azdo-cli 0.11.0 → 0.13.0

package/dist/index.js

@@ -6,15 +6,19 @@ import {
   SETTINGS,
   appendAuthAuditEvent,
   buildScopeString,
+  copyOrgScope,
   defaultScopes,
+  deleteOrgScope,
   deletePat,
   firstPartyShippedScopes,
   getConfigValue,
+  getOrgScopedValue,
   getPat,
   getStoredCredential,
   listOrgsWithStoredPat,
   loadConfig,
   maskedDisplay,
+  moveOrgScope,
   normalizePat,
   openUrl,
   probeBackend,
@@ -22,16 +26,19 @@ import {
   readTokenResponse,
   refreshIfNeeded,
   resolveOAuthConfig,
+  resolveScopedConfig,
   runAuthCodeFlow,
   setConfigValue,
+  setOrgScopedValue,
   storeOAuthCredential,
   storePat,
   tokenResponseToCredential,
-  unsetConfigValue
-} from "./chunk-C7RAZJHV.js";
+  unsetConfigValue,
+  unsetOrgScopedValue
+} from "./chunk-XVXMDWQE.js";
 
 // src/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command17 } from "commander";
 
 // src/version.ts
 import { readFileSync } from "fs";
@@ -44,6 +51,78 @@ var version = pkg.version;
 // src/commands/get-item.ts
 import { Command } from "commander";
 
+// src/services/trace-writer.ts
+import { openSync, writeSync, closeSync } from "fs";
+import { platform } from "os";
+var REDACTED = "[REDACTED]";
+var SENSITIVE_HEADER = /^(authorization|x-.*token)$/i;
+var SENSITIVE_QUERY_PARAM = /^(token|pat)$/i;
+var SENSITIVE_BODY_FIELD = /^(token|accessToken|pat)$/;
+function redactHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADER.test(key) ? REDACTED : value;
+  }
+  return out;
+}
+function redactUrl(url) {
+  try {
+    const u = new URL(url);
+    for (const [key] of u.searchParams.entries()) {
+      if (SENSITIVE_QUERY_PARAM.test(key)) {
+        u.searchParams.set(key, REDACTED);
+      }
+    }
+    return u.toString();
+  } catch {
+    return url;
+  }
+}
+function redactBody(body) {
+  if (body === null) return null;
+  try {
+    const parsed = JSON.parse(body);
+    let changed = false;
+    const redacted = { ...parsed };
+    for (const key of Object.keys(parsed)) {
+      if (SENSITIVE_BODY_FIELD.test(key)) {
+        redacted[key] = REDACTED;
+        changed = true;
+      }
+    }
+    return changed ? JSON.stringify(redacted) : body;
+  } catch {
+    return body;
+  }
+}
+var TraceWriter = class {
+  fd;
+  constructor(filepath) {
+    const mode = platform() === "win32" ? void 0 : 384;
+    this.fd = openSync(filepath, "a", mode);
+  }
+  append(entry) {
+    const line = JSON.stringify(entry) + "\n\n";
+    writeSync(this.fd, line);
+  }
+  close() {
+    closeSync(this.fd);
+  }
+};
+var activeWriter = null;
+function initTraceWriter(filepath) {
+  try {
+    activeWriter = new TraceWriter(filepath);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Warning: could not open trace file "${filepath}": ${msg}
+`);
+  }
+}
+function getActiveTraceWriter() {
+  return activeWriter;
+}
+
 // src/services/azdo-client.ts
 var DEFAULT_FIELDS = [
   "System.Title",
@@ -67,12 +146,48 @@ function authHeaders(credentialOrPat) {
   const token = Buffer.from(`:${credentialOrPat.pat}`).toString("base64");
   return { Authorization: `Basic ${token}` };
 }
+async function fetchRaw(url, init) {
+  let response;
+  try {
+    response = await fetch(url, init);
+  } catch (err) {
+    throw new Error(`NETWORK_ERROR: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+  }
+  const body = await response.text();
+  return { status: response.status, body };
+}
 async function fetchWithErrors(url, init) {
+  const writer = getActiveTraceWriter();
   let response;
   try {
     response = await fetch(url, init);
-  } catch {
-    throw new Error("NETWORK_ERROR");
+  } catch (err) {
+    throw new Error("NETWORK_ERROR", { cause: err });
+  }
+  if (writer) {
+    const reqHeaders = redactHeaders(init.headers ?? {});
+    const reqBody = typeof init.body === "string" ? redactBody(init.body) : null;
+    let responseBody = "";
+    const clone = response.clone();
+    try {
+      responseBody = await clone.text();
+    } catch {
+    }
+    const respHeaders = {};
+    response.headers.forEach((v, k) => {
+      respHeaders[k] = v;
+    });
+    const entry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      method: (init.method ?? "GET").toUpperCase(),
+      url: redactUrl(url),
+      requestHeaders: reqHeaders,
+      requestBody: reqBody ?? null,
+      responseStatus: response.status,
+      responseHeaders: respHeaders,
+      responseBody
+    };
+    writer.append(entry);
   }
   if (response.status === 401) throw new Error("AUTH_FAILED");
   if (response.status === 403) throw new Error("PERMISSION_DENIED");
@@ -245,28 +360,66 @@ async function fetchWorkItemResponse(context, id, cred, options = {}) {
   }
   return await response.json();
 }
-async function getWorkItem(context, id, cred, extraFields) {
-  const normalizedExtraFields = extraFields ? normalizeFieldList(extraFields) : [];
-  const data = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, cred, {
-    fields: normalizeFieldList([...DEFAULT_FIELDS, ...normalizedExtraFields])
-  }) : await fetchWorkItemResponse(context, id, cred, { includeRelations: true });
-  const relationsData = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, cred, { includeRelations: true }) : data;
-  const descriptionParts = [];
-  if (data.fields["System.Description"]) {
-    descriptionParts.push({ label: "Description", value: data.fields["System.Description"] });
+async function getOrgFieldNames(context, cred) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/wit/fields`
+  );
+  url.searchParams.set("api-version", "7.1");
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
+  }
+  const data = await response.json();
+  return (data.value ?? []).map((f) => f.referenceName);
+}
+function buildCombinedDescription(fields) {
+  const parts = [];
+  if (fields["System.Description"]) {
+    parts.push({ label: "Description", value: fields["System.Description"] });
   }
-  if (data.fields["Microsoft.VSTS.Common.AcceptanceCriteria"]) {
-    descriptionParts.push({ label: "Acceptance Criteria", value: data.fields["Microsoft.VSTS.Common.AcceptanceCriteria"] });
+  if (fields["Microsoft.VSTS.Common.AcceptanceCriteria"]) {
+    parts.push({ label: "Acceptance Criteria", value: fields["Microsoft.VSTS.Common.AcceptanceCriteria"] });
   }
-  if (data.fields["Microsoft.VSTS.TCM.ReproSteps"]) {
-    descriptionParts.push({ label: "Repro Steps", value: data.fields["Microsoft.VSTS.TCM.ReproSteps"] });
+  if (fields["Microsoft.VSTS.TCM.ReproSteps"]) {
+    parts.push({ label: "Repro Steps", value: fields["Microsoft.VSTS.TCM.ReproSteps"] });
+  }
+  if (parts.length === 0) return null;
+  if (parts.length === 1) return parts[0].value;
+  return parts.map((p) => `<h3>${p.label}</h3>${p.value}`).join("");
+}
+async function fetchWorkItemWithFallback(context, id, cred, normalizedExtraFields) {
+  try {
+    const data = await fetchWorkItemResponse(context, id, cred, {
+      fields: normalizeFieldList([...DEFAULT_FIELDS, ...normalizedExtraFields])
+    });
+    return { data, effectiveExtraFields: normalizedExtraFields };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!msg.includes("TF51535")) throw err;
+    const orgFieldNames = await getOrgFieldNames(context, cred);
+    const orgFieldsLower = new Set(orgFieldNames.map((n) => n.toLowerCase()));
+    const missing = normalizedExtraFields.filter((f) => !orgFieldsLower.has(f.toLowerCase()));
+    const effectiveExtraFields = normalizedExtraFields.filter((f) => orgFieldsLower.has(f.toLowerCase()));
+    for (const f of missing) {
+      process.stderr.write(`azdo: warning: field '${f}' does not exist in organization '${context.org}' and was skipped
+`);
+    }
+    const data = await fetchWorkItemResponse(context, id, cred, {
+      fields: normalizeFieldList([...DEFAULT_FIELDS, ...effectiveExtraFields])
+    });
+    return { data, effectiveExtraFields };
   }
-  let combinedDescription = null;
-  if (descriptionParts.length === 1) {
-    combinedDescription = descriptionParts.at(0)?.value ?? null;
-  } else if (descriptionParts.length > 1) {
-    combinedDescription = descriptionParts.map((p) => `<h3>${p.label}</h3>${p.value}`).join("");
+}
+async function getWorkItem(context, id, cred, extraFields) {
+  const normalizedExtraFields = extraFields ? normalizeFieldList(extraFields) : [];
+  let effectiveExtraFields = normalizedExtraFields;
+  let data;
+  if (normalizedExtraFields.length > 0) {
+    ({ data, effectiveExtraFields } = await fetchWorkItemWithFallback(context, id, cred, normalizedExtraFields));
+  } else {
+    data = await fetchWorkItemResponse(context, id, cred, { includeRelations: true });
   }
+  const relationsData = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, cred, { includeRelations: true }) : data;
   return {
     id: data.id,
     rev: data.rev,
@@ -274,11 +427,11 @@ async function getWorkItem(context, id, cred, extraFields) {
     state: data.fields["System.State"],
     type: data.fields["System.WorkItemType"],
     assignedTo: data.fields["System.AssignedTo"]?.displayName ?? null,
-    description: combinedDescription,
+    description: buildCombinedDescription(data.fields),
     areaPath: data.fields["System.AreaPath"],
     iterationPath: data.fields["System.IterationPath"],
     url: data._links.html.href,
-    extraFields: normalizedExtraFields.length > 0 ? buildExtraFields(data.fields, normalizedExtraFields) : null,
+    extraFields: effectiveExtraFields.length > 0 ? buildExtraFields(data.fields, effectiveExtraFields) : null,
     attachments: extractAttachments(relationsData.relations)
   };
 }
@@ -479,13 +632,13 @@ async function classifyDeviceTokenResponse(response) {
 async function pollForDeviceToken(deviceCode, oauthConfig, initialIntervalSec, expiresAtMs, deps) {
   const fetchFn = deps.fetch ?? fetch;
   const now = deps.now ?? (() => Date.now());
-  const sleep = deps.sleep ?? defaultSleep;
+  const sleep2 = deps.sleep ?? defaultSleep;
   let intervalSec = Math.max(MIN_INTERVAL_SEC, initialIntervalSec);
   for (; ; ) {
     if (now() >= expiresAtMs) {
       throw new DeviceCodeFlowError("expired_token", "device-code flow expired before authorisation completed");
     }
-    await sleep(intervalSec * 1e3);
+    await sleep2(intervalSec * 1e3);
     const body = new URLSearchParams({
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
       client_id: oauthConfig.clientId,
@@ -579,7 +732,7 @@ function findDotEnvPat(startDir = process.cwd()) {
     if (existsSync(envFile)) {
       const contents = readFileSync2(envFile, "utf8");
       for (const line of contents.split("\n")) {
-        const match = line.match(/^AZDO_PAT\s*=\s*(.+)$/);
+        const match = line.match(/^AZDO_PAT\s*=([^\n\r]+)$/);
         if (match) {
           const value = match[1].trim().replace(/^["']|["']$/g, "");
           if (value.length > 0) return value;
@@ -765,23 +918,39 @@ async function status() {
 }
 
 // src/services/git-remote.ts
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
+import fs from "fs";
+import path from "path";
 
 // src/services/remote-warning.ts
-var WARNING = "azdo: warning: origin includes embedded credentials; consider removing them with 'git remote set-url origin <clean-url>'\n";
 var warned = false;
-function noticeCredentialBearingRemote() {
+function buildWarning(remoteName) {
+  return `azdo: warning: ${remoteName} includes embedded credentials; consider removing them with 'git remote set-url ${remoteName} <clean-url>'
+`;
+}
+function noticeCredentialBearingRemote(remoteName = "origin") {
   if (warned) {
     return;
   }
   warned = true;
   try {
-    process.stderr.write(WARNING);
+    process.stderr.write(buildWarning(remoteName));
   } catch {
   }
 }
 
