diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..196277e
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,32 @@
+name: tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  phpunit:
+    name: PHPUnit (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.2', '8.3', '8.4']
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: pdo, pdo_sqlite, sqlite3, curl, simplexml
+          coverage: none
+          tools: composer:v2
+
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress --prefer-dist
+
+      - name: Run PHPUnit
+        run: vendor/bin/phpunit
diff --git a/.gitignore b/.gitignore
index afc0e2b..740022d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,11 @@
 /.php-cs-fixer.cache
 
 /composer.lock
+/composer.phar
 /vendor/
 
+/.phpunit.cache/
+/tests/tmp/
+
 /yarn.lock
 /node_modules/
diff --git a/action.php b/action.php
index a25990d..ee0786f 100644
--- a/action.php
+++ b/action.php
@@ -1,98 +1,276 @@
 <?php
 
-require 'workflow.php';
+require_once 'workflow.php';
 
-$query = trim($argv[1]);
+class Action
+{
+    public static $skipDialogs = false;
 
-if ('>' !== $query[0] && 0 !== strpos($query, 'e >')) {
-    if ('.git' == substr($query, -4)) {
-        $query = 'x-github-client://openRepo/'.substr($query, 0, -4);
-    }
-    exec('open '.$query);
+    public static function dispatch(array $parts, bool $enterprise): string
+    {
+        switch ($parts[1]) {
+            case 'enterprise-url':
+                Workflow::setConfig('enterprise_url', rtrim($parts[2], '/'));
+                exec('osascript -e "tell application \"Alfred\" to search \"ghe \""');
 
-    return;
-}
+                return '';
 
-$enterprise = 0 === strpos($query, 'e ');
-if ($enterprise) {
-    $query = substr($query, 2);
-}
-$parts = explode(' ', $query);
-
-Workflow::init($enterprise);
-
-switch ($parts[1]) {
-    case 'enterprise-url':
-        Workflow::setConfig('enterprise_url', rtrim($parts[2], '/'));
-        exec('osascript -e "tell application \"Alfred\" to search \"ghe \""');
-        break;
-
-    case 'enterprise-reset':
-        Workflow::removeConfig('enterprise_url');
-        Workflow::removeConfig('enterprise_access_token');
-        Workflow::deleteCache();
-        break;
-
-    case 'login':
-        if (isset($parts[2]) && $parts[2]) {
-            Workflow::setAccessToken($parts[2]);
-            echo 'Successfully logged in';
-        } elseif (!$enterprise) {
-            Workflow::startServer();
-            $state = version_compare(PHP_VERSION, '5.4', '<') ? 'm' : '';
-            $url = Workflow::getBaseUrl().'/login/oauth/authorize?client_id=2d4f43826cb68e11c17c&scope=repo&state='.$state;
-            exec('open '.escapeshellarg($url));
+            case 'enterprise-reset':
+                Workflow::removeConfig('enterprise_url');
+                Workflow::removeConfig('enterprise_access_token');
+                Workflow::deleteCache();
+
+                return '';
+
+            case 'login':
+                if (isset($parts[2]) && $parts[2]) {
+                    Workflow::setAccessToken($parts[2]);
+
+                    return 'Successfully logged in';
+                }
+                if (!$enterprise) {
+                    Workflow::startServer();
+                    $state = version_compare(PHP_VERSION, '5.4', '<') ? 'm' : '';
+                    $url = Workflow::getBaseUrl().'/login/oauth/authorize?client_id=2d4f43826cb68e11c17c&scope=repo&state='.$state;
+                    exec('open '.escapeshellarg($url));
+                }
+
+                return '';
+
+            case 'logout':
+                Workflow::removeAccessToken();
+                Workflow::deleteCache();
+
+                return 'Successfully logged out';
+
+            case 'delete-cache':
+                Workflow::deleteCache();
+
+                return 'Successfully deleted cache';
+
+            case 'delete-database':
+                Workflow::deleteDatabase();
+
+                return 'Successfully deleted database';
+
+            case 'refresh-cache':
+                $curl = new Curl();
+                foreach (explode(',', $parts[2]) as $url) {
+                    Workflow::requestCache($url, $curl, null, false, 0, false);
+                }
+                $curl->execute();
+                Workflow::cleanCache();
+
+                return '';
+
+            case 'activate-autoupdate':
+                Workflow::setConfig('autoupdate', 1);
+
+                return 'Activated auto updating';
+
+            case 'deactivate-autoupdate':
+                Workflow::setConfig('autoupdate', 0);
+
+                return 'Deactivated auto updating';
+
+            case 'update':
+                $release = json_decode(Workflow::request('https://api.github.com/repos/gharlan/alfred-github-workflow/releases/latest'));
+                if (!isset($release->assets[0]->browser_download_url)) {
+                    return 'Update failed';
+                }
+                $response = Workflow::request($release->assets[0]->browser_download_url, null, null, false);
+                if (!$response) {
+                    return 'Update failed';
+                }
+                $path = getenv('alfred_workflow_data').'/github.alfredworkflow';
+                file_put_contents($path, $response);
+                exec('open '.escapeshellarg($path));
+
+                return '';
+
+            case 'user':
+                return self::dispatchUser($parts, $enterprise);
         }
-        break;
-
-    case 'logout':
-        Workflow::removeAccessToken();
-        Workflow::deleteCache();
-        echo 'Successfully logged out';
-        break;
-
-    case 'delete-cache':
-        Workflow::deleteCache();
-        echo 'Successfully deleted cache';
-        break;
-
-    case 'delete-database':
-        Workflow::deleteDatabase();
-        echo 'Successfully deleted database';
-        break;
-
-    case 'refresh-cache':
-        $curl = new Curl();
-        foreach (explode(',', $parts[2]) as $url) {
-            Workflow::requestCache($url, $curl, null, false, 0, false);
+
+        return '';
+    }
+
+    private static function confirmDialog(string $title, string $message): bool
+    {
+        if (self::$skipDialogs) {
+            return true;
         }
-        $curl->execute();
-        Workflow::cleanCache();
-        break;
-
-    case 'activate-autoupdate':
-        Workflow::setConfig('autoupdate', 1);
-        echo 'Activated auto updating';
-        break;
-
-    case 'deactivate-autoupdate':
-        Workflow::setConfig('autoupdate', 0);
-        echo 'Deactivated auto updating';
-        break;
-
-    case 'update':
-        $release = json_decode(Workflow::request('https://api.github.com/repos/gharlan/alfred-github-workflow/releases/latest'));
-        if (!isset($release->assets[0]->browser_download_url)) {
-            echo 'Update failed';
-            exit;
+        $safeTitle = str_replace('"', '\\"', $title);
+        $safeMessage = str_replace('"', '\\"', $message);
+        $script = 'display dialog "'.$safeMessage.'" buttons {"Cancel", "Delete"} default button "Cancel" cancel button "Cancel" with title "'.$safeTitle.'"';
+        exec('osascript -e '.escapeshellarg($script).' 2>&1', $output, $exitCode);
+
+        return 0 === $exitCode;
+    }
+
+    private static function showSimpleAlert(string $title, string $message): void
+    {
+        $safeTitle = str_replace('"', '\\"', $title);
+        $safeMessage = str_replace('"', '\\"', $message);
+        $script = 'display dialog "'.$safeMessage.'" buttons {"OK"} default button "OK" with title "'.$safeTitle.'"';
+        exec('osascript -e '.escapeshellarg($script).' > /dev/null 2>&1 &');
+    }
+
+    private static function showAlert(string $title, string $message): void
+    {
+        $safeTitle = str_replace('"', '\\"', $title);
+        $safeMessage = str_replace('"', '\\"', $message);
+        $script = 'set r to display dialog "'.$safeMessage.'" buttons {"OK", "Open GitHub"} default button "Open GitHub" with title "'.$safeTitle.'"'."\n".
+            'if button returned of r is "Open GitHub" then'."\n".
+            '    open location "https://github.com"'."\n".
+            'end if';
+        exec('osascript -e '.escapeshellarg($script).' > /dev/null 2>&1 &');
+    }
+
+    private static function dispatchUser(array $parts, bool $enterprise): string
+    {
+        $action = $parts[2] ?? '';
+        $label = $parts[3] ?? '';
+
+        switch ($action) {
+            case 'add':
+                if ($enterprise) {
+                    return 'Multi-account is only supported for github.com.';
+                }
+                if ('' === $label) {
+                    return 'Usage: gh user add <label>';
+                }
+                foreach (Workflow::listAccounts() as $account) {
+                    if ($account['label'] === $label) {
+                        return 'Account "'.$label.'" already exists. Use "gh user update '.$label.'" to refresh the token.';
+                    }
+                }
+                Workflow::setConfig('pending_account_label', $label);
+                Workflow::startServer();
+                $state = version_compare(PHP_VERSION, '5.4', '<') ? 'm' : '';
+                $url = 'https://github.com/login/oauth/authorize?client_id=2d4f43826cb68e11c17c&scope=repo&state='.$state.'&login='.urlencode($label).'&prompt=select_account';
+                exec('open '.escapeshellarg($url));
+
+                return 'Authorize in browser. Token will be saved as "'.$label.'". Then run "gh > user switch '.$label.'".';
+
+            case 'login':
+                if ($enterprise) {
+                    return 'Multi-account is only supported for github.com.';
+                }
+                if ('' === $label) {
+                    return 'Usage: gh user login <label> <token>';
+                }
+                $token = $parts[4] ?? '';
+                if ('' === $token) {
+                    return 'Usage: gh user login <label> <token>';
+                }
+                $existing = null;
+                foreach (Workflow::listAccounts() as $account) {
+                    if ($account['label'] === $label) {
+                        $existing = $account;
+                        break;
+                    }
+                }
+                if ($existing) {
+                    Workflow::updateAccountToken((int) $existing['id'], $token);
+                    $accountId = (int) $existing['id'];
+                } else {
+                    $accountId = Workflow::addAccount($label, $token);
+                }
+                if (!Workflow::getActiveAccount()) {
+                    Workflow::setActiveAccount($accountId);
+                }
+
+                return 'Saved token for "'.$label.'". Run "gh > user switch '.$label.'" to activate.';
+
+            case 'switch':
+                if ('' === $label) {
+                    return 'Usage: gh user switch <label>';
+                }
+                foreach (Workflow::listAccounts() as $account) {
+                    if ($account['label'] === $label) {
+                        Workflow::setActiveAccount((int) $account['id']);
+                        self::showAlert(
+                            'Switched to '.$label,
+                            'Alfred is now using the "'.$label.'" GitHub account. Switch your browser session to match if needed.'
+                        );
+
+                        return '';
+                    }
+                }
+
+                return 'Account "'.$label.'" not found';
+
+            case 'update':
+                if ($enterprise) {
+                    return 'Multi-account is only supported for github.com.';
+                }
+                if ('' === $label) {
+                    return 'Usage: gh user update <label>';
+                }
+                $found = false;
+                foreach (Workflow::listAccounts() as $account) {
+                    if ($account['label'] === $label) {
+                        $found = true;
+                        break;
+                    }
+                }
+                if (!$found) {
+                    return 'Account "'.$label.'" not found';
+                }
+                Workflow::setConfig('pending_account_label', $label);
+                Workflow::startServer();
+                $state = version_compare(PHP_VERSION, '5.4', '<') ? 'm' : '';
+                $url = 'https://github.com/login/oauth/authorize?client_id=2d4f43826cb68e11c17c&scope=repo&state='.$state.'&login='.urlencode($label).'&prompt=select_account';
+                exec('open '.escapeshellarg($url));
+
+                return 'Authorize in browser to refresh token for "'.$label.'".';
+
+            case 'delete':
+                if ('' === $label) {
+                    return 'Usage: gh user delete <label>';
+                }
+                foreach (Workflow::listAccounts() as $account) {
+                    if ($account['label'] === $label) {
+                        try {
+                            if (!self::confirmDialog('Delete "'.$label.'"?', 'This will remove the account and its cached data.')) {
+                                return '';
+                            }
+                            Workflow::removeAccount((int) $account['id']);
+                            self::showSimpleAlert('Account Deleted', 'Removed "'.$label.'".');
+
+                            return '';
+                        } catch (\RuntimeException $e) {
+                            return 'Cannot delete active account "'.$label.'" — switch first';
+                        }
+                    }
+                }
+
+                return 'Account "'.$label.'" not found';
         }
-        $response = Workflow::request($release->assets[0]->browser_download_url, null, null, false);
-        if (!$response) {
-            echo 'Update failed';
-            exit;
+
+        return 'Unknown user command: '.$action;
+    }
+}
+
+if (isset($argv[1])) {
+    $query = trim($argv[1]);
+
+    if ('>' !== $query[0] && 0 !== strpos($query, 'e >')) {
+        if ('.git' == substr($query, -4)) {
+            $query = 'x-github-client://openRepo/'.substr($query, 0, -4);
         }
-        $path = getenv('alfred_workflow_data').'/github.alfredworkflow';
-        file_put_contents($path, $response);
-        exec('open '.escapeshellarg($path));
-        break;
+        exec('open '.escapeshellarg($query));
+
+        return;
+    }
+
+    $enterprise = 0 === strpos($query, 'e ');
+    if ($enterprise) {
+        $query = substr($query, 2);
+    }
+    $parts = explode(' ', $query);
+
+    Workflow::init($enterprise);
+    echo Action::dispatch($parts, $enterprise);
 }
diff --git a/composer.json b/composer.json
index bdb1425..98df486 100644
--- a/composer.json
+++ b/composer.json
@@ -1,5 +1,9 @@
 {
     "require-dev": {
-        "friendsofphp/php-cs-fixer": "^3.48"
+        "friendsofphp/php-cs-fixer": "^3.48",
+        "phpunit/phpunit": "^11.0"
+    },
+    "scripts": {
+        "test": "phpunit"
     }
 }
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
new file mode 100644
index 0000000..632c115
--- /dev/null
+++ b/phpunit.xml.dist
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="tests/bootstrap.php"
+         cacheDirectory=".phpunit.cache"
+         colors="true"
+         failOnWarning="true"
+         failOnRisky="true"
+         beStrictAboutOutputDuringTests="true">
+    <testsuites>
+        <testsuite name="Unit">
+            <directory>tests</directory>
+        </testsuite>
+    </testsuites>
+</phpunit>
diff --git a/search.php b/search.php
index 14fb1c2..12cb267 100644
--- a/search.php
+++ b/search.php
@@ -1,6 +1,6 @@
 <?php
 
-require 'workflow.php';
+require_once 'workflow.php';
 
 class Search
 {
@@ -42,6 +42,12 @@ public static function run($scope, $query, $hotkey)
             return;
         }
 
+        if (!$hotkey && isset($parts[0]) && '>' === $parts[0] && isset($parts[1]) && 'user' === $parts[1]) {
+            self::addUserCommands();
+
+            return Workflow::getItemsAsXml();
+        }
+
         if (!Workflow::getAccessToken() || !(self::$user = Workflow::requestApi('/user'))) {
             self::addLoginCommands();
 
@@ -134,7 +140,7 @@ public static function run($scope, $query, $hotkey)
     private static function addEmptyQueryCommand()
     {
         Workflow::addItem(Item::create()
-            ->title(self::$enterprise ? 'ghe' : 'gh')
+            ->title(self::$enterprise ? 'ghe' : self::renderGhHeader())
             ->subtitle('Search or type a command'.(self::$enterprise ? ' (GitHub Enterprise)' : ''))
             ->comparator('')
             ->valid(false)
@@ -626,4 +632,158 @@ private static function addSystemCommands()
             );
         }
     }
+
+    private static function renderGhHeader(): string
+    {
+        $active = Workflow::getActiveAccount();
+        if (!$active) {
+            return 'gh';
+        }
+
+        return 'gh ('.$active['label'].')';
+    }
+
+    private static function addUserCommands(): void
+    {
+        $sub = self::$parts[2] ?? '';
+        $label = self::$parts[3] ?? '';
+        $accounts = Workflow::listAccounts();
+
+        if ('switch' === $sub) {
+            if ('' !== $label) {
+                Workflow::addItem(Item::create()
+                    ->title('> user switch '.$label)
+                    ->subtitle('Switch to '.$label)
+                    ->icon('user')
+                    ->arg('> user switch '.$label)
+                );
+
+                return;
+            }
+            foreach ($accounts as $account) {
+                $acctLabel = $account['label'];
+                $isActive = 1 === (int) $account['is_active'];
+                Workflow::addItem(Item::create()
+                    ->title($acctLabel.($isActive ? ' (active)' : ''))
+                    ->subtitle('Switch to '.$acctLabel)
+                    ->icon($isActive ? 'stars' : 'user')
+                    ->arg('> user switch '.$acctLabel)
+                    ->autocomplete(false)
+                );
+            }
+
+            return;
+        }
+
+        if ('delete' === $sub) {
+            if ('' !== $label) {
+                Workflow::addItem(Item::create()
+                    ->title('> user delete '.$label)
+                    ->subtitle('Remove "'.$label.'"')
+                    ->icon('user')
+                    ->arg('> user delete '.$label)
+                );
+
+                return;
+            }
+            foreach ($accounts as $account) {
+                $acctLabel = $account['label'];
+                $isActive = 1 === (int) $account['is_active'];
+                Workflow::addItem(Item::create()
+                    ->title($acctLabel.($isActive ? ' (active — switch first)' : ''))
+                    ->subtitle('Delete '.$acctLabel)
+                    ->icon('user')
+                    ->arg('> user delete '.$acctLabel)
+                    ->valid(!$isActive)
+                );
+            }
+
+            return;
+        }
+
+        if ('update' === $sub) {
+            if ('' !== $label) {
+                Workflow::addItem(Item::create()
+                    ->title('> user update '.$label)
+                    ->subtitle('Open github.com to generate a new token for "'.$label.'"')
+                    ->icon('user')
+                    ->arg('> user update '.$label)
+                );
+
+                return;
+            }
+            foreach ($accounts as $account) {
+                Workflow::addItem(Item::create()
+                    ->title($account['label'])
+                    ->subtitle('Refresh token for '.$account['label'])
+                    ->icon('user')
+                    ->arg('> user update '.$account['label'])
+                );
+            }
+
+            return;
+        }
+
+        if ('add' === $sub) {
+            if ('' !== $label) {
+                Workflow::addItem(Item::create()
+                    ->title('> user add '.$label)
+                    ->subtitle('Sign in as "'.$label.'" in your browser first, then authorize')
+                    ->icon('user')
+                    ->arg('> user add '.$label)
+                );
+
+                return;
+            }
+
+            Workflow::addItem(Item::create()
+                ->title('> user add')
+                ->subtitle('Add a new github account')
+                ->icon('user')
+                ->valid(false, ' ')
+            );
+
+            return;
+        }
+
+        if ('login' === $sub) {
+            if ('' !== $label) {
+                $token = self::$parts[4] ?? '';
+                Workflow::addItem(Item::create()
+                    ->title('> user login '.$label.' '.($token ?: '<token>'))
+                    ->subtitle('' !== $token ? 'Save token for "'.$label.'"' : 'Paste your token after the label')
+                    ->icon('user')
+                    ->arg('> user login '.$label.' '.$token)
+                    ->valid('' !== $token)
+                );
+
+                return;
+            }
+
+            Workflow::addItem(Item::create()
+                ->title('> user login')
+                ->subtitle('Save a token: > user login <label> <token>')
+                ->icon('user')
+                ->valid(false, ' ')
+            );
+
+            return;
+        }
+
+        $cmds = [
+            'add' => 'Add a new github account',
+            'login' => 'Save a token for an account',
+            'switch' => 'Switch active github account',
+            'update' => 'Refresh the token for an existing account',
+            'delete' => 'Remove a github account',
+        ];
+        foreach ($cmds as $cmd => $desc) {
+            Workflow::addItem(Item::create()
+                ->title('> user '.$cmd)
+                ->subtitle($desc)
+                ->icon('user')
+                ->valid(false, ' ')
+            );
+        }
+    }
 }
diff --git a/server.php b/server.php
index b269e6c..4e0043a 100644
--- a/server.php
+++ b/server.php
@@ -8,12 +8,58 @@
 
 Workflow::init();
 
-if (!isset($_GET['access_token'])) {
+$token = $_GET['access_token'] ?? null;
+if (!$token) {
     echo 'FAILURE (missing access_token parameter)!';
     exit;
 }
 
-Workflow::setAccessToken($_GET['access_token']);
+$label = Workflow::getConfig('pending_account_label') ?? 'default';
+Workflow::removeConfig('pending_account_label');
+
+// Resolve the actual GitHub username from the token so the account
+// label is meaningful (instead of "default" for legacy gh > login).
+if ('default' === $label) {
+    $ch = curl_init('https://api.github.com/user');
+    curl_setopt_array($ch, [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_HTTPHEADER => ['Authorization: token '.$token, 'User-Agent: alfred-github-workflow'],
+    ]);
+    $body = curl_exec($ch);
+    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    unset($ch);
+    if (200 === $status) {
+        $user = json_decode($body);
+        if (isset($user->login) && '' !== $user->login) {
+            $label = $user->login;
+        }
+    }
+}
+
+$existing = null;
+foreach (Workflow::listAccounts() as $account) {
+    if ($account['label'] === $label) {
+        $existing = $account;
+        break;
+    }
+}
+
+if ($existing) {
+    Workflow::updateAccountToken((int) $existing['id'], $token);
+} else {
+    Workflow::addAccount($label, $token);
+}
+
+if (!Workflow::getActiveAccount()) {
+    $accounts = Workflow::listAccounts();
+    foreach ($accounts as $account) {
+        if ($account['label'] === $label) {
+            Workflow::setActiveAccount((int) $account['id']);
+            break;
+        }
+    }
+}
+
 Workflow::cacheWarmup();
 
 ?>
diff --git a/tests/AccountsCrudTest.php b/tests/AccountsCrudTest.php
new file mode 100644
index 0000000..224bd13
--- /dev/null
+++ b/tests/AccountsCrudTest.php
@@ -0,0 +1,254 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class AccountsCrudTest extends WorkflowTestCase
+{
+    public function testAddAccountReturnsIdAndInsertsRow(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'token-a');
+
+        $this->assertGreaterThan(0, $id);
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('alice', $accounts[0]['label']);
+        $this->assertSame('token-a', $this->getAccountToken('alice'));
+        $this->assertSame(0, (int) $accounts[0]['is_active']);
+    }
+
+    public function testAddAccountRejectsDuplicateLabel(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('alice', 'token-a');
+
+        $this->expectException(PDOException::class);
+        Workflow::addAccount('alice', 'token-b');
+    }
+
+    public function testListAccountsReturnsEmptyArrayWhenNoAccounts(): void
+    {
+        Workflow::init();
+        $this->assertSame([], Workflow::listAccounts());
+    }
+
+    public function testListAccountsSortsByLabel(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('zulu', 'tok-z');
+        Workflow::addAccount('alpha', 'tok-a');
+        Workflow::addAccount('mike', 'tok-m');
+
+        $accounts = Workflow::listAccounts();
+        $this->assertSame(['alpha', 'mike', 'zulu'], array_column($accounts, 'label'));
+    }
+
+    public function testGetActiveAccountReturnsNullWhenNoneActive(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('alice', 'token-a');
+
+        $this->assertNull(Workflow::getActiveAccount());
+    }
+
+    public function testSetActiveAccountMarksSingleActive(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'token-a');
+        Workflow::setActiveAccount($id);
+
+        $active = Workflow::getActiveAccount();
+        $this->assertNotNull($active);
+        $this->assertSame('alice', $active['label']);
+        $this->assertSame(1, (int) $active['is_active']);
+    }
+
+    public function testSwitchingActiveClearsPreviousActive(): void
+    {
+        Workflow::init();
+        $a = Workflow::addAccount('alice', 'token-a');
+        $b = Workflow::addAccount('bob', 'token-b');
+
+        Workflow::setActiveAccount($a);
+        Workflow::setActiveAccount($b);
+
+        $this->assertSame('bob', Workflow::getActiveAccount()['label']);
+        $accounts = Workflow::listAccounts();
+        $activeCount = 0;
+        foreach ($accounts as $account) {
+            if (1 === (int) $account['is_active']) {
+                ++$activeCount;
+            }
+        }
+        $this->assertSame(1, $activeCount);
+    }
+
+    public function testSetActiveAccountThrowsOnUnknownId(): void
+    {
+        Workflow::init();
+
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessageMatches('/not found/i');
+        Workflow::setActiveAccount(999);
+    }
+
+    public function testSetActiveAccountRollsBackOnFailure(): void
+    {
+        Workflow::init();
+        $a = Workflow::addAccount('alice', 'token-a');
+        Workflow::setActiveAccount($a);
+
+        // Attempt to set a non-existent account; the transaction should roll back
+        // and leave 'alice' still active.
+        try {
+            Workflow::setActiveAccount(999);
+            $this->fail('Expected RuntimeException');
+        } catch (RuntimeException $e) {
+            // expected
+        }
+
+        $active = Workflow::getActiveAccount();
+        $this->assertNotNull($active);
+        $this->assertSame('alice', $active['label']);
+    }
+
+    public function testRemoveAccountDeletesRow(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'token-a');
+        Workflow::removeAccount($id);
+
+        $this->assertCount(0, Workflow::listAccounts());
+    }
+
+    public function testRemoveAccountRefusesActiveAccount(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'token-a');
+        Workflow::setActiveAccount($id);
+
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessageMatches('/active/i');
+        Workflow::removeAccount($id);
+    }
+
+    public function testRemoveAccountDropsCacheRows(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'token-a');
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->prepare(
+            'REPLACE INTO request_cache (account_id, url, timestamp, etag, content, refresh, parent) VALUES (?, ?, ?, ?, ?, ?, ?)'
+        )->execute([$id, 'https://api.github.com/user', time(), null, '{}', 0, null]);
+
+        Workflow::removeAccount($id);
+
+        $count = (int) $pdo->query("SELECT COUNT(*) FROM request_cache WHERE account_id = $id")->fetchColumn();
+        $this->assertSame(0, $count);
+    }
+
+    public function testUpdateAccountTokenReplacesToken(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'old-token');
+        Workflow::updateAccountToken($id, 'new-token');
+
+        $accounts = Workflow::listAccounts();
+        $this->assertSame('new-token', $this->getAccountToken('alice'));
+    }
+
+    public function testUpdateAccountTokenThrowsOnUnknownId(): void
+    {
+        Workflow::init();
+
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessageMatches('/not found/i');
+        Workflow::updateAccountToken(999, 'irrelevant');
+    }
+
+    public function testDeleteDatabasePreservesAccounts(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'tok-a');
+        Workflow::setActiveAccount($id);
+
+        Workflow::deleteDatabase();
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('alice', $accounts[0]['label']);
+        $this->assertSame('tok-a', $this->getAccountToken('alice'));
+        $this->assertSame(1, (int) $accounts[0]['is_active']);
+    }
+
+    public function testDeleteDatabaseClearsRequestCache(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'tok-a');
+        Workflow::setActiveAccount($id);
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->prepare(
+            'REPLACE INTO request_cache (account_id, url, timestamp, etag, content, refresh, parent) VALUES (?, ?, ?, ?, ?, ?, ?)'
+        )->execute([$id, 'https://api.github.com/user', time(), null, '{}', 0, null]);
+
+        Workflow::deleteDatabase();
+
+        $count = (int) $pdo->query('SELECT COUNT(*) FROM request_cache')->fetchColumn();
+        $this->assertSame(0, $count);
+    }
+
+    public function testDeleteDatabaseClearsConfig(): void
+    {
+        Workflow::init();
+        Workflow::setConfig('autoupdate', '0');
+        Workflow::setConfig('version', 'test-version');
+
+        Workflow::deleteDatabase();
+
+        agw_test_reset_workflow();
+        Workflow::init();
+        $this->assertNull(Workflow::getConfig('autoupdate'));
+        $this->assertNull(Workflow::getConfig('version'));
+    }
+
+    public function testDeleteDatabaseDoesNotUnlinkFile(): void
+    {
+        Workflow::init();
+        $dbFile = $this->dataDir.'/db.sqlite';
+        $this->assertFileExists($dbFile);
+
+        Workflow::deleteDatabase();
+
+        $this->assertFileExists($dbFile);
+    }
+
+    public function testDeleteDatabaseFollowedByAddAccountWorks(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('pre', 'tok-pre');
+        Workflow::setActiveAccount($id);
+
+        // Exercise the cached statement path (setConfig/getConfig use getStatement)
+        Workflow::setConfig('alpha', '1');
+        $this->assertSame('1', Workflow::getConfig('alpha'));
+
+        Workflow::deleteDatabase();
+
+        // After deleteDatabase, cached statements should be rebuilt cleanly
+        Workflow::setConfig('alpha', '2');
+        $this->assertSame('2', Workflow::getConfig('alpha'));
+
+        // No re-init — the PDO handle should still be live and accounts CRUD should still work.
+        $newId = Workflow::addAccount('post', 'tok-post');
+        $this->assertGreaterThan(0, $newId);
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(2, $accounts);
+    }
+}
diff --git a/tests/AccountsMigrationTest.php b/tests/AccountsMigrationTest.php
new file mode 100644
index 0000000..4ee80cf
--- /dev/null
+++ b/tests/AccountsMigrationTest.php
@@ -0,0 +1,110 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class AccountsMigrationTest extends WorkflowTestCase
+{
+    public function testLegacyAccessTokenIsMigratedToDefaultAccount(): void
+    {
+        Workflow::init();
+        Workflow::setConfig('access_token', 'legacy-token');
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $row = $pdo->query('SELECT label, token, is_active FROM accounts')->fetch(PDO::FETCH_ASSOC);
+
+        $this->assertSame('default', $row['label']);
+        $this->assertSame('legacy-token', $row['token']);
+        $this->assertSame(1, (int) $row['is_active']);
+    }
+
+    public function testMigrationIsIdempotent(): void
+    {
+        Workflow::init();
+        Workflow::setConfig('access_token', 'legacy-token');
+
+        agw_test_reset_workflow();
+        Workflow::init();
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $count = (int) $pdo->query('SELECT COUNT(*) FROM accounts')->fetchColumn();
+        $this->assertSame(1, $count);
+    }
+
+    public function testNoMigrationWhenNoLegacyToken(): void
+    {
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $count = (int) $pdo->query('SELECT COUNT(*) FROM accounts')->fetchColumn();
+        $this->assertSame(0, $count);
+    }
+
+    public function testEnterpriseAccessTokenIsNotMigrated(): void
+    {
+        Workflow::init(true);
+        Workflow::setConfig('enterprise_access_token', 'ghe-token');
+        Workflow::setConfig('enterprise_url', 'https://ghe.example.com');
+
+        agw_test_reset_workflow();
+        Workflow::init(true);
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $count = (int) $pdo->query('SELECT COUNT(*) FROM accounts')->fetchColumn();
+        $this->assertSame(0, $count);
+
+        // Enterprise token still reachable via legacy config path
+        $this->assertSame('ghe-token', Workflow::getAccessToken());
+    }
+
+    public function testMigrationDoesNotRunWhenAccountsAlreadyExist(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        // Pre-seed with label 'default' so the UNIQUE constraint is NOT what
+        // prevents a second insert — only the $count > 0 early return can.
+        $pdo->exec("INSERT INTO accounts (label, token, is_active, created_at) VALUES ('default', 'first-seeded', 1, 1)");
+        Workflow::setConfig('access_token', 'should-not-migrate');
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $row = $pdo->query('SELECT label, token FROM accounts')->fetch(PDO::FETCH_ASSOC);
+        $this->assertSame('default', $row['label']);
+        $this->assertSame('first-seeded', $row['token']); // would be 'should-not-migrate' if early return failed
+    }
+
+    public function testMigrationRunsOnPreExistingLegacyDatabase(): void
+    {
+        // Simulate a pre-PR-#2 database: create config + request_cache manually
+        // with no accounts table, then set the legacy access_token.
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->exec('CREATE TABLE config (key TEXT PRIMARY KEY NOT NULL, value TEXT) WITHOUT ROWID');
+        $pdo->exec('
+            CREATE TABLE request_cache (
+                url TEXT PRIMARY KEY NOT NULL,
+                timestamp INTEGER NOT NULL,
+                etag TEXT,
+                content TEXT,
+                refresh INTEGER,
+                parent TEXT
+            ) WITHOUT ROWID
+        ');
+        $pdo->exec("INSERT INTO config VALUES ('access_token', 'legacy-from-prior-version')");
+        $pdo = null;
+
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $row = $pdo->query('SELECT label, token, is_active FROM accounts')->fetch(PDO::FETCH_ASSOC);
+        $this->assertSame('default', $row['label']);
+        $this->assertSame('legacy-from-prior-version', $row['token']);
+        $this->assertSame(1, (int) $row['is_active']);
+    }
+}
diff --git a/tests/AccountsSchemaTest.php b/tests/AccountsSchemaTest.php
new file mode 100644
index 0000000..8d7b68d
--- /dev/null
+++ b/tests/AccountsSchemaTest.php
@@ -0,0 +1,55 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class AccountsSchemaTest extends WorkflowTestCase
+{
+    public function testInitCreatesAccountsTable(): void
+    {
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $columns = $pdo->query('PRAGMA table_info(accounts)')->fetchAll(PDO::FETCH_ASSOC);
+
+        $this->assertSame(
+            ['id', 'label', 'token', 'is_active', 'created_at'],
+            array_column($columns, 'name')
+        );
+    }
+
+    public function testLabelIsUnique(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->exec("INSERT INTO accounts (label, token, is_active, created_at) VALUES ('a', 't1', 0, 1)");
+
+        $this->expectException(PDOException::class);
+        $pdo->exec("INSERT INTO accounts (label, token, is_active, created_at) VALUES ('a', 't2', 0, 2)");
+    }
+
+    public function testOnlyOneActiveAccountAllowed(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->exec("INSERT INTO accounts (label, token, is_active, created_at) VALUES ('a', 't1', 1, 1)");
+
+        $this->expectException(PDOException::class);
+        $pdo->exec("INSERT INTO accounts (label, token, is_active, created_at) VALUES ('b', 't2', 1, 2)");
+    }
+
+    public function testNotNullConstraintsArePinned(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $columns = $pdo->query('PRAGMA table_info(accounts)')->fetchAll(PDO::FETCH_ASSOC);
+        $byName = [];
+        foreach ($columns as $column) {
+            $byName[$column['name']] = (int) $column['notnull'];
+        }
+
+        $this->assertSame(1, $byName['label']);
+        $this->assertSame(1, $byName['token']);
+        $this->assertSame(1, $byName['is_active']);
+        $this->assertSame(1, $byName['created_at']);
+    }
+}
diff --git a/tests/ActionDispatchTest.php b/tests/ActionDispatchTest.php
new file mode 100644
index 0000000..76c8696
--- /dev/null
+++ b/tests/ActionDispatchTest.php
@@ -0,0 +1,264 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class ActionDispatchTest extends WorkflowTestCase
+{
+    public function testLoginWithTokenSavesAndConfirms(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'login', 'new-token'], false);
+
+        $this->assertStringContainsString('logged in', $output);
+        $this->assertSame('new-token', Workflow::getAccessToken());
+    }
+
+    // Skipped: testLoginWithoutTokenReturnsEmptyString — triggers real OAuth browser
+    // open + PHP built-in server via exec(). Covered in Phase I manual QA.
+
+    public function testLogoutRemovesTokenAndConfirms(): void
+    {
+        Workflow::init();
+        Workflow::setAccessToken('existing');
+        $output = Action::dispatch(['>', 'logout'], false);
+
+        $this->assertStringContainsString('logged out', $output);
+        $this->assertNull(Workflow::getAccessToken());
+    }
+
+    public function testDeleteCacheConfirms(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'delete-cache'], false);
+        $this->assertStringContainsString('deleted cache', $output);
+    }
+
+    public function testDeleteDatabaseConfirms(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'delete-database'], false);
+        $this->assertStringContainsString('deleted database', $output);
+    }
+
+    public function testActivateAutoupdateSetsConfig(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'activate-autoupdate'], false);
+        $this->assertStringContainsString('Activated', $output);
+        $this->assertSame(1, (int) Workflow::getConfig('autoupdate'));
+    }
+
+    public function testDeactivateAutoupdateSetsConfig(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'deactivate-autoupdate'], false);
+        $this->assertStringContainsString('Deactivated', $output);
+        $this->assertSame(0, (int) Workflow::getConfig('autoupdate'));
+    }
+
+    public function testEnterpriseUrlSetsConfig(): void
+    {
+        Workflow::init(true);
+        // Test config storage directly — dispatch would trigger osascript exec.
+        Workflow::setConfig('enterprise_url', rtrim('https://ghe.example.com/', '/'));
+        $this->assertSame('https://ghe.example.com', Workflow::getConfig('enterprise_url'));
+    }
+
+    public function testEnterpriseResetClearsConfig(): void
+    {
+        Workflow::init(true);
+        Workflow::setConfig('enterprise_url', 'https://ghe.example.com');
+        Workflow::setConfig('enterprise_access_token', 'tok');
+        Action::dispatch(['>', 'enterprise-reset'], true);
+        $this->assertNull(Workflow::getConfig('enterprise_url'));
+        $this->assertNull(Workflow::getConfig('enterprise_access_token'));
+    }
+
+    public function testUnknownCommandReturnsEmptyString(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'never-heard-of-this'], false);
+        $this->assertSame('', $output);
+    }
+
+    // --- Phase D: gh user subcommands ---
+
+    public function testUserAddRejectsDuplicateLabel(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('work', 'existing');
+
+        $output = Action::dispatch(['>', 'user', 'add', 'work'], false);
+        $this->assertStringContainsString('already exists', $output);
+    }
+
+    public function testUserAddRejectsEmptyLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'add'], false);
+        $this->assertStringContainsString('Usage', $output);
+    }
+
+    public function testUserAddRejectsEnterprise(): void
+    {
+        Workflow::init(true);
+        $output = Action::dispatch(['>', 'user', 'add', 'test'], true);
+        $this->assertStringContainsString('only supported for github.com', $output);
+    }
+
+    public function testUserSwitchActivatesAccount(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('alice', 'tok-a');
+        Workflow::addAccount('bob', 'tok-b');
+
+        Action::dispatch(['>', 'user', 'switch', 'bob'], false);
+        $this->assertSame('bob', Workflow::getActiveAccount()['label']);
+    }
+
+    public function testUserSwitchRejectsUnknownLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'switch', 'nobody'], false);
+        $this->assertStringContainsString('not found', $output);
+    }
+
+    public function testUserSwitchRejectsEmptyLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'switch'], false);
+        $this->assertStringContainsString('Usage', $output);
+    }
+
+    public function testUserDeleteRemovesInactiveAccount(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('work', 'tok');
+
+        Action::dispatch(['>', 'user', 'delete', 'work'], false);
+        $this->assertCount(0, Workflow::listAccounts());
+    }
+
+    public function testUserDeleteRefusesActiveAccount(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('work', 'tok');
+        Workflow::setActiveAccount($id);
+
+        $output = Action::dispatch(['>', 'user', 'delete', 'work'], false);
+        $this->assertStringContainsString('active', $output);
+        $this->assertCount(1, Workflow::listAccounts());
+    }
+
+    public function testUserDeleteRejectsUnknownLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'delete', 'ghost'], false);
+        $this->assertStringContainsString('not found', $output);
+    }
+
+    public function testUserDeleteRejectsEmptyLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'delete'], false);
+        $this->assertStringContainsString('Usage', $output);
+    }
+
+    public function testUserUpdateRejectsUnknownLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'update', 'ghost'], false);
+        $this->assertStringContainsString('not found', $output);
+    }
+
+    public function testUserUpdateRejectsEmptyLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'update'], false);
+        $this->assertStringContainsString('Usage', $output);
+    }
+
+    public function testUserUpdateRejectsEnterprise(): void
+    {
+        Workflow::init(true);
+        $output = Action::dispatch(['>', 'user', 'update', 'work'], true);
+        $this->assertStringContainsString('only supported for github.com', $output);
+    }
+
+    // --- Phase D (revised): gh user login subcommand ---
+
+    public function testUserLoginCreatesNewAccount(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'login', 'mnmal', 'ghp_testtoken123'], false);
+
+        $this->assertStringContainsString('Saved token', $output);
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('mnmal', $accounts[0]['label']);
+        $this->assertSame('ghp_testtoken123', $this->getAccountToken('mnmal'));
+    }
+
+    public function testUserLoginUpdatesExistingAccount(): void
+    {
+        Workflow::init();
+        Workflow::addAccount('mnmal', 'old-token');
+
+        $output = Action::dispatch(['>', 'user', 'login', 'mnmal', 'ghp_newtoken456'], false);
+        $this->assertStringContainsString('Saved token', $output);
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('ghp_newtoken456', $this->getAccountToken('mnmal'));
+    }
+
+    public function testUserLoginAutoActivatesWhenNoActiveAccount(): void
+    {
+        Workflow::init();
+        Action::dispatch(['>', 'user', 'login', 'mnmal', 'ghp_tok'], false);
+
+        $active = Workflow::getActiveAccount();
+        $this->assertNotNull($active);
+        $this->assertSame('mnmal', $active['label']);
+    }
+
+    public function testUserLoginDoesNotAutoActivateWhenAnotherAccountIsActive(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('existing', 'tok-existing');
+        Workflow::setActiveAccount($id);
+
+        Action::dispatch(['>', 'user', 'login', 'second', 'ghp_tok2'], false);
+
+        $active = Workflow::getActiveAccount();
+        $this->assertSame('existing', $active['label']);
+    }
+
+    public function testUserLoginRejectsEmptyLabel(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'login'], false);
+        $this->assertStringContainsString('Usage', $output);
+    }
+
+    public function testUserLoginRejectsMissingToken(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'login', 'mnmal'], false);
+        $this->assertStringContainsString('Usage', $output);
+    }
+
+    public function testUserLoginRejectsEnterprise(): void
+    {
+        Workflow::init(true);
+        $output = Action::dispatch(['>', 'user', 'login', 'test', 'tok'], true);
+        $this->assertStringContainsString('only supported for github.com', $output);
+    }
+
+    public function testUnknownUserSubcommandReturnsError(): void
+    {
+        Workflow::init();
+        $output = Action::dispatch(['>', 'user', 'nonsense'], false);
+        $this->assertStringContainsString('Unknown user command', $output);
+    }
+}
diff --git a/tests/CurlRequestTest.php b/tests/CurlRequestTest.php
new file mode 100644
index 0000000..180df2d
--- /dev/null
+++ b/tests/CurlRequestTest.php
@@ -0,0 +1,30 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * CurlRequest is the per-request token carrier. The fact that the token is
+ * a constructor argument (not global state) is the load-bearing property
+ * that lets multi-account work avoid touching the network layer — pin it.
+ */
+final class CurlRequestTest extends TestCase
+{
+    public function testConstructorAssignsAllFields(): void
+    {
+        $callback = static function () {};
+        $request = new CurlRequest('https://api.github.com/user', 'etag-1', 'tok', $callback);
+
+        $this->assertSame('https://api.github.com/user', $request->url);
+        $this->assertSame('etag-1', $request->etag);
+        $this->assertSame('tok', $request->token);
+        $this->assertSame($callback, $request->callback);
+    }
+
+    public function testTokenMayBeNullForUnauthenticatedRequests(): void
+    {
+        $request = new CurlRequest('https://api.github.com/', null, null, static function () {});
+
+        $this->assertNull($request->token);
+        $this->assertNull($request->etag);
+    }
+}
diff --git a/tests/ItemRenderTest.php b/tests/ItemRenderTest.php
new file mode 100644
index 0000000..b9813dd
--- /dev/null
+++ b/tests/ItemRenderTest.php
@@ -0,0 +1,125 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Characterization tests for Item::toXml. The XML structure, attribute
+ * ordering, escaping, and the baseUrl-prefix/enterprise-prefix rules are
+ * exercised against fixed inputs so that any accidental drift shows up as
+ * a diff in CI.
+ */
+final class ItemRenderTest extends TestCase
+{
+    public function testMinimalItemProducesExpectedXml(): void
+    {
+        $item = Item::create()->title('repo');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $expectedUid = md5('repo');
+        $expected = '<?xml version="1.0"?>'."\n".
+            '<items><item uid="'.$expectedUid.'" autocomplete=" repo"><icon>icon.png</icon><title>repo</title></item></items>'."\n";
+
+        $this->assertSame($expected, $xml);
+    }
+
+    public function testAbsolutePathArgIsPrefixedWithBaseUrl(): void
+    {
+        $item = Item::create()->title('repo')->arg('/owner/repo');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('arg="https://github.com/owner/repo"', $xml);
+    }
+
+    public function testEnterpriseFlagPrefixesNonUrlArg(): void
+    {
+        $item = Item::create()->title('search')->arg('foo bar');
+        $xml = Item::toXml([$item], true, false, 'https://ghe.example.com');
+
+        $this->assertStringContainsString('arg="e foo bar"', $xml);
+    }
+
+    public function testNonEnterpriseDoesNotPrefixArg(): void
+    {
+        $item = Item::create()->title('search')->arg('foo bar');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('arg="foo bar"', $xml);
+    }
+
+    public function testAbsoluteUrlArgIsUsedVerbatim(): void
+    {
+        $item = Item::create()->title('site')->arg('https://example.com/thing');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('arg="https://example.com/thing"', $xml);
+    }
+
+    public function testInvalidItemAppendsEllipsisAndValidNo(): void
+    {
+        $item = Item::create()->title('partial')->valid(false);
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('valid="no"', $xml);
+        $this->assertStringContainsString('<title>partial&#x2026;</title>', $xml);
+    }
+
+    public function testInvalidItemUsesCustomSuffix(): void
+    {
+        $item = Item::create()->title('type')->valid(false, ' more');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('<title>type more</title>', $xml);
+    }
+
+    public function testSubtitleAndTitleAreHtmlEscaped(): void
+    {
+        $item = Item::create()->title('<b>bold</b>')->subtitle('a & b');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('<title>&lt;b&gt;bold&lt;/b&gt;</title>', $xml);
+        $this->assertStringContainsString('<subtitle>a &amp; b</subtitle>', $xml);
+    }
+
+    public function testHotkeyFlagStripsLeadingAutocompleteSpace(): void
+    {
+        $item = Item::create()->title('repo');
+        $xml = Item::toXml([$item], false, true, 'https://github.com');
+
+        $this->assertStringContainsString('autocomplete="repo"', $xml);
+    }
+
+    public function testPrefixIsIncludedInDisplayTitleButNotAutocompleteByDefault(): void
+    {
+        $item = Item::create()->prefix('gh ')->title('repo');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('<title>gh repo</title>', $xml);
+        $this->assertStringContainsString('autocomplete=" repo"', $xml);
+    }
+
+    public function testPrefixIncludedInAutocompleteWhenNotOnlyTitle(): void
+    {
+        $item = Item::create()->prefix('gh ', false)->title('repo');
+        $xml = Item::toXml([$item], false, false, 'https://github.com');
+
+        $this->assertStringContainsString('autocomplete=" gh repo"', $xml);
+    }
+
+    public function testMultipleItemsAreEmittedInOrder(): void
+    {
+        $items = [
+            Item::create()->title('first'),
+            Item::create()->title('second'),
+            Item::create()->title('third'),
+        ];
+        $xml = Item::toXml($items, false, false, 'https://github.com');
+
+        $firstPos = strpos($xml, '<title>first</title>');
+        $secondPos = strpos($xml, '<title>second</title>');
+        $thirdPos = strpos($xml, '<title>third</title>');
+
+        $this->assertNotFalse($firstPos);
+        $this->assertLessThan($secondPos, $firstPos);
+        $this->assertLessThan($thirdPos, $secondPos);
+    }
+}
diff --git a/tests/RequestCachePartitionTest.php b/tests/RequestCachePartitionTest.php
new file mode 100644
index 0000000..5de9555
--- /dev/null
+++ b/tests/RequestCachePartitionTest.php
@@ -0,0 +1,199 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class RequestCachePartitionTest extends WorkflowTestCase
+{
+    public function testRequestCacheHasAccountIdColumn(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $columns = $pdo->query('PRAGMA table_info(request_cache)')->fetchAll(PDO::FETCH_ASSOC);
+
+        $this->assertContains('account_id', array_column($columns, 'name'));
+    }
+
+    public function testRequestCachePrimaryKeyIncludesAccountId(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $columns = $pdo->query('PRAGMA table_info(request_cache)')->fetchAll(PDO::FETCH_ASSOC);
+
+        $pkColumns = [];
+        foreach ($columns as $column) {
+            if ((int) $column['pk'] > 0) {
+                $pkColumns[(int) $column['pk']] = $column['name'];
+            }
+        }
+        ksort($pkColumns);
+
+        $this->assertSame(['account_id', 'url'], array_values($pkColumns));
+    }
+
+    public function testSameUrlCanBeCachedForTwoAccounts(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+
+        $insert = $pdo->prepare(
+            'REPLACE INTO request_cache (account_id, url, timestamp, etag, content, refresh, parent) VALUES (?, ?, ?, ?, ?, ?, ?)'
+        );
+        $insert->execute([1, 'https://api.github.com/user', time(), null, '{"login":"a"}', 0, null]);
+        $insert->execute([2, 'https://api.github.com/user', time(), null, '{"login":"b"}', 0, null]);
+
+        $rows = $pdo->query('SELECT account_id, content FROM request_cache ORDER BY account_id')->fetchAll(PDO::FETCH_ASSOC);
+        $this->assertCount(2, $rows);
+        $this->assertSame('{"login":"a"}', $rows[0]['content']);
+        $this->assertSame('{"login":"b"}', $rows[1]['content']);
+    }
+
+    public function testParentUrlIndexStillExists(): void
+    {
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $row = $pdo->query("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'parent_url'")->fetch(PDO::FETCH_ASSOC);
+
+        $this->assertIsArray($row);
+        $this->assertStringContainsString('request_cache', $row['sql']);
+        $this->assertStringContainsString('parent', $row['sql']);
+    }
+
+    public function testLegacyDatabaseWithoutAccountIdIsMigrated(): void
+    {
+        // Simulate a pre-PR-#2 DB: old request_cache schema, with data rows.
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->exec('
+            CREATE TABLE config (key TEXT PRIMARY KEY NOT NULL, value TEXT) WITHOUT ROWID
+        ');
+        $pdo->exec('
+            CREATE TABLE request_cache (
+                url TEXT PRIMARY KEY NOT NULL,
+                timestamp INTEGER NOT NULL,
+                etag TEXT,
+                content TEXT,
+                refresh INTEGER,
+                parent TEXT
+            ) WITHOUT ROWID
+        ');
+        $pdo->exec('CREATE INDEX parent_url ON request_cache(parent) WHERE parent IS NOT NULL');
+        $pdo->exec("INSERT INTO request_cache VALUES ('https://api.github.com/user', ".time().", NULL, '{\"login\":\"legacy\"}', 0, NULL)");
+        $pdo = null;
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $columns = $pdo->query('PRAGMA table_info(request_cache)')->fetchAll(PDO::FETCH_ASSOC);
+        $this->assertContains('account_id', array_column($columns, 'name'));
+
+        $row = $pdo->query('SELECT account_id, url, content FROM request_cache')->fetch(PDO::FETCH_ASSOC);
+        $this->assertSame(0, (int) $row['account_id']);
+        $this->assertSame('https://api.github.com/user', $row['url']);
+        $this->assertSame('{"login":"legacy"}', $row['content']);
+    }
+
+    public function testMigrationIsIdempotent(): void
+    {
+        // After one migration run, a second init() must not rebuild again.
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->prepare(
+            'REPLACE INTO request_cache (account_id, url, timestamp, etag, content, refresh, parent) VALUES (?, ?, ?, ?, ?, ?, ?)'
+        )->execute([42, 'https://example.com', time(), null, 'data', 0, null]);
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $row = $pdo->query("SELECT account_id, content FROM request_cache WHERE url = 'https://example.com'")->fetch(PDO::FETCH_ASSOC);
+        $this->assertSame(42, (int) $row['account_id']);
+        $this->assertSame('data', $row['content']);
+
+        // Affirmative check: if migration ran again, request_cache_new would transiently exist
+        // during the transaction. Since we use BEGIN/COMMIT, post-commit it won't be present
+        // either way — but an orphan left behind by a crashed rename would stick around.
+        $orphan = $pdo->query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'request_cache_new'")->fetchColumn();
+        $this->assertFalse($orphan, 'request_cache_new must not exist after an idempotent second init');
+    }
+
+    public function testResolveAccountIdForCacheReturnsZeroInEnterpriseMode(): void
+    {
+        // Even with an active github account, an enterprise init() must produce
+        // account_id=0 for request_cache entries, per spec.
+        Workflow::init();
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->exec("INSERT INTO accounts (label, token, is_active, created_at) VALUES ('gh', 'tok', 1, 1)");
+        Workflow::setConfig('enterprise_url', 'https://ghe.example.com');
+
+        agw_test_reset_workflow();
+        Workflow::init(true);
+
+        // We cannot call the private resolveAccountIdForCache directly. Instead,
+        // insert a row through the lower-level REPLACE and verify by reading it back.
+        // Since requestCache() is network-bound, we can only exercise resolveAccountIdForCache
+        // indirectly by confirming that any existing cache behavior in enterprise mode
+        // uses account_id=0. A simple way: manually INSERT through the code path is not
+        // possible without a network call; instead, use reflection to invoke the private
+        // method directly.
+        $reflection = new ReflectionMethod(Workflow::class, 'resolveAccountIdForCache');
+        $accountId = $reflection->invoke(null);
+
+        $this->assertSame(0, $accountId, 'Enterprise mode must map to sentinel account_id=0');
+    }
+
+    public function testResolveAccountIdForCacheReturnsActiveAccountIdInGithubMode(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', 'tok-a');
+        Workflow::setActiveAccount($id);
+
+        $reflection = new ReflectionMethod(Workflow::class, 'resolveAccountIdForCache');
+        $accountId = $reflection->invoke(null);
+
+        $this->assertSame($id, $accountId, 'Github mode must return the active account id');
+    }
+
+    public function testResolveAccountIdForCacheReturnsZeroWhenNoActiveAccount(): void
+    {
+        Workflow::init();
+
+        $reflection = new ReflectionMethod(Workflow::class, 'resolveAccountIdForCache');
+        $accountId = $reflection->invoke(null);
+
+        $this->assertSame(0, $accountId, 'No active account must fall back to sentinel 0');
+    }
+
+    public function testParentUrlIndexSurvivesMigration(): void
+    {
+        // Seed a legacy DB, run migration, confirm parent_url index is still there.
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+        $pdo->exec('
+            CREATE TABLE config (key TEXT PRIMARY KEY NOT NULL, value TEXT) WITHOUT ROWID
+        ');
+        $pdo->exec('
+            CREATE TABLE request_cache (
+                url TEXT PRIMARY KEY NOT NULL,
+                timestamp INTEGER NOT NULL,
+                etag TEXT,
+                content TEXT,
+                refresh INTEGER,
+                parent TEXT
+            ) WITHOUT ROWID
+        ');
+        $pdo->exec('CREATE INDEX parent_url ON request_cache(parent) WHERE parent IS NOT NULL');
+        $pdo = null;
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $row = $pdo->query("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'parent_url'")->fetch(PDO::FETCH_ASSOC);
+        $this->assertIsArray($row);
+        $this->assertStringContainsString('parent', $row['sql']);
+    }
+}
diff --git a/tests/SearchHeaderTest.php b/tests/SearchHeaderTest.php
new file mode 100644
index 0000000..9a5b696
--- /dev/null
+++ b/tests/SearchHeaderTest.php
@@ -0,0 +1,28 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class SearchHeaderTest extends WorkflowTestCase
+{
+    public function testRenderGhHeaderReturnsPlainGhWhenNoActiveAccount(): void
+    {
+        Workflow::init();
+
+        $reflection = new ReflectionMethod(Search::class, 'renderGhHeader');
+        $result = $reflection->invoke(null);
+
+        $this->assertSame('gh', $result);
+    }
+
+    public function testRenderGhHeaderShowsActiveLabelInParens(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('dokun1', 'tok');
+        Workflow::setActiveAccount($id);
+
+        $reflection = new ReflectionMethod(Search::class, 'renderGhHeader');
+        $result = $reflection->invoke(null);
+
+        $this->assertSame('gh (dokun1)', $result);
+    }
+}
diff --git a/tests/WorkflowConfigTest.php b/tests/WorkflowConfigTest.php
new file mode 100644
index 0000000..0a439da
--- /dev/null
+++ b/tests/WorkflowConfigTest.php
@@ -0,0 +1,43 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+final class WorkflowConfigTest extends WorkflowTestCase
+{
+    public function testSetAndGetConfigRoundTrip(): void
+    {
+        Workflow::init();
+
+        Workflow::setConfig('greeting', 'hello');
+
+        $this->assertSame('hello', Workflow::getConfig('greeting'));
+    }
+
+    public function testGetConfigReturnsDefaultWhenMissing(): void
+    {
+        Workflow::init();
+
+        $this->assertNull(Workflow::getConfig('missing'));
+        $this->assertSame('fallback', Workflow::getConfig('missing', 'fallback'));
+    }
+
+    public function testSetConfigOverwritesExistingValue(): void
+    {
+        Workflow::init();
+
+        Workflow::setConfig('k', 'v1');
+        Workflow::setConfig('k', 'v2');
+
+        $this->assertSame('v2', Workflow::getConfig('k'));
+    }
+
+    public function testRemoveConfigDeletesKey(): void
+    {
+        Workflow::init();
+
+        Workflow::setConfig('k', 'v');
+        Workflow::removeConfig('k');
+
+        $this->assertNull(Workflow::getConfig('k'));
+    }
+}
diff --git a/tests/WorkflowEnterpriseUrlTest.php b/tests/WorkflowEnterpriseUrlTest.php
new file mode 100644
index 0000000..cf37632
--- /dev/null
+++ b/tests/WorkflowEnterpriseUrlTest.php
@@ -0,0 +1,58 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+/**
+ * Pins the URL derivation performed by Workflow::init when the enterprise
+ * flag is set: baseUrl is read from the enterprise_url config key, and the
+ * API/gist URLs are derived from it. When no config value is present the
+ * derived URLs become null — this is the current (pre-multi-account) shape
+ * and callers depend on it.
+ */
+final class WorkflowEnterpriseUrlTest extends WorkflowTestCase
+{
+    public function testDefaultGithubUrls(): void
+    {
+        Workflow::init();
+
+        $this->assertSame('https://github.com', Workflow::getBaseUrl());
+        $this->assertSame('https://api.github.com', Workflow::getApiUrl());
+        $this->assertSame('https://gist.github.com', Workflow::getGistUrl());
+    }
+
+    public function testEnterpriseUrlsDerivedFromConfig(): void
+    {
+        Workflow::init();
+        Workflow::setConfig('enterprise_url', 'https://ghe.example.com');
+
+        agw_test_reset_workflow();
+        Workflow::init(true);
+
+        $this->assertSame('https://ghe.example.com', Workflow::getBaseUrl());
+        $this->assertSame('https://ghe.example.com/api/v3', Workflow::getApiUrl());
+        $this->assertSame('https://ghe.example.com/gist', Workflow::getGistUrl());
+    }
+
+    public function testEnterpriseUrlsAreNullWhenConfigMissing(): void
+    {
+        Workflow::init(true);
+
+        $this->assertNull(Workflow::getBaseUrl());
+        $this->assertNull(Workflow::getApiUrl());
+        $this->assertNull(Workflow::getGistUrl());
+    }
+
+    public function testGetApiUrlAppendsPathAndPerPage(): void
+    {
+        Workflow::init();
+
+        $this->assertSame(
+            'https://api.github.com/user/repos?per_page=100',
+            Workflow::getApiUrl('/user/repos')
+        );
+        $this->assertSame(
+            'https://api.github.com/search/repositories?q=foo&per_page=100',
+            Workflow::getApiUrl('/search/repositories?q=foo')
+        );
+    }
+}
diff --git a/tests/WorkflowSchemaTest.php b/tests/WorkflowSchemaTest.php
new file mode 100644
index 0000000..809d9c9
--- /dev/null
+++ b/tests/WorkflowSchemaTest.php
@@ -0,0 +1,97 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+/**
+ * Pins the SQLite schema that Workflow::init creates on a fresh database,
+ * plus the fact that init is safe to call against an existing database
+ * without recreating tables. Multi-account work will alter request_cache;
+ * these assertions are the canary for that migration.
+ */
+final class WorkflowSchemaTest extends WorkflowTestCase
+{
+    public function testInitCreatesConfigTableWithExpectedColumns(): void
+    {
+        Workflow::init();
+
+        $columns = $this->tableColumns('config');
+
+        $this->assertSame(['key', 'value'], array_column($columns, 'name'));
+        $this->assertSame(1, $this->columnByName($columns, 'key')['pk']);
+        $this->assertSame(1, $this->columnByName($columns, 'key')['notnull']);
+    }
+
+    public function testInitCreatesRequestCacheTableWithExpectedColumns(): void
+    {
+        Workflow::init();
+
+        $columns = $this->tableColumns('request_cache');
+
+        $this->assertSame(
+            ['account_id', 'url', 'timestamp', 'etag', 'content', 'refresh', 'parent'],
+            array_column($columns, 'name')
+        );
+        // Composite primary key (account_id, url) — account_id is pk=1, url is pk=2.
+        $this->assertSame(1, $this->columnByName($columns, 'account_id')['pk']);
+        $this->assertSame(2, $this->columnByName($columns, 'url')['pk']);
+    }
+
+    public function testInitCreatesParentUrlIndex(): void
+    {
+        Workflow::init();
+
+        $pdo = $this->db();
+        $row = $pdo->query("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'parent_url'")->fetch(PDO::FETCH_ASSOC);
+
+        $this->assertIsArray($row);
+        $this->assertStringContainsString('request_cache', $row['sql']);
+        $this->assertStringContainsString('parent', $row['sql']);
+    }
+
+    public function testInitIsIdempotentAcrossReopen(): void
+    {
+        Workflow::init();
+        Workflow::setConfig('persisted', 'yes');
+
+        agw_test_reset_workflow();
+        Workflow::init();
+
+        $this->assertSame('yes', Workflow::getConfig('persisted'));
+
+        $columns = $this->tableColumns('config');
+        $this->assertSame(['key', 'value'], array_column($columns, 'name'));
+    }
+
+    private function db(): PDO
+    {
+        return new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+    }
+
+    /** @return array<int,array{name:string,pk:int,notnull:int}> */
+    private function tableColumns(string $table): array
+    {
+        $stmt = $this->db()->query('PRAGMA table_info('.$table.')');
+        $columns = [];
+        foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $row) {
+            $columns[] = [
+                'name' => $row['name'],
+                'pk' => (int) $row['pk'],
+                'notnull' => (int) $row['notnull'],
+            ];
+        }
+
+        return $columns;
+    }
+
+    /** @param array<int,array{name:string,pk:int,notnull:int}> $columns */
+    private function columnByName(array $columns, string $name): array
+    {
+        foreach ($columns as $column) {
+            if ($column['name'] === $name) {
+                return $column;
+            }
+        }
+
+        $this->fail('Column '.$name.' not found');
+    }
+}
diff --git a/tests/WorkflowTestCase.php b/tests/WorkflowTestCase.php
new file mode 100644
index 0000000..04fcbeb
--- /dev/null
+++ b/tests/WorkflowTestCase.php
@@ -0,0 +1,39 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Base test case that gives each test a fresh Workflow data directory and
+ * resets the static Workflow state. Workflow is a static class, so without
+ * this its SQLite handle and cached prepared statements would leak between
+ * tests.
+ */
+abstract class WorkflowTestCase extends TestCase
+{
+    /** @var string */
+    protected $dataDir;
+
+    protected function setUp(): void
+    {
+        $this->dataDir = agw_test_tmp_dir();
+        putenv('alfred_workflow_data='.$this->dataDir);
+        agw_test_reset_workflow();
+    }
+
+    protected function getAccountToken(string $label): ?string
+    {
+        $pdo = new PDO('sqlite:'.$this->dataDir.'/db.sqlite');
+        $stmt = $pdo->prepare('SELECT token FROM accounts WHERE label = ?');
+        $stmt->execute([$label]);
+        $token = $stmt->fetchColumn();
+
+        return false !== $token ? $token : null;
+    }
+
+    protected function tearDown(): void
+    {
+        agw_test_reset_workflow();
+        putenv('alfred_workflow_data');
+        agw_test_rmrf($this->dataDir);
+    }
+}
diff --git a/tests/WorkflowTokenTest.php b/tests/WorkflowTokenTest.php
new file mode 100644
index 0000000..bc39949
--- /dev/null
+++ b/tests/WorkflowTokenTest.php
@@ -0,0 +1,178 @@
+<?php
+
+require_once __DIR__.'/WorkflowTestCase.php';
+
+/**
+ * Pins the dual-slot token behavior: the github.com token and the enterprise
+ * token live in two separate config keys and MUST NOT collide. Multi-account
+ * work (PR #2) will change the storage model; these tests ensure the
+ * migration preserves the current isolation guarantees.
+ */
+final class WorkflowTokenTest extends WorkflowTestCase
+{
+    public function testGithubTokenStoredInActiveAccount(): void
+    {
+        Workflow::init();
+
+        Workflow::setAccessToken('gh-token');
+
+        $this->assertSame('gh-token', Workflow::getAccessToken());
+        $active = Workflow::getActiveAccount();
+        $this->assertNotNull($active);
+        $this->assertSame('default', $active['label']);
+        $this->assertSame('gh-token', $active['token']);
+        $this->assertNull(Workflow::getConfig('enterprise_access_token'));
+    }
+
+    public function testEnterpriseTokenStoredUnderEnterpriseKey(): void
+    {
+        Workflow::init(true);
+
+        Workflow::setAccessToken('ghe-token');
+
+        $this->assertSame('ghe-token', Workflow::getAccessToken());
+        $this->assertSame('ghe-token', Workflow::getConfig('enterprise_access_token'));
+        $this->assertNull(Workflow::getConfig('access_token'));
+    }
+
+    public function testGithubAndEnterpriseTokensDoNotCollide(): void
+    {
+        Workflow::init();
+        Workflow::setAccessToken('gh-token');
+
+        agw_test_reset_workflow();
+        Workflow::init(true);
+        Workflow::setAccessToken('ghe-token');
+
+        $this->assertSame('ghe-token', Workflow::getAccessToken());
+
+        agw_test_reset_workflow();
+        Workflow::init();
+        $this->assertSame('gh-token', Workflow::getAccessToken());
+    }
+
+    public function testRemoveAccessTokenOnlyAffectsActiveSlot(): void
+    {
+        Workflow::init();
+        Workflow::setAccessToken('gh-token');
+
+        agw_test_reset_workflow();
+        Workflow::init(true);
+        Workflow::setAccessToken('ghe-token');
+        Workflow::removeAccessToken();
+
+        $this->assertNull(Workflow::getAccessToken());
+
+        agw_test_reset_workflow();
+        Workflow::init();
+        $this->assertSame('gh-token', Workflow::getAccessToken());
+    }
+
+    public function testGithubSetAccessTokenCreatesDefaultAccountWhenNoneActive(): void
+    {
+        Workflow::init();
+        Workflow::setAccessToken('fresh-token');
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('default', $accounts[0]['label']);
+        $this->assertSame('fresh-token', $this->getAccountToken('default'));
+        $this->assertSame(1, (int) $accounts[0]['is_active']);
+    }
+
+    public function testGithubSetAccessTokenUpdatesActiveAccountWhenOneExists(): void
+    {
+        Workflow::init();
+        Workflow::setAccessToken('first-token');
+        Workflow::setAccessToken('second-token');
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('second-token', $this->getAccountToken('default'));
+    }
+
+    public function testGithubRemoveAccessTokenClearsTokenButKeepsRow(): void
+    {
+        Workflow::init();
+        Workflow::setAccessToken('to-be-removed');
+        Workflow::removeAccessToken();
+
+        $this->assertNull(Workflow::getAccessToken());
+        // Row is preserved so the label survives re-login
+        $this->assertCount(1, Workflow::listAccounts());
+    }
+
+    public function testGetAccessTokenReturnsNullForEmptyStringToken(): void
+    {
+        Workflow::init();
+        $id = Workflow::addAccount('alice', '');
+        Workflow::setActiveAccount($id);
+
+        $this->assertNull(Workflow::getAccessToken());
+    }
+
+    public function testGithubRemoveAccessTokenIsNoOpWhenNoActiveAccount(): void
+    {
+        Workflow::init();
+        Workflow::removeAccessToken(); // must not throw
+        $this->assertNull(Workflow::getAccessToken());
+    }
+
+    public function testGithubSetAccessTokenRecoversExistingInactiveDefaultAccount(): void
+    {
+        Workflow::init();
+        // Seed a 'default' account but leave it INACTIVE
+        $id = Workflow::addAccount('default', 'old-token');
+        // Verify there is no active account
+        $this->assertNull(Workflow::getActiveAccount());
+
+        // setAccessToken must find the existing 'default' row and reuse it
+        Workflow::setAccessToken('new-token');
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('default', $accounts[0]['label']);
+        $this->assertSame('new-token', $this->getAccountToken('default'));
+        $this->assertSame(1, (int) $accounts[0]['is_active']);
+    }
+
+    public function testGithubSetAccessTokenRecoversPostLogoutDefaultAccount(): void
+    {
+        Workflow::init();
+        // Log in, then log out (clears token to '' but keeps row active)
+        Workflow::setAccessToken('original');
+        Workflow::removeAccessToken();
+
+        // Log in again — should reuse the same row
+        Workflow::setAccessToken('fresh-login');
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('default', $accounts[0]['label']);
+        $this->assertSame('fresh-login', $this->getAccountToken('default'));
+        $this->assertSame(1, (int) $accounts[0]['is_active']);
+    }
+
+    public function testLegacyLoginCommandCreatesDefaultAccount(): void
+    {
+        Workflow::init();
+        Action::dispatch(['>', 'login', 'brand-new-token'], false);
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts);
+        $this->assertSame('default', $accounts[0]['label']);
+        $this->assertSame('brand-new-token', $this->getAccountToken('default'));
+        $this->assertSame(1, (int) $accounts[0]['is_active']);
+    }
+
+    public function testLegacyLogoutClearsTokenButKeepsAccount(): void
+    {
+        Workflow::init();
+        Action::dispatch(['>', 'login', 'tok'], false);
+        Action::dispatch(['>', 'logout'], false);
+
+        $accounts = Workflow::listAccounts();
+        $this->assertCount(1, $accounts); // account row preserved
+        $this->assertNull(Workflow::getAccessToken()); // but no usable token
+    }
+}
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
new file mode 100644
index 0000000..8aa47e5
--- /dev/null
+++ b/tests/bootstrap.php
@@ -0,0 +1,75 @@
+<?php
+
+// workflow.php uses relative requires for item.php and curl.php, so the
+// include path must point at the repo root when it is loaded.
+chdir(__DIR__.'/..');
+require __DIR__.'/../workflow.php';
+require __DIR__.'/../action.php';
+require __DIR__.'/../search.php';
+Action::$skipDialogs = true;
+
+/**
+ * Create a fresh temp directory that will be used as alfred_workflow_data.
+ * Each test gets its own directory to prevent SQLite file collisions and
+ * to keep tests independent of one another.
+ */
+function agw_test_tmp_dir(): string
+{
+    $dir = sys_get_temp_dir().'/agw-test-'.bin2hex(random_bytes(8));
+    mkdir($dir, 0755, true);
+
+    return $dir;
+}
+
+/**
+ * Recursively remove a test directory.
+ */
+function agw_test_rmrf(string $dir): void
+{
+    if (!is_dir($dir)) {
+        return;
+    }
+    foreach (scandir($dir) as $entry) {
+        if ('.' === $entry || '..' === $entry) {
+            continue;
+        }
+        $path = $dir.'/'.$entry;
+        if (is_dir($path)) {
+            agw_test_rmrf($path);
+        } else {
+            unlink($path);
+        }
+    }
+    rmdir($dir);
+}
+
+/**
+ * Reset the static state of the Workflow class between tests. Because
+ * Workflow is a singleton-style static class, state leaks between tests
+ * otherwise — fresh SQLite handles, urls, and item buffers are required.
+ */
+function agw_test_reset_workflow(): void
+{
+    $ref = new ReflectionClass(Workflow::class);
+    $resets = [
+        'filePids' => null,
+        'fileDb' => null,
+        'db' => null,
+        'statements' => [],
+        'enterprise' => null,
+        'baseUrl' => 'https://github.com',
+        'apiUrl' => 'https://api.github.com',
+        'gistUrl' => 'https://gist.github.com',
+        'query' => null,
+        'hotkey' => null,
+        'items' => [],
+        'refreshUrls' => [],
+        'debug' => false,
+    ];
+    foreach ($resets as $name => $value) {
+        if ($ref->hasProperty($name)) {
+            $prop = $ref->getProperty($name);
+            $prop->setValue(null, $value);
+        }
+    }
+}
diff --git a/workflow.php b/workflow.php
index 9017ca9..5131cb7 100644
--- a/workflow.php
+++ b/workflow.php
@@ -58,6 +58,13 @@ public static function init($enterprise = false, $query = null, $hotkey = false)
             self::createTables();
         }
 
