Agent Sessions: GitHub MCP tools lost permanently after a credential failure — no retry, no reset path, no error surfaced

- VS Code Version: 1.133.0 (a5b5009)
- Copilot Chat Extension Version: 0.61.0 (bundled)
- Bundled Copilot CLI: 1.0.79-6
- OS Version: macOS 26.6.1
- Feature: Agent Sessions + built-in GitHub MCP server
- Split out from the root-cause investigation on #327640 (that issue stays scoped to the auth-flow feedback gaps)

## Summary

When the Agent Host's GitHub credential handoff to the Copilot CLI fails (here: the stored token was invalidated by a local keychain incident, but any token expiry/revocation should be equivalent), agent sessions lose the built-in GitHub MCP server **permanently**:

1. The handoff never recovers, even after account auth is healthy again. The CLI initially retried and got 401s; after it gave up, every subsequent agent-host CLI process makes **zero** MCP connection attempts (no `rmcp` activity at all in `~/.copilot/logs/process-*.log`).
2. No affordance resets it. Everything I could find was tried without effect (details below).
3. The failure is silent. Lanes just come up without GitHub tools; nothing in the UI, the CLI process logs, or the agent-host log indicates that the credential handoff failed.

## Root-cause isolation

Agent sessions run inside the bundled Copilot CLI, spawned headless with `--stdio --headless --no-auto-login`. The CLI configures its built-in GitHub MCP server only after it has GitHub auth, and `--no-auto-login` disables all ambient auth, so credentials can only arrive over the IDE's stdio bridge. Running the **same bundled binary** standalone (`node .../@github/copilot-darwin-arm64/index.js`):

| Mode | Auth | GitHub MCP |
| --- | --- | --- |
| default, `-p` prompt | gh-CLI keyring fallback (debug: `[rust:copilot_runtime::auth::gh] GitHub CLI authenticated with valid token`) | works: `github-mcp-server-*` tools discovered, API calls succeed |
| `--no-auto-login` | "No authentication information found" | none |
| `--no-auto-login` + valid `COPILOT_GITHUB_TOKEN` | same error: env tokens ignored in this mode | none |

So client, endpoint, account, and machine are all healthy; only the IDE-side credential push into the CLI is broken.

## Recovery attempts (all ineffective for agent sessions)

- Full GitHub account sign-out/sign-in in VS Code (all consumers re-prompted, account healthy afterwards) + full relaunch.
- Disable → re-enable of the built-in GitHub server (Agent Customizations → MCP Servers). Its context menu offers nothing else: no authenticate, sign-in, or restart action.
- `MCP: List Servers → GitHub → Start Server`: the editor/chat server starts cleanly ("Discovered 47 tools", no auth challenge) — but agent sessions don't route through it.
- `Authentication: Remove Dynamic Authentication Providers`: reports none exist.
- Settings variations: `github.copilot.chat.githubMcpServer.enabled: true`, `github.copilot.chat.cli.mcp.enabled: false` (each followed by a relaunch).
- Account MCP policy verified healthy: `mcpAccess: "allow_all"`.

Verification after each attempt: a fresh agent session's tool inventory (no `github-*` tools) and the newest CLI process log (zero MCP activity).

## Expected

- The credential handoff retries once account auth is healthy again, instead of giving up permanently.
- Some user-visible way to reset/re-trigger it (a re-auth action on the server entry, or an effect from account sign-in).
- When the handoff fails, an error surfaces: in the server list UI, the session, or at least the CLI/agent-host logs.

Timeline and log evidence (401 era → silent era) in #327640 [comment](https://github.com/microsoft/vscode/issues/327640#issuecomment-5292331632); can provide full logs privately.