dsh-git-branch-manage 1.0.10 → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# 变更日志
+
+本文件记录 `dsh-git-branch-manage` 的重要变更。版本号遵循语义化版本。
+
+## [1.1.0] - 2026-11-02
+
+### 修复
+
+- **宿主里的 `git` 命令全部 `fatal`**（`fatal: unable to parse command-line config`）：0032 的 `GIT_CONFIG_KEY/VALUE_*` 环境注入被 DeepSeek Harness 的子进程环境清洗（按 `/KEY|PASSWORD|SECRET|TOKEN/i` 过滤变量名、并剥掉 `DSH_*` 前缀）半剥离——`KEY_n` 被删、`COUNT/VALUE_n` 幸存。改用 `GIT_CONFIG_GLOBAL` 指向一份会话临时 gitconfig 注入凭据（决策 0034）。
+- **shell 里的 `git` 走本机 gh 账号而非面板令牌**：会话配置用 URL 作用域的空 `helper` 重置，清掉 `~/.gitconfig` 里 `[credential "https://github.com"]` 的 gh helper，让已配置域名命中面板令牌。
+- **未配置域名弹 GCM 凭据对话框 / 挂死**：全局空 `helper` 清空机器 helper 链，未配置域名 `exit 128` 快速失败，不再弹窗。
+- **含空格的 node/helper 路径调用失败**（`sh: C:/Program: No such file or directory`）：`gitconfigEscape` / `shellQuote` 正确转义引号与反斜杠。
+
+### 变更
+
+- 新增 `createCredentialService`，把凭据入口收敛为单一服务（`store` / `authConfigArgs` / `refreshShellEnv` / `dispose`）；routes、`git_network`、密钥工具统一经它取 store 与注入通道（决策 0034）。
+- 桥 helper 环境变量改 `DGB_*` 命名（`DGB_BRIDGE_HELPER` 等），避开 DSH 环境清洗。
+- 新增真实 `git` 端到端回归测试（`shell-bridge-e2e`）：验证已配置域名命中桥令牌、空格路径正确调用、未配置域名快速失败。
+
+## [1.0.10] - 2026-10-30
+
+- shell 里的 `git push` 也走插件密钥（环境变量桥，决策 0032）。注：该注入通道在 DeepSeek Harness 宿主中失效，已由 1.1.0 修正（决策 0034）。
+
+更早版本见 [GitHub Releases](https://github.com/GaoHu1997/dsh-git-branch/releases)。

package/lib/credential-service.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The one entry point every credential channel goes through (decision 0034).
+ *
+ * Before this module the store, the `-c http.<url>.extraHeader` injection
+ * (`authConfigArgs`, 0021/0029) and the shell environment bridge
+ * (`shell-bridge.ts`, 0032/0034) were assembled in three places — the routes,
+ * the two model-facing tools and the plugin entry — each resolving the store
+ * path itself. Every future plugin that needs git credentials would have
+ * repeated that wiring and drifted from it.
+ *
+ * `createCredentialService` owns the store instance and both injection
+ * channels, so callers share one contract:
+ *
+ *  - {@link CredentialService.authConfigArgs} — the `-c extraHeader` pairs for
+ *    git commands the plugin itself runs (panel routes, `git_network`). The
+ *    token rides the argv of that one command and never an environment.
+ *  - {@link CredentialService.refreshShellEnv} — re-derive the session
+ *    gitconfig + `GIT_CONFIG_GLOBAL` environment so a plain shell `git push`
+ *    authenticates as configured. Call it after every store change.
+ *  - {@link CredentialService.dispose} — undo the environment injection and
+ *    delete the session config file (plugin teardown).
+ *
+ * A store that cannot be read degrades to "no credentials" on every channel
+ * (an unauthenticated command runs as it always did; the credentials route is
+ * where the file problem surfaces) — a broken file must never break git.
+ */
+import { type CredentialStore } from './credentials.js';
+/** Host-side seams the service reads through (tests substitute all of them). */
+export interface CredentialServiceDeps {
+    /** User home directory seam. */
+    readonly home: () => string;
+    /** `$DSH_HOME` seam (blank/undefined = unset). */
+    readonly envHome: () => string | undefined;
+    /** Store seam; the fs-backed store at the resolved path when absent. */
+    readonly store?: CredentialStore;
+    /** The environment object to mutate; `process.env` when absent. */
+    readonly env?: Record<string, string | undefined>;
+    /** Absolute helper script path; the compiled sibling under `helpers/` when absent. */
+    readonly helperPath?: string;
+    /** Node executable that runs the helper; `process.execPath` when absent. */
+    readonly nodePath?: string;
+    /** Directory for the session config; the OS temp dir when absent. */
+    readonly configDir?: () => string;
+    /** Exact session config path (tests); derived from the pid when absent. */
+    readonly configPath?: string;
+    /** User global config the session file includes; `<home>/.gitconfig` when absent. */
+    readonly userGitconfig?: string;
+}
+/** The single credential entry point. */
+export interface CredentialService {
+    /** The shared global store (one row per remote host). */
+    readonly store: CredentialStore;
+    /**
+     * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
+     * prepend to a git network command the plugin runs itself. A broken store
+     * degrades to "no credentials" rather than throwing.
+     */
+    readonly authConfigArgs: () => Promise<readonly string[]>;
+    /**
+     * Re-derive the shell credential environment after a credential changed, so
+     * a message sent in the same session can `git push` with the token the user
+     * just saved. Never throws: the worst case is a stale environment until the
+     * next refresh.
+     */
+    readonly refreshShellEnv: () => Promise<void>;
+    /** Remove the environment injection and delete the session config file. */
+    readonly dispose: () => Promise<void>;
+}
+/**
+ * Build the credential service for one host process: one store instance, one
+ * session-gitconfig bridge, shared by the routes and every tool.
+ * @param deps - host seams (see {@link CredentialServiceDeps}).
+ */
+export declare function createCredentialService(deps: CredentialServiceDeps): CredentialService;

package/lib/credential-service.js

@@ -0,0 +1,56 @@
+/**
+ * The one entry point every credential channel goes through (decision 0034).
+ *
+ * Before this module the store, the `-c http.<url>.extraHeader` injection
+ * (`authConfigArgs`, 0021/0029) and the shell environment bridge
+ * (`shell-bridge.ts`, 0032/0034) were assembled in three places — the routes,
+ * the two model-facing tools and the plugin entry — each resolving the store
+ * path itself. Every future plugin that needs git credentials would have
+ * repeated that wiring and drifted from it.
+ *
+ * `createCredentialService` owns the store instance and both injection
+ * channels, so callers share one contract:
+ *
+ *  - {@link CredentialService.authConfigArgs} — the `-c extraHeader` pairs for
+ *    git commands the plugin itself runs (panel routes, `git_network`). The
+ *    token rides the argv of that one command and never an environment.
+ *  - {@link CredentialService.refreshShellEnv} — re-derive the session
+ *    gitconfig + `GIT_CONFIG_GLOBAL` environment so a plain shell `git push`
+ *    authenticates as configured. Call it after every store change.
+ *  - {@link CredentialService.dispose} — undo the environment injection and
+ *    delete the session config file (plugin teardown).
+ *
+ * A store that cannot be read degrades to "no credentials" on every channel
+ * (an unauthenticated command runs as it always did; the credentials route is
+ * where the file problem surfaces) — a broken file must never break git.
+ */
+import { authConfigArgs, createCredentialStore, credentialFilePath, } from './credentials.js';
+import { createShellBridge } from './shell-bridge.js';
+/**
+ * Build the credential service for one host process: one store instance, one
+ * session-gitconfig bridge, shared by the routes and every tool.
+ * @param deps - host seams (see {@link CredentialServiceDeps}).
+ */
+export function createCredentialService(deps) {
+    const store = deps.store
+        ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const bridgeDeps = { ...deps, store };
+    const shellBridge = createShellBridge(bridgeDeps);
+    return {
+        store,
+        async authConfigArgs() {
+            try {
+                return authConfigArgs(await store.load());
+            }
+            catch {
+                return [];
+            }
+        },
+        refreshShellEnv() {
+            return shellBridge.apply();
+        },
+        dispose() {
+            return shellBridge.dispose();
+        },
+    };
+}

package/lib/helpers/git-credential-bridge.d.ts

@@ -4,28 +4,33 @@
  * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
  * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
  * This helper extends that coverage to a plain shell `git push`: the plugin's
- * host process exports `GIT_CONFIG_COUNT/KEY/VALUE` entries that install this
- * script as a URL-scoped credential helper for every stored host, so commands
- * the model runs in the shell authenticate as the configured account too.
+ * host process writes a session gitconfig (see `src/shell-bridge.ts`) that
+ * installs this script as a URL-scoped credential helper for every stored
+ * host, so commands the model runs in the shell authenticate as the
+ * configured account too.
  *
- * Design constraints (see docs/decisions/0029 and 0032):
+ * Design constraints (see docs/decisions/0029, 0032 and 0034):
  *  - The user's global git config and credential helpers are never written;
- *    the injection lives in the process environment only.
+ *    the injection lives in one generated session config plus the process
+ *    environment only.
  *  - The token never enters the conversation: this script reads the
  *    credential file directly on the host and answers git on stdout.
- *  - URL scope (`credential.https://<host>/.helper`) confines the helper to
- *    hosts with a stored credential. The host half also clears the machine
- *    helper list, so a host this script cannot answer fails fast instead of
- *    opening an interactive credential dialog.
+ *  - URL scope (`credential.https://<host>/`) confines the helper to hosts
+ *    with a stored credential. The host half also clears the machine helper
+ *    list, so a host this script cannot answer fails fast instead of opening
+ *    an interactive credential dialog.
  *  - `get` is silent on a miss (git falls through to the next helper);
  *    `store`/`erase` are pass-through by decision — writing back would race
  *    the panel's atomic save and leak the file shape.
  *
- * Environment contract (set by src/shell-bridge.ts):
- *  - `DSH_GIT_BRIDGE_HELPER` — credential file path (required).
- *  - `DSH_GIT_BRIDGE_HOME` — user home directory (fallback resolution).
- *  - `DSH_GIT_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
- *  - `DSH_GIT_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
+ * Environment contract (set by src/shell-bridge.ts). The names carry no
+ * KEY/PASSWORD/SECRET/TOKEN substring and no `DSH_` prefix, because the DSH
+ * subprocess scrubber strips exactly those from inherited environments
+ * (decision 0034; a stripped path made this helper read the wrong file):
+ *  - `DGB_BRIDGE_HELPER` — credential file path (required).
+ *  - `DGB_BRIDGE_HOME` — user home directory (fallback resolution).
+ *  - `DGB_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
+ *  - `DGB_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
  *
  * @module dsh-git-branch/git-credential-bridge
  */

package/lib/helpers/git-credential-bridge.js

@@ -4,28 +4,33 @@
  * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
  * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
  * This helper extends that coverage to a plain shell `git push`: the plugin's
- * host process exports `GIT_CONFIG_COUNT/KEY/VALUE` entries that install this
- * script as a URL-scoped credential helper for every stored host, so commands
- * the model runs in the shell authenticate as the configured account too.
+ * host process writes a session gitconfig (see `src/shell-bridge.ts`) that
+ * installs this script as a URL-scoped credential helper for every stored
+ * host, so commands the model runs in the shell authenticate as the
+ * configured account too.
  *
- * Design constraints (see docs/decisions/0029 and 0032):
+ * Design constraints (see docs/decisions/0029, 0032 and 0034):
  *  - The user's global git config and credential helpers are never written;
- *    the injection lives in the process environment only.
+ *    the injection lives in one generated session config plus the process
+ *    environment only.
  *  - The token never enters the conversation: this script reads the
  *    credential file directly on the host and answers git on stdout.
- *  - URL scope (`credential.https://<host>/.helper`) confines the helper to
- *    hosts with a stored credential. The host half also clears the machine
- *    helper list, so a host this script cannot answer fails fast instead of
- *    opening an interactive credential dialog.
+ *  - URL scope (`credential.https://<host>/`) confines the helper to hosts
+ *    with a stored credential. The host half also clears the machine helper
+ *    list, so a host this script cannot answer fails fast instead of opening
+ *    an interactive credential dialog.
  *  - `get` is silent on a miss (git falls through to the next helper);
  *    `store`/`erase` are pass-through by decision — writing back would race
  *    the panel's atomic save and leak the file shape.
  *
- * Environment contract (set by src/shell-bridge.ts):
- *  - `DSH_GIT_BRIDGE_HELPER` — credential file path (required).
- *  - `DSH_GIT_BRIDGE_HOME` — user home directory (fallback resolution).
- *  - `DSH_GIT_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
- *  - `DSH_GIT_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
+ * Environment contract (set by src/shell-bridge.ts). The names carry no
+ * KEY/PASSWORD/SECRET/TOKEN substring and no `DSH_` prefix, because the DSH
+ * subprocess scrubber strips exactly those from inherited environments
+ * (decision 0034; a stripped path made this helper read the wrong file):
+ *  - `DGB_BRIDGE_HELPER` — credential file path (required).
+ *  - `DGB_BRIDGE_HOME` — user home directory (fallback resolution).
+ *  - `DGB_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
+ *  - `DGB_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
  *
  * @module dsh-git-branch/git-credential-bridge
  */
@@ -34,7 +39,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 /** git helpers receive exactly one argument: the operation. */
 const OPERATION = process.argv[2] ?? 'get';
-/** The credential file this helper reads (`DSH_GIT_BRIDGE_HELPER` wins). */
+/** The credential file this helper reads (`DGB_BRIDGE_HELPER` wins). */
 const DEFAULT_CREDENTIAL_FILE = 'git-credentials.json';
 /** The dsh home directory below the user profile when `$DSH_HOME` is unset. */
 const PACKAGE_HOME = '.dsh';
@@ -45,7 +50,7 @@ const TOKEN_USERNAME = 'oauth2';
  * break the credential lookup.
  */
 function debug(line) {
-    const path = process.env.DSH_GIT_BRIDGE_DEBUG;
+    const path = process.env.DGB_BRIDGE_DEBUG;
     if (path === undefined || path.trim() === '')
         return;
     try {
@@ -55,16 +60,16 @@ function debug(line) {
         // Deliberately swallowed: debugging is best-effort.
     }
 }
-/** The credential file this helper reads (`DSH_GIT_BRIDGE_HELPER` wins). */
+/** The credential file this helper reads (`DGB_BRIDGE_HELPER` wins). */
 function credentialFile() {
-    const helper = process.env.DSH_GIT_BRIDGE_HELPER;
+    const helper = process.env.DGB_BRIDGE_HELPER;
     if (helper !== undefined && helper.trim() !== '')
         return helper;
-    const dshHome = process.env.DSH_GIT_BRIDGE_DSH_HOME;
+    const dshHome = process.env.DGB_BRIDGE_DSH_HOME;
     const home = dshHome !== undefined && dshHome.trim() !== ''
         ? dshHome
-        : process.env.DSH_GIT_BRIDGE_HOME ?? homedir();
-    return join(home, DEFAULT_CREDENTIAL_FILE);
+        : process.env.DGB_BRIDGE_HOME ?? homedir();
+    return join(home, PACKAGE_HOME, DEFAULT_CREDENTIAL_FILE);
 }
 /** One `key=value` request from git on stdin. */
 function readRequest() {

package/lib/index.js

@@ -13,7 +13,7 @@ import { handleCredentials, handleCredentialsDelete, handleCredentialsOAuthPoll,
 import { validateRootDir } from './settings.js';
 import { gitNetworkTool } from './network-tool.js';
 import { gitCredentialsTool } from './tool.js';
-import { createShellBridge } from './shell-bridge.js';
+import { createCredentialService } from './credential-service.js';
 import { ROUTE_AI_COMMIT_MESSAGE, ROUTE_BRANCH, ROUTE_BRANCH_DELETE, ROUTE_BRANCH_RENAME, ROUTE_CHANGES, ROUTE_COMMIT, ROUTE_COMMIT_FILES, ROUTE_CREDENTIALS, ROUTE_CREDENTIALS_DELETE, ROUTE_CREDENTIALS_OAUTH_POLL, ROUTE_CREDENTIALS_OAUTH_START, ROUTE_CREDENTIALS_SAVE, ROUTE_ENSURE_DIRECTORY, ROUTE_EXISTS, ROUTE_FETCH, ROUTE_GROUP, ROUTE_INSPECT, ROUTE_LOG, ROUTE_PUSH, ROUTE_PURGE, ROUTE_REMOTE, ROUTE_REMOTES, ROUTE_REMOVE, ROUTE_STAGE, ROUTE_STATUS, ROUTE_SWITCH, ROUTE_TAG, ROUTE_TAG_PUSH, ROUTE_UPDATE, ROUTE_WORKTREE, ROUTE_WORKTREES_ALL } from './wire.js';
 export const name = 'dsh-git-branch';
 export const inject = [];
@@ -142,14 +142,19 @@ export function sectionOf(config) {
 export function apply(ctx, config = {}) {
     validateConfig(config);
     const currentConfig = () => ctx.fiber?.config ?? config;
-    // Host half of the shell credential bridge: derive the environment that
-    // lets a plain `git push` in a spawned shell authenticate with the panel's
-    // stored token instead of the machine helper's account. It also clears the
-    // machine helper chain, so a host without a stored token fails fast rather
-    // than opening a credential dialog no agent shell can answer. Applied at
-    // activate and re-derived after every credential save / delete / sign-in.
-    const shellBridge = createShellBridge({ home: () => homedir(), envHome: () => process.env.DSH_HOME });
-    void shellBridge.apply();
+    // Host half of the credential channels: one service owns the store, the
+    // `-c extraHeader` injection for plugin-run commands and the shell bridge
+    // (decision 0034). The bridge lets a plain `git push` in a spawned shell
+    // authenticate with the panel's stored token instead of the machine helper's
+    // account. It also clears the machine helper chain, so a host without a
+    // stored token fails fast rather than opening a credential dialog no agent
+    // shell can answer. Applied at activate and re-derived after every
+    // credential save / delete / sign-in.
+    const credentials = createCredentialService({ home: () => homedir(), envHome: () => process.env.DSH_HOME });
+    void credentials.refreshShellEnv();
+    ctx.effect(() => () => {
+        void credentials.dispose();
+    }, 'git-worktree: credential service dispose');
     const deps = () => ({
         exec: childProcessExec,
         sectionRootDir: () => readVolatile(currentConfig().rootDir),
@@ -159,7 +164,8 @@ export function apply(ctx, config = {}) {
         sectionCnAccelerateUrl: () => readVolatile(currentConfig().cnAccelerateUrl),
         home: () => homedir(),
         envHome: () => process.env.DSH_HOME,
-        refreshShellBridge: () => shellBridge.apply(),
+        credentialsService: credentials,
+        refreshShellBridge: () => credentials.refreshShellEnv(),
     });
     // In dsh 0.1.7+, the settings service projects volatile Config fields into forms.
     // We configure auto: false to inform the host that this plugin provides its own
@@ -173,7 +179,7 @@ export function apply(ctx, config = {}) {
     // unless the user explicitly asked to see it.
     ctx.inject(['tools'], (toolsCtx) => {
         const tools = toolsCtx.tools;
-        toolsCtx.effect(() => tools.register(gitCredentialsTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_credentials tool');
+        toolsCtx.effect(() => tools.register(gitCredentialsTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME, credentialsService: credentials })), 'git-worktree: git_credentials tool');
         // The panel routes inject the stored credentials into the requests the
         // browser half makes; a shell command is served by the environment bridge
         // (see `shell-bridge.ts`) instead. This tool is the deterministic path for
@@ -181,7 +187,7 @@ export function apply(ctx, config = {}) {
         // http.<url>.extraHeader` prefix, so the command authenticates as the
         // configured account and the secret never enters the conversation — even
         // when the bridge is missing (an older host, a shell outside the plugin).
-        toolsCtx.effect(() => tools.register(gitNetworkTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_network tool');
+        toolsCtx.effect(() => tools.register(gitNetworkTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME, credentialsService: credentials })), 'git-worktree: git_network tool');
     });
     ctx.inject(['webServer'], (webCtx) => {
         /** Send one outcome as JSON; no-store because repo facts are point-in-time. */

package/lib/network-tool.d.ts

@@ -20,6 +20,7 @@
  * @module dsh-git-branch/network-tool
  */
 import { type CredentialStore, type GitCredential } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 import { type Exec } from './git.js';
 /** Model-facing tool name. */
 export declare const GIT_NETWORK_TOOL_NAME = "git_network";
@@ -66,6 +67,9 @@ export interface GitNetworkToolDeps {
     readonly envHome: () => string | undefined;
     /** Store seam; the fs-backed store at the resolved path when absent. */
     readonly store?: CredentialStore;
+    /** The single credential entry point (decision 0034); when wired its store
+     * is shared with the routes and the shell bridge. */
+    readonly credentialsService?: CredentialService;
     /** Process seam; the real `git` over node:child_process when absent. */
     readonly exec?: Exec;
 }

package/lib/network-tool.js

@@ -162,7 +162,7 @@ export function renderGitNetwork(value) {
  * @returns a definition ready for `ctx.tools.register`.
  */
 export function gitNetworkTool(deps) {
-    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
     const exec = deps.exec ?? childProcessExec;
     return {
         name: GIT_NETWORK_TOOL_NAME,

package/lib/routes.d.ts

@@ -4,6 +4,7 @@
  */
 import { type CopyFilesSeams } from './copy-files.js';
 import { type CredentialStore } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 import { type DirExists, type ExcludeSeams, type Exec } from './git.js';
 import type { AiCommitMessageResult, ChangesResult, CommitFilesResult, CommitResult, CreateBranchResult, CreateTagResult, CreateWorktreeResult, CredentialOAuthPollResult, CredentialOAuthStartResult, CredentialsResult, EnsureDirectoryResult, FetchResult, GroupWorkspacesResult, InspectWorktreeResult, LogResult, PathExistsResult, PurgeDirectoryResult, PushTagResult, RemoveWorktreeResult, RemotesResult, RepoStatus, RouteError, StageResult, SwitchResult, UpdateResult, WorktreesAllResult } from './wire.js';
 /** Everything the handlers need from the host half. */
@@ -44,6 +45,9 @@ export interface RouteDeps {
     /** Global per-host credential store. Absent = the fs-backed store at the
      * resolved dsh home; tests substitute an in-memory one. */
     credentialsStore?: CredentialStore;
+    /** The single credential entry point (decision 0034): when wired, it owns
+     * the store and both injection channels, and the seams below are ignored. */
+    credentialsService?: CredentialService;
     /** Re-derive the shell credential bridge after the store changed (absent =
      * a host that does not provide the bridge; tests omit it). */
     refreshShellBridge?: () => Promise<void>;

package/lib/routes.js

@@ -53,10 +53,11 @@ function accelPrefix(deps) {
     const url = deps.sectionCnAccelerateUrl?.() ?? ACCEL_DEFAULT_URL;
     return accelerateUrlError(url) === undefined ? normalizeAccelerateUrl(url) : undefined;
 }
-/** The global credential store: the wired one, else the fs-backed file at the
- * resolved dsh home (`<dshHome>/git-credentials.json`). */
+/** The global credential store: the service's shared instance (decision 0034),
+ * else the wired store, else the fs-backed file at the resolved dsh home
+ * (`<dshHome>/git-credentials.json`). */
 function credentialStore(deps) {
-    return deps.credentialsStore ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    return deps.credentialsService?.store ?? deps.credentialsStore ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
 }
 /**
  * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
@@ -66,6 +67,8 @@ function credentialStore(deps) {
  * route is where the file problem surfaces.
  */
 async function authArgsFor(deps) {
+    if (deps.credentialsService !== undefined)
+        return deps.credentialsService.authConfigArgs();
     try {
         return authConfigArgs(await credentialStore(deps).load());
     }
@@ -81,10 +84,11 @@ async function authArgsFor(deps) {
  * save (an added host is not reachable, a deleted one may still be).
  */
 async function refreshBridge(deps) {
-    if (deps.refreshShellBridge === undefined)
+    const refresh = deps.credentialsService?.refreshShellEnv ?? deps.refreshShellBridge;
+    if (refresh === undefined)
         return;
     try {
-        await deps.refreshShellBridge();
+        await refresh();
     }
     catch {
         // Deliberately swallowed; see the contract above.

package/lib/shell-bridge.d.ts

@@ -1,35 +1,53 @@
 /**
- * Shell credential bridge (host half). The credential panel stores one token
- * per remote host, but 0029 could only inject it into the panel's own routes
- * and the `git_network` tool; a plain `git push` run in a shell authenticated
- * as whatever the machine's credential helper held — often a different
- * account — or hung on an interactive prompt nobody could answer.
+ * Shell credential bridge (host half) — session gitconfig channel. The
+ * credential panel stores one token per remote host, but 0029 could only
+ * inject it into the panel's own routes and the `git_network` tool; a plain
+ * `git push` run in a shell authenticated as whatever the machine's
+ * credential helper held — often a different account — or hung on an
+ * interactive prompt nobody could answer.
  *
- * This module closes that gap without touching the user's git configuration
- * FILES (0021's constraint): it exports `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
- * `GIT_CONFIG_VALUE_n` entries that install the bundled credential helper
- * (`helpers/git-credential-bridge.js`) as a URL-scoped helper for every stored
- * host. git reads that environment as configuration, every child process the
- * host spawns inherits it, and a non-empty value list is always preceded by the
- * same key with an empty value — git resets the accumulated helper list
- * there, so the machine chain (`helper-selector` → GCM) can neither answer
- * with a different account nor open a blocking dialog for those hosts.
- * The list is reset globally as well: a host with no stored credential then
- * fails at once ("terminal prompts disabled") instead of reaching the machine
- * chain, whose interactive GUI dialog nobody in an agent shell can answer.
+ * 0032 closed that gap with `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
+ * `GIT_CONFIG_VALUE_n` environment entries. That channel is dead on a DSH
+ * host: the subprocess environment scrubber
+ * (`@deepseek-ai/dsh-subprocess`, `SENSITIVE_ENV_PATTERN = /KEY|PASSWORD|SECRET|TOKEN/i`
+ * plus every `DSH_*` name) strips the `GIT_CONFIG_KEY_*` names and keeps
+ * `GIT_CONFIG_COUNT`/`VALUE_*`, so git starts with a half-parsed config and
+ * dies with `fatal: unable to parse command-line config` — every git command
+ * in the shell, not only the networked ones (0034).
  *
- * `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` ride along so a host
- * with no usable credential fails fast instead of parking a shell on a prompt
- * (the failure mode that started this: a 3m38s silent hang).
+ * The replacement writes ONE generated gitconfig per host process and points
+ * git at it with `GIT_CONFIG_GLOBAL` — a name the scrubber keeps. The file:
  *
- * The assignments are re-derived whenever the credential store changes
+ *  1. `[include]`s the user's own `~/.gitconfig` (read-only; 0021's "never
+ *     write the user's git config files" stands) so identity, proxies and
+ *     `http.sslBackend` keep working;
+ *  2. resets the whole `credential.helper` list to empty, cutting the machine
+ *     chain (`helper-selector` → GCM) and any helper the included user config
+ *     carries (the local `gh` helper being the motivating case);
+ *  3. per stored host, resets that URL scope and then installs the bundled
+ *     helper (`helpers/git-credential-bridge.js`) as a `!`-shell command.
+ *
+ * A host with no stored credential then fails at once ("terminal prompts
+ * disabled") instead of reaching the machine chain, whose interactive GUI
+ * dialog nobody in an agent shell can answer. `GIT_TERMINAL_PROMPT=0` and
+ * `GCM_INTERACTIVE=never` ride along as the last line of defence.
+ *
+ * Environment contract (all names survive the scrubber — no KEY/PASSWORD/
+ * SECRET/TOKEN substring, no `DSH_` prefix):
+ *  - `GIT_CONFIG_GLOBAL` — the generated session config (0034).
+ *  - `DGB_BRIDGE_HELPER` — credential file path for the helper script.
+ *  - `GIT_TERMINAL_PROMPT` / `GCM_INTERACTIVE` — fail fast, never prompt.
+ *
+ * The file is re-derived whenever the credential store changes
  * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
  */
 import { type CredentialStore } from './credentials.js';
 /** Env var carrying the credential file path to the helper script. */
-export declare const BRIDGE_HELPER_ENV = "DSH_GIT_BRIDGE_HELPER";
+export declare const BRIDGE_HELPER_ENV = "DGB_BRIDGE_HELPER";
 /** Env var carrying a debug log path to the helper script (unset by default). */
-export declare const BRIDGE_DEBUG_ENV = "DSH_GIT_BRIDGE_DEBUG";
+export declare const BRIDGE_DEBUG_ENV = "DGB_BRIDGE_DEBUG";
+/** Env var pointing git at the generated session configuration file. */
+export declare const SESSION_GITCONFIG_ENV = "GIT_CONFIG_GLOBAL";
 /** Host-side seams the bridge reads through (tests substitute all of them). */
 export interface ShellBridgeDeps {
     /** User home directory seam. */
@@ -45,21 +63,31 @@ export interface ShellBridgeDeps {
     readonly helperPath?: string;
     /** Node executable that runs the helper; `process.execPath` when absent. */
     readonly nodePath?: string;
+    /** Directory for the session config; the OS temp dir when absent. */
+    readonly configDir?: () => string;
+    /** Exact session config path (tests); `<configDir>/dsh-git-branch-<pid>.gitconfig` when absent. */
+    readonly configPath?: string;
+    /** User global config the session file includes; `<home>/.gitconfig` when absent. */
+    readonly userGitconfig?: string;
 }
-/** The bridge's one operation: re-derive the environment from the store. */
+/** The bridge's operations: re-derive the environment, and undo it. */
 export interface ShellBridge {
     /** Read the credential store and rewrite the injected environment.
      * A store that cannot be read drops every URL-scoped helper (no host can be
      * bridged), but keeps the global reset, so shell git still fails fast
      * instead of opening an interactive credential dialog. */
     readonly apply: () => Promise<void>;
+    /** Remove the injected environment and delete the session config file. */
+    readonly dispose: () => Promise<void>;
+    /** The session config path this bridge writes. */
+    readonly configPath: () => string;
 }
 /** One ordered environment assignment. */
 export type BridgeAssignment = readonly [key: string, value: string];
 /**
  * Quote one executable or path for git's `!` shell command. Backslashes are
  * normalized to forward slashes first: git runs `!` helpers through `sh`,
- * where `C:\…` would be read as escape sequences.
+ * where `C:\\…` would be read as escape sequences.
  * @param value - an absolute path.
  */
 export declare function shellQuote(value: string): string;
@@ -72,22 +100,44 @@ export declare function shellQuote(value: string): string;
  */
 export declare function bridgeCommand(nodePath: string, helperPath: string): string;
 /**
- * The ordered environment assignments for the given hosts: per host an empty
- * helper value (git resets the accumulated list for that URL scope) and then
- * the bridge command, plus the credential-file variable the helper reads and
- * the two fail-fast switches.
+ * Escape one value for a gitconfig line: a literal `"` becomes `\"`, which is
+ * how a quoted path survives git's config parser and still reaches `sh`
+ * intact. Without this the quotes are eaten and `sh` splits
+ * `C:/Program Files/…` on the space.
+ * @param value - the raw helper command.
+ */
+export declare function gitconfigEscape(value: string): string;
+/**
+ * The session gitconfig body for the given hosts: the user's own config
+ * included (read-only), the whole machine helper list reset to empty, and per
+ * host a URL-scoped reset followed by the bridge command. The empty value
+ * before each command is what cuts the included `gh` helper (and any other
+ * helper the user configures for that URL) out of that scope.
  * @param hosts - normalized hosts with a stored credential.
- * @param options - process paths and the credential file.
+ * @param options - the node/helper pair and the user config to include.
  */
-export declare function shellBridgeEnv(hosts: readonly string[], options: {
+export declare function sessionGitconfigBody(hosts: readonly string[], options: {
     readonly nodePath: string;
     readonly helperPath: string;
+    readonly userGitconfig?: string;
+}): string;
+/**
+ * The environment assignments pointing git at the session config: the config
+ * path itself, the credential file the helper reads, and the two fail-fast
+ * switches. `hosts` live in the file now, not in the environment.
+ * @param options - the session config path and the credential file.
+ */
+export declare function shellBridgeEnv(options: {
+    readonly configPath: string;
     readonly credentialFile: string;
 }): readonly BridgeAssignment[];
 /**
  * Build the bridge over one host process. Every {@link ShellBridge.apply}
- * first removes the assignments it made last time, so a deleted host loses
- * its helper scope just like a freshly added one gains it.
+ * rewrites the session config for the current store and re-points the
+ * environment at it, so a deleted host loses its helper scope just like a
+ * freshly added one gains it. A config file that cannot be written leaves
+ * `GIT_CONFIG_GLOBAL` untouched (git then runs with the machine config —
+ * unauthenticated at worst) while the fail-fast switches still go out.
  * @param deps - host seams.
  */
 export declare function createShellBridge(deps: ShellBridgeDeps): ShellBridge;

package/lib/shell-bridge.js

@@ -1,40 +1,61 @@
 /**
- * Shell credential bridge (host half). The credential panel stores one token
- * per remote host, but 0029 could only inject it into the panel's own routes
- * and the `git_network` tool; a plain `git push` run in a shell authenticated
- * as whatever the machine's credential helper held — often a different
- * account — or hung on an interactive prompt nobody could answer.
+ * Shell credential bridge (host half) — session gitconfig channel. The
+ * credential panel stores one token per remote host, but 0029 could only
+ * inject it into the panel's own routes and the `git_network` tool; a plain
+ * `git push` run in a shell authenticated as whatever the machine's
+ * credential helper held — often a different account — or hung on an
+ * interactive prompt nobody could answer.
  *
- * This module closes that gap without touching the user's git configuration
- * FILES (0021's constraint): it exports `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
- * `GIT_CONFIG_VALUE_n` entries that install the bundled credential helper
- * (`helpers/git-credential-bridge.js`) as a URL-scoped helper for every stored
- * host. git reads that environment as configuration, every child process the
- * host spawns inherits it, and a non-empty value list is always preceded by the
- * same key with an empty value — git resets the accumulated helper list
- * there, so the machine chain (`helper-selector` → GCM) can neither answer
- * with a different account nor open a blocking dialog for those hosts.
- * The list is reset globally as well: a host with no stored credential then
- * fails at once ("terminal prompts disabled") instead of reaching the machine
- * chain, whose interactive GUI dialog nobody in an agent shell can answer.
+ * 0032 closed that gap with `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
+ * `GIT_CONFIG_VALUE_n` environment entries. That channel is dead on a DSH
+ * host: the subprocess environment scrubber
+ * (`@deepseek-ai/dsh-subprocess`, `SENSITIVE_ENV_PATTERN = /KEY|PASSWORD|SECRET|TOKEN/i`
+ * plus every `DSH_*` name) strips the `GIT_CONFIG_KEY_*` names and keeps
+ * `GIT_CONFIG_COUNT`/`VALUE_*`, so git starts with a half-parsed config and
+ * dies with `fatal: unable to parse command-line config` — every git command
+ * in the shell, not only the networked ones (0034).
  *
- * `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` ride along so a host
- * with no usable credential fails fast instead of parking a shell on a prompt
- * (the failure mode that started this: a 3m38s silent hang).
+ * The replacement writes ONE generated gitconfig per host process and points
+ * git at it with `GIT_CONFIG_GLOBAL` — a name the scrubber keeps. The file:
  *
- * The assignments are re-derived whenever the credential store changes
+ *  1. `[include]`s the user's own `~/.gitconfig` (read-only; 0021's "never
+ *     write the user's git config files" stands) so identity, proxies and
+ *     `http.sslBackend` keep working;
+ *  2. resets the whole `credential.helper` list to empty, cutting the machine
+ *     chain (`helper-selector` → GCM) and any helper the included user config
+ *     carries (the local `gh` helper being the motivating case);
+ *  3. per stored host, resets that URL scope and then installs the bundled
+ *     helper (`helpers/git-credential-bridge.js`) as a `!`-shell command.
+ *
+ * A host with no stored credential then fails at once ("terminal prompts
+ * disabled") instead of reaching the machine chain, whose interactive GUI
+ * dialog nobody in an agent shell can answer. `GIT_TERMINAL_PROMPT=0` and
+ * `GCM_INTERACTIVE=never` ride along as the last line of defence.
+ *
+ * Environment contract (all names survive the scrubber — no KEY/PASSWORD/
+ * SECRET/TOKEN substring, no `DSH_` prefix):
+ *  - `GIT_CONFIG_GLOBAL` — the generated session config (0034).
+ *  - `DGB_BRIDGE_HELPER` — credential file path for the helper script.
+ *  - `GIT_TERMINAL_PROMPT` / `GCM_INTERACTIVE` — fail fast, never prompt.
+ *
+ * The file is re-derived whenever the credential store changes
  * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
  */
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { credentialFilePath, createCredentialStore, } from './credentials.js';
 /** Env var carrying the credential file path to the helper script. */
-export const BRIDGE_HELPER_ENV = 'DSH_GIT_BRIDGE_HELPER';
+export const BRIDGE_HELPER_ENV = 'DGB_BRIDGE_HELPER';
 /** Env var carrying a debug log path to the helper script (unset by default). */
-export const BRIDGE_DEBUG_ENV = 'DSH_GIT_BRIDGE_DEBUG';
+export const BRIDGE_DEBUG_ENV = 'DGB_BRIDGE_DEBUG';
+/** Env var pointing git at the generated session configuration file. */
+export const SESSION_GITCONFIG_ENV = 'GIT_CONFIG_GLOBAL';
 /**
  * Quote one executable or path for git's `!` shell command. Backslashes are
  * normalized to forward slashes first: git runs `!` helpers through `sh`,
- * where `C:\…` would be read as escape sequences.
+ * where `C:\\…` would be read as escape sequences.
  * @param value - an absolute path.
  */
 export function shellQuote(value) {
@@ -51,50 +72,101 @@ export function bridgeCommand(nodePath, helperPath) {
     return `!${shellQuote(nodePath)} ${shellQuote(helperPath)}`;
 }
 /**
- * The ordered environment assignments for the given hosts: per host an empty
- * helper value (git resets the accumulated list for that URL scope) and then
- * the bridge command, plus the credential-file variable the helper reads and
- * the two fail-fast switches.
+ * Escape one value for a gitconfig line: a literal `"` becomes `\"`, which is
+ * how a quoted path survives git's config parser and still reaches `sh`
+ * intact. Without this the quotes are eaten and `sh` splits
+ * `C:/Program Files/…` on the space.
+ * @param value - the raw helper command.
+ */
+export function gitconfigEscape(value) {
+    return value.replace(/"/g, '\\"');
+}
+/**
+ * The session gitconfig body for the given hosts: the user's own config
+ * included (read-only), the whole machine helper list reset to empty, and per
+ * host a URL-scoped reset followed by the bridge command. The empty value
+ * before each command is what cuts the included `gh` helper (and any other
+ * helper the user configures for that URL) out of that scope.
  * @param hosts - normalized hosts with a stored credential.
- * @param options - process paths and the credential file.
+ * @param options - the node/helper pair and the user config to include.
  */
-export function shellBridgeEnv(hosts, options) {
+export function sessionGitconfigBody(hosts, options) {
     const unique = [...new Set(hosts)];
-    const assignments = [];
-    // Reset the WHOLE helper list first, even when no host is stored. Without it,
-    // any host without a stored credential still reaches the machine chain
+    const lines = [
+        '# Generated by dsh-git-branch-manage (shell credential bridge, decision 0034). Do not edit.',
+        '# Regenerated whenever the credential store changes; safe to delete.',
+    ];
+    if (options.userGitconfig !== undefined) {
+        // Read-only include: the user\'s identity, proxies and TLS settings keep
+        // working, and nothing is ever written back to this file.
+        lines.push('[include]', `\tpath = ${options.userGitconfig.replace(/\\/g, '/')}`);
+    }
+    // Reset the WHOLE helper list first, even when no host is stored. Without
+    // it, any host without a stored credential still reaches the machine chain
     // (`helper-selector` → GCM), which raises a GUI prompt no agent shell can
-    // answer — the dialog that kept popping up. With it, such a host fails at
-    // once with "terminal prompts disabled", and the URL-scoped pairs below are
-    // the only way credentials get back into a shell.
-    assignments.push(['GIT_CONFIG_COUNT', String(unique.length * 2 + 1)]);
-    assignments.push(['GIT_CONFIG_KEY_0', 'credential.helper'], ['GIT_CONFIG_VALUE_0', '']);
-    unique.forEach((host, index) => {
-        const key = `credential.https://${host}/.helper`;
-        const empty = String(index * 2 + 1);
-        const command = String(index * 2 + 2);
-        assignments.push([`GIT_CONFIG_KEY_${empty}`, key], [`GIT_CONFIG_VALUE_${empty}`, '']);
-        assignments.push([`GIT_CONFIG_KEY_${command}`, key], [`GIT_CONFIG_VALUE_${command}`, bridgeCommand(options.nodePath, options.helperPath)]);
-    });
-    assignments.push([BRIDGE_HELPER_ENV, options.credentialFile]);
-    // Fail fast instead of parking a shell on a prompt or a GUI dialog.
-    assignments.push(['GIT_TERMINAL_PROMPT', '0'], ['GCM_INTERACTIVE', 'never']);
-    return assignments;
+    // answer. With it, such a host fails at once with "terminal prompts
+    // disabled", and the URL-scoped pairs below are the only way credentials
+    // get back into a shell.
+    lines.push('[credential]', '\thelper =');
+    const command = gitconfigEscape(bridgeCommand(options.nodePath, options.helperPath));
+    for (const host of unique) {
+        lines.push(`[credential "https://${host}/"]`, 
+        // Empty first: it resets whatever helper list the included user config
+        // accumulated for this URL (the local `gh` helper), or git would answer
+        // with that account before the bridge is ever consulted.
+        '\thelper =', `\thelper = ${command}`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+/**
+ * The environment assignments pointing git at the session config: the config
+ * path itself, the credential file the helper reads, and the two fail-fast
+ * switches. `hosts` live in the file now, not in the environment.
+ * @param options - the session config path and the credential file.
+ */
+export function shellBridgeEnv(options) {
+    return [
+        [SESSION_GITCONFIG_ENV, options.configPath],
+        [BRIDGE_HELPER_ENV, options.credentialFile],
+        // Fail fast instead of parking a shell on a prompt or a GUI dialog.
+        ['GIT_TERMINAL_PROMPT', '0'],
+        ['GCM_INTERACTIVE', 'never'],
+    ];
 }
 /**
  * Build the bridge over one host process. Every {@link ShellBridge.apply}
- * first removes the assignments it made last time, so a deleted host loses
- * its helper scope just like a freshly added one gains it.
+ * rewrites the session config for the current store and re-points the
+ * environment at it, so a deleted host loses its helper scope just like a
+ * freshly added one gains it. A config file that cannot be written leaves
+ * `GIT_CONFIG_GLOBAL` untouched (git then runs with the machine config —
+ * unauthenticated at worst) while the fail-fast switches still go out.
  * @param deps - host seams.
  */
 export function createShellBridge(deps) {
     const env = deps.env ?? process.env;
+    const configPath = deps.configPath
+        ?? join((deps.configDir ?? tmpdir)(), `dsh-git-branch-${String(process.pid)}.gitconfig`);
     let applied = [];
+    const credentialFile = () => credentialFilePath(deps.home(), deps.envHome());
+    /** Write the session config atomically with owner-only permissions. */
+    const writeConfig = (body) => {
+        mkdirSync(dirname(configPath), { recursive: true });
+        const partial = `${configPath}.tmp`;
+        writeFileSync(partial, body, { encoding: 'utf8', mode: 0o600 });
+        renameSync(partial, configPath);
+        try {
+            chmodSync(configPath, 0o600);
+        }
+        catch {
+            // Best effort: Windows ignores the mode, the file holds no secret.
+        }
+    };
     return {
+        configPath: () => configPath,
         async apply() {
             let hosts = [];
             try {
-                hosts = (await (deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()))).load()).map(entry => entry.host);
+                hosts = (await (deps.store ?? createCredentialStore(credentialFile())).load()).map(entry => entry.host);
             }
             catch {
                 // An unreadable store means no host can be bridged. The global helper
@@ -104,11 +176,25 @@ export function createShellBridge(deps) {
             }
             const helperPath = deps.helperPath
                 ?? fileURLToPath(new URL('./helpers/git-credential-bridge.js', import.meta.url));
-            const assignments = shellBridgeEnv(hosts, {
+            const body = sessionGitconfigBody(hosts, {
                 nodePath: deps.nodePath ?? process.execPath,
                 helperPath,
-                credentialFile: credentialFilePath(deps.home(), deps.envHome()),
+                userGitconfig: deps.userGitconfig ?? join(deps.home(), '.gitconfig'),
             });
+            let assignments = [
+                ['GIT_TERMINAL_PROMPT', '0'],
+                ['GCM_INTERACTIVE', 'never'],
+            ];
+            try {
+                writeConfig(body);
+                assignments = shellBridgeEnv({ configPath, credentialFile: credentialFile() });
+            }
+            catch {
+                // The session config could not be written. Do not point
+                // GIT_CONFIG_GLOBAL at a missing file (that would drop the reset and
+                // let the machine chain pop a dialog); only the fail-fast switches
+                // remain, so a shell git runs unauthenticated but never hangs.
+            }
             for (const key of applied)
                 delete env[key];
             applied = [];
@@ -117,5 +203,16 @@ export function createShellBridge(deps) {
                 applied.push(key);
             }
         },
+        async dispose() {
+            for (const key of applied)
+                delete env[key];
+            applied = [];
+            try {
+                rmSync(configPath, { force: true });
+            }
+            catch {
+                // Best effort: a leftover file holds no secret and apply rewrites it.
+            }
+        },
     };
 }

package/lib/tool.d.ts

@@ -15,6 +15,7 @@
  * @module dsh-git-branch/tool
  */
 import { type CredentialStore } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 /** Model-facing tool name. */
 export declare const GIT_CREDENTIALS_TOOL_NAME = "git_credentials";
 /** One text block in a tool result. */
@@ -58,6 +59,9 @@ export interface GitCredentialsToolDeps {
     readonly envHome: () => string | undefined;
     /** Store seam; the fs-backed store at the resolved path when absent. */
     readonly store?: CredentialStore;
+    /** The single credential entry point (decision 0034); when wired its store
+     * is shared with the routes and the shell bridge. */
+    readonly credentialsService?: CredentialService;
 }
 /** A tool definition as `ctx.tools.register` accepts it. */
 export interface GitCredentialsTool {

package/lib/tool.js

@@ -48,7 +48,7 @@ export function renderGitCredentials(value) {
  * @returns a definition ready for `ctx.tools.register`.
  */
 export function gitCredentialsTool(deps) {
-    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
     /** Read the store, folding a read failure into the result value. */
     const read = async (args) => {
         const store = storeOf();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-branch-manage",
-  "version": "1.0.10",
+  "version": "1.1.0",
   "description": "提供 git 分支与 worktree 管理：输入框工具栏显示当前分支、可原地切换；支持 IDEA 风格分支选择器、远程分支检出、右键操作菜单（新建/重命名/删除/复制）、推送与更新当前分支，以及把分支隔离到独立 worktree 工作区，并管理其创建与删除。",
   "keywords": [
     "dsh",
@@ -45,6 +45,7 @@
     "!lib/**/*.map",
     "cordis.patch.yml",
     "README.md",
+    "CHANGELOG.md",
     "locale/*.json",
     "icon.svg"
   ],