dsh-github-bridge
中文 · English
A DSH plugin that connects DSH/dwsh to GitHub, letting the agent call remote GitHub APIs directly (repos, issues, pull requests, files, and search) and sign in with a GitHub OAuth login, the way CLI tools like Codex do.
Features
- Login-based GitHub authentication — OAuth 2.0 device flow (
github_login,
or the "Login with GitHub" button on the plugin's config page in Settings → Plugins). No personal access token required; the token is stored in DSH credentials and never exposed to the model.
- Generic GitHub REST API call:
github_request - User and repositories:
github_get_user,github_list_repos,github_get_repo - Issues:
github_list_issues,github_get_issue,github_create_issue - Pull requests:
github_list_pull_requests - File contents:
github_get_file - Search:
github_search_repositories - Auth helpers:
github_auth_status,github_logout
Install
cd /path/to/dsh-github-bridge
dsh plugin --profile web add .The plugin declares dsh.bundle.patch, so dsh plugin automatically adds it to dsh.profile.bundles when installed into a DSH profile. The default row id is github-bridge.
After installing, restart DSH once. The web app discovers client bundles (package dsh.client) at boot, so the plugin's config card appears in Settings → Plugins after the restart.
Configuration
All configuration lives in the plugin itself and is set manually, either in the profile's cordis.patch.yml or a --patch overlay — and, for the OAuth settings, directly on the plugin's config page (Settings → Plugins → dsh-github-bridge), which needs no restart:
- id: github-bridge
config:
# GitHub OAuth App client ID. Required for login-based auth (device flow).
# Create an OAuth App at https://github.com/settings/applications/new and
# tick "Enable Device Flow". The client_secret is NOT needed for the
# device flow. Can also be entered on the config page instead of here.
clientId: Iv1.xxxxxxxxxxxxxxxx
# OAuth scopes (space-delimited). Defaults to "repo".
scopes: repo
# OAuth host. Defaults to https://github.com (set for GitHub Enterprise).
oauthBaseUrl: https://github.com
# DSH credential reference / env var the token is stored under.
tokenEnv: GITHUB_TOKEN
baseUrl: https://api.github.com
defaultOwner: my-org
defaultRepo: my-repoclientId, scopes, and oauthBaseUrl entered on the config page (the "OAuth client (Client ID)" section) are stored in a DSH settings namespace and take effect immediately; values entered there win over the patch layer, and clearing a field reverts to the patch-layer value. The manual-token box on the same card is for an access token (ghp_… / github_pat_…) only — a Client ID (Iv1.… / Ov23li…) is not a token and will be rejected with a clear error.
defaultOwner and defaultRepo are optional conveniences; when omitted, the tools require explicit owner / repo arguments.
Creating the GitHub OAuth App
Sign in at <https://github.com/settings/applications/new> and fill the form:
| Field | Value |
|---|---|
| Application name | anything, e.g. dsh-github-bridge |
| Homepage URL | http://localhost is fine — GitHub only displays it, it does not need to be publicly reachable |
| Authorization callback URL | http://localhost — only used by the redirect (web) flow; the device flow never redirects (the token comes back through polling), so this value is never invoked |
| Enable Device Flow | must be checked — otherwise login fails with device_flow_disabled |
| Expire user access tokens | uncheck unless refresh-token support is added: with expiration on, the token expires after 8h and this plugin (which stores only the access token) would stop working |
After registering, copy the Client ID (shown on the app page; the client_secret is not needed for the device flow) into the plugin config as clientId.
Signing in to GitHub
From the config page (Settings → Plugins → dsh-github-bridge)
1. Make sure clientId is configured (see above). 2. Open Settings → Plugins, expand the dsh-github-bridge card. 3. Click Login with GitHub: the card shows the verification URL and a one-time code, and polls until you authorize. 4. Open the URL, sign in, and enter the code. The card then shows the signed-in user; "Sign out" removes the token.
You can also paste a token manually ("Save token") on the same card.
From a conversation
Ask DSH to log in, e.g. "登录 GitHub". The agent runs github_login, which starts the device flow, shows the verification URL + code, and polls until you authorize. Use github_auth_status to check who is signed in and github_logout to sign out.
The stored token is resolved per operation through the DSH credentials service, so a login takes effect immediately — no restart needed after the first boot.
Usage in DSH
After installation and login, you can ask DSH things like:
- "Show me the README of
my-org/my-repo" - "List recent open issues in this repository"
- "Create an issue in
my-org/my-repowith title ... and body ..." - "Search GitHub for TypeScript repositories about dsh"
The model will call the corresponding github_* tools.
Development
npm testLayout:
dsh-github-bridge/
├── cordis.patch.yml # DSH bundle patch inserting the plugin row into a profile
├── client/
│ └── client.js # Browser half: the Settings → Plugins config card
│ # (ModuleLoader module, registers settings.plugin.item)
├── src/
│ ├── github.js # GitHub REST client + OAuth device flow + HTTP helpers
│ └── index.js # DSH plugin entry: tools, auth routes, config card wiring
└── test/
├── github.test.js # Client and helper tests
├── plugin.test.js # Plugin registration / execute-path smoke tests
└── auth.test.js # Device flow, route handlers, and auth tool tests