dsh-git-branch-manage 1.0.9 → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# 变更日志
+
+本文件记录 `dsh-git-branch-manage` 的重要变更。版本号遵循语义化版本。
+
+## [1.1.0] - 2026-11-02
+
+### 修复
+
+- **宿主里的 `git` 命令全部 `fatal`**（`fatal: unable to parse command-line config`）：0032 的 `GIT_CONFIG_KEY/VALUE_*` 环境注入被 DeepSeek Harness 的子进程环境清洗（按 `/KEY|PASSWORD|SECRET|TOKEN/i` 过滤变量名、并剥掉 `DSH_*` 前缀）半剥离——`KEY_n` 被删、`COUNT/VALUE_n` 幸存。改用 `GIT_CONFIG_GLOBAL` 指向一份会话临时 gitconfig 注入凭据（决策 0034）。
+- **shell 里的 `git` 走本机 gh 账号而非面板令牌**：会话配置用 URL 作用域的空 `helper` 重置，清掉 `~/.gitconfig` 里 `[credential "https://github.com"]` 的 gh helper，让已配置域名命中面板令牌。
+- **未配置域名弹 GCM 凭据对话框 / 挂死**：全局空 `helper` 清空机器 helper 链，未配置域名 `exit 128` 快速失败，不再弹窗。
+- **含空格的 node/helper 路径调用失败**（`sh: C:/Program: No such file or directory`）：`gitconfigEscape` / `shellQuote` 正确转义引号与反斜杠。
+
+### 变更
+
+- 新增 `createCredentialService`，把凭据入口收敛为单一服务（`store` / `authConfigArgs` / `refreshShellEnv` / `dispose`）；routes、`git_network`、密钥工具统一经它取 store 与注入通道（决策 0034）。
+- 桥 helper 环境变量改 `DGB_*` 命名（`DGB_BRIDGE_HELPER` 等），避开 DSH 环境清洗。
+- 新增真实 `git` 端到端回归测试（`shell-bridge-e2e`）：验证已配置域名命中桥令牌、空格路径正确调用、未配置域名快速失败。
+
+## [1.0.10] - 2026-10-30
+
+- shell 里的 `git push` 也走插件密钥（环境变量桥，决策 0032）。注：该注入通道在 DeepSeek Harness 宿主中失效，已由 1.1.0 修正（决策 0034）。
+
+更早版本见 [GitHub Releases](https://github.com/GaoHu1997/dsh-git-branch/releases)。

package/lib/credential-service.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The one entry point every credential channel goes through (decision 0034).
+ *
+ * Before this module the store, the `-c http.<url>.extraHeader` injection
+ * (`authConfigArgs`, 0021/0029) and the shell environment bridge
+ * (`shell-bridge.ts`, 0032/0034) were assembled in three places — the routes,
+ * the two model-facing tools and the plugin entry — each resolving the store
+ * path itself. Every future plugin that needs git credentials would have
+ * repeated that wiring and drifted from it.
+ *
+ * `createCredentialService` owns the store instance and both injection
+ * channels, so callers share one contract:
+ *
+ *  - {@link CredentialService.authConfigArgs} — the `-c extraHeader` pairs for
+ *    git commands the plugin itself runs (panel routes, `git_network`). The
+ *    token rides the argv of that one command and never an environment.
+ *  - {@link CredentialService.refreshShellEnv} — re-derive the session
+ *    gitconfig + `GIT_CONFIG_GLOBAL` environment so a plain shell `git push`
+ *    authenticates as configured. Call it after every store change.
+ *  - {@link CredentialService.dispose} — undo the environment injection and
+ *    delete the session config file (plugin teardown).
+ *
+ * A store that cannot be read degrades to "no credentials" on every channel
+ * (an unauthenticated command runs as it always did; the credentials route is
+ * where the file problem surfaces) — a broken file must never break git.
+ */
+import { type CredentialStore } from './credentials.js';
+/** Host-side seams the service reads through (tests substitute all of them). */
+export interface CredentialServiceDeps {
+    /** User home directory seam. */
+    readonly home: () => string;
+    /** `$DSH_HOME` seam (blank/undefined = unset). */
+    readonly envHome: () => string | undefined;
+    /** Store seam; the fs-backed store at the resolved path when absent. */
+    readonly store?: CredentialStore;
+    /** The environment object to mutate; `process.env` when absent. */
+    readonly env?: Record<string, string | undefined>;
+    /** Absolute helper script path; the compiled sibling under `helpers/` when absent. */
+    readonly helperPath?: string;
+    /** Node executable that runs the helper; `process.execPath` when absent. */
+    readonly nodePath?: string;
+    /** Directory for the session config; the OS temp dir when absent. */
+    readonly configDir?: () => string;
+    /** Exact session config path (tests); derived from the pid when absent. */
+    readonly configPath?: string;
+    /** User global config the session file includes; `<home>/.gitconfig` when absent. */
+    readonly userGitconfig?: string;
+}
+/** The single credential entry point. */
+export interface CredentialService {
+    /** The shared global store (one row per remote host). */
+    readonly store: CredentialStore;
+    /**
+     * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
+     * prepend to a git network command the plugin runs itself. A broken store
+     * degrades to "no credentials" rather than throwing.
+     */
+    readonly authConfigArgs: () => Promise<readonly string[]>;
+    /**
+     * Re-derive the shell credential environment after a credential changed, so
+     * a message sent in the same session can `git push` with the token the user
+     * just saved. Never throws: the worst case is a stale environment until the
+     * next refresh.
+     */
+    readonly refreshShellEnv: () => Promise<void>;
+    /** Remove the environment injection and delete the session config file. */
+    readonly dispose: () => Promise<void>;
+}
+/**
+ * Build the credential service for one host process: one store instance, one
+ * session-gitconfig bridge, shared by the routes and every tool.
+ * @param deps - host seams (see {@link CredentialServiceDeps}).
+ */
+export declare function createCredentialService(deps: CredentialServiceDeps): CredentialService;

