bmsdna-devtools 0.46.0__tar.gz → 0.47.0__tar.gz

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bmsdna-devtools
-Version: 0.46.0
+Version: 0.47.0
 Summary: Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects
 Requires-Python: >=3.14
 Requires-Dist: azure-identity>=1.19.0
@@ -19,7 +19,7 @@ Description-Content-Type: text/markdown
 # bmsdna-devtools
 
 Shared developer tooling for BMS projects: PR build/check status and a
-one-shot PR summary (`bdt pr info`), PR creation, claiming an issue (`bdt issue take`), issue/work item creation and comments, finding issues addressed to an agent (`bdt issue search --for-me`) and waiting for new comments (`bdt issue watch`), git worktrees (creation and
+one-shot PR summary (`bdt pr info`), PR creation, claiming an issue (`bdt issue take`), issue/work item creation and comments, finding issues addressed to an agent (`bdt issue search --for-me`), finding issues filed by business users (`bdt issue search --business-user`) and waiting for new comments (`bdt issue watch`), git worktrees (creation and
 merged-worktree/orphaned-test-DB cleanup), a commit-and-push helper with
 pre-flight checks, Azure log queries, and static checks (`bdt lint`) for
 postgres/psycopg (and arrowbricks) SQL rules, pydantic-model placement, hand-wired HTTP access in
@@ -333,8 +333,10 @@ adds/edits/deletes comments on one, auto-detected from `origin` like `bdt pr
 `issue show NUMBER` prints one issue / work item: state, title, URL, description, tags, links to other
 issues (parent, children, blocked by, blocks; related on Azure DevOps), the Azure DevOps Type / Area /
 Iteration / Assigned to (GitHub: assignees, milestone) and all comments (Azure DevOps HTML is shown as plain
-text). `--json` prints the same as one JSON document (`number, title, state, url, body, tags, fields,
-parent, children, blocked_by, blocks, related, comments`).
+text). On Azure DevOps it also prints `Created by:` with whether the creator is a business user (see
+[`bdt issue search --business-user`](#bdt-issue-search---business-user)). `--json` prints the same as one JSON
+document (`number, title, state, url, body, tags, fields, parent, children, blocked_by, blocks, related,
+comments, created_by, business_user, business_user_reason`; the last three are `null` on GitHub).
 
 `--parent ID` and `--blocked-by ID` (repeatable) on `create` and `update` link the item to its parent and to
 the issues / work items that block it, on both backends. On `update` only the links that are missing are
@@ -536,6 +538,33 @@ bdt issue watch 84 --since-comment 123 --skip-own --json --timeout 1800
 - A single failed poll (network blip, API error) is retried; three in a row abort with the error.
 - On Azure DevOps only the newest 100 comments of a work item are looked at per poll.
 
+## `bdt issue search --business-user`
+
+Business users file work items too, often with vague wording, and those need a different handling than a
+developer's. `--business-user` (Azure DevOps only) keeps the work items **created by a business user**:
+
+```bash
+bdt issue search --business-user [--commit-depth 1000] [--tag needs-techie] [--for-me] [--state open] ...
+bdt issue show 1234        # also prints: Created by: Sam Sales (business user: Stakeholder license)
+```
+
+A creator is a business user when
+
+1. their license is **Stakeholder** (Member Entitlement API; needs a PAT with the *Member Entitlement
+   Management (read)* scope), or
+2. they authored **none of the last `--commit-depth` commits** (default 1000) of the repo you run `bdt` in. This
+   also decides when the license can't be read (missing PAT scope, ...) -- the license is then "unknown"; it is
+   not an error.
+
+The commit check matches the creator's email, else display name (a heuristic: two people sharing a name are
+taken for one), against the authors and committers of those commits (`.mailmap` applied). Identities that are
+not a person (build service, service accounts: no email as `uniqueName`) stay "unknown". A developer whose last commit is older than that window, or who works in other
+repos, counts as a business user here. A shallow clone with less history than `--commit-depth` can't say who never
+committed, so the creator stays "unknown" and is not returned by `--business-user`. `issue show` prints the reason
+next to the creator -- `business user`, `developer` or `unknown` -- and `--json` has `created_by`, `business_user`
+and `business_user_reason`. `--business-user` can't be combined with `--org-wide` (the commit check is about this
+repo's history).
+
 ## `bdt env get-keys`
 
 Lists the variable **names** (never the values) defined in `.env`, `*.env` and `.env.*` files under the

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/README.md

@@ -1,7 +1,7 @@
 # bmsdna-devtools
 
 Shared developer tooling for BMS projects: PR build/check status and a
-one-shot PR summary (`bdt pr info`), PR creation, claiming an issue (`bdt issue take`), issue/work item creation and comments, finding issues addressed to an agent (`bdt issue search --for-me`) and waiting for new comments (`bdt issue watch`), git worktrees (creation and
+one-shot PR summary (`bdt pr info`), PR creation, claiming an issue (`bdt issue take`), issue/work item creation and comments, finding issues addressed to an agent (`bdt issue search --for-me`), finding issues filed by business users (`bdt issue search --business-user`) and waiting for new comments (`bdt issue watch`), git worktrees (creation and
 merged-worktree/orphaned-test-DB cleanup), a commit-and-push helper with
 pre-flight checks, Azure log queries, and static checks (`bdt lint`) for
 postgres/psycopg (and arrowbricks) SQL rules, pydantic-model placement, hand-wired HTTP access in
@@ -315,8 +315,10 @@ adds/edits/deletes comments on one, auto-detected from `origin` like `bdt pr
 `issue show NUMBER` prints one issue / work item: state, title, URL, description, tags, links to other
 issues (parent, children, blocked by, blocks; related on Azure DevOps), the Azure DevOps Type / Area /
 Iteration / Assigned to (GitHub: assignees, milestone) and all comments (Azure DevOps HTML is shown as plain
-text). `--json` prints the same as one JSON document (`number, title, state, url, body, tags, fields,
-parent, children, blocked_by, blocks, related, comments`).
+text). On Azure DevOps it also prints `Created by:` with whether the creator is a business user (see
+[`bdt issue search --business-user`](#bdt-issue-search---business-user)). `--json` prints the same as one JSON
+document (`number, title, state, url, body, tags, fields, parent, children, blocked_by, blocks, related,
+comments, created_by, business_user, business_user_reason`; the last three are `null` on GitHub).
 
 `--parent ID` and `--blocked-by ID` (repeatable) on `create` and `update` link the item to its parent and to
 the issues / work items that block it, on both backends. On `update` only the links that are missing are
@@ -518,6 +520,33 @@ bdt issue watch 84 --since-comment 123 --skip-own --json --timeout 1800
 - A single failed poll (network blip, API error) is retried; three in a row abort with the error.
 - On Azure DevOps only the newest 100 comments of a work item are looked at per poll.
 
+## `bdt issue search --business-user`
+
+Business users file work items too, often with vague wording, and those need a different handling than a
+developer's. `--business-user` (Azure DevOps only) keeps the work items **created by a business user**:
+
+```bash
+bdt issue search --business-user [--commit-depth 1000] [--tag needs-techie] [--for-me] [--state open] ...
+bdt issue show 1234        # also prints: Created by: Sam Sales (business user: Stakeholder license)
+```
+
+A creator is a business user when
+
+1. their license is **Stakeholder** (Member Entitlement API; needs a PAT with the *Member Entitlement
+   Management (read)* scope), or
+2. they authored **none of the last `--commit-depth` commits** (default 1000) of the repo you run `bdt` in. This
+   also decides when the license can't be read (missing PAT scope, ...) -- the license is then "unknown"; it is
+   not an error.
+
+The commit check matches the creator's email, else display name (a heuristic: two people sharing a name are
+taken for one), against the authors and committers of those commits (`.mailmap` applied). Identities that are
+not a person (build service, service accounts: no email as `uniqueName`) stay "unknown". A developer whose last commit is older than that window, or who works in other
+repos, counts as a business user here. A shallow clone with less history than `--commit-depth` can't say who never
+committed, so the creator stays "unknown" and is not returned by `--business-user`. `issue show` prints the reason
+next to the creator -- `business user`, `developer` or `unknown` -- and `--json` has `created_by`, `business_user`
+and `business_user_reason`. `--business-user` can't be combined with `--org-wide` (the commit check is about this
+repo's history).
+
 ## `bdt env get-keys`
 
 Lists the variable **names** (never the values) defined in `.env`, `*.env` and `.env.*` files under the

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/bmsdna/devtools/ado_issue.py

@@ -50,6 +50,7 @@ from urllib.parse import quote
 import requests
 
 from .bdt_config import load_bdt_table
+from .business_user import BusinessUserDetector
 from .cli_tools import ensure_agent_session_note
 from .gitrepo import AdoRemote
 from .issue_show import IssueDetails
@@ -324,9 +325,12 @@ def get_work_item(session: requests.Session, remote: AdoRemote, work_item_id: in
     return r.json()
 
 
-def get_details(session: requests.Session, remote: AdoRemote, work_item_id: int) -> IssueDetails:
+def get_details(
+    session: requests.Session, remote: AdoRemote, work_item_id: int, business_users: BusinessUserDetector | None = None
+) -> IssueDetails:
     """What `bdt issue show` prints for a work item: its fields, links and comments. Long text
-    (Description, comments) is HTML as stored; it is shown as plain text."""
+    (Description, comments) is HTML as stored; it is shown as plain text. With `business_users`, also who
+    created it and whether that is a business user."""
     work_item = get_work_item(session, remote, work_item_id)
     fields = work_item.get("fields", {})
     relations = work_item.get("relations") or []
@@ -338,6 +342,8 @@ def get_details(session: requests.Session, remote: AdoRemote, work_item_id: int)
     if isinstance(assigned_to, dict):
         assigned_to = assigned_to.get("displayName")
     parents = linked(PARENT_REL)
+    creator = fields.get("System.CreatedBy")
+    verdict = business_users.verdict(creator) if business_users else None
     return IssueDetails(
         number=work_item_id,
         title=fields.get("System.Title", ""),
@@ -357,6 +363,9 @@ def get_details(session: requests.Session, remote: AdoRemote, work_item_id: int)
         blocks=linked(BLOCKS_REL),
         related=linked(RELATED_REL),
         comments=to_comments(list_all_comments(session, remote, work_item_id), is_html=True),
+        created_by=creator.get("displayName") if isinstance(creator, dict) else None,
+        business_user=verdict.business_user if verdict else None,
+        business_user_reason=verdict.reason if verdict else None,
     )
 
 
@@ -700,7 +709,9 @@ def run_wiql(session: requests.Session, remote: AdoRemote, wiql: str, top: int,
     return [wi["id"] for wi in r.json()["workItems"]]
 
 
-def get_work_items(session: requests.Session, remote: AdoRemote, ids: list[int], org_wide: bool = False) -> list[dict]:
+def get_work_items(
+    session: requests.Session, remote: AdoRemote, ids: list[int], org_wide: bool = False, with_creator: bool = False
+) -> list[dict]:
     """Batch-fetch Title/State (plus TeamProject when `org_wide`) for a set of work item ids, in
     the given `ids` order — WIQL only returns ids (not field values), and this batch endpoint
     doesn't guarantee it echoes them back in the order they were requested, so the caller's WIQL
@@ -708,12 +719,14 @@ def get_work_items(session: requests.Session, remote: AdoRemote, ids: list[int],
 
     `org_wide` fetches via the org-level endpoint (ids from an org-wide `run_wiql` may belong to
     a project other than `remote.project`) and also asks for `System.TeamProject`, so `search()`
-    can show which project each result came from.
+    can show which project each result came from. `with_creator` also asks for `System.CreatedBy`.
     """
     if not ids:
         return []
     base = _org_url(remote) if org_wide else _base_url(remote)
     fields = "System.Title,System.State,System.TeamProject" if org_wide else "System.Title,System.State"
+    if with_creator:
+        fields += ",System.CreatedBy"
     r = session.get(
         f"{base}/_apis/wit/workitems",
         params={"ids": ",".join(map(str, ids)), "fields": fields, "api-version": "7.1"},
@@ -756,6 +769,7 @@ def search(
     tags: list[str] | None = None,
     comment_filter: Callable[[str | None], bool] | None = None,
     scan_limit: int | None = None,
+    business_users: BusinessUserDetector | None = None,
 ) -> list[dict]:
     """Search (or, with no keywords, just list) work items by keywords (ANDed, matched against
     Title or Description) and state, most recently changed first. `board` is an Azure Boards team
@@ -771,13 +785,21 @@ def search(
     e.g. `bdt issue search --for-me`. WIQL can't query comments, so up to `_COMMENT_FILTER_POOL`
     candidates are fetched and checked one by one, stopping once `top` have matched. `scan_limit` sizes that
     pool as if it were `top` (default: `top`), for a caller that wants few results out of a wide scan.
+
+    `business_users` keeps only work items created by a business user (see `business_user.py`), checked before
+    `comment_filter` since it costs no request per work item.
     """
     if org_wide and board:
         sys.exit("--board can't be combined with --org-wide (a board's Area Path is scoped to a single project).")
     area_path = get_team_area_path(session, remote, board) if board else None
     wiql = build_search_wiql(keywords, since, area_path, state, org_wide=org_wide, tags=tags)
-    ids = run_wiql(session, remote, wiql, min((scan_limit or top) * 10, _COMMENT_FILTER_POOL) if comment_filter else top, org_wide=org_wide)
-    items = get_work_items(session, remote, ids, org_wide=org_wide)
+    filtered = comment_filter or business_users
+    ids = run_wiql(session, remote, wiql, min((scan_limit or top) * 10, _COMMENT_FILTER_POOL) if filtered else top, org_wide=org_wide)
+    items = get_work_items(session, remote, ids, org_wide=org_wide, with_creator=business_users is not None)
+    if business_users:
+        items = [i for i in items if business_users.verdict(i["fields"].get("System.CreatedBy")).business_user]
+        if not comment_filter:
+            items = items[:top]
     if comment_filter:
         items = _filter_by_last_comment(session, remote, items, top, comment_filter)
     for item in items:

bmsdna_devtools-0.47.0/bmsdna/devtools/business_user.py

@@ -0,0 +1,144 @@
+"""Is the creator of an Azure DevOps work item a business user (as opposed to a developer)?
+
+Backs `bdt issue search --business-user` and the `Created by` line of `bdt issue show`. A creator is a
+business user when
+
+1. their Azure DevOps license is `Stakeholder` (Member Entitlement API), or
+2. they authored none of the last `DEFAULT_COMMIT_DEPTH` commits of the local repo.
+
+The entitlement API needs a PAT with the "Member Entitlement Management (read)" scope; when it is not
+reachable the license is treated as unknown and only the commit check decides.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from collections.abc import Callable
+from dataclasses import dataclass
+from functools import cached_property
+from pathlib import Path
+from urllib.parse import quote
+
+import requests
+
+from .gitrepo import AdoRemote
+
+DEFAULT_COMMIT_DEPTH = 1000
+STAKEHOLDER = "stakeholder"
+_ENTITLEMENT_API_VERSION = "7.1-preview.3"
+
+
+@dataclass(frozen=True)
+class Verdict:
+    """`business_user` is None when neither check could tell (no license info, no usable git history)."""
+
+    business_user: bool | None
+    reason: str
+
+
+@dataclass(frozen=True)
+class CommitAuthors:
+    """Lowercased emails and names of the authors and committers of the last `depth` commits."""
+
+    emails: frozenset[str]
+    names: frozenset[str]
+    depth: int
+
+    def contains(self, email: str | None, name: str | None) -> bool:
+        return bool(email and email.casefold() in self.emails) or bool(name and name.casefold() in self.names)
+
+
+def read_commit_authors(depth: int = DEFAULT_COMMIT_DEPTH, cwd: Path | None = None) -> CommitAuthors | None:
+    """The authors of the last `depth` commits of the repo at `cwd`, or None when that history can't tell who never
+    committed: not a git repo, or a shallow clone that has fewer than `depth` commits."""
+    # %aE/%aN/%cE/%cN honour .mailmap; \x1f can't occur in a name, and a name can't hold a newline
+    log = subprocess.run(
+        ["git", "log", "-n", str(depth), "--format=%aE%x1f%aN%x1f%cE%x1f%cN"],
+        capture_output=True,
+        encoding="utf-8",
+        errors="replace",
+        cwd=cwd,
+        check=False,
+    )
+    if log.returncode != 0:
+        return None
+    rows = [fields for line in log.stdout.split("\n") if len(fields := line.split("\x1f")) == 4]
+    # `--is-shallow-repository` needs git 2.15; the shallow file's presence works everywhere
+    shallow_file = subprocess.run(["git", "rev-parse", "--git-path", "shallow"], capture_output=True, text=True, cwd=cwd, check=False)
+    if shallow_file.returncode == 0 and (cwd or Path()).joinpath(shallow_file.stdout.strip()).exists() and len(rows) < depth:
+        return None
+    return CommitAuthors(
+        emails=frozenset(v.casefold() for row in rows for v in (row[0], row[2]) if v),
+        names=frozenset(v.casefold() for row in rows for v in (row[1], row[3]) if v),
+        depth=depth,
+    )
+
+
+def get_license(session: requests.Session, remote: AdoRemote, identity_id: str) -> str | None:
+    """The account license type of an identity, lowercased (`stakeholder`, `express`, `advanced`, `none`, ...), or None
+    when the entitlement API doesn't answer (missing PAT scope, user not in the org, outage, ...): the license is
+    optional enrichment, and the commit check still has a say without it."""
+    try:
+        r = session.get(
+            f"https://vsaex.dev.azure.com/{remote.org}/_apis/userentitlements/{quote(identity_id, safe='')}",
+            params={"api-version": _ENTITLEMENT_API_VERSION},
+        )
+    except requests.RequestException:
+        return None
+    if r.status_code != 200:
+        return None
+    try:
+        body = r.json()
+    except ValueError:  # e.g. an HTML sign-in page for a PAT that may not use this API
+        return None
+    license_type = ((body.get("accessLevel") if isinstance(body, dict) else None) or {}).get("accountLicenseType")
+    return license_type.casefold() if isinstance(license_type, str) else None
+
+
+def classify(
+    license_type: str | None, read_authors: Callable[[], CommitAuthors | None], email: str | None, name: str | None
+) -> Verdict:
+    """Stakeholder license -> business user; else, no commit by this person in `read_authors()` (only called when the
+    license doesn't settle it) -> business user."""
+    if license_type == STAKEHOLDER:
+        return Verdict(True, "Stakeholder license")
+    authors = read_authors()
+    known_license = f"{license_type} license" if license_type else "license unknown"
+    if authors is None:
+        return Verdict(None, f"{known_license}, commit history unavailable")
+    if authors.contains(email, name):
+        return Verdict(False, f"{known_license}, has commits")
+    return Verdict(True, f"{known_license}, no commits in the last {authors.depth} of this repo")
+
+
+class BusinessUserDetector:
+    """Judges work item creators (the `System.CreatedBy` identity dict), looking up each license once and reading
+    the git history of the current directory's repo once per detector."""
+
+    def __init__(self, session: requests.Session, remote: AdoRemote, commit_depth: int = DEFAULT_COMMIT_DEPTH) -> None:
+        self._session = session
+        self._remote = remote
+        self._commit_depth = commit_depth
+        self._licenses: dict[str, str | None] = {}
+
+    @cached_property
+    def _commit_authors(self) -> CommitAuthors | None:
+        return read_commit_authors(self._commit_depth)
+
+    def _license(self, identity_id: str | None) -> str | None:
+        if not identity_id:
+            return None
+        if identity_id not in self._licenses:
+            self._licenses[identity_id] = get_license(self._session, self._remote, identity_id)
+        return self._licenses[identity_id]
+
+    def verdict(self, creator: dict | None) -> Verdict:
+        """`creator` is the `System.CreatedBy` field: an identity dict (`id`, `uniqueName`, `displayName`)."""
+        if not isinstance(creator, dict):
+            return Verdict(None, "creator unknown")
+        if "@" not in (creator.get("uniqueName") or ""):
+            # build service, service accounts, ...: no license, no commits, and not someone to ask questions
+            return Verdict(None, "not a person")
+        identity_id = creator.get("id")
+        license_type = self._license(identity_id if isinstance(identity_id, str) else None)
+        return classify(license_type, lambda: self._commit_authors, creator.get("uniqueName"), creator.get("displayName"))

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/bmsdna/devtools/cli.py

@@ -27,6 +27,7 @@ from . import find_repo as find_repo_mod
 from . import issue_do as issue_do_mod
 from . import issue_watch as issue_watch_mod
 from . import gh_issue, gh_pr
+from . import business_user as business_user_mod
 from . import issue_show as issue_show_mod
 from . import find_injection as find_injection_mod
 from . import lint as lint_mod
@@ -926,6 +927,19 @@ def issue_search(
         envvar=["AZURE_DEVOPS_EXT_PAT", "AZURE_DEVOPS_PAT"],
         help="Azure DevOps PAT (else uses DefaultAzureCredential, e.g. your `az login`)",
     ),
+    business_user: bool = typer.Option(
+        False,
+        "--business-user",
+        help="Azure DevOps only: only work items created by a business user -- someone with a Stakeholder license, or "
+        "(when the license can't be read, or isn't Stakeholder) with no commit in the last --commit-depth commits of "
+        "this repo. The license lookup needs a PAT with the 'Member Entitlement Management (read)' scope.",
+    ),
+    commit_depth: int = typer.Option(
+        business_user_mod.DEFAULT_COMMIT_DEPTH,
+        "--commit-depth",
+        min=1,
+        help="With --business-user: how many of the latest commits of this repo count when checking whether a creator ever committed",
+    ),
     for_me: bool = typer.Option(
         False,
         "--for-me",
@@ -968,6 +982,10 @@ def issue_search(
     """
     if state not in ("open", "closed", "all"):
         raise typer.BadParameter("Must be one of: open, closed, all", param_hint="--state")
+    if business_user and org_wide:
+        raise typer.BadParameter("--business-user checks the commits of this repo, so it can't be combined with --org-wide", param_hint="--business-user")
+    if commit_depth != business_user_mod.DEFAULT_COMMIT_DEPTH and not business_user:
+        raise typer.BadParameter("--commit-depth only works together with --business-user", param_hint="--commit-depth")
     if take and not for_me:
         raise typer.BadParameter("--take only works together with --for-me", param_hint="--take")
     if take and limit < 1:
@@ -1010,9 +1028,15 @@ def issue_search(
     else:
         remote = current_remote()
 
+    if business_user and isinstance(remote, GitHubRemote):
+        raise typer.BadParameter("--business-user is only available for Azure DevOps work items", param_hint="--business-user")
+    # one detector for all polls of --wait: it caches the git history and the licenses it asked for
+    detector: business_user_mod.BusinessUserDetector | None = None
+
     def search_once() -> tuple[list[dict], tuple[AdoRemote | GitHubRemote, int] | None]:
         """One search (the backend prints the matches, or "No matching ...", itself); with the first match's
         remote and number, which is where `--take` claims it."""
+        nonlocal detector
         if isinstance(remote, GitHubRemote):
             resolved_board = gh_issue.resolve_board(board)
             items = gh_issue.search(
@@ -1023,6 +1047,9 @@ def issue_search(
             session = requests.Session()
             session.headers.update(auth_header(pat))
             resolved_board = ado_issue.resolve_board(board)
+            if business_user:
+                detector = detector or business_user_mod.BusinessUserDetector(session, remote, commit_depth)
+                search_extra["business_users"] = detector
             items = ado_issue.search(
                 session, remote, keywords or [], since=since, board=resolved_board, top=limit, state=state, org_wide=org_wide, tags=tags_or_labels, **search_extra
             )
@@ -1343,7 +1370,7 @@ def issue_show(
     else:
         session = requests.Session()
         session.headers.update(auth_header(pat))
-        details = ado_issue.get_details(session, remote, number)
+        details = ado_issue.get_details(session, remote, number, business_user_mod.BusinessUserDetector(session, remote))
     typer.echo(issue_show_mod.format_details(details, as_json=as_json))
 
 

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/bmsdna/devtools/issue_show.py

@@ -33,18 +33,31 @@ class IssueDetails:
     blocks: list[int] = field(default_factory=list)
     related: list[int] = field(default_factory=list)
     comments: list[Comment] = field(default_factory=list)
+    # Azure DevOps with a business-user check: who created it, and whether that is a business user (None = unknown)
+    created_by: str | None = None
+    business_user: bool | None = None
+    business_user_reason: str | None = None
 
 
 def _refs(numbers: list[int]) -> str:
     return ", ".join(f"#{n}" for n in numbers)
 
 
+def _creator_note(details: IssueDetails) -> str:
+    if details.business_user_reason is None:
+        return ""
+    kind = {True: "business user", False: "developer", None: "unknown"}[details.business_user]
+    return f" ({kind}: {details.business_user_reason})"
+
+
 def format_details(details: IssueDetails, *, as_json: bool = False) -> str:
     """The issue as one JSON document (`as_json`, values unchanged) or as readable text (control characters shown escaped)."""
     if as_json:
         return json.dumps(asdict(details), ensure_ascii=False, indent=2)
     lines = [f"#{details.number} [{details.state}] {details.title}", details.url]
     lines += [f"{name}: {value}" for name, value in details.fields.items() if value]
+    if details.created_by:
+        lines.append(f"Created by: {details.created_by}{_creator_note(details)}")
     if details.tags:
         lines.append(f"Tags: {', '.join(details.tags)}")
     if details.parent is not None:

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["bmsdna"]
 
 [project]
 name = "bmsdna-devtools"
-version = "0.46.0"
+version = "0.47.0"
 description = "Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects"
 readme = "README.md"
 requires-python = ">=3.14"  # pgdevkit>=0.7.1 requires 3.14; was >=3.11 before adding it as a dependency

{bmsdna_devtools-0.46.0 → bmsdna_devtools-0.47.0}/skills/bmsdna-devtools/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Use the `bdt` CLI (from the bmsdna-devtools package) instead of ad hoc git/az/gh
   commands or repo-local scripts for: checking PR build/check status, creating
   a PR, creating a git worktree, committing and pushing files (with pre-flight
-  checks), claiming an issue / work item (`bdt issue take`), showing an issue / work item and linking it to a parent / blockers (`bdt issue show`, `--parent`, `--blocked-by`, `--iteration`), finding issues addressed to you (`bdt issue search --for-me`), waiting for a reply on an issue (`bdt issue watch`), a one-shot PR summary
+  checks), claiming an issue / work item (`bdt issue take`), showing an issue / work item and linking it to a parent / blockers (`bdt issue show`, `--parent`, `--blocked-by`, `--iteration`), finding issues addressed to you (`bdt issue search --for-me`), finding work items filed by business users (`bdt issue search --business-user`), waiting for a reply on an issue (`bdt issue watch`), a one-shot PR summary
   (`bdt pr info`: link, build state, closed issues), querying Azure logs, and static checks (`bdt lint`: SQL/psycopg/arrowbricks rules, pydantic placement, tooling; `bdt dead-code`:
   unreferenced .sql files and backend routes nothing calls), listing which env vars a repo defines (`bdt env get-keys`, names only). `bdt pr *` works against both Azure DevOps
   and GitHub — it auto-detects which one from the `origin` remote. Trigger
@@ -97,7 +97,7 @@ session-link comment instead.
 ## Reading and linking an issue
 
 ```bash
-bdt issue show 1234 [--json]        # state, description, tags, area/iteration, links (parent/children/blocked by/blocks), comments
+bdt issue show 1234 [--json]        # state, description, tags, area/iteration, links (parent/children/blocked by/blocks), comments, creator + business-user verdict (Azure DevOps)
 bdt issue create --title "..." --parent 1200 --blocked-by 1210 [--iteration 'Project\Sprint 1']
 bdt issue update 1234 --parent 1200 --blocked-by 1210 [--iteration 'Project\Sprint 1']
 ```
@@ -107,6 +107,12 @@ Azure DevOps; `update` only adds missing links, so it's safe to repeat. `--itera
 exit 2 on GitHub) sets the Iteration Path, which Basic-process work items need to show on the team backlog;
 on `create` it defaults to `[tool.bdt.ado].iteration` in `pyproject.toml`.
 
+Azure DevOps only: `bdt issue show` names the creator and whether they are a **business user** (Stakeholder license,
+or no commit in the last 1000 commits of this repo; the license lookup needs the *Member Entitlement Management
+(read)* PAT scope, else only commits decide), and `bdt issue search --business-user [--commit-depth N]` lists only
+work items created by business users (not with `--org-wide`). Combine with `--tag` to find e.g. their items tagged
+`needs-techie`.
+
 ## Finding issues meant for you, and asking via an issue
 
 ```bash