azdo-cli 0.20.0-develop.741 → 0.20.0-develop.751

package/README.md

@@ -19,7 +19,7 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Feed long PR titles, descriptions and comment bodies from a file or a pipe instead of the shell (`--title-file`, `--description-file`, `--file`; `-` reads standard input)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store — or, on Windows over SSH where Credential Manager is unreachable, in DPAPI-encrypted files under `~/.azdo` (`azdo config set credentialStore dpapi`, which offers to copy existing Credential Manager credentials; `--copy-credentials` / `--no-copy-credentials` skip the prompt). Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
 - Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation
@@ -38,6 +38,10 @@ azdo auth login --org myorg
 azdo config set org myorg
 azdo config set project myproject
 
+# Windows over SSH: keep credentials in DPAPI files instead of Credential Manager
+# (run once from a console to copy the existing credentials across)
+azdo config set credentialStore dpapi --copy-credentials
+
 # Read a work item
 azdo get-item 12345
 

package/dist/{chunk-K2CKMY72.js → chunk-W4EVKARR.js}

@@ -34,6 +34,21 @@ var CODE_CHALLENGE_METHOD = "S256";
 import fs from "fs";
 import path from "path";
 import os from "os";
+
+// src/services/credential-store-kind.ts
+var CREDENTIAL_STORES = ["keyring", "dpapi"];
+function parseCredentialStore(value, platform = process.platform) {
+  const normalised = value.trim().toLowerCase();
+  if (!CREDENTIAL_STORES.includes(normalised)) {
+    throw new Error(`Invalid value "${value}" for credentialStore. Must be one of: ${CREDENTIAL_STORES.join(", ")}.`);
+  }
+  if (normalised === "dpapi" && platform !== "win32") {
+    throw new Error('credentialStore "dpapi" is only available on Windows.');
+  }
+  return normalised;
+}
+
+// src/services/config-store.ts
 var SETTINGS = [
   {
     key: "org",
@@ -62,6 +77,13 @@ var SETTINGS = [
     type: "boolean",
     example: "true",
     required: false
+  },
+  {
+    key: "credentialStore",
+    description: 'Where credentials are stored: "keyring" (OS vault, default) or "dpapi" (Windows only, ~/.azdo/credentials)',
+    type: "string",
+    example: "dpapi",
+    required: false
   }
 ];
 var VALID_KEYS = SETTINGS.map((s) => s.key);
@@ -128,6 +150,8 @@ function setConfigValue(key, value) {
       throw new Error(`Invalid value "${value}" for markdown. Must be "true" or "false".`);
     }
     config.markdown = value === "true";
+  } else if (key === "credentialStore") {
+    config.credentialStore = parseCredentialStore(value);
   } else if (key === "fields") {
     config.fields = value.split(",").map((s) => s.trim());
   } else {
@@ -209,7 +233,7 @@ function getOrgScopedValue(org, key) {
 }
 function readScope(config, name) {
   if (name === "default") {
-    const { org: _o, organizations: _orgs, ...defaults } = config;
+    const { org: _o, organizations: _orgs, credentialStore: _cs, ...defaults } = config;
     return defaults;
   }
   return config.organizations?.[name.toLowerCase()] ?? {};
@@ -476,11 +500,11 @@ function handleCallback(req, res, active) {
     return;
   }
   const url = new URL(req.url, "http://127.0.0.1");
-  const path3 = url.pathname;
+  const path4 = url.pathname;
   const q = url.searchParams;
-  if (path3 !== "/callback" && path3 !== "/") {
-    writeError(res, 404, `unexpected path ${path3}`);
-    if (active) active.reject(new OAuthFlowError("redirect-mismatch", `unexpected callback path "${path3}"`));
+  if (path4 !== "/callback" && path4 !== "/") {
+    writeError(res, 404, `unexpected path ${path4}`);
+    if (active) active.reject(new OAuthFlowError("redirect-mismatch", `unexpected callback path "${path4}"`));
     return;
   }
   if (!active) {
@@ -746,10 +770,16 @@ function readAuditEvents() {
 import { Entry } from "@napi-rs/keyring";
 
 // src/types/credential.ts
+function defaultUnavailableMessage(backend) {
+  const base = `OS secret backend unavailable (${backend}). Install the platform's credential service and try again.`;
+  if (backend !== "windows-credential-manager") return base;
+  return `${base}
+Over SSH, Windows Credential Manager is not reachable. Store credentials with DPAPI in ~/.azdo instead: \`azdo config set credentialStore dpapi\` (or AZDO_CREDENTIAL_STORE=dpapi), then \`azdo auth login\` again.`;
+}
 var CredentialStoreUnavailableError = class extends Error {
   backend;
-  constructor(backend, cause) {
-    super(`OS secret backend unavailable (${backend}). Install the platform's credential service and try again.`);
+  constructor(backend, cause, message) {
+    super(message ?? defaultUnavailableMessage(backend));
     this.name = "CredentialStoreUnavailableError";
     this.backend = backend;
     if (cause instanceof Error) {
@@ -796,13 +826,157 @@ function normalizePat(rawPat) {
   return trimmedPat.length > 0 ? trimmedPat : null;
 }
 
+// src/services/dpapi-store.ts
+import fs3 from "fs";
+import os3 from "os";
+import path3 from "path";
+
+// src/services/dpapi-binding.ts
+import { createRequire } from "module";
+var cached = null;
+function loadDpapi() {
+  if (cached) return cached;
+  const require2 = createRequire(import.meta.url);
+  const mod = require2("@primno/dpapi");
+  if (!mod.isPlatformSupported) {
+    throw new Error("the @primno/dpapi native binary is not available for this platform");
+  }
+  cached = mod.Dpapi;
+  return cached;
+}
+
+// src/services/dpapi-store.ts
+var BACKEND = "windows-dpapi";
+var FILENAME_UNSAFE = /[^A-Za-z0-9_.-]/g;
+function dpapiCredentialsDir() {
+  return path3.join(os3.homedir(), ".azdo", "credentials");
+}
+function dpapiFilePath(account) {
+  const safe = account.replaceAll(FILENAME_UNSAFE, (ch) => `_${ch.codePointAt(0).toString(16)}`);
+  return path3.join(dpapiCredentialsDir(), `${safe}.dpapi`);
+}
+function entropyFor(account) {
+  return Buffer.from(`azdo-cli:${account}`, "utf8");
+}
+function unavailable(cause, message) {
+  return new CredentialStoreUnavailableError(BACKEND, cause, message);
+}
+function binding() {
+  try {
+    return loadDpapi();
+  } catch (err) {
+    throw unavailable(
+      err,
+      `DPAPI credential store unavailable: ${err.message}. Reinstall azdo-cli, or switch back with \`azdo config set credentialStore keyring\`.`
+    );
+  }
+}
+function isNotFound(err) {
+  return err.code === "ENOENT";
+}
+var DpapiEntry = class {
+  constructor(account) {
+    this.account = account;
+    this.file = dpapiFilePath(account);
+  }
+  account;
+  file;
+  getPassword() {
+    let blob;
+    try {
+      blob = fs3.readFileSync(this.file);
+    } catch (err) {
+      if (isNotFound(err)) return null;
+      throw unavailable(err, `Could not read the DPAPI credential file ${this.file}: ${err.message}`);
+    }
+    try {
+      const plain = binding().unprotectData(blob, entropyFor(this.account), "CurrentUser");
+      return Buffer.from(plain).toString("utf8");
+    } catch (err) {
+      if (err instanceof CredentialStoreUnavailableError) throw err;
+      throw unavailable(
+        err,
+        `Could not decrypt the DPAPI credential file ${this.file}: ${err.message}. It was written by another Windows user, on another machine, or from a logon session without access to your DPAPI master key. Run \`azdo auth login\` again from this session to replace it.`
+      );
+    }
+  }
+  setPassword(value) {
+    const dpapi = binding();
+    const entropy = entropyFor(this.account);
+    let blob;
+    try {
+      blob = dpapi.protectData(Buffer.from(value, "utf8"), entropy, "CurrentUser");
+      const check = Buffer.from(dpapi.unprotectData(blob, entropy, "CurrentUser")).toString("utf8");
+      if (check !== value) throw new Error("decrypted value does not match");
+    } catch (err) {
+      throw unavailable(
+        err,
+        `DPAPI could not protect the credential in this session: ${err.message}. Nothing was stored. Over SSH this usually means the logon has no access to your DPAPI master key (common with public-key authentication); log in with a password, or use AZDO_PAT for this session.`
+      );
+    }
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    try {
+      fs3.mkdirSync(dpapiCredentialsDir(), { recursive: true, mode: 448 });
+      fs3.writeFileSync(tmp, blob, { mode: 384 });
+      fs3.renameSync(tmp, this.file);
+    } catch (err) {
+      fs3.rmSync(tmp, { force: true });
+      throw unavailable(err, `Could not write the DPAPI credential file ${this.file}: ${err.message}`);
+    }
+  }
+  deletePassword() {
+    try {
+      fs3.unlinkSync(this.file);
+      return true;
+    } catch (err) {
+      if (isNotFound(err)) return false;
+      throw unavailable(err, `Could not delete the DPAPI credential file ${this.file}: ${err.message}`);
+    }
+  }
+};
+
 // src/services/credential-store.ts
 var SERVICE = "azdo-cli";
 var LEGACY_ACCOUNT = "pat";
 function accountFor(org) {
   return `pat:${org}`;
 }
+function requestedStore() {
+  const fromEnv = process.env.AZDO_CREDENTIAL_STORE?.trim();
+  if (fromEnv) return fromEnv.toLowerCase();
+  let fromConfig;
+  try {
+    fromConfig = loadConfig()?.credentialStore;
+  } catch (err) {
+    throw new CredentialStoreUnavailableError(
+      "unknown",
+      err,
+      `Could not read the azdo config file to determine the credential store: ${err.message}. Fix the file, or set AZDO_CREDENTIAL_STORE=<keyring|dpapi> for this session.`
+    );
+  }
+  return fromConfig?.trim().toLowerCase() || "keyring";
+}
+function activeCredentialStore() {
+  const requested = requestedStore();
+  try {
+    return parseCredentialStore(requested);
+  } catch (err) {
+    const backend = requested === "dpapi" ? "windows-dpapi" : "unknown";
+    throw new CredentialStoreUnavailableError(
+      backend,
+      err,
+      `${err.message} Set it with \`azdo config set credentialStore <keyring|dpapi>\` or AZDO_CREDENTIAL_STORE.`
+    );
+  }
+}
 function probeBackend() {
+  let requested;
+  try {
+    requested = requestedStore();
+  } catch {
+    return "unknown";
+  }
+  if (requested === "dpapi") return "windows-dpapi";
   switch (process.platform) {
     case "win32":
       return "windows-credential-manager";
@@ -814,14 +988,19 @@ function probeBackend() {
       return "unknown";
   }
 }
-function wrapUnavailable(fn) {
+function wrapUnavailableAs(backend, fn) {
   try {
     return fn();
   } catch (err) {
-    throw new CredentialStoreUnavailableError(probeBackend(), err);
+    if (err instanceof CredentialStoreUnavailableError) throw err;
+    throw new CredentialStoreUnavailableError(backend, err);
   }
 }
+function wrapUnavailable(fn) {
+  return wrapUnavailableAs(probeBackend(), fn);
+}
 function entryFor(account) {
+  if (activeCredentialStore() === "dpapi") return new DpapiEntry(account);
   return wrapUnavailable(() => new Entry(SERVICE, account));
 }
 var legacyUnsetNoticeEmitted = false;
@@ -897,6 +1076,7 @@ function serializeCredential(cred) {
   return JSON.stringify(cred);
 }
 async function maybeMigrateLegacy(targetOrg) {
+  if (activeCredentialStore() === "dpapi") return null;
   const config = loadConfig();
   if (!config.org || config.org !== targetOrg) {
     if (!config.org) {
@@ -998,7 +1178,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-PXUQE5JE.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-RUT4XIMM.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1024,6 +1204,62 @@ async function listOrgsWithStoredPat() {
   present.sort((a, b) => a.localeCompare(b));
   return present;
 }
+function keyringEntry(account) {
+  return new Entry(SERVICE, account);
+}
+function knownOrgs() {
+  const orgs = /* @__PURE__ */ new Set();
+  for (const ev of readAuditEvents()) {
+    if (ev.event === "auth.store" || ev.event === "oauth-login-success") orgs.add(ev.org);
+  }
+  try {
+    const config = loadConfig();
+    if (config.org) orgs.add(config.org);
+    for (const name of Object.keys(config.organizations ?? {})) orgs.add(name);
+  } catch {
+  }
+  return [...orgs].sort((a, b) => a.localeCompare(b));
+}
+function listKeyringCredentials() {
+  const present = [];
+  for (const org of knownOrgs()) {
+    const value = wrapUnavailableAs(
+      "windows-credential-manager",
+      () => keyringEntry(accountFor(org)).getPassword()
+    );
+    if (value !== null) present.push(org);
+  }
+  return present;
+}
+function copyKeyringCredentialsToDpapi(orgs) {
+  const result = { copied: [], skipped: [], failed: [] };
+  for (const org of orgs) {
+    try {
+      const raw = wrapUnavailableAs(
+        "windows-credential-manager",
+        () => keyringEntry(accountFor(org)).getPassword()
+      );
+      if (raw === null) continue;
+      const target = new DpapiEntry(accountFor(org));
+      if (target.getPassword() !== null) {
+        result.skipped.push(org);
+        continue;
+      }
+      const cred = parseStoredValue(raw);
+      target.setPassword(raw);
+      appendAuthAuditEvent({
+        event: "auth.store",
+        org,
+        backend: "windows-dpapi",
+        ...cred.kind === "pat" ? { masked_pat: maskedDisplay(cred.token) } : { accountId: cred.accountId }
+      });
+      result.copied.push(org);
+    } catch (err) {
+      result.failed.push({ org, message: err.message });
+    }
+  }
+  return result;
+}
 
 // src/services/oauth-token-refresh.ts
 var DEFAULT_LOCK_WAIT_MS = 5e3;
@@ -1031,23 +1267,23 @@ var inFlight = /* @__PURE__ */ new Map();
 function locksDir() {
   return join(homedir(), ".azdo", ".locks");
 }
-var FILENAME_UNSAFE = /[^A-Za-z0-9_.-]/g;
+var FILENAME_UNSAFE2 = /[^A-Za-z0-9_.-]/g;
 function lockPath(org) {
-  const safe = org.replaceAll(FILENAME_UNSAFE, "_");
+  const safe = org.replaceAll(FILENAME_UNSAFE2, "_");
   return join(locksDir(), `${safe}.refresh`);
 }
 async function defaultAcquireLock(org, waitMs = DEFAULT_LOCK_WAIT_MS) {
-  const path3 = lockPath(org);
+  const path4 = lockPath(org);
   mkdirSync(locksDir(), { recursive: true, mode: 448 });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      const fd = openSync(path3, "wx");
+      const fd = openSync(path4, "wx");
       closeSync(fd);
       return {
         release: () => {
           try {
-            unlinkSync(path3);
+            unlinkSync(path4);
           } catch {
           }
         }
@@ -1226,5 +1462,7 @@ export {
   storePat,
   storeOAuthCredential,
   deletePat,
-  listOrgsWithStoredPat
+  listOrgsWithStoredPat,
+  listKeyringCredentials,
+  copyKeyringCredentialsToDpapi
 };

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   SETTINGS,
   appendAuthAuditEvent,
   buildScopeString,
+  copyKeyringCredentialsToDpapi,
   copyOrgScope,
   defaultScopes,
   deleteOrgScope,
@@ -16,6 +17,7 @@ import {
   getOrgScopedValue,
   getPat,
   getStoredCredential,
+  listKeyringCredentials,
   listOrgsWithStoredPat,
   loadConfig,
   maskedDisplay,
@@ -37,7 +39,7 @@ import {
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-K2CKMY72.js";
+} from "./chunk-W4EVKARR.js";
 
 // src/program.ts
 import { Command as Command19 } from "commander";
@@ -141,6 +143,14 @@ function getActiveTraceWriter() {
 }
 
 // src/services/command-helpers.ts
+var EXIT_CREDENTIAL_STORE_UNAVAILABLE = 4;
+function reportCredentialStoreUnavailable(err) {
+  if (!(err instanceof CredentialStoreUnavailableError)) return false;
+  process.stderr.write(`Error: ${err.message}
+`);
+  process.exitCode = EXIT_CREDENTIAL_STORE_UNAVAILABLE;
+  return true;
+}
 function isSentinel(message, sentinel) {
   return message === sentinel || message.startsWith(`${sentinel}: `);
 }
@@ -219,6 +229,10 @@ function formatCreateError(err) {
   return `Create rejected: ${message}`;
 }
 function handleCommandError(err, id, context, scope = "write", exit = true) {
+  if (reportCredentialStoreUnavailable(err)) {
+    if (exit) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
+    return;
+  }
   const error = err instanceof Error ? err : new Error(String(err));
   const msg = error.message;
   const scopeLabel = scope === "read" ? "Work Items (read)" : "Work Items (Read & Write)";
@@ -2607,6 +2621,56 @@ not be resolved, 4 OS credential store unavailable. stdout stays empty on all.
 // src/commands/config.ts
 import { Command as Command4 } from "commander";
 import { createInterface as createInterface2 } from "readline";
+
+// src/services/dpapi-copy.ts
+var RERUN = "azdo config set credentialStore dpapi --copy-credentials";
+function isYes(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "" || a === "y" || a === "yes";
+}
+function empty(found, keyringUnavailable) {
+  return { found, keyringUnavailable, copied: [], skipped: [], failed: [] };
+}
+async function offerKeyringToDpapiCopy(choice, io) {
+  if (choice === "no") return empty([], false);
+  let found;
+  try {
+    found = listKeyringCredentials();
+  } catch {
+    io.notice(
+      `Credential Manager is not reachable from this session (typical over SSH), so no existing credentials were copied. To bring them over, run \`${RERUN}\` once from a console session.
+`
+    );
+    return empty([], true);
+  }
+  if (found.length === 0) return empty(found, false);
+  const list = found.join(", ");
+  if (choice === "ask") {
+    if (!io.interactive) {
+      io.notice(`Credential Manager holds credentials for ${list}. Run \`${RERUN}\` to copy them to the DPAPI store.
+`);
+      return empty(found, false);
+    }
+    const answer = await io.ask(`Copy the credentials for ${list} from Credential Manager to the DPAPI store? [Y/n] `);
+    if (!isYes(answer)) {
+      io.notice("Nothing copied. Run `azdo auth login` for each org, or re-run with --copy-credentials.\n");
+      return empty(found, false);
+    }
+  }
+  const result = copyKeyringCredentialsToDpapi(found);
+  for (const org of result.copied) io.notice(`Copied the credential for ${org} to the DPAPI store.
+`);
+  for (const org of result.skipped) io.notice(`Kept the existing DPAPI credential for ${org} (not overwritten).
+`);
+  for (const { org, message } of result.failed) io.notice(`Could not copy the credential for ${org}: ${message}
+`);
+  if (result.copied.length > 0) {
+    io.notice("The Credential Manager entries were left in place; `credentialStore keyring` still finds them.\n");
+  }
+  return { found, keyringUnavailable: false, ...result };
+}
+
+// src/commands/config.ts
 function formatConfigValue(value, unsetFallback = "") {
   if (value === void 0) {
     return unsetFallback;
@@ -2627,7 +2691,8 @@ function buildConfigListEntries(cfg) {
   return entries;
 }
 function writeConfigList(cfg) {
-  const keyWidth = 10;
+  const orgKeys = Object.values(cfg.organizations ?? {}).flatMap((scope) => Object.keys(scope ?? {}));
+  const keyWidth = Math.max(10, ...SETTINGS.map((s) => s.key.length + 1), ...orgKeys.map((k) => k.length + 1));
   const valueWidth = 30;
   const scopeWidth = 12;
   process.stdout.write(
@@ -2661,6 +2726,25 @@ function writeConfigList(cfg) {
     );
   }
 }
+async function offerCopy(options) {
+  let choice = "ask";
+  if (options.copyCredentials === true) choice = "yes";
+  else if (options.copyCredentials === false) choice = "no";
+  const interactive = !options.json && Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY);
+  let rl;
+  try {
+    return await offerKeyringToDpapiCopy(choice, {
+      interactive,
+      ask: (prompt) => {
+        rl ??= createInterface2({ input: process.stdin, output: process.stderr });
+        return createAsk(rl)(prompt);
+      },
+      notice: (message) => process.stderr.write(message)
+    });
+  } finally {
+    rl?.close();
+  }
+}
 function createAsk(rl) {
   return (prompt) => new Promise((resolve2) => rl.question(prompt, resolve2));
 }
@@ -2702,7 +2786,8 @@ function createConfigCommand() {
       "",
       "Credentials are NOT stored in the configuration file. They are resolved in this order:",
       "  1. the AZDO_PAT environment variable (wins over everything below)",
-      "  2. the OS credential store, per organization (see `azdo auth login`)",
+      "  2. the OS credential store, per organization (see `azdo auth login`) \u2014 or, with",
+      "     `credentialStore` set to dpapi (Windows), DPAPI-encrypted files in ~/.azdo/credentials",
       "  3. a .env file with AZDO_PAT, searched upwards from the working directory",
       "",
       "Only AZDO_PAT is read \u2014 AZURE_DEVOPS_PAT, AZURE_DEVOPS_EXT_PAT and AZDO_TOKEN are ignored.",
@@ -2712,33 +2797,41 @@ function createConfigCommand() {
     ].join("\n")
   );
   const set = new Command4("set");
-  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
+  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").option("--copy-credentials", "with credentialStore dpapi: copy Credential Manager credentials without asking").option("--no-copy-credentials", "with credentialStore dpapi: do not offer to copy Credential Manager credentials").action((key, value, options) => {
     try {
       if (options.org) {
         setOrgScopedValue(options.org, key, value);
       } else {
         setConfigValue(key, value);
       }
-      if (options.json) {
-        const output = { key, value, scope: options.org ?? "default" };
-        if (key === "fields") {
-          output.value = value.split(",").map((s) => s.trim());
-        }
-        process.stdout.write(JSON.stringify(output) + "\n");
-      } else {
-        const scopeTag = options.org ? ` (org: ${options.org})` : "";
-        process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
-`);
-      }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       process.stderr.write(`Error: ${message}
 `);
       process.exit(1);
     }
+    const output = { key, value, scope: options.org ?? "default" };
+    if (key === "fields") {
+      output.value = value.split(",").map((s) => s.trim());
+    }
+    if (!options.json) {
+      const scopeTag = options.org ? ` (org: ${options.org})` : "";
+      process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
+`);
+    }
+    const writeJson = () => {
+      if (options.json) process.stdout.write(JSON.stringify(output) + "\n");
+    };
+    if (!options.org && key === "credentialStore" && loadConfig().credentialStore === "dpapi") {
+      return offerCopy(options).then((outcome) => {
+        output.credentialsCopied = outcome.copied;
+        writeJson();
+      });
+    }
+    writeJson();
   });
   const get = new Command4("get");
-  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
+  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
       const value = options.org ? getOrgScopedValue(options.org, key) : getConfigValue(key);
       if (options.json) {
@@ -2771,7 +2864,7 @@ function createConfigCommand() {
     writeConfigList(cfg);
   });
   const unset = new Command4("unset");
-  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "remove from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
+  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").option("--org <org>", "remove from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
       if (options.org) {
         unsetOrgScopedValue(options.org, key);
@@ -2809,6 +2902,7 @@ function createConfigCommand() {
     process.stderr.write("Azure DevOps CLI - Configuration Wizard\n");
     process.stderr.write("=======================================\n\n");
     for (const setting of SETTINGS) {
+      if (setting.key === "credentialStore") continue;
       await promptForSetting(cfg, setting, ask);
     }
     rl.close();
@@ -3380,6 +3474,7 @@ function isCreateWriteError(err) {
   return isSentinel(err.message, "AUTH_FAILED") || isSentinel(err.message, "PERMISSION_DENIED") || err.message === "NETWORK_ERROR" || err.message.startsWith("BAD_REQUEST:") || err.message.startsWith("HTTP_");
 }
 function handleUpsertError(err, id, context) {
+  if (reportCredentialStoreUnavailable(err)) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
   if (!(err instanceof Error)) {
     process.stderr.write(`Error: ${String(err)}
 `);
@@ -4374,6 +4469,7 @@ function writeError(message, exitCode = 1) {
   process.exitCode = exitCode;
 }
 function handlePrCommandError(err, context, mode = "read") {
+  if (reportCredentialStoreUnavailable(err)) return;
   const error = err instanceof Error ? err : new Error(String(err));
   if (isSentinel(error.message, "AUTH_FAILED")) {
     const scopeLabel = mode === "write" ? "Code (Read & Write)" : "Code (Read)";
@@ -6084,6 +6180,7 @@ function writeError2(message) {
   process.exitCode = 1;
 }
 function handlePipelineError(err, context) {
+  if (reportCredentialStoreUnavailable(err)) return;
   const error = err instanceof Error ? err : new Error(String(err));
   if (isSentinel(error.message, "AUTH_FAILED")) {
     writeError2('Authentication failed. Check that your credential is valid and has the "Build (Read)" scope.');
@@ -7143,6 +7240,7 @@ function formatRelationsList(workItemId, relations) {
   return lines.join("\n");
 }
 function handleRelationError(err, id1) {
+  if (reportCredentialStoreUnavailable(err)) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
   const msg = err instanceof Error ? err.message : String(err);
   if (msg === "SELF_RELATION") {
     process.stderr.write(`Error: cannot relate a work item to itself (#${id1}).

package/dist/{oauth-token-refresh-PXUQE5JE.js → oauth-token-refresh-RUT4XIMM.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-K2CKMY72.js";
+} from "./chunk-W4EVKARR.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.20.0-develop.741",
+  "version": "0.20.0-develop.751",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {
@@ -25,7 +25,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@napi-rs/keyring": "^1.2.0",
+    "@napi-rs/keyring": "^1.3.0",
+    "@primno/dpapi": "^2.0.1",
     "commander": "^14.0.3",
     "jimp": "^1.6.1",
     "node-html-markdown": "^2.0.0"
@@ -35,12 +36,12 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^25.5.0",
-    "eslint": "^10.1.0",
-    "prettier": "^3.8.1",
+    "@types/node": "^25.9.8",
+    "eslint": "^10.11.0",
+    "prettier": "^3.9.9",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.57.2",
-    "vitest": "^4.1.2"
+    "typescript-eslint": "^8.70.1",
+    "vitest": "^4.1.11"
   }
 }