azrepos: add login/logout/list for Microsoft accounts and rename list to list-bindings

Split the verb surface into two clusters:

  - `login` / `logout` / `list` now operate on the MSAL account
    cache: they add an account, remove one, and enumerate what is
    currently cached. They do not touch the binding manager.

  - `bind` / `unbind` / `list-bindings` continue to manage which
    account a particular Azure DevOps organization should use.
    `list-bindings` is what `list` used to be (pure rename — the
    binding view, argument surface, and output format are
    unchanged).

The names were previously overloaded: the old `list` showed
bindings, there was no equivalent of `gh auth status` for "which
identities does GCM actually have credentials for", and signing in
or out was an implicit side effect of bind/unbind. Splitting the
clusters makes the two layers explicit and matches the vocabulary
of comparable tools (`az login`, `gh auth login`).

  - `azure-repos login [--tenant <id|domain>]`

    Runs an interactive Microsoft sign-in. With no flag, signs in
    against the wildcard `organizations` authority so the user can
    pick any work/school account; `--tenant` constrains to a
    specific Microsoft Entra tenant. The flag exists primarily to
    pre-stage a guest-account record: signing in against the home
    tenant for a UPN that's also a guest in another tenant only
    populates the cache with the home-tenant account, so for the
    guest tenant you have to sign in explicitly against that
    tenant's authority.

  - `azure-repos logout (<account> | --all)`

    Removes one account (matched by UPN or HomeAccountId) or every
    cached account from MSAL. UPN matches are case-insensitive;
    ambiguous matches print the candidates so the user can specify
    by HomeAccountId. No interactive picker yet — `<account>` is
    required unless `--all` is passed.

  - `azure-repos list`

    Prints each cached account on its own line followed by an
    indented HomeAccountId line, sorted by UPN. The
    HomeAccountId line exists so users can copy it into
    `logout <account>` and `bind` when UPN alone is ambiguous
    (typically guest accounts in multiple tenants).

The rename of `list` to `list-bindings` is a deliberate breaking
change — vnext is still pre-release and there is no separate
deprecation step planned. The follow-on commit reshapes
`bind`/`unbind` themselves.

Assisted-by: Claude Opus 4.7

Author: mjcheetham

src/shared/Microsoft.AzureRepos/AzureReposHostProvider.cs

@@ -828,9 +828,36 @@ ProviderCommand ICommandProvider.CreateCommand()
             clearCacheCmd.SetHandler(ClearCacheCmd);
 
             //
-            // list <organization> [--show-remotes] [--verbose]
+            // login [--tenant <id|domain>]
             //
-            var listCmd = new Command("list", "List all user account bindings");
+            var loginCmd = new Command("login", "Sign in to a Microsoft account and add it to the credential cache");
+            var loginTenantOpt = new Option<string>("--tenant", "Sign in to a specific Microsoft Entra tenant (GUID or domain). Required when adding a guest account whose home tenant is different from the tenant you want to use it for.");
+            loginCmd.AddOption(loginTenantOpt);
+            loginCmd.SetHandler(LoginCmd, loginTenantOpt);
+
+            //
+            // logout (<account> | --all)
+            //
+            var logoutCmd = new Command("logout", "Remove a Microsoft account from the credential cache");
+            var logoutAccountArg = new Argument<string>("account", "Account to remove (UPN or HomeAccountId)")
+            {
+                Arity = ArgumentArity.ZeroOrOne
+            };
+            var logoutAllOpt = new Option<bool>("--all", "Remove every cached Microsoft account");
+            logoutCmd.AddArgument(logoutAccountArg);
+            logoutCmd.AddOption(logoutAllOpt);
+            logoutCmd.SetHandler(LogoutCmd, logoutAccountArg, logoutAllOpt);
+
+            //
+            // list
+            //
+            var listCmd = new Command("list", "List Microsoft accounts in the credential cache");
+            listCmd.SetHandler(ListCmd);
+
+            //
+            // list-bindings [<organization>] [--show-remotes] [--verbose]
+            //
+            var listBindingsCmd = new Command("list-bindings", "List all user account bindings");
             var orgFilterArg = new Argument<string>("organization", "(optional) Filter results by Azure DevOps organization name")
             {
                 Arity = ArgumentArity.ZeroOrOne
@@ -840,10 +867,10 @@ ProviderCommand ICommandProvider.CreateCommand()
                 Description = "Also show Azure DevOps remote user bindings for the current repository"
             };
             var verboseOpt = new Option<bool>(new[] { "--verbose", "-v" }, "Verbose output - show remote URLs");
-            listCmd.AddArgument(orgFilterArg);
-            listCmd.AddOption(remoteOpt);
-            listCmd.AddOption(verboseOpt);
-            listCmd.SetHandler(ListCmd, orgFilterArg, remoteOpt, verboseOpt);
+            listBindingsCmd.AddArgument(orgFilterArg);
+            listBindingsCmd.AddOption(remoteOpt);
+            listBindingsCmd.AddOption(verboseOpt);
+            listBindingsCmd.SetHandler(ListBindingsCmd, orgFilterArg, remoteOpt, verboseOpt);
 
