azdo-cli 0.20.0-feature-043-dpapi-credential-store.742 → 0.20.0-feature-043-dpapi-credential-store.744

package/dist/{chunk-B76UX3CR.js → chunk-RG45CRKX.js}

@@ -978,14 +978,17 @@ function probeBackend() {
       return "unknown";
   }
 }
-function wrapUnavailable(fn) {
+function wrapUnavailableAs(backend, fn) {
   try {
     return fn();
   } catch (err) {
     if (err instanceof CredentialStoreUnavailableError) throw err;
-    throw new CredentialStoreUnavailableError(probeBackend(), err);
+    throw new CredentialStoreUnavailableError(backend, err);
   }
 }
+function wrapUnavailable(fn) {
+  return wrapUnavailableAs(probeBackend(), fn);
+}
 function entryFor(account) {
   if (activeCredentialStore() === "dpapi") return new DpapiEntry(account);
   return wrapUnavailable(() => new Entry(SERVICE, account));
@@ -1165,7 +1168,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-5O2DYWFR.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-M6L5EUZW.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1191,6 +1194,62 @@ async function listOrgsWithStoredPat() {
   present.sort((a, b) => a.localeCompare(b));
   return present;
 }
+function keyringEntry(account) {
+  return new Entry(SERVICE, account);
+}
+function knownOrgs() {
+  const orgs = /* @__PURE__ */ new Set();
+  for (const ev of readAuditEvents()) {
+    if (ev.event === "auth.store" || ev.event === "oauth-login-success") orgs.add(ev.org);
+  }
+  try {
+    const config = loadConfig();
+    if (config.org) orgs.add(config.org);
+    for (const name of Object.keys(config.organizations ?? {})) orgs.add(name);
+  } catch {
+  }
+  return [...orgs].sort((a, b) => a.localeCompare(b));
+}
+function listKeyringCredentials() {
+  const present = [];
+  for (const org of knownOrgs()) {
+    const value = wrapUnavailableAs(
+      "windows-credential-manager",
+      () => keyringEntry(accountFor(org)).getPassword()
+    );
+    if (value !== null) present.push(org);
+  }
+  return present;
+}
+function copyKeyringCredentialsToDpapi(orgs) {
+  const result = { copied: [], skipped: [], failed: [] };
+  for (const org of orgs) {
+    try {
+      const raw = wrapUnavailableAs(
+        "windows-credential-manager",
+        () => keyringEntry(accountFor(org)).getPassword()
+      );
+      if (raw === null) continue;
+      const target = new DpapiEntry(accountFor(org));
+      if (target.getPassword() !== null) {
+        result.skipped.push(org);
+        continue;
+      }
+      const cred = parseStoredValue(raw);
+      target.setPassword(raw);
+      appendAuthAuditEvent({
+        event: "auth.store",
+        org,
+        backend: "windows-dpapi",
+        ...cred.kind === "pat" ? { masked_pat: maskedDisplay(cred.token) } : { accountId: cred.accountId }
+      });
+      result.copied.push(org);
+    } catch (err) {
+      result.failed.push({ org, message: err.message });
+    }
+  }
+  return result;
+}
 
 // src/services/oauth-token-refresh.ts
 var DEFAULT_LOCK_WAIT_MS = 5e3;
@@ -1393,5 +1452,7 @@ export {
   storePat,
   storeOAuthCredential,
   deletePat,
-  listOrgsWithStoredPat
+  listOrgsWithStoredPat,
+  listKeyringCredentials,
+  copyKeyringCredentialsToDpapi
 };

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   SETTINGS,
   appendAuthAuditEvent,
   buildScopeString,
+  copyKeyringCredentialsToDpapi,
   copyOrgScope,
   defaultScopes,
   deleteOrgScope,
@@ -16,6 +17,7 @@ import {
   getOrgScopedValue,
   getPat,
   getStoredCredential,
+  listKeyringCredentials,
   listOrgsWithStoredPat,
   loadConfig,
   maskedDisplay,
@@ -37,7 +39,7 @@ import {
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-B76UX3CR.js";
+} from "./chunk-RG45CRKX.js";
 
 // src/program.ts
 import { Command as Command19 } from "commander";
@@ -2607,6 +2609,56 @@ not be resolved, 4 OS credential store unavailable. stdout stays empty on all.
 // src/commands/config.ts
 import { Command as Command4 } from "commander";
 import { createInterface as createInterface2 } from "readline";
+
+// src/services/dpapi-copy.ts
+var RERUN = "azdo config set credentialStore dpapi --copy-credentials";
+function isYes(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "" || a === "y" || a === "yes";
+}
+function empty(found, keyringUnavailable) {
+  return { found, keyringUnavailable, copied: [], skipped: [], failed: [] };
+}
+async function offerKeyringToDpapiCopy(choice, io) {
+  if (choice === "no") return empty([], false);
+  let found;
+  try {
+    found = listKeyringCredentials();
+  } catch {
+    io.notice(
+      `Credential Manager is not reachable from this session (typical over SSH), so no existing credentials were copied. To bring them over, run \`${RERUN}\` once from a console session.
+`
+    );
+    return empty([], true);
+  }
+  if (found.length === 0) return empty(found, false);
+  const list = found.join(", ");
+  if (choice === "ask") {
+    if (!io.interactive) {
+      io.notice(`Credential Manager holds credentials for ${list}. Run \`${RERUN}\` to copy them to the DPAPI store.
+`);
+      return empty(found, false);
+    }
+    const answer = await io.ask(`Copy the credentials for ${list} from Credential Manager to the DPAPI store? [Y/n] `);
+    if (!isYes(answer)) {
+      io.notice("Nothing copied. Run `azdo auth login` for each org, or re-run with --copy-credentials.\n");
+      return empty(found, false);
+    }
+  }
+  const result = copyKeyringCredentialsToDpapi(found);
+  for (const org of result.copied) io.notice(`Copied the credential for ${org} to the DPAPI store.
+`);
+  for (const org of result.skipped) io.notice(`Kept the existing DPAPI credential for ${org} (not overwritten).
+`);
+  for (const { org, message } of result.failed) io.notice(`Could not copy the credential for ${org}: ${message}
+`);
+  if (result.copied.length > 0) {
+    io.notice("The Credential Manager entries were left in place; `credentialStore keyring` still finds them.\n");
+  }
+  return { found, keyringUnavailable: false, ...result };
+}
+
+// src/commands/config.ts
 function formatConfigValue(value, unsetFallback = "") {
   if (value === void 0) {
     return unsetFallback;
@@ -2661,6 +2713,25 @@ function writeConfigList(cfg) {
     );
   }
 }
+async function offerCopy(options) {
+  let choice = "ask";
+  if (options.copyCredentials === true) choice = "yes";
+  else if (options.copyCredentials === false) choice = "no";
+  const interactive = !options.json && Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY);
+  let rl;
+  try {
+    return await offerKeyringToDpapiCopy(choice, {
+      interactive,
+      ask: (prompt) => {
+        rl ??= createInterface2({ input: process.stdin, output: process.stderr });
+        return createAsk(rl)(prompt);
+      },
+      notice: (message) => process.stderr.write(message)
+    });
+  } finally {
+    rl?.close();
+  }
+}
 function createAsk(rl) {
   return (prompt) => new Promise((resolve2) => rl.question(prompt, resolve2));
 }
@@ -2713,30 +2784,38 @@ function createConfigCommand() {
     ].join("\n")
   );
   const set = new Command4("set");
-  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
+  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").option("--copy-credentials", "with credentialStore dpapi: copy Credential Manager credentials without asking").option("--no-copy-credentials", "with credentialStore dpapi: do not offer to copy Credential Manager credentials").action((key, value, options) => {
     try {
       if (options.org) {
         setOrgScopedValue(options.org, key, value);
       } else {
         setConfigValue(key, value);
       }
-      if (options.json) {
-        const output = { key, value, scope: options.org ?? "default" };
-        if (key === "fields") {
-          output.value = value.split(",").map((s) => s.trim());
-        }
-        process.stdout.write(JSON.stringify(output) + "\n");
-      } else {
-        const scopeTag = options.org ? ` (org: ${options.org})` : "";
-        process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
-`);
-      }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       process.stderr.write(`Error: ${message}
 `);
       process.exit(1);
     }
+    const output = { key, value, scope: options.org ?? "default" };
+    if (key === "fields") {
+      output.value = value.split(",").map((s) => s.trim());
+    }
+    if (!options.json) {
+      const scopeTag = options.org ? ` (org: ${options.org})` : "";
+      process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
+`);
+    }
+    const writeJson = () => {
+      if (options.json) process.stdout.write(JSON.stringify(output) + "\n");
+    };
+    if (!options.org && key === "credentialStore" && loadConfig().credentialStore === "dpapi") {
+      return offerCopy(options).then((outcome) => {
+        output.credentialsCopied = outcome.copied;
+        writeJson();
+      });
+    }
+    writeJson();
   });
   const get = new Command4("get");
   get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {

package/dist/{oauth-token-refresh-5O2DYWFR.js → oauth-token-refresh-M6L5EUZW.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-B76UX3CR.js";
+} from "./chunk-RG45CRKX.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.20.0-feature-043-dpapi-credential-store.742",
+  "version": "0.20.0-feature-043-dpapi-credential-store.744",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {