Introduction

In the DeepSeek Harness (DSH) development environment, agents typically need to interact with Git services (such as GitHub or GitLab) or use SSH keys for deployment. Maintaining these credentials manually is error-prone and less secure. The dsh-git-auth plugin provides a unified set of commands and configuration options, enabling agents to complete authentication and key management non-interactively.

Feature Overview

The plugin includes the following core features:

  1. Unified Status: Reports the status of gh (GitHub CLI), glab (GitLab CLI), SSH-agent, and public keys in a single call.
  2. Non-interactive Login: Authenticates and logs in gh or glab using the Token configured in plugin settings or the Token from DSH host environment variables.
  3. Workspace Deployment Keys: Generates, configures, lists, and displays Ed25519-type deployment keys for each workspace under the .ssh directory.
  4. Approval-Aware Writes: Limits key changes to the workspace access scope and requests host approval for changes to shared CLI/agent configurations.
  5. Settings UI: Exposes default configurations for host, timeout, key path, comment, and ssh-add under Settings → Plugins.

Installation and Activation

Clone the plugin from source and add it to the DSH profile.

git clone https://github.com/Wisdoverse/dsh-git-auth-plugin.git

dsh plugin --profile web add ./dsh-git-auth-plugin

After installation, restart the Web profile.

Configuration

The plugin configuration is located under Settings → Plugins → Plugin configuration, or you can directly edit the DSH settings document (usually $DSH_HOME/settings.yaml).

The main configuration items are as follows:

Configuration Item Default Value Description
ghHost github.com GitHub host name, may include a port
glabHost gitlab.com GitLab host name, may include a port
commandTimeoutMs 60000 Command execution timeout (milliseconds)
sshPath Empty Direct subpath under the workspace .ssh directory; if empty, defaults to <workspace>/.ssh/id_ed25519
sshComment Empty Default comment passed to ssh-keygen
sshAddAgent false Whether to use ssh-add by default to load the generated key

Configuration example:

git-auth:
  glabHost: gitlab.example.com
  commandTimeoutMs: 60000
  sshPath: id_ed25519
  sshComment: developer@example.com
  sshAddAgent: true

Typical Usage

The plugin provides the following tool commands:

  • auth_status: Checks the authentication status for GitHub, GitLab, and SSH.
  • client_auth: Logs in to or logs out from gh or glab using the configured Token.
  • ssh_key: Generates, configures, lists, or displays the Ed25519 deployment key for the current workspace.

Applicable Scenarios and Notes

  • Token Security: Access tokens must not be passed as tool parameters. They must be stored in plugin settings or DSH host environment variables to avoid entering the model context or tool call logs.
  • Single-User/Trusted Environments: This release is suitable for single-user or mutually trusted user environments. The host, tokens, gh/glab configuration files, and SSH agent are shared by the DSH instance.
  • Key Path Boundary: Workspace-local key paths are used only for routing and do not constitute a multi-user security boundary.
  • Global Tokens: In the current DSH credential model, tokens are instance-global, so all workspaces share these tokens.

Summary

dsh-git-auth addresses the credential management challenges when agents interact with Git services in the DSH environment. Through a unified command interface and secure Token storage mechanisms, it supports non-interactive login and standardized SSH key management, making it suitable for scenarios that require stable Git operations within a DSH instance.