             //
             // bind <organization> <username> [--local]
@@ -875,7 +902,10 @@ ProviderCommand ICommandProvider.CreateCommand()
             unbindCmd.SetHandler(UnbindCmd, orgArg, localOpt);
 
             var rootCmd = new ProviderCommand(this);
+            rootCmd.AddCommand(loginCmd);
+            rootCmd.AddCommand(logoutCmd);
             rootCmd.AddCommand(listCmd);
+            rootCmd.AddCommand(listBindingsCmd);
             rootCmd.AddCommand(bindCmd);
             rootCmd.AddCommand(unbindCmd);
             rootCmd.AddCommand(clearCacheCmd);
@@ -888,14 +918,133 @@ private void ClearCacheCmd()
             _context.Streams.Out.WriteLine("Authority cache cleared");
         }
 
+        private async Task<int> LoginCmd(string tenantId)
+        {
+            // Pick the authority MSAL signs in against. By default we use the wildcard
+            // `organizations` authority so the user can pick any work/school account; an
+            // explicit --tenant constrains to one tenant (the only way to pre-stage a
+            // guest-account record for a non-home tenant).
+            string authority = !string.IsNullOrWhiteSpace(tenantId)
+                ? $"{AzureDevOpsConstants.AadAuthorityBaseUrl}/{tenantId}"
+                : $"{AzureDevOpsConstants.AadAuthorityBaseUrl}/organizations";
+
+            IMicrosoftAuthenticationResult result;
+            try
+            {
+                result = await _msAuth.GetTokenForUserAsync(
+                    authority,
+                    GetClientId(),
+                    GetRedirectUri(),
+                    AzureDevOpsConstants.AzureDevOpsDefaultScopes,
+                    account: null,
+                    msaPt: true);
+            }
+            catch (Exception ex)
+            {
+                _context.Streams.Error.WriteLine($"error: sign-in failed: {ex.Message}");
+                return -1;
+            }
+
+            if (result.Account is null || string.IsNullOrWhiteSpace(result.Account.HomeAccountId))
+            {
+                _context.Streams.Error.WriteLine(
+                    "error: sign-in succeeded but no account identifier was returned");
+                return -1;
+            }
+
+            _context.Streams.Out.WriteLine($"Signed in as {result.Account.UserName}.");
+            return 0;
+        }
+
+        private async Task<int> LogoutCmd(string account, bool all)
+        {
+            bool hasAccount = !string.IsNullOrWhiteSpace(account);
+            if (all == hasAccount)
+            {
+                _context.Streams.Error.WriteLine("error: specify either <account> or --all");
+                return -1;
+            }
+
+            IReadOnlyList<IMicrosoftAccount> cached =
+                await _msAuth.GetUserAccountsAsync(GetClientId(), msaPt: true);
+
+            if (cached.Count == 0)
+            {
+                _context.Streams.Out.WriteLine("No accounts cached.");
+                return 0;
+            }
+
+            IEnumerable<IMicrosoftAccount> targets;
+            if (all)
+            {
+                targets = cached;
+            }
+            else
+            {
+                IMicrosoftAccount[] matches = cached.Where(a =>
+                        StringComparer.OrdinalIgnoreCase.Equals(a.UserName, account) ||
+                        StringComparer.Ordinal.Equals(a.HomeAccountId, account))
+                    .ToArray();
+                if (matches.Length == 0)
+                {
+                    _context.Streams.Error.WriteLine($"error: no cached account matches '{account}'");
+                    return -1;
+                }
+                if (matches.Length > 1)
+                {
+                    _context.Streams.Error.WriteLine(
+                        $"error: '{account}' is ambiguous; specify the HomeAccountId of the account to remove:");
+                    foreach (IMicrosoftAccount m in matches)
+                    {
+                        _context.Streams.Error.WriteLine($"  {m.UserName}  ({m.HomeAccountId})");
+                    }
+                    return -1;
+                }
+                targets = matches;
+            }
+
+            int removed = 0;
+            foreach (IMicrosoftAccount target in targets)
+            {
+                if (await _msAuth.RemoveUserAccountAsync(GetClientId(), target, msaPt: true))
+                {
+                    _context.Streams.Out.WriteLine($"Signed out {target.UserName}.");
+                    removed++;
+                }
+            }
+
+            return removed > 0 ? 0 : -1;
+        }
+
+        private async Task<int> ListCmd()
+        {
+            IReadOnlyList<IMicrosoftAccount> cached =
+                await _msAuth.GetUserAccountsAsync(GetClientId(), msaPt: true);
+
+            if (cached.Count == 0)
+            {
+                _context.Streams.Out.WriteLine("No accounts cached.");
+                return 0;
+            }
+
+            foreach (IMicrosoftAccount account in cached
+                         .OrderBy(a => a.UserName ?? string.Empty, StringComparer.OrdinalIgnoreCase))
+            {
+                _context.Streams.Out.WriteLine(account.UserName ?? "(unknown)");
+                _context.Streams.Out.WriteLine($"  {account.HomeAccountId}");
+            }
+
+            return 0;
+        }
+
         private class RemoteBinding
         {
             public string Remote { get; set; }
             public bool IsPush { get; set; }
             public Uri Uri { get; set; }
         }
 
-        private void ListCmd(string organization, bool showRemotes, bool verbose)
+        private void ListBindingsCmd(string organization, bool showRemotes, bool verbose)
         {
             // Get all organization bindings from the user manager
             IList<AzureReposBinding> bindings = _bindingManager.GetBindings(organization).ToList();