Built-in `task` tool fails with "No GitHub OAuth token" in BYOK/Azure AI Foundry deployments

[jbayardo]

Description

When using the Copilot SDK with a BYOK (Bring Your Own Key) Azure AI Foundry provider, the built-in task tool always fails because the sub-agent it spawns cannot authenticate. The parent session authenticates via Azure AI Foundry, but the sub-agent expects GitHub OAuth or Copilot HMAC credentials which don't exist in BYOK mode.

Every task invocation fails immediately with:

{
  "message": "Error: No GitHub OAuth token or Copilot HMAC key provided",
  "code": "failure"
}

This also means MCP servers configured in the parent session are inaccessible to sub-agents, since they never get past the auth step.

Environment

• Copilot SDK Version: 0.1.26 (.NET)
• .NET Version: 10.0
• OS: Linux (Ubuntu 24.04, containerized)
• Provider: Azure AI Foundry BYOK (type: "azure")
• Model: gpt-5.2

Steps to Reproduce

1. Create a Copilot client with a BYOK Azure AI Foundry provider
2. Create a session with MCP servers configured
3. Send a prompt that causes the agent to use the task tool
4. The model calls the task tool to delegate work to a sub-agent
5. The sub-agent immediately fails with the auth error above

var client = new CopilotClient(new CopilotClientOptions
{
    CliPath = "copilot",
    UseStdio = true
});

await client.StartAsync();

var session = await client.CreateSessionAsync(new SessionConfig
{
    Model = "gpt-5.2",
    Provider = new ProviderConfig
    {
        Type = "azure",
        BaseUrl = "https://my-resource.services.ai.azure.com/openai/deployments/gpt-5.2",
        ApiKey = "<key>"
    },
    McpServers = new Dictionary<string, McpServerConfig>
    {
        ...
    }
});

// Agent will try to use `task` tool to delegate to a sub-agent
// Sub-agent fails with "No GitHub OAuth token or Copilot HMAC key provided"
await session.SendAndWaitAsync(new MessageOptions
{
    Prompt = "...."
});

Expected Behavior

The task tool should either:

1. Propagate the parent session's auth context (BYOK provider config) and MCP server configurations to the sub-agent, OR
2. Fail gracefully with an error indicating that task is not supported in BYOK mode, so the model can fall back to direct tool calls

Actual Behavior

The task tool spawns a sub-agent that immediately fails because it tries to authenticate via GitHub OAuth/HMAC, which is not available in BYOK deployments. The error gives the model no indication that it should retry the same work as a direct tool call instead.

Impact

This effectively breaks any multi-step investigation workflow in BYOK mode:

• The model prefers delegating MCP tool calls via task (likely trained on patterns where task works)
• task always fails in BYOK mode
• The model rarely recovers by calling MCP tools directly
• The session produces empty results despite MCP servers being configured and available

Related Issues

• MCP servers in CustomAgentConfig are not exposed to the agent during execution #553 — MCP servers in CustomAgentConfig are not exposed to the agent during execution (similar MCP propagation problem, but for custom agents rather than built-in task)
• Custom Agents are not working | Node | Dotnet #251 — Custom Agents are not working (custom agent configs overwritten during session init)
• Sub-agent messages are queued instead of streamed in real-time #477 — Sub-agent messages are queued instead of streamed (separate sub-agent issue)

[github-actions]

Thanks for the detailed bug report, @jbayardo! This is a well-documented issue with clear reproduction steps.

Labels applied: bug, sdk/dotnet

This appears to be a legitimate issue where the built-in task tool doesn't propagate BYOK authentication context or MCP server configurations to sub-agents, breaking multi-step workflows in Azure AI Foundry deployments. As you noted, it's related to similar configuration propagation issues in #553, #251, and #477.

The team will review this and determine the appropriate fix—either propagating the parent auth context or failing gracefully with a clear error message.

---

🤖 Triaged by Issue Triage Agent

AI generated by Issue Triage Agent