
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
changehow-opencode-token-dashboard
Advanced tools
Local-first token usage dashboard for OpenCode sessions.
| Dependency | Minimum | Notes |
|---|---|---|
| Node.js | 24.x | |
| pnpm | 10+ | |
| glibc | ≥ 2.31 | Debian 11+, Ubuntu 20.04+. Alpine (musl) not supported |
| GCC | ≥ 10 | Required by better-sqlite3 (C++20). No prebuild for older distros |
The BFF reads OpenCode usage from the directory configured in .env.local.
It queries opencode.db via the better-sqlite3 native binding, which compiles against the system toolchain at install time. Older distributions (e.g. Debian 10, Ubuntu 18.04) ship glibc and GCC versions that are too old for this dependency.
Expected files inside that directory:
opencode.dbstorage/message/nvm use
pnpm install
cp .env.example .env.local
Then set:
OPENCODE_DATA_DIR=/absolute/path/to/opencode
For daily use, the recommended way is to build once and let the dashboard run in the background. This gives you a single command to start, a single command to stop, and a predictable upgrade flow.
pnpm build
opendash server
Open the dashboard at:
http://127.0.0.1:8787To listen on all interfaces (e.g. for LAN access):
opendash server --lan
The daemon command prints:
logs/bff.loglogs/bff-error.logpnpm daemon:start
pnpm daemon:stop
pnpm daemon:restart
opendash server --port 9000
opendash server --lan --port 9000
Useful log command:
tail -f logs/bff.log
The opendash CLI can query the running daemon directly, tokscale-style — table output by default, --json for scripting:
opendash summary # totals, streaks, top model (default 7d)
opendash models --range month # per-model spend and volume
opendash daily --range 3mo --limit 14 # recent active days
opendash providers --range all # per-provider totals
opendash models --json > report.json # raw JSON for automation
opendash summary --start 2026-07-01 --end 2026-07-31 # custom window
Common flags: --range 7d|month|3mo|year|all, --start/--end, --json, --url <base> (defaults to the daemon on 127.0.0.1:8787).
If the dashboard is already running as a daemon, use the built-in upgrade script:
pnpm upgrade:app
That flow will:
git pullIf any step fails, the script exits with an error so you can inspect the output before retrying.
If you are actively changing code, run the web app and BFF in separate terminals:
pnpm dev:bff
pnpm dev:web
Default local addresses:
http://127.0.0.1:3000http://localhost:8787To listen on all interfaces, pass --host:
pnpm dev:bff -- --host 0.0.0.0
Both --host and --port are supported by the BFF server and daemon (CLI args take priority over env vars).
Process titles for local debugging:
opencode-telescope-clientopencode-telescope-bffIf the ports are already occupied, the dev scripts will stop before Vite starts and print the current listener PID and process name.
pnpm dev
pnpm dev:bff
pnpm dev:web
pnpm stop:bff
pnpm stop:web
pnpm restart:bff
pnpm restart:web
pnpm daemon:start
pnpm daemon:stop
pnpm daemon:restart
pnpm upgrade:app
pnpm build
pnpm typecheck
pnpm lint
GET /api — machine-readable index of every endpointGET /api/summary?range=7d|month|3mo|year|allGET /api/heatmap?range=…GET /api/trend?range=…GET /api/series?range=…&series=<key>GET /api/dashboard?range=… — consolidated payloadGET /api/providers?range=… / GET /api/provider/:providerIdGET /api/day/:date / GET /api/session/:sessionId…GET /api/sync/remote / POST /api/sync/forcePOST /api/refreshAll read endpoints also support start=YYYY-MM-DD&end=YYYY-MM-DD instead of range, plus timeZone (IANA name).
FAQs
Local-first token usage dashboard for OpenCode sessions.
We found that changehow-opencode-token-dashboard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.