ai-dev-workflow 0.3.1.2__tar.gz → 0.3.1.4__tar.gz

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-dev-workflow
-Version: 0.3.1.2
+Version: 0.3.1.4
 Summary: Provider-neutral AI-assisted development workflow and CLI
 Author: vuthethienlong
 Project-URL: Homepage, https://github.com/vuthethienlong/ai-dev-workflow
@@ -11,6 +11,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: PyYAML>=6.0
+Requires-Dist: azure-identity>=1.25.0
 
 # AI Dev Workflow
 

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/pyproject.toml

@@ -4,12 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ai-dev-workflow"
-version = "0.3.1.2"
+version = "0.3.1.4"
 description = "Provider-neutral AI-assisted development workflow and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
   "PyYAML>=6.0",
+  "azure-identity>=1.25.0",
 ]
 authors = [
   { name = "vuthethienlong" }

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/tests/test_ai_workflow_cli.py

@@ -18,7 +18,7 @@ DISCOVERY={
 
 class Tests(unittest.TestCase):
     def test_package_version(self):
-        self.assertEqual(PACKAGE_VERSION, "0.3.1.1")
+        self.assertEqual(PACKAGE_VERSION, "0.3.1.4")
 
     def test_guide_command_is_exposed_by_cli(self):
         output=io.StringIO()

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/tests/test_setup_wizard.py

@@ -141,6 +141,86 @@ class Tests(unittest.TestCase):
         self.assertEqual(credential["auth_scheme"],"basic")
         self.assertEqual(credential["source"],"worker-env")
 
+    def test_ado_setup_browser_auth_works_without_workers_or_azure_cli(self):
+        class Args:
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+            ado_setup_auth="browser"
+        with patch.dict(os.environ,{},clear=True):
+            credential=resolve_ado_discovery_credential(
+                Args(),
+                [],
+                azure_cli_token_fn=lambda:None,
+                native_token_fn=lambda mode:"entra-token" if mode=="browser" else None,
+            )
+        self.assertEqual(credential["token"],"entra-token")
+        self.assertIsNone(credential["worker_id"])
+        self.assertEqual(credential["auth_scheme"],"bearer")
+        self.assertEqual(credential["source"],"browser")
+
+    def test_ado_setup_device_code_auth_works_without_azure_cli(self):
+        class Args:
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+            ado_setup_auth="device-code"
+        credential=resolve_ado_discovery_credential(
+            Args(),
+            [],
+            azure_cli_token_fn=lambda:None,
+            native_token_fn=lambda mode:"device-token" if mode=="device-code" else None,
+        )
+        self.assertEqual(credential["token"],"device-token")
+        self.assertEqual(credential["source"],"device-code")
+
+    @patch("setup_wizard.detect_repository_context", side_effect=RuntimeError("not a git repo"))
+    def test_ado_wizard_collects_setup_auth_before_workers(self, _detect):
+        class Args:
+            root="."
+            work_items=None
+            github_repository=None
+            github_auth=None
+            github_token_env="GH_TOKEN"
+            ado_organization=None
+            ado_project=None
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+            ado_setup_auth=None
+            ado_mcp_mode=None
+            ado_mcp_auth=None
+            ado_team=None
+            ai_provider=[]
+            role_provider=[]
+            worker=[]
+            skill=[]
+            environment=None
+            codespaces_mode=None
+            tdd=None
+            reviewer_mode=None
+            runtime_mode=None
+
+        answers=iter([
+            ".",          # root
+            "2",          # Azure DevOps only
+            "contoso",    # organization
+            "App",        # project
+            "1",          # browser login
+            "n",          # no multi-repo workspace
+            "n",          # no CCR
+            "n",          # no Claude
+            "", "", "", "", "", "", "", # manual role defaults
+            "n",          # no workers
+            "n",          # optional skills
+            "1",          # environment none
+            "",           # TDD yes
+            "1",          # reviewer manual
+            "1",          # runtime project-defined
+        ])
+        args=interactive_setup_options(
+            Args(),
+            input_fn=lambda _:next(answers),
+            output_fn=lambda *_:None,
+        )
+        self.assertEqual(args.ado_organization,"contoso")
+        self.assertEqual(args.ado_project,"App")
+        self.assertEqual(args.ado_setup_auth,"browser")
+
     def test_ado_project_defaults_are_selected_from_discovery(self):
         discovery={
             "project":"proj",

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/tools/ai_dev_workflow.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-dev-workflow
-Version: 0.3.1.2
+Version: 0.3.1.4
 Summary: Provider-neutral AI-assisted development workflow and CLI
 Author: vuthethienlong
 Project-URL: Homepage, https://github.com/vuthethienlong/ai-dev-workflow
@@ -11,6 +11,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: PyYAML>=6.0
+Requires-Dist: azure-identity>=1.25.0
 
 # AI Dev Workflow
 

ai_dev_workflow-0.3.1.4/tools/ai_dev_workflow.egg-info/requires.txt

@@ -0,0 +1,2 @@
+PyYAML>=6.0
+azure-identity>=1.25.0

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/tools/ai_workflow_cli.py

@@ -67,7 +67,7 @@ DEFAULT_ROLE_PROVIDERS = {
     "RuntimeVerifierAgent": "manual",
 }
 
-PACKAGE_VERSION = "0.3.1.2"
+PACKAGE_VERSION = "0.3.1.4"
 
 ROLE_KEYS = {
     "SetupAgent": "setup",
@@ -888,55 +888,73 @@ def setup_cmd(args) -> int:
     ado_discovery_worker = None
     if args.work_items in ("azure-devops", "composite"):
         discovery_credential = resolve_ado_discovery_credential(args, workers)
+        setup_auth = getattr(args, "ado_setup_auth", None)
 
-        interactive_worker_auth = any(
-            (((worker.get("identity") or {}).get("azure_devops") or {}).get("auth") or {}).get("type")
-            in ("interactive", "azure-cli")
-            or (((worker.get("identity") or {}).get("azure_devops") or {}).get("auth") or {}).get("store")
-            in ("mcp", "azure-cli")
-            for worker in workers
-        )
-
-        if not discovery_credential and interactive_worker_auth and not args.non_interactive:
-            print(
-                "ADO worker authentication is interactive. Metadata discovery also needs "
-                "an authenticated setup session."
-            )
-            if _wizard_yes_no(
-                "Sign in with Azure CLI for metadata discovery (credential is not stored)?",
-                True,
-            ):
+        if not discovery_credential and not args.non_interactive:
+            if setup_auth in ("browser", "device-code"):
+                login_cmd = ["az", "login"]
+                if setup_auth == "device-code":
+                    login_cmd.append("--use-device-code")
                 try:
-                    subprocess.run(["az", "login"], check=True)
+                    if setup_auth == "browser":
+                        print("Opening Microsoft sign-in for Azure DevOps setup...")
+                    else:
+                        print("Starting Microsoft device-code sign-in for Azure DevOps setup...")
+                    subprocess.run(login_cmd, check=True)
                 except FileNotFoundError:
                     print(
-                        "Azure CLI is not installed. Falling back to a one-time PAT/token prompt."
+                        "Azure CLI is not installed, so Microsoft interactive login cannot start "
+                        "from this setup session."
                     )
                 except subprocess.CalledProcessError:
-                    print(
-                        "Azure CLI sign-in did not complete. Falling back to a one-time PAT/token prompt."
-                    )
+                    print("Microsoft sign-in did not complete successfully.")
                 discovery_credential = resolve_ado_discovery_credential(args, workers)
 
-        if not discovery_credential and not args.non_interactive:
-            ado_token = getpass.getpass(
-                "ADO setup-only discovery PAT/token (not stored; leave blank to cancel): "
-            ).strip()
-            if ado_token:
-                discovery_credential = {
-                    "token": ado_token,
-                    "worker_id": None,
-                    "auth_scheme": "basic",
-                    "source": "secure-prompt",
-                }
+            elif setup_auth == "azure-cli":
+                print(
+                    "No usable Azure CLI session was found. Run 'az login' first, "
+                    "or choose browser/device-code authentication."
+                )
+
+            if not discovery_credential and setup_auth == "token-prompt":
+                ado_token = getpass.getpass(
+                    "ADO setup-only PAT/token (not stored; leave blank to cancel): "
+                ).strip()
+                if ado_token:
+                    discovery_credential = {
+                        "token": ado_token,
+                        "worker_id": None,
+                        "auth_scheme": "basic",
+                        "source": "secure-prompt",
+                    }
+
+            # Backward-compatible fallback for older invocations that do not
+            # carry the new setup-auth choice.
+            if not discovery_credential and not setup_auth:
+                ado_token = getpass.getpass(
+                    "ADO setup-only discovery PAT/token (not stored; leave blank to cancel): "
+                ).strip()
+                if ado_token:
+                    discovery_credential = {
+                        "token": ado_token,
+                        "worker_id": None,
+                        "auth_scheme": "basic",
+                        "source": "secure-prompt",
+                    }
 
         if not discovery_credential:
+            auth_hint = {
+                "browser": "Microsoft browser sign-in failed. Retry, use device-code, or choose PAT/token auth.",
+                "device-code": "Microsoft device-code sign-in failed. Retry, use browser login, or choose PAT/token auth.",
+                "azure-cli": "Run 'az login' and retry, or choose another ADO setup authentication method.",
+                "token-env": f"Export {args.ado_token_env} in this shell and retry.",
+                "token-prompt": "Provide a PAT/token at the secure setup prompt.",
+            }.get(
+                setup_auth,
+                "Choose a usable ADO setup authentication method and retry.",
+            )
             raise RuntimeError(
-                "ADO metadata discovery has no usable setup credential. "
-                "For env/PAT auth, export the configured worker token variable or --ado-token-env. "
-                "For Azure CLI or MCP/interactive auth, sign in with 'az login' so setup can obtain "
-                "a temporary Azure DevOps bearer token. Cloud/Codespaces secret names are runtime "
-                "references and are not readable from the local setup process."
+                "ADO metadata discovery could not authenticate. " + auth_hint
             )
 
         ado_discovery_worker = discovery_credential.get("worker_id")

{ai_dev_workflow-0.3.1.2 → ai_dev_workflow-0.3.1.4}/tools/setup_wizard.py

@@ -156,6 +156,35 @@ def discover_provider(args):
 
 
 ADO_RESOURCE = "499b84ac-1321-427f-aa17-267ca6975798"
+ADO_SCOPE = ADO_RESOURCE + "/.default"
+
+
+def _native_interactive_access_token(mode: str) -> str | None:
+    """Authenticate directly with Microsoft Entra without requiring Azure CLI."""
+    try:
+        from azure.identity import DeviceCodeCredential, InteractiveBrowserCredential
+        from azure.core.exceptions import ClientAuthenticationError, CredentialUnavailableError
+    except ImportError as exc:
+        raise RuntimeError(
+            "Microsoft browser/device-code authentication requires the 'azure-identity' package. "
+            "Reinstall or upgrade ai-dev-workflow."
+        ) from exc
+
+    if mode == "browser":
+        credential = InteractiveBrowserCredential()
+    elif mode == "device-code":
+        credential = DeviceCodeCredential()
+    else:
+        raise ValueError(f"unsupported native ADO auth mode: {mode}")
+
+    try:
+        return credential.get_token(ADO_SCOPE).token
+    except (ClientAuthenticationError, CredentialUnavailableError) as exc:
+        raise RuntimeError(f"Microsoft {mode} authentication failed: {exc}") from exc
+    finally:
+        close = getattr(credential, "close", None)
+        if callable(close):
+            close()
 
 
 def _azure_cli_access_token() -> str | None:
@@ -185,6 +214,7 @@ def resolve_ado_discovery_credential(
     args,
     workers: list[dict],
     azure_cli_token_fn=None,
+    native_token_fn=None,
 ) -> dict | None:
     """Resolve setup-only ADO discovery auth without persisting the credential.
 
@@ -221,13 +251,26 @@ def resolve_ado_discovery_credential(
             cli_worker = worker
             break
 
-    if cli_worker is not None:
+    setup_auth = getattr(args, "ado_setup_auth", None)
+
+    if setup_auth in ("browser", "device-code"):
+        token_fn = native_token_fn or _native_interactive_access_token
+        token = token_fn(setup_auth)
+        if token:
+            return {
+                "token": token,
+                "worker_id": cli_worker.get("worker_id") if cli_worker else None,
+                "auth_scheme": "bearer",
+                "source": setup_auth,
+            }
+
+    if setup_auth == "azure-cli" or cli_worker is not None:
         token_fn = azure_cli_token_fn or _azure_cli_access_token
         token = token_fn()
         if token:
             return {
                 "token": token,
-                "worker_id": cli_worker.get("worker_id"),
+                "worker_id": cli_worker.get("worker_id") if cli_worker else None,
                 "auth_scheme": "bearer",
                 "source": "azure-cli",
             }
@@ -465,9 +508,37 @@ def interactive_setup_options(args, input_fn=input, output_fn=print):
 
     if args.work_items in ("azure-devops", "composite"):
         output_fn("4/11 Azure DevOps project metadata")
-        args.ado_organization = args.ado_organization or _prompt(input_fn, "ADO organization")
-        args.ado_project = args.ado_project or _prompt(input_fn, "ADO project")
-        output_fn("ADO credentials are configured per worker, not as project credentials.")
+        args.ado_organization = args.ado_organization or _required_prompt(
+            input_fn,
+            output_fn,
+            "ADO organization",
+        )
+        args.ado_project = args.ado_project or _required_prompt(
+            input_fn,
+            output_fn,
+            "ADO project",
+        )
+        output_fn("ADO setup authentication is temporary and is not stored in project config.")
+        if not getattr(args, "ado_setup_auth", None):
+            args.ado_setup_auth = _choice(
+                input_fn,
+                output_fn,
+                "ADO setup authentication",
+                [
+                    ("browser", "Microsoft sign-in in browser (recommended)"),
+                    ("device-code", "Microsoft device-code sign-in"),
+                    ("azure-cli", "Use existing Azure CLI session"),
+                    ("token-env", "PAT/token environment variable"),
+                    ("token-prompt", "Paste PAT/token securely for this setup only"),
+                ],
+                "browser",
+            )
+        if args.ado_setup_auth == "token-env":
+            args.ado_token_env = _prompt(
+                input_fn,
+                "ADO token environment variable",
+                args.ado_token_env or "AZURE_DEVOPS_TOKEN",
+            )
         args.ado_mcp_mode = args.ado_mcp_mode or "none"
 
     workspace = interactive_workspace_options(args, input_fn=input_fn, output_fn=output_fn)
@@ -645,6 +716,10 @@ def interactive_setup_options(args, input_fn=input, output_fn=print):
                     parts.extend(["ado_auth=azure-cli", "ado_store=azure-cli"])
                 else:
                     parts.extend(["ado_auth=interactive", "ado_store=mcp"])
+                    if args.ado_mcp_mode == "none":
+                        args.ado_mcp_mode = "remote"
+                    if not getattr(args, "ado_mcp_auth", None):
+                        args.ado_mcp_auth = "interactive"
 
             if environment in ("cloud", "codespaces"):
                 github_env = _prompt(

ai_dev_workflow-0.3.1.2/tools/ai_dev_workflow.egg-info/requires.txt

@@ -1 +0,0 @@
-PyYAML>=6.0