dsh-opencode-go-quota: Display OpenCode Go Quota Beside the DSH Web Input Box
`dsh-opencode-go-quota` is a DSH web plugin designed to address the issues of scattered OpenCode Go quotas, lack of intuitive monitoring, and delayed quota warnings during agent requests. Its core functionalities include displaying a dynamic progress ring next to the chat input box, which shows real-time quota remaining for 5-hour, weekly, and monthly periods. The ring's color changes based on urgency, supports clicking to switch windows and automatic refresh. When the quota reaches a threshold, the plugin injects a one-time reminder into the system prompt as the agent enters a new tier, avoiding repetitive disruptions. The plugin retrieves keys by reading the local `auth.json` or environment variables, calls official APIs to fetch data, and offers multiple configuration options to customize warning thresholds and caching durations. Installation is straightforward, supporting additions via GitHub or local paths.
Read MoreUnauthenticated HTTP Service in OpenCode Leads to RCE: The Security Red Line for Open-Source AI Coding Agents
### CVE-2026-22812 Disclosure: Versions of OpenCode prior to 1.0.216 automatically start an unauthenticated HTTP service upon launch, which defaults to ports starting at 4096 and exposes interfaces for shell execution, PTY access and arbitrary file reading. Combined with permissive CORS policies, both local processes and malicious web pages can achieve remote code execution (RCE). This vulnerability has a CVSS score of 8.8 and was fixed in version 1.0.216. This article sorts out the cause of the vulnerability, the Proof-of-Concept (PoC) attack path, and the industry background of the Hugging Face Agent intrusion, and provides suggestions for upgrading and secure Agent security design.
Read More