Description

gh api builds a specialized HTTP client to support command-specific cache and verbose behavior. This API Client was not provided with a TelemetryDisabler at construction time. It was therefore possible for gh api --hostname or gh api <absolute url> to emit telemetry unexpectedly under extremely narrow conditions:

1. User is logged into a non-GHES host (e.g. github.com or GHEC with DR), otherwise global auth check fails:

➜ GH_CONFIG_DIR=/tmp gh api --hostname ghe.example.com /
To get started with GitHub CLI, please run:  gh auth login
Alternatively, populate the GH_TOKEN environment variable with a GitHub API authentication token.

2. No GHES hosts are logged into, otherwise mightBeGHESUser disables telemetry:

3. No enterprise-token environment variable is set, otherwise mightBeGHESUser disables telemetry:

Under these circumstances, an unauthenticated request using gh api could send telemetry if sampled at a 1% chance:

➜ GH_TELEMETRY=log gh api --hostname ghe.io /
Telemetry payload:
{
  "events": [
    {
      "type": "command_invocation",
      "dimensions": {
        "accessible_colors": "false",
        "accessible_prompter": "false",
        "agent": "",
        "architecture": "arm64",
        "ci": "false",
        "color_labels": "false",
        "command": "gh api",
        "device_id": "160e44ae-38df-4bc5-9bae-0d9a126573b3",
        "flags": "hostname",
        "github_actions": "false",
        "invocation_id": "1e13fd5a-9110-4287-817c-e8c55cd3ebf6",
        "is_tty": "true",
        "os": "darwin",
        "spinner_disabled": "false",
        "timestamp": "2026-09-03T13:55:18.399Z",
        "version": "2.98.0"
      }
    }
  ]
}

How did you test this change?

Before

See above

After

➜ GH_TELEMETRY=log ./bin/gh api --hostname ghe.io /
Telemetry payload: none

Authorship and follow-up

Who wrote this:

• A human wrote it.
• An agent wrote it under close human direction.
• An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

• @williammartin will read and reply directly.
• An agent will draft replies and @username will read them before they are posted.
• Nobody has explicitly committed to replying.