package/lib/credential-service.js

@@ -0,0 +1,56 @@
+/**
+ * The one entry point every credential channel goes through (decision 0034).
+ *
+ * Before this module the store, the `-c http.<url>.extraHeader` injection
+ * (`authConfigArgs`, 0021/0029) and the shell environment bridge
+ * (`shell-bridge.ts`, 0032/0034) were assembled in three places — the routes,
+ * the two model-facing tools and the plugin entry — each resolving the store
+ * path itself. Every future plugin that needs git credentials would have
+ * repeated that wiring and drifted from it.
+ *
+ * `createCredentialService` owns the store instance and both injection
+ * channels, so callers share one contract:
+ *
+ *  - {@link CredentialService.authConfigArgs} — the `-c extraHeader` pairs for
+ *    git commands the plugin itself runs (panel routes, `git_network`). The
+ *    token rides the argv of that one command and never an environment.
+ *  - {@link CredentialService.refreshShellEnv} — re-derive the session
+ *    gitconfig + `GIT_CONFIG_GLOBAL` environment so a plain shell `git push`
+ *    authenticates as configured. Call it after every store change.
+ *  - {@link CredentialService.dispose} — undo the environment injection and
+ *    delete the session config file (plugin teardown).
+ *
+ * A store that cannot be read degrades to "no credentials" on every channel
+ * (an unauthenticated command runs as it always did; the credentials route is
+ * where the file problem surfaces) — a broken file must never break git.
+ */
+import { authConfigArgs, createCredentialStore, credentialFilePath, } from './credentials.js';
+import { createShellBridge } from './shell-bridge.js';
+/**
+ * Build the credential service for one host process: one store instance, one
+ * session-gitconfig bridge, shared by the routes and every tool.
+ * @param deps - host seams (see {@link CredentialServiceDeps}).
+ */
+export function createCredentialService(deps) {
+    const store = deps.store
+        ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const bridgeDeps = { ...deps, store };
+    const shellBridge = createShellBridge(bridgeDeps);
+    return {
+        store,
+        async authConfigArgs() {
+            try {
+                return authConfigArgs(await store.load());
+            }
+            catch {
+                return [];
+            }
+        },
+        refreshShellEnv() {
+            return shellBridge.apply();
+        },
+        dispose() {
+            return shellBridge.dispose();
+        },
+    };
+}

package/lib/credentials.d.ts

@@ -7,9 +7,13 @@
  * and the store is read/written by the host alone.
  *
  * Authentication rides `git -c http.https://<host>/.extraHeader=…` on the
- * panel's own network commands: the user's global git config and credential
- * helpers are left untouched. Only `https://` remotes receive the header;
- * ssh and plain-http remotes are never sent a secret.
+ * panel's own network commands and on the `git_network` tool: the user's git
+ * configuration FILES are never written. Plain `git` commands in a spawned
+ * shell are covered separately by the environment bridge in `shell-bridge.ts`,
+ * which installs this store's per-host tokens as URL-scoped credential helpers
+ * through `GIT_CONFIG_*` (process environment only, never a config file).
+ * Only `https://` remotes receive the header; ssh and plain-http remotes are
+ * never sent a secret.
  */
 import type { CredentialMethod } from './wire.js';
 /**

package/lib/credentials.js

@@ -7,9 +7,13 @@
  * and the store is read/written by the host alone.
  *
  * Authentication rides `git -c http.https://<host>/.extraHeader=…` on the
- * panel's own network commands: the user's global git config and credential
- * helpers are left untouched. Only `https://` remotes receive the header;
- * ssh and plain-http remotes are never sent a secret.
+ * panel's own network commands and on the `git_network` tool: the user's git
+ * configuration FILES are never written. Plain `git` commands in a spawned
+ * shell are covered separately by the environment bridge in `shell-bridge.ts`,
+ * which installs this store's per-host tokens as URL-scoped credential helpers
+ * through `GIT_CONFIG_*` (process environment only, never a config file).
+ * Only `https://` remotes receive the header; ssh and plain-http remotes are
+ * never sent a secret.
  */
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';

package/lib/helpers/git-credential-bridge.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Standalone git credential helper shipped with the dsh-git-branch plugin.
+ *
+ * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
+ * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
+ * This helper extends that coverage to a plain shell `git push`: the plugin's
+ * host process writes a session gitconfig (see `src/shell-bridge.ts`) that
+ * installs this script as a URL-scoped credential helper for every stored
+ * host, so commands the model runs in the shell authenticate as the
+ * configured account too.
+ *
+ * Design constraints (see docs/decisions/0029, 0032 and 0034):
+ *  - The user's global git config and credential helpers are never written;
+ *    the injection lives in one generated session config plus the process
+ *    environment only.
+ *  - The token never enters the conversation: this script reads the
+ *    credential file directly on the host and answers git on stdout.
+ *  - URL scope (`credential.https://<host>/`) confines the helper to hosts
+ *    with a stored credential. The host half also clears the machine helper
+ *    list, so a host this script cannot answer fails fast instead of opening
+ *    an interactive credential dialog.
+ *  - `get` is silent on a miss (git falls through to the next helper);
+ *    `store`/`erase` are pass-through by decision — writing back would race
+ *    the panel's atomic save and leak the file shape.
+ *
+ * Environment contract (set by src/shell-bridge.ts). The names carry no
+ * KEY/PASSWORD/SECRET/TOKEN substring and no `DSH_` prefix, because the DSH
+ * subprocess scrubber strips exactly those from inherited environments
+ * (decision 0034; a stripped path made this helper read the wrong file):
+ *  - `DGB_BRIDGE_HELPER` — credential file path (required).
+ *  - `DGB_BRIDGE_HOME` — user home directory (fallback resolution).
+ *  - `DGB_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
+ *  - `DGB_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
+ *
+ * @module dsh-git-branch/git-credential-bridge
+ */
+export {};

package/lib/helpers/git-credential-bridge.js

@@ -0,0 +1,119 @@
+/**
+ * Standalone git credential helper shipped with the dsh-git-branch plugin.
+ *
+ * The panel's credential file (`~/.dsh/git-credentials.json`) normally rides
+ * `-c http.<url>.extraHeader` config on the routes and the `git_network` tool.
+ * This helper extends that coverage to a plain shell `git push`: the plugin's
+ * host process writes a session gitconfig (see `src/shell-bridge.ts`) that
+ * installs this script as a URL-scoped credential helper for every stored
+ * host, so commands the model runs in the shell authenticate as the
+ * configured account too.
+ *
+ * Design constraints (see docs/decisions/0029, 0032 and 0034):
+ *  - The user's global git config and credential helpers are never written;
+ *    the injection lives in one generated session config plus the process
+ *    environment only.
+ *  - The token never enters the conversation: this script reads the
+ *    credential file directly on the host and answers git on stdout.
+ *  - URL scope (`credential.https://<host>/`) confines the helper to hosts
+ *    with a stored credential. The host half also clears the machine helper
+ *    list, so a host this script cannot answer fails fast instead of opening
+ *    an interactive credential dialog.
+ *  - `get` is silent on a miss (git falls through to the next helper);
+ *    `store`/`erase` are pass-through by decision — writing back would race
+ *    the panel's atomic save and leak the file shape.
+ *
+ * Environment contract (set by src/shell-bridge.ts). The names carry no
+ * KEY/PASSWORD/SECRET/TOKEN substring and no `DSH_` prefix, because the DSH
+ * subprocess scrubber strips exactly those from inherited environments
+ * (decision 0034; a stripped path made this helper read the wrong file):
+ *  - `DGB_BRIDGE_HELPER` — credential file path (required).
+ *  - `DGB_BRIDGE_HOME` — user home directory (fallback resolution).
+ *  - `DGB_BRIDGE_DSH_HOME` — `$DSH_HOME` override (optional).
+ *  - `DGB_BRIDGE_DEBUG` — when non-blank, a debug log path (optional).
+ *
+ * @module dsh-git-branch/git-credential-bridge
+ */
+import { appendFileSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** git helpers receive exactly one argument: the operation. */
+const OPERATION = process.argv[2] ?? 'get';
+/** The credential file this helper reads (`DGB_BRIDGE_HELPER` wins). */
+const DEFAULT_CREDENTIAL_FILE = 'git-credentials.json';
+/** The dsh home directory below the user profile when `$DSH_HOME` is unset. */
+const PACKAGE_HOME = '.dsh';
+/** The Basic-auth name a token without a username is sent under. */
+const TOKEN_USERNAME = 'oauth2';
+/**
+ * Append one debug line behind the user's back; a broken log path must never
+ * break the credential lookup.
+ */
+function debug(line) {
+    const path = process.env.DGB_BRIDGE_DEBUG;
+    if (path === undefined || path.trim() === '')
+        return;
+    try {
+        appendFileSync(path, `${line}\n`, 'utf8');
+    }
+    catch {
+        // Deliberately swallowed: debugging is best-effort.
+    }
+}
+/** The credential file this helper reads (`DGB_BRIDGE_HELPER` wins). */
+function credentialFile() {
+    const helper = process.env.DGB_BRIDGE_HELPER;
+    if (helper !== undefined && helper.trim() !== '')
+        return helper;
+    const dshHome = process.env.DGB_BRIDGE_DSH_HOME;
+    const home = dshHome !== undefined && dshHome.trim() !== ''
+        ? dshHome
+        : process.env.DGB_BRIDGE_HOME ?? homedir();
+    return join(home, PACKAGE_HOME, DEFAULT_CREDENTIAL_FILE);
+}
+/** One `key=value` request from git on stdin. */
+function readRequest() {
+    const text = readFileSync(0, 'utf8');
+    const request = new Map();
+    for (const line of text.split('\n')) {
+        const at = line.indexOf('=');
+        if (at > 0)
+            request.set(line.slice(0, at), line.slice(at + 1));
+    }
+    return request;
+}
+/** The stored credential for one host, or undefined when there is none. */
+function readCredential(host) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(credentialFile(), 'utf8'));
+    }
+    catch (error) {
+        debug(`read failed: ${String(error)}`);
+        return undefined;
+    }
+    const credentials = parsed.credentials;
+    if (!Array.isArray(credentials))
+        return undefined;
+    const entry = credentials.find((item) => typeof item === 'object' && item !== null && item.host === host);
+    if (entry === undefined)
+        return undefined;
+    const secret = typeof entry.secret === 'string' ? entry.secret : '';
+    if (secret === '')
+        return undefined;
+    const username = typeof entry.username === 'string' && entry.username.trim() !== ''
+        ? entry.username
+        : TOKEN_USERNAME;
+    return { username, secret };
+}
+if (OPERATION === 'get') {
+    const request = readRequest();
+    const host = request.get('host') ?? '';
+    debug(`get host=${host} protocol=${request.get('protocol') ?? ''}`);
+    const credential = readCredential(host);
+    if (credential !== undefined) {
+        process.stdout.write(`username=${credential.username}\npassword=${credential.secret}\n`);
+    }
+    // A miss stays silent: git tries the next helper in the chain.
+}
+// `store` / `erase` are deliberate no-ops (see the header comment).

package/lib/index.js

@@ -13,6 +13,7 @@ import { handleCredentials, handleCredentialsDelete, handleCredentialsOAuthPoll,
 import { validateRootDir } from './settings.js';
 import { gitNetworkTool } from './network-tool.js';
 import { gitCredentialsTool } from './tool.js';
+import { createCredentialService } from './credential-service.js';
 import { ROUTE_AI_COMMIT_MESSAGE, ROUTE_BRANCH, ROUTE_BRANCH_DELETE, ROUTE_BRANCH_RENAME, ROUTE_CHANGES, ROUTE_COMMIT, ROUTE_COMMIT_FILES, ROUTE_CREDENTIALS, ROUTE_CREDENTIALS_DELETE, ROUTE_CREDENTIALS_OAUTH_POLL, ROUTE_CREDENTIALS_OAUTH_START, ROUTE_CREDENTIALS_SAVE, ROUTE_ENSURE_DIRECTORY, ROUTE_EXISTS, ROUTE_FETCH, ROUTE_GROUP, ROUTE_INSPECT, ROUTE_LOG, ROUTE_PUSH, ROUTE_PURGE, ROUTE_REMOTE, ROUTE_REMOTES, ROUTE_REMOVE, ROUTE_STAGE, ROUTE_STATUS, ROUTE_SWITCH, ROUTE_TAG, ROUTE_TAG_PUSH, ROUTE_UPDATE, ROUTE_WORKTREE, ROUTE_WORKTREES_ALL } from './wire.js';
 export const name = 'dsh-git-branch';
 export const inject = [];
@@ -141,6 +142,19 @@ export function sectionOf(config) {
 export function apply(ctx, config = {}) {
     validateConfig(config);
     const currentConfig = () => ctx.fiber?.config ?? config;
+    // Host half of the credential channels: one service owns the store, the
+    // `-c extraHeader` injection for plugin-run commands and the shell bridge
+    // (decision 0034). The bridge lets a plain `git push` in a spawned shell
+    // authenticate with the panel's stored token instead of the machine helper's
+    // account. It also clears the machine helper chain, so a host without a
+    // stored token fails fast rather than opening a credential dialog no agent
+    // shell can answer. Applied at activate and re-derived after every
+    // credential save / delete / sign-in.
+    const credentials = createCredentialService({ home: () => homedir(), envHome: () => process.env.DSH_HOME });
+    void credentials.refreshShellEnv();
+    ctx.effect(() => () => {
+        void credentials.dispose();
+    }, 'git-worktree: credential service dispose');
     const deps = () => ({
         exec: childProcessExec,
         sectionRootDir: () => readVolatile(currentConfig().rootDir),
@@ -150,6 +164,8 @@ export function apply(ctx, config = {}) {
         sectionCnAccelerateUrl: () => readVolatile(currentConfig().cnAccelerateUrl),
         home: () => homedir(),
         envHome: () => process.env.DSH_HOME,
+        credentialsService: credentials,
+        refreshShellBridge: () => credentials.refreshShellEnv(),
     });
     // In dsh 0.1.7+, the settings service projects volatile Config fields into forms.
     // We configure auto: false to inform the host that this plugin provides its own
@@ -163,14 +179,15 @@ export function apply(ctx, config = {}) {
     // unless the user explicitly asked to see it.
     ctx.inject(['tools'], (toolsCtx) => {
         const tools = toolsCtx.tools;
-        toolsCtx.effect(() => tools.register(gitCredentialsTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_credentials tool');
-        // The panel routes are the only other place that injects the stored
-        // credentials; a model running `git push` through the shell would go out
-        // as the machine's helper account instead. This tool runs one network
-        // subcommand with the same `-c http.<url>.extraHeader` prefix, so the
-        // session can authenticate as the configured account without the secret
-        // ever entering the conversation.
-        toolsCtx.effect(() => tools.register(gitNetworkTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME })), 'git-worktree: git_network tool');
+        toolsCtx.effect(() => tools.register(gitCredentialsTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME, credentialsService: credentials })), 'git-worktree: git_credentials tool');
+        // The panel routes inject the stored credentials into the requests the
+        // browser half makes; a shell command is served by the environment bridge
+        // (see `shell-bridge.ts`) instead. This tool is the deterministic path for
+        // a session: it runs one network subcommand with the `-c
+        // http.<url>.extraHeader` prefix, so the command authenticates as the
+        // configured account and the secret never enters the conversation — even
+        // when the bridge is missing (an older host, a shell outside the plugin).
+        toolsCtx.effect(() => tools.register(gitNetworkTool({ home: () => homedir(), envHome: () => process.env.DSH_HOME, credentialsService: credentials })), 'git-worktree: git_network tool');
     });
     ctx.inject(['webServer'], (webCtx) => {
         /** Send one outcome as JSON; no-store because repo facts are point-in-time. */

package/lib/network-tool.d.ts

@@ -1,14 +1,14 @@
 /**
  * The model-facing `git_network` tool (host half).
  *
- * The credentials panel stores one token per remote host, but the panel's own
- * fetch / pull / push routes are the only places that inject it (`-c
- * http.<url>.extraHeader=…`). A model running `git push` through the shell
- * therefore authenticates as whatever the machine's credential helper holds —
- * often a different account, which is exactly the complaint this tool closes:
- * it runs ONE git network command with the same `authConfigArgs` the routes
- * use, so the session pushes as the account the user configured, and the
- * secret never enters the conversation.
+ * The credentials panel stores one token per remote host and makes it work on
+ * two channels: the panel's own fetch / pull / push routes (`-c
+ * http.<url>.extraHeader=…`, see `authConfigArgs`) and the environment bridge
+ * the host installs for the shells it spawns (`shell-bridge.ts`). This tool is
+ * the third, explicit one: it runs ONE git network command with the same
+ * `authConfigArgs` the routes use, so a session reliably pushes as the account
+ * the user configured and the secret never enters the conversation — including
+ * on a host that predates the bridge.
  *
  * It is deliberately narrower than a shell wrapper: a fixed subcommand
  * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
@@ -20,6 +20,7 @@
  * @module dsh-git-branch/network-tool
  */
 import { type CredentialStore, type GitCredential } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 import { type Exec } from './git.js';
 /** Model-facing tool name. */
 export declare const GIT_NETWORK_TOOL_NAME = "git_network";
@@ -66,6 +67,9 @@ export interface GitNetworkToolDeps {
     readonly envHome: () => string | undefined;
     /** Store seam; the fs-backed store at the resolved path when absent. */
     readonly store?: CredentialStore;
+    /** The single credential entry point (decision 0034); when wired its store
+     * is shared with the routes and the shell bridge. */
+    readonly credentialsService?: CredentialService;
     /** Process seam; the real `git` over node:child_process when absent. */
     readonly exec?: Exec;
 }

package/lib/network-tool.js

@@ -1,14 +1,14 @@
 /**
  * The model-facing `git_network` tool (host half).
  *
- * The credentials panel stores one token per remote host, but the panel's own
- * fetch / pull / push routes are the only places that inject it (`-c
- * http.<url>.extraHeader=…`). A model running `git push` through the shell
- * therefore authenticates as whatever the machine's credential helper holds —
- * often a different account, which is exactly the complaint this tool closes:
- * it runs ONE git network command with the same `authConfigArgs` the routes
- * use, so the session pushes as the account the user configured, and the
- * secret never enters the conversation.
+ * The credentials panel stores one token per remote host and makes it work on
+ * two channels: the panel's own fetch / pull / push routes (`-c
+ * http.<url>.extraHeader=…`, see `authConfigArgs`) and the environment bridge
+ * the host installs for the shells it spawns (`shell-bridge.ts`). This tool is
+ * the third, explicit one: it runs ONE git network command with the same
+ * `authConfigArgs` the routes use, so a session reliably pushes as the account
+ * the user configured and the secret never enters the conversation — including
+ * on a host that predates the bridge.
  *
  * It is deliberately narrower than a shell wrapper: a fixed subcommand
  * allow-list (fetch / pull / push / ls-remote), no force/delete refspecs, no
@@ -162,14 +162,18 @@ export function renderGitNetwork(value) {
  * @returns a definition ready for `ctx.tools.register`.
  */
 export function gitNetworkTool(deps) {
-    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
     const exec = deps.exec ?? childProcessExec;
     return {
         name: GIT_NETWORK_TOOL_NAME,
         description: 'Run ONE git network command (fetch, pull, push or ls-remote) inside a repository with the '
             + 'plugin\'s stored Git credentials injected, so the command authenticates as the account configured in the '
-            + 'Git credential panel instead of whatever the machine\'s git credential helper happens to hold. Use it when '
-            + 'you must push/fetch/pull yourself; a plain shell `git push` does NOT see these credentials. Pass the git '
+            + 'Git credential panel instead of whatever the machine\'s git credential helper happens to hold. Prefer it for '
+            + 'every push/fetch/pull: the credential is injected explicitly and redacted from the output, while a plain '
+            + 'shell `git push` only reaches these credentials through the environment bridge the plugin host installs '
+            + 'for the shells it spawns. That bridge is absent in an older host or in a terminal started outside it; there '
+            + 'git clears the machine helper chain too, so an unconfigured host fails fast with a "terminal prompts '
+            + 'disabled" error instead of opening a credential dialog nobody can answer. Pass the git '
             + 'arguments subcommand-first, for example ["push"], ["fetch", "--all", "--prune"] or '
             + '["push", "origin", "main"]. Force/delete refspecs, --force/--delete/--mirror/--prune and '
             + '--upload-pack/--receive-pack style options are rejected by design. The secret itself never appears in the '

