Fix misleading WSLInterop browser login errors

[Copilot]

Related command

az login

Description

On newer WSL environments, interop can be enabled through entries such as WSLInterop-late, while older browser-launch fallbacks still probe /proc/sys/fs/binfmt_misc/WSLInterop and emit misleading “WSL Interoperability is disabled” errors. az login can still succeed, but the error output incorrectly suggests WSL is misconfigured.

• WSL interop detection

  • Detects enabled WSLInterop* binfmt entries, including WSLInterop-late.
  • Falls back to WSL_INTEROP when binfmt metadata is unavailable.

• Interactive login browser launch

  • Routes MSAL browser opening through Azure CLI’s WSL-aware launcher when interop is enabled.
  • Avoids noisy WSL fallback output by launching through PowerShell with stderr/stdout suppressed.
  • Passes the login URL via subprocess environment rather than command interpolation.

• Safety and concurrency

  • Validates browser URLs as HTTP(S) with a host and no control characters.
  • Serializes temporary webbrowser.open patching during interactive login.

Testing Guide

Focused regression coverage was added for:

• WSLInterop-late detection
• WSL browser wrapper behavior
• unsafe URL rejection
• az login interactive auth-code path using the WSL browser wrapper

History Notes

[Profile] az login: Fix misleading WSLInterop disabled errors during browser login on WSL

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

• Fixes Misleading error about WSLInterop #33931

[azure-client-tools-bot-prd]

Hi Copilot,
Since the current milestone time is less than 7 days, this pr may not catch up with this release.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

[azure-client-tools-agent]

Automated Review Summary — PR #33932

Live test: Skipped — the only changed test file is an azure-cli-core unit test, which is not runnable via azdev test --live. Not a gap in coverage; unit tests are exercised by upstream CI instead.

CI checks: ✅ All passed (1/1 completed, 0 failed, 0 pending).

No outstanding issues found. This PR looks ready for human maintainer review/merge.

[Yong Zhang (yonzhan)]

az login

[azure-client-tools-agent]

CI Failures — 5 checks failed

The following CI checks failed for this PR (build #339750):

Check	Result
Azure.azure-cli (main build)	❌ Failed — 6 errors
Check CLI Style	❌ Failed — 1 error
azdev-style	❌ Failed (×2)
Test Deb Packages Bullseye AMD64	❌ Failed — 1 error

Live test: Skipped (no changed test files detected).

What to address

1. Style failures (azdev-style, Check CLI Style): Run azdev style locally against the changed modules and fix all linting violations before re-submitting.

2. Main build and Deb packaging failures: The 6 build errors may be related to import errors, missing symbols, or packaging metadata. Review the full Azure DevOps build log for the exact error messages. Common causes for WSL-interop detection changes include new imports that aren't available on all platforms, or a code path that breaks the module import graph.

Please fix the style errors first (these are quick), then investigate and resolve the build failures. Once all checks pass this PR will be ready for merge.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-identity-squad.

[Cooper Cox (coopercox-ms)]

Copilot can you please fix the CI issues indicated

[Copilot]

Copilot can you please fix the CI issues indicated

Fixed the actionable CI style failures in commit 2788773 by initializing _WslBrowserOpen attributes in __init__ and grouping the azure imports. Validated with the focused WSL browser tests (5 passed) and pylint on the changed files (10.00/10). The latest GitHub style/linter workflow records are action_required before jobs are created, so there are no new job logs exposed for those runs.

[azure-client-tools-agent]

Started a Copilot task using claude-sonnet-4.6 for human feedback at #33932 (comment): https://github.com/Azure/azure-cli/tasks/c6e7904b-9a15-401e-a2f7-2d2d80f9769b