Files
deepseek-harness/packages/experimental/forge-github/README.md
T
Yichen Jiang d0fc1f6458 feat(forge): show the changes of a Session and of its change requests
The forge panel opens a changes view in the right sidebar for the
checkout's local changes and for the diff of each change request.

- ForgePanelController reads local diffs in the branch, uncommitted,
  unstaged, and staged scopes through Git in the Session's read-only
  sandbox, change request diffs through the forge provider, and the text
  of a changed file to expand unchanged lines. Change request patches stay
  cached by head commit and base branch within maxCachedDiffBytes. A local
  diff over maxDiffBytes fails as forgePanel/diff-too-large, and a provider
  read over its output limit fails as too-large, which the view explains
  with a link to the code host; a gh timeout fails as unavailable.
- forge adds the diff, fileText, and fileUrl provider methods and the
  too-large failure code, and forge-github implements them with gh.
- The panel shows a local changes card that opens the view and asks the
  Agent for a change request. The view collapses files past a line
  budget, draws lines side by side or in one column with optional
  wrapping, expands unchanged lines on request, and collapses or expands
  every file from its toolbar; file headers use a bare chevron.
- The checkout row copies the worktree or project directory path, the
  refresh glyph turns while a refresh runs, change request cards keep
  their actions while collapsed, and the header entry uses the shared
  compact button.
- client-ui-forge classifies changeRequestKey and FsError as
  peer-required Host imports, which keeps forge and dsh-fs as its peers.
2026-10-20 13:34:27 +08:00

7.0 KiB

description, kind
description kind
Serve the experimental forge registry for GitHub hosts through the GitHub CLI on the host. package-reference

@deepseek-ai/dsh-experimental-forge-github

English | 中文

Summary

Read GitHub and GitHub Enterprise pull requests for ctx.forge with the GitHub CLI that is already signed in on the host. One GraphQL query per host and poll reads state, changed lines, checks, review decision, mergeability, and unresolved review threads for every due pull request.

Table of Contents


Use this package

Mount the provider after the forge registry and list every GitHub Enterprise host explicitly.

- name: '@deepseek-ai/dsh-experimental-forge'
- name: '@deepseek-ai/dsh-experimental-forge-github'
  config:
    hosts: [github.com, ghe.example.com]

The provider runs gh as a host process, even when Sessions execute commands in another execution world. Sign in once per host with gh auth login --hostname <host>. The child receives the host environment without DSH_* variables and without variables whose names contain KEY, PASSWORD, SECRET, or TOKEN, so GH_TOKEN and GITHUB_TOKEN are not forwarded and gh uses its own credential store. Prompts, update notices, pagers, and colors are disabled. ghCommand, hosts, timeoutMs, and maxOutputBytes are listed in the configuration catalog.

The provider serves a remote URL in https, http, ssh, or git form, or in scp form such as [email protected]:owner/name.git, when its host is configured. It serves pull request URLs of the form https://<host>/<owner>/<name>/pull/<number> with any trailing path, query, or fragment, and builds that form without the suffix as the canonical URL. A readiness probe runs gh auth status --hostname <host>: exit status 0 is ready, another exit status is unauthenticated with the first diagnostic line, and a gh that cannot start is unavailable. A head lookup returns up to 20 open pull requests whose head is the branch, newest first, excluding pull requests from forks; a lookup of the default branch returns none.

Check runs map to pending until completed, then to success, failure (failure, timed out, startup failure, or action required), cancelled, skipped, or neutral. Check runs keep their start and completion times. Commit status contexts map SUCCESS to success, FAILURE and ERROR to failure, and every other state to pending, and carry no times. A GraphQL NOT_FOUND error becomes a not-found failure. When gh prints no JSON, a diagnostic that mentions authentication or gh auth login becomes unauthenticated and any other diagnostic becomes unavailable.

A pull request is mergeReady when it is open, not a draft, GitHub reports its merge state as CLEAN, HAS_HOOKS, or UNSTABLE, and the signed-in user has write, maintain, or admin permission. mergeMethods lists the squash, merge-commit, and rebase methods the repository allows, the user's default merge method first. Marking ready runs gh pr ready <number> --repo <host>/<owner>/<name>. Merging calls PUT repos/<owner>/<name>/pulls/<number>/merge through gh api with the method and the expected head SHA, so GitHub refuses once new commits arrived, which is reported as stale. Unlike gh pr merge, it never enables auto-merge, never joins a merge queue, and never deletes the head branch. A refused action reports GitHub's message, and a diagnostic that mentions authentication becomes unauthenticated.

diff runs gh pr diff <number> --repo <host>/<owner>/<name> --color never. fileText reads repos/<owner>/<name>/contents/<path>?ref=<commit> through gh api with the raw media type and accepts only a full 40- or 64-digit hexadecimal commit. fileUrl returns https://<host>/<owner>/<name>/blob/<commit>/<path>. Both paths percent-encode each segment. A refused read becomes not-found for HTTP 404, unauthenticated for a diagnostic that mentions authentication, too-large for GitHub's too_large error, which a diff over its own size limit draws, and unavailable otherwise, with GitHub's message. A read whose output exceeds maxOutputBytes becomes too-large, and one that outlives timeoutMs becomes unavailable.


Understand the implementation

Implementation internals — click to expand

A fetch groups references by host and sends one gh api graphql query per host. The query inlines validated owner, name, and number values and gives each pull request an alias, so partial GraphQL errors fail only their own aliases. gh exits nonzero on partial errors but still prints the complete response, which the provider parses before it inspects the exit code.

Source Responsibility
src/index.ts Configuration validation and provider registration
src/provider.ts URL mapping, host grouping, and failure classification
src/graphql.ts Query construction and response validation and mapping
src/gh.ts Host gh execution with environment scrubbing and limits
src/urls.ts Remote URL and pull request URL parsing

Further Exploration


Model Experience

None, as the provider reads pull request status for host-side watchers without contributing model context.

KV Cache effect

None. Provider output reaches only host-side watchers.

Known Limitations and Deferred Work

  • GitHub CLI on the host — gh must be installed and signed in for each configured host; tokens in environment variables are not forwarded. Hosts missing from hosts are never read.
  • First 100 checks and review threads — checksTruncated marks a head commit with more checks; unresolved threads after the first 100 are not counted.
  • No fork discovery — head lookups exclude pull requests whose head is in another repository.
  • Rate limits — every poll costs one GraphQL query per host against the signed-in account's rate limit.
  • No merge queue — a base branch that requires a merge queue refuses a direct merge, and the provider never queues one.

Dev Note

Working context for maintainers — click to expand

None.