azdo-cli 0.5.0-next.155 → 0.5.0-next.349

package/dist/index.js

@@ -1,7 +1,37 @@
 #!/usr/bin/env node
+import {
+  AZDO_RESOURCE_ID,
+  CredentialMissingError,
+  CredentialStoreUnavailableError,
+  SETTINGS,
+  appendAuthAuditEvent,
+  buildScopeString,
+  defaultScopes,
+  deletePat,
+  firstPartyShippedScopes,
+  getConfigValue,
+  getPat,
+  getStoredCredential,
+  listOrgsWithStoredPat,
+  loadConfig,
+  maskedDisplay,
+  normalizePat,
+  openUrl,
+  probeBackend,
+  readAuditEvents,
+  readTokenResponse,
+  refreshIfNeeded,
+  resolveOAuthConfig,
+  runAuthCodeFlow,
+  setConfigValue,
+  storeOAuthCredential,
+  storePat,
+  tokenResponseToCredential,
+  unsetConfigValue
+} from "./chunk-C7RAZJHV.js";
 
 // src/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command15 } from "commander";
 
 // src/version.ts
 import { readFileSync } from "fs";
@@ -26,8 +56,15 @@ var DEFAULT_FIELDS = [
   "System.AreaPath",
   "System.IterationPath"
 ];
-function authHeaders(pat) {
-  const token = Buffer.from(`:${pat}`).toString("base64");
+function authHeaders(credentialOrPat) {
+  if (typeof credentialOrPat === "string") {
+    const token2 = Buffer.from(`:${credentialOrPat}`).toString("base64");
+    return { Authorization: `Basic ${token2}` };
+  }
+  if (credentialOrPat.kind === "oauth") {
+    return { Authorization: `Bearer ${credentialOrPat.pat}` };
+  }
+  const token = Buffer.from(`:${credentialOrPat.pat}`).toString("base64");
   return { Authorization: `Basic ${token}` };
 }
 async function fetchWithErrors(url, init) {
@@ -48,6 +85,10 @@ async function fetchWithErrors(url, init) {
     }
     throw new Error(`NOT_FOUND${detail}`);
   }
+  const contentType = response.headers?.get("content-type") ?? "";
+  if (contentType.toLowerCase().startsWith("text/html")) {
+    throw new Error("AUTH_FAILED");
+  }
   return response;
 }
 async function readResponseMessage(response) {
@@ -90,9 +131,9 @@ function buildExtraFields(fields, requested) {
   }
   return Object.keys(result).length > 0 ? result : null;
 }
-function writeHeaders(pat) {
+function writeHeaders(cred) {
   return {
-    ...authHeaders(pat),
+    ...authHeaders(cred),
     "Content-Type": "application/json-patch+json"
   };
 }
@@ -147,13 +188,13 @@ async function readWriteResponse(response, errorCode) {
     fields: data.fields
   };
 }
-async function getWorkItemFields(context, id, pat) {
+async function getWorkItemFields(context, id, cred) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
   url.searchParams.set("$expand", "all");
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   if (response.status === 400) {
     const serverMessage = await readResponseMessage(response);
     if (serverMessage) {
@@ -166,17 +207,33 @@ async function getWorkItemFields(context, id, pat) {
   const data = await response.json();
   return data.fields;
 }
-async function getWorkItem(context, id, pat, extraFields) {
+function extractAttachments(relations) {
+  if (!relations) return null;
+  const attachments = relations.filter((r) => r.rel === "AttachedFile").map((r) => ({
+    name: r.attributes.name ?? "unknown",
+    size: r.attributes.resourceSize ?? 0,
+    url: r.url
+  }));
+  return attachments.length > 0 ? attachments : null;
+}
+function buildWorkItemUrl(context, id, options = {}) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
-  const normalizedExtraFields = extraFields ? normalizeFieldList(extraFields) : [];
-  if (normalizedExtraFields.length > 0) {
-    const allFields = normalizeFieldList([...DEFAULT_FIELDS, ...normalizedExtraFields]);
-    url.searchParams.set("fields", allFields.join(","));
+  if (options.includeRelations) {
+    url.searchParams.set("$expand", "relations");
   }
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  if (options.fields && options.fields.length > 0) {
+    url.searchParams.set("fields", options.fields.join(","));
+  }
+  return url;
+}
+async function fetchWorkItemResponse(context, id, cred, options = {}) {
+  const response = await fetchWithErrors(
+    buildWorkItemUrl(context, id, options).toString(),
+    { headers: authHeaders(cred) }
+  );
   if (response.status === 400) {
     const serverMessage = await readResponseMessage(response);
     if (serverMessage) {
@@ -186,7 +243,14 @@ async function getWorkItem(context, id, pat, extraFields) {
   if (!response.ok) {
     throw new Error(`HTTP_${response.status}`);
   }
-  const data = await response.json();
+  return await response.json();
+}
+async function getWorkItem(context, id, cred, extraFields) {
+  const normalizedExtraFields = extraFields ? normalizeFieldList(extraFields) : [];
+  const data = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, cred, {
+    fields: normalizeFieldList([...DEFAULT_FIELDS, ...normalizedExtraFields])
+  }) : await fetchWorkItemResponse(context, id, cred, { includeRelations: true });
+  const relationsData = normalizedExtraFields.length > 0 ? await fetchWorkItemResponse(context, id, cred, { includeRelations: true }) : data;
   const descriptionParts = [];
   if (data.fields["System.Description"]) {
     descriptionParts.push({ label: "Description", value: data.fields["System.Description"] });
@@ -214,16 +278,17 @@ async function getWorkItem(context, id, pat, extraFields) {
     areaPath: data.fields["System.AreaPath"],
     iterationPath: data.fields["System.IterationPath"],
     url: data._links.html.href,
-    extraFields: normalizedExtraFields.length > 0 ? buildExtraFields(data.fields, normalizedExtraFields) : null
+    extraFields: normalizedExtraFields.length > 0 ? buildExtraFields(data.fields, normalizedExtraFields) : null,
+    attachments: extractAttachments(relationsData.relations)
   };
 }
-async function getWorkItemFieldValue(context, id, pat, fieldName) {
+async function getWorkItemFieldValue(context, id, cred, fieldName) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
   url.searchParams.set("fields", fieldName);
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   if (response.status === 400) {
     const serverMessage = await readResponseMessage(response);
     if (serverMessage) {
@@ -240,13 +305,13 @@ async function getWorkItemFieldValue(context, id, pat, fieldName) {
   }
   return stringifyFieldValue(value);
 }
-async function listWorkItemComments(context, id, pat) {
+async function listWorkItemComments(context, id, cred) {
   const comments = [];
   let continuationToken = null;
   do {
     const response = await fetchWithErrors(
       buildWorkItemCommentsListUrl(context, id, continuationToken ?? void 0).toString(),
-      { headers: authHeaders(pat) }
+      { headers: authHeaders(cred) }
     );
     if (!response.ok) {
       throw new Error(`HTTP_${response.status}`);
@@ -263,11 +328,13 @@ async function listWorkItemComments(context, id, pat) {
     comments
   };
 }
-async function addWorkItemComment(context, id, pat, text) {
-  const response = await fetchWithErrors(buildWorkItemCommentsUrl(context, id).toString(), {
+async function addWorkItemComment(context, id, cred, text, format = "html") {
+  const url = buildWorkItemCommentsUrl(context, id);
+  url.searchParams.set("format", format);
+  const response = await fetchWithErrors(url.toString(), {
     method: "POST",
     headers: {
-      ...authHeaders(pat),
+      ...authHeaders(cred),
       "Content-Type": "application/json"
     },
     body: JSON.stringify({ text })
@@ -289,8 +356,8 @@ async function addWorkItemComment(context, id, pat, text) {
     url: data.url ?? null
   };
 }
-async function updateWorkItem(context, id, pat, fieldName, operations) {
-  const result = await applyWorkItemPatch(context, id, pat, operations);
+async function updateWorkItem(context, id, cred, fieldName, operations) {
+  const result = await applyWorkItemPatch(context, id, cred, operations);
   const title = result.fields["System.Title"];
   const lastOp = operations.at(-1);
   const fieldValue = lastOp?.value ?? null;
@@ -302,68 +369,165 @@ async function updateWorkItem(context, id, pat, fieldName, operations) {
     fieldValue
   };
 }
-async function createWorkItem(context, workItemType, pat, operations) {
+async function createWorkItem(context, workItemType, cred, operations) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/$${encodeURIComponent(workItemType)}`
   );
   url.searchParams.set("api-version", "7.1");
   const response = await fetchWithErrors(url.toString(), {
     method: "POST",
-    headers: writeHeaders(pat),
+    headers: writeHeaders(cred),
     body: JSON.stringify(operations)
   });
   return readWriteResponse(response, "CREATE_REJECTED");
 }
-async function applyWorkItemPatch(context, id, pat, operations) {
+async function applyWorkItemPatch(context, id, cred, operations) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/wit/workitems/${id}`
   );
   url.searchParams.set("api-version", "7.1");
   const response = await fetchWithErrors(url.toString(), {
     method: "PATCH",
-    headers: writeHeaders(pat),
+    headers: writeHeaders(cred),
     body: JSON.stringify(operations)
   });
   return readWriteResponse(response, "UPDATE_REJECTED");
 }
+async function downloadAttachment(url, cred) {
+  const response = await fetchWithErrors(url, { headers: authHeaders(cred) });
+  if (!response.ok) {
+    throw new Error(`HTTP_${response.status}`);
+  }
+  return response.arrayBuffer();
+}
 
 // src/services/auth.ts
 import { createInterface } from "readline";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, join } from "path";
 
-// src/services/credential-store.ts
-import { Entry } from "@napi-rs/keyring";
-var SERVICE = "azdo-cli";
-var ACCOUNT = "pat";
-async function getPat() {
-  try {
-    const entry = new Entry(SERVICE, ACCOUNT);
-    return entry.getPassword();
-  } catch {
-    return null;
+// src/services/oauth-device-code.ts
+var DeviceCodeFlowError = class extends Error {
+  reason;
+  constructor(reason, message, cause) {
+    super(message);
+    this.name = "DeviceCodeFlowError";
+    this.reason = reason;
+    if (cause instanceof Error) {
+      this.cause = cause;
+    }
   }
+};
+var MIN_INTERVAL_SEC = 5;
+async function defaultSleep(ms) {
+  await new Promise((r) => setTimeout(r, ms));
 }
-async function storePat(pat) {
+async function requestDeviceCode(oauthConfig, fetchFn) {
+  const body = new URLSearchParams({
+    client_id: oauthConfig.clientId,
+    scope: buildScopeString(oauthConfig.scopes)
+  });
+  const response = await fetchFn(oauthConfig.deviceCodeEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: body.toString()
+  });
+  const text = await response.text();
+  let parsed;
   try {
-    const entry = new Entry(SERVICE, ACCOUNT);
-    entry.setPassword(pat);
+    parsed = JSON.parse(text);
   } catch {
+    throw new DeviceCodeFlowError("idp-error", `device-code endpoint returned non-JSON HTTP ${response.status}: ${text.slice(0, 200)}`);
+  }
+  if (!response.ok) {
+    const err = parsed;
+    const code = err.error ?? "unknown";
+    const desc = err.error_description ? `: ${err.error_description}` : "";
+    throw new DeviceCodeFlowError(
+      "idp-error",
+      `device-code endpoint rejected request (${response.status}): ${code}${desc}`
+    );
   }
+  return parsed;
 }
-async function deletePat() {
+async function classifyDeviceTokenResponse(response) {
+  if (response.ok) {
+    return { kind: "success", token: await readTokenResponse(response) };
+  }
+  const text = await response.text();
+  let parsed;
   try {
-    const entry = new Entry(SERVICE, ACCOUNT);
-    entry.deletePassword();
-    return true;
+    parsed = JSON.parse(text);
   } catch {
-    return false;
+    throw new DeviceCodeFlowError("idp-error", `non-JSON HTTP ${response.status}: ${text.slice(0, 200)}`);
+  }
+  const errCode = parsed.error ?? "";
+  if (errCode === "authorization_pending") return { kind: "pending" };
+  if (errCode === "slow_down") return { kind: "slow_down" };
+  if (errCode === "expired_token") {
+    throw new DeviceCodeFlowError("expired_token", "device code expired before authorisation completed");
+  }
+  if (errCode === "access_denied") {
+    throw new DeviceCodeFlowError("access_denied", "authorisation denied by user");
+  }
+  const desc = parsed.error_description ? `: ${parsed.error_description}` : "";
+  throw new DeviceCodeFlowError(
+    "idp-error",
+    `IdP rejected device-token poll (${response.status}): ${errCode}${desc}`
+  );
+}
+async function pollForDeviceToken(deviceCode, oauthConfig, initialIntervalSec, expiresAtMs, deps) {
+  const fetchFn = deps.fetch ?? fetch;
+  const now = deps.now ?? (() => Date.now());
+  const sleep = deps.sleep ?? defaultSleep;
+  let intervalSec = Math.max(MIN_INTERVAL_SEC, initialIntervalSec);
+  for (; ; ) {
+    if (now() >= expiresAtMs) {
+      throw new DeviceCodeFlowError("expired_token", "device-code flow expired before authorisation completed");
+    }
+    await sleep(intervalSec * 1e3);
+    const body = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: oauthConfig.clientId,
+      device_code: deviceCode
+    });
+    const response = await fetchFn(oauthConfig.tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: body.toString()
+    });
+    const outcome = await classifyDeviceTokenResponse(response);
+    if (outcome.kind === "success") return outcome.token;
+    if (outcome.kind === "slow_down") {
+      intervalSec += 5;
+    }
   }
 }
+async function runDeviceCodeFlow(org, oauthConfig, deps = {}) {
+  const fetchFn = deps.fetch ?? fetch;
+  const now = deps.now ?? (() => Date.now());
+  const writePrompt = deps.writePrompt ?? ((m) => {
+    process.stderr.write(m);
+  });
+  const dc = await requestDeviceCode(oauthConfig, fetchFn);
+  const expiryMin = Math.round(dc.expires_in / 60);
+  writePrompt(
+    `
+To authenticate, open ${dc.verification_uri} in a browser and enter the code:
 
-// src/services/auth.ts
-function normalizePat(rawPat) {
-  const trimmedPat = rawPat.trim();
-  return trimmedPat.length > 0 ? trimmedPat : null;
+    ${dc.user_code}
+
+Waiting for authorisation (expires in ${expiryMin} min)\u2026
+`
+  );
+  const expiresAtMs = now() + dc.expires_in * 1e3;
+  const token = await pollForDeviceToken(dc.device_code, oauthConfig, dc.interval, expiresAtMs, deps);
+  const credential = tokenResponseToCredential(org, oauthConfig, token, now());
+  return { credential, flowUsed: "device-code" };
 }
+
+// src/services/auth.ts
+var PAT_PROMPT = "Enter your Azure DevOps PAT: ";
 async function promptForPat() {
   if (!process.stdin.isTTY) {
     return null;
@@ -371,12 +535,16 @@ async function promptForPat() {
   return new Promise((resolve2) => {
     const rl = createInterface({
       input: process.stdin,
-      output: process.stderr
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      output: null
     });
-    process.stderr.write("Enter your Azure DevOps PAT: ");
+    process.stderr.write(PAT_PROMPT);
     process.stdin.setRawMode(true);
     process.stdin.resume();
     let pat = "";
+    const redraw = () => {
+      process.stderr.write(`\r${PAT_PROMPT}${maskedDisplay(pat)}\x1B[K`);
+    };
     const onData = (key) => {
       const ch = key.toString("utf8");
       if (ch === "") {
@@ -394,56 +562,246 @@ async function promptForPat() {
       } else if (ch === "\x7F" || ch === "\b") {
         if (pat.length > 0) {
           pat = pat.slice(0, -1);
-          process.stderr.write("\b \b");
+          redraw();
         }
       } else {
         pat += ch;
-        process.stderr.write("*".repeat(ch.length));
+        redraw();
       }
     };
     process.stdin.on("data", onData);
   });
 }
-async function resolvePat() {
+function findDotEnvPat(startDir = process.cwd()) {
+  let current = startDir;
+  while (true) {
+    const envFile = join(current, ".env");
+    if (existsSync(envFile)) {
+      const contents = readFileSync2(envFile, "utf8");
+      for (const line of contents.split("\n")) {
+        const match = line.match(/^AZDO_PAT\s*=\s*(.+)$/);
+        if (match) {
+          const value = match[1].trim().replace(/^["']|["']$/g, "");
+          if (value.length > 0) return value;
+        }
+      }
+    }
+    const parent = dirname2(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return null;
+}
+async function resolveAuthCredential(org) {
   const envPat = process.env.AZDO_PAT;
-  if (envPat) {
-    return { pat: envPat, source: "env" };
+  if (envPat && envPat.length > 0) {
+    return { pat: envPat, source: "env", kind: "pat" };
   }
-  const storedPat = await getPat();
-  if (storedPat !== null) {
-    return { pat: storedPat, source: "credential-store" };
+  const stored = await getStoredCredential(org);
+  if (stored !== null) {
+    if (stored.kind === "pat") {
+      return { pat: stored.token, source: "credential-store", kind: "pat" };
+    }
+    const fresh = await refreshIfNeeded(org, stored);
+    return {
+      pat: fresh.accessToken,
+      source: "credential-store",
+      kind: "oauth",
+      accountId: fresh.accountId
+    };
+  }
+  const dotEnvPat = findDotEnvPat();
+  if (dotEnvPat !== null) {
+    return { pat: dotEnvPat, source: "env", kind: "pat" };
   }
-  const promptedPat = await promptForPat();
-  if (promptedPat !== null) {
-    const normalizedPat = normalizePat(promptedPat);
-    if (normalizedPat !== null) {
-      await storePat(normalizedPat);
-      return { pat: normalizedPat, source: "prompt" };
+  return null;
+}
+async function requireAuthCredential(org) {
+  const cred = await resolveAuthCredential(org);
+  if (cred !== null) {
+    return cred;
+  }
+  throw new CredentialMissingError(org);
+}
+async function validatePatAgainstAzdo(pat, org) {
+  const url = `https://dev.azure.com/${encodeURIComponent(org)}/_apis/projects?$top=1&api-version=7.1`;
+  const auth = Buffer.from(`:${pat}`).toString("base64");
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Basic ${auth}`,
+      Accept: "application/json"
+    }
+  });
+  if (response.status === 200) {
+    return { ok: true, status: 200 };
+  }
+  if (response.status === 401 || response.status === 403) {
+    return { ok: false, status: response.status };
+  }
+  throw new Error(`Azure DevOps returned HTTP ${response.status} while validating PAT for org "${org}".`);
+}
+var LOGIN_FAILURE_REASONS = /* @__PURE__ */ new Set([
+  "user-cancelled",
+  "port-conflict",
+  "state-mismatch",
+  "redirect-mismatch",
+  "idp-error",
+  "timeout",
+  "expired_token",
+  "access_denied"
+]);
+function extractLoginFailureReason(err) {
+  if (typeof err === "object" && err !== null && "reason" in err) {
+    const r = err.reason;
+    if (typeof r === "string" && LOGIN_FAILURE_REASONS.has(r)) {
+      return r;
     }
   }
-  throw new Error(
-    "Authentication cancelled. Set AZDO_PAT environment variable or run again to enter a PAT."
-  );
+  return "unknown";
+}
+async function loginWithOAuth(org, opts = {}) {
+  const oauthConfig = resolveOAuthConfig({
+    clientIdOverride: opts.clientIdOverride,
+    tenantIdOverride: opts.tenantIdOverride,
+    scopesOverride: opts.scopesOverride
+  });
+  const isHeadlessRuntime = () => {
+    if (opts.forceHeadless) return true;
+    if (process.platform === "linux") {
+      return !process.env.DISPLAY || process.env.DISPLAY.length === 0;
+    }
+    return false;
+  };
+  const useDeviceCode = opts.flow === "device-code" || opts.flow !== "auth-code" && isHeadlessRuntime();
+  appendAuthAuditEvent({
+    event: "oauth-login-started",
+    org,
+    backend: probeBackend(),
+    flow: useDeviceCode ? "device-code" : "auth-code",
+    clientIdSource: oauthConfig.clientIdSource
+  });
+  let credential;
+  let flowUsed;
+  try {
+    if (useDeviceCode) {
+      const r = await runDeviceCodeFlow(org, oauthConfig);
+      credential = r.credential;
+      flowUsed = "device-code";
+    } else {
+      const r = await runAuthCodeFlow(org, oauthConfig);
+      credential = r.credential;
+      flowUsed = "auth-code";
+    }
+  } catch (err) {
+    appendAuthAuditEvent({
+      event: "oauth-login-failed",
+      org,
+      backend: probeBackend(),
+      flow: useDeviceCode ? "device-code" : "auth-code",
+      reason: extractLoginFailureReason(err)
+    });
+    throw err;
+  }
+  await storeOAuthCredential(org, credential);
+  appendAuthAuditEvent({
+    event: "oauth-login-success",
+    org,
+    backend: probeBackend(),
+    flow: flowUsed,
+    clientIdSource: oauthConfig.clientIdSource,
+    accountId: credential.accountId,
+    scope: credential.scope,
+    tokenLifetimeSec: credential.expiresAt - credential.issuedAt
+  });
+  return {
+    org,
+    kind: "oauth",
+    accountId: credential.accountId,
+    expiresAt: credential.expiresAt,
+    scope: credential.scope,
+    flowUsed
+  };
+}
+async function logout(opts = {}) {
+  if (opts.all) {
+    const orgs = await listOrgsWithStoredPat();
+    const removed = [];
+    for (const o of orgs) {
+      const cred2 = await getStoredCredential(o);
+      const ok2 = await deletePat(o);
+      if (ok2 && cred2 !== null) {
+        removed.push({ org: o, kind: cred2.kind });
+      }
+    }
+    return { removed };
+  }
+  if (!opts.org) {
+    throw new Error("logout requires an org or --all");
+  }
+  const cred = await getStoredCredential(opts.org);
+  const ok = await deletePat(opts.org);
+  return { removed: ok && cred !== null ? [{ org: opts.org, kind: cred.kind }] : [] };
+}
+async function status() {
+  const orgs = await listOrgsWithStoredPat();
+  const out = [];
+  for (const org of orgs) {
+    const cred = await getStoredCredential(org);
+    if (cred === null) continue;
+    if (cred.kind === "pat") {
+      out.push({ org, kind: "pat", backend: probeBackend() });
+    } else {
+      out.push({
+        org,
+        kind: "oauth",
+        accountId: cred.accountId,
+        expiresAt: cred.expiresAt,
+        scope: cred.scope,
+        backend: probeBackend()
+      });
+    }
+  }
+  return { orgs: out };
 }
 
 // src/services/git-remote.ts
 import { execSync } from "child_process";
+
+// src/services/remote-warning.ts
+var WARNING = "azdo: warning: origin includes embedded credentials; consider removing them with 'git remote set-url origin <clean-url>'\n";
+var warned = false;
+function noticeCredentialBearingRemote() {
+  if (warned) {
+    return;
+  }
+  warned = true;
+  try {
+    process.stderr.write(WARNING);
+  } catch {
+  }
+}
+
+// src/services/git-remote.ts
 var patterns = [
-  // HTTPS (current): https://dev.azure.com/{org}/{project}/_git/{repo}
-  /^https?:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)$/,
-  // HTTPS (legacy + DefaultCollection): https://{org}.visualstudio.com/DefaultCollection/{project}/_git/{repo}
-  /^https?:\/\/([^.]+)\.visualstudio\.com\/DefaultCollection\/([^/]+)\/_git\/([^/]+)$/,
-  // HTTPS (legacy): https://{org}.visualstudio.com/{project}/_git/{repo}
-  /^https?:\/\/([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+)$/,
-  // SSH (current): git@ssh.dev.azure.com:v3/{org}/{project}/{repo}
-  /^git@ssh\.dev\.azure\.com:v3\/([^/]+)\/([^/]+)\/([^/]+)$/,
-  // SSH (legacy): {org}@vs-ssh.visualstudio.com:v3/{org}/{project}/{repo}
-  /^[^@]+@vs-ssh\.visualstudio\.com:v3\/([^/]+)\/([^/]+)\/([^/]+)$/
+  // HTTPS (current): https://[user[:token]@]dev.azure.com/{org}/{project}/_git/{repo}[.git]
+  /^https?:\/\/(?:[^@/]+@)?dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
+  // HTTPS (legacy + DefaultCollection): https://[user[:token]@]{org}.visualstudio.com/DefaultCollection/{project}/_git/{repo}[.git]
+  /^https?:\/\/(?:[^@/]+@)?([^.]+)\.visualstudio\.com\/DefaultCollection\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
+  // HTTPS (legacy): https://[user[:token]@]{org}.visualstudio.com/{project}/_git/{repo}[.git]
+  /^https?:\/\/(?:[^@/]+@)?([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+?)(?:\.git)?$/,
+  // SSH (current): git@ssh.dev.azure.com:v3/{org}/{project}/{repo}[.git]
+  /^git@ssh\.dev\.azure\.com:v3\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?$/,
+  // SSH (legacy): {org}@vs-ssh.visualstudio.com:v3/{org}/{project}/{repo}[.git]
+  /^[^@]+@vs-ssh\.visualstudio\.com:v3\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?$/
 ];
+var httpsUserinfo = /^https?:\/\/[^@/]+@/;
 function parseAzdoRemote(url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
     if (match) {
+      if (httpsUserinfo.test(url)) {
+        noticeCredentialBearingRemote();
+      }
       const project = match[2];
       if (/^DefaultCollection$/i.test(project)) {
         return { org: match[1], project: "" };
@@ -470,6 +828,9 @@ function parseRepoName(url) {
   for (const pattern of patterns) {
     const match = pattern.exec(url);
     if (match) {
+      if (httpsUserinfo.test(url)) {
+        noticeCredentialBearingRemote();
+      }
       return match[3];
     }
   }
@@ -496,122 +857,57 @@ function getCurrentBranch() {
   return branch;
 }
 
-// src/services/config-store.ts
-import fs from "fs";
-import path from "path";
-import os from "os";
-var SETTINGS = [
-  {
-    key: "org",
-    description: "Azure DevOps organization name",
-    type: "string",
-    example: "mycompany",
-    required: true
-  },
-  {
-    key: "project",
-    description: "Azure DevOps project name",
-    type: "string",
-    example: "MyProject",
-    required: true
-  },
-  {
-    key: "fields",
-    description: "Extra work item fields to include (comma-separated reference names)",
-    type: "string[]",
-    example: "System.Tags,Custom.Priority",
-    required: false
-  },
-  {
-    key: "markdown",
-    description: "Convert rich text fields to markdown on display",
-    type: "boolean",
-    example: "true",
-    required: false
-  }
-];
-var VALID_KEYS = SETTINGS.map((s) => s.key);
-function getConfigPath() {
-  return path.join(os.homedir(), ".azdo", "config.json");
-}
-function loadConfig() {
-  const configPath = getConfigPath();
-  let raw;
-  try {
-    raw = fs.readFileSync(configPath, "utf-8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return {};
-    }
-    throw err;
-  }
+// src/services/org-resolver.ts
+function defaultDetectFromGit() {
   try {
-    return JSON.parse(raw);
+    return detectAzdoContext().org ?? null;
   } catch {
-    process.stderr.write(`Warning: Config file ${configPath} contains invalid JSON. Using defaults.
-`);
-    return {};
+    return null;
   }
 }
-function saveConfig(config) {
-  const configPath = getConfigPath();
-  const dir = path.dirname(configPath);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+function defaultReadConfig() {
+  return loadConfig();
 }
-function validateKey(key) {
-  if (!VALID_KEYS.includes(key)) {
-    throw new Error(`Unknown setting key "${key}". Valid keys: ${VALID_KEYS.join(", ")}`);
+function resolveOrg(options) {
+  if (options.org && options.org.length > 0) {
+    return { org: options.org, source: "flag" };
   }
-}
-function getConfigValue(key) {
-  validateKey(key);
-  const config = loadConfig();
-  return config[key];
-}
-function setConfigValue(key, value) {
-  validateKey(key);
-  const config = loadConfig();
-  if (value === "") {
-    delete config[key];
-  } else if (key === "markdown") {
-    if (value !== "true" && value !== "false") {
-      throw new Error(`Invalid value "${value}" for markdown. Must be "true" or "false".`);
-    }
-    config.markdown = value === "true";
-  } else if (key === "fields") {
-    config.fields = value.split(",").map((s) => s.trim());
-  } else {
-    config[key] = value;
+  const gitOrg = (options.detectFromGit ?? defaultDetectFromGit)();
+  if (gitOrg && gitOrg.length > 0) {
+    return { org: gitOrg, source: "git" };
+  }
+  const configOrg = (options.readConfig ?? defaultReadConfig)().org;
+  if (configOrg && configOrg.length > 0) {
+    return { org: configOrg, source: "config" };
   }
-  saveConfig(config);
+  return null;
 }
-function unsetConfigValue(key) {
-  validateKey(key);
-  const config = loadConfig();
-  delete config[key];
-  saveConfig(config);
+function formatResolutionError() {
+  return [
+    "Could not resolve an Azure DevOps organization. Options (in priority order):",
+    "  1. Pass --org <name> on the command line.",
+    "  2. Run this command from a git repo whose origin remote is an Azure DevOps URL.",
+    "  3. Run `azdo config set org <name>` once to set a persistent default."
+  ].join("\n");
 }
 
 // src/services/context.ts
 function resolveContext(options) {
-  if (options.org && options.project) {
-    return { org: options.org, project: options.project };
-  }
-  const config = loadConfig();
-  if (config.org && config.project) {
-    return { org: config.org, project: config.project };
-  }
+  const resolvedOrg = resolveOrg({ org: options.org });
   let gitContext = null;
   try {
     gitContext = detectAzdoContext();
   } catch {
   }
-  const org = config.org || gitContext?.org;
-  const project = config.project || gitContext?.project;
+  const config = loadConfig();
+  const org = resolvedOrg?.org;
+  const project = options.project || (gitContext?.project && gitContext.project.length > 0 ? gitContext.project : void 0) || config.project;
   if (org && project) {
     return { org, project };
   }
+  if (!org) {
+    throw new Error(formatResolutionError());
+  }
   throw new Error(
     'Could not determine org/project. Use --org and --project flags, work from an Azure DevOps git repo, or run "azdo config set org/project".'
   );
@@ -771,32 +1067,81 @@ function stripHtml(html) {
   text = text.replaceAll(/<br\s*\/?>/gi, "\n");
   text = text.replaceAll(/<\/?(p|div)>/gi, "\n");
   text = text.replaceAll(/<li>/gi, "\n");
-  text = text.replaceAll(/<[^>]*>/g, "");
-  text = text.replaceAll("&amp;", "&");
+  text = removeHtmlTags(text);
   text = text.replaceAll("&lt;", "<");
   text = text.replaceAll("&gt;", ">");
   text = text.replaceAll("&quot;", '"');
   text = text.replaceAll("&#39;", "'");
   text = text.replaceAll("&nbsp;", " ");
+  text = text.replaceAll("&amp;", "&");
   text = text.replaceAll(/\n{3,}/g, "\n\n");
   return text.trim();
 }
+function removeHtmlTags(value) {
+  let result = "";
+  let insideTag = false;
+  for (const char of value) {
+    if (char === "<") {
+      insideTag = true;
+      continue;
+    }
+    if (char === ">" && insideTag) {
+      insideTag = false;
+      continue;
+    }
+    if (!insideTag) {
+      result += char;
+    }
+  }
+  return result;
+}
 function convertRichText(html, markdown) {
   if (!html) return "";
   return markdown ? toMarkdown(html) : stripHtml(html);
 }
+function formatMarkdownField(fieldLabel, value) {
+  if (value.includes("\n")) {
+    return `${fieldLabel}:
+${value}`;
+  }
+  return `${fieldLabel}: ${value}`;
+}
 function formatExtraFields(extraFields, markdown) {
   return Object.entries(extraFields).map(([refName, value]) => {
     const fieldLabel = refName.includes(".") ? refName.split(".").pop() : refName;
-    const displayValue = markdown ? toMarkdown(value) : value;
-    return `${fieldLabel.padEnd(13)}${displayValue}`;
+    if (markdown) {
+      const displayValue = toMarkdown(value);
+      return formatMarkdownField(fieldLabel, displayValue);
+    }
+    return formatMarkdownField(fieldLabel, value);
   });
 }
-function summarizeDescription(text, label) {
+function summarizeDescription(text, label, markdown) {
   const descLines = text.split("\n").filter((l) => l.trim() !== "");
   const firstThree = descLines.slice(0, 3);
   const suffix = descLines.length > 3 ? "\n..." : "";
-  return [`${label("Description:")}${firstThree.join("\n")}${suffix}`];
+  const content = `${firstThree.join("\n")}${suffix}`;
+  if (markdown) {
+    return [formatMarkdownField("Description", content)];
+  }
+  return [`${label("Description:")}${content}`];
+}
+function formatFileSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  const kb = bytes / 1024;
+  if (kb < 1024) return `${kb.toFixed(1)} KB`;
+  const mb = kb / 1024;
+  return `${mb.toFixed(1)} MB`;
+}
+function formatAttachments(attachments, short) {
+  if (short) {
+    return [`Attachments: ${attachments.length}`];
+  }
+  const lines = ["", "Attachments:"];
+  for (const att of attachments) {
+    lines.push(`  ${att.name} (${formatFileSize(att.size)})`);
+  }
+  return lines;
 }
 function formatWorkItem(workItem, short, markdown = false) {
   const label = (name) => name.padEnd(13);
@@ -820,10 +1165,13 @@ function formatWorkItem(workItem, short, markdown = false) {
   lines.push("");
   const descriptionText = convertRichText(workItem.description, markdown);
   if (short) {
-    lines.push(...summarizeDescription(descriptionText, label));
+    lines.push(...summarizeDescription(descriptionText, label, markdown));
   } else {
     lines.push("Description:", descriptionText);
   }
+  if (workItem.attachments) {
+    lines.push(...formatAttachments(workItem.attachments, short));
+  }
   return lines.join("\n");
 }
 function createGetItemCommand() {
@@ -835,9 +1183,9 @@ function createGetItemCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
+        const credential = await requireAuthCredential(context.org);
         const fieldsList = options.fields === void 0 ? parseRequestedFields(loadConfig().fields) : parseRequestedFields(options.fields);
-        const workItem = await getWorkItem(context, id, credential.pat, fieldsList);
+        const workItem = await getWorkItem(context, id, credential, fieldsList);
         const markdownEnabled = options.markdown ?? loadConfig().markdown ?? false;
         const output = formatWorkItem(workItem, options.short ?? false, markdownEnabled);
         process.stdout.write(output + "\n");
@@ -853,19 +1201,455 @@ function createGetItemCommand() {
 import { Command as Command2 } from "commander";
 function createClearPatCommand() {
   const command = new Command2("clear-pat");
-  command.description("Remove the stored Azure DevOps PAT from the credential store").action(async () => {
-    const deleted = await deletePat();
+  command.description("Remove a stored Azure DevOps PAT (deprecated: use `azdo auth logout`)").option("--org <name>", "Azure DevOps organization (overrides auto-detect / config)").action(async (options) => {
+    process.stderr.write("`azdo clear-pat` is deprecated; use `azdo auth logout [--org <name>]` instead.\n");
+    const resolved = resolveOrg({ org: options.org });
+    if (!resolved) {
+      process.stderr.write(`${formatResolutionError()}
+`);
+      process.exitCode = 3;
+      return;
+    }
+    const deleted = await deletePat(resolved.org);
     if (deleted) {
-      process.stdout.write("PAT removed from credential store.\n");
+      process.stdout.write(`PAT removed for org ${resolved.org}.
+`);
     } else {
-      process.stdout.write("No stored PAT found.\n");
+      process.stdout.write(`No stored PAT found for org ${resolved.org}.
+`);
     }
   });
   return command;
 }
 
-// src/commands/config.ts
+// src/commands/auth.ts
 import { Command as Command3 } from "commander";
+async function readStdinToString() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function promptYesNo(prompt) {
+  if (!process.stdin.isTTY) return true;
+  process.stderr.write(prompt);
+  return await new Promise((resolve2) => {
+    process.stdin.setEncoding("utf8");
+    let answered = false;
+    const handler = (data) => {
+      if (answered) return;
+      answered = true;
+      process.stdin.removeListener("data", handler);
+      process.stdin.pause();
+      const trimmed = data.trim().toLowerCase();
+      resolve2(trimmed === "y" || trimmed === "yes");
+    };
+    process.stdin.resume();
+    process.stdin.on("data", handler);
+  });
+}
+async function confirmOverwrite(org) {
+  return promptYesNo(`A PAT is already stored for org ${org}. Overwrite? [y/N] `);
+}
+async function confirmOverwriteCredential(org, existingKind) {
+  const label = existingKind === "oauth" ? "OAuth credential" : "PAT";
+  return promptYesNo(`A ${label} is already stored for org ${org}. The new login will replace it. Continue? [y/N] `);
+}
+function rejectMutuallyExclusive(opts) {
+  if (opts.usePat && opts.deviceCode) {
+    return "--use-pat and --device-code are mutually exclusive (PAT has no device-code flow).";
+  }
+  if (opts.usePat && (opts.clientId || opts.tenantId || opts.scopes)) {
+    return "--use-pat cannot be combined with OAuth-only flags (--client-id / --tenant-id / --scopes).";
+  }
+  return null;
+}
+async function handlePatLogin(options) {
+  const resolved = resolveOrg({ org: options.org });
+  if (!resolved) {
+    process.stderr.write(`${formatResolutionError()}
+`);
+    process.exitCode = 3;
+    return;
+  }
+  const org = resolved.org;
+  const wantBrowser = options.browser !== false && !options.fromStdin;
+  if (wantBrowser) {
+    const url = `https://dev.azure.com/${encodeURIComponent(org)}/_usersSettings/tokens`;
+    await openUrl(url);
+  }
+  const raw = options.fromStdin ? await readStdinToString() : await promptForPat();
+  const pat = raw ? normalizePat(raw) : null;
+  if (!pat) {
+    process.stderr.write("No PAT provided. Aborting.\n");
+    process.exitCode = 1;
+    return;
+  }
+  let validation;
+  try {
+    validation = await validatePatAgainstAzdo(pat, org);
+  } catch (err) {
+    process.stderr.write(`Could not reach Azure DevOps to validate PAT: ${err.message}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (!validation.ok) {
+    appendAuthAuditEvent({ event: "auth.validate.fail", org, backend: probeBackend() });
+    process.stderr.write(`PAT validation failed (HTTP ${validation.status}). Token NOT stored.
+`);
+    process.exitCode = 2;
+    return;
+  }
+  appendAuthAuditEvent({
+    event: "auth.validate.ok",
+    org,
+    backend: probeBackend(),
+    masked_pat: maskedDisplay(pat)
+  });
+  try {
+    const existing = await getPat(org);
+    if (existing !== null) {
+      const overwrite = await confirmOverwrite(org);
+      if (!overwrite) {
+        process.stderr.write("Aborted. Existing PAT preserved.\n");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    await storePat(org, pat);
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      process.exitCode = 4;
+      return;
+    }
+    throw err;
+  }
+  process.stdout.write(`PAT stored for org ${org} in ${probeBackend()}.
+`);
+}
+async function ensureOverwriteConfirmed(org) {
+  try {
+    const existing = await getStoredCredential(org);
+    if (existing === null || !process.stdin.isTTY) return "ok";
+    const ok = await confirmOverwriteCredential(org, existing.kind);
+    return ok ? "ok" : "aborted";
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      return "unavailable";
+    }
+    throw err;
+  }
+}
+function buildOAuthLoginOptions(options) {
+  return {
+    flow: options.deviceCode ? "device-code" : "auto",
+    clientIdOverride: options.clientId,
+    tenantIdOverride: options.tenantId,
+    scopesOverride: options.scopes ? options.scopes.split(/\s+/).filter(Boolean) : void 0
+  };
+}
+function reportOAuthFailure(err) {
+  const reason = typeof err === "object" && err !== null && "reason" in err ? err.reason : null;
+  const msg = err.message;
+  process.stderr.write(reason ? `OAuth login failed (${reason}): ${msg}
+` : `OAuth login failed: ${msg}
+`);
+  const noDisplay = process.platform === "linux" && (!process.env.DISPLAY || process.env.DISPLAY.length === 0);
+  if (noDisplay) {
+    process.stderr.write("Tip: this host has no DISPLAY; pass --device-code to use the headless flow.\n");
+  } else if (reason === "port-conflict") {
+    process.stderr.write("Tip: another process is using the loopback callback port. Try again or pass --device-code.\n");
+  }
+}
+async function handleOAuthLogin(options) {
+  const resolved = resolveOrg({ org: options.org });
+  if (!resolved) {
+    process.stderr.write(`${formatResolutionError()}
+`);
+    process.exitCode = 3;
+    return;
+  }
+  const org = resolved.org;
+  const confirm = await ensureOverwriteConfirmed(org);
+  if (confirm === "aborted") {
+    process.stderr.write("Aborted. Existing credential preserved.\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (confirm === "unavailable") {
+    process.exitCode = 4;
+    return;
+  }
+  try {
+    const result = await loginWithOAuth(org, buildOAuthLoginOptions(options));
+    process.stdout.write(
+      `Logged in to ${org} via OAuth (${result.flowUsed}). Account: ${result.accountId}; expires ${new Date(result.expiresAt * 1e3).toISOString()}.
+`
+    );
+  } catch (err) {
+    reportOAuthFailure(err);
+    process.exitCode = 1;
+  }
+}
+async function handleAuthRoot(options) {
+  const conflict = rejectMutuallyExclusive(options);
+  if (conflict) {
+    process.stderr.write(`${conflict}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  await handlePatLogin(options);
+}
+async function handleLoginSubcommand(options) {
+  const conflict = rejectMutuallyExclusive(options);
+  if (conflict) {
+    process.stderr.write(`${conflict}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  if (options.fromStdin || options.usePat) {
+    await handlePatLogin(options);
+    return;
+  }
+  await handleOAuthLogin(options);
+}
+async function handleStatusJson() {
+  try {
+    const report = await status();
+    process.stdout.write(`${JSON.stringify(report)}
+`);
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      process.exitCode = 4;
+      return;
+    }
+    throw err;
+  }
+}
+async function handleStatus(options, org) {
+  if (options.json) {
+    let backend2;
+    let value2;
+    try {
+      backend2 = probeBackend();
+      value2 = await getPat(org);
+    } catch (err) {
+      if (err instanceof CredentialStoreUnavailableError) {
+        process.stderr.write(`${err.message}
+`);
+        process.exitCode = 4;
+        return;
+      }
+      throw err;
+    }
+    const storedEvents2 = readAuditEvents().filter((ev) => ev.org === org && ev.event === "auth.store");
+    const last2 = storedEvents2.at(-1);
+    const updatedAt2 = last2?.ts ?? null;
+    if (!value2) {
+      process.stdout.write(
+        `${JSON.stringify({ org, backend: backend2, stored: false, masked: null, updated_at: updatedAt2 })}
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const masked2 = maskedDisplay(value2);
+    process.stdout.write(
+      `${JSON.stringify({ org, backend: backend2, stored: true, masked: masked2, updated_at: updatedAt2 })}
+`
+    );
+    return;
+  }
+  let backend;
+  let value;
+  try {
+    backend = probeBackend();
+    value = await getPat(org);
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      process.exitCode = 4;
+      return;
+    }
+    throw err;
+  }
+  const storedEvents = readAuditEvents().filter((ev) => ev.org === org && ev.event === "auth.store");
+  const last = storedEvents.at(-1);
+  const updatedAt = last?.ts ?? null;
+  if (!value) {
+    process.stdout.write(`Organization: ${org}
+Backend:      ${backend}
+Stored:       no
+`);
+    process.exitCode = 1;
+    return;
+  }
+  const masked = maskedDisplay(value);
+  process.stdout.write(
+    `Organization: ${org}
+Backend:      ${backend}
+Stored:       yes
+Identifier:   ${masked}
+` + (updatedAt ? `Last updated: ${updatedAt}
+` : "")
+  );
+}
+async function handleLogout(options, orgFromGlobal) {
+  if (options.all && orgFromGlobal) {
+    process.stderr.write("--org and --all are mutually exclusive.\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (options.all) {
+    try {
+      const result = await logout({ all: true });
+      if (result.removed.length === 0) {
+        process.stdout.write("No stored credentials to remove.\n");
+        return;
+      }
+      for (const r of result.removed) {
+        process.stdout.write(`Removed ${r.kind} credential for org ${r.org}.
+`);
+      }
+    } catch (err) {
+      if (err instanceof CredentialStoreUnavailableError) {
+        process.stderr.write(`${err.message}
+`);
+        process.exitCode = 4;
+        return;
+      }
+      process.stderr.write(`Failed to remove credentials: ${err.message}
+`);
+      process.exitCode = 1;
+    }
+    return;
+  }
+  const resolved = resolveOrg({ org: orgFromGlobal });
+  if (!resolved) {
+    process.stderr.write(`${formatResolutionError()}
+`);
+    process.exitCode = 3;
+    return;
+  }
+  try {
+    const removed = await deletePat(resolved.org);
+    if (removed) {
+      process.stdout.write(`Credential removed for org ${resolved.org}.
+`);
+    } else {
+      process.stdout.write(`No stored credential for org ${resolved.org}.
+`);
+    }
+  } catch (err) {
+    if (err instanceof CredentialStoreUnavailableError) {
+      process.stderr.write(`${err.message}
+`);
+      process.exitCode = 4;
+      return;
+    }
+    throw err;
+  }
+}
+function createAuthCommand() {
+  const command = new Command3("auth");
+  command.description(
+    "Manage Azure DevOps authentication. Use `azdo auth login` for OAuth (default); the bare `azdo auth` form preserves the legacy PAT-prompt path for back-compat."
+  );
+  command.option("--org <name>", "Azure DevOps organization (flag wins over auto-detect / config)").option("--from-stdin", "read PAT from stdin instead of prompting (implies --use-pat)", false).option("--no-browser", "do not open the Azure DevOps PAT page in a browser (PAT path only)").option("--use-pat", "use Personal Access Token instead of OAuth (legacy path)", false).option("--device-code", "use OAuth device-code flow (headless hosts; OAuth only)", false).option("--client-id <id>", "override the default OAuth client id (FR-013 override path)").option("--tenant-id <id>", "override the default OAuth tenant id (default: common)").option("--scopes <scopes>", "space-separated OAuth scope override (advanced; default mirrors PAT scope table)");
+  command.addHelpText(
+    "after",
+    `
+Default flow (OAuth, browser-based):
+  azdo auth login --org <name>
+  \u2192 opens the default browser for OAuth (Microsoft Entra v2 + PKCE).
+
+Headless / no-browser:
+  azdo auth login --org <name> --device-code
+
+PAT path (legacy, opt-in):
+  azdo auth login --org <name> --use-pat
+  azdo auth --org <name>            # back-compat alias of the above
+
+OAuth scope set \u2014 shipped first-party client (default install):
+  ${firstPartyShippedScopes().join("\n  ")}
+  (uses ${AZDO_RESOURCE_ID}/.default \u2014 per-scope consent is unavailable
+  against a client we do not own; .default grants the VS client's
+  pre-authorized AzDO permissions in one step.)
+
+OAuth scope set \u2014 self-registered apps (--client-id / AZDO_OAUTH_CLIENT_ID):
+  ${defaultScopes().join("\n  ")}
+  (FR-016, mirrors the PAT scope table \u2014 see docs/oauth-app-registration.md)
+
+For self-registered OAuth apps (locked-down tenants), see docs/oauth-app-registration.md
+\u2014 that same guide is the maintainer reference for the project's shared client id.
+
+Note: stored credentials may coexist as 'pat' or 'oauth' across orgs (FR-007).
+Note: \`azdo auth\` (no subcommand) preserves the legacy PAT-prompt entry point;
+      \`azdo auth login\` is the spec-canonical name and defaults to OAuth.`
+  ).action(async (options) => {
+    await handleAuthRoot(options);
+  });
+  const loginCmd = command.command("login").description("Authenticate against Azure DevOps (OAuth default; --use-pat for PAT)").option("--org <name>", "Azure DevOps organization (defaults: git remote \u2192 config)");
+  loginCmd.action(async () => {
+    const merged = loginCmd.optsWithGlobals();
+    await handleLoginSubcommand(merged);
+  });
+  const statusCmd = command.command("status").description("Report stored credentials (kind, org, account/expiry, backend) \u2014 never the token").option("--json", "emit JSON", false);
+  statusCmd.action(async (options) => {
+    const globals = statusCmd.optsWithGlobals();
+    if (!globals.org) {
+      if (options.json) {
+        await handleStatusJson();
+        return;
+      }
+      const report = await status();
+      if (report.orgs.length === 0) {
+        process.stdout.write("No stored credentials.\n");
+        return;
+      }
+      for (const e of report.orgs) {
+        const expiry = e.expiresAt ? new Date(e.expiresAt * 1e3).toISOString() : "n/a";
+        process.stdout.write(
+          `${e.org}	${e.kind}	${e.accountId ?? ""}	${expiry}
+`
+        );
+      }
+      return;
+    }
+    const resolved = resolveOrg({ org: globals.org });
+    if (!resolved) {
+      process.stderr.write(`${formatResolutionError()}
+`);
+      process.exitCode = 3;
+      return;
+    }
+    await handleStatus(options, resolved.org);
+  });
+  statusCmd.addHelpText(
+    "after",
+    "\nStored credentials may be of kind `pat` or `oauth` and may coexist across orgs (FR-007).\n"
+  );
+  const logoutCmd = command.command("logout").description("Remove the stored credential for an org (or all orgs with --all)").option("--all", "remove every stored credential (PAT and OAuth)", false);
+  logoutCmd.action(async (options) => {
+    const globals = logoutCmd.optsWithGlobals();
+    await handleLogout(options, globals.org);
+  });
+  return command;
+}
+
+// src/commands/config.ts
+import { Command as Command4 } from "commander";
 import { createInterface as createInterface2 } from "readline";
 function formatConfigValue(value, unsetFallback = "") {
   if (value === void 0) {
@@ -925,9 +1709,9 @@ async function promptForSetting(cfg, setting, ask) {
 `);
 }
 function createConfigCommand() {
-  const config = new Command3("config");
+  const config = new Command4("config");
   config.description("Manage CLI settings");
-  const set = new Command3("set");
+  const set = new Command4("set");
   set.description("Set a configuration value").argument("<key>", "setting key (org, project, fields)").argument("<value>", "setting value").option("--json", "output in JSON format").action((key, value, options) => {
     try {
       setConfigValue(key, value);
@@ -948,7 +1732,7 @@ function createConfigCommand() {
       process.exit(1);
     }
   });
-  const get = new Command3("get");
+  const get = new Command4("get");
   get.description("Get a configuration value").argument("<key>", "setting key (org, project, fields)").option("--json", "output in JSON format").action((key, options) => {
     try {
       const value = getConfigValue(key);
@@ -971,7 +1755,7 @@ function createConfigCommand() {
       process.exit(1);
     }
   });
-  const list = new Command3("list");
+  const list = new Command4("list");
   list.description("List all configuration values").option("--json", "output in JSON format").action((options) => {
     const cfg = loadConfig();
     if (options.json) {
@@ -980,7 +1764,7 @@ function createConfigCommand() {
     }
     writeConfigList(cfg);
   });
-  const unset = new Command3("unset");
+  const unset = new Command4("unset");
   unset.description("Remove a configuration value").argument("<key>", "setting key (org, project, fields)").option("--json", "output in JSON format").action((key, options) => {
     try {
       unsetConfigValue(key);
@@ -997,7 +1781,7 @@ function createConfigCommand() {
       process.exit(1);
     }
   });
-  const wizard = new Command3("wizard");
+  const wizard = new Command4("wizard");
   wizard.description("Interactive wizard to configure all settings").action(async () => {
     if (!process.stdin.isTTY) {
       process.stderr.write(
@@ -1028,9 +1812,9 @@ function createConfigCommand() {
 }
 
 // src/commands/set-state.ts
-import { Command as Command4 } from "commander";
+import { Command as Command5 } from "commander";
 function createSetStateCommand() {
-  const command = new Command4("set-state");
+  const command = new Command5("set-state");
   command.description("Change the state of a work item").argument("<id>", "work item ID").argument("<state>", 'target state (e.g., "Active", "Closed")').option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output result as JSON").action(
     async (idStr, state, options) => {
       const id = parseWorkItemId(idStr);
@@ -1038,11 +1822,11 @@ function createSetStateCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
+        const credential = await requireAuthCredential(context.org);
         const operations = [
           { op: "add", path: "/fields/System.State", value: state }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, "System.State", operations);
+        const result = await updateWorkItem(context, id, credential, "System.State", operations);
         if (options.json) {
           process.stdout.write(
             JSON.stringify({
@@ -1066,9 +1850,9 @@ function createSetStateCommand() {
 }
 
 // src/commands/assign.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 function createAssignCommand() {
-  const command = new Command5("assign");
+  const command = new Command6("assign");
   command.description("Assign a work item to a user, or unassign it").argument("<id>", "work item ID").argument("[name]", "user display name or email").option("--unassign", "clear the Assigned To field").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output result as JSON").action(
     async (idStr, name, options) => {
       const id = parseWorkItemId(idStr);
@@ -1088,12 +1872,12 @@ function createAssignCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
+        const credential = await requireAuthCredential(context.org);
         const value = options.unassign ? "" : name;
         const operations = [
           { op: "add", path: "/fields/System.AssignedTo", value }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, "System.AssignedTo", operations);
+        const result = await updateWorkItem(context, id, credential, "System.AssignedTo", operations);
         if (options.json) {
           process.stdout.write(
             JSON.stringify({
@@ -1118,9 +1902,9 @@ function createAssignCommand() {
 }
 
 // src/commands/set-field.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 function createSetFieldCommand() {
-  const command = new Command6("set-field");
+  const command = new Command7("set-field");
   command.description("Set any work item field by its reference name").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Title)").argument("<value>", "new value for the field").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output result as JSON").action(
     async (idStr, field, value, options) => {
       const id = parseWorkItemId(idStr);
@@ -1128,11 +1912,11 @@ function createSetFieldCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
+        const credential = await requireAuthCredential(context.org);
         const operations = [
           { op: "add", path: `/fields/${field}`, value }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, field, operations);
+        const result = await updateWorkItem(context, id, credential, field, operations);
         if (options.json) {
           process.stdout.write(
             JSON.stringify({
@@ -1156,9 +1940,9 @@ function createSetFieldCommand() {
 }
 
 // src/commands/get-md-field.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 function createGetMdFieldCommand() {
-  const command = new Command7("get-md-field");
+  const command = new Command8("get-md-field");
   command.description("Get a work item field value, converting HTML to markdown").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Description)").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").action(
     async (idStr, field, options) => {
       const id = parseWorkItemId(idStr);
@@ -1166,8 +1950,8 @@ function createGetMdFieldCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
-        const value = await getWorkItemFieldValue(context, id, credential.pat, field);
+        const credential = await requireAuthCredential(context.org);
+        const value = await getWorkItemFieldValue(context, id, credential, field);
         if (value === null) {
           process.stdout.write("\n");
         } else {
@@ -1182,8 +1966,8 @@ function createGetMdFieldCommand() {
 }
 
 // src/commands/set-md-field.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { Command as Command8 } from "commander";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { Command as Command9 } from "commander";
 function fail(message) {
   process.stderr.write(`Error: ${message}
 `);
@@ -1202,11 +1986,11 @@ function resolveContent(inlineContent, options) {
   return null;
 }
 function readFileContent(filePath) {
-  if (!existsSync(filePath)) {
+  if (!existsSync2(filePath)) {
     fail(`File not found: ${filePath}`);
   }
   try {
-    return readFileSync2(filePath, "utf-8");
+    return readFileSync3(filePath, "utf-8");
   } catch {
     fail(`Cannot read file: ${filePath}`);
   }
@@ -1245,7 +2029,7 @@ function formatOutput(result, options, field) {
   }
 }
 function createSetMdFieldCommand() {
-  const command = new Command8("set-md-field");
+  const command = new Command9("set-md-field");
   command.description("Set a work item field with markdown content").argument("<id>", "work item ID").argument("<field>", "field reference name (e.g., System.Description)").argument("[content]", "markdown content to set").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output result as JSON").option("--file <path>", "read markdown content from file").action(
     async (idStr, field, inlineContent, options) => {
       const id = parseWorkItemId(idStr);
@@ -1254,12 +2038,12 @@ function createSetMdFieldCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
+        const credential = await requireAuthCredential(context.org);
         const operations = [
           { op: "add", path: `/fields/${field}`, value: content },
           { op: "add", path: `/multilineFieldsFormat/${field}`, value: "Markdown" }
         ];
-        const result = await updateWorkItem(context, id, credential.pat, field, operations);
+        const result = await updateWorkItem(context, id, credential, field, operations);
         formatOutput(result, options, field);
       } catch (err) {
         handleCommandError(err, id, context, "write");
@@ -1270,8 +2054,8 @@ function createSetMdFieldCommand() {
 }
 
 // src/commands/upsert.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, unlinkSync } from "fs";
-import { Command as Command9 } from "commander";
+import { existsSync as existsSync3, readFileSync as readFileSync4, unlinkSync } from "fs";
+import { Command as Command10 } from "commander";
 
 // src/services/task-document.ts
 var FIELD_ALIASES = /* @__PURE__ */ new Map([
@@ -1434,12 +2218,12 @@ function loadSourceContent(options) {
     return { content: options.content };
   }
   const filePath = options.file;
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     fail2(`File not found: ${filePath}`);
   }
   try {
     return {
-      content: readFileSync3(filePath, "utf-8"),
+      content: readFileSync4(filePath, "utf-8"),
       sourceFile: filePath
     };
   } catch {
@@ -1555,7 +2339,7 @@ function handleUpsertError(err, id, context) {
   process.exit(1);
 }
 function createUpsertCommand() {
-  const command = new Command9("upsert");
+  const command = new Command10("upsert");
   command.description("Create or update a work item from a markdown document").argument("[id]", "work item ID to update; omit to create a new work item").option("--content <markdown>", "task document content").option("--file <path>", "read task document from file").option("--type <workItemType>", "create mode work item type (defaults to Task)").option("--json", "output result as JSON").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").action(async (idStr, options) => {
     validateOrgProjectPair(options);
     const id = idStr === void 0 ? void 0 : parseWorkItemId(idStr);
@@ -1570,15 +2354,15 @@ function createUpsertCommand() {
         ensureTitleForCreate(document.fields);
       }
       const operations = toPatchOperations(document.fields, action);
-      const credential = await resolvePat();
+      const credential = await requireAuthCredential(context.org);
       let writeResult;
       if (action === "created") {
-        writeResult = await createWorkItem(context, createType, credential.pat, operations);
+        writeResult = await createWorkItem(context, createType, credential, operations);
       } else {
         if (id === void 0) {
           fail2("Work item ID is required for updates.");
         }
-        writeResult = await applyWorkItemPatch(context, id, credential.pat, operations);
+        writeResult = await applyWorkItemPatch(context, id, credential, operations);
       }
       const result = buildUpsertResult(
         action,
@@ -1596,7 +2380,7 @@ function createUpsertCommand() {
 }
 
 // src/commands/list-fields.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 function stringifyValue(value) {
   if (value === null || value === void 0) return "";
   if (typeof value === "object") return JSON.stringify(value);
@@ -1628,7 +2412,7 @@ function formatFieldList(fields) {
   }).join("\n");
 }
 function createListFieldsCommand() {
-  const command = new Command10("list-fields");
+  const command = new Command11("list-fields");
   command.description("List all fields of an Azure DevOps work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output result as JSON").action(
     async (idStr, options) => {
       const id = parseWorkItemId(idStr);
@@ -1636,8 +2420,8 @@ function createListFieldsCommand() {
       let context;
       try {
         context = resolveContext(options);
-        const credential = await resolvePat();
-        const fields = await getWorkItemFields(context, id, credential.pat);
+        const credential = await requireAuthCredential(context.org);
+        const fields = await getWorkItemFields(context, id, credential);
         if (options.json) {
           process.stdout.write(JSON.stringify({ id, fields }, null, 2) + "\n");
         } else {
@@ -1655,7 +2439,7 @@ function createListFieldsCommand() {
 }
 
 // src/commands/pr.ts
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 
 // src/services/pr-client.ts
 function buildPullRequestsUrl(context, repo, sourceBranch, opts) {
@@ -1672,6 +2456,13 @@ function buildPullRequestsUrl(context, repo, sourceBranch, opts) {
   }
   return url;
 }
+function buildPullRequestStatusesUrl(context, repo, prId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/statuses`
+  );
+  url.searchParams.set("api-version", "7.1");
+  return url;
+}
 function mapPullRequest(repo, pullRequest) {
   return {
     id: pullRequest.pullRequestId,
@@ -1681,7 +2472,36 @@ function mapPullRequest(repo, pullRequest) {
     targetRefName: pullRequest.targetRefName,
     status: pullRequest.status,
     createdBy: pullRequest.createdBy?.displayName ?? null,
-    url: pullRequest._links.web.href
+    url: pullRequest._links?.web?.href ?? null
+  };
+}
+function mapPullRequestCheckName(status2) {
+  const genre = status2.context?.genre?.trim();
+  const name = status2.context?.name?.trim();
+  if (genre && name) {
+    return `${genre}/${name}`;
+  }
+  if (name) {
+    return name;
+  }
+  if (genre) {
+    return genre;
+  }
+  return `Status #${status2.id}`;
+}
+function mapPullRequestCheck(status2) {
+  if (status2.state === "notApplicable" || status2.state === "notSet") {
+    return null;
+  }
+  return {
+    id: status2.id,
+    state: status2.state,
+    name: mapPullRequestCheckName(status2),
+    description: status2.description ?? null,
+    targetUrl: status2.targetUrl ?? null,
+    createdBy: status2.createdBy?.displayName ?? null,
+    createdAt: status2.creationDate ?? null,
+    updatedAt: status2.updatedDate ?? null
   };
 }
 function mapComment(comment) {
@@ -1697,9 +2517,6 @@ function mapComment(comment) {
   };
 }
 function mapThread(thread) {
-  if (thread.status !== "active" && thread.status !== "pending") {
-    return null;
-  }
   const comments = thread.comments.map(mapComment).filter((comment) => comment !== null);
   if (comments.length === 0) {
     return null;
@@ -1711,22 +2528,67 @@ function mapThread(thread) {
     comments
   };
 }
+function toActiveCommentThread(thread) {
+  return {
+    id: thread.id,
+    status: thread.status,
+    threadContext: thread.threadContext?.filePath ?? null,
+    comments: thread.comments.map(mapComment).filter((comment) => comment !== null)
+  };
+}
+var RESOLVED_THREAD_STATUSES = /* @__PURE__ */ new Set(["fixed", "wontFix", "closed", "byDesign"]);
+function isThreadResolved(status2) {
+  return RESOLVED_THREAD_STATUSES.has(status2);
+}
 async function readJsonResponse(response) {
   if (!response.ok) {
     throw new Error(`HTTP_${response.status}`);
   }
   return response.json();
 }
-async function listPullRequests(context, repo, pat, sourceBranch, opts) {
+async function patchThreadStatus(context, repo, cred, prId, threadId, status2) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads/${threadId}`
+  );
+  url.searchParams.set("api-version", "7.1");
+  const response = await fetchWithErrors(url.toString(), {
+    method: "PATCH",
+    headers: {
+      ...authHeaders(cred),
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ status: status2 })
+  });
+  const data = await readJsonResponse(response);
+  return toActiveCommentThread(data);
+}
+async function getPullRequestById(context, repo, cred, prId) {
+  const url = new URL(
+    `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}`
+  );
+  url.searchParams.set("api-version", "7.1");
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
+  const data = await readJsonResponse(response);
+  return mapPullRequest(repo, data);
+}
+async function listPullRequests(context, repo, cred, sourceBranch, opts) {
   const response = await fetchWithErrors(
     buildPullRequestsUrl(context, repo, sourceBranch, opts).toString(),
-    { headers: authHeaders(pat) }
+    { headers: authHeaders(cred) }
   );
   const data = await readJsonResponse(response);
   return data.value.map((pullRequest) => mapPullRequest(repo, pullRequest));
 }
-async function openPullRequest(context, repo, pat, sourceBranch, title, description) {
-  const existing = await listPullRequests(context, repo, pat, sourceBranch, {
+async function getPullRequestChecks(context, repo, cred, prId) {
+  const response = await fetchWithErrors(
+    buildPullRequestStatusesUrl(context, repo, prId).toString(),
+    { headers: authHeaders(cred) }
+  );
+  const data = await readJsonResponse(response);
+  return data.value.map(mapPullRequestCheck).filter((check) => check !== null);
+}
+async function openPullRequest(context, repo, cred, sourceBranch, title, description) {
+  const existing = await listPullRequests(context, repo, cred, sourceBranch, {
     status: "active",
     targetBranch: "develop"
   });
@@ -1754,7 +2616,7 @@ async function openPullRequest(context, repo, pat, sourceBranch, title, descript
   const response = await fetchWithErrors(url.toString(), {
     method: "POST",
     headers: {
-      ...authHeaders(pat),
+      ...authHeaders(cred),
       "Content-Type": "application/json"
     },
     body: JSON.stringify(payload)
@@ -1767,96 +2629,147 @@ async function openPullRequest(context, repo, pat, sourceBranch, title, descript
     pullRequest: mapPullRequest(repo, data)
   };
 }
-async function getPullRequestThreads(context, repo, pat, prId) {
+async function getPullRequestThreads(context, repo, cred, prId) {
   const url = new URL(
     `https://dev.azure.com/${encodeURIComponent(context.org)}/${encodeURIComponent(context.project)}/_apis/git/repositories/${encodeURIComponent(repo)}/pullRequests/${prId}/threads`
   );
   url.searchParams.set("api-version", "7.1");
-  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(pat) });
+  const response = await fetchWithErrors(url.toString(), { headers: authHeaders(cred) });
   const data = await readJsonResponse(response);
   return data.value.map(mapThread).filter((thread) => thread !== null);
 }
 
