@aryacode/dsh-aryacode-polish 0.4.4 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.5.0] - 2026-10-27
+
+### Added
+
+- **Add a workspace from GitHub.** A new switch (`githubWorkspace`) adds an
+  **Add workspace from GitHub** entry to the sidebar foot. It lists the
+  repositories the GitHub CLI session can clone, clones the chosen one into
+  `<home>\AryaCode\<owner>\<repo>`, and registers that folder as a workspace
+  through the same controller call the "+" menu uses. The token never reaches the
+  browser: the Host reads it with `gh auth token` and hands it to git as an
+  `http.extraHeader` in git's environment, so it stays out of the URL, the
+  command line, and any stored remote. See
+  [`docs/github-workspaces.md`](docs/github-workspaces.md).
+
+### Fixed
+
+- **A clone would have failed on a real machine.** `cloneRepo` spawned the
+  argument list without the `git` command name and passed the token as an option
+  the runner never read, so the clone carried no authentication at all. It now
+  spawns `git` with the token in `GIT_CONFIG_*`, which is what GitHub's git
+  server accepts, and `test/github.spec.mjs` pins the spawn shape.
+- **The signed-out reason told you nothing you could act on.** It now names the
+  command that fixes it (`gh auth login`).
+
+### Changed
+
+- `pnpm test` also runs `test/github.spec.mjs`; the suite is 87 tests.
+
 ## [0.4.4] - 2026-10-27
 
 ### Fixed
@@ -232,8 +260,8 @@
 
 ### Fixed
 
-- The pill's `≈` was stored as cp1252 mojibake (`≈`), so a real turn rendered
-  `≈$0.003` instead of `≈$0.003`. Same cause as the two strings repaired in
+- The pill's `≈` was stored as cp1252 mojibake (`≈`), so a real turn rendered
+  `≈$0.003` instead of `≈$0.003`. Same cause as the two strings repaired in
   0.2.1 — a PowerShell round-trip over the face source — and the last of that
   damage. Verified against a real turn in Dev AryaCode.
 

package/README.md

@@ -7,7 +7,7 @@ installed into and patches nothing. It is one package, one Plugins row, and one
 switch per feature, so a refinement that turns out to be wrong for a machine can
 be turned off without uninstalling anything.
 
-Status: **three features shipped.** The version is the package's, and the card
+Status: **four features shipped.** The version is the package's, and the card
 header already shows it.
 
 ## What it is
@@ -33,6 +33,7 @@ Configure page automatically.
 | **Estimated session cost** (`sessionCost`) | On | A `≈$0.39` pill in the composer dock that opens a breakdown card — cache hit, uncached input, cached input, output, requests, and the estimate — priced from the session's recorded usage at the published DeepSeek rates. |
 | **Account balance** (`accountBalance`) | On | The account's remaining wallet (`$17.33`) in the sidebar foot, above the account row. Renders nothing when the Host exposes no wallet, so it never shows a number nobody gave it. |
 | **Open workspace folder** (`openWorkspaceFolder`) | On | An **Open workspace folder** row in a Session's "…" menu that opens the Session's workspace in Explorer/Finder. Renders nothing when the Session has no workspace or the Host cannot open a path. See [Open a workspace folder](docs/workspace-folder.md) for why the request had to land here instead of on the workspace row itself. |
+| **Add a workspace from GitHub** (`githubWorkspace`) | On | **Add workspace from GitHub** in the sidebar foot: the dialog lists the repositories your GitHub CLI session can clone, and cloning one creates the workspace. The token never enters the browser — it is read on the Host, used only as git's http auth header, and never stored. See [GitHub workspaces](docs/github-workspaces.md). |
 
 ### How the cost is computed
 
@@ -122,6 +123,7 @@ entries/polish.js    the row: Config derived from the registry, apply()
 entries/registry.js  the feature list — the one place a feature is declared
 entries/usage.js     the fold: model-attributed usage out of the session log
 entries/cost.js      the polishCost projection: rates, pricing, host mount
+entries/github.js    the GitHub route: gh token, repository list, clone, workspace
 entries/config.js    volatile-reference accessors (resolve/flag/list/text)
 lib/index.js         mount point re-exporting the row
 client/face.js       browser face source: the Configure page and every surface

package/client/face.js

@@ -530,22 +530,24 @@ function BalanceLine(props) {
     return React.createElement('div', { 'data-polish-balance': 'empty', style: { display: 'none' } })
   }
   const money = formatBalance(wallet)
+  // The foot is a single row shared with the GitHub entry, so the amount stays
+  // bare: a tooltip names it, and nothing here competes for width.
   return React.createElement('div', {
     title: 'Remaining account balance',
+    'data-polish-balance': 'ready',
     style: {
       display: 'flex',
       alignItems: 'center',
       gap: '6px',
-      padding: '2px 8px 4px',
+      padding: '2px 4px 4px 8px',
       fontSize: '12px',
       lineHeight: '16px',
-      minWidth: 0,
-      overflow: 'hidden',
+      flex: '0 0 auto',
       whiteSpace: 'nowrap',
-      textOverflow: 'ellipsis',
       opacity: 0.75,
+      fontVariantNumeric: 'tabular-nums',
     },
-  }, props.wide === false ? money : 'Balance ' + money)
+  }, money)
 }
 
 /**
@@ -616,6 +618,305 @@ function OpenFolderMenuItem(props) {
   return React.createElement('button', { type: 'button', role: 'menuitem', onClick: onSelect }, label)
 }
 
