v1.6.3 — first open-source release

First open-source release. A GitHub toolkit for DeepSeek Harness: eight typed github_* tools over the GitHub CLI, a layered credential chain with Device Flow authorization, workspace-bound repository detection, and a guarded raw REST escape hatch.

Install

Download dsh-github-toolkit-1.6.3.tgz below and point the Harness plugin manager (plugin_manager action install_bundle) at the unpacked package directory. Do not install a link: to the source tree — the launcher's runtime resolution does not reach bare @deepseek-ai/* imports through a junction, and the plugin then fails with ERR_MODULE_NOT_FOUND.

Requires DSH >=0.2.0-0 <0.3.0 and the GitHub CLI (gh) on PATH.

What it provides

Tool	Covers
github_auth	Credential chain status, end-to-end connectivity probe, Device Flow login, PAT login, logout
github_repo	View, list, branches, clone, create, edit, rename, archive, delete
github_pr	List, view, diff, checks, status, create, comment, review, ready, checkout, merge, close, reopen, edit
github_issue	List, view, create, comment, close, reopen, edit, develop
github_release	List, view, create, edit, upload, download, delete
github_actions	Run list/view/log/watch/rerun/cancel/delete, workflow list/view/dispatch
github_search	Repositories, issues, pull requests, code, commits
github_api	Guarded raw REST for everything else (opt-in via allowRawApi)

Also: a prompt section, three on-demand skills (github-pr-review, github-ci-triage, github-issue-to-pr), and a session-header branch pill.

Safety model

• Every command is an argv array spawned with shell: false — model-supplied text is never re-interpreted as shell syntax.
• Every action that changes remote state is classified destructive: 23 of them, each requiring confirm: true and passing an approval seam. confirm is the model's intent, not the user's consent.
• github_api write methods are classified at run time by their method, so the escape hatch cannot skip the gate.
• Secrets never enter argv. Device Flow talks only to github.com, with no broker and no secret on disk.
• Bounded processes (timeout → SIGTERM → SIGKILL) and bounded output (one byte budget across stdout+stderr, spilling to a file).

Verification

• 140 offline tests, 203/203 declared-parameter coverage
• 176 behaviour snapshots pinning exact argv and result values
• 80/80 argv shapes parsed by a real gh --help; 50/50 positional arities matched against gh's own USAGE text
• Bundle integrity, prompt/skill guidance, and encoding all gated in npm run release

Full history in CHANGELOG.md; design decisions and the defects that shaped them in docs/DESIGN.md.

MIT licensed.