dsh-plugin-github

LIMITATIONS

Known limitations

### Networking: clone and push need a wider sandbox The default `workspace-write` sandbox blocks git's network transport (observed as `schannel: AcquireCredentialsHandle failed: SEC_E_NO_CREDENTIALS`, plus MSYS `sh.exe` being unable to create a signal pipe). Therefore: | Operation | `workspace-write` sandbox | `danger-full-access` | |---|---|---| | `gh_account` / `gh_config` (Node `fetch`, not git) | ✅ | ✅ | | `gh_api` (`fetch`) | ✅ | ✅ | | `gh_repo status/diff/log/branches`, `gh_file`, `gh_commit` (purely local) | ✅ | ✅ | | `gh_repo clone` / `gh_pull` / `gh_push` (git over HTTPS) | ❌ | ✅ | To let the agent actually clone and push, set the session to `danger-full-access`, or approve a one-off escalation for those operations. ### Other | Symptom | Cause / fix | |---|---| | No `gh_*` tools visible at all | The plugin is not installed, or DSH was not restarted. Install it, then fully quit and start DSH again | | "no GitHub account has been bound" | Run `gh_account(action="bind")`, or set the `GITHUB_TOKEN` environment variable | | A call fails with `value is not lossless JSON` | The plugin is an older version (its output carried `undefined` keys). Upgrade to a version that includes `output-contract.test.mjs` | | `gh_push` reports `allowPush` | Enable `allowPush: true` in the config and restart | | 401 / authentication failure | Check credentials with `gh_account(action="status")`; a private repository requires a token | | 403 with `rate_remaining: 0` | The unauthenticated limit (60/hour) is exhausted; binding a token raises it to 5000/hour | | `edit` reports "oldText appears N times" | Widen `oldText` until it is unique, or pass `count` explicitly | | `pull` fails on a divergence | Use `rebase: true`, or commit local changes first |