teams-cli 0.1.4__tar.gz → 0.1.6__tar.gz

teams_cli-0.1.6/.github/workflows/dependencies.yml

@@ -0,0 +1,28 @@
+name: Dependency health
+
+on:
+  schedule:
+    - cron: "7 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  packages: read
+  pull-requests: read
+
+jobs:
+  update:
+    uses: rvben/upd/.github/workflows/dependency-health.yml@ecb605d32c4edc8dee4091aeb30b3d37ebdd290a # v0.10.0
+    with:
+      langs: rust,actions
+      lock: true
+      min-age: 7d
+      max-bump: minor
+      prepare-command: >-
+        rustup toolchain install 1.96.0 --profile minimal --component clippy,rustfmt &&
+        rustup default 1.96.0
+      validation-command: make check
+      fail-on-blocked: false
+      branch: deps/upd
+      commit-message: "chore(deps): weekly dependency update"

{teams_cli-0.1.4 → teams_cli-0.1.6}/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.6](https://github.com/rvben/teams-cli/compare/v0.1.5...v0.1.6) - 2026-09-03
+
+### Added
+
+- **auth**: standardize authentication workflow ([bb0019f](https://github.com/rvben/teams-cli/commit/bb0019f0ceb86dbb963f3499348c58a95922081e))
+
+### Fixed
+
+- **auth**: tolerate missing Linux credential service ([7764383](https://github.com/rvben/teams-cli/commit/776438359f3c913d0514de921042d770c6a88bf0))
+
+## [0.1.5](https://github.com/rvben/teams-cli/compare/v0.1.4...v0.1.5) - 2026-08-26
+
+### Added
+
+- **tui**: recover Microsoft sign-in in place ([8266887](https://github.com/rvben/teams-cli/commit/8266887feef3feb651fa4ae5348752be2703d36b))
+
 ## [0.1.4](https://github.com/rvben/teams-cli/compare/v0.1.3...v0.1.4) - 2026-08-26
 
 ### Added

{teams_cli-0.1.4 → teams_cli-0.1.6}/Cargo.lock

@@ -2964,7 +2964,7 @@ dependencies = [
 
 [[package]]
 name = "teams-cli"
-version = "0.1.4"
+version = "0.1.6"
 dependencies = [
  "assert_cmd",
  "base64 0.23.1",

{teams_cli-0.1.4 → teams_cli-0.1.6}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "teams-cli"
-version = "0.1.4"
+version = "0.1.6"
 edition = "2024"
 rust-version = "1.90"
 description = "A Microsoft Teams CLI and TUI designed equally for humans and agents"

{teams_cli-0.1.4 → teams_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: teams-cli
-Version: 0.1.4
+Version: 0.1.6
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 License-File: LICENSE
@@ -73,6 +73,11 @@ Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
 ChannelMessage.Send
 ```
 
+The TUI is also the recovery path: an unconfigured profile, missing credential,
+expired refresh session, or Microsoft `401` opens a focused connection screen.
+Press `Enter` or `a` to restore the normal terminal, complete Microsoft sign-in,
+and return directly to the inbox; `q` exits without changing anything.
+
 Reading channel history is intentionally separate because `ChannelMessage.Read.All` requires administrator consent. Request it only when needed:
 
 ```console
@@ -110,8 +115,14 @@ teams auth login --channel-history  # once, with administrator approval
 teams messages list --team TEAM_ID --channel CHANNEL_ID
 teams messages send --chat CHAT_ID --body "On it."
 printf 'Status update' | teams messages send --chat CHAT_ID --body -
+teams auth status
+teams auth status --offline
+teams profile list
+teams profile use work
+teams profile remove old --yes
 teams config show
-teams doctor
+teams config path
+teams doctor --offline
 ```
 
 Collection commands expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.

{teams_cli-0.1.4 → teams_cli-0.1.6}/README.md

@@ -57,6 +57,11 @@ Channel.ReadBasic.All Chat.Read Chat.Create ChatMessage.Send
 ChannelMessage.Send
 ```
 
+The TUI is also the recovery path: an unconfigured profile, missing credential,
+expired refresh session, or Microsoft `401` opens a focused connection screen.
+Press `Enter` or `a` to restore the normal terminal, complete Microsoft sign-in,
+and return directly to the inbox; `q` exits without changing anything.
+
 Reading channel history is intentionally separate because `ChannelMessage.Read.All` requires administrator consent. Request it only when needed:
 
 ```console
@@ -94,8 +99,14 @@ teams auth login --channel-history  # once, with administrator approval
 teams messages list --team TEAM_ID --channel CHANNEL_ID
 teams messages send --chat CHAT_ID --body "On it."
 printf 'Status update' | teams messages send --chat CHAT_ID --body -
+teams auth status
+teams auth status --offline
+teams profile list
+teams profile use work
+teams profile remove old --yes
 teams config show
-teams doctor
+teams config path
+teams doctor --offline
 ```
 
 Collection commands expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.

{teams_cli-0.1.4 → teams_cli-0.1.6}/src/auth.rs

@@ -104,12 +104,29 @@ fn load(profile_name: &str) -> Result<TokenBundle, AppError> {
 pub fn logout(profile_name: &str) -> Result<(), AppError> {
     match entry(profile_name)?.delete_credential() {
         Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+        Err(e) if secret_service_is_unavailable(&e) => Ok(()),
         Err(e) => Err(AppError::Unexpected(format!(
             "could not remove stored credentials: {e}"
         ))),
     }
 }
 
+#[cfg(target_os = "linux")]
+fn secret_service_is_unavailable(error: &keyring::Error) -> bool {
+    match error {
+        keyring::Error::PlatformFailure(source) => {
+            let message = source.to_string();
+            message.contains("org.freedesktop.secrets") && message.contains("not provided")
+        }
+        _ => false,
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+fn secret_service_is_unavailable(_error: &keyring::Error) -> bool {
+    false
+}
+
 pub async fn access_token(profile_name: &str, profile: &Profile) -> Result<String, AppError> {
     if let Ok(token) = std::env::var("TEAMS_ACCESS_TOKEN") {
         return Ok(token);
@@ -385,4 +402,14 @@ mod tests {
     fn channel_history_is_explicitly_opted_in() {
         assert!(scopes(true).contains(CHANNEL_HISTORY_SCOPE));
     }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn missing_secret_service_is_treated_as_an_empty_store() {
+        let error = keyring::Error::PlatformFailure(Box::new(std::io::Error::other(
+            "The name org.freedesktop.secrets was not provided by any .service files",
+        )));
+
+        assert!(super::secret_service_is_unavailable(&error));
+    }
 }

{teams_cli-0.1.4 → teams_cli-0.1.6}/src/cli.rs

@@ -20,6 +20,9 @@ pub struct Cli {
     /// Suppress progress and informational messages
     #[arg(long, global = true)]
     pub quiet: bool,
+    /// Skip confirmation prompts for destructive operations
+    #[arg(long, short = 'y', global = true)]
+    pub yes: bool,
     /// Alias for --output json
     #[arg(long, global = true, hide = true)]
     pub json: bool,
@@ -36,6 +39,11 @@ pub enum Command {
         #[command(subcommand)]
         command: AuthCommand,
     },
+    /// List, select, or remove configuration profiles
+    Profile {
+        #[command(subcommand)]
+        command: ProfileCommand,
+    },
     /// Inspect resolved, secret-free configuration
     Config {
         #[command(subcommand)]
@@ -63,7 +71,11 @@ pub enum Command {
     /// Open the keyboard-first terminal interface
     Tui(TuiArgs),
     /// Check configuration, credential storage, and Graph access
-    Doctor,
+    Doctor {
+        /// Check local state without contacting Microsoft Graph
+        #[arg(long)]
+        offline: bool,
+    },
     /// Describe supported and deliberately unsupported capabilities
     Capabilities,
     /// Emit the offline CLI Spec v0.3 contract
@@ -118,8 +130,22 @@ pub enum AuthCommand {
     },
     /// Remove locally stored credentials
     Logout,
-    /// Show local authentication status without network access
-    Status,
+    /// Verify authentication and show the selected profile's status
+    Status {
+        /// Inspect local credential state without contacting Microsoft Graph
+        #[arg(long)]
+        offline: bool,
+    },
+}
+
+#[derive(Debug, Subcommand)]
+pub enum ProfileCommand {
+    /// List configured profiles and identify the active one
+    List,
+    /// Select the default profile for future commands
+    Use { name: String },
+    /// Remove a profile and its stored credential
+    Remove { name: String },
 }
 
 #[derive(Debug, Subcommand)]

{teams_cli-0.1.4 → teams_cli-0.1.6}/src/config.rs

@@ -44,6 +44,15 @@ struct ConfigFile {
     profiles: BTreeMap<String, Profile>,
 }
 
+#[derive(Debug, Serialize)]
+pub struct ProfileSummary {
+    pub name: String,
+    pub active: bool,
+    pub tenant: String,
+    pub client_id: String,
+    pub read_only: bool,
+}
+
 pub fn path() -> PathBuf {
     if let Some(base) = std::env::var_os("XDG_CONFIG_HOME").filter(|v| !v.is_empty()) {
         PathBuf::from(base).join("teams").join("config.toml")
@@ -61,6 +70,11 @@ pub fn save(profile_name: &str, profile: Profile) -> Result<PathBuf, AppError> {
     let mut config = read_file()?;
     config.profiles.insert(profile_name.to_string(), profile);
     config.active_profile = Some(profile_name.to_string());
+    write_file(&path, &config)?;
+    Ok(path)
+}
+
+fn write_file(path: &std::path::Path, config: &ConfigFile) -> Result<(), AppError> {
     let parent = path
         .parent()
         .ok_or_else(|| AppError::Unexpected("configuration path has no parent".into()))?;
@@ -77,17 +91,13 @@ pub fn save(profile_name: &str, profile: Profile) -> Result<PathBuf, AppError> {
         use std::os::unix::fs::PermissionsExt;
         std::fs::set_permissions(temp.path(), std::fs::Permissions::from_mode(0o600))?;
     }
-    temp.persist(&path).map_err(|error| error.error)?;
-    Ok(path)
+    temp.persist(path).map_err(|error| error.error)?;
+    Ok(())
 }
 
 pub fn load(requested: Option<&str>) -> Result<(String, Profile), AppError> {
     let config = read_file()?;
-    let name = requested
-        .map(str::to_owned)
-        .or_else(|| std::env::var("TEAMS_PROFILE").ok())
-        .or(config.active_profile)
-        .unwrap_or_else(|| "default".into());
+    let name = selected_profile_name_from(requested, config.active_profile.as_deref());
     let stored = config.profiles.get(&name);
     let client_id = std::env::var("TEAMS_CLIENT_ID")
         .ok()
@@ -118,6 +128,25 @@ pub fn load(requested: Option<&str>) -> Result<(String, Profile), AppError> {
     Ok((name, profile))
 }
 
+/// Resolve the profile a command would use without requiring that profile to
+/// be configured. Interactive recovery screens need the name even on first
+/// use, before there is a profile for [`load`] to return.
+pub fn selected_profile_name(requested: Option<&str>) -> Result<String, AppError> {
+    let config = read_file()?;
+    Ok(selected_profile_name_from(
+        requested,
+        config.active_profile.as_deref(),
+    ))
+}
+
+fn selected_profile_name_from(requested: Option<&str>, active: Option<&str>) -> String {
+    requested
+        .map(str::to_owned)
+        .or_else(|| std::env::var("TEAMS_PROFILE").ok())
+        .or_else(|| active.map(str::to_owned))
+        .unwrap_or_else(|| "default".into())
+}
+
 fn parse_bool(name: &str, value: &str) -> Result<bool, AppError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "1" | "true" | "yes" | "on" => Ok(true),
@@ -144,6 +173,46 @@ pub fn configured_profile(requested: Option<&str>) -> Option<(String, Profile)>
     load(requested).ok()
 }
 
+pub fn profile_summaries() -> Result<Vec<ProfileSummary>, AppError> {
+    let config = read_file()?;
+    Ok(config
+        .profiles
+        .iter()
+        .map(|(name, profile)| ProfileSummary {
+            name: name.clone(),
+            active: config.active_profile.as_deref() == Some(name.as_str()),
+            tenant: profile.tenant.clone(),
+            client_id: profile.client_id.clone(),
+            read_only: profile.read_only,
+        })
+        .collect())
+}
+
+pub fn use_profile(name: &str) -> Result<(), AppError> {
+    let path = path();
+    let mut config = read_file()?;
+    if !config.profiles.contains_key(name) {
+        return Err(AppError::InvalidInput(format!(
+            "profile '{name}' is not configured"
+        )));
+    }
+    config.active_profile = Some(name.into());
+    write_file(&path, &config)
+}
+
+pub fn remove_profile(name: &str) -> Result<bool, AppError> {
+    let path = path();
+    let mut config = read_file()?;
+    let removed = config.profiles.remove(name).is_some();
+    if removed {
+        if config.active_profile.as_deref() == Some(name) {
+            config.active_profile = config.profiles.keys().next().cloned();
+        }
+        write_file(&path, &config)?;
+    }
+    Ok(removed)
+}
+
 fn read_file() -> Result<ConfigFile, AppError> {
     match std::fs::read_to_string(path()) {
         Ok(body) => toml::from_str(&body)

{teams_cli-0.1.4 → teams_cli-0.1.6}/src/main.rs

@@ -7,7 +7,7 @@ use serde_json::Value;
 use teams_cli::auth;
 use teams_cli::cli::{
     AuthCommand, ChannelsCommand, ChatsCommand, Cli, Command, ConfigCommand, InitArgs,
-    MessagesCommand, OffsetPageArgs, PageArgs, TuiArgs,
+    MessagesCommand, OffsetPageArgs, PageArgs, ProfileCommand, TuiArgs,
 };
 use teams_cli::config::{self, Profile};
 use teams_cli::error::AppError;
@@ -51,6 +51,7 @@ async fn main() {
 
 async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
     let profile_arg = cli.profile.as_deref();
+    let yes = cli.yes;
     let command = match cli.command {
         Some(command) => command,
         None if io::stdin().is_terminal() && io::stdout().is_terminal() && !config::exists() => {
@@ -78,6 +79,7 @@ async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
     match command {
         Command::Init(args) => init(profile_arg.unwrap_or("default"), args, out).await,
         Command::Auth { command } => auth_command(profile_arg, command, out).await,
+        Command::Profile { command } => profile_command(command, yes, out),
         Command::Config { command } => config_command(profile_arg, command, out),
         Command::Whoami => {
             let client = client(profile_arg).await?;
@@ -154,7 +156,7 @@ async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
             })
         }
         Command::Tui(args) => tui_command(profile_arg, args).await,
-        Command::Doctor => doctor(profile_arg, out).await,
+        Command::Doctor { offline } => doctor(profile_arg, offline, out).await,
         Command::Capabilities => capabilities(out),
         Command::Schema { command } => {
             let value = schema::generate(command.as_deref());
@@ -307,7 +309,7 @@ async fn auth_command(
             let value = serde_json::json!({"profile":name,"signed_in":false});
             out.value(&value, || format!("Signed out profile '{name}'."))
         }
-        AuthCommand::Status => {
+        AuthCommand::Status { offline } => {
             let configured = config::configured_profile(profile_arg);
             let name = configured
                 .as_ref()
@@ -316,7 +318,12 @@ async fn auth_command(
             let signed_in = auth::has_token(name);
             let scopes = auth::granted_scopes(name);
             let channel_history = auth::channel_history_granted(name);
-            let value = serde_json::json!({"profile":name,"configured":configured.is_some(),"signed_in":signed_in,"config_path":config::path(),"read_only":configured.as_ref().is_some_and(|(_, profile)| profile.read_only),"granted_scopes":scopes,"channel_history":channel_history});
+            let identity = if !offline && configured.is_some() && signed_in {
+                Some(client(Some(name)).await?.me().await?)
+            } else {
+                None
+            };
+            let value = serde_json::json!({"profile":name,"configured":configured.is_some(),"signed_in":signed_in,"verified":identity.is_some(),"identity":identity,"config_path":config::path(),"read_only":configured.as_ref().is_some_and(|(_, profile)| profile.read_only),"granted_scopes":scopes,"channel_history":channel_history});
             out.value(&value, || {
                 format!(
                     "Profile: {name}\nConfigured: {}\nSigned in: {}\nRead only: {}\nChannel history: {}\nConfig: {}",
@@ -331,6 +338,59 @@ async fn auth_command(
     }
 }
 
+fn profile_command(command: ProfileCommand, yes: bool, out: Output) -> Result<(), AppError> {
+    match command {
+        ProfileCommand::List => {
+            let profiles = config::profile_summaries()?;
+            out.value(
+                &serde_json::json!({"items": profiles, "total": profiles.len()}),
+                || {
+                    if profiles.is_empty() {
+                        "No profiles configured. Run `teams init`.".into()
+                    } else {
+                        profiles
+                            .iter()
+                            .map(|profile| {
+                                format!(
+                                    "{} {}  {}",
+                                    if profile.active { "*" } else { " " },
+                                    profile.name,
+                                    profile.tenant
+                                )
+                            })
+                            .collect::<Vec<_>>()
+                            .join("\n")
+                    }
+                },
+            )
+        }
+        ProfileCommand::Use { name } => {
+            config::use_profile(&name)?;
+            out.value(
+                &serde_json::json!({"profile": name, "active": true}),
+                || format!("Active profile set to '{name}'."),
+            )
+        }
+        ProfileCommand::Remove { name } => {
+            if !yes {
+                return Err(AppError::InvalidInput(
+                    "profile removal requires --yes".into(),
+                ));
+            }
+            auth::logout(&name)?;
+            if !config::remove_profile(&name)? {
+                return Err(AppError::InvalidInput(format!(
+                    "profile '{name}' is not configured"
+                )));
+            }
+            out.value(
+                &serde_json::json!({"profile": name, "removed": true}),
+                || format!("Removed profile '{name}'."),
+            )
+        }
+    }
+}
+
 async fn client(profile_arg: Option<&str>) -> Result<GraphClient, AppError> {
     let (name, profile) = config::load(profile_arg)?;
     let token = auth::access_token(&name, &profile).await?;
@@ -393,6 +453,59 @@ async fn tui_command(profile_arg: Option<&str>, args: TuiArgs) -> Result<(), App
     if args.demo {
         return tui::run(tui::demo_data());
     }
+    let profile_name = config::selected_profile_name(profile_arg)?;
+    let mut reason_override = None;
+    loop {
+        match load_tui_data(profile_arg).await {
+            Ok(data) => return tui::run(data),
+            Err(error) if tui_auth_recoverable(&error) => {
+                let configured = config::configured_profile(profile_arg).is_some();
+                let reason = reason_override
+                    .take()
+                    .unwrap_or_else(|| tui_connection_reason(&error));
+                if tui::request_authentication(&profile_name, configured, &reason)?
+                    == tui::TuiExit::Quit
+                {
+                    return Ok(());
+                }
+
+                let auth_output = Output {
+                    format: OutputFormat::Text,
+                    quiet: false,
+                };
+                let result = if configured {
+                    let (_, profile) = config::load(profile_arg)?;
+                    auth::login(&profile_name, &profile, false, false, &auth_output)
+                        .await
+                        .map(|_| ())
+                } else {
+                    init(
+                        &profile_name,
+                        InitArgs {
+                            client_id: None,
+                            tenant: config::DEFAULT_TENANT.into(),
+                            no_login: false,
+                            device_code: false,
+                            channel_history: false,
+                            read_only: false,
+                        },
+                        auth_output,
+                    )
+                    .await
+                };
+                if let Err(error) = result {
+                    reason_override = Some(format!(
+                        "Sign-in did not complete: {} You can try again.",
+                        concise_error(&error)
+                    ));
+                }
+            }
+            Err(error) => return Err(error),
+        }
+    }
+}
+
+async fn load_tui_data(profile_arg: Option<&str>) -> Result<tui::TuiData, AppError> {
     let graph = client(profile_arg).await?;
     let me = graph.me().await?;
     let teams = graph.teams(50, 0).await?;
@@ -416,7 +529,7 @@ async fn tui_command(profile_arg: Option<&str>, args: TuiArgs) -> Result<(), App
             messages: vec![],
         });
     }
-    tui::run(tui::TuiData {
+    Ok(tui::TuiData {
         account: string_at(&me, "/displayName")
             .unwrap_or("Microsoft 365")
             .into(),
@@ -424,6 +537,63 @@ async fn tui_command(profile_arg: Option<&str>, args: TuiArgs) -> Result<(), App
     })
 }
 
+fn tui_auth_recoverable(error: &AppError) -> bool {
+    matches!(error, AppError::Auth(_))
+        || matches!(error, AppError::InvalidInput(message) if message.contains("is not configured"))
+}
+
+fn tui_connection_reason(error: &AppError) -> String {
+    match error {
+        AppError::InvalidInput(message) if message.contains("is not configured") => {
+            "This profile has not been connected yet.".into()
+        }
+        AppError::Auth(message)
+            if message.contains("not signed in") || message.contains("unreadable") =>
+        {
+            "This profile does not have a usable Microsoft sign-in yet.".into()
+        }
+        AppError::Auth(message) if message.contains("expired") => {
+            "Your saved Microsoft session has expired.".into()
+        }
+        _ => "Microsoft rejected the current session.".into(),
+    }
+}
+
+fn concise_error(error: &AppError) -> String {
+    error.to_string().trim_end_matches('.').to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tui_recovers_configuration_and_authentication_only() {
+        assert!(tui_auth_recoverable(&AppError::InvalidInput(
+            "profile 'work' is not configured; run `teams init`".into()
+        )));
+        assert!(tui_auth_recoverable(&AppError::Auth(
+            "session expired".into()
+        )));
+        assert!(!tui_auth_recoverable(&AppError::InvalidInput(
+            "invalid field selection".into()
+        )));
+        assert!(!tui_auth_recoverable(&AppError::RateLimit(None)));
+    }
+
+    #[test]
+    fn tui_connection_copy_is_actionable_without_shell_instructions() {
+        let reason = tui_connection_reason(&AppError::Auth(
+            "not signed in; run `teams auth login`".into(),
+        ));
+        assert_eq!(
+            reason,
+            "This profile does not have a usable Microsoft sign-in yet."
+        );
+        assert!(!reason.contains("teams auth login"));
+    }
+}
+
 #[derive(Serialize)]
 struct Check {
     name: &'static str,
@@ -431,7 +601,7 @@ struct Check {
     detail: String,
 }
 
-async fn doctor(profile_arg: Option<&str>, out: Output) -> Result<(), AppError> {
+async fn doctor(profile_arg: Option<&str>, offline: bool, out: Output) -> Result<(), AppError> {
     let mut checks = Vec::new();
     let configured = config::configured_profile(profile_arg);
     checks.push(Check {
@@ -483,7 +653,7 @@ async fn doctor(profile_arg: Option<&str>, out: Output) -> Result<(), AppError>
     });
     let mut identity_ok = false;
     let mut teams_ok = false;
-    let (identity_detail, teams_detail) = if configured.is_some() && signed_in {
+    let (identity_detail, teams_detail) = if !offline && configured.is_some() && signed_in {
         match client(profile_arg).await {
             Ok(client) => {
                 let identity_detail = match client.me().await {
@@ -513,21 +683,38 @@ async fn doctor(profile_arg: Option<&str>, out: Output) -> Result<(), AppError>
             }
         }
     } else {
-        let detail = "skipped until setup is complete".to_string();
+        let detail = if offline {
+            "network check skipped"
+        } else {
+            "skipped until setup is complete"
+        }
+        .to_string();
         (detail.clone(), detail)
     };
     checks.push(Check {
         name: "microsoft_identity",
-        status: if identity_ok { "pass" } else { "fail" },
+        status: if offline {
+            "skip"
+        } else if identity_ok {
+            "pass"
+        } else {
+            "fail"
+        },
         detail: identity_detail,
     });
     checks.push(Check {
         name: "microsoft_teams",
-        status: if teams_ok { "pass" } else { "fail" },
+        status: if offline {
+            "skip"
+        } else if teams_ok {
+            "pass"
+        } else {
+            "fail"
+        },
         detail: teams_detail,
     });
     let healthy = checks.iter().all(|check| check.status != "fail");
-    let value = serde_json::json!({"checks":checks,"healthy":healthy});
+    let value = serde_json::json!({"checks":checks,"healthy":healthy,"offline":offline});
     out.value(&value, || {
         checks
             .iter()

{teams_cli-0.1.4 → teams_cli-0.1.6}/src/schema.rs

@@ -130,20 +130,57 @@ pub fn generate(command_filter: Option<&str>) -> Value {
             "idempotent",
             vec![field("profile", "string"), field("signed_in", "boolean")],
         ),
+        {
+            let mut value = single(
+                "auth status",
+                "Verify authentication and inspect credential state",
+                "read_only",
+                vec![
+                    field("profile", "string"),
+                    field("configured", "boolean"),
+                    field("signed_in", "boolean"),
+                    field("verified", "boolean"),
+                    nullable_field("identity", "object"),
+                    field("config_path", "string"),
+                    field("read_only", "boolean"),
+                    nullable_array_field("granted_scopes", "string"),
+                    nullable_field("channel_history", "boolean"),
+                ],
+            );
+            value["args"] = json!([arg(
+                "--offline",
+                "boolean",
+                "Inspect local credential state without contacting Microsoft Graph"
+            )]);
+            value
+        },
         single(
-            "auth status",
-            "Inspect local configuration and credential presence without network access",
+            "profile list",
+            "List configured profiles and identify the active one",
             "read_only",
-            vec![
-                field("profile", "string"),
-                field("configured", "boolean"),
-                field("signed_in", "boolean"),
-                field("config_path", "string"),
-                field("read_only", "boolean"),
-                nullable_array_field("granted_scopes", "string"),
-                nullable_field("channel_history", "boolean"),
-            ],
+            vec![array_field("items", "object"), field("total", "integer")],
         ),
+        {
+            let mut value = single(
+                "profile use",
+                "Select the default profile for future commands",
+                "idempotent",
+                vec![field("profile", "string"), field("active", "boolean")],
+            );
+            value["args"] = json!([required_arg("name", "string", "Profile name")]);
+            value
+        },
+        {
+            let mut value = single(
+                "profile remove",
+                "Remove a profile and its stored credential",
+                "idempotent",
+                vec![field("profile", "string"), field("removed", "boolean")],
+            );
+            value["args"] = json!([required_arg("name", "string", "Profile name")]);
+            value["confirmation_bypass_arg"] = json!("--yes");
+            value
+        },
         single(
             "config show",
             "Print the resolved profile without credentials",
@@ -246,12 +283,20 @@ pub fn generate(command_filter: Option<&str>) -> Value {
             value
         },
         json!({"name":"tui", "description":"Open the keyboard-first terminal interface", "effects":"read_only", "output_kind":"opaque", "media_type":"text/plain", "requires_tty":true, "args":[arg("--demo", "boolean", "Use deterministic sample data"), arg("--snapshot", "boolean", "Print one ANSI-free demo frame")]}),
-        single(
-            "doctor",
-            "Check configuration, credential storage, Microsoft identity, and Teams provisioning",
-            "read_only",
-            vec![array_field("checks", "object"), field("healthy", "boolean")],
-        ),
+        {
+            let mut value = single(
+                "doctor",
+                "Check configuration, credential storage, Microsoft identity, and Teams provisioning",
+                "read_only",
+                vec![array_field("checks", "object"), field("healthy", "boolean")],
+            );
+            value["args"] = json!([arg(
+                "--offline",
+                "boolean",
+                "Check local state without contacting Microsoft Graph"
+            )]);
+            value
+        },
         single(
             "capabilities",
             "Describe supported and deliberately unsupported capabilities",
@@ -287,7 +332,8 @@ pub fn generate(command_filter: Option<&str>) -> Value {
         "global_args": [
             {"name":"--output", "short":"-o", "type":"string", "enum":["auto","text","json"], "default":"auto", "description":"Output format"},
             {"name":"--profile", "type":"string", "description":"Configuration profile"},
-            {"name":"--quiet", "type":"boolean", "description":"Suppress informational stderr output"}
+            {"name":"--quiet", "type":"boolean", "description":"Suppress informational stderr output"},
+            {"name":"--yes", "short":"-y", "type":"boolean", "description":"Skip confirmation prompts for destructive operations"}
         ],
         "commands": commands,
         "errors": error::ALL.iter().map(|e| json!({"kind":e.kind,"exit_code":e.exit_code,"retryable":e.retryable,"description":e.description})).collect::<Vec<_>>(),

{teams_cli-0.1.4 → teams_cli-0.1.6}/src/tui.rs

@@ -1,7 +1,7 @@
 use std::io::{self, IsTerminal};
 use std::time::Duration;
 
-use crossterm::event::{self, Event, KeyCode, KeyEventKind};
+use crossterm::event::{self, Event, KeyCode, KeyEventKind, KeyModifiers};
 use crossterm::execute;
 use crossterm::terminal::{
     EnterAlternateScreen, LeaveAlternateScreen, disable_raw_mode, enable_raw_mode,
@@ -21,6 +21,32 @@ const FOCUS: Color = Color::Rgb(102, 194, 255);
 const LIVE: Color = Color::Rgb(255, 119, 107);
 const SURFACE: Color = Color::Rgb(20, 23, 30);
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum TuiExit {
+    Quit,
+    Authenticate,
+}
+
+struct TerminalGuard;
+
+impl TerminalGuard {
+    fn enter() -> Result<Self, AppError> {
+        enable_raw_mode()?;
+        if let Err(error) = execute!(io::stdout(), EnterAlternateScreen) {
+            let _ = disable_raw_mode();
+            return Err(error.into());
+        }
+        Ok(Self)
+    }
+}
+
+impl Drop for TerminalGuard {
+    fn drop(&mut self) {
+        let _ = disable_raw_mode();
+        let _ = execute!(io::stdout(), LeaveAlternateScreen);
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct TuiData {
     pub account: String,
@@ -119,17 +145,46 @@ pub fn snapshot(width: u16, height: u16) -> Result<String, AppError> {
     Ok(output)
 }
 
+pub fn connection_snapshot(
+    width: u16,
+    height: u16,
+    profile: &str,
+    configured: bool,
+    reason: &str,
+) -> Result<String, AppError> {
+    let backend = TestBackend::new(width.max(48), height.max(18));
+    let mut terminal = Terminal::new(backend).expect("test backend is infallible");
+    terminal
+        .draw(|frame| draw_connection(frame, profile, configured, reason))
+        .expect("test backend is infallible");
+    Ok(buffer_text(terminal.backend().buffer()))
+}
+
+fn buffer_text(buffer: &ratatui::buffer::Buffer) -> String {
+    let mut output = String::new();
+    for y in 0..buffer.area.height {
+        let mut line = String::new();
+        for x in 0..buffer.area.width {
+            line.push_str(buffer[(x, y)].symbol());
+        }
+        output.push_str(line.trim_end());
+        output.push('\n');
+    }
+    while output.ends_with("\n\n") {
+        output.pop();
+    }
+    output
+}
+
 pub fn run(data: TuiData) -> Result<(), AppError> {
     if !io::stdout().is_terminal() || !io::stdin().is_terminal() {
         return Err(AppError::NonInteractive("`teams tui` needs a terminal; use `teams tui --demo --snapshot` for an inspectable frame".into()));
     }
-    enable_raw_mode()?;
-    let mut stdout = io::stdout();
-    execute!(stdout, EnterAlternateScreen)?;
-    let backend = CrosstermBackend::new(stdout);
+    let _terminal_guard = TerminalGuard::enter()?;
+    let backend = CrosstermBackend::new(io::stdout());
     let mut terminal = Terminal::new(backend)?;
     let mut app = App { data, selected: 0 };
-    let result = (|| -> Result<(), AppError> {
+    (|| -> Result<(), AppError> {
         loop {
             terminal.draw(|frame| draw(frame, &app))?;
             if event::poll(Duration::from_millis(150))?
@@ -140,6 +195,7 @@ pub fn run(data: TuiData) -> Result<(), AppError> {
                 }
                 match key.code {
                     KeyCode::Char('q') | KeyCode::Esc => break,
+                    KeyCode::Char('c') if key.modifiers.contains(KeyModifiers::CONTROL) => break,
                     KeyCode::Down | KeyCode::Char('j') => {
                         app.selected =
                             (app.selected + 1).min(app.data.conversations.len().saturating_sub(1))
@@ -152,14 +208,111 @@ pub fn run(data: TuiData) -> Result<(), AppError> {
             }
         }
         Ok(())
-    })();
-    let cleanup = (|| -> Result<(), AppError> {
-        disable_raw_mode()?;
-        execute!(terminal.backend_mut(), LeaveAlternateScreen)?;
-        terminal.show_cursor()?;
-        Ok(())
-    })();
-    result.and(cleanup)
+    })()
+}
+
+/// Present an actionable connection state inside the same terminal experience.
+/// Returning first restores the alternate screen before the caller opens a
+/// browser or prints device-code instructions.
+pub fn request_authentication(
+    profile: &str,
+    configured: bool,
+    reason: &str,
+) -> Result<TuiExit, AppError> {
+    if !io::stdout().is_terminal() || !io::stdin().is_terminal() {
+        return Err(AppError::NonInteractive(
+            "`teams tui` needs a terminal; run `teams auth login --device-code` for headless sign-in"
+                .into(),
+        ));
+    }
+    let _terminal_guard = TerminalGuard::enter()?;
+    let backend = CrosstermBackend::new(io::stdout());
+    let mut terminal = Terminal::new(backend)?;
+    loop {
+        terminal.draw(|frame| draw_connection(frame, profile, configured, reason))?;
+        if event::poll(Duration::from_millis(150))?
+            && let Event::Key(key) = event::read()?
+        {
+            if key.kind != KeyEventKind::Press {
+                continue;
+            }
+            match key.code {
+                KeyCode::Enter | KeyCode::Char('a') => return Ok(TuiExit::Authenticate),
+                KeyCode::Char('q') | KeyCode::Esc => return Ok(TuiExit::Quit),
+                KeyCode::Char('c') if key.modifiers.contains(KeyModifiers::CONTROL) => {
+                    return Ok(TuiExit::Quit);
+                }
+                _ => {}
+            }
+        }
+    }
+}
+
+fn draw_connection(frame: &mut ratatui::Frame, profile: &str, configured: bool, reason: &str) {
+    let area = frame.area();
+    frame.render_widget(Block::default().style(Style::default().bg(SURFACE)), area);
+    let panel_width = area.width.saturating_sub(2).clamp(1, 74);
+    let panel_height = area.height.saturating_sub(2).clamp(1, 12);
+    let panel = Rect {
+        x: area.x + area.width.saturating_sub(panel_width) / 2,
+        y: area.y + area.height.saturating_sub(panel_height) / 2,
+        width: panel_width,
+        height: panel_height,
+    };
+    let title = if configured {
+        " SIGN-IN REQUIRED "
+    } else {
+        " CONNECT MICROSOFT TEAMS "
+    };
+    let action = if configured {
+        "Continue with Microsoft sign-in. Your password is never shared with teams-cli."
+    } else {
+        "Set up this profile and continue with secure Microsoft sign-in."
+    };
+    let content = vec![
+        Line::styled(
+            if configured {
+                "Your Teams session needs attention"
+            } else {
+                "Bring your Teams workspace into focus"
+            },
+            Style::default().fg(INK).add_modifier(Modifier::BOLD),
+        ),
+        Line::styled(format!("Profile: {profile}"), Style::default().fg(MUTED)),
+        Line::raw(""),
+        Line::styled(reason, Style::default().fg(INK)),
+        Line::styled(action, Style::default().fg(MUTED)),
+        Line::raw(""),
+        Line::from(vec![
+            Span::styled(
+                " enter / a ",
+                Style::default()
+                    .fg(Color::Black)
+                    .bg(FOCUS)
+                    .add_modifier(Modifier::BOLD),
+            ),
+            Span::styled(
+                if configured {
+                    " sign in   "
+                } else {
+                    " set up   "
+                },
+                Style::default().fg(MUTED),
+            ),
+            Span::styled("q", Style::default().fg(INK)),
+            Span::styled(" quit", Style::default().fg(MUTED)),
+        ]),
+    ];
+    frame.render_widget(
+        Paragraph::new(content).wrap(Wrap { trim: true }).block(
+            Block::default()
+                .title(title)
+                .borders(Borders::ALL)
+                .border_style(Style::default().fg(FOCUS))
+                .padding(ratatui::widgets::Padding::horizontal(2)),
+        ),
+        panel,
+    );
 }
 
 fn draw(frame: &mut ratatui::Frame, app: &App) {
@@ -312,4 +465,16 @@ mod tests {
         assert!(frame.contains("release candidate is green"));
         assert!(frame.contains("q quit"));
     }
+
+    #[test]
+    fn connection_snapshot_has_a_clear_recovery_action() {
+        let frame =
+            super::connection_snapshot(80, 22, "work", true, "Your saved session has expired.")
+                .unwrap();
+        assert!(frame.contains("SIGN-IN REQUIRED"));
+        assert!(frame.contains("Profile: work"));
+        assert!(frame.contains("enter / a"));
+        assert!(frame.contains("sign in"));
+        assert!(frame.contains("q quit"));
+    }
 }

{teams_cli-0.1.4 → teams_cli-0.1.6}/tests/cli.rs

@@ -142,6 +142,58 @@ fn init_can_create_a_read_only_profile_and_config_show_resolves_it() {
         .stdout(predicate::str::contains("\"read_only\": true"));
 }
 
+#[test]
+fn profile_lifecycle_and_offline_auth_status_are_local() {
+    let temp = tempfile::tempdir().unwrap();
+    for name in ["work", "sandbox"] {
+        Command::cargo_bin("teams")
+            .unwrap()
+            .env("XDG_CONFIG_HOME", temp.path())
+            .args(["--profile", name, "init", "--no-login"])
+            .assert()
+            .success();
+    }
+
+    Command::cargo_bin("teams")
+        .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
+        .args(["profile", "use", "work"])
+        .assert()
+        .success();
+
+    let list = Command::cargo_bin("teams")
+        .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
+        .args(["--output", "json", "profile", "list"])
+        .output()
+        .unwrap();
+    assert!(list.status.success());
+    let value: Value = serde_json::from_slice(&list.stdout).unwrap();
+    assert_eq!(value["total"], 2);
+    assert!(
+        value["items"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|profile| { profile["name"] == "work" && profile["active"] == true })
+    );
+
+    Command::cargo_bin("teams")
+        .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
+        .args(["auth", "status", "--offline"])
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("\"verified\": false"));
+
+    Command::cargo_bin("teams")
+        .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
+        .args(["profile", "remove", "sandbox", "--yes"])
+        .assert()
+        .success();
+}
+
 #[test]
 fn suite_exit_codes_and_error_kinds_are_stable() {
     let schema: Value = serde_json::from_slice(

teams_cli-0.1.4/.github/dependabot.yml

@@ -1,6 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly