fix: propagate authorization header to subagents

[towsif-rahman]

Summary

• Pass parent session headers into sub-agent A2A call contexts for both initial calls and HITL resume calls.
• Forward the parent Authorization header from _SubagentInterceptor while preserving existing x-user-id and x-kagent-source headers.
• Add focused unit coverage for context header propagation and interceptor filtering behavior.

Test plan

• UV_NATIVE_TLS=true UV_PROJECT_ENVIRONMENT=/home/ubuntu/oneai_devops/kagent/.venv ../.venv/bin/uv run --python /home/ubuntu/oneai_devops/kagent/.venv/bin/python pytest ./packages/kagent-adk/tests/unittests/test_remote_a2a_tool.py

Closes #1745

[Copilot]

Pull request overview

Propagates the parent agent session’s request headers (notably Authorization) into sub-agent A2A calls so JWT/auth context is preserved across supervisor → sub-agent delegation, including HITL resume flows.

Changes:

• Add _build_subagent_call_context() to include session.state["headers"] in ClientCallContext for both first-call and resume paths.
• Update _SubagentInterceptor to forward the parent Authorization header (case-insensitive) while preserving existing x-user-id and x-kagent-source behavior.
• Add unit tests covering call context header propagation and interceptor filtering/override behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
python/packages/kagent-adk/src/kagent/adk/_remote_a2a_tool.py	Build A2A call contexts with session headers and forward Authorization via the subagent interceptor.
python/packages/kagent-adk/tests/unittests/test_remote_a2a_tool.py	Add focused unit tests for header propagation into call contexts and for interceptor behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[supreme-gg-gg]

hi @towsif-rahman, the changes look good here. Can you also do it for the go runtime: https://github.com/kagent-dev/kagent/blob/main/go/adk/pkg/tools/remote_a2a_tool.go

[towsif-rahman]

@supreme-gg-gg Added same implementation to Go runtime

Need to fix go lint

[towsif-rahman]

@supreme-gg-gg Pushed a change for Go lint.. would you mind running again

[EItanya]

I really don't like that we're creating new context keys for all of our values. Can we re-use something similar to this PR: #1733

[supreme-gg-gg]

Agreed, we should also do the same for userID here so there's no need for context keys for the interceptor and it's self-contained (reads directly from A2A server and tool context)

[supreme-gg-gg]

Pushed a change for Go lint.. would you mind running again

Doesn't seem like it passed, can you make sure to run it locally...