[Bug]: GitHub PR sync fails behind TLS-inspecting proxy since nightly 20261006.2752 #16703

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Use the Windows desktop app with a WSL runtime behind a corporate TLS-inspecting proxy.
2. Install the proxy's root CA in the WSL system trust store and export NODE_EXTRA_CA_CERTS in the WSL shell profile (.bashrc/.zshrc), pointing to the proxy CA certificate.
3. Start T3 Code normally from Windows using 0.0.46-nightly.20261006.2752.
4. Use a thread with an open, linked GitHub PR and automatic settlement on merge enabled.
5. Merge the PR on GitHub and allow background PR synchronization to run.
6. Observe that the linked PR remains open in T3 Code and the thread does not auto-settle. The server trace repeatedly reports the TLS error below.

The same setup works with 0.0.46-nightly.20261006.2735.

Expected behavior

GitHub PR synchronization succeeds behind the proxy using the configured trusted CA. Linked PRs update to merged, allowing otherwise eligible threads to auto-settle, as in nightly 2735.

Actual behavior

Linked PRs remain open after merging on GitHub, preventing automatic thread settlement. Background synchronization repeatedly fails with self-signed certificate in certificate chain.

The desktop-launched WSL server does not have NODE_EXTRA_CA_CERTS in its environment, despite the variable being exported in the WSL shell profile.

A separate Node fetch test against https://api.github.com succeeds when NODE_EXTRA_CA_CERTS is supplied and fails with the certificate error when it is absent.

Likely cause

#16319 / #16320 moved GitHub PR operations from the gh CLI to in-process HTTP requests. In this environment, gh accepts the proxy CA through the OS trust store, while the new Node request path does not trust it under the desktop server's launch configuration.

This is consistent with the version regression and the controlled fetch test, but the specific introducing change has not been bisected.

Possible fixes

• Use the system certificate store for GitHub requests, for example Node's --use-system-ca where supported by the server runtime.
• Import and forward NODE_EXTRA_CA_CERTS when starting the desktop/WSL server, using fix(desktop): honor the telemetry opt-out from the shell profile #16563's telemetry environment-variable handling as a precedent. Consider SSL_CERT_FILE where applicable.
• Provide a setting for additional trusted CA certificates.

Impact

Minor bug or occasional failure

Version or commit

0.0.46-nightly.20261006.2752

Environment

Windows 11 desktop app with a WSL 3 runtime, behind a corporate TLS-inspecting proxy. The proxy's root CA is installed in the WSL system trust store. NODE_EXTRA_CA_CERTS is exported in the WSL shell profile (.bashrc/.zshrc).

Logs or stack traces

PullRequestSyncReactor.sweep: pull request sync skipped
  reason: Pull request operation summary failed: Could not reach GitHub at github.com.

GitHubApi.send (getPullRequestSummary, POST /graphql)
  HttpClientError: Transport error (POST https://api.github.com/graphql)
    TypeError: fetch failed
      Error: self-signed certificate in certificate chain

Additional observation: anonymous usage-data uploads through AnalyticsService.sendBatch fail with the same certificate error on nightly 2735 as well. That failure predates this PR-sync regression.

Screenshots, recordings, or supporting files

No response

Workaround

Nightly 0.0.46-nightly.20261006.2735 works in the same environment.

Supplying NODE_EXTRA_CA_CERTS fixes the standalone Node fetch test, but exporting it in the WSL shell profile does not reach the desktop-launched server. A workaround for the desktop launch on nightly 2752 has not been verified.