The agent opens the PR; the token never appears in the transcript

Your product's agent fixes a customer's bug and needs to ship it as a pull request. That means a GitHub token in the room with a model.

The agent uses the GitHub endpoints under /api/v1/agent/github/: clone, commit, sync, pr. The customer authenticated once with the device flow. The token lives in the daemon's environment and is never returned in any reply, to the customer, to the agent, or to anything reading the session log. auth/status reports that a token exists; it doesn't show one.

The model did the git work without ever holding the credential as text. A prompt injection hidden in a commit message can ask the agent for its GitHub token and get an honest "I don't have it."