 // src/services/git-remote.ts
+var GIT_BINARY = (() => {
+  const known = process.platform === "win32" ? [String.raw`C:\Program Files\Git\bin\git.exe`, String.raw`C:\Program Files (x86)\Git\bin\git.exe`] : ["/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"];
+  return known.find((p) => {
+    try {
+      execFileSync(p, ["--version"], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }) ?? "git";
+})();
 var patterns = [
   // HTTPS (current): https://[user[:token]@]dev.azure.com/{org}/{project}/_git/{repo}[.git]
   /^https?:\/\/(?:[^@/]+@)?dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
@@ -794,41 +963,144 @@ var patterns = [
   // SSH (legacy): {org}@vs-ssh.visualstudio.com:v3/{org}/{project}/{repo}[.git]
   /^[^@]+@vs-ssh\.visualstudio\.com:v3\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?$/
 ];
-var httpsUserinfo = /^https?:\/\/[^@/]+@/;
-function parseAzdoRemote(url) {
+var httpsEmbeddedSecret = /^https?:\/\/[^:@/]+:[^@/]+@/;
+function parseSingleRemoteLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return null;
+  const tabIdx = trimmed.indexOf("	");
+  if (tabIdx === -1) return null;
+  const remoteName = trimmed.slice(0, tabIdx);
+  const afterTab = trimmed.slice(tabIdx + 1);
+  const urlEnd = afterTab.lastIndexOf(" (");
+  const url = urlEnd === -1 ? afterTab : afterTab.slice(0, urlEnd);
+  return { remoteName, url };
+}
+function decodePctSegment(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+function matchAzdoRemote(remoteName, url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
-    if (match) {
-      if (httpsUserinfo.test(url)) {
-        noticeCredentialBearingRemote();
+    if (!match) continue;
+    const project = decodePctSegment(match[2]);
+    if (/^DefaultCollection$/i.test(project)) return null;
+    return { remoteName, org: match[1], project, hasEmbeddedSecret: httpsEmbeddedSecret.test(url) };
+  }
+  return null;
+}
+function parseAllAzdoRemotes(output) {
+  const seen = /* @__PURE__ */ new Set();
+  const results = [];
+  for (const line of output.split("\n")) {
+    const parsed = parseSingleRemoteLine(line);
+    if (!parsed) continue;
+    const { remoteName, url } = parsed;
+    if (seen.has(remoteName)) continue;
+    const candidate = matchAzdoRemote(remoteName, url);
+    if (candidate) {
+      seen.add(remoteName);
+      results.push(candidate);
+    }
+  }
+  return results;
+}
+function selectRemote(candidates) {
+  if (candidates.length === 0) {
+    throw new Error("No Azure DevOps remote found. Provide --org and --project explicitly.");
+  }
+  const origin = candidates.find((c) => c.remoteName === "origin");
+  if (origin) return origin;
+  if (candidates.length === 1) return candidates[0];
+  const first = candidates[0];
+  const allSame = candidates.every(
+    (c) => c.org.toLowerCase() === first.org.toLowerCase() && c.project.toLowerCase() === first.project.toLowerCase()
+  );
+  if (allSame) return first;
+  const lines = candidates.map((c) => `  ${c.remoteName.padEnd(8)} \u2192 ${c.org}/${c.project}`).join("\n");
+  throw new Error(
+    `Multiple Azure DevOps remotes found with different org/project:
+${lines}
+Use --org/--project (or 'git remote rename <name> origin') to disambiguate.`
+  );
+}
+function readGitConfigContent() {
+  const gitDirEnv = process.env.GIT_DIR;
+  if (gitDirEnv) {
+    return fs.readFileSync(path.join(gitDirEnv, "config"), "utf-8");
+  }
+  let dir = process.cwd();
+  for (; ; ) {
+    const gitPath = path.join(dir, ".git");
+    try {
+      const stat = fs.statSync(gitPath);
+      if (stat.isDirectory()) {
+        return fs.readFileSync(path.join(gitPath, "config"), "utf-8");
+      }
+      if (stat.isFile()) {
+        const ref = fs.readFileSync(gitPath, "utf-8");
+        const m = /^gitdir:[ \t]*([^\r\n]+)/m.exec(ref);
+        if (m) {
+          return fs.readFileSync(path.join(path.resolve(dir, m[1].trim()), "config"), "utf-8");
+        }
       }
-      const project = match[2];
-      if (/^DefaultCollection$/i.test(project)) {
-        return { org: match[1], project: "" };
+    } catch {
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("Not in a git repository. Provide --org and --project explicitly.");
+}
+function gitConfigToRemoteLines(configContent) {
+  const lines = [];
+  let currentRemote = null;
+  let emittedUrl = false;
+  for (const line of configContent.split("\n")) {
+    const sectionMatch = /^\[remote\s+"([^"]+)"\]/.exec(line);
+    if (sectionMatch) {
+      currentRemote = sectionMatch[1];
+      emittedUrl = false;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      currentRemote = null;
+      emittedUrl = false;
+      continue;
+    }
+    if (currentRemote && !emittedUrl) {
+      const urlMatch = /^[ \t]+url[ \t]*=[ \t]*([^\r\n]+)/.exec(line);
+      if (urlMatch) {
+        lines.push(`${currentRemote}	${urlMatch[1].trim()} (fetch)`);
+        emittedUrl = true;
       }
-      return { org: match[1], project };
     }
   }
-  return null;
+  return lines.join("\n");
 }
 function detectAzdoContext() {
-  let remoteUrl;
+  let configContent;
   try {
-    remoteUrl = execSync("git remote get-url origin", { encoding: "utf-8" }).trim();
+    configContent = readGitConfigContent();
   } catch {
     throw new Error("Not in a git repository. Provide --org and --project explicitly.");
   }
-  const context = parseAzdoRemote(remoteUrl);
-  if (!context || !context.org && !context.project) {
-    throw new Error('Git remote "origin" is not an Azure DevOps URL. Provide --org and --project explicitly.');
+  const remoteLines = gitConfigToRemoteLines(configContent);
+  const candidates = parseAllAzdoRemotes(remoteLines);
+  const selected = selectRemote(candidates);
+  if (selected.hasEmbeddedSecret) {
+    noticeCredentialBearingRemote(selected.remoteName);
   }
-  return context;
+  return { org: selected.org, project: selected.project };
 }
 function parseRepoName(url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
     if (match) {
-      if (httpsUserinfo.test(url)) {
+      if (httpsEmbeddedSecret.test(url)) {
         noticeCredentialBearingRemote();
       }
       return match[3];
@@ -839,7 +1111,7 @@ function parseRepoName(url) {
 function detectRepoName() {
   let remoteUrl;
   try {
-    remoteUrl = execSync("git remote get-url origin", { encoding: "utf-8" }).trim();
+    remoteUrl = execFileSync(GIT_BINARY, ["remote", "get-url", "origin"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     throw new Error('Not in a git repository. Check that git remote "origin" exists and try again.');
   }
@@ -850,7 +1122,7 @@ function detectRepoName() {
   return repo;
 }
 function getCurrentBranch() {
-  const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
+  const branch = execFileSync(GIT_BINARY, ["rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   if (branch === "HEAD") {
     throw new Error("Not on a named branch. Check out a named branch and try again.");
   }
@@ -886,7 +1158,7 @@ function formatResolutionError() {
   return [
     "Could not resolve an Azure DevOps organization. Options (in priority order):",
     "  1. Pass --org <name> on the command line.",
-    "  2. Run this command from a git repo whose origin remote is an Azure DevOps URL.",
+    "  2. Run this command from a git repo that has an Azure DevOps remote.",
     "  3. Run `azdo config set org <name>` once to set a persistent default."
   ].join("\n");
 }
@@ -899,9 +1171,9 @@ function resolveContext(options) {
     gitContext = detectAzdoContext();
   } catch {
   }
-  const config = loadConfig();
   const org = resolvedOrg?.org;
-  const project = options.project || (gitContext?.project && gitContext.project.length > 0 ? gitContext.project : void 0) || config.project;
+  const scopedCfg = resolveScopedConfig(org);
+  const project = options.project || (gitContext?.project && gitContext.project.length > 0 ? gitContext.project : void 0) || scopedCfg.project;
   if (org && project) {
     return { org, project };
   }
@@ -1053,6 +1325,173 @@ function handleCommandError(err, id, context, scope = "write", exit = true) {
   }
 }
 
+// src/services/image-download.ts
+import { Jimp } from "jimp";
+import { writeFile } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+var ATTACHMENT_GUID_RE = /_apis\/wit\/attachments\/([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})/;
+function isAzureDevOpsAttachmentHost(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "dev.azure.com" || host.endsWith(".dev.azure.com") || host.endsWith(".visualstudio.com");
+}
+function decodeHtmlEntities(value) {
+  return value.replaceAll("&quot;", '"').replaceAll("&#39;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
+function parseAttachmentReference(rawUrl, sourceField) {
+  const url = decodeHtmlEntities(rawUrl.trim());
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || !isAzureDevOpsAttachmentHost(parsed.hostname)) {
+    return null;
+  }
+  const match = ATTACHMENT_GUID_RE.exec(parsed.pathname);
+  if (!match) return null;
+  const guid = match[1].toLowerCase();
+  let suggestedExtension = ".png";
+  const fileName = parsed.searchParams.get("fileName");
+  if (fileName?.includes(".")) {
+    suggestedExtension = fileName.slice(fileName.lastIndexOf(".")).toLowerCase();
+  }
+  return { url, sourceField, guid, suggestedExtension };
+}
+function extractImageReferences(content, sourceField) {
+  if (!content) return [];
+  const references = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (rawUrl) => {
+    const reference = parseAttachmentReference(rawUrl, sourceField);
+    if (reference && !seen.has(reference.guid)) {
+      seen.add(reference.guid);
+      references.push(reference);
+    }
+  };
+  const imgRegex = /<img\b[^>]*?\ssrc\s*=\s*["']([^"']+)["']/gi;
+  let match;
+  while ((match = imgRegex.exec(content)) !== null) {
+    add(match[1]);
+  }
+  const markdownRegex = /!\[[^\]]*\]\(\s*([^)\s]+)/g;
+  while ((match = markdownRegex.exec(content)) !== null) {
+    add(match[1]);
+  }
+  return references;
+}
+function addImageDownloadOptions(command) {
+  return command.option("--download-images", "download images embedded in rich-text fields to local files").option("--resize-images <pixels>", "max image width in px; downloads and resizes embedded images to PNG (implies --download-images)").option("--images-path <dir>", "destination directory for downloaded images (default: system temp dir)");
+}
+function resolveImageDownloadOptionsOrExit(flags) {
+  try {
+    return resolveImageDownloadOptions(flags);
+  } catch (err) {
+    process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  }
+}
+function resolveImageDownloadOptions(flags) {
+  const wantsResize = flags.resizeImages !== void 0;
+  const enabled = Boolean(flags.downloadImages) || wantsResize;
+  let maxWidth;
+  if (wantsResize) {
+    const parsed = Number(flags.resizeImages);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      throw new Error(
+        `Invalid --resize-images value "${flags.resizeImages}": must be a positive integer (max width in pixels).`
+      );
+    }
+    maxWidth = parsed;
+  }
+  const outputDir = flags.imagesPath ?? tmpdir();
+  if (flags.imagesPath !== void 0 && !existsSync2(outputDir)) {
+    throw new Error(`Images path "${outputDir}" does not exist.`);
+  }
+  return { enabled, maxWidth, outputDir };
+}
+function buildImageFileName(workItemId, index, reference, resizing) {
+  const ext = resizing ? ".png" : reference.suggestedExtension;
+  return `wi-${workItemId}-${index}${ext}`;
+}
+async function processImageBytes(bytes, maxWidth) {
+  if (maxWidth === void 0) {
+    return { buffer: Buffer.from(bytes), resized: false, format: "original" };
+  }
+  const image = await Jimp.read(Buffer.from(bytes));
+  let resized = false;
+  if (image.bitmap.width > maxWidth) {
+    image.resize({ w: maxWidth });
+    resized = true;
+  }
+  const buffer = await image.getBuffer("image/png");
+  return { buffer, resized, format: "png" };
+}
+async function downloadImagesFromFields(fields, args, credential) {
+  const { workItemId, options } = args;
+  const resizing = options.maxWidth !== void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const references = [];
+  for (const field of fields) {
+    for (const reference of extractImageReferences(field.content, field.field)) {
+      if (!seen.has(reference.guid)) {
+        seen.add(reference.guid);
+        references.push(reference);
+      }
+    }
+  }
+  const results = [];
+  let index = 0;
+  for (const reference of references) {
+    index += 1;
+    try {
+      const bytes = await downloadAttachment(reference.url, credential);
+      const processed = await processImageBytes(bytes, options.maxWidth);
+      const fileName = buildImageFileName(workItemId, index, reference, resizing);
+      const outputPath = join2(options.outputDir, fileName);
+      await writeFile(outputPath, processed.buffer);
+      results.push({
+        reference,
+        path: outputPath,
+        resized: processed.resized,
+        format: resizing ? "png" : reference.suggestedExtension.replace(/^\./, "")
+      });
+    } catch (err) {
+      results.push({
+        reference,
+        resized: false,
+        format: reference.suggestedExtension.replace(/^\./, ""),
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return results;
+}
+async function runImageDownload(fields, args, credential) {
+  const results = await downloadImagesFromFields(fields, args, credential);
+  process.stdout.write(formatImageSummary(results) + "\n");
+  for (const result of results) {
+    if (result.error) {
+      process.stderr.write(`Failed to download image ${result.reference.url}: ${result.error}
+`);
+    }
+  }
+}
+function formatImageSummary(results) {
+  if (results.length === 0) {
+    return "Images: no images found in rich-text fields";
+  }
+  const saved = results.filter((r) => r.path);
+  const lines = [`Images: ${saved.length} downloaded`];
+  for (const result of saved) {
+    lines.push(`  ${result.path}`);
+  }
+  return lines.join("\n");
+}
+
 // src/commands/get-item.ts
 function parseRequestedFields(raw) {
   if (raw === void 0) return void 0;
@@ -1176,19 +1615,32 @@ function formatWorkItem(workItem, short, markdown = false) {
 }
 function createGetItemCommand() {
   const command = new Command("get-item");
-  command.description("Retrieve an Azure DevOps work item by ID").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--short", "show abbreviated output").option("--fields <fields>", "comma-separated additional field reference names").option("--markdown", "convert rich text fields to markdown").action(
+  command.description("Retrieve an Azure DevOps work item by ID").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--short", "show abbreviated output").option("--fields <fields>", "comma-separated additional field reference names").option("--markdown", "convert rich text fields to markdown");
+  addImageDownloadOptions(command);
+  command.action(
     async (idStr, options) => {
       const id = parseWorkItemId(idStr);
       validateOrgProjectPair(options);
+      const imageOptions = resolveImageDownloadOptionsOrExit(options);
       let context;
       try {
         context = resolveContext(options);
         const credential = await requireAuthCredential(context.org);
-        const fieldsList = options.fields === void 0 ? parseRequestedFields(loadConfig().fields) : parseRequestedFields(options.fields);
+        const scopedCfg = resolveScopedConfig(context.org);
+        const fieldsList = options.fields === void 0 ? parseRequestedFields(scopedCfg.fields) : parseRequestedFields(options.fields);
         const workItem = await getWorkItem(context, id, credential, fieldsList);
-        const markdownEnabled = options.markdown ?? loadConfig().markdown ?? false;
+        const markdownEnabled = options.markdown ?? scopedCfg.markdown ?? false;
         const output = formatWorkItem(workItem, options.short ?? false, markdownEnabled);
         process.stdout.write(output + "\n");
+        if (imageOptions.enabled) {
+          const fields = [{ content: workItem.description ?? "", field: "Description" }];
+          if (workItem.extraFields) {
+            for (const [name, value] of Object.entries(workItem.extraFields)) {
+              fields.push({ content: value, field: name });
+            }
+          }
+          await runImageDownload(fields, { workItemId: id, options: imageOptions }, credential);
+        }
       } catch (err) {
         handleCommandError(err, id, context, "read", false);
       }
@@ -1224,6 +1676,79 @@ function createClearPatCommand() {
 
 // src/commands/auth.ts
 import { Command as Command3 } from "commander";
+
+// src/services/auth-diagnostics.ts
+async function runConnectivityTest(org, cred) {
+  const url = `https://dev.azure.com/${encodeURIComponent(org)}/_apis/projects?api-version=7.1&$top=1`;
+  let result;
+  try {
+    result = await fetchRaw(url, { headers: authHeaders(cred) });
+  } catch (err) {
+    return { status: "failed", error: err instanceof Error ? err.message : String(err) };
+  }
+  if (result.status >= 200 && result.status < 300) {
+    return { status: "ok", error: null };
+  }
+  let error = `HTTP ${result.status}`;
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed.message === "string" && parsed.message.trim() !== "") {
+      error = parsed.message.trim();
+    }
+  } catch {
+  }
+  return { status: "failed", error };
+}
+async function diagnoseAuth(org, project, resolveCredential) {
+  const cred = await resolveCredential(org);
+  if (cred === null) {
+    return {
+      authType: "none",
+      credentialSource: null,
+      org,
+      project,
+      connectivityStatus: "no-credentials",
+      connectivityError: null
+    };
+  }
+  const connectivity = await runConnectivityTest(org, cred);
+  const envVarName = process.env.AZDO_PAT ? "AZDO_PAT" : "dotenv";
+  const sourceLabel = cred.source === "env" ? `env:${envVarName}` : "credential-store";
+  return {
+    authType: cred.kind ?? "pat",
+    credentialSource: sourceLabel,
+    org,
+    project,
+    connectivityStatus: connectivity.status,
+    connectivityError: connectivity.error
+  };
+}
+function formatDiagnosticReport(report, json) {
+  if (json) {
+    return JSON.stringify(report, null, 2);
+  }
+  let connectivityLine;
+  if (report.connectivityStatus === "ok") {
+    connectivityLine = "OK";
+  } else if (report.connectivityStatus === "no-credentials") {
+    connectivityLine = "no credentials found";
+  } else {
+    connectivityLine = "FAILED";
+  }
+  const lines = [
+    `Auth type:    ${report.authType}`,
+    `Source:       ${report.credentialSource ?? "(none)"}`,
+    `Org:          ${report.org}`,
+    `Project:      ${report.project ?? "(not set)"}`,
+    `Connectivity: ${connectivityLine}`
+  ];
+  if (report.connectivityStatus === "failed" && report.connectivityError !== null) {
+    lines.push(`Error:        ${report.connectivityError}`);
+  }
+  return lines.join("\n");
+}
+
+// src/commands/auth.ts
 async function readStdinToString() {
   const chunks = [];
   for await (const chunk of process.stdin) {
@@ -1645,6 +2170,25 @@ Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
     const globals = logoutCmd.optsWithGlobals();
     await handleLogout(options, globals.org);
   });
+  const diagnoseCmd = command.command("diagnose").description("Show auth type, credential source, org, and live connectivity test result").option("--org <name>", "Azure DevOps organization (overrides context resolution)").option("--project <name>", "Azure DevOps project (optional context)").option("--json", "emit JSON instead of human-readable text", false);
+  diagnoseCmd.action(async (options) => {
+    const globals = diagnoseCmd.optsWithGlobals();
+    const orgName = options.org ?? globals.org;
+    const resolved = resolveOrg({ org: orgName });
+    if (!resolved) {
+      process.stderr.write(`${formatResolutionError()}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const report = await diagnoseAuth(resolved.org, options.project ?? null, resolveAuthCredential);
+    const output = formatDiagnosticReport(report, options.json ?? false);
+    process.stdout.write(`${output}
+`);
+    if (report.connectivityStatus === "failed") {
+      process.exitCode = 1;
+    }
+  });
   return command;
 }
 
@@ -1657,18 +2201,47 @@ function formatConfigValue(value, unsetFallback = "") {
   }
   return Array.isArray(value) ? value.join(",") : value;
 }
+function buildConfigListEntries(cfg) {
+  const entries = SETTINGS.map((s) => ({
+    scope: "default",
+    key: s.key,
+    value: cfg[s.key]
+  }));
+  for (const [orgName, scope] of Object.entries(cfg.organizations ?? {})) {
+    for (const [k, v] of Object.entries(scope)) {
+      entries.push({ scope: orgName, key: k, value: v });
+    }
+  }
+  return entries;
+}
 function writeConfigList(cfg) {
   const keyWidth = 10;
   const valueWidth = 30;
+  const scopeWidth = 12;
+  process.stdout.write(
+    `${"scope".padEnd(scopeWidth)}${"key".padEnd(keyWidth)}${"value".padEnd(valueWidth)}description
+`
+  );
   for (const setting of SETTINGS) {
     const raw = cfg[setting.key];
     const value = formatConfigValue(raw, "(not set)");
     const marker = raw === void 0 && setting.required ? " *" : "";
     process.stdout.write(
-      `${setting.key.padEnd(keyWidth)}${String(value).padEnd(valueWidth)}${setting.description}${marker}
+      `${"default".padEnd(scopeWidth)}${setting.key.padEnd(keyWidth)}${String(value).padEnd(valueWidth)}${setting.description}${marker}
 `
     );
   }
+  for (const [orgName, scope] of Object.entries(cfg.organizations ?? {})) {
+    const orgScope = scope;
+    const scopedSettings = Object.entries(orgScope);
+    for (const [k, v] of scopedSettings) {
+      const value = formatConfigValue(v, "(not set)");
+      process.stdout.write(
+        `${orgName.padEnd(scopeWidth)}${k.padEnd(keyWidth)}${String(value).padEnd(valueWidth)}
+`
+      );
+    }
+  }
   const hasUnset = SETTINGS.some((s) => s.required && cfg[s.key] === void 0);
   if (hasUnset) {
     process.stdout.write(
@@ -1712,17 +2285,22 @@ function createConfigCommand() {
   const config = new Command4("config");
   config.description("Manage CLI settings");
   const set = new Command4("set");
-  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields)").argument("<value>", "setting value").option("--json", "output in JSON format").action((key, value, options) => {
+  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
     try {
-      setConfigValue(key, value);
+      if (options.org) {
+        setOrgScopedValue(options.org, key, value);
+      } else {
+        setConfigValue(key, value);
+      }
       if (options.json) {
-        const output = { key, value };
+        const output = { key, value, scope: options.org ?? "default" };
         if (key === "fields") {
           output.value = value.split(",").map((s) => s.trim());
         }
         process.stdout.write(JSON.stringify(output) + "\n");
       } else {
-        process.stdout.write(`Set "${key}" to "${value}"
+        const scopeTag = options.org ? ` (org: ${options.org})` : "";
+        process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
 `);
       }
     } catch (err) {
@@ -1733,12 +2311,12 @@ function createConfigCommand() {
     }
   });
   const get = new Command4("get");
-  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields)").option("--json", "output in JSON format").action((key, options) => {
+  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
-      const value = getConfigValue(key);
+      const value = options.org ? getOrgScopedValue(options.org, key) : getConfigValue(key);
       if (options.json) {
         process.stdout.write(
-          JSON.stringify({ key, value: value ?? null }) + "\n"
+          JSON.stringify({ key, value: value ?? null, scope: options.org ?? "default" }) + "\n"
         );
       } else if (value === void 0) {
         process.stdout.write(`Setting "${key}" is not configured.
@@ -1746,7 +2324,7 @@ function createConfigCommand() {
       } else if (Array.isArray(value)) {
         process.stdout.write(value.join(",") + "\n");
       } else {
-        process.stdout.write(value + "\n");
+        process.stdout.write(String(value) + "\n");
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -1759,19 +2337,25 @@ function createConfigCommand() {
   list.description("List all configuration values").option("--json", "output in JSON format").action((options) => {
     const cfg = loadConfig();
     if (options.json) {
-      process.stdout.write(JSON.stringify(cfg) + "\n");
+      const entries = buildConfigListEntries(cfg);
+      process.stdout.write(JSON.stringify(entries) + "\n");
       return;
     }
     writeConfigList(cfg);
   });
   const unset = new Command4("unset");
-  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields)").option("--json", "output in JSON format").action((key, options) => {
+  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "remove from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
-      unsetConfigValue(key);
+      if (options.org) {
+        unsetOrgScopedValue(options.org, key);
+      } else {
+        unsetConfigValue(key);
+      }
       if (options.json) {
-        process.stdout.write(JSON.stringify({ key, unset: true }) + "\n");
+        process.stdout.write(JSON.stringify({ key, unset: true, scope: options.org ?? "default" }) + "\n");
       } else {
-        process.stdout.write(`Unset "${key}"
+        const scopeTag = options.org ? ` (org: ${options.org})` : "";
+        process.stdout.write(`Unset "${key}"${scopeTag}
 `);
       }
     } catch (err) {
@@ -1803,10 +2387,52 @@ function createConfigCommand() {
     rl.close();
     process.stderr.write("Configuration complete!\n");
   });
+  const orgCopy = new Command4("org-copy");
+  orgCopy.description('Copy settings from one scope to another (use "default" as source to copy top-level settings)').argument("<from>", 'source scope name or "default"').argument("<to>", "destination org name").option("--force", "overwrite existing values on collision").action((from, to, options) => {
+    try {
+      copyOrgScope(from, to, options.force ?? false);
+      process.stdout.write(`Copied scope "${from}" to "${to}"
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  const orgMove = new Command4("org-move");
+  orgMove.description("Move settings from one org scope to another").argument("<from>", "source org name").argument("<to>", "destination org name").option("--force", "overwrite existing values on collision").action((from, to, options) => {
+    try {
+      moveOrgScope(from, to, options.force ?? false);
+      process.stdout.write(`Moved scope "${from}" to "${to}"
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  const orgDelete = new Command4("org-delete");
+  orgDelete.description("Delete an org-scoped configuration").argument("<name>", "org name").action((name) => {
+    try {
+      deleteOrgScope(name);
+      process.stdout.write(`Deleted scope "${name}"
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
   config.addCommand(set);
   config.addCommand(get);
   config.addCommand(list);
   config.addCommand(unset);
+  config.addCommand(orgCopy);
+  config.addCommand(orgMove);
+  config.addCommand(orgDelete);
   config.addCommand(wizard);
   return config;
 }
@@ -1943,10 +2569,13 @@ function createSetFieldCommand() {
 import { Command as Command8 } from "commander";
 function createGetMdFieldCommand() {
   const command = new Command8("get-md-field");
-  command.description("Get a work item field value, converting HTML to markdown").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Description)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").action(
+  command.description("Get a work item field value, converting HTML to markdown").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Description)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project");
+  addImageDownloadOptions(command);
+  command.action(
     async (idStr, field, options) => {
       const id = parseWorkItemId(idStr);
       validateOrgProjectPair(options);
+      const imageOptions = resolveImageDownloadOptionsOrExit(options);
       let context;
       try {
         context = resolveContext(options);
@@ -1957,6 +2586,13 @@ function createGetMdFieldCommand() {
         } else {
           process.stdout.write(toMarkdown(value) + "\n");
         }
+        if (imageOptions.enabled) {
+          await runImageDownload(
+            [{ content: value ?? "", field }],
+            { workItemId: id, options: imageOptions },
+            credential
+          );
+        }
       } catch (err) {
         handleCommandError(err, id, context, "read");
       }
@@ -1966,7 +2602,7 @@ function createGetMdFieldCommand() {
 }
 
 // src/commands/set-md-field.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { Command as Command9 } from "commander";
 function fail(message) {
   process.stderr.write(`Error: ${message}
@@ -1986,7 +2622,7 @@ function resolveContent(inlineContent, options) {
   return null;
 }
 function readFileContent(filePath) {
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     fail(`File not found: ${filePath}`);
   }
   try {
@@ -2054,7 +2690,7 @@ function createSetMdFieldCommand() {
 }
 
 // src/commands/upsert.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, unlinkSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync } from "fs";
 import { Command as Command10 } from "commander";
 
 // src/services/task-document.ts
@@ -2218,7 +2854,7 @@ function loadSourceContent(options) {
     return { content: options.content };
   }
   const filePath = options.file;
-  if (!existsSync3(filePath)) {
+  if (!existsSync4(filePath)) {
     fail2(`File not found: ${filePath}`);
   }
   try {
@@ -2463,18 +3099,43 @@ function buildPullRequestStatusesUrl(context, repo, prId) {
   url.searchParams.set("api-version", "7.1");
   return url;
 }
-function mapPullRequest(repo, pullRequest) {
-  return {
-    id: pullRequest.pullRequestId,
-    title: pullRequest.title,
-    repository: repo,
-    sourceRefName: pullRequest.sourceRefName,
-    targetRefName: pullRequest.targetRefName,
-    status: pullRequest.status,
-    createdBy: pullRequest.createdBy?.displayName ?? null,
-    url: pullRequest._links?.web?.href ?? null
-  };
-}
+function buildProjectUrl(context) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/projects/${encodeURIComponent(context.project)}`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+function buildPolicyEvaluationsUrl(context, projectId, prId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/policy/evaluations`
+  );
+  url.searchParams.set("api-version", "7.1");
+  url.searchParams.set("artifactId", `vstfs:///CodeReview/CodeReviewId/${projectId}/${prId}`);
+  return url;
+}
+function buildPullRequestBuildsUrl(context, prId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/build/builds`
+  );
+  url.searchParams.set("branchName", `refs/pull/${prId}/merge`);
+  url.searchParams.set("queryOrder", "queueTimeDescending");
+  url.searchParams.set("$top", "50");
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+function mapPullRequest(repo, pullRequest) {
+  return {
+    id: pullRequest.pullRequestId,
+    title: pullRequest.title,
+    repository: repo,
+    sourceRefName: pullRequest.sourceRefName,
+    targetRefName: pullRequest.targetRefName,
+    status: pullRequest.status,
+    createdBy: pullRequest.createdBy?.displayName ?? null,
+    url: pullRequest._links?.web?.href ?? null
+  };
+}
 function mapPullRequestCheckName(status2) {
   const genre = status2.context?.genre?.trim();
   const name = status2.context?.name?.trim();
@@ -2501,7 +3162,66 @@ function mapPullRequestCheck(status2) {
     targetUrl: status2.targetUrl ?? null,
     createdBy: status2.createdBy?.displayName ?? null,
     createdAt: status2.creationDate ?? null,
-    updatedAt: status2.updatedDate ?? null
+    updatedAt: status2.updatedDate ?? null,
+    source: "status"
+  };
+}
+function mapPolicyEvaluationState(status2) {
+  switch (status2) {
+    case "approved":
+      return "succeeded";
+    case "rejected":
+      return "failed";
+    case "running":
+    case "queued":
+      return "pending";
+    case "notApplicable":
+    case "notSet":
+    case void 0:
+      return null;
+    default:
+      return status2;
+  }
+}
+function mapBuildToCheckState(build) {
+  if (build.status !== "completed") {
+    return "pending";
+  }
+  switch (build.result) {
+    case "succeeded":
+    case "partiallySucceeded":
+      return "succeeded";
+    case "failed":
+      return "failed";
+    case "canceled":
+      return "error";
+    default:
+      return "pending";
+  }
+}
+function mapPolicyEvaluationName(evaluation) {
+  const display = evaluation.configuration?.settings?.displayName?.trim() || evaluation.configuration?.type?.displayName?.trim();
+  if (display) {
+    return display;
+  }
+  return `Policy ${evaluation.configuration?.id ?? evaluation.evaluationId ?? "?"}`;
+}
+function mapPolicyEvaluationCheck(evaluation) {
+  const state = mapPolicyEvaluationState(evaluation.status);
+  if (state === null) {
+    return null;
+  }
+  return {
+    id: evaluation.configuration?.id ?? 0,
+    state,
+    name: mapPolicyEvaluationName(evaluation),
+    description: null,
+    targetUrl: null,
+    createdBy: null,
+    createdAt: null,
+    updatedAt: null,
+    source: "policy",
+    isBlocking: evaluation.configuration?.isBlocking ?? null
   };
 }
 function mapComment(comment) {
@@ -2521,18 +3241,22 @@ function mapThread(thread) {
   if (comments.length === 0) {
     return null;
   }
+  const line = thread.threadContext?.rightFileStart?.line ?? thread.threadContext?.leftFileStart?.line ?? null;
   return {
     id: thread.id,
-    status: thread.status,
+    status: thread.status ?? "unknown",
     threadContext: thread.threadContext?.filePath ?? null,
+    line,
     comments
   };
 }
 function toActiveCommentThread(thread) {
+  const line = thread.threadContext?.rightFileStart?.line ?? thread.threadContext?.leftFileStart?.line ?? null;
   return {
     id: thread.id,
-    status: thread.status,
+    status: thread.status ?? "unknown",
     threadContext: thread.threadContext?.filePath ?? null,
+    line,
     comments: thread.comments.map(mapComment).filter((comment) => comment !== null)
   };
 }
@@ -2587,6 +3311,39 @@ async function getPullRequestChecks(context, repo, cred, prId) {
   const data = await readJsonResponse(response);
   return data.value.map(mapPullRequestCheck).filter((check) => check !== null);
 }
+async function resolveProjectId(context, cred) {
+  const response = await fetchWithErrors(buildProjectUrl(context).toString(), {
+    headers: authHeaders(cred)
+  });
+  const data = await readJsonResponse(response);
+  return data.id;
+}
+async function getPullRequestPolicyEvaluations(context, cred, projectId, prId) {
+  const response = await fetchWithErrors(
+    buildPolicyEvaluationsUrl(context, projectId, prId).toString(),
+    { headers: authHeaders(cred) }
+  );
+  const data = await readJsonResponse(response);
+  return data.value.map(mapPolicyEvaluationCheck).filter((check) => check !== null);
+}
+async function getPullRequestBuilds(context, cred, prId) {
+  const response = await fetchWithErrors(buildPullRequestBuildsUrl(context, prId).toString(), {
+    headers: authHeaders(cred)
+  });
+  const data = await readJsonResponse(response);
+  return data.value.map((build) => ({
+    id: build.id,
+    state: mapBuildToCheckState(build),
+    name: build.definition?.name ?? `Build #${build.id}`,
+    description: null,
+    targetUrl: build._links?.web?.href ?? null,
+    createdBy: null,
+    createdAt: build.queueTime ?? null,
+    updatedAt: build.finishTime ?? null,
+    source: "build",
+    isBlocking: null
+  }));
+}
 async function openPullRequest(context, repo, cred, sourceBranch, title, description) {
   const existing = await listPullRequests(context, repo, cred, sourceBranch, {
     status: "active",
@@ -2638,6 +3395,30 @@ async function getPullRequestThreads(context, repo, cred, prId) {
   const data = await readJsonResponse(response);
   return data.value.map(mapThread).filter((thread) => thread !== null);
 }
+function buildThreadCommentUrl(context, repo, prId, threadId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads/${threadId}/comments`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+async function postThreadComment(context, repo, cred, prId, threadId, content) {
+  const response = await fetchWithErrors(buildThreadCommentUrl(context, repo, prId, threadId).toString(), {
+    method: "POST",
+    headers: {
+      ...authHeaders(cred),
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ content, parentCommentId: 0, commentType: 1 })
+  });
+  const data = await readJsonResponse(response);
+  return {
+    id: data.id,
+    author: data.author?.displayName ?? null,
+    content: data.content ?? content,
+    publishedAt: data.publishedDate ?? null
+  };
+}
 
 // src/commands/pr.ts
 function parsePositivePrNumber(raw) {
@@ -2655,7 +3436,8 @@ function autoDetectZeroMatch(branch) {
   return `No open pull request matches branch ${branch}. Pass --pr-number to target a specific PR, or push the branch and open a pull request.`;
 }
 function autoDetectMultiMatch(branch, ids) {
-  return `Multiple open pull requests match branch ${branch}: ${ids.map((id) => `#${id}`).join(", ")}. Re-run with --pr-number to choose.`;
+  const idList = ids.map((id) => `#${id}`).join(", ");
+  return `Multiple open pull requests match branch ${branch}: ${idList}. Re-run with --pr-number to choose.`;
 }
 function writeContractError(line) {
   process.stderr.write(`${line}
@@ -2695,34 +3477,101 @@ function handlePrCommandError(err, context, mode = "read") {
   }
   writeError(error.message);
 }
-function formatPullRequestChecks(checks) {
+function formatPullRequestChecks(checks, checksError) {
+  if (checksError) {
+    return [`Checks: unable to retrieve (${checksError})`];
+  }
   if (checks.length === 0) {
     return ["Checks: none reported by Azure DevOps"];
   }
   const lines = ["Checks:"];
   for (const check of checks) {
-    lines.push(`- [${check.state}] ${check.name}`);
+    const optionalTag = check.isBlocking === false ? " [optional]" : "";
+    lines.push(`- [${check.state}] ${check.name}${optionalTag}`);
     if ((check.state === "failed" || check.state === "error") && check.description) {
       lines.push(`  Detail: ${check.description}`);
     }
   }
   return lines;
 }
+function countCodeComments(threads) {
+  let open = 0;
+  let closed = 0;
+  for (const thread of threads) {
+    if (thread.threadContext === null) {
+      continue;
+    }
+    if (isThreadResolved(thread.status)) {
+      closed += 1;
+    } else {
+      open += 1;
+    }
+  }
+  return { open, closed };
+}
+function formatCodeCommentCounts(counts) {
+  return `Code comments: ${counts.open} open, ${counts.closed} closed`;
+}
 function formatPullRequestBlock(pullRequest) {
   return [
     `#${pullRequest.id} [${pullRequest.status}] ${pullRequest.title}`,
     `${formatBranchName(pullRequest.sourceRefName)} -> ${formatBranchName(pullRequest.targetRefName)}`,
     pullRequest.url ?? "\u2014",
-    ...formatPullRequestChecks(pullRequest.checks)
+    ...formatPullRequestChecks(pullRequest.checks, pullRequest.checksError),
+    formatCodeCommentCounts(pullRequest.codeCommentCounts)
   ].join("\n");
 }
+async function buildPullRequestStatusEntry(context, repo, cred, pullRequest, projectId) {
+  let statusChecks = [];
+  let statusOk = true;
+  try {
+    statusChecks = await getPullRequestChecks(context, repo, cred, pullRequest.id);
+  } catch {
+    statusOk = false;
+  }
+  let policyChecks = [];
+  let policyOk = true;
+  if (projectId === null) {
+    policyOk = false;
+  } else {
+    try {
+      policyChecks = await getPullRequestPolicyEvaluations(context, cred, projectId, pullRequest.id);
+    } catch {
+      policyOk = false;
+    }
+  }
+  let buildChecks = [];
+  let buildsOk = true;
+  try {
+    buildChecks = await getPullRequestBuilds(context, cred, pullRequest.id);
+  } catch {
+    buildsOk = false;
+  }
+  let codeCommentCounts;
+  try {
+    const threads = await getPullRequestThreads(context, repo, cred, pullRequest.id);
+    codeCommentCounts = countCodeComments(threads);
+  } catch {
+    codeCommentCounts = { open: 0, closed: 0 };
+  }
+  const checks = [...statusChecks, ...policyChecks, ...buildChecks];
+  const checksError = checks.length === 0 && (!statusOk || !policyOk || !buildsOk) ? "Azure DevOps request failed" : null;
+  return {
+    ...pullRequest,
+    checks,
+    codeCommentCounts,
+    checksError
+  };
+}
 function threadStatusLabel(status2) {
   return isThreadResolved(status2) ? "resolved" : status2;
 }
 function formatThreads(prId, title, threads) {
   const lines = [`Comment threads for pull request #${prId}: ${title}`];
   for (const thread of threads) {
-    lines.push("", `Thread #${thread.id} [${threadStatusLabel(thread.status)}] ${thread.threadContext ?? "(general)"}`);
+    const lineSuffix = thread.line === null ? "" : `:${thread.line}`;
+    const location = thread.threadContext ? `${thread.threadContext}${lineSuffix}` : "(general)";
+    lines.push("", `Thread #${thread.id} [${threadStatusLabel(thread.status)}] ${location}`);
     for (const comment of thread.comments) {
       lines.push(`  ${comment.author ?? "Unknown"}: ${comment.content}`);
     }
@@ -2752,11 +3601,16 @@ function createPrStatusCommand() {
       context = resolved.context;
       const branch = resolved.branch;
       const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, branch);
+      let projectId = null;
+      try {
+        projectId = await resolveProjectId(resolved.context, resolved.pat);
+      } catch {
+        projectId = null;
+      }
       const pullRequestsWithChecks = await Promise.all(
-        pullRequests.map(async (pullRequest) => ({
-          ...pullRequest,
-          checks: await getPullRequestChecks(resolved.context, resolved.repo, resolved.pat, pullRequest.id)
-        }))
+        pullRequests.map(
+          async (pullRequest) => buildPullRequestStatusEntry(resolved.context, resolved.repo, resolved.pat, pullRequest, projectId)
+        )
       );
       const result = { branch, repository: resolved.repo, pullRequests: pullRequestsWithChecks };
       if (options.json) {
@@ -2837,7 +3691,7 @@ ${result.pullRequest.url ?? "\u2014"}
 }
 function createPrCommentsCommand() {
   const command = new Command12("comments");
-  configureUnwrappedHelp(command).description("List pull request comment threads for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--hide-resolved", "hide threads whose status is resolved / won't fix / closed / by design").option("--json", "output JSON").action(async (options) => {
+  configureUnwrappedHelp(command).description("List pull request comment threads for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--hide-resolved", "hide threads whose status is resolved / won't fix / closed / by design").option("--exclude-resolved", "alias of --hide-resolved: exclude resolved / won't fix / closed / by design threads").option("--code-related-only", "show only threads anchored to a file/line; omit general discussion threads").option("--json", "output JSON").action(async (options) => {
     validateOrgProjectPair(options);
     let context;
     let explicitPrId = null;
@@ -2879,8 +3733,12 @@ function createPrCommentsCommand() {
         pullRequest = pullRequests[0];
         branchLabel = resolved.branch;
       }
+      const hideResolved = options.hideResolved === true || options.excludeResolved === true;
+      const codeRelatedOnly = options.codeRelatedOnly === true;
       const allThreads = await getPullRequestThreads(resolved.context, resolved.repo, resolved.pat, pullRequest.id);
-      const threads = options.hideResolved ? allThreads.filter((thread) => !isThreadResolved(thread.status)) : allThreads;
+      const threads = allThreads.filter(
+        (thread) => (!hideResolved || !isThreadResolved(thread.status)) && (!codeRelatedOnly || thread.threadContext !== null)
+      );
       const result = { branch: branchLabel, pullRequest, threads };
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
@@ -2888,9 +3746,18 @@ function createPrCommentsCommand() {
         return;
       }
       if (threads.length === 0) {
-        if (options.hideResolved && allThreads.length > 0) {
-          process.stdout.write(`Pull request #${pullRequest.id} has no unresolved comment threads (${allThreads.length} resolved thread${allThreads.length === 1 ? "" : "s"} hidden by --hide-resolved).
-`);
+        if (allThreads.length > 0 && (hideResolved || codeRelatedOnly)) {
+          const filters = [];
+          if (codeRelatedOnly) {
+            filters.push("code-related");
+          }
+          if (hideResolved) {
+            filters.push("unresolved");
+          }
+          process.stdout.write(
+            `Pull request #${pullRequest.id} has no ${filters.join(" ")} comment threads (filtered from ${allThreads.length} thread${allThreads.length === 1 ? "" : "s"}).
+`
+          );
         } else {
           process.stdout.write(`Pull request #${pullRequest.id} has no comment threads.
 `);
@@ -2903,6 +3770,7 @@ function createPrCommentsCommand() {
       handlePrCommandError(err, context, "read");
     }
   });
+  command.addCommand(createPrCommentsReplyCommand());
   return command;
 }
 async function resolveThreadTarget(threadIdRaw, options) {
@@ -3021,6 +3889,64 @@ function createPrCommentReopenCommand() {
   });
   return command;
 }
+async function runCommentReply(threadIdRaw, text, options) {
+  let context;
+  try {
+    const trimmedText = text.trim();
+    if (!trimmedText) {
+      writeError("Reply text must not be empty.");
+      return;
+    }
+    const target = await resolveThreadTarget(threadIdRaw, options);
+    if (target === null) {
+      return;
+    }
+    context = target.context;
+    const threads = await getPullRequestThreads(target.context, target.repo, target.pat, target.pullRequest.id);
+    const thread = threads.find((t) => t.id === target.threadId);
+    if (!thread) {
+      writeError(`Thread #${target.threadId} not found on pull request #${target.pullRequest.id}.`);
+      return;
+    }
+    const posted = await postThreadComment(
+      target.context,
+      target.repo,
+      target.pat,
+      target.pullRequest.id,
+      target.threadId,
+      trimmedText
+    );
+    const result = {
+      pullRequestId: target.pullRequest.id,
+      threadId: target.threadId,
+      commentId: posted.id,
+      content: posted.content
+    };
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+      return;
+    }
+    process.stdout.write(`Reply posted to thread #${target.threadId} on pull request #${target.pullRequest.id}.
+`);
+  } catch (err) {
+    handlePrCommandError(err, context, "write");
+  }
+}
+function createPrCommentsReplyCommand() {
+  const command = new Command12("reply");
+  configureUnwrappedHelp(command).description("Post a reply to a pull request comment thread").argument("<threadId>", "numeric id of the thread to reply to").argument("<text>", "text of the reply").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, text, options) => {
+    await runCommentReply(threadIdRaw, text, options);
+  });
+  return command;
+}
+function createPrCommentReplyCommand() {
+  const command = new Command12("comment-reply");
+  configureUnwrappedHelp(command).description('Post a reply to a pull request comment thread (alias of "azdo pr comments reply")').argument("<threadId>", "numeric id of the thread to reply to").argument("<text>", "text of the reply").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, text, options) => {
+    await runCommentReply(threadIdRaw, text, options);
+  });
+  return command;
+}
 function createPrCommand() {
   const command = new Command12("pr");
   command.description("Manage Azure DevOps pull requests");
@@ -3029,99 +3955,1012 @@ function createPrCommand() {
   command.addCommand(createPrCommentsCommand());
   command.addCommand(createPrCommentResolveCommand());
   command.addCommand(createPrCommentReopenCommand());
+  command.addCommand(createPrCommentReplyCommand());
   return command;
 }
 
