a365 setup all fails on macOS 15.x with PlatformNotSupportedException during authentication

[sellakumaran]

Running a365 setup all on macOS 15.x crashes during the authentication step with an unhandled PlatformNotSupportedException. The error message includes the macOS version string (e.g., "macOS 15.3.1") and the CLI exits without completing setup.

Steps to Reproduce

1. Install the a365 CLI on a machine running macOS 15.x
2. Run a365 setup all
3. When prompted to authenticate, the CLI attempts to open the system browser

Error

System.PlatformNotSupportedException: macOS 15.3.1
   at Microsoft.Identity.Client.Platforms.Mac.MacEmbeddedWebUI...
   at Microsoft.Agents.A365.DevTools.Cli.Services.MsalBrowserCredential.GetTokenAsync(...)

Expected Behavior

Authentication completes successfully. If the browser flow is unavailable, the CLI falls back to device code flow and displays a URL and code the user can use from any browser.

Actual Behavior

The CLI crashes with an unhandled PlatformNotSupportedException. The user cannot complete a365 setup all.

Environment

• macOS 15.x (confirmed on 15.3.1)
• a365 CLI (any version before the fix in PR fix: fall back to device code when browser auth fails on macOS #290)

Root Cause

MSAL.NET throws PlatformNotSupportedException when the interactive browser flow is unavailable on macOS 15.x. This exception was not caught in MsalBrowserCredential.GetTokenAsync and propagated as an unhandled error.

[github-actions]

[AUTO-TRIAGE] Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'bug' because the issue describes a crash caused by an unhandled exception during a critical setup process.
Priority: Assigned P1 because the issue prevents users from completing the setup process, making the CLI unusable on macOS 15.x, with no workaround provided. [Security issue detected: The issue involves authentication failure and unhandled exceptions, which could lead to denial of service or inability to securely authenticate, potentially exposing users to security risks if fallback mechanisms are not implemented.]
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. The issue involves authentication failure and unhandled exceptions, which could lead to denial of service or inability to securely authenticate, potentially exposing users to security risks if fallback mechanisms are not implemented.
Labels: Applied labels bug, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

[github-actions]

[AUTO-TRIAGE] Results

Classification: bug
Priority: P1
Confidence: 100.0%

Recommended Assignee: @sellakumaran

Analysis:
type rationale: Classified as 'bug' because the issue describes a crash caused by an unhandled exception during a critical setup process.

priority rationale: Assigned P1 because the issue prevents users from completing the setup process, making the CLI unusable on macOS 15.x, with no workaround provided. [Security issue detected: The issue involves authentication failure and unhandled exceptions, which could lead to denial of service or inability to securely authenticate, potentially exposing users to security risks if fallback mechanisms are not implemented.]

copilot rationale: Security issues require human review and should not be auto-fixed

assignment rationale: Security issue assigned to security lead. The issue involves authentication failure and unhandled exceptions, which could lead to denial of service or inability to securely authenticate, potentially exposing users to security risks if fallback mechanisms are not implemented.

labels rationale: Applied labels bug, P1, security based on issue type and priority

[SUGGESTION] Suggested Approach

1. 1. Implement a fallback authentication flow: Modify the MsalBrowserCredential.GetTokenAsync method in src/Microsoft.Agents.A365.DevTools.Cli/Services/MsalBrowserCredential.cs to catch the PlatformNotSupportedException. If the exception occurs, fallback to the device code flow by using AcquireTokenWithDeviceCodeAsync from MSAL.NET, and display the URL and code to the user for manual authentication.
2. 2. Add macOS version checks: In the initialization logic for authentication (likely in src/Microsoft.Agents.A365.DevTools.Cli/Program.cs or related setup code), detect the macOS version using System.Runtime.InteropServices.RuntimeInformation.OSDescription. If the version is 15.x, preemptively disable the browser flow and use the device code flow instead.
3. 3. Update unit tests for authentication: Add tests in src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/MsalBrowserCredentialTests.cs to verify that the fallback device code flow is triggered correctly when PlatformNotSupportedException is thrown. Mock the MSAL.NET library to simulate this exception and validate the CLI's behavior.
4. 4. Improve error handling and logging: Enhance exception handling in MsalBrowserCredential.GetTokenAsync to log detailed error messages using the existing logging framework. Include the macOS version and a suggestion for the user to manually authenticate using the device code flow. This will help users understand the issue and provide better diagnostics.
5. 5. Update documentation: Modify the docs/setup.md file to include a troubleshooting section for macOS users. Explain the fallback device code flow and provide step-by-step instructions for manual authentication, including screenshots of the process.

---

Generated by TeamAssistant Auto-Triage powered by GitHub Models