azdo-cli 0.20.0-feature-043-dpapi-credential-store.744 → 0.20.0-feature-043-dpapi-credential-store.746

package/README.md

@@ -19,7 +19,7 @@ Azure DevOps CLI focused on work item read/write workflows.
 - Feed long PR titles, descriptions and comment bodies from a file or a pipe instead of the shell (`--title-file`, `--description-file`, `--file`; `-` reads standard input)
 - Persist org/project/default fields in local config (`config`)
 - List all fields of a work item (`list-fields`)
-- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store. Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
+- Authenticate per Azure DevOps organization with `azdo auth login` — OAuth (Microsoft Entra) by default, or a Personal Access Token via `--use-pat` (or the `AZDO_PAT` env var). Credentials are stored in the OS credential store — or, on Windows over SSH where Credential Manager is unreachable, in DPAPI-encrypted files under `~/.azdo` (`azdo config set credentialStore dpapi`, which offers to copy existing Credential Manager credentials; `--copy-credentials` / `--no-copy-credentials` skip the prompt). Inspect with `azdo auth status`, remove with `azdo auth logout`. Diagnose auth problems with `azdo auth diagnose`. Print the credential the CLI itself would use, for API calls the CLI does not yet wrap, with `azdo auth token`. See [docs/authentication.md](docs/authentication.md).
 - Trace all HTTP requests to a local file with `--trace <filepath>` (sensitive headers and tokens are automatically redacted).
 
 ## Installation
@@ -38,6 +38,10 @@ azdo auth login --org myorg
 azdo config set org myorg
 azdo config set project myproject
 
+# Windows over SSH: keep credentials in DPAPI files instead of Credential Manager
+# (run once from a console to copy the existing credentials across)
+azdo config set credentialStore dpapi --copy-credentials
+
 # Read a work item
 azdo get-item 12345
 

package/dist/{chunk-RG45CRKX.js → chunk-W4EVKARR.js}

@@ -947,8 +947,12 @@ function requestedStore() {
   let fromConfig;
   try {
     fromConfig = loadConfig()?.credentialStore;
-  } catch {
-    fromConfig = void 0;
+  } catch (err) {
+    throw new CredentialStoreUnavailableError(
+      "unknown",
+      err,
+      `Could not read the azdo config file to determine the credential store: ${err.message}. Fix the file, or set AZDO_CREDENTIAL_STORE=<keyring|dpapi> for this session.`
+    );
   }
   return fromConfig?.trim().toLowerCase() || "keyring";
 }
@@ -966,7 +970,13 @@ function activeCredentialStore() {
   }
 }
 function probeBackend() {
-  if (requestedStore() === "dpapi") return "windows-dpapi";
+  let requested;
+  try {
+    requested = requestedStore();
+  } catch {
+    return "unknown";
+  }
+  if (requested === "dpapi") return "windows-dpapi";
   switch (process.platform) {
     case "win32":
       return "windows-credential-manager";
@@ -1168,7 +1178,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-M6L5EUZW.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-RUT4XIMM.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }

package/dist/index.js

@@ -39,7 +39,7 @@ import {
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-RG45CRKX.js";
+} from "./chunk-W4EVKARR.js";
 
 // src/program.ts
 import { Command as Command19 } from "commander";
@@ -143,6 +143,14 @@ function getActiveTraceWriter() {
 }
 
 // src/services/command-helpers.ts
+var EXIT_CREDENTIAL_STORE_UNAVAILABLE = 4;
+function reportCredentialStoreUnavailable(err) {
+  if (!(err instanceof CredentialStoreUnavailableError)) return false;
+  process.stderr.write(`Error: ${err.message}
+`);
+  process.exitCode = EXIT_CREDENTIAL_STORE_UNAVAILABLE;
+  return true;
+}
 function isSentinel(message, sentinel) {
   return message === sentinel || message.startsWith(`${sentinel}: `);
 }
@@ -221,6 +229,10 @@ function formatCreateError(err) {
   return `Create rejected: ${message}`;
 }
 function handleCommandError(err, id, context, scope = "write", exit = true) {
+  if (reportCredentialStoreUnavailable(err)) {
+    if (exit) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
+    return;
+  }
   const error = err instanceof Error ? err : new Error(String(err));
   const msg = error.message;
   const scopeLabel = scope === "read" ? "Work Items (read)" : "Work Items (Read & Write)";
@@ -2679,7 +2691,8 @@ function buildConfigListEntries(cfg) {
   return entries;
 }
 function writeConfigList(cfg) {
-  const keyWidth = 10;
+  const orgKeys = Object.values(cfg.organizations ?? {}).flatMap((scope) => Object.keys(scope ?? {}));
+  const keyWidth = Math.max(10, ...SETTINGS.map((s) => s.key.length + 1), ...orgKeys.map((k) => k.length + 1));
   const valueWidth = 30;
   const scopeWidth = 12;
   process.stdout.write(
@@ -3461,6 +3474,7 @@ function isCreateWriteError(err) {
   return isSentinel(err.message, "AUTH_FAILED") || isSentinel(err.message, "PERMISSION_DENIED") || err.message === "NETWORK_ERROR" || err.message.startsWith("BAD_REQUEST:") || err.message.startsWith("HTTP_");
 }
 function handleUpsertError(err, id, context) {
+  if (reportCredentialStoreUnavailable(err)) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
   if (!(err instanceof Error)) {
     process.stderr.write(`Error: ${String(err)}
 `);
@@ -4455,6 +4469,7 @@ function writeError(message, exitCode = 1) {
   process.exitCode = exitCode;
 }
 function handlePrCommandError(err, context, mode = "read") {
+  if (reportCredentialStoreUnavailable(err)) return;
   const error = err instanceof Error ? err : new Error(String(err));
   if (isSentinel(error.message, "AUTH_FAILED")) {
     const scopeLabel = mode === "write" ? "Code (Read & Write)" : "Code (Read)";
@@ -6165,6 +6180,7 @@ function writeError2(message) {
   process.exitCode = 1;
 }
 function handlePipelineError(err, context) {
+  if (reportCredentialStoreUnavailable(err)) return;
   const error = err instanceof Error ? err : new Error(String(err));
   if (isSentinel(error.message, "AUTH_FAILED")) {
     writeError2('Authentication failed. Check that your credential is valid and has the "Build (Read)" scope.');
@@ -7224,6 +7240,7 @@ function formatRelationsList(workItemId, relations) {
   return lines.join("\n");
 }
 function handleRelationError(err, id1) {
+  if (reportCredentialStoreUnavailable(err)) process.exit(EXIT_CREDENTIAL_STORE_UNAVAILABLE);
   const msg = err instanceof Error ? err.message : String(err);
   if (msg === "SELF_RELATION") {
     process.stderr.write(`Error: cannot relate a work item to itself (#${id1}).

package/dist/{oauth-token-refresh-M6L5EUZW.js → oauth-token-refresh-RUT4XIMM.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-RG45CRKX.js";
+} from "./chunk-W4EVKARR.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.20.0-feature-043-dpapi-credential-store.744",
+  "version": "0.20.0-feature-043-dpapi-credential-store.746",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {