the very same
  folds the agent loop reads when it builds each request.
- Cold session fallback: `sessionQuery.readSession` + `readSurface` from the
  durable log.
- Wire expansion mirrors the DeepSeek chat-completions adapter's text path:
  the system prompt becomes message `#0`; each `tool-result` block becomes its
  own `role: "tool"` message; assistant text, reasoning and `tool_calls` are
  split into their wire fields.

## Layout

```
package.json        dsh.bundle.patch -> ./cordis.patch.yml; dsh.client.platform web
cordis.patch.yml    inserts the plugin row into the profile layer stack
lib/index.js        host half: registers GET /request-frame-preview/api
lib/client.js       browser half (window.__ModuleLoader__ bundle)
```

## Security notes

- The endpoint is read-only (`GET`/`HEAD`) and serves no state mutation.
- Cross-origin requests are rejected when an `Origin` header is present and
  does not match `Host`; requests without `Origin` (curl, `<a download>`)
  are allowed, mirroring `dshmarket`'s GET route convention.
- This is a debugging aid: it exposes the session's full system prompt, tool
  schemas and message contents to anyone who can reach the endpoint. The host
  endpoint is not a security boundary.