azdo-cli 0.23.0-develop.895 → 0.23.0-feature-058-credential-error-cause.897

package/dist/{chunk-MHJ6OBX3.js → chunk-DNOOZIXA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/services/oauth-token-refresh.ts
-import { closeSync, mkdirSync, openSync, unlinkSync } from "fs";
+import { closeSync as closeSync2, mkdirSync, openSync as openSync2, unlinkSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 
@@ -37,12 +37,12 @@ import os from "os";
 
 // src/services/credential-store-kind.ts
 var CREDENTIAL_STORES = ["keyring", "dpapi"];
-function parseCredentialStore(value, platform = process.platform) {
+function parseCredentialStore(value, platform2 = process.platform) {
   const normalised = value.trim().toLowerCase();
   if (!CREDENTIAL_STORES.includes(normalised)) {
     throw new Error(`Invalid value "${value}" for credentialStore. Must be one of: ${CREDENTIAL_STORES.join(", ")}.`);
   }
-  if (normalised === "dpapi" && platform !== "win32") {
+  if (normalised === "dpapi" && platform2 !== "win32") {
     throw new Error('credentialStore "dpapi" is only available on Windows.');
   }
   return normalised;
@@ -349,14 +349,14 @@ function buildScopeString(scopes) {
 
 // src/services/browser-open.ts
 import { execFile } from "child_process";
-function isHeadless(platform, hasDisplay) {
-  if (platform === "linux") {
+function isHeadless(platform2, hasDisplay) {
+  if (platform2 === "linux") {
     return !hasDisplay;
   }
   return false;
 }
-function commandForPlatform(platform) {
-  switch (platform) {
+function commandForPlatform(platform2) {
+  switch (platform2) {
     case "darwin":
       return { cmd: "open", args: (url) => [url] };
     case "win32":
@@ -368,15 +368,15 @@ function commandForPlatform(platform) {
   }
 }
 async function openUrl(url, opts = {}) {
-  const platform = opts.platform ?? process.platform;
+  const platform2 = opts.platform ?? process.platform;
   const hasDisplay = opts.hasDisplay ?? (process.env.DISPLAY !== void 0 && process.env.DISPLAY !== "");
   const forcePrint = opts.forcePrint ?? false;
-  if (forcePrint || isHeadless(platform, hasDisplay)) {
+  if (forcePrint || isHeadless(platform2, hasDisplay)) {
     process.stderr.write(`Open this URL in your browser: ${url}
 `);
     return "printed";
   }
-  const spec = commandForPlatform(platform);
+  const spec = commandForPlatform(platform2);
   if (!spec) {
     process.stderr.write(`Open this URL in your browser: ${url}
 `);
@@ -780,9 +780,110 @@ function readAuditEvents() {
 // src/services/credential-store.ts
 import { Entry } from "@napi-rs/keyring";
 
+// src/services/trace-writer.ts
+import { openSync, writeSync, closeSync } from "fs";
+import { platform } from "os";
+var REDACTED = "[REDACTED]";
+var SENSITIVE_HEADER = /^(authorization|x-.*token)$/i;
+var SENSITIVE_QUERY_PARAM = /^(token|pat)$/i;
+var SENSITIVE_BODY_FIELD = /^(token|accessToken|pat)$/;
+function redactHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADER.test(key) ? REDACTED : value;
+  }
+  return out;
+}
+function redactUrl(url) {
+  try {
+    const u = new URL(url);
+    for (const [key] of u.searchParams.entries()) {
+      if (SENSITIVE_QUERY_PARAM.test(key)) {
+        u.searchParams.set(key, REDACTED);
+      }
+    }
+    return u.toString();
+  } catch {
+    return url;
+  }
+}
+var SECRET_ASSIGNMENT = String.raw`["']?\s*[:=]\s*["']?)[^"'\s,;&}]+`;
+var SECRET_IN_TEXT = [
+  [/\b(Bearer|Basic)\s+[\w.~+/=-]{8,}/gi, `$1 ${REDACTED}`],
+  [new RegExp(String.raw`(\b(?:access|refresh|api)[_-]?(?:token|key)\b${SECRET_ASSIGNMENT}`, "gi"), `$1${REDACTED}`],
+  [new RegExp(String.raw`(\b(?:token|pat|password|secret)\b${SECRET_ASSIGNMENT}`, "gi"), `$1${REDACTED}`],
+  [/\beyJ[A-Za-z0-9._~+/=-]{20,}/g, REDACTED],
+  [/\b(?=[A-Za-z0-9]*\d)(?=[A-Za-z0-9]*[A-Za-z])[A-Za-z0-9]{40,}\b/g, REDACTED]
+];
+function redactText(text) {
+  let out = text;
+  for (const [pattern, replacement] of SECRET_IN_TEXT) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+function redactBody(body) {
+  if (body === null) return null;
+  try {
+    const parsed = JSON.parse(body);
+    let changed = false;
+    const redacted = { ...parsed };
+    for (const key of Object.keys(parsed)) {
+      if (SENSITIVE_BODY_FIELD.test(key)) {
+        redacted[key] = REDACTED;
+        changed = true;
+      }
+    }
+    return changed ? JSON.stringify(redacted) : body;
+  } catch {
+    return body;
+  }
+}
+var TraceWriter = class {
+  fd;
+  constructor(filepath) {
+    const mode = platform() === "win32" ? void 0 : 384;
+    this.fd = openSync(filepath, "a", mode);
+  }
+  append(entry) {
+    const line = JSON.stringify(entry) + "\n\n";
+    writeSync(this.fd, line);
+  }
+  close() {
+    closeSync(this.fd);
+  }
+};
+var activeWriter = null;
+function initTraceWriter(filepath) {
+  try {
+    activeWriter = new TraceWriter(filepath);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Warning: could not open trace file "${filepath}": ${msg}
+`);
+  }
+}
+function getActiveTraceWriter() {
+  return activeWriter;
+}
+
 // src/types/credential.ts
-function defaultUnavailableMessage(backend) {
-  const base = `OS secret backend unavailable (${backend}). Install the platform's credential service and try again.`;
+function underlyingDetail(cause) {
+  if (!(cause instanceof Error)) return null;
+  const text = redactText(cause.message).replace(/\s+/g, " ").trim();
+  if (!text) return null;
+  const name = cause.name && cause.name !== "Error" ? `${cause.name}: ` : "";
+  return `${name}${text}`;
+}
+function defaultUnavailableMessage(backend, cause) {
+  const detail = underlyingDetail(cause);
+  const suffix = detail ? `
+Underlying error: ${detail}` : "";
+  if (backend === "linux-libsecret") {
+    return `OS secret backend unavailable (linux-libsecret). The Secret Service may be missing or unreachable (for example a sandbox or container blocking the user D-Bus socket, or no session bus).${suffix}
+Install/start a Secret Service (see docs/linux-credential-store.md), run azdo outside the sandbox, or set AZDO_PAT to bypass the keyring.`;
+  }
+  const base = `OS secret backend unavailable (${backend}). Install the platform's credential service and try again.${suffix}`;
   if (backend !== "windows-credential-manager") return base;
   return `${base}
 Over SSH, Windows Credential Manager is not reachable. Store credentials with DPAPI in ~/.azdo instead: \`azdo config set credentialStore dpapi\` (or AZDO_CREDENTIAL_STORE=dpapi), then \`azdo auth login\` again.`;
@@ -790,7 +891,7 @@ Over SSH, Windows Credential Manager is not reachable. Store credentials with DP
 var CredentialStoreUnavailableError = class extends Error {
   backend;
   constructor(backend, cause, message) {
-    super(message ?? defaultUnavailableMessage(backend));
+    super(message ?? defaultUnavailableMessage(backend, cause));
     this.name = "CredentialStoreUnavailableError";
     this.backend = backend;
     if (cause instanceof Error) {
@@ -1189,7 +1290,7 @@ async function deletePat(org) {
   }
   try {
     const { unlinkSync: unlinkSync2 } = await import("fs");
-    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-QPPOTES2.js");
+    const { lockPath: lockPath2 } = await import("./oauth-token-refresh-RLDAAR5D.js");
     unlinkSync2(lockPath2(org));
   } catch {
   }
@@ -1289,8 +1390,8 @@ async function defaultAcquireLock(org, waitMs = DEFAULT_LOCK_WAIT_MS) {
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      const fd = openSync(path4, "wx");
-      closeSync(fd);
+      const fd = openSync2(path4, "wx");
+      closeSync2(fd);
       return {
         release: () => {
           try {
@@ -1433,6 +1534,12 @@ function _resetInFlight() {
 }
 
 export {
+  redactHeaders,
+  redactUrl,
+  redactText,
+  redactBody,
+  initTraceWriter,
+  getActiveTraceWriter,
   CredentialStoreUnavailableError,
   CredentialMissingError,
   CredentialRefreshError,

package/dist/index.js

@@ -13,10 +13,12 @@ import {
   deleteOrgScope,
   deletePat,
   firstPartyShippedScopes,
+  getActiveTraceWriter,
   getConfigValue,
   getOrgScopedValue,
   getPat,
   getStoredCredential,
+  initTraceWriter,
   listKeyringCredentials,
   listOrgsWithStoredPat,
   loadConfig,
@@ -27,6 +29,10 @@ import {
   probeBackend,
   readAuditEvents,
   readTokenResponse,
+  redactBody,
+  redactHeaders,
+  redactText,
+  redactUrl,
   refreshIfNeeded,
   resolveOAuthConfig,
   resolveScopedConfig,
@@ -39,7 +45,7 @@ import {
   tokenResponseToCredential,
   unsetConfigValue,
   unsetOrgScopedValue
-} from "./chunk-MHJ6OBX3.js";
+} from "./chunk-DNOOZIXA.js";
 
 // src/program.ts
 import { Command as Command20 } from "commander";
@@ -55,93 +61,6 @@ var version = pkg.version;
 // src/commands/get-item.ts
 import { Command } from "commander";
 
-// src/services/trace-writer.ts
-import { openSync, writeSync, closeSync } from "fs";
-import { platform } from "os";
-var REDACTED = "[REDACTED]";
-var SENSITIVE_HEADER = /^(authorization|x-.*token)$/i;
-var SENSITIVE_QUERY_PARAM = /^(token|pat)$/i;
-var SENSITIVE_BODY_FIELD = /^(token|accessToken|pat)$/;
-function redactHeaders(headers) {
-  const out = {};
-  for (const [key, value] of Object.entries(headers)) {
-    out[key] = SENSITIVE_HEADER.test(key) ? REDACTED : value;
-  }
-  return out;
-}
-function redactUrl(url) {
-  try {
-    const u = new URL(url);
-    for (const [key] of u.searchParams.entries()) {
-      if (SENSITIVE_QUERY_PARAM.test(key)) {
-        u.searchParams.set(key, REDACTED);
-      }
-    }
-    return u.toString();
-  } catch {
-    return url;
-  }
-}
-var SECRET_ASSIGNMENT = String.raw`["']?\s*[:=]\s*["']?)[^"'\s,;&}]+`;
-var SECRET_IN_TEXT = [
-  [/\b(Bearer|Basic)\s+[\w.~+/=-]{8,}/gi, `$1 ${REDACTED}`],
-  [new RegExp(String.raw`(\b(?:access|refresh|api)[_-]?(?:token|key)\b${SECRET_ASSIGNMENT}`, "gi"), `$1${REDACTED}`],
-  [new RegExp(String.raw`(\b(?:token|pat|password|secret)\b${SECRET_ASSIGNMENT}`, "gi"), `$1${REDACTED}`],
-  [/\beyJ[A-Za-z0-9._~+/=-]{20,}/g, REDACTED],
-  [/\b(?=[A-Za-z0-9]*\d)(?=[A-Za-z0-9]*[A-Za-z])[A-Za-z0-9]{40,}\b/g, REDACTED]
-];
-function redactText(text) {
-  let out = text;
-  for (const [pattern, replacement] of SECRET_IN_TEXT) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-function redactBody(body) {
-  if (body === null) return null;
-  try {
-    const parsed = JSON.parse(body);
-    let changed = false;
-    const redacted = { ...parsed };
-    for (const key of Object.keys(parsed)) {
-      if (SENSITIVE_BODY_FIELD.test(key)) {
-        redacted[key] = REDACTED;
-        changed = true;
-      }
-    }
-    return changed ? JSON.stringify(redacted) : body;
-  } catch {
-    return body;
-  }
-}
-var TraceWriter = class {
-  fd;
-  constructor(filepath) {
-    const mode = platform() === "win32" ? void 0 : 384;
-    this.fd = openSync(filepath, "a", mode);
-  }
-  append(entry) {
-    const line = JSON.stringify(entry) + "\n\n";
-    writeSync(this.fd, line);
-  }
-  close() {
-    closeSync(this.fd);
-  }
-};
-var activeWriter = null;
-function initTraceWriter(filepath) {
-  try {
-    activeWriter = new TraceWriter(filepath);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`Warning: could not open trace file "${filepath}": ${msg}
-`);
-  }
-}
-function getActiveTraceWriter() {
-  return activeWriter;
-}
-
 // src/services/command-helpers.ts
 import { existsSync, readFileSync as readFileSync2 } from "fs";
 var EXIT_CREDENTIAL_STORE_UNAVAILABLE = 4;

package/dist/{oauth-token-refresh-QPPOTES2.js → oauth-token-refresh-RLDAAR5D.js}

@@ -5,7 +5,7 @@ import {
   lockPath,
   locksDir,
   refreshIfNeeded
-} from "./chunk-MHJ6OBX3.js";
+} from "./chunk-DNOOZIXA.js";
 export {
   _resetInFlight,
   classifyRefreshFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azdo-cli",
-  "version": "0.23.0-develop.895",
+  "version": "0.23.0-feature-058-credential-error-cause.897",
   "description": "Azure DevOps CLI tool",
   "type": "module",
   "bin": {