songoao25/dsh-bottom-info-bar
C3Bottom Info Bar — an information bar plugin for DeepSeek Harness: provider/model, live balance, peak/off-peak pricing with countdown, and real persisted per-session spend in a single line.
★ 5+ · songoao25/dsh-bottom-info-bar source on GitHub · this plugin in the registry
songoao25/dsh-bottom-info-bar is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, reads credential-class env vars.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| reads credential-class env vars | token_env | DSH_BOTTOM_INFO_BAR_CODEX_AUTH, DSH_BOTTOM_INFO_BAR_OPENCODE_AUTH |
Services it injects
credentials slots timer
Hooks it attaches
llm/adapters-updated llm/stream
Outbound domains
api.deepseek.com chatgpt.com opencode.ai
Environment variables it reads
DSH_BOTTOM_INFO_BAR_DATA_DIR DSH_BOTTOM_INFO_BAR_CODEX_AUTH DSH_BOTTOM_INFO_BAR_OPENCODE_AUTH
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.