
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
dsh-ollama-cloud-usage
Advanced tools
DeepSeek Harness plugin: show Ollama Cloud remaining quota (session/weekly) as a Settings section beside Account & Balance, with an in-page API key editor. · DSH 插件:在设置页“账号与余额”下方显示 Ollama Cloud 剩余额度,并支持在页面内填写 API Key。
English | 中文
DeepSeek Harness plugin that shows the remaining Ollama Cloud quota as a Settings section, and lets you enter or replace the Ollama Cloud API key right on that page. The section registers as settings.section with id ollama-quota and order: -9, so it sits directly below the shipped Account / 账号与余额 entry. (The account page itself declares no child slot, so a plugin cannot append a card inside it; a sibling section is the supported placement.)
| Row | Source field |
|---|---|
| Session window remaining | limits.session.usage (fraction in [0, 1]) |
| Weekly window remaining | limits.weekly.usage |
| Per-model request counts | limits.<window>.models[].request_count |
| Last-4-weeks cost and period | activity.cost, activity.period |
| Key source | which credential reference resolved |
| API key editor | credentials.describe / credentials.set / credentials.unset over the DSH Remote |
Data comes from GET https://ollama.com/api/usage with Authorization: Bearer <key>. That is the endpoint behind the "Cloud usage" panel of ollama.com/settings; the local daemon at 127.0.0.1:11434 has no quota route. The response carries no plan label and no reset timestamps.
From npm:
dsh plugin --profile <profile> add dsh-ollama-cloud-usage
From a checkout:
npm pack --pack-destination dist
dsh plugin --profile <profile> add "$(pwd)/dist/dsh-ollama-cloud-usage-0.2.0.tgz"
The install reconciles dsh.profile.bundles and the profile applies the new layer. If the Host row does not appear, restart the app; an updated Client half needs a page refresh (the Desktop app has no client-bundle watcher).
The section's API key card writes to the first credential reference in keyEnvs through the shipped credentials Remote — the same write path the Models settings section uses. Saving stores the key in $DSH_HOME/.credentials.yaml and immediately re-reads the quota; Clear removes it.
env, file, …).credentials Remote falls back to a manual-configuration hint.The plugin row reads these fields, all optional:
| Field | Default | Meaning |
|---|---|---|
keyEnvs | [OLLAMA_CLOUD_API_KEY, OLLAMA_API_KEY] | credential references tried in order; the first is the one the editor writes |
usageUrl | https://ollama.com/api/usage | usage endpoint |
refreshMs | 60000 | snapshot refresh interval, minimum 5000 |
timeoutMs | 15000 | per-request timeout |
Example profile patch entry:
- id: ollama-cloud-usage
config:
refreshMs: 120000
The key is resolved through ctx.credentials, so it can live in the process environment, $DSH_HOME/.env, or the refs section of $DSH_HOME/.credentials.yaml:
version: 1
refs:
OLLAMA_CLOUD_API_KEY: <key from https://ollama.com/settings/keys>
A missing key is not an error: the section renders the editor and a configuration hint. The key never reaches the browser — the snapshot route returns window fractions, request counts, the activity cost, the reference order, and error labels only.
| File | Role |
|---|---|
index.js | Host half: credential resolution, /api/usage polling, JSON snapshot route |
client.js | Client half: the settings.section registration, quota UI, and key editor |
cordis.patch.yml | bundle patch inserting the plugin row |
node --check index.js && node --check client.js
node scripts/verify.mjs
scripts/verify.mjs drives both halves offline: the Host route paths (healthy, missing key, unauthorized, transport failure, credentials/updated refresh) and the Client component rendered against a hook-faithful React stub, including the key editor's describe/save/clear calls, the read-only branch, and locale switching.
ollama.com/api/usage is unofficial but stable; the payload carries no plan name and no reset timestamps, so the page shows window usage only.credentials/updated; there is no push channel.keyEnvs is editable. Additional references remain configuration-only.FAQs
DeepSeek Harness plugin: show Ollama Cloud remaining quota (session/weekly) as a Settings section beside Account & Balance, with an in-page API key editor. · DSH 插件:在设置页“账号与余额”下方显示 Ollama Cloud 剩余额度,并支持在页面内填写 API Key。
The npm package dsh-ollama-cloud-usage receives a total of 26 weekly downloads. As such, dsh-ollama-cloud-usage popularity was classified as not popular.
We found that dsh-ollama-cloud-usage demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.