github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

hivectl/README.md

@@ -3,7 +3,7 @@
 The operator-facing host CLI. A thin client for the `hive-c0re`
 daemon — speaks the host admin socket protocol (`hive-host-sock`) and
 does not link the daemon crate. Container lifecycle, the approval
-queue, and the matrix/github/gateway verbs all forward to the daemon
+queue, and the matrix/gateway verbs all forward to the daemon
 and need it running; a few (`wg`/`peer-config`, `choom`) work off local
 host state instead.
 
@@ -30,7 +30,6 @@ dispatch:
 - **`forge.rs`** — reconciles an agent's config against its forge
   repo.
 - **`matrix.rs`** — invite a matrix user to the hive Space or a room.
-- **`github.rs`** — per-agent GitHub PAT writes (`set-token`).
 - **`gateway.rs`** — gateway Basic-auth user management (htpasswd).
 - **`wg.rs`** — WireGuard mesh helpers.
 - **`subvol.rs`** — btrfs state-subvolume ops.

hivectl/src/cli.rs

@@ -45,15 +45,6 @@ pub enum Cmd {
         #[command(subcommand)]
         cmd: MatrixCmd,
     },
-    /// GitHub account provisioning.
-    ///
-    /// Store an operator-supplied personal access token (PAT) for an agent
-    /// so its `gh` and git can authenticate. Creates no account — the PAT
-    /// is for an existing GitHub account.
-    Github {
-        #[command(subcommand)]
-        cmd: GithubCmd,
-    },
     /// Gateway htpasswd user management.
     ///
     /// Add, remove, or list users for the gateway's HTTP Basic auth.
@@ -299,26 +290,6 @@ pub enum MatrixCmd {
     },
 }
 
-#[derive(Subcommand)]
-pub enum GithubCmd {
-    /// Store a GitHub PAT for `<agent>` so its `gh` and git can
-    /// authenticate.
-    ///
-    /// Prefer `--token-stdin` — an inline `--token` is visible in shell
-    /// history.
-    SetToken {
-        /// Logical agent name (the container/agent name).
-        agent: String,
-        /// The PAT value inline. Mutually exclusive with `--token-stdin`.
-        #[arg(long)]
-        token: Option<String>,
-        /// Read the PAT from stdin (trailing newline stripped). Mutually
-        /// exclusive with `--token`.
-        #[arg(long, conflicts_with = "token")]
-        token_stdin: bool,
-    },
-}
-
 #[derive(Subcommand)]
 pub enum GatewayCmd {
     /// Add a user or update an existing user's password in the gateway

hivectl/src/github.rs

@@ -1,48 +0,0 @@
-//! `hivectl github set-token <agent>` — write an operator-supplied GitHub PAT
-//! into an agent's `github-token` state file via the daemon's privileged
-//! helper, so the agent's `gh` wrapper + git credential helper authenticate.
-
-use std::path::Path;
-
-use anyhow::{Result, bail};
-
-use crate::util::daemon_request;
-
-/// `hivectl github set-token <agent>`: write an operator-supplied GitHub PAT
-/// into the agent's `github-token` state file (0600, agent-owned) via
-/// hive-priv, so the agent's `gh` wrapper + git credential helper can
-/// authenticate. Read live at invocation, so no rebuild/restart is needed.
-pub(crate) async fn github_set_token(
-    socket: &Path,
-    agent: &str,
-    token: Option<String>,
-    token_stdin: bool,
-) -> Result<()> {
-    // Resolve + validate the token client-side (inline flag or stdin read);
-    // the daemon never touches this process's stdin. Persistence happens
-    // daemon-side via the privileged helper.
-    let token = match (token, token_stdin) {
-        (Some(t), _) => t,
-        (None, true) => {
-            let mut s = String::new();
-            std::io::Read::read_to_string(&mut std::io::stdin(), &mut s)?;
-            s.trim_end_matches(['\n', '\r']).to_owned()
-        }
-        (None, false) => bail!(
-            "provide the PAT via --token <pat> or --token-stdin (stdin preferred — \
-             an inline token is visible in shell history + process listings)"
-        ),
-    };
-    if token.is_empty() {
-        bail!("refusing to write an empty GitHub token for agent '{agent}'");
-    }
-    daemon_request(
-        socket,
-        hive_host_sock::HostRequest::SetAgentGithubToken {
-            agent: crate::util::parse_ident(agent)?,
-            token,
-        },
-        "github",
-    )
-    .await
-}

hivectl/src/main.rs

@@ -5,7 +5,7 @@
 //! Container lifecycle + the approval queue (`agent <name> <spawn|kill|
 //! rebuild|restart|choom|…>`, `list-agents`, `approvals <pending|approve|
 //! deny>`, `stop` / `start`) and provisioning (`forge` / `matrix` /
-//! `github` / `gateway`) all forward to the daemon, which owns the broker,
+//! `gateway`) all forward to the daemon, which owns the broker,
 //! the credentials, and the provisioning logic — a running daemon is
 //! required for those. A couple of verbs work off local host state
 //! directly instead (`wg` / `peer-config` read the mesh key + TLS CA), so
@@ -27,7 +27,7 @@ mod client;
 /// Rebuild-queue node progress rendering (`wait_for_nodes` + the spinner /
 /// plain renderers), split out to keep this file manageable.
 mod dag_progress;
-use cli::{Cli, Cmd, ForgeCmd, GatewayCmd, GithubCmd, WgCmd};
+use cli::{Cli, Cmd, ForgeCmd, GatewayCmd, WgCmd};
 mod completions;
 mod quota;
 mod util;
@@ -41,10 +41,8 @@ use open::open_url;
 mod wg;
 use wg::{peer_config, require_hive_domain, wg_init, wg_peer, wg_status};
 mod choom;
-mod github;
-mod watch;
-use github::github_set_token;
 mod forge;
+mod watch;
 use forge::forge_reconcile_config;
 mod agents;
 use agents::{agents_list, run_agent};
@@ -73,13 +71,6 @@ async fn main() -> Result<()> {
             } => forge_reconcile_config(&socket, &agent, from, verbose).await,
         },
         Cmd::Matrix { cmd } => run_matrix_cmd(&socket, cmd).await,
-        Cmd::Github { cmd } => match cmd {
-            GithubCmd::SetToken {
-                agent,
-                token,
-                token_stdin,
-            } => github_set_token(&socket, &agent, token, token_stdin).await,
-        },
         Cmd::Gateway { cmd } => match cmd {
             GatewayCmd::CreateUser {
                 username,

hivectl/src/util.rs

@@ -18,7 +18,7 @@ pub(crate) fn parse_ident(name: &str) -> Result<hive_types::Ident> {
 
 /// Send a provisioning request to the daemon and print its result lines.
 /// The daemon owns the provisioning logic; hivectl just relays the outcome,
-/// prefixing any error with `label` (e.g. `forge` / `github`).
+/// prefixing any error with `label` (e.g. `forge` / `gateway`).
 pub(crate) async fn daemon_request(
     socket: &Path,
     req: hive_host_sock::HostRequest,