dsh-wsl-github
Install set: part of dsh-wsl-kit. Prefer KIT_SET=daily | llm | github | full (see kit README). Fault tree: TROUBLESHOOTING.md.
DeepSeek Harness tools: github_app_hint + github_repo_status — GitHub App auth for the current repo’s open PRs and latest Actions run.
Part of dsh-wsl-kit.
中文说明 → README.zh.md
Why this plugin exists
WSL agents already have dsh-wsl-cred (cred_hint) for git push credentials. They still need the GitHub API for “what PRs are open?” and “did CI pass?”—without dumping a PAT into chat.
This plugin mints a short-lived GitHub App installation token in memory. Tool output never includes the private key, JWT, or token. Pair with dsh-wsl-browser (win_open_url) to open returned html_urls on Windows.
It is intentionally small. It is not a 40-tool GitHub connector.
How it fits dsh-wsl-kit
DSH in WSL + Chat in a Windows browser is the kit’s home turf. GitHub work splits across plugins:
| Job | Plugin | Tool |
|---|
| Push / HTTPS credentials | dsh-wsl-cred | cred_hint |
| API: open PRs + latest Actions | this plugin | github_app_hint, github_repo_status |
| Open PR / Actions in Windows | dsh-wsl-browser | win_open_url |
| Proxy / Node 24 fetch issues | dsh-wsl-net | net_doctor |
Why the kit path is convenient
- One install pack (
dsh-wsl-kit / install.sh) instead of ad-hoc PAT wiring.
- Secrets stay on disk under
~/.dsh/ and in process memory—not in Trajectory.
- Same mental model as the rest of the kit: small tools, clear OS boundary.
- Enough of a real GitHub App integration to join the GitHub Developer Program.
Suite overview: dsh-wsl-kit README.
Tools
| Tool | Role |
|---|
github_app_hint | Whether App credentials / ~/.dsh/dsh-wsl-github.env exist (existence only), setup + role split vs cred/ssh/win_open_url (no secrets) |
github_repo_status | Open PRs (up to 5) + latest Actions run. repo optional; default is git origin |
After configuring the env file, self-check with github_app_hint (no live App e2e in CI — needs your PEM).
End-to-end usage (WSL)
- Install the plugin (with the kit or alone):
dsh plugin --profile web add github:173787247/dsh-wsl-github
- Register the GitHub App once (permissions are pre-filled from
github-app-manifest.json):
npm run register-app
On GitHub: keep or rename the app → Create GitHub App. The script writes App ID + PEM to ~/.dsh/ and does not print secrets.
| Permission | Access | Why |
|---|
| Metadata | Read | Repo name, default branch |
| Pull requests | Read | List open PRs |
| Actions | Read | Latest workflow run |
| Webhook | Off | This plugin polls the API; it does not receive events |
| Install scope | Private app (public: false) | Install on your account while developing |
-
Install the App on your GitHub account (link printed by the script, or apps/dsh-wsl-github). Choose All repositories or only the repos you need.
-
Load env before dsh web (WSL / bash):
set -a
source "$HOME/.dsh/dsh-wsl-github.env"
set +a
dsh web
Windows PowerShell (if you start DSH from Windows):
Get-Content "$HOME\.dsh\dsh-wsl-github.env" | ForEach-Object {
if ($_ -match '^(GITHUB_[A-Z_]+)=(.*)$') { Set-Item -Path "Env:$($matches[1])" -Value $matches[2] }
}
-
Open a new session. Ask the agent:
- “Run
github_app_hint.”
- “Run
github_repo_status for this repo.”
- “Open that
html_url with win_open_url.”
If HTTPS to GitHub fails, run net_doctor. If git push fails, run cred_hint—that is a different problem from this plugin.
Manual App creation (no script): Register a GitHub App, Homepage https://github.com/173787247/dsh-wsl-kit, same permissions as the table, webhook off, then:
export GITHUB_APP_ID=123456
export GITHUB_APP_PRIVATE_KEY_PATH="$HOME/.dsh/dsh-wsl-github.pem"
GITHUB_TOKEN / GH_TOKEN is a last-resort smoke-test fallback, not the intended auth.
Optional: after the App can call the API, join the Developer Program at github.com/developer/register (product website can be this kit or plugin repo URL).
Config
- id: dsh-wsl-github
name: dsh-wsl-github
config:
timeoutMs: 20000
appId: ""
privateKeyPath: ""
installationId: ""
Empty strings mean “read from env”. A later profile config object replaces the whole block.
Test
npm test
License
MIT
