
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Git capability bundle for DeepSeek Harness: structured git tools, approval-gated mutations, and auto-checkpoints.
Provides DeepSeek Harness agents with automatic checkpoints before risky edits, structured Git tools, and approval-gated write operations in a single npm bundle.
English | 中文
write, edit, str_replace_editor, and, by default, bash—the worktree is snapshotted under refs/harness-checkpoints/<session-id>. The git_checkpoint_restore tool restores the corresponding state. Because shell commands cannot be integrated directly into the agent's edit pipeline, the system prompt defines a mandatory Git safety procedure: create a checkpoint before every mutating tool call, verify the result with git_status, and restore the checkpoint if an error occurs.git_status, git_diff, and git_log return typed data parsed from porcelain v2, allowing the model to reason over repository state without parsing terminal formatting.refs/harness-checkpoints/<session-id>. They are not pushed or pruned, and rollback does not remove untracked files. If no checkpoint exists—typically during the first edit after a clean state—git_checkpoint_restore restores from HEAD.All mutating tools are approval-gated through the Harness UI, using the same approval mechanism as bash.
| Tool | Purpose |
|---|---|
git_status / git_diff / git_log | Structured reads of the working tree |
git_commit | Commit staged changes (approval-gated) |
git_restore | Discard worktree changes (approval-gated) |
git_checkpoint / git_checkpoint_restore | Manual snapshot / rollback (approval-gated; falls back to HEAD when no snapshot exists) |
@deepseek-ai/* packages it needs come with the install and are declared as peersgit executable on the hostInstall through the Harness plugin command:
dsh plugin --profile web add dsh-git
dsh plugin runs pnpm add dsh-git inside the profile and auto-registers the bundle through its dsh.bundle.patch. Restart, and the three plugins (git-local, tool-git, git-checkpoint-policy) plus the seven git_* tools are live.
Alternatively, install the package manually and mount the plugins:
cd ~/.dsh/profiles/<profile>
npm install dsh-git
- insert:
- id: git-local
name: 'dsh-git/local'
- id: tool-git
name: 'dsh-git/tool'
- id: git-checkpoint-policy
name: 'dsh-git/checkpoint-policy'
Restart after editing the profile's cordis.patch.yml.
Do not mount
dsh-git/gitas a plugin entry. The definition registersctx.gitautomatically; mounting it alongsidegit-localcauses a duplicate-service error.
git-local, tool-git, and git-checkpoint-policy.git_status and confirm that it returns a structured report containing branch:.git_commit, approve the operation, and confirm that it returns committed <sha>.refs/harness-checkpoints/, and use git_checkpoint_restore to restore the pre-edit state.The built lib/ directory is synchronized from the upstream Harness repository (packages/git/ at https://github.com/deepseek-ai/deepseek-harness) with ./sync.sh [UPSTREAM_DIR]. The script copies each component's lib/ directory to lib/<component>/, rewrites internal @deepseek-ai/dsh-git imports to the package self-reference dsh-git/git, and pins the version. The upstream repository contains src/ and tests/; this repository distributes the build output.
push, fetch, and gh workflows remain shell-driven.git clean is deferred.refs/harness-checkpoints/* are local refs and are neither fetched nor pushed or pruned.@deepseek-ai/* peer dependencies are provided by Harness rather than published as registry packages. dsh-git must be installed in a profile belonging to a compatible Harness installation.gh.FAQs
Git panel for the dsh web GUI - name reserved; first release in development.
The npm package dsh-git receives a total of 18 weekly downloads. As such, dsh-git popularity was classified as not popular.
We found that dsh-git demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.