dsh-easygit-plugin 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 dsh-git-plugin contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,131 @@
+<div align="center">
+
+# DSH Git Plugin
+
+**A visual Git workbench for inspecting repositories, running common actions, and safely executing AI-generated Git workflows in DeepSeek Harness Web.**
+
+![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-Developer%20Preview-4f46e5)
+![Web profile](https://img.shields.io/badge/profile-Web-0ea5e9)
+[![npm version](https://img.shields.io/npm/v/dsh-easygit-plugin.svg)](https://www.npmjs.com/package/dsh-easygit-plugin)
+[![GitHub repository](https://img.shields.io/badge/GitHub-Repository-181717?logo=github)](https://github.com/IT-coder-Yy/dsh-git-plugin)
+[![MIT License](https://img.shields.io/badge/license-MIT-22c55e)](LICENSE)
+
+English · [简体中文](README.zh-CN.md)
+
+</div>
+
+## How to use
+
+<p align="center">
+  <strong>👀 Inspect Git state &nbsp;→&nbsp; 🖱️ Run a quick action or ask the Agent &nbsp;→&nbsp; ✅ Review &nbsp;→&nbsp; 🚀 Execute</strong>
+</p>
+
+## Preview
+
+![DSH Git Plugin visual workbench](./assets/preview.png)
+
+## Features
+
+1. **Visual repository state**: See the current branch, staged and unstaged files, and each file's formatted review view or raw diff.
+2. **Commit history and details**: Browse the current branch as a commit graph, then click a commit to inspect its message, author, timestamps, parents, changed files, statistics, and full diff.
+3. **One-click Git actions**: Stage or unstage one file or all files, create commits, and create, search, switch, or safely delete local branches directly from the workbench.
+4. **References at a glance**: Inspect local branches, remote branches, and tags without leaving DeepSeek Harness Web.
+5. **Natural-language workflows**: Turn a request into a clear, step-by-step Git command proposal, then execute it directly or copy it for manual execution.
+6. **Safety by default**: Validate commands against a conservative allowlist, require confirmation for high-risk operations, prevent proposal replay, and redact common credentials from diagnostics.
+
+## Quick start
+
+### 0. Allow immediate installation of the new package
+
+Newer versions of `pnpm` may delay recently published packages. To install the latest release immediately, add `dsh-easygit-plugin` to `~/.dsh/profiles/web/pnpm-workspace.yaml`:
+
+```yaml
+minimumReleaseAgeExclude:
+  - dsh-easygit-plugin
+```
+
+### 1. Install the plugin
+
+```sh
+dsh plugin --profile web add dsh-easygit-plugin
+```
+
+### 2. Start DSH Web
+
+```sh
+dsh web
+```
+
+### 3. Open the Git workbench
+
+Use the Git button beside the composer to inspect changes, review commit history, stage files, commit changes, or manage branches with a click.
+
+For a more involved workflow, ask the Agent for a Git operation. For example:
+
+```text
+Commit the documentation update to the current branch with the message "docs: update guide"
+```
+
+Review the generated steps in the Git workbench, then choose direct execution or manual execution.
+
+## Install from source
+
+```sh
+git clone https://github.com/IT-coder-Yy/dsh-git-plugin.git
+cd dsh-git-plugin
+npm install
+npm run build
+dsh plugin --profile web add ${PWD}
+```
+
+## Install from GitHub repository
+
+```sh
+dsh plugin --profile web add github:IT-coder-Yy/dsh-git-plugin
+```
+
+## Update the plugin
+
+```sh
+dsh plugin --profile web update dsh-easygit-plugin
+```
+
+## Uninstall the plugin
+
+```sh
+dsh plugin --profile web remove dsh-easygit-plugin
+```
+
+## How it works
+
+The plugin registers two model tools:
+
+| Tool | Description |
+| --- | --- |
+| `git_repo_state` | Reads the current repository state without modifying it. |
+| `git_propose` | Validates and registers one or more Git steps. |
+
+The Web profile adds a Git action beside the composer and opens the workbench in the native details area. Its tabs provide visual access to working-tree changes and diffs, branches and references, commit history and details, stashes, and Agent-generated proposals. Commands are validated both when a proposal is created and immediately before execution.
+
+## Security
+
+- Each step must contain exactly one allowed `git <subcommand> ...` command.
+- Shell control operators, command substitution, redirection, executable hooks, and unsafe Git options are rejected.
+- High-risk operations require explicit confirmation and proposals can only be executed once.
+- The plugin follows the Shell and sandbox policies provided by DeepSeek Harness; use it only with trusted repositories and trusted Git configuration.
+
+Please report vulnerabilities privately by following [SECURITY.md](SECURITY.md).
+
+## Development
+
+Requires Node.js `^22.19.0 || >=24.0.0`, Git, and a DeepSeek Harness developer preview release that supports static Cordis plugins.
+
+```sh
+npm install
+npm run check
+npm pack --dry-run --ignore-scripts
+```
+
+## License
+
+[MIT](LICENSE)

package/README.zh-CN.md

@@ -0,0 +1,131 @@
+<div align="center">
+
+# DSH Git Plugin
+
+**面向 DeepSeek Harness Web 的可视化 Git 工作台：查看仓库、执行常用操作，并安全运行 AI 生成的 Git 工作流。**
+
+![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-Developer%20Preview-4f46e5)
+![Web profile](https://img.shields.io/badge/profile-Web-0ea5e9)
+[![npm version](https://img.shields.io/npm/v/dsh-easygit-plugin.svg)](https://www.npmjs.com/package/dsh-easygit-plugin)
+[![GitHub repository](https://img.shields.io/badge/GitHub-Repository-181717?logo=github)](https://github.com/IT-coder-Yy/dsh-git-plugin)
+[![MIT License](https://img.shields.io/badge/license-MIT-22c55e)](LICENSE)
+
+[English](README.md) · 简体中文
+
+</div>
+
+## 怎么用
+
+<p align="center">
+  <strong>👀 查看 Git 状态 &nbsp;→&nbsp; 🖱️ 点击快捷操作或询问 Agent &nbsp;→&nbsp; ✅ 检查确认 &nbsp;→&nbsp; 🚀 执行</strong>
+</p>
+
+## 效果预览
+
+![DSH Git Plugin 可视化工作台](./assets/preview.png)
+
+## 功能
+
+1. **可视化仓库状态**：查看当前分支、已暂存和未暂存文件，并查看每个文件的格式化审阅视图或原始 Diff。
+2. **提交记录与详情**：通过提交图浏览当前分支历史；点击提交即可查看提交说明、作者、时间、父提交、变更文件、增删统计和完整 Diff。
+3. **点击执行 Git 操作**：直接暂存或取消暂存单个/全部文件、创建提交，以及新建、搜索、切换或安全删除本地分支。
+4. **集中查看引用**：无需离开 DeepSeek Harness Web，即可查看本地分支、远程分支和标签。
+5. **自然语言工作流**：将自然语言请求转换成清晰、分步骤的 Git 命令提议，然后直接执行或复制到终端手动执行。
+6. **默认安全**：使用保守的命令白名单、高风险操作确认、防重复执行和诊断信息脱敏机制。
+
+## 快速开始
+
+### 0. 允许立即安装新发布的包
+
+较新版本的 `pnpm` 可能延迟安装刚发布的包。若要立即安装最新版本，请在 `~/.dsh/profiles/web/pnpm-workspace.yaml` 中加入：
+
+```yaml
+minimumReleaseAgeExclude:
+  - dsh-easygit-plugin
+```
+
+### 1. 安装插件
+
+```sh
+dsh plugin --profile web add dsh-easygit-plugin
+```
+
+### 2. 启动 DSH Web
+
+```sh
+dsh web
+```
+
+### 3. 打开 Git 工作台
+
+点击输入框旁的 Git 按钮，即可查看变更和提交记录，也可以点击暂存文件、创建提交或管理分支。
+
+遇到更复杂的工作流时，可以用自然语言告诉 Agent。例如：
+
+```text
+将文档更新提交到当前分支，提交信息为 "docs: update guide"
+```
+
+在 Git 工作台中检查生成的步骤，然后选择直接执行或手动执行。
+
+## 从源码安装
+
+```sh
+git clone https://github.com/IT-coder-Yy/dsh-git-plugin.git
+cd dsh-git-plugin
+npm install
+npm run build
+dsh plugin --profile web add ${PWD}
+```
+
+## 从 GitHub 仓库安装
+
+```sh
+dsh plugin --profile web add github:IT-coder-Yy/dsh-git-plugin
+```
+
+## 更新插件
+
+```sh
+dsh plugin --profile web update dsh-easygit-plugin
+```
+
+## 卸载插件
+
+```sh
+dsh plugin --profile web remove dsh-easygit-plugin
+```
+
+## 工作原理
+
+插件注册两个模型工具：
+
+| 工具 | 说明 |
+| --- | --- |
+| `git_repo_state` | 只读获取当前仓库状态。 |
+| `git_propose` | 校验并登记一个或多个 Git 操作步骤。 |
+
+Web profile 会在输入框旁添加 Git 操作入口，并在原生详情区域打开工作台。工作台通过多个标签页集中展示工作区变更与 Diff、分支与引用、提交记录与详情、贮藏，以及 Agent 生成的操作提议。命令会在创建提议时和实际执行前分别进行校验。
+
+## 安全说明
+
+- 每个步骤只能包含一条允许的 `git <子命令> ...` 命令。
+- 禁止 shell 控制符、命令替换、重定向、可执行 hook 和不安全的 Git 选项。
+- 高风险操作必须显式确认，每个提议只能执行一次。
+- 插件遵循 DeepSeek Harness 提供的 Shell 和沙箱策略；请仅在可信仓库和可信 Git 配置中使用。
+
+如需报告安全漏洞，请按照 [SECURITY.md](SECURITY.md) 中的方式私下联系。
+
+## 开发
+
+需要 Node.js `^22.19.0 || >=24.0.0`、Git，以及支持静态 Cordis 插件的 DeepSeek Harness 开发者预览版本。
+
+```sh
+npm install
+npm run check
+npm pack --dry-run --ignore-scripts
+```
+
+## 许可证
+
+[MIT](LICENSE)

