dsh-git-branch-manage 1.0.10 → 1.2.0

package/lib/shell-bridge.d.ts

@@ -1,93 +1,85 @@
 /**
- * Shell credential bridge (host half). The credential panel stores one token
- * per remote host, but 0029 could only inject it into the panel's own routes
- * and the `git_network` tool; a plain `git push` run in a shell authenticated
- * as whatever the machine's credential helper held — often a different
- * account — or hung on an interactive prompt nobody could answer.
+ * Shell credential setup (host half) — decision 0037.
  *
- * This module closes that gap without touching the user's git configuration
- * FILES (0021's constraint): it exports `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
- * `GIT_CONFIG_VALUE_n` entries that install the bundled credential helper
- * (`helpers/git-credential-bridge.js`) as a URL-scoped helper for every stored
- * host. git reads that environment as configuration, every child process the
- * host spawns inherits it, and a non-empty value list is always preceded by the
- * same key with an empty value — git resets the accumulated helper list
- * there, so the machine chain (`helper-selector` → GCM) can neither answer
- * with a different account nor open a blocking dialog for those hosts.
- * The list is reset globally as well: a host with no stored credential then
- * fails at once ("terminal prompts disabled") instead of reaching the machine
- * chain, whose interactive GUI dialog nobody in an agent shell can answer.
+ * Before 0037 the panel's token only reached commands the plugin itself ran;
+ * a plain `git push` in a shell authenticated as whatever the machine's
+ * helper held (often a different account) or hung on a prompt nobody could
+ * answer. 0032/0034 tried to bridge that through the process environment
+ * (`GIT_CONFIG_COUNT`, then a generated `GIT_CONFIG_GLOBAL` session file) —
+ * both channels existed only in the host process's own environment, so a
+ * shell that received a different environment snapshot saw nothing.
  *
- * `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` ride along so a host
- * with no usable credential fails fast instead of parking a shell on a prompt
- * (the failure mode that started this: a 3m38s silent hang).
+ * 0037 stops fighting the environment and uses git's own mechanisms:
  *
- * The assignments are re-derived whenever the credential store changes
- * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
+ *  1. `<dsh-home>/git-credentials.include.gitconfig` is generated with one
+ *     URL-scoped section per managed host;
+ *  2. `~/.gitconfig` gains exactly one `[include] path = <that file>` line
+ *     (idempotent; see `ensureGitconfigInclude` in `credentials.ts`);
+ *  3. every git process — the plugin's own routes, `git_network`, and a
+ *     plain shell — reads that include and therefore resolves the host
+ *     through `credential-store`, i.e. `~/.git-credentials`.
+ *
+ * Nothing rides the process environment any more, which is why the module is
+ * now only a gitconfig-install + fail-fast switch manager. `GIT_TERMINAL_PROMPT=0`
+ * and `GCM_INTERACTIVE=never` stay: a host without a stored credential should
+ * fail at once instead of parking an agent shell on a GUI dialog.
+ *
+ * `apply`/`dispose` still delete the retired 0032 channel's leftovers
+ * (`GIT_CONFIG_COUNT` with a broken `GIT_CONFIG_KEY_n` / `GIT_CONFIG_VALUE_n`
+ * set). The DSH subprocess scrubber strips the KEY names while the count and
+ * values survive, so a half-injected channel — left behind by an upgrade from
+ * 1.0.10 — makes git abort every command; see `legacyConfigNames` (0036).
  */
 import { type CredentialStore } from './credentials.js';
-/** Env var carrying the credential file path to the helper script. */
-export declare const BRIDGE_HELPER_ENV = "DSH_GIT_BRIDGE_HELPER";
-/** Env var carrying a debug log path to the helper script (unset by default). */
-export declare const BRIDGE_DEBUG_ENV = "DSH_GIT_BRIDGE_DEBUG";
-/** Host-side seams the bridge reads through (tests substitute all of them). */
+/** Host-side seams the setup reads through (tests substitute all of them). */
 export interface ShellBridgeDeps {
     /** User home directory seam. */
     readonly home: () => string;
     /** `$DSH_HOME` seam (blank/undefined = unset). */
     readonly envHome: () => string | undefined;
-    /** Store seam; the fs-backed store at the resolved path when absent. */
+    /** Store seam; the fs-backed local store when absent. */
     readonly store?: CredentialStore;
     /** The environment object to mutate; `process.env` when absent. */
