azdo-cli 0.19.0-develop.717 → 0.19.0-develop.724

package/README.md

@@ -19,7 +19,7 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Feed long PR titles, descriptions and comment bodies from a file or a pipe instead of the shell (`--title-file`, `--description-file`, `--file`; `-` reads standard input)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
 - Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation

package/dist/{chunk-TY5KENBQ.js → chunk-K2CKMY72.js}

@@ -825,10 +825,18 @@ function entryFor(account) {
   return wrapUnavailable(() => new Entry(SERVICE, account));
 }
 var legacyUnsetNoticeEmitted = false;
+var noticesSuppressed = false;
+function suppressCredentialStoreNotices(suppressed) {
+  noticesSuppressed = suppressed;
+}
+function writeNotice(message) {
+  if (noticesSuppressed) return;
+  process.stderr.write(message);
+}
 function emitLegacyUnsetNoticeOnce() {
   if (legacyUnsetNoticeEmitted) return;
   legacyUnsetNoticeEmitted = true;
-  process.stderr.write(
+  writeNotice(
     'A legacy PAT exists in the OS vault from a previous azdo-cli version, but no "org" is set in config. Run `azdo auth --org <name>` to re-store it under the per-org key, then `azdo clear-pat` to remove the legacy slot.\n'
   );
 }
@@ -925,7 +933,7 @@ async function maybeMigrateLegacy(targetOrg) {
     backend: probeBackend(),
     masked_pat: maskedDisplay(legacy)
   });
-  process.stderr.write(`Migrated legacy PAT to org ${targetOrg}.
+  writeNotice(`Migrated legacy PAT to org ${targetOrg}.
 `);
   return legacy;
 }
@@ -990,7 +998,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-DEDIDLNN.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-PXUQE5JE.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1180,6 +1188,7 @@ function _resetInFlight() {
 export {
   CredentialStoreUnavailableError,
   CredentialMissingError,
+  CredentialRefreshError,
   appendAuthAuditEvent,
   readAuditEvents,
   SETTINGS,
@@ -1211,6 +1220,7 @@ export {
   refreshIfNeeded,
   _resetInFlight,
   probeBackend,
+  suppressCredentialStoreNotices,
   getPat,
   getStoredCredential,
   storePat,

package/dist/index.js

@@ -2,6 +2,7 @@
 import {
   AZDO_RESOURCE_ID,
   CredentialMissingError,
+  CredentialRefreshError,
   CredentialStoreUnavailableError,
   SETTINGS,
   appendAuthAuditEvent,
@@ -32,12 +33,13 @@ import {
   setOrgScopedValue,
   storeOAuthCredential,
   storePat,
+  suppressCredentialStoreNotices,
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-TY5KENBQ.js";
+} from "./chunk-K2CKMY72.js";
 
-// src/index.ts
+// src/program.ts
 import { Command as Command19 } from "commander";
 
 // src/version.ts
@@ -1165,28 +1167,28 @@ function findDotEnvPat(startDir = process.cwd()) {
   return null;
 }
 async function resolveAuthCredential(org) {
-  const envPat = process.env.AZDO_PAT;
-  if (envPat && envPat.length > 0) {
-    return { pat: envPat, source: "env", kind: "pat" };
-  }
-  const stored = await getStoredCredential(org);
-  if (stored !== null) {
-    if (stored.kind === "pat") {
-      return { pat: stored.token, source: "credential-store", kind: "pat" };
+  let cred;
+  try {
+    cred = await exportCredential(org);
+  } catch (err) {
+    if (err instanceof CredentialMissingError) {
+      return null;
     }
-    const fresh = await refreshIfNeeded(org, stored);
+    throw err;
+  }
+  if (cred.kind === "oauth") {
     return {
-      pat: fresh.accessToken,
+      pat: cred.token,
       source: "credential-store",
       kind: "oauth",
-      accountId: fresh.accountId
+      accountId: cred.accountId
     };
   }
-  const dotEnvPat = findDotEnvPat();
-  if (dotEnvPat !== null) {
-    return { pat: dotEnvPat, source: "env", kind: "pat" };
-  }
-  return null;
+  return {
+    pat: cred.token,
+    source: cred.source === "credential-store" ? "credential-store" : "env",
+    kind: "pat"
+  };
 }
 var lastResolvedCredential = null;
 async function requireAuthCredential(org) {
@@ -1351,6 +1353,32 @@ async function status() {
   }
   return { orgs: out };
 }
+async function exportCredential(org) {
+  const envPat = process.env.AZDO_PAT;
+  if (envPat && envPat.length > 0) {
+    return { kind: "pat", token: envPat, source: "env" };
+  }
+  const stored = await getStoredCredential(org);
+  if (stored === null) {
+    const dotEnvPat = findDotEnvPat();
+    if (dotEnvPat !== null) {
+      return { kind: "pat", token: dotEnvPat, source: "dotenv" };
+    }
+    throw new CredentialMissingError(org);
+  }
+  if (stored.kind === "pat") {
+    return { kind: "pat", token: stored.token, source: "credential-store" };
+  }
+  const fresh = await refreshIfNeeded(org, stored);
+  return {
+    kind: "oauth",
+    token: fresh.accessToken,
+    source: "credential-store",
+    accountId: fresh.accountId,
+    expiresAt: fresh.expiresAt,
+    scope: fresh.scope
+  };
+}
 
 // src/services/git-remote.ts
 import { execFileSync } from "child_process";
@@ -2364,6 +2392,73 @@ async function handleLogout(options, orgFromGlobal) {
     throw err;
   }
 }
+function describeCredentialSource(cred) {
+  switch (cred.source) {
+    case "env":
+      return "the AZDO_PAT environment variable";
+    case "dotenv":
+      return "the AZDO_PAT entry in a .env file";
+    default:
+      return `the OS credential store (${probeBackend()})`;
+  }
+}
+function describeExportedCredential(cred, org) {
+  const source = describeCredentialSource(cred);
+  if (cred.kind === "oauth") {
+    const expires = new Date(cred.expiresAt * 1e3).toISOString();
+    return `OAuth access token for org ${org} from ${source}; account ${cred.accountId}, expires ${expires}.
+Send it as: Authorization: Bearer <token>
+`;
+  }
+  return `PAT for org ${org} from ${source}.
+Send it as: Authorization: Basic base64(":<token>")  (curl: -u :<token>)
+`;
+}
+function reportTokenFailure(err) {
+  if (err instanceof CredentialStoreUnavailableError) {
+    process.stderr.write(`${err.message}
+`);
+    process.exitCode = 4;
+    return;
+  }
+  if (err instanceof CredentialMissingError || err instanceof CredentialRefreshError) {
+    process.stderr.write(`${err.message}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  throw err;
+}
+async function handleToken(orgFromGlobal) {
+  const resolved = resolveOrg({ org: orgFromGlobal });
+  if (!resolved) {
+    process.stderr.write(`${formatResolutionError()}
+`);
+    process.exitCode = 3;
+    return;
+  }
+  const org = resolved.org;
+  const stderrIsTty = Boolean(process.stderr.isTTY);
+  suppressCredentialStoreNotices(!stderrIsTty);
+  let cred;
+  try {
+    cred = await exportCredential(org);
+  } catch (err) {
+    reportTokenFailure(err);
+    return;
+  }
+  appendAuthAuditEvent({
+    event: "auth.token",
+    org,
+    backend: probeBackend(),
+    ...cred.kind === "oauth" ? { accountId: cred.accountId } : {}
+  });
+  if (stderrIsTty) {
+    process.stderr.write(describeExportedCredential(cred, org));
+  }
+  process.stdout.write(`${cred.token}
+`);
+}
 function createAuthCommand() {
   const command = new Command3("auth");
   command.description(
@@ -2448,6 +2543,38 @@ Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
     const globals = logoutCmd.optsWithGlobals();
     await handleLogout(options, globals.org);
   });
+  const tokenCmd = command.command("token").description(
+    "Print the credential the CLI uses for an org \u2014 a PAT or an OAuth access token \u2014 to stdout (for scripted API calls)"
+  ).option("--org <name>", "Azure DevOps organization (defaults: git remote -> config)");
+  tokenCmd.action(async () => {
+    const globals = tokenCmd.optsWithGlobals();
+    await handleToken(globals.org);
+  });
+  tokenCmd.addHelpText(
+    "after",
+    `
+stdout carries the token and nothing else, so it is safe to capture:
+
+  TOKEN=$(azdo auth token --org myorg)
+
+The token is whichever credential the CLI would use itself (AZDO_PAT, then the
+stored credential for the org, then a .env AZDO_PAT); an expired OAuth access
+token is refreshed first. Treat it as a password \u2014 it carries your full access.
+
+Azure DevOps needs a different header for each kind:
+
+  PAT               curl -u :"$TOKEN" https://dev.azure.com/myorg/_apis/projects
+  OAuth access tok  curl -H "Authorization: Bearer $TOKEN" https://dev.azure.com/myorg/_apis/projects
+
+When stderr is a terminal the command names the kind, source and expiry there;
+redirected or piped, stderr stays silent. There is deliberately no --json: use
+\`azdo auth status --json\` for machine-readable credential metadata, which never
+includes token material.
+
+Exit codes: 1 no stored credential (or a rejected OAuth refresh), 3 org could
+not be resolved, 4 OS credential store unavailable. stdout stays empty on all.
+`
+  );
   const diagnoseCmd = command.command("diagnose").description("Show auth type, credential source, org, and live connectivity test result").option("--org <name>", "Azure DevOps organization (overrides context resolution)").option("--project <name>", "Azure DevOps project (optional context)").option("--json", "emit JSON instead of human-readable text", false);
   diagnoseCmd.action(async (options) => {
     const globals = diagnoseCmd.optsWithGlobals();
@@ -7087,6 +7214,18 @@ import os from "os";
 var THROTTLE_MS = 10 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 1500;
 var REGISTRY_URL = "https://registry.npmjs.org/azdo-cli/latest";
+var UPDATE_CHECK_EXEMPT_COMMANDS = /* @__PURE__ */ new Set(["auth token"]);
+function commandPathOf(command) {
+  const names = [];
+  for (let node = command; node !== null; node = node.parent) {
+    names.unshift(node.name());
+  }
+  return names;
+}
+function skipsUpdateCheck(commandPath) {
+  const withoutRoot = commandPath.slice(1);
+  return UPDATE_CHECK_EXEMPT_COMMANDS.has(withoutRoot.join(" "));
+}
 function getCachePath() {
   return path2.join(os.homedir(), ".azdo", "update-check.json");
 }
@@ -7184,6 +7323,49 @@ async function getUpdateNotice(opts) {
   }
 }
 
+// src/program.ts
+function createProgram() {
+  const program2 = new Command19();
+  program2.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
+  program2.option("--no-update-check", "Skip the check for a newer published version");
+  program2.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
+  program2.addCommand(createGetItemCommand());
+  program2.addCommand(createAuthCommand());
+  program2.addCommand(createClearPatCommand());
+  program2.addCommand(createConfigCommand());
+  program2.addCommand(createSetStateCommand());
+  program2.addCommand(createAssignCommand());
+  program2.addCommand(createSetFieldCommand());
+  program2.addCommand(createGetMdFieldCommand());
+  program2.addCommand(createSetMdFieldCommand());
+  program2.addCommand(createUpsertCommand());
+  program2.addCommand(createListFieldsCommand());
+  program2.addCommand(createPrCommand());
+  program2.addCommand(createPipelineCommand());
+  program2.addCommand(createCommentsCommand());
+  program2.addCommand(createDownloadAttachmentCommand());
+  program2.addCommand(createAddAttachmentCommand());
+  program2.addCommand(createDeleteAttachmentCommand());
+  program2.addCommand(createRelationsCommand());
+  program2.showHelpAfterError();
+  program2.hook("preAction", () => {
+    const { trace } = program2.opts();
+    if (trace) {
+      initTraceWriter(trace);
+    }
+  });
+  program2.hook("postAction", async (_thisCommand, actionCommand) => {
+    if (skipsUpdateCheck(commandPathOf(actionCommand))) {
+      return;
+    }
+    const notice = await getUpdateNotice({ enabled: program2.opts().updateCheck });
+    if (notice) {
+      process.stderr.write(notice + "\n");
+    }
+  });
+  return program2;
+}
+
 // src/index.ts
 function exitOnEpipe(err) {
   if (err.code === "EPIPE") {
@@ -7193,41 +7375,7 @@ function exitOnEpipe(err) {
 }
 process.stdout.on("error", exitOnEpipe);
 process.stderr.on("error", exitOnEpipe);
-var program = new Command19();
-program.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
-program.option("--no-update-check", "Skip the check for a newer published version");
-program.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
-program.addCommand(createGetItemCommand());
-program.addCommand(createAuthCommand());
-program.addCommand(createClearPatCommand());
-program.addCommand(createConfigCommand());
-program.addCommand(createSetStateCommand());
-program.addCommand(createAssignCommand());
-program.addCommand(createSetFieldCommand());
-program.addCommand(createGetMdFieldCommand());
-program.addCommand(createSetMdFieldCommand());
-program.addCommand(createUpsertCommand());
-program.addCommand(createListFieldsCommand());
-program.addCommand(createPrCommand());
-program.addCommand(createPipelineCommand());
-program.addCommand(createCommentsCommand());
-program.addCommand(createDownloadAttachmentCommand());
-program.addCommand(createAddAttachmentCommand());
-program.addCommand(createDeleteAttachmentCommand());
-program.addCommand(createRelationsCommand());
-program.showHelpAfterError();
-program.hook("preAction", () => {
-  const { trace } = program.opts();
-  if (trace) {
-    initTraceWriter(trace);
-  }
-});
-program.hook("postAction", async () => {
-  const notice = await getUpdateNotice({ enabled: program.opts().updateCheck });
-  if (notice) {
-    process.stderr.write(notice + "\n");
-  }
-});
+var program = createProgram();
 await program.parseAsync();
 if (process.argv.length <= 2) {
   program.help();

package/dist/{oauth-token-refresh-DEDIDLNN.js → oauth-token-refresh-PXUQE5JE.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-TY5KENBQ.js";
+} from "./chunk-K2CKMY72.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.19.0-develop.717",
+  "version": "0.19.0-develop.724",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {