dsh-git-branch-manage 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 本文件记录 `dsh-git-branch-manage` 的重要变更。版本号遵循语义化版本。
 
+## [1.2.0] - 2026-11-02
+
+### 新增
+
+- **凭据管理直接读写本机 `~/.git-credentials`**（决策 0037）：面板里存一次，任何 shell、任何子进程的 `git push/fetch/pull` 都用同一账号；文件里不属于本插件的行（注释、`ssh://` 等）原样保留，卸载插件后凭据仍属于用户。
+- **从本机导入凭据，启动时默认执行**（决策 0038）：按用户 gitconfig 里声明过的 credential 域名逐个探测（`git credential fill`，串行 + 20 秒超时），答出令牌即导入面板；面板另有手动「从本机导入」入口（`POST /credentials-import`），toast 汇总导入/跳过/失败数量。`gh`、GCM、`store` 里的账号一次导入即可接管。
+
+### 变更
+
+- 凭据生效通道改用 git 原生机制：`~/.gitconfig` 幂等追加一行 `[include]` 指向生成的 URL 作用域配置（每个已存域名重置 helper 链后装内置 `store`），不再向进程环境注入（废弃 0032/0034 的 `GIT_CONFIG_*` / `GIT_CONFIG_GLOBAL` 通道），令牌也不再进入命令行参数。
+- 未管理域名的机器原有 helper（gh、GCM 等）保持原样，不再被全局清空；未存域名依旧 fail-fast 不弹窗。
+- 令牌明文落在 `~/.git-credentials`（0600）——与 git 自带 `store` helper 一致的安全取舍；面板列表元数据（`method`/`updatedAt`）另存不含 secret 的旁文件。
+
+### 移除
+
+- 删除自研 `git-credential-bridge` helper，改用 git 内置 `credential-store`，不再为每次 git 调用拉起 node 进程。
+
 ## [1.1.0] - 2026-11-02
 
 ### 修复

package/lib/client.js

@@ -144,6 +144,9 @@ window.__ModuleLoader__.load({
 		/** POST ROUTE_PREFIX/credentials-oauth-poll — poll a started browser sign-in;
 		* stores the token and answers the fresh masked list once the user approves. */
 		const ROUTE_CREDENTIALS_OAUTH_POLL = `${ROUTE_PREFIX}/credentials-oauth-poll`;
+		/** POST ROUTE_PREFIX/credentials-import — copy the credentials the machine's
+		* own helpers already answer for into the managed store (decision 0038). */
+		const ROUTE_CREDENTIALS_IMPORT = `${ROUTE_PREFIX}/credentials-import`;
 		/** POST ROUTE_PREFIX/remotes — the repository's configured remotes. */
 		const ROUTE_REMOTES = `${ROUTE_PREFIX}/remotes`;
 		/** POST ROUTE_PREFIX/remote — add, re-point or remove ONE remote. */
@@ -508,6 +511,16 @@ window.__ModuleLoader__.load({
 			return post(ROUTE_CREDENTIALS_OAUTH_POLL, body);
 		}
 		/**
+		* Adopt the credentials this machine's own git helpers already answer for
+		* (gh, Windows Credential Manager, Keychain) into the plugin's store. Hosts
+		* the panel already manages are skipped; a host whose helper had nothing is
+		* reported per host, never as a request failure.
+		* @param body - `{}` (probe what the gitconfig names) or `{ hosts }`.
+		*/
+		function requestImportCredentials(body = {}) {
+			return post(ROUTE_CREDENTIALS_IMPORT, body);
+		}
+		/**
 		* The repository's configured remotes (fetch/push URLs).
 		* @param repoPath - absolute directory inside the repository.
 		*/
@@ -4784,6 +4797,10 @@ window.__ModuleLoader__.load({
 			const [seed, setSeed] = (0, react.useState)();
 			const [formError, setFormError] = (0, react.useState)();
 			const [busy, setBusy] = (0, react.useState)(false);
+			/** The one-click machine import runs on its own flag: it is read-only on the
+			* form, so it must not disable editing, and a slow helper (a cold keychain
+			* prompt) must not look like a hung save. */
+			const [importing, setImporting] = (0, react.useState)(false);
 			/** Two-step delete: the first click only arms the row. */
 			const [confirmHost, setConfirmHost] = (0, react.useState)();
 			/** The editor starts collapsed; the "+" icon in the header row opens it,
@@ -5006,6 +5023,34 @@ window.__ModuleLoader__.load({
 				seed,
 				t
 			]);
+			/** Adopt what this machine's own git helpers already answer for. The host
+			* decides which hosts to probe (the user's gitconfig names them) and skips
+			* the ones the panel already manages, so this is always safe to click. */
+			const importLocal = (0, react.useCallback)(async () => {
+				if (busy || importing) return;
+				setImporting(true);
+				const result = await requestImportCredentials();
+				setImporting(false);
+				if (!result.ok) {
+					pushToast(result.error, "error");
+					return;
+				}
+				setEntries(result.credentials);
+				if (result.imported.length === 0) {
+					pushToast(t("cred.importNone"), result.failed.length === 0 ? "success" : "error");
+					return;
+				}
+				pushToast(t("cred.importDone", {
+					count: result.imported.length,
+					skipped: result.skipped.length,
+					failed: result.failed.length
+				}), "success");
+			}, [
+				busy,
+				importing,
+				pushToast,
+				t
+			]);
 			const title = seed === void 0 ? t("cred.add") : t("cred.edit");
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
 				open: true,
@@ -5021,21 +5066,34 @@ window.__ModuleLoader__.load({
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: GitHistoryPanel_module_default.credTop,
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-							className: GitHistoryPanel_module_default.credHint,
-							children: t("cred.hint")
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							className: GitHistoryPanel_module_default.credAdd,
-							title: t("cred.add"),
-							"aria-label": t("cred.add"),
-							"aria-expanded": editorOpen,
-							onClick: openNew,
-							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								"aria-hidden": "true",
-								children: "+"
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: GitHistoryPanel_module_default.credHint,
+								children: t("cred.hint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								size: "sm",
+								variant: "ghost",
+								disabled: busy || importing,
+								title: t("cred.import"),
+								onClick: () => {
+									importLocal();
+								},
+								children: importing ? t("cred.importing") : t("cred.import")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: GitHistoryPanel_module_default.credAdd,
+								title: t("cred.add"),
+								"aria-label": t("cred.add"),
+								"aria-expanded": editorOpen,
+								onClick: openNew,
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									"aria-hidden": "true",
+									children: "+"
+								})
 							})
-						})]
+						]
 					}),
 					loadError !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: GitHistoryPanel_module_default.formError,
@@ -8432,7 +8490,7 @@ window.__ModuleLoader__.load({
 			"accel.mirrorDownHint": "If the mirror is down, disable acceleration or change the URL",
 			"panel.credentials": "Credentials",
 			"cred.title": "Git credentials",
-			"cred.hint": "Global, one entry per host: a token saved for github.com serves every repository. Stored only on this machine in git-credentials.json.",
+			"cred.hint": "One entry per host, shared by all repos. Stored in ~/.git-credentials, so plain git uses it too.",