package/lib/routes.d.ts

@@ -4,6 +4,7 @@
  */
 import { type CopyFilesSeams } from './copy-files.js';
 import { type CredentialStore } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 import { type DirExists, type ExcludeSeams, type Exec } from './git.js';
 import type { AiCommitMessageResult, ChangesResult, CommitFilesResult, CommitResult, CreateBranchResult, CreateTagResult, CreateWorktreeResult, CredentialOAuthPollResult, CredentialOAuthStartResult, CredentialsResult, EnsureDirectoryResult, FetchResult, GroupWorkspacesResult, InspectWorktreeResult, LogResult, PathExistsResult, PurgeDirectoryResult, PushTagResult, RemoveWorktreeResult, RemotesResult, RepoStatus, RouteError, StageResult, SwitchResult, UpdateResult, WorktreesAllResult } from './wire.js';
 /** Everything the handlers need from the host half. */
@@ -44,6 +45,12 @@ export interface RouteDeps {
     /** Global per-host credential store. Absent = the fs-backed store at the
      * resolved dsh home; tests substitute an in-memory one. */
     credentialsStore?: CredentialStore;
+    /** The single credential entry point (decision 0034): when wired, it owns
+     * the store and both injection channels, and the seams below are ignored. */
+    credentialsService?: CredentialService;
+    /** Re-derive the shell credential bridge after the store changed (absent =
+     * a host that does not provide the bridge; tests omit it). */
+    refreshShellBridge?: () => Promise<void>;
 }
 /** Real fs-backed one-level directory listing (names only). Plain FILES are
  * filtered out — the storage root can carry strays (a legacy settings.json

package/lib/routes.js

@@ -53,10 +53,11 @@ function accelPrefix(deps) {
     const url = deps.sectionCnAccelerateUrl?.() ?? ACCEL_DEFAULT_URL;
     return accelerateUrlError(url) === undefined ? normalizeAccelerateUrl(url) : undefined;
 }
-/** The global credential store: the wired one, else the fs-backed file at the
- * resolved dsh home (`<dshHome>/git-credentials.json`). */
+/** The global credential store: the service's shared instance (decision 0034),
+ * else the wired store, else the fs-backed file at the resolved dsh home
+ * (`<dshHome>/git-credentials.json`). */
 function credentialStore(deps) {
-    return deps.credentialsStore ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    return deps.credentialsService?.store ?? deps.credentialsStore ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
 }
 /**
  * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
@@ -66,6 +67,8 @@ function credentialStore(deps) {
  * route is where the file problem surfaces.
  */
 async function authArgsFor(deps) {
+    if (deps.credentialsService !== undefined)
+        return deps.credentialsService.authConfigArgs();
     try {
         return authConfigArgs(await credentialStore(deps).load());
     }
@@ -73,6 +76,24 @@ async function authArgsFor(deps) {
         return [];
     }
 }
+/**
+ * Re-derive the shell credential bridge after a credential changed, so a
+ * message sent in the same session can `git push` with the token the user just
+ * saved. A bridge failure must never fail the save itself: the store write has
+ * already landed, and the worst case is a stale environment until the next
+ * save (an added host is not reachable, a deleted one may still be).
+ */
+async function refreshBridge(deps) {
+    const refresh = deps.credentialsService?.refreshShellEnv ?? deps.refreshShellBridge;
+    if (refresh === undefined)
+        return;
+    try {
+        await refresh();
+    }
+    catch {
+        // Deliberately swallowed; see the contract above.
+    }
+}
 /** Upper bound on distinct paths one /group request may probe. */
 const GROUP_PATHS_LIMIT = 256;
 /** Probes per in-flight batch — polite on Windows, where each git call is a
@@ -1362,6 +1383,7 @@ export async function handleCredentialsSave(deps, body) {
             updatedAt: Date.now(),
         });
         await store.save(next);
+        await refreshBridge(deps);
         const result = { credentials: sortCredentials(next).map(credentialView) };
         return { status: 200, body: result };
     }
@@ -1389,6 +1411,7 @@ export async function handleCredentialsDelete(deps, body) {
         if (next.length === entries.length)
             return fail(400, `no credential is stored for "${host}"`);
         await store.save(next);
+        await refreshBridge(deps);
         const result = { credentials: sortCredentials(next).map(credentialView) };
         return { status: 200, body: result };
     }
@@ -1495,6 +1518,7 @@ export async function handleCredentialsOAuthPoll(deps, body) {
             updatedAt: Date.now(),
         });
         await store.save(next);
+        await refreshBridge(deps);
         const done = { status: 'done', credentials: sortCredentials(next).map(credentialView) };
         return { status: 200, body: done };
     }

package/lib/shell-bridge.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Shell credential bridge (host half) — session gitconfig channel. The
+ * credential panel stores one token per remote host, but 0029 could only
+ * inject it into the panel's own routes and the `git_network` tool; a plain
+ * `git push` run in a shell authenticated as whatever the machine's
+ * credential helper held — often a different account — or hung on an
+ * interactive prompt nobody could answer.
+ *
+ * 0032 closed that gap with `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
+ * `GIT_CONFIG_VALUE_n` environment entries. That channel is dead on a DSH
+ * host: the subprocess environment scrubber
+ * (`@deepseek-ai/dsh-subprocess`, `SENSITIVE_ENV_PATTERN = /KEY|PASSWORD|SECRET|TOKEN/i`
+ * plus every `DSH_*` name) strips the `GIT_CONFIG_KEY_*` names and keeps
+ * `GIT_CONFIG_COUNT`/`VALUE_*`, so git starts with a half-parsed config and
+ * dies with `fatal: unable to parse command-line config` — every git command
+ * in the shell, not only the networked ones (0034).
+ *
+ * The replacement writes ONE generated gitconfig per host process and points
+ * git at it with `GIT_CONFIG_GLOBAL` — a name the scrubber keeps. The file:
+ *
+ *  1. `[include]`s the user's own `~/.gitconfig` (read-only; 0021's "never
+ *     write the user's git config files" stands) so identity, proxies and
+ *     `http.sslBackend` keep working;
+ *  2. resets the whole `credential.helper` list to empty, cutting the machine
+ *     chain (`helper-selector` → GCM) and any helper the included user config
+ *     carries (the local `gh` helper being the motivating case);
+ *  3. per stored host, resets that URL scope and then installs the bundled
+ *     helper (`helpers/git-credential-bridge.js`) as a `!`-shell command.
+ *
+ * A host with no stored credential then fails at once ("terminal prompts
+ * disabled") instead of reaching the machine chain, whose interactive GUI
+ * dialog nobody in an agent shell can answer. `GIT_TERMINAL_PROMPT=0` and
+ * `GCM_INTERACTIVE=never` ride along as the last line of defence.
+ *
+ * Environment contract (all names survive the scrubber — no KEY/PASSWORD/
+ * SECRET/TOKEN substring, no `DSH_` prefix):
+ *  - `GIT_CONFIG_GLOBAL` — the generated session config (0034).
+ *  - `DGB_BRIDGE_HELPER` — credential file path for the helper script.
+ *  - `GIT_TERMINAL_PROMPT` / `GCM_INTERACTIVE` — fail fast, never prompt.
+ *
+ * The file is re-derived whenever the credential store changes
+ * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
+ */
+import { type CredentialStore } from './credentials.js';
+/** Env var carrying the credential file path to the helper script. */
+export declare const BRIDGE_HELPER_ENV = "DGB_BRIDGE_HELPER";
+/** Env var carrying a debug log path to the helper script (unset by default). */
+export declare const BRIDGE_DEBUG_ENV = "DGB_BRIDGE_DEBUG";
+/** Env var pointing git at the generated session configuration file. */
+export declare const SESSION_GITCONFIG_ENV = "GIT_CONFIG_GLOBAL";
+/** Host-side seams the bridge reads through (tests substitute all of them). */
+export interface ShellBridgeDeps {
+    /** User home directory seam. */
+    readonly home: () => string;
+    /** `$DSH_HOME` seam (blank/undefined = unset). */
+    readonly envHome: () => string | undefined;
+    /** Store seam; the fs-backed store at the resolved path when absent. */
+    readonly store?: CredentialStore;
+    /** The environment object to mutate; `process.env` when absent. */
+    readonly env?: Record<string, string | undefined>;
+    /** Absolute helper script path; the compiled sibling under `helpers/` when
+     * absent. */
+    readonly helperPath?: string;
+    /** Node executable that runs the helper; `process.execPath` when absent. */
+    readonly nodePath?: string;
+    /** Directory for the session config; the OS temp dir when absent. */
+    readonly configDir?: () => string;
+    /** Exact session config path (tests); `<configDir>/dsh-git-branch-<pid>.gitconfig` when absent. */
+    readonly configPath?: string;
+    /** User global config the session file includes; `<home>/.gitconfig` when absent. */
+    readonly userGitconfig?: string;
+}
+/** The bridge's operations: re-derive the environment, and undo it. */
+export interface ShellBridge {
+    /** Read the credential store and rewrite the injected environment.
+     * A store that cannot be read drops every URL-scoped helper (no host can be
+     * bridged), but keeps the global reset, so shell git still fails fast
+     * instead of opening an interactive credential dialog. */
+    readonly apply: () => Promise<void>;
+    /** Remove the injected environment and delete the session config file. */
+    readonly dispose: () => Promise<void>;
+    /** The session config path this bridge writes. */
+    readonly configPath: () => string;
+}
+/** One ordered environment assignment. */
+export type BridgeAssignment = readonly [key: string, value: string];
+/**
+ * Quote one executable or path for git's `!` shell command. Backslashes are
+ * normalized to forward slashes first: git runs `!` helpers through `sh`,
+ * where `C:\\…` would be read as escape sequences.
+ * @param value - an absolute path.
+ */
+export declare function shellQuote(value: string): string;
+/**
+ * The helper command git runs for one configured host: a `!`-prefixed shell
+ * command, because git does not word-split a helper value by itself (a bare
+ * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
+ * @param nodePath - the node executable.
+ * @param helperPath - the compiled helper script.
+ */
+export declare function bridgeCommand(nodePath: string, helperPath: string): string;
+/**
+ * Escape one value for a gitconfig line: a literal `"` becomes `\"`, which is
+ * how a quoted path survives git's config parser and still reaches `sh`
+ * intact. Without this the quotes are eaten and `sh` splits
+ * `C:/Program Files/…` on the space.
+ * @param value - the raw helper command.
+ */
+export declare function gitconfigEscape(value: string): string;
+/**
+ * The session gitconfig body for the given hosts: the user's own config
+ * included (read-only), the whole machine helper list reset to empty, and per
+ * host a URL-scoped reset followed by the bridge command. The empty value
+ * before each command is what cuts the included `gh` helper (and any other
+ * helper the user configures for that URL) out of that scope.
+ * @param hosts - normalized hosts with a stored credential.
+ * @param options - the node/helper pair and the user config to include.
+ */
+export declare function sessionGitconfigBody(hosts: readonly string[], options: {
+    readonly nodePath: string;
+    readonly helperPath: string;
+    readonly userGitconfig?: string;
+}): string;
+/**
+ * The environment assignments pointing git at the session config: the config
+ * path itself, the credential file the helper reads, and the two fail-fast
+ * switches. `hosts` live in the file now, not in the environment.
+ * @param options - the session config path and the credential file.
+ */
+export declare function shellBridgeEnv(options: {
+    readonly configPath: string;
+    readonly credentialFile: string;
+}): readonly BridgeAssignment[];
+/**
+ * Build the bridge over one host process. Every {@link ShellBridge.apply}
+ * rewrites the session config for the current store and re-points the
+ * environment at it, so a deleted host loses its helper scope just like a
+ * freshly added one gains it. A config file that cannot be written leaves
+ * `GIT_CONFIG_GLOBAL` untouched (git then runs with the machine config —
+ * unauthenticated at worst) while the fail-fast switches still go out.
+ * @param deps - host seams.
+ */
+export declare function createShellBridge(deps: ShellBridgeDeps): ShellBridge;

package/lib/shell-bridge.js

@@ -0,0 +1,218 @@
+/**
+ * Shell credential bridge (host half) — session gitconfig channel. The
+ * credential panel stores one token per remote host, but 0029 could only
+ * inject it into the panel's own routes and the `git_network` tool; a plain
+ * `git push` run in a shell authenticated as whatever the machine's
+ * credential helper held — often a different account — or hung on an
+ * interactive prompt nobody could answer.
+ *
+ * 0032 closed that gap with `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`/
+ * `GIT_CONFIG_VALUE_n` environment entries. That channel is dead on a DSH
+ * host: the subprocess environment scrubber
+ * (`@deepseek-ai/dsh-subprocess`, `SENSITIVE_ENV_PATTERN = /KEY|PASSWORD|SECRET|TOKEN/i`
+ * plus every `DSH_*` name) strips the `GIT_CONFIG_KEY_*` names and keeps
+ * `GIT_CONFIG_COUNT`/`VALUE_*`, so git starts with a half-parsed config and
+ * dies with `fatal: unable to parse command-line config` — every git command
+ * in the shell, not only the networked ones (0034).
+ *
+ * The replacement writes ONE generated gitconfig per host process and points
+ * git at it with `GIT_CONFIG_GLOBAL` — a name the scrubber keeps. The file:
+ *
+ *  1. `[include]`s the user's own `~/.gitconfig` (read-only; 0021's "never
+ *     write the user's git config files" stands) so identity, proxies and
+ *     `http.sslBackend` keep working;
+ *  2. resets the whole `credential.helper` list to empty, cutting the machine
+ *     chain (`helper-selector` → GCM) and any helper the included user config
+ *     carries (the local `gh` helper being the motivating case);
+ *  3. per stored host, resets that URL scope and then installs the bundled
+ *     helper (`helpers/git-credential-bridge.js`) as a `!`-shell command.
+ *
+ * A host with no stored credential then fails at once ("terminal prompts
+ * disabled") instead of reaching the machine chain, whose interactive GUI
+ * dialog nobody in an agent shell can answer. `GIT_TERMINAL_PROMPT=0` and
+ * `GCM_INTERACTIVE=never` ride along as the last line of defence.
+ *
+ * Environment contract (all names survive the scrubber — no KEY/PASSWORD/
+ * SECRET/TOKEN substring, no `DSH_` prefix):
+ *  - `GIT_CONFIG_GLOBAL` — the generated session config (0034).
+ *  - `DGB_BRIDGE_HELPER` — credential file path for the helper script.
+ *  - `GIT_TERMINAL_PROMPT` / `GCM_INTERACTIVE` — fail fast, never prompt.
+ *
+ * The file is re-derived whenever the credential store changes
+ * (`src/routes.ts` calls the bridge after every save / delete / sign-in).
+ */
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { credentialFilePath, createCredentialStore, } from './credentials.js';
+/** Env var carrying the credential file path to the helper script. */
+export const BRIDGE_HELPER_ENV = 'DGB_BRIDGE_HELPER';
+/** Env var carrying a debug log path to the helper script (unset by default). */
+export const BRIDGE_DEBUG_ENV = 'DGB_BRIDGE_DEBUG';
+/** Env var pointing git at the generated session configuration file. */
+export const SESSION_GITCONFIG_ENV = 'GIT_CONFIG_GLOBAL';
+/**
+ * Quote one executable or path for git's `!` shell command. Backslashes are
+ * normalized to forward slashes first: git runs `!` helpers through `sh`,
+ * where `C:\\…` would be read as escape sequences.
+ * @param value - an absolute path.
+ */
+export function shellQuote(value) {
+    return `"${value.replace(/\\/g, '/')}"`;
+}
+/**
+ * The helper command git runs for one configured host: a `!`-prefixed shell
+ * command, because git does not word-split a helper value by itself (a bare
+ * `node "C:/…/bridge.js"` is looked up as the program `git-credential-node`).
+ * @param nodePath - the node executable.
+ * @param helperPath - the compiled helper script.
+ */
+export function bridgeCommand(nodePath, helperPath) {
+    return `!${shellQuote(nodePath)} ${shellQuote(helperPath)}`;
+}
+/**
+ * Escape one value for a gitconfig line: a literal `"` becomes `\"`, which is
+ * how a quoted path survives git's config parser and still reaches `sh`
+ * intact. Without this the quotes are eaten and `sh` splits
+ * `C:/Program Files/…` on the space.
+ * @param value - the raw helper command.
+ */
+export function gitconfigEscape(value) {
+    return value.replace(/"/g, '\\"');
+}
+/**
+ * The session gitconfig body for the given hosts: the user's own config
+ * included (read-only), the whole machine helper list reset to empty, and per
+ * host a URL-scoped reset followed by the bridge command. The empty value
+ * before each command is what cuts the included `gh` helper (and any other
+ * helper the user configures for that URL) out of that scope.
+ * @param hosts - normalized hosts with a stored credential.
+ * @param options - the node/helper pair and the user config to include.
+ */
+export function sessionGitconfigBody(hosts, options) {
+    const unique = [...new Set(hosts)];
+    const lines = [
+        '# Generated by dsh-git-branch-manage (shell credential bridge, decision 0034). Do not edit.',
+        '# Regenerated whenever the credential store changes; safe to delete.',
+    ];
+    if (options.userGitconfig !== undefined) {
+        // Read-only include: the user\'s identity, proxies and TLS settings keep
+        // working, and nothing is ever written back to this file.
+        lines.push('[include]', `\tpath = ${options.userGitconfig.replace(/\\/g, '/')}`);
+    }
+    // Reset the WHOLE helper list first, even when no host is stored. Without
+    // it, any host without a stored credential still reaches the machine chain
+    // (`helper-selector` → GCM), which raises a GUI prompt no agent shell can
+    // answer. With it, such a host fails at once with "terminal prompts
+    // disabled", and the URL-scoped pairs below are the only way credentials
+    // get back into a shell.
+    lines.push('[credential]', '\thelper =');
+    const command = gitconfigEscape(bridgeCommand(options.nodePath, options.helperPath));
+    for (const host of unique) {
+        lines.push(`[credential "https://${host}/"]`, 
+        // Empty first: it resets whatever helper list the included user config
+        // accumulated for this URL (the local `gh` helper), or git would answer
+        // with that account before the bridge is ever consulted.
+        '\thelper =', `\thelper = ${command}`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+/**
+ * The environment assignments pointing git at the session config: the config
+ * path itself, the credential file the helper reads, and the two fail-fast
+ * switches. `hosts` live in the file now, not in the environment.
+ * @param options - the session config path and the credential file.
+ */
+export function shellBridgeEnv(options) {
+    return [
+        [SESSION_GITCONFIG_ENV, options.configPath],
+        [BRIDGE_HELPER_ENV, options.credentialFile],
+        // Fail fast instead of parking a shell on a prompt or a GUI dialog.
+        ['GIT_TERMINAL_PROMPT', '0'],
+        ['GCM_INTERACTIVE', 'never'],
+    ];
+}
+/**
+ * Build the bridge over one host process. Every {@link ShellBridge.apply}
+ * rewrites the session config for the current store and re-points the
+ * environment at it, so a deleted host loses its helper scope just like a
+ * freshly added one gains it. A config file that cannot be written leaves
+ * `GIT_CONFIG_GLOBAL` untouched (git then runs with the machine config —
+ * unauthenticated at worst) while the fail-fast switches still go out.
+ * @param deps - host seams.
+ */
+export function createShellBridge(deps) {
+    const env = deps.env ?? process.env;
+    const configPath = deps.configPath
+        ?? join((deps.configDir ?? tmpdir)(), `dsh-git-branch-${String(process.pid)}.gitconfig`);
+    let applied = [];
+    const credentialFile = () => credentialFilePath(deps.home(), deps.envHome());
+    /** Write the session config atomically with owner-only permissions. */
+    const writeConfig = (body) => {
+        mkdirSync(dirname(configPath), { recursive: true });
+        const partial = `${configPath}.tmp`;
+        writeFileSync(partial, body, { encoding: 'utf8', mode: 0o600 });
+        renameSync(partial, configPath);
+        try {
+            chmodSync(configPath, 0o600);
+        }
+        catch {
+            // Best effort: Windows ignores the mode, the file holds no secret.
+        }
+    };
+    return {
+        configPath: () => configPath,
+        async apply() {
+            let hosts = [];
+            try {
+                hosts = (await (deps.store ?? createCredentialStore(credentialFile())).load()).map(entry => entry.host);
+            }
+            catch {
+                // An unreadable store means no host can be bridged. The global helper
+                // reset still goes out, so shell git fails fast rather than popping a
+                // credential dialog nobody can answer.
+                hosts = [];
+            }
+            const helperPath = deps.helperPath
+                ?? fileURLToPath(new URL('./helpers/git-credential-bridge.js', import.meta.url));
+            const body = sessionGitconfigBody(hosts, {
+                nodePath: deps.nodePath ?? process.execPath,
+                helperPath,
+                userGitconfig: deps.userGitconfig ?? join(deps.home(), '.gitconfig'),
+            });
+            let assignments = [
+                ['GIT_TERMINAL_PROMPT', '0'],
+                ['GCM_INTERACTIVE', 'never'],
+            ];
+            try {
+                writeConfig(body);
+                assignments = shellBridgeEnv({ configPath, credentialFile: credentialFile() });
+            }
+            catch {
+                // The session config could not be written. Do not point
+                // GIT_CONFIG_GLOBAL at a missing file (that would drop the reset and
+                // let the machine chain pop a dialog); only the fail-fast switches
+                // remain, so a shell git runs unauthenticated but never hangs.
+            }
+            for (const key of applied)
+                delete env[key];
+            applied = [];
+            for (const [key, value] of assignments) {
+                env[key] = value;
+                applied.push(key);
+            }
+        },
+        async dispose() {
+            for (const key of applied)
+                delete env[key];
+            applied = [];
+            try {
+                rmSync(configPath, { force: true });
+            }
+            catch {
+                // Best effort: a leftover file holds no secret and apply rewrites it.
+            }
+        },
+    };
+}

