[BUG] Desktop runs `gh auth token` to pull the GitHub CLI token (undocumented) and respawns it every 10s when it times out

What's Wrong?

I only noticed this because I run a tool (Automic Vault) that makes me approve every read of my gh token. Without it, this would be invisible.

The desktop app runs gh auth token --hostname github.com from my home directory and takes the raw token. Going by the code around it, it then calls the GitHub API itself with that token. The desktop docs say PR monitoring "requires the GitHub CLI (gh) to be installed and authenticated on your machine." I couldn't find anything that says the app reads the token out of gh, what it uses it for, or how to turn that off.

When the call takes longer than the app's 10s timeout, the app kills gh and spawns another one right away. In the three days ending 2026-09-25 that came to 387 token reads:

• Two bursts: 294 reads over 53 minutes on 09-23, and 88 reads over 17 minutes on 09-24
• 356 of the gaps between reads are exactly 10 seconds
• Both bursts started within seconds of the app finishing its launch, and stopped only when I finally approved one

The call site in the bundle (app.asar, minified, so the names are whatever the minifier gave them):

this.spawnGh(["auth","token","--hostname",n],
  {cwd:this.homePath, ignoreExitCode:!0, timeoutMs:be /* 1e4 */,
   timeoutMsg:"gh auth token timed out", env:e})

The class around it also keeps REST and GraphQL rate-limit budgets and ETag caches per host, which is why I read this as the app making API calls with the token. That part is my inference from the source, not something documented.

What Should Happen?

Ideally the app has its own narrowly scoped GitHub credential and never reads mine out of gh. Short of that:

• Call gh api for the requests it needs, so the token stays inside gh
• Document that the desktop app reads the token via gh auth token, and what it uses the token for
• Add a setting to turn it off
• Back off after a timeout instead of respawning immediately

Error Messages/Logs

One row from my approval tool's history (av history --json), trimmed. There are 381 like it:

{
  "date": "2026-09-23T20:02:29Z",
  "tool": "gh",
  "command": "gh auth token --hostname github.com",
  "launcher": "Claude",
  "cwd": "~",
  "decision": "Canceled",
  "reason": "Gate client exited"
}

Steps to Reproduce

What I ran: the desktop app with a gate in front of gh that waits on me to approve token reads, launched and left alone. Both times the reads began within about ten seconds of the app finishing its launch. I don't know whether a Code session or a bound PR has to be open.

A stub should give the same result without any gate. I've run the script itself (it stalls auth token, logs the call, and passes everything else through) but not against the app:

#!/bin/sh
# Save as `gh` ahead of the real one on PATH, then chmod +x. Adjust the real path.
if [ "$1" = auth ] && [ "$2" = token ]; then
  echo "$(date -u +%FT%TZ) gh $*" >> /tmp/gh-token-calls.log
  sleep 15
  exit 0
fi
exec /opt/homebrew/bin/gh "$@"

1. Put the stub first on PATH
2. Quit and relaunch the desktop app
3. Run tail -f /tmp/gh-token-calls.log. I'd expect a new line about every 10 seconds, since the app kills each call at its 10s timeout

Additional Information

• Claude desktop 2.9939.2 (the version installed now, which is the bundle I read; it updated after both bursts, and the call shape matches what I logged: cwd set to home, auth token --hostname github.com, 10s timeout). Claude Code inside the app was 2.1.281.
• macOS. Regression: unknown.
• Related: #67055 and #67087 are the same area (gh auth status on a 5s timeout, failures shown as expired credentials). Both closed as stale.