request-frame-preview

dsh plugin --profile web add request-frame-preview

request-frame-preview

Preview and download the exact request frame that DeepSeek Harness sends to

the model for a session: the full system prompt, the tool declarations

(tools), and the wire message array (system → user / assistant /

tool-result in order), rebuilt from the session log.

A small DSH plugin with a host half (one read-only HTTP endpoint) and a browser

half (a "请求预览 / Request preview" button in the session header).

Install

dsh plugin --profile web add request-frame-preview

or from a local checkout:

dsh plugin --profile web add /path/to/request-frame-preview

Restart dsh web (or let the plugin market restart it) so the bundle is

loaded. A 请求预览 button then appears in the session header utilities,

next to the built-in "Session log" button.

What it does

Click the button to open an overlay showing, top to bottom:

1. ① system prompt — message #0 of the wire array (collapsed by default).

2. ② tools — the tool declarations carried by the request, one

tool row each; click a row to see its parameters.

3. ③ messages — the wire message array from #1 on, with user,

assistant, tool-result chips, tool_call_ids, reasoning content and

tool_calls expanded inline.

下载 JSON / Download JSON saves the whole frame (config + system + tools

with full parameter schemas + messages) as dsh-request-<sessionId>.json.

How the data is produced

• Live session first: requestHeader() and deriveMessages() — the very same

folds the agent loop reads when it builds each request.

• Cold session fallback: sessionQuery.readSession + readSurface from the

durable log.

• Wire expansion mirrors the DeepSeek chat-completions adapter's text path:

the system prompt becomes message #0; each tool-result block becomes its

own role: "tool" message; assistant text, reasoning and tool_calls are

split into their wire fields.

Layout

package.json        dsh.bundle.patch -> ./cordis.patch.yml; dsh.client.platform web
cordis.patch.yml    inserts the plugin row into the profile layer stack
lib/index.js        host half: registers GET /request-frame-preview/api
lib/client.js       browser half (window.__ModuleLoader__ bundle)

Security notes

• The endpoint is read-only (GET/HEAD) and serves no state mutation.
• Cross-origin requests are rejected when an Origin header is present and

does not match Host; requests without Origin (curl, <a download>)

are allowed, mirroring dshmarket's GET route convention.

• This is a debugging aid: it exposes the session's full system prompt, tool

schemas and message contents to anyone who can reach the endpoint. The host

endpoint is not a security boundary.