dsh-plugin-git-inspect

When an agent needs to make sense of a Git repository—current branch, uncommitted changes, who owns a particular line, whether merge conflicts are pending—it must do so without touching write operations. dsh-plugin-git-inspect provides exactly that read-only inspection layer for DeepSeek Harness: ten registered tools covering status, diff, diff-stat, log, show, refs, conflicts, blame, stash-list, and worktree-list, letting the model drill into a repo the way a seasoned code reviewer would, with zero ability to commit, push, reset, or switch branches.

Security is the foundation of every design choice. The plugin never executes a shell; all git invocations go through the Harness subprocess service with a fixed argv. User-supplied paths are always placed after the --pathspec separator, eliminating shell-expansion vectors. Pagers, colored output, external diffs, and interactive prompts are all disabled so results stay stable and predictable. stdout and stderr are capped in bytes, and truncated output is explicitly flagged. Git blame returns at most 50 lines by default (200 as the hard ceiling), keeping context windows clean.

It is built for developers assembling agent-based code-review pipelines and for teams that want per-tool approval policies inside their host compositions. Whether you are debugging a local CI failure, triaging merge conflicts before integration, or scanning a multi-worktree project layout, a single bundle install adds a safe, structured layer of Git awareness to every Harness session.