     readonly env?: Record<string, string | undefined>;
-    /** Absolute helper script path; the compiled sibling under `helpers/` when
-     * absent. */
-    readonly helperPath?: string;
-    /** Node executable that runs the helper; `process.execPath` when absent. */
-    readonly nodePath?: string;
+    /** User global config the generated file is included from; `<home>/.gitconfig` when absent. */
+    readonly userGitconfig?: string;
 }
-/** The bridge's one operation: re-derive the environment from the store. */
+/** The setup's operations: re-derive the include, and undo it. */
 export interface ShellBridge {
-    /** Read the credential store and rewrite the injected environment.
-     * A store that cannot be read drops every URL-scoped helper (no host can be
-     * bridged), but keeps the global reset, so shell git still fails fast
-     * instead of opening an interactive credential dialog. */
+    /** The generated include file (diagnostics/tests). */
+    readonly configPath: () => string;
+    /** Read the credential store and rewrite the include + `~/.gitconfig`.
+     * A store that cannot be read writes an empty include (no host is
+     * scoped), while the fail-fast switches still go out. */
     readonly apply: () => Promise<void>;
+    /** Remove the fail-fast switches, the include line and the generated file. */
+    readonly dispose: () => Promise<void>;
 }
-/** One ordered environment assignment. */
-export type BridgeAssignment = readonly [key: string, value: string];
-/**
- * Quote one executable or path for git's `!` shell command. Backslashes are
- * normalized to forward slashes first: git runs `!` helpers through `sh`,
- * where `C:\…` would be read as escape sequences.
- * @param value - an absolute path.
- */
-export declare function shellQuote(value: string): string;
+/** The retired 0032 channel's count variable. */
+export declare const LEGACY_COUNT_ENV = "GIT_CONFIG_COUNT";
 /**
- * The helper command git runs for one configured host: a `!`-prefixed shell
- * command, because git does not word-split a helper value by itself (a bare
- * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
- * @param nodePath - the node executable.
- * @param helperPath - the compiled helper script.
- */
-export declare function bridgeCommand(nodePath: string, helperPath: string): string;
-/**
- * The ordered environment assignments for the given hosts: per host an empty
- * helper value (git resets the accumulated list for that URL scope) and then
- * the bridge command, plus the credential-file variable the helper reads and
- * the two fail-fast switches.
- * @param hosts - normalized hosts with a stored credential.
- * @param options - process paths and the credential file.
+ * Environment names left over from the retired 0032 channel that would make
+ * git abort with `fatal: unable to parse command-line config`.
+ *
+ * The DSH subprocess scrubber deletes every `GIT_CONFIG_KEY_<n>` (the name
+ * contains `KEY`) while `GIT_CONFIG_COUNT` / `GIT_CONFIG_VALUE_<n>` survive, so
+ * the channel is injected half-way and git can no longer parse it. Those
+ * leftovers outlive the code that wrote them: upgrading the plugin from 1.0.10
+ * leaves them in the host process environment, where they break every `git`
+ * command in every derived shell until someone deletes them by hand.
+ *
+ * A count whose pairs are all present is valid git input (a caller may set the
+ * channel deliberately), so it is left untouched; only a broken channel — or a
+ * non-numeric count — is reported for removal.
+ * @param env - the environment to inspect.
  */
-export declare function shellBridgeEnv(hosts: readonly string[], options: {
-    readonly nodePath: string;
-    readonly helperPath: string;
-    readonly credentialFile: string;
-}): readonly BridgeAssignment[];
+export declare function legacyConfigNames(env: Record<string, string | undefined>): string[];
 /**
- * Build the bridge over one host process. Every {@link ShellBridge.apply}
- * first removes the assignments it made last time, so a deleted host loses
- * its helper scope just like a freshly added one gains it.
+ * Build the setup over one host process. Every {@link ShellBridge.apply}
+ * rewrites the include for the current store, so a deleted host loses its
+ * helper scope just like a freshly added one gains it. A failing write never
+ * throws: the worst case is a stale include until the next credential save,
+ * and git keeps working with the machine's own configuration.
  * @param deps - host seams.
  */
 export declare function createShellBridge(deps: ShellBridgeDeps): ShellBridge;

package/lib/shell-bridge.js

@@ -1,121 +1,144 @@
 /**
- * Shell credential bridge (host half). The credential panel stores one token
- * per remote host, but 0029 could only inject it into the panel's own routes
- * and the `git_network` tool; a plain `git push` run in a shell authenticated
- * as whatever the machine's credential helper held — often a different
- * account — or hung on an interactive prompt nobody could answer.
+ * Shell credential setup (host half) — decision 0037.
  *
- * This module closes that gap without touching the user's git configuration
- * FILES (0021's constraint): it exports `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
- * `GIT_CONFIG_VALUE_n` entries that install the bundled credential helper
- * (`helpers/git-credential-bridge.js`) as a URL-scoped helper for every stored
- * host. git reads that environment as configuration, every child process the
- * host spawns inherits it, and a non-empty value list is always preceded by the
- * same key with an empty value — git resets the accumulated helper list
- * there, so the machine chain (`helper-selector` → GCM) can neither answer
- * with a different account nor open a blocking dialog for those hosts.
- * The list is reset globally as well: a host with no stored credential then
- * fails at once ("terminal prompts disabled") instead of reaching the machine
- * chain, whose interactive GUI dialog nobody in an agent shell can answer.
+ * Before 0037 the panel's token only reached commands the plugin itself ran;
+ * a plain `git push` in a shell authenticated as whatever the machine's
+ * helper held (often a different account) or hung on a prompt nobody could
+ * answer. 0032/0034 tried to bridge that through the process environment
+ * (`GIT_CONFIG_COUNT`, then a generated `GIT_CONFIG_GLOBAL` session file) —
+ * both channels existed only in the host process's own environment, so a
+ * shell that received a different environment snapshot saw nothing.
  *
- * `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` ride along so a host
- * with no usable credential fails fast instead of parking a shell on a prompt
- * (the failure mode that started this: a 3m38s silent hang).
+ * 0037 stops fighting the environment and uses git's own mechanisms:
  *
- * The assignments are re-derived whenever the credential store changes
- * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
- */
-import { fileURLToPath } from 'node:url';
-import { credentialFilePath, createCredentialStore, } from './credentials.js';
-/** Env var carrying the credential file path to the helper script. */
-export const BRIDGE_HELPER_ENV = 'DSH_GIT_BRIDGE_HELPER';
-/** Env var carrying a debug log path to the helper script (unset by default). */
-export const BRIDGE_DEBUG_ENV = 'DSH_GIT_BRIDGE_DEBUG';
-/**
- * Quote one executable or path for git's `!` shell command. Backslashes are
- * normalized to forward slashes first: git runs `!` helpers through `sh`,
- * where `C:\…` would be read as escape sequences.
- * @param value - an absolute path.
- */
-export function shellQuote(value) {
-    return `"${value.replace(/\\/g, '/')}"`;
-}
-/**
- * The helper command git runs for one configured host: a `!`-prefixed shell
- * command, because git does not word-split a helper value by itself (a bare
- * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
- * @param nodePath - the node executable.
- * @param helperPath - the compiled helper script.
+ *  1. `<dsh-home>/git-credentials.include.gitconfig` is generated with one
+ *     URL-scoped section per managed host;
+ *  2. `~/.gitconfig` gains exactly one `[include] path = <that file>` line
+ *     (idempotent; see `ensureGitconfigInclude` in `credentials.ts`);
+ *  3. every git process — the plugin's own routes, `git_network`, and a
+ *     plain shell — reads that include and therefore resolves the host
+ *     through `credential-store`, i.e. `~/.git-credentials`.
+ *
+ * Nothing rides the process environment any more, which is why the module is
+ * now only a gitconfig-install + fail-fast switch manager. `GIT_TERMINAL_PROMPT=0`
+ * and `GCM_INTERACTIVE=never` stay: a host without a stored credential should
+ * fail at once instead of parking an agent shell on a GUI dialog.
+ *
+ * `apply`/`dispose` still delete the retired 0032 channel's leftovers
+ * (`GIT_CONFIG_COUNT` with a broken `GIT_CONFIG_KEY_n` / `GIT_CONFIG_VALUE_n`
+ * set). The DSH subprocess scrubber strips the KEY names while the count and
+ * values survive, so a half-injected channel — left behind by an upgrade from
+ * 1.0.10 — makes git abort every command; see `legacyConfigNames` (0036).
  */
-export function bridgeCommand(nodePath, helperPath) {
-    return `!${shellQuote(nodePath)} ${shellQuote(helperPath)}`;
-}
+import { rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { credentialIncludeBody, credentialIncludeFile, createLocalCredentialStore, ensureGitconfigInclude, removeGitconfigInclude, writeFileAtomic, } from './credentials.js';
+/** The retired 0032 channel's count variable. */
+export const LEGACY_COUNT_ENV = 'GIT_CONFIG_COUNT';
+/** Names of the retired 0032 channel's per-entry pairs. */
+const LEGACY_KEY_NAME = /^GIT_CONFIG_KEY_\d+$/;
+const LEGACY_VALUE_NAME = /^GIT_CONFIG_VALUE_\d+$/;
+/** Fail fast instead of parking a shell on a prompt or a GUI dialog. */
+const FAIL_FAST = [
+    ['GIT_TERMINAL_PROMPT', '0'],
+    ['GCM_INTERACTIVE', 'never'],
+];
 /**
- * The ordered environment assignments for the given hosts: per host an empty
- * helper value (git resets the accumulated list for that URL scope) and then
- * the bridge command, plus the credential-file variable the helper reads and
- * the two fail-fast switches.
- * @param hosts - normalized hosts with a stored credential.
- * @param options - process paths and the credential file.
+ * Environment names left over from the retired 0032 channel that would make
+ * git abort with `fatal: unable to parse command-line config`.
+ *
+ * The DSH subprocess scrubber deletes every `GIT_CONFIG_KEY_<n>` (the name
+ * contains `KEY`) while `GIT_CONFIG_COUNT` / `GIT_CONFIG_VALUE_<n>` survive, so
+ * the channel is injected half-way and git can no longer parse it. Those
+ * leftovers outlive the code that wrote them: upgrading the plugin from 1.0.10
+ * leaves them in the host process environment, where they break every `git`
+ * command in every derived shell until someone deletes them by hand.
+ *
+ * A count whose pairs are all present is valid git input (a caller may set the
+ * channel deliberately), so it is left untouched; only a broken channel — or a
+ * non-numeric count — is reported for removal.
+ * @param env - the environment to inspect.
  */
-export function shellBridgeEnv(hosts, options) {
-    const unique = [...new Set(hosts)];
-    const assignments = [];
-    // Reset the WHOLE helper list first, even when no host is stored. Without it,
-    // any host without a stored credential still reaches the machine chain
-    // (`helper-selector` → GCM), which raises a GUI prompt no agent shell can
-    // answer — the dialog that kept popping up. With it, such a host fails at
-    // once with "terminal prompts disabled", and the URL-scoped pairs below are
-    // the only way credentials get back into a shell.
-    assignments.push(['GIT_CONFIG_COUNT', String(unique.length * 2 + 1)]);
-    assignments.push(['GIT_CONFIG_KEY_0', 'credential.helper'], ['GIT_CONFIG_VALUE_0', '']);
-    unique.forEach((host, index) => {
-        const key = `credential.https://${host}/.helper`;
-        const empty = String(index * 2 + 1);
-        const command = String(index * 2 + 2);
-        assignments.push([`GIT_CONFIG_KEY_${empty}`, key], [`GIT_CONFIG_VALUE_${empty}`, '']);
-        assignments.push([`GIT_CONFIG_KEY_${command}`, key], [`GIT_CONFIG_VALUE_${command}`, bridgeCommand(options.nodePath, options.helperPath)]);
-    });
-    assignments.push([BRIDGE_HELPER_ENV, options.credentialFile]);
-    // Fail fast instead of parking a shell on a prompt or a GUI dialog.
-    assignments.push(['GIT_TERMINAL_PROMPT', '0'], ['GCM_INTERACTIVE', 'never']);
-    return assignments;
+export function legacyConfigNames(env) {
+    if (env[LEGACY_COUNT_ENV] === undefined)
+        return [];
+    const count = Number(env[LEGACY_COUNT_ENV]);
+    const paired = Number.isInteger(count) && count >= 0
+        && Array.from({ length: count }, (_, index) => `GIT_CONFIG_KEY_${index}`)
+            .every(name => env[name] !== undefined);
+    if (paired)
+        return [];
+    return Object.keys(env).filter(name => name === LEGACY_COUNT_ENV || LEGACY_KEY_NAME.test(name) || LEGACY_VALUE_NAME.test(name));
 }
 /**
- * Build the bridge over one host process. Every {@link ShellBridge.apply}
- * first removes the assignments it made last time, so a deleted host loses
- * its helper scope just like a freshly added one gains it.
+ * Build the setup over one host process. Every {@link ShellBridge.apply}
+ * rewrites the include for the current store, so a deleted host loses its
+ * helper scope just like a freshly added one gains it. A failing write never
+ * throws: the worst case is a stale include until the next credential save,
+ * and git keeps working with the machine's own configuration.
  * @param deps - host seams.
  */
 export function createShellBridge(deps) {
     const env = deps.env ?? process.env;
+    const includePath = credentialIncludeFile(deps.home(), deps.envHome());
+    const gitconfig = () => deps.userGitconfig ?? join(deps.home(), '.gitconfig');
+    const store = () => deps.store ?? createLocalCredentialStore(deps.home(), deps.envHome());
     let applied = [];
+    /** Delete the retired 0032 channel's leftovers before git can see them. */
+    const dropLegacy = () => {
+        for (const key of legacyConfigNames(env)) {
+            delete env[key];
+            applied.push(key);
+        }
+    };
     return {
+        configPath: () => includePath,
         async apply() {
             let hosts = [];
             try {
-                hosts = (await (deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()))).load()).map(entry => entry.host);
+                hosts = (await store().load()).map(entry => entry.host);
             }
             catch {
-                // An unreadable store means no host can be bridged. The global helper
-                // reset still goes out, so shell git fails fast rather than popping a
-                // credential dialog nobody can answer.
+                // An unreadable store means no host can be scoped. The include file
+                // is still rewritten empty, so a stale host does not keep a helper
+                // pointing at a file that no longer holds its credential.
                 hosts = [];
             }
-            const helperPath = deps.helperPath
-                ?? fileURLToPath(new URL('./helpers/git-credential-bridge.js', import.meta.url));
-            const assignments = shellBridgeEnv(hosts, {
-                nodePath: deps.nodePath ?? process.execPath,
-                helperPath,
-                credentialFile: credentialFilePath(deps.home(), deps.envHome()),
-            });
+            try {
+                // Write the include first: if `~/.gitconfig` cannot be updated, the
+                // file it already points at is at least current.
+                await writeFileAtomic(includePath, credentialIncludeBody(hosts), 0o600);
+                await ensureGitconfigInclude(gitconfig(), includePath);
+            }
+            catch {
+                // Deliberately swallowed; see the contract above.
+            }
+            dropLegacy();
             for (const key of applied)
                 delete env[key];
             applied = [];
-            for (const [key, value] of assignments) {
+            for (const [key, value] of FAIL_FAST) {
                 env[key] = value;
                 applied.push(key);
             }
         },
+        async dispose() {
+            dropLegacy();
+            for (const key of applied)
+                delete env[key];
+            applied = [];
+            try {
+                await removeGitconfigInclude(gitconfig(), includePath);
+            }
+            catch {
+                // Best effort: a leftover include still points at the file below.
+            }
+            try {
+                await rm(includePath, { force: true });
+            }
+            catch {
+                // Best effort: the file holds no secret and `apply` rewrites it.
+            }
+        },
     };
 }

package/lib/tool.d.ts

@@ -15,6 +15,7 @@
  * @module dsh-git-branch/tool
  */
 import { type CredentialStore } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 /** Model-facing tool name. */
 export declare const GIT_CREDENTIALS_TOOL_NAME = "git_credentials";
 /** One text block in a tool result. */
@@ -58,6 +59,9 @@ export interface GitCredentialsToolDeps {
     readonly envHome: () => string | undefined;
     /** Store seam; the fs-backed store at the resolved path when absent. */
     readonly store?: CredentialStore;
+    /** The single credential entry point (decision 0034); when wired its store
+     * is shared with the routes and the shell bridge. */
+    readonly credentialsService?: CredentialService;
 }
 /** A tool definition as `ctx.tools.register` accepts it. */
 export interface GitCredentialsTool {

package/lib/tool.js

@@ -14,7 +14,7 @@
  *
  * @module dsh-git-branch/tool
  */
-import { basicUsername, createCredentialStore, credentialFilePath, maskSecret, } from './credentials.js';
+import { basicUsername, createLocalCredentialStore, maskSecret, } from './credentials.js';
 /** Model-facing tool name. */
 export const GIT_CREDENTIALS_TOOL_NAME = 'git_credentials';
 /** Project one stored entry onto its model-facing row. */
@@ -48,7 +48,7 @@ export function renderGitCredentials(value) {
  * @returns a definition ready for `ctx.tools.register`.
  */
 export function gitCredentialsTool(deps) {
-    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createLocalCredentialStore(deps.home(), deps.envHome());
     /** Read the store, folding a read failure into the result value. */
     const read = async (args) => {
         const store = storeOf();

package/lib/wire.d.ts

@@ -70,6 +70,9 @@ export declare const ROUTE_CREDENTIALS_OAUTH_START = "/plugin/git-worktree/crede
 /** POST ROUTE_PREFIX/credentials-oauth-poll — poll a started browser sign-in;
  * stores the token and answers the fresh masked list once the user approves. */
 export declare const ROUTE_CREDENTIALS_OAUTH_POLL = "/plugin/git-worktree/credentials-oauth-poll";
+/** POST ROUTE_PREFIX/credentials-import — copy the credentials the machine's
+ * own helpers already answer for into the managed store (decision 0038). */
+export declare const ROUTE_CREDENTIALS_IMPORT = "/plugin/git-worktree/credentials-import";
 /** POST ROUTE_PREFIX/remotes — the repository's configured remotes. */
 export declare const ROUTE_REMOTES = "/plugin/git-worktree/remotes";
 /** POST ROUTE_PREFIX/remote — add, re-point or remove ONE remote. */
@@ -626,6 +629,32 @@ export interface CredentialDeleteBody {
 }
 /** POST credentials-delete response body: the updated masked list. */
 export type CredentialDeleteResult = CredentialsResult;
+/** POST credentials-import request body — absent hosts means "whatever the
+ * machine's gitconfig points git at". */
+export interface CredentialImportBody {
+    /** Explicit hosts to probe; omitted, the gitconfig's URL-scoped hosts are
+     * the candidates. */
+    hosts?: string[];
+}
+/** One host the import copied into the store (secret never included). */
+export interface CredentialImportEntry {
+    host: string;
+    /** `oauth2` for a token credential, the helper's user name otherwise. */
+    username: string;
+    method: CredentialMethod;
+}
+/** One host whose machine helper had nothing to give; the store is untouched. */
+export interface CredentialImportFailure {
+    host: string;
+    error: string;
+}
+/** POST credentials-import response body: the fresh masked list plus what the
+ * import did per host. */
+export interface CredentialImportResult extends CredentialsResult {
+    imported: CredentialImportEntry[];
+    skipped: string[];
+    failed: CredentialImportFailure[];
+}
 /** POST credentials-oauth-start request body. */
 export interface CredentialOAuthStartBody {
     /** Remote host whose browser sign-in to start (must support device flow). */

package/lib/wire.js

@@ -70,6 +70,9 @@ export const ROUTE_CREDENTIALS_OAUTH_START = `${ROUTE_PREFIX}/credentials-oauth-
 /** POST ROUTE_PREFIX/credentials-oauth-poll — poll a started browser sign-in;
  * stores the token and answers the fresh masked list once the user approves. */
 export const ROUTE_CREDENTIALS_OAUTH_POLL = `${ROUTE_PREFIX}/credentials-oauth-poll`;
+/** POST ROUTE_PREFIX/credentials-import — copy the credentials the machine's
+ * own helpers already answer for into the managed store (decision 0038). */
+export const ROUTE_CREDENTIALS_IMPORT = `${ROUTE_PREFIX}/credentials-import`;
 /** POST ROUTE_PREFIX/remotes — the repository's configured remotes. */
 export const ROUTE_REMOTES = `${ROUTE_PREFIX}/remotes`;
 /** POST ROUTE_PREFIX/remote — add, re-point or remove ONE remote. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-branch-manage",
-  "version": "1.0.10",
+  "version": "1.2.0",
   "description": "提供 git 分支与 worktree 管理：输入框工具栏显示当前分支、可原地切换；支持 IDEA 风格分支选择器、远程分支检出、右键操作菜单（新建/重命名/删除/复制）、推送与更新当前分支，以及把分支隔离到独立 worktree 工作区，并管理其创建与删除。",
   "keywords": [
     "dsh",
@@ -45,6 +45,7 @@
     "!lib/**/*.map",
     "cordis.patch.yml",
     "README.md",
+    "CHANGELOG.md",
     "locale/*.json",
     "icon.svg"
   ],

package/lib/helpers/git-credential-bridge.d.ts

@@ -1,32 +0,0 @@
-/**
- * Standalone git credential helper shipped with the dsh-git-branch plugin.
- *
- * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
- * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
- * This helper extends that coverage to a plain shell `git push`: the plugin's
- * host process exports `GIT_CONFIG_COUNT/KEY/VALUE` entries that install this
- * script as a URL-scoped credential helper for every stored host, so commands
- * the model runs in the shell authenticate as the configured account too.
- *
- * Design constraints (see docs/decisions/0029 and 0032):
- *  - The user's global git config and credential helpers are never written;
- *    the injection lives in the process environment only.
- *  - The token never enters the conversation: this script reads the
- *    credential file directly on the host and answers git on stdout.
- *  - URL scope (`credential.https://<host>/.helper`) confines the helper to
- *    hosts with a stored credential. The host half also clears the machine
- *    helper list, so a host this script cannot answer fails fast instead of
- *    opening an interactive credential dialog.
- *  - `get` is silent on a miss (git falls through to the next helper);
- *    `store`/`erase` are pass-through by decision — writing back would race
- *    the panel's atomic save and leak the file shape.
- *
- * Environment contract (set by src/shell-bridge.ts):
- *  - `DSH_GIT_BRIDGE_HELPER` — credential file path (required).
- *  - `DSH_GIT_BRIDGE_HOME` — user home directory (fallback resolution).
- *  - `DSH_GIT_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
- *  - `DSH_GIT_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
- *
- * @module dsh-git-branch/git-credential-bridge
- */
-export {};