[RedStar071]

🔗 Linked issue

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

agent-gh only ran through bash, so Windows hosts needed WSL or Git Bash to read public GitHub data as wolfstar-agent-beep. This adds scripts/github-public.ps1, a native PowerShell 7 twin of scripts/github-public.sh. It allows the same reads, refuses the same writes, raw GraphQL, non-GET API calls, headers, host overrides and input files, and never falls back to personal credentials.

• Token: same path, $HOME\.config\wolfstar-agent-kit\github-public-token. agent-gh --setup-token prompts without echo and creates the file with a protected ACL for the user, SYSTEM and Administrators. A normal read never creates it. A file with any other allow rule, a link, or a token that is not github_pat_ is refused.
• gh resolution: only fixed install locations, gh.exe only, never PATH or the working directory.
• Environment: the script runs inside the caller's session, so it sets GH_TOKEN, GH_HOST, GH_PROMPT_DISABLED and GH_CONFIG_DIR for the gh call, clears the conflicting token variables, and restores every previous value afterwards. User and machine variables are untouched.
• Install: pnpm sync:context and pnpm check:context now go through scripts/agent-context-platform.ts. Linux and macOS run the same bash scripts as before. Windows runs scripts/sync-agent-context.ps1, which installs agent-gh.ps1 in $HOME\.local\bin idempotently, never touches the token, and adds the directory to the user PATH only with -AddToPath.
• Policy parity: scripts/github-public-ps.test.ts reads the bash allowlist and gh locations and runs one refusal table against both wrappers, so the two cannot drift. A new windows-2025 CI job runs the suite with real ACLs, and the Linux test job now runs pnpm test:github-public.

Setup, Windows and Linux differences, and troubleshooting live in docs/agent-gh.md.

🤖 AI disclosure: Wolfstar Agent Kit modified this description. AI open source policy.

    

[coldtea-pr-lens]

• Redraw · drawn at bb2217a, the branch has moved on

Architecture

Inside the changed components — 1 view

Component view — Windows agent-gh tooling

Platform router, installation scripts, and the native PowerShell agent-gh wrapper

Data flow

The other flows — 1 sequence

Context synchronization on Windows

Tip

Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."

🪧 More tips

• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through
• The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture… row. Drawing still runs as before
• Set github.draw: on-demand in .github/pr-lens.yml and PR Lens stops drawing pull requests on its own. Comment @pr-lens draw on a pull request when you want that one drawn
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works
• After a push, tick Redraw to draw the latest commit
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion
• Set github.description: false in .github/pr-lens.yml to stop PR Lens adding buttons to your PR descriptions

_{Thanks for using PR Lens! It's free for OSS. If it helped, a star helps other teams find it.}