fix: prefer interactive browser auth over device code in scripts/auth.py

[suyask-msft]

Summary

Default auth flow for local development now opens a browser once and completes silently, rather than prompting the user to copy a device code into the browser on every new process. The previous DeviceCodeCredential flow led to multiple code-copy cycles during a single setup in real-world testing, even on machines that had browsers available.

Changes

Priority order in scripts/auth.py

Before:

1. Service principal (CLIENT_ID + CLIENT_SECRET)
2. DeviceCodeCredential (always)

After:

1. Service principal (unchanged)
2. InteractiveBrowserCredential — default for local dev, opens browser once
3. DeviceCodeCredential — explicit opt-in via DATAVERSE_AUTH_DEVICE_CODE=1 for headless/CI/SSH

New env var

DATAVERSE_AUTH_DEVICE_CODE=1 — set in the environment (or .env) to force device-code flow. Intended for scenarios where no browser is available.

Error handling

If interactive browser auth fails (e.g., no browser), the error message now explicitly points to DATAVERSE_AUTH_DEVICE_CODE=1 as the fallback.

Token caching unchanged

Both interactive credentials share the same TokenCachePersistenceOptions (OS credential store) and AuthenticationRecord persistence, so:

• First login: one prompt (browser or device code depending on choice)
• Subsequent processes: silent refresh via persisted record
• No change to cache location or behavior

Evidence

During real-world testing, users on Windows development machines saw multiple device-code prompts across several auth.py invocations in a single setup, despite having a working browser. Each prompt required manually copying the code and completing a browser sign-in.

Version bump

1.2.0 → 1.2.1 (PATCH — script-level fix, no skill behavior change, no breaking change for users who already have DATAVERSE_AUTH_DEVICE_CODE=1 or a working token cache)

Test plan

• Python syntax check (ast.parse) — passes
• python .github/evals/static_checks.py — passes
• python .github/evals/version_bump_check.py — passes
• Manually verify on a Windows dev machine: fresh dv-connect flow opens a browser once, no code-copy prompts
• Manually verify DATAVERSE_AUTH_DEVICE_CODE=1 forces device code flow
• Manually verify token cache from InteractiveBrowserCredential is reused by subsequent processes

[suyask-msft]

Closing in favor of a more focused fix. The core friction observed in real-world testing turned out to be cross-tenant AuthenticationRecord invalidation (user re-authing every time they switched tenants), not the DeviceCodeCredential vs InteractiveBrowserCredential choice. The smaller, lower-risk fix (per-tenant AuthenticationRecord keying) will land as a separate PR. The broader 'switch credential type' question deserves multi-environment testing before shipping — parking for now.