azdo-cli 0.12.0 → 0.13.0

package/README.md

@@ -17,7 +17,8 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Check branch pull request status, open PRs to `develop`, list PR comment threads for any PR (`--pr-number`), and resolve/reopen threads from the CLI (`pr`)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. See [docs/authentication.md](docs/authentication.md).
+- Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation
 
@@ -62,6 +63,11 @@ azdo pr status                          # PR checks (status + branch policies +
 azdo pr comment-resolve 17 --pr-number 64   # idempotent: exit 0 even when already resolved
 azdo pr comment-reopen 17  --pr-number 64
 
+# Reply to a PR comment thread
+azdo pr comments reply 148 "Great suggestion, I'll address it."          # human-readable output
+azdo pr comments reply 148 "Done." --pr-number 64 --json                 # JSON: { pullRequestId, threadId, commentId, content }
+azdo pr comment-reply 148 "Done."  --pr-number 64                        # flat alias, identical behaviour
+
 # Pipelines — list, inspect runs, wait (exit code = result), start
 azdo pipeline list --filter ci
 azdo pipeline get-runs 12 --branch develop --limit 1

package/dist/index.js

@@ -51,6 +51,78 @@ var version = pkg.version;
 // src/commands/get-item.ts
 import { Command } from "commander";
 
+// src/services/trace-writer.ts
+import { openSync, writeSync, closeSync } from "fs";
+import { platform } from "os";
+var REDACTED = "[REDACTED]";
+var SENSITIVE_HEADER = /^(authorization|x-.*token)$/i;
+var SENSITIVE_QUERY_PARAM = /^(token|pat)$/i;
+var SENSITIVE_BODY_FIELD = /^(token|accessToken|pat)$/;
+function redactHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADER.test(key) ? REDACTED : value;
+  }
+  return out;
+}
+function redactUrl(url) {
+  try {
+    const u = new URL(url);
+    for (const [key] of u.searchParams.entries()) {
+      if (SENSITIVE_QUERY_PARAM.test(key)) {
+        u.searchParams.set(key, REDACTED);
+      }
+    }
+    return u.toString();
+  } catch {
+    return url;
+  }
+}
+function redactBody(body) {
+  if (body === null) return null;
+  try {
+    const parsed = JSON.parse(body);
+    let changed = false;
+    const redacted = { ...parsed };
+    for (const key of Object.keys(parsed)) {
+      if (SENSITIVE_BODY_FIELD.test(key)) {
+        redacted[key] = REDACTED;
+        changed = true;
+      }
+    }
+    return changed ? JSON.stringify(redacted) : body;
+  } catch {
+    return body;
+  }
+}
+var TraceWriter = class {
+  fd;
+  constructor(filepath) {
+    const mode = platform() === "win32" ? void 0 : 384;
+    this.fd = openSync(filepath, "a", mode);
+  }
+  append(entry) {
+    const line = JSON.stringify(entry) + "\n\n";
+    writeSync(this.fd, line);
+  }
+  close() {
+    closeSync(this.fd);
+  }
+};
+var activeWriter = null;
+function initTraceWriter(filepath) {
+  try {
+    activeWriter = new TraceWriter(filepath);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Warning: could not open trace file "${filepath}": ${msg}
+`);
+  }
+}
+function getActiveTraceWriter() {
+  return activeWriter;
+}
+
 // src/services/azdo-client.ts
 var DEFAULT_FIELDS = [
   "System.Title",
@@ -74,12 +146,48 @@ function authHeaders(credentialOrPat) {
   const token = Buffer.from(`:${credentialOrPat.pat}`).toString("base64");
   return { Authorization: `Basic ${token}` };
 }
+async function fetchRaw(url, init) {
+  let response;
+  try {
+    response = await fetch(url, init);
+  } catch (err) {
+    throw new Error(`NETWORK_ERROR: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+  }
+  const body = await response.text();
+  return { status: response.status, body };
+}
 async function fetchWithErrors(url, init) {
+  const writer = getActiveTraceWriter();
   let response;
   try {
     response = await fetch(url, init);
-  } catch {
-    throw new Error("NETWORK_ERROR");
+  } catch (err) {
+    throw new Error("NETWORK_ERROR", { cause: err });
+  }
+  if (writer) {
+    const reqHeaders = redactHeaders(init.headers ?? {});
+    const reqBody = typeof init.body === "string" ? redactBody(init.body) : null;
+    let responseBody = "";
+    const clone = response.clone();
+    try {
+      responseBody = await clone.text();
+    } catch {
+    }
+    const respHeaders = {};
+    response.headers.forEach((v, k) => {
+      respHeaders[k] = v;
+    });
+    const entry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      method: (init.method ?? "GET").toUpperCase(),
+      url: redactUrl(url),
+      requestHeaders: reqHeaders,
+      requestBody: reqBody ?? null,
+      responseStatus: response.status,
+      responseHeaders: respHeaders,
+      responseBody
+    };
+    writer.append(entry);
   }
   if (response.status === 401) throw new Error("AUTH_FAILED");
   if (response.status === 403) throw new Error("PERMISSION_DENIED");
@@ -624,7 +732,7 @@ function findDotEnvPat(startDir = process.cwd()) {
     if (existsSync(envFile)) {
       const contents = readFileSync2(envFile, "utf8");
       for (const line of contents.split("\n")) {
-        const match = line.match(/^AZDO_PAT\s*=\s*(.+)$/);
+        const match = line.match(/^AZDO_PAT\s*=([^\n\r]+)$/);
         if (match) {
           const value = match[1].trim().replace(/^["']|["']$/g, "");
           if (value.length > 0) return value;
@@ -867,11 +975,18 @@ function parseSingleRemoteLine(line) {
   const url = urlEnd === -1 ? afterTab : afterTab.slice(0, urlEnd);
   return { remoteName, url };
 }
+function decodePctSegment(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
 function matchAzdoRemote(remoteName, url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
     if (!match) continue;
-    const project = match[2];
+    const project = decodePctSegment(match[2]);
     if (/^DefaultCollection$/i.test(project)) return null;
     return { remoteName, org: match[1], project, hasEmbeddedSecret: httpsEmbeddedSecret.test(url) };
   }
@@ -1561,6 +1676,79 @@ function createClearPatCommand() {
 
