
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
dsh-balance-by-token
Advanced tools
DeepSeek balance & token-cost plugin for DeepSeek Harness (dual-face): query official balances of every DeepSeek provider (multi API key), compute costs (last question / session / today-project / today-all) from token usage with a user-editable price tabl
A DeepSeek Harness plugin (dual-face: host + browser) for watching your DeepSeek account balance and estimating token-based costs, with prices configured per model × peak/off-peak period online. Everything lives in a unified modal (opened from the sidebar-footer Balance button); a session-header button shows a live "Session ≈xx CNY". UI copy is bilingual (Chinese / English, following the host UI language).
llm-pi-ai settings whose baseURL points at DeepSeek,llm-deepseek route,apiKeyEnv via the host
credentials service and calls the official
GET https://api.deepseek.com/user/balance (proxied by the host — keys never
reach the browser). Each row shows total_balance / granted_balance
(+ topped-out flag) or the failure reason. Results are cached in memory for 60s;
"Refresh" bypasses the cache.$DSH_HOME/settings.yaml.api.deepseek.com) — non-official keys
show a "not billed" chip instead of an amount. Multiple official keys (several
routes pointing at the official API) each get their own row and their own bill.provider field of request/context events → that
provider's baseURL in host settings → hostname equals api.deepseek.com
(trailing slash / case normalized; lookalike domains such as
api.deepseek.com.xx.com are not official).tokenUsage projection). Today
entries: on-demand scan of dshHomePath('sessions') logs (.jsonl and
.jsonl.zstd, frame-wise zstd decode, per-file memoized).模型版本 (colspan=2) + one column per model; three metric groups (input
cache-hit / cache-miss / output, each rowspan=2) + off-peak/peak rows;
only the price cells are input boxes (peak red, off-peak green).deepseek-v4-flash /
deepseek-v4-pro / deepseek-v4-flash-vision-exp). Old flat-format
config migrates automatically on first read (legacy built-in defaults upgrade to
the official three tiers).conversation.session.header.utilities, showing
Session ≈xx CNY (amount green) — the current session's estimated cost only.sidebar.footer.action Balance button with horizontal right-side text:
"余额(110.00 CNY) 高峰时段" — the amount in parentheses right after the label,
then the period text. It shows 高峰时段 (red) or 空闲时段 半价 (green)
depending on the current time; the amount comes from the balance API.$DSH_HOME/settings.yaml (autoRefreshJson) and survives restarts.Config + a settings namespace (dsh-balance): extra keys,
price config and auto-refresh interval persist to $DSH_HOME/settings.yaml.dsh.bundle + dsh.client(web) manifests; the official
deepseek-harness project is never modified — everything rides existing slots
and the HTTP / command channel.├── src/host/*.ts # host half: index.ts, providers.ts (enum + official check),
│ # balance.ts, cost.ts (fold + today scan + period pricing +
│ # official filter), ops.ts, fence.ts, types.ts
├── src/client/* # browser half: plugin.tsx (slots + timer), BalanceModal.tsx,
│ # HeaderButton.tsx, FooterButton.tsx, rpc.ts, store.ts,
│ # i18n.ts, styles.ts, logo.ts
├── lib/index.js # host bundle (tsdown ESM), committed for git installs
├── lib/client.js # browser bundle (__ModuleLoader__ factory), committed
├── lib/types/ # declarations (tsc -b)
├── scripts/ # verify-client.mjs
├── tsdown.config.ts # tsdown config (host + client banner wrap)
├── tsconfig.json # solution: tsconfig.host.json / tsconfig.client.json
├── cordis.patch.yml # bundle patch
├── package.json # dsh.bundle + dsh.client(web) manifests + peerDependencies
├── README.md # this file (English, default)
└── README.zh-CN.md # 中文文档
# local development
dsh plugin --profile web add ./dsh-balance-by-token
# published: npm / tarball / GitHub
dsh plugin --profile web add dsh-balance-by-token
dsh plugin --profile web add ./dsh-balance-by-token-0.1.0.tgz
dsh plugin --profile web add github:you/dsh-balance-by-token#<sha>
dsh --profile web --dump-config # inspect the plugin layer
dsh --profile web # start (host-half changes need a restart)
Local dev deps: the host loads
index.jsas native Node ESM, so@deepseek-ai/schemastery,@deepseek-ai/dsh-tools,@deepseek-ai/dsh-settings,@deepseek-ai/dsh-home-pathsmust resolve from the plugin directory (runpnpm installthere;node_modulesis gitignored).
