gh-auth-isolation

To prevent cross-account pushes, you must detect and isolate the active GitHub identity before executing operations. This involves scoping tokens via environment variables and using separate gh config directories to ensure agents operate within the correct account context.

Managing mixed EMU and personal accounts requires identity detection and context isolation. You can safely switch contexts using shell aliases to perform operations like pushes or clones, then revert to the default gh auth state to avoid credential leaks.

Environment variable scoping for GitHub token management works by binding specific tokens to isolated shell contexts. This ensures that automated agents only use the credentials mapped to the designated environment, preventing unauthorized cross-account access.

You need to configure separate gh config directories when an agent must perform operations across different GitHub accounts, such as pushing to a personal repo while defaulting to an EMU. This isolates the active identity and prevents cross-account token usage.

Yes, you can use shell aliases to switch GitHub contexts for clones and pull requests. Aliases allow you to temporarily reassign the active identity, execute the required operation, and then revert the shell back to its default authentication state.