 // src/commands/auth.ts
 import { Command as Command3 } from "commander";
+
+// src/services/auth-diagnostics.ts
+async function runConnectivityTest(org, cred) {
+  const url = `https://dev.azure.com/${encodeURIComponent(org)}/_apis/projects?api-version=7.1&$top=1`;
+  let result;
+  try {
+    result = await fetchRaw(url, { headers: authHeaders(cred) });
+  } catch (err) {
+    return { status: "failed", error: err instanceof Error ? err.message : String(err) };
+  }
+  if (result.status >= 200 && result.status < 300) {
+    return { status: "ok", error: null };
+  }
+  let error = `HTTP ${result.status}`;
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed.message === "string" && parsed.message.trim() !== "") {
+      error = parsed.message.trim();
+    }
+  } catch {
+  }
+  return { status: "failed", error };
+}
+async function diagnoseAuth(org, project, resolveCredential) {
+  const cred = await resolveCredential(org);
+  if (cred === null) {
+    return {
+      authType: "none",
+      credentialSource: null,
+      org,
+      project,
+      connectivityStatus: "no-credentials",
+      connectivityError: null
+    };
+  }
+  const connectivity = await runConnectivityTest(org, cred);
+  const envVarName = process.env.AZDO_PAT ? "AZDO_PAT" : "dotenv";
+  const sourceLabel = cred.source === "env" ? `env:${envVarName}` : "credential-store";
+  return {
+    authType: cred.kind ?? "pat",
+    credentialSource: sourceLabel,
+    org,
+    project,
+    connectivityStatus: connectivity.status,
+    connectivityError: connectivity.error
+  };
+}
+function formatDiagnosticReport(report, json) {
+  if (json) {
+    return JSON.stringify(report, null, 2);
+  }
+  let connectivityLine;
+  if (report.connectivityStatus === "ok") {
+    connectivityLine = "OK";
+  } else if (report.connectivityStatus === "no-credentials") {
+    connectivityLine = "no credentials found";
+  } else {
+    connectivityLine = "FAILED";
+  }
+  const lines = [
+    `Auth type:    ${report.authType}`,
+    `Source:       ${report.credentialSource ?? "(none)"}`,
+    `Org:          ${report.org}`,
+    `Project:      ${report.project ?? "(not set)"}`,
+    `Connectivity: ${connectivityLine}`
+  ];
+  if (report.connectivityStatus === "failed" && report.connectivityError !== null) {
+    lines.push(`Error:        ${report.connectivityError}`);
+  }
+  return lines.join("\n");
+}
+
+// src/commands/auth.ts
 async function readStdinToString() {
   const chunks = [];
   for await (const chunk of process.stdin) {
@@ -1982,6 +2170,25 @@ Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
     const globals = logoutCmd.optsWithGlobals();
     await handleLogout(options, globals.org);
   });
+  const diagnoseCmd = command.command("diagnose").description("Show auth type, credential source, org, and live connectivity test result").option("--org <name>", "Azure DevOps organization (overrides context resolution)").option("--project <name>", "Azure DevOps project (optional context)").option("--json", "emit JSON instead of human-readable text", false);
+  diagnoseCmd.action(async (options) => {
+    const globals = diagnoseCmd.optsWithGlobals();
+    const orgName = options.org ?? globals.org;
+    const resolved = resolveOrg({ org: orgName });
+    if (!resolved) {
+      process.stderr.write(`${formatResolutionError()}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const report = await diagnoseAuth(resolved.org, options.project ?? null, resolveAuthCredential);
+    const output = formatDiagnosticReport(report, options.json ?? false);
+    process.stdout.write(`${output}
+`);
+    if (report.connectivityStatus === "failed") {
+      process.exitCode = 1;
+    }
+  });
   return command;
 }
 
@@ -3188,6 +3395,30 @@ async function getPullRequestThreads(context, repo, cred, prId) {
   const data = await readJsonResponse(response);
   return data.value.map(mapThread).filter((thread) => thread !== null);
 }
+function buildThreadCommentUrl(context, repo, prId, threadId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads/${threadId}/comments`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+async function postThreadComment(context, repo, cred, prId, threadId, content) {
+  const response = await fetchWithErrors(buildThreadCommentUrl(context, repo, prId, threadId).toString(), {
+    method: "POST",
+    headers: {
+      ...authHeaders(cred),
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ content, parentCommentId: 0, commentType: 1 })
+  });
+  const data = await readJsonResponse(response);
+  return {
+    id: data.id,
+    author: data.author?.displayName ?? null,
+    content: data.content ?? content,
+    publishedAt: data.publishedDate ?? null
+  };
+}
 
 // src/commands/pr.ts
 function parsePositivePrNumber(raw) {
@@ -3205,7 +3436,8 @@ function autoDetectZeroMatch(branch) {
   return `No open pull request matches branch ${branch}. Pass --pr-number to target a specific PR, or push the branch and open a pull request.`;
 }
 function autoDetectMultiMatch(branch, ids) {
-  return `Multiple open pull requests match branch ${branch}: ${ids.map((id) => `#${id}`).join(", ")}. Re-run with --pr-number to choose.`;
+  const idList = ids.map((id) => `#${id}`).join(", ");
+  return `Multiple open pull requests match branch ${branch}: ${idList}. Re-run with --pr-number to choose.`;
 }
 function writeContractError(line) {
   process.stderr.write(`${line}
@@ -3538,6 +3770,7 @@ function createPrCommentsCommand() {
       handlePrCommandError(err, context, "read");
     }
   });
+  command.addCommand(createPrCommentsReplyCommand());
   return command;
 }
 async function resolveThreadTarget(threadIdRaw, options) {
@@ -3656,6 +3889,64 @@ function createPrCommentReopenCommand() {
   });
   return command;
 }
+async function runCommentReply(threadIdRaw, text, options) {
+  let context;
+  try {
+    const trimmedText = text.trim();
+    if (!trimmedText) {
+      writeError("Reply text must not be empty.");
+      return;
+    }
+    const target = await resolveThreadTarget(threadIdRaw, options);
+    if (target === null) {
+      return;
+    }
+    context = target.context;
+    const threads = await getPullRequestThreads(target.context, target.repo, target.pat, target.pullRequest.id);
+    const thread = threads.find((t) => t.id === target.threadId);
+    if (!thread) {
+      writeError(`Thread #${target.threadId} not found on pull request #${target.pullRequest.id}.`);
+      return;
+    }
+    const posted = await postThreadComment(
+      target.context,
+      target.repo,
+      target.pat,
+      target.pullRequest.id,
+      target.threadId,
+      trimmedText
+    );
+    const result = {
+      pullRequestId: target.pullRequest.id,
+      threadId: target.threadId,
+      commentId: posted.id,
+      content: posted.content
+    };
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+      return;
+    }
+    process.stdout.write(`Reply posted to thread #${target.threadId} on pull request #${target.pullRequest.id}.
+`);
+  } catch (err) {
+    handlePrCommandError(err, context, "write");
+  }
+}
+function createPrCommentsReplyCommand() {
+  const command = new Command12("reply");
+  configureUnwrappedHelp(command).description("Post a reply to a pull request comment thread").argument("<threadId>", "numeric id of the thread to reply to").argument("<text>", "text of the reply").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, text, options) => {
+    await runCommentReply(threadIdRaw, text, options);
+  });
+  return command;
+}
+function createPrCommentReplyCommand() {
+  const command = new Command12("comment-reply");
+  configureUnwrappedHelp(command).description('Post a reply to a pull request comment thread (alias of "azdo pr comments reply")').argument("<threadId>", "numeric id of the thread to reply to").argument("<text>", "text of the reply").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, text, options) => {
+    await runCommentReply(threadIdRaw, text, options);
+  });
+  return command;
+}
 function createPrCommand() {
   const command = new Command12("pr");
   command.description("Manage Azure DevOps pull requests");
@@ -3664,6 +3955,7 @@ function createPrCommand() {
   command.addCommand(createPrCommentsCommand());
   command.addCommand(createPrCommentResolveCommand());
   command.addCommand(createPrCommentReopenCommand());
+  command.addCommand(createPrCommentReplyCommand());
   return command;
 }
 
@@ -5118,6 +5410,7 @@ process.stderr.on("error", exitOnEpipe);
 var program = new Command17();
 program.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
 program.option("--no-update-check", "Skip the check for a newer published version");
+program.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
 program.addCommand(createGetItemCommand());
 program.addCommand(createAuthCommand());
 program.addCommand(createClearPatCommand());
@@ -5135,16 +5428,19 @@ program.addCommand(createCommentsCommand());
 program.addCommand(createDownloadAttachmentCommand());
 program.addCommand(createRelationsCommand());
 program.showHelpAfterError();
+program.hook("preAction", () => {
+  const { trace } = program.opts();
+  if (trace) {
+    initTraceWriter(trace);
+  }
+});
 program.hook("postAction", async () => {
   const notice = await getUpdateNotice({ enabled: program.opts().updateCheck });
   if (notice) {
     process.stderr.write(notice + "\n");
   }
 });
-async function main() {
-  await program.parseAsync();
-  if (process.argv.length <= 2) {
-    program.help();
-  }
+await program.parseAsync();
+if (process.argv.length <= 2) {
+  program.help();
 }
-void main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {
@@ -14,8 +14,8 @@
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
     "format": "prettier --check src/",
-    "test": "npm run build && vitest run tests/unit tests/integration",
-    "test:unit": "npm run build && vitest run tests/unit",
+    "test": "npm run typecheck && npm run lint && npm run build && vitest run tests/unit tests/integration",
+    "test:unit": "npm run typecheck && npm run lint && npm run build && vitest run tests/unit",
     "test:integration": "npm run build && vitest run tests/integration",
     "test:integration:full": "bash scripts/setup-keyring.sh && npm run test:integration"
   },