zukunftsholz/dsh-zgit

Name: zukunftsholz/dsh-zgit
Author: zukunftsholz

Plugin插件 Native原生 ⭐ 3 MIT Dev Workflow开发与代码工作流

DeepSeek Harness 插件：纯 HTTPS 取源码与发行版，无需 git 二进制、不 clone。| DeepSeek Harness plugin: fetch source & releases over plain HTTPS, no git binary, no clone.

Project Overview项目介绍

Edited by Zhiwei Agent (zhiwei)由知微Agent(zhiwei)编辑

dsh-zgit (slash command /zgit) is a plugin built specifically for DeepSeek Harness (DSH), targeting the release candidate DSH 0.1.5-rc.2 with cordis 4.0.2 and schemastery 3.18.2 as hard runtime peers. It exists to fetch source archives and binary releases from git hosts without ever requiring a local git binary, layering on top of DSH through a cordis plugin row with zero runtime dependencies (pure Node builtins: node:zlib, node:crypto, node:fs, node:http). Installation is the standard DSH plugin command dsh plugin --profile web add dsh-zgit, with alternative install forms github:zukunftsholz/dsh-zgit and a local path ./dsh-zgit; the package ships on npm under the same name and exposes all operations as registered DSH tools.

Typical usage pairs the agent with the human plane: the model calls zgit_ls_remote, zgit_clone, zgit_show, zgit_ls_tree, zgit_log, zgit_diff, zgit_status, zgit_fetch_release, and zgit_download, while operators trigger the same work without the model through the /zgit Web slash menu or TUI subcommands clone, get, show, ls, log, diff, resolve, status, and download. The plugin re-implements the read side of git over forge APIs (GitHub, GitLab API v4 with nested groups, Gitee API v5, plus generic Gitea/GitHub Enterprise URL guessing), produces a simulated checkout under a .zerogit/ metadata directory, and supports archive references such as owner/repo@ref, full https URLs with /tree/ref, and git@host:owner/repo.git ssh forms. It is aimed at second-party developers, CI maintainers, and code auditors working inside DSH sandboxes.

Configuration lives in the plugin row of $DSH_HOME/cordis.patch.yml, the active profile patch, or an overlay, with per-tool toggles (lsRemote, clone, release, show, lsTree, log, diff, status, download, command) and explicit caps: timeoutMs 120000, maxArchiveBytes 512 MiB, maxDownloadBytes 1 GiB, maxFileBytes 256 KiB, maxTreeEntries 5000, maxLogCommits 30, maxDiffChars 100000, and maxExtractedEntries 100000. Tokens raise API rate limits and unlock private repos through either tokenEnv env-var names or direct tokens values, and env wins over literal. Safety defaults enforce workspace confinement against exec.agent.session.header.cwd, reject path traversal, Windows reserved names, case-insensitive collisions, symlink materialization, zip decompression is CRC32-checked, gzip is capped against decompression bombs, and downloads stream with early-abort byte caps. The license is MIT, development uses npm run build (scripts/build.sh with junctioned DSH checkout plus tsc) and npm test (vitest covering parser/glob units, tar.gz+zip extractors, forge fixtures, real-HTTP e2e, and the Cordis mount itself).

dsh-zgit（命令 /zgit）是为 DeepSeek Harness 打造的原生插件，专门解决"想要源码或发行包但不想依赖 git 二进制"的场景。它通过纯 HTTPS 直接调用 GitHub、GitLab、Gitee 的 archive、raw、release 接口，无需任何运行时依赖（仅使用 Node 内置的 zlib、crypto、fs、http），并以 cordis 插件形式挂载到 DSH 上，安装方式为 dsh plugin --profile web add dsh-zgit，也支持 github: 与本地路径。

在工作流上，zgit_clone 会拉取 codeload 风格的 tar.gz/zip 归档，解压到工作区后生成含 .zerogit/meta.json 与 .zerogit/HEAD 的"模拟 checkout"；zgit_status 可重比对远端 ref 报告落后提交数，zgit_ls_remote、zgit_show、zgit_ls_tree、zgit_log、zgit_diff 重新实现了 git 的读取侧。用户还可借助 zgit_fetch_release 列出或下载 GitHub/GitLab/Gitee 发行资产，并用 sha256 与随包校验文件校验。该工具面向需要在沙箱或受限环境内获取源码、再交由 DSH 代理进一步处理的二次开发者、CI 维护者与代码审计人员。

需要注意，配置文件位于插件行（cordis.patch.yml、profile patch 或 overlay）中，可逐项开关工具并调整超时、字节上限（默认 clone 512 MiB、download 1 GiB、单文件 256 KiB）与 token 来源（环境变量名优先）。下载开启流式早停、压缩炸弹防护、路径遍历与 Windows 保留名拒绝、zip CRC32 校验、对称链接仅记录不落地。所有写入都被锁定在调用会话的工作区内，越界路径会被拒绝。项目以 MIT 协议发布，目标 DSH 版本 0.1.5-rc.2（cordis 4.0.2、schemastery 3.18.2），构建使用随附的 scripts/build.sh，测试套件 vitest 覆盖解析、归档提取、forge 模拟与 Cordis 挂载。

View on GitHub在 GitHub 查看

Send to your DSH发给你的 DSH 安装

请帮我安装这个 DSH 插件。安装前先完成【兼容性检查 + 安全性检查】，检查通过再动手。

插件：dsh-zgit（zukunftsholz/dsh-zgit）
仓库：https://github.com/zukunftsholz/dsh-zgit
本站详情页：https://www.yhbd.top/plugins/zukunftsholz-dsh-zgit/
本站登记：类型 plugin · 归类 原生 DSH 插件 · 许可证 MIT · ⭐ 3 · 最近提交 2026-09-28 · 主语言 TypeScript

按下面顺序执行，每步先把结论告诉我，再进入下一步：

【1 兼容性检查】
① 我这边：DSH 版本、Node 版本、操作系统、当前 profile（web / desktop）。
② 读它的 README、package.json、插件 manifest，列出它要求的 DSH 版本 / Node 版本 / 操作系统 / 外部依赖 / 需要另外先装的运行时。
③ 逐条比对，结论只写「满足 / 不满足 / 未知」三种；不满足的给出可行替代方案。
④ 检查是否和我已装的插件冲突：命令名重复、skill / tool 重名、端口占用、重复注册的 MCP server。

【2 安全性检查】
① 仓库可信度：和上面「本站登记」是否一致；star / fork 数、创建时间、最近提交，是否归档或长期停更。
② 安装脚本：逐行看 package.json 的 preinstall / install / postinstall，以及 install.sh、setup.ps1 之类脚本。出现 curl|bash、下载后直接执行、混淆代码、访问与插件功能无关的域名，立刻停下来告诉我，不要继续装。
③ 依赖：列出新增依赖，标出无人维护、或与知名包拼写近似的可疑包（typosquatting）。
④ 权限与副作用：它会读写哪些目录、访问哪些域名、需要哪些 DSH 权限（filesystem / network / shell / clipboard 等），以及怎么卸载和回滚。
⑤ 如果它要求 sudo / 管理员权限，或权限明显超出功能所需，先停下来问我。

【3 安装】
上面两步没有「不满足」和「高危项」时才执行；用官方推荐方式安装，不要自行提权。

【4 汇报】
用表格输出：检查项 / 结论 / 依据 / 是否需要我决策。拿不准的一律写「未知」并说明要我怎么确认——不要猜，也不要替我决定。

Send this message to DSH in your current session: it verifies compatibility and security first (answering met / not met / unknown item by item) and only installs once everything checks out — it will stop and ask you if it finds a high-risk item. The box scrolls; the copy is the full prompt. CLI install commands may not be accurate across systems, so DSH is the safer route.把上面这条消息直接发给当前会话里的 DSH：它会先核对兼容性与安全性（逐条给「满足 / 不满足 / 未知」），确认没问题再安装，有高危项会停下来问你。框内可滚动，复制到的是完整提示词；安装命令不一定准确，发给 DSH 更稳。

Pre-install check安装前体检Compatibility · Security兼容性 · 安全性 1 warning1 项注意

Only 3 stars - very few users, little community feedback星标只有 3，几乎没人在用，遇到问题缺少社区反馈

DSH walks through these 9 checksDSH 会逐条核对这 9 项

Compatibility兼容性

DSH, Node, OS and profile requirementsDSH 版本 / Node 版本 / 操作系统 / profile 是否满足要求
External dependencies and runtimes (Electron / Python / Docker, ...)外部依赖与运行时（Electron / Python / Docker 等）是否齐备
Conflicts with installed plugins: command names, skill / tool names, ports, duplicate MCP registration与已装插件是否冲突：命令名、skill / tool 重名、端口占用、重复 MCP 注册

Security安全性

Repo matches the facts registered here; archived or abandoned?仓库是否与页面登记一致，是否归档或长期停更
Safety of preinstall / install / postinstall and install.sh / setup.ps1preinstall / install / postinstall 与 install.sh、setup.ps1 是否安全
curl|bash, download-then-execute, obfuscation, unrelated domains → stop immediatelycurl|bash、下载即执行、混淆代码、无关域名 → 立刻停止
Typosquatting or unmaintained packages among the new dependencies新增依赖里有没有 typosquatting 或无人维护的包
Requested permissions vs. what the feature actually needs申请了哪些权限、是否超出功能所需（filesystem / network / shell / clipboard）
Any sudo / admin requirement, plus uninstall and rollback是否要求 sudo / 管理员权限，以及卸载与回滚方式

Anything uncertain must be marked unknown with a note on how to confirm it. This site's signal screen is a static snapshot, not a security audit.拿不准的必须标「未知」并说明要我怎么确认。本站的信号筛查是静态快照，不能替代安全审计。

Or use CLI install (for developers)或使用命令行安装（适合开发者）

CLI Install命令行安装

dsh plugin --profile web add dsh-zgit

把 zukunftsholz/dsh-zgit 加入你的 DSH 配置（web profile）即可启用。

READMEREADME

8.0 KB · 缓存于 2026-09-29 05:52:24 · 8.0 KB

dsh-zgit

English | 中文

[!TIP] 第一个《世界计划》本地化知识库，为同人作者和考据党而生：SekaiSync
The first Project SEKAI localization knowledge base, built for fan creators and lore enthusiasts: SekaiSync

即将面向 DeepSeek Harness 插件生态针对性适配，欢迎各位豆腐人 Star 和共建。
Targeted adaptation for the DeepSeek Harness plugin ecosystem is coming soon. Fellow Tofus are welcome to star and contribute!

dsh-zgit (the /zgit plugin) is a DeepSeek Harness (dsh) plugin for when the first thought about fetching source code or binary releases from a git host should not be git clone.

It fetches over plain HTTPS, with no git binary and zero runtime dependencies:

Docs: https://zukunftsholz.github.io/dsh-zgit/

Source code → downloaded as a forge archive (codeload-style tar.gz/zip), extracted into a simulated checkout with .zerogit metadata — a git-like directory you can inspect, status-check, and refresh.
Binary releases → release assets listed or downloaded straight from GitHub/GitLab/Gitee releases, with sha256 verification against shipped checksum files.
git, simulated → zgit_ls_remote, zgit_show, zgit_ls_tree, zgit_log, zgit_diff, zgit_status reimplement the read side of git over the forge APIs.
Anything else → zgit_download fetches any direct URL (mirrors, toolchains) into the workspace with a byte cap and optional sha256.

dsh plugin --profile web add dsh-zgit
# …or from Git (no npm account needed):
# dsh plugin --profile web add github:zukunftsholz/dsh-zgit
# …or from a local checkout:
# dsh plugin --profile web add ./dsh-zgit

Tools

Tool	git analog	What it does
`zgit_ls_remote`	`git ls-remote`	Branches, tags, ref→sha resolution, default branch, latest release tag.
`zgit_clone`	`git clone` / `git archive`	Downloads the source archive at a ref, extracts it into the workspace as a simulated checkout (`.zerogit/meta.json`), supports `subdir` sparse extraction and explicit archive URLs (mirrors).
`zgit_fetch_release`	`gh release download`	Lists or downloads release assets (latest or a tag) with glob patterns and sha256 verification.
`zgit_show`	`git show`	Fetches one raw file at a ref (optionally saved into the workspace).
`zgit_ls_tree`	`git ls-tree`	Lists files/dirs at a ref via the forge API.
`zgit_log`	`git log`	Recent commits at a ref.
`zgit_diff`	`git diff`	Compare two refs: changed-files summary or a single-file unified diff.
`zgit_status`	`git status` + `git fetch`	Checks a simulated checkout against the remote: moved ref, commits behind.
`zgit_download`	`curl`	Any direct HTTPS download into the workspace, capped, with optional sha256.

Showing the opening section of the README — the full document lives in the repository以上为 README 开头摘要，完整文档在仓库内 · View the full README on GitHub →在 GitHub 查看完整 README →

渲染基于仓库 zukunftsholz/dsh-zgit 的 README.md。在 GitHub 查看原文 →