+/** The Host route the GitHub halves talk over. Document-relative, like every app route. */
+const GITHUB_ROUTE = 'api/polish.github'
+
+/**
+ * Whether the GitHub panel is open. One store for the whole bundle: the footer
+ * row opens it, and the overlay panel is the only reader.
+ */
+const githubStore = (() => {
+  let open = false
+  const listeners = new Set()
+  return {
+    isOpen: () => open,
+    subscribe(listener) {
+      listeners.add(listener)
+      return () => { listeners.delete(listener) }
+    },
+    set(next) {
+      if (open === next) return
+      open = next
+      for (const listener of listeners) listener()
+    },
+  }
+})()
+
+/**
+ * Post one action to the GitHub route.
+ * @param action - `status`, `repos` or `clone`.
+ * @param extra - fields the action needs.
+ * @returns the route's `value`, or throws with its own message.
+ */
+async function githubCall(action, extra) {
+  const response = await fetch(GITHUB_ROUTE, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ action, ...(extra ?? {}) }),
+  })
+  const payload = await response.json().catch(() => undefined)
+  if (payload === undefined || typeof payload !== 'object') {
+    throw new Error(`the Host answered ${String(response.status)}`)
+  }
+  if (payload.ok !== true) throw new Error(payload.error || 'GitHub request failed')
+  return payload.value
+}
+
+/** Modal backdrop and panel skin, matching the Shell's own dialogs. */
+const GITHUB_BACKDROP_STYLE = {
+  position: 'fixed',
+  inset: 0,
+  zIndex: 1200,
+  display: 'flex',
+  alignItems: 'center',
+  justifyContent: 'center',
+  background: 'rgba(16, 18, 22, 0.32)',
+}
+
+const GITHUB_CARD_STYLE = {
+  ...PANEL_STYLE,
+  position: 'static',
+  width: 'min(560px, calc(100vw - 32px))',
+  maxHeight: 'min(560px, calc(100vh - 64px))',
+  display: 'flex',
+  flexDirection: 'column',
+  overflow: 'hidden',
+}
+
+const GITHUB_LIST_STYLE = {
+  marginTop: '10px',
+  overflowY: 'auto',
+  borderTop: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.12))',
+}
+
+const GITHUB_ROW_STYLE = {
+  display: 'flex',
+  alignItems: 'center',
+  gap: '8px',
+  width: '100%',
+  padding: '8px 4px',
+  border: 'none',
+  background: 'transparent',
+  color: 'inherit',
+  font: 'inherit',
+  textAlign: 'left',
+  cursor: 'pointer',
+  borderBottom: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.08))',
+}
+
+const GITHUB_INPUT_STYLE = {
+  width: '100%',
+  boxSizing: 'border-box',
+  padding: '6px 8px',
+  font: 'inherit',
+  color: 'inherit',
+  background: 'transparent',
+  border: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.2))',
+  borderRadius: 'var(--dsw-radius-sm, 6px)',
+}
+
+/**
+ * The add-a-workspace-from-GitHub dialog.
+ *
+ * Sign-in is the GitHub CLI's own session: the Host asks `gh` for the token it
+ * already holds, so this dialog never collects a credential. A clone becomes a
+ * workspace through the Workspace Remote, which is the same call the "+" menu
+ * makes after its folder picker returns a path.
+ *
+ * @param props - our lazy `configForms` and the `createWorkspace` opener.
+ * @returns the dialog, or null while it is closed or switched off.
+ */
+function GitHubPanel(props) {
+  const open = React.useSyncExternalStore(githubStore.subscribe, githubStore.isOpen)
+  const enabled = useSwitch(props.configForms, 'githubWorkspace', true)
+  const [phase, setPhase] = React.useState('idle')
+  const [account, setAccount] = React.useState(undefined)
+  const [repos, setRepos] = React.useState([])
+  const [query, setQuery] = React.useState('')
+  const [error, setError] = React.useState('')
+  const [busy, setBusy] = React.useState('')
+
+  React.useEffect(() => {
+    if (!open || !enabled) return undefined
+    let live = true
+    setPhase('loading')
+    setError('')
+    setBusy('')
+    setQuery('')
+    Promise.resolve()
+      .then(() => githubCall('status'))
+      .then(status => {
+        if (!live) return undefined
+        setAccount(status)
+        if (status.signedIn !== true) return undefined
+        return githubCall('repos').then(list => {
+          if (!live) return
+          setRepos(Array.isArray(list.repos) ? list.repos : [])
+        })
+      })
+      .then(() => { if (live) setPhase('ready') })
+      .catch(reason => {
+        if (!live) return
+        setError(reason instanceof Error ? reason.message : String(reason))
+        setPhase('ready')
+      })
+    return () => { live = false }
+  }, [open, enabled])
+
+  React.useEffect(() => {
+    if (!open) return undefined
+    const onKey = event => { if (event.key === 'Escape') githubStore.set(false) }
+    document.addEventListener('keydown', onKey)
+    return () => document.removeEventListener('keydown', onKey)
+  }, [open])
+
+  if (!open || !enabled) return null
+
+  const signedIn = account !== undefined && account.signedIn === true
+  const needle = query.trim().toLowerCase()
+  const visible = needle === ''
+    ? repos
+    : repos.filter(repo => `${repo.fullName} ${repo.description}`.toLowerCase().includes(needle))
+  const root = account !== undefined && typeof account.root === 'string' ? account.root : ''
+
+  const clone = repo => {
+    if (busy !== '') return
+    setBusy(repo.fullName)
+    setError('')
+    Promise.resolve()
+      .then(() => githubCall('clone', { owner: repo.owner, name: repo.name }))
+      .then(result => Promise.resolve(props.createWorkspace(result.path)).then(() => result))
+      .then(result => {
+        setBusy('')
+        githubStore.set(false)
+        if (typeof console !== 'undefined' && typeof console.info === 'function') {
+          console.info('[aryacode-polish] workspace ready:', result.path)
+        }
+      })
+      .catch(reason => {
+        setBusy('')
+        setError(reason instanceof Error ? reason.message : String(reason))
+      })
+  }
+
+  const rows = visible.slice(0, 200).map(repo => React.createElement('button', {
+    key: repo.fullName,
+    type: 'button',
+    style: GITHUB_ROW_STYLE,
+    disabled: busy !== '',
+    onClick: () => clone(repo),
+    title: repo.description === '' ? repo.fullName : `${repo.fullName} — ${repo.description}`,
+    'data-polish-github-row': repo.fullName,
+  },
+  React.createElement('span', { style: { flex: 1, minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' } },
+    repo.fullName,
+    repo.isPrivate ? React.createElement('span', { style: { marginLeft: '6px', opacity: 0.6 } }, 'private') : null,
+    repo.isFork ? React.createElement('span', { style: { marginLeft: '6px', opacity: 0.6 } }, 'fork') : null),
+  repo.cloned === true
+    ? React.createElement('span', { style: { opacity: 0.6 } }, 'cloned')
+    : null,
+  busy === repo.fullName ? React.createElement('span', { style: { opacity: 0.7 } }, 'cloning…') : null))
+
+  return ReactDOM.createPortal(
+    React.createElement('div', {
+      style: GITHUB_BACKDROP_STYLE,
+      'data-polish-github': 'dialog',
+      onPointerDown: event => { if (event.target === event.currentTarget) githubStore.set(false) },
+    },
+    React.createElement('div', { style: GITHUB_CARD_STYLE, role: 'dialog', 'aria-label': 'Add a workspace from GitHub' },
+      React.createElement('div', { style: { ...PANEL_TITLE_STYLE, marginBottom: '4px' } },
+        React.createElement('span', null, 'Add a workspace from GitHub'),
+        React.createElement('button', {
+          type: 'button',
+          onClick: () => githubStore.set(false),
+          style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7 },
+          'aria-label': 'Close',
+        }, '×')),
+      React.createElement('div', { style: { opacity: 0.75, minHeight: '18px' } },
+        phase === 'loading' && !signedIn ? 'Checking the GitHub CLI session…' : null,
+        signedIn ? `Signed in as ${String(account.login)} · cloning into ${root}` : null,
+        !signedIn && phase !== 'loading'
+          ? 'The GitHub CLI is not signed in. Run `gh auth login` in a terminal, then reopen this dialog.'
+          : null),
+      signedIn
+        ? React.createElement('input', {
+          style: { ...GITHUB_INPUT_STYLE, marginTop: '10px' },
+          value: query,
+          placeholder: 'Search your repositories',
+          'aria-label': 'Search your repositories',
+          autoFocus: true,
+          onChange: event => setQuery(event.target.value),
+        })
+        : null,
+      error !== ''
+        ? React.createElement('div', { style: { marginTop: '10px', color: 'var(--dsw-alias-label-error, #b42318)' } }, error)
+        : null,
+      signedIn
+        ? React.createElement('div', { style: GITHUB_LIST_STYLE, 'data-polish-github-list': String(visible.length) },
+          phase === 'loading' && visible.length === 0 ? React.createElement('div', { style: { padding: '10px 4px', opacity: 0.7 } }, 'Loading repositories…') : null,
+          phase === 'ready' && visible.length === 0 ? React.createElement('div', { style: { padding: '10px 4px', opacity: 0.7 } }, 'No repository matches that search.') : null,
+          ...rows)
+        : null,
+      React.createElement('p', { style: { margin: '10px 0 0', color: 'var(--dsw-alias-label-tertiary, inherit)' } },
+        'The clone is added as a workspace. Sign-in comes from the GitHub CLI, so this plugin stores no token.')))
+    , document.body)
+}
+
+/**
+ * The footer row that opens the GitHub dialog.
+ * @param props - our lazy `configForms`.
+ * @returns the row, or null when the feature is switched off.
+ */
+function GithubEntry(props) {
+  const enabled = useSwitch(props.configForms, 'githubWorkspace', true)
+  if (!enabled) return null
+  return React.createElement('div', { style: { padding: '2px 8px 4px', minWidth: 0 } },
+    React.createElement('button', {
+      type: 'button',
+      'data-polish-github': 'entry',
+      title: 'Add a workspace from GitHub',
+      'aria-label': 'Add a workspace from GitHub',
+      onClick: () => githubStore.set(true),
+      style: {
+        display: 'flex',
+        alignItems: 'center',
+        gap: '6px',
+        maxWidth: '100%',
+        minWidth: 0,
+        padding: '2px 6px',
+        border: 'none',
+        borderRadius: 'var(--dsw-radius-sm, 6px)',
+        background: 'transparent',
+        color: 'var(--dsw-alias-label-tertiary, inherit)',
+        font: 'inherit',
+        fontSize: '12px',
+        lineHeight: '18px',
+        fontVariantNumeric: 'tabular-nums',
+        whiteSpace: 'nowrap',
+        overflow: 'hidden',
+        textOverflow: 'ellipsis',
+        cursor: 'pointer',
+      },
+      onMouseEnter: event => { event.currentTarget.style.background = 'var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.06))' },
+      onMouseLeave: event => { event.currentTarget.style.background = 'transparent' },
+    },
+    React.createElement('svg', {
+      width: 14,
+      height: 14,
+      viewBox: '0 0 16 16',
+      fill: 'none',
+      stroke: 'currentColor',
+      strokeWidth: 1.2,
+      strokeLinecap: 'round',
+      strokeLinejoin: 'round',
+      'aria-hidden': 'true',
+      style: { flex: 'none' },
+    },
+    React.createElement('path', { d: 'M2.5 5.5h4l1.2 1.5h5.8v6.5h-11z' }),
+    React.createElement('path', { d: 'M8 9.8v3.4M6.3 11.5h3.4' })),
+    'Add from GitHub'))
+}
+
 return {
   inject: ['slots'],
   /**
@@ -678,5 +979,28 @@ return {
         inject: () => ({ configForms, openFolder, workspaces: workspaceCtx.get('workspaces') }),
       }, OpenFolderMenuItem))
     })
+    // Adding a workspace from GitHub goes through the Workspace service's own
+    // create call — the same one the "+" menu makes once its folder picker
+    // returns a path — so a clone lands in the sidebar exactly like a picked
+    // folder does, with no Harness change anywhere. The service takes the plain
+    // path and throws on refusal; the Remote namespace underneath it is
+    // `ctx.remote.workspace` (singular), which is why this injects the service.
+    ctx.inject(['workspaces'], (githubCtx) => {
+      const createWorkspace = async (path) => {
+        const workspace = await githubCtx.workspaces.create({ path })
+        return workspace
+      }
+      githubCtx.slots.inject('shell.overlay', () => githubCtx.slots.register({
+        name: 'shell.overlay',
+        id: 'polish-github',
+        inject: () => ({ configForms, createWorkspace }),
+      }, GitHubPanel))
+      githubCtx.slots.inject('sidebar.footer.action', () => githubCtx.slots.register({
+        name: 'sidebar.footer.action',
+        id: 'polish-github-entry',
+        order: 4,
+        inject: () => ({ configForms }),
+      }, GithubEntry))
+    })
   },
 }

package/client/switches.json

@@ -16,7 +16,13 @@
     {
       "key": "openWorkspaceFolder",
       "label": "Open workspace folder",
-      "description": "Add an \u201cOpen workspace folder\u201d row to a Session\u2019s menu that opens its workspace in the file browser.",
+      "description": "Add an “Open workspace folder” row to a Session’s menu that opens its workspace in the file browser.",
+      "defaultOn": true
+    },
+    {
+      "key": "githubWorkspace",
+      "label": "Add a workspace from GitHub",
+      "description": "Sign in with the GitHub CLI, browse your repositories, and clone one as a workspace.",
       "defaultOn": true
     }
   ]

package/docs/github-workspaces.md

@@ -0,0 +1,63 @@
+# GitHub workspaces
+
+**Add workspace from GitHub** turns a repository you can already reach with the
+GitHub CLI into a workspace, without a second sign-in and without storing a
+token.
+
+## What it does
+
+1. **Reads the CLI session.** The host half runs `gh auth token`. That is the
+   whole authentication story: no OAuth app, no device code, no token in a
+   settings file, no token in the browser. When `gh` is missing or signed out,
+   the dialog says so and names the command that fixes it (`gh auth login`).
+2. **Lists what that session can clone.** `GET /user/repos` with
+   `affiliation=owner,collaborator,organization_member`, paged through the
+   `link` header, most recently updated first.
+3. **Clones into your own folder.** `<home>\AryaCode\<owner>\<repo>`, created if
+   missing. A directory that is already the same repository is reused instead of
+   cloned again; a directory that is a *different* repository is an error, never
+   a silent overwrite.
+4. **Creates the workspace.** The clone path is handed to the workspace
+   controller (`workspaces.create({ path })`), which is the same call the "+" menu
+   makes, so the new workspace behaves like any other.
+
+## Where the token goes, and where it does not
+
+The token is read on the Host and passed to `git` as an `http.extraHeader` value
+in git's own environment (`GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_0`/
+`GIT_CONFIG_VALUE_0`), never in the remote URL and never on the command line — so
+it cannot leak through `ps`, a stored remote, or a shell history. GitHub's git
+server rejects a bearer token for clone, which is why the header carries
+`x-access-token` basic auth. Every line of git output is scrubbed of the token
+before it can reach the browser, and the route answers `cache-control: no-store`.
+
+## Why the entry point is the sidebar foot
+
+The "+" menu's **Add workspace** entry only appears when something occupies
+`sidebar.workspaces.directoryFlow`, and that slot is `kind: 'single'`: it already
+holds the folder picker, so occupying it would mean re-implementing folder
+choosing (browse *and* the native desktop picker) just to add a second source.
+Rather than replace the shipped picker, the feature adds its own entry in the
+sidebar foot next to it. If a multi-source workspace socket ever lands in the
+harness, only the registration moves; the route, the clone rules and the tests
+stay as they are.
+
+## Not used from the AryaAI-era plugin
+
+`@deepseek-ai/dsh-github` was read as a reference and deliberately not reused:
+it is a typert remote service with generated protocol packages, and it
+authenticates through an OAuth device flow that needs a registered OAuth app.
+Its ideas that were kept: reject anything that is not one path segment, reuse a
+checkout whose origin already matches, present the token as basic auth in git's
+environment, page the repository list, and mark a repository that is already
+cloned.
+
+## Tests
+
+`test/github.spec.mjs` covers the path rules (`.`, `..`, separators, empty),
+the destination layout, origin comparison across https/ssh forms, token
+scrubbing, the CLI token's three failure modes, signed-out and signed-in status,
+the `cloned` marker against a real temporary tree, the spawn shape of a clone
+(command, `--`, URL, destination, and the header in the environment rather than
+in the arguments), the reuse path, the refusal to overwrite another repository,
+and a failing clone whose message is scrubbed.

package/docs/workspace-folder.md

@@ -55,6 +55,12 @@ If the harness ever declares a workspace-scoped menu slot, this feature should m
 there: the Host call and the path resolution stay exactly as they are, and only the
 registration line changes.
 
+**Owner's decision (2026-10-27):** asked again, after the Session row menu shipped,
+whether to add that slot to the harness and release a harness patch, the owner
+declined — "then forget it". The workspace row stays untouched and the feature stays
+on the Session row menu. The question has been asked and answered; do not re-open it
+without a new instruction.
+
 ## Evidence for the next reader
 
 - Slot contract: `packages/client/ui-workspace/src/client/contract/slots.ts:152-205`.

package/entries/github.js

@@ -0,0 +1,347 @@
+/**
+ * GitHub workspaces: sign in through the GitHub CLI's existing session, list
+ * repositories, and clone one under the clone root so it can be adopted as a
+ * workspace.
+ *
+ * The browser half never sees the token. It posts to one route and gets back
+ * JSON; every GitHub call and every `git` invocation happens here.
+ */
+
+import { spawn } from 'node:child_process'
+import { mkdir, realpath, stat } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+
+/** Absolute path the Host registers; the browser addresses `api/polish.github`. */
+export const GITHUB_ROUTE = '/api/polish.github'
+
+/** Root a clone lands in: `<home>/AryaCode/<owner>/<repo>`. */
+export function cloneRoot(home = homedir()) {
+  return join(home, 'AryaCode')
+}
+
+const SEGMENT = /^[A-Za-z0-9_.-]+$/
+
+/**
+ * Reject a repository part that could escape the clone root.
+ * @param value - owner or repository name from GitHub.
+ * @returns the same value when it is one plain path segment.
+ */
+export function assertSegment(value) {
+  if (typeof value !== 'string' || !SEGMENT.test(value) || value === '.' || value === '..') {
+    throw new Error('repository name must be a single path segment')
+  }
+  return value
+}
+
+/**
+ * Directory one repository clones into.
+ * @param owner - repository owner.
+ * @param name - repository name.
+ * @param home - home directory to root the default clone tree in.
+ * @returns absolute destination path.
+ */
+export function cloneDestination(owner, name, home = homedir()) {
+  return join(cloneRoot(home), assertSegment(owner), assertSegment(name))
+}
+
+/**
+ * Whether a git origin URL already points at this repository.
+ * @param origin - `git remote get-url origin` output.
+ * @param owner - repository owner.
+ * @param name - repository name.
+ * @returns true for either the https or the ssh form of the same repo.
+ */
+export function sameOrigin(origin, owner, name) {
+  const normalized = String(origin).trim().replace(/\.git$/i, '').replace(/\/+$/, '').toLowerCase()
+  return normalized === `https://github.com/${owner}/${name}`.toLowerCase()
+    || normalized === `git@github.com:${owner}/${name}`.toLowerCase()
+}
+
+/**
+ * Run a program and collect its output. Never throws on a non-zero exit.
+ * @param command - executable name.
+ * @param args - arguments.
+ * @param options - extra environment and working directory.
+ * @returns exit code plus captured stdout and stderr.
+ */
+export function runCommand(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never', ...options.env },
+      windowsHide: true,
+    })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', chunk => { stdout += chunk })
+    child.stderr.on('data', chunk => { stderr += chunk })
+    child.on('error', reject)
+    child.on('close', code => { resolve({ code: code ?? 1, stdout, stderr }) })
+  })
+}
+
+/**
+ * Remove the token from text that may reach the browser.
+ * @param text - command output.
+ * @param token - access token.
+ * @returns text with every occurrence replaced.
+ */
+export function scrubToken(text, token) {
+  if (token === undefined || token === '') return text
+  return String(text).split(token).join('[redacted]')
+}
+
+/**
+ * Ask the GitHub CLI for the token it already holds.
+ *
+ * Nothing is stored by this plugin: when `gh` is signed out, the feature says
+ * so instead of collecting a credential of its own.
+ * @param run - command runner, injected by tests.
+ * @returns the token, or undefined when `gh` is missing or signed out.
+ */
+export async function ghToken(run = runCommand) {
+  let answer
+  try {
+    answer = await run('gh', ['auth', 'token'])
+  } catch {
+    return undefined
+  }
+  if (answer.code !== 0) return undefined
+  const token = answer.stdout.trim()
+  return token === '' ? undefined : token
+}
+
+/**
+ * Read the login that owns a token.
+ * @param token - GitHub access token.
+ * @param fetchImpl - HTTP implementation.
+ * @returns the login name.
+ */
+export async function fetchLogin(token, fetchImpl = fetch) {
+  const response = await fetchImpl('https://api.github.com/user', { headers: githubHeaders(token) })
+  if (!response.ok) throw new Error(`GitHub sign-in check failed (${String(response.status)})`)
+  const body = await response.json()
+  const login = body?.login
+  if (typeof login !== 'string' || login === '') throw new Error('GitHub did not return a login')
+  return login
+}
+
+/**
+ * List repositories the token can clone, most recently updated first.
+ * @param token - GitHub access token.
+ * @param fetchImpl - HTTP implementation.
+ * @param pages - most pages of 100 to read.
+ * @returns repository rows in list order.
+ */
+export async function fetchRepos(token, fetchImpl = fetch, pages = 3) {
+  const repos = []
+  let url = 'https://api.github.com/user/repos?per_page=100&sort=updated&affiliation=owner,collaborator,organization_member'
+  for (let page = 0; page < pages && url !== undefined; page += 1) {
+    const response = await fetchImpl(url, { headers: githubHeaders(token) })
+    if (!response.ok) throw new Error(`GitHub repository list failed (${String(response.status)})`)
+    const body = await response.json()
+    if (!Array.isArray(body)) throw new Error('GitHub repository list was not an array')
+    for (const item of body) {
+      const row = readRepo(item)
+      if (row !== undefined) repos.push(row)
+    }
+    url = nextLink(response.headers.get('link'))
+  }
+  return repos
+}
+
+function githubHeaders(token) {
+  return {
+    accept: 'application/vnd.github+json',
+    authorization: `Bearer ${token}`,
+    'user-agent': 'aryacode-polish',
+  }
+}
+
+function readRepo(value) {
+  if (value === null || typeof value !== 'object') return undefined
+  const name = value.name
+  const owner = value.owner !== null && typeof value.owner === 'object' ? value.owner.login : undefined
+  if (typeof name !== 'string' || typeof owner !== 'string') return undefined
+  return {
+    owner,
+    name,
+    fullName: typeof value.full_name === 'string' ? value.full_name : `${owner}/${name}`,
+    isPrivate: value.private === true,
+    isFork: value.fork === true,
+    description: typeof value.description === 'string' ? value.description : '',
+    updatedAt: typeof value.updated_at === 'string' ? value.updated_at : '',
+    defaultBranch: typeof value.default_branch === 'string' ? value.default_branch : '',
+  }
+}
+
+function nextLink(header) {
+  if (typeof header !== 'string' || header === '') return undefined
+  for (const part of header.split(',')) {
+    const match = /<([^>]+)>;\s*rel="next"/.exec(part)
+    if (match?.[1] !== undefined) return match[1]
+  }
+  return undefined
+}
+
+async function directoryExists(path) {
+  try {
+    return (await stat(path)).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+async function existingRealpath(path) {
+  try {
+    return await realpath(path)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Clone a repository, or reuse a directory whose origin is already that repo.
+ *
+ * The token travels in git's environment as an http header, never in the
+ * remote URL and never on the command line, so it cannot leak through `ps` or
+ * a stored remote.
+ * @param owner - repository owner.
+ * @param name - repository name.
+ * @param token - GitHub access token.
+ * @param options - command runner, home directory and optional progress sink.
+ * @returns destination path and whether an existing checkout was kept.
+ */
+export async function cloneRepo(owner, name, token, options = {}) {
+  const run = options.run ?? runCommand
+  const path = cloneDestination(owner, name, options.home)
+  const progress = options.progress ?? (() => {})
+  if (await directoryExists(path)) {
+    const origin = await run('git', ['remote', 'get-url', 'origin'], { cwd: path })
+    if (origin.code === 0 && sameOrigin(origin.stdout, owner, name)) {
+      progress(`Reusing the existing checkout at ${path}`)
+      return { path, reused: true }
+    }
+    throw new Error(`${path} already exists and is not ${owner}/${name}`)
+  }
+  await mkdir(dirname(path), { recursive: true })
+  progress(`Cloning ${owner}/${name} into ${path}`)
+  // GitHub's git server rejects a bearer token, so it is presented as basic auth
+  // through an extra http header in git's own environment.
+  const header = `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString('base64')}`
+  const cloned = await run(
+    'git',
+    ['-c', 'credential.helper=', 'clone', '--progress', '--', `https://github.com/${owner}/${name}.git`, path],
+    {
+      env: {
+        GIT_CONFIG_COUNT: '1',
+        GIT_CONFIG_KEY_0: 'http.extraHeader',
+        GIT_CONFIG_VALUE_0: header,
+      },
+    },
+  )
+  if (cloned.code !== 0) {
+    throw new Error(scrubToken(cloned.stderr || cloned.stdout || 'git clone failed', token))
+  }
+  return { path, reused: false }
+}
+
+/**
+ * Answer one browser request.
+ * @param body - parsed request body.
+ * @param deps - injected GitHub and git implementations.
+ * @returns the JSON value the browser half renders.
+ */
+export async function handleRequest(body, deps = {}) {
+  const action = body?.action
+  const token = await (deps.token ?? ghToken)()
+  if (action === 'status') {
+    if (token === undefined) {
+      return {
+        ok: true,
+        value: { signedIn: false, login: '', root: cloneRoot(deps.home), reason: 'The GitHub CLI is missing or not signed in: run `gh auth login` in a terminal.' },
+      }
+    }
+    const login = await (deps.login ?? fetchLogin)(token)
+    return { ok: true, value: { signedIn: true, login, root: cloneRoot(deps.home), reason: '' } }
+  }
+  if (token === undefined) {
+    return { ok: false, error: 'Sign in with the GitHub CLI first: run `gh auth login` in a terminal, then try again.' }
+  }
+  if (action === 'repos') {
+    const repos = await (deps.repos ?? fetchRepos)(token)
+    const marked = []
+    for (const repo of repos) {
+      const real = await existingRealpath(cloneDestination(repo.owner, repo.name, deps.home))
+      marked.push({ ...repo, cloned: real !== undefined })
+    }
+    return { ok: true, value: { root: cloneRoot(deps.home), repos: marked } }
+  }
+  if (action === 'clone') {
+    const owner = assertSegment(body.owner)
+    const name = assertSegment(body.name)
+    const result = await (deps.clone ?? cloneRepo)(owner, name, token, { home: deps.home })
+    return { ok: true, value: { path: result.path, reused: result.reused } }
+  }
+  return { ok: false, error: `unknown GitHub action: ${String(action)}` }
+}
+
+/**
+ * JSON response helper.
+ * @param value - payload to serialize.
+ * @param status - HTTP status.
+ * @returns a JSON response.
+ */
+export function json(value, status = 200) {
+  return new Response(JSON.stringify(value), {
+    status,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
+  })
+}
+
+/** Mount the route on a context that provides the `connection` service. */
+export const githubFeature = {
+  name: 'polish-github',
+  inject: ['connection'],
+  apply(ctx, config = {}) {
+    ctx.effect(() => ctx.connection.fetch.register({
+      path: GITHUB_ROUTE,
+      // Without a method list the platform would only route GET, which is why the
+      // browser's POST would fall through to the static handler as a 404.
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        if (request.method !== 'POST') return json({ ok: false, error: 'POST only' }, 405)
+        let body
+        try {
+          body = await request.json()
+        } catch {
+          return json({ ok: false, error: 'body must be JSON' }, 400)
+        }
+        try {
+          const deps = {
+            home: typeof config.home === 'string' && config.home !== '' ? config.home : undefined,
+          }
+          return json(await handleRequest(body, deps))
+        } catch (error) {
+          const message = error instanceof Error ? error.message : 'GitHub request failed'
+          return json({ ok: false, error: message })
+        }
+      },
+    }))
+  },
+}
+
+/**
+ * Register one child fiber carrying the GitHub route when a profile mounts the
+ * feature. Kept separate from the switch so turning the switch off removes the
+ * route together with every other surface.
+ * @param ctx - the row's context.
+ * @returns the mounted fiber.
+ */
+export function mountGithub(ctx, config = {}) {
+  return ctx.plugin({ ...githubFeature, config })
+}

package/entries/registry.js

@@ -24,6 +24,7 @@
  */
 
 import { mountCost } from './cost.js'
+import { mountGithub } from './github.js'
 
 /**
  * Every feature this bundle ships. Spelling corrections are investigated and
@@ -52,6 +53,13 @@ export const features = [
     description: 'Add an "Open workspace folder" row to a Session\u2019s menu that opens its workspace in the file browser.',
     defaultOn: true,
   },
+  {
+    id: 'githubWorkspace',
+    label: 'Add a workspace from GitHub',
+    description: 'Sign in with the GitHub CLI, browse your repositories, and clone one as a workspace.',
+    defaultOn: true,
+    mount: mountGithub,
+  },
 ]
 
 /**

package/lib/client.js

@@ -25,11 +25,17 @@ window.__ModuleLoader__.load({
         "label": "Open workspace folder",
         "description": "Add an “Open workspace folder” row to a Session’s menu that opens its workspace in the file browser.",
         "defaultOn": true
+      },
+      {
+        "key": "githubWorkspace",
+        "label": "Add a workspace from GitHub",
+        "description": "Sign in with the GitHub CLI, browse your repositories, and clone one as a workspace.",
+        "defaultOn": true
       }
     ]
     const ROW_ID = "polish"
     const ROW_KEY = "@aryacode/dsh-aryacode-polish" + '#' + ROW_ID
-    const CLIENT_VERSION = "0.4.4"
+    const CLIENT_VERSION = "0.5.0"
 
     /**
      * The two pure decisions behind the balance line: which wallet to show, and how
@@ -685,22 +691,24 @@ window.__ModuleLoader__.load({
         return React.createElement('div', { 'data-polish-balance': 'empty', style: { display: 'none' } })
       }
       const money = formatBalance(wallet)
+      // The foot is a single row shared with the GitHub entry, so the amount stays
+      // bare: a tooltip names it, and nothing here competes for width.
       return React.createElement('div', {
         title: 'Remaining account balance',
+        'data-polish-balance': 'ready',
         style: {
           display: 'flex',
           alignItems: 'center',
           gap: '6px',
-          padding: '2px 8px 4px',
+          padding: '2px 4px 4px 8px',
           fontSize: '12px',
           lineHeight: '16px',
-          minWidth: 0,
-          overflow: 'hidden',
+          flex: '0 0 auto',
           whiteSpace: 'nowrap',
-          textOverflow: 'ellipsis',
           opacity: 0.75,
+          fontVariantNumeric: 'tabular-nums',
         },
-      }, props.wide === false ? money : 'Balance ' + money)
+      }, money)
     }
 
     /**
@@ -771,6 +779,305 @@ window.__ModuleLoader__.load({
       return React.createElement('button', { type: 'button', role: 'menuitem', onClick: onSelect }, label)
     }
 
+    /** The Host route the GitHub halves talk over. Document-relative, like every app route. */
+    const GITHUB_ROUTE = 'api/polish.github'
+
+    /**
+     * Whether the GitHub panel is open. One store for the whole bundle: the footer
+     * row opens it, and the overlay panel is the only reader.
+     */
+    const githubStore = (() => {
+      let open = false
+      const listeners = new Set()
+      return {
+        isOpen: () => open,
+        subscribe(listener) {
+          listeners.add(listener)
+          return () => { listeners.delete(listener) }
+        },
+        set(next) {
+          if (open === next) return
+          open = next
+          for (const listener of listeners) listener()
+        },
+      }
+    })()
+
+    /**
+     * Post one action to the GitHub route.
+     * @param action - `status`, `repos` or `clone`.
+     * @param extra - fields the action needs.
+     * @returns the route's `value`, or throws with its own message.
+     */
+    async function githubCall(action, extra) {
+      const response = await fetch(GITHUB_ROUTE, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ action, ...(extra ?? {}) }),
+      })
+      const payload = await response.json().catch(() => undefined)
+      if (payload === undefined || typeof payload !== 'object') {
+        throw new Error(`the Host answered ${String(response.status)}`)
+      }
+      if (payload.ok !== true) throw new Error(payload.error || 'GitHub request failed')
+      return payload.value
+    }
+
+    /** Modal backdrop and panel skin, matching the Shell's own dialogs. */
+    const GITHUB_BACKDROP_STYLE = {
+      position: 'fixed',
+      inset: 0,
+      zIndex: 1200,
+      display: 'flex',
+      alignItems: 'center',
+      justifyContent: 'center',
+      background: 'rgba(16, 18, 22, 0.32)',
+    }
+
+    const GITHUB_CARD_STYLE = {
+      ...PANEL_STYLE,
+      position: 'static',
+      width: 'min(560px, calc(100vw - 32px))',
+      maxHeight: 'min(560px, calc(100vh - 64px))',
+      display: 'flex',
+      flexDirection: 'column',
+      overflow: 'hidden',
+    }
+
+    const GITHUB_LIST_STYLE = {
+      marginTop: '10px',
+      overflowY: 'auto',
+      borderTop: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.12))',
+    }
+
+    const GITHUB_ROW_STYLE = {
+      display: 'flex',
+      alignItems: 'center',
+      gap: '8px',
+      width: '100%',
+      padding: '8px 4px',
+      border: 'none',
+      background: 'transparent',
+      color: 'inherit',
+      font: 'inherit',
+      textAlign: 'left',
+      cursor: 'pointer',
+      borderBottom: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.08))',
+    }
+
+    const GITHUB_INPUT_STYLE = {
+      width: '100%',
+      boxSizing: 'border-box',
+      padding: '6px 8px',
+      font: 'inherit',
+      color: 'inherit',
+      background: 'transparent',
+      border: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.2))',
+      borderRadius: 'var(--dsw-radius-sm, 6px)',
+    }
+
+    /**
+     * The add-a-workspace-from-GitHub dialog.
+     *
+     * Sign-in is the GitHub CLI's own session: the Host asks `gh` for the token it
+     * already holds, so this dialog never collects a credential. A clone becomes a
+     * workspace through the Workspace Remote, which is the same call the "+" menu
+     * makes after its folder picker returns a path.
+     *
+     * @param props - our lazy `configForms` and the `createWorkspace` opener.
+     * @returns the dialog, or null while it is closed or switched off.
+     */
+    function GitHubPanel(props) {
+      const open = React.useSyncExternalStore(githubStore.subscribe, githubStore.isOpen)
+      const enabled = useSwitch(props.configForms, 'githubWorkspace', true)
+      const [phase, setPhase] = React.useState('idle')
+      const [account, setAccount] = React.useState(undefined)
+      const [repos, setRepos] = React.useState([])
+      const [query, setQuery] = React.useState('')
+      const [error, setError] = React.useState('')
+      const [busy, setBusy] = React.useState('')
+
+      React.useEffect(() => {
+        if (!open || !enabled) return undefined
+        let live = true
+        setPhase('loading')
+        setError('')
+        setBusy('')
+        setQuery('')
+        Promise.resolve()
+          .then(() => githubCall('status'))
+          .then(status => {
+            if (!live) return undefined
+            setAccount(status)
+            if (status.signedIn !== true) return undefined
+            return githubCall('repos').then(list => {
+              if (!live) return
+              setRepos(Array.isArray(list.repos) ? list.repos : [])
+            })
+          })
+          .then(() => { if (live) setPhase('ready') })
+          .catch(reason => {
+            if (!live) return
+            setError(reason instanceof Error ? reason.message : String(reason))
+            setPhase('ready')
+          })
+        return () => { live = false }
+      }, [open, enabled])
+
+      React.useEffect(() => {
+        if (!open) return undefined
+        const onKey = event => { if (event.key === 'Escape') githubStore.set(false) }
+        document.addEventListener('keydown', onKey)
+        return () => document.removeEventListener('keydown', onKey)
+      }, [open])
+
+      if (!open || !enabled) return null
+
+      const signedIn = account !== undefined && account.signedIn === true
+      const needle = query.trim().toLowerCase()
+      const visible = needle === ''
+        ? repos
+        : repos.filter(repo => `${repo.fullName} ${repo.description}`.toLowerCase().includes(needle))
+      const root = account !== undefined && typeof account.root === 'string' ? account.root : ''
+
+      const clone = repo => {
+        if (busy !== '') return
+        setBusy(repo.fullName)
+        setError('')
+        Promise.resolve()
+          .then(() => githubCall('clone', { owner: repo.owner, name: repo.name }))
+          .then(result => Promise.resolve(props.createWorkspace(result.path)).then(() => result))
+          .then(result => {
+            setBusy('')
+            githubStore.set(false)
+            if (typeof console !== 'undefined' && typeof console.info === 'function') {
+              console.info('[aryacode-polish] workspace ready:', result.path)
+            }
+          })
+          .catch(reason => {
+            setBusy('')
+            setError(reason instanceof Error ? reason.message : String(reason))
+          })
+      }
+
+      const rows = visible.slice(0, 200).map(repo => React.createElement('button', {
+        key: repo.fullName,
+        type: 'button',
+        style: GITHUB_ROW_STYLE,
+        disabled: busy !== '',
+        onClick: () => clone(repo),
+        title: repo.description === '' ? repo.fullName : `${repo.fullName} — ${repo.description}`,
+        'data-polish-github-row': repo.fullName,
+      },
+      React.createElement('span', { style: { flex: 1, minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' } },
+        repo.fullName,
+        repo.isPrivate ? React.createElement('span', { style: { marginLeft: '6px', opacity: 0.6 } }, 'private') : null,
+        repo.isFork ? React.createElement('span', { style: { marginLeft: '6px', opacity: 0.6 } }, 'fork') : null),
+      repo.cloned === true
+        ? React.createElement('span', { style: { opacity: 0.6 } }, 'cloned')
+        : null,
