dsh-git-auth
DSH 主机工具包：管理 glab / gh 授权和 SSH 密钥
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Wisdoverse/dsh-git-auth-plugin#8ac4a5ed9962fcaa052a659e7c55d0558490446aGit Auth 以 dsh-git-auth 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
GitHub, GitLab, and SSH authentication tools for DeepSeek Harness
English · 简体中文
Give DSH agents a small, approval-aware toolset for inspecting and managing
gh, glab, and SSH credentials on the host.
Check authentication → auth_status
Sign in with GH_TOKEN / GITLAB_TOKEN → client_auth
Generate or inspect an SSH key → ssh_key
| Feature | Description |
|---|---|
| Unified status | Reports gh, glab, SSH-agent, and public-key status in one call. |
| Non-interactive login | Authenticates gh or glab with a token supplied by the DSH host environment. |
| SSH key management | Generates, lists, and displays Ed25519 keys directly under ~/.ssh. |
| Approval-aware writes | Requests DSH approval before login, logout, key generation, or ssh-add. |
| Settings UI | Exposes hosts, timeout, key path, comment, and ssh-add defaults under Settings → Plugins. |
[!IMPORTANT] Access tokens are not accepted as tool arguments. Put them in the DSH host environment so they do not enter the model context or tool-call log.
| Tool | Purpose | Writes state |
|---|---|---|
auth_status | Show GitHub CLI, GitLab CLI, SSH-agent, and public-key status. | No |
client_auth | Log gh or glab in or out. | Yes; approval required |
ssh_key | Generate, list, or display an Ed25519 key. | Generation and ssh-add require approval |
Example requests:
Check my GitHub, GitLab, and SSH authentication status.
Use the configured GH_TOKEN to sign in to GitHub.
Generate ~/.ssh/id_ed25519 and add it to ssh-agent.
Show the public key for ~/.ssh/id_ed25519.
Clone the plugin into a path visible to the DSH host:
git clone https://github.com/Wisdoverse/dsh-git-auth-plugin.git \
/path/to/local-plugins/dsh-git-auth
Add it to the target profile:
dsh plugin --profile web add /path/to/local-plugins/dsh-git-auth
Restart the profile.
The package declares its DSH bundle in package.json, and
cordis.patch.yml mounts the tool plugin in the host's
global tool layer.
Open Settings → Plugins → Plugin configuration, or edit the git-auth
section in the DSH settings document (normally $DSH_HOME/settings.yaml).
| Setting | Default | Accepted value |
|---|---|---|
ghHost | github.com | Bare GitHub hostname, optionally with a port |
glabHost | gitlab.com | Bare GitLab hostname, optionally with a port |
commandTimeoutMs | 60000 | Integer greater than or equal to 1 |
sshPath | Empty | Direct child of ~/.ssh; empty means ~/.ssh/id_ed25519 |
sshComment | Empty | Default comment passed to ssh-keygen |
sshAddAgent | false | Whether generated keys are loaded with ssh-add by default |
git-auth:
glabHost: gitlab.example.com
commandTimeoutMs: 60000
sshPath: ~/.ssh/id_ed25519
sshComment: developer@example.com
sshAddAgent: true
Settings are resolved at tool-call time, so host-side settings-file updates do not require a plugin reinstall. DSH may restrict settings writes from remote browsers; edit the host settings file if the UI is read-only.
The plugin configuration card includes write-only GitHub Token and
GitLab Token fields. They store GH_TOKEN and GITLAB_TOKEN through the
DSH credentials service; saved values are never returned to the browser, so
the inputs stay blank and show only configured/source status.
The login tool resolves credential references in this order:
| Client | Precedence |
|---|---|
gh | GH_TOKEN → GITHUB_TOKEN |
glab | GITLAB_TOKEN → GLAB_TOKEN → GITLAB_ACCESS_TOKEN |
Existing deployment environment variables remain supported. A live environment value is read-only and takes precedence over the DSH credential store. Do not paste tokens into chat or commit them to this repository.
An environment token can be sent only to that client's configured host. To use
a different host, update ghHost or glabHost first, then restart DSH if the
host process also needs a new environment token.
This plugin manages host credentials, so its boundary is deliberately narrow:
~/.ssh; existing symlinks
at the directory, private-key, or public-key path are rejected.| Command | Purpose |
|---|---|
node test/compose.test.js | Run dependency-free command, token, host, and path assertions. |
node --check lib/index.js | Syntax-check the host plugin. |
node --check lib/client.js | Syntax-check the settings client. |
| Path | Responsibility |
|---|---|
lib/index.js | Tool registration, approvals, settings, and shell execution. |
lib/compose.js | Pure host, token, shell-argument, and SSH-path helpers. |
lib/client.js | Browser-side settings card. |
cordis.patch.yml | DSH bundle mounting. |
test/compose.test.js | Dependency-free regression checks. |
The running Web profile loads the plugin at startup. Restart it after changing the source files.
Released under the MIT License.