{"record":{"id":"3ec9a5ff278efd40","repo":"github/copilot-sdk","slug":"githubtoken-and-useloggedinuser-cannot-be-used-wit-3ec9a5","errorCode":null,"errorMessage":"GitHubToken and UseLoggedInUser cannot be used with URIConnection (external runtime manages its own auth)","messagePattern":"GitHubToken and UseLoggedInUser cannot be used with URIConnection \\(external runtime manages its own auth\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/client.go","lineNumber":298,"sourceCode":"\t\tclient.useStdio = false\n\t\tclient.tcpConnectionToken = conn.ConnectionToken\n\tcase InProcessConnection:\n\t\tclient.useStdio = false\n\t\tclient.useInProcess = true\n\tdefault:\n\t\tpanic(fmt.Sprintf(\"unknown RuntimeConnection type: %T\", connection))\n\t}\n\n\t// Validate transport-specific option constraints (fail loud). The in-process\n\t// transport loads the runtime into this process, whose single environment\n\t// block, process-global working directory, and shared telemetry state cannot\n\t// carry per-client values. Child-process transports may set env via either\n\t// the client-level option or the connection, but not both.\n\tvalidateEnvironmentOptions(connection, &opts)\n\n\t// Validate auth options when connecting to an external runtime.\n\tif client.isExternalServer && (opts.GitHubToken != \"\" || opts.UseLoggedInUser != nil) {\n\t\tpanic(\"GitHubToken and UseLoggedInUser cannot be used with URIConnection (external runtime manages its own auth)\")\n\t}\n\n\t// For child-process transports, a connection-level env takes precedence over\n\t// the client-level env (setting both was rejected above). Resolve it before\n\t// defaulting so an explicit empty connection env stays authoritative.\n\tif cp, ok := connection.(childProcessConnection); ok {\n\t\tif env := cp.connEnv(); env != nil {\n\t\t\topts.Env = env\n\t\t}\n\t}\n\n\t// Default Env to current environment if not set\n\tif opts.Env == nil {\n\t\topts.Env = os.Environ()\n\t}\n\n\t// Check the effective environment for a child-process runtime override.\n\tif client.cliPath == \"\" && !client.useInProcess {","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/go/client.go#L280-L316","documentation":"NewClient panics when connecting to an external runtime via URIConnection while also supplying auth options (GitHubToken or UseLoggedInUser). An external server manages its own authentication; per-client auth supplied by the SDK client would conflict with or be ignored by it, so the SDK rejects the combination.","triggerScenarios":"Calling NewClient with Connection: URIConnection{URL: ...} (which sets client.isExternalServer) and either Options.GitHubToken != \"\" or Options.UseLoggedInUser != nil. Panic at go/client.go:298.","commonSituations":"Shared client-construction helper that always sets GitHubToken, then reused for an attach-to-external-server code path; copying auth settings from a stdio-based setup into a URIConnection setup.","solutions":["Remove GitHubToken and UseLoggedInUser from the options when using URIConnection; authenticate at the external runtime itself.","If you need the SDK to manage auth, switch to StdioConnection (child-process transport) instead.","Conditionally build the Options struct based on whether you're attaching or spawning."],"exampleFix":"// before\nclient := clientpkg.NewClient(&clientpkg.Options{\n    Connection:  clientpkg.URIConnection{URL: \"http://127.0.0.1:4141\"},\n    GitHubToken: token,\n})\n// after\nclient := clientpkg.NewClient(&clientpkg.Options{\n    Connection: clientpkg.URIConnection{URL: \"http://127.0.0.1:4141\"},\n    // auth is managed by the external runtime\n})","handlingStrategy":"validation","validationCode":"if _, ok := opts.Connection.(clientpkg.URIConnection); ok && (opts.GitHubToken != \"\" || opts.UseLoggedInUser != nil) {\n    return fmt.Errorf(\"auth options are not allowed with URIConnection\")\n}","typeGuard":"func isExternalServer(c clientpkg.RuntimeConnection) bool { _, ok := c.(clientpkg.URIConnection); return ok }","tryCatchPattern":null,"preventionTips":["Keep auth options only in the spawn-a-runtime code path.","Authenticate the external server itself, not the attaching client.","Build options conditionally based on attach-vs-spawn mode."],"tags":["go","panic","authentication","connection","configuration"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}