Introduction¶

DSH extends tool capabilities using a plugin-based approach. If you want the model to directly handle GitHub transactions within a conversation, two issues need to be addressed first: whether authentication can be reused long-term and whether dangerous operations have approval controls.

dsh-github is a community plugin for DeepSeek Harness maintained by ChenYiming-aaa and released under the MIT License. It provides 45 github_* tools, all of which call the GitHub REST API v3. Once configured with GITHUB_TOKEN or OAuth Device Flow, the model can directly complete tasks such as creating repositories, pushing, submitting Pull Requests, managing issues, and searching code; regular read and write operations are allowed directly, while dangerous operations like deletion, force push, merging PRs, and closing issues/PRs are subject to approval gates.

What is it¶

dsh-github is a GitHub integration plugin used to integrate the GitHub REST API into DSH’s tool invocation pipeline.

Its primary positioning is:

• Providing 45 github_* tools covering GitHub transactions such as creating repositories, pushing, submitting PRs, managing issues, and searching code.
• Supporting authentication via GITHUB_TOKEN or OAuth Device Flow, persisting to DSH credentials or environment variables.
• Allowing regular read/write operations directly while retaining approval gates for dangerous operations.
• Zero dependencies, using only Node 22+ built-in modules.
• When github domains are pointed to 127.0.0.1 in the hosts file, automatically switching to DNS direct query bypass.
• Tokens are only sent in the Authorization request header, with defensive redaction applied to error messages and tool outputs.

Regarding prerequisites, package.json declares the Node engine as:

"^22.19.0 || >=24.0.0"

It also declares the following peerDependencies:

"@deepseek-ai/cordis"
"@deepseek-ai/dsh-tools"
"@deepseek-ai/schemastery"

Testing requires DSH Desktop to be installed locally, as the loader references its dsh-tools.

Installation and Activation¶

1. Execute the installation:

powershell -ExecutionPolicy Bypass -File .\install.ps1

2. If you only need to install the desktop profile:

powershell -ExecutionPolicy Bypass -File .\install.ps1 -Profiles desktop

3. After installation, restart DSH Desktop or reload the web profile for it to take effect.

Configure Authentication¶

Using a Personal Access Token¶

The PAT requires the following permissions:

repo
read:org
user

You can first write it using environment variables:

setx GITHUB_TOKEN "ghp_xxx"

It takes effect after opening a new terminal or restarting DSH.

Alternatively, you can skip setting the environment variable and add GITHUB_TOKEN in the credentials section of the DSH settings page, then paste the token.

Using OAuth Device Flow¶

OAuth Device Flow requires the Client ID and Client Secret of a GitHub OAuth App.

1. Configure oauthClientId and oauthClientSecretRef in the cordis.patch.yml of the profile you wish to enable. If you are using both web and desktop, configure both profiles. An example is as follows:

- insert:
  - id: github
    name: dsh-github
    config:
      oauthClientId: <OAuth Client ID>
      oauthClientSecretRef: GITHUB_OAUTH_CLIENT_SECRET

2. Add the GITHUB_OAUTH_CLIENT_SECRET credential in the DSH settings page, or set an environment variable with the same name.

3. After restarting DSH, instruct the model to call github_auth_login to log in to GitHub. After completing the browser authorization as prompted, the token will be persisted.

The access token from GitHub’s device-flow is valid for a long time and does not have a refresh token mechanism. If it expires, simply call github_auth_logout to clear it and log in again.

Verify Authentication¶

Call the following tools in a new session:

• github_get_me: Returns the current GitHub user
• github_auth_status: View authentication source and validity

Typical Usage¶

One-Click Project Upload¶

Calling github_upload_project allows you to submit all necessary data for repository creation, pushing, and creating a PR in one go. Example:

github_upload_project(
  repo: "my-app",
  description: "我的应用",
  files: [
    { path: "README.md", content: "# my-app" },
    { path: "src/main.js", content: "..." }
  ],
  create_pull_request: true
)

This workflow includes regular operations like creating repositories, pushing, and creating PRs; if it does not contain actions requiring approval, they will be allowed directly according to approval rules.

Manual Workflow¶

You can also call them step-by-step:

1. github_create_repository

2. github_create_branch

3. github_push_files

4. github_create_pull_request

If merging a PR is needed, call github_merge_pull_request. This operation requires approval.

To close an issue or PR, you can use github_update_issue or github_update_pull_request with state: closed. This operation requires approval.

Approval Gates¶

Approval gates are enabled by default. Only allowed-once will allow execution; it fails closed when rejected, cancelled, or no approval channel is available.

You can also disable the approval gate by setting approvalGate: false, but this is not recommended.

Operations requiring approval include:

Other read operations and regular write operations are allowed directly.

Notes¶

• The plugin runs with the permissions of the current DSH process. Before installing, you should check the source code, dependencies, and the MIT license.
• This article does not list all 45 tools in detail; TOOLS.md in the repository can serve as a reference for the tool list.
• Grant the PAT only the necessary scopes; at minimum, repo, read:org, and user are required.
• If there are blocking or invalid entries in the local hosts file, when the github domain is pointed to 127.0.0.1, the plugin will switch to DNS direct query bypass.
• The DSH plugin directory is an independent community site and should not be interpreted as an official app store for DeepSeek or Hypersphere.

Get Links¶

• GitHub: https://github.com/ChenYiming-aaa/dsh-github
• Directory page in plugin registry: https://www.skillhub.cn/plugins/ChenYiming-aaa/dsh-github

Conclusion¶

The value of dsh-github lies in integrating GitHub operations into DSH’s plugin system: available long-term after one-time authentication, maintaining low friction for regular operations, and retaining approval for dangerous operations. For scenarios that need to handle repositories, branches, issues, PRs, and searches within an agent workflow, it provides a clear entry point.