azdo-cli 0.19.0-feature-040-auth-token.718 → 0.19.0-feature-040-auth-token.720

package/README.md

@@ -19,7 +19,7 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Feed long PR titles, descriptions and comment bodies from a file or a pipe instead of the shell (`--title-file`, `--description-file`, `--file`; `-` reads standard input)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
 - Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation

package/dist/{chunk-FHXLWD6S.js → chunk-K2CKMY72.js}

@@ -825,10 +825,18 @@ function entryFor(account) {
   return wrapUnavailable(() => new Entry(SERVICE, account));
 }
 var legacyUnsetNoticeEmitted = false;
+var noticesSuppressed = false;
+function suppressCredentialStoreNotices(suppressed) {
+  noticesSuppressed = suppressed;
+}
+function writeNotice(message) {
+  if (noticesSuppressed) return;
+  process.stderr.write(message);
+}
 function emitLegacyUnsetNoticeOnce() {
   if (legacyUnsetNoticeEmitted) return;
   legacyUnsetNoticeEmitted = true;
-  process.stderr.write(
+  writeNotice(
     'A legacy PAT exists in the OS vault from a previous azdo-cli version, but no "org" is set in config. Run `azdo auth --org <name>` to re-store it under the per-org key, then `azdo clear-pat` to remove the legacy slot.\n'
   );
 }
@@ -925,7 +933,7 @@ async function maybeMigrateLegacy(targetOrg) {
     backend: probeBackend(),
     masked_pat: maskedDisplay(legacy)
   });
-  process.stderr.write(`Migrated legacy PAT to org ${targetOrg}.
+  writeNotice(`Migrated legacy PAT to org ${targetOrg}.
 `);
   return legacy;
 }
@@ -990,7 +998,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-C6UTL2OJ.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-PXUQE5JE.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1212,6 +1220,7 @@ export {
   refreshIfNeeded,
   _resetInFlight,
   probeBackend,
+  suppressCredentialStoreNotices,
   getPat,
   getStoredCredential,
   storePat,

package/dist/index.js

@@ -33,10 +33,11 @@ import {
   setOrgScopedValue,
   storeOAuthCredential,
   storePat,
+  suppressCredentialStoreNotices,
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-FHXLWD6S.js";
+} from "./chunk-K2CKMY72.js";
 
 // src/index.ts
 import { Command as Command19 } from "commander";
@@ -1166,28 +1167,28 @@ function findDotEnvPat(startDir = process.cwd()) {
   return null;
 }
 async function resolveAuthCredential(org) {
-  const envPat = process.env.AZDO_PAT;
-  if (envPat && envPat.length > 0) {
-    return { pat: envPat, source: "env", kind: "pat" };
-  }
-  const stored = await getStoredCredential(org);
-  if (stored !== null) {
-    if (stored.kind === "pat") {
-      return { pat: stored.token, source: "credential-store", kind: "pat" };
+  let cred;
+  try {
+    cred = await exportCredential(org);
+  } catch (err) {
+    if (err instanceof CredentialMissingError) {
+      return null;
     }
-    const fresh = await refreshIfNeeded(org, stored);
+    throw err;
+  }
+  if (cred.kind === "oauth") {
     return {
-      pat: fresh.accessToken,
+      pat: cred.token,
       source: "credential-store",
       kind: "oauth",
-      accountId: fresh.accountId
+      accountId: cred.accountId
     };
   }
-  const dotEnvPat = findDotEnvPat();
-  if (dotEnvPat !== null) {
-    return { pat: dotEnvPat, source: "env", kind: "pat" };
-  }
-  return null;
+  return {
+    pat: cred.token,
+    source: cred.source === "credential-store" ? "credential-store" : "env",
+    kind: "pat"
+  };
 }
 var lastResolvedCredential = null;
 async function requireAuthCredential(org) {
@@ -2437,6 +2438,8 @@ async function handleToken(orgFromGlobal) {
     return;
   }
   const org = resolved.org;
+  const stderrIsTty = Boolean(process.stderr.isTTY);
+  suppressCredentialStoreNotices(!stderrIsTty);
   let cred;
   try {
     cred = await exportCredential(org);
@@ -2450,7 +2453,7 @@ async function handleToken(orgFromGlobal) {
     backend: probeBackend(),
     ...cred.kind === "oauth" ? { accountId: cred.accountId } : {}
   });
-  if (process.stderr.isTTY) {
+  if (stderrIsTty) {
     process.stderr.write(describeExportedCredential(cred, org));
   }
   process.stdout.write(`${cred.token}
@@ -2540,7 +2543,9 @@ Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
     const globals = logoutCmd.optsWithGlobals();
     await handleLogout(options, globals.org);
   });
-  const tokenCmd = command.command("token").description("Print the access token the CLI uses for an org to stdout (for scripted API calls)").option("--org <name>", "Azure DevOps organization (defaults: git remote -> config)");
+  const tokenCmd = command.command("token").description(
+    "Print the credential the CLI uses for an org \u2014 a PAT or an OAuth access token \u2014 to stdout (for scripted API calls)"
+  ).option("--org <name>", "Azure DevOps organization (defaults: git remote -> config)");
   tokenCmd.action(async () => {
     const globals = tokenCmd.optsWithGlobals();
     await handleToken(globals.org);
@@ -7209,6 +7214,11 @@ import os from "os";
 var THROTTLE_MS = 10 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 1500;
 var REGISTRY_URL = "https://registry.npmjs.org/azdo-cli/latest";
+var UPDATE_CHECK_EXEMPT_COMMANDS = /* @__PURE__ */ new Set(["auth token"]);
+function skipsUpdateCheck(commandPath) {
+  const withoutRoot = commandPath.slice(1);
+  return UPDATE_CHECK_EXEMPT_COMMANDS.has(withoutRoot.join(" "));
+}
 function getCachePath() {
   return path2.join(os.homedir(), ".azdo", "update-check.json");
 }
@@ -7344,7 +7354,17 @@ program.hook("preAction", () => {
     initTraceWriter(trace);
   }
 });
-program.hook("postAction", async () => {
+function commandPathOf(command) {
+  const names = [];
+  for (let node = command; node !== null; node = node.parent) {
+    names.unshift(node.name());
+  }
+  return names;
+}
+program.hook("postAction", async (_thisCommand, actionCommand) => {
+  if (skipsUpdateCheck(commandPathOf(actionCommand))) {
+    return;
+  }
   const notice = await getUpdateNotice({ enabled: program.opts().updateCheck });
   if (notice) {
     process.stderr.write(notice + "\n");

package/dist/{oauth-token-refresh-C6UTL2OJ.js → oauth-token-refresh-PXUQE5JE.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-FHXLWD6S.js";
+} from "./chunk-K2CKMY72.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.19.0-feature-040-auth-token.718",
+  "version": "0.19.0-feature-040-auth-token.720",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {