# Repository-scoped GitHub accounts: verification

Rebuilt from @rookmate’s [#20337](https://github.com/pingdotgg/t3code/pull/20337) as [#21581](https://github.com/pingdotgg/t3code/pull/21581) (credentials), [#21582](https://github.com/pingdotgg/t3code/pull/21582) (settings and client media), and [#21583](https://github.com/pingdotgg/t3code/pull/21583) (agent sessions). Base: [1451e7cb23](https://github.com/pingdotgg/t3code/commit/1451e7cb23034d29774338608368a15d8845df36). Integrated head: [8d2c44a330](https://github.com/pingdotgg/t3code/commit/8d2c44a330817a4998bcdefec97ca6ebb5054ddd).

## Running-server proof

An isolated server used three local Git repositories and synthetic personal/work GitHub logins. Browser-session HTTP authentication, WebSocket RPC, signed asset issuance, and HTTP asset delivery were real server paths. GitHub requests and gh account/token discovery were fixture-backed. No live credentials or customer data were used.

Before account rules, northwind/docs and personal/blog were visible as personal. After northwind → work with northwind/docs → personal, northwind/app appeared as work and the other two stayed personal. Authored and Reviewing each returned all three. Save and clear both persisted through settings rereads. This probe explicitly invalidated PR caches; focused service tests separately cover automatic settings invalidation.

For a media request from the personal northwind/docs workspace, a synthetic work-only PNG returned 404 without an explicit repository. Passing northwind/app in the signed resource selected work and returned HTTP 200, image/png, and the exact 68-byte PNG. Fourteen assertions passed on the integrated head above. This proves server credential propagation; it does not establish GitHub’s external private-attachment authorization or rendered UI correctness.

[Raw synthetic API and media proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/79343bc459431be6/20337-api-proof-v7-public.json).

## Tests and checks

PR-added named cases: 20 in 8 files → 15 in 8 existing files, excluding moved existing cases and extensions to base tests. Duplicate per-adapter/helper assertions were removed. The retained cases cover account isolation, bounded lookups, settings, and actual session/query behavior. A later count audit corrected the earlier 12-in-7 report: the head then had 14 in 7, including three existing githubAccounts cases; the final deadline regression adds one case in an eighth existing file.

The initial test stage found empty-search account visibility reuse and unbounded credential lookups; both were corrected. Negative controls failed with the old credential routing and with the Claude environment-sensitive reuse key removed, then passed when restored.

The final test continuation produced 46 passing cases and two expected failures: a signed media resource lost its repository and sent the workspace bearer, and agent sessions ignored gh default/GH_REPO. After the fixes, all 48 cases in AssetAccess and RuntimePolicy pass. Tests use the actual schema, signed capabilities, HTTP media fetch, runtime policy, and repository resolution; only external processes/account/HTTP boundaries are stubbed.

Final scoped checks passed for contracts, GitHub, server, web, and mobile, with changed-file lint and formatting. Additional focused suites passed: GitHub provider/credentials; selection/project identity; session manager, turn start, and rollback; existing project/thread fixtures; and client media/markdown logic. Affected web and mobile React Compiler targets passed. These runs overlap; their counts are not added together.

Earlier implementation stages also passed 729 GitHub/service/settings cases in 13 suites, 451 adapter/session cases in 9 suites, and 52 runtime cases in 3 suites. CI follow-up fixes passed the affected credentials, compiler, mobile settings, ACP terminal, and provider package checks. An unrelated Claude foreground-subagent timeout occurred before rebuilding and a similar existing case timed out in published CI; its focused rerun passed once. No source or timeout change hides that flake. No repository-wide check was run.

The latest link-deadline regression failed before the fix because credential selection remained blocked after three seconds. After moving the existing timeout around the complete lookup, all 44 provider and 9 credential tests passed, including typed error, zero REST attempts, and cancellation cleanup. The settings-row ID now includes destination environment and project; scoped GitHub/web types, changed-file lint/format, and the existing focused React Compiler check passed. No implementation tests were added or weakened.

The last published CI retry passed the lower two layers; the top failed inside Playwright with `route.fulfill: Route is already handled!`. A focused actual headless Chromium run of the two previously failing browser suites passed all 11 tests. Those are test-suite results, not integrated visual proof of the new controls. Fresh published-head CI is still required.

## Reviews

Independent whole-stack reviews use Claude Opus 5.5 and GPT-6 Sol in fresh runs. Round 1 found git/token work during orchestrator dispatch and documentation scope gaps; these were fixed, and round 2 was clear. Published CI/bots then exposed inherited owner-property lookup, unsupported compiler try/finally, an Expo test import, a provider-core diagnostic, and missing ACP terminal overrides; these were corrected with focused evidence. Round 3 found discovery’s unknown state being treated as no accounts; controls now wait for successful discovery while a successful empty result still permits stale-rule clearing. Round 4 found differing effective GitHub repository selection and cross-repository PR media scope; both were fixed and the new regressions pass. Round 5 found no source blockers in either review. Opus found no new confirmed bug. Sol suggested adding arbitrary repository-rule entry for repositories without a project; this extends the original project-based settings model and was declined as outside scope. The limitation and the add-a-project workflow are disclosed below. CodeRabbit subsequently found that account selection could exceed the link-enrichment deadline and that project account rows shared a search/DOM ID across destinations. Both were fixed with the focused evidence above. Round 6 found no confirmed source findings in either independent whole-stack review. Opus verified that the moved deadline covers credential cancellation without caching interruptions, while read/decode mappings remain intact; the existing title-enrichment caller already had its own deadline. The row ID follows the actual environment/project target tuple. The parent recaptured all fourteen running-server assertions on the final integrated head after the review brief was issued; no source changes followed.

## Limits and human follow-up

Browser automation failed with “Preview automation snapshot timed out after 15000ms.” and “Preview automation navigate timed out after 15000ms.” No screenshot or visual verification was obtained. The user authorized API/test proof as a fallback. Verify host, owner, and project account controls, unavailable-rule clearing, PR attribution, media, and account changes with two real accounts on the web/desktop and native mobile clients.

Repository overrides are created from a project’s Source control settings. For a linked repository that needs its own account rule, add that repository as a project first; host and owner defaults otherwise apply. Arbitrary repository-rule entry is outside this change.

Live GitHub/GHE/GHES, macOS/Windows, iOS/Android, Electron shell, and external provider processes were not exercised. GitHub media support remains limited to github.com; enterprise credentials are not forwarded to those media hosts. Update the server and all clients together: older clients can erase rules and older servers ignore them. Git transport retains its own authentication. Saved/environment tokens keep their precedence and suppress selected-login agent overrides. Codex already-loaded-thread environment adoption remains unproven; restart sessions as documented. Cursor/OpenCode shared and external processes keep their documented credentials.

GH_TOKEN selects the agent process account for GitHub.com and GHE.com commands. It is not host confinement; self-hosted GHES tokens stay in gh’s host-specific store. Macroscope declined automatic approval because this authentication-sensitive scope needs human review. Published-head CI and review follow-up are separate gates; nothing has been merged.

Model/harness: GPT-6.1 Sol, Codex in T3 Code; tests by GPT-6 Astra; independent review by Claude Opus 5.5 and GPT-6 Sol.