Route git-https to the right GitHub account per org path

bin/executable_git-credential-gh-user

@@ -0,0 +1,19 @@
+#!/bin/sh
+# git credential helper: serve the gh-keyring token for the username git
+# asks for (pinned per URL via credential.<url>.username in gitconfig),
+# regardless of which gh account is currently active. gh's own helper only
+# answers for the active account, which is why this exists. Declines
+# silently — no username pinned, gh missing, or account not logged in —
+# so the next helper in the chain can answer.
+[ "$1" = get ] || exit 0
+
+user=
+while IFS='=' read -r key value; do
+  [ "$key" = username ] && user=$value
+done
+
+[ -n "$user" ] || exit 0
+command -v gh >/dev/null 2>&1 || exit 0
+token=$(gh auth token --user "$user" 2>/dev/null) || exit 0
+[ -n "$token" ] || exit 0
+printf 'username=%s\npassword=%s\n' "$user" "$token"

dot_gitconfig.local.tmpl

@@ -25,6 +25,26 @@
 	path = ~/.gitconfig-ica
 [commit]
 	gpgsign = true
+
+# Route git-over-HTTPS to the right GitHub account (the gh() wrapper in
+# ~/.functions, but for plain git). The Xcode CLT system gitconfig
+# hardwires osxkeychain, which answers with whichever account last cached
+# a credential — background tooling (e.g. Claude Code's plugin marketplace
+# updater) then clones private work repos as the wrong user and gets
+# "repository not found". Reset the helper list: git-credential-gh-user
+# (~/bin) serves the pinned account's token straight from gh's keyring,
+# and gh's own helper covers unpinned URLs with the active account.
+[credential "https://github.com"]
+	helper =
+	helper = !$HOME/bin/git-credential-gh-user
+	helper = !gh auth git-credential
+	useHttpPath = true
+[credential "https://github.com/icanalytica"]
+	username = icaevan
+[credential "https://github.com/icarichie"]
+	username = icaevan
+[credential "https://github.com/hadees"]
+	username = hadees
 {{- end }}
 {{- if eq .machineClass "wsl" }}
 [core]