npm:dsh-cost-meter@1.8.8

Stale. the latest tag points at 1.8.13, while this report covers 1.8.8

sha512-qK4Wswen1Ek5QYFKI/kx7tQxKwjXn6Dr8SFE24YpLP8nOd3LofdZ+l5AltmBFrSOibStgtn0f2BBH/ymRr2UDw==

Subject

name	`dsh-cost-meter`
version	`1.8.8`
integrity	`sha512-qK4Wswen1Ek5QYFKI/kx7tQxKwjXn6Dr8SFE24YpLP8nOd3LofdZ+l5AltmBFrSOibStgtn0f2BBH/ymRr2UDw==`
repository	git+https://github.com/Han-1413141/dsh-cost-meter.git
declared bundle patch	`"./cordis.patch.yml"`
declared engines.dsh	`not declared` — declarative and unenforced

Environment

DSH	`0.2.0-rc.2`
Node	`v24.21.0`
OS / arch	`linux 6.17.0-1022-azure x64`
verifier	`dsh-verified 0.2.0` `f78b5c4b87a9`
generated	`2026-10-04T17:45:51.544Z`

Dimensions

	status	summary	evidence
`L0`	pass	declares dsh.bundle.patch and every declared patch path exists (48 files, 1458942 bytes unpacked) dsh.manifestVersion is not declared; the reader does not infer a default tarball ships no src/ paths, so capability findings are limited to build output metrics { "fileCount": 48, "unpackedBytes": 1458942, "patchPaths": [ "./cordis.patch.yml" ], "declaredEnginesDsh": null, "shipsSource": false }	`e-resolve`, `e-tarball`, `e-l0`
`L1`	pass	installed the CLI completed the install with exit code 0 no dependency build script was approved by the verifier; approval permits commands with the host user permissions metrics { "durationMs": 1194, "exitCode": 0, "declaredPeers": null, "bundlesAfterInstall": [ "@deepseek-ai/dsh-base", "dsh-cost-meter" ], "pendingBuildScripts": [], "buildScriptsApproved": 0, "diagnosticsLog": null }	`e-l1-install`
`L2`	inconclusive	Host loader rows active; browser client not observed the subject declares dsh.client or its manifest could not be read; no browser client fiber was measured Host bundle rows were read from the running plugin manager; browser client execution requires separate evidence metrics { "bootBoundMs": 25000, "durationMs": 25063, "signal": null, "observedRows": 1, "activeRows": 1, "browserClientDeclared": true }	`e-l2-boot`, `e-l2-inventory`
`L3`	pass	a session completed with no credential the model call was served by the official replay adapter from a fixture authored in this repository; no provider was contacted and no credential was present probe task, stated verbatim: "reply with any text" metrics { "replayAdapter": "@deepseek-ai/dsh-llm-replay@0.2.0-rc.2", "probeTask": "reply with any text", "events": { "turnEndReason": { "kind": "completed" }, "finalEventSeen": true, "textEventCount": 1, "errorEventSeen": false, "exitCode": 0, "durationMs": 1326, "eventCount": 7 } }	`e-l3-session`
`L4`	pass	4 capability signal(s) present across 36 scanned file(s) the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency static analysis cannot see dynamically constructed code or prove intent metrics { "scannedFiles": 36, "scannedBytes": 1221328, "skippedFiles": 0 }	`e-l4`, `e-patch`
`L5`	pass	no significant delta across 6 sampled run(s) no metric moved beyond the significance thresholds; that is the finding differential attribution: baseline profile first, then the subject activated, same container and order thresholds are coarse on purpose — order-of-magnitude watcher changes, RSS growth beyond 100 MiB, steady state more than 2 s later metrics { "samples": 6, "baseline": { "atMs": 8041, "rss": 200003584, "heapUsed": 58514200, "external": 4426614, "activeTotal": 10, "watchers": 7, "timers": 0, "libuvHandles": 22, "libuvActiveHandles": 17, "fds": 20 }, "activated": { "atMs": 8036, "rss": 206131200, "heapUsed": 75146424, "external": 4651664, "activeTotal": 11, "watchers": 8, "timers": 0, "libuvHandles": 23, "libuvActiveHandles": 19, "fds": 20 }, "delta": { "atMs": -5, "rss": 6127616, "heapUsed": 16632224, "external": 225050, "activeTotal": 1, "watchers": 1, "timers": 0, "libuvHandles": 1, "libuvActiveHandles": 2, "fds": 0 } }	`e-l5-overhead`
`L6`	pass	removed without residue the profile retains no bundle selection, dependency entry or files for the subject metrics { "residue": [], "durationMs": 521 }	`e-l6-remove`

Capability (L4, static)

capability	confidence	attribution	first evidence
`hooks_api_gate`	medium	unknown	`package/lib/index.js:3253`
`network_egress`	medium	unknown	`package/lib/native-search-billing.js:85`
`spawns_process`	medium	unknown	`package/lib/cli-bridge.js:5`
`writes_outside_workspace`	low	unknown	`package/lib/index.js:690`

Capability is not intent. A signature records what the code can reach for, not what it does.

Overhead (L5, dynamic)

{
  "status": "no-significant-delta",
  "samples": 6,
  "baseline": {
    "atMs": 8041,
    "rss": 200003584,
    "heapUsed": 58514200,
    "external": 4426614,
    "activeTotal": 10,
    "watchers": 7,
    "timers": 0,
    "libuvHandles": 22,
    "libuvActiveHandles": 17,
    "fds": 20
  },
  "activated": {
    "atMs": 8036,
    "rss": 206131200,
    "heapUsed": 75146424,
    "external": 4651664,
    "activeTotal": 11,
    "watchers": 8,
    "timers": 0,
    "libuvHandles": 23,
    "libuvActiveHandles": 19,
    "fds": 20
  },
  "delta": {
    "atMs": -5,
    "rss": 6127616,
    "heapUsed": 16632224,
    "external": 225050,
    "activeTotal": 1,
    "watchers": 1,
    "timers": 0,
    "libuvHandles": 1,
    "libuvActiveHandles": 2,
    "fds": 0
  },
  "significant": []
}

Evidence

id	kind	artifact
`e-resolve`	command exit 0 146 ms	`resolve dsh-cost-meter@1.8.8 -> dsh-cost-meter@1.8.8` { "name": "dsh-cost-meter", "version": "1.8.8", "registry": "https://registry.npmjs.org", "tarball": "https://registry.npmjs.org/dsh-cost-meter/-/dsh-cost-meter-1.8.8.tgz", "advertisedIntegrity": "sha512-qK4Wswen1Ek5QYFKI/kx7tQxKwjXn6Dr8SFE24YpLP8nOd3LofdZ+l5AltmBFrSOibStgtn0f2BBH/ymRr2UDw==", "publishedAt": "2026-10-03T10:59:09.474Z" }
`e-tarball`	artifact exit 0 49 ms	`fetch https://registry.npmjs.org/dsh-cost-meter/-/dsh-cost-meter-1.8.8.tgz` { "bytes": 411843, "resolvedIntegrity": "sha512-qK4Wswen1Ek5QYFKI/kx7tQxKwjXn6Dr8SFE24YpLP8nOd3LofdZ+l5AltmBFrSOibStgtn0f2BBH/ymRr2UDw==", "advertisedIntegrity": "sha512-qK4Wswen1Ek5QYFKI/kx7tQxKwjXn6Dr8SFE24YpLP8nOd3LofdZ+l5AltmBFrSOibStgtn0f2BBH/ymRr2UDw==", "integrityMatchesRegistry": true, "sha256": "21e4fd0d9655707fddb328ce8cb93cc49a8d21f304f946ae7674b336bba51080" }
`e-l0`	static	`read published package.json and verify declared dsh.bundle.patch paths exist` { "status": "pass", "reasons": [], "declared": { "manifestVersion": null, "bundlePatch": [ "./cordis.patch.yml" ], "clientPlatform": "web", "enginesDsh": null, "enginesNode": ">=20" }, "missingPatchPaths": [], "fileCount": 48, "unpackedBytes": 1458942, "shipsSource": false }
`e-patch`	static	`read cordis.patch.yml` # dsh-cost-meter bundle patch: one host row over the Web or Desktop profile. # The row name resolves from the profile's own node_modules where # `dsh plugin --profile <profile> add <path>` installed this package. - insert: - id: cost-meter name: dsh-cost-meter
`e-l4`	static	`scan 36 shipped source file(s) for capability signatures` { "present": [ { "id": "hooks_api_gate", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/index.js", "line": 3253, "snippet": "ctx.on('llm/stream', createLlmStreamBilling({" } }, { "id": "network_egress", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/native-search-billing.js", "line": 85, "snippet": "const source = diagnostics(`undici:request:${name}`)" } }, { "id": "spawns_process", "confidence": "medium", "attribution": "unknown", "firstEvidence": { "file": "package/lib/cli-bridge.js", "line": 5, "snippet": "import { execFile } from 'node:child_process'" } }, { "id": "writes_outside_workspace", "confidence": "low", "attribution": "unknown", "firstEvidence": { "file": "package/lib/index.js", "line": 690, "snippet": "const home = process.env.USERPROFILE \|\| process.env.HOME \|\| ''" } } ], "scannedFiles": 36, "skippedFiles": 0, "limits": [ "the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency", "static analysis cannot see dynamically constructed code or prove intent" ] }
`e-l1-install`	command exit 0 1194 ms	`dsh plugin --profile verify add dsh-cost-meter@1.8.8` Progress: resolved 1, reused 0, downloaded 0, added 0 WARN Issues with peer dependencies found . └─┬ dsh-cost-meter 1.8.8 ├── ✕ missing peer @deepseek-ai/dsh-home-paths@"^0.1.0-rc.6 \|\| ^0.1.1-0 \|\| ^0.1.2-0 \|\| ^0.1.3-0 \|\| ^0.1.5-0 \|\| >=0.2.0-rc.1 <0.3.0-0" └── ✕ missing peer @deepseek-ai/dsh-credentials@"^0.1.0-rc.6 \|\| ^0.1.1-0 \|\| ^0.1.2-0 \|\| ^0.1.3-0 \|\| ^0.1.5-0 \|\| >=0.2.0-rc.1 <0.3.0-0" Peer dependencies that should be installed: @deepseek-ai/dsh-credentials@"^0.1.0-rc.6 \|\| ^0.1.1-0 \|\| ^0.1.2-0 \|\| ^0.1.3-0 \|\| ^0.1.5-0 \|\| >=0.2.0-rc.1 <0.3.0-0" @deepseek-ai/dsh-home-paths@"^0.1.0-rc.6 \|\| ^0.1.1-0 \|\| ^0.1.2-0 \|\| ^0.1.3-0 \|\| ^0.1.5-0 \|\| >=0.2.0-rc.1 <0.3.0-0" dependencies: + dsh-cost-meter 1.8.8 Packages: +2 ++ Progress: resolved 2, reused 2, downloaded 0, added 2, done Done in 469ms using pnpm v10.33.2 dsh: initialized profile verify at <work>/dsh-home/profiles/verify
`e-l2-boot`	command exit 0 25063 ms	`dsh --profile verify --patch <work>/fixtures/load/l2-overlay.yml` [dsh-cost-meter] 已加载,账本:<work>/dsh-home/storages/cost-meter/ledger.json [dsh-cost-meter] OpenRouter 价格刷新失败(保留本地价格): fetch failed
`e-l2-inventory`	sample	`pluginManager.listBundles() + pluginManager.listPlugins() in the running Host` {"found":true,"enabled":true,"error":null,"overrides":[],"rows":[{"rowId":"cost-meter","entryId":"include:cost-meter","enabled":true,"fiberPhase":"active"}],"browserClientDeclared":true}
`e-l6-remove`	command exit 0 521 ms	`dsh plugin --profile verify remove dsh-cost-meter` dependencies: - dsh-cost-meter 1.8.8 Already up to date Done in 328ms using pnpm v10.33.2
`e-l5-overhead`	sample	`dsh --profile <baseline\|activated> with the host sampler injected via NODE_OPTIONS=--import` { "method": "differential", "status": "no-significant-delta", "samples": 6, "baselineMedian": { "atMs": 8041, "rss": 200003584, "heapUsed": 58514200, "external": 4426614, "activeTotal": 10, "watchers": 7, "timers": 0, "libuvHandles": 22, "libuvActiveHandles": 17, "fds": 20 }, "activatedMedian": { "atMs": 8036, "rss": 206131200, "heapUsed": 75146424, "external": 4651664, "activeTotal": 11, "watchers": 8, "timers": 0, "libuvHandles": 23, "libuvActiveHandles": 19, "fds": 20 }, "delta": { "atMs": -5, "rss": 6127616, "heapUsed": 16632224, "external": 225050, "activeTotal": 1, "watchers": 1, "timers": 0, "libuvHandles": 1, "libuvActiveHandles": 2, "fds": 0 }, "significant": [] }
`e-l3-session`	command exit 0 1326 ms	`dsh --profile l3 --patch <work>/fixtures/replay/l3-overlay.yml --json reply with any text` [dsh-cost-meter] 已加载,账本:<work>/dsh-home/storages/cost-meter/ledger.json {"type":"session","sessionId":"[redacted:session-content]","cwd":"<work>"} {"type":"status","phase":"turn_start","turn":1} {"type":"status","phase":"step_start","turn":1,"step":1} {"type":"text","text":"[redacted:session-content]"} {"type":"status","phase":"step_end","turn":1,"step":1} {"type":"status","phase":"turn_end","turn":1,"reason":{"kind":"completed"}} {"type":"final","text":"[redacted:session-content]"}

Limits

the artifact ships no source paths, so capability findings describe build output only; code-level attribution between the author and inlined dependencies is not resolvable from this artifact
the package ships build output; code inside a bundle cannot be reliably attributed to the author or to an inlined dependency
static analysis cannot see dynamically constructed code or prove intent
L3 ran against a replayed transcript from a fixture authored by the verifier, not against a provider: it establishes that a session completes without a credential, not that the plugin behaves correctly against a live model
network egress was denied; attempted destination hosts were not observable in this run
no dependency build script was approved by this executor
overhead is reported only where a delta cleared the significance thresholds; otherwise the result is no-significant-delta
sampling happens inside the host process via NODE_OPTIONS=--import, so process.getActiveResourcesInfo() and process.report.getReport() describe the process under test
L3 session identifiers and text are redacted before execution evidence is written

Disclaimers

Verification is not a security audit and not an endorsement. It records what was executed and observed on one machine at one time. Absence of a finding is not a finding of absence.

raw report JSON · badge · dispute this report