node-git-ssh

Use git over SSH in Node.js without any system git or ssh binaries.

Works in sandboxed environments (Docker containers, serverless functions, restricted CI) where you only have Node.js available.

Built on:

• dugite — bundles a full git binary as an npm package
• ssh2 — pure JavaScript SSH client

Why?

Some environments (e.g. minimal Docker images, sandboxed runtimes, OpenClaw agent containers) have Node.js but no git or ssh binaries. This package bridges the gap.

Installation

npm install node-git-ssh
# or
yarn add node-git-ssh

Usage

Generate a key pair

const { generateKeyPair } = require('node-git-ssh');

const { privateKey, publicKey } = generateKeyPair('my-app');

console.log(publicKey);
// ssh-ed25519 AAAAC3... my-app
// → Add this to your GitHub/GitLab account SSH keys

Clone a repository

const { clone } = require('node-git-ssh');
const fs = require('fs');

const privateKey = fs.readFileSync('/path/to/id_ed25519', 'utf8');

clone(
  '[email protected]:user/repo.git',
  '/local/destination',
  { privateKey, depth: 1 }
);

Fetch & push

const { fetch, push } = require('node-git-ssh');

fetch('/path/to/repo', { privateKey });
push('/path/to/repo', { privateKey, branch: 'main' });

Run any git command

const { gitWithSSH } = require('node-git-ssh');

const result = gitWithSSH(
  ['log', '--oneline', '-10'],
  { privateKey, cwd: '/path/to/repo', stdio: 'pipe' }
);

console.log(result.stdout);

API

generateKeyPair(comment?)

Generates an ed25519 key pair in OpenSSH format.

• Returns { privateKey: string, publicKey: string }
• publicKey is in OpenSSH authorized_keys format — paste it directly into GitHub/GitLab

clone(url, destination, options)

Clones a repository.

• url — SSH git URL (e.g. [email protected]:user/repo.git)
• destination — local path
• options.privateKey — OpenSSH PEM private key string
• options.depth — (optional) shallow clone depth
• options.branch — (optional) branch to clone

fetch(repoPath, options)

Fetches all remotes.

push(repoPath, options)

Pushes to a remote.

• options.remote — default 'origin'
• options.branch — (optional)

gitWithSSH(args, options)

Runs an arbitrary git command with SSH authentication.

• Returns { status, stdout, stderr }

getGitBinary()

Returns the path to the bundled git binary.

getGitExecPath()

Returns the path to git's libexec directory.

How it works

1. dugite provides a pre-compiled git binary bundled as an npm package — no system git needed.
2. A temporary shell script is written to $TMPDIR and set as GIT_SSH.
3. That script calls a Node.js process using ssh2 to handle the SSH connection and authenticate with the provided key.
4. git's GIT_EXEC_PATH is pointed at dugite's libexec/git-core so internal git tools (like index-pack) are found.

The private key never touches disk as a persistent file — it's written to a temp file for the duration of the command and deleted immediately after.

Caveats

• Only SSH URLs are supported (not HTTPS). For HTTPS, just use the native https module or isomorphic-git.
• Host key verification is skipped (hostVerifier: () => true). For production use, implement proper host key pinning.
• Tested on Linux (x64). Should work on macOS. Windows support depends on dugite's platform support.

License

MIT