dsh-git-branch-manage 1.0.8 → 1.0.10

package/lib/credentials.d.ts

@@ -7,9 +7,13 @@
  * and the store is read/written by the host alone.
  *
  * Authentication rides `git -c http.https://<host>/.extraHeader=…` on the
- * panel's own network commands: the user's global git config and credential
- * helpers are left untouched. Only `https://` remotes receive the header;
- * ssh and plain-http remotes are never sent a secret.
+ * panel's own network commands and on the `git_network` tool: the user's git
+ * configuration FILES are never written. Plain `git` commands in a spawned
+ * shell are covered separately by the environment bridge in `shell-bridge.ts`,
+ * which installs this store's per-host tokens as URL-scoped credential helpers
+ * through `GIT_CONFIG_*` (process environment only, never a config file).
+ * Only `https://` remotes receive the header; ssh and plain-http remotes are
+ * never sent a secret.
  */
 import type { CredentialMethod } from './wire.js';
 /**

package/lib/credentials.js

@@ -7,9 +7,13 @@
  * and the store is read/written by the host alone.
  *
  * Authentication rides `git -c http.https://<host>/.extraHeader=…` on the
- * panel's own network commands: the user's global git config and credential
- * helpers are left untouched. Only `https://` remotes receive the header;
- * ssh and plain-http remotes are never sent a secret.
+ * panel's own network commands and on the `git_network` tool: the user's git
+ * configuration FILES are never written. Plain `git` commands in a spawned
+ * shell are covered separately by the environment bridge in `shell-bridge.ts`,
+ * which installs this store's per-host tokens as URL-scoped credential helpers
+ * through `GIT_CONFIG_*` (process environment only, never a config file).
+ * Only `https://` remotes receive the header; ssh and plain-http remotes are
+ * never sent a secret.
  */
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';

package/lib/helpers/git-credential-bridge.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Standalone git credential helper shipped with the dsh-git-branch plugin.
+ *
+ * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
+ * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
+ * This helper extends that coverage to a plain shell `git push`: the plugin's
+ * host process exports `GIT_CONFIG_COUNT/KEY/VALUE` entries that install this
+ * script as a URL-scoped credential helper for every stored host, so commands
+ * the model runs in the shell authenticate as the configured account too.
+ *
+ * Design constraints (see docs/decisions/0029 and 0032):
+ *  - The user's global git config and credential helpers are never written;
+ *    the injection lives in the process environment only.
+ *  - The token never enters the conversation: this script reads the
+ *    credential file directly on the host and answers git on stdout.
+ *  - URL scope (`credential.https://<host>/.helper`) confines the helper to
+ *    hosts with a stored credential. The host half also clears the machine
+ *    helper list, so a host this script cannot answer fails fast instead of
+ *    opening an interactive credential dialog.
+ *  - `get` is silent on a miss (git falls through to the next helper);
+ *    `store`/`erase` are pass-through by decision — writing back would race
+ *    the panel's atomic save and leak the file shape.
+ *
+ * Environment contract (set by src/shell-bridge.ts):
+ *  - `DSH_GIT_BRIDGE_HELPER` — credential file path (required).
+ *  - `DSH_GIT_BRIDGE_HOME` — user home directory (fallback resolution).
+ *  - `DSH_GIT_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
+ *  - `DSH_GIT_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
+ *
+ * @module dsh-git-branch/git-credential-bridge
+ */
+export {};

package/lib/helpers/git-credential-bridge.js

@@ -0,0 +1,114 @@
+/**
+ * Standalone git credential helper shipped with the dsh-git-branch plugin.
+ *
+ * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
+ * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
+ * This helper extends that coverage to a plain shell `git push`: the plugin's
+ * host process exports `GIT_CONFIG_COUNT/KEY/VALUE` entries that install this
+ * script as a URL-scoped credential helper for every stored host, so commands
+ * the model runs in the shell authenticate as the configured account too.
+ *
+ * Design constraints (see docs/decisions/0029 and 0032):
+ *  - The user's global git config and credential helpers are never written;
+ *    the injection lives in the process environment only.
+ *  - The token never enters the conversation: this script reads the
+ *    credential file directly on the host and answers git on stdout.
+ *  - URL scope (`credential.https://<host>/.helper`) confines the helper to
+ *    hosts with a stored credential. The host half also clears the machine
+ *    helper list, so a host this script cannot answer fails fast instead of
+ *    opening an interactive credential dialog.
+ *  - `get` is silent on a miss (git falls through to the next helper);
+ *    `store`/`erase` are pass-through by decision — writing back would race
+ *    the panel's atomic save and leak the file shape.
+ *
+ * Environment contract (set by src/shell-bridge.ts):
+ *  - `DSH_GIT_BRIDGE_HELPER` — credential file path (required).
+ *  - `DSH_GIT_BRIDGE_HOME` — user home directory (fallback resolution).
+ *  - `DSH_GIT_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
+ *  - `DSH_GIT_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
+ *
+ * @module dsh-git-branch/git-credential-bridge
+ */
+import { appendFileSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** git helpers receive exactly one argument: the operation. */
+const OPERATION = process.argv[2] ?? 'get';
+/** The credential file this helper reads (`DSH_GIT_BRIDGE_HELPER` wins). */
+const DEFAULT_CREDENTIAL_FILE = 'git-credentials.json';
+/** The dsh home directory below the user profile when `$DSH_HOME` is unset. */
+const PACKAGE_HOME = '.dsh';
+/** The Basic-auth name a token without a username is sent under. */
+const TOKEN_USERNAME = 'oauth2';
+/**
+ * Append one debug line behind the user's back; a broken log path must never
+ * break the credential lookup.
+ */
+function debug(line) {
+    const path = process.env.DSH_GIT_BRIDGE_DEBUG;
+    if (path === undefined || path.trim() === '')
+        return;
+    try {
+        appendFileSync(path, `${line}\n`, 'utf8');
+    }
+    catch {
+        // Deliberately swallowed: debugging is best-effort.
+    }
+}
+/** The credential file this helper reads (`DSH_GIT_BRIDGE_HELPER` wins). */
+function credentialFile() {
+    const helper = process.env.DSH_GIT_BRIDGE_HELPER;
+    if (helper !== undefined && helper.trim() !== '')
+        return helper;
+    const dshHome = process.env.DSH_GIT_BRIDGE_DSH_HOME;
+    const home = dshHome !== undefined && dshHome.trim() !== ''
+        ? dshHome
+        : process.env.DSH_GIT_BRIDGE_HOME ?? homedir();
+    return join(home, DEFAULT_CREDENTIAL_FILE);
+}
+/** One `key=value` request from git on stdin. */
+function readRequest() {
+    const text = readFileSync(0, 'utf8');
+    const request = new Map();
+    for (const line of text.split('\n')) {
+        const at = line.indexOf('=');
+        if (at > 0)
+            request.set(line.slice(0, at), line.slice(at + 1));
+    }
+    return request;
+}
+/** The stored credential for one host, or undefined when there is none. */
+function readCredential(host) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(credentialFile(), 'utf8'));
+    }
+    catch (error) {
+        debug(`read failed: ${String(error)}`);
+        return undefined;
+    }
+    const credentials = parsed.credentials;
+    if (!Array.isArray(credentials))
+        return undefined;
+    const entry = credentials.find((item) => typeof item === 'object' && item !== null && item.host === host);
+    if (entry === undefined)
+        return undefined;
+    const secret = typeof entry.secret === 'string' ? entry.secret : '';
+    if (secret === '')
+        return undefined;
+    const username = typeof entry.username === 'string' && entry.username.trim() !== ''
+        ? entry.username
+        : TOKEN_USERNAME;
+    return { username, secret };
+}
+if (OPERATION === 'get') {
+    const request = readRequest();
+    const host = request.get('host') ?? '';
+    debug(`get host=${host} protocol=${request.get('protocol') ?? ''}`);
+    const credential = readCredential(host);
+    if (credential !== undefined) {
+        process.stdout.write(`username=${credential.username}\npassword=${credential.secret}\n`);
+    }
+    // A miss stays silent: git tries the next helper in the chain.
+}
+// `store` / `erase` are deliberate no-ops (see the header comment).

package/lib/index.js

@@ -11,7 +11,9 @@ import { childProcessExec } from './git.js';
 import { ACCEL_DEFAULT_URL, accelerateUrlError } from './normalize.js';
 import { handleCredentials, handleCredentialsDelete, handleCredentialsOAuthPoll, handleCredentialsOAuthStart, handleCredentialsSave, handleRemote, handleRemotes, handleAiCommitMessage, handleChanges, handleCommit, handleCommitFiles, handleCreateBranch, handleCreateTag, handleCreateWorktree, handleDeleteBranch, handleEnsureDirectory, handleFetch, handleGroupWorktrees, handleInspectWorktree, handleLog, handlePathExists, handlePurgeDirectory, handlePushTag, handleRemoveWorktree, handleRenameBranch, handleStage, handleStatus, handleSwitch, handleUpdate, handlePush, handleWorktreesAll, } from './routes.js';
 import { validateRootDir } from './settings.js';
+import { gitNetworkTool } from './network-tool.js';
 import { gitCredentialsTool } from './tool.js';
+import { createShellBridge } from './shell-bridge.js';
 import { ROUTE_AI_COMMIT_MESSAGE, ROUTE_BRANCH, ROUTE_BRANCH_DELETE, ROUTE_BRANCH_RENAME, ROUTE_CHANGES, ROUTE_COMMIT, ROUTE_COMMIT_FILES, ROUTE_CREDENTIALS, ROUTE_CREDENTIALS_DELETE, ROUTE_CREDENTIALS_OAUTH_POLL, ROUTE_CREDENTIALS_OAUTH_START, ROUTE_CREDENTIALS_SAVE, ROUTE_ENSURE_DIRECTORY, ROUTE_EXISTS, ROUTE_FETCH, ROUTE_GROUP, ROUTE_INSPECT, ROUTE_LOG, ROUTE_PUSH, ROUTE_PURGE, ROUTE_REMOTE, ROUTE_REMOTES, ROUTE_REMOVE, ROUTE_STAGE, ROUTE_STATUS, ROUTE_SWITCH, ROUTE_TAG, ROUTE_TAG_PUSH, ROUTE_UPDATE, ROUTE_WORKTREE, ROUTE_WORKTREES_ALL } from './wire.js';
 export const name = 'dsh-git-branch';
 export const inject = [];
@@ -140,6 +142,14 @@ export function sectionOf(config) {
 export function apply(ctx, config = {}) {
     validateConfig(config);
     const currentConfig = () => ctx.fiber?.config ?? config;
+    // Host half of the shell credential bridge: derive the environment that
+    // lets a plain `git push` in a spawned shell authenticate with the panel's
+    // stored token instead of the machine helper's account. It also clears the
+    // machine helper chain, so a host without a stored token fails fast rather
+    // than opening a credential dialog no agent shell can answer. Applied at
+    // activate and re-derived after every credential save / delete / sign-in.
+    const shellBridge = createShellBridge({ home: () => homedir(), envHome: () => process.env.DSH_HOME });
+    void shellBridge.apply();
     const deps = () => ({
         exec: childProcessExec,
         sectionRootDir: () => readVolatile(currentConfig().rootDir),
@@ -149,6 +159,7 @@ export function apply(ctx, config = {}) {
         sectionCnAccelerateUrl: () => readVolatile(currentConfig().cnAccelerateUrl),
         home: () => homedir(),
         envHome: () => process.env.DSH_HOME,
+        refreshShellBridge: () => shellBridge.apply(),
     });
     // In dsh 0.1.7+, the settings service projects volatile Config fields into forms.
     // We configure auto: false to inform the host that this plugin provides its own
@@ -163,6 +174,14 @@ export function apply(ctx, config = {}) {
     ctx.inject(['tools'], (toolsCtx) => {
         const tools = toolsCtx.tools;
         toolsCtx.effect(() => tools.register(gitCredentialsTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_credentials tool');
+        // The panel routes inject the stored credentials into the requests the
+        // browser half makes; a shell command is served by the environment bridge
+        // (see `shell-bridge.ts`) instead. This tool is the deterministic path for
+        // a session: it runs one network subcommand with the `-c
+        // http.<url>.extraHeader` prefix, so the command authenticates as the
+        // configured account and the secret never enters the conversation — even
+        // when the bridge is missing (an older host, a shell outside the plugin).
+        toolsCtx.effect(() => tools.register(gitNetworkTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_network tool');
     });
     ctx.inject(['webServer'], (webCtx) => {
         /** Send one outcome as JSON; no-store because repo facts are point-in-time. */