 			"cred.empty": "No credentials saved yet",
 			"cred.hostLabel": "Host",
 			"cred.hostPlaceholder": "github.com",
@@ -8447,6 +8505,10 @@ window.__ModuleLoader__.load({
 			"cred.methodPassword": "Password",
 			"cred.getToken": "Get a token",
 			"cred.add": "Add credential",
+			"cred.import": "Import from this machine",
+			"cred.importing": "Importing…",
+			"cred.importDone": "Imported {count} host(s) — skipped {skipped}, failed {failed}",
+			"cred.importNone": "Nothing new to import from this machine",
 			"cred.edit": "Edit",
 			"cred.save": "Save",
 			"cred.saving": "Saving…",
@@ -8718,7 +8780,7 @@ window.__ModuleLoader__.load({
 			"accel.mirrorDownHint": "若加速地址不可用，可停用国内加速或更换地址",
 			"panel.credentials": "密钥配置",
 			"cred.title": "Git 密钥配置",
-			"cred.hint": "全局生效：同一域名只需配置一次，该域名的所有仓库共用。密钥只保存在本机 git-credentials.json 中。",
+			"cred.hint": "按域名保存，所有仓库共用；密钥写入本机 ~/.git-credentials，命令行 git 同样生效。",
 			"cred.empty": "还没有配置任何密钥",
 			"cred.hostLabel": "域名",
 			"cred.hostPlaceholder": "github.com",
@@ -8733,6 +8795,10 @@ window.__ModuleLoader__.load({
 			"cred.methodPassword": "密码",
 			"cred.getToken": "获取令牌",
 			"cred.add": "新增密钥",
+			"cred.import": "从本机导入",
+			"cred.importing": "导入中…",
+			"cred.importDone": "已导入 {count} 个域名（跳过 {skipped}，失败 {failed}）",
+			"cred.importNone": "本机没有新的凭据可导入",
 			"cred.edit": "编辑",
 			"cred.save": "保存",
 			"cred.saving": "保存中…",

package/lib/credential-service.d.ts

@@ -1,49 +1,41 @@
 /**
- * The one entry point every credential channel goes through (decision 0034).
+ * The one entry point every credential channel goes through (decision 0037).
  *
- * Before this module the store, the `-c http.<url>.extraHeader` injection
- * (`authConfigArgs`, 0021/0029) and the shell environment bridge
- * (`shell-bridge.ts`, 0032/0034) were assembled in three places — the routes,
- * the two model-facing tools and the plugin entry — each resolving the store
- * path itself. Every future plugin that needs git credentials would have
- * repeated that wiring and drifted from it.
+ * The store is the machine's own `~/.git-credentials` (git's
+ * `credential-store` format), plus a secret-free metadata sidecar for the
+ * panel's "method / updated" columns. Every channel — the panel routes, both
+ * model-facing tools, and a plain `git` command in any shell — authenticates
+ * through the same `credential-store` helper, because `createShellBridge`
+ * installs a URL-scoped `helper = store` include into `~/.gitconfig`.
  *
- * `createCredentialService` owns the store instance and both injection
- * channels, so callers share one contract:
+ * `createCredentialService` owns the store instance and the include setup, so
+ * callers share one contract:
  *
- *  - {@link CredentialService.authConfigArgs} — the `-c extraHeader` pairs for
- *    git commands the plugin itself runs (panel routes, `git_network`). The
- *    token rides the argv of that one command and never an environment.
- *  - {@link CredentialService.refreshShellEnv} — re-derive the session
- *    gitconfig + `GIT_CONFIG_GLOBAL` environment so a plain shell `git push`
- *    authenticates as configured. Call it after every store change.
- *  - {@link CredentialService.dispose} — undo the environment injection and
- *    delete the session config file (plugin teardown).
+ *  - {@link CredentialService.refreshShellEnv} — re-derive the include after a
+ *    store change and run the one-time legacy import. Call it after every save
+ *    / delete / sign-in; it never throws.
+ *  - {@link CredentialService.dispose} — remove the include line and the
+ *    generated file on plugin teardown. The credentials themselves stay in
+ *    `~/.git-credentials`: they belong to the user, not to the plugin.
  *
  * A store that cannot be read degrades to "no credentials" on every channel
  * (an unauthenticated command runs as it always did; the credentials route is
  * where the file problem surfaces) — a broken file must never break git.
  */
 import { type CredentialStore } from './credentials.js';
+import { type LocalImportReport } from './local-import.js';
 /** Host-side seams the service reads through (tests substitute all of them). */
 export interface CredentialServiceDeps {
     /** User home directory seam. */
     readonly home: () => string;
     /** `$DSH_HOME` seam (blank/undefined = unset). */
     readonly envHome: () => string | undefined;
-    /** Store seam; the fs-backed store at the resolved path when absent. */
+    /** Store seam; the fs-backed local store when absent. */
     readonly store?: CredentialStore;
     /** The environment object to mutate; `process.env` when absent. */
     readonly env?: Record<string, string | undefined>;
-    /** Absolute helper script path; the compiled sibling under `helpers/` when absent. */
-    readonly helperPath?: string;
-    /** Node executable that runs the helper; `process.execPath` when absent. */
-    readonly nodePath?: string;
-    /** Directory for the session config; the OS temp dir when absent. */
-    readonly configDir?: () => string;
-    /** Exact session config path (tests); derived from the pid when absent. */
-    readonly configPath?: string;
-    /** User global config the session file includes; `<home>/.gitconfig` when absent. */
+    /** User global config the generated include is installed into;
+     * `<home>/.gitconfig` when absent. */
     readonly userGitconfig?: string;
 }
 /** The single credential entry point. */
@@ -51,24 +43,26 @@ export interface CredentialService {
     /** The shared global store (one row per remote host). */
     readonly store: CredentialStore;
     /**
-     * `-c http.<url>.extraHeader` pairs for every stored credential, ready to
-     * prepend to a git network command the plugin runs itself. A broken store
-     * degrades to "no credentials" rather than throwing.
+     * Import the retired plugin-private file (once) and re-derive the git
+     * include after a credential changed, so a message sent in the same session
+     * can `git push` with the token the user just saved. Never throws: the worst
+     * case is a stale include until the next refresh.
      */
-    readonly authConfigArgs: () => Promise<readonly string[]>;
+    readonly refreshShellEnv: () => Promise<void>;
     /**
-     * Re-derive the shell credential environment after a credential changed, so
-     * a message sent in the same session can `git push` with the token the user
-     * just saved. Never throws: the worst case is a stale environment until the
-     * next refresh.
+     * Copy the credentials the machine's own helpers already answer for into
+     * the store, once per process (decision 0038). Runs on startup so a machine
+     * already signed in through gh / GCM / Keychain keeps working without the
+     * user re-entering a token here. Idempotent, never throws; the hosts that
+     * did import trigger one include refresh.
      */
-    readonly refreshShellEnv: () => Promise<void>;
-    /** Remove the environment injection and delete the session config file. */
+    readonly autoImport: () => Promise<LocalImportReport>;
+    /** Remove the fail-fast switches, the include line and the generated file. */
     readonly dispose: () => Promise<void>;
 }
 /**
  * Build the credential service for one host process: one store instance, one
- * session-gitconfig bridge, shared by the routes and every tool.
+ * gitconfig include, shared by the routes and every tool.
  * @param deps - host seams (see {@link CredentialServiceDeps}).
  */
 export declare function createCredentialService(deps: CredentialServiceDeps): CredentialService;

package/lib/credential-service.js

@@ -1,53 +1,82 @@
 /**
- * The one entry point every credential channel goes through (decision 0034).
+ * The one entry point every credential channel goes through (decision 0037).
  *
- * Before this module the store, the `-c http.<url>.extraHeader` injection
- * (`authConfigArgs`, 0021/0029) and the shell environment bridge
- * (`shell-bridge.ts`, 0032/0034) were assembled in three places — the routes,
- * the two model-facing tools and the plugin entry — each resolving the store
- * path itself. Every future plugin that needs git credentials would have
- * repeated that wiring and drifted from it.
+ * The store is the machine's own `~/.git-credentials` (git's
+ * `credential-store` format), plus a secret-free metadata sidecar for the
+ * panel's "method / updated" columns. Every channel — the panel routes, both
+ * model-facing tools, and a plain `git` command in any shell — authenticates
+ * through the same `credential-store` helper, because `createShellBridge`
+ * installs a URL-scoped `helper = store` include into `~/.gitconfig`.
  *
- * `createCredentialService` owns the store instance and both injection
- * channels, so callers share one contract:
+ * `createCredentialService` owns the store instance and the include setup, so
+ * callers share one contract:
  *
- *  - {@link CredentialService.authConfigArgs} — the `-c extraHeader` pairs for
- *    git commands the plugin itself runs (panel routes, `git_network`). The
- *    token rides the argv of that one command and never an environment.
- *  - {@link CredentialService.refreshShellEnv} — re-derive the session
- *    gitconfig + `GIT_CONFIG_GLOBAL` environment so a plain shell `git push`
- *    authenticates as configured. Call it after every store change.
- *  - {@link CredentialService.dispose} — undo the environment injection and
- *    delete the session config file (plugin teardown).
+ *  - {@link CredentialService.refreshShellEnv} — re-derive the include after a
+ *    store change and run the one-time legacy import. Call it after every save
+ *    / delete / sign-in; it never throws.
+ *  - {@link CredentialService.dispose} — remove the include line and the
+ *    generated file on plugin teardown. The credentials themselves stay in
+ *    `~/.git-credentials`: they belong to the user, not to the plugin.
  *
  * A store that cannot be read degrades to "no credentials" on every channel
  * (an unauthenticated command runs as it always did; the credentials route is
  * where the file problem surfaces) — a broken file must never break git.
  */
-import { authConfigArgs, createCredentialStore, credentialFilePath, } from './credentials.js';
+import { createLocalCredentialStore, migrateLegacyCredentialFile, } from './credentials.js';
 import { createShellBridge } from './shell-bridge.js';
+import { importLocalCredentials } from './local-import.js';
 /**
  * Build the credential service for one host process: one store instance, one
- * session-gitconfig bridge, shared by the routes and every tool.
+ * gitconfig include, shared by the routes and every tool.
  * @param deps - host seams (see {@link CredentialServiceDeps}).
  */
 export function createCredentialService(deps) {
-    const store = deps.store
-        ?? createCredentialStore(credentialFilePath(deps.home(), deps.envHome()));
-    const bridgeDeps = { ...deps, store };
+    const store = deps.store ?? createLocalCredentialStore(deps.home(), deps.envHome());
+    const bridgeDeps = {
+        home: deps.home,
+        envHome: deps.envHome,
+        store,
+        ...(deps.env === undefined ? {} : { env: deps.env }),
+        ...(deps.userGitconfig === undefined ? {} : { userGitconfig: deps.userGitconfig }),
+    };
     const shellBridge = createShellBridge(bridgeDeps);
+    let autoImportTask;
     return {
         store,
-        async authConfigArgs() {
+        async refreshShellEnv() {
             try {
-                return authConfigArgs(await store.load());
+                await migrateLegacyCredentialFile(deps.home(), deps.envHome(), store);
             }
             catch {
-                return [];
+                // A damaged legacy file must not block the include refresh; the
+                // credentials route reports it when the user opens the panel.
             }
+            await shellBridge.apply();
         },
-        refreshShellEnv() {
-            return shellBridge.apply();
+        autoImport() {
+            autoImportTask ??= (async () => {
+                try {
+                    // The legacy file migrates first so an imported host cannot
+                    // duplicate a row the panel already had.
+                    await migrateLegacyCredentialFile(deps.home(), deps.envHome(), store);
+                }
+                catch {
+                    // Same contract as refreshShellEnv: a broken legacy file is not
+                    // worth failing the startup import over.
+                }
+                try {
+                    const report = await importLocalCredentials(store, { env: deps.env ?? process.env });
+                    if (report.imported.length > 0)
+                        await shellBridge.apply();
+                    return report;
+                }
+                catch {
+                    // The import is opportunistic: a missing git, an unreadable store
+                    // or a helper that misbehaves just leaves the panel as it was.
+                    return { imported: [], skipped: [], failed: [] };
+                }
+            })();
+            return autoImportTask;
         },
         dispose() {
             return shellBridge.dispose();