diff --git a/Agent.md b/Agent.md
index 4ab533c..d82b002 100644
--- a/Agent.md
+++ b/Agent.md
@@ -93,7 +93,7 @@ Community needs voiced in HN agent-UI discussions map directly to EMRG's design:
 pkill -f "emrg.server"; rm -f ~/.emrg/emrgd.port; python -m emrg
 ```
 
-Python: `uv run pytest tests/ -v` (534) — import check: `uv run python -c "from emrg.client.app import run_client"`
+Python: `uv run pytest tests/ -v` (542) — import check: `uv run python -c "from emrg.client.app import run_client"`
 GUI: `cd emrg/gui && npm test` (91: 22 daemon_client + 22 app-commands + 22 renderer smoke + 15 i18n + 7 integration + 3 commands) — syntax: `node --check main.js preload.js daemon_client.js renderer/js/*.js`
 CI: `uv run pytest` + GUI tests + **actionlint workflow lint** (`rhysd/actionlint@v1.7.12` gate, #444 — workflow 解析错误在 PR CI 即失败，如 `if:` secrets 上下文)
 Re-trigger: `scripts/re-trigger-ci.sh [branch]` (workflow_dispatch, #527 — 替代空 commit 重触发：Actions outage 会整段丢弃 push 事件，dispatch 走 API 路径不受影响)
diff --git a/README.cn.md b/README.cn.md
index 9cdda4c..39828c6 100644
--- a/README.cn.md
+++ b/README.cn.md
@@ -274,7 +274,7 @@ EMRG 不只是追赶——它自己追上来。
 git clone https://github.com/argszero/emrg.git
 cd emrg
 uv sync              # 安装依赖
-uv run pytest tests/ -v   # 跑测试（当前 534 项）
+uv run pytest tests/ -v   # 跑测试（当前 542 项）
 uv run python -m emrg     # 启动 TUI
 # CI 含 actionlint workflow 门禁（#444）：workflow 解析错误在 PR 即失败
 
diff --git a/README.md b/README.md
index eefb54f..6d8fe2c 100644
--- a/README.md
+++ b/README.md
@@ -273,7 +273,7 @@ EMRG doesn't just keep up — it catches up on its own.
 git clone https://github.com/argszero/emrg.git
 cd emrg
 uv sync              # install deps
-uv run pytest tests/ -v   # run tests (currently 534 items)
+uv run pytest tests/ -v   # run tests (currently 542 items)
 uv run python -m emrg     # launch TUI
 # CI includes actionlint workflow gate (#444): workflow parse errors fail PR CI
 
diff --git a/emrg/gui/daemon_client.js b/emrg/gui/daemon_client.js
index 76a4849..dd27983 100644
--- a/emrg/gui/daemon_client.js
+++ b/emrg/gui/daemon_client.js
@@ -45,6 +45,8 @@ const RESPONSE_TYPES = {
   rewind_session: "rewind_result", // 补缺：daemon.py:955 rewind_result
   read_memory: "memory_content", // 补缺：daemon.py:771/778 memory_content
   evolution_summary: "evolution_summary", // WorkBuddy P3：自进化可见化
+  github_connect: "github_connect_result", // Windows GCM rant Stage 2：PAT 授权（daemon.py github_connect）
+  github_disconnect: "github_disconnect_result", // Windows GCM rant Stage 2：断开（daemon.py github_disconnect）
 };
 
 class DaemonClient {
diff --git a/emrg/gui/main.js b/emrg/gui/main.js
index 0b20c7e..06404e5 100644
--- a/emrg/gui/main.js
+++ b/emrg/gui/main.js
@@ -442,6 +442,24 @@ vision = false
       return { count: frame.count ?? 0, recent: frame.recent || [] };
     });
 
+    ipcMain.handle("emrg:githubStatus", async () => {
+      // Windows GCM rant Stage 2：设置页 GitHub 连接状态（daemon github_status）
+      const frame = await client.sendCommandAndWait("github_status", {}, 10000);
+      return { authenticated: Boolean(frame.authenticated), user: frame.user || null };
+    });
+
+    ipcMain.handle("emrg:githubConnect", async (_e, { token }) => {
+      // Windows GCM rant Stage 2：PAT 授权 + setup-git（daemon github_connect）
+      const frame = await client.sendCommandAndWait("github_connect", { token: String(token || "").trim() }, 40000);
+      return { ok: Boolean(frame.ok), user: frame.user || null, error: frame.error || null };
+    });
+
+    ipcMain.handle("emrg:githubDisconnect", async () => {
+      // Windows GCM rant Stage 2：断开 GitHub（daemon github_disconnect）
+      const frame = await client.sendCommandAndWait("github_disconnect", {}, 40000);
+      return { ok: Boolean(frame.ok), error: frame.error || null };
+    });
+
     ipcMain.handle("emrg:setModel", async (_e, { model }) => {
       await client.sendCommandAndWait("set_model", { model }, 5000);
       return { ok: true };
diff --git a/emrg/gui/preload.js b/emrg/gui/preload.js
index 197b2be..945225e 100644
--- a/emrg/gui/preload.js
+++ b/emrg/gui/preload.js
@@ -27,6 +27,9 @@ const api = {
   triggerTask: (payload) => ipcRenderer.invoke("emrg:triggerTask", payload),
   sendRant: (payload) => ipcRenderer.invoke("emrg:sendRant", payload),
   evolutionSummary: (payload) => ipcRenderer.invoke("emrg:evolutionSummary", payload),
+  githubStatus: () => ipcRenderer.invoke("emrg:githubStatus"),
+  githubConnect: (payload) => ipcRenderer.invoke("emrg:githubConnect", payload),
+  githubDisconnect: () => ipcRenderer.invoke("emrg:githubDisconnect"),
   listModels: () => ipcRenderer.invoke("emrg:listModels"),
   openFile: (payload) => ipcRenderer.invoke("emrg:openFile", payload),
   saveSettings: (payload) => ipcRenderer.invoke("emrg:saveSettings", payload),
diff --git a/emrg/gui/renderer/index.html b/emrg/gui/renderer/index.html
index 9715252..166739e 100644
--- a/emrg/gui/renderer/index.html
+++ b/emrg/gui/renderer/index.html
@@ -123,6 +123,16 @@ <h2 data-i18n="settings.title">设置</h2>
           </div>
         </label>
       </div>
+      <div class="settings-group">
+        <div class="settings-group-title" data-i18n="settings.groupGithub">GitHub 连接</div>
+        <div id="github-status" class="hint" style="margin-bottom:6px;">—</div>
+        <div id="github-auth-row" style="display:flex;gap:8px;">
+          <input type="password" id="set-github-token" placeholder="GitHub Personal Access Token" style="flex:1;min-width:0;" data-i18n-placeholder="settings.githubTokenPlaceholder" />
+          <button type="button" id="github-connect-btn" class="btn btn-primary" data-i18n="settings.githubConnect">连接</button>
+          <button type="button" id="github-disconnect-btn" class="btn btn-ghost hidden" data-i18n="settings.githubDisconnect">断开</button>
+        </div>
+        <div class="hint" style="margin-top:6px;" data-i18n="settings.githubHint">用于自进化推送 PR；授权后自动执行 gh auth setup-git，git 操作不再弹 GCM</div>
+      </div>
       <div class="settings-group">
         <div class="settings-group-title" data-i18n="settings.groupAppearance">外观</div>
         <label><span data-i18n="settings.theme">主题</span>
diff --git a/emrg/gui/renderer/js/app.js b/emrg/gui/renderer/js/app.js
index 73de2d6..dd40c6f 100644
--- a/emrg/gui/renderer/js/app.js
+++ b/emrg/gui/renderer/js/app.js
@@ -1184,6 +1184,7 @@ const App = (() => {
     Dialogs.initThemeButtons();
     Dialogs.initModelForm();
     Dialogs.initRenameDialog();
+    Dialogs.initGithubSection(); // Windows GCM rant Stage 2：设置页 GitHub 连接
     initModelSwitcher();
     initModeSwitcher(); // WorkBuddy P2：Ask/Auto 工作模式
     ResultPanel.init(); // WorkBuddy P1：结果面板（⌘\ 折叠 + 窄屏自动隐藏）
diff --git a/emrg/gui/renderer/js/dialogs.js b/emrg/gui/renderer/js/dialogs.js
index f5a040f..23534f3 100644
--- a/emrg/gui/renderer/js/dialogs.js
+++ b/emrg/gui/renderer/js/dialogs.js
@@ -230,6 +230,8 @@ const Dialogs = (() => {
         const evo = $("about-evolutions");
         if (evo) evo.textContent = `🌱 ${_t("copy.growthCountPrefix")} ${App.state.evolutionCount ?? 0} ${_t("copy.times")}`;
       } catch { /* 元素缺失（测试桩）时忽略 */ }
+      // Windows GCM rant Stage 2：GitHub 连接状态随设置面板打开时刷新
+      await refreshGithubStatus();
     } catch (e) {
       Chat.addSystemMessage(_t("settings.readFailed", { msg: e.message }));
     }
@@ -357,6 +359,67 @@ const Dialogs = (() => {
     });
   }
 
+  // ── GitHub 连接（Windows GCM rant Stage 2：设置页 PAT 授权） ────