package/lib/network-tool.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The model-facing `git_network` tool (host half).
+ *
+ * The credentials panel stores one token per remote host and makes it work on
+ * two channels: the panel's own fetch / pull / push routes (`-c
+ * http.<url>.extraHeader=…`, see `authConfigArgs`) and the environment bridge
+ * the host installs for the shells it spawns (`shell-bridge.ts`). This tool is
+ * the third, explicit one: it runs ONE git network command with the same
+ * `authConfigArgs` the routes use, so a session reliably pushes as the account
+ * the user configured and the secret never enters the conversation — including
+ * on a host that predates the bridge.
+ *
+ * It is deliberately narrower than a shell wrapper: a fixed subcommand
+ * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
+ * `--upload-pack` / `--receive-pack` / `-c` options, and an absolute
+ * `repoPath` as cwd. Those exclusions are about blast radius, not about
+ * authentication: the tool exists to let a session reach the network with the
+ * configured credential, not to become a general command runner.
+ *
+ * @module dsh-git-branch/network-tool
+ */
+import { type CredentialStore, type GitCredential } from './credentials.js';
+import { type Exec } from './git.js';
+/** Model-facing tool name. */
+export declare const GIT_NETWORK_TOOL_NAME = "git_network";
+/** The only git subcommands this tool will run. */
+export declare const GIT_NETWORK_SUBCOMMANDS: readonly ["fetch", "pull", "push", "ls-remote"];
+/** Upper bound on the argument vector (the panel's own commands need far fewer). */
+export declare const GIT_NETWORK_MAX_ARGS = 32;
+/** The arguments this tool accepts. */
+export interface GitNetworkArgs {
+    /** Absolute directory inside the target repository; the command's cwd. */
+    readonly repoPath?: string;
+    /** Git arguments, subcommand first (`['push', 'origin', 'main']`). */
+    readonly args?: readonly string[];
+}
+/** A validated request, ready to run. */
+export interface GitNetworkRequest {
+    readonly repoPath: string;
+    readonly args: readonly string[];
+}
+/** The canonical value `execute` returns. */
+export interface GitNetworkValue {
+    /** Directory the command ran in (echoed for the transcript). */
+    readonly repoPath: string;
+    /** The git subcommand that ran. */
+    readonly subcommand: string;
+    /** git's exit status; a non-zero status is a normal result, not an error. */
+    readonly exitCode: number;
+    /** Standard output, secret-redacted and length-capped. */
+    readonly stdout: string;
+    /** Standard error, secret-redacted and length-capped. */
+    readonly stderr: string;
+    /** Hosts a credential was injected for (injected in full on every call). */
+    readonly authenticatedHosts: readonly string[];
+    /** Whether either stream was cut at the length cap. */
+    readonly truncated: boolean;
+    /** Why the credential store could not be read; the command then ran bare. */
+    readonly credentialsError?: string;
+}
+/** Host-side seams the tool reads through. */
+export interface GitNetworkToolDeps {
+    /** User home directory seam. */
+    readonly home: () => string;
+    /** `$DSH_HOME` seam (blank/undefined = unset). */
+    readonly envHome: () => string | undefined;
+    /** Store seam; the fs-backed store at the resolved path when absent. */
+    readonly store?: CredentialStore;
+    /** Process seam; the real `git` over node:child_process when absent. */
+    readonly exec?: Exec;
+}
+/** A tool definition as `ctx.tools.register` accepts it. */
+export interface GitNetworkTool {
+    readonly name: string;
+    readonly description: string;
+    readonly parameters: Record<string, unknown>;
+    readonly output: {
+        readonly schema: Record<string, unknown>;
+        readonly render: (args: GitNetworkArgs, value: GitNetworkValue) => readonly {
+            readonly type: 'text';
+            readonly text: string;
+        }[];
+    };
+    readonly execute: (args: GitNetworkArgs, exec?: {
+        readonly signal?: AbortSignal;
+    }) => Promise<GitNetworkValue>;
+}
+/**
+ * Why a request cannot run (undefined = fine). Pure and exhaustive so the
+ * tests can pin every rejection without spawning git.
+ * @param repoPath - the requested cwd (validated as an absolute path).
+ * @param args - the requested git argument vector (subcommand first).
+ */
+export declare function gitNetworkRequestIssue(repoPath: unknown, args: unknown): string | undefined;
+/**
+ * Remove stored secrets — raw and in the Basic header's base64 form — from
+ * git's own diagnostics. git does not echo the Authorization header, but the
+ * redaction also covers a remote URL that embeds the token, and costs one
+ * pass per stored host.
+ * @param text - one captured stream.
+ * @param entries - the credentials that were injected.
+ */
+export declare function redactSecrets(text: string, entries: readonly GitCredential[]): string;
+/** Compose the model-facing text of one result. */
+export declare function renderGitNetwork(value: GitNetworkValue): string;
+/**
+ * Build the `git_network` tool definition.
+ * @param deps - host seams (home/env, an optional store and an optional exec).
+ * @returns a definition ready for `ctx.tools.register`.
+ */
+export declare function gitNetworkTool(deps: GitNetworkToolDeps): GitNetworkTool;

package/lib/network-tool.js

@@ -0,0 +1,250 @@
+/**
+ * The model-facing `git_network` tool (host half).
+ *
+ * The credentials panel stores one token per remote host and makes it work on
+ * two channels: the panel's own fetch / pull / push routes (`-c
+ * http.<url>.extraHeader=…`, see `authConfigArgs`) and the environment bridge
+ * the host installs for the shells it spawns (`shell-bridge.ts`). This tool is
+ * the third, explicit one: it runs ONE git network command with the same
+ * `authConfigArgs` the routes use, so a session reliably pushes as the account
+ * the user configured and the secret never enters the conversation — including
+ * on a host that predates the bridge.
+ *
+ * It is deliberately narrower than a shell wrapper: a fixed subcommand
+ * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
+ * `--upload-pack` / `--receive-pack` / `-c` options, and an absolute
+ * `repoPath` as cwd. Those exclusions are about blast radius, not about
+ * authentication: the tool exists to let a session reach the network with the
+ * configured credential, not to become a general command runner.
+ *
+ * @module dsh-git-branch/network-tool
+ */
+import { isAbsolute } from 'node:path';
+import { authConfigArgs, basicUsername, createCredentialStore, credentialFilePath, } from './credentials.js';
+import { childProcessExec, NETWORK_TIMEOUT_MS } from './git.js';
+/** Model-facing tool name. */
+export const GIT_NETWORK_TOOL_NAME = 'git_network';
+/** The only git subcommands this tool will run. */
+export const GIT_NETWORK_SUBCOMMANDS = ['fetch', 'pull', 'push', 'ls-remote'];
+/** Upper bound on the argument vector (the panel's own commands need far fewer). */
+export const GIT_NETWORK_MAX_ARGS = 32;
+/** Upper bound on one argument token. */
+const MAX_TOKEN_LENGTH = 512;
+/** Output kept from each stream, in characters; git diagnostics are short. */
+const MAX_OUTPUT_CHARS = 64 * 1024;
+/**
+ * Global options that would either replace the injected credential, point
+ * git at another repository, or load another config. They belong BEFORE the
+ * subcommand in git's own grammar, so the allow-list below already rejects
+ * them; this set is defence in depth for arguments passed after it.
+ */
+const BLOCKED_FLAGS = new Set([
+    '-c',
+    '--config-env',
+    '--exec-path',
+    '--git-dir',
+    '--work-tree',
+    '--namespace',
+    '--bare',
+    '--no-replace-objects',
+]);
+/** Same defence for flags that take a value with `=`. */
+const BLOCKED_PREFIXES = ['--config-env=', '--upload-pack', '--receive-pack', '--exec='];
+/** `push` is the one subcommand where these change the remote irreversibly. */
+const PUSH_BLOCKED_FLAGS = new Set([
+    '-f',
+    '--force',
+    '--force-with-lease',
+    '--force-if-includes',
+    '--mirror',
+    '--delete',
+    '-d',
+    '--prune',
+]);
+/**
+ * Why a request cannot run (undefined = fine). Pure and exhaustive so the
+ * tests can pin every rejection without spawning git.
+ * @param repoPath - the requested cwd (validated as an absolute path).
+ * @param args - the requested git argument vector (subcommand first).
+ */
+export function gitNetworkRequestIssue(repoPath, args) {
+    if (typeof repoPath !== 'string' || repoPath.trim() === '')
+        return '"repoPath" must be a non-empty string';
+    if (!isAbsolute(repoPath))
+        return '"repoPath" must be an absolute path';
+    if (!Array.isArray(args) || args.length === 0)
+        return '"args" must be a non-empty array of git arguments';
+    if (args.length > GIT_NETWORK_MAX_ARGS)
+        return `"args" may hold at most ${String(GIT_NETWORK_MAX_ARGS)} items`;
+    const tokens = [];
+    for (const item of args) {
+        if (typeof item !== 'string')
+            return '"args" must contain only strings';
+        if (item === '' || item.includes('\0'))
+            return '"args" must not contain empty or NUL tokens';
+        if (item.length > MAX_TOKEN_LENGTH)
+            return `one argument exceeds ${String(MAX_TOKEN_LENGTH)} characters`;
+        tokens.push(item);
+    }
+    const subcommand = tokens[0];
+    if (subcommand === undefined)
+        return '"args" must name a git subcommand first';
+    if (!GIT_NETWORK_SUBCOMMANDS.includes(subcommand)) {
+        return `"${subcommand}" is not permitted here; use one of ${GIT_NETWORK_SUBCOMMANDS.join(', ')}`;
+    }
+    for (const token of tokens.slice(1)) {
+        if (BLOCKED_FLAGS.has(token))
+            return `"${token}" is not permitted by this tool`;
+        const blocked = BLOCKED_PREFIXES.find(prefix => token.startsWith(prefix));
+        if (blocked !== undefined)
+            return `"${blocked}…" is not permitted by this tool`;
+        if (subcommand === 'push') {
+            if (PUSH_BLOCKED_FLAGS.has(token))
+                return `"${token}" is not permitted: this tool never forces or deletes on the remote`;
+            if (token.startsWith('+') || token.startsWith(':')) {
+                return 'force/delete refspecs ("+" or ":") are not permitted: this tool never forces or deletes on the remote';
+            }
+        }
+    }
+    return undefined;
+}
+/** Validate one raw request or throw the reason as a plain Error. */
+function requestOf(args) {
+    const issue = gitNetworkRequestIssue(args.repoPath, args.args);
+    if (issue !== undefined)
+        throw new Error(issue);
+    return { repoPath: args.repoPath, args: [...args.args] };
+}
+/** Cut one stream at the cap; `truncated` reports whether anything was lost. */
+function cap(text) {
+    return text.length <= MAX_OUTPUT_CHARS
+        ? { text, truncated: false }
+        : { text: text.slice(0, MAX_OUTPUT_CHARS), truncated: true };
+}
+/**
+ * Remove stored secrets — raw and in the Basic header's base64 form — from
+ * git's own diagnostics. git does not echo the Authorization header, but the
+ * redaction also covers a remote URL that embeds the token, and costs one
+ * pass per stored host.
+ * @param text - one captured stream.
+ * @param entries - the credentials that were injected.
