dsh-zgit

In agent workflows, the reflexive move when you need external source code or a binary release is git clone. The catch: it demands a git binary, native libraries, and sometimes even fails inside a restricted sandbox. dsh-zgit takes a more direct route. If the job is read-only, skip git entirely and just pull the files over plain HTTPS. No git binary, no runtime dependencies, no setup. It fits naturally into DeepSeek Harness agent pipelines where the environment is minimal by design.

The plugin covers three common cases. For source code it downloads the forge archive at a given ref as a tar.gz or zip, unpacks it into a simulated checkout tagged with .zerogit metadata, and then supports the familiar read-side verbs. ls, log, diff, show, status all work just like their git counterparts, and a single replace-mode refresh gives you a newer snapshot when needed. For binary releases it lists or fetches assets straight from GitHub, GitLab, or Gitee release endpoints, with glob filtering and sha256 verification against shipped checksums. For everything else, a generic zgit_download grabs any HTTPS mirror or toolchain link into the workspace, bounded by a configurable byte cap and an optional hash check.

Under the hood the plugin ships with zero runtime dependencies, relying purely on Node builtins for zlib, crypto, fs, and http. Every write is confined to the calling session workspace, and archive extraction is hardened against path traversal, zip bombs, symlink materialization, and case-insensitive collisions. Extracted files are read-only and never executed. It is a good fit for sandboxed or minimal agent environments that need light-touch access to a Git forge, and for tooling that only ever needs a one-off source snapshot or release asset without leaving a git installation behind.