gh-auth-isolation

To switch GitHub identities safely, use isolated gh config directories and on-demand token extraction to separate contexts. This prevents credential leakage by ensuring non-persistent token usage and explicit remote URL handling during automated agent-driven tasks.

Your agent pushes commits to the wrong GitHub account because it defaults to a single enterprise auth context. You must detect the active identity and switch contexts safely to target the correct EMU or personal account before pushing.

Yes, you can push to a personal fork from an enterprise context by switching to an isolated GitHub config context for the target account. This isolates credentials so your actions stay within the intended personal account.

The best way to detect the active GitHub identity is to run a pre-operation check that reports the current authenticated user. This verifies the context before executing operations like creating PRs or forking repos across EMU and personal accounts.

Yes, you need isolated configuration directories to manage multiple GitHub tokens safely. They prevent token leakage by separating EMU and personal account credentials into distinct contexts during automated workflow execution.