azdo-cli 0.5.0-feature-fixer-and-gitflow-skills.261 → 0.5.0-feature-tech-stack-030-auth-diagnostics.546

package/dist/index.js

@@ -1,7 +1,44 @@
 #!/usr/bin/env node
+import {
+  AZDO_RESOURCE_ID,
+  CredentialMissingError,
+  CredentialStoreUnavailableError,
+  SETTINGS,
+  appendAuthAuditEvent,
+  buildScopeString,
+  copyOrgScope,
+  defaultScopes,
+  deleteOrgScope,
+  deletePat,
+  firstPartyShippedScopes,
+  getConfigValue,
+  getOrgScopedValue,
+  getPat,
+  getStoredCredential,
+  listOrgsWithStoredPat,
+  loadConfig,
+  maskedDisplay,
+  moveOrgScope,
+  normalizePat,
+  openUrl,
+  probeBackend,
+  readAuditEvents,
+  readTokenResponse,
+  refreshIfNeeded,
+  resolveOAuthConfig,
+  resolveScopedConfig,
+  runAuthCodeFlow,
+  setConfigValue,
+  setOrgScopedValue,
+  storeOAuthCredential,
+  storePat,
+  tokenResponseToCredential,
+  unsetConfigValue,
+  unsetOrgScopedValue
+} from "./chunk-XVXMDWQE.js";
 
 // src/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command17 } from "commander";
 
 // src/version.ts
 import { readFileSync } from "fs";
@@ -14,6 +51,78 @@ var version = pkg.version;
 // src/commands/get-item.ts
 import { Command } from "commander";
 
+// src/services/trace-writer.ts
+import { openSync, writeSync, closeSync } from "fs";
+import { platform } from "os";
+var REDACTED = "[REDACTED]";
+var SENSITIVE_HEADER = /^(authorization|x-.*token)$/i;
+var SENSITIVE_QUERY_PARAM = /^(token|pat)$/i;
+var SENSITIVE_BODY_FIELD = /^(token|accessToken|pat)$/;
+function redactHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADER.test(key) ? REDACTED : value;
+  }
+  return out;
+}
+function redactUrl(url) {
+  try {
+    const u = new URL(url);
+    for (const [key] of u.searchParams.entries()) {
+      if (SENSITIVE_QUERY_PARAM.test(key)) {
+        u.searchParams.set(key, REDACTED);
+      }
+    }
+    return u.toString();
+  } catch {
+    return url;
+  }
+}
+function redactBody(body) {
+  if (body === null) return null;
+  try {
+    const parsed = JSON.parse(body);
+    let changed = false;
+    const redacted = { ...parsed };
+    for (const key of Object.keys(parsed)) {
+      if (SENSITIVE_BODY_FIELD.test(key)) {
+        redacted[key] = REDACTED;
+        changed = true;
+      }
+    }
+    return changed ? JSON.stringify(redacted) : body;
+  } catch {
+    return body;
+  }
+}
+var TraceWriter = class {
+  fd;
+  constructor(filepath) {
+    const mode = platform() === "win32" ? void 0 : 384;
+    this.fd = openSync(filepath, "a", mode);
+  }
+  append(entry) {
+    const line = JSON.stringify(entry) + "\n\n";
+    writeSync(this.fd, line);
+  }
+  close() {
+    closeSync(this.fd);
+  }
+};
+var activeWriter = null;
+function initTraceWriter(filepath) {
+  try {
+    activeWriter = new TraceWriter(filepath);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Warning: could not open trace file "${filepath}": ${msg}
+`);
+  }
+}
+function getActiveTraceWriter() {
+  return activeWriter;
+}
+
 // src/services/azdo-client.ts
 var DEFAULT_FIELDS = [
   "System.Title",
@@ -26,16 +135,59 @@ var DEFAULT_FIELDS = [
   "System.AreaPath",
   "System.IterationPath"
 ];
-function authHeaders(pat) {
-  const token = Buffer.from(`:${pat}`).toString("base64");
+function authHeaders(credentialOrPat) {
+  if (typeof credentialOrPat === "string") {
+    const token2 = Buffer.from(`:${credentialOrPat}`).toString("base64");
+    return { Authorization: `Basic ${token2}` };
+  }
+  if (credentialOrPat.kind === "oauth") {
+    return { Authorization: `Bearer ${credentialOrPat.pat}` };
+  }
+  const token = Buffer.from(`:${credentialOrPat.pat}`).toString("base64");
   return { Authorization: `Basic ${token}` };
 }
+async function fetchRaw(url, init) {
+  let response;
+  try {
+    response = await fetch(url, init);
+  } catch (err) {
+    throw new Error(`NETWORK_ERROR: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+  }
+  const body = await response.text();
+  return { status: response.status, body };
+}
 async function fetchWithErrors(url, init) {
+  const writer = getActiveTraceWriter();
   let response;
   try {
     response = await fetch(url, init);
-  } catch {
-    throw new Error("NETWORK_ERROR");
+  } catch (err) {
+    throw new Error("NETWORK_ERROR", { cause: err });
+  }
+  if (writer) {
+    const reqHeaders = redactHeaders(init.headers ?? {});
+    const reqBody = typeof init.body === "string" ? redactBody(init.body) : null;
+    let responseBody = "";
+    const clone = response.clone();
+    try {
+      responseBody = await clone.text();
+    } catch {
+    }
+    const respHeaders = {};
+    response.headers.forEach((v, k) => {
+      respHeaders[k] = v;
+    });
+    const entry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      method: (init.method ?? "GET").toUpperCase(),
+      url: redactUrl(url),
+      requestHeaders: reqHeaders,
+      requestBody: reqBody ?? null,
+      responseStatus: response.status,
+      responseHeaders: respHeaders,
+      responseBody
+    };
+    writer.append(entry);
   }
   if (response.status === 401) throw new Error("AUTH_FAILED");
   if (response.status === 403) throw new Error("PERMISSION_DENIED");
@@ -48,6 +200,10 @@ async function fetchWithErrors(url, init) {
     }
     throw new Error(`NOT_FOUND${detail}`);
   }
+  const contentType = response.headers?.get("content-type") ?? "";
+  if (contentType.toLowerCase().startsWith("text/html")) {
+    throw new Error("AUTH_FAILED");
+  }
   return response;
 }
 async function readResponseMessage(response) {
@@ -90,9 +246,9 @@ function buildExtraFields(fields, requested) {
   }
   return Object.keys(result).length > 0 ? result : null;
 }
-function writeHeaders(pat) {
+function writeHeaders(cred) {
   return {
-    ...authHeaders(pat),
+    ...authHeaders(cred),
     "Content-Type": "application/json-patch+json"
   };
 }
@@ -147,13 +303,13 @@ async function readWriteResponse(response, errorCode) {
     fields: data.fields
   };
 }
-async function getWorkItemFields(context, id, pat) {
+async function getWorkItemFields(context, id, cred) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
   url.searchParams.set("$expand", "all");
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   if (response.status === 400) {
     const serverMessage = await readResponseMessage(response);
     if (serverMessage) {
@@ -188,10 +344,10 @@ function buildWorkItemUrl(context, id, options = {}) {
   }
   return url;
 }
-async function fetchWorkItemResponse(context, id, pat, options = {}) {
+async function fetchWorkItemResponse(context, id, cred, options = {}) {
   const response = await fetchWithErrors(
     buildWorkItemUrl(context, id, options).toString(),
-    { headers: authHeaders(pat) }
+    { headers: authHeaders(cred) }
   );
   if (response.status === 400) {
     const serverMessage = await readResponseMessage(response);
@@ -204,28 +360,66 @@ async function fetchWorkItemResponse(context, id, pat, options = {}) {
   }
   return await response.json();
 }
-async function getWorkItem(context, id, pat, extraFields) {
+async function getOrgFieldNames(context, cred) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/wit/fields`
+  );
+  url.searchParams.set("api-version", "7.1");
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
+  }
+  const data = await response.json();
+  return (data.value ?? []).map((f) => f.referenceName);
+}
+function buildCombinedDescription(fields) {
+  const parts = [];
+  if (fields["System.Description"]) {
+    parts.push({ label: "Description", value: fields["System.Description"] });
+  }
+  if (fields["Microsoft.VSTS.Common.AcceptanceCriteria"]) {
+    parts.push({ label: "Acceptance Criteria", value: fields["Microsoft.VSTS.Common.AcceptanceCriteria"] });
+  }
+  if (fields["Microsoft.VSTS.TCM.ReproSteps"]) {
+    parts.push({ label: "Repro Steps", value: fields["Microsoft.VSTS.TCM.ReproSteps"] });
+  }
+  if (parts.length === 0) return null;
+  if (parts.length === 1) return parts[0].value;
+  return parts.map((p) => `<h3>${p.label}</h3>${p.value}`).join("");
+}
+async function fetchWorkItemWithFallback(context, id, cred, normalizedExtraFields) {
+  try {
+    const data = await fetchWorkItemResponse(context, id, cred, {
+      fields: normalizeFieldList([...DEFAULT_FIELDS, ...normalizedExtraFields])
+    });
+    return { data, effectiveExtraFields: normalizedExtraFields };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!msg.includes("TF51535")) throw err;
+    const orgFieldNames = await getOrgFieldNames(context, cred);
+    const orgFieldsLower = new Set(orgFieldNames.map((n) => n.toLowerCase()));
+    const missing = normalizedExtraFields.filter((f) => !orgFieldsLower.has(f.toLowerCase()));
+    const effectiveExtraFields = normalizedExtraFields.filter((f) => orgFieldsLower.has(f.toLowerCase()));
+    for (const f of missing) {
+      process.stderr.write(`azdo: warning: field '${f}' does not exist in organization '${context.org}' and was skipped
+`);
+    }
+    const data = await fetchWorkItemResponse(context, id, cred, {
+      fields: normalizeFieldList([...DEFAULT_FIELDS, ...effectiveExtraFields])
+    });
+    return { data, effectiveExtraFields };
+  }
+}
+async function getWorkItem(context, id, cred, extraFields) {
   const normalizedExtraFields = extraFields ? normalizeFieldList(extraFields) : [];
-  const data = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, pat, {
-    fields: normalizeFieldList([...DEFAULT_FIELDS, ...normalizedExtraFields])
-  }) : await fetchWorkItemResponse(context, id, pat, { includeRelations: true });
-  const relationsData = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, pat, { includeRelations: true }) : data;
-  const descriptionParts = [];
-  if (data.fields["System.Description"]) {
-    descriptionParts.push({ label: "Description", value: data.fields["System.Description"] });
-  }
-  if (data.fields["Microsoft.VSTS.Common.AcceptanceCriteria"]) {
-    descriptionParts.push({ label: "Acceptance Criteria", value: data.fields["Microsoft.VSTS.Common.AcceptanceCriteria"] });
-  }
-  if (data.fields["Microsoft.VSTS.TCM.ReproSteps"]) {
-    descriptionParts.push({ label: "Repro Steps", value: data.fields["Microsoft.VSTS.TCM.ReproSteps"] });
-  }
-  let combinedDescription = null;
-  if (descriptionParts.length === 1) {
-    combinedDescription = descriptionParts.at(0)?.value ?? null;
-  } else if (descriptionParts.length > 1) {
-    combinedDescription = descriptionParts.map((p) => `<h3>${p.label}</h3>${p.value}`).join("");
+  let effectiveExtraFields = normalizedExtraFields;
+  let data;
+  if (normalizedExtraFields.length > 0) {
+    ({ data, effectiveExtraFields } = await fetchWorkItemWithFallback(context, id, cred, normalizedExtraFields));
+  } else {
+    data = await fetchWorkItemResponse(context, id, cred, { includeRelations: true });
   }
+  const relationsData = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, cred, { includeRelations: true }) : data;
   return {
     id: data.id,
     rev: data.rev,
@@ -233,21 +427,21 @@ async function getWorkItem(context, id, pat, extraFields) {
     state: data.fields["System.State"],
     type: data.fields["System.WorkItemType"],
     assignedTo: data.fields["System.AssignedTo"]?.displayName ?? null,
-    description: combinedDescription,
+    description: buildCombinedDescription(data.fields),
     areaPath: data.fields["System.AreaPath"],
     iterationPath: data.fields["System.IterationPath"],
     url: data._links.html.href,
-    extraFields: normalizedExtraFields.length > 0 ? buildExtraFields(data.fields, normalizedExtraFields) : null,
+    extraFields: effectiveExtraFields.length > 0 ? buildExtraFields(data.fields, effectiveExtraFields) : null,
     attachments: extractAttachments(relationsData.relations)
   };
 }
-async function getWorkItemFieldValue(context, id, pat, fieldName) {
+async function getWorkItemFieldValue(context, id, cred, fieldName) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
   url.searchParams.set("fields", fieldName);
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   if (response.status === 400) {
     const serverMessage = await readResponseMessage(response);
     if (serverMessage) {
@@ -264,13 +458,13 @@ async function getWorkItemFieldValue(context, id, pat, fieldName) {
   }
   return stringifyFieldValue(value);
 }
-async function listWorkItemComments(context, id, pat) {
+async function listWorkItemComments(context, id, cred) {
   const comments = [];
   let continuationToken = null;
   do {
     const response = await fetchWithErrors(
       buildWorkItemCommentsListUrl(context, id, continuationToken ?? void 0).toString(),
-      { headers: authHeaders(pat) }
+      { headers: authHeaders(cred) }
     );
     if (!response.ok) {
       throw new Error(`HTTP_${response.status}`);
@@ -287,13 +481,13 @@ async function listWorkItemComments(context, id, pat) {
     comments
   };
 }
-async function addWorkItemComment(context, id, pat, text, format = "html") {
+async function addWorkItemComment(context, id, cred, text, format = "html") {
   const url = buildWorkItemCommentsUrl(context, id);
   url.searchParams.set("format", format);
   const response = await fetchWithErrors(url.toString(), {
     method: "POST",
     headers: {
-      ...authHeaders(pat),
+      ...authHeaders(cred),
       "Content-Type": "application/json"
     },
     body: JSON.stringify({ text })
@@ -315,8 +509,8 @@ async function addWorkItemComment(context, id, pat, text, format = "html") {
     url: data.url ?? null
   };
 }
-async function updateWorkItem(context, id, pat, fieldName, operations) {
-  const result = await applyWorkItemPatch(context, id, pat, operations);
+async function updateWorkItem(context, id, cred, fieldName, operations) {
+  const result = await applyWorkItemPatch(context, id, cred, operations);
   const title = result.fields["System.Title"];
   const lastOp = operations.at(-1);
   const fieldValue = lastOp?.value ?? null;
@@ -328,32 +522,32 @@ async function updateWorkItem(context, id, pat, fieldName, operations) {
     fieldValue
   };
 }
-async function createWorkItem(context, workItemType, pat, operations) {
+async function createWorkItem(context, workItemType, cred, operations) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/$${encodeURIComponent(workItemType)}`
   );
   url.searchParams.set("api-version", "7.1");
   const response = await fetchWithErrors(url.toString(), {
     method: "POST",
-    headers: writeHeaders(pat),
+    headers: writeHeaders(cred),
     body: JSON.stringify(operations)
   });
   return readWriteResponse(response, "CREATE_REJECTED");
 }
-async function applyWorkItemPatch(context, id, pat, operations) {
+async function applyWorkItemPatch(context, id, cred, operations) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
   const response = await fetchWithErrors(url.toString(), {
     method: "PATCH",
-    headers: writeHeaders(pat),
+    headers: writeHeaders(cred),
     body: JSON.stringify(operations)
   });
   return readWriteResponse(response, "UPDATE_REJECTED");
 }
-async function downloadAttachment(url, pat) {
-  const response = await fetchWithErrors(url, { headers: authHeaders(pat) });
+async function downloadAttachment(url, cred) {
+  const response = await fetchWithErrors(url, { headers: authHeaders(cred) });
   if (!response.ok) {
     throw new Error(`HTTP_${response.status}`);
   }
@@ -365,323 +559,124 @@ import { createInterface } from "readline";
 import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname2, join } from "path";
 
-// src/services/credential-store.ts
-import { Entry } from "@napi-rs/keyring";
-
-// src/types/credential.ts
-var CredentialStoreUnavailableError = class extends Error {
-  backend;
-  constructor(backend, cause) {
-    super(`OS secret backend unavailable (${backend}). Install the platform's credential service and try again.`);
-    this.name = "CredentialStoreUnavailableError";
-    this.backend = backend;
+// src/services/oauth-device-code.ts
+var DeviceCodeFlowError = class extends Error {
+  reason;
+  constructor(reason, message, cause) {
+    super(message);
+    this.name = "DeviceCodeFlowError";
+    this.reason = reason;
     if (cause instanceof Error) {
       this.cause = cause;
     }
   }
 };
-
-// src/services/audit-log.ts
-import fs from "fs";
-import os from "os";
-import path from "path";
-function getAuditLogPath() {
-  return path.join(os.homedir(), ".azdo", "audit.log");
-}
-function ensureDirWithPerms(dir) {
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true, mode: 448 });
-    return;
-  }
+var MIN_INTERVAL_SEC = 5;
+async function defaultSleep(ms) {
+  await new Promise((r) => setTimeout(r, ms));
+}
+async function requestDeviceCode(oauthConfig, fetchFn) {
+  const body = new URLSearchParams({
+    client_id: oauthConfig.clientId,
+    scope: buildScopeString(oauthConfig.scopes)
+  });
+  const response = await fetchFn(oauthConfig.deviceCodeEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: body.toString()
+  });
+  const text = await response.text();
+  let parsed;
   try {
-    fs.chmodSync(dir, 448);
+    parsed = JSON.parse(text);
   } catch {
+    throw new DeviceCodeFlowError("idp-error", `device-code endpoint returned non-JSON HTTP ${response.status}: ${text.slice(0, 200)}`);
   }
+  if (!response.ok) {
+    const err = parsed;
+    const code = err.error ?? "unknown";
+    const desc = err.error_description ? `: ${err.error_description}` : "";
+    throw new DeviceCodeFlowError(
+      "idp-error",
+      `device-code endpoint rejected request (${response.status}): ${code}${desc}`
+    );
+  }
+  return parsed;
 }
-function ensureFileWithPerms(file) {
-  if (!fs.existsSync(file)) {
-    fs.writeFileSync(file, "", { mode: 384 });
-    return;
+async function classifyDeviceTokenResponse(response) {
+  if (response.ok) {
+    return { kind: "success", token: await readTokenResponse(response) };
   }
+  const text = await response.text();
+  let parsed;
   try {
-    fs.chmodSync(file, 384);
+    parsed = JSON.parse(text);
   } catch {
+    throw new DeviceCodeFlowError("idp-error", `non-JSON HTTP ${response.status}: ${text.slice(0, 200)}`);
   }
-}
-function appendAuthAuditEvent(input) {
-  const auditLog = getAuditLogPath();
-  const dir = path.dirname(auditLog);
-  ensureDirWithPerms(dir);
-  ensureFileWithPerms(auditLog);
-  const record = {
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    event: input.event,
-    org: input.org,
-    backend: input.backend,
-    ...input.masked_pat !== void 0 ? { masked_pat: input.masked_pat } : {}
-  };
-  fs.appendFileSync(auditLog, `${JSON.stringify(record)}
-`);
-}
-function readAuditEvents() {
-  const auditLog = getAuditLogPath();
-  if (!fs.existsSync(auditLog)) {
-    return [];
-  }
-  const contents = fs.readFileSync(auditLog, "utf8");
-  const out = [];
-  for (const line of contents.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (parsed && typeof parsed === "object" && typeof parsed.event === "string") {
-        out.push(parsed);
-      }
-    } catch {
-    }
+  const errCode = parsed.error ?? "";
+  if (errCode === "authorization_pending") return { kind: "pending" };
+  if (errCode === "slow_down") return { kind: "slow_down" };
+  if (errCode === "expired_token") {
+    throw new DeviceCodeFlowError("expired_token", "device code expired before authorisation completed");
   }
-  return out;
-}
-
-// src/services/config-store.ts
-import fs2 from "fs";
-import path2 from "path";
-import os2 from "os";
-var SETTINGS = [
-  {
-    key: "org",
-    description: "Azure DevOps organization name",
-    type: "string",
-    example: "mycompany",
-    required: true
-  },
-  {
-    key: "project",
-    description: "Azure DevOps project name",
-    type: "string",
-    example: "MyProject",
-    required: true
-  },
-  {
-    key: "fields",
-    description: "Extra work item fields to include (comma-separated reference names)",
-    type: "string[]",
-    example: "System.Tags,Custom.Priority",
-    required: false
-  },
-  {
-    key: "markdown",
-    description: "Convert rich text fields to markdown on display",
-    type: "boolean",
-    example: "true",
-    required: false
+  if (errCode === "access_denied") {
+    throw new DeviceCodeFlowError("access_denied", "authorisation denied by user");
   }
-];
-var VALID_KEYS = SETTINGS.map((s) => s.key);
-function getConfigPath() {
-  return path2.join(os2.homedir(), ".azdo", "config.json");
+  const desc = parsed.error_description ? `: ${parsed.error_description}` : "";
+  throw new DeviceCodeFlowError(
+    "idp-error",
+    `IdP rejected device-token poll (${response.status}): ${errCode}${desc}`
+  );
 }
-function loadConfig() {
-  const configPath = getConfigPath();
-  let raw;
-  try {
-    raw = fs2.readFileSync(configPath, "utf-8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return {};
+async function pollForDeviceToken(deviceCode, oauthConfig, initialIntervalSec, expiresAtMs, deps) {
+  const fetchFn = deps.fetch ?? fetch;
+  const now = deps.now ?? (() => Date.now());
+  const sleep2 = deps.sleep ?? defaultSleep;
+  let intervalSec = Math.max(MIN_INTERVAL_SEC, initialIntervalSec);
+  for (; ; ) {
+    if (now() >= expiresAtMs) {
+      throw new DeviceCodeFlowError("expired_token", "device-code flow expired before authorisation completed");
     }
-    throw err;
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    process.stderr.write(`Warning: Config file ${configPath} contains invalid JSON. Using defaults.
-`);
-    return {};
-  }
-}
-function saveConfig(config) {
-  const configPath = getConfigPath();
-  const dir = path2.dirname(configPath);
-  fs2.mkdirSync(dir, { recursive: true });
-  fs2.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-}
-function validateKey(key) {
-  if (!VALID_KEYS.includes(key)) {
-    throw new Error(`Unknown setting key "${key}". Valid keys: ${VALID_KEYS.join(", ")}`);
-  }
-}
-function getConfigValue(key) {
-  validateKey(key);
-  const config = loadConfig();
-  return config[key];
-}
-function setConfigValue(key, value) {
-  validateKey(key);
-  const config = loadConfig();
-  if (value === "") {
-    delete config[key];
-  } else if (key === "markdown") {
-    if (value !== "true" && value !== "false") {
-      throw new Error(`Invalid value "${value}" for markdown. Must be "true" or "false".`);
+    await sleep2(intervalSec * 1e3);
+    const body = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: oauthConfig.clientId,
+      device_code: deviceCode
+    });
+    const response = await fetchFn(oauthConfig.tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: body.toString()
+    });
+    const outcome = await classifyDeviceTokenResponse(response);
+    if (outcome.kind === "success") return outcome.token;
+    if (outcome.kind === "slow_down") {
+      intervalSec += 5;
     }
-    config.markdown = value === "true";
-  } else if (key === "fields") {
-    config.fields = value.split(",").map((s) => s.trim());
-  } else {
-    config[key] = value;
   }
-  saveConfig(config);
-}
-function unsetConfigValue(key) {
-  validateKey(key);
-  const config = loadConfig();
-  delete config[key];
-  saveConfig(config);
 }
+async function runDeviceCodeFlow(org, oauthConfig, deps = {}) {
+  const fetchFn = deps.fetch ?? fetch;
+  const now = deps.now ?? (() => Date.now());
+  const writePrompt = deps.writePrompt ?? ((m) => {
+    process.stderr.write(m);
+  });
+  const dc = await requestDeviceCode(oauthConfig, fetchFn);
+  const expiryMin = Math.round(dc.expires_in / 60);
+  writePrompt(
+    `
+To authenticate, open ${dc.verification_uri} in a browser and enter the code:
 
-// src/services/auth-masking.ts
-var VISIBLE_CHARS = 5;
-function maskedDisplay(pat) {
-  if (pat.length <= VISIBLE_CHARS * 2) {
-    return pat;
-  }
-  const hiddenCount = pat.length - VISIBLE_CHARS * 2;
-  return pat.slice(0, VISIBLE_CHARS) + "*".repeat(hiddenCount) + pat.slice(-VISIBLE_CHARS);
-}
-function normalizePat(rawPat) {
-  const trimmedPat = rawPat.trim();
-  return trimmedPat.length > 0 ? trimmedPat : null;
-}
+    ${dc.user_code}
 
-// src/services/credential-store.ts
-var SERVICE = "azdo-cli";
-var LEGACY_ACCOUNT = "pat";
-function accountFor(org) {
-  return `pat:${org}`;
-}
-function probeBackend() {
-  switch (process.platform) {
-    case "win32":
-      return "windows-credential-manager";
-    case "darwin":
-      return "macos-keychain";
-    case "linux":
-      return "linux-libsecret";
-    default:
-      return "unknown";
-  }
-}
-function wrapUnavailable(fn) {
-  try {
-    return fn();
-  } catch (err) {
-    throw new CredentialStoreUnavailableError(probeBackend(), err);
-  }
-}
-var legacyUnsetNoticeEmitted = false;
-function emitLegacyUnsetNoticeOnce() {
-  if (legacyUnsetNoticeEmitted) return;
-  legacyUnsetNoticeEmitted = true;
-  process.stderr.write(
-    'A legacy PAT exists in the OS vault from a previous azdo-cli version, but no "org" is set in config. Run `azdo auth --org <name>` to re-store it under the per-org key, then `azdo clear-pat` to remove the legacy slot.\n'
+Waiting for authorisation (expires in ${expiryMin} min)\u2026
+`
   );
-}
-async function maybeMigrateLegacy(targetOrg) {
-  const config = loadConfig();
-  if (!config.org || config.org !== targetOrg) {
-    if (!config.org) {
-      let legacyExists;
-      try {
-        const legacyEntry2 = new Entry(SERVICE, LEGACY_ACCOUNT);
-        legacyExists = legacyEntry2.getPassword() !== null;
-      } catch {
-        legacyExists = false;
-      }
-      if (legacyExists) {
-        emitLegacyUnsetNoticeOnce();
-      }
-    }
-    return null;
-  }
-  const newEntry = new Entry(SERVICE, accountFor(targetOrg));
-  const existingNew = wrapUnavailable(() => newEntry.getPassword());
-  if (existingNew !== null) {
-    return null;
-  }
-  const legacyEntry = new Entry(SERVICE, LEGACY_ACCOUNT);
-  const legacy = wrapUnavailable(() => legacyEntry.getPassword());
-  if (legacy === null) {
-    return null;
-  }
-  wrapUnavailable(() => {
-    newEntry.setPassword(legacy);
-    legacyEntry.deletePassword();
-  });
-  appendAuthAuditEvent({
-    event: "auth.store",
-    org: targetOrg,
-    backend: probeBackend(),
-    masked_pat: maskedDisplay(legacy)
-  });
-  process.stderr.write(`Migrated legacy PAT to org ${targetOrg}.
-`);
-  return legacy;
-}
-async function getPat(org) {
-  const entry = new Entry(SERVICE, accountFor(org));
-  const value = wrapUnavailable(() => entry.getPassword());
-  if (value !== null) {
-    return value;
-  }
-  const migrated = await maybeMigrateLegacy(org);
-  return migrated;
-}
-async function storePat(org, pat) {
-  const entry = new Entry(SERVICE, accountFor(org));
-  wrapUnavailable(() => entry.setPassword(pat));
-  appendAuthAuditEvent({
-    event: "auth.store",
-    org,
-    backend: probeBackend(),
-    masked_pat: maskedDisplay(pat)
-  });
-}
-async function deletePat(org) {
-  const entry = new Entry(SERVICE, accountFor(org));
-  const existing = wrapUnavailable(() => entry.getPassword());
-  if (existing === null) {
-    return false;
-  }
-  wrapUnavailable(() => entry.deletePassword());
-  appendAuthAuditEvent({
-    event: "auth.delete",
-    org,
-    backend: probeBackend(),
-    masked_pat: maskedDisplay(existing)
-  });
-  return true;
-}
-async function listOrgsWithStoredPat() {
-  const seen = /* @__PURE__ */ new Set();
-  for (const ev of readAuditEvents()) {
-    if (ev.event === "auth.store") {
-      seen.add(ev.org);
-    } else if (ev.event === "auth.delete") {
-      seen.delete(ev.org);
-    }
-  }
-  const present = [];
-  for (const org of seen) {
-    const entry = new Entry(SERVICE, accountFor(org));
-    const value = wrapUnavailable(() => entry.getPassword());
-    if (value !== null) {
-      present.push(org);
-    }
-  }
-  present.sort((a, b) => a.localeCompare(b));
-  return present;
+  const expiresAtMs = now() + dc.expires_in * 1e3;
+  const token = await pollForDeviceToken(dc.device_code, oauthConfig, dc.interval, expiresAtMs, deps);
+  const credential = tokenResponseToCredential(org, oauthConfig, token, now());
+  return { credential, flowUsed: "device-code" };
 }
 
 // src/services/auth.ts
@@ -737,7 +732,7 @@ function findDotEnvPat(startDir = process.cwd()) {
     if (existsSync(envFile)) {
       const contents = readFileSync2(envFile, "utf8");
       for (const line of contents.split("\n")) {
-        const match = line.match(/^AZDO_PAT\s*=\s*(.+)$/);
+        const match = line.match(/^AZDO_PAT\s*=([^\n\r]+)$/);
         if (match) {
           const value = match[1].trim().replace(/^["']|["']$/g, "");
           if (value.length > 0) return value;
@@ -750,29 +745,36 @@ function findDotEnvPat(startDir = process.cwd()) {
   }
   return null;
 }
-async function resolvePat(org) {
+async function resolveAuthCredential(org) {
   const envPat = process.env.AZDO_PAT;
   if (envPat && envPat.length > 0) {
-    return { pat: envPat, source: "env" };
+    return { pat: envPat, source: "env", kind: "pat" };
   }
-  const storedPat = await getPat(org);
-  if (storedPat !== null) {
-    return { pat: storedPat, source: "credential-store" };
+  const stored = await getStoredCredential(org);
+  if (stored !== null) {
+    if (stored.kind === "pat") {
+      return { pat: stored.token, source: "credential-store", kind: "pat" };
+    }
+    const fresh = await refreshIfNeeded(org, stored);
+    return {
+      pat: fresh.accessToken,
+      source: "credential-store",
+      kind: "oauth",
+      accountId: fresh.accountId
+    };
   }
   const dotEnvPat = findDotEnvPat();
   if (dotEnvPat !== null) {
-    return { pat: dotEnvPat, source: "env" };
+    return { pat: dotEnvPat, source: "env", kind: "pat" };
   }
   return null;
 }
-async function requirePat(org) {
-  const cred = await resolvePat(org);
+async function requireAuthCredential(org) {
+  const cred = await resolveAuthCredential(org);
   if (cred !== null) {
     return cred;
   }
-  throw new Error(
-    `No PAT available for org "${org}". Set AZDO_PAT environment variable or run \`azdo auth --org ${org}\`.`
-  );
+  throw new CredentialMissingError(org);
 }
 async function validatePatAgainstAzdo(pat, org) {
   const url = `https://dev.azure.com/${encodeURIComponent(org)}/_apis/projects?$top=1&api-version=7.1`;
@@ -791,51 +793,309 @@ async function validatePatAgainstAzdo(pat, org) {
   }
   throw new Error(`Azure DevOps returned HTTP ${response.status} while validating PAT for org "${org}".`);
 }
+var LOGIN_FAILURE_REASONS = /* @__PURE__ */ new Set([
+  "user-cancelled",
+  "port-conflict",
+  "state-mismatch",
+  "redirect-mismatch",
+  "idp-error",
+  "timeout",
+  "expired_token",
+  "access_denied"
+]);
+function extractLoginFailureReason(err) {
+  if (typeof err === "object" && err !== null && "reason" in err) {
+    const r = err.reason;
+    if (typeof r === "string" && LOGIN_FAILURE_REASONS.has(r)) {
+      return r;
+    }
+  }
+  return "unknown";
+}
+async function loginWithOAuth(org, opts = {}) {
+  const oauthConfig = resolveOAuthConfig({
+    clientIdOverride: opts.clientIdOverride,
+    tenantIdOverride: opts.tenantIdOverride,
+    scopesOverride: opts.scopesOverride
+  });
+  const isHeadlessRuntime = () => {
+    if (opts.forceHeadless) return true;
+    if (process.platform === "linux") {
+      return !process.env.DISPLAY || process.env.DISPLAY.length === 0;
+    }
+    return false;
+  };
+  const useDeviceCode = opts.flow === "device-code" || opts.flow !== "auth-code" && isHeadlessRuntime();
+  appendAuthAuditEvent({
+    event: "oauth-login-started",
+    org,
+    backend: probeBackend(),
+    flow: useDeviceCode ? "device-code" : "auth-code",
+    clientIdSource: oauthConfig.clientIdSource
+  });
+  let credential;
+  let flowUsed;
+  try {
+    if (useDeviceCode) {
+      const r = await runDeviceCodeFlow(org, oauthConfig);
+      credential = r.credential;
+      flowUsed = "device-code";
+    } else {
+      const r = await runAuthCodeFlow(org, oauthConfig);
+      credential = r.credential;
+      flowUsed = "auth-code";
+    }
+  } catch (err) {
+    appendAuthAuditEvent({
+      event: "oauth-login-failed",
+      org,
+      backend: probeBackend(),
+      flow: useDeviceCode ? "device-code" : "auth-code",
+      reason: extractLoginFailureReason(err)
+    });
+    throw err;
+  }
+  await storeOAuthCredential(org, credential);
+  appendAuthAuditEvent({
+    event: "oauth-login-success",
+    org,
+    backend: probeBackend(),
+    flow: flowUsed,
+    clientIdSource: oauthConfig.clientIdSource,
+    accountId: credential.accountId,
+    scope: credential.scope,
+    tokenLifetimeSec: credential.expiresAt - credential.issuedAt
+  });
+  return {
+    org,
+    kind: "oauth",
+    accountId: credential.accountId,
+    expiresAt: credential.expiresAt,
+    scope: credential.scope,
+    flowUsed
+  };
+}
+async function logout(opts = {}) {
+  if (opts.all) {
+    const orgs = await listOrgsWithStoredPat();
+    const removed = [];
+    for (const o of orgs) {
+      const cred2 = await getStoredCredential(o);
+      const ok2 = await deletePat(o);
+      if (ok2 && cred2 !== null) {
+        removed.push({ org: o, kind: cred2.kind });
+      }
+    }
+    return { removed };
+  }
+  if (!opts.org) {
+    throw new Error("logout requires an org or --all");
+  }
+  const cred = await getStoredCredential(opts.org);
+  const ok = await deletePat(opts.org);
+  return { removed: ok && cred !== null ? [{ org: opts.org, kind: cred.kind }] : [] };
+}
+async function status() {
+  const orgs = await listOrgsWithStoredPat();
+  const out = [];
+  for (const org of orgs) {
+    const cred = await getStoredCredential(org);
+    if (cred === null) continue;
+    if (cred.kind === "pat") {
+      out.push({ org, kind: "pat", backend: probeBackend() });
+    } else {
+      out.push({
+        org,
+        kind: "oauth",
+        accountId: cred.accountId,
+        expiresAt: cred.expiresAt,
+        scope: cred.scope,
+        backend: probeBackend()
+      });
+    }
+  }
+  return { orgs: out };
+}
+
+// src/services/git-remote.ts
+import { execFileSync } from "child_process";
+import fs from "fs";
+import path from "path";
+
+// src/services/remote-warning.ts
+var warned = false;
+function buildWarning(remoteName) {
+  return `azdo: warning: ${remoteName} includes embedded credentials; consider removing them with 'git remote set-url ${remoteName} <clean-url>'
+`;
+}
+function noticeCredentialBearingRemote(remoteName = "origin") {
+  if (warned) {
+    return;
+  }
+  warned = true;
+  try {
+    process.stderr.write(buildWarning(remoteName));
+  } catch {
+  }
+}
 
