{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"ychris12138-dsh-usage-stats","slug":"ychris12138-dsh-usage-stats","rank":62,"url":"https://github.com/Ychris12138/dsh-usage-stats","name":"Ychris12138/dsh-usage-stats","category":"usage","description":{"zh":"多供应商用量看板：按供应商/模型统计 Token 与日期下钻，统一展示账户余额，并追踪 OpenCode Go / Z.ai 订阅额度。","en":"Multi-provider usage dashboard with provider/model token breakdowns, calendar drill-downs, account balances, and OpenCode Go / Z.ai subscription quota tracking."},"stars":102,"starsCheckedAt":"2026-08-21","repository":{"owner":"Ychris12138","repo":"dsh-usage-stats","requestedRef":null,"subpath":""},"npm":"@ychris12138/dsh-usage-stats","downloads":0,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @ychris12138/dsh-usage-stats","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/Ychris12138/dsh-usage-stats/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"ychris12138-dsh-usage-stats","slug":"ychris12138-dsh-usage-stats","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:18.224Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"7c88a445b73f78af7df6082fd671d22a293acb6d","commitDate":"2026-08-22T15:42:47+08:00","artifactDigest":"sha256:fb4e509dd5afc98d63100036d11f69b7a114c4f22bde08ac14abfea1f210caf2","downloadUrl":"https://github.com/Ychris12138/dsh-usage-stats/archive/7c88a445b73f78af7df6082fd671d22a293acb6d.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @ychris12138/dsh-usage-stats","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@ychris12138/dsh-usage-stats","packageVersion":"0.2.10","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-primitives"]},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@ychris12138/dsh-usage-stats","manifestName":"@ychris12138/dsh-usage-stats","nameMatch":true,"npm":{"name":"@ychris12138/dsh-usage-stats","latestVersion":"0.2.9","publishedAt":"2026-08-20T11:57:25.910Z","createdAt":"2026-08-20T03:07:47.385Z","versionCount":4,"maintainers":1,"repository":"git+https://github.com/Ychris12138/dsh-usage-stats.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"usage-stats","name":"@ychris12138/dsh-usage-stats","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[{"host":"api.deepseek.com","count":11},{"host":"ollama.com","count":7},{"host":"api.z.ai","count":6},{"host":"opencode.ai","count":5},{"host":"api.minimax.io","count":5},{"host":"relay.example.com","count":5},{"host":"www.minimax.io","count":4},{"host":"ollama.example.com","count":4},{"host":"openrouter.ai","count":3},{"host":"usage.invalid","count":2},{"host":"api.kimi.com","count":2},{"host":"www.minimaxi.com","count":2},{"host":"api.passionapi.com","count":2},{"host":"late-provider.example.com","count":2},{"host":"api.moonshot.cn","count":2},{"host":"open.bigmodel.cn","count":1},{"host":"api.minimaxi.com","count":1},{"host":"evil.example","count":1},{"host":"usage.other.example","count":1},{"host":"api.ollama.com","count":1}],"findings":[{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"scripts/smoke-client.mjs","pathClass":"source","line":42,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"6b4da6cff782aa572b2a6fd5","review":{"verdict":"placeholder","reason":"该 new Function 调用位于 scripts/smoke-client.mjs，仅在 npm run test:client 时用假 DOM/require 沙箱执行插件自身本地 lib/client.js 做渲染冒烟测试，且该脚本未列入 package.json 的 files 字段，不会随 npm 安装分发或在用户运行时执行。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:19:00.556Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/test-install.mjs","pathClass":"source","line":5,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7ad85f0b0b0b43a94e606c89"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/test-install.mjs","pathClass":"source","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"795d6baf32a16d7a30a419c7"}],"counts":{"critical":0,"high":0,"medium":0,"low":2},"rawCounts":{"critical":0,"high":1,"medium":0,"low":2},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":28,"bytesScanned":400417,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":2,"markdown":3,"data":3,"cordis":1,"source":18,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:20:18.224Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:20:18.224Z","commit":"7c88a445b73f78af7df6082fd671d22a293acb6d","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:00.556Z","commit":"1623c3998f75c53e2125559f712124779ce5cb5d","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:46:52.850Z","commit":"1623c3998f75c53e2125559f712124779ce5cb5d","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"7c88a445b73f78af7df6082fd671d22a293acb6d","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:18.224Z"},{"kind":"verdict-change","from":"caution","to":"pass","commit":"1623c3998f75c53e2125559f712124779ce5cb5d","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:00.556Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"1623c3998f75c53e2125559f712124779ce5cb5d","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:46:52.850Z"}]}