{"record":{"id":"e79581f801ed19ea","repo":"gastownhall/beads","slug":"ado-pat-not-configured-set-via-bd-config-set-ado","errorCode":null,"errorMessage":"ado.pat not configured: set via 'bd config set ado.pat <token>' or AZURE_DEVOPS_PAT env var","messagePattern":"ado\\.pat not configured: set via 'bd config set ado\\.pat <token>' or AZURE_DEVOPS_PAT env var","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/bd/ado.go","lineNumber":243,"sourceCode":"\tcase \"ado.pat\":\n\t\treturn \"AZURE_DEVOPS_PAT\"\n\tcase \"ado.org\":\n\t\treturn \"AZURE_DEVOPS_ORG\"\n\tcase \"ado.project\":\n\t\treturn \"AZURE_DEVOPS_PROJECT\"\n\tcase \"ado.projects\":\n\t\treturn \"AZURE_DEVOPS_PROJECTS\"\n\tcase \"ado.url\":\n\t\treturn \"AZURE_DEVOPS_URL\"\n\tdefault:\n\t\treturn \"\"\n\t}\n}\n\n// validateADOConfig checks that required configuration is present.\nfunc validateADOConfig(cfg ADOConfig) error {\n\tif cfg.PAT == \"\" {\n\t\treturn fmt.Errorf(\"ado.pat not configured: set via 'bd config set ado.pat <token>' or AZURE_DEVOPS_PAT env var\")\n\t}\n\tif cfg.Org == \"\" && cfg.URL == \"\" {\n\t\treturn fmt.Errorf(\"ado.org not configured: set via 'bd config set ado.org <org>' or AZURE_DEVOPS_ORG env var\")\n\t}\n\tif len(cfg.Projects) == 0 {\n\t\treturn fmt.Errorf(\"no ADO project configured\\nSet via 'bd config set ado.project <project>'\\nOr:  'bd config set ado.projects \\\"proj1,proj2\\\"'\\nOr: AZURE_DEVOPS_PROJECT env var\")\n\t}\n\treturn nil\n}\n\n// maskADOToken masks a token for safe display.\n// Shows only the first 4 characters to aid identification without\n// revealing enough to reduce brute-force entropy.\nfunc maskADOToken(token string) string {\n\tif token == \"\" {\n\t\treturn \"(not set)\"\n\t}\n\tif len(token) <= 4 {","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/cmd/bd/ado.go#L225-L261","documentation":"validateADOConfig requires an Azure DevOps PAT before any ADO command can talk to the service. When cfg.PAT is empty this error explains both configuration channels: the `bd config set ado.pat <token>` key or the AZURE_DEVOPS_PAT environment variable. It fails fast before any network call.","triggerScenarios":"Running any ADO command that calls validateADOConfig (runADOStatus, runADOSync, runADOPush, runADOPull, or the anonymous command setup) with ado.pat unset in bd config and AZURE_DEVOPS_PAT absent from the environment.","commonSituations":"Fresh ADO integration setup; CI runners where the secret env var was never injected; PAT stored under a different config key or exported only in an interactive shell, not the service context.","solutions":["Run `bd config set ado.pat <token>` with a valid Azure DevOps PAT","Export AZURE_DEVOPS_PAT=<token> in the shell/CI environment","Verify with `bd config get ado.pat` (masked) that a token is actually persisted for the repo/user"],"exampleFix":"// before (CI)\n- run: bd ado sync\n// after\n- run: bd ado sync\n  env:\n    AZURE_DEVOPS_PAT: ${{ secrets.ADO_PAT }}","handlingStrategy":"validation","validationCode":"if os.Getenv(\"AZURE_DEVOPS_PAT\") == \"\" {\n    if pat, _ := config.Get(\"ado.pat\"); pat == \"\" {\n        return errors.New(\"set ado.pat via bd config or AZURE_DEVOPS_PAT before running ADO commands\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := bdAdoSync(); err != nil && strings.Contains(err.Error(), \"ado.pat not configured\") {\n    return configurePATThenRetry()\n}","preventionTips":["Store the PAT in bd config or always export AZURE_DEVOPS_PAT in CI","Check `bd config get ado.pat` during onboarding","Inject secrets explicitly in CI job definitions"],"tags":["azure-devops","authentication","missing-config","pat"],"backgroundTag":"missing-env-var","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}