## The message is server-side, not a CLI bug

`(re)link your GitHub account to continue` is **not** in the CLI repo. It's emitted by the EntireDB backend and passed through verbatim by `entire repo mirror create`.

**The path:**

1. **CLI** — `repo_mirror.go:140` `CreateMirror` POSTs the placement request to the cluster.
2. **Server** — `CreateMirrorPlacement` → `authorizeUserMirrorCreate` (`core/api/mirror_project.go:49`).
3. Your upstream is `github.com/**entirehq**/entire.io`. `entirehq` is a GitHub **org**, so it takes the `AccountTypeOrganization` branch → `requireRepoAdmin(ctx, claims, "entirehq", "entire.io")` (`mirror_project.go:65`).
4. `requireRepoAdmin` → `IsRepoAdmin` → **`resolve(ctx, account)`** (`adminchecker.go:160`), which needs your _personal_ GitHub login + a fresh access token to run the live admin check.
5. `resolve` fails and collapses to `ErrGitHubLinkRequired` for one of three reasons (`adminchecker.go:160-176`):
   - no `github` handle on your Entire account (`identity.ErrNotFound`)
   - no stored OAuth credential (`githubtokens.ErrNotLinked`)
   - GitHub rejected your refresh token (`githubtokens.ErrRefreshRevoked`)
6. `mirrorAdminCheckError` sees `IsGitHubLinkRequired(err) == true` and returns **HTTP 401** with `Message: "(re)link your GitHub account to continue"` (`mirror_project.go:173-177`).

## What it actually means

You _are_ logged into Entire (otherwise the request would 401 at the session gate before reaching this). The Entire account behind your **active auth context** has no usable GitHub link — so the server can't run the org-repo admin check that mirroring `entirehq/entire.io` requires. Mirroring an **org** repo demands a live GitHub repo-admin verdict using your personal token; mirroring your own user repo wouldn't hit this path.

## To resolve / diagnose further

- **Fix:** re-link GitHub for the active account (the OAuth link flow at entire.io, or whatever your re-link command is). After that, the admin check can run.
- **Which of the three conditions tripped** is deliberately collapsed in the user-facing message. To distinguish them you'd look at the server logs — but note `resolve` only logs for _other_ errors; the link-required branches return silently. The fastest client-side check: confirm which account `entire auth status` reports, then verify that account has a GitHub identity linked.

Want me to check your active auth context / which account is in play (`entire auth status`), or look at how the CLI renders this 401 to confirm nothing is being swallowed on the client side?