package/SECURITY.md

@@ -0,0 +1,23 @@
+# 安全策略
+
+## 支持范围
+
+安全修复优先合入当前开发分支和最新发布版本。`0.x` 阶段接口可能变化，旧预览版本不保证单独回补。
+
+## 报告漏洞
+
+请使用 GitHub 仓库的 **Security → Report a vulnerability** 私下提交报告。不要在公开 Issue、Discussion 或 Pull Request 中披露可利用细节。
+
+报告中请尽量包含：
+
+- 受影响版本和运行环境；
+- 最小复现步骤或测试仓库；
+- 实际影响和预期行为；
+- 已知缓解措施；
+- 是否允许在修复公告中致谢。
+
+维护者会先确认收到报告，再评估影响、修复和披露时间。请在修复发布前保密。
+
+## 安全边界
+
+本插件校验模型提交的命令、隔离会话提议并阻止重放，但执行仍依赖 Harness Shell、沙箱策略、操作系统权限、Git 配置和仓库内容。恶意仓库中的 hook、helper 或其他 Git 配置不属于本插件能够完全隔离的边界；请只在可信环境中运行。

package/git-guide.cordis.yml

@@ -0,0 +1,14 @@
+# dsh-easygit-plugin composition mount patch
+#
+# Temporary use: dsh web --patch ./git-guide.cordis.yml
+# Persistent use: merge this patch into the profile's cordis.patch.yml, or into
+# $DSH_HOME/cordis.patch.yml for all profiles. Install this package first with
+# dsh plugin --profile <name> add dsh-easygit-plugin (or an equivalent command).
+#
+# package.json's dsh.bundle.patch only applies to packages listed in
+# dsh.profile.bundles. A composition-row installation must use --patch or
+# cordis.patch.yml. New top-level plugin rows must use insert; a direct
+# `- id: git-guide / name: ...` entry only patches an existing id and is skipped.
+- insert:
+    - id: git-guide
+      name: dsh-easygit-plugin