{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"glfzr-dsh-opencode-go-quota","slug":"glfzr-dsh-opencode-go-quota","rank":396,"url":"https://github.com/GLFzr/dsh-opencode-go-quota","name":"GLFzr/dsh-opencode-go-quota","category":"usage","description":{"zh":"模型选择器左侧的 OpenCode Go 额度圆环：点击循环切换 5 小时/每周/每月用量窗口，按紧急程度着色（绿/蓝/橙/红），悬停显示百分比与重置倒计时。","en":"OpenCode Go quota ring: click-to-cycle progress ring (5h/weekly/monthly) left of the model selector, colored by urgency, with reset countdowns on hover."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"GLFzr","repo":"dsh-opencode-go-quota","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:GLFzr/dsh-opencode-go-quota","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/GLFzr/dsh-opencode-go-quota/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"glfzr-dsh-opencode-go-quota","slug":"glfzr-dsh-opencode-go-quota","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:24:30.352Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","commitDate":"2026-08-16T19:50:32+08:00","artifactDigest":"sha256:f7c0031efdcdabec488555250851a9b87de4cd74c71cc613278e6800e390ceb6","downloadUrl":"https://github.com/GLFzr/dsh-opencode-go-quota/archive/38ddb2a81166a6a08287896f601a3fa9915b1f6a.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:GLFzr/dsh-opencode-go-quota","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-opencode-go-quota","packageVersion":"0.3.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-opencode-go-quota","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"ocg-quota","name":"dsh-opencode-go-quota","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network"],"outboundHosts":[{"host":"opencode.ai","count":2}],"findings":[{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":31,"evidence":"credential access at line 31 + outbound network at line 49","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"52720c3a580c616d52118e0c","review":{"verdict":"functional","reason":"key仅从env或本地auth.json中opencode-go条目读取，并通过node子进程fetch发往其官方用量接口https://opencode.ai/zen/go/v1/usage，正是同一服务商用于查询自身额度，属于插件核心功能。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:24:55.835Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":0,"high":0,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":10,"bytesScanned":55595,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":3,"markdown":2,"cordis":1,"source":3,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:24:30.352Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:24:30.352Z","commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:24:55.835Z","commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:53:37.279Z","commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:24:30.352Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:24:55.835Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"38ddb2a81166a6a08287896f601a3fa9915b1f6a","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:53:37.279Z"}]}