-// src/commands/comments.ts
+// src/commands/pipeline.ts
 import { Command as Command13 } from "commander";
-function writeError2(message) {
-  process.stderr.write(`Error: ${message}
-`);
-  process.exit(1);
+
+// src/services/pipeline-client.ts
+var API_VERSION = "7.1";
+function orgProjectBase(context) {
+  return `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}`;
 }
-function formatCommentHeader(comment) {
-  const author = comment.author ?? "Unknown";
-  const timestamp = comment.modifiedAt ?? comment.createdAt ?? "Unknown time";
-  return `Comment #${comment.id} by ${author} at ${timestamp}`;
+function withApiVersion(url) {
+  url.searchParams.set("api-version", API_VERSION);
+  return url;
 }
-function formatComments(result, convertMarkdown) {
-  const lines = [`Comments for work item #${result.workItemId}`];
-  for (const comment of result.comments) {
-    const text = convertMarkdown ? toMarkdown(comment.text) : comment.text;
-    lines.push("", formatCommentHeader(comment), text);
+async function readJsonResponse2(response) {
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
   }
-  return lines.join("\n");
+  return await response.json();
 }
-function createCommentsListCommand() {
-  const command = new Command13("list");
-  command.description("List visible comments for a work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "convert HTML comment bodies to markdown").action(async (idStr, options) => {
-    validateOrgProjectPair(options);
-    const id = parseWorkItemId(idStr);
-    let context;
-    try {
-      context = resolveContext(options);
-      const credential = await requireAuthCredential(context.org);
-      const result = await listWorkItemComments(context, id, credential);
-      if (options.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
-        return;
-      }
-      if (result.comments.length === 0) {
-        process.stdout.write(`Work item #${id} has no comments.
-`);
-        return;
-      }
-      process.stdout.write(`${formatComments(result, options.markdown === true)}
-`);
-    } catch (err) {
-      handleCommandError(err, id, context, "read");
-    }
+function mapPipeline(pipeline) {
+  return {
+    id: pipeline.id,
+    name: pipeline.name,
+    folder: pipeline.folder?.trim() ? pipeline.folder : null
+  };
+}
+function mapRunState(state) {
+  if (state === "inProgress" || state === "completed") {
+    return state;
+  }
+  return "unknown";
+}
+function mapRunResult(result) {
+  if (result === "succeeded" || result === "failed" || result === "canceled") {
+    return result;
+  }
+  if (result === "partiallySucceeded") {
+    return "failed";
+  }
+  return null;
+}
+function mapBuildState(status2) {
+  if (status2 === "completed") return "completed";
+  if (status2 === void 0 || status2 === "none") return "unknown";
+  return "inProgress";
+}
+function mapBuildSummary(build) {
+  return {
+    id: build.id,
+    name: build.buildNumber ?? null,
+    state: mapBuildState(build.status),
+    result: mapRunResult(build.result),
+    createdDate: build.queueTime ?? build.startTime ?? null,
+    finishedDate: build.finishTime ?? null,
+    sourceBranch: build.sourceBranch ?? null,
+    sourceCommit: build.sourceVersion ?? null
+  };
+}
+function normalizeRef(branch) {
+  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+}
+async function getPipelineDefinitions(context, cred) {
+  const url = withApiVersion(new URL(`${orgProjectBase(context)}/_apis/pipelines`));
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  return data.value.map(mapPipeline);
+}
+var COMMIT_LOOKBACK = 200;
+async function getPipelineRuns(context, cred, query) {
+  const url = withApiVersion(new URL(`${orgProjectBase(context)}/_apis/build/builds`));
+  if (query.definitionId !== void 0) {
+    url.searchParams.set("definitions", String(query.definitionId));
+  }
+  if (query.prNumber !== void 0) {
+    url.searchParams.set("branchName", `refs/pull/${query.prNumber}/merge`);
+  } else if (query.branch) {
+    url.searchParams.set("branchName", normalizeRef(query.branch));
+  }
+  url.searchParams.set("queryOrder", "queueTimeDescending");
+  url.searchParams.set("$top", String(query.commit ? COMMIT_LOOKBACK : query.top));
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  let runs = data.value.map(mapBuildSummary);
+  if (query.commit) {
+    const needle = query.commit.toLowerCase();
+    runs = runs.filter((run) => run.sourceCommit?.toLowerCase().startsWith(needle));
+  }
+  return runs.slice(0, query.top);
+}
+async function runPipeline(context, cred, pipelineId, opts) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/pipelines/${pipelineId}/runs`)
+  );
+  const body = {};
+  if (opts.branch) {
+    const refName = opts.branch.startsWith("refs/") ? opts.branch : `refs/heads/${opts.branch}`;
+    body.resources = { repositories: { self: { refName } } };
+  }
+  if (opts.parameters && Object.keys(opts.parameters).length > 0) {
+    body.templateParameters = opts.parameters;
+  }
+  const response = await fetchWithErrors(url.toString(), {
+    method: "POST",
+    headers: { ...authHeaders(cred), "Content-Type": "application/json" },
+    body: JSON.stringify(body)
   });
-  return command;
+  const data = await readJsonResponse2(response);
+  return {
+    id: data.id,
+    state: mapRunState(data.state),
+    webUrl: data._links?.web?.href ?? null
+  };
 }
-function createCommentsAddCommand() {
-  const command = new Command13("add");
-  command.description("Add a comment to a work item").argument("<id>", "work item ID").argument("<text>", "comment text").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "post comment as markdown").action(async (idStr, text, options) => {
-    validateOrgProjectPair(options);
-    const id = parseWorkItemId(idStr);
-    if (text.trim() === "") {
-      writeError2("Comment text must be a non-empty string.");
-    }
-    let context;
-    try {
-      context = resolveContext(options);
-      const credential = await requireAuthCredential(context.org);
-      const format = options.markdown === true ? "markdown" : "html";
-      const result = await addWorkItemComment(context, id, credential, text, format);
-      if (options.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
-        return;
+function buildUrl(context, buildId) {
+  return withApiVersion(new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}`));
+}
+async function getBuild(context, cred, buildId) {
+  const response = await fetchWithErrors(buildUrl(context, buildId).toString(), {
+    headers: authHeaders(cred)
+  });
+  return readJsonResponse2(response);
+}
+async function getBuildStatus(context, cred, buildId) {
+  const build = await getBuild(context, cred, buildId);
+  return { state: mapBuildState(build.status), result: mapRunResult(build.result) };
+}
+async function getBuildTimeline(context, cred, buildId) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}/timeline`)
+  );
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  const records = data.records ?? [];
+  const errors = [];
+  const stages = [];
+  const jobs = [];
+  const logSteps = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    for (const issue of record.issues ?? []) {
+      if (issue.type === "error" && issue.message) {
+        errors.push({ message: issue.message, source: record.name ?? null });
       }
-      process.stdout.write(`Added comment #${result.commentId} to work item #${result.workItemId}
-`);
-    } catch (err) {
-      handleCommandError(err, id, context, "write");
     }
+    if (record.name && record.log?.id !== void 0) {
+      logSteps.set(record.log.id, record.name);
+    }
+    if (!record.name) continue;
+    const status2 = {
+      name: record.name,
+      state: record.state ?? "unknown",
+      result: record.result ?? null
+    };
+    if (record.type === "Stage") {
+      stages.push(status2);
+    } else if (record.type === "Job") {
+      jobs.push({ startTime: record.startTime, status: status2 });
+    }
+  }
+  jobs.sort((a, b) => {
+    if (a.startTime === b.startTime) return 0;
+    if (a.startTime === void 0) return 1;
+    if (b.startTime === void 0) return -1;
+    return a.startTime < b.startTime ? -1 : 1;
   });
-  return command;
+  return { errors, stages, jobs: jobs.map((j) => j.status), logSteps };
 }
-function createCommentsCommand() {
-  const command = new Command13("comments");
-  command.description("Manage Azure DevOps work item comments");
-  command.addCommand(createCommentsListCommand());
-  command.addCommand(createCommentsAddCommand());
-  return command;
-}
-
-// src/commands/download-attachment.ts
+async function listTestRuns(context, cred, buildId) {
+  const url = withApiVersion(new URL(`${orgProjectBase(context)}/_apis/test/runs`));
+  url.searchParams.set("buildUri", `vstfs:///Build/Build/${buildId}`);
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  return data.value;
+}
+async function getTestSummary(context, cred, buildId) {
+  const testRuns = await listTestRuns(context, cred, buildId);
+  let total = 0;
+  let failed = 0;
+  for (const run of testRuns) {
+    const runTotal = run.totalTests ?? 0;
+    total += runTotal;
+    const passedOrSkipped = (run.passedTests ?? 0) + (run.notApplicableTests ?? 0) + (run.incompleteTests ?? 0);
+    failed += Math.max(0, runTotal - passedOrSkipped);
+  }
+  if (total === 0) {
+    return { present: false, total: 0, failed: 0, failedTests: [] };
+  }
+  return { present: true, total, failed, failedTests: [] };
+}
+var MAX_FAILED_TESTS = 50;
+async function getFailedTests(context, cred, buildId) {
+  const testRuns = await listTestRuns(context, cred, buildId);
+  const failed = [];
+  for (const testRun of testRuns) {
+    if (failed.length >= MAX_FAILED_TESTS) break;
+    const resultsUrl = withApiVersion(
+      new URL(`${orgProjectBase(context)}/_apis/test/runs/${testRun.id}/results`)
+    );
+    resultsUrl.searchParams.set("outcomes", "Failed");
+    resultsUrl.searchParams.set("$top", String(MAX_FAILED_TESTS - failed.length));
+    const resultsResponse = await fetchWithErrors(resultsUrl.toString(), {
+      headers: authHeaders(cred)
+    });
+    const resultsData = await readJsonResponse2(resultsResponse);
+    for (const result of resultsData.value) {
+      failed.push({
+        name: result.testCaseTitle ?? result.automatedTestName ?? "(unnamed test)",
+        errorMessage: result.errorMessage ?? null
+      });
+    }
+  }
+  return failed;
+}
+function secondsBetween(start, finish) {
+  if (!start || !finish) return null;
+  const ms = Date.parse(finish) - Date.parse(start);
+  return Number.isFinite(ms) ? Math.round(ms / 1e3) : null;
+}
+async function getRunDetail(context, cred, buildId) {
+  const build = await getBuild(context, cred, buildId);
+  let errors = [];
+  let stages = [];
+  let jobs = [];
+  let errorsAvailable = true;
+  try {
+    const timeline = await getBuildTimeline(context, cred, buildId);
+    errors = timeline.errors;
+    stages = timeline.stages;
+    jobs = timeline.jobs;
+  } catch {
+    errorsAvailable = false;
+  }
+  let tests = { present: false, total: 0, failed: 0, failedTests: [] };
+  let testsAvailable = true;
+  try {
+    tests = await getTestSummary(context, cred, buildId);
+    if (tests.failed > 0) {
+      try {
+        tests = { ...tests, failedTests: await getFailedTests(context, cred, buildId) };
+      } catch {
+      }
+    }
+  } catch {
+    testsAvailable = false;
+  }
+  return {
+    id: build.id,
+    name: build.buildNumber ?? null,
+    state: mapBuildState(build.status),
+    result: mapRunResult(build.result),
+    // createdDate is the queue time, matching the run-list mapping.
+    createdDate: build.queueTime ?? build.startTime ?? null,
+    startedDate: build.startTime ?? null,
+    finishedDate: build.finishTime ?? null,
+    durationSeconds: secondsBetween(build.startTime, build.finishTime),
+    reason: build.reason ?? null,
+    requestedFor: build.requestedFor?.displayName ?? null,
+    sourceBranch: build.sourceBranch ?? null,
+    sourceCommit: build.sourceVersion ?? null,
+    webUrl: build._links?.web?.href ?? null,
+    errors,
+    errorsAvailable,
+    stages,
+    jobs,
+    tests,
+    testsAvailable
+  };
+}
+async function getRunLogs(context, cred, buildId) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}/logs`)
+  );
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  let logSteps = /* @__PURE__ */ new Map();
+  try {
+    logSteps = (await getBuildTimeline(context, cred, buildId)).logSteps;
+  } catch {
+  }
+  return data.value.map((log) => ({
+    id: log.id,
+    createdOn: log.createdOn ?? null,
+    lineCount: log.lineCount ?? null,
+    step: logSteps.get(log.id) ?? null
+  }));
+}
+async function getRunLog(context, cred, buildId, logId) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}/logs/${logId}`)
+  );
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
+  }
+  return response.text();
+}
+
+// src/commands/pipeline.ts
+var EXIT_FAILED = 1;
+var EXIT_CANCELED = 2;
+var EXIT_TIMEOUT = 124;
+function writeError2(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exitCode = 1;
+}
+function handlePipelineError(err, context) {
+  const error = err instanceof Error ? err : new Error(String(err));
+  if (error.message === "AUTH_FAILED") {
+    writeError2('Authentication failed. Check that your credential is valid and has the "Build (Read)" scope.');
+    return;
+  }
+  if (error.message === "PERMISSION_DENIED") {
+    writeError2(`Access denied. Your credential may lack pipeline permissions for project "${context?.project}".`);
+    return;
+  }
+  if (error.message === "NETWORK_ERROR") {
+    writeError2("Could not connect to Azure DevOps. Check your network connection.");
+    return;
+  }
+  if (error.message.startsWith("NOT_FOUND")) {
+    writeError2(`Resource not found in ${context?.org}/${context?.project}.`);
+    return;
+  }
+  if (error.message.startsWith("HTTP_")) {
+    writeError2(`Azure DevOps request failed with ${error.message}.`);
+    return;
+  }
+  writeError2(error.message);
+}
+function parsePositiveId(raw) {
+  if (!/^\d+$/.test(raw)) return null;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+function parseOptionalCount(value, flag) {
+  if (value === void 0) return void 0;
+  const parsed = parsePositiveId(value);
+  if (parsed === null) {
+    writeError2(`Invalid ${flag} "${value}"; expected a positive integer.`);
+    return null;
+  }
+  return parsed;
+}
+function formatBranchName2(refName) {
+  if (!refName) return "\u2014";
+  return refName.startsWith("refs/heads/") ? refName.slice("refs/heads/".length) : refName;
+}
+async function resolvePipelineContext(options) {
+  const context = resolveContext(options);
+  const cred = await requireAuthCredential(context.org);
+  return { context, cred };
+}
+function sleep(ms) {
+  return new Promise((resolve2) => {
+    setTimeout(resolve2, ms);
+  });
+}
+function formatTable(rows, rightAlign = /* @__PURE__ */ new Set()) {
+  const widths = [];
+  for (const row of rows) {
+    row.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
+  }
+  return rows.map(
+    (row) => row.map((cell, i) => rightAlign.has(i) ? cell.padStart(widths[i]) : cell.padEnd(widths[i])).join("  ").trimEnd()
+  ).join("\n");
+}
+function createPipelineListCommand() {
+  const command = new Command13("list");
+  command.description("List Azure DevOps pipeline definitions").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--filter <name>", "filter definitions by name (case-insensitive substring)").option("--json", "output JSON").action(async (options) => {
+    validateOrgProjectPair(options);
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      let definitions = await getPipelineDefinitions(resolved.context, resolved.cred);
+      if (options.filter) {
+        const needle = options.filter.toLowerCase();
+        definitions = definitions.filter((d) => d.name.toLowerCase().includes(needle));
+      }
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(definitions, null, 2)}
+`);
+        return;
+      }
+      if (definitions.length === 0) {
+        process.stdout.write("No pipelines found.\n");
+        return;
+      }
+      const hasFolder = definitions.some((d) => d.folder);
+      const rows = definitions.map(
+        (d) => hasFolder ? [String(d.id), d.name, d.folder ?? ""] : [String(d.id), d.name]
+      );
+      process.stdout.write(`${formatTable(rows, /* @__PURE__ */ new Set([0]))}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function runRow(run) {
+  const status2 = run.result ? `${run.state}/${run.result}` : run.state;
+  return [
+    String(run.id),
+    `[${status2}]`,
+    run.createdDate ?? "\u2014",
+    formatBranchName2(run.sourceBranch),
+    run.sourceCommit ? run.sourceCommit.slice(0, 8) : "\u2014"
+  ];
+}
+var COMMIT_SHA_PATTERN = /^[0-9a-f]{6,40}$/i;
+function parseGetRunsInputs(defIdRaw, options) {
+  let defId;
+  if (defIdRaw !== void 0) {
+    const parsed = parsePositiveId(defIdRaw);
+    if (parsed === null) {
+      writeError2(`Invalid definition id "${defIdRaw}"; expected a positive integer.`);
+      return null;
+    }
+    defId = parsed;
+  } else if (options.commit === void 0 && options.pr === void 0) {
+    writeError2("Definition id is required unless --commit or --pr is given.");
+    return null;
+  }
+  const limit = parseOptionalCount(options.limit, "--limit");
+  if (limit === null) return null;
+  const prNumber = parseOptionalCount(options.pr, "--pr");
+  if (prNumber === null) return null;
+  if (options.commit !== void 0 && !COMMIT_SHA_PATTERN.test(options.commit)) {
+    writeError2(`Invalid --commit "${options.commit}"; expected 6-40 hex characters.`);
+    return null;
+  }
+  if (options.branch !== void 0 && prNumber !== void 0) {
+    writeError2("Use either --branch or --pr, not both.");
+    return null;
+  }
+  return { defId, limit: limit ?? 10, prNumber };
+}
+function createPipelineGetRunsCommand() {
+  const command = new Command13("get-runs");
+  command.description("List recent runs for a pipeline definition (newest first)").argument("[def_id]", "pipeline definition id (optional with --commit or --pr)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--limit <n>", "maximum number of runs to show (default 10)").option("--branch <branch>", "only show runs for this source branch").option("--commit <sha>", "only show runs that built this commit (full or abbreviated SHA)").option("--pr <number>", "only show runs for this pull request").option("--json", "output JSON").action(async (defIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const inputs = parseGetRunsInputs(defIdRaw, options);
+    if (inputs === null) {
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const runs = await getPipelineRuns(resolved.context, resolved.cred, {
+        definitionId: inputs.defId,
+        branch: options.branch,
+        prNumber: inputs.prNumber,
+        commit: options.commit,
+        top: inputs.limit
+      });
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(runs, null, 2)}
+`);
+        return;
+      }
+      if (runs.length === 0) {
+        process.stdout.write(
+          inputs.defId === void 0 ? "No runs found matching the filters.\n" : `No runs found for pipeline ${inputs.defId}.
+`
+        );
+        return;
+      }
+      process.stdout.write(`${formatTable(runs.map(runRow), /* @__PURE__ */ new Set([0]))}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function applyWaitExitCode(result) {
+  if (result.timedOut) {
+    process.exitCode = EXIT_TIMEOUT;
+    return;
+  }
+  switch (result.result) {
+    case "succeeded":
+      return;
+    case "canceled":
+      process.exitCode = EXIT_CANCELED;
+      return;
+    case "failed":
+    default:
+      process.exitCode = EXIT_FAILED;
+  }
+}
+function createPipelineWaitCommand() {
+  const command = new Command13("wait");
+  command.description("Wait for a pipeline run to finish; exit code reflects the result (0 success, non-zero otherwise)").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--timeout <seconds>", "maximum seconds to wait (default 1800)").option("--poll-interval <seconds>", "seconds between status checks (default 5)").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    const timeoutSec = options.timeout === void 0 ? 1800 : Number(options.timeout);
+    const pollSec = options.pollInterval === void 0 ? 5 : Number(options.pollInterval);
+    if (!Number.isFinite(timeoutSec) || timeoutSec < 0) {
+      writeError2(`Invalid --timeout "${options.timeout}"; expected a non-negative number.`);
+      return;
+    }
+    if (!Number.isFinite(pollSec) || pollSec <= 0) {
+      writeError2(`Invalid --poll-interval "${options.pollInterval}"; expected a positive number.`);
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const deadline = Date.now() + timeoutSec * 1e3;
+      let waitResult = null;
+      for (; ; ) {
+        const status2 = await getBuildStatus(resolved.context, resolved.cred, runId);
+        if (status2.state === "completed") {
+          waitResult = { id: runId, state: status2.state, result: status2.result, timedOut: false };
+          break;
+        }
+        if (Date.now() >= deadline) {
+          waitResult = { id: runId, state: status2.state, result: status2.result, timedOut: true };
+          break;
+        }
+        await sleep(pollSec * 1e3);
+      }
+      applyWaitExitCode(waitResult);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(waitResult, null, 2)}
+`);
+        return;
+      }
+      if (waitResult.timedOut) {
+        process.stdout.write(`Run ${runId} did not finish within ${timeoutSec}s (still ${waitResult.state}).
+`);
+      } else {
+        process.stdout.write(`Run ${runId} finished: ${waitResult.result ?? waitResult.state}.
+`);
+      }
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function timelineRows(items, available) {
+  if (!available) {
+    return ["  unavailable"];
+  }
+  if (items.length === 0) {
+    return ["  (none)"];
+  }
+  return items.map((item) => `  - ${item.name} [${item.result ?? item.state}]`);
+}
+function formatDuration(totalSeconds) {
+  const h = Math.floor(totalSeconds / 3600);
+  const m = Math.floor(totalSeconds % 3600 / 60);
+  const s = totalSeconds % 60;
+  if (h > 0) return `${h}h${m}m${s}s`;
+  if (m > 0) return `${m}m${s}s`;
+  return `${s}s`;
+}
+function errorRows(detail) {
+  if (!detail.errorsAvailable) {
+    return ["  unavailable"];
+  }
+  if (detail.errors.length === 0) {
+    return ["  (none)"];
+  }
+  return detail.errors.map((error) => {
+    const source = error.source ? `[${error.source}] ` : "";
+    return `  - ${source}${error.message}`;
+  });
+}
+function failedTestRow(test) {
+  if (!test.errorMessage) {
+    return `  - ${test.name}`;
+  }
+  const firstLine = test.errorMessage.split("\n", 1)[0].trim();
+  return `  - ${test.name}: ${firstLine}`;
+}
+function testRows(detail) {
+  if (!detail.testsAvailable) {
+    return ["  unavailable"];
+  }
+  if (detail.tests.present) {
+    return [
+      `  ${detail.tests.failed} failing of ${detail.tests.total}`,
+      ...detail.tests.failedTests.map(failedTestRow)
+    ];
+  }
+  return ["  no tests present"];
+}
+function formatRunDetail(detail) {
+  const status2 = detail.result ? `${detail.state}/${detail.result}` : detail.state;
+  const name = detail.name ? ` ${detail.name}` : "";
+  const duration = detail.durationSeconds == null ? "\u2014" : formatDuration(detail.durationSeconds);
+  return [
+    `Run #${detail.id} [${status2}]${name}`,
+    `Queued: ${detail.createdDate ?? "\u2014"}    Started: ${detail.startedDate ?? "\u2014"}    Finished: ${detail.finishedDate ?? "\u2014"}`,
+    `Duration: ${duration}    Reason: ${detail.reason ?? "\u2014"}    Requested for: ${detail.requestedFor ?? "\u2014"}`,
+    `Branch: ${formatBranchName2(detail.sourceBranch)}    Commit: ${detail.sourceCommit ?? "unavailable"}`,
+    ...detail.webUrl ? [`Link: ${detail.webUrl}`] : [],
+    "",
+    "Stages:",
+    ...timelineRows(detail.stages, detail.errorsAvailable),
+    "",
+    "Jobs:",
+    ...timelineRows(detail.jobs, detail.errorsAvailable),
+    "",
+    "Errors:",
+    ...errorRows(detail),
+    "",
+    "Tests:",
+    ...testRows(detail)
+  ].join("\n");
+}
+function createPipelineGetRunDetailCommand() {
+  const command = new Command13("get-run-detail");
+  command.description("Show a detailed summary of a single pipeline run (errors, failing tests, stages)").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const detail = await getRunDetail(resolved.context, resolved.cred, runId);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(detail, null, 2)}
+`);
+        return;
+      }
+      process.stdout.write(`${formatRunDetail(detail)}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function grepWithContext(lines, grep, context) {
+  const include = /* @__PURE__ */ new Set();
+  lines.forEach((line, i) => {
+    if (grep.test(line)) {
+      for (let j = Math.max(0, i - context); j <= Math.min(lines.length - 1, i + context); j++) {
+        include.add(j);
+      }
+    }
+  });
+  const selected = [];
+  let prev = -1;
+  for (const i of [...include].sort((a, b) => a - b)) {
+    if (selected.length > 0 && i > prev + 1) {
+      selected.push("--");
+    }
+    selected.push(lines[i]);
+    prev = i;
+  }
+  return selected;
+}
+function filterLogLines(content, grep, tail, context) {
+  let lines = content.split("\n");
+  if (lines.at(-1) === "") {
+    lines.pop();
+  }
+  if (grep) {
+    lines = context > 0 ? grepWithContext(lines, grep, context) : lines.filter((line) => grep.test(line));
+  }
+  if (tail !== void 0 && lines.length > tail) {
+    lines = lines.slice(-tail);
+  }
+  return lines;
+}
+function parseLogFilters(options) {
+  if (options.logId !== void 0 && options.step !== void 0) {
+    writeError2("Use either --log-id or --step, not both.");
+    return null;
+  }
+  const selectsSingleLog = options.logId !== void 0 || options.step !== void 0;
+  const slices = options.tail !== void 0 || options.grep !== void 0 || options.context !== void 0;
+  if (slices && !selectsSingleLog) {
+    writeError2("--tail, --grep, and --context require --log-id or --step.");
+    return null;
+  }
+  if (options.context !== void 0 && options.grep === void 0) {
+    writeError2("--context requires --grep.");
+    return null;
+  }
+  const tail = parseOptionalCount(options.tail, "--tail");
+  if (tail === null) return null;
+  const contextLines = parseOptionalCount(options.context, "--context");
+  if (contextLines === null) return null;
+  let grep;
+  if (options.grep !== void 0) {
+    try {
+      grep = new RegExp(options.grep);
+    } catch {
+      writeError2(`Invalid --grep "${options.grep}"; expected a valid regular expression.`);
+      return null;
+    }
+  }
+  return { tail, contextLines: contextLines ?? 0, grep };
+}
+function chooseStepLog(logs, step, runId) {
+  const needle = step.toLowerCase();
+  const matches = logs.filter((l) => l.step?.toLowerCase().includes(needle));
+  const exact = matches.filter((l) => l.step?.toLowerCase() === needle);
+  const chosen = exact.length === 1 ? exact : matches;
+  if (chosen.length === 0) {
+    writeError2(`No log matches step "${step}" in run ${runId}.`);
+    return null;
+  }
+  if (chosen.length > 1) {
+    const candidates = chosen.map((l) => `${l.id} (${l.step})`).join(", ");
+    writeError2(`Step "${step}" matches multiple logs: ${candidates}. Be more specific or use --log-id.`);
+    return null;
+  }
+  return chosen[0].id;
+}
+async function resolveRequestedLogId(resolved, runId, options) {
+  if (options.logId !== void 0) {
+    const parsed = parsePositiveId(options.logId);
+    if (parsed === null) {
+      writeError2(`Invalid --log-id "${options.logId}"; expected a positive integer.`);
+      return null;
+    }
+    return parsed;
+  }
+  if (options.step === void 0) {
+    return void 0;
+  }
+  const allLogs = await getRunLogs(resolved.context, resolved.cred, runId);
+  return chooseStepLog(allLogs, options.step, runId);
+}
+function printSingleLog(content, filters) {
+  if (filters.grep !== void 0 || filters.tail !== void 0) {
+    const lines = filterLogLines(content, filters.grep, filters.tail, filters.contextLines);
+    if (lines.length > 0) {
+      process.stdout.write(`${lines.join("\n")}
+`);
+    }
+    return;
+  }
+  process.stdout.write(content.endsWith("\n") ? content : `${content}
+`);
+}
+function createPipelineLogsCommand() {
+  const command = new Command13("logs");
+  command.description("List a pipeline run's logs, or print a specific log with --log-id").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--log-id <id>", "print the content of this log id").option("--step <name>", "print the log of the step/job matching this name (case-insensitive substring)").option("--tail <n>", "with --log-id/--step, print only the last N lines").option("--grep <pattern>", "with --log-id/--step, print only lines matching this regular expression").option("--context <n>", "with --grep, also print N lines around each match (grep -C)").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    const filters = parseLogFilters(options);
+    if (filters === null) {
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const logId = await resolveRequestedLogId(resolved, runId, options);
+      if (logId === null) {
+        return;
+      }
+      if (logId !== void 0) {
+        const content = await getRunLog(resolved.context, resolved.cred, runId, logId);
+        printSingleLog(content, filters);
+        return;
+      }
+      const logs = await getRunLogs(resolved.context, resolved.cred, runId);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(logs, null, 2)}
+`);
+        return;
+      }
+      if (logs.length === 0) {
+        process.stdout.write(`No logs found for run ${runId}.
+`);
+        return;
+      }
+      const rows = logs.map((l) => [
+        String(l.id),
+        l.createdOn ?? "\u2014",
+        l.lineCount == null ? "" : `${l.lineCount} lines`,
+        l.step ?? ""
+      ]);
+      process.stdout.write(`${formatTable(rows, /* @__PURE__ */ new Set([0]))}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function createPipelineTestsCommand() {
+  const command = new Command13("tests");
+  command.description("Show a run's test results: summary plus failing tests by name (no log grepping needed)").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--failed", "list only the failing tests").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const summary = await getTestSummary(resolved.context, resolved.cred, runId);
+      const failedTests = summary.failed > 0 ? await getFailedTests(resolved.context, resolved.cred, runId) : [];
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify({ ...summary, failedTests }, null, 2)}
+`);
+        return;
+      }
+      if (!summary.present) {
+        process.stdout.write(`No test results published for run ${runId}.
+`);
+        return;
+      }
+      if (!options.failed) {
+        process.stdout.write(`Run #${runId}: ${summary.failed} failing of ${summary.total} tests
+`);
+      }
+      if (failedTests.length > 0) {
+        process.stdout.write(`${failedTests.map(failedTestRow).join("\n")}
+`);
+      } else if (options.failed) {
+        process.stdout.write("No failing tests.\n");
+      }
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function parseParameters(values) {
+  const result = {};
+  for (const entry of values ?? []) {
+    const eq = entry.indexOf("=");
+    if (eq <= 0) {
+      return null;
+    }
+    const key = entry.slice(0, eq);
+    const value = entry.slice(eq + 1);
+    result[key] = value;
+  }
+  return result;
+}
+function collectParameter(value, previous) {
+  return previous.concat([value]);
+}
+function createPipelineStartCommand() {
+  const command = new Command13("start");
+  command.description("Queue a new run of a pipeline definition").argument("<def_id>", "pipeline definition id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--branch <branch>", "branch to run against (default: pipeline default branch)").option("--parameter <key=value>", "template parameter (repeatable)", collectParameter, []).option("--json", "output JSON").action(async (defIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const defId = parsePositiveId(defIdRaw);
+    if (defId === null) {
+      writeError2(`Invalid definition id "${defIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    const parameters = parseParameters(options.parameter);
+    if (parameters === null) {
+      writeError2("Invalid --parameter; expected key=value.");
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const result = await runPipeline(resolved.context, resolved.cred, defId, {
+        branch: options.branch,
+        parameters
+      });
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        return;
+      }
+      process.stdout.write(`Queued run #${result.id} [${result.state}]
+${result.webUrl ?? "\u2014"}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function createPipelineCommand() {
+  const command = new Command13("pipeline");
+  command.description("Manage Azure DevOps pipelines");
+  command.addCommand(createPipelineListCommand());
+  command.addCommand(createPipelineGetRunsCommand());
+  command.addCommand(createPipelineWaitCommand());
+  command.addCommand(createPipelineGetRunDetailCommand());
+  command.addCommand(createPipelineLogsCommand());
+  command.addCommand(createPipelineTestsCommand());
+  command.addCommand(createPipelineStartCommand());
+  return command;
+}
+
+// src/commands/comments.ts
 import { Command as Command14 } from "commander";
-import { writeFile } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import { join as join2 } from "path";
+function writeError3(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(1);
+}
+function formatCommentHeader(comment) {
+  const author = comment.author ?? "Unknown";
+  const timestamp = comment.modifiedAt ?? comment.createdAt ?? "Unknown time";
+  return `Comment #${comment.id} by ${author} at ${timestamp}`;
+}
+function formatComments(result, convertMarkdown) {
+  const lines = [`Comments for work item #${result.workItemId}`];
+  for (const comment of result.comments) {
+    const text = convertMarkdown ? toMarkdown(comment.text) : comment.text;
+    lines.push("", formatCommentHeader(comment), text);
+  }
+  return lines.join("\n");
+}
+function createCommentsListCommand() {
+  const command = new Command14("list");
+  command.description("List visible comments for a work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "convert HTML comment bodies to markdown").action(async (idStr, options) => {
+    validateOrgProjectPair(options);
+    const id = parseWorkItemId(idStr);
+    let context;
+    try {
+      context = resolveContext(options);
+      const credential = await requireAuthCredential(context.org);
+      const result = await listWorkItemComments(context, id, credential);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        return;
+      }
+      if (result.comments.length === 0) {
+        process.stdout.write(`Work item #${id} has no comments.
+`);
+        return;
+      }
+      process.stdout.write(`${formatComments(result, options.markdown === true)}
+`);
+    } catch (err) {
+      handleCommandError(err, id, context, "read");
+    }
+  });
+  return command;
+}
+function createCommentsAddCommand() {
+  const command = new Command14("add");
+  command.description("Add a comment to a work item").argument("<id>", "work item ID").argument("<text>", "comment text").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "post comment as markdown").action(async (idStr, text, options) => {
+    validateOrgProjectPair(options);
+    const id = parseWorkItemId(idStr);
+    if (text.trim() === "") {
+      writeError3("Comment text must be a non-empty string.");
+    }
+    let context;
+    try {
+      context = resolveContext(options);
+      const credential = await requireAuthCredential(context.org);
+      const format = options.markdown === true ? "markdown" : "html";
+      const result = await addWorkItemComment(context, id, credential, text, format);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        return;
+      }
+      process.stdout.write(`Added comment #${result.commentId} to work item #${result.workItemId}
+`);
+    } catch (err) {
+      handleCommandError(err, id, context, "write");
+    }
+  });
+  return command;
+}
+function createCommentsCommand() {
+  const command = new Command14("comments");
+  command.description("Manage Azure DevOps work item comments");
+  command.addCommand(createCommentsListCommand());
+  command.addCommand(createCommentsAddCommand());
+  return command;
+}
+
+// src/commands/download-attachment.ts
+import { Command as Command15 } from "commander";
+import { writeFile as writeFile2 } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { join as join3 } from "path";
 function createDownloadAttachmentCommand() {
-  const command = new Command14("download-attachment");
+  const command = new Command15("download-attachment");
   command.description("Download an attachment from an Azure DevOps work item").argument("<id>", "work item ID").argument("<filename>", "name of the attachment to download").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--output <dir>", "target directory for the downloaded file").action(
     async (idStr, filename, options) => {
       const id = parseWorkItemId(idStr);
@@ -3131,7 +4970,7 @@ function createDownloadAttachmentCommand() {
         context = resolveContext(options);
         const credential = await requireAuthCredential(context.org);
         const outputDir = options.output ?? ".";
-        if (!existsSync4(outputDir)) {
+        if (!existsSync5(outputDir)) {
           process.stderr.write(`Error: Output directory "${outputDir}" does not exist.
 `);
           process.exit(1);
@@ -3148,8 +4987,8 @@ function createDownloadAttachmentCommand() {
           process.exit(1);
         }
         const data = await downloadAttachment(attachment.url, credential);
-        const outputPath = join2(outputDir, filename);
-        await writeFile(outputPath, Buffer.from(data));
+        const outputPath = join3(outputDir, filename);
+        await writeFile2(outputPath, Buffer.from(data));
         process.stdout.write(
           `Downloaded "${filename}" (${formatFileSize(attachment.size)}) to ${outputPath}
 `
@@ -3162,9 +5001,416 @@ function createDownloadAttachmentCommand() {
   return command;
 }
 
+// src/commands/relations.ts
+import { Command as Command16 } from "commander";
+
+// src/services/relations-client.ts
+var API_VERSION2 = "7.1";
+function buildRelationTypesUrl(context) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/wit/workitemrelationtypes`
+  );
+  url.searchParams.set("api-version", API_VERSION2);
+  return url;
+}
+function buildWorkItemUrl2(context, id, expand) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
+  );
+  url.searchParams.set("api-version", API_VERSION2);
+  if (expand) url.searchParams.set("$expand", expand);
+  return url;
+}
+function buildBatchWorkItemsUrl(context, ids) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems`
+  );
+  url.searchParams.set("ids", ids.join(","));
+  url.searchParams.set("fields", "System.Id,System.Title");
+  url.searchParams.set("api-version", API_VERSION2);
+  return url;
+}
+function mapRelationType(raw) {
+  return {
+    referenceName: raw.referenceName,
+    name: raw.name,
+    usage: raw.attributes?.usage ?? "unknown",
+    enabled: raw.attributes?.enabled !== false,
+    directional: raw.attributes?.directional ?? null
+  };
+}
+async function readJsonResponse3(response) {
+  if (!response.ok) throw new Error(`HTTP_${response.status}`);
+  return await response.json();
+}
+function parseTargetId(url) {
+  const match = /\/workItems\/(\d+)$/i.exec(url);
+  return match ? Number(match[1]) : null;
+}
+async function getWorkItemRelationTypes(context, cred) {
+  const url = buildRelationTypesUrl(context);
+  const response = await fetchWithErrors(url.toString(), {
+    headers: authHeaders(cred)
+  });
+  const body = await readJsonResponse3(response);
+  return (body.value ?? []).map(mapRelationType).filter((t) => t.usage === "workItemLink" && t.enabled);
+}
+async function resolveRelationType(context, cred, alias) {
+  const types = await getWorkItemRelationTypes(context, cred);
+  const lower = alias.toLowerCase();
+  const match = types.find((t) => t.name.toLowerCase() === lower);
+  if (!match) throw new Error(`UNKNOWN_RELATION_TYPE:${alias}`);
+  return match;
+}
+async function getWorkItemWithRelations(context, cred, id) {
+  const url = buildWorkItemUrl2(context, id, "relations");
+  const response = await fetchWithErrors(url.toString(), {
+    headers: authHeaders(cred)
+  });
+  return readJsonResponse3(response);
+}
+async function addWorkItemRelation(context, cred, type, id1, id2) {
+  if (id1 === id2) throw new Error("SELF_RELATION");
+  const relType = await resolveRelationType(context, cred, type);
+  const workItem = await getWorkItemWithRelations(context, cred, id1);
+  const targetUrl = `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/wit/workItems/${id2}`;
+  const existing = (workItem.relations ?? []).find(
+    (r) => r.rel === relType.referenceName && r.url.toLowerCase() === targetUrl.toLowerCase()
+  );
+  if (existing) {
+    return { status: "already_exists", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+  }
+  const patchUrl = buildWorkItemUrl2(context, id1);
+  const response = await fetchWithErrors(patchUrl.toString(), {
+    method: "PATCH",
+    headers: { ...authHeaders(cred), "Content-Type": "application/json-patch+json" },
+    body: JSON.stringify([
+      { op: "add", path: "/relations/-", value: { rel: relType.referenceName, url: targetUrl } }
+    ])
+  });
+  if (!response.ok) throw new Error(`HTTP_${response.status}`);
+  return { status: "added", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+}
+async function removeWorkItemRelation(context, cred, type, id1, id2) {
+  if (id1 === id2) throw new Error("SELF_RELATION");
+  const relType = await resolveRelationType(context, cred, type);
+  const workItem = await getWorkItemWithRelations(context, cred, id1);
+  const relations = workItem.relations ?? [];
+  const index = relations.findIndex(
+    (r) => r.rel === relType.referenceName && parseTargetId(r.url) === id2
+  );
+  if (index === -1) {
+    return { status: "not_found", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+  }
+  const patchUrl = buildWorkItemUrl2(context, id1);
+  const response = await fetchWithErrors(patchUrl.toString(), {
+    method: "PATCH",
+    headers: { ...authHeaders(cred), "Content-Type": "application/json-patch+json" },
+    body: JSON.stringify([{ op: "remove", path: `/relations/${index}` }])
+  });
+  if (!response.ok) throw new Error(`HTTP_${response.status}`);
+  return { status: "removed", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+}
+async function listWorkItemRelations(context, cred, id) {
+  const workItem = await getWorkItemWithRelations(context, cred, id);
+  const allRelations = workItem.relations ?? [];
+  const wiRelations = allRelations.filter(
+    (r) => !r.rel.startsWith("AttachedFile") && !r.rel.startsWith("Hyperlink") && !r.rel.startsWith("ArtifactLink")
+  );
+  if (wiRelations.length === 0) {
+    return { workItemId: id, relations: [] };
+  }
+  const types = await getWorkItemRelationTypes(context, cred);
+  const typeNameMap = new Map(types.map((t) => [t.referenceName, t.name]));
+  const targetIds = wiRelations.map((r) => parseTargetId(r.url)).filter((n) => n !== null);
+  const titleMap = /* @__PURE__ */ new Map();
+  if (targetIds.length > 0) {
+    try {
+      const batchUrl = buildBatchWorkItemsUrl(context, targetIds);
+      const batchResponse = await fetchWithErrors(batchUrl.toString(), {
+        headers: authHeaders(cred)
+      });
+      const batchBody = await readJsonResponse3(batchResponse);
+      for (const item of batchBody.value ?? []) {
+        titleMap.set(item.id, item.fields["System.Title"] ?? "");
+      }
+    } catch {
+    }
+  }
+  const relations = wiRelations.map((r) => {
+    const targetId = parseTargetId(r.url);
+    return {
+      rel: r.rel,
+      relName: typeNameMap.get(r.rel) ?? r.rel,
+      targetId: targetId ?? 0,
+      targetTitle: targetId !== null ? titleMap.get(targetId) ?? null : null,
+      targetUrl: r.url,
+      comment: r.attributes?.comment ?? null
+    };
+  });
+  return { workItemId: id, relations };
+}
+
+// src/commands/relations.ts
+function addCommonOptions(cmd) {
+  return cmd.option("--json", "Output as JSON").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project");
+}
+async function resolveCredentials(opts) {
+  const context = resolveContext(opts);
+  const cred = await requireAuthCredential(context.org);
+  return { context, cred };
+}
+function formatRelationTypes(types) {
+  if (types.length === 0) return "No work item relation types found.";
+  const nameWidth = Math.max(...types.map((t) => t.name.length), 4);
+  const lines = ["Available work item relation types:", ""];
+  for (const t of types) {
+    lines.push(`${t.name.padEnd(nameWidth + 2)}${t.referenceName}`);
+  }
+  return lines.join("\n");
+}
+function formatRelationsList(workItemId, relations) {
+  if (relations.length === 0) return `Work item #${workItemId} has no relations.`;
+  const typeWidth = Math.max(...relations.map((r) => r.relName.length), 4) + 2;
+  const idWidth = Math.max(...relations.map((r) => String(r.targetId).length), 4) + 1;
+  const lines = [`Relations for work item #${workItemId}:`, ""];
+  for (const r of relations) {
+    const typeLabel = `[${r.relName}]`.padEnd(typeWidth);
+    const idLabel = `#${r.targetId}`.padEnd(idWidth);
+    lines.push(`${typeLabel}  ${idLabel}  ${r.targetTitle ?? "(unknown)"}`);
+  }
+  return lines.join("\n");
+}
+function handleRelationError(err, id1) {
+  const msg = err instanceof Error ? err.message : String(err);
+  if (msg === "SELF_RELATION") {
+    process.stderr.write(`Error: cannot relate a work item to itself (#${id1}).
+`);
+  } else if (msg.startsWith("UNKNOWN_RELATION_TYPE:")) {
+    const name = msg.replace("UNKNOWN_RELATION_TYPE:", "");
+    process.stderr.write(
+      `Error: unknown relation type "${name}". Run 'azdo relations types' to see valid names.
+`
+    );
+  } else if (msg.startsWith("NOT_FOUND")) {
+    const target = id1 !== void 0 ? id1 : "unknown";
+    process.stderr.write(`Error: work item #${target} not found.
+`);
+  } else if (msg === "AUTH_FAILED") {
+    process.stderr.write(
+      `Error: authentication failed. Check your PAT has Work Items \u2192 Read & Write scope.
+`
+    );
+  } else {
+    process.stderr.write(`Error: ${msg}
+`);
+  }
+  process.exit(1);
+}
+function parsePositiveInt(value, label) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n <= 0) {
+    process.stderr.write(`Error: ${label} must be a positive integer.
+`);
+    process.exit(1);
+  }
+  return n;
+}
+function createRelationsCommand() {
+  const relations = new Command16("relations").description("Manage work item relations");
+  addCommonOptions(
+    relations.command("types").description("List all available work item relation types")
+  ).action(async (opts) => {
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const types = await getWorkItemRelationTypes(context, cred);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(types, null, 2) + "\n");
+      } else {
+        process.stdout.write(formatRelationTypes(types) + "\n");
+      }
+    } catch (err) {
+      handleRelationError(err);
+    }
+  });
+  addCommonOptions(
+    relations.command("add <type> <id1> <id2>").description("Add a directed relation from work item <id1> to <id2>")
+  ).action(async (type, id1Str, id2Str, opts) => {
+    const id1 = parsePositiveInt(id1Str, "id1");
+    const id2 = parsePositiveInt(id2Str, "id2");
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const result = await addWorkItemRelation(context, cred, type, id1, id2);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else if (result.status === "already_exists") {
+        process.stdout.write(`Relation already exists: #${id1} --[${result.type}]--> #${id2}
+`);
+      } else {
+        process.stdout.write(`Added relation: #${id1} --[${result.type}]--> #${id2}
+`);
+      }
+    } catch (err) {
+      handleRelationError(err, id1);
+    }
+  });
+  addCommonOptions(
+    relations.command("remove <type> <id1> <id2>").description("Remove a directed relation of <type> from work item <id1> to <id2>")
+  ).action(async (type, id1Str, id2Str, opts) => {
+    const id1 = parsePositiveInt(id1Str, "id1");
+    const id2 = parsePositiveInt(id2Str, "id2");
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const result = await removeWorkItemRelation(context, cred, type, id1, id2);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else if (result.status === "not_found") {
+        process.stdout.write(`No relation of type '${result.type}' found between #${id1} and #${id2}
+`);
+      } else {
+        process.stdout.write(`Removed relation: #${id1} --[${result.type}]--> #${id2}
+`);
+      }
+    } catch (err) {
+      handleRelationError(err, id1);
+    }
+  });
+  addCommonOptions(
+    relations.command("list <id>").description("List all work item link relations on a work item")
+  ).action(async (idStr, opts) => {
+    const id = parsePositiveInt(idStr, "id");
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const result = await listWorkItemRelations(context, cred, id);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else {
+        process.stdout.write(formatRelationsList(result.workItemId, result.relations) + "\n");
+      }
+    } catch (err) {
+      handleRelationError(err, id);
+    }
+  });
+  return relations;
+}
+
+// src/services/update-check.ts
+import fs2 from "fs";
+import path2 from "path";
+import os from "os";
+var THROTTLE_MS = 10 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 1500;
+var REGISTRY_URL = "https://registry.npmjs.org/azdo-cli/latest";
+function getCachePath() {
+  return path2.join(os.homedir(), ".azdo", "update-check.json");
+}
+function defaultReadCache() {
+  try {
+    return fs2.readFileSync(getCachePath(), "utf-8");
+  } catch {
+    return null;
+  }
+}
+function defaultWriteCache(data) {
+  try {
+    const cachePath = getCachePath();
+    fs2.mkdirSync(path2.dirname(cachePath), { recursive: true });
+    fs2.writeFileSync(cachePath, data);
+  } catch {
+  }
+}
+function parseCache(raw) {
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const { lastCheck, latestVersion } = parsed;
+  if (typeof lastCheck !== "number" || !Number.isFinite(lastCheck)) return null;
+  if (typeof latestVersion !== "string" || latestVersion.length === 0) return null;
+  return { lastCheck, latestVersion };
+}
+async function defaultFetchLatest() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(REGISTRY_URL, { signal: controller.signal });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (typeof body !== "object" || body === null) return null;
+    const v = body.version;
+    return typeof v === "string" && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseVersion(v) {
+  if (typeof v !== "string") return null;
+  const trimmed = v.trim().replace(/^v/, "");
+  const match = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/.exec(trimmed);
+  if (!match) return null;
+  const release = [Number(match[1]), Number(match[2]), Number(match[3])];
+  if (!release.every(Number.isFinite)) return null;
+  return { release, prerelease: match[4] !== void 0 };
+}
+function isNewer(latest, current) {
+  const a = parseVersion(latest);
+  const b = parseVersion(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a.release[i] > b.release[i]) return true;
+    if (a.release[i] < b.release[i]) return false;
+  }
+  if (a.prerelease && !b.prerelease) return false;
+  if (!a.prerelease && b.prerelease) return true;
+  return false;
+}
+async function getUpdateNotice(opts) {
+  try {
+    const {
+      enabled = true,
+      now = Date.now,
+      readCache = defaultReadCache,
+      writeCache = defaultWriteCache,
+      fetchLatest = defaultFetchLatest,
+      isTTY = () => Boolean(process.stderr.isTTY),
+      currentVersion = version
+    } = opts ?? {};
+    if (enabled === false) return null;
+    if (!isTTY()) return null;
+    const cache = parseCache(readCache());
+    const lastCheck = cache?.lastCheck ?? 0;
+    if (now() - lastCheck < THROTTLE_MS) return null;
+    const latest = await fetchLatest();
+    if (!latest) return null;
+    writeCache(JSON.stringify({ lastCheck: now(), latestVersion: latest }));
+    if (isNewer(latest, currentVersion)) {
+      return `A new version of azdo-cli is available: ${currentVersion} \u2192 ${latest}. Run \`npm i -g azdo-cli\` to update.`;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // src/index.ts
-var program = new Command15();
+function exitOnEpipe(err) {
+  if (err.code === "EPIPE") {
+    process.exit(0);
+  }
+  throw err;
+}
+process.stdout.on("error", exitOnEpipe);
+process.stderr.on("error", exitOnEpipe);
+var program = new Command17();
 program.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
+program.option("--no-update-check", "Skip the check for a newer published version");
+program.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
 program.addCommand(createGetItemCommand());
 program.addCommand(createAuthCommand());
 program.addCommand(createClearPatCommand());
@@ -3177,10 +5423,24 @@ program.addCommand(createSetMdFieldCommand());
 program.addCommand(createUpsertCommand());
 program.addCommand(createListFieldsCommand());
 program.addCommand(createPrCommand());
+program.addCommand(createPipelineCommand());
 program.addCommand(createCommentsCommand());
 program.addCommand(createDownloadAttachmentCommand());
+program.addCommand(createRelationsCommand());
 program.showHelpAfterError();
-program.parse();
+program.hook("preAction", () => {
+  const { trace } = program.opts();
+  if (trace) {
+    initTraceWriter(trace);
+  }
+});
+program.hook("postAction", async () => {
+  const notice = await getUpdateNotice({ enabled: program.opts().updateCheck });
+  if (notice) {
+    process.stderr.write(notice + "\n");
+  }
+});
+await program.parseAsync();
 if (process.argv.length <= 2) {
   program.help();
 }