+ */
+export function redactSecrets(text, entries) {
+    let out = text;
+    for (const entry of entries) {
+        if (entry.secret !== '')
+            out = out.split(entry.secret).join('****');
+        const basic = Buffer.from(`${basicUsername(entry)}:${entry.secret}`, 'utf8').toString('base64');
+        out = out.split(basic).join('****');
+    }
+    return out;
+}
+/** Compose the model-facing text of one result. */
+export function renderGitNetwork(value) {
+    const hosts = value.authenticatedHosts.length === 0 ? 'none' : value.authenticatedHosts.join(', ');
+    const lines = [
+        `git ${value.subcommand} (exit ${String(value.exitCode)}) in ${value.repoPath}`,
+        `credentials injected for: ${hosts}`,
+    ];
+    if (value.credentialsError !== undefined)
+        lines.push(`credentials unavailable: ${value.credentialsError}`);
+    if (value.stdout.trim() !== '')
+        lines.push('--- stdout ---', value.stdout.trimEnd());
+    if (value.stderr.trim() !== '')
+        lines.push('--- stderr ---', value.stderr.trimEnd());
+    if (value.truncated)
+        lines.push('(output truncated at the length cap)');
+    return lines.join('\n');
+}
+/**
+ * Build the `git_network` tool definition.
+ * @param deps - host seams (home/env, an optional store and an optional exec).
+ * @returns a definition ready for `ctx.tools.register`.
+ */
+export function gitNetworkTool(deps) {
+    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const exec = deps.exec ?? childProcessExec;
+    return {
+        name: GIT_NETWORK_TOOL_NAME,
+        description: 'Run ONE git network command (fetch, pull, push or ls-remote) inside a repository with the '
+            + 'plugin\'s stored Git credentials injected, so the command authenticates as the account configured in the '
+            + 'Git credential panel instead of whatever the machine\'s git credential helper happens to hold. Prefer it for '
+            + 'every push/fetch/pull: the credential is injected explicitly and redacted from the output, while a plain '
+            + 'shell `git push` only reaches these credentials through the environment bridge the plugin host installs '
+            + 'for the shells it spawns. That bridge is absent in an older host or in a terminal started outside it; there '
+            + 'git clears the machine helper chain too, so an unconfigured host fails fast with a "terminal prompts '
+            + 'disabled" error instead of opening a credential dialog nobody can answer. Pass the git '
+            + 'arguments subcommand-first, for example ["push"], ["fetch", "--all", "--prune"] or '
+            + '["push", "origin", "main"]. Force/delete refspecs, --force/--delete/--mirror/--prune and '
+            + '--upload-pack/--receive-pack style options are rejected by design. The secret itself never appears in the '
+            + 'result: only exit status, redacted stdout/stderr and the hosts that were authenticated.',
+        parameters: {
+            type: 'object',
+            properties: {
+                repoPath: {
+                    type: 'string',
+                    description: 'Absolute path to any directory inside the target repository; the command runs with this as cwd.',
+                },
+                args: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Git arguments with the subcommand first. Permitted subcommands: fetch, pull, push, ls-remote.',
+                },
+            },
+            required: ['repoPath', 'args'],
+            additionalProperties: false,
+        },
+        output: {
+            schema: {
+                type: 'object',
+                properties: {
+                    repoPath: { type: 'string' },
+                    subcommand: { type: 'string' },
+                    exitCode: { type: 'integer' },
+                    stdout: { type: 'string' },
+                    stderr: { type: 'string' },
+                    authenticatedHosts: { type: 'array', items: { type: 'string' } },
+                    truncated: { type: 'boolean' },
+                    credentialsError: { type: 'string' },
+                },
+                required: ['repoPath', 'subcommand', 'exitCode', 'stdout', 'stderr', 'authenticatedHosts', 'truncated'],
+            },
+            render: (_args, value) => [
+                { type: 'text', text: renderGitNetwork(value) },
+            ],
+        },
+        async execute(raw) {
+            const request = requestOf(raw ?? {});
+            let entries = [];
+            let credentialsError;
+            try {
+                entries = await storeOf().load();
+            }
+            catch (error) {
+                // A damaged credential file must not make the tool unusable: run the
+                // command bare and report why, exactly like the routes do.
+                credentialsError = error instanceof Error ? error.message : String(error);
+            }
+            const hosts = [...new Set(entries.map(entry => entry.host))].sort();
+            const result = await exec('git', [...authConfigArgs(entries), ...request.args], {
+                cwd: request.repoPath,
+                timeoutMs: NETWORK_TIMEOUT_MS,
+            });
+            const stdout = cap(redactSecrets(result.stdout, entries));
+            const stderrSource = result.stderr.trim() === '' && result.errorMessage !== undefined
+                ? result.errorMessage
+                : result.stderr;
+            const stderr = cap(redactSecrets(stderrSource, entries));
+            return {
+                repoPath: request.repoPath,
+                subcommand: request.args[0] ?? '',
+                exitCode: result.code,
+                stdout: stdout.text,
+                stderr: stderr.text,
+                authenticatedHosts: hosts,
+                truncated: stdout.truncated || stderr.truncated,
+                ...(credentialsError === undefined ? {} : { credentialsError }),
+            };
+        },
+    };
+}

package/lib/routes.d.ts

@@ -44,6 +44,9 @@ export interface RouteDeps {
     /** Global per-host credential store. Absent = the fs-backed store at the
      * resolved dsh home; tests substitute an in-memory one. */
     credentialsStore?: CredentialStore;
+    /** Re-derive the shell credential bridge after the store changed (absent =
+     * a host that does not provide the bridge; tests omit it). */
+    refreshShellBridge?: () => Promise<void>;
 }
 /** Real fs-backed one-level directory listing (names only). Plain FILES are
  * filtered out — the storage root can carry strays (a legacy settings.json

package/lib/routes.js

@@ -73,6 +73,23 @@ async function authArgsFor(deps) {
         return [];
     }
 }
+/**
+ * Re-derive the shell credential bridge after a credential changed, so a
+ * message sent in the same session can `git push` with the token the user just
+ * saved. A bridge failure must never fail the save itself: the store write has
+ * already landed, and the worst case is a stale environment until the next
+ * save (an added host is not reachable, a deleted one may still be).
+ */
+async function refreshBridge(deps) {
+    if (deps.refreshShellBridge === undefined)
+        return;
+    try {
+        await deps.refreshShellBridge();
+    }
+    catch {
+        // Deliberately swallowed; see the contract above.
+    }
+}
 /** Upper bound on distinct paths one /group request may probe. */
 const GROUP_PATHS_LIMIT = 256;
 /** Probes per in-flight batch — polite on Windows, where each git call is a
@@ -1362,6 +1379,7 @@ export async function handleCredentialsSave(deps, body) {
             updatedAt: Date.now(),
         });
         await store.save(next);
+        await refreshBridge(deps);
         const result = { credentials: sortCredentials(next).map(credentialView) };
         return { status: 200, body: result };
     }
@@ -1389,6 +1407,7 @@ export async function handleCredentialsDelete(deps, body) {
         if (next.length === entries.length)
             return fail(400, `no credential is stored for "${host}"`);
         await store.save(next);
+        await refreshBridge(deps);
         const result = { credentials: sortCredentials(next).map(credentialView) };
         return { status: 200, body: result };
     }
@@ -1495,6 +1514,7 @@ export async function handleCredentialsOAuthPoll(deps, body) {
             updatedAt: Date.now(),
         });
         await store.save(next);
+        await refreshBridge(deps);
         const done = { status: 'done', credentials: sortCredentials(next).map(credentialView) };
         return { status: 200, body: done };
     }

package/lib/shell-bridge.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Shell credential bridge (host half). The credential panel stores one token
+ * per remote host, but 0029 could only inject it into the panel's own routes
+ * and the `git_network` tool; a plain `git push` run in a shell authenticated
+ * as whatever the machine's credential helper held — often a different
+ * account — or hung on an interactive prompt nobody could answer.
+ *
+ * This module closes that gap without touching the user's git configuration
+ * FILES (0021's constraint): it exports `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
+ * `GIT_CONFIG_VALUE_n` entries that install the bundled credential helper
+ * (`helpers/git-credential-bridge.js`) as a URL-scoped helper for every stored
+ * host. git reads that environment as configuration, every child process the
+ * host spawns inherits it, and a non-empty value list is always preceded by the
+ * same key with an empty value — git resets the accumulated helper list
+ * there, so the machine chain (`helper-selector` → GCM) can neither answer
+ * with a different account nor open a blocking dialog for those hosts.
+ * The list is reset globally as well: a host with no stored credential then
+ * fails at once ("terminal prompts disabled") instead of reaching the machine
+ * chain, whose interactive GUI dialog nobody in an agent shell can answer.
+ *
+ * `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` ride along so a host
+ * with no usable credential fails fast instead of parking a shell on a prompt
+ * (the failure mode that started this: a 3m38s silent hang).
+ *
+ * The assignments are re-derived whenever the credential store changes
+ * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
+ */
+import { type CredentialStore } from './credentials.js';
+/** Env var carrying the credential file path to the helper script. */
+export declare const BRIDGE_HELPER_ENV = "DSH_GIT_BRIDGE_HELPER";
+/** Env var carrying a debug log path to the helper script (unset by default). */
+export declare const BRIDGE_DEBUG_ENV = "DSH_GIT_BRIDGE_DEBUG";
+/** Host-side seams the bridge reads through (tests substitute all of them). */
+export interface ShellBridgeDeps {
+    /** User home directory seam. */
+    readonly home: () => string;
+    /** `$DSH_HOME` seam (blank/undefined = unset). */
+    readonly envHome: () => string | undefined;
+    /** Store seam; the fs-backed store at the resolved path when absent. */
+    readonly store?: CredentialStore;
+    /** The environment object to mutate; `process.env` when absent. */
+    readonly env?: Record<string, string | undefined>;
+    /** Absolute helper script path; the compiled sibling under `helpers/` when
+     * absent. */
+    readonly helperPath?: string;
+    /** Node executable that runs the helper; `process.execPath` when absent. */
+    readonly nodePath?: string;
+}
+/** The bridge's one operation: re-derive the environment from the store. */
+export interface ShellBridge {
+    /** Read the credential store and rewrite the injected environment.
+     * A store that cannot be read drops every URL-scoped helper (no host can be
+     * bridged), but keeps the global reset, so shell git still fails fast
+     * instead of opening an interactive credential dialog. */
+    readonly apply: () => Promise<void>;
+}
+/** One ordered environment assignment. */
+export type BridgeAssignment = readonly [key: string, value: string];
+/**
+ * Quote one executable or path for git's `!` shell command. Backslashes are
+ * normalized to forward slashes first: git runs `!` helpers through `sh`,
+ * where `C:\…` would be read as escape sequences.
+ * @param value - an absolute path.
+ */
+export declare function shellQuote(value: string): string;
+/**
+ * The helper command git runs for one configured host: a `!`-prefixed shell
+ * command, because git does not word-split a helper value by itself (a bare
+ * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
+ * @param nodePath - the node executable.
+ * @param helperPath - the compiled helper script.
+ */
+export declare function bridgeCommand(nodePath: string, helperPath: string): string;
+/**
+ * The ordered environment assignments for the given hosts: per host an empty
+ * helper value (git resets the accumulated list for that URL scope) and then
+ * the bridge command, plus the credential-file variable the helper reads and
+ * the two fail-fast switches.
+ * @param hosts - normalized hosts with a stored credential.
+ * @param options - process paths and the credential file.
+ */
+export declare function shellBridgeEnv(hosts: readonly string[], options: {
+    readonly nodePath: string;
+    readonly helperPath: string;
+    readonly credentialFile: string;
+}): readonly BridgeAssignment[];
+/**
+ * Build the bridge over one host process. Every {@link ShellBridge.apply}
+ * first removes the assignments it made last time, so a deleted host loses
+ * its helper scope just like a freshly added one gains it.
+ * @param deps - host seams.
+ */
+export declare function createShellBridge(deps: ShellBridgeDeps): ShellBridge;

package/lib/shell-bridge.js

@@ -0,0 +1,121 @@
+/**
+ * Shell credential bridge (host half). The credential panel stores one token
+ * per remote host, but 0029 could only inject it into the panel's own routes
+ * and the `git_network` tool; a plain `git push` run in a shell authenticated
+ * as whatever the machine's credential helper held — often a different
+ * account — or hung on an interactive prompt nobody could answer.
+ *
+ * This module closes that gap without touching the user's git configuration
+ * FILES (0021's constraint): it exports `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
+ * `GIT_CONFIG_VALUE_n` entries that install the bundled credential helper
+ * (`helpers/git-credential-bridge.js`) as a URL-scoped helper for every stored
+ * host. git reads that environment as configuration, every child process the
+ * host spawns inherits it, and a non-empty value list is always preceded by the
+ * same key with an empty value — git resets the accumulated helper list
+ * there, so the machine chain (`helper-selector` → GCM) can neither answer
+ * with a different account nor open a blocking dialog for those hosts.
+ * The list is reset globally as well: a host with no stored credential then
+ * fails at once ("terminal prompts disabled") instead of reaching the machine
+ * chain, whose interactive GUI dialog nobody in an agent shell can answer.
+ *
+ * `GIT_TERMINAL_PROMPT=0` and `GCM_INTERACTIVE=never` ride along so a host
+ * with no usable credential fails fast instead of parking a shell on a prompt
+ * (the failure mode that started this: a 3m38s silent hang).
+ *
+ * The assignments are re-derived whenever the credential store changes
+ * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
+ */
+import { fileURLToPath } from 'node:url';
+import { credentialFilePath, createCredentialStore, } from './credentials.js';
+/** Env var carrying the credential file path to the helper script. */
+export const BRIDGE_HELPER_ENV = 'DSH_GIT_BRIDGE_HELPER';
+/** Env var carrying a debug log path to the helper script (unset by default). */
+export const BRIDGE_DEBUG_ENV = 'DSH_GIT_BRIDGE_DEBUG';
+/**
+ * Quote one executable or path for git's `!` shell command. Backslashes are
+ * normalized to forward slashes first: git runs `!` helpers through `sh`,
+ * where `C:\…` would be read as escape sequences.
+ * @param value - an absolute path.
+ */
+export function shellQuote(value) {
+    return `"${value.replace(/\\/g, '/')}"`;
+}
+/**
+ * The helper command git runs for one configured host: a `!`-prefixed shell
+ * command, because git does not word-split a helper value by itself (a bare
+ * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
+ * @param nodePath - the node executable.
+ * @param helperPath - the compiled helper script.
+ */
+export function bridgeCommand(nodePath, helperPath) {
+    return `!${shellQuote(nodePath)} ${shellQuote(helperPath)}`;
+}
+/**
+ * The ordered environment assignments for the given hosts: per host an empty
+ * helper value (git resets the accumulated list for that URL scope) and then
+ * the bridge command, plus the credential-file variable the helper reads and
+ * the two fail-fast switches.
+ * @param hosts - normalized hosts with a stored credential.
+ * @param options - process paths and the credential file.
+ */
+export function shellBridgeEnv(hosts, options) {
+    const unique = [...new Set(hosts)];
+    const assignments = [];
+    // Reset the WHOLE helper list first, even when no host is stored. Without it,
+    // any host without a stored credential still reaches the machine chain
+    // (`helper-selector` → GCM), which raises a GUI prompt no agent shell can
+    // answer — the dialog that kept popping up. With it, such a host fails at
+    // once with "terminal prompts disabled", and the URL-scoped pairs below are
+    // the only way credentials get back into a shell.
+    assignments.push(['GIT_CONFIG_COUNT', String(unique.length * 2 + 1)]);
+    assignments.push(['GIT_CONFIG_KEY_0', 'credential.helper'], ['GIT_CONFIG_VALUE_0', '']);
+    unique.forEach((host, index) => {
+        const key = `credential.https://${host}/.helper`;
+        const empty = String(index * 2 + 1);
+        const command = String(index * 2 + 2);
+        assignments.push([`GIT_CONFIG_KEY_${empty}`, key], [`GIT_CONFIG_VALUE_${empty}`, '']);
+        assignments.push([`GIT_CONFIG_KEY_${command}`, key], [`GIT_CONFIG_VALUE_${command}`, bridgeCommand(options.nodePath, options.helperPath)]);
+    });
+    assignments.push([BRIDGE_HELPER_ENV, options.credentialFile]);
+    // Fail fast instead of parking a shell on a prompt or a GUI dialog.
+    assignments.push(['GIT_TERMINAL_PROMPT', '0'], ['GCM_INTERACTIVE', 'never']);
+    return assignments;
+}
+/**
+ * Build the bridge over one host process. Every {@link ShellBridge.apply}
+ * first removes the assignments it made last time, so a deleted host loses
+ * its helper scope just like a freshly added one gains it.
+ * @param deps - host seams.
+ */
+export function createShellBridge(deps) {
+    const env = deps.env ?? process.env;
+    let applied = [];
+    return {
+        async apply() {
+            let hosts = [];
+            try {
+                hosts = (await (deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()))).load()).map(entry => entry.host);
+            }
+            catch {
+                // An unreadable store means no host can be bridged. The global helper
+                // reset still goes out, so shell git fails fast rather than popping a
+                // credential dialog nobody can answer.
+                hosts = [];
+            }
+            const helperPath = deps.helperPath
+                ?? fileURLToPath(new URL('./helpers/git-credential-bridge.js', import.meta.url));
+            const assignments = shellBridgeEnv(hosts, {
+                nodePath: deps.nodePath ?? process.execPath,
+                helperPath,
+                credentialFile: credentialFilePath(deps.home(), deps.envHome()),
+            });
+            for (const key of applied)
+                delete env[key];
+            applied = [];
+            for (const [key, value] of assignments) {
+                env[key] = value;
+                applied.push(key);
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-branch-manage",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "提供 git 分支与 worktree 管理：输入框工具栏显示当前分支、可原地切换；支持 IDEA 风格分支选择器、远程分支检出、右键操作菜单（新建/重命名/删除/复制）、推送与更新当前分支，以及把分支隔离到独立 worktree 工作区，并管理其创建与删除。",
   "keywords": [
     "dsh",