JC Beasley
0bd719ab91
- Create patterns/ directory with README, manifest, and 10 initial patterns covering Ollama JSON fallback, API escaping, deprecation, PTY auth, queue-poll, LLM-as-parser, credential rotation, reverse proxy binding, human approval gates, and transient retry. - Wire pattern loading into architecture/pipeline.js based on task tags. - Update architecture/orchestrator.js to load patterns and surface them in the system prompt. - Update MEMORY.md, ARCHITECTURE.md, and CONTEXT.md to document the registry and record the decision.
30 lines
1.6 KiB
Markdown
30 lines
1.6 KiB
Markdown
# Pattern: PTY-Required Device Code Authentication
|
|
|
|
## Symptom
|
|
A web app or automation script shells out to a CLI tool (e.g., PowerShell `Connect-MgGraph -UseDeviceAuthentication`) and hangs. The user never sees the device code or authentication URL needed to complete login. The process appears to do nothing.
|
|
|
|
## Affected Projects
|
|
- Intune Inspector (PowerShell + Microsoft Graph device code auth)
|
|
- Microsoft 365 Admin Toolkit (PowerShell + Microsoft Graph)
|
|
|
|
## Root Cause
|
|
Some CLI commands write authentication prompts to the console host rather than stdout. When run via `subprocess.Popen` or equivalent without a pseudo-terminal (PTY), that output is not captured or displayed, so the user cannot complete the interactive step.
|
|
|
|
## Standard Fix
|
|
1. Use a PTY-enabled subprocess library (`pexpect` in Python, `node-pty` in Node.js) so the spawned process believes it has a real terminal.
|
|
2. Capture and surface console-host output to the user in real time (device code, URL, instructions).
|
|
3. Poll for completion if the process is long-running.
|
|
4. Document that this is a workaround for interactive CLI flows that cannot be fully non-interactive.
|
|
|
|
## When to Apply
|
|
- Any integration that spawns a command-line tool requiring interactive authentication.
|
|
- Microsoft Graph device-code flows, Azure CLI login prompts, OAuth CLI helpers, or similar tools.
|
|
|
|
## Verification
|
|
- Running the script standalone in a real terminal produces a device code/URL.
|
|
- The app captures and displays the same code/URL via PTY.
|
|
- Authentication completes and the downstream operation succeeds.
|
|
|
|
## Related Patterns
|
|
- None yet.
|