1.0.81 regression: OAuth login fails behind a TLS-inspecting HTTP proxy while 1.0.80 works

[hskm07]

Describe the bug

GitHub Copilot CLI 1.0.81 cannot start or complete OAuth authentication when using a corporate HTTP CONNECT proxy with TLS inspection.

Both authentication modes fail:

• Device-code flow fails while requesting a device code from https://github.com/login/device/code.
• Web flow succeeds in the browser but the CLI fails while exchanging the authorization code at https://github.com/login/oauth/access_token.

The same proxy and CA certificate configuration works with Copilot CLI 1.0.80. A curl POST to the device-code endpoint also succeeds through the same proxy.

This appears to be a regression in 1.0.81.

Affected version

GitHub Copilot CLI 1.0.81.

Steps to reproduce the behavior

1. Configure a corporate HTTP proxy and CA certificate:

   export HTTP_PROXY=http://proxy.example:8888
   export HTTPS_PROXY=http://proxy.example:8888
   export http_proxy=http://proxy.example:8888
   export https_proxy=http://proxy.example:8888
   export SSL_CERT_FILE=/path/to/corporate-ca.pem
   export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem

2. Confirm the affected version:

   copilot --version

   Output:

   GitHub Copilot CLI 1.0.81
   

3. Start device-code authentication:

   copilot login --device-code

4. Observe the failure before a device code is displayed:

   Login failed: Error: request failed: error sending request for url (https://github.com/login/device/code)
   

5. The default web flow also fails:

   copilot login

   Browser authorization succeeds, but the CLI reports:

   Error during sign-in:
   request failed: error sending request for url
   (https://github.com/login/oauth/access_token)
   

6. Verify that the OAuth endpoint is reachable using curl through the same proxy and CA:

   curl \
     --proxy http://proxy.example:8888 \
     --cacert /path/to/corporate-ca.pem \
     -H 'Accept: application/json' \
     -X POST \
     -d 'client_id=<client-id>' \
     -d 'scope=read:user read:org repo gist codespace' \
     https://github.com/login/device/code

   This returns HTTP 200 with the expected fields:

   device_code, expires_in, interval, user_code, verification_uri
   

7. Run the locally cached Copilot CLI 1.0.80 with the exact same environment:

   COPILOT_AUTO_UPDATE=false \
   node ~/.copilot/pkg/darwin-arm64/1.0.80/index.js \
   login --device-code

   Version 1.0.80 succeeds:

   To authenticate, visit https://github.com/login/device and enter code ...
   Waiting for authorization...
   

Using the proxy IP address directly instead of its hostname does not fix version 1.0.81, so this does not appear to be proxy DNS resolution.

Expected behavior

Copilot CLI 1.0.81 should use the configured HTTP proxy and CA certificate to request an OAuth device code and exchange OAuth authorization codes, as version 1.0.80 does under the same network configuration.

Additional context

• Direct outbound HTTPS is blocked or reset on this network, so the corporate proxy is required.
• curl successfully connects through the proxy and validates TLS using the same CA certificate.
• SSL_CERT_FILE and NODE_EXTRA_CA_CERTS both point to an existing, valid PEM certificate.
• ~/.copilot/settings.json does not contain a separate proxyUrl.
• The Copilot debug log confirms that HTTP_PROXY and HTTPS_PROXY are detected.
• Supplying the proxy by IP address produces the same failure in 1.0.81.
• Downgrading to the cached 1.0.80 package is the current workaround.