gh-auth-isolation

name	gh-auth-isolation
description	Prevent multiple Squad/Ralph instances from fighting over global gh auth state when running across repos with different GitHub accounts (personal vs EMU/enterprise).

GitHub Auth Isolation for Multi-Repo Squad

Problem

When multiple Ralphs run across repos (e.g., personal repos on one account + work repos on another), they fight over the global gh auth switch state. Each Ralph switches to its required account, causing the others to fail on the next round.

Symptoms:

• Consecutive Ralph failures (exit code 1) across repos
• gh api user returns wrong account intermittently
• Failures are timing-dependent — works when only one Ralph runs

Root Cause

gh auth switch --user X mutates GLOBAL state in the gh CLI keyring. All processes on the machine share this state. When process A switches to account X and process B switches to account Y, process A's next API call uses account Y.

Solution: Per-Process GH_TOKEN

Instead of switching global auth, extract the token for the required account and set it as a process-local environment variable:

# Detect required account from git remote
$remoteUrl = git remote get-url origin
$requiredAccount = if ($remoteUrl -match "your_org") { "your_work_account" } else { "your_personal_account" }

# Get token without switching global state
$token = gh auth token --user $requiredAccount
$env:GH_TOKEN = $token.Trim()

# All subsequent gh commands in THIS process use the correct account
# Other processes are unaffected

Integration with ralph-watch.ps1

Add this at the start of each Ralph round (before any gh commands):

try {
    $remoteUrl = & git remote get-url origin 2>&1 | Out-String
    $requiredAccount = if ($remoteUrl -match "your_org") { "your_work_account" } else { "your_personal_account" }
    $token = & gh auth token --user $requiredAccount 2>&1 | Out-String
    $token = $token.Trim()
    if ($token -and $token.StartsWith("gho_")) {
        $env:GH_TOKEN = $token
    } else {
        # Fallback to global switch (single-Ralph scenarios)
        & gh auth switch --user $requiredAccount 2>&1 | Out-Null
    }
} catch {
    Write-Warning "gh auth isolation failed: $_"
}

When to Use

• Multiple Ralph instances across repos with different GitHub accounts
• CI/CD environments where multiple gh-authenticated processes run concurrently
• DevBox/Cloud PC setups where personal and work repos coexist

Key Insight

This is a classic distributed systems problem — shared mutable state (global auth) accessed by concurrent processes. The fix is the same as any concurrent programming fix: eliminate shared mutable state by making it process-local.