azdo-cli 0.19.0-feature-040-auth-token.718 → 0.19.0-feature-040-auth-token.722

package/README.md

@@ -19,7 +19,7 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Feed long PR titles, descriptions and comment bodies from a file or a pipe instead of the shell (`--title-file`, `--description-file`, `--file`; `-` reads standard input)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
 - Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation

package/dist/{chunk-FHXLWD6S.js → chunk-K2CKMY72.js}

@@ -825,10 +825,18 @@ function entryFor(account) {
   return wrapUnavailable(() => new Entry(SERVICE, account));
 }
 var legacyUnsetNoticeEmitted = false;
+var noticesSuppressed = false;
+function suppressCredentialStoreNotices(suppressed) {
+  noticesSuppressed = suppressed;
+}
+function writeNotice(message) {
+  if (noticesSuppressed) return;
+  process.stderr.write(message);
+}
 function emitLegacyUnsetNoticeOnce() {
   if (legacyUnsetNoticeEmitted) return;
   legacyUnsetNoticeEmitted = true;
-  process.stderr.write(
+  writeNotice(
     'A legacy PAT exists in the OS vault from a previous azdo-cli version, but no "org" is set in config. Run `azdo auth --org <name>` to re-store it under the per-org key, then `azdo clear-pat` to remove the legacy slot.\n'
   );
 }
@@ -925,7 +933,7 @@ async function maybeMigrateLegacy(targetOrg) {
     backend: probeBackend(),
     masked_pat: maskedDisplay(legacy)
   });
-  process.stderr.write(`Migrated legacy PAT to org ${targetOrg}.
+  writeNotice(`Migrated legacy PAT to org ${targetOrg}.
 `);
   return legacy;
 }
@@ -990,7 +998,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-C6UTL2OJ.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-PXUQE5JE.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1212,6 +1220,7 @@ export {
   refreshIfNeeded,
   _resetInFlight,
   probeBackend,
+  suppressCredentialStoreNotices,
   getPat,
   getStoredCredential,
   storePat,

package/dist/index.js

@@ -33,12 +33,13 @@ import {
   setOrgScopedValue,
   storeOAuthCredential,
   storePat,
+  suppressCredentialStoreNotices,
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-FHXLWD6S.js";
+} from "./chunk-K2CKMY72.js";
 
-// src/index.ts
+// src/program.ts
 import { Command as Command19 } from "commander";
 
 // src/version.ts
@@ -1166,28 +1167,28 @@ function findDotEnvPat(startDir = process.cwd()) {
   return null;
 }
 async function resolveAuthCredential(org) {
-  const envPat = process.env.AZDO_PAT;
-  if (envPat && envPat.length > 0) {
-    return { pat: envPat, source: "env", kind: "pat" };
-  }
-  const stored = await getStoredCredential(org);
-  if (stored !== null) {
-    if (stored.kind === "pat") {
-      return { pat: stored.token, source: "credential-store", kind: "pat" };
+  let cred;
+  try {
+    cred = await exportCredential(org);
+  } catch (err) {
+    if (err instanceof CredentialMissingError) {
+      return null;
     }
-    const fresh = await refreshIfNeeded(org, stored);
+    throw err;
+  }
+  if (cred.kind === "oauth") {
     return {
-      pat: fresh.accessToken,
+      pat: cred.token,
       source: "credential-store",
       kind: "oauth",
-      accountId: fresh.accountId
+      accountId: cred.accountId
     };
   }
-  const dotEnvPat = findDotEnvPat();
-  if (dotEnvPat !== null) {
-    return { pat: dotEnvPat, source: "env", kind: "pat" };
-  }
-  return null;
+  return {
+    pat: cred.token,
+    source: cred.source === "credential-store" ? "credential-store" : "env",
+    kind: "pat"
+  };
 }
 var lastResolvedCredential = null;
 async function requireAuthCredential(org) {
@@ -2437,6 +2438,8 @@ async function handleToken(orgFromGlobal) {
     return;
   }
   const org = resolved.org;
+  const stderrIsTty = Boolean(process.stderr.isTTY);
+  suppressCredentialStoreNotices(!stderrIsTty);
   let cred;
   try {
     cred = await exportCredential(org);
@@ -2450,7 +2453,7 @@ async function handleToken(orgFromGlobal) {
     backend: probeBackend(),
     ...cred.kind === "oauth" ? { accountId: cred.accountId } : {}
   });
-  if (process.stderr.isTTY) {
+  if (stderrIsTty) {
     process.stderr.write(describeExportedCredential(cred, org));
   }
   process.stdout.write(`${cred.token}
@@ -2540,7 +2543,9 @@ Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
     const globals = logoutCmd.optsWithGlobals();
     await handleLogout(options, globals.org);
   });
-  const tokenCmd = command.command("token").description("Print the access token the CLI uses for an org to stdout (for scripted API calls)").option("--org <name>", "Azure DevOps organization (defaults: git remote -> config)");
+  const tokenCmd = command.command("token").description(
+    "Print the credential the CLI uses for an org \u2014 a PAT or an OAuth access token \u2014 to stdout (for scripted API calls)"
+  ).option("--org <name>", "Azure DevOps organization (defaults: git remote -> config)");
   tokenCmd.action(async () => {
     const globals = tokenCmd.optsWithGlobals();
     await handleToken(globals.org);
@@ -7209,6 +7214,18 @@ import os from "os";
 var THROTTLE_MS = 10 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 1500;
 var REGISTRY_URL = "https://registry.npmjs.org/azdo-cli/latest";
+var UPDATE_CHECK_EXEMPT_COMMANDS = /* @__PURE__ */ new Set(["auth token"]);
+function commandPathOf(command) {
+  const names = [];
+  for (let node = command; node !== null; node = node.parent) {
+    names.unshift(node.name());
+  }
+  return names;
+}
+function skipsUpdateCheck(commandPath) {
+  const withoutRoot = commandPath.slice(1);
+  return UPDATE_CHECK_EXEMPT_COMMANDS.has(withoutRoot.join(" "));
+}
 function getCachePath() {
   return path2.join(os.homedir(), ".azdo", "update-check.json");
 }
@@ -7306,6 +7323,49 @@ async function getUpdateNotice(opts) {
   }
 }
 
+// src/program.ts
+function createProgram() {
+  const program2 = new Command19();
+  program2.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
+  program2.option("--no-update-check", "Skip the check for a newer published version");
+  program2.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
+  program2.addCommand(createGetItemCommand());
+  program2.addCommand(createAuthCommand());
+  program2.addCommand(createClearPatCommand());
+  program2.addCommand(createConfigCommand());
+  program2.addCommand(createSetStateCommand());
+  program2.addCommand(createAssignCommand());
+  program2.addCommand(createSetFieldCommand());
+  program2.addCommand(createGetMdFieldCommand());
+  program2.addCommand(createSetMdFieldCommand());
+  program2.addCommand(createUpsertCommand());
+  program2.addCommand(createListFieldsCommand());
+  program2.addCommand(createPrCommand());
+  program2.addCommand(createPipelineCommand());
+  program2.addCommand(createCommentsCommand());
+  program2.addCommand(createDownloadAttachmentCommand());
+  program2.addCommand(createAddAttachmentCommand());
+  program2.addCommand(createDeleteAttachmentCommand());
+  program2.addCommand(createRelationsCommand());
+  program2.showHelpAfterError();
+  program2.hook("preAction", () => {
+    const { trace } = program2.opts();
+    if (trace) {
+      initTraceWriter(trace);
+    }
+  });
+  program2.hook("postAction", async (_thisCommand, actionCommand) => {
+    if (skipsUpdateCheck(commandPathOf(actionCommand))) {
+      return;
+    }
+    const notice = await getUpdateNotice({ enabled: program2.opts().updateCheck });
+    if (notice) {
+      process.stderr.write(notice + "\n");
+    }
+  });
+  return program2;
+}
+
 // src/index.ts
 function exitOnEpipe(err) {
   if (err.code === "EPIPE") {
@@ -7315,41 +7375,7 @@ function exitOnEpipe(err) {
 }
 process.stdout.on("error", exitOnEpipe);
 process.stderr.on("error", exitOnEpipe);
-var program = new Command19();
-program.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
-program.option("--no-update-check", "Skip the check for a newer published version");
-program.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
-program.addCommand(createGetItemCommand());
-program.addCommand(createAuthCommand());
-program.addCommand(createClearPatCommand());
-program.addCommand(createConfigCommand());
-program.addCommand(createSetStateCommand());
-program.addCommand(createAssignCommand());
-program.addCommand(createSetFieldCommand());
-program.addCommand(createGetMdFieldCommand());
-program.addCommand(createSetMdFieldCommand());
-program.addCommand(createUpsertCommand());
-program.addCommand(createListFieldsCommand());
-program.addCommand(createPrCommand());
-program.addCommand(createPipelineCommand());
-program.addCommand(createCommentsCommand());
-program.addCommand(createDownloadAttachmentCommand());
-program.addCommand(createAddAttachmentCommand());
-program.addCommand(createDeleteAttachmentCommand());
-program.addCommand(createRelationsCommand());
-program.showHelpAfterError();
-program.hook("preAction", () => {
-  const { trace } = program.opts();
-  if (trace) {
-    initTraceWriter(trace);
-  }
-});
-program.hook("postAction", async () => {
-  const notice = await getUpdateNotice({ enabled: program.opts().updateCheck });
-  if (notice) {
-    process.stderr.write(notice + "\n");
-  }
-});
+var program = createProgram();
 await program.parseAsync();
 if (process.argv.length <= 2) {
   program.help();

package/dist/{oauth-token-refresh-C6UTL2OJ.js → oauth-token-refresh-PXUQE5JE.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-FHXLWD6S.js";
+} from "./chunk-K2CKMY72.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.19.0-feature-040-auth-token.718",
+  "version": "0.19.0-feature-040-auth-token.722",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {