feat(github): use the right account for each repository

[DominicVonk]

What Changed

• Discover every signed-in GitHub account from gh auth status --json hosts.
• Let users select a default account per GitHub host and override it for individual repository owners.
• Apply the selected account consistently to source-control actions and Pull Requests.
• Support the same routing for GitHub.com and configured GitHub Enterprise hosts without storing tokens in T3 Code.

Why

T3 Code previously used whichever GitHub CLI account happened to be active. Users signed into personal, work, or GitHub Enterprise accounts could therefore access a repository with the wrong identity unless they switched accounts outside T3 Code.

Routing by host and repository owner matches how users separate those accounts while keeping GitHub CLI as the token authority.

UI Changes

Previously, the GitHub provider settings did not expose account selection. The updated UI shows each host's default account and lets users add repository-owner overrides.

Before	After

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Created with GPT-5.6 Sol in T3 Code.

---

Note

High Risk
Changes GitHub authentication and credential selection for all CLI/PR operations, including token injection and how viewers/batches are resolved across repositories.

Overview
Lets users pick which signed-in GitHub account T3 Code uses per host, with optional overrides by repository owner, instead of always using the active gh account.

Adds githubAccountRouting settings and a Source Control settings UI to choose defaults and owner overrides. Credentials stay with GitHub CLI / env vars; T3 Code only stores login + token source.

GitHubCli now resolves a credential route for each call and injects GH_TOKEN / GH_ENTERPRISE_TOKEN accordingly. Pull request listing and viewer resolution batch by that route so repos on the same host with different accounts stay separate, and involvement filtering can use per-repository viewers.

^{Reviewed by Cursor Bugbot for commit 7620cb2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Route GitHub CLI calls using the correct account per repository

• Adds GitHubAccountRouting settings (default account per host, per-owner overrides) persisted in ServerSettings and editable via a new settings UI in GitHubAccountSettings.tsx.
• Introduces credential routing in GitHubCli.ts: selects a token from the environment or gh keyring based on the chosen account, then injects GH_TOKEN/GH_ENTERPRISE_TOKEN for every CLI/GraphQL call.
• All GitHub CLI operations in GitHubPullRequestCli.ts now receive explicit host and repositories scoping so the right token is used per request.
• Viewer resolution and PR listing in PullRequestService.ts now operate per provider batch key (which maps to a credential route) rather than per host, so repositories on the same host but different accounts are handled independently.
• Risk: getViewerLogin, getBatchKey, and execute interfaces are extended with required host/repository parameters, which is a breaking change for any callers of GitHubPullRequestCli or GitHubCli outside this PR.

^{Macroscope summarized 7620cb2.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: eca03658-eba4-438a-8d8d-4bbf6e109c6b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Two findings in apps/server/src/sourceControl/GitHubCli.ts: new validation failures fabricate an Error only to satisfy the required cause field, and the real reason never reaches the error's structural attributes or message.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Effect service conventions review of the changed server/contracts/web TypeScript. The GitHub account-selection code in apps/server/src/sourceControl/GitHubCli.ts carries new failure modes in synthetic new Error(...) causes attached to pre-existing generic error tags, which the conventions disallow. One test-only namespace/deprecation note is included as well.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One error-modelling finding in apps/server/src/sourceControl/GitHubCli.ts: the new gh auth token subprocess failure is collapsed onto GitHubCliAuthenticationError instead of the file's reusable fromVcsError classifier.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a substantial new feature for multi-account GitHub support with per-owner credential routing. It adds ~1600 lines including new credential selection logic, settings schemas, and UI components, and involves security-sensitive token handling from environment variables and the GitHub CLI keyring. The scope and authentication implications warrant human review.

No code changes detected at 72e6b4e. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention finding: the new local service dependency is imported by name rather than through its module namespace. Everything else in the account-selection work (dedicated tagged errors with structural fields and no invented causes, yield*-based dependency acquisition in make, subpath namespace imports for effect/*, no new Layer.succeed/ManagedRuntime/runPromise) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One convention finding on the new GitHub credential failure model in apps/server/src/sourceControl/GitHubCli.ts. Everything else in the changed Effect service scope (namespace imports, ServerSettings acquisition via the environment, make/layer shape, the pure GitHubCredentials routing helper, and the new tests) looks consistent with the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f84749e. Configure here.}

[t3-code]

thanks for the contribution! closing this at the request of @StiensWout because it currently has merge conflicts. if you think closing this was a mistake, please feel free to reopen it.