[Bug]: Private GitHub images in chat messages show "Image unavailable" (PR panel loads them) #25922

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

1. Open a project whose repository is a private GitHub repo, signed in with gh (the same setup where the pull request panel already shows that repo's images, after fix(web): show private repository media in pull request tabs #11706).
2. Commit an image to the repo, e.g. docs/shot.png.
3. Have the agent (or paste as a message) reply with Markdown that embeds it:
   ![After](https://github.com/<owner>/<private-repo>/blob/<sha>/docs/shot.png?raw=true)
   (a raw.githubusercontent.com or github.com/user-attachments/assets/<id> URL behaves the same.)
4. Open the same pull request's tab, where that body image does render.

Expected behavior

The image renders in the chat transcript, the same way it renders in the pull request panel, since the server already holds the cwd's source control credential and already serves these URLs for the panel.

Actual behavior

The chat transcript shows "Image unavailable". The browser requests the URL without a credential and GitHub answers 404 (verified: same URL is 404 anonymously, 200 with gh auth).

Cause, on main @ 1152e91: ChatMarkdown only routes host media through the server when its sourceControlMedia prop is true (apps/web/src/components/ChatMarkdown.tsx, default false, check around line 1419). The only caller that sets it is PullRequestMarkdown.tsx (line 96). The chat transcript never passes it, so the fix from #11706 (and its move into the source control drivers in #23994) covers the pull request tab only.

Impact

Minor bug or occasional failure

Version or commit

Desktop 0.1.3 (Windows); code reading at main @ 1152e91

Environment

Windows 11 Pro, T3 Code desktop 0.1.3, Claude and Codex providers, private GitHub repo, gh authenticated with repo scope.

Workaround

Agents copy the image to a local folder and embed the local path in chat, keeping the GitHub URL only for the PR description. It works, but every agent has to remember it, and it is the usual way PR screenshots end up broken in the hand-back message.

Note

This is likely a small change (pass sourceControlMedia for assistant messages in a thread with a cwd), but it does make chat content able to trigger authenticated fetches of the repo's media, so I am filing it for triage first rather than sending a PR. Happy to send one if the direction is wanted.