coleam00/Archon · error · Error

Copilot authentication failed: ${combined} Run `copilot log

Error message

Copilot authentication failed: ${combined}

Run `copilot login` (default), set COPILOT_GITHUB_TOKEN, or set `useLoggedInUser: false` in `.archon/config.yaml` to use GH_TOKEN / GITHUB_TOKEN.

What it means

Same buildFriendlyCopilotError classification path, but for authentication failures: the Copilot CLI/SDK sign-in was missing or rejected. The message aggregates the thrown error with the SDK's session.error detail and lists the three supported auth routes: interactive `copilot login`, COPILOT_GITHUB_TOKEN, or useLoggedInUser:false with GH_TOKEN/GITHUB_TOKEN in .archon/config.yaml.

Source

Thrown at packages/providers/src/community/copilot/provider.ts:620

        skills: sessionConfig.skillDirectories?.length ?? 0,
        agents: sessionConfig.customAgents?.length ?? 0,
        tokenSource,
        resumed: resumeSessionId !== undefined && !resumeFailed,
      },
      'copilot.session_started'
    );

    try {
      yield* bridgeSession(
        session,
        effectivePrompt,
        requestOptions?.abortSignal,
        wantsStructured ? outputFormat.schema : undefined
      );
      log.info({ sessionId: session.sessionId }, 'copilot.prompt_completed');
    } catch (err) {
      log.error({ err, sessionId: session.sessionId }, 'copilot.prompt_failed');
      throw buildFriendlyCopilotError(err);
    } finally {
      // Stop the client so its CLI subprocess shuts down; bridgeSession already
      // handled session.abort() + session.disconnect() in its own finally.
      try {
        const stopErrors = await client.stop();
        if (stopErrors.length > 0) {
          log.warn({ errors: stopErrors.map(e => e.message) }, 'copilot.client_stop_errors');
        }
      } catch (stopErr) {
        log.debug({ err: stopErr }, 'copilot.client_stop_threw');
      }
    }
  }
}

View on GitHub (pinned to 0773b97458)

Solutions

Run `copilot login` interactively on the machine running Archon.
Export COPILOT_GITHUB_TOKEN with a token that has Copilot access.
Alternatively set useLoggedInUser: false in .archon/config.yaml and provide GH_TOKEN/GITHUB_TOKEN (e.g. a CI token with Copilot entitlement).
If a token is present but rejected, read the `combined` detail for expiry/scope messages and regenerate the token.

Example fix

# CI environment
export COPILOT_GITHUB_TOKEN=ghp_xxx
# or .archon/config.yaml
assistants:
  copilot:
    useLoggedInUser: false

Defensive patterns

Strategy: validation

Validate before calling

// before running Copilot nodes
const hasInteractiveLogin = await exists('~/.config/github-copilot');
const hasToken = Boolean(process.env.COPILOT_GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN);
if (!hasInteractiveLogin && !hasToken) {
  throw new Error('No Copilot credentials: run `copilot login` or export COPILOT_GITHUB_TOKEN');
}

Try / catch

try {
  await runCopilotNode(node);
} catch (err) {
  if (err instanceof Error && err.message.startsWith('Copilot authentication failed:')) {
    throw new Error('Re-authenticate: `copilot login`, or set COPILOT_GITHUB_TOKEN (CI)');
  }
  throw err;
}

Prevention

In CI, always export COPILOT_GITHUB_TOKEN (or GH_TOKEN with useLoggedInUser:false) as a secret.
Rotate Copilot tokens before expiry and verify Copilot entitlement on new tokens.
After `copilot login`, confirm the logged-in user matches the intended account.
Run a one-prompt smoke test after any credential rotation.

When it happens

Trigger: Running a Copilot provider node with no prior `copilot login`, an expired GitHub token, a token lacking Copilot entitlement, GITHUB_TOKEN set to an invalid PAT while useLoggedInUser is false, or CI where no interactive login exists and no token env var is exported.

Common situations: First run in CI without COPILOT_GITHUB_TOKEN; token expired or rotated; `copilot login` done under a different user than the token env vars imply; GitHub SSO/organization requires re-authorization; GITHUB_TOKEN is a fine-grained PAT without Copilot access.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/5f763962e577bbce. Report an issue: GitHub.