No static config required: extra keys, price config and the auto-refresh interval
are edited in the modal and persisted to $DSH_HOME/settings.yaml.
Toolchain: tsc + tsdown (no vite): tsc -b type-checks and emits
declarations; tsdown (Rolldown core) bundles the host half
(lib/index.js, ESM) and the browser half (lib/client.js, single-file CJS
__ModuleLoader__ factory). Dependency manager: pnpm 10.
pnpm install # per pnpm-lock.yaml
pnpm run build # clean lib → tsc -b (types + declarations) → tsdown (both halves)
pnpm run verify # simulate the host seed to validate lib/client.js (optional)
pnpm publish # or pnpm pack / git push origin main (lib/ committed → git installs need no build)
Pushing a v* tag (pnpm run release bumps the patch version, rebuilds and
tags) triggers .github/workflows/publish.yml:
pnpm install --frozen-lockfile →
pnpm run check → pnpm run build → pnpm pack → create GitHub Release;NPM_TOKEN repo secret.Requirements: Node ≥ 26 + pnpm 10 (pinned via the packageManager field).
pnpm install # devDependencies: typescript, tsdown, @types/react, @deepseek-ai/* type packages…
pnpm run check # full-tree TypeScript check (tsc -b)
pnpm run build # rebuild both bundles after source changes (tsc -b && tsdown)
pnpm run verify # validate lib/client.js against a simulated host seed
src/host/; browser half in src/client/;window.__ModuleLoader__.load factory wrap of lib/client.js is generated
by tsdown's banner/intro/footer; external deps (react etc.) resolve through the
host module table (seed) at runtime./dsh-balance/api (POST JSON, host
webServer + trust fence) with a ctx.remote.commands.execute fallback;
errors carry a code that the client localizes.credentials service is looked up lazily per request
(not captured at apply time), avoiding a "no credential" state when the host
service starts late; the providers op returns credentialsPresent and per-entry
keySource diagnostics.(uncachedInput × p_input + cacheRead × p_cacheRead + cacheWrite × p_cacheWrite + output × p_output) / 1e6 per million tokens, priced
by each event's time (peak/off-peak).request/context provider → baseURL in host settings →
hostname == api.deepseek.com; non-official tokens are counted only
(per-provider four buckets), never billed.dshHomePath('sessions')/<projectKey>/<sessionId>/session.jsonl(.zstd),
decoded frame-wise via zstdDecompressSync from node:zlib.@deepseek-ai/cordis, dsh-tools, schemastery, dsh-settings,
dsh-commands, dsh-session, dsh-api-remotes, client runtime / ui-slots /
ui-settings / cordis-client-runner, react) are resolved by the host at install.deepseek-harness project is never modified; everything uses
existing slots (sidebar.footer.action, shell.overlay,
conversation.session.header.utilities) and the HTTP / command channel.FAQs
DeepSeek balance & token-cost plugin for DeepSeek Harness (dual-face): query official balances of every DeepSeek provider (multi API key), compute costs (last question / session / today-project / today-all) from token usage with a user-editable price tabl
The npm package dsh-balance-by-token receives a total of 0 weekly downloads. As such, dsh-balance-by-token popularity was classified as not popular.
We found that dsh-balance-by-token demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.