 // src/services/git-remote.ts
-import { execSync } from "child_process";
+var GIT_BINARY = (() => {
+  const known = process.platform === "win32" ? [String.raw`C:\Program Files\Git\bin\git.exe`, String.raw`C:\Program Files (x86)\Git\bin\git.exe`] : ["/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"];
+  return known.find((p) => {
+    try {
+      execFileSync(p, ["--version"], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }) ?? "git";
+})();
 var patterns = [
-  // HTTPS (current): https://dev.azure.com/{org}/{project}/_git/{repo}
-  /^https?:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)$/,
-  // HTTPS (legacy + DefaultCollection): https://{org}.visualstudio.com/DefaultCollection/{project}/_git/{repo}
-  /^https?:\/\/([^.]+)\.visualstudio\.com\/DefaultCollection\/([^/]+)\/_git\/([^/]+)$/,
-  // HTTPS (legacy): https://{org}.visualstudio.com/{project}/_git/{repo}
-  /^https?:\/\/([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+)$/,
-  // SSH (current): git@ssh.dev.azure.com:v3/{org}/{project}/{repo}
-  /^git@ssh\.dev\.azure\.com:v3\/([^/]+)\/([^/]+)\/([^/]+)$/,
-  // SSH (legacy): {org}@vs-ssh.visualstudio.com:v3/{org}/{project}/{repo}
-  /^[^@]+@vs-ssh\.visualstudio\.com:v3\/([^/]+)\/([^/]+)\/([^/]+)$/
+  // HTTPS (current): https://[user[:token]@]dev.azure.com/{org}/{project}/_git/{repo}[.git]
+  /^https?:\/\/(?:[^@/]+@)?dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
+  // HTTPS (legacy + DefaultCollection): https://[user[:token]@]{org}.visualstudio.com/DefaultCollection/{project}/_git/{repo}[.git]
+  /^https?:\/\/(?:[^@/]+@)?([^.]+)\.visualstudio\.com\/DefaultCollection\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
+  // HTTPS (legacy): https://[user[:token]@]{org}.visualstudio.com/{project}/_git/{repo}[.git]
+  /^https?:\/\/(?:[^@/]+@)?([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
+  // SSH (current): git@ssh.dev.azure.com:v3/{org}/{project}/{repo}[.git]
+  /^git@ssh\.dev\.azure\.com:v3\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?$/,
+  // SSH (legacy): {org}@vs-ssh.visualstudio.com:v3/{org}/{project}/{repo}[.git]
+  /^[^@]+@vs-ssh\.visualstudio\.com:v3\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?$/
 ];
-function parseAzdoRemote(url) {
+var httpsEmbeddedSecret = /^https?:\/\/[^:@/]+:[^@/]+@/;
+function parseSingleRemoteLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return null;
+  const tabIdx = trimmed.indexOf("	");
+  if (tabIdx === -1) return null;
+  const remoteName = trimmed.slice(0, tabIdx);
+  const afterTab = trimmed.slice(tabIdx + 1);
+  const urlEnd = afterTab.lastIndexOf(" (");
+  const url = urlEnd === -1 ? afterTab : afterTab.slice(0, urlEnd);
+  return { remoteName, url };
+}
+function matchAzdoRemote(remoteName, url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
-    if (match) {
-      const project = match[2];
-      if (/^DefaultCollection$/i.test(project)) {
-        return { org: match[1], project: "" };
+    if (!match) continue;
+    const project = match[2];
+    if (/^DefaultCollection$/i.test(project)) return null;
+    return { remoteName, org: match[1], project, hasEmbeddedSecret: httpsEmbeddedSecret.test(url) };
+  }
+  return null;
+}
+function parseAllAzdoRemotes(output) {
+  const seen = /* @__PURE__ */ new Set();
+  const results = [];
+  for (const line of output.split("\n")) {
+    const parsed = parseSingleRemoteLine(line);
+    if (!parsed) continue;
+    const { remoteName, url } = parsed;
+    if (seen.has(remoteName)) continue;
+    const candidate = matchAzdoRemote(remoteName, url);
+    if (candidate) {
+      seen.add(remoteName);
+      results.push(candidate);
+    }
+  }
+  return results;
+}
+function selectRemote(candidates) {
+  if (candidates.length === 0) {
+    throw new Error("No Azure DevOps remote found. Provide --org and --project explicitly.");
+  }
+  const origin = candidates.find((c) => c.remoteName === "origin");
+  if (origin) return origin;
+  if (candidates.length === 1) return candidates[0];
+  const first = candidates[0];
+  const allSame = candidates.every(
+    (c) => c.org.toLowerCase() === first.org.toLowerCase() && c.project.toLowerCase() === first.project.toLowerCase()
+  );
+  if (allSame) return first;
+  const lines = candidates.map((c) => `  ${c.remoteName.padEnd(8)} \u2192 ${c.org}/${c.project}`).join("\n");
+  throw new Error(
+    `Multiple Azure DevOps remotes found with different org/project:
+${lines}
+Use --org/--project (or 'git remote rename <name> origin') to disambiguate.`
+  );
+}
+function readGitConfigContent() {
+  const gitDirEnv = process.env.GIT_DIR;
+  if (gitDirEnv) {
+    return fs.readFileSync(path.join(gitDirEnv, "config"), "utf-8");
+  }
+  let dir = process.cwd();
+  for (; ; ) {
+    const gitPath = path.join(dir, ".git");
+    try {
+      const stat = fs.statSync(gitPath);
+      if (stat.isDirectory()) {
+        return fs.readFileSync(path.join(gitPath, "config"), "utf-8");
+      }
+      if (stat.isFile()) {
+        const ref = fs.readFileSync(gitPath, "utf-8");
+        const m = /^gitdir:[ \t]*([^\r\n]+)/m.exec(ref);
+        if (m) {
+          return fs.readFileSync(path.join(path.resolve(dir, m[1].trim()), "config"), "utf-8");
+        }
+      }
+    } catch {
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("Not in a git repository. Provide --org and --project explicitly.");
+}
+function gitConfigToRemoteLines(configContent) {
+  const lines = [];
+  let currentRemote = null;
+  let emittedUrl = false;
+  for (const line of configContent.split("\n")) {
+    const sectionMatch = /^\[remote\s+"([^"]+)"\]/.exec(line);
+    if (sectionMatch) {
+      currentRemote = sectionMatch[1];
+      emittedUrl = false;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      currentRemote = null;
+      emittedUrl = false;
+      continue;
+    }
+    if (currentRemote && !emittedUrl) {
+      const urlMatch = /^[ \t]+url[ \t]*=[ \t]*([^\r\n]+)/.exec(line);
+      if (urlMatch) {
+        lines.push(`${currentRemote}	${urlMatch[1].trim()} (fetch)`);
+        emittedUrl = true;
       }
-      return { org: match[1], project };
     }
   }
-  return null;
+  return lines.join("\n");
 }
 function detectAzdoContext() {
-  let remoteUrl;
+  let configContent;
   try {
-    remoteUrl = execSync("git remote get-url origin", { encoding: "utf-8" }).trim();
+    configContent = readGitConfigContent();
   } catch {
     throw new Error("Not in a git repository. Provide --org and --project explicitly.");
   }
-  const context = parseAzdoRemote(remoteUrl);
-  if (!context || !context.org && !context.project) {
-    throw new Error('Git remote "origin" is not an Azure DevOps URL. Provide --org and --project explicitly.');
+  const remoteLines = gitConfigToRemoteLines(configContent);
+  const candidates = parseAllAzdoRemotes(remoteLines);
+  const selected = selectRemote(candidates);
+  if (selected.hasEmbeddedSecret) {
+    noticeCredentialBearingRemote(selected.remoteName);
   }
-  return context;
+  return { org: selected.org, project: selected.project };
 }
 function parseRepoName(url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
     if (match) {
+      if (httpsEmbeddedSecret.test(url)) {
+        noticeCredentialBearingRemote();
+      }
       return match[3];
     }
   }
@@ -844,7 +1104,7 @@ function parseRepoName(url) {
 function detectRepoName() {
   let remoteUrl;
   try {
-    remoteUrl = execSync("git remote get-url origin", { encoding: "utf-8" }).trim();
+    remoteUrl = execFileSync(GIT_BINARY, ["remote", "get-url", "origin"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     throw new Error('Not in a git repository. Check that git remote "origin" exists and try again.');
   }
@@ -855,7 +1115,7 @@ function detectRepoName() {
   return repo;
 }
 function getCurrentBranch() {
-  const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
+  const branch = execFileSync(GIT_BINARY, ["rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   if (branch === "HEAD") {
     throw new Error("Not on a named branch. Check out a named branch and try again.");
   }
@@ -891,7 +1151,7 @@ function formatResolutionError() {
   return [
     "Could not resolve an Azure DevOps organization. Options (in priority order):",
     "  1. Pass --org <name> on the command line.",
-    "  2. Run this command from a git repo whose origin remote is an Azure DevOps URL.",
+    "  2. Run this command from a git repo that has an Azure DevOps remote.",
     "  3. Run `azdo config set org <name>` once to set a persistent default."
   ].join("\n");
 }
@@ -904,9 +1164,9 @@ function resolveContext(options) {
     gitContext = detectAzdoContext();
   } catch {
   }
-  const config = loadConfig();
   const org = resolvedOrg?.org;
-  const project = options.project || (gitContext?.project && gitContext.project.length > 0 ? gitContext.project : void 0) || config.project;
+  const scopedCfg = resolveScopedConfig(org);
+  const project = options.project || (gitContext?.project && gitContext.project.length > 0 ? gitContext.project : void 0) || scopedCfg.project;
   if (org && project) {
     return { org, project };
   }
@@ -1058,12 +1318,179 @@ function handleCommandError(err, id, context, scope = "write", exit = true) {
   }
 }
 
-// src/commands/get-item.ts
-function parseRequestedFields(raw) {
-  if (raw === void 0) return void 0;
-  const source = Array.isArray(raw) ? raw : [raw];
-  const tokens = source.flatMap((entry) => entry.split(/[,\s]+/)).map((field) => field.trim()).filter((field) => field.length > 0);
-  if (tokens.length === 0) return void 0;
+// src/services/image-download.ts
+import { Jimp } from "jimp";
+import { writeFile } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+var ATTACHMENT_GUID_RE = /_apis\/wit\/attachments\/([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})/;
+function isAzureDevOpsAttachmentHost(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "dev.azure.com" || host.endsWith(".dev.azure.com") || host.endsWith(".visualstudio.com");
+}
+function decodeHtmlEntities(value) {
+  return value.replaceAll("&quot;", '"').replaceAll("&#39;", "'").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
+function parseAttachmentReference(rawUrl, sourceField) {
+  const url = decodeHtmlEntities(rawUrl.trim());
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || !isAzureDevOpsAttachmentHost(parsed.hostname)) {
+    return null;
+  }
+  const match = ATTACHMENT_GUID_RE.exec(parsed.pathname);
+  if (!match) return null;
+  const guid = match[1].toLowerCase();
+  let suggestedExtension = ".png";
+  const fileName = parsed.searchParams.get("fileName");
+  if (fileName?.includes(".")) {
+    suggestedExtension = fileName.slice(fileName.lastIndexOf(".")).toLowerCase();
+  }
+  return { url, sourceField, guid, suggestedExtension };
+}
+function extractImageReferences(content, sourceField) {
+  if (!content) return [];
+  const references = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (rawUrl) => {
+    const reference = parseAttachmentReference(rawUrl, sourceField);
+    if (reference && !seen.has(reference.guid)) {
+      seen.add(reference.guid);
+      references.push(reference);
+    }
+  };
+  const imgRegex = /<img\b[^>]*?\ssrc\s*=\s*["']([^"']+)["']/gi;
+  let match;
+  while ((match = imgRegex.exec(content)) !== null) {
+    add(match[1]);
+  }
+  const markdownRegex = /!\[[^\]]*\]\(\s*([^)\s]+)/g;
+  while ((match = markdownRegex.exec(content)) !== null) {
+    add(match[1]);
+  }
+  return references;
+}
+function addImageDownloadOptions(command) {
+  return command.option("--download-images", "download images embedded in rich-text fields to local files").option("--resize-images <pixels>", "max image width in px; downloads and resizes embedded images to PNG (implies --download-images)").option("--images-path <dir>", "destination directory for downloaded images (default: system temp dir)");
+}
+function resolveImageDownloadOptionsOrExit(flags) {
+  try {
+    return resolveImageDownloadOptions(flags);
+  } catch (err) {
+    process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  }
+}
+function resolveImageDownloadOptions(flags) {
+  const wantsResize = flags.resizeImages !== void 0;
+  const enabled = Boolean(flags.downloadImages) || wantsResize;
+  let maxWidth;
+  if (wantsResize) {
+    const parsed = Number(flags.resizeImages);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      throw new Error(
+        `Invalid --resize-images value "${flags.resizeImages}": must be a positive integer (max width in pixels).`
+      );
+    }
+    maxWidth = parsed;
+  }
+  const outputDir = flags.imagesPath ?? tmpdir();
+  if (flags.imagesPath !== void 0 && !existsSync2(outputDir)) {
+    throw new Error(`Images path "${outputDir}" does not exist.`);
+  }
+  return { enabled, maxWidth, outputDir };
+}
+function buildImageFileName(workItemId, index, reference, resizing) {
+  const ext = resizing ? ".png" : reference.suggestedExtension;
+  return `wi-${workItemId}-${index}${ext}`;
+}
+async function processImageBytes(bytes, maxWidth) {
+  if (maxWidth === void 0) {
+    return { buffer: Buffer.from(bytes), resized: false, format: "original" };
+  }
+  const image = await Jimp.read(Buffer.from(bytes));
+  let resized = false;
+  if (image.bitmap.width > maxWidth) {
+    image.resize({ w: maxWidth });
+    resized = true;
+  }
+  const buffer = await image.getBuffer("image/png");
+  return { buffer, resized, format: "png" };
+}
+async function downloadImagesFromFields(fields, args, credential) {
+  const { workItemId, options } = args;
+  const resizing = options.maxWidth !== void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const references = [];
+  for (const field of fields) {
+    for (const reference of extractImageReferences(field.content, field.field)) {
+      if (!seen.has(reference.guid)) {
+        seen.add(reference.guid);
+        references.push(reference);
+      }
+    }
+  }
+  const results = [];
+  let index = 0;
+  for (const reference of references) {
+    index += 1;
+    try {
+      const bytes = await downloadAttachment(reference.url, credential);
+      const processed = await processImageBytes(bytes, options.maxWidth);
+      const fileName = buildImageFileName(workItemId, index, reference, resizing);
+      const outputPath = join2(options.outputDir, fileName);
+      await writeFile(outputPath, processed.buffer);
+      results.push({
+        reference,
+        path: outputPath,
+        resized: processed.resized,
+        format: resizing ? "png" : reference.suggestedExtension.replace(/^\./, "")
+      });
+    } catch (err) {
+      results.push({
+        reference,
+        resized: false,
+        format: reference.suggestedExtension.replace(/^\./, ""),
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return results;
+}
+async function runImageDownload(fields, args, credential) {
+  const results = await downloadImagesFromFields(fields, args, credential);
+  process.stdout.write(formatImageSummary(results) + "\n");
+  for (const result of results) {
+    if (result.error) {
+      process.stderr.write(`Failed to download image ${result.reference.url}: ${result.error}
+`);
+    }
+  }
+}
+function formatImageSummary(results) {
+  if (results.length === 0) {
+    return "Images: no images found in rich-text fields";
+  }
+  const saved = results.filter((r) => r.path);
+  const lines = [`Images: ${saved.length} downloaded`];
+  for (const result of saved) {
+    lines.push(`  ${result.path}`);
+  }
+  return lines.join("\n");
+}
+
+// src/commands/get-item.ts
+function parseRequestedFields(raw) {
+  if (raw === void 0) return void 0;
+  const source = Array.isArray(raw) ? raw : [raw];
+  const tokens = source.flatMap((entry) => entry.split(/[,\s]+/)).map((field) => field.trim()).filter((field) => field.length > 0);
+  if (tokens.length === 0) return void 0;
   return Array.from(new Set(tokens));
 }
 function stripHtml(html) {
@@ -1073,12 +1500,12 @@ function stripHtml(html) {
   text = text.replaceAll(/<\/?(p|div)>/gi, "\n");
   text = text.replaceAll(/<li>/gi, "\n");
   text = removeHtmlTags(text);
-  text = text.replaceAll("&amp;", "&");
   text = text.replaceAll("&lt;", "<");
   text = text.replaceAll("&gt;", ">");
   text = text.replaceAll("&quot;", '"');
   text = text.replaceAll("&#39;", "'");
   text = text.replaceAll("&nbsp;", " ");
+  text = text.replaceAll("&amp;", "&");
   text = text.replaceAll(/\n{3,}/g, "\n\n");
   return text.trim();
 }
@@ -1181,19 +1608,32 @@ function formatWorkItem(workItem, short, markdown = false) {
 }
 function createGetItemCommand() {
   const command = new Command("get-item");
-  command.description("Retrieve an Azure DevOps work item by ID").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--short", "show abbreviated output").option("--fields <fields>", "comma-separated additional field reference names").option("--markdown", "convert rich text fields to markdown").action(
+  command.description("Retrieve an Azure DevOps work item by ID").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--short", "show abbreviated output").option("--fields <fields>", "comma-separated additional field reference names").option("--markdown", "convert rich text fields to markdown");
+  addImageDownloadOptions(command);
+  command.action(
     async (idStr, options) => {
       const id = parseWorkItemId(idStr);
       validateOrgProjectPair(options);
+      const imageOptions = resolveImageDownloadOptionsOrExit(options);
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
-        const fieldsList = options.fields === void 0 ? parseRequestedFields(loadConfig().fields) : parseRequestedFields(options.fields);
-        const workItem = await getWorkItem(context, id, credential.pat, fieldsList);
-        const markdownEnabled = options.markdown ?? loadConfig().markdown ?? false;
+        const credential = await requireAuthCredential(context.org);
+        const scopedCfg = resolveScopedConfig(context.org);
+        const fieldsList = options.fields === void 0 ? parseRequestedFields(scopedCfg.fields) : parseRequestedFields(options.fields);
+        const workItem = await getWorkItem(context, id, credential, fieldsList);
+        const markdownEnabled = options.markdown ?? scopedCfg.markdown ?? false;
         const output = formatWorkItem(workItem, options.short ?? false, markdownEnabled);
         process.stdout.write(output + "\n");
+        if (imageOptions.enabled) {
+          const fields = [{ content: workItem.description ?? "", field: "Description" }];
+          if (workItem.extraFields) {
+            for (const [name, value] of Object.entries(workItem.extraFields)) {
+              fields.push({ content: value, field: name });
+            }
+          }
+          await runImageDownload(fields, { workItemId: id, options: imageOptions }, credential);
+        }
       } catch (err) {
         handleCommandError(err, id, context, "read", false);
       }
@@ -1230,59 +1670,75 @@ function createClearPatCommand() {
 // src/commands/auth.ts
 import { Command as Command3 } from "commander";
 
-// src/services/browser-open.ts
-import { execFile } from "child_process";
-function isHeadless(platform, hasDisplay) {
-  if (platform === "linux") {
-    return !hasDisplay;
+// src/services/auth-diagnostics.ts
+async function runConnectivityTest(org, cred) {
+  const url = `https://dev.azure.com/${encodeURIComponent(org)}/_apis/projects?api-version=7.1&$top=1`;
+  let result;
+  try {
+    result = await fetchRaw(url, { headers: authHeaders(cred) });
+  } catch (err) {
+    return { status: "failed", error: err instanceof Error ? err.message : String(err) };
   }
-  return false;
+  if (result.status >= 200 && result.status < 300) {
+    return { status: "ok", error: null };
+  }
+  let error = `HTTP ${result.status}`;
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed.message === "string" && parsed.message.trim() !== "") {
+      error = parsed.message.trim();
+    }
+  } catch {
+  }
+  return { status: "failed", error };
 }
-function commandForPlatform(platform) {
-  switch (platform) {
-    case "darwin":
-      return { cmd: "open", args: (url) => [url] };
-    case "win32":
-      return { cmd: "cmd", args: (url) => ["/c", "start", '""', url] };
-    case "linux":
-      return { cmd: "xdg-open", args: (url) => [url] };
-    default:
-      return null;
+async function diagnoseAuth(org, project, resolveCredential) {
+  const cred = await resolveCredential(org);
+  if (cred === null) {
+    return {
+      authType: "none",
+      credentialSource: null,
+      org,
+      project,
+      connectivityStatus: "no-credentials",
+      connectivityError: null
+    };
   }
+  const connectivity = await runConnectivityTest(org, cred);
+  const envVarName = process.env.AZDO_PAT ? "AZDO_PAT" : "dotenv";
+  const sourceLabel = cred.source === "env" ? `env:${envVarName}` : "credential-store";
+  return {
+    authType: cred.kind ?? "pat",
+    credentialSource: sourceLabel,
+    org,
+    project,
+    connectivityStatus: connectivity.status,
+    connectivityError: connectivity.error
+  };
 }
-async function openUrl(url, opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  const hasDisplay = opts.hasDisplay ?? (process.env.DISPLAY !== void 0 && process.env.DISPLAY !== "");
-  const forcePrint = opts.forcePrint ?? false;
-  if (forcePrint || isHeadless(platform, hasDisplay)) {
-    process.stderr.write(`Open this URL in your browser: ${url}
-`);
-    return "printed";
+function formatDiagnosticReport(report, json) {
+  if (json) {
+    return JSON.stringify(report, null, 2);
   }
-  const spec = commandForPlatform(platform);
-  if (!spec) {
-    process.stderr.write(`Open this URL in your browser: ${url}
-`);
-    return "printed";
+  let connectivityLine;
+  if (report.connectivityStatus === "ok") {
+    connectivityLine = "OK";
+  } else if (report.connectivityStatus === "no-credentials") {
+    connectivityLine = "no credentials found";
+  } else {
+    connectivityLine = "FAILED";
   }
-  const runner = opts.execFileFn ?? ((cmd, args, cb) => execFile(cmd, args, { timeout: 5e3 }, (err) => cb(err)));
-  return await new Promise((resolve2) => {
-    try {
-      runner(spec.cmd, spec.args(url), (err) => {
-        if (err) {
-          process.stderr.write(`Open this URL in your browser: ${url}
-`);
-          resolve2("printed");
-        } else {
-          resolve2("opened");
-        }
-      });
-    } catch {
-      process.stderr.write(`Open this URL in your browser: ${url}
-`);
-      resolve2("printed");
-    }
-  });
+  const lines = [
+    `Auth type:    ${report.authType}`,
+    `Source:       ${report.credentialSource ?? "(none)"}`,
+    `Org:          ${report.org}`,
+    `Project:      ${report.project ?? "(not set)"}`,
+    `Connectivity: ${connectivityLine}`
+  ];
+  if (report.connectivityStatus === "failed" && report.connectivityError !== null) {
+    lines.push(`Error:        ${report.connectivityError}`);
+  }
+  return lines.join("\n");
 }
 
 // src/commands/auth.ts
@@ -1293,9 +1749,9 @@ async function readStdinToString() {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
-async function confirmOverwrite(org) {
+async function promptYesNo(prompt) {
   if (!process.stdin.isTTY) return true;
-  process.stderr.write(`A PAT is already stored for org ${org}. Overwrite? [y/N] `);
+  process.stderr.write(prompt);
   return await new Promise((resolve2) => {
     process.stdin.setEncoding("utf8");
     let answered = false;
@@ -1311,7 +1767,23 @@ async function confirmOverwrite(org) {
     process.stdin.on("data", handler);
   });
 }
-async function handleAuthRoot(options) {
+async function confirmOverwrite(org) {
+  return promptYesNo(`A PAT is already stored for org ${org}. Overwrite? [y/N] `);
+}
+async function confirmOverwriteCredential(org, existingKind) {
+  const label = existingKind === "oauth" ? "OAuth credential" : "PAT";
+  return promptYesNo(`A ${label} is already stored for org ${org}. The new login will replace it. Continue? [y/N] `);
+}
+function rejectMutuallyExclusive(opts) {
+  if (opts.usePat && opts.deviceCode) {
+    return "--use-pat and --device-code are mutually exclusive (PAT has no device-code flow).";
+  }
+  if (opts.usePat && (opts.clientId || opts.tenantId || opts.scopes)) {
+    return "--use-pat cannot be combined with OAuth-only flags (--client-id / --tenant-id / --scopes).";
+  }
+  return null;
+}
+async function handlePatLogin(options) {
   const resolved = resolveOrg({ org: options.org });
   if (!resolved) {
     process.stderr.write(`${formatResolutionError()}
@@ -1377,7 +1849,145 @@ async function handleAuthRoot(options) {
   process.stdout.write(`PAT stored for org ${org} in ${probeBackend()}.
 `);
 }
+async function ensureOverwriteConfirmed(org) {
+  try {
+    const existing = await getStoredCredential(org);
+    if (existing === null || !process.stdin.isTTY) return "ok";
+    const ok = await confirmOverwriteCredential(org, existing.kind);
+    return ok ? "ok" : "aborted";
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      return "unavailable";
+    }
+    throw err;
+  }
+}
+function buildOAuthLoginOptions(options) {
+  return {
+    flow: options.deviceCode ? "device-code" : "auto",
+    clientIdOverride: options.clientId,
+    tenantIdOverride: options.tenantId,
+    scopesOverride: options.scopes ? options.scopes.split(/\s+/).filter(Boolean) : void 0
+  };
+}
+function reportOAuthFailure(err) {
+  const reason = typeof err === "object" && err !== null && "reason" in err ? err.reason : null;
+  const msg = err.message;
+  process.stderr.write(reason ? `OAuth login failed (${reason}): ${msg}
+` : `OAuth login failed: ${msg}
+`);
+  const noDisplay = process.platform === "linux" && (!process.env.DISPLAY || process.env.DISPLAY.length === 0);
+  if (noDisplay) {
+    process.stderr.write("Tip: this host has no DISPLAY; pass --device-code to use the headless flow.\n");
+  } else if (reason === "port-conflict") {
+    process.stderr.write("Tip: another process is using the loopback callback port. Try again or pass --device-code.\n");
+  }
+}
+async function handleOAuthLogin(options) {
+  const resolved = resolveOrg({ org: options.org });
+  if (!resolved) {
+    process.stderr.write(`${formatResolutionError()}
+`);
+    process.exitCode = 3;
+    return;
+  }
+  const org = resolved.org;
+  const confirm = await ensureOverwriteConfirmed(org);
+  if (confirm === "aborted") {
+    process.stderr.write("Aborted. Existing credential preserved.\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (confirm === "unavailable") {
+    process.exitCode = 4;
+    return;
+  }
+  try {
+    const result = await loginWithOAuth(org, buildOAuthLoginOptions(options));
+    process.stdout.write(
+      `Logged in to ${org} via OAuth (${result.flowUsed}). Account: ${result.accountId}; expires ${new Date(result.expiresAt * 1e3).toISOString()}.
+`
+    );
+  } catch (err) {
+    reportOAuthFailure(err);
+    process.exitCode = 1;
+  }
+}
+async function handleAuthRoot(options) {
+  const conflict = rejectMutuallyExclusive(options);
+  if (conflict) {
+    process.stderr.write(`${conflict}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  await handlePatLogin(options);
+}
+async function handleLoginSubcommand(options) {
+  const conflict = rejectMutuallyExclusive(options);
+  if (conflict) {
+    process.stderr.write(`${conflict}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  if (options.fromStdin || options.usePat) {
+    await handlePatLogin(options);
+    return;
+  }
+  await handleOAuthLogin(options);
+}
+async function handleStatusJson() {
+  try {
+    const report = await status();
+    process.stdout.write(`${JSON.stringify(report)}
+`);
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      process.exitCode = 4;
+      return;
+    }
+    throw err;
+  }
+}
 async function handleStatus(options, org) {
+  if (options.json) {
+    let backend2;
+    let value2;
+    try {
+      backend2 = probeBackend();
+      value2 = await getPat(org);
+    } catch (err) {
+      if (err instanceof CredentialStoreUnavailableError) {
+        process.stderr.write(`${err.message}
+`);
+        process.exitCode = 4;
+        return;
+      }
+      throw err;
+    }
+    const storedEvents2 = readAuditEvents().filter((ev) => ev.org === org && ev.event === "auth.store");
+    const last2 = storedEvents2.at(-1);
+    const updatedAt2 = last2?.ts ?? null;
+    if (!value2) {
+      process.stdout.write(
+        `${JSON.stringify({ org, backend: backend2, stored: false, masked: null, updated_at: updatedAt2 })}
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const masked2 = maskedDisplay(value2);
+    process.stdout.write(
+      `${JSON.stringify({ org, backend: backend2, stored: true, masked: masked2, updated_at: updatedAt2 })}
+`
+    );
+    return;
+  }
   let backend;
   let value;
   try {
@@ -1393,39 +2003,25 @@ async function handleStatus(options, org) {
     throw err;
   }
   const storedEvents = readAuditEvents().filter((ev) => ev.org === org && ev.event === "auth.store");
-  const last = storedEvents[storedEvents.length - 1];
+  const last = storedEvents.at(-1);
   const updatedAt = last?.ts ?? null;
   if (!value) {
-    if (options.json) {
-      process.stdout.write(
-        `${JSON.stringify({ org, backend, stored: false, masked: null, updated_at: updatedAt })}
-`
-      );
-    } else {
-      process.stdout.write(`Organization: ${org}
+    process.stdout.write(`Organization: ${org}
 Backend:      ${backend}
 Stored:       no
 `);
-    }
     process.exitCode = 1;
     return;
   }
   const masked = maskedDisplay(value);
-  if (options.json) {
-    process.stdout.write(
-      `${JSON.stringify({ org, backend, stored: true, masked, updated_at: updatedAt })}
-`
-    );
-  } else {
-    process.stdout.write(
-      `Organization: ${org}
+  process.stdout.write(
+    `Organization: ${org}
 Backend:      ${backend}
 Stored:       yes
 Identifier:   ${masked}
 ` + (updatedAt ? `Last updated: ${updatedAt}
 ` : "")
-    );
-  }
+  );
 }
 async function handleLogout(options, orgFromGlobal) {
   if (options.all && orgFromGlobal) {
@@ -1434,9 +2030,16 @@ async function handleLogout(options, orgFromGlobal) {
     return;
   }
   if (options.all) {
-    let orgs;
     try {
-      orgs = await listOrgsWithStoredPat();
+      const result = await logout({ all: true });
+      if (result.removed.length === 0) {
+        process.stdout.write("No stored credentials to remove.\n");
+        return;
+      }
+      for (const r of result.removed) {
+        process.stdout.write(`Removed ${r.kind} credential for org ${r.org}.
+`);
+      }
     } catch (err) {
       if (err instanceof CredentialStoreUnavailableError) {
         process.stderr.write(`${err.message}
@@ -1444,22 +2047,9 @@ async function handleLogout(options, orgFromGlobal) {
         process.exitCode = 4;
         return;
       }
-      throw err;
-    }
-    if (orgs.length === 0) {
-      process.stdout.write("No stored PATs to remove.\n");
-      return;
-    }
-    for (const org of orgs) {
-      try {
-        await deletePat(org);
-        process.stdout.write(`PAT removed for org ${org}.
-`);
-      } catch (err) {
-        process.stderr.write(`Failed to remove PAT for org ${org}: ${err.message}
+      process.stderr.write(`Failed to remove credentials: ${err.message}
 `);
-        process.exitCode = 1;
-      }
+      process.exitCode = 1;
     }
     return;
   }
@@ -1473,10 +2063,10 @@ async function handleLogout(options, orgFromGlobal) {
   try {
     const removed = await deletePat(resolved.org);
     if (removed) {
-      process.stdout.write(`PAT removed for org ${resolved.org}.
+      process.stdout.write(`Credential removed for org ${resolved.org}.
 `);
     } else {
-      process.stdout.write(`No stored PAT found for org ${resolved.org}.
+      process.stdout.write(`No stored credential for org ${resolved.org}.
 `);
     }
   } catch (err) {
@@ -1491,14 +2081,70 @@ async function handleLogout(options, orgFromGlobal) {
 }
 function createAuthCommand() {
   const command = new Command3("auth");
-  command.description("Manage Azure DevOps Personal Access Tokens (PAT) in the OS secret vault");
-  command.option("--org <name>", "Azure DevOps organization (flag wins over auto-detect / config)").option("--from-stdin", "read PAT from stdin instead of prompting", false).option("--no-browser", "do not open the Azure DevOps PAT page in a browser");
-  command.action(async (options) => {
+  command.description(
+    "Manage Azure DevOps authentication. Use `azdo auth login` for OAuth (default); the bare `azdo auth` form preserves the legacy PAT-prompt path for back-compat."
+  );
+  command.option("--org <name>", "Azure DevOps organization (flag wins over auto-detect / config)").option("--from-stdin", "read PAT from stdin instead of prompting (implies --use-pat)", false).option("--no-browser", "do not open the Azure DevOps PAT page in a browser (PAT path only)").option("--use-pat", "use Personal Access Token instead of OAuth (legacy path)", false).option("--device-code", "use OAuth device-code flow (headless hosts; OAuth only)", false).option("--client-id <id>", "override the default OAuth client id (FR-013 override path)").option("--tenant-id <id>", "override the default OAuth tenant id (default: common)").option("--scopes <scopes>", "space-separated OAuth scope override (advanced; default mirrors PAT scope table)");
+  command.addHelpText(
+    "after",
+    `
+Default flow (OAuth, browser-based):
+  azdo auth login --org <name>
+  \u2192 opens the default browser for OAuth (Microsoft Entra v2 + PKCE).
+
+Headless / no-browser:
+  azdo auth login --org <name> --device-code
+
+PAT path (legacy, opt-in):
+  azdo auth login --org <name> --use-pat
+  azdo auth --org <name>            # back-compat alias of the above
+
+OAuth scope set \u2014 shipped first-party client (default install):
+  ${firstPartyShippedScopes().join("\n  ")}
+  (uses ${AZDO_RESOURCE_ID}/.default \u2014 per-scope consent is unavailable
+  against a client we do not own; .default grants the VS client's
+  pre-authorized AzDO permissions in one step.)
+
+OAuth scope set \u2014 self-registered apps (--client-id / AZDO_OAUTH_CLIENT_ID):
+  ${defaultScopes().join("\n  ")}
+  (FR-016, mirrors the PAT scope table \u2014 see docs/oauth-app-registration.md)
+
+For self-registered OAuth apps (locked-down tenants), see docs/oauth-app-registration.md
+\u2014 that same guide is the maintainer reference for the project's shared client id.
+
+Note: stored credentials may coexist as 'pat' or 'oauth' across orgs (FR-007).
+Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
+      \`azdo auth login\` is the spec-canonical name and defaults to OAuth.`
+  ).action(async (options) => {
     await handleAuthRoot(options);
   });
-  const statusCmd = command.command("status").description("Report whether a PAT is stored for the resolved org (masked, never the full value)").option("--json", "emit a JSON object", false);
+  const loginCmd = command.command("login").description("Authenticate against Azure DevOps (OAuth default; --use-pat for PAT)").option("--org <name>", "Azure DevOps organization (defaults: git remote \u2192 config)");
+  loginCmd.action(async () => {
+    const merged = loginCmd.optsWithGlobals();
+    await handleLoginSubcommand(merged);
+  });
+  const statusCmd = command.command("status").description("Report stored credentials (kind, org, account/expiry, backend) \u2014 never the token").option("--json", "emit JSON", false);
   statusCmd.action(async (options) => {
     const globals = statusCmd.optsWithGlobals();
+    if (!globals.org) {
+      if (options.json) {
+        await handleStatusJson();
+        return;
+      }
+      const report = await status();
+      if (report.orgs.length === 0) {
+        process.stdout.write("No stored credentials.\n");
+        return;
+      }
+      for (const e of report.orgs) {
+        const expiry = e.expiresAt ? new Date(e.expiresAt * 1e3).toISOString() : "n/a";
+        process.stdout.write(
+          `${e.org}	${e.kind}	${e.accountId ?? ""}	${expiry}
+`
+        );
+      }
+      return;
+    }
     const resolved = resolveOrg({ org: globals.org });
     if (!resolved) {
       process.stderr.write(`${formatResolutionError()}
@@ -1508,11 +2154,34 @@ function createAuthCommand() {
     }
     await handleStatus(options, resolved.org);
   });
-  const logoutCmd = command.command("logout").description("Remove the stored PAT for an org (or all orgs with --all)").option("--all", "remove the stored PAT for every org", false);
+  statusCmd.addHelpText(
+    "after",
+    "\nStored credentials may be of kind `pat` or `oauth` and may coexist across orgs (FR-007).\n"
+  );
+  const logoutCmd = command.command("logout").description("Remove the stored credential for an org (or all orgs with --all)").option("--all", "remove every stored credential (PAT and OAuth)", false);
   logoutCmd.action(async (options) => {
     const globals = logoutCmd.optsWithGlobals();
     await handleLogout(options, globals.org);
   });
+  const diagnoseCmd = command.command("diagnose").description("Show auth type, credential source, org, and live connectivity test result").option("--org <name>", "Azure DevOps organization (overrides context resolution)").option("--project <name>", "Azure DevOps project (optional context)").option("--json", "emit JSON instead of human-readable text", false);
+  diagnoseCmd.action(async (options) => {
+    const globals = diagnoseCmd.optsWithGlobals();
+    const orgName = options.org ?? globals.org;
+    const resolved = resolveOrg({ org: orgName });
+    if (!resolved) {
+      process.stderr.write(`${formatResolutionError()}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const report = await diagnoseAuth(resolved.org, options.project ?? null, resolveAuthCredential);
+    const output = formatDiagnosticReport(report, options.json ?? false);
+    process.stdout.write(`${output}
+`);
+    if (report.connectivityStatus === "failed") {
+      process.exitCode = 1;
+    }
+  });
   return command;
 }
 
@@ -1525,21 +2194,50 @@ function formatConfigValue(value, unsetFallback = "") {
   }
   return Array.isArray(value) ? value.join(",") : value;
 }
+function buildConfigListEntries(cfg) {
+  const entries = SETTINGS.map((s) => ({
+    scope: "default",
+    key: s.key,
+    value: cfg[s.key]
+  }));
+  for (const [orgName, scope] of Object.entries(cfg.organizations ?? {})) {
+    for (const [k, v] of Object.entries(scope)) {
+      entries.push({ scope: orgName, key: k, value: v });
+    }
+  }
+  return entries;
+}
 function writeConfigList(cfg) {
   const keyWidth = 10;
   const valueWidth = 30;
+  const scopeWidth = 12;
+  process.stdout.write(
+    `${"scope".padEnd(scopeWidth)}${"key".padEnd(keyWidth)}${"value".padEnd(valueWidth)}description
+`
+  );
   for (const setting of SETTINGS) {
     const raw = cfg[setting.key];
     const value = formatConfigValue(raw, "(not set)");
     const marker = raw === void 0 && setting.required ? " *" : "";
     process.stdout.write(
-      `${setting.key.padEnd(keyWidth)}${String(value).padEnd(valueWidth)}${setting.description}${marker}
+      `${"default".padEnd(scopeWidth)}${setting.key.padEnd(keyWidth)}${String(value).padEnd(valueWidth)}${setting.description}${marker}
 `
     );
   }
-  const hasUnset = SETTINGS.some((s) => s.required && cfg[s.key] === void 0);
-  if (hasUnset) {
-    process.stdout.write(
+  for (const [orgName, scope] of Object.entries(cfg.organizations ?? {})) {
+    const orgScope = scope;
+    const scopedSettings = Object.entries(orgScope);
+    for (const [k, v] of scopedSettings) {
+      const value = formatConfigValue(v, "(not set)");
+      process.stdout.write(
+        `${orgName.padEnd(scopeWidth)}${k.padEnd(keyWidth)}${String(value).padEnd(valueWidth)}
+`
+      );
+    }
+  }
+  const hasUnset = SETTINGS.some((s) => s.required && cfg[s.key] === void 0);
+  if (hasUnset) {
+    process.stdout.write(
       '\n* = required but not configured. Run "azdo config wizard" to set up.\n'
     );
   }
@@ -1580,17 +2278,22 @@ function createConfigCommand() {
   const config = new Command4("config");
   config.description("Manage CLI settings");
   const set = new Command4("set");
-  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields)").argument("<value>", "setting value").option("--json", "output in JSON format").action((key, value, options) => {
+  set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").argument("<value>", "setting value").option("--org <org>", "set value in an org-scoped configuration").option("--json", "output in JSON format").action((key, value, options) => {
     try {
-      setConfigValue(key, value);
+      if (options.org) {
+        setOrgScopedValue(options.org, key, value);
+      } else {
+        setConfigValue(key, value);
+      }
       if (options.json) {
-        const output = { key, value };
+        const output = { key, value, scope: options.org ?? "default" };
         if (key === "fields") {
           output.value = value.split(",").map((s) => s.trim());
         }
         process.stdout.write(JSON.stringify(output) + "\n");
       } else {
-        process.stdout.write(`Set "${key}" to "${value}"
+        const scopeTag = options.org ? ` (org: ${options.org})` : "";
+        process.stdout.write(`Set "${key}" to "${value}"${scopeTag}
 `);
       }
     } catch (err) {
@@ -1601,12 +2304,12 @@ function createConfigCommand() {
     }
   });
   const get = new Command4("get");
-  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields)").option("--json", "output in JSON format").action((key, options) => {
+  get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "read from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
-      const value = getConfigValue(key);
+      const value = options.org ? getOrgScopedValue(options.org, key) : getConfigValue(key);
       if (options.json) {
         process.stdout.write(
-          JSON.stringify({ key, value: value ?? null }) + "\n"
+          JSON.stringify({ key, value: value ?? null, scope: options.org ?? "default" }) + "\n"
         );
       } else if (value === void 0) {
         process.stdout.write(`Setting "${key}" is not configured.
@@ -1614,7 +2317,7 @@ function createConfigCommand() {
       } else if (Array.isArray(value)) {
         process.stdout.write(value.join(",") + "\n");
       } else {
-        process.stdout.write(value + "\n");
+        process.stdout.write(String(value) + "\n");
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -1627,19 +2330,25 @@ function createConfigCommand() {
   list.description("List all configuration values").option("--json", "output in JSON format").action((options) => {
     const cfg = loadConfig();
     if (options.json) {
-      process.stdout.write(JSON.stringify(cfg) + "\n");
+      const entries = buildConfigListEntries(cfg);
+      process.stdout.write(JSON.stringify(entries) + "\n");
       return;
     }
     writeConfigList(cfg);
   });
   const unset = new Command4("unset");
-  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields)").option("--json", "output in JSON format").action((key, options) => {
+  unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields, markdown)").option("--org <org>", "remove from an org-scoped configuration").option("--json", "output in JSON format").action((key, options) => {
     try {
-      unsetConfigValue(key);
+      if (options.org) {
+        unsetOrgScopedValue(options.org, key);
+      } else {
+        unsetConfigValue(key);
+      }
       if (options.json) {
-        process.stdout.write(JSON.stringify({ key, unset: true }) + "\n");
+        process.stdout.write(JSON.stringify({ key, unset: true, scope: options.org ?? "default" }) + "\n");
       } else {
-        process.stdout.write(`Unset "${key}"
+        const scopeTag = options.org ? ` (org: ${options.org})` : "";
+        process.stdout.write(`Unset "${key}"${scopeTag}
 `);
       }
     } catch (err) {
@@ -1671,10 +2380,52 @@ function createConfigCommand() {
     rl.close();
     process.stderr.write("Configuration complete!\n");
   });
+  const orgCopy = new Command4("org-copy");
+  orgCopy.description('Copy settings from one scope to another (use "default" as source to copy top-level settings)').argument("<from>", 'source scope name or "default"').argument("<to>", "destination org name").option("--force", "overwrite existing values on collision").action((from, to, options) => {
+    try {
+      copyOrgScope(from, to, options.force ?? false);
+      process.stdout.write(`Copied scope "${from}" to "${to}"
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  const orgMove = new Command4("org-move");
+  orgMove.description("Move settings from one org scope to another").argument("<from>", "source org name").argument("<to>", "destination org name").option("--force", "overwrite existing values on collision").action((from, to, options) => {
+    try {
+      moveOrgScope(from, to, options.force ?? false);
+      process.stdout.write(`Moved scope "${from}" to "${to}"
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  const orgDelete = new Command4("org-delete");
+  orgDelete.description("Delete an org-scoped configuration").argument("<name>", "org name").action((name) => {
+    try {
+      deleteOrgScope(name);
+      process.stdout.write(`Deleted scope "${name}"
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
   config.addCommand(set);
   config.addCommand(get);
   config.addCommand(list);
   config.addCommand(unset);
+  config.addCommand(orgCopy);
+  config.addCommand(orgMove);
+  config.addCommand(orgDelete);
   config.addCommand(wizard);
   return config;
 }
@@ -1690,11 +2441,11 @@ function createSetStateCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
+        const credential = await requireAuthCredential(context.org);
         const operations = [
           { op: "add", path: "/fields/System.State", value: state }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, "System.State", operations);
+        const result = await updateWorkItem(context, id, credential, "System.State", operations);
         if (options.json) {
           process.stdout.write(
             JSON.stringify({
@@ -1740,12 +2491,12 @@ function createAssignCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
+        const credential = await requireAuthCredential(context.org);
         const value = options.unassign ? "" : name;
         const operations = [
           { op: "add", path: "/fields/System.AssignedTo", value }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, "System.AssignedTo", operations);
+        const result = await updateWorkItem(context, id, credential, "System.AssignedTo", operations);
         if (options.json) {
           process.stdout.write(
             JSON.stringify({
@@ -1780,11 +2531,11 @@ function createSetFieldCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
+        const credential = await requireAuthCredential(context.org);
         const operations = [
           { op: "add", path: `/fields/${field}`, value }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, field, operations);
+        const result = await updateWorkItem(context, id, credential, field, operations);
         if (options.json) {
           process.stdout.write(
             JSON.stringify({
@@ -1811,20 +2562,30 @@ function createSetFieldCommand() {
 import { Command as Command8 } from "commander";
 function createGetMdFieldCommand() {
   const command = new Command8("get-md-field");
-  command.description("Get a work item field value, converting HTML to markdown").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Description)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").action(
+  command.description("Get a work item field value, converting HTML to markdown").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Description)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project");
+  addImageDownloadOptions(command);
+  command.action(
     async (idStr, field, options) => {
       const id = parseWorkItemId(idStr);
       validateOrgProjectPair(options);
+      const imageOptions = resolveImageDownloadOptionsOrExit(options);
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
-        const value = await getWorkItemFieldValue(context, id, credential.pat, field);
+        const credential = await requireAuthCredential(context.org);
+        const value = await getWorkItemFieldValue(context, id, credential, field);
         if (value === null) {
           process.stdout.write("\n");
         } else {
           process.stdout.write(toMarkdown(value) + "\n");
         }
+        if (imageOptions.enabled) {
+          await runImageDownload(
+            [{ content: value ?? "", field }],
+            { workItemId: id, options: imageOptions },
+            credential
+          );
+        }
       } catch (err) {
         handleCommandError(err, id, context, "read");
       }
@@ -1834,7 +2595,7 @@ function createGetMdFieldCommand() {
 }
 
 // src/commands/set-md-field.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { Command as Command9 } from "commander";
 function fail(message) {
   process.stderr.write(`Error: ${message}
@@ -1854,7 +2615,7 @@ function resolveContent(inlineContent, options) {
   return null;
 }
 function readFileContent(filePath) {
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     fail(`File not found: ${filePath}`);
   }
   try {
@@ -1906,12 +2667,12 @@ function createSetMdFieldCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
+        const credential = await requireAuthCredential(context.org);
         const operations = [
           { op: "add", path: `/fields/${field}`, value: content },
           { op: "add", path: `/multilineFieldsFormat/${field}`, value: "Markdown" }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, field, operations);
+        const result = await updateWorkItem(context, id, credential, field, operations);
         formatOutput(result, options, field);
       } catch (err) {
         handleCommandError(err, id, context, "write");
@@ -1922,7 +2683,7 @@ function createSetMdFieldCommand() {
 }
 
 // src/commands/upsert.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, unlinkSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync } from "fs";
 import { Command as Command10 } from "commander";
 
 // src/services/task-document.ts
@@ -2086,7 +2847,7 @@ function loadSourceContent(options) {
     return { content: options.content };
   }
   const filePath = options.file;
-  if (!existsSync3(filePath)) {
+  if (!existsSync4(filePath)) {
     fail2(`File not found: ${filePath}`);
   }
   try {
@@ -2222,15 +2983,15 @@ function createUpsertCommand() {
         ensureTitleForCreate(document.fields);
       }
       const operations = toPatchOperations(document.fields, action);
-      const credential = await requirePat(context.org);
+      const credential = await requireAuthCredential(context.org);
       let writeResult;
       if (action === "created") {
-        writeResult = await createWorkItem(context, createType, credential.pat, operations);
+        writeResult = await createWorkItem(context, createType, credential, operations);
       } else {
         if (id === void 0) {
           fail2("Work item ID is required for updates.");
         }
-        writeResult = await applyWorkItemPatch(context, id, credential.pat, operations);
+        writeResult = await applyWorkItemPatch(context, id, credential, operations);
       }
       const result = buildUpsertResult(
         action,
@@ -2288,8 +3049,8 @@ function createListFieldsCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
-        const fields = await getWorkItemFields(context, id, credential.pat);
+        const credential = await requireAuthCredential(context.org);
+        const fields = await getWorkItemFields(context, id, credential);
         if (options.json) {
           process.stdout.write(JSON.stringify({ id, fields }, null, 2) + "\n");
         } else {
@@ -2331,6 +3092,31 @@ function buildPullRequestStatusesUrl(context, repo, prId) {
   url.searchParams.set("api-version", "7.1");
   return url;
 }
+function buildProjectUrl(context) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/projects/${encodeURIComponent(context.project)}`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+function buildPolicyEvaluationsUrl(context, projectId, prId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/policy/evaluations`
+  );
+  url.searchParams.set("api-version", "7.1");
+  url.searchParams.set("artifactId", `vstfs:///CodeReview/CodeReviewId/${projectId}/${prId}`);
+  return url;
+}
+function buildPullRequestBuildsUrl(context, prId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/build/builds`
+  );
+  url.searchParams.set("branchName", `refs/pull/${prId}/merge`);
+  url.searchParams.set("queryOrder", "queueTimeDescending");
+  url.searchParams.set("$top", "50");
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
 function mapPullRequest(repo, pullRequest) {
   return {
     id: pullRequest.pullRequestId,
@@ -2343,9 +3129,9 @@ function mapPullRequest(repo, pullRequest) {
     url: pullRequest._links?.web?.href ?? null
   };
 }
-function mapPullRequestCheckName(status) {
-  const genre = status.context?.genre?.trim();
-  const name = status.context?.name?.trim();
+function mapPullRequestCheckName(status2) {
+  const genre = status2.context?.genre?.trim();
+  const name = status2.context?.name?.trim();
   if (genre && name) {
     return `${genre}/${name}`;
   }
@@ -2355,21 +3141,80 @@ function mapPullRequestCheckName(status) {
   if (genre) {
     return genre;
   }
-  return `Status #${status.id}`;
+  return `Status #${status2.id}`;
+}
+function mapPullRequestCheck(status2) {
+  if (status2.state === "notApplicable" || status2.state === "notSet") {
+    return null;
+  }
+  return {
+    id: status2.id,
+    state: status2.state,
+    name: mapPullRequestCheckName(status2),
+    description: status2.description ?? null,
+    targetUrl: status2.targetUrl ?? null,
+    createdBy: status2.createdBy?.displayName ?? null,
+    createdAt: status2.creationDate ?? null,
+    updatedAt: status2.updatedDate ?? null,
+    source: "status"
+  };
+}
+function mapPolicyEvaluationState(status2) {
+  switch (status2) {
+    case "approved":
+      return "succeeded";
+    case "rejected":
+      return "failed";
+    case "running":
+    case "queued":
+      return "pending";
+    case "notApplicable":
+    case "notSet":
+    case void 0:
+      return null;
+    default:
+      return status2;
+  }
+}
+function mapBuildToCheckState(build) {
+  if (build.status !== "completed") {
+    return "pending";
+  }
+  switch (build.result) {
+    case "succeeded":
+    case "partiallySucceeded":
+      return "succeeded";
+    case "failed":
+      return "failed";
+    case "canceled":
+      return "error";
+    default:
+      return "pending";
+  }
+}
+function mapPolicyEvaluationName(evaluation) {
+  const display = evaluation.configuration?.settings?.displayName?.trim() || evaluation.configuration?.type?.displayName?.trim();
+  if (display) {
+    return display;
+  }
+  return `Policy ${evaluation.configuration?.id ?? evaluation.evaluationId ?? "?"}`;
 }
-function mapPullRequestCheck(status) {
-  if (status.state === "notApplicable" || status.state === "notSet") {
+function mapPolicyEvaluationCheck(evaluation) {
+  const state = mapPolicyEvaluationState(evaluation.status);
+  if (state === null) {
     return null;
   }
   return {
-    id: status.id,
-    state: status.state,
-    name: mapPullRequestCheckName(status),
-    description: status.description ?? null,
-    targetUrl: status.targetUrl ?? null,
-    createdBy: status.createdBy?.displayName ?? null,
-    createdAt: status.creationDate ?? null,
-    updatedAt: status.updatedDate ?? null
+    id: evaluation.configuration?.id ?? 0,
+    state,
+    name: mapPolicyEvaluationName(evaluation),
+    description: null,
+    targetUrl: null,
+    createdBy: null,
+    createdAt: null,
+    updatedAt: null,
+    source: "policy",
+    isBlocking: evaluation.configuration?.isBlocking ?? null
   };
 }
 function mapComment(comment) {
@@ -2389,24 +3234,28 @@ function mapThread(thread) {
   if (comments.length === 0) {
     return null;
   }
+  const line = thread.threadContext?.rightFileStart?.line ?? thread.threadContext?.leftFileStart?.line ?? null;
   return {
     id: thread.id,
-    status: thread.status,
+    status: thread.status ?? "unknown",
     threadContext: thread.threadContext?.filePath ?? null,
+    line,
     comments
   };
 }
 function toActiveCommentThread(thread) {
+  const line = thread.threadContext?.rightFileStart?.line ?? thread.threadContext?.leftFileStart?.line ?? null;
   return {
     id: thread.id,
-    status: thread.status,
+    status: thread.status ?? "unknown",
     threadContext: thread.threadContext?.filePath ?? null,
+    line,
     comments: thread.comments.map(mapComment).filter((comment) => comment !== null)
   };
 }
 var RESOLVED_THREAD_STATUSES = /* @__PURE__ */ new Set(["fixed", "wontFix", "closed", "byDesign"]);
-function isThreadResolved(status) {
-  return RESOLVED_THREAD_STATUSES.has(status);
+function isThreadResolved(status2) {
+  return RESOLVED_THREAD_STATUSES.has(status2);
 }
 async function readJsonResponse(response) {
   if (!response.ok) {
@@ -2414,7 +3263,7 @@ async function readJsonResponse(response) {
   }
   return response.json();
 }
-async function patchThreadStatus(context, repo, pat, prId, threadId, status) {
+async function patchThreadStatus(context, repo, cred, prId, threadId, status2) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads/${threadId}`
   );
@@ -2422,41 +3271,74 @@ async function patchThreadStatus(context, repo, pat, prId, threadId, status) {
   const response = await fetchWithErrors(url.toString(), {
     method: "PATCH",
     headers: {
-      ...authHeaders(pat),
+      ...authHeaders(cred),
       "Content-Type": "application/json"
     },
-    body: JSON.stringify({ status })
+    body: JSON.stringify({ status: status2 })
   });
   const data = await readJsonResponse(response);
   return toActiveCommentThread(data);
 }
-async function getPullRequestById(context, repo, pat, prId) {
+async function getPullRequestById(context, repo, cred, prId) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}`
   );
   url.searchParams.set("api-version", "7.1");
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   const data = await readJsonResponse(response);
   return mapPullRequest(repo, data);
 }
-async function listPullRequests(context, repo, pat, sourceBranch, opts) {
+async function listPullRequests(context, repo, cred, sourceBranch, opts) {
   const response = await fetchWithErrors(
     buildPullRequestsUrl(context, repo, sourceBranch, opts).toString(),
-    { headers: authHeaders(pat) }
+    { headers: authHeaders(cred) }
   );
   const data = await readJsonResponse(response);
   return data.value.map((pullRequest) => mapPullRequest(repo, pullRequest));
 }
-async function getPullRequestChecks(context, repo, pat, prId) {
+async function getPullRequestChecks(context, repo, cred, prId) {
   const response = await fetchWithErrors(
     buildPullRequestStatusesUrl(context, repo, prId).toString(),
-    { headers: authHeaders(pat) }
+    { headers: authHeaders(cred) }
   );
   const data = await readJsonResponse(response);
   return data.value.map(mapPullRequestCheck).filter((check) => check !== null);
 }
-async function openPullRequest(context, repo, pat, sourceBranch, title, description) {
-  const existing = await listPullRequests(context, repo, pat, sourceBranch, {
+async function resolveProjectId(context, cred) {
+  const response = await fetchWithErrors(buildProjectUrl(context).toString(), {
+    headers: authHeaders(cred)
+  });
+  const data = await readJsonResponse(response);
+  return data.id;
+}
+async function getPullRequestPolicyEvaluations(context, cred, projectId, prId) {
+  const response = await fetchWithErrors(
+    buildPolicyEvaluationsUrl(context, projectId, prId).toString(),
+    { headers: authHeaders(cred) }
+  );
+  const data = await readJsonResponse(response);
+  return data.value.map(mapPolicyEvaluationCheck).filter((check) => check !== null);
+}
+async function getPullRequestBuilds(context, cred, prId) {
+  const response = await fetchWithErrors(buildPullRequestBuildsUrl(context, prId).toString(), {
+    headers: authHeaders(cred)
+  });
+  const data = await readJsonResponse(response);
+  return data.value.map((build) => ({
+    id: build.id,
+    state: mapBuildToCheckState(build),
+    name: build.definition?.name ?? `Build #${build.id}`,
+    description: null,
+    targetUrl: build._links?.web?.href ?? null,
+    createdBy: null,
+    createdAt: build.queueTime ?? null,
+    updatedAt: build.finishTime ?? null,
+    source: "build",
+    isBlocking: null
+  }));
+}
+async function openPullRequest(context, repo, cred, sourceBranch, title, description) {
+  const existing = await listPullRequests(context, repo, cred, sourceBranch, {
     status: "active",
     targetBranch: "develop"
   });
@@ -2484,7 +3366,7 @@ async function openPullRequest(context, repo, pat, sourceBranch, title, descript
   const response = await fetchWithErrors(url.toString(), {
     method: "POST",
     headers: {
-      ...authHeaders(pat),
+      ...authHeaders(cred),
       "Content-Type": "application/json"
     },
     body: JSON.stringify(payload)
@@ -2497,15 +3379,39 @@ async function openPullRequest(context, repo, pat, sourceBranch, title, descript
     pullRequest: mapPullRequest(repo, data)
   };
 }
-async function getPullRequestThreads(context, repo, pat, prId) {
+async function getPullRequestThreads(context, repo, cred, prId) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads`
   );
   url.searchParams.set("api-version", "7.1");
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   const data = await readJsonResponse(response);
   return data.value.map(mapThread).filter((thread) => thread !== null);
 }
+function buildThreadCommentUrl(context, repo, prId, threadId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads/${threadId}/comments`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
+async function postThreadComment(context, repo, cred, prId, threadId, content) {
+  const response = await fetchWithErrors(buildThreadCommentUrl(context, repo, prId, threadId).toString(), {
+    method: "POST",
+    headers: {
+      ...authHeaders(cred),
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ content, parentCommentId: 0, commentType: 1 })
+  });
+  const data = await readJsonResponse(response);
+  return {
+    id: data.id,
+    author: data.author?.displayName ?? null,
+    content: data.content ?? content,
+    publishedAt: data.publishedDate ?? null
+  };
+}
 
 // src/commands/pr.ts
 function parsePositivePrNumber(raw) {
@@ -2515,6 +3421,22 @@ function parsePositivePrNumber(raw) {
   const n = Number.parseInt(raw, 10);
   return Number.isFinite(n) && n > 0 ? n : null;
 }
+var PR_NUMBER_HELP = "target the pull request with this numeric id, instead of the current branch's PR. When omitted, the CLI auto-detects the pull request whose source branch equals refs/heads/<current branch> in the Azure DevOps repository identified by the origin remote; if zero or more than one open PR matches, the command fails with a message naming the searched branch.";
+function configureUnwrappedHelp(command) {
+  return command.configureHelp({ helpWidth: 1e3 });
+}
+function autoDetectZeroMatch(branch) {
+  return `No open pull request matches branch ${branch}. Pass --pr-number to target a specific PR, or push the branch and open a pull request.`;
+}
+function autoDetectMultiMatch(branch, ids) {
+  const idList = ids.map((id) => `#${id}`).join(", ");
+  return `Multiple open pull requests match branch ${branch}: ${idList}. Re-run with --pr-number to choose.`;
+}
+function writeContractError(line) {
+  process.stderr.write(`${line}
+`);
+  process.exitCode = 1;
+}
 function formatBranchName(refName) {
   return refName.startsWith("refs/heads/") ? refName.slice("refs/heads/".length) : refName;
 }
@@ -2548,34 +3470,101 @@ function handlePrCommandError(err, context, mode = "read") {
   }
   writeError(error.message);
 }
-function formatPullRequestChecks(checks) {
+function formatPullRequestChecks(checks, checksError) {
+  if (checksError) {
+    return [`Checks: unable to retrieve (${checksError})`];
+  }
   if (checks.length === 0) {
     return ["Checks: none reported by Azure DevOps"];
   }
   const lines = ["Checks:"];
   for (const check of checks) {
-    lines.push(`- [${check.state}] ${check.name}`);
+    const optionalTag = check.isBlocking === false ? " [optional]" : "";
+    lines.push(`- [${check.state}] ${check.name}${optionalTag}`);
     if ((check.state === "failed" || check.state === "error") && check.description) {
       lines.push(`  Detail: ${check.description}`);
     }
   }
   return lines;
 }
+function countCodeComments(threads) {
+  let open = 0;
+  let closed = 0;
+  for (const thread of threads) {
+    if (thread.threadContext === null) {
+      continue;
+    }
+    if (isThreadResolved(thread.status)) {
+      closed += 1;
+    } else {
+      open += 1;
+    }
+  }
+  return { open, closed };
+}
+function formatCodeCommentCounts(counts) {
+  return `Code comments: ${counts.open} open, ${counts.closed} closed`;
+}
 function formatPullRequestBlock(pullRequest) {
   return [
     `#${pullRequest.id} [${pullRequest.status}] ${pullRequest.title}`,
     `${formatBranchName(pullRequest.sourceRefName)} -> ${formatBranchName(pullRequest.targetRefName)}`,
     pullRequest.url ?? "\u2014",
-    ...formatPullRequestChecks(pullRequest.checks)
+    ...formatPullRequestChecks(pullRequest.checks, pullRequest.checksError),
+    formatCodeCommentCounts(pullRequest.codeCommentCounts)
   ].join("\n");
 }
-function threadStatusLabel(status) {
-  return isThreadResolved(status) ? "resolved" : status;
+async function buildPullRequestStatusEntry(context, repo, cred, pullRequest, projectId) {
+  let statusChecks = [];
+  let statusOk = true;
+  try {
+    statusChecks = await getPullRequestChecks(context, repo, cred, pullRequest.id);
+  } catch {
+    statusOk = false;
+  }
+  let policyChecks = [];
+  let policyOk = true;
+  if (projectId === null) {
+    policyOk = false;
+  } else {
+    try {
+      policyChecks = await getPullRequestPolicyEvaluations(context, cred, projectId, pullRequest.id);
+    } catch {
+      policyOk = false;
+    }
+  }
+  let buildChecks = [];
+  let buildsOk = true;
+  try {
+    buildChecks = await getPullRequestBuilds(context, cred, pullRequest.id);
+  } catch {
+    buildsOk = false;
+  }
+  let codeCommentCounts;
+  try {
+    const threads = await getPullRequestThreads(context, repo, cred, pullRequest.id);
+    codeCommentCounts = countCodeComments(threads);
+  } catch {
+    codeCommentCounts = { open: 0, closed: 0 };
+  }
+  const checks = [...statusChecks, ...policyChecks, ...buildChecks];
+  const checksError = checks.length === 0 && (!statusOk || !policyOk || !buildsOk) ? "Azure DevOps request failed" : null;
+  return {
+    ...pullRequest,
+    checks,
+    codeCommentCounts,
+    checksError
+  };
+}
+function threadStatusLabel(status2) {
+  return isThreadResolved(status2) ? "resolved" : status2;
 }
 function formatThreads(prId, title, threads) {
   const lines = [`Comment threads for pull request #${prId}: ${title}`];
   for (const thread of threads) {
-    lines.push("", `Thread #${thread.id} [${threadStatusLabel(thread.status)}] ${thread.threadContext ?? "(general)"}`);
+    const lineSuffix = thread.line === null ? "" : `:${thread.line}`;
+    const location = thread.threadContext ? `${thread.threadContext}${lineSuffix}` : "(general)";
+    lines.push("", `Thread #${thread.id} [${threadStatusLabel(thread.status)}] ${location}`);
     for (const comment of thread.comments) {
       lines.push(`  ${comment.author ?? "Unknown"}: ${comment.content}`);
     }
@@ -2587,12 +3576,12 @@ async function resolvePrCommandContext(options, resolveOpts = {}) {
   const context = resolveContext(options);
   const repo = detectRepoName();
   const branch = requireBranch ? getCurrentBranch() : null;
-  const credential = await requirePat(context.org);
+  const credential = await requireAuthCredential(context.org);
   return {
     context,
     repo,
     branch,
-    pat: credential.pat
+    pat: credential
   };
 }
 function createPrStatusCommand() {
@@ -2605,11 +3594,16 @@ function createPrStatusCommand() {
       context = resolved.context;
       const branch = resolved.branch;
       const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, branch);
+      let projectId = null;
+      try {
+        projectId = await resolveProjectId(resolved.context, resolved.pat);
+      } catch {
+        projectId = null;
+      }
       const pullRequestsWithChecks = await Promise.all(
-        pullRequests.map(async (pullRequest) => ({
-          ...pullRequest,
-          checks: await getPullRequestChecks(resolved.context, resolved.repo, resolved.pat, pullRequest.id)
-        }))
+        pullRequests.map(
+          async (pullRequest) => buildPullRequestStatusEntry(resolved.context, resolved.repo, resolved.pat, pullRequest, projectId)
+        )
       );
       const result = { branch, repository: resolved.repo, pullRequests: pullRequestsWithChecks };
       if (options.json) {
@@ -2690,7 +3684,7 @@ ${result.pullRequest.url ?? "\u2014"}
 }
 function createPrCommentsCommand() {
   const command = new Command12("comments");
-  command.description("List pull request comment threads for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", "target the pull request with this numeric id, instead of the current branch's PR").option("--hide-resolved", "hide threads whose status is resolved / won't fix / closed / by design").option("--json", "output JSON").action(async (options) => {
+  configureUnwrappedHelp(command).description("List pull request comment threads for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--hide-resolved", "hide threads whose status is resolved / won't fix / closed / by design").option("--exclude-resolved", "alias of --hide-resolved: exclude resolved / won't fix / closed / by design threads").option("--code-related-only", "show only threads anchored to a file/line; omit general discussion threads").option("--json", "output JSON").action(async (options) => {
     validateOrgProjectPair(options);
     let context;
     let explicitPrId = null;
@@ -2722,19 +3716,22 @@ function createPrCommentsCommand() {
           status: "active"
         });
         if (pullRequests.length === 0) {
-          writeError(`No active pull request found for branch ${resolved.branch}.`);
+          writeContractError(autoDetectZeroMatch(resolved.branch));
           return;
         }
         if (pullRequests.length > 1) {
-          const ids = pullRequests.map((pr) => `#${pr.id}`).join(", ");
-          writeError(`Multiple active pull requests found for branch ${resolved.branch}: ${ids}. Use pr status to review them.`);
+          writeContractError(autoDetectMultiMatch(resolved.branch, pullRequests.map((pr) => pr.id)));
           return;
         }
         pullRequest = pullRequests[0];
         branchLabel = resolved.branch;
       }
+      const hideResolved = options.hideResolved === true || options.excludeResolved === true;
+      const codeRelatedOnly = options.codeRelatedOnly === true;
       const allThreads = await getPullRequestThreads(resolved.context, resolved.repo, resolved.pat, pullRequest.id);
-      const threads = options.hideResolved ? allThreads.filter((thread) => !isThreadResolved(thread.status)) : allThreads;
+      const threads = allThreads.filter(
+        (thread) => (!hideResolved || !isThreadResolved(thread.status)) && (!codeRelatedOnly || thread.threadContext !== null)
+      );
       const result = { branch: branchLabel, pullRequest, threads };
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
@@ -2742,9 +3739,18 @@ function createPrCommentsCommand() {
         return;
       }
       if (threads.length === 0) {
-        if (options.hideResolved && allThreads.length > 0) {
-          process.stdout.write(`Pull request #${pullRequest.id} has no unresolved comment threads (${allThreads.length} resolved thread${allThreads.length === 1 ? "" : "s"} hidden by --hide-resolved).
-`);
+        if (allThreads.length > 0 && (hideResolved || codeRelatedOnly)) {
+          const filters = [];
+          if (codeRelatedOnly) {
+            filters.push("code-related");
+          }
+          if (hideResolved) {
+            filters.push("unresolved");
+          }
+          process.stdout.write(
+            `Pull request #${pullRequest.id} has no ${filters.join(" ")} comment threads (filtered from ${allThreads.length} thread${allThreads.length === 1 ? "" : "s"}).
+`
+          );
         } else {
           process.stdout.write(`Pull request #${pullRequest.id} has no comment threads.
 `);
@@ -2757,6 +3763,7 @@ function createPrCommentsCommand() {
       handlePrCommandError(err, context, "read");
     }
   });
+  command.addCommand(createPrCommentsReplyCommand());
   return command;
 }
 async function resolveThreadTarget(threadIdRaw, options) {
@@ -2791,12 +3798,11 @@ async function resolveThreadTarget(threadIdRaw, options) {
       status: "active"
     });
     if (pullRequests.length === 0) {
-      writeError(`No active pull request found for branch ${resolved.branch}.`);
+      writeContractError(autoDetectZeroMatch(resolved.branch));
       return null;
     }
     if (pullRequests.length > 1) {
-      const ids = pullRequests.map((pr) => `#${pr.id}`).join(", ");
-      writeError(`Multiple active pull requests found for branch ${resolved.branch}: ${ids}. Use pr status to review them.`);
+      writeContractError(autoDetectMultiMatch(resolved.branch, pullRequests.map((pr) => pr.id)));
       return null;
     }
     pullRequest = pullRequests[0];
@@ -2864,18 +3870,76 @@ async function runThreadStateChange(threadIdRaw, options, direction) {
 }
 function createPrCommentResolveCommand() {
   const command = new Command12("comment-resolve");
-  command.description("Mark a pull request comment thread as resolved").argument("<threadId>", "numeric id of the thread to resolve").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", "target the pull request with this numeric id, instead of the current branch's PR").option("--json", "output JSON").action(async (threadIdRaw, options) => {
+  configureUnwrappedHelp(command).description("Mark a pull request comment thread as resolved").argument("<threadId>", "numeric id of the thread to resolve").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, options) => {
     await runThreadStateChange(threadIdRaw, options, "resolve");
   });
   return command;
 }
 function createPrCommentReopenCommand() {
   const command = new Command12("comment-reopen");
-  command.description("Reopen (set to active) a previously resolved pull request comment thread").argument("<threadId>", "numeric id of the thread to reopen").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", "target the pull request with this numeric id, instead of the current branch's PR").option("--json", "output JSON").action(async (threadIdRaw, options) => {
+  configureUnwrappedHelp(command).description("Reopen (set to active) a previously resolved pull request comment thread").argument("<threadId>", "numeric id of the thread to reopen").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, options) => {
     await runThreadStateChange(threadIdRaw, options, "reopen");
   });
   return command;
 }
+async function runCommentReply(threadIdRaw, text, options) {
+  let context;
+  try {
+    const trimmedText = text.trim();
+    if (!trimmedText) {
+      writeError("Reply text must not be empty.");
+      return;
+    }
+    const target = await resolveThreadTarget(threadIdRaw, options);
+    if (target === null) {
+      return;
+    }
+    context = target.context;
+    const threads = await getPullRequestThreads(target.context, target.repo, target.pat, target.pullRequest.id);
+    const thread = threads.find((t) => t.id === target.threadId);
+    if (!thread) {
+      writeError(`Thread #${target.threadId} not found on pull request #${target.pullRequest.id}.`);
+      return;
+    }
+    const posted = await postThreadComment(
+      target.context,
+      target.repo,
+      target.pat,
+      target.pullRequest.id,
+      target.threadId,
+      trimmedText
+    );
+    const result = {
+      pullRequestId: target.pullRequest.id,
+      threadId: target.threadId,
+      commentId: posted.id,
+      content: posted.content
+    };
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+      return;
+    }
+    process.stdout.write(`Reply posted to thread #${target.threadId} on pull request #${target.pullRequest.id}.
+`);
+  } catch (err) {
+    handlePrCommandError(err, context, "write");
+  }
+}
+function createPrCommentsReplyCommand() {
+  const command = new Command12("reply");
+  configureUnwrappedHelp(command).description("Post a reply to a pull request comment thread").argument("<threadId>", "numeric id of the thread to reply to").argument("<text>", "text of the reply").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, text, options) => {
+    await runCommentReply(threadIdRaw, text, options);
+  });
+  return command;
+}
+function createPrCommentReplyCommand() {
+  const command = new Command12("comment-reply");
+  configureUnwrappedHelp(command).description('Post a reply to a pull request comment thread (alias of "azdo pr comments reply")').argument("<threadId>", "numeric id of the thread to reply to").argument("<text>", "text of the reply").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, text, options) => {
+    await runCommentReply(threadIdRaw, text, options);
+  });
+  return command;
+}
 function createPrCommand() {
   const command = new Command12("pr");
   command.description("Manage Azure DevOps pull requests");
@@ -2884,71 +3948,984 @@ function createPrCommand() {
   command.addCommand(createPrCommentsCommand());
   command.addCommand(createPrCommentResolveCommand());
   command.addCommand(createPrCommentReopenCommand());
+  command.addCommand(createPrCommentReplyCommand());
   return command;
 }
 
-// src/commands/comments.ts
+// src/commands/pipeline.ts
 import { Command as Command13 } from "commander";
-function writeError2(message) {
-  process.stderr.write(`Error: ${message}
-`);
-  process.exit(1);
+
+// src/services/pipeline-client.ts
+var API_VERSION = "7.1";
+function orgProjectBase(context) {
+  return `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}`;
 }
-function formatCommentHeader(comment) {
-  const author = comment.author ?? "Unknown";
-  const timestamp = comment.modifiedAt ?? comment.createdAt ?? "Unknown time";
-  return `Comment #${comment.id} by ${author} at ${timestamp}`;
+function withApiVersion(url) {
+  url.searchParams.set("api-version", API_VERSION);
+  return url;
 }
-function formatComments(result, convertMarkdown) {
-  const lines = [`Comments for work item #${result.workItemId}`];
-  for (const comment of result.comments) {
-    const text = convertMarkdown ? toMarkdown(comment.text) : comment.text;
-    lines.push("", formatCommentHeader(comment), text);
+async function readJsonResponse2(response) {
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
   }
-  return lines.join("\n");
+  return await response.json();
 }
-function createCommentsListCommand() {
-  const command = new Command13("list");
-  command.description("List visible comments for a work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "convert HTML comment bodies to markdown").action(async (idStr, options) => {
-    validateOrgProjectPair(options);
-    const id = parseWorkItemId(idStr);
-    let context;
-    try {
-      context = resolveContext(options);
-      const credential = await requirePat(context.org);
-      const result = await listWorkItemComments(context, id, credential.pat);
-      if (options.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
-        return;
-      }
-      if (result.comments.length === 0) {
-        process.stdout.write(`Work item #${id} has no comments.
-`);
-        return;
+function mapPipeline(pipeline) {
+  return {
+    id: pipeline.id,
+    name: pipeline.name,
+    folder: pipeline.folder?.trim() ? pipeline.folder : null
+  };
+}
+function mapRunState(state) {
+  if (state === "inProgress" || state === "completed") {
+    return state;
+  }
+  return "unknown";
+}
+function mapRunResult(result) {
+  if (result === "succeeded" || result === "failed" || result === "canceled") {
+    return result;
+  }
+  if (result === "partiallySucceeded") {
+    return "failed";
+  }
+  return null;
+}
+function mapBuildState(status2) {
+  if (status2 === "completed") return "completed";
+  if (status2 === void 0 || status2 === "none") return "unknown";
+  return "inProgress";
+}
+function mapBuildSummary(build) {
+  return {
+    id: build.id,
+    name: build.buildNumber ?? null,
+    state: mapBuildState(build.status),
+    result: mapRunResult(build.result),
+    createdDate: build.queueTime ?? build.startTime ?? null,
+    finishedDate: build.finishTime ?? null,
+    sourceBranch: build.sourceBranch ?? null,
+    sourceCommit: build.sourceVersion ?? null
+  };
+}
+function normalizeRef(branch) {
+  return branch.startsWith("refs/") ? branch : `refs/heads/${branch}`;
+}
+async function getPipelineDefinitions(context, cred) {
+  const url = withApiVersion(new URL(`${orgProjectBase(context)}/_apis/pipelines`));
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  return data.value.map(mapPipeline);
+}
+var COMMIT_LOOKBACK = 200;
+async function getPipelineRuns(context, cred, query) {
+  const url = withApiVersion(new URL(`${orgProjectBase(context)}/_apis/build/builds`));
+  if (query.definitionId !== void 0) {
+    url.searchParams.set("definitions", String(query.definitionId));
+  }
+  if (query.prNumber !== void 0) {
+    url.searchParams.set("branchName", `refs/pull/${query.prNumber}/merge`);
+  } else if (query.branch) {
+    url.searchParams.set("branchName", normalizeRef(query.branch));
+  }
+  url.searchParams.set("queryOrder", "queueTimeDescending");
+  url.searchParams.set("$top", String(query.commit ? COMMIT_LOOKBACK : query.top));
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  let runs = data.value.map(mapBuildSummary);
+  if (query.commit) {
+    const needle = query.commit.toLowerCase();
+    runs = runs.filter((run) => run.sourceCommit?.toLowerCase().startsWith(needle));
+  }
+  return runs.slice(0, query.top);
+}
+async function runPipeline(context, cred, pipelineId, opts) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/pipelines/${pipelineId}/runs`)
+  );
+  const body = {};
+  if (opts.branch) {
+    const refName = opts.branch.startsWith("refs/") ? opts.branch : `refs/heads/${opts.branch}`;
+    body.resources = { repositories: { self: { refName } } };
+  }
+  if (opts.parameters && Object.keys(opts.parameters).length > 0) {
+    body.templateParameters = opts.parameters;
+  }
+  const response = await fetchWithErrors(url.toString(), {
+    method: "POST",
+    headers: { ...authHeaders(cred), "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const data = await readJsonResponse2(response);
+  return {
+    id: data.id,
+    state: mapRunState(data.state),
+    webUrl: data._links?.web?.href ?? null
+  };
+}
+function buildUrl(context, buildId) {
+  return withApiVersion(new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}`));
+}
+async function getBuild(context, cred, buildId) {
+  const response = await fetchWithErrors(buildUrl(context, buildId).toString(), {
+    headers: authHeaders(cred)
+  });
+  return readJsonResponse2(response);
+}
+async function getBuildStatus(context, cred, buildId) {
+  const build = await getBuild(context, cred, buildId);
+  return { state: mapBuildState(build.status), result: mapRunResult(build.result) };
+}
+async function getBuildTimeline(context, cred, buildId) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}/timeline`)
+  );
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  const records = data.records ?? [];
+  const errors = [];
+  const stages = [];
+  const jobs = [];
+  const logSteps = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    for (const issue of record.issues ?? []) {
+      if (issue.type === "error" && issue.message) {
+        errors.push({ message: issue.message, source: record.name ?? null });
       }
-      process.stdout.write(`${formatComments(result, options.markdown === true)}
-`);
-    } catch (err) {
-      handleCommandError(err, id, context, "read");
     }
+    if (record.name && record.log?.id !== void 0) {
+      logSteps.set(record.log.id, record.name);
+    }
+    if (!record.name) continue;
+    const status2 = {
+      name: record.name,
+      state: record.state ?? "unknown",
+      result: record.result ?? null
+    };
+    if (record.type === "Stage") {
+      stages.push(status2);
+    } else if (record.type === "Job") {
+      jobs.push({ startTime: record.startTime, status: status2 });
+    }
+  }
+  jobs.sort((a, b) => {
+    if (a.startTime === b.startTime) return 0;
+    if (a.startTime === void 0) return 1;
+    if (b.startTime === void 0) return -1;
+    return a.startTime < b.startTime ? -1 : 1;
   });
-  return command;
+  return { errors, stages, jobs: jobs.map((j) => j.status), logSteps };
+}
+async function listTestRuns(context, cred, buildId) {
+  const url = withApiVersion(new URL(`${orgProjectBase(context)}/_apis/test/runs`));
+  url.searchParams.set("buildUri", `vstfs:///Build/Build/${buildId}`);
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  return data.value;
+}
+async function getTestSummary(context, cred, buildId) {
+  const testRuns = await listTestRuns(context, cred, buildId);
+  let total = 0;
+  let failed = 0;
+  for (const run of testRuns) {
+    const runTotal = run.totalTests ?? 0;
+    total += runTotal;
+    const passedOrSkipped = (run.passedTests ?? 0) + (run.notApplicableTests ?? 0) + (run.incompleteTests ?? 0);
+    failed += Math.max(0, runTotal - passedOrSkipped);
+  }
+  if (total === 0) {
+    return { present: false, total: 0, failed: 0, failedTests: [] };
+  }
+  return { present: true, total, failed, failedTests: [] };
+}
+var MAX_FAILED_TESTS = 50;
+async function getFailedTests(context, cred, buildId) {
+  const testRuns = await listTestRuns(context, cred, buildId);
+  const failed = [];
+  for (const testRun of testRuns) {
+    if (failed.length >= MAX_FAILED_TESTS) break;
+    const resultsUrl = withApiVersion(
+      new URL(`${orgProjectBase(context)}/_apis/test/runs/${testRun.id}/results`)
+    );
+    resultsUrl.searchParams.set("outcomes", "Failed");
+    resultsUrl.searchParams.set("$top", String(MAX_FAILED_TESTS - failed.length));
+    const resultsResponse = await fetchWithErrors(resultsUrl.toString(), {
+      headers: authHeaders(cred)
+    });
+    const resultsData = await readJsonResponse2(resultsResponse);
+    for (const result of resultsData.value) {
+      failed.push({
+        name: result.testCaseTitle ?? result.automatedTestName ?? "(unnamed test)",
+        errorMessage: result.errorMessage ?? null
+      });
+    }
+  }
+  return failed;
+}
+function secondsBetween(start, finish) {
+  if (!start || !finish) return null;
+  const ms = Date.parse(finish) - Date.parse(start);
+  return Number.isFinite(ms) ? Math.round(ms / 1e3) : null;
+}
+async function getRunDetail(context, cred, buildId) {
+  const build = await getBuild(context, cred, buildId);
+  let errors = [];
+  let stages = [];
+  let jobs = [];
+  let errorsAvailable = true;
+  try {
+    const timeline = await getBuildTimeline(context, cred, buildId);
+    errors = timeline.errors;
+    stages = timeline.stages;
+    jobs = timeline.jobs;
+  } catch {
+    errorsAvailable = false;
+  }
+  let tests = { present: false, total: 0, failed: 0, failedTests: [] };
+  let testsAvailable = true;
+  try {
+    tests = await getTestSummary(context, cred, buildId);
+    if (tests.failed > 0) {
+      try {
+        tests = { ...tests, failedTests: await getFailedTests(context, cred, buildId) };
+      } catch {
+      }
+    }
+  } catch {
+    testsAvailable = false;
+  }
+  return {
+    id: build.id,
+    name: build.buildNumber ?? null,
+    state: mapBuildState(build.status),
+    result: mapRunResult(build.result),
+    // createdDate is the queue time, matching the run-list mapping.
+    createdDate: build.queueTime ?? build.startTime ?? null,
+    startedDate: build.startTime ?? null,
+    finishedDate: build.finishTime ?? null,
+    durationSeconds: secondsBetween(build.startTime, build.finishTime),
+    reason: build.reason ?? null,
+    requestedFor: build.requestedFor?.displayName ?? null,
+    sourceBranch: build.sourceBranch ?? null,
+    sourceCommit: build.sourceVersion ?? null,
+    webUrl: build._links?.web?.href ?? null,
+    errors,
+    errorsAvailable,
+    stages,
+    jobs,
+    tests,
+    testsAvailable
+  };
+}
+async function getRunLogs(context, cred, buildId) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}/logs`)
+  );
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse2(response);
+  let logSteps = /* @__PURE__ */ new Map();
+  try {
+    logSteps = (await getBuildTimeline(context, cred, buildId)).logSteps;
+  } catch {
+  }
+  return data.value.map((log) => ({
+    id: log.id,
+    createdOn: log.createdOn ?? null,
+    lineCount: log.lineCount ?? null,
+    step: logSteps.get(log.id) ?? null
+  }));
+}
+async function getRunLog(context, cred, buildId, logId) {
+  const url = withApiVersion(
+    new URL(`${orgProjectBase(context)}/_apis/build/builds/${buildId}/logs/${logId}`)
+  );
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
+  }
+  return response.text();
+}
+
+// src/commands/pipeline.ts
+var EXIT_FAILED = 1;
+var EXIT_CANCELED = 2;
+var EXIT_TIMEOUT = 124;
+function writeError2(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exitCode = 1;
+}
+function handlePipelineError(err, context) {
+  const error = err instanceof Error ? err : new Error(String(err));
+  if (error.message === "AUTH_FAILED") {
+    writeError2('Authentication failed. Check that your credential is valid and has the "Build (Read)" scope.');
+    return;
+  }
+  if (error.message === "PERMISSION_DENIED") {
+    writeError2(`Access denied. Your credential may lack pipeline permissions for project "${context?.project}".`);
+    return;
+  }
+  if (error.message === "NETWORK_ERROR") {
+    writeError2("Could not connect to Azure DevOps. Check your network connection.");
+    return;
+  }
+  if (error.message.startsWith("NOT_FOUND")) {
+    writeError2(`Resource not found in ${context?.org}/${context?.project}.`);
+    return;
+  }
+  if (error.message.startsWith("HTTP_")) {
+    writeError2(`Azure DevOps request failed with ${error.message}.`);
+    return;
+  }
+  writeError2(error.message);
+}
+function parsePositiveId(raw) {
+  if (!/^\d+$/.test(raw)) return null;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+function parseOptionalCount(value, flag) {
+  if (value === void 0) return void 0;
+  const parsed = parsePositiveId(value);
+  if (parsed === null) {
+    writeError2(`Invalid ${flag} "${value}"; expected a positive integer.`);
+    return null;
+  }
+  return parsed;
+}
+function formatBranchName2(refName) {
+  if (!refName) return "\u2014";
+  return refName.startsWith("refs/heads/") ? refName.slice("refs/heads/".length) : refName;
+}
+async function resolvePipelineContext(options) {
+  const context = resolveContext(options);
+  const cred = await requireAuthCredential(context.org);
+  return { context, cred };
+}
+function sleep(ms) {
+  return new Promise((resolve2) => {
+    setTimeout(resolve2, ms);
+  });
+}
+function formatTable(rows, rightAlign = /* @__PURE__ */ new Set()) {
+  const widths = [];
+  for (const row of rows) {
+    row.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
+  }
+  return rows.map(
+    (row) => row.map((cell, i) => rightAlign.has(i) ? cell.padStart(widths[i]) : cell.padEnd(widths[i])).join("  ").trimEnd()
+  ).join("\n");
+}
+function createPipelineListCommand() {
+  const command = new Command13("list");
+  command.description("List Azure DevOps pipeline definitions").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--filter <name>", "filter definitions by name (case-insensitive substring)").option("--json", "output JSON").action(async (options) => {
+    validateOrgProjectPair(options);
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      let definitions = await getPipelineDefinitions(resolved.context, resolved.cred);
+      if (options.filter) {
+        const needle = options.filter.toLowerCase();
+        definitions = definitions.filter((d) => d.name.toLowerCase().includes(needle));
+      }
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(definitions, null, 2)}
+`);
+        return;
+      }
+      if (definitions.length === 0) {
+        process.stdout.write("No pipelines found.\n");
+        return;
+      }
+      const hasFolder = definitions.some((d) => d.folder);
+      const rows = definitions.map(
+        (d) => hasFolder ? [String(d.id), d.name, d.folder ?? ""] : [String(d.id), d.name]
+      );
+      process.stdout.write(`${formatTable(rows, /* @__PURE__ */ new Set([0]))}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function runRow(run) {
+  const status2 = run.result ? `${run.state}/${run.result}` : run.state;
+  return [
+    String(run.id),
+    `[${status2}]`,
+    run.createdDate ?? "\u2014",
+    formatBranchName2(run.sourceBranch),
+    run.sourceCommit ? run.sourceCommit.slice(0, 8) : "\u2014"
+  ];
+}
+var COMMIT_SHA_PATTERN = /^[0-9a-f]{6,40}$/i;
+function parseGetRunsInputs(defIdRaw, options) {
+  let defId;
+  if (defIdRaw !== void 0) {
+    const parsed = parsePositiveId(defIdRaw);
+    if (parsed === null) {
+      writeError2(`Invalid definition id "${defIdRaw}"; expected a positive integer.`);
+      return null;
+    }
+    defId = parsed;
+  } else if (options.commit === void 0 && options.pr === void 0) {
+    writeError2("Definition id is required unless --commit or --pr is given.");
+    return null;
+  }
+  const limit = parseOptionalCount(options.limit, "--limit");
+  if (limit === null) return null;
+  const prNumber = parseOptionalCount(options.pr, "--pr");
+  if (prNumber === null) return null;
+  if (options.commit !== void 0 && !COMMIT_SHA_PATTERN.test(options.commit)) {
+    writeError2(`Invalid --commit "${options.commit}"; expected 6-40 hex characters.`);
+    return null;
+  }
+  if (options.branch !== void 0 && prNumber !== void 0) {
+    writeError2("Use either --branch or --pr, not both.");
+    return null;
+  }
+  return { defId, limit: limit ?? 10, prNumber };
+}
+function createPipelineGetRunsCommand() {
+  const command = new Command13("get-runs");
+  command.description("List recent runs for a pipeline definition (newest first)").argument("[def_id]", "pipeline definition id (optional with --commit or --pr)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--limit <n>", "maximum number of runs to show (default 10)").option("--branch <branch>", "only show runs for this source branch").option("--commit <sha>", "only show runs that built this commit (full or abbreviated SHA)").option("--pr <number>", "only show runs for this pull request").option("--json", "output JSON").action(async (defIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const inputs = parseGetRunsInputs(defIdRaw, options);
+    if (inputs === null) {
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const runs = await getPipelineRuns(resolved.context, resolved.cred, {
+        definitionId: inputs.defId,
+        branch: options.branch,
+        prNumber: inputs.prNumber,
+        commit: options.commit,
+        top: inputs.limit
+      });
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(runs, null, 2)}
+`);
+        return;
+      }
+      if (runs.length === 0) {
+        process.stdout.write(
+          inputs.defId === void 0 ? "No runs found matching the filters.\n" : `No runs found for pipeline ${inputs.defId}.
+`
+        );
+        return;
+      }
+      process.stdout.write(`${formatTable(runs.map(runRow), /* @__PURE__ */ new Set([0]))}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function applyWaitExitCode(result) {
+  if (result.timedOut) {
+    process.exitCode = EXIT_TIMEOUT;
+    return;
+  }
+  switch (result.result) {
+    case "succeeded":
+      return;
+    case "canceled":
+      process.exitCode = EXIT_CANCELED;
+      return;
+    case "failed":
+    default:
+      process.exitCode = EXIT_FAILED;
+  }
+}
+function createPipelineWaitCommand() {
+  const command = new Command13("wait");
+  command.description("Wait for a pipeline run to finish; exit code reflects the result (0 success, non-zero otherwise)").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--timeout <seconds>", "maximum seconds to wait (default 1800)").option("--poll-interval <seconds>", "seconds between status checks (default 5)").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    const timeoutSec = options.timeout === void 0 ? 1800 : Number(options.timeout);
+    const pollSec = options.pollInterval === void 0 ? 5 : Number(options.pollInterval);
+    if (!Number.isFinite(timeoutSec) || timeoutSec < 0) {
+      writeError2(`Invalid --timeout "${options.timeout}"; expected a non-negative number.`);
+      return;
+    }
+    if (!Number.isFinite(pollSec) || pollSec <= 0) {
+      writeError2(`Invalid --poll-interval "${options.pollInterval}"; expected a positive number.`);
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const deadline = Date.now() + timeoutSec * 1e3;
+      let waitResult = null;
+      for (; ; ) {
+        const status2 = await getBuildStatus(resolved.context, resolved.cred, runId);
+        if (status2.state === "completed") {
+          waitResult = { id: runId, state: status2.state, result: status2.result, timedOut: false };
+          break;
+        }
+        if (Date.now() >= deadline) {
+          waitResult = { id: runId, state: status2.state, result: status2.result, timedOut: true };
+          break;
+        }
+        await sleep(pollSec * 1e3);
+      }
+      applyWaitExitCode(waitResult);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(waitResult, null, 2)}
+`);
+        return;
+      }
+      if (waitResult.timedOut) {
+        process.stdout.write(`Run ${runId} did not finish within ${timeoutSec}s (still ${waitResult.state}).
+`);
+      } else {
+        process.stdout.write(`Run ${runId} finished: ${waitResult.result ?? waitResult.state}.
+`);
+      }
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function timelineRows(items, available) {
+  if (!available) {
+    return ["  unavailable"];
+  }
+  if (items.length === 0) {
+    return ["  (none)"];
+  }
+  return items.map((item) => `  - ${item.name} [${item.result ?? item.state}]`);
+}
+function formatDuration(totalSeconds) {
+  const h = Math.floor(totalSeconds / 3600);
+  const m = Math.floor(totalSeconds % 3600 / 60);
+  const s = totalSeconds % 60;
+  if (h > 0) return `${h}h${m}m${s}s`;
+  if (m > 0) return `${m}m${s}s`;
+  return `${s}s`;
+}
+function errorRows(detail) {
+  if (!detail.errorsAvailable) {
+    return ["  unavailable"];
+  }
+  if (detail.errors.length === 0) {
+    return ["  (none)"];
+  }
+  return detail.errors.map((error) => {
+    const source = error.source ? `[${error.source}] ` : "";
+    return `  - ${source}${error.message}`;
+  });
+}
+function failedTestRow(test) {
+  if (!test.errorMessage) {
+    return `  - ${test.name}`;
+  }
+  const firstLine = test.errorMessage.split("\n", 1)[0].trim();
+  return `  - ${test.name}: ${firstLine}`;
+}
+function testRows(detail) {
+  if (!detail.testsAvailable) {
+    return ["  unavailable"];
+  }
+  if (detail.tests.present) {
+    return [
+      `  ${detail.tests.failed} failing of ${detail.tests.total}`,
+      ...detail.tests.failedTests.map(failedTestRow)
+    ];
+  }
+  return ["  no tests present"];
+}
+function formatRunDetail(detail) {
+  const status2 = detail.result ? `${detail.state}/${detail.result}` : detail.state;
+  const name = detail.name ? ` ${detail.name}` : "";
+  const duration = detail.durationSeconds == null ? "\u2014" : formatDuration(detail.durationSeconds);
+  return [
+    `Run #${detail.id} [${status2}]${name}`,
+    `Queued: ${detail.createdDate ?? "\u2014"}    Started: ${detail.startedDate ?? "\u2014"}    Finished: ${detail.finishedDate ?? "\u2014"}`,
+    `Duration: ${duration}    Reason: ${detail.reason ?? "\u2014"}    Requested for: ${detail.requestedFor ?? "\u2014"}`,
+    `Branch: ${formatBranchName2(detail.sourceBranch)}    Commit: ${detail.sourceCommit ?? "unavailable"}`,
+    ...detail.webUrl ? [`Link: ${detail.webUrl}`] : [],
+    "",
+    "Stages:",
+    ...timelineRows(detail.stages, detail.errorsAvailable),
+    "",
+    "Jobs:",
+    ...timelineRows(detail.jobs, detail.errorsAvailable),
+    "",
+    "Errors:",
+    ...errorRows(detail),
+    "",
+    "Tests:",
+    ...testRows(detail)
+  ].join("\n");
+}
+function createPipelineGetRunDetailCommand() {
+  const command = new Command13("get-run-detail");
+  command.description("Show a detailed summary of a single pipeline run (errors, failing tests, stages)").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const detail = await getRunDetail(resolved.context, resolved.cred, runId);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(detail, null, 2)}
+`);
+        return;
+      }
+      process.stdout.write(`${formatRunDetail(detail)}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function grepWithContext(lines, grep, context) {
+  const include = /* @__PURE__ */ new Set();
+  lines.forEach((line, i) => {
+    if (grep.test(line)) {
+      for (let j = Math.max(0, i - context); j <= Math.min(lines.length - 1, i + context); j++) {
+        include.add(j);
+      }
+    }
+  });
+  const selected = [];
+  let prev = -1;
+  for (const i of [...include].sort((a, b) => a - b)) {
+    if (selected.length > 0 && i > prev + 1) {
+      selected.push("--");
+    }
+    selected.push(lines[i]);
+    prev = i;
+  }
+  return selected;
+}
+function filterLogLines(content, grep, tail, context) {
+  let lines = content.split("\n");
+  if (lines.at(-1) === "") {
+    lines.pop();
+  }
+  if (grep) {
+    lines = context > 0 ? grepWithContext(lines, grep, context) : lines.filter((line) => grep.test(line));
+  }
+  if (tail !== void 0 && lines.length > tail) {
+    lines = lines.slice(-tail);
+  }
+  return lines;
+}
+function parseLogFilters(options) {
+  if (options.logId !== void 0 && options.step !== void 0) {
+    writeError2("Use either --log-id or --step, not both.");
+    return null;
+  }
+  const selectsSingleLog = options.logId !== void 0 || options.step !== void 0;
+  const slices = options.tail !== void 0 || options.grep !== void 0 || options.context !== void 0;
+  if (slices && !selectsSingleLog) {
+    writeError2("--tail, --grep, and --context require --log-id or --step.");
+    return null;
+  }
+  if (options.context !== void 0 && options.grep === void 0) {
+    writeError2("--context requires --grep.");
+    return null;
+  }
+  const tail = parseOptionalCount(options.tail, "--tail");
+  if (tail === null) return null;
+  const contextLines = parseOptionalCount(options.context, "--context");
+  if (contextLines === null) return null;
+  let grep;
+  if (options.grep !== void 0) {
+    try {
+      grep = new RegExp(options.grep);
+    } catch {
+      writeError2(`Invalid --grep "${options.grep}"; expected a valid regular expression.`);
+      return null;
+    }
+  }
+  return { tail, contextLines: contextLines ?? 0, grep };
+}
+function chooseStepLog(logs, step, runId) {
+  const needle = step.toLowerCase();
+  const matches = logs.filter((l) => l.step?.toLowerCase().includes(needle));
+  const exact = matches.filter((l) => l.step?.toLowerCase() === needle);
+  const chosen = exact.length === 1 ? exact : matches;
+  if (chosen.length === 0) {
+    writeError2(`No log matches step "${step}" in run ${runId}.`);
+    return null;
+  }
+  if (chosen.length > 1) {
+    const candidates = chosen.map((l) => `${l.id} (${l.step})`).join(", ");
+    writeError2(`Step "${step}" matches multiple logs: ${candidates}. Be more specific or use --log-id.`);
+    return null;
+  }
+  return chosen[0].id;
+}
+async function resolveRequestedLogId(resolved, runId, options) {
+  if (options.logId !== void 0) {
+    const parsed = parsePositiveId(options.logId);
+    if (parsed === null) {
+      writeError2(`Invalid --log-id "${options.logId}"; expected a positive integer.`);
+      return null;
+    }
+    return parsed;
+  }
+  if (options.step === void 0) {
+    return void 0;
+  }
+  const allLogs = await getRunLogs(resolved.context, resolved.cred, runId);
+  return chooseStepLog(allLogs, options.step, runId);
+}
+function printSingleLog(content, filters) {
+  if (filters.grep !== void 0 || filters.tail !== void 0) {
+    const lines = filterLogLines(content, filters.grep, filters.tail, filters.contextLines);
+    if (lines.length > 0) {
+      process.stdout.write(`${lines.join("\n")}
+`);
+    }
+    return;
+  }
+  process.stdout.write(content.endsWith("\n") ? content : `${content}
+`);
+}
+function createPipelineLogsCommand() {
+  const command = new Command13("logs");
+  command.description("List a pipeline run's logs, or print a specific log with --log-id").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--log-id <id>", "print the content of this log id").option("--step <name>", "print the log of the step/job matching this name (case-insensitive substring)").option("--tail <n>", "with --log-id/--step, print only the last N lines").option("--grep <pattern>", "with --log-id/--step, print only lines matching this regular expression").option("--context <n>", "with --grep, also print N lines around each match (grep -C)").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    const filters = parseLogFilters(options);
+    if (filters === null) {
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const logId = await resolveRequestedLogId(resolved, runId, options);
+      if (logId === null) {
+        return;
+      }
+      if (logId !== void 0) {
+        const content = await getRunLog(resolved.context, resolved.cred, runId, logId);
+        printSingleLog(content, filters);
+        return;
+      }
+      const logs = await getRunLogs(resolved.context, resolved.cred, runId);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(logs, null, 2)}
+`);
+        return;
+      }
+      if (logs.length === 0) {
+        process.stdout.write(`No logs found for run ${runId}.
+`);
+        return;
+      }
+      const rows = logs.map((l) => [
+        String(l.id),
+        l.createdOn ?? "\u2014",
+        l.lineCount == null ? "" : `${l.lineCount} lines`,
+        l.step ?? ""
+      ]);
+      process.stdout.write(`${formatTable(rows, /* @__PURE__ */ new Set([0]))}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function createPipelineTestsCommand() {
+  const command = new Command13("tests");
+  command.description("Show a run's test results: summary plus failing tests by name (no log grepping needed)").argument("<run_id>", "pipeline run id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--failed", "list only the failing tests").option("--json", "output JSON").action(async (runIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const runId = parsePositiveId(runIdRaw);
+    if (runId === null) {
+      writeError2(`Invalid run id "${runIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const summary = await getTestSummary(resolved.context, resolved.cred, runId);
+      const failedTests = summary.failed > 0 ? await getFailedTests(resolved.context, resolved.cred, runId) : [];
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify({ ...summary, failedTests }, null, 2)}
+`);
+        return;
+      }
+      if (!summary.present) {
+        process.stdout.write(`No test results published for run ${runId}.
+`);
+        return;
+      }
+      if (!options.failed) {
+        process.stdout.write(`Run #${runId}: ${summary.failed} failing of ${summary.total} tests
+`);
+      }
+      if (failedTests.length > 0) {
+        process.stdout.write(`${failedTests.map(failedTestRow).join("\n")}
+`);
+      } else if (options.failed) {
+        process.stdout.write("No failing tests.\n");
+      }
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function parseParameters(values) {
+  const result = {};
+  for (const entry of values ?? []) {
+    const eq = entry.indexOf("=");
+    if (eq <= 0) {
+      return null;
+    }
+    const key = entry.slice(0, eq);
+    const value = entry.slice(eq + 1);
+    result[key] = value;
+  }
+  return result;
+}
+function collectParameter(value, previous) {
+  return previous.concat([value]);
+}
+function createPipelineStartCommand() {
+  const command = new Command13("start");
+  command.description("Queue a new run of a pipeline definition").argument("<def_id>", "pipeline definition id").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--branch <branch>", "branch to run against (default: pipeline default branch)").option("--parameter <key=value>", "template parameter (repeatable)", collectParameter, []).option("--json", "output JSON").action(async (defIdRaw, options) => {
+    validateOrgProjectPair(options);
+    const defId = parsePositiveId(defIdRaw);
+    if (defId === null) {
+      writeError2(`Invalid definition id "${defIdRaw}"; expected a positive integer.`);
+      return;
+    }
+    const parameters = parseParameters(options.parameter);
+    if (parameters === null) {
+      writeError2("Invalid --parameter; expected key=value.");
+      return;
+    }
+    let context;
+    try {
+      const resolved = await resolvePipelineContext(options);
+      context = resolved.context;
+      const result = await runPipeline(resolved.context, resolved.cred, defId, {
+        branch: options.branch,
+        parameters
+      });
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        return;
+      }
+      process.stdout.write(`Queued run #${result.id} [${result.state}]
+${result.webUrl ?? "\u2014"}
+`);
+    } catch (err) {
+      handlePipelineError(err, context);
+    }
+  });
+  return command;
+}
+function createPipelineCommand() {
+  const command = new Command13("pipeline");
+  command.description("Manage Azure DevOps pipelines");
+  command.addCommand(createPipelineListCommand());
+  command.addCommand(createPipelineGetRunsCommand());
+  command.addCommand(createPipelineWaitCommand());
+  command.addCommand(createPipelineGetRunDetailCommand());
+  command.addCommand(createPipelineLogsCommand());
+  command.addCommand(createPipelineTestsCommand());
+  command.addCommand(createPipelineStartCommand());
+  return command;
+}
+
+// src/commands/comments.ts
+import { Command as Command14 } from "commander";
+function writeError3(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(1);
+}
+function formatCommentHeader(comment) {
+  const author = comment.author ?? "Unknown";
+  const timestamp = comment.modifiedAt ?? comment.createdAt ?? "Unknown time";
+  return `Comment #${comment.id} by ${author} at ${timestamp}`;
+}
+function formatComments(result, convertMarkdown) {
+  const lines = [`Comments for work item #${result.workItemId}`];
+  for (const comment of result.comments) {
+    const text = convertMarkdown ? toMarkdown(comment.text) : comment.text;
+    lines.push("", formatCommentHeader(comment), text);
+  }
+  return lines.join("\n");
+}
+function createCommentsListCommand() {
+  const command = new Command14("list");
+  command.description("List visible comments for a work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "convert HTML comment bodies to markdown").action(async (idStr, options) => {
+    validateOrgProjectPair(options);
+    const id = parseWorkItemId(idStr);
+    let context;
+    try {
+      context = resolveContext(options);
+      const credential = await requireAuthCredential(context.org);
+      const result = await listWorkItemComments(context, id, credential);
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        return;
+      }
+      if (result.comments.length === 0) {
+        process.stdout.write(`Work item #${id} has no comments.
+`);
+        return;
+      }
+      process.stdout.write(`${formatComments(result, options.markdown === true)}
+`);
+    } catch (err) {
+      handleCommandError(err, id, context, "read");
+    }
+  });
+  return command;
 }
 function createCommentsAddCommand() {
-  const command = new Command13("add");
+  const command = new Command14("add");
   command.description("Add a comment to a work item").argument("<id>", "work item ID").argument("<text>", "comment text").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "post comment as markdown").action(async (idStr, text, options) => {
     validateOrgProjectPair(options);
     const id = parseWorkItemId(idStr);
     if (text.trim() === "") {
-      writeError2("Comment text must be a non-empty string.");
+      writeError3("Comment text must be a non-empty string.");
     }
     let context;
     try {
       context = resolveContext(options);
-      const credential = await requirePat(context.org);
+      const credential = await requireAuthCredential(context.org);
       const format = options.markdown === true ? "markdown" : "html";
-      const result = await addWorkItemComment(context, id, credential.pat, text, format);
+      const result = await addWorkItemComment(context, id, credential, text, format);
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
@@ -2963,7 +4940,7 @@ function createCommentsAddCommand() {
   return command;
 }
 function createCommentsCommand() {
-  const command = new Command13("comments");
+  const command = new Command14("comments");
   command.description("Manage Azure DevOps work item comments");
   command.addCommand(createCommentsListCommand());
   command.addCommand(createCommentsAddCommand());
@@ -2971,12 +4948,12 @@ function createCommentsCommand() {
 }
 
 // src/commands/download-attachment.ts
-import { Command as Command14 } from "commander";
-import { writeFile } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import { join as join2 } from "path";
+import { Command as Command15 } from "commander";
+import { writeFile as writeFile2 } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { join as join3 } from "path";
 function createDownloadAttachmentCommand() {
-  const command = new Command14("download-attachment");
+  const command = new Command15("download-attachment");
   command.description("Download an attachment from an Azure DevOps work item").argument("<id>", "work item ID").argument("<filename>", "name of the attachment to download").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--output <dir>", "target directory for the downloaded file").action(
     async (idStr, filename, options) => {
       const id = parseWorkItemId(idStr);
@@ -2984,14 +4961,14 @@ function createDownloadAttachmentCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await requirePat(context.org);
+        const credential = await requireAuthCredential(context.org);
         const outputDir = options.output ?? ".";
-        if (!existsSync4(outputDir)) {
+        if (!existsSync5(outputDir)) {
           process.stderr.write(`Error: Output directory "${outputDir}" does not exist.
 `);
           process.exit(1);
         }
-        const workItem = await getWorkItem(context, id, credential.pat);
+        const workItem = await getWorkItem(context, id, credential);
         const attachment = workItem.attachments?.find(
           (a) => a.name === filename
         );
@@ -3002,9 +4979,9 @@ function createDownloadAttachmentCommand() {
           );
           process.exit(1);
         }
-        const data = await downloadAttachment(attachment.url, credential.pat);
-        const outputPath = join2(outputDir, filename);
-        await writeFile(outputPath, Buffer.from(data));
+        const data = await downloadAttachment(attachment.url, credential);
+        const outputPath = join3(outputDir, filename);
+        await writeFile2(outputPath, Buffer.from(data));
         process.stdout.write(
           `Downloaded "${filename}" (${formatFileSize(attachment.size)}) to ${outputPath}
 `
@@ -3017,9 +4994,416 @@ function createDownloadAttachmentCommand() {
   return command;
 }
 
+// src/commands/relations.ts
+import { Command as Command16 } from "commander";
+
+// src/services/relations-client.ts
+var API_VERSION2 = "7.1";
+function buildRelationTypesUrl(context) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/wit/workitemrelationtypes`
+  );
+  url.searchParams.set("api-version", API_VERSION2);
+  return url;
+}
+function buildWorkItemUrl2(context, id, expand) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
+  );
+  url.searchParams.set("api-version", API_VERSION2);
+  if (expand) url.searchParams.set("$expand", expand);
+  return url;
+}
+function buildBatchWorkItemsUrl(context, ids) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems`
+  );
+  url.searchParams.set("ids", ids.join(","));
+  url.searchParams.set("fields", "System.Id,System.Title");
+  url.searchParams.set("api-version", API_VERSION2);
+  return url;
+}
+function mapRelationType(raw) {
+  return {
+    referenceName: raw.referenceName,
+    name: raw.name,
+    usage: raw.attributes?.usage ?? "unknown",
+    enabled: raw.attributes?.enabled !== false,
+    directional: raw.attributes?.directional ?? null
+  };
+}
+async function readJsonResponse3(response) {
+  if (!response.ok) throw new Error(`HTTP_${response.status}`);
+  return await response.json();
+}
+function parseTargetId(url) {
+  const match = /\/workItems\/(\d+)$/i.exec(url);
+  return match ? Number(match[1]) : null;
+}
+async function getWorkItemRelationTypes(context, cred) {
+  const url = buildRelationTypesUrl(context);
+  const response = await fetchWithErrors(url.toString(), {
+    headers: authHeaders(cred)
+  });
+  const body = await readJsonResponse3(response);
+  return (body.value ?? []).map(mapRelationType).filter((t) => t.usage === "workItemLink" && t.enabled);
+}
+async function resolveRelationType(context, cred, alias) {
+  const types = await getWorkItemRelationTypes(context, cred);
+  const lower = alias.toLowerCase();
+  const match = types.find((t) => t.name.toLowerCase() === lower);
+  if (!match) throw new Error(`UNKNOWN_RELATION_TYPE:${alias}`);
+  return match;
+}
+async function getWorkItemWithRelations(context, cred, id) {
+  const url = buildWorkItemUrl2(context, id, "relations");
+  const response = await fetchWithErrors(url.toString(), {
+    headers: authHeaders(cred)
+  });
+  return readJsonResponse3(response);
+}
+async function addWorkItemRelation(context, cred, type, id1, id2) {
+  if (id1 === id2) throw new Error("SELF_RELATION");
+  const relType = await resolveRelationType(context, cred, type);
+  const workItem = await getWorkItemWithRelations(context, cred, id1);
+  const targetUrl = `https://dev.azure.com/${encodeURIComponent(context.org)}/_apis/wit/workItems/${id2}`;
+  const existing = (workItem.relations ?? []).find(
+    (r) => r.rel === relType.referenceName && r.url.toLowerCase() === targetUrl.toLowerCase()
+  );
+  if (existing) {
+    return { status: "already_exists", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+  }
+  const patchUrl = buildWorkItemUrl2(context, id1);
+  const response = await fetchWithErrors(patchUrl.toString(), {
+    method: "PATCH",
+    headers: { ...authHeaders(cred), "Content-Type": "application/json-patch+json" },
+    body: JSON.stringify([
+      { op: "add", path: "/relations/-", value: { rel: relType.referenceName, url: targetUrl } }
+    ])
+  });
+  if (!response.ok) throw new Error(`HTTP_${response.status}`);
+  return { status: "added", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+}
+async function removeWorkItemRelation(context, cred, type, id1, id2) {
+  if (id1 === id2) throw new Error("SELF_RELATION");
+  const relType = await resolveRelationType(context, cred, type);
+  const workItem = await getWorkItemWithRelations(context, cred, id1);
+  const relations = workItem.relations ?? [];
+  const index = relations.findIndex(
+    (r) => r.rel === relType.referenceName && parseTargetId(r.url) === id2
+  );
+  if (index === -1) {
+    return { status: "not_found", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+  }
+  const patchUrl = buildWorkItemUrl2(context, id1);
+  const response = await fetchWithErrors(patchUrl.toString(), {
+    method: "PATCH",
+    headers: { ...authHeaders(cred), "Content-Type": "application/json-patch+json" },
+    body: JSON.stringify([{ op: "remove", path: `/relations/${index}` }])
+  });
+  if (!response.ok) throw new Error(`HTTP_${response.status}`);
+  return { status: "removed", type: relType.name, referenceName: relType.referenceName, id1, id2 };
+}
+async function listWorkItemRelations(context, cred, id) {
+  const workItem = await getWorkItemWithRelations(context, cred, id);
+  const allRelations = workItem.relations ?? [];
+  const wiRelations = allRelations.filter(
+    (r) => !r.rel.startsWith("AttachedFile") && !r.rel.startsWith("Hyperlink") && !r.rel.startsWith("ArtifactLink")
+  );
+  if (wiRelations.length === 0) {
+    return { workItemId: id, relations: [] };
+  }
+  const types = await getWorkItemRelationTypes(context, cred);
+  const typeNameMap = new Map(types.map((t) => [t.referenceName, t.name]));
+  const targetIds = wiRelations.map((r) => parseTargetId(r.url)).filter((n) => n !== null);
+  const titleMap = /* @__PURE__ */ new Map();
+  if (targetIds.length > 0) {
+    try {
+      const batchUrl = buildBatchWorkItemsUrl(context, targetIds);
+      const batchResponse = await fetchWithErrors(batchUrl.toString(), {
+        headers: authHeaders(cred)
+      });
+      const batchBody = await readJsonResponse3(batchResponse);
+      for (const item of batchBody.value ?? []) {
+        titleMap.set(item.id, item.fields["System.Title"] ?? "");
+      }
+    } catch {
+    }
+  }
+  const relations = wiRelations.map((r) => {
+    const targetId = parseTargetId(r.url);
+    return {
+      rel: r.rel,
+      relName: typeNameMap.get(r.rel) ?? r.rel,
+      targetId: targetId ?? 0,
+      targetTitle: targetId !== null ? titleMap.get(targetId) ?? null : null,
+      targetUrl: r.url,
+      comment: r.attributes?.comment ?? null
+    };
+  });
+  return { workItemId: id, relations };
+}
+
+// src/commands/relations.ts
+function addCommonOptions(cmd) {
+  return cmd.option("--json", "Output as JSON").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project");
+}
+async function resolveCredentials(opts) {
+  const context = resolveContext(opts);
+  const cred = await requireAuthCredential(context.org);
+  return { context, cred };
+}
+function formatRelationTypes(types) {
+  if (types.length === 0) return "No work item relation types found.";
+  const nameWidth = Math.max(...types.map((t) => t.name.length), 4);
+  const lines = ["Available work item relation types:", ""];
+  for (const t of types) {
+    lines.push(`${t.name.padEnd(nameWidth + 2)}${t.referenceName}`);
+  }
+  return lines.join("\n");
+}
+function formatRelationsList(workItemId, relations) {
+  if (relations.length === 0) return `Work item #${workItemId} has no relations.`;
+  const typeWidth = Math.max(...relations.map((r) => r.relName.length), 4) + 2;
+  const idWidth = Math.max(...relations.map((r) => String(r.targetId).length), 4) + 1;
+  const lines = [`Relations for work item #${workItemId}:`, ""];
+  for (const r of relations) {
+    const typeLabel = `[${r.relName}]`.padEnd(typeWidth);
+    const idLabel = `#${r.targetId}`.padEnd(idWidth);
+    lines.push(`${typeLabel}  ${idLabel}  ${r.targetTitle ?? "(unknown)"}`);
+  }
+  return lines.join("\n");
+}
+function handleRelationError(err, id1) {
+  const msg = err instanceof Error ? err.message : String(err);
+  if (msg === "SELF_RELATION") {
+    process.stderr.write(`Error: cannot relate a work item to itself (#${id1}).
+`);
+  } else if (msg.startsWith("UNKNOWN_RELATION_TYPE:")) {
+    const name = msg.replace("UNKNOWN_RELATION_TYPE:", "");
+    process.stderr.write(
+      `Error: unknown relation type "${name}". Run 'azdo relations types' to see valid names.
+`
+    );
+  } else if (msg.startsWith("NOT_FOUND")) {
+    const target = id1 !== void 0 ? id1 : "unknown";
+    process.stderr.write(`Error: work item #${target} not found.
+`);
+  } else if (msg === "AUTH_FAILED") {
+    process.stderr.write(
+      `Error: authentication failed. Check your PAT has Work Items \u2192 Read & Write scope.
+`
+    );
+  } else {
+    process.stderr.write(`Error: ${msg}
+`);
+  }
+  process.exit(1);
+}
+function parsePositiveInt(value, label) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n <= 0) {
+    process.stderr.write(`Error: ${label} must be a positive integer.
+`);
+    process.exit(1);
+  }
+  return n;
+}
+function createRelationsCommand() {
+  const relations = new Command16("relations").description("Manage work item relations");
+  addCommonOptions(
+    relations.command("types").description("List all available work item relation types")
+  ).action(async (opts) => {
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const types = await getWorkItemRelationTypes(context, cred);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(types, null, 2) + "\n");
+      } else {
+        process.stdout.write(formatRelationTypes(types) + "\n");
+      }
+    } catch (err) {
+      handleRelationError(err);
+    }
+  });
+  addCommonOptions(
+    relations.command("add <type> <id1> <id2>").description("Add a directed relation from work item <id1> to <id2>")
+  ).action(async (type, id1Str, id2Str, opts) => {
+    const id1 = parsePositiveInt(id1Str, "id1");
+    const id2 = parsePositiveInt(id2Str, "id2");
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const result = await addWorkItemRelation(context, cred, type, id1, id2);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else if (result.status === "already_exists") {
+        process.stdout.write(`Relation already exists: #${id1} --[${result.type}]--> #${id2}
+`);
+      } else {
+        process.stdout.write(`Added relation: #${id1} --[${result.type}]--> #${id2}
+`);
+      }
+    } catch (err) {
+      handleRelationError(err, id1);
+    }
+  });
+  addCommonOptions(
+    relations.command("remove <type> <id1> <id2>").description("Remove a directed relation of <type> from work item <id1> to <id2>")
+  ).action(async (type, id1Str, id2Str, opts) => {
+    const id1 = parsePositiveInt(id1Str, "id1");
+    const id2 = parsePositiveInt(id2Str, "id2");
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const result = await removeWorkItemRelation(context, cred, type, id1, id2);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else if (result.status === "not_found") {
+        process.stdout.write(`No relation of type '${result.type}' found between #${id1} and #${id2}
+`);
+      } else {
+        process.stdout.write(`Removed relation: #${id1} --[${result.type}]--> #${id2}
+`);
+      }
+    } catch (err) {
+      handleRelationError(err, id1);
+    }
+  });
+  addCommonOptions(
+    relations.command("list <id>").description("List all work item link relations on a work item")
+  ).action(async (idStr, opts) => {
+    const id = parsePositiveInt(idStr, "id");
+    try {
+      const { context, cred } = await resolveCredentials(opts);
+      const result = await listWorkItemRelations(context, cred, id);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      } else {
+        process.stdout.write(formatRelationsList(result.workItemId, result.relations) + "\n");
+      }
+    } catch (err) {
+      handleRelationError(err, id);
+    }
+  });
+  return relations;
+}
+
+// src/services/update-check.ts
+import fs2 from "fs";
+import path2 from "path";
+import os from "os";
+var THROTTLE_MS = 10 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 1500;
+var REGISTRY_URL = "https://registry.npmjs.org/azdo-cli/latest";
+function getCachePath() {
+  return path2.join(os.homedir(), ".azdo", "update-check.json");
+}
+function defaultReadCache() {
+  try {
+    return fs2.readFileSync(getCachePath(), "utf-8");
+  } catch {
+    return null;
+  }
+}
+function defaultWriteCache(data) {
+  try {
+    const cachePath = getCachePath();
+    fs2.mkdirSync(path2.dirname(cachePath), { recursive: true });
+    fs2.writeFileSync(cachePath, data);
+  } catch {
+  }
+}
+function parseCache(raw) {
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const { lastCheck, latestVersion } = parsed;
+  if (typeof lastCheck !== "number" || !Number.isFinite(lastCheck)) return null;
+  if (typeof latestVersion !== "string" || latestVersion.length === 0) return null;
+  return { lastCheck, latestVersion };
+}
+async function defaultFetchLatest() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(REGISTRY_URL, { signal: controller.signal });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (typeof body !== "object" || body === null) return null;
+    const v = body.version;
+    return typeof v === "string" && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseVersion(v) {
+  if (typeof v !== "string") return null;
+  const trimmed = v.trim().replace(/^v/, "");
+  const match = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/.exec(trimmed);
+  if (!match) return null;
+  const release = [Number(match[1]), Number(match[2]), Number(match[3])];
+  if (!release.every(Number.isFinite)) return null;
+  return { release, prerelease: match[4] !== void 0 };
+}
+function isNewer(latest, current) {
+  const a = parseVersion(latest);
+  const b = parseVersion(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a.release[i] > b.release[i]) return true;
+    if (a.release[i] < b.release[i]) return false;
+  }
+  if (a.prerelease && !b.prerelease) return false;
+  if (!a.prerelease && b.prerelease) return true;
+  return false;
+}
+async function getUpdateNotice(opts) {
+  try {
+    const {
+      enabled = true,
+      now = Date.now,
+      readCache = defaultReadCache,
+      writeCache = defaultWriteCache,
+      fetchLatest = defaultFetchLatest,
+      isTTY = () => Boolean(process.stderr.isTTY),
+      currentVersion = version
+    } = opts ?? {};
+    if (enabled === false) return null;
+    if (!isTTY()) return null;
+    const cache = parseCache(readCache());
+    const lastCheck = cache?.lastCheck ?? 0;
+    if (now() - lastCheck < THROTTLE_MS) return null;
+    const latest = await fetchLatest();
+    if (!latest) return null;
+    writeCache(JSON.stringify({ lastCheck: now(), latestVersion: latest }));
+    if (isNewer(latest, currentVersion)) {
+      return `A new version of azdo-cli is available: ${currentVersion} \u2192 ${latest}. Run \`npm i -g azdo-cli\` to update.`;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // src/index.ts
-var program = new Command15();
+function exitOnEpipe(err) {
+  if (err.code === "EPIPE") {
+    process.exit(0);
+  }
+  throw err;
+}
+process.stdout.on("error", exitOnEpipe);
+process.stderr.on("error", exitOnEpipe);
+var program = new Command17();
 program.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
+program.option("--no-update-check", "Skip the check for a newer published version");
+program.option("--trace <filepath>", "Append redacted HTTP request/response trace to a file (owner-read-only permissions)");
 program.addCommand(createGetItemCommand());
 program.addCommand(createAuthCommand());
 program.addCommand(createClearPatCommand());
@@ -3032,10 +5416,24 @@ program.addCommand(createSetMdFieldCommand());
 program.addCommand(createUpsertCommand());
 program.addCommand(createListFieldsCommand());
 program.addCommand(createPrCommand());
+program.addCommand(createPipelineCommand());
 program.addCommand(createCommentsCommand());
 program.addCommand(createDownloadAttachmentCommand());
+program.addCommand(createRelationsCommand());
 program.showHelpAfterError();
-program.parse();
+program.hook("preAction", () => {
+  const { trace } = program.opts();
+  if (trace) {
+    initTraceWriter(trace);
+  }
+});
+program.hook("postAction", async () => {
+  const notice = await getUpdateNotice({ enabled: program.opts().updateCheck });
+  if (notice) {
+    process.stderr.write(notice + "\n");
+  }
+});
+await program.parseAsync();
 if (process.argv.length <= 2) {
   program.help();
 }