+  function initGithubSection() {
+    $("github-connect-btn").addEventListener("click", async () => {
+      const token = $("set-github-token").value.trim();
+      if (!token) {
+        Chat.addSystemMessage(_t("settings.githubTokenEmpty"));
+        return;
+      }
+      $("github-connect-btn").disabled = true;
+      $("github-connect-btn").textContent = _t("settings.githubConnecting");
+      try {
+        const res = await window.emrg.githubConnect({ token });
+        if (res && res.ok) {
+          $("set-github-token").value = "";
+          Chat.addSystemMessage(_t("settings.githubConnected", { user: res.user || "" }));
+          await refreshGithubStatus();
+        } else {
+          Chat.addSystemMessage(_t("settings.githubConnectFailed", { msg: (res && res.error) || _t("app.unknownError") }));
+        }
+      } catch (e) {
+        Chat.addSystemMessage(_t("settings.githubConnectFailed", { msg: e.message }));
+      } finally {
+        $("github-connect-btn").disabled = false;
+        $("github-connect-btn").textContent = _t("settings.githubConnect");
+      }
+    });
+    $("github-disconnect-btn").addEventListener("click", async () => {
+      try {
+        const res = await window.emrg.githubDisconnect();
+        if (res && res.ok) {
+          Chat.addSystemMessage(_t("settings.githubDisconnected"));
+          await refreshGithubStatus();
+        } else {
+          Chat.addSystemMessage(_t("settings.githubDisconnectFailed", { msg: (res && res.error) || _t("app.unknownError") }));
+        }
+      } catch (e) {
+        Chat.addSystemMessage(_t("settings.githubDisconnectFailed", { msg: e.message }));
+      }
+    });
+  }
+
+  async function refreshGithubStatus() {
+    const statusEl = $("github-status");
+    const authRow = $("github-auth-row");
+    if (!statusEl || !authRow) return; // 元素缺失（测试桩）时忽略
+    statusEl.textContent = _t("settings.githubChecking");
+    try {
+      const s = await window.emrg.githubStatus();
+      const connected = Boolean(s && s.authenticated);
+      const user = (s && s.user) || "";
+      statusEl.textContent = connected
+        ? _t("settings.githubConnectedStatus", { user })
+        : _t("settings.githubNotConnected");
+      $("github-disconnect-btn").classList.toggle("hidden", !connected);
+      $("set-github-token").classList.toggle("hidden", connected);
+      $("github-connect-btn").classList.toggle("hidden", connected);
+    } catch {
+      statusEl.textContent = _t("settings.githubStatusFailed");
+    }
+  }
+
   // ── 确认对话框（替代 confirm/alert） ────
   let confirmCb = null;
   function showConfirm(title, message, opts = {}) {
@@ -388,6 +451,8 @@ const Dialogs = (() => {
     renderLangOptions,
     initModelForm,
     initRenameDialog,
+    initGithubSection,
+    refreshGithubStatus,
     showRename,
     submitRename,
     showSettings,
diff --git a/emrg/gui/renderer/js/i18n.js b/emrg/gui/renderer/js/i18n.js
index 9f0e7dc..b2281e1 100644
--- a/emrg/gui/renderer/js/i18n.js
+++ b/emrg/gui/renderer/js/i18n.js
@@ -79,6 +79,22 @@ const I18N = (() => {
       "settings.save": "保存",
       "settings.readFailed": "读取设置失败了：{msg}",
       "settings.saveFailed": "保存失败了：{msg}",
+      // Windows GCM rant Stage 2：GitHub 连接
+      "settings.groupGithub": "GitHub 连接",
+      "settings.githubTokenPlaceholder": "GitHub Personal Access Token",
+      "settings.githubConnect": "连接",
+      "settings.githubDisconnect": "断开",
+      "settings.githubHint": "用于自进化推送 PR；授权后自动执行 gh auth setup-git，git 操作不再弹 GCM",
+      "settings.githubChecking": "检查中…",
+      "settings.githubConnectedStatus": "已连接 @{user}",
+      "settings.githubNotConnected": "未连接",
+      "settings.githubStatusFailed": "状态获取失败",
+      "settings.githubTokenEmpty": "请先粘贴 GitHub Personal Access Token",
+      "settings.githubConnecting": "连接中…",
+      "settings.githubConnected": "已连接 GitHub：@{user}（gh auth setup-git 已执行）",
+      "settings.githubConnectFailed": "GitHub 连接失败：{msg}",
+      "settings.githubDisconnected": "已断开 GitHub 连接",
+      "settings.githubDisconnectFailed": "断开失败：{msg}",
 
       // 首启引导
       "welcome.title": "欢迎使用 EMRG",
@@ -342,6 +358,22 @@ const I18N = (() => {
       "settings.save": "Save",
       "settings.readFailed": "Failed to read settings: {msg}",
       "settings.saveFailed": "Failed to save settings: {msg}",
+      // Windows GCM rant Stage 2: GitHub connection
+      "settings.groupGithub": "GitHub connection",
+      "settings.githubTokenPlaceholder": "GitHub Personal Access Token",
+      "settings.githubConnect": "Connect",
+      "settings.githubDisconnect": "Disconnect",
+      "settings.githubHint": "Used for self-evolution PR pushes; runs gh auth setup-git after auth so git operations never pop up GCM",
+      "settings.githubChecking": "Checking…",
+      "settings.githubConnectedStatus": "Connected as @{user}",
+      "settings.githubNotConnected": "Not connected",
+      "settings.githubStatusFailed": "Failed to load status",
+      "settings.githubTokenEmpty": "Please paste a GitHub Personal Access Token first",
+      "settings.githubConnecting": "Connecting…",
+      "settings.githubConnected": "Connected to GitHub: @{user} (gh auth setup-git done)",
+      "settings.githubConnectFailed": "GitHub connect failed: {msg}",
+      "settings.githubDisconnected": "Disconnected from GitHub",
+      "settings.githubDisconnectFailed": "Disconnect failed: {msg}",
 
       // Welcome / onboarding
       "welcome.title": "Welcome to EMRG",
diff --git a/emrg/gui/test/daemon_client.test.js b/emrg/gui/test/daemon_client.test.js
index 7e9944c..57046aa 100644
--- a/emrg/gui/test/daemon_client.test.js
+++ b/emrg/gui/test/daemon_client.test.js
@@ -413,6 +413,20 @@ test("RESPONSE_TYPES 映射表与 daemon 命令名一致（修正 clear/rename/t
   currentMockWs.emit("message", Buffer.from(JSON.stringify({ type: "memory_content", content: "x" })));
   const r5 = await p5;
   assert.strictEqual(r5.type, "memory_content");
+  // github_connect → github_connect_result（Windows GCM rant Stage 2）
+  const p6 = client.sendCommandAndWait("github_connect", { token: "ghp_x" }, 2000);
+  await new Promise((r) => setTimeout(r, 10));
+  currentMockWs.emit("message", Buffer.from(JSON.stringify({ type: "github_connect_result", ok: true, user: "octocat", error: null })));
+  const r6 = await p6;
+  assert.strictEqual(r6.type, "github_connect_result");
+  assert.strictEqual(r6.ok, true);
+  // github_disconnect → github_disconnect_result（Windows GCM rant Stage 2）
+  const p7 = client.sendCommandAndWait("github_disconnect", {}, 2000);
+  await new Promise((r) => setTimeout(r, 10));
+  currentMockWs.emit("message", Buffer.from(JSON.stringify({ type: "github_disconnect_result", ok: true, error: null })));
+  const r7 = await p7;
+  assert.strictEqual(r7.type, "github_disconnect_result");
+  assert.strictEqual(r7.ok, true);
 });
 
 test("命令-响应配对超时 → reject（G93）", async () => {
diff --git a/emrg/server/daemon.py b/emrg/server/daemon.py
index 8f71b90..ead0d79 100644
--- a/emrg/server/daemon.py
+++ b/emrg/server/daemon.py
@@ -599,6 +599,93 @@ async def _check_github_auth(self) -> dict:
         except (asyncio.TimeoutError, OSError, ValueError):
             return {"authenticated": False, "user": None, "method": "none"}
 
+    async def _github_connect(self, token: str) -> dict:
+        """Authenticate gh with a PAT (rant 2026-08-07T10:17:27 Stage 2).
+
+        Runs ``gh auth login --with-token`` (token via stdin) followed by
+        ``gh auth setup-git`` so git uses gh as its credential helper and
+        push/pull/fetch never falls back to a GCM popup on Windows.
+        Returns:
+            {"ok": bool, "user": str|None, "error": str|None}
+        Never raises; any failure degrades to {"ok": False, "error": ...}.
+        """
+        token = (token or "").strip()
+        if not token:
+            return {"ok": False, "user": None, "error": "empty token"}
+        _, gh = resolve_git_gh()
+        if not gh:
+            return {"ok": False, "user": None, "error": "gh binary not found"}
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                gh, "auth", "login", "--with-token",
+                stdin=asyncio.subprocess.PIPE,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.STDOUT,
+                env=no_prompt_env(),
+            )
+            stdout, _ = await asyncio.wait_for(
+                proc.communicate(token.encode("utf-8") + b"\n"), timeout=30
+            )
+            if proc.returncode != 0:
+                output = stdout.decode("utf-8", errors="replace").strip()
+                return {
+                    "ok": False,
+                    "user": None,
+                    "error": output or f"gh auth login failed ({proc.returncode})",
+                }
+            # Re-verify via the same parser used by github_status.
+            user = (await self._check_github_auth()).get("user")
+            # setup-git: git must use gh as credential helper, otherwise
+            # git push/pull/fetch would still trigger GCM (acceptance item).
+            setup_ok = await self._gh_setup_git(gh)
+            return {
+                "ok": True,
+                "user": user,
+                "error": None if setup_ok else "auth ok but gh auth setup-git failed",
+            }
+        except (asyncio.TimeoutError, OSError, ValueError):
+            return {"ok": False, "user": None, "error": "gh auth login failed"}
+
+    async def _gh_setup_git(self, gh: str) -> bool:
+        """Run ``gh auth setup-git`` so git uses gh as credential helper."""
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                gh, "auth", "setup-git",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.STDOUT,
+                env=no_prompt_env(),
+            )
+            await asyncio.wait_for(proc.communicate(), timeout=30)
+            return proc.returncode == 0
+        except (asyncio.TimeoutError, OSError, ValueError):
+            return False
+
+    async def _github_disconnect(self) -> dict:
+        """Log out of gh (rant 2026-08-07T10:17:27 Stage 2).
+
+        Returns {"ok": bool, "error": str|None}. Never raises.
+        """
+        _, gh = resolve_git_gh()
+        if not gh:
+            return {"ok": False, "error": "gh binary not found"}
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                gh, "auth", "logout", "--hostname", "github.com",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.STDOUT,
+                env=no_prompt_env(),
+            )
+            stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=30)
+            if proc.returncode != 0:
+                output = stdout.decode("utf-8", errors="replace").strip()
+                return {
+                    "ok": False,
+                    "error": output or f"gh auth logout failed ({proc.returncode})",
+                }
+            return {"ok": True, "error": None}
+        except (asyncio.TimeoutError, OSError, ValueError):
+            return {"ok": False, "error": "gh auth logout failed"}
+
     def _build_system_prompt(self, session: Session | None = None) -> str:
         """Build the system prompt via Jinja2 template.
 
@@ -984,6 +1071,18 @@ async def _process_message(
             auth = await self._check_github_auth()
             await self._send(ws, {"type": "github_status", **auth})
 
+        elif msg_type == "github_connect":
+            # Windows GCM rant Stage 2: GUI PAT auth — gh auth login
+            # --with-token + gh auth setup-git (git no longer touches GCM).
+            token = msg.get("token", "")
+            result = await self._github_connect(token)
+            await self._send(ws, {"type": "github_connect_result", **result})
+
+        elif msg_type == "github_disconnect":
+            # Windows GCM rant Stage 2: GUI disconnect — gh auth logout.
+            result = await self._github_disconnect()
+            await self._send(ws, {"type": "github_disconnect_result", **result})
+
         elif msg_type == "clear_session":
             session_id = msg.get("session_id", "")
             cwd = msg.get("cwd", "")
diff --git a/tests/test_daemon.py b/tests/test_daemon.py
index e8c015d..c3d3f10 100644
--- a/tests/test_daemon.py
+++ b/tests/test_daemon.py
@@ -676,6 +676,190 @@ async def fake_exec(*args, **kwargs):
     assert result == {"authenticated": True, "user": "octocat", "method": "gh"}
 
 
+# ── github_connect / github_disconnect commands (rant 10:17:27 Stage 2) ──
+
+
+class _FakeProc:
+    """Minimal fake subprocess for github_connect/setup-git tests."""
+
+    def __init__(self, returncode=0, output=b""):
+        self.returncode = returncode
+        self._output = output
+        self.received = None
+
+    async def communicate(self, data=None):
+        self.received = data
+        return (self._output, None)
+
+
+def test_github_connect_success_dispatch(monkeypatch):
+    """github_connect returns github_connect_result with ok/user."""
+    import asyncio
+
+    server = _make_server()
+    writer = _FakeWriter()
+
+    async def fake_connect(token):
+        return {"ok": True, "user": "octocat", "error": None}
+
+    monkeypatch.setattr(server, "_github_connect", fake_connect)
+    asyncio.run(server._process_message({"type": "github_connect", "token": "ghp_x"}, writer))
+
+    assert len(writer._frames) == 1
+    reply = json.loads(writer._frames[0])
+    assert reply["type"] == "github_connect_result"
+    assert reply["ok"] is True
+    assert reply["user"] == "octocat"
+
+
+def test_github_connect_empty_token(monkeypatch):
+    """Empty/whitespace token is rejected before any subprocess runs."""
+    import asyncio
+
+    from emrg.server import daemon as dmod
+
+    server = _make_server()
+    writer = _FakeWriter()
+    monkeypatch.setattr(dmod, "resolve_git_gh", lambda: ("/usr/bin/git", "/usr/bin/gh"))
+    asyncio.run(server._process_message({"type": "github_connect", "token": "  "}, writer))
+
+    reply = json.loads(writer._frames[0])
+    assert reply["type"] == "github_connect_result"
+    assert reply["ok"] is False
+    assert reply["error"] == "empty token"
+
+
+def test_github_connect_gh_missing(monkeypatch):
+    """Missing gh binary degrades to ok=False, never raises."""
+    import asyncio
+
+    from emrg.server import daemon as dmod
+
+    server = _make_server()
+    writer = _FakeWriter()
+    monkeypatch.setattr(dmod, "resolve_git_gh", lambda: ("", ""))
+    asyncio.run(server._process_message({"type": "github_connect", "token": "ghp_x"}, writer))
+
+    reply = json.loads(writer._frames[0])
+    assert reply["type"] == "github_connect_result"
+    assert reply["ok"] is False
+    assert reply["error"] == "gh binary not found"
+
+
+def test_github_connect_pat_login_sets_up_git(monkeypatch):
+    """PAT path: gh auth login --with-token → re-verify → setup-git runs."""
+    import asyncio
+
+    from emrg.server import daemon as dmod
+
+    server = _make_server()
+    monkeypatch.setattr(dmod, "resolve_git_gh", lambda: ("/usr/bin/git", "/usr/bin/gh"))
+    calls = []  # [(argv, proc)]
+
+    async def fake_exec(*args, **kwargs):
+        if "setup-git" in args:
+            proc = _FakeProc(0, b"gh auth setup-git ok\n")
+        elif "status" in args:
+            proc = _FakeProc(0, b"Logged in to github.com as octocat (keyring)\n")
+        else:
+            proc = _FakeProc(0, b"Logged in as octocat\n")
+        calls.append((list(args), proc))
+        return proc
+
+    monkeypatch.setattr(dmod.asyncio, "create_subprocess_exec", fake_exec)
+    result = asyncio.run(server._github_connect("ghp_x"))
+
+    assert result["ok"] is True
+    assert result["user"] == "octocat"
+    assert result["error"] is None
+    login_entries = [(a, p) for a, p in calls if "login" in a]
+    setup_entries = [(a, p) for a, p in calls if "setup-git" in a]
+    assert len(login_entries) == 1
+    assert login_entries[0][0][1:] == ["auth", "login", "--with-token"]
+    # token must be delivered via stdin, never argv (argv leaks into ps)
+    assert login_entries[0][1].received == b"ghp_x\n"
+    assert len(setup_entries) == 1
+    assert setup_entries[0][0][1:] == ["auth", "setup-git"]
+
+
+def test_github_connect_login_failure_reported(monkeypatch):
+    """gh auth login non-zero → ok=False with gh output as error."""
+    import asyncio
+
+    from emrg.server import daemon as dmod
+
+    server = _make_server()
+    monkeypatch.setattr(dmod, "resolve_git_gh", lambda: ("/usr/bin/git", "/usr/bin/gh"))
+
+    async def fake_exec(*args, **kwargs):
+        return _FakeProc(1, b"HTTP 401: Bad credentials\n")
+
+    monkeypatch.setattr(dmod.asyncio, "create_subprocess_exec", fake_exec)
+    result = asyncio.run(server._github_connect("ghp_bad"))
+
+    assert result["ok"] is False
+    assert "401" in result["error"]
+
+
+def test_github_connect_setup_git_failure_reported(monkeypatch):
+    """Auth ok but setup-git fails → ok=True with explanatory error note."""
+    import asyncio
+
+    from emrg.server import daemon as dmod
+
+    server = _make_server()
+    monkeypatch.setattr(dmod, "resolve_git_gh", lambda: ("/usr/bin/git", "/usr/bin/gh"))
+
+    async def fake_exec(*args, **kwargs):
+        if "setup-git" in args:
+            return _FakeProc(1, b"could not set git config\n")
+        if "status" in args:
+            return _FakeProc(0, b"Logged in to github.com as octocat (keyring)\n")
+        return _FakeProc(0, b"Logged in as octocat\n")
+
+    monkeypatch.setattr(dmod.asyncio, "create_subprocess_exec", fake_exec)
+    result = asyncio.run(server._github_connect("ghp_x"))
+
+    assert result["ok"] is True
+    assert result["user"] == "octocat"
+    assert "setup-git" in result["error"]
+
+
+def test_github_disconnect_success_dispatch(monkeypatch):
+    """github_disconnect returns github_disconnect_result with ok."""
+    import asyncio
+
+    server = _make_server()
+    writer = _FakeWriter()
+
+    async def fake_disconnect():
+        return {"ok": True, "error": None}
+
+    monkeypatch.setattr(server, "_github_disconnect", fake_disconnect)
+    asyncio.run(server._process_message({"type": "github_disconnect"}, writer))
+
+    reply = json.loads(writer._frames[0])
+    assert reply["type"] == "github_disconnect_result"
+    assert reply["ok"] is True
+
+
+def test_github_disconnect_gh_missing(monkeypatch):
+    """Missing gh binary degrades to ok=False with error, never raises."""
+    import asyncio
+
+    from emrg.server import daemon as dmod
+
+    server = _make_server()
+    writer = _FakeWriter()
+    monkeypatch.setattr(dmod, "resolve_git_gh", lambda: ("", ""))
+    asyncio.run(server._process_message({"type": "github_disconnect"}, writer))
+
+    reply = json.loads(writer._frames[0])
+    assert reply["type"] == "github_disconnect_result"
+    assert reply["ok"] is False
+    assert reply["error"] == "gh binary not found"
+
+
 # ── /rant project list shows evolution-workspace entries (rant 10:48:00) ──