The seeding script was never in the repository. .gitignore carries "scripts/"
for local helper scripts, core.ignorecase is true on Windows, so Scripts/
matched it and git add -A silently skipped the file. The commit that claimed to
add the script contained only its CHANGELOG and README entries; the script
itself existed on disk and nowhere else. It now lives in Tools/, which is not
ignored, and the ignore rule says why so this cannot swallow shipped tooling
again.
The script also gains an -AccessToken parameter set alongside
-ClientId/-ClientSecret, so a throwaway instance can be seeded with the bearer
token from a signed-in browser session rather than by first creating a machine
identity. The two are mutually exclusive parameter sets, so supplying both is
rejected at binding rather than silently preferring one.
A supplied token is proven with a single read before anything is created. An
expired browser token is the common case, and failing there is much better than
failing midway through building a CA hierarchy and leaving a half-seeded
project behind; the error says as much and suggests copying a fresh one.
Renaming the internal token variable was not cosmetic. The script held the
bearer token in $Script:AccessToken, the same name as the new parameter, so
PowerShell applied the parameter's [ValidateNotNull()] to every assignment and
both authentication paths failed with "the value $null is not a valid value for
the AccessToken variable" before reaching the network. It is now
$Script:BearerToken.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
gsadmin
f2a1492b66