[Bug] GHE.com data residency: built-in PR/issue tools send unauthenticated requests to api.<tenant>.ghe.com (401/403), agent must fall back to gh CLI

[FBakkensen]

Short summary

Built-in PR/issue features send unauthenticated API requests to GHE.com (data residency) host, causing 401/403

Affected version or release

1.1.6 (commit a9706b2)

Installation context

Windows 11 x64. Signed in with a single GHE.com data-residency account (9altitudes.ghe.com), which also holds the Copilot subscription. A secondary github.com account is added but has no Copilot license.

What happened?

The app resolves the correct GHE.com host for its internal PR/issue tooling, but several internal API calls go out without credentials, so they fail with 401/403 anonymous-request errors:

• create_pull_request tool:

  github_app::tools::create_pull_request: Project account repair candidate could not inspect repository for PR creation
  login=FlemmingBK host=9altitudes.ghe.com
  error=github API request failed (401): Must authenticate to access this API.
  

• PR auto-link loop (github_api_external_created_pr_lookup) repeatedly fails:

  url=https://api.9altitudes.ghe.com/repositories/<id>/pulls
  status=403 error=github API rate limited (403): API rate limit exceeded for <client IP>.
  (But here's the good news: Authenticated requests get a higher rate limit...)
  

  The "rate limit exceeded for " wording confirms the request was anonymous.

Replaying the exact same URL (https://api.9altitudes.ghe.com/repositories/<id>) with the OAuth token the app itself provisioned (the one it injects as GH_TOKEN for sessions) succeeds — so the token is valid and has access; the app just does not attach it for these calls.

Net effect: built-in create-PR/issue features fail and the agent must fall back to the gh CLI, which works because GH_HOST/GH_TOKEN are injected correctly.

Request IDs (from github-app.<pid>.log):

• 403 anonymous: F874:EE0A5:C31A1:6D5050:6A787AE1 (2026-08-09 13:04:33 UTC)
• 401 create_pull_request: D0D6:9A8F9:25D76F:AAAC03:6A75EF50

Steps to reproduce

1. Sign in to the Copilot app with a GHE.com data-residency account only (Copilot subscription on that account).
2. Open a project session on a repo hosted on the GHE.com tenant, make a change.
3. Use the built-in create pull request flow (or let the app try to auto-link an externally created PR).
4. Observe 401/403 failures in ~/.copilot/logs/github-app.<pid>.log against api.<tenant>.ghe.com, and the agent falling back to gh.

Expected behavior

Internal API calls to api.<tenant>.ghe.com should carry the same OAuth credentials the app already holds for that host, so built-in PR/issue tooling works on GHE.com the same as on github.com.

Additional context

• gh auth status inside sessions is correct (GH_HOST=9altitudes.ghe.com, valid token) — only the app's own internal client is affected.
• Possibly related but distinct: [Bugs] Seems not to work with ghe.com #1441 (ghe.com sign-in), GitHub Copilot App v1.0.0: model_not_supported on GHEC Data Residency — OAuth token missing copilot scope #1131 (OAuth scope on GHEC data residency), [Bug] Links open Github.com instead of Github Enterprise #2027 (links open github.com).