WAM broker account picker still prompts on every MCP tool call despite defaultAccount and --account (v0.4.1)

WAM broker account picker still prompts on every MCP tool call despite defaultAccount and --account (v0.4.1)

Description

When using WorkIQ as an MCP server (via GitHub Copilot CLI), the WAM broker account picker dialog pops up on every tool call, despite:

• defaultAccount being set in ~/.work-iq-cli/.workiq.json
• --account mib...@microsoft.com passed as a global CLI arg
• --tenant-id 72f988bf-86f1-41af-91ab-2d7cd011db47 passed as a global CLI arg
• v0.4.1 changelog stating "Fixed WAM broker account picker prompting on every call"

The WAM broker must be used because the Microsoft corp tenant enforces a token protection Conditional Access policy (error 530084), which blocks browser-based fallback auth. So disableBrokeredAuth is not an option.

Steps to reproduce

1. Install WorkIQ globally: npm install -g @microsoft/workiq@latest
2. Configure .workiq.json with defaultAccount:

   {
     "I-accept-EULA": "true",
     "defaultAccount": "mib...@microsoft.com",
     "isMSITTenant": "true",
     "experimental": "false"
   }
   

3. Configure MCP server in .mcp.json:

   {
     "mcpServers": {
       "workiq": {
         "command": "workiq",
         "args": ["--tenant-id", "72f988bf-86f1-41af-91ab-2d7cd011db47", "--account", "mib...@microsoft.com", "mcp"],
         "tools": ["*"]
       }
     }
   }
   

4. Use any WorkIQ MCP tool (e.g. ask_work_iq) from GitHub Copilot CLI
5. Observe: WAM account picker popup appears on every call (not just the first)

Expected behavior

After the first successful WAM authentication, subsequent MCP tool calls should use the cached WAM token silently — especially when defaultAccount and --account are configured.

Actual behavior

The WAM account picker dialog appears on every tool call. If the user doesn't respond to the popup quickly enough, auth fails entirely. This makes the MCP server mode effectively unusable in interactive workflows.

Additional context

• Setting disableBrokeredAuth: true causes browser-based auth, which is blocked by the tenant's token protection CA policy (error code 530084, app ID ba081686-5d24-4bc6-a0d6-d034ecffed87).
• The defaultAccount config key and --account flag do not appear to influence WAM's silent token acquisition in MCP server mode.
• The 0.4.0 changelog mentions "Store DefaultAccount to enable cached token retrieval" and "Warm up token cache for MCP server mode" — these fixes don't seem to be taking effect.

Environment

• WorkIQ version: 0.4.1.19742
• Node.js: v22.18.0
• OS: Windows 11 (NT 10.0.26200.0)
• Install method: npm install -g @microsoft/workiq
• Client: GitHub Copilot CLI (Agency) v1.0.43
• Tenant: Microsoft corp (72f988bf-86f1-41af-91ab-2d7cd011db47)
• Token protection CA policy: Enabled (blocks non-WAM auth)

Start by reproducing the issue through the workiq mcp entry point with defaultAccount, --account, and --tenant-id configured, then trace the WAM authentication and token-cache behavior for repeated MCP tool calls. Done means subsequent calls use the cached WAM token silently without showing the account picker, while browser fallback remains disabled.