dsh-git-auth-plugin

Managing Git credentials inside a DSH agent environment tends to be fragmented. An agent must check gh, glab, and SSH-agent status separately, complete non-interactive logins without leaking tokens into model context or tool-call logs, and generate per-workspace deploy keys on the host. dsh-git-auth-plugin consolidates these steps into a single approval-aware toolset, so one call surfaces the full authentication picture and every credential mutation stays auditable.

Core capabilities span three areas. First, a unified auth_status call reports GitHub CLI, GitLab CLI, SSH-agent, and public-key status in a single response. Second, non-interactive login resolves tokens through the DSH credentials service or host environment variables and pipes them to the CLI over stdin, never as tool arguments or shell strings. Third, workspace-level Ed25519 deploy keys can be generated, configured, listed, and displayed under each workspace's .ssh directory; paths must be direct children of that directory, symlinks are rejected at every level, and an effective ignore rule is appended to .ssh/.gitignore before any key is written. Mutations to shared CLI credentials request DSH escalation, preserving the minimum-privilege boundary by design.

The plugin is aimed at developers who concurrently manage GitHub, GitLab, and bare Git servers through DSH agents, as well as ops and security teams that want credential isolation, an auditable approval flow, and a narrow verifiable security surface without sacrificing the non-interactive workflows that make agent-driven Git practical. It targets a single-user or mutually-trusted-user deployment; use a separate DSH instance for a different trust domain.