Problem
GitHub mandatory 2FA enrollment now blocks agent PAT creation/rotation for some agent accounts.
Observed on 2026-06-01 while repairing fold agent auth:
c0da and x1f9 stored GitHub PATs still verify via gh api /user, but expire soon.- GitHub classic token listing/creation automation logs in successfully, including email/device verification.
- Navigating to the classic token creation page redirects to an enrollment interstitial:
Two-factor authentication (2FA) is required for your GitHub accountEnable 2FA nowYou have 7 days left to enable 2FA
- Because 2FA is not enabled, GitHub does not expose the token creation UI, so token create/rotate cannot proceed.
No token values are included here.
Why this belongs in shimmer
Fold has the immediate operational incident in ricon-family/fold#71, but shimmer/websites own the reusable agent auth/tooling path:
- agent GitHub credential lifecycle;
- token status/create/rotate/store/sync orchestration;
- browser login automation;
- secret-provider integration.
Agents are modeled as people with their own GitHub accounts, so the fix should preserve agent-owned PATs rather than replacing agent identity with a shared GitHub App. GitHub Apps may still be useful for shared org plumbing, but they do not replace agent-as-person identity.
Proposed direction
Support TOTP-backed GitHub 2FA for agent accounts:
- During first 2FA enrollment, capture and store the agent's GitHub TOTP seed and recovery codes in the secret provider without printing them.
- Add a helper that generates the current TOTP code from the stored seed, without logging the seed or code unless explicitly requested for debugging.
- Teach GitHub login/token tooling to fill GitHub's 2FA code prompt from that helper.
- Keep token create/rotate wrappers responsible for capturing PAT stdout, storing it, syncing CI secrets, and verifying the stored token without printing it.
Potential secret paths:
<agent>/github-totp-secret or <agent>/github-totp-otpauth<agent>/github-recovery-codes
Potential CLI shapes:
shimmer github:totp <agent>
shimmer github:2fa:enroll <agent>
shimmer github:token:rotate <agent>
The TOTP generator can use an existing provider feature (op item get --otp, bw get totp) if available, or a small RFC 6238 helper over a stored base32 seed.
Related
ricon-family/fold#71 — immediate c0da/x1f9 PAT rotation blockerKnickKnackLabs/shimmer#589 — GitHub token check/rotation tasksKnickKnackLabs/shimmer#572 — agent passkey/credential providerKnickKnackLabs/shimmer#538 — Vaultwarden for agent secret managementKnickKnackLabs/shimmer#588 — browser-based GitHub token tasks
Problem
GitHub mandatory 2FA enrollment now blocks agent PAT creation/rotation for some agent accounts.
Observed on 2026-06-01 while repairing fold agent auth:
c0daandx1f9stored GitHub PATs still verify viagh api /user, but expire soon.Two-factor authentication (2FA) is required for your GitHub accountEnable 2FA nowYou have 7 days left to enable 2FANo token values are included here.
Why this belongs in shimmer
Fold has the immediate operational incident in
ricon-family/fold#71, but shimmer/websites own the reusable agent auth/tooling path:Agents are modeled as people with their own GitHub accounts, so the fix should preserve agent-owned PATs rather than replacing agent identity with a shared GitHub App. GitHub Apps may still be useful for shared org plumbing, but they do not replace agent-as-person identity.
Proposed direction
Support TOTP-backed GitHub 2FA for agent accounts:
Potential secret paths:
<agent>/github-totp-secretor<agent>/github-totp-otpauth<agent>/github-recovery-codesPotential CLI shapes:
The TOTP generator can use an existing provider feature (
op item get --otp,bw get totp) if available, or a small RFC 6238 helper over a stored base32 seed.Related
ricon-family/fold#71— immediate c0da/x1f9 PAT rotation blockerKnickKnackLabs/shimmer#589— GitHub token check/rotation tasksKnickKnackLabs/shimmer#572— agent passkey/credential providerKnickKnackLabs/shimmer#538— Vaultwarden for agent secret managementKnickKnackLabs/shimmer#588— browser-based GitHub token tasks