teams-cli 0.2.1__tar.gz → 0.2.3__tar.gz

{teams_cli-0.2.1 → teams_cli-0.2.3}/.github/workflows/ci.yml

@@ -24,6 +24,16 @@ jobs:
           components: rustfmt, clippy
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: cargo test --locked --all-targets
+      - name: Verify pass and GPG credential encryption
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends pass
+          bash tests/pass_credentials.sh
+      - name: Verify WSL credential encryption
+        if: runner.os == 'Windows'
+        shell: powershell
+        run: ./tests/wsl_credentials.test.ps1
 
   quality:
     name: Formatting and lints

{teams_cli-0.2.1 → teams_cli-0.2.3}/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.3](https://github.com/rvben/teams-cli/compare/v0.2.2...v0.2.3) - 2026-10-16
+
+### Fixed
+
+- Close extension-managed browser sessions after the last client exits, including crashes and editor reloads, while retaining saved sign-in and browsers started independently.
+- Track shared clients and active CLI reads before shutdown. Recover interrupted cleanup and stop individually verified browser helpers, including hung processes, without signalling unrelated applications.
+
+## [0.2.2](https://github.com/rvben/teams-cli/compare/v0.2.1...v0.2.2) - 2026-10-15
+
+### Added
+
+- Guided `teams init` asks for Work/school or Personal, chooses a separate browser port, offers explicit send permission, and opens the inbox after verified sign-in.
+- Browser setup can opt in to reopening its saved session with `teams`; existing profiles, native Teams and scripted reads keep their connection behaviour. Explicit setup supports `--auto-start`.
+- Offer initialized `pass` stores during new Graph setup on Linux, WSL and macOS, with explicit `--credential-store pass` and `--pass-store-dir` options. Save the backend and absolute directory per profile, verify GPG encryption/decryption before sign-in, and preserve encrypted credentials on failed updates.
+
+### Fixed
+
+- Report credential-helper failures distinctly from missing sign-ins; bound helper operations and preserve the chosen backend across sign-in, refresh and logout.
+- Store WSL Graph credentials with Windows DPAPI through PowerShell, so callback and device-code sign-in, token refresh, and logout do not require D-Bus or Secret Service.
+
+### Changed
+
+- Guided setup offers separate accounts or explicit connection updates, preserves Graph registration and channel-history access, resumes interrupted browser sign-in on the original port, and verifies fresh Graph credentials before saving them with rollback on config failure.
+- Cold work-browser inbox startup checks sign-in renewal in the background; failures pause sending and offer sign-in while preserving drafts. First-run `teams tui` uses guided setup, including headless Graph recovery and environment-override checks.
+- Guided setup checks local browser/display support, Teams installation and Windows interop, and matching lightweight browser downloads before allowing a connection choice. Unavailable options explain their requirements; supported alternatives are selected automatically.
+- Guided Graph setup verifies chat access before saving connection settings. Desktop/browser sending opt-in now requires a send-interface probe; guided setup offers an explicit read-only alternative if it fails, without sending a test message.
+- Reject personal-only lightweight browser/work-school combinations before saving even with `--no-login`.
+
 ## [0.2.1](https://github.com/rvben/teams-cli/compare/v0.2.0...v0.2.1) - 2026-10-15
 
 ### Added

{teams_cli-0.2.1 → teams_cli-0.2.3}/Cargo.lock

@@ -3187,7 +3187,7 @@ dependencies = [
 
 [[package]]
 name = "teams-cli"
-version = "0.2.1"
+version = "0.2.3"
 dependencies = [
  "assert_cmd",
  "base64 0.23.1",

{teams_cli-0.2.1 → teams_cli-0.2.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "teams-cli"
-version = "0.2.1"
+version = "0.2.3"
 edition = "2024"
 rust-version = "1.90"
 description = "A Microsoft Teams CLI and TUI designed equally for humans and agents"

{teams_cli-0.2.1 → teams_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: teams-cli
-Version: 0.2.1
+Version: 0.2.3
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 License-File: LICENSE
@@ -62,23 +62,76 @@ Run `teams` in a terminal on first use, or start explicitly:
 teams init
 ```
 
-`teams-cli` includes a maintained multitenant Microsoft Entra public-client registration, so normal setup does not require creating an app or copying a client ID:
+Choose **Work or school** or **Personal**, choose whether to enable sending, and
+follow sign-in. Setup checks this machine first and gives unavailable connections
+no selectable number, with an explanation of what they need. It chooses a separate
+browser port and opens your inbox once chats are readable. After that, just run:
 
 ```console
-teams init
+teams
 ```
 
-For a personal Microsoft account with the lightweight hidden browser:
+On macOS, Linux and WSL2, work/school setup prefers a dedicated browser; personal
+setup prefers the lightweight browser. Missing display support, missing executables,
+invalid browser overrides and unavailable matching downloads are checked before
+selection. Personal can use a full browser or Teams Desktop when lightweight mode
+is unavailable. Work/school can use Teams Desktop or Microsoft Graph when needed.
+When no lightweight runtime is installed, these checks query public Chrome for
+Testing version metadata at `googlechromelabs.github.io`; no browser download or
+Teams sign-in happens before consent.
+On a Linux terminal without a display, Graph uses device-code sign-in on another device.
+You explicitly approve reopening a dedicated browser
+when you start the inbox. The saved sign-in is reused, and expired work/school
+sign-in offers to reopen the sign-in window. Some organisations require keeping
+the browser visible; minimise it instead of closing it. WSL2 needs WSLg for sign-in.
+On native Windows, browser options are unavailable; use Teams Desktop or run inside
+WSL2 for browser mode.
+
+Guided setup saves connection settings only after a successful chat read, including
+Graph profiles. If sending was requested, desktop/browser setup also probes the
+send interface without sending a message. If that fails, you can explicitly continue
+read-only; setup never silently downgrades your choice. A successful probe establishes
+that the interface is available, while delivery and organisation policies are checked
+when you actually send. Teams build compatibility and sign-in still need live validation.
+
+Running setup again asks whether to connect another account or update an existing
+connection. Updates preserve Graph application/tenant settings and previously granted
+channel-history access. Failed Graph verification preserves the previous credential;
+if saving settings fails, the credential change is rolled back. Browser setup can resume
+an unfinished sign-in on the same port, or start a separate account without touching it.
+Recovery errors include the exact command to close that browser.
+You can forget an unfinished setup after confirmation; its browser data and saved
+sign-in remain on disk, and the old browser's close command is shown. Reusing that
+forgotten browser data requires explicit setup with its original `--desktop-port`.
+Setup offers unfinished connections under other names when you connect another account.
+
+Cold work-browser startup opens the inbox once chats are readable and checks sign-in
+renewal in the background. A sign-out pauses sending and offers sign-in in the inbox.
+Other startup-check failures keep chats readable and pause sending until you reopen
+the inbox to check again. Drafts stay in memory through the sign-in detour.
+Guided Graph setup disables conflicting token or permission environment overrides;
+explicit flags keep their automation behavior.
+
+**Other connection options** keeps Microsoft Graph and the running Teams Desktop
+available. Microsoft Graph includes a maintained Entra public-client registration,
+so normal API setup needs no app registration or copied client ID.
+
+Scripts and explicit connection flags keep their existing behaviour. For example:
 
 ```console
-teams init --profile personal --backend desktop --desktop-client browser-core
+teams init --backend graph
+# Or configure an automatically reopened work browser explicitly:
+teams init --profile work --backend desktop --desktop-client browser \
+  --desktop-account work-school --desktop-port 9224 --auto-start
 ```
 
-This downloads its browsers automatically, opens visible sign-in once, and then
-runs hidden. See [lightweight browser setup](#low-memory-browser-client-experimental)
-for sending, reconnecting, and experimental compatibility limits.
+Browser profiles default to read-only; add `--allow-send` to enable sending.
+Existing profiles retain their connection behaviour unless you opt in with setup
+or `--auto-start`. CLI reads, JSON output, demo mode and snapshots never start a
+browser automatically. See [lightweight browser setup](#low-memory-browser-client-experimental)
+for personal-account compatibility limits.
 
-Browser PKCE is the human-friendly default. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal sign-in requests these delegated scopes:
+For Microsoft Graph profiles, browser PKCE is the default when a local browser is available. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal Graph sign-in requests these delegated scopes:
 
 ```text
 openid profile offline_access User.Read User.ReadBasic.All
@@ -157,6 +210,51 @@ The custom app must be a public client with `http://localhost` registered for br
 
 For short-lived automation, `TEAMS_ACCESS_TOKEN` overrides the stored credential. Refresh credentials are never written to the config file.
 
+Under WSL, Graph credentials use Windows DPAPI encryption for the current Windows
+user through `powershell.exe`; no D-Bus or Linux Secret Service is required. Windows
+executable interop must be enabled. Encrypted files live under
+`%LOCALAPPDATA%\teams-cli\credentials` and are shared by WSL distributions using
+the same Windows account and profile name. Existing WSL Secret Service sign-ins
+require `teams auth login` again after upgrading; their old entries are not migrated
+or removed. Native Linux uses Secret Service by default.
+
+### Using pass for Graph credentials
+
+On Linux, WSL and macOS, interactive Graph setup offers `pass` when it is installed
+and the selected password store has a readable `.gpg-id`. The OS store is recommended
+when available; if it is unavailable, setup recommends the configured pass store.
+Existing profiles keep their saved credential store without prompting again.
+
+To select it explicitly, initialize your GPG password store first, then run:
+
+```console
+pass init GPG_KEY_ID
+teams --profile work-pass init --credential-store pass --device-code
+# To use a different existing store:
+teams --profile other-work init --credential-store pass --pass-store-dir /path/to/password-store --device-code
+```
+
+Before opening Microsoft sign-in for a new pass credential, the CLI checks encryption
+and decryption using synthetic data in a private temporary store. The check leaves
+no probe entries or Git commits in your password store. GPG may ask you to unlock
+your key; configure `gpg-agent` and a suitable pinentry for your terminal or desktop.
+Terminal pinentry may need `export GPG_TTY="$(tty)"`. Helper operations time out after
+60 seconds if unlocking or another operation stalls.
+
+Tokens are passed to `pass` through stdin, and stored under
+`teams-cli/<SHA-256 of profile name>`. The CLI saves `credential_store = "pass"` and
+the absolute `pass_store_dir` in the profile. Changing `PASSWORD_STORE_DIR` later
+will not redirect that profile's credentials. Sign-in, refresh, status and logout
+use the same saved store; failures report the store or GPG problem without falling
+back to another backend. Failed replacements restore the previous encrypted file.
+As usual, pass manages its own local Git history if enabled; logout removes the
+current entry, while older encrypted versions may remain in that history.
+
+Use a new profile name to change credential stores or pass directories. After
+verifying the new connection, sign out the old profile if you no longer need it.
+`--no-login` validates the pass installation and recipient configuration without
+unlocking a key or running the encryption/decryption check.
+
 ## Everyday commands
 
 ```console
@@ -414,7 +512,7 @@ helper route remains the default for native desktop profiles.
 Create a separate read-only profile and sign in in the window that opens:
 
 ```console
-teams init --profile browser --backend desktop --desktop-client browser --desktop-account work-school --yes
+teams init --profile browser --backend desktop --desktop-client browser --desktop-account work-school --auto-start --yes
 # The window closes automatically after a successful chat read.
 # Teams then runs headless with the same saved sign-in:
 teams --profile browser
@@ -446,7 +544,22 @@ profile. Different ports use different browser profiles. Disconnect closes this
 browser and keeps its sign-in data. To switch between visible and headless operation,
 disconnect first. `desktop recover` closes a verified managed browser or clears a
 stale record when no listener remains. A verified browser that does not exit after
-closing its debugging port is stopped; unverifiable processes are left untouched.
+closing its debugging port is stopped. Verified helpers are recorded before shutdown
+and closed individually if they outlive it; unverifiable processes are left untouched.
+
+Standalone CLI browser sessions persist until `desktop disconnect`. Applications can
+instead use `desktop supervise`: keep its stdin pipe open, read its protocol-1 JSON
+handshake, and pass the returned `client` token as `TEAMS_DESKTOP_BROWSER_CLIENT` to
+CLI commands and sign-in terminals. Browsers those commands start close when their
+last application user exits, including after a parent-process crash, with a 15-second
+grace period so a reloaded application can reclaim its session. Existing
+persistent sessions are left running, and in-flight CLI commands finish before
+cleanup. The supervisor must run in its own process group, with its stdin pipe held
+only by the application. Sign-in data is retained. `--keep-alive` opts newly started
+sessions into persistent operation; `TEAMS_DESKTOP_BROWSER_KEEP_ALIVE=1` or `0` can
+override that policy for subsequent launches without restarting the supervisor.
+Explicit `desktop connect` outside supervision makes a shared session persistent.
+Only macOS and Linux support this integration protocol.
 
 The CLI checks that every listener is loopback-only and belongs to the recorded
 browser process, running as you with the expected executable, debugging port and

{teams_cli-0.2.1 → teams_cli-0.2.3}/README.md

@@ -46,23 +46,76 @@ Run `teams` in a terminal on first use, or start explicitly:
 teams init
 ```
 
-`teams-cli` includes a maintained multitenant Microsoft Entra public-client registration, so normal setup does not require creating an app or copying a client ID:
+Choose **Work or school** or **Personal**, choose whether to enable sending, and
+follow sign-in. Setup checks this machine first and gives unavailable connections
+no selectable number, with an explanation of what they need. It chooses a separate
+browser port and opens your inbox once chats are readable. After that, just run:
 
 ```console
-teams init
+teams
 ```
 
-For a personal Microsoft account with the lightweight hidden browser:
+On macOS, Linux and WSL2, work/school setup prefers a dedicated browser; personal
+setup prefers the lightweight browser. Missing display support, missing executables,
+invalid browser overrides and unavailable matching downloads are checked before
+selection. Personal can use a full browser or Teams Desktop when lightweight mode
+is unavailable. Work/school can use Teams Desktop or Microsoft Graph when needed.
+When no lightweight runtime is installed, these checks query public Chrome for
+Testing version metadata at `googlechromelabs.github.io`; no browser download or
+Teams sign-in happens before consent.
+On a Linux terminal without a display, Graph uses device-code sign-in on another device.
+You explicitly approve reopening a dedicated browser
+when you start the inbox. The saved sign-in is reused, and expired work/school
+sign-in offers to reopen the sign-in window. Some organisations require keeping
+the browser visible; minimise it instead of closing it. WSL2 needs WSLg for sign-in.
+On native Windows, browser options are unavailable; use Teams Desktop or run inside
+WSL2 for browser mode.
+
+Guided setup saves connection settings only after a successful chat read, including
+Graph profiles. If sending was requested, desktop/browser setup also probes the
+send interface without sending a message. If that fails, you can explicitly continue
+read-only; setup never silently downgrades your choice. A successful probe establishes
+that the interface is available, while delivery and organisation policies are checked
+when you actually send. Teams build compatibility and sign-in still need live validation.
+
+Running setup again asks whether to connect another account or update an existing
+connection. Updates preserve Graph application/tenant settings and previously granted
+channel-history access. Failed Graph verification preserves the previous credential;
+if saving settings fails, the credential change is rolled back. Browser setup can resume
+an unfinished sign-in on the same port, or start a separate account without touching it.
+Recovery errors include the exact command to close that browser.
+You can forget an unfinished setup after confirmation; its browser data and saved
+sign-in remain on disk, and the old browser's close command is shown. Reusing that
+forgotten browser data requires explicit setup with its original `--desktop-port`.
+Setup offers unfinished connections under other names when you connect another account.
+
+Cold work-browser startup opens the inbox once chats are readable and checks sign-in
+renewal in the background. A sign-out pauses sending and offers sign-in in the inbox.
+Other startup-check failures keep chats readable and pause sending until you reopen
+the inbox to check again. Drafts stay in memory through the sign-in detour.
+Guided Graph setup disables conflicting token or permission environment overrides;
+explicit flags keep their automation behavior.
+
+**Other connection options** keeps Microsoft Graph and the running Teams Desktop
+available. Microsoft Graph includes a maintained Entra public-client registration,
+so normal API setup needs no app registration or copied client ID.
+
+Scripts and explicit connection flags keep their existing behaviour. For example:
 
 ```console
-teams init --profile personal --backend desktop --desktop-client browser-core
+teams init --backend graph
+# Or configure an automatically reopened work browser explicitly:
+teams init --profile work --backend desktop --desktop-client browser \
+  --desktop-account work-school --desktop-port 9224 --auto-start
 ```
 
-This downloads its browsers automatically, opens visible sign-in once, and then
-runs hidden. See [lightweight browser setup](#low-memory-browser-client-experimental)
-for sending, reconnecting, and experimental compatibility limits.
+Browser profiles default to read-only; add `--allow-send` to enable sending.
+Existing profiles retain their connection behaviour unless you opt in with setup
+or `--auto-start`. CLI reads, JSON output, demo mode and snapshots never start a
+browser automatically. See [lightweight browser setup](#low-memory-browser-client-experimental)
+for personal-account compatibility limits.
 
-Browser PKCE is the human-friendly default. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal sign-in requests these delegated scopes:
+For Microsoft Graph profiles, browser PKCE is the default when a local browser is available. The browser talks directly to Microsoft, and the CLI never receives or stores your password. Normal Graph sign-in requests these delegated scopes:
 
 ```text
 openid profile offline_access User.Read User.ReadBasic.All
@@ -141,6 +194,51 @@ The custom app must be a public client with `http://localhost` registered for br
 
 For short-lived automation, `TEAMS_ACCESS_TOKEN` overrides the stored credential. Refresh credentials are never written to the config file.
 
+Under WSL, Graph credentials use Windows DPAPI encryption for the current Windows
+user through `powershell.exe`; no D-Bus or Linux Secret Service is required. Windows
+executable interop must be enabled. Encrypted files live under
+`%LOCALAPPDATA%\teams-cli\credentials` and are shared by WSL distributions using
+the same Windows account and profile name. Existing WSL Secret Service sign-ins
+require `teams auth login` again after upgrading; their old entries are not migrated
+or removed. Native Linux uses Secret Service by default.
+
+### Using pass for Graph credentials
+
+On Linux, WSL and macOS, interactive Graph setup offers `pass` when it is installed
+and the selected password store has a readable `.gpg-id`. The OS store is recommended
+when available; if it is unavailable, setup recommends the configured pass store.
+Existing profiles keep their saved credential store without prompting again.
+
+To select it explicitly, initialize your GPG password store first, then run:
+
+```console
+pass init GPG_KEY_ID
+teams --profile work-pass init --credential-store pass --device-code
+# To use a different existing store:
+teams --profile other-work init --credential-store pass --pass-store-dir /path/to/password-store --device-code
+```
+
+Before opening Microsoft sign-in for a new pass credential, the CLI checks encryption
+and decryption using synthetic data in a private temporary store. The check leaves
+no probe entries or Git commits in your password store. GPG may ask you to unlock
+your key; configure `gpg-agent` and a suitable pinentry for your terminal or desktop.
+Terminal pinentry may need `export GPG_TTY="$(tty)"`. Helper operations time out after
+60 seconds if unlocking or another operation stalls.
+
+Tokens are passed to `pass` through stdin, and stored under
+`teams-cli/<SHA-256 of profile name>`. The CLI saves `credential_store = "pass"` and
+the absolute `pass_store_dir` in the profile. Changing `PASSWORD_STORE_DIR` later
+will not redirect that profile's credentials. Sign-in, refresh, status and logout
+use the same saved store; failures report the store or GPG problem without falling
+back to another backend. Failed replacements restore the previous encrypted file.
+As usual, pass manages its own local Git history if enabled; logout removes the
+current entry, while older encrypted versions may remain in that history.
+
+Use a new profile name to change credential stores or pass directories. After
+verifying the new connection, sign out the old profile if you no longer need it.
+`--no-login` validates the pass installation and recipient configuration without
+unlocking a key or running the encryption/decryption check.
+
 ## Everyday commands
 
 ```console
@@ -398,7 +496,7 @@ helper route remains the default for native desktop profiles.
 Create a separate read-only profile and sign in in the window that opens:
 
 ```console
-teams init --profile browser --backend desktop --desktop-client browser --desktop-account work-school --yes
+teams init --profile browser --backend desktop --desktop-client browser --desktop-account work-school --auto-start --yes
 # The window closes automatically after a successful chat read.
 # Teams then runs headless with the same saved sign-in:
 teams --profile browser
@@ -430,7 +528,22 @@ profile. Different ports use different browser profiles. Disconnect closes this
 browser and keeps its sign-in data. To switch between visible and headless operation,
 disconnect first. `desktop recover` closes a verified managed browser or clears a
 stale record when no listener remains. A verified browser that does not exit after
-closing its debugging port is stopped; unverifiable processes are left untouched.
+closing its debugging port is stopped. Verified helpers are recorded before shutdown
+and closed individually if they outlive it; unverifiable processes are left untouched.
+
+Standalone CLI browser sessions persist until `desktop disconnect`. Applications can
+instead use `desktop supervise`: keep its stdin pipe open, read its protocol-1 JSON
+handshake, and pass the returned `client` token as `TEAMS_DESKTOP_BROWSER_CLIENT` to
+CLI commands and sign-in terminals. Browsers those commands start close when their
+last application user exits, including after a parent-process crash, with a 15-second
+grace period so a reloaded application can reclaim its session. Existing
+persistent sessions are left running, and in-flight CLI commands finish before
+cleanup. The supervisor must run in its own process group, with its stdin pipe held
+only by the application. Sign-in data is retained. `--keep-alive` opts newly started
+sessions into persistent operation; `TEAMS_DESKTOP_BROWSER_KEEP_ALIVE=1` or `0` can
+override that policy for subsequent launches without restarting the supervisor.
+Explicit `desktop connect` outside supervision makes a shared session persistent.
+Only macOS and Linux support this integration protocol.
 
 The CLI checks that every listener is loopback-only and belongs to the recorded
 browser process, running as you with the expected executable, debugging port and