dsh-wsl-github

When you drive a DeepSeek Harness agent from WSL, dsh-wsl-cred already covers git push credentials. What is still missing is a safe way to ask the agent which PRs are open on this repo, or whether the last CI run passed. The usual workaround is pasting a personal access token into the chat and deleting it afterward, which is both risky and messy. dsh-wsl-github wraps that one narrow job into a deliberately small plugin.

It exposes exactly two tools. github_app_hint verifies that GitHub App credentials exist in the local config and that the permission split (relative to cred, ssh, and win_open_url) is correct, without ever printing a secret. github_repo_status returns up to five open pull requests and the latest Actions run for the current repository, or an optional target. A short-lived App installation token is minted in process memory; the PEM, JWT, and token never appear in tool output or chat transcripts.

The sweet spot is clear: you are coding and submitting PRs from WSL while a Windows browser handles the reading on GitHub, and you are already part of the dsh-wsl-kit ecosystem. It sits alongside cred_hint, win_open_url, and net_doctor, each owning a narrow slice of the workflow. No Webhooks, no forty-tool GitHub connector, no ad-hoc PAT wiring. If you only need a quick, safe pulse check on open PRs and CI status, this plugin is small enough and secure enough for the job.