revive/dsh-git-credentials ↗★ 1
dsh-git-credentials
Out-of-tree dsh plugin: GitLab, GitHub, Gitee, Gitea, and Bitbucket tokens stay out of the model context, stored encrypted (AES-256-GCM) in a plugin-owned file; the model calls forge API tools on demand, and the web settings page manages sites and tokens.
AI 分析
核心用途是安全管理 Git 托管平台的访问凭证。适合需要让 AI 操作 Git 仓库（如读取、提交代码），同时要求 Token 保持加密、不暴露给模型上下文的用户。
インストール
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:revive/dsh-git-credentialsドキュメント
README 全文を読む ↗Usage
Manage sites and tokens in Settings → Git Credentials:
- Add a site: provider (GitLab / GitHub / Gitee / Gitea / Bitbucket), site id, API base URL (defaults per provider:
https://api.github.com,https://gitee.com/api/v5,https://api.bitbucket.org/2.0; GitLab and Gitea are self-hosted and need their own address, e.g.https://gitlab.example.com/https://gitea.example.com/api/v1), token reference name (defaults toGITLAB_TOKEN/GITHUB_TOKEN/GITEE_TOKEN/GITEA_TOKEN/BITBUCKET_TOKEN), optional token value (write it with the dedicated Save Token button, or together with Add Site), optional default project - Each existing site: read-only by default (provider, base URL, token ref, default project, configured state) with an Edit button; edit mode reveals the inputs plus Save / Cancel, and lets you store or clear the token value, or delete the site
- The panel talks to same-origin
/git-credentials-admin/*JSON endpoints; token values never appear in any response - All changes take effect immediately — every tool call reads a fresh decrypted snapshot
Tools
| Tool | Arguments | Returns |
|---|---|---|
gitlab_projects | site?, search?, membership?, perPage? | project summary array |
gitlab_file | site?, project, path, ref? | { path, ref, content, truncated } |
gitlab_merge_requests | site?, project?, state?, perPage? | MR summary array |
gitlab_issues | site?, project?, state?, perPage? | issue summary array |
github_repos | site?, search?, perPage? | repository summary array |
github_file | site?, project (owner/repo), path, ref? | { path, ref, content, truncated } |
github_issues | site?, project?, state?, perPage? | issue summary array (PRs excluded) |
github_pull_requests | site?, project?, state?, perPage? | PR summary array |
gitee_repos | site?, search?, perPage? | repository summary array |
gitee_file | site?, project (owner/repo), path, ref? | { path, ref, content, truncated } |
gitee_issues | site?, project?, state?, perPage? | issue summary array |
gitee_pull_requests | site?, project?, state?, perPage? | PR summary array |
gitea_repos | site?, search?, perPage? | repository summary array |
gitea_file | site?, project (owner/repo), path, ref? | { path, ref, content, truncated } |
gitea_issues | site?, project?, state?, perPage? | issue summary array |
gitea_pull_requests | site?, project?, state?, perPage? | PR summary array |
bitbucket_repos | site?, search?, perPage? | repository summary array |
bitbucket_file | site?, project (workspace/repo), path, ref? | { path, ref, content, truncated } |
bitbucket_issues | site?, project?, state?, perPage? | issue summary array |
bitbucket_pull_requests | site?, project?, state?, perPage? | PR summary array |
- Token reference names are POSIX identifiers (
GITLAB_TOKEN,GITHUB_TOKEN,GITEE_TOKEN,GITEA_TOKEN,BITBUCKET_TOKEN, …); multiple sites can share one reference or use their own - GitLab authenticates with the
PRIVATE-TOKENheader; GitHub, Gitee, and Bitbucket withAuthorization: Bearer(Gitee additionally falls back to theaccess_tokenURL parameter when the header form is rejected); Gitea withAuthorization: token - HTTP goes through Node's built-in
fetchdirectly —ctx.web.fetchis deliberately not used (URL-only, no header support)