Add identity token sources for Anthropic Workload Identity Federation
beyond a token file:
- ANTHROPIC_IDENTITY_TOKEN_COMMAND: a command run on every exchange whose
stdout is the JWT (run without a shell; errors never include stdout).
Saved to the Strix config like the other ANTHROPIC_* settings.
- `strix auth login entra [--manual] [--tenant ID] [--app ID]`: PKCE
sign-in as a Microsoft Entra ID user, using the audience app as its own
public client so the stored refresh token only reaches that audience.
Tokens are refreshed automatically; defaults come from
STRIX_ENTRA_TENANT_ID / STRIX_ENTRA_APP_ID.
Source order: token file, command, literal token, Entra sign-in, GitHub
Actions OIDC. `strix auth status` and `logout` now cover both ChatGPT and
Entra, and `strix auth test [--config PATH]` runs one exchange with the
source a scan would use, reporting the source, claims and result without
printing any token.
Docs: new "Anthropic via Microsoft Entra ID" guide (Entra and Console
setup, Entra users on any host, Azure VM managed identities, everyday
use, security, troubleshooting), plus the WIF settings in the
configuration reference and `strix auth` in the CLI reference.
Co-authored-by: Jonathan Singer <jonathansinger@Jonathans-MacBook-Pro.local>
Co-authored-by: Jonathan Singer <jonathansinger@Mac-3004.lan>
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
