fix(auth): Azure DevOps az-CLI token returns None on undecodable output instead of crashing

[jawwad-ali]

What

AzureDevOpsAuth._acquire_via_az_cli runs az account get-access-token with text=True, then parses the JSON:

result = subprocess.run([...], capture_output=True, text=True, ...)
...
payload = _json.loads(result.stdout)
...
except (OSError, subprocess.TimeoutExpired, _json.JSONDecodeError, KeyError):
    return None

With text=True, subprocess.run decodes stdout using the locale encoding, so if az emits bytes that aren't decodable there it raises UnicodeDecodeError inside run() — before json.loads ever runs. UnicodeDecodeError is a ValueError sibling but not a JSONDecodeError, so it isn't caught and it crashes a helper whose entire contract is to return str | None.

Fix

Add UnicodeDecodeError to the except tuple so undecodable output degrades to None like every other failure mode. One-token change; direction unambiguous given the str | None return contract and the sibling encoding guards elsewhere in the codebase.

Test

test_resolve_token_azure_cli_undecodable_output_returns_none patches subprocess.run to raise UnicodeDecodeError and asserts resolve_token(...) is None — fails before (the error propagated), passes after.

---

🤖 Written with the assistance of Claude Code (AI). Bug self-found; fix/tests verified locally (fail-before / pass-after), ruff clean.

[Copilot]

Pull request overview

Handles undecodable Azure CLI output gracefully during Azure DevOps authentication.

Changes:

• Catches UnicodeDecodeError and returns None.
• Adds regression coverage for undecodable CLI output.

Show a summary per file

File	Description
src/specify_cli/authentication/azure_devops.py	Handles stdout decoding failures.
tests/test_authentication.py	Tests graceful handling of undecodable output.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium