azdo-cli 0.20.0-feature-043-dpapi-credential-store.742 → 0.20.0-feature-043-dpapi-credential-store.746

package/README.md

@@ -19,7 +19,7 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Feed long PR titles, descriptions and comment bodies from a file or a pipe instead of the shell (`--title-file`, `--description-file`, `--file`; `-` reads standard input)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store — or, on Windows over SSH where Credential Manager is unreachable, in DPAPI-encrypted files under `~/.azdo` (`azdo config set credentialStore dpapi`, which offers to copy existing Credential Manager credentials; `--copy-credentials` / `--no-copy-credentials` skip the prompt). Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
 - Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation
@@ -38,6 +38,10 @@ azdo auth login --org myorg
 azdo config set org myorg
 azdo config set project myproject
 
+# Windows over SSH: keep credentials in DPAPI files instead of Credential Manager
+# (run once from a console to copy the existing credentials across)
+azdo config set credentialStore dpapi --copy-credentials
+
 # Read a work item
 azdo get-item 12345
 

package/dist/{chunk-B76UX3CR.js → chunk-W4EVKARR.js}

@@ -947,8 +947,12 @@ function requestedStore() {
   let fromConfig;
   try {
     fromConfig = loadConfig()?.credentialStore;
-  } catch {
-    fromConfig = void 0;
+  } catch (err) {
+    throw new CredentialStoreUnavailableError(
+      "unknown",
+      err,
+      `Could not read the azdo config file to determine the credential store: ${err.message}. Fix the file, or set AZDO_CREDENTIAL_STORE=<keyring|dpapi> for this session.`
+    );
   }
   return fromConfig?.trim().toLowerCase() || "keyring";
 }
@@ -966,7 +970,13 @@ function activeCredentialStore() {
   }
 }
 function probeBackend() {
-  if (requestedStore() === "dpapi") return "windows-dpapi";
+  let requested;
+  try {
+    requested = requestedStore();
+  } catch {
+    return "unknown";
+  }
+  if (requested === "dpapi") return "windows-dpapi";
   switch (process.platform) {
     case "win32":
       return "windows-credential-manager";
@@ -978,14 +988,17 @@ function probeBackend() {
       return "unknown";
   }
 }
-function wrapUnavailable(fn) {
+function wrapUnavailableAs(backend, fn) {
   try {
     return fn();
   } catch (err) {
     if (err instanceof CredentialStoreUnavailableError) throw err;
-    throw new CredentialStoreUnavailableError(probeBackend(), err);
+    throw new CredentialStoreUnavailableError(backend, err);
   }
 }
+function wrapUnavailable(fn) {
+  return wrapUnavailableAs(probeBackend(), fn);
+}
 function entryFor(account) {
   if (activeCredentialStore() === "dpapi") return new DpapiEntry(account);
   return wrapUnavailable(() => new Entry(SERVICE, account));
@@ -1165,7 +1178,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-5O2DYWFR.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-RUT4XIMM.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1191,6 +1204,62 @@ async function listOrgsWithStoredPat() {
   present.sort((a, b) => a.localeCompare(b));
   return present;
 }
+function keyringEntry(account) {
+  return new Entry(SERVICE, account);
+}
+function knownOrgs() {
+  const orgs = /* @__PURE__ */ new Set();
+  for (const ev of readAuditEvents()) {
+    if (ev.event === "auth.store" || ev.event === "oauth-login-success") orgs.add(ev.org);
+  }
+  try {
+    const config = loadConfig();
+    if (config.org) orgs.add(config.org);
+    for (const name of Object.keys(config.organizations ?? {})) orgs.add(name);
+  } catch {
+  }
+  return [...orgs].sort((a, b) => a.localeCompare(b));
+}
+function listKeyringCredentials() {
+  const present = [];
+  for (const org of knownOrgs()) {
+    const value = wrapUnavailableAs(
+      "windows-credential-manager",
+      () => keyringEntry(accountFor(org)).getPassword()
+    );
+    if (value !== null) present.push(org);
+  }
+  return present;
+}
+function copyKeyringCredentialsToDpapi(orgs) {
+  const result = { copied: [], skipped: [], failed: [] };
+  for (const org of orgs) {
+    try {
+      const raw = wrapUnavailableAs(
+        "windows-credential-manager",
+        () => keyringEntry(accountFor(org)).getPassword()
+      );
+      if (raw === null) continue;
+      const target = new DpapiEntry(accountFor(org));
+      if (target.getPassword() !== null) {
+        result.skipped.push(org);
+        continue;
+      }
+      const cred = parseStoredValue(raw);
+      target.setPassword(raw);
+      appendAuthAuditEvent({
+        event: "auth.store",
+        org,
+        backend: "windows-dpapi",
+        ...cred.kind === "pat" ? { masked_pat: maskedDisplay(cred.token) } : { accountId: cred.accountId }
+      });
+      result.copied.push(org);
+    } catch (err) {
+      result.failed.push({ org, message: err.message });
+    }
+  }
+  return result;
+}
 
 // src/services/oauth-token-refresh.ts
 var DEFAULT_LOCK_WAIT_MS = 5e3;
@@ -1393,5 +1462,7 @@ export {
   storePat,
   storeOAuthCredential,
   deletePat,
-  listOrgsWithStoredPat
+  listOrgsWithStoredPat,
+  listKeyringCredentials,
+  copyKeyringCredentialsToDpapi
 };

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   SETTINGS,
   appendAuthAuditEvent,
   buildScopeString,
+  copyKeyringCredentialsToDpapi,
   copyOrgScope,
   defaultScopes,
   deleteOrgScope,
@@ -16,6 +17,7 @@ import {
   getOrgScopedValue,
   getPat,
   getStoredCredential,
+  listKeyringCredentials,
   listOrgsWithStoredPat,
   loadConfig,
   maskedDisplay,
@@ -37,7 +39,7 @@ import {
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-B76UX3CR.js";
+} from "./chunk-W4EVKARR.js";
 
 // src/program.ts
 import { Command as Command19 } from "commander";
@@ -141,6 +143,14 @@ function getActiveTraceWriter() {
 }
 
 // src/services/command-helpers.ts
+var EXIT_CREDENTIAL_STORE_UNAVAILABLE = 4;
+function reportCredentialStoreUnavailable(err) {
+  if (!(err instanceof CredentialStoreUnavailableError)) return false;
+  process.stderr.write(`Error: ${err.message}
+`);
+  process.exitCode = EXIT_CREDENTIAL_STORE_UNAVAILABLE;
+  return true;
+}
 function isSentinel(message, sentinel) {
   return message === sentinel || message.startsWith(`${sentinel}: `);
 }
@@ -219,6 +229,10 @@ function formatCreateError(err) {
   return `Create rejected: ${message}`;
 }
 function handleCommandError(err, id, context, scope = "write", exit = true) {
+  if (reportCredentialStoreUnavailable(err)) {
+    if (exit) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
+    return;
+  }
   const error = err instanceof Error ? err : new Error(String(err));
   const msg = error.message;
   const scopeLabel = scope === "read" ? "Work Items (read)" : "Work Items (Read & Write)";
@@ -2607,6 +2621,56 @@ not be resolved, 4 OS credential store unavailable. stdout stays empty on all.
 // src/commands/config.ts
 import { Command as Command4 } from "commander";
 import { createInterface as createInterface2 } from "readline";
+
+// src/services/dpapi-copy.ts
+var RERUN = "azdo config set credentialStore dpapi --copy-credentials";
+function isYes(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "" || a === "y" || a === "yes";
+}
+function empty(found, keyringUnavailable) {
+  return { found, keyringUnavailable, copied: [], skipped: [], failed: [] };
+}
+async function offerKeyringToDpapiCopy(choice, io) {
+  if (choice === "no") return empty([], false);
+  let found;
+  try {
+    found = listKeyringCredentials();
+  } catch {
+    io.notice(
+      `Credential Manager is not reachable from this session (typical over SSH), so no existing credentials were copied. To bring them over, run \`${RERUN}\` once from a console session.
+`
+    );
+    return empty([], true);
+  }
+  if (found.length === 0) return empty(found, false);
+  const list = found.join(", ");
+  if (choice === "ask") {
+    if (!io.interactive) {
+      io.notice(`Credential Manager holds credentials for ${list}. Run \`${RERUN}\` to copy them to the DPAPI store.
+`);
+      return empty(found, false);
+    }
+    const answer = await io.ask(`Copy the credentials for ${list} from Credential Manager to the DPAPI store? [Y/n] `);
+    if (!isYes(answer)) {
+      io.notice("Nothing copied. Run `azdo auth login` for each org, or re-run with --copy-credentials.\n");
+      return empty(found, false);
+    }
+  }
+  const result = copyKeyringCredentialsToDpapi(found);
+  for (const org of result.copied) io.notice(`Copied the credential for ${org} to the DPAPI store.
+`);
+  for (const org of result.skipped) io.notice(`Kept the existing DPAPI credential for ${org} (not overwritten).
+`);
+  for (const { org, message } of result.failed) io.notice(`Could not copy the credential for ${org}: ${message}
+`);
+  if (result.copied.length > 0) {
+    io.notice("The Credential Manager entries were left in place; `credentialStore keyring` still finds them.\n");
+  }
+  return { found, keyringUnavailable: false, ...result };
+}
+
+// src/commands/config.ts
 function formatConfigValue(value, unsetFallback = "") {
   if (value === void 0) {
     return unsetFallback;
@@ -2627,7 +2691,8 @@ function buildConfigListEntries(cfg) {
   return entries;
 }
 function writeConfigList(cfg) {
-  const keyWidth = 10;
+  const orgKeys = Object.values(cfg.organizations ?? {}).flatMap((scope) => Object.keys(scope ?? {}));
+  const keyWidth = Math.max(10, ...SETTINGS.map((s) => s.key.length + 1), ...orgKeys.map((k) => k.length + 1));
   const valueWidth = 30;
   const scopeWidth = 12;
   process.stdout.write(
@@ -2661,6 +2726,25 @@ function writeConfigList(cfg) {
     );
   }
 }
+async function offerCopy(options) {
+  let choice = "ask";
+  if (options.copyCredentials === true) choice = "yes";
+  else if (options.copyCredentials === false) choice = "no";
+  const interactive = !options.json && Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY);
+  let rl;
+  try {
+    return await offerKeyringToDpapiCopy(choice, {
+      interactive,
+      ask: (prompt) => {
+        rl ??= createInterface2({ input: process.stdin, output: process.stderr });
+        return createAsk(rl)(prompt);
+      },
+      notice: (message) => process.stderr.write(message)
+    });
+  } finally {
+    rl?.close();
+  }
+}
 function createAsk(rl) {
   return (prompt) => new Promise((resolve2) => rl.question(prompt, resolve2));
 }
@@ -2713,30 +2797,38 @@ function createConfigCommand() {
     ].join("\n")
   );
   const set = new Command4("set");
-  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
+  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").option("--copy-credentials", "with credentialStore dpapi: copy Credential Manager credentials without asking").option("--no-copy-credentials", "with credentialStore dpapi: do not offer to copy Credential Manager credentials").action((key, value, options) => {
     try {
       if (options.org) {
         setOrgScopedValue(options.org, key, value);
       } else {
         setConfigValue(key, value);
       }
-      if (options.json) {
-        const output = { key, value, scope: options.org ?? "default" };
-        if (key === "fields") {
-          output.value = value.split(",").map((s) => s.trim());
-        }
-        process.stdout.write(JSON.stringify(output) + "\n");
-      } else {
-        const scopeTag = options.org ? ` (org: ${options.org})` : "";
-        process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
-`);
-      }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       process.stderr.write(`Error: ${message}
 `);
       process.exit(1);
     }
+    const output = { key, value, scope: options.org ?? "default" };
+    if (key === "fields") {
+      output.value = value.split(",").map((s) => s.trim());
+    }
+    if (!options.json) {
+      const scopeTag = options.org ? ` (org: ${options.org})` : "";
+      process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
+`);
+    }
+    const writeJson = () => {
+      if (options.json) process.stdout.write(JSON.stringify(output) + "\n");
+    };
+    if (!options.org && key === "credentialStore" && loadConfig().credentialStore === "dpapi") {
+      return offerCopy(options).then((outcome) => {
+        output.credentialsCopied = outcome.copied;
+        writeJson();
+      });
+    }
+    writeJson();
   });
   const get = new Command4("get");
   get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown, credentialStore)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
@@ -3382,6 +3474,7 @@ function isCreateWriteError(err) {
   return isSentinel(err.message, "AUTH_FAILED") || isSentinel(err.message, "PERMISSION_DENIED") || err.message === "NETWORK_ERROR" || err.message.startsWith("BAD_REQUEST:") || err.message.startsWith("HTTP_");
 }
 function handleUpsertError(err, id, context) {
+  if (reportCredentialStoreUnavailable(err)) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
   if (!(err instanceof Error)) {
     process.stderr.write(`Error: ${String(err)}
 `);
@@ -4376,6 +4469,7 @@ function writeError(message, exitCode = 1) {
   process.exitCode = exitCode;
 }
 function handlePrCommandError(err, context, mode = "read") {
+  if (reportCredentialStoreUnavailable(err)) return;
   const error = err instanceof Error ? err : new Error(String(err));
   if (isSentinel(error.message, "AUTH_FAILED")) {
     const scopeLabel = mode === "write" ? "Code (Read & Write)" : "Code (Read)";
@@ -6086,6 +6180,7 @@ function writeError2(message) {
   process.exitCode = 1;
 }
 function handlePipelineError(err, context) {
+  if (reportCredentialStoreUnavailable(err)) return;
   const error = err instanceof Error ? err : new Error(String(err));
   if (isSentinel(error.message, "AUTH_FAILED")) {
     writeError2('Authentication failed. Check that your credential is valid and has the "Build (Read)" scope.');
@@ -7145,6 +7240,7 @@ function formatRelationsList(workItemId, relations) {
   return lines.join("\n");
 }
 function handleRelationError(err, id1) {
+  if (reportCredentialStoreUnavailable(err)) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
   const msg = err instanceof Error ? err.message : String(err);
   if (msg === "SELF_RELATION") {
     process.stderr.write(`Error: cannot relate a work item to itself (#${id1}).

package/dist/{oauth-token-refresh-5O2DYWFR.js → oauth-token-refresh-RUT4XIMM.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-B76UX3CR.js";
+} from "./chunk-W4EVKARR.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.20.0-feature-043-dpapi-credential-store.742",
+  "version": "0.20.0-feature-043-dpapi-credential-store.746",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {