[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699ERKDVD7K7Y1NXWSJKPR0":3,"skill-same:01M699ERKDVD7K7Y1NXWSJKPR0":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":46,"ownerHtmlUrl":47,"ownerBlogUrl":48,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M699ERKDVD7K7Y1NXWSJKPR0","auth",null,"Activate when code touches token management, credential resolution, git auth flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or any remote host authentication -- even if 'auth' isn't mentioned explicitly.","microsoft\u002Fapm","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699CC41JR5QW38C9PDX6101",4361,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002F.apm\u002Fskills\u002Fauth\u002FSKILL.md",[],[5,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"when","github","token management","flows","remote","ado","host","resolution","token","activate","credential","pat","management","apm","git","authentication","code","2026-11-10 10:12:30",false,"---\nname: auth\ndescription: >\n  Activate when code touches token management, credential resolution, git auth\n  flows, GITHUB_APM_PAT, ADO_APM_PAT, AuthResolver, HostInfo, AuthContext, or\n  any remote host authentication -- even if 'auth' isn't mentioned explicitly.\n---\n\n# Auth Skill\n\n[Auth expert persona](..\u002F..\u002Fagents\u002Fauth-expert.agent.md)\n\n## When to activate\n\n- Any change to `src\u002Fapm_cli\u002Fcore\u002Fauth.py` or `src\u002Fapm_cli\u002Fcore\u002Ftoken_manager.py`\n- Code that reads `GITHUB_APM_PAT`, `GITHUB_TOKEN`, `GH_TOKEN`, `ADO_APM_PAT`\n- Code using `git ls-remote`, `git clone`, or GitHub\u002FADO API calls\n- Error messages mentioning tokens, authentication, or credentials\n- Changes to `github_downloader.py` auth paths\n- Per-host or per-org token resolution logic\n\n## Key rule\n\nAll auth flows MUST go through `AuthResolver`. No direct `os.getenv()` for token variables in application code.\n\n## Canonical reference\n\nThe full per-org -> global -> credential-fill -> fallback resolution flow is in [`docs\u002Fsrc\u002Fcontent\u002Fdocs\u002Fgetting-started\u002Fauthentication.md`](..\u002F..\u002F..\u002Fdocs\u002Fsrc\u002Fcontent\u002Fdocs\u002Fgetting-started\u002Fauthentication.md) (mermaid flowchart). Treat it as the single source of truth; if behavior diverges, fix the diagram in the same PR.\n\n## Bearer-token authentication for ADO\n\nAzure DevOps Services (`dev.azure.com`, `*.visualstudio.com`) use this chain:\n\n1. `ADO_APM_PAT` env var if set\n2. AAD bearer via `az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798` if `az` is installed and `az account show` succeeds\n3. Operation-time path-scoped `git credential fill` after HTTP 401\u002F403 or a recognized Git authentication failure (`is_ado_auth_failure_signal`)\n4. Otherwise: `AdoAuthChainExhaustedError` from `try_with_fallback`, or `build_error_context` on resolve-time failures\n\nAzure DevOps Server hosts (`ADO_HOST` \u002F `APM_ADO_HOSTS`) skip az bearer: PAT, then fill.\n\n`ADO_APM_PAT` is the env var name used by the auth flow. The AAD bearer source constant lives in `src\u002Fapm_cli\u002Fcore\u002Ftoken_manager.py` as `GitHubTokenManager.ADO_BEARER_SOURCE = \"AAD_BEARER_AZ_CLI\"`.\n\n**Stale-PAT fallback:** on HTTP 401\u002F403 or a recognized Git authentication failure, APM tries an available az bearer. A successful bearer retry emits:\n\n```\n[!] ADO_APM_PAT was rejected for {host}; fell back to az cli bearer.\n[!]     Consider unsetting the stale variable.\n```\n\n**Verbose source line** (one per host, emitted under `--verbose`):\n\n```\n[i] dev.azure.com -- using bearer from az cli (source: AAD_BEARER_AZ_CLI)\n[i] dev.azure.com -- token from ADO_APM_PAT\n```\n\n**Diagnostic cases** (`build_error_context` + `AdoAuthChainExhaustedError` in `src\u002Fapm_cli\u002Fcore\u002Fauth.py`):\n\nInitial PAT\u002Fbearer diagnostics do not describe the later helper retry.\n\n1. No PAT, no `az`: `Azure DevOps requires authentication. You have two options` -> install `az` and `az login`, or set `ADO_APM_PAT`.\n2. No PAT, `az` not signed in: same two-options copy with `az login` first.\n3. No PAT, wrong tenant: `Your az cli session (tenant: ...) returned a bearer token, but Azure DevOps rejected it (HTTP 401).` -> `az login --tenant \u003Ccorrect-tenant>`, or set `ADO_APM_PAT`.\n4. PAT set, request failed: `ADO_APM_PAT is set, but the Azure DevOps request failed.` -> rotate the PAT, `az login` on Services, or store a GCM credential.\n5. Helper empty or rejected: `AdoAuthChainExhaustedError` names only attempted steps -> refresh PAT, `az login` on Services, or store a repository credential in GCM. DNS, TLS, and timeout failures re-raise without unlocking fill or becoming auth exhaustion.\n6. Server, no PAT: `Azure DevOps Server requires ADO_APM_PAT or a Git credential helper.` -> set `ADO_APM_PAT` or store a GCM credential (`az` does not apply).\n","# Auth Skill\n\n[Auth expert persona](..\u002F..\u002Fagents\u002Fauth-expert.agent.md)\n\n## When to activate\n\n- Any change to `src\u002Fapm_cli\u002Fcore\u002Fauth.py` or `src\u002Fapm_cli\u002Fcore\u002Ftoken_manager.py`\n- Code that reads `GITHUB_APM_PAT`, `GITHUB_TOKEN`, `GH_TOKEN`, `ADO_APM_PAT`\n- Code using `git ls-remote`, `git clone`, or GitHub\u002FADO API calls\n- Error messages mentioning tokens, authentication, or credentials\n- Changes to `github_downloader.py` auth paths\n- Per-host or per-org token resolution logic\n\n## Key rule\n\nAll auth flows MUST go through `AuthResolver`. No direct `os.getenv()` for token variables in application code.\n\n## Canonical reference\n\nThe full per-org -> global -> credential-fill -> fallback resolution flow is in [`docs\u002Fsrc\u002Fcontent\u002Fdocs\u002Fgetting-started\u002Fauthentication.md`](..\u002F..\u002F..\u002Fdocs\u002Fsrc\u002Fcontent\u002Fdocs\u002Fgetting-started\u002Fauthentication.md) (mermaid flowchart). Treat it as the single source of truth; if behavior diverges, fix the diagram in the same PR.\n\n## Bearer-token authentication for ADO\n\nAzure DevOps Services (`dev.azure.com`, `*.visualstudio.com`) use this chain:\n\n1. `ADO_APM_PAT` env var if set\n2. AAD bearer via `az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798` if `az` is installed and `az account show` succeeds\n3. Operation-time path-scoped `git credential fill` after HTTP 401\u002F403 or a recognized Git authentication failure (`is_ado_auth_failure_signal`)\n4. Otherwise: `AdoAuthChainExhaustedError` from `try_with_fallback`, or `build_error_context` on resolve-time failures\n\nAzure DevOps Server hosts (`ADO_HOST` \u002F `APM_ADO_HOSTS`) skip az bearer: PAT, then fill.\n\n`ADO_APM_PAT` is the env var name used by the auth flow. The AAD bearer source constant lives in `src\u002Fapm_cli\u002Fcore\u002Ftoken_manager.py` as `GitHubTokenManager.ADO_BEARER_SOURCE = \"AAD_BEARER_AZ_CLI\"`.\n\n**Stale-PAT fallback:** on HTTP 401\u002F403 or a recognized Git authentication failure, APM tries an available az bearer. A successful bearer retry emits:\n\n```\n[!] ADO_APM_PAT was rejected for {host}; fell back to az cli bearer.\n[!]     Consider unsetting the stale variable.\n```\n\n**Verbose source line** (one per host, emitted under `--verbose`):\n\n```\n[i] dev.azure.com -- using bearer from az cli (source: AAD_BEARER_AZ_CLI)\n[i] dev.azure.com -- token from ADO_APM_PAT\n```\n\n**Diagnostic cases** (`build_error_context` + `AdoAuthChainExhaustedError` in `src\u002Fapm_cli\u002Fcore\u002Fauth.py`):\n\nInitial PAT\u002Fbearer diagnostics do not describe the later helper retry.\n\n1. No PAT, no `az`: `Azure DevOps requires authentication. You have two options` -> install `az` and `az login`, or set `ADO_APM_PAT`.\n2. No PAT, `az` not signed in: same two-options copy with `az login` first.\n3. No PAT, wrong tenant: `Your az cli session (tenant: ...) returned a bearer token, but Azure DevOps rejected it (HTTP 401).` -> `az login --tenant \u003Ccorrect-tenant>`, or set `ADO_APM_PAT`.\n4. PAT set, request failed: `ADO_APM_PAT is set, but the Azure DevOps request failed.` -> rotate the PAT, `az login` on Services, or store a GCM credential.\n5. Helper empty or rejected: `AdoAuthChainExhaustedError` names only attempted steps -> refresh PAT, `az login` on Services, or store a repository credential in GCM. DNS, TLS, and timeout failures re-raise without unlocking fill or becoming auth exhaustion.\n6. Server, no PAT: `Azure DevOps Server requires ADO_APM_PAT or a Git credential helper.` -> set `ADO_APM_PAT` or store a GCM credential (`az` does not apply).\n",{"name":5,"description":7},"main","2920043258932f0f67e6f01df7b9047eb42f358c",".apm\u002Fskills\u002Fauth",425,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm","https:\u002F\u002Fmicrosoft.github.io\u002Fapm\u002F","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-13 18:27:31",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add microsoft\u002Fapm --skill auth",{"tool":57,"command":58},"bunx","bunx skills add microsoft\u002Fapm --skill auth",{"tool":60,"command":61},"pnpm","pnpm dlx skills add microsoft\u002Fapm --skill auth","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002F.apm\u002Fskills\u002Fauth\u002FSKILL.md",true,[65,71,75,79,83],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"agents\u002Fopenai.yaml","REFERENCE","参考文档",139,"https:\u002F\u002Fgithub.com\u002Fnichee\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude\u002Fskills\u002Fteach\u002Fagents\u002Fopenai.yaml",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"GLOSSARY-FORMAT.md",2131,"https:\u002F\u002Fgithub.com\u002Fnichee\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude\u002Fskills\u002Fteach\u002FGLOSSARY-FORMAT.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"LEARNING-RECORD-FORMAT.md",2777,"https:\u002F\u002Fgithub.com\u002Fnichee\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude\u002Fskills\u002Fteach\u002FLEARNING-RECORD-FORMAT.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"MISSION-FORMAT.md",1553,"https:\u002F\u002Fgithub.com\u002Fnichee\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude\u002Fskills\u002Fteach\u002FMISSION-FORMAT.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"RESOURCES-FORMAT.md",1926,"https:\u002F\u002Fgithub.com\u002Fnichee\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude\u002Fskills\u002Fteach\u002FRESOURCES-FORMAT.md",[88,94,100,105,110,115],{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":36},"01M699JMZBYWPBT7JYWBSB95Z6","hello","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fshared\u002Fminimal_skill\u002F.apm\u002Fskills\u002Fhello\u002FSKILL.md",[],[90],{"skillNo":95,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":36},"01M699JKAMZ4DH1PYJMXHE4FG4","placeholder","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs25_copilot_alias\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[96],{"skillNo":101,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":36},"01M699JHR9DKJ7BZHAPF6DZX2Z","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs24_priority_override\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[96],{"skillNo":106,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":36},"01M699JG5BJBZSWM25F1VMJ2H6","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs23_error_renderer\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[96],{"skillNo":111,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":36},"01M699JEFSMBP3HNS061R15CE9","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs22_gemini_md_only\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[96],{"skillNo":116,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":36},"01M699JCRCJCVZ3Z3RD8F9MXF5","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fapm\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Ftarget_resolution\u002Fs21_codex_dir\u002F.apm\u002Fskills\u002Fplaceholder\u002FSKILL.md",[],[96]]