zampie/request-frame-preview

Preview and download the exact request frame that DeepSeek Harness sends to the model for a session: the full system prompt, the tool declarations (tools), and the wire message array (system → user / assistant / tool-result in order), rebuilt from the session log.

A small DSH plugin with a host half (one read-only HTTP endpoint) and a browser half (a "请求预览 / Request preview" button in the session header).

Install

dsh plugin --profile web add request-frame-preview

or from a local checkout:

dsh plugin --profile web add /path/to/request-frame-preview

Restart dsh web (or let the plugin market restart it) so the bundle is loaded. A 请求预览 button then appears in the session header utilities, next to the built-in "Session log" button.

What it does

Click the button to open an overlay showing, top to bottom:

1. ① system prompt — message #0 of the wire array (collapsed by default).
2. ② tools — the tool declarations carried by the request, one tool row each; click a row to see its parameters.
3. ③ messages — the wire message array from #1 on, with user, assistant, tool-result chips, tool_call_ids, reasoning content and tool_calls expanded inline.

下载 JSON / Download JSON saves the whole frame (config + system + tools with full parameter schemas + messages) as dsh-request-<sessionId>.json.

How the data is produced

• Live session first: requestHeader() and deriveMessages() — the very same folds the agent loop reads when it builds each request.
• Cold session fallback: sessionQuery.readSession + readSurface from the durable log.
• Wire expansion mirrors the DeepSeek chat-completions adapter's text path: the system prompt becomes message #0; each tool-result block becomes its own role: "tool" message; assistant text, reasoning and tool_calls are split into their wire fields.

Layout

package.json        dsh.bundle.patch -> ./cordis.patch.yml; dsh.client.platform web
cordis.patch.yml    inserts the plugin row into the profile layer stack
lib/index.js        host half: registers GET /request-frame-preview/api
lib/client.js       browser half (window.__ModuleLoader__ bundle)

Security notes

• The endpoint is read-only (GET/HEAD) and serves no state mutation.
• Cross-origin requests are rejected when an Origin header is present and does not match Host; requests without Origin (curl, <a download>) are allowed, mirroring dshmarket's GET route convention.
• This is a debugging aid: it exposes the session's full system prompt, tool schemas and message contents to anyone who can reach the endpoint. The host endpoint is not a security boundary.