# Pattern: PTY-Required Device Code Authentication

## Symptom
A web app or automation script shells out to a CLI tool (e.g., PowerShell `Connect-MgGraph -UseDeviceAuthentication`) and hangs. The user never sees the device code or authentication URL needed to complete login. The process appears to do nothing.

## Affected Projects
- Intune Inspector (PowerShell + Microsoft Graph device code auth)
- Microsoft 365 Admin Toolkit (PowerShell + Microsoft Graph)

## Root Cause
Some CLI commands write authentication prompts to the console host rather than stdout. When run via `subprocess.Popen` or equivalent without a pseudo-terminal (PTY), that output is not captured or displayed, so the user cannot complete the interactive step.

## Standard Fix
1. Use a PTY-enabled subprocess library (`pexpect` in Python, `node-pty` in Node.js) so the spawned process believes it has a real terminal.
2. Capture and surface console-host output to the user in real time (device code, URL, instructions).
3. Poll for completion if the process is long-running.
4. Document that this is a workaround for interactive CLI flows that cannot be fully non-interactive.

## When to Apply
- Any integration that spawns a command-line tool requiring interactive authentication.
- Microsoft Graph device-code flows, Azure CLI login prompts, OAuth CLI helpers, or similar tools.

## Verification
- Running the script standalone in a real terminal produces a device code/URL.
- The app captures and displays the same code/URL via PTY.
- Authentication completes and the downstream operation succeeds.

## Related Patterns
- None yet.