ai-dev-workflow 0.3.1__tar.gz → 0.3.1.2__tar.gz

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-dev-workflow
-Version: 0.3.1
+Version: 0.3.1.2
 Summary: Provider-neutral AI-assisted development workflow and CLI
 Author: vuthethienlong
 Project-URL: Homepage, https://github.com/vuthethienlong/ai-dev-workflow

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ai-dev-workflow"
-version = "0.3.1"
+version = "0.3.1.2"
 description = "Provider-neutral AI-assisted development workflow and CLI"
 readme = "README.md"
 requires-python = ">=3.10"

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tests/test_ado_provider.py

@@ -1,7 +1,8 @@
 import sys, unittest
+from unittest.mock import patch, Mock
 from pathlib import Path
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools"))
-from ado_provider import build_state_mapping, suggest_state, validate_mapping, available_fields, flatten_classification_paths, validate_project_defaults
+from ado_provider import AzureDevOps, build_state_mapping, suggest_state, validate_mapping, available_fields, flatten_classification_paths, validate_project_defaults
 
 DISCOVERY={
   "organization":"org","project":"proj","project_id":"p","process_id":"proc",
@@ -21,6 +22,26 @@ DISCOVERY={
 }
 
 class Tests(unittest.TestCase):
+    def test_bearer_auth_uses_authorization_bearer_header(self):
+        response=Mock()
+        response.__enter__=Mock(return_value=response)
+        response.__exit__=Mock(return_value=False)
+        with patch("ado_provider.urlopen",return_value=response) as mocked:
+            with patch("ado_provider.json.load",return_value={"ok":True}):
+                AzureDevOps("org","entra-token",auth_scheme="bearer").request("/_apis/test")
+        request=mocked.call_args.args[0]
+        self.assertEqual(request.get_header("Authorization"),"Bearer entra-token")
+
+    def test_basic_auth_remains_default_for_pat_tokens(self):
+        response=Mock()
+        response.__enter__=Mock(return_value=response)
+        response.__exit__=Mock(return_value=False)
+        with patch("ado_provider.urlopen",return_value=response) as mocked:
+            with patch("ado_provider.json.load",return_value={"ok":True}):
+                AzureDevOps("org","pat-token").request("/_apis/test")
+        request=mocked.call_args.args[0]
+        self.assertTrue(request.get_header("Authorization").startswith("Basic "))
+
     def test_classification_tree_flattens_to_work_item_paths(self):
         node={
             "name":"Area",

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tests/test_ai_workflow_cli.py

@@ -3,7 +3,7 @@ from pathlib import Path
 from contextlib import redirect_stdout
 from unittest.mock import patch
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools"))
-from ai_workflow_cli import build_ado_config, doctor, parse_role_provider, parse_ado_field_mapping, onboarding_guide, setup_next_steps, _interactive_add_worker, main, PACKAGE_VERSION
+from ai_workflow_cli import build_ado_config, build_agents, doctor, parse_role_provider, parse_ado_field_mapping, onboarding_guide, setup_next_steps, _interactive_add_worker, main, PACKAGE_VERSION
 
 DISCOVERY={
   "organization":"org","project":"proj","project_id":"p","process_id":"proc",
@@ -18,7 +18,7 @@ DISCOVERY={
 
 class Tests(unittest.TestCase):
     def test_package_version(self):
-        self.assertEqual(PACKAGE_VERSION, "0.3.1")
+        self.assertEqual(PACKAGE_VERSION, "0.3.1.1")
 
     def test_guide_command_is_exposed_by_cli(self):
         output=io.StringIO()
@@ -150,11 +150,74 @@ class Tests(unittest.TestCase):
         self.assertEqual(cfg["work_items"]["azure_devops"]["state_mapping"]["Custom.Task"]["Ready"],"ready")
         self.assertEqual(cfg["agents"]["implementer"]["role"],"ImplementerAgent")
 
+    def test_all_agent_roles_default_to_manual(self):
+        agents=build_agents()
+        self.assertEqual(set(item["provider"] for item in agents.values()),{"manual"})
+        self.assertIn("PMAgent",{item["role"] for item in agents.values()})
+
     def test_role_assignment_override(self):
         roles=parse_role_provider(["ArchitectAgent=claude","ImplementerAgent=codex"])
         self.assertEqual(roles["ArchitectAgent"],"claude")
         self.assertEqual(roles["ImplementerAgent"],"codex")
 
+    def test_setup_ado_can_use_setup_only_secure_discovery_token(self):
+        class Args:
+            root="."
+            work_items="azure-devops"
+            github_repository=None
+            github_auth=None
+            github_token_env="GH_TOKEN"
+            ado_organization="org"
+            ado_project="proj"
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+            ado_mcp_mode="remote"
+            ado_mcp_auth="interactive"
+            ado_team=None
+            ai_provider=[]
+            role_provider=[
+                "SetupAgent=manual","PMAgent=manual","ArchitectAgent=manual",
+                "TesterAgent=manual","ImplementerAgent=manual","ReviewerAgent=manual","RuntimeVerifierAgent=manual",
+            ]
+            worker=[]
+            skill=[]
+            environment="none"
+            codespaces_mode="on-demand"
+            tdd=True
+            reviewer_mode="manual"
+            runtime_mode="project-defined"
+            non_interactive=False
+            ado_field=[]
+            ado_epic_wit=None
+            ado_issue_wit=None
+            ado_area_path=None
+            ado_iteration_path=None
+            no_files=True
+            output=".ai-workflow.yml"
+            force=False
+            framework_ref=""
+            yes=True
+            plan_only=True
+            plan_output=str(Path(tempfile.gettempdir())/"ai-workflow-ado-mcp-test-plan.yml")
+
+        discovery={
+            "organization":"org","project":"proj","project_id":"p","process_id":"proc",
+            "work_item_types":[{"name":"Epic","reference_name":"Epic","states":[]},{"name":"Issue","reference_name":"Issue","states":[]}],
+            "area_paths":["proj"],"iteration_paths":["proj"],
+        }
+        with patch("ai_workflow_cli.detect_repository_context", side_effect=RuntimeError("not a git repo")), \
+             patch("ai_workflow_cli.interactive_setup_options", side_effect=lambda args: args), \
+             patch("ai_workflow_cli.resolve_ado_discovery_token", return_value=(None,None)), \
+             patch("ai_workflow_cli.getpass.getpass", return_value="temporary-token"), \
+             patch("ai_workflow_cli.discover_provider", return_value=(discovery,{})) as discover, \
+             patch("ai_workflow_cli.detect_git_author", return_value={"name":None,"email":None}), \
+             patch("ai_workflow_cli.interactive_mapping", return_value={}), \
+             patch("ai_workflow_cli.interactive_ado_field_mapping", return_value={}), \
+             patch("ai_workflow_cli.interactive_ado_project_defaults", return_value={"work_item_types":{"epic":"Epic","issue":"Issue"},"defaults":{"area_path":"proj","iteration_path":"proj"}}), \
+             patch("ai_workflow_cli.confirm_setup_plan", return_value=False):
+            from ai_workflow_cli import setup_cmd
+            self.assertEqual(setup_cmd(Args()),0)
+            self.assertEqual(discover.call_args.args[0]._ado_discovery_token,"temporary-token")
+
     def test_doctor_ok(self):
         cfg=build_ado_config(DISCOVERY)
         self.assertEqual(doctor(cfg,DISCOVERY),[])

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tests/test_setup_wizard.py

@@ -5,7 +5,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools"))
 
 from github_work_item_provider import build_github_mapping, suggest_github_state, validate_github_mapping
 from setup_context import analyze_repository, setup_agent_context
-from setup_wizard import build_setup_plan, credential_requirements, interactive_setup_options, interactive_workspace_options, interactive_ado_project_defaults, resolve_ado_discovery_token, confirm_setup_plan
+from setup_wizard import build_setup_plan, credential_requirements, interactive_setup_options, interactive_workspace_options, interactive_ado_project_defaults, resolve_ado_discovery_credential, resolve_ado_discovery_token, confirm_setup_plan
 
 class Tests(unittest.TestCase):
     def test_context_analysis_detects_project_signals(self):
@@ -86,6 +86,61 @@ class Tests(unittest.TestCase):
         self.assertEqual(token,"worker-token")
         self.assertEqual(worker_id,"local-a")
 
+    def test_ado_discovery_credential_resolves_azure_cli_worker_as_bearer(self):
+        worker={
+            "worker_id":"local-cli",
+            "identity":{"azure_devops":{"auth":{"type":"azure-cli","store":"azure-cli"}}},
+        }
+        class Args:
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+        with patch.dict(os.environ,{},clear=True):
+            credential=resolve_ado_discovery_credential(
+                Args(),
+                [worker],
+                azure_cli_token_fn=lambda:"entra-token",
+            )
+        self.assertEqual(credential["token"],"entra-token")
+        self.assertEqual(credential["worker_id"],"local-cli")
+        self.assertEqual(credential["auth_scheme"],"bearer")
+        self.assertEqual(credential["source"],"azure-cli")
+
+    def test_ado_discovery_credential_resolves_mcp_interactive_worker_as_bearer(self):
+        worker={
+            "worker_id":"local-mcp",
+            "identity":{"azure_devops":{"auth":{"type":"interactive","store":"mcp"}}},
+        }
+        class Args:
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+        with patch.dict(os.environ,{},clear=True):
+            credential=resolve_ado_discovery_credential(
+                Args(),
+                [worker],
+                azure_cli_token_fn=lambda:"entra-token",
+            )
+        self.assertEqual(credential["worker_id"],"local-mcp")
+        self.assertEqual(credential["auth_scheme"],"bearer")
+
+    def test_ado_discovery_env_token_takes_precedence_over_interactive_auth(self):
+        worker={
+            "worker_id":"local-mcp",
+            "identity":{"azure_devops":{"auth":{
+                "type":"interactive",
+                "store":"mcp",
+                "env":"ADO_TOKEN_LOCAL_MCP",
+            }}},
+        }
+        class Args:
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+        with patch.dict(os.environ,{"ADO_TOKEN_LOCAL_MCP":"pat-token"},clear=True):
+            credential=resolve_ado_discovery_credential(
+                Args(),
+                [worker],
+                azure_cli_token_fn=lambda:"entra-token",
+            )
+        self.assertEqual(credential["token"],"pat-token")
+        self.assertEqual(credential["auth_scheme"],"basic")
+        self.assertEqual(credential["source"],"worker-env")
+
     def test_ado_project_defaults_are_selected_from_discovery(self):
         discovery={
             "project":"proj",
@@ -163,7 +218,8 @@ class Tests(unittest.TestCase):
             "1",                 # reviewer manual
             "1",                 # runtime project-defined
         ])
-        args=interactive_setup_options(Args(), input_fn=lambda _: next(answers), output_fn=lambda *_: None)
+        output=[]
+        args=interactive_setup_options(Args(), input_fn=lambda _: next(answers), output_fn=lambda *x: output.append(" ".join(map(str,x))))
         self.assertEqual(args.work_items,"github-issues")
         self.assertEqual(args.github_repository,"owner/main")
         self.assertEqual(args.workspace_config["workspace"]["name"],"product-workspace")
@@ -172,6 +228,58 @@ class Tests(unittest.TestCase):
         self.assertEqual(args.workspace_config["planning"]["default_repository"],"owner/main")
         self.assertTrue(args.tdd)
         self.assertEqual(args.skill,["implementation"])
+        self.assertEqual(
+            args.role_provider,
+            [
+                "SetupAgent=manual",
+                "PMAgent=manual",
+                "ArchitectAgent=manual",
+                "TesterAgent=manual",
+                "ImplementerAgent=manual",
+                "ReviewerAgent=manual",
+                "RuntimeVerifierAgent=manual",
+            ],
+        )
+        rendered="\n".join(output)
+        for role in ("SetupAgent","PMAgent","ArchitectAgent","TesterAgent","ImplementerAgent","ReviewerAgent","RuntimeVerifierAgent"):
+            self.assertIn(f"Choose provider for {role}",rendered)
+
+    def test_setup_requires_github_repository_when_detection_is_unavailable(self):
+        class Args:
+            root="."
+            work_items=None
+            github_repository=None
+            github_auth=None
+            github_token_env="GH_TOKEN"
+            ado_organization=None
+            ado_project=None
+            ado_token_env="AZURE_DEVOPS_TOKEN"
+            ado_mcp_mode=None
+            ado_mcp_auth=None
+            ado_team=None
+            ai_provider=[]
+            role_provider=[]
+            worker=[]
+            skill=["implementation"]
+            environment=None
+            codespaces_mode=None
+            tdd=None
+            reviewer_mode=None
+            runtime_mode=None
+
+        answers=iter([
+            ".", "1", "", "owner/repo", "1", "n", "n", "n",
+            "", "", "", "", "", "", "", "n", "1", "", "1", "1",
+        ])
+        output=[]
+        with patch("setup_wizard.detect_repository_context", side_effect=RuntimeError("not a git repo")):
+            args=interactive_setup_options(
+                Args(),
+                input_fn=lambda _: next(answers),
+                output_fn=lambda *x: output.append(" ".join(map(str,x))),
+            )
+        self.assertEqual(args.github_repository,"owner/repo")
+        self.assertIn("3/10 GitHub repository (owner/repo) is required.","\n".join(output))
 
     def test_setup_plan_records_skills_and_identities(self):
         plan=build_setup_plan(

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tools/ado_provider.py

@@ -38,17 +38,30 @@ def flatten_classification_paths(node: dict | None, project_name: str) -> list[s
 
 
 class AzureDevOps:
-    def __init__(self, organization: str, token: str, base_url="https://dev.azure.com"):
+    def __init__(
+        self,
+        organization: str,
+        token: str,
+        base_url="https://dev.azure.com",
+        auth_scheme: str = "basic",
+    ):
         self.organization = organization
         self.base = f"{base_url.rstrip('/')}/{quote(organization, safe='')}"
         self.token = token
+        if auth_scheme not in ("basic", "bearer"):
+            raise ValueError(f"unsupported Azure DevOps auth scheme: {auth_scheme}")
+        self.auth_scheme = auth_scheme
 
     def request(self, path: str):
-        auth = base64.b64encode((":" + self.token).encode()).decode()
+        if self.auth_scheme == "bearer":
+            authorization = "Bearer " + self.token
+        else:
+            encoded = base64.b64encode((":" + self.token).encode()).decode()
+            authorization = "Basic " + encoded
         req = Request(
             self.base + path,
             headers={
-                "Authorization": "Basic " + auth,
+                "Authorization": authorization,
                 "Accept": "application/json",
             },
         )

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tools/ai_dev_workflow.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-dev-workflow
-Version: 0.3.1
+Version: 0.3.1.2
 Summary: Provider-neutral AI-assisted development workflow and CLI
 Author: vuthethienlong
 Project-URL: Homepage, https://github.com/vuthethienlong/ai-dev-workflow

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tools/ai_workflow_cli.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import argparse
+import getpass
 import json
 import os
 import subprocess
@@ -21,6 +22,7 @@ from setup_wizard import (
     interactive_mapping,
     interactive_ado_field_mapping,
     interactive_ado_project_defaults,
+    resolve_ado_discovery_credential,
     resolve_ado_discovery_token,
     render_user_steps,
     apply_github_status_bootstrap,
@@ -59,13 +61,13 @@ DEFAULT_ROLE_PROVIDERS = {
     "SetupAgent": "manual",
     "PMAgent": "manual",
     "ArchitectAgent": "manual",
-    "TesterAgent": "codex",
-    "ImplementerAgent": "codex",
-    "ReviewerAgent": "codex",
-    "RuntimeVerifierAgent": "project-defined",
+    "TesterAgent": "manual",
+    "ImplementerAgent": "manual",
+    "ReviewerAgent": "manual",
+    "RuntimeVerifierAgent": "manual",
 }
 
-PACKAGE_VERSION = "0.3.1"
+PACKAGE_VERSION = "0.3.1.2"
 
 ROLE_KEYS = {
     "SetupAgent": "setup",
@@ -885,14 +887,61 @@ def setup_cmd(args) -> int:
 
     ado_discovery_worker = None
     if args.work_items in ("azure-devops", "composite"):
-        ado_token, ado_discovery_worker = resolve_ado_discovery_token(args, workers)
-        if not ado_token:
+        discovery_credential = resolve_ado_discovery_credential(args, workers)
+
+        interactive_worker_auth = any(
+            (((worker.get("identity") or {}).get("azure_devops") or {}).get("auth") or {}).get("type")
+            in ("interactive", "azure-cli")
+            or (((worker.get("identity") or {}).get("azure_devops") or {}).get("auth") or {}).get("store")
+            in ("mcp", "azure-cli")
+            for worker in workers
+        )
+
+        if not discovery_credential and interactive_worker_auth and not args.non_interactive:
+            print(
+                "ADO worker authentication is interactive. Metadata discovery also needs "
+                "an authenticated setup session."
+            )
+            if _wizard_yes_no(
+                "Sign in with Azure CLI for metadata discovery (credential is not stored)?",
+                True,
+            ):
+                try:
+                    subprocess.run(["az", "login"], check=True)
+                except FileNotFoundError:
+                    print(
+                        "Azure CLI is not installed. Falling back to a one-time PAT/token prompt."
+                    )
+                except subprocess.CalledProcessError:
+                    print(
+                        "Azure CLI sign-in did not complete. Falling back to a one-time PAT/token prompt."
+                    )
+                discovery_credential = resolve_ado_discovery_credential(args, workers)
+
+        if not discovery_credential and not args.non_interactive:
+            ado_token = getpass.getpass(
+                "ADO setup-only discovery PAT/token (not stored; leave blank to cancel): "
+            ).strip()
+            if ado_token:
+                discovery_credential = {
+                    "token": ado_token,
+                    "worker_id": None,
+                    "auth_scheme": "basic",
+                    "source": "secure-prompt",
+                }
+
+        if not discovery_credential:
             raise RuntimeError(
-                "ADO metadata discovery needs a worker credential available in this setup session. "
-                "Register a worker with ado_auth=env and an environment variable, or provide "
-                "--ado-token-env as a setup-only compatibility fallback."
+                "ADO metadata discovery has no usable setup credential. "
+                "For env/PAT auth, export the configured worker token variable or --ado-token-env. "
+                "For Azure CLI or MCP/interactive auth, sign in with 'az login' so setup can obtain "
+                "a temporary Azure DevOps bearer token. Cloud/Codespaces secret names are runtime "
+                "references and are not readable from the local setup process."
             )
-        args._ado_discovery_token = ado_token
+
+        ado_discovery_worker = discovery_credential.get("worker_id")
+        args._ado_discovery_token = discovery_credential["token"]
+        args._ado_discovery_auth_scheme = discovery_credential.get("auth_scheme", "basic")
 
     discovery, suggestions = discover_provider(args)
 

{ai_dev_workflow-0.3.1 → ai_dev_workflow-0.3.1.2}/tools/setup_wizard.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import os
+import subprocess
 from pathlib import Path
 
 from ado_provider import AzureDevOps, build_state_mapping, available_fields
@@ -139,7 +140,12 @@ def discover_provider(args):
                 "ADO discovery needs a temporary credential from a registered worker "
                 "or setup-session environment reference"
             )
-        discovery = AzureDevOps(args.ado_organization, token).discover(args.ado_project)
+        auth_scheme = getattr(args, "_ado_discovery_auth_scheme", "basic")
+        discovery = AzureDevOps(
+            args.ado_organization,
+            token,
+            auth_scheme=auth_scheme,
+        ).discover(args.ado_project)
         return discovery, build_state_mapping(discovery)
 
     token = getattr(args, "_resolved_github_token", None)
@@ -149,20 +155,92 @@ def discover_provider(args):
     return discovery, build_github_mapping(discovery)
 
 
-def resolve_ado_discovery_token(args, workers: list[dict]) -> tuple[str | None, str | None]:
-    """Resolve a setup-only ADO token from worker auth refs; never persist the value."""
+ADO_RESOURCE = "499b84ac-1321-427f-aa17-267ca6975798"
+
+
+def _azure_cli_access_token() -> str | None:
+    """Get an Azure DevOps Entra access token from an existing Azure CLI session."""
+    try:
+        token = subprocess.check_output(
+            [
+                "az",
+                "account",
+                "get-access-token",
+                "--resource",
+                ADO_RESOURCE,
+                "--query",
+                "accessToken",
+                "-o",
+                "tsv",
+            ],
+            text=True,
+            stderr=subprocess.DEVNULL,
+        ).strip()
+    except (FileNotFoundError, subprocess.CalledProcessError):
+        return None
+    return token or None
+
+
+def resolve_ado_discovery_credential(
+    args,
+    workers: list[dict],
+    azure_cli_token_fn=None,
+) -> dict | None:
+    """Resolve setup-only ADO discovery auth without persisting the credential.
+
+    PAT/token environment references use HTTP Basic auth. Azure CLI and
+    MCP/interactive worker identities may reuse an existing Entra session and
+    use HTTP Bearer auth for the REST metadata discovery pass.
+    """
     for worker in workers:
         auth = (((worker.get("identity") or {}).get("azure_devops") or {}).get("auth") or {})
         env_name = auth.get("env")
         if env_name and os.environ.get(env_name):
-            return os.environ[env_name], worker.get("worker_id")
+            return {
+                "token": os.environ[env_name],
+                "worker_id": worker.get("worker_id"),
+                "auth_scheme": "basic",
+                "source": "worker-env",
+            }
 
     # Backward-compatible setup-session fallback. This remains a temporary
     # discovery credential and is not stored as project runtime auth.
     env_name = getattr(args, "ado_token_env", None)
     if env_name and os.environ.get(env_name):
-        return os.environ[env_name], None
-    return None, None
+        return {
+            "token": os.environ[env_name],
+            "worker_id": None,
+            "auth_scheme": "basic",
+            "source": "setup-env",
+        }
+
+    cli_worker = None
+    for worker in workers:
+        auth = (((worker.get("identity") or {}).get("azure_devops") or {}).get("auth") or {})
+        if auth.get("type") in ("azure-cli", "interactive") or auth.get("store") in ("azure-cli", "mcp"):
+            cli_worker = worker
+            break
+
+    if cli_worker is not None:
+        token_fn = azure_cli_token_fn or _azure_cli_access_token
+        token = token_fn()
+        if token:
+            return {
+                "token": token,
+                "worker_id": cli_worker.get("worker_id"),
+                "auth_scheme": "bearer",
+                "source": "azure-cli",
+            }
+
+    return None
+
+
+def resolve_ado_discovery_token(args, workers: list[dict]) -> tuple[str | None, str | None]:
+    """Backward-compatible token-only view of discovery credentials."""
+    credential = resolve_ado_discovery_credential(args, workers)
+    if not credential:
+        return None, None
+    return credential["token"], credential.get("worker_id")
 
 
 def _default_wit(discovery: dict, logical: str) -> str:
@@ -304,6 +382,14 @@ def _prompt(input_fn, text: str, default: str | None = None) -> str:
     return value if value else (default or "")
 
 
+def _required_prompt(input_fn, output_fn, text: str, default: str | None = None) -> str:
+    while True:
+        value = _prompt(input_fn, text, default)
+        if value:
+            return value
+        output_fn(f"{text} is required.")
+
+
 def _choice(input_fn, output_fn, title: str, options: list[tuple[str, str]], default: str) -> str:
     output_fn(title)
     by_number = {}
@@ -359,8 +445,10 @@ def interactive_setup_options(args, input_fn=input, output_fn=print):
     )
 
     if args.work_items in ("github-issues", "composite"):
-        args.github_repository = args.github_repository or _prompt(
-            input_fn, "3/10 GitHub repository (owner/repo)"
+        args.github_repository = args.github_repository or _required_prompt(
+            input_fn,
+            output_fn,
+            "3/10 GitHub repository (owner/repo)",
         )
         args.github_auth = args.github_auth or _choice(
             input_fn, output_fn, "GitHub authentication",
@@ -407,14 +495,33 @@ def interactive_setup_options(args, input_fn=input, output_fn=print):
         "SetupAgent": "manual",
         "PMAgent": "manual",
         "ArchitectAgent": "manual",
-        "TesterAgent": "codex",
-        "ImplementerAgent": "codex",
-        "ReviewerAgent": "codex",
-        "RuntimeVerifierAgent": "project-defined",
+        "TesterAgent": "manual",
+        "ImplementerAgent": "manual",
+        "ReviewerAgent": "manual",
+        "RuntimeVerifierAgent": "manual",
     }
     if not args.role_provider:
-        for role, default in role_defaults.items():
-            provider = _prompt(input_fn, f"{role} provider", default)
+        provider_ids = ["manual", "codex"]
+        for raw in getattr(args, "ai_provider", []):
+            if "=" not in raw:
+                continue
+            provider_id = raw.split("=", 1)[0].strip()
+            if provider_id and provider_id not in provider_ids:
+                provider_ids.append(provider_id)
+        provider_options = [
+            (provider_id, "Manual / human-operated" if provider_id == "manual" else provider_id)
+            for provider_id in provider_ids
+        ]
+        roles = list(role_defaults)
+        for index, role in enumerate(roles, 1):
+            output_fn(f"\nAgent {index}/{len(roles)}: {role}")
+            provider = _choice(
+                input_fn,
+                output_fn,
+                f"Choose provider for {role}",
+                provider_options,
+                role_defaults[role],
+            )
             args.role_provider.append(f"{role}={provider}")
 
     output_fn("7/11 Workers")