Identity routing for the GitHub CLI

Right repo.
Right account.
Every time.

Route each gh command through the account that belongs to this repository—without changing global auth or colliding with another agent.

Install the shim View source
  • Never stores tokens
  • Never mutates global state
Two separate luminous account routes pass through a transparent policy prism and arrive at one repository.
personal@github.com policy matched work@github.com

Process-scopedOne token. One command.

Context-awareRemote, owner, host, or path.

Agent-safeNo shared switch to race.

01 / The handoff

A policy layer, not another credential store.

The shim reads context, asks your existing gh installation for the selected token, and exposes it to one child process only.

  1. 01

    Read the repository

    Inspect origin, its host and owner, plus the absolute working directory.

  2. 02

    Resolve one rule

    Evaluate your TOML top to bottom. Every field in the first winning rule must match.

  3. 03

    Run in isolation

    Retrieve the token from gh and pass it only to the requested command.

02 / Explain first

See the decision before you trust it.

which never retrieves a token. It shows the exact input and winning rule, in plain text or JSON.

gh-account-autoswitch which
Host
github.com
Owner
acme-corp
Directory
~/src/work/payments
Matched
Acme work · rule 1

03 / Tiny surface

Four ways to describe where an identity belongs.

~/.config/gh-accounts.toml
# First complete match wins.
version = 1

[[rules]]
name = "Acme work"
account = "dev@acme.example"
host = "github.com"
owner = "^acme-corp$"

[[rules]]
name = "Personal"
account = "octocat"
directory = "~/src/personal/**"
host
Exact host, including your GHES domain.
owner
Regular expression for an organization or user.
remote
Regular expression for canonical host/owner/repo.
directory
Path glob with ~, *, and **.

04 / Get routed

Two commands.
No global switch.

Requires Go 1.22+ and an existing authenticated GitHub CLI. Generate your starter rules, review them, then keep working as usual.

Read the complete CLI reference
1 · Install go install github.com/B-Divyesh/sf-gh-account-autoswitch/cmd/gh-account-autoswitch@latest
2 · Create rules gh-account-autoswitch init

Safety, by construction

Nothing global to race. Nothing secret to sync.

No account switching

The shim never invokes gh auth switch. Your active account remains untouched.

No token storage

Tokens stay in the existing gh credential store and one child environment.

No silent fallback

No matching rule is exit code 3, not permission to use whatever account happens to be active.

Open source · MIT

Keep every identity
in its own lane.

Install gh-account-autoswitch