[Copilot]

Description

Adds a NuGet credential provider (ENG-13680). After a one-off install, dotnet restore, MSBuild and Visual Studio authenticate to Cloudsmith feeds with the CLI's own credentials: an API key, a SAML session from the keyring, or OIDC. No token goes into nuget.config.

$ cloudsmith credential-helper install nuget --workspace acme
$ dotnet restore

Install. credential-helper install nuget writes a nuget-plugin-cloudsmith launcher next to cloudsmith, as a .bat on Windows. NuGet 6.13 and later (.NET SDK 9.0.200+) finds any nuget-plugin-* executable on PATH, so no NuGet config changes.

NuGet often runs the plugin from an IDE or a build agent that does not have your shell's environment. So the launcher keeps the CLOUDSMITH_* settings that you gave at install time as a flag or an environment variable: the Workspace, profile, config and credentials files, API host, TLS verification, OIDC and keyring settings. These values win over the runtime environment (ENG-15016). Secrets and the proxy URL are never written, because the launcher is world-readable. On Windows, the installer refuses a value that a batch file cannot hold safely.

Runtime. credential-helper nuget speaks NuGet's cross-platform plugin protocol. NuGet asks every plugin about every feed:

• An https feed on *.cloudsmith.io, *.cloudsmith.com or a NuGet domain of the Workspace → Basic token:<credential>.
• Any other feed, or a failed domain lookup → NotFound, so NuGet tries its other credential sources.
• A Cloudsmith feed with no credential → Error, with a message that says how to authenticate.
• A retry after a 401 resolves the credential again, so a renewed SAML or OIDC token is used.

--domain <host> adds hosts that always match. --no-discover turns off the domain lookup, so only those hosts and the Cloudsmith hosts match. Stdout carries only protocol messages, also under --debug.

Changes outside NuGet.

• core/api/init.py writes its --debug credential messages to stderr. One of them now says "SAML" instead of "SSO".
• On Windows, launcher_arg() checks the standalone binary path with batch_value. This also applies to the docker, pnpm, cargo and terraform .cmd launchers.
• resolve_credentials keeps its CredentialContext on opts for the retry. is_cloudsmith_domain passes configure_api through, so the domain lookup keeps the CLI's proxy and TLS settings.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

Testing. A temporary workflow ran a real dotnet restore (SDK 10) on Linux, macOS and Windows, from both a pip install and the PyInstaller binary. It covered a standard feed, a custom domain found by the live lookup with --debug on, and --domain --no-discover with an unreachable API host. Each job checks that the restore fails with 401 without the plugin and succeeds with it. All 18 jobs passed: run 38967385354.

I also ran dotnet nuget push and dotnet restore locally against a private repo with only a SAML session. Both worked with no API key.

Known limits.

• credential-helper list can say "not installed" after a default install. This affects every helper, and fix(ENG-15090): find default-installed launchers in credential-helper list #491 fixes it.
• The docker, pnpm and cargo launchers do not keep install-time settings yet (ENG-15016).

NuGet's plugin timeouts are 30 seconds in ProtocolConstants, not the 5 seconds in the Microsoft docs. Credentials resolve before the handshake, so the plugin needs no threads or progress messages.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Plaintext credential exposure, protocol deadline failures, and lost credential configuration remain unresolved.

Review effort: Balanced
Findings: 2 · 4

Open (6)

• Resolve credentials after handshake to avoid NuGet timeout · New
• Reject non-HTTPS feeds before sending credentials · New
• Use fullmatch to reject trailing newlines in workspace values · New
• Preserve launcher profile and configuration selectors · New
• Recognize cached custom feeds without requiring credentials · New
• Make custom-domain discovery asynchronous and cancellation-aware · New

What changed in this PR

Adds a NuGet credential provider that reuses CLI credentials without storing tokens in nuget.config.

Changes:

• Implements plugin authentication and Cloudsmith feed matching.
• Adds launcher installation, status, and removal.
• Adds unit/live tests, CI setup, and documentation.

File	Description
cloudsmith_cli/​credential_helpers/​nuget/​runtime.py	Implements protocol and credential responses.
cloudsmith_cli/​credential_helpers/​nuget/​installer.py	Manages launchers and trusted domains.
cloudsmith_cli/​credential_helpers/​nuget/​__init__.py	Exports runtime entry point.
cloudsmith_cli/​credential_helpers/​launchers.py	Supports configurable Windows extensions.
cloudsmith_cli/​cli/​tests/​test_credential_helper_nuget.py	Tests runtime, command, and installer.
cloudsmith_cli/​cli/​tests/​commands/​test_credential_helper_nuget_integration.py	Adds live restore and custom-domain checks.
cloudsmith_cli/​cli/​commands/​credential_helper/​nuget.py	Connects CLI credentials to the protocol.
cloudsmith_cli/​cli/​commands/​credential_helper/​manage.py	Registers NuGet installation management.
cloudsmith_cli/​cli/​commands/​credential_helper/​__init__.py	Registers the NuGet command.
CHANGELOG.md	Documents the new provider.
.github/​workflows/​test.yml	Configures .NET for integration tests.
.env.example	Documents optional NuGet test settings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cloudsmith-iduffy]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[Copilot]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested chang...

Addressed all six review threads in e398c8f.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The security-sensitive, cross-platform provider has unresolved blockers and only Linux end-to-end coverage.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Use an executable shim instead of a batch plugin launcher · New
• Parse URI authority before validating trusted Cloudsmith hosts · New
• Clear runtime plugin-path overrides to test PATH discovery · New

Resolved since last review (6)

• Reject non-HTTPS feeds before sending credentials
• Resolve credentials after handshake to avoid NuGet timeout
• Make custom-domain discovery asynchronous and cancellation-aware
• Recognize cached custom feeds without requiring credentials
• Preserve launcher profile and configuration selectors
• Use fullmatch to reject trailing newlines in workspace values

[Copilot]

🟡 Changes recommended

Schemeless proxy credentials can leak into launchers, and a remaining debug diagnostic can corrupt the protocol stream.

2 open findings

• Detect credentials in schemeless proxy authorities · New
• Redirect Basic-auth diagnostic output to stderr · New

3 resolved since last review

• Send debug diagnostics to stderr to preserve JSON protocol output
• Refresh credentials through the provider chain on retry
• Resolve keyring paths to absolute values during installation

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Authentication routing and cross-platform launchers warrant human review, with an unresolved TLS-setting precedence issue.

2 open findings

• Preserve explicit false for CLOUDSMITH_WITHOUT_API_SSL_VERIFY · New
• Detect credentials in schemeless proxy authorities

1 resolved since last review

• Redirect Basic-auth diagnostic output to stderr

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Security-sensitive credential handling and launcher configuration precedence warrant final human verification before approval.

2 open findings

• Preserve explicit false for CLOUDSMITH_WITHOUT_API_SSL_VERIFY
• Detect credentials in schemeless proxy authorities

🧠 Review effort: Balanced

[cloudsmith-iduffy]

Reopened as #494 so that I am the author. The code is the same commit (091ed1c). The review history stays here.