package/lib/tool.d.ts

@@ -15,6 +15,7 @@
  * @module dsh-git-branch/tool
  */
 import { type CredentialStore } from './credentials.js';
+import type { CredentialService } from './credential-service.js';
 /** Model-facing tool name. */
 export declare const GIT_CREDENTIALS_TOOL_NAME = "git_credentials";
 /** One text block in a tool result. */
@@ -58,6 +59,9 @@ export interface GitCredentialsToolDeps {
     readonly envHome: () => string | undefined;
     /** Store seam; the fs-backed store at the resolved path when absent. */
     readonly store?: CredentialStore;
+    /** The single credential entry point (decision 0034); when wired its store
+     * is shared with the routes and the shell bridge. */
+    readonly credentialsService?: CredentialService;
 }
 /** A tool definition as `ctx.tools.register` accepts it. */
 export interface GitCredentialsTool {

package/lib/tool.js

@@ -48,7 +48,7 @@ export function renderGitCredentials(value) {
  * @returns a definition ready for `ctx.tools.register`.
  */
 export function gitCredentialsTool(deps) {
-    const storeOf = () => deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
+    const storeOf = () => deps.credentialsService?.store ?? deps.store ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
     /** Read the store, folding a read failure into the result value. */
     const read = async (args) => {
         const store = storeOf();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-branch-manage",
-  "version": "1.0.9",
+  "version": "1.1.0",
   "description": "提供 git 分支与 worktree 管理：输入框工具栏显示当前分支、可原地切换；支持 IDEA 风格分支选择器、远程分支检出、右键操作菜单（新建/重命名/删除/复制）、推送与更新当前分支，以及把分支隔离到独立 worktree 工作区，并管理其创建与删除。",
   "keywords": [
     "dsh",
@@ -45,6 +45,7 @@
     "!lib/**/*.map",
     "cordis.patch.yml",
     "README.md",
+    "CHANGELOG.md",
     "locale/*.json",
     "icon.svg"
   ],