dsh-git-nexus

A single, self-contained DeepSeek Harness (DSH) web plugin that merges the
git-management features of the popular dsh-web-ui plugin (SCM change panel +
branch management) with GitHub access, a workflow board, and file browsing —
one panel instead of several plugins.

Features

• Changes (SCM) — working-tree status, per-file diff, stage / unstage / discard, commit.
• Branches — list, switch, create, delete.
• Remote — push, pull, sync (pull then push), fetch.
• Log — bounded, structured commit history.
• Files — list tracked files with search, read any text file.
• Workflow — persistent step board (Claude Code-style plan tracking).
• GitHub — OAuth Device Flow login (full repo access, revocable), scope seal, PR creation.

Install

dsh plugin --profile web add "file:/absolute/path/to/dsh-git-nexus"
# then restart the web profile
dsh web

The plugin appears under Settings → Plugins and the panel pill appears in
the session header of git-managed workspaces.

Compatibility

Targets DSH 0.1.0-rc.6 (web profile). The plugin ships a strict
Typert host manifest
(./typert) and mounts strict client codecs, matching the conventions of the
plugins inside the official repository.

This is a community plugin published under the dsh-plugin
topic — the channel the DeepSeek Harness
maintainers ask community extensions to use (see the project's
CONTRIBUTING.md).

GitHub OAuth

GitHub auth uses the device flow,
so no long-lived PAT is written to disk. You need a GitHub OAuth App client id:

1. Go to GitHub → Settings → Developer settings → OAuth Apps → New OAuth App.
2. Any name / homepage / callback will do (device flow ignores the callback).
3. Paste the resulting Client ID into the panel's GitHub tab, click Connect,
   then open the printed URL and enter the user code.

The resulting token requests the repo, workflow, read:user and user:email
scopes and is stored with 0600 permissions under
~/.dsh/storages/dsh-git-nexus/. If the gh CLI is already authenticated, the
plugin uses it automatically and no client id is required.

Security notes

• Every git/file command runs through a fresh /bin/sh -c child process with a
  30s timeout and a 2 MiB output cap. The web profile scopes DSH's shell
  service to per-session agent realms, so the host-plane gateway executes
  directly instead of injecting it.
• Branch names, paths, and commit messages are shell-quoted; control characters are rejected.
• GitHub tokens live only under ~/.dsh/storages/dsh-git-nexus/settings.json (mode 0600).

License

MIT