[Desktop] 环境信息面板无法显示私有仓库的拉取请求状态（未带 GitHub 鉴权）

Summary

The desktop 环境信息 panel always shows 「无法获取拉取请求状态」 for private GitHub repositories, even when the user is logged into GitHub (gh) and has full repo access.

Environment

• App: Xiaomi MiMo Desktop (Electron)
• OS: Windows
• Remote: [email protected]:AAAclc/2027RC.git (private)
• Branch: main (no open PRs; expected UI state would be “当前分支暂无拉取请求”)
• gh auth status: logged in as the repo owner, scopes repo, read:org, workflow

Steps to reproduce

1. Open a git workspace whose origin is a private GitHub repo.
2. Look at the right-side 环境信息 panel.
3. Observe the PR row.

Expected

• If the current branch has a PR → show number/state.
• If not → show 「当前分支暂无拉取请求」.
• If auth is required → prompt for / reuse a GitHub token instead of a hard failure.

Actual

Always shows 「无法获取拉取请求状态」 (infoPanel.prUnavailable).

Root cause (from resources/app.asar)

The panel fetches PR status without any Authorization header:

const url = new URL(`https://api.github.com/repos/${owner}/${repo}/pulls`);
url.searchParams.set("state", "all");
url.searchParams.set("head", `${owner}:${branch}`);
url.searchParams.set("per_page", "10");

await fetch(url.href, {
  headers: {
    Accept: "application/vnd.github+json",
    "X-GitHub-Api-Version": "2022-11-28",
    "User-Agent": "MiMo-Desktop",
    // no Authorization
  },
  signal: AbortSignal.timeout(8000),
});

GitHub returns 404 for unauthenticated access to private-repo /pulls (same as “not found”). The client maps 401/404 → unauthorized → prUnavailable.

This is independent of:

• local gh login
• configured GitHub MCP
• whether the branch actually has PRs

Suggested fix

1. Reuse an existing credential when available:
   • gh auth token / keyring, or
   • GH_TOKEN / GITHUB_TOKEN env, or
   • a Desktop Settings → GitHub token.
2. Send Authorization: Bearer <token> on the /pulls request.
3. Distinguish responses for better UX:
   • 404 with no token → “需要登录 GitHub 才能查看私有仓库 PR”
   • 200 + empty list → “当前分支暂无拉取请求”
   • 403/429 → rate-limit message

Workarounds today

• Query PRs in-session via gh pr list / GitHub MCP.
• Make the repo public (not acceptable for private work).

Related observation: local MCP spawn previously failed with npx ENOENT/EINVAL on Windows when npx was not on PATH / was a .cmd. Using absolute node.exe + npx-cli.js fixed MCP startup; this does not fix the sidebar PR row, which does not use MCP.