v2.0.0 — renamed to dsh-github-gate, and the product surface it was missing

Renamed to dsh-github-gate. A plugin called dsh-github-toolkit already exists with the same topics and is more product-complete; in a marketplace we looked like a less-featured copy of it. The new name keeps "github" (searchable) and names the actual differentiator: every state-changing action goes through a gate.

Tool names (github_*) and actions are unchanged — only the package identity changed.

What this release adds

Settings → Plugins → GitHub. A real page, not YAML editing:

• shows whether a credential is configured and which layer supplied it
• a password field that writes the PAT to the Harness credential store
• Test connection — one real gh api user round trip through the same chain the tools use
• cannot read the token back: the Host never returns it, and the field clears on save
• all three routes requireGate and fail closed (403) when no connection service can judge the caller — a page that writes a secret must not be reachable by an unjudged caller

One failure vocabulary (lib/format.js). 401, 403 quota, 403 SAML, missing scope, 404, 422, 409, network and missing-gh each name the fix. An unrecognised failure gets no hint rather than a generic sentence — generic hints train readers to skip hints.

One-command download. install.ps1 / install.sh fetch the release, verify its sha256 against the digest GitHub publishes, and print the install path. They deliberately do not install: that step belongs to the plugin manager, which asks for approval.

Repository furniture. Bug/feature issue forms whose fields mirror this plugin's own diagnostics; a PR template that asks which behaviour contract applies; dependabot for Actions; and a tag-driven release workflow that checks the tag matches package.json before packing the same tarball a user installs.

PRIVACY.md and docs/roadmap.md — the latter records what is not planned and why.

Verification

Suite	Result
Offline tests	176/176 (18 new)
Parameter coverage	211/211 across 9 tools
Behaviour snapshots	180/180 deterministic
argv shapes parsed by real gh	84/84
Guidance / bundle / encoding	all clean
install.ps1 against this release	downloaded 235 KB, sha256 matched

The 18 new tests cover the two places Node's test runner cannot reach on its own: the HTTP routes (fail-closed admission, no token echo, real API call) and the browser half (loaded through a fake __ModuleLoader__, both slots register, both components return an element tree instead of throwing).

Install

irm https://raw.githubusercontent.com/1273984347/dsh-github-gate/main/install.ps1 | iex

Then plugin_manager action install_bundle with the printed path.

If you installed the old name, uninstall dsh-github-toolkit first — the package identity changed.

Full Changelog: v1.7.1...v2.0.0