Microsoft.Agents.A365.DevTools.Cli 1.1.214

This package has no dependencies.

Added
- Log separator written at the start of each CLI invocation now redacts values for secret-bearing options (e.g. --idp-client-secret) so they are not written to the log file in plain text.
- Authentication context (tenant and user) is now logged at the Information level whenever the resolved sign-in identity changes, giving operators a clear audit trail in the log file of who the CLI is acting as, without exposing credentials.
- --authmode obo|s2s|both option on setup all — controls how the agent identity service principal receives permissions: - obo (default): principal-scoped delegated grants (consentType: "Principal"); no Global Administrator required. - s2s: application role assignments on the agent identity SP; attempted programmatically, falls back to printed PowerShell instructions if the caller lacks Global Administrator. - both: applies both OBO delegated grants and S2S app role assignments. - Non-DW agents stamp inheritable permissions and S2S grants on the blueprint (Global Administrator only); the agent identity inherits them, so a per-identity grant runs only when inheritance is not in force. - authMode can be persisted in a365.config.json to apply on every run without the flag.
- a365 develop get-token --device-code — forces device code auth for Microsoft Graph scopes the Windows WAM broker rejects (e.g. Exchange MailboxSettings.ReadWrite, ExchangeMessageTrace.Read.All).

Fixed
- setup all --authmode s2s no longer prints spurious "Action Required" PowerShell steps when the agent identity already inherits its app roles from the blueprint, and now retries the grant automatically before falling back to manual steps (#460).
- a365 develop get-token now falls back to device code when the Windows WAM broker rejects Exchange Graph scopes with ApiContractViolation, instead of failing with an opaque MSAL error.
- setup blueprint now configures the blueprint's inheritable Microsoft Graph permissions even when the signed-in user is not a Global Administrator, no longer aborts with a misleading "Failed to configure inheritable permissions" error when the tenant-wide consent grant cannot be made programmatically, and ends with a setup summary whose Action Required block surfaces the admin-consent URL for non-admins to hand off (#452).

Changed
- Hardened token storage: the CLI no longer writes access tokens to a plaintext file — they live only in the OS-protected MSAL cache (DPAPI/Keychain/owner-only file). Any legacy plaintext cache is removed automatically; sign-in prompts are unchanged.