+        self::ensureAccountsTable();
+        self::migrateRequestCacheSchema();
+
+        if (!self::$enterprise) {
+            self::migrateLegacyAccessToken();
+        }
+
         if (self::$enterprise) {
             self::$baseUrl = self::getConfig('enterprise_url');
             self::$apiUrl = self::$baseUrl ? self::$baseUrl.'/api/v3' : null;
@@ -121,17 +128,122 @@ public static function getGistUrl()
 
     public static function setAccessToken($token)
     {
-        self::setConfig(self::$enterprise ? 'enterprise_access_token' : 'access_token', $token);
+        if (self::$enterprise) {
+            self::setConfig('enterprise_access_token', $token);
+
+            return;
+        }
+        $active = self::getActiveAccount();
+        if ($active) {
+            self::updateAccountToken((int) $active['id'], $token);
+
+            return;
+        }
+        $stmt = self::$db->prepare('SELECT id FROM accounts WHERE label = ?');
+        $stmt->execute(['default']);
+        $existingId = $stmt->fetchColumn();
+        if (false !== $existingId) {
+            self::updateAccountToken((int) $existingId, $token);
+            self::setActiveAccount((int) $existingId);
+
+            return;
+        }
+        $id = self::addAccount('default', $token);
+        self::setActiveAccount($id);
     }
 
     public static function getAccessToken()
     {
-        return self::getConfig(self::$enterprise ? 'enterprise_access_token' : 'access_token');
+        if (self::$enterprise) {
+            return self::getConfig('enterprise_access_token');
+        }
+        $account = self::getActiveAccount();
+        if (!$account) {
+            return null;
+        }
+
+        return '' !== $account['token'] ? $account['token'] : null;
     }
 
     public static function removeAccessToken()
     {
-        self::removeConfig(self::$enterprise ? 'enterprise_access_token' : 'access_token');
+        if (self::$enterprise) {
+            self::removeConfig('enterprise_access_token');
+
+            return;
+        }
+        $active = self::getActiveAccount();
+        if ($active) {
+            self::updateAccountToken((int) $active['id'], '');
+        }
+    }
+
+    public static function addAccount(string $label, string $token): int
+    {
+        $stmt = self::$db->prepare(
+            'INSERT INTO accounts (label, token, is_active, created_at) VALUES (?, ?, 0, ?)'
+        );
+        $stmt->execute([$label, $token, time()]);
+        return (int) self::$db->lastInsertId();
+    }
+
+    public static function listAccounts(): array
+    {
+        $rows = self::$db->query(
+            'SELECT id, label, is_active, created_at FROM accounts ORDER BY label'
+        )->fetchAll(PDO::FETCH_ASSOC);
+        return $rows ?: [];
+    }
+
+    public static function getActiveAccount(): ?array
+    {
+        $row = self::$db->query(
+            'SELECT id, label, token, is_active, created_at FROM accounts WHERE is_active = 1 LIMIT 1'
+        )->fetch(PDO::FETCH_ASSOC);
+        return $row ?: null;
+    }
+
+    public static function setActiveAccount(int $id): void
+    {
+        self::$db->beginTransaction();
+        try {
+            self::$db->exec('UPDATE accounts SET is_active = 0 WHERE is_active = 1');
+            $stmt = self::$db->prepare('UPDATE accounts SET is_active = 1 WHERE id = ?');
+            $stmt->execute([$id]);
+            if (0 === $stmt->rowCount()) {
+                throw new RuntimeException('Account not found: '.$id);
+            }
+            self::$db->commit();
+        } catch (Throwable $e) {
+            self::$db->rollBack();
+            throw $e;
+        }
+    }
+
+    public static function removeAccount(int $id): void
+    {
+        $active = self::getActiveAccount();
+        if ($active && (int) $active['id'] === $id) {
+            throw new RuntimeException('Cannot remove active account — switch first');
+        }
+        self::$db->beginTransaction();
+        try {
+            self::$db->prepare('DELETE FROM request_cache WHERE account_id = ?')->execute([$id]);
+            self::$db->prepare('DELETE FROM accounts WHERE id = ?')->execute([$id]);
+            self::$db->commit();
+        } catch (Throwable $e) {
+            self::$db->rollBack();
+            throw $e;
+        }
+    }
+
+    public static function updateAccountToken(int $id, string $token): void
+    {
+        $stmt = self::$db->prepare('UPDATE accounts SET token = ? WHERE id = ?');
+        $stmt->execute([$token, $id]);
+        if (0 === $stmt->rowCount()) {
+            throw new RuntimeException('Account not found: '.$id);
+        }
     }
 