+      busy === repo.fullName ? React.createElement('span', { style: { opacity: 0.7 } }, 'cloning…') : null))
+
+      return ReactDOM.createPortal(
+        React.createElement('div', {
+          style: GITHUB_BACKDROP_STYLE,
+          'data-polish-github': 'dialog',
+          onPointerDown: event => { if (event.target === event.currentTarget) githubStore.set(false) },
+        },
+        React.createElement('div', { style: GITHUB_CARD_STYLE, role: 'dialog', 'aria-label': 'Add a workspace from GitHub' },
+          React.createElement('div', { style: { ...PANEL_TITLE_STYLE, marginBottom: '4px' } },
+            React.createElement('span', null, 'Add a workspace from GitHub'),
+            React.createElement('button', {
+              type: 'button',
+              onClick: () => githubStore.set(false),
+              style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7 },
+              'aria-label': 'Close',
+            }, '×')),
+          React.createElement('div', { style: { opacity: 0.75, minHeight: '18px' } },
+            phase === 'loading' && !signedIn ? 'Checking the GitHub CLI session…' : null,
+            signedIn ? `Signed in as ${String(account.login)} · cloning into ${root}` : null,
+            !signedIn && phase !== 'loading'
+              ? 'The GitHub CLI is not signed in. Run `gh auth login` in a terminal, then reopen this dialog.'
+              : null),
+          signedIn
+            ? React.createElement('input', {
+              style: { ...GITHUB_INPUT_STYLE, marginTop: '10px' },
+              value: query,
+              placeholder: 'Search your repositories',
+              'aria-label': 'Search your repositories',
+              autoFocus: true,
+              onChange: event => setQuery(event.target.value),
+            })
+            : null,
+          error !== ''
+            ? React.createElement('div', { style: { marginTop: '10px', color: 'var(--dsw-alias-label-error, #b42318)' } }, error)
+            : null,
+          signedIn
+            ? React.createElement('div', { style: GITHUB_LIST_STYLE, 'data-polish-github-list': String(visible.length) },
+              phase === 'loading' && visible.length === 0 ? React.createElement('div', { style: { padding: '10px 4px', opacity: 0.7 } }, 'Loading repositories…') : null,
+              phase === 'ready' && visible.length === 0 ? React.createElement('div', { style: { padding: '10px 4px', opacity: 0.7 } }, 'No repository matches that search.') : null,
+              ...rows)
+            : null,
+          React.createElement('p', { style: { margin: '10px 0 0', color: 'var(--dsw-alias-label-tertiary, inherit)' } },
+            'The clone is added as a workspace. Sign-in comes from the GitHub CLI, so this plugin stores no token.')))
+        , document.body)
+    }
+
+    /**
+     * The footer row that opens the GitHub dialog.
+     * @param props - our lazy `configForms`.
+     * @returns the row, or null when the feature is switched off.
+     */
+    function GithubEntry(props) {
+      const enabled = useSwitch(props.configForms, 'githubWorkspace', true)
+      if (!enabled) return null
+      return React.createElement('div', { style: { padding: '2px 8px 4px', minWidth: 0 } },
+        React.createElement('button', {
+          type: 'button',
+          'data-polish-github': 'entry',
+          title: 'Add a workspace from GitHub',
+          'aria-label': 'Add a workspace from GitHub',
+          onClick: () => githubStore.set(true),
+          style: {
+            display: 'flex',
+            alignItems: 'center',
+            gap: '6px',
+            maxWidth: '100%',
+            minWidth: 0,
+            padding: '2px 6px',
+            border: 'none',
+            borderRadius: 'var(--dsw-radius-sm, 6px)',
+            background: 'transparent',
+            color: 'var(--dsw-alias-label-tertiary, inherit)',
+            font: 'inherit',
+            fontSize: '12px',
+            lineHeight: '18px',
+            fontVariantNumeric: 'tabular-nums',
+            whiteSpace: 'nowrap',
+            overflow: 'hidden',
+            textOverflow: 'ellipsis',
+            cursor: 'pointer',
+          },
+          onMouseEnter: event => { event.currentTarget.style.background = 'var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.06))' },
+          onMouseLeave: event => { event.currentTarget.style.background = 'transparent' },
+        },
+        React.createElement('svg', {
+          width: 14,
+          height: 14,
+          viewBox: '0 0 16 16',
+          fill: 'none',
+          stroke: 'currentColor',
+          strokeWidth: 1.2,
+          strokeLinecap: 'round',
+          strokeLinejoin: 'round',
+          'aria-hidden': 'true',
+          style: { flex: 'none' },
+        },
+        React.createElement('path', { d: 'M2.5 5.5h4l1.2 1.5h5.8v6.5h-11z' }),
+        React.createElement('path', { d: 'M8 9.8v3.4M6.3 11.5h3.4' })),
+        'Add from GitHub'))
+    }
+
     return {
       inject: ['slots'],
       /**
@@ -833,6 +1140,29 @@ window.__ModuleLoader__.load({
             inject: () => ({ configForms, openFolder, workspaces: workspaceCtx.get('workspaces') }),
           }, OpenFolderMenuItem))
         })
+        // Adding a workspace from GitHub goes through the Workspace service's own
+        // create call — the same one the "+" menu makes once its folder picker
+        // returns a path — so a clone lands in the sidebar exactly like a picked
+        // folder does, with no Harness change anywhere. The service takes the plain
+        // path and throws on refusal; the Remote namespace underneath it is
+        // `ctx.remote.workspace` (singular), which is why this injects the service.
+        ctx.inject(['workspaces'], (githubCtx) => {
+          const createWorkspace = async (path) => {
+            const workspace = await githubCtx.workspaces.create({ path })
+            return workspace
+          }
+          githubCtx.slots.inject('shell.overlay', () => githubCtx.slots.register({
+            name: 'shell.overlay',
+            id: 'polish-github',
+            inject: () => ({ configForms, createWorkspace }),
+          }, GitHubPanel))
+          githubCtx.slots.inject('sidebar.footer.action', () => githubCtx.slots.register({
+            name: 'sidebar.footer.action',
+            id: 'polish-github-entry',
+            order: 4,
+            inject: () => ({ configForms }),
+          }, GithubEntry))
+        })
       },
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryacode/dsh-aryacode-polish",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "AryaCode Polish: one install for the small things that make AryaCode feel finished. One Plugins row, one switch per quality-of-life feature.",
   "keywords": [
     "dsh",
@@ -51,7 +51,7 @@
   "scripts": {
     "build:client": "node scripts/build-client.mjs",
     "prepack": "node scripts/build-client.mjs",
-    "test": "node --test test/patch.spec.mjs test/config.spec.mjs test/registry.spec.mjs test/cost.spec.mjs test/money.spec.mjs test/account.spec.mjs test/docs.spec.mjs test/manifests.spec.mjs test/client-face.spec.mjs"
+    "test": "node --test test/patch.spec.mjs test/config.spec.mjs test/registry.spec.mjs test/cost.spec.mjs test/money.spec.mjs test/account.spec.mjs test/github.spec.mjs test/docs.spec.mjs test/manifests.spec.mjs test/client-face.spec.mjs"
   },
   "dependencies": {
     "zod": "^4.4.3"