@@ -5,7 +5,6 @@ import type { SourceControlProviderKind } from "@t3tools/contracts";
 
 import * as AzureDevOpsCli from "../sourceControl/AzureDevOpsCli.ts";
 import * as BitbucketApi from "../sourceControl/BitbucketApi.ts";
-import * as GitHubCli from "../sourceControl/GitHubCli.ts";
 import * as GitHubGraphQlBudget from "../sourceControl/githubGraphQlBudget.ts";
 import * as GitLabCli from "../sourceControl/GitLabCli.ts";
 import * as ForgejoCli from "../sourceControl/ForgejoCli.ts";
@@ -58,12 +57,7 @@ export const make = Effect.map(
 );
 
 export const layer = Layer.effect(PullRequestProviderRegistry, make).pipe(
-  Layer.provide(
-    GitHubPullRequestCli.layer.pipe(
-      Layer.provide(GitHubCli.layer),
-      Layer.provide(GitHubGraphQlBudget.layer),
-    ),
-  ),
+  Layer.provide(GitHubPullRequestCli.layer.pipe(Layer.provide(GitHubGraphQlBudget.layer))),
   Layer.provide(GitLabPullRequestCli.layer.pipe(Layer.provide(GitLabCli.layer))),
   Layer.provide(ForgejoCli.layer),
   Layer.provide(BitbucketPullRequestApi.layer.pipe(Layer.provide(BitbucketApi.layer))),
 
@@ -61,6 +61,7 @@ import * as CheckpointStore from "./checkpointing/CheckpointStore.ts";
 import * as AzureDevOpsCli from "./sourceControl/AzureDevOpsCli.ts";
 import * as BitbucketApi from "./sourceControl/BitbucketApi.ts";
 import * as GitHubCli from "./sourceControl/GitHubCli.ts";
+import * as GitHubCliAccountSelection from "./sourceControl/GitHubCliAccountSelection.ts";
 import * as GitLabCli from "./sourceControl/GitLabCli.ts";
 import * as ForgejoCli from "./sourceControl/ForgejoCli.ts";
 import * as TextGeneration from "./textGeneration/TextGeneration.ts";
@@ -274,6 +275,11 @@ const ProviderLayerLive = ProviderServiceLive.pipe(
 
 const PersistenceLayerLive = Layer.empty.pipe(Layer.provideMerge(SqlitePersistenceLayerLive));
 
+// Every server-side GitHub command resolves its checkout's selected `gh` login through this one instance.
+const GitHubCliLayerLive = GitHubCli.layer.pipe(
+  Layer.provide(GitHubCliAccountSelection.layer.pipe(Layer.provide(ServerSettingsLayerLive))),
+);
+
 const VcsDriverRegistryLayerLive = VcsDriverRegistry.layer.pipe(
   Layer.provide(VcsProjectConfig.layer),
 );
@@ -283,7 +289,7 @@ const SourceControlProviderRegistryLayerLive = SourceControlProviderRegistry.lay
     Layer.mergeAll(
       AzureDevOpsCli.layer,
       BitbucketApi.layer,
-      GitHubCli.layer,
+      GitHubCliLayerLive,
       GitLabCli.layer,
       ForgejoCli.layer,
     ),
@@ -329,7 +335,7 @@ const RepositoryIdentityResolverLayerLive = Layer.effect(
 ).pipe(Layer.provide(SourceControlProviderRegistryLayerLive), Layer.provide(ProcessRunner.layer));
 
 const PullRequestServiceLive = PullRequestService.layer.pipe(
-  Layer.provide(PullRequestProviderRegistry.layer),
+  Layer.provide(PullRequestProviderRegistry.layer.pipe(Layer.provide(GitHubCliLayerLive))),
   // Where the viewed-file marks live for a host that keeps none of its own.
   Layer.provide(PullRequestFilesViewed.layer),
   Layer.provide(PullRequestReadCache.layer),
@@ -493,7 +499,11 @@ const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(
   // `GitHubCli` is the registry's own instance, exposed because the asset route fetches
   // GitHub-hosted pull request media with the repository's credential.
   Layer.provideMerge(
-    Layer.mergeAll(SourceControlProviderRegistryLayerLive, PullRequestServiceLive, GitHubCli.layer),
+    Layer.mergeAll(
+      SourceControlProviderRegistryLayerLive,
+      PullRequestServiceLive,
+      GitHubCliLayerLive,
+    ),
   ),
   Layer.provideMerge(GitLayerLive),
   Layer.provideMerge(VcsLayerLive),
 
@@ -358,6 +358,7 @@ const ATOMIC_SETTINGS_KEYS: ReadonlySet<string> = new Set([
   "sourceControlWriterModelSelection",
   "textGenerationModelSelection",
   "pullRequestMergeMethod",
+  "githubCliAccount",
 ]);
 
 // Preserve both enabled states because provider history cannot recover a new opt-in.
 
@@ -243,6 +243,92 @@ describe("GitHubCli.layer", () => {
     }).pipe(Effect.provide(layer)),
   );
 
+  it.effect("runs commands as the checkout's selected account without switching gh", () =>
+    Effect.gen(function* () {
+      const commands: Array<{ args: ReadonlyArray<string>; env: NodeJS.ProcessEnv | undefined }> =
+        [];
+      const gh = yield* GitHubCli.make.pipe(
+        Effect.provideService(GitHubCli.GitHubCliAccountSelection, {
+          forCwd: (cwd) =>
+            Effect.succeed(
+              cwd === "/work"
+                ? { host: "github.com", login: "work-login" }
+                : cwd === "/enterprise"
+                  ? { host: "github.example.test", login: "enterprise-login" }
+                  : null,
+            ),
+        }),
+        Effect.provideService(VcsProcess.VcsProcess, {
+          run: (input) =>
+            Effect.sync(() => {
+              commands.push({ args: input.args, env: input.env });
+              return input.args[0] === "auth"
+                ? processOutput(`token-for-${input.args[5]}\n`)
+                : processOutput("");
+            }),
+        }),
+      );
+      yield* gh.execute({ cwd: "/work", args: ["pr", "merge", "1"] });
+      yield* gh.execute({ cwd: "/work", args: ["pr", "close", "2"] });
+      yield* gh.execute({ cwd: "/enterprise", args: ["pr", "merge", "3"] });
+      yield* gh.execute({ cwd: "/personal", args: ["pr", "merge", "4"] });
+
+      expect(commands.map((command) => command.args.join(" "))).toEqual([
+        "auth token --hostname github.com --user work-login",
+        "pr merge 1",
+        "pr close 2",
+        "auth token --hostname github.example.test --user enterprise-login",
+        "pr merge 3",
+        "pr merge 4",
+      ]);
+      // The lookup ignores an ambient env token, which gh would print instead.
+      expect(commands[0]?.env).toMatchObject({ GH_TOKEN: "", GITHUB_TOKEN: "" });
+      expect(commands[1]?.env).toEqual({
+        GH_TOKEN: "token-for-work-login",
+        GITHUB_TOKEN: "token-for-work-login",
+      });
+      expect(commands[4]?.env).toEqual({
+        GH_ENTERPRISE_TOKEN: "token-for-enterprise-login",
+        GITHUB_ENTERPRISE_TOKEN: "token-for-enterprise-login",
+      });
+      expect(commands[5]?.env).toBeUndefined();
+    }).pipe(Effect.provide(Layer.merge(GitHubGraphQlBudget.layer, SourceControlRateLimit.layer))),
+  );
+
+  it.effect("fails instead of falling back when the selected account is signed out", () =>
+    Effect.gen(function* () {
+      const commands: string[] = [];
+      const gh = yield* GitHubCli.make.pipe(
+        Effect.provideService(GitHubCli.GitHubCliAccountSelection, {
+          forCwd: () => Effect.succeed({ host: "github.com", login: "gone" }),
+        }),
+        Effect.provideService(VcsProcess.VcsProcess, {
+          run: (input) => {
+            commands.push(input.args.join(" "));
+            return input.args[0] === "auth"
+              ? Effect.fail(
+                  new VcsProcessExitError({
+                    operation: "GitHubCli.accountToken",
+                    command: "gh",
+                    cwd: "/work",
+                    exitCode: 1,
+                    failureKind: "authentication",
+                    detail: "no oauth token found for github.com account gone",
+                  }),
+                )
+              : Effect.succeed(processOutput(""));
+          },
+        }),
+      );
+      const failure = yield* gh
+        .execute({ cwd: "/work", args: ["pr", "merge", "1"] })
+        .pipe(Effect.flip);
+      expect(failure._tag).toBe("GitHubCliAccountUnavailableError");
+      expect(failure.detail).toContain("gone on github.com");
+      expect(commands).toEqual(["auth token --hostname github.com --user gone"]);
+    }).pipe(Effect.provide(Layer.merge(GitHubGraphQlBudget.layer, SourceControlRateLimit.layer))),
+  );
+
   it("does not classify a missing cwd as an unavailable gh executable", () => {
     const context = { command: "gh", cwd: "/repo" } as const;
     const missingCwd = new VcsProcessSpawnError({
 
@@ -13,6 +13,7 @@ import * as Schema from "effect/Schema";
 
 import {
   TrimmedNonEmptyString,
+  type GitHubCliAccount,
   type SourceControlRepositoryVisibility,
   type VcsError,
 } from "@t3tools/contracts";
@@ -35,6 +36,24 @@ export const PinnedGitHubCredential = Context.Reference<{
   readonly credentialFingerprint: string;
 } | null>("t3/sourceControl/PinnedGitHubCredential", { defaultValue: () => null });
 
+/**
+ * The `gh` login a command's checkout is set to use, or null for the CLI's
+ * active login. Read once when the service is built; the server provides it
+ * from settings (see `GitHubCliAccountSelection.ts`).
+ */
+export class GitHubCliAccountSelection extends Context.Reference<{
+  readonly forCwd: (cwd: string) => Effect.Effect<GitHubCliAccount | null>;
+}>("t3/sourceControl/GitHubCliAccountSelection", {
+  defaultValue: () => ({ forCwd: () => Effect.succeed(null) }),
+}) {}
+
+/** gh reads github.com and GHE.com tenancies from GH_TOKEN, every other host from GH_ENTERPRISE_TOKEN. */
+function tokenEnv(host: string, token: string): NodeJS.ProcessEnv {
+  return host === "github.com" || host.endsWith(".ghe.com")
+    ? { GH_TOKEN: token, GITHUB_TOKEN: token }
+    : { GH_ENTERPRISE_TOKEN: token, GITHUB_ENTERPRISE_TOKEN: token };
+}
+
 export const AllowGitHubReserve = Context.Reference<boolean>(
   "t3/sourceControl/AllowGitHubReserve",
   { defaultValue: () => false },
@@ -117,6 +136,19 @@ export class GitHubCliRateLimitError extends Schema.TaggedError<GitHubCliRateLim
   }
 }
 
+export class GitHubCliAccountUnavailableError extends Schema.TaggedError<GitHubCliAccountUnavailableError>()(
+  "GitHubCliAccountUnavailableError",
+  { ...gitHubCliFailureFields, host: Schema.String, login: Schema.String },
+) {
+  get detail(): string {
+    return `GitHub CLI account ${this.login} on ${this.host} is not signed in. Run \`gh auth login\` for it or choose another account in Source Control settings.`;
+  }
+
+  override get message(): string {
+    return `GitHub CLI failed in execute: ${this.detail}`;
+  }
+}
+
 export class GitHubPullRequestNotFoundError extends Schema.TaggedError<GitHubPullRequestNotFoundError>()(
   "GitHubPullRequestNotFoundError",
   gitHubCliFailureFields,
@@ -204,6 +236,7 @@ export class GitHubRepositoryDecodeError extends Schema.TaggedError<GitHubReposi
 export const GitHubCliError = Schema.Union([
   GitHubCliUnavailableError,
   GitHubCliAuthenticationError,
+  GitHubCliAccountUnavailableError,
   GitHubCliRateLimitError,
   GitHubPullRequestNotFoundError,
   GitHubCliCommandError,
@@ -399,6 +432,34 @@ export const make = Effect.gen(function* () {
   const process = yield* VcsProcess.VcsProcess;
   const budget = yield* GitHubGraphQlBudget.GitHubGraphQlBudget;
   const limits = yield* SourceControlRateLimit.SourceControlRateLimit;
+  const accountSelection = yield* GitHubCliAccountSelection;
+
+  // `gh auth token --user` reads one login's token from the CLI's store without
+  // switching the active login. Blank env tokens so an ambient GH_TOKEN cannot answer for it.
+  const accountTokens = yield* Cache.makeWith(
+    (key: string) => {
+      const [host = "", login = ""] = key.split("\0");
+      return process
+        .run({
+          operation: "GitHubCli.accountToken",
+          command: "gh",
+          args: ["auth", "token", "--hostname", host, "--user", login],
+          cwd: globalThis.process.cwd(),
+          timeoutMs: DEFAULT_TIMEOUT_MS,
+          env: { ...tokenEnv(host, ""), GH_DEBUG: "" },
+        })
+        .pipe(
+          Effect.map((result) => result.stdout.trim()),
+          Effect.flatMap((token) =>
+            token ? Effect.succeed(Redacted.make(token)) : Effect.fail(null),
+          ),
+        );
+    },
+    {
+      capacity: 16,
+      timeToLive: (exit) => (Exit.isSuccess(exit) ? Duration.minutes(1) : Duration.zero),
+    },
+  );
 
   const executeRaw: GitHubCli["Service"]["execute"] = Effect.fn("GitHubCli.executeRaw")(
     function* (input) {
@@ -411,9 +472,33 @@ export const make = Effect.gen(function* () {
         });
       }
       const token = credential === null ? undefined : Redacted.value(credential.token);
+      // A pinned credential already names its account; otherwise use the checkout's selection.
+      // A selected login that cannot be read fails the command rather than running as another.
+      const account = credential === null ? yield* accountSelection.forCwd(input.cwd) : null;
+      const accountToken =
+        account === null
+          ? null
+          : yield* Cache.get(accountTokens, `${account.host.toLowerCase()}\0${account.login}`).pipe(
+              // Only the token is kept. Never attach credential lookup output to an error.
+              Effect.mapError(
+                () =>
+                  new GitHubCliAccountUnavailableError({
+                    command: "gh",
+                    cwd: input.cwd,
+                    host: account.host,
+                    login: account.login,
+                    cause: new Error("`gh auth token --user` did not return a token."),
+                  }),
+              ),
+            );
       const env =
         credential === null
-          ? input.env
+          ? account === null || accountToken === null
+            ? input.env
+            : {
+                ...tokenEnv(account.host.toLowerCase(), Redacted.value(accountToken)),
+                ...input.env,
+              }
           : {
               ...input.env,
               GH_HOST: credential.host,