dsh-plugin-github

4. Configuration

Configuration lives under the plugin row's config: in the profile's cordis.patch.yml (that file replaces the whole config value; it does not deep-merge).

Field	Default	Meaning
workspaceRoot	host process working directory	Root for local clones. Every gh_* path is confined to this directory
allowRepos	[]	Repository allowlist: owner/repo, owner/*, */repo, *. Empty means no restriction by repository name. Only strict owner/repo is accepted; full URLs are rejected
allowPush	false	Allow pushing and creating remote repositories. While off, gh_push and gh_commit{push:true} are refused outright
allowForcePush	false	Allow --force-with-lease (still requires allowPush)
allowApiWrite	false	Allow POST/PATCH/PUT/DELETE on gh_api, and gh_repo action=create
allowApiReadOutsideAllowlist	false	Set true to let read-only gh_api reach repositories outside the allowlist (e.g. searching public repositories)
allowNonGithubRemotes	false	Allow remotes other than github.com (self-hosted Git). Off by default: the allowlist constrains owner/repo but not the host, so allowing any host means allowing the PAT to be sent anywhere
allowAutoBind	true	Whether to prompt for account binding when credentials are needed
promptForToken	true	Whether the prompt may collect a pasted token
accountStorePath	$DSH_HOME/github-accounts.json	Account file path (used only when the DSH credential service is not mounted)
tokenRef	GITHUB_TOKEN	Credential reference name (the key under refs: in $DSH_HOME/.credentials.yaml)
tokenEnv	GITHUB_TOKEN	Environment variable to fall back to (then GITHUB_TOKEN / GH_TOKEN)
dotenv	true	Also fall back to .env.local / .env in the workspace
commandTimeoutMs	120000	Timeout for a single git command
maxDiffChars / maxReadChars	20000 / 40000	Cap on content returned to the model
gitAuthorName / gitAuthorEmail	unset	Commit author; unset means the git global configuration

Enabling writes:

- id: github-repo
  config:
    allowPush: true
    allowApiWrite: true
    allowRepos:
      - your-name/your-repo
    workspaceRoot: '/path/to/clones'