GHE.com data residency: repo-scoped queries bound to github.com provider — PR panel shows 0 in all categories (clean-profile repro included)

[daniel1978m]

Environment

• Extension: github.vscode-pull-request-github 0.162.0 (also reproduced identically after full restarts; not tested pre-release)
• VS Code: 1.131.0, Windows 11
• Tenant: GitHub Enterprise Cloud with data residency (https://TENANT.ghe.com, EMU accounts)
• Repo: organization-owned, visibility: internal, user is org owner with admin on the repo
• github-enterprise.uri set to https://TENANT.ghe.com (verified in both user and workspace scope; log confirms [Authentication] Enterprise server authority TENANT.ghe.com either way)

Minimal clean-room reproduction

1. code --user-data-dir C:\Temp\vsc-clean --extensions-dir C:\Temp\vsc-clean-ext <fresh clone of the ghe.com repo> — throwaway profile, nothing pre-existing
2. Install this extension (fresh from Marketplace)
3. github-enterprise.uri present via the repo's committed .vscode/settings.json
4. Sign in to GitHub Enterprise only — the enterprise auth log confirms a session with the extension's full scope set:

   Logging in for the following scopes: read:user repo user:email workflow
   Token exchange success!  Login success!
   

   github.com provider: 0 sessions (never signed in, in this profile)
5. Open the PR view

Result: every category shows "0 pull requests". Log:

[Authentication] Creating hub for enterprise
[Authentication] Enterprise server authority TENANT.ghe.com
[error] [GitHubRepository+0] Unable to fetch pull requests with query: Error: Not authenticated

…and the extension initiates a github.com login flow on its own (https://github.com/login/oauth/select_account?client_id=01ab8ac9400c4e429b23 opens; the Accounts menu shows "Sign in with GitHub to use GitHub Pull Requests (1)") — i.e. for a workspace whose only remote is https://TENANT.ghe.com/ORG/REPO.git, repo-scoped queries are bound to the github.com auth provider, and the properly-scoped enterprise session is never used for them.

Same machine, main profile (github.com session also present)

With a github.com session signed in (the common real-world state — Copilot), the same misbinding produces the masked variant — repo queries go out with the valid github.com token and every repo-scoped GraphQL call fails:

[error] [GitHubRepository+0] Error querying GraphQL API (MaxPullRequest): GraphQL error: Could not resolve to a Repository with the name 'ORG/REPO'.
[error] [GitHubRepository+0] Unable to fetch pull requests with query: ...

while the NotificationsProvider works and resolves those same PRs' metadata (Found GitHub repo for pr #NN: yes, Resolved PR #NNN), then each PR is dropped again (Found GitHub pr repo for pr #NN: no). Network observation (netstat, per-process): the extension host holds simultaneous connections to api.github.com and to the tenant during these queries.

Controls (the tenant side is healthy)

The identical query the extension fails on succeeds with a gh CLI token against the tenant's dedicated endpoint:

POST https://api.TENANT.ghe.com/graphql
{repository(owner:"ORG",name:"REPO"){nameWithOwner pullRequests(states:OPEN){totalCount}}}
→ {"data":{"repository":{"nameWithOwner":"ORG/REPO","pullRequests":{"totalCount":8}}}}

https://TENANT.ghe.com/status → GitHub lives!; https://api.TENANT.ghe.com/meta → X-GitHub-Enterprise-Version: ghe.com.

Ruled out (each verified directly)

• OAuth app org-access restrictions: the org restricts third-party apps, but "Visual Studio Code" shows the org with a green check under Organization access (screenshot available) — same as GitHub CLI, which works
• Account bindings in storage: github.vscode-pull-request-github-github / -github-enterprise keys hold the correct logins (both global and workspace state)
• Stale local state: reproduced with fresh clone + fresh profile + fresh extension install (see above); also reproduced after removing 1,294 stale github-pr-* entries the extension had written to .git/config pre-migration
• Multiple accounts (Multiple accounts doesn't work for any but the first account added #8789 shape): reproduced with the enterprise account as the ONLY signed-in account
• github-enterprise.uri format/scope: bare host, trailing slash, user vs workspace scope — no change; the parsed authority is always logged correctly
• Scopes: enterprise session carries read:user repo user:email workflow

Related

• API requests should be sent to api.my-name.ghe.com instead of using /api/v3 in the URL path #6233 / When authority is ghe.com, don't probe API to determine if enterprise #6246 — the 2024 ghe.com routing fix (present in 0.162.0; githubServer.ts hardcodes *.ghe.com as Enterprise, verified against the v0.162.0 tag)
• PR Extension not working properly with ghe.com #8096 — ghe.com tenant, PR panel broken, closed as unreproduced — likely this
• Multiple accounts doesn't work for any but the first account added #8789 — byte-identical log signature (MaxPullRequest / Could not resolve, notifications working), but reproduces here with a single account

Where it seems to point

Server-type detection resolves the tenant correctly (enterprise hub is created with the right authority), but the remote→auth-provider binding selects AuthProvider.github for the ghe.com remote (Remote.authProviderId, src/common/remote.ts — strict host === enterpriseUri.authority with a silent github.com fallback and no logging on mismatch). A debug log line stating which provider a remote was bound to, and why, would have made this diagnosable in minutes.

Happy to provide full logs, run a pre-release or instrumented build, or live-debug — the tenant and repro environment are available.