 // src/commands/pr.ts
+function parsePositivePrNumber(raw) {
+  if (!/^\d+$/.test(raw)) {
+    return null;
+  }
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+var PR_NUMBER_HELP = "target the pull request with this numeric id, instead of the current branch's PR. When omitted, the CLI auto-detects the pull request whose source branch equals refs/heads/<current branch> in the Azure DevOps repository identified by the origin remote; if zero or more than one open PR matches, the command fails with a message naming the searched branch.";
+function configureUnwrappedHelp(command) {
+  return command.configureHelp({ helpWidth: 1e3 });
+}
+function autoDetectZeroMatch(branch) {
+  return `No open pull request matches branch ${branch}. Pass --pr-number to target a specific PR, or push the branch and open a pull request.`;
+}
+function autoDetectMultiMatch(branch, ids) {
+  return `Multiple open pull requests match branch ${branch}: ${ids.map((id) => `#${id}`).join(", ")}. Re-run with --pr-number to choose.`;
+}
+function writeContractError(line) {
+  process.stderr.write(`${line}
+`);
+  process.exitCode = 1;
+}
 function formatBranchName(refName) {
   return refName.startsWith("refs/heads/") ? refName.slice("refs/heads/".length) : refName;
 }
 function writeError(message) {
   process.stderr.write(`Error: ${message}
 `);
-  process.exit(1);
+  process.exitCode = 1;
 }
 function handlePrCommandError(err, context, mode = "read") {
   const error = err instanceof Error ? err : new Error(String(err));
   if (error.message === "AUTH_FAILED") {
     const scopeLabel = mode === "write" ? "Code (Read & Write)" : "Code (Read)";
     writeError(`Authentication failed. Check that your PAT is valid and has the "${scopeLabel}" scope.`);
+    return;
   }
   if (error.message === "PERMISSION_DENIED") {
     writeError(`Access denied. Your PAT may lack ${mode} permissions for project "${context?.project}".`);
+    return;
   }
   if (error.message === "NETWORK_ERROR") {
     writeError("Could not connect to Azure DevOps. Check your network connection.");
+    return;
   }
   if (error.message.startsWith("NOT_FOUND")) {
     writeError(`Azure DevOps repository not found in ${context?.org}/${context?.project}.`);
+    return;
   }
   if (error.message.startsWith("HTTP_")) {
     writeError(`Azure DevOps request failed with ${error.message}.`);
+    return;
   }
   writeError(error.message);
 }
+function formatPullRequestChecks(checks) {
+  if (checks.length === 0) {
+    return ["Checks: none reported by Azure DevOps"];
+  }
+  const lines = ["Checks:"];
+  for (const check of checks) {
+    lines.push(`- [${check.state}] ${check.name}`);
+    if ((check.state === "failed" || check.state === "error") && check.description) {
+      lines.push(`  Detail: ${check.description}`);
+    }
+  }
+  return lines;
+}
 function formatPullRequestBlock(pullRequest) {
   return [
     `#${pullRequest.id} [${pullRequest.status}] ${pullRequest.title}`,
     `${formatBranchName(pullRequest.sourceRefName)} -> ${formatBranchName(pullRequest.targetRefName)}`,
-    pullRequest.url
+    pullRequest.url ?? "\u2014",
+    ...formatPullRequestChecks(pullRequest.checks)
   ].join("\n");
 }
+function threadStatusLabel(status2) {
+  return isThreadResolved(status2) ? "resolved" : status2;
+}
 function formatThreads(prId, title, threads) {
-  const lines = [`Active comments for pull request #${prId}: ${title}`];
+  const lines = [`Comment threads for pull request #${prId}: ${title}`];
   for (const thread of threads) {
-    lines.push("", `Thread #${thread.id} [${thread.status}] ${thread.threadContext ?? "(general)"}`);
+    lines.push("", `Thread #${thread.id} [${threadStatusLabel(thread.status)}] ${thread.threadContext ?? "(general)"}`);
     for (const comment of thread.comments) {
       lines.push(`  ${comment.author ?? "Unknown"}: ${comment.content}`);
     }
   }
   return lines.join("\n");
 }
-async function resolvePrCommandContext(options) {
+async function resolvePrCommandContext(options, resolveOpts = {}) {
+  const requireBranch = resolveOpts.requireBranch ?? true;
   const context = resolveContext(options);
   const repo = detectRepoName();
-  const branch = getCurrentBranch();
-  const credential = await resolvePat();
+  const branch = requireBranch ? getCurrentBranch() : null;
+  const credential = await requireAuthCredential(context.org);
   return {
     context,
     repo,
     branch,
-    pat: credential.pat
+    pat: credential
   };
 }
 function createPrStatusCommand() {
-  const command = new Command11("status");
+  const command = new Command12("status");
   command.description("Check pull requests for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (options) => {
     validateOrgProjectPair(options);
     let context;
     try {
       const resolved = await resolvePrCommandContext(options);
       context = resolved.context;
-      const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, resolved.branch);
-      const { branch, repo } = resolved;
-      const result = { branch, repository: repo, pullRequests };
+      const branch = resolved.branch;
+      const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, branch);
+      const pullRequestsWithChecks = await Promise.all(
+        pullRequests.map(async (pullRequest) => ({
+          ...pullRequest,
+          checks: await getPullRequestChecks(resolved.context, resolved.repo, resolved.pat, pullRequest.id)
+        }))
+      );
+      const result = { branch, repository: resolved.repo, pullRequests: pullRequestsWithChecks };
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
         return;
       }
-      if (pullRequests.length === 0) {
+      if (pullRequestsWithChecks.length === 0) {
         process.stdout.write(`No pull requests found for branch ${branch}.
 `);
         return;
       }
-      process.stdout.write(`${pullRequests.map(formatPullRequestBlock).join("\n\n")}
+      process.stdout.write(`${pullRequestsWithChecks.map(formatPullRequestBlock).join("\n\n")}
 `);
     } catch (err) {
       handlePrCommandError(err, context, "read");
@@ -1865,16 +2778,18 @@ function createPrStatusCommand() {
   return command;
 }
 function createPrOpenCommand() {
-  const command = new Command11("open");
+  const command = new Command12("open");
   command.description("Open a pull request from the current branch to develop").option("--title <title>", "pull request title").option("--description <description>", "pull request description").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (options) => {
     validateOrgProjectPair(options);
     const title = options.title?.trim();
     if (!title) {
       writeError("--title is required for pull request creation.");
+      return;
     }
     const description = options.description?.trim();
     if (!description) {
       writeError("--description is required for pull request creation.");
+      return;
     }
     let context;
     try {
@@ -1882,12 +2797,14 @@ function createPrOpenCommand() {
       context = resolved.context;
       if (resolved.branch === "develop") {
         writeError("Pull request creation requires a source branch other than develop.");
+        return;
       }
+      const openBranch = resolved.branch;
       const result = await openPullRequest(
         resolved.context,
         resolved.repo,
         resolved.pat,
-        resolved.branch,
+        openBranch,
         title,
         description
       );
@@ -1898,19 +2815,20 @@ function createPrOpenCommand() {
       }
       if (result.created) {
         process.stdout.write(`Created pull request #${result.pullRequest.id}: ${result.pullRequest.title}
-${result.pullRequest.url}
+${result.pullRequest.url ?? "\u2014"}
 `);
         return;
       }
       process.stdout.write(
         `Active pull request already exists for ${resolved.branch} -> develop: #${result.pullRequest.id}
-${result.pullRequest.url}
+${result.pullRequest.url ?? "\u2014"}
 `
       );
     } catch (err) {
       if (err instanceof Error && err.message.startsWith("AMBIGUOUS_PRS:")) {
         const ids = err.message.replace("AMBIGUOUS_PRS:", "").split(",").map((id) => `#${id}`).join(", ");
         writeError(`Multiple active pull requests already exist for this branch targeting develop: ${ids}. Use pr status to review them.`);
+        return;
       }
       handlePrCommandError(err, context, "write");
     }
@@ -1918,34 +2836,65 @@ ${result.pullRequest.url}
   return command;
 }
 function createPrCommentsCommand() {
-  const command = new Command11("comments");
-  command.description("List active pull request comments for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (options) => {
+  const command = new Command12("comments");
+  configureUnwrappedHelp(command).description("List pull request comment threads for the current branch").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--hide-resolved", "hide threads whose status is resolved / won't fix / closed / by design").option("--json", "output JSON").action(async (options) => {
     validateOrgProjectPair(options);
     let context;
+    let explicitPrId = null;
+    if (options.prNumber !== void 0) {
+      explicitPrId = parsePositivePrNumber(options.prNumber);
+      if (explicitPrId === null) {
+        writeError(`Invalid --pr-number "${options.prNumber}"; expected a positive integer.`);
+        return;
+      }
+    }
     try {
-      const resolved = await resolvePrCommandContext(options);
+      const resolved = await resolvePrCommandContext(options, { requireBranch: explicitPrId === null });
       context = resolved.context;
-      const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, resolved.branch, {
-        status: "active"
-      });
-      if (pullRequests.length === 0) {
-        writeError(`No active pull request found for branch ${resolved.branch}.`);
-      }
-      if (pullRequests.length > 1) {
-        const ids = pullRequests.map((pullRequest2) => `#${pullRequest2.id}`).join(", ");
-        writeError(`Multiple active pull requests found for branch ${resolved.branch}: ${ids}. Use pr status to review them.`);
+      let pullRequest;
+      let branchLabel;
+      if (explicitPrId !== null) {
+        try {
+          pullRequest = await getPullRequestById(resolved.context, resolved.repo, resolved.pat, explicitPrId);
+        } catch (err) {
+          if (err instanceof Error && err.message.startsWith("NOT_FOUND")) {
+            writeError(`Pull request #${explicitPrId} not found in ${resolved.context.org}/${resolved.context.project}/${resolved.repo}.`);
+            return;
+          }
+          throw err;
+        }
+        branchLabel = resolved.branch ?? pullRequest.sourceRefName;
+      } else {
+        const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, resolved.branch, {
+          status: "active"
+        });
+        if (pullRequests.length === 0) {
+          writeContractError(autoDetectZeroMatch(resolved.branch));
+          return;
+        }
+        if (pullRequests.length > 1) {
+          writeContractError(autoDetectMultiMatch(resolved.branch, pullRequests.map((pr) => pr.id)));
+          return;
+        }
+        pullRequest = pullRequests[0];
+        branchLabel = resolved.branch;
       }
-      const pullRequest = pullRequests[0];
-      const threads = await getPullRequestThreads(resolved.context, resolved.repo, resolved.pat, pullRequest.id);
-      const result = { branch: resolved.branch, pullRequest, threads };
+      const allThreads = await getPullRequestThreads(resolved.context, resolved.repo, resolved.pat, pullRequest.id);
+      const threads = options.hideResolved ? allThreads.filter((thread) => !isThreadResolved(thread.status)) : allThreads;
+      const result = { branch: branchLabel, pullRequest, threads };
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
         return;
       }
       if (threads.length === 0) {
-        process.stdout.write(`Pull request #${pullRequest.id} has no active comments.
+        if (options.hideResolved && allThreads.length > 0) {
+          process.stdout.write(`Pull request #${pullRequest.id} has no unresolved comment threads (${allThreads.length} resolved thread${allThreads.length === 1 ? "" : "s"} hidden by --hide-resolved).
 `);
+        } else {
+          process.stdout.write(`Pull request #${pullRequest.id} has no comment threads.
+`);
+        }
         return;
       }
       process.stdout.write(`${formatThreads(pullRequest.id, pullRequest.title, threads)}
@@ -1956,17 +2905,135 @@ function createPrCommentsCommand() {
   });
   return command;
 }
+async function resolveThreadTarget(threadIdRaw, options) {
+  validateOrgProjectPair(options);
+  const threadId = parsePositivePrNumber(threadIdRaw);
+  if (threadId === null) {
+    writeError(`Invalid thread id "${threadIdRaw}"; expected a positive integer.`);
+    return null;
+  }
+  let explicitPrId = null;
+  if (options.prNumber !== void 0) {
+    explicitPrId = parsePositivePrNumber(options.prNumber);
+    if (explicitPrId === null) {
+      writeError(`Invalid --pr-number "${options.prNumber}"; expected a positive integer.`);
+      return null;
+    }
+  }
+  const resolved = await resolvePrCommandContext(options, { requireBranch: explicitPrId === null });
+  let pullRequest;
+  if (explicitPrId !== null) {
+    try {
+      pullRequest = await getPullRequestById(resolved.context, resolved.repo, resolved.pat, explicitPrId);
+    } catch (err) {
+      if (err instanceof Error && err.message.startsWith("NOT_FOUND")) {
+        writeError(`Pull request #${explicitPrId} not found in ${resolved.context.org}/${resolved.context.project}/${resolved.repo}.`);
+        return null;
+      }
+      throw err;
+    }
+  } else {
+    const pullRequests = await listPullRequests(resolved.context, resolved.repo, resolved.pat, resolved.branch, {
+      status: "active"
+    });
+    if (pullRequests.length === 0) {
+      writeContractError(autoDetectZeroMatch(resolved.branch));
+      return null;
+    }
+    if (pullRequests.length > 1) {
+      writeContractError(autoDetectMultiMatch(resolved.branch, pullRequests.map((pr) => pr.id)));
+      return null;
+    }
+    pullRequest = pullRequests[0];
+  }
+  return { context: resolved.context, repo: resolved.repo, pat: resolved.pat, pullRequest, threadId };
+}
+async function runThreadStateChange(threadIdRaw, options, direction) {
+  let context;
+  try {
+    const target = await resolveThreadTarget(threadIdRaw, options);
+    if (target === null) {
+      return;
+    }
+    context = target.context;
+    const threads = await getPullRequestThreads(target.context, target.repo, target.pat, target.pullRequest.id);
+    const thread = threads.find((t) => t.id === target.threadId);
+    if (!thread) {
+      writeError(`Thread #${target.threadId} not found on pull request #${target.pullRequest.id}.`);
+      return;
+    }
+    const alreadyInTargetState = direction === "resolve" ? isThreadResolved(thread.status) : !isThreadResolved(thread.status);
+    const targetStatus = direction === "resolve" ? "fixed" : "active";
+    if (alreadyInTargetState) {
+      const humanLabel = direction === "resolve" ? "resolved" : "active";
+      const noopResult = {
+        pullRequestId: target.pullRequest.id,
+        threadId: target.threadId,
+        status: thread.status,
+        noop: true
+      };
+      if (options.json) {
+        process.stdout.write(`${JSON.stringify(noopResult, null, 2)}
+`);
+        return;
+      }
+      process.stdout.write(`Thread #${target.threadId} is already ${humanLabel} on pull request #${target.pullRequest.id} (current status: ${thread.status}).
+`);
+      return;
+    }
+    const updated = await patchThreadStatus(
+      target.context,
+      target.repo,
+      target.pat,
+      target.pullRequest.id,
+      target.threadId,
+      targetStatus
+    );
+    const result = {
+      pullRequestId: target.pullRequest.id,
+      threadId: target.threadId,
+      status: targetStatus,
+      noop: false
+    };
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+      return;
+    }
+    const verb = direction === "resolve" ? "resolved" : "reopened";
+    process.stdout.write(`Thread #${target.threadId} ${verb} on pull request #${target.pullRequest.id} (status: ${updated.status}).
+`);
+  } catch (err) {
+    handlePrCommandError(err, context, "write");
+  }
+}
+function createPrCommentResolveCommand() {
+  const command = new Command12("comment-resolve");
+  configureUnwrappedHelp(command).description("Mark a pull request comment thread as resolved").argument("<threadId>", "numeric id of the thread to resolve").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, options) => {
+    await runThreadStateChange(threadIdRaw, options, "resolve");
+  });
+  return command;
+}
+function createPrCommentReopenCommand() {
+  const command = new Command12("comment-reopen");
+  configureUnwrappedHelp(command).description("Reopen (set to active) a previously resolved pull request comment thread").argument("<threadId>", "numeric id of the thread to reopen").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--pr-number <N>", PR_NUMBER_HELP).option("--json", "output JSON").action(async (threadIdRaw, options) => {
+    await runThreadStateChange(threadIdRaw, options, "reopen");
+  });
+  return command;
+}
 function createPrCommand() {
-  const command = new Command11("pr");
+  const command = new Command12("pr");
   command.description("Manage Azure DevOps pull requests");
   command.addCommand(createPrStatusCommand());
   command.addCommand(createPrOpenCommand());
   command.addCommand(createPrCommentsCommand());
+  command.addCommand(createPrCommentResolveCommand());
+  command.addCommand(createPrCommentReopenCommand());
   return command;
 }
 
 // src/commands/comments.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 function writeError2(message) {
   process.stderr.write(`Error: ${message}
 `);
@@ -1977,23 +3044,24 @@ function formatCommentHeader(comment) {
   const timestamp = comment.modifiedAt ?? comment.createdAt ?? "Unknown time";
   return `Comment #${comment.id} by ${author} at ${timestamp}`;
 }
-function formatComments(result) {
+function formatComments(result, convertMarkdown) {
   const lines = [`Comments for work item #${result.workItemId}`];
   for (const comment of result.comments) {
-    lines.push("", formatCommentHeader(comment), comment.text);
+    const text = convertMarkdown ? toMarkdown(comment.text) : comment.text;
+    lines.push("", formatCommentHeader(comment), text);
   }
   return lines.join("\n");
 }
 function createCommentsListCommand() {
-  const command = new Command12("list");
-  command.description("List visible comments for a work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (idStr, options) => {
+  const command = new Command13("list");
+  command.description("List visible comments for a work item").argument("<id>", "work item ID").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "convert HTML comment bodies to markdown").action(async (idStr, options) => {
     validateOrgProjectPair(options);
     const id = parseWorkItemId(idStr);
     let context;
     try {
       context = resolveContext(options);
-      const credential = await resolvePat();
-      const result = await listWorkItemComments(context, id, credential.pat);
+      const credential = await requireAuthCredential(context.org);
+      const result = await listWorkItemComments(context, id, credential);
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
@@ -2004,7 +3072,7 @@ function createCommentsListCommand() {
 `);
         return;
       }
-      process.stdout.write(`${formatComments(result)}
+      process.stdout.write(`${formatComments(result, options.markdown === true)}
 `);
     } catch (err) {
       handleCommandError(err, id, context, "read");
@@ -2013,8 +3081,8 @@ function createCommentsListCommand() {
   return command;
 }
 function createCommentsAddCommand() {
-  const command = new Command12("add");
-  command.description("Add a comment to a work item").argument("<id>", "work item ID").argument("<text>", "comment text").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").action(async (idStr, text, options) => {
+  const command = new Command13("add");
+  command.description("Add a comment to a work item").argument("<id>", "work item ID").argument("<text>", "comment text").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--json", "output JSON").option("--markdown", "post comment as markdown").action(async (idStr, text, options) => {
     validateOrgProjectPair(options);
     const id = parseWorkItemId(idStr);
     if (text.trim() === "") {
@@ -2023,8 +3091,9 @@ function createCommentsAddCommand() {
     let context;
     try {
       context = resolveContext(options);
-      const credential = await resolvePat();
-      const result = await addWorkItemComment(context, id, credential.pat, text);
+      const credential = await requireAuthCredential(context.org);
+      const format = options.markdown === true ? "markdown" : "html";
+      const result = await addWorkItemComment(context, id, credential, text, format);
       if (options.json) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
@@ -2039,17 +3108,65 @@ function createCommentsAddCommand() {
   return command;
 }
 function createCommentsCommand() {
-  const command = new Command12("comments");
+  const command = new Command13("comments");
   command.description("Manage Azure DevOps work item comments");
   command.addCommand(createCommentsListCommand());
   command.addCommand(createCommentsAddCommand());
   return command;
 }
 
+// src/commands/download-attachment.ts
+import { Command as Command14 } from "commander";
+import { writeFile } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import { join as join2 } from "path";
+function createDownloadAttachmentCommand() {
+  const command = new Command14("download-attachment");
+  command.description("Download an attachment from an Azure DevOps work item").argument("<id>", "work item ID").argument("<filename>", "name of the attachment to download").option("--org <org>", "Azure DevOps organization").option("--project <project>", "Azure DevOps project").option("--output <dir>", "target directory for the downloaded file").action(
+    async (idStr, filename, options) => {
+      const id = parseWorkItemId(idStr);
+      validateOrgProjectPair(options);
+      let context;
+      try {
+        context = resolveContext(options);
+        const credential = await requireAuthCredential(context.org);
+        const outputDir = options.output ?? ".";
+        if (!existsSync4(outputDir)) {
+          process.stderr.write(`Error: Output directory "${outputDir}" does not exist.
+`);
+          process.exit(1);
+        }
+        const workItem = await getWorkItem(context, id, credential);
+        const attachment = workItem.attachments?.find(
+          (a) => a.name === filename
+        );
+        if (!attachment) {
+          process.stderr.write(
+            `Error: Attachment "${filename}" not found on work item ${id}.
+`
+          );
+          process.exit(1);
+        }
+        const data = await downloadAttachment(attachment.url, credential);
+        const outputPath = join2(outputDir, filename);
+        await writeFile(outputPath, Buffer.from(data));
+        process.stdout.write(
+          `Downloaded "${filename}" (${formatFileSize(attachment.size)}) to ${outputPath}
+`
+        );
+      } catch (err) {
+        handleCommandError(err, id, context, "read", false);
+      }
+    }
+  );
+  return command;
+}
+
 // src/index.ts
-var program = new Command13();
+var program = new Command15();
 program.name("azdo").description("Azure DevOps CLI tool").version(version, "-v, --version");
 program.addCommand(createGetItemCommand());
+program.addCommand(createAuthCommand());
 program.addCommand(createClearPatCommand());
 program.addCommand(createConfigCommand());
 program.addCommand(createSetStateCommand());
@@ -2061,6 +3178,7 @@ program.addCommand(createUpsertCommand());
 program.addCommand(createListFieldsCommand());
 program.addCommand(createPrCommand());
 program.addCommand(createCommentsCommand());
+program.addCommand(createDownloadAttachmentCommand());
 program.showHelpAfterError();
 program.parse();
 if (process.argv.length <= 2) {