fix(cli): exclude GITHUB_API_URL when api-proxy is enabled by Claude · Pull Request #1303 · github/gh-aw-firewall

Claude · 2026-03-14T18:29:14Z

Summary

Fixes API proxy routing issue on GitHub Enterprise Server (GHES) where Copilot API requests were incorrectly routed to the GHES API instead of the Copilot API.

Problem

On GHES, workflows pass GITHUB_API_URL (e.g., https://api.ghes-host) to the agent container. The Copilot CLI was using this environment variable for ALL API requests, including Copilot model/chat requests, which don't exist on the GHES API. This caused immediate failures with:

Error loading models: Error: Failed to list models: 400 Bad Request

Solution

Modified src/docker-manager.ts to conditionally exclude GITHUB_API_URL from the agent container's environment when the API proxy is enabled (--enable-api-proxy).

When API proxy is enabled:

GITHUB_API_URL is excluded from agent environment
Agent uses COPILOT_API_URL instead (pointing to the API proxy)
API proxy's deriveCopilotApiTarget() correctly routes Copilot requests to:
- GHES: api.enterprise.githubcopilot.com
- GHEC (*.ghe.com): api.<subdomain>.ghe.com
- github.com: api.githubcopilot.com

Testing

Added integration tests in tests/integration/api-proxy.test.ts:

Verifies GITHUB_API_URL is excluded when API proxy is enabled
Verifies COPILOT_API_URL points to the proxy
Verifies GITHUB_API_URL passes through normally when API proxy is disabled

On GHES, workflows set GITHUB_API_URL to the GHES API endpoint (e.g., https://api.ghes-host). When api-proxy is enabled, this variable should NOT be passed to the agent container, because Copilot CLI would use it for Copilot API requests, which don't exist on GHES API. Instead, the agent should use COPILOT_API_URL pointing to the proxy, which correctly routes Copilot API requests to api.enterprise.githubcopilot.com (not the GHES API which lacks Copilot endpoints). This fix ensures: - GITHUB_API_URL is excluded from agent env when --enable-api-proxy is set - COPILOT_API_URL takes precedence for Copilot API routing - The API proxy's deriveCopilotApiTarget() correctly determines the endpoint Fixes: github/gh-aw#20875

lpcox · 2026-03-14T18:29:29Z

@claude[agent] fix the pr title and summary

github-actions · 2026-03-14T18:30:12Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	85.76%	85.88%	📈 +0.12%
Statements	85.69%	85.81%	📈 +0.12%
Functions	85.95%	85.95%	➡️ +0.00%
Branches	78.85%	79.03%	📈 +0.18%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	87.4% → 87.9% (+0.50%)	86.8% → 87.2% (+0.48%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-03-14T18:37:03Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #1303 · ◷

Claude · 2026-03-14T18:38:21Z

@claude[agent] fix the pr title and summary

I don't have permissions to edit the PR directly, but here's the updated PR title and description you can apply:

Title:

fix(cli): exclude GITHUB_API_URL when api-proxy is enabled

Description:

## Summary

Fixes API proxy routing issue on GitHub Enterprise Server (GHES) where Copilot API requests were incorrectly routed to the GHES API instead of the Copilot API.

## Problem

On GHES, workflows pass `GITHUB_API_URL` (e.g., `https://api.ghes-host`) to the agent container. The Copilot CLI was using this environment variable for ALL API requests, including Copilot model/chat requests, which don't exist on the GHES API. This caused immediate failures with:

Error loading models: Error: Failed to list models: 400 Bad Request


## Solution

Modified `src/docker-manager.ts` to conditionally exclude `GITHUB_API_URL` from the agent container's environment when the API proxy is enabled (`--enable-api-proxy`).

When API proxy is enabled:
- `GITHUB_API_URL` is excluded from agent environment
- Agent uses `COPILOT_API_URL` instead (pointing to the API proxy)
- API proxy's `deriveCopilotApiTarget()` correctly routes Copilot requests to:
  - GHES: `api.enterprise.githubcopilot.com`
  - GHEC (*.ghe.com): `api.<subdomain>.ghe.com`
  - github.com: `api.githubcopilot.com`

## Testing

Added integration tests in `tests/integration/api-proxy.test.ts`:
- Verifies `GITHUB_API_URL` is excluded when API proxy is enabled
- Verifies `COPILOT_API_URL` points to the proxy
- Verifies `GITHUB_API_URL` passes through normally when API proxy is disabled

## Related

Fixes github/gh-aw#20875

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh pr view --json title,body /home/REDACTED/.nvm/bash_completion /home/REDACTED/.nvm/install.sh /home/REDACTED/.nvm/nvm-exec /home/REDACTED/.nvm/nvm.sh /home/REDACTED/.nvm/package.json /home/REDACTED/.nvm/rename_test.sh /home/REDACTED/.nvm/test (http block)
- Triggering command: `/usr/bin/gh gh pr edit --title fix(cli): exclude GITHUB_API_URL when api-proxy is enabled --body ## Summary

Fixes API proxy routing issue on GitHub Enterprise Server (GHES) where Copilot API requests were incorrectly routed to the GHES API instead of the Copilot API.

Problem

On GHES, workflows pass GITHUB_API_URL (e.g., REDACTED /home/REDACTED/.nvm/nvm-exec /home/REDACTED/.nvm/nvm.sh /home/REDACTED/.nvm/package.json /home/REDACTED/.nvm/rename_test.sh /home/REDACTED/.nvm/test (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled

Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

Fixes GHES routing when the API proxy sidecar is enabled by preventing GITHUB_API_URL (GHES REST API base) from being injected into the agent container, so Copilot requests use COPILOT_API_URL via the sidecar instead of being misrouted to GHES.

Changes:

Conditionally omit GITHUB_API_URL from agent container environment when --enable-api-proxy is enabled.
Add integration coverage asserting GITHUB_API_URL passthrough behavior differs depending on whether the API proxy is enabled.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
tests/integration/api-proxy.test.ts	Adds integration tests for `GITHUB_API_URL` passthrough/exclusion behavior with/without API proxy.
src/docker-manager.ts	Updates agent env-var pass-through logic to exclude `GITHUB_API_URL` when API proxy is enabled.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

tests/integration/api-proxy.test.ts

+    expect(result).toSucceed();
+    // GITHUB_API_URL should NOT be set in agent container when api-proxy is enabled
+    expect(result.stdout).toContain('GITHUB_API_URL_NOT_SET');
+    // COPILOT_API_URL should point to the proxy instead
+    expect(result.stdout).toContain(`COPILOT_API_URL=http://${API_PROXY_IP}:10002`);
+  }, 180000);


src/docker-manager.ts

+    // When api-proxy is enabled, Copilot CLI must use COPILOT_API_URL (pointing to the proxy)
+    // instead of GITHUB_API_URL, because the proxy correctly routes Copilot API requests to
+    // api.enterprise.githubcopilot.com (not the GHES API which lacks Copilot endpoints).
+    // See: github/gh-aw#20875
+    if (process.env.GITHUB_API_URL && !config.enableApiProxy) environment.GITHUB_API_URL = process.env.GITHUB_API_URL;


…abled Regression introduced in commit 9761e87 (PR #1305) re-added an unconditional GITHUB_API_URL assignment that PR #1303 had fixed. Combined with the missing EXCLUDED_ENV_VARS entry for the --env-all code path, GITHUB_API_URL was leaking into the agent container when api-proxy is enabled. With GITHUB_API_URL present in the agent, the Copilot CLI routes its token exchange to api.github.com/copilot_internal/v2/token using the placeholder COPILOT_GITHUB_TOKEN instead of going through COPILOT_API_URL → api-proxy (which injects the real token), causing a 401 authentication failure. Fix: - Add GITHUB_API_URL to EXCLUDED_ENV_VARS when api-proxy is enabled (covers the --env-all path used by build-test.lock.yml) - Replace the duplicate unconditional assignment with the correct conditional version that was already present below it (from PR #1303) Tests: - should not leak GITHUB_API_URL to agent when api-proxy is enabled with envAll - should pass GITHUB_API_URL to agent when api-proxy is NOT enabled with envAll See: github/gh-aw#20875

…abled (#1419) * Initial plan * fix: exclude GITHUB_API_URL from agent container when api-proxy is enabled Regression introduced in commit 9761e87 (PR #1305) re-added an unconditional GITHUB_API_URL assignment that PR #1303 had fixed. Combined with the missing EXCLUDED_ENV_VARS entry for the --env-all code path, GITHUB_API_URL was leaking into the agent container when api-proxy is enabled. With GITHUB_API_URL present in the agent, the Copilot CLI routes its token exchange to api.github.com/copilot_internal/v2/token using the placeholder COPILOT_GITHUB_TOKEN instead of going through COPILOT_API_URL → api-proxy (which injects the real token), causing a 401 authentication failure. Fix: - Add GITHUB_API_URL to EXCLUDED_ENV_VARS when api-proxy is enabled (covers the --env-all path used by build-test.lock.yml) - Replace the duplicate unconditional assignment with the correct conditional version that was already present below it (from PR #1303) Tests: - should not leak GITHUB_API_URL to agent when api-proxy is enabled with envAll - should pass GITHUB_API_URL to agent when api-proxy is NOT enabled with envAll See: github/gh-aw#20875 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Claude AI added 2 commits March 14, 2026 14:38

Initial plan

541fc85

Claude AI assigned Claude and lpcox Mar 14, 2026

Claude created this pull request from a session on behalf of lpcox March 14, 2026 18:29 View session

Claude AI linked an issue Mar 14, 2026 that may be closed by this pull request

API proxy routes Copilot model requests to GHES API instead of Copilot API on Enterprise Server #1300

Closed

github-actions bot added the build-test label Mar 14, 2026

Claude started work on behalf of lpcox March 14, 2026 18:37 View session

Claude AI changed the title ~~Completing task~~ fix(cli): exclude GITHUB_API_URL when api-proxy is enabled Mar 14, 2026

Claude AI requested a review from lpcox March 14, 2026 18:38

Claude finished work on behalf of lpcox March 14, 2026 18:38

lpcox marked this pull request as ready for review March 14, 2026 19:07

lpcox requested a review from Mossaka as a code owner March 14, 2026 19:07

Copilot AI review requested due to automatic review settings March 14, 2026 19:07

lpcox merged commit 02d71c3 into main Mar 14, 2026
60 of 61 checks passed

lpcox deleted the claude/fix-api-proxy-routes branch March 14, 2026 19:08

Copilot started reviewing on behalf of lpcox March 14, 2026 19:08 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 14, 2026

feat(cli): auto-inject GH_HOST in agent container when GHES detected #1305

Merged

Copilot AI mentioned this pull request Mar 24, 2026

fix: exclude GITHUB_API_URL from agent container when api-proxy is enabled #1419

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(cli): exclude GITHUB_API_URL when api-proxy is enabled#1303

fix(cli): exclude GITHUB_API_URL when api-proxy is enabled#1303
lpcox merged 2 commits intomainfrom
claude/fix-api-proxy-routes

Claude AI commented Mar 14, 2026 •

edited

Loading

Uh oh!

lpcox commented Mar 14, 2026

Uh oh!

github-actions bot commented Mar 14, 2026

Uh oh!

github-actions bot commented Mar 14, 2026

Uh oh!

Claude AI commented Mar 14, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Claude AI commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Testing

Uh oh!

lpcox commented Mar 14, 2026

Uh oh!

github-actions bot commented Mar 14, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions bot commented Mar 14, 2026

🏗️ Build Test Suite Results

Uh oh!

Claude AI commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Problem

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Claude AI commented Mar 14, 2026 •

edited

Loading

Claude AI commented Mar 14, 2026 •

edited

Loading