Subagents fail with HTTP 401 when using OAuth authentication

Problem

When the root agent is authenticated via OAuth, subagents launched via the Agent tool fail with authentication errors, while the root agent works perfectly fine.

Error Messages

• LLM API error (HTTP 401): The API Key appears to be invalid or may have expired
• LLM provider error: Connection error

Root Cause Analysis

The root agent successfully uses OAuth (credentials stored in ~/.kimi/credentials/kimi-code.json). However, subagents are spawned as separate processes and do not inherit the OAuth context from the parent. Instead, they read api_key = "" from ~/.kimi/config.toml and attempt to authenticate with an empty key, resulting in 401.

Config (~/.kimi/config.toml)

[providers."managed:kimi-code"]
type = "kimi"
base_url = "https://api.kimi.com/coding/v1"
api_key = ""                              # empty!

[providers."managed:kimi-code".oauth]
storage = "file"
key = "oauth/kimi-code"

Logs

Using LLM provider: ... api_key=SecretStr('') ... oauth=OAuthRef(storage='file', key='oauth/kimi-code')
...
kosong.chat_provider.APIStatusError: Error code: 401 - {'error': {'message': 'The API Key appears to be invalid...'}}

Workaround

Manually setting an API key fixes the issue:

kimi config set providers.managed:kimi-code.api_key "sk-..."

After setting the API key, subagents work correctly because they can authenticate with the explicit key instead of relying on OAuth inheritance.

Expected Behavior

Subagents should either:

1. Inherit the OAuth authentication context from the parent agent, or
2. Fall back to OAuth credentials when api_key is empty.

Actual Behavior

Subagents only attempt to use api_key and fail with 401 when it is empty, ignoring the available OAuth credentials.

Environment

• OS: macOS
• Kimi CLI version: latest (installed via uv)
• Auth method: OAuth (device auth)
• Python: 3.13

Steps to Reproduce

1. Authenticate via OAuth: kimi login --device-auth
2. Ensure ~/.kimi/config.toml has api_key = ""
3. Start any session and call the Agent tool with a simple task
4. Observe 401 / Connection error from the subagent

Suggested Fix

Pass OAuth context (or a temporary token) to subagent processes, or ensure subagents read and use the same OAuth credentials file as the root agent.

Start by tracing the Agent tool's subagent process and how it reads ~/.kimi/config.toml and ~/.kimi/credentials/kimi-code.json after kimi login --device-auth. Reproduce with an empty api_key and OAuth credentials, then verify that a subagent completes a simple task without HTTP 401 while explicit API-key authentication still works.