Repository navigation
FR: Support for HTTPS_PROXY (web proxies) #41
Description
Activity
✚ 1 This is a must have feature. Copilot CLI is announced for copilot enterprise plan as well but enterprise customers are not able to use it rn.
Temporary workaround to force copilot through a proxy:
sudo apt install proxychains4
mkdir -p ~/.proxychains
cp /etc/proxychains4.conf ~/.proxychains/proxychains.conf
nano ~/.proxychains/proxychains.conf
Scroll to the bottom and add your proxy (change your port):[ProxyList] http 127.0.0.1 55555Remove the line starting with socks4
Then run copilot with the following command:
proxychains4 copilotThis should get rid of the "Waiting for device code... Error during sign-in: fetch failed" error.
Reacted by Sebastian Danielsson, Arphen Lin, ChrisTorng, future-rtakahashi, Gwen, Luong Trung Kien and AnomatomatoOn the brigh side we know that Github employees don't have to bother with proxy connections 😉
Reacted by Andy Feller, Mateusz Żerebecki and Felipe RodriguesReacted by Louis Erbkamm, Diluka, Jun Ikai and Felipe RodriguesWith solution suggested at #111 (comment) i am able to login but any subsequent commands are stuck at "Thinking"
Reacted by Nguyen Duy LuanWith solution suggested at #111 (comment) i am able to login but any subsequent commands are stuck at "Thinking"
That's right, it's stuck because
copilotdoes not forward all the traffic the proxy.
I have identified that after setting the following env vars, where :8888 is my Web Debugging Proxy, the requests are still not traversing the proxy:- export {HTTP,HTTPS,ALL}_PROXY="http://127.0.0.1:8888" # Charles Web Debugging
- export NODE_USE_ENV_PROXY=1
- export NODE_DEBUG=http,https,tls,net
- export NODE_OPTIONS="--trace-warnings --trace-uncaught"
It captures one request to
api.individual.githubcopilot.comand one tohttps://api.githubcopilot.com/modelsbut not the actual LLM requests...
HTTPS 33713: https createConnection should use proxy for api.githubcopilot.com:443: nullSo I had to use Wireshark to see what's happening:
I instructed NodeJS to export TLS keys so that I could inspect the traffic in Wireshark
export NODE_OPTIONS="--tls-keylog=$HOME/tlskey.log”
The requests were indeed escaping the HTTP proxy so #111 is not a viable workaround.
Reacted by Geliba, Sirish Kumar Bethala and Younes BrahimiReacted by Sirish Kumar Bethala, Younes Brahimi and Du ShuangfeiReacted by Younes BrahimiAs an update here, work is in progress to move the model calls onto the networking stack that supports Node's new built-in proxy support.
Will keep this issue updated with the progress
Reacted by future-rtakahashi, kadirtugarantibbva, Sebastian Danielsson, Jun Ikai, Florian Bidabe, ChrisTorng, GuillaumeGrpm, Oliver, Johannes Ehm, Sirish Kumar Bethala and 8 moreUpdate here, improvements were shipped in 0.0.332 that should move all calls onto the latest Node.js native fetch networking stack.
Please update to ^0.0.332 and set:
export NODE_USE_ENV_PROXY=1along withHTTP_PROXY/HTTPS_PROXYto use https://nodejs.org/api/http.html#built-in-proxy-supportReacted by future-rtakahashi- marked Add Configuration Option for Network Proxy in Copilot CLI #134 as a duplicate of this issue
on Oct 2, 2025 - marked Copilot CLI shows Error when submit any request: TypeError: fetch failed; Execution failed: fetch failed #115 as a duplicate of this issue
on Oct 2, 2025 Adding this so others know it too.
The nodejs built in proxy is only available in v24.5.0 and higher.
For my work we only use LTS, for which the latest is v22.20.0. I did try moving to node v24.9.0 to try it but i'm blocked by #173
Reacted by Devraj Mehta and Jun IkaiThanks for testing @borcherspm could you share more details and/or logs from the error you're hitting?
I can confirm that node v24.9.0 and copilot 0.0.333 Commit: 4cbf3da is working using:
- export HTTP_PROXY=http://myproxy
- export NODE_USE_ENV_PROXY=1
- export NODE_TLS_REJECT_UNAUTHORIZED=0
Looking into what certs are getting rejected but this was at least it successful.
Reacted by Devraj Mehta, Sebastian Danielsson, kk0kojirr and 曹伟Thanks for testing @seriouscorey!
On Node 24, you can try setting
NODE_USE_SYSTEM_CA=1for using local system certs https://nodejs.org/api/cli.html#node_use_system_ca1Reacted by Sebastian Danielsson, seriouscorey and kk0kojirrupgrading to 0.0.333
- it's seems to work sometimes and not others
- i dont think it's related to the proxy.
- if i remove our vpn/proxy from the equation, i am still getting Execution failed: 421 421 Misdirected Request #173 and if i look in the logs i see that CAPIError. "Connection error." with CAPIError in the logs #116
- but other times i've tried this morning i have gotten a prompt to go through successfully
NODE_USE_SYSTEM_CA=1
This solved it for me. I was able to unset NODE_TLS_REJECT_UNAUTHORIZED and use export NODE_USE_SYSTEM_CA=1 and connect through my proxy without issue now.
Reacted by Devraj Mehta, kk0kojirr, Jun Nakarai, Younes Brahimi and Dan Clarkeworked for me with node version 24 +
export NODE_USE_SYSTEM_CA=1cant wait for this to be supported with 22 node LTS! cheers to everyone who made this happen.
Reacted by kk0kojirr and hardboiledphilHas anybody faced what seems to be a kerberos issue while authenticating? Our corp proxies are set at firewall level and after checking logs with the networks team, the call from copilot cli is resulting in a 407 not challenged. Networks team seem to think it's related to the CLI sending NTLM instead of Kerberos.
@agohil12 I don't think the undici ProxyAgent (that the CLI is using) supports either NTLM or kerberos auth. So the 407 you're seeing would be expected. To support kerberos proxy auth could you open a new issue to track?
As a workaround if you are able to use something like px-proxy with basic auth or unauthenticated that should be supported.
Describe the Feature Request
Many organisations have web proxies in place filtering all traffic from SOE.
In the absence of support for it, GitHub Copilot CLI is unable to get a working connectivity as its traffic is going direct (and blackholed) as opposed to going via the corporate proxy which would allow the traffic.
Ideally GH CP CLI would check those HTTPS_PROXY and HTTP_PROXY environment variables and take it into account.