     public static function request(string $url, ?Curl $curl = null, $callback = null, bool $withAuthorization = true)
@@ -184,8 +296,10 @@ public static function requestCache(string $url, ?Curl $curl = null, $callback =
             };
         }
 
-        $stmt = self::getStatement('SELECT * FROM request_cache WHERE url = ?');
-        $stmt->execute([$url]);
+        $accountId = self::resolveAccountIdForCache();
+
+        $stmt = self::getStatement('SELECT * FROM request_cache WHERE account_id = ? AND url = ?');
+        $stmt->execute([$accountId, $url]);
         $stmt->bindColumn('timestamp', $timestamp);
         $stmt->bindColumn('etag', $etag);
         $stmt->bindColumn('content', $content);
@@ -196,7 +310,7 @@ public static function requestCache(string $url, ?Curl $curl = null, $callback =
         $refreshInBackground = $refreshInBackground && null !== $content;
 
         if ($shouldRefresh && $refreshInBackground && $refresh < time() - 3 * 60) {
-            self::getStatement('UPDATE request_cache SET refresh = ? WHERE url = ?')->execute([time(), $url]);
+            self::getStatement('UPDATE request_cache SET refresh = ? WHERE account_id = ? AND url = ?')->execute([time(), $accountId, $url]);
             self::$refreshUrls[$url] = true;
         }
 
@@ -205,8 +319,8 @@ public static function requestCache(string $url, ?Curl $curl = null, $callback =
             $content = json_decode($content);
 
             if (!$firstPageOnly) {
-                $stmt = self::getStatement('SELECT url, content FROM request_cache WHERE parent = ? ORDER BY `timestamp` DESC');
-                while ($stmt->execute([$url]) && $data = $stmt->fetchObject()) {
+                $stmt = self::getStatement('SELECT url, content FROM request_cache WHERE account_id = ? AND parent = ? ORDER BY `timestamp` DESC');
+                while ($stmt->execute([$accountId, $url]) && $data = $stmt->fetchObject()) {
                     $content = array_merge($content, json_decode($data->content));
                     $url = $data->url;
                 }
@@ -221,7 +335,7 @@ public static function requestCache(string $url, ?Curl $curl = null, $callback =
 
         $responses = [];
 
-        $handleResponse = static function (CurlResponse $response, $content, $parent = null) use (&$handleResponse, $curl, &$responses, $stmt, $callback, $firstPageOnly) {
+        $handleResponse = static function (CurlResponse $response, $content, $parent = null) use (&$handleResponse, $curl, &$responses, $stmt, $callback, $firstPageOnly, $accountId) {
             $url = $response->request->url;
             if ($response && in_array($response->status, [200, 304])) {
                 $checkNext = false;
@@ -236,14 +350,14 @@ public static function requestCache(string $url, ?Curl $curl = null, $callback =
                     $response->content = $response->content->items;
                 }
                 $responses[] = $response->content;
-                self::getStatement('REPLACE INTO request_cache VALUES(?, ?, ?, ?, 0, ?)')
-                    ->execute([$url, time(), $response->etag, json_encode($response->content), $parent]);
+                self::getStatement('REPLACE INTO request_cache VALUES(?, ?, ?, ?, ?, 0, ?)')
+                    ->execute([$accountId, $url, time(), $response->etag, json_encode($response->content), $parent]);
 
                 if ($firstPageOnly) {
                     // do nothing
                 } elseif ($checkNext || $response->link && preg_match('/<([^<>]+)>; rel="next"/U', $response->link, $match)) {
-                    $stmt = self::getStatement('SELECT * FROM request_cache WHERE parent = ?');
-                    $stmt->execute([$url]);
+                    $stmt = self::getStatement('SELECT * FROM request_cache WHERE account_id = ? AND parent = ?');
+                    $stmt->execute([$accountId, $url]);
                     if ($checkNext) {
                         $stmt->bindColumn('url', $nextUrl);
                     } else {
@@ -260,10 +374,10 @@ public static function requestCache(string $url, ?Curl $curl = null, $callback =
                         return;
                     }
                 } else {
-                    self::getStatement('DELETE FROM request_cache WHERE parent = ?')->execute([$url]);
+                    self::getStatement('DELETE FROM request_cache WHERE account_id = ? AND parent = ?')->execute([$accountId, $url]);
                 }
             } else {
-                self::getStatement('DELETE FROM request_cache WHERE url = ?')->execute([$url]);
+                self::getStatement('DELETE FROM request_cache WHERE account_id = ? AND url = ?')->execute([$accountId, $url]);
                 $url = null;
             }
 
@@ -373,22 +487,123 @@ private static function createTables()
 
         self::$db->exec('
             CREATE TABLE request_cache (
-                url TEXT PRIMARY KEY NOT NULL,
+                account_id INTEGER NOT NULL DEFAULT 0,
+                url TEXT NOT NULL,
                 timestamp INTEGER NOT NULL,
                 etag TEXT,
                 content TEXT,
                 refresh INTEGER,
-                parent TEXT
+                parent TEXT,
+                PRIMARY KEY (account_id, url)
             ) WITHOUT ROWID
         ');
         self::$db->exec('CREATE INDEX parent_url ON request_cache(parent) WHERE parent IS NOT NULL');
     }
 
+    private static function ensureAccountsTable()
+    {
+        self::$db->exec('
+            CREATE TABLE IF NOT EXISTS accounts (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                label TEXT NOT NULL UNIQUE,
+                token TEXT NOT NULL,
+                is_active INTEGER NOT NULL DEFAULT 0,
+                created_at INTEGER NOT NULL
+            )
+        ');
+        self::$db->exec('
+            CREATE UNIQUE INDEX IF NOT EXISTS accounts_one_active
+                ON accounts(is_active) WHERE is_active = 1
+        ');
+    }
+
+    private static function migrateRequestCacheSchema()
+    {
+        $columns = self::$db->query('PRAGMA table_info(request_cache)')->fetchAll(PDO::FETCH_ASSOC);
+        if (!$columns) {
+            return;
+        }
+        foreach ($columns as $column) {
+            if ('account_id' === $column['name']) {
+                return;
+            }
+        }
+
+        self::$db->exec('BEGIN TRANSACTION');
+        try {
+            self::$db->exec('DROP TABLE IF EXISTS request_cache_new');
+            self::$db->exec('
+                CREATE TABLE request_cache_new (
+                    account_id INTEGER NOT NULL DEFAULT 0,
+                    url TEXT NOT NULL,
+                    timestamp INTEGER NOT NULL,
+                    etag TEXT,
+                    content TEXT,
+                    refresh INTEGER,
+                    parent TEXT,
+                    PRIMARY KEY (account_id, url)
+                ) WITHOUT ROWID
+            ');
+            self::$db->exec('
+                INSERT INTO request_cache_new (account_id, url, timestamp, etag, content, refresh, parent)
+                SELECT 0, url, timestamp, etag, content, refresh, parent FROM request_cache
+            ');
+            self::$db->exec('DROP INDEX IF EXISTS parent_url');
+            self::$db->exec('DROP TABLE request_cache');
+            self::$db->exec('ALTER TABLE request_cache_new RENAME TO request_cache');
+            self::$db->exec('CREATE INDEX parent_url ON request_cache(parent) WHERE parent IS NOT NULL');
+            self::$db->exec('COMMIT');
+        } catch (\Throwable $e) {
+            self::$db->exec('ROLLBACK');
+            throw $e;
+        }
+    }
+
+    private static function resolveAccountIdForCache()
+    {
+        if (self::$enterprise) {
+            return 0;
+        }
+        try {
+            $stmt = self::$db->query('SELECT id FROM accounts WHERE is_active = 1 LIMIT 1');
+            if ($stmt) {
+                $id = $stmt->fetchColumn();
+                if (false !== $id && null !== $id) {
+                    return (int) $id;
+                }
+            }
+        } catch (\PDOException $e) {
+            // accounts table missing or unreadable — fall through to legacy bucket
+        }
+
+        return 0;
+    }
+
+    private static function migrateLegacyAccessToken()
+    {
+        $count = (int) self::$db->query('SELECT COUNT(*) FROM accounts')->fetchColumn();
+        if ($count > 0) {
+            return;
+        }
+
+        $legacyToken = self::getConfig('access_token');
+        if (!$legacyToken) {
+            return;
+        }
+
+        $stmt = self::$db->prepare(
+            'INSERT INTO accounts (label, token, is_active, created_at) VALUES (?, ?, 1, ?)'
+        );
+        $stmt->execute(['default', $legacyToken, time()]);
+    }
+
     public static function deleteDatabase()
     {
+        // Release half-consumed cursors so the DELETEs below cannot hit a
+        // "database locked" error from an in-flight SELECT on request_cache.
         self::closeCursors();
-        self::$db = null;
-        unlink(self::$fileDb);
+        self::$db->exec('DELETE FROM request_cache');
+        self::$db->exec('DELETE FROM config');
     }
 
     public static function addItemIfMatches(Item $item)