
Security News
pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.
dsh-git-workbench
Advanced tools
DeepSeek Harness git development workbench: captures git context (branch, status, worktrees, stash, recent commits) into every session, asks which branch/worktree to develop in at session start, and switches branches / creates and manages worktrees throug
A git development workbench for DeepSeek Harness: not a git-status display plugin — it drives the branch/worktree workflow. It captures the repository state (branch, ahead/behind, worktree status, worktrees, stashes, recent commits) into every session, asks which branch or worktree to develop in at new-session start, and switches branches / creates and manages worktrees through /git commands, the git_workbench agent tool, and a Settings page.
autoAsk on, the agent asks once per session which environment to develop in: stay on the current branch, switch to another branch, create a new branch, open an existing worktree, or create a new worktree. The user can skip (stay where they are)./git slash commands
/git status — inject the current git context snapshot/git switch <branch> [--stash|--force] — switch branch/git merge <target> — merge the current branch into /git branch <name> [--from <base>] — create a branch and switch to it/git log [N] — recent commits/git stash [push|list|pop|drop] — stash management/git worktree list · add <branch> [--from <base>] [--dir <path>] · remove <path|branch> [--force] [--delete-branch]git_workbench agent tool — the same guarded operations, callable by the agent (e.g. from the auto-ask flow). Agent-driven switching goes through exactly the same guardrails as the command.git_workbench (action merge, which also handles the target being checked out in another worktree, dirty-tree guards, and already-merged detection), then asks you whether to delete the branch/worktree after the merge or keep it, and only deletes with your explicit choice.needsDecision with options (stash first / force / cancel). Force is gated by allowForceSwitch (default off).--force, gated by allowForceWorktreeRemove (default off). Optionally deletes the branch after removal (--delete-branch, only when merged).execFile with an argument array — no shell, so names cannot inject commands. Branch names are sanitized.autoAsk, ask threshold, worktree directory template ({parent}/{repo}-{branch}), recent-commit count, and the two force toggles. Persisted to $DSH_HOME/git-workbench.json.dsh plugin --profile web add dsh-git-workbench
Slow npm registry?
dsh plugin --profile web add dsh-git-workbench --registry=https://registry.npmmirror.com
Install from a local checkout (development):
dsh plugin --profile web add file:/path/to/dsh-git-workbench
Use the
file:prefix (copies the package intonode_modules). A bareadd .oradd link:…makes pnpm symlink the package, in which case the plugin'sschemasterydependency resolves from the source checkout and is not found — a general pnpm symlink-install gotcha, not a bug in the plugin.
Restart dsh web, then:
/git for the command menu.Worktrees are separate directories, so in DSH each worktree is its own workspace/session. /git worktree add <branch> creates the worktree at <parent>/<repo>-<branch> (configurable via worktreeDirTemplate) and tells you to open a new DSH session in that directory — that is the intended way to "develop in a worktree". The worktree is immediately visible in the worktree list of every other session of the same repository.
@deepseek-ai/* from an out-of-tree host plugin. Declaring @deepseek-ai/dsh-llm / dsh-tools (or any @deepseek-ai/*) as dependencies installs second copies into the profile's node_modules; the resulting duplicate module instances break host module identity (empirically: the tools scheduler's TOOL_RUNTIME_SCHEDULER symbol mismatch makes every tool dispatch fail with Cannot read properties of undefined (reading 'prepare')). This plugin therefore hand-builds its pre-step context message (the createUserMessage shape: id + role:'user' + content + source:{kind:'plugin',plugin,form:'snapshot',sections}, deep-frozen) and registers its agent tool as a plain compiled definition (parameters as an object-rooted JSON Schema with a root required array; output as a strict JsonSchemaNode).dsh-time-context pre-step pattern: ctx.on('agent/pre-step', …, { prepend: true }), fresh capture on step 1, memoized between steps, re-injected when the fingerprint changes or after our own writes.git status --porcelain=v2 does not emit # branch.* header lines unless --branch is passed.npm test # client regression, unit, and real-git integration tests (temp repos)
FAQs
DeepSeek Harness git development workbench: captures git context (branch, status, worktrees, stash, recent commits) into every session, asks which branch/worktree to develop in at session start, and switches branches / creates and manages worktrees throug
We found that dsh-git-workbench demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.

Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.