gh aw extension upgrade on GHE falsely reports "already up to date"

[anthonymastreanvae]

Summary

In a GHE-authenticated environment, gh extension upgrade aw reports already up to date while gh-aw is still on an older version (v0.72.1) and a newer release exists (v0.74.0).

Observed output:

gh aw version v0.72.1
[aw]: already up to date

I could only upgrade by forcing github.com resolution and pinning:

GH_HOST=github.com gh extension install github/gh-aw --pin v0.74.0

This suggests extension update metadata/source resolution is host-confused in mixed GHE + github.com setups.

Environment

• OS: macOS 26.4.1 (Apple Silicon)
• Kernel/arch: Darwin 25.4.0, arm64
• CPU: Apple M5 Max
• gh: 2.92.0
• gh-aw (before workaround): v0.72.1
• gh-aw (after workaround): v0.74.0
• Auth host: GHE (sanitized): ghe.example.com
• Repo (sanitized): example/example-repo

Reproduction

1) Confirm versions on GHE auth context

gh --version
gh aw --version
gh extension list

2) Attempt upgrade

gh extension upgrade aw

3) Observe false up-to-date result

[aw]: already up to date
✓ Successfully checked extension upgrades

4) Confirm still old version

gh aw --version
# -> v0.72.1

5) Workaround that succeeds

GH_HOST=github.com gh extension install github/gh-aw --pin v0.74.0
gh aw --version
# -> v0.74.0

Expected behavior

• gh extension upgrade aw should find and install the newest available version from the correct source, or clearly state which host/registry it is using.
• If a newer version exists on github.com, the tool should not report already up to date without context.
• Host/registry context should be explicit for extension update checks in mixed-host setups.

Actual behavior

• gh extension upgrade aw reported already up to date while installed version remained v0.72.1.
• Upgrading required manual host override and pinning.

Why this matters

• Blocks users from receiving fixes unless they know host override/pin workarounds.
• Creates confusion for users on GHE.
• Makes troubleshooting unrelated issues harder (users cannot trust update state).

Suggested fix

• Ensure extension upgrade checks resolve against the extension's canonical origin (or clearly declared source), not only active auth host.
• Include host context in update output (for example: checking updates from github.com vs checking updates from ghe.example.com).

Additional context

This may be related to mixed-host workflows where:

• extension was installed from github.com,
• active auth host is GHE,
• update metadata lookup may prefer current host rather than extension origin.

Footer

Agent attribution: Drafted with GitHub Copilot (GPT-5.3-Codex) in VS Code and reviewed by the reporter.

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#3246

Generated by Firewall Issue Dispatcher · ● 10.7M · ◷