fix: address PR #433 review comments

- Extract IExecutionContextLogger / ExecutionContextLogger service
  Uses IConfigService.LoadAsync for merged config (static + generated +
  env-var overrides) so displayed values match what commands actually act
  against. Removes raw JsonDocument parsing from Program.cs.

- Gate execution context panel on --verbose / A365_SHOW_CONTEXT=1
  Previously ran az account show unconditionally on every non-help
  command (700ms-2s on Windows). Now opt-in only.

- Drop az-derived context panel; JWT path is authoritative
  AuthenticationService.LogAuthenticationContext emits user/tenant from
  JWT claims (what the command actually acts against). Removes conflict
  between two panels that could disagree.

- Consolidate --config arg parsing into Program.ResolveConfigPath
  Removes duplicate parser in DI setup. New helper handles both
  '--config value' and '--config=value' forms. Guards empty/whitespace
  values (fixes misleading 'not found (<cwd>)' diagnostic).

- Move LogInformation inside lock in LogAuthenticationContext
  Removes the awkward changed-outside-lock shape.

- Use Console.WriteLine for blank-line spacing in context panel
  logger.LogInformation empty strings emit garbage under JSON/file
  log formatters.

- Refactor TryExtractUpnFromJwt into TryExtractClaimFromJwt helper
  Shared by UPN and tenant-id extraction, removing duplication.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: sshandilya1991

CHANGELOG.md

@@ -23,6 +23,7 @@ Agents provisioned before this release need `Agent365.Observability.OtelWrite` g
 **Option B — CLI** (`a365 setup admin`) has been removed in this release. Use Option A above, or copy the PowerShell instructions printed in the `a365 setup all` summary output.
 
 ### Added
+- Opt-in startup execution context display via `--verbose`, `-v`, or `A365_SHOW_CONTEXT=1`, showing the invoked command, resolved config path, merged config tenant, effective environment, and agent identity while redacting secret option values.
 - `--skip-sp-provisioning` option on `setup all` — skips the interactive in-line provisioning of missing resource service principals (issue #429). Default: setup prompts per-resource and runs `az ad sp create --id <appId>` using the operator's `az login`. With this flag, missing SPs are excluded from the consent URL and listed in the Action Required block with the `az` command and a per-SP consent URL. Implicitly enabled when stdin is redirected (CI / pipe scenarios).
 - Action Required block in the `setup all` summary now lists missing service principals — each entry shows the resource, pending scopes, the `az ad sp create` command, and the per-SP consent URL needed to complete provisioning.
 - `logs export [command] [--output <dir>]` — exports a redacted copy of a CLI diagnostic log safe to share with Microsoft support. Redacts JWT tokens, email addresses, OS-path usernames, and tenant-specific GUIDs; replaces identical values with consistent aliases so log correlation is preserved. Preserves diagnostic IDs that aren't sensitive but are useful for debugging — `TraceId`, `CorrelationId`, Microsoft Graph `request-id` and `client-request-id` values, and well-known public Microsoft / Agent 365 resource appIds (such as the Microsoft Graph appId `00000003-0000-0000-c000-000000000000`). Omit `[command]` to export all available logs at once.

src/Microsoft.Agents.A365.DevTools.Cli/Helpers/CommandStringHelper.cs

@@ -8,6 +8,18 @@ namespace Microsoft.Agents.A365.DevTools.Cli.Helpers;
 /// </summary>
 public static class CommandStringHelper
 {
+    private const string RedactedValue = "<redacted>";
+    private static readonly HashSet<string> SensitiveValueOptions = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "--access-token",
+        "--api-key",
+        "--client-secret",
+        "--idp-client-secret",
+        "--password",
+        "--refresh-token",
+        "--token"
+    };
+
     /// <summary>
     /// Escapes a string for safe use in PowerShell single-quoted strings.
     /// In PowerShell single-quoted strings, only single quotes need escaping (doubled).
@@ -41,4 +53,44 @@ public static bool ContainsDangerousCharacters(string input)
         var dangerous = new[] { '\'', '"', ';', '`', '$', '&', '|', '<', '>', '\n', '\r', '\t' };
         return input.IndexOfAny(dangerous) >= 0;
     }
+
+    /// <summary>
+    /// Formats a command line for diagnostics while redacting values for options that carry secrets.
+    /// </summary>
+    public static string FormatForDisplay(string executable, IReadOnlyList<string> args)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(executable);
+        ArgumentNullException.ThrowIfNull(args);
+
+        var redactedArgs = new List<string>(args.Count);
+        var redactNext = false;
+
+        foreach (var arg in args)
+        {
+            if (redactNext)
+            {
+                redactedArgs.Add(RedactedValue);
+                redactNext = false;
+                continue;
+            }
+
+            var equalsIndex = arg.IndexOf('=');
+            if (equalsIndex > 0)
+            {
+                var optionName = arg[..equalsIndex];
+                if (SensitiveValueOptions.Contains(optionName))
+                {
+                    redactedArgs.Add($"{optionName}={RedactedValue}");
+                    continue;
+                }
+            }
+
+            redactedArgs.Add(arg);
+            redactNext = SensitiveValueOptions.Contains(arg);
+        }
+
+        return redactedArgs.Count == 0
+            ? executable
+            : $"{executable} {string.Join(" ", redactedArgs)}";
+    }
 }

src/Microsoft.Agents.A365.DevTools.Cli/Program.cs

@@ -2,7 +2,9 @@
 // Licensed under the MIT License.
 
 using Microsoft.Agents.A365.DevTools.Cli.Commands;
+using Microsoft.Agents.A365.DevTools.Cli.Constants;
 using Microsoft.Agents.A365.DevTools.Cli.Exceptions;
+using Microsoft.Agents.A365.DevTools.Cli.Helpers;
 using Microsoft.Agents.A365.DevTools.Cli.Services;
 using Microsoft.Agents.A365.DevTools.Cli.Services.Helpers;
 using Microsoft.Extensions.DependencyInjection;
@@ -33,8 +35,7 @@ static async Task<int> Main(string[] args)
         {
             try
             {
-                // args are CLI arguments only — no secrets are passed as args (API keys, passwords are read from config/env).
-                var commandLine = "a365 " + string.Join(" ", args);
+                var commandLine = CommandStringHelper.FormatForDisplay("a365", args);
                 var separator =
                     Environment.NewLine +
                     "============================================================" + Environment.NewLine +
@@ -249,6 +250,17 @@ await Task.WhenAll(
                 || a.StartsWith("--show-secret=", StringComparison.Ordinal));
             if (!isHelpOrVersion && !isShowSecret)
             {
+                // Print execution context panel when --verbose or A365_SHOW_CONTEXT=1 is set.
+                // Gated so fast read-only commands (list/get) are not penalised by the overhead.
+                var showContext = isVerbose
+                    || string.Equals(Environment.GetEnvironmentVariable("A365_SHOW_CONTEXT"), "1", StringComparison.Ordinal);
+                if (showContext)
+                {
+                    var executionContextLogger = serviceProvider.GetRequiredService<IExecutionContextLogger>();
+                    var configPath = ResolveConfigPath(args);
+                    await executionContextLogger.LogAsync(configPath, args);
+                }
+
                 try
                 {
                     await configService.TryResolveClientAppIdAsync(graphApiService);
@@ -333,35 +345,28 @@ private static void ConfigureServices(IServiceCollection services, LogLevel mini
             string environment = Environment.GetEnvironmentVariable("A365_ENVIRONMENT") ?? "prod";
 
             var args = Environment.GetCommandLineArgs();
-            var configIndex = Array.FindIndex(args, arg => arg == "--config" || arg == "-c");
-            if (configIndex >= 0 && configIndex < args.Length - 1)
+            var configFilePath = ResolveConfigPath(args);
+            try
             {
-                try
+                if (File.Exists(configFilePath))
                 {
-                    var configFilePath = args[configIndex + 1];
-                    if (!Path.IsPathRooted(configFilePath))
-                        configFilePath = Path.Combine(System.Environment.CurrentDirectory, configFilePath);
-
-                    if (File.Exists(configFilePath))
+                    var json = File.ReadAllText(configFilePath);
+                    using var doc = System.Text.Json.JsonDocument.Parse(json);
+                    if (doc.RootElement.TryGetProperty("environment", out var envProp))
                     {
-                        var json = File.ReadAllText(configFilePath);
-                        using var doc = System.Text.Json.JsonDocument.Parse(json);
-                        if (doc.RootElement.TryGetProperty("environment", out var envProp))
+                        var envValue = envProp.GetString();
+                        if (!string.IsNullOrWhiteSpace(envValue))
                         {
-                            var envValue = envProp.GetString();
-                            if (!string.IsNullOrWhiteSpace(envValue))
-                            {
-                                environment = envValue;
-                            }
+                            environment = envValue;
                         }
                     }
 
                     logger.LogDebug("Resolved environment from config: {Environment}", environment);
                 }
-                catch (Exception ex)
-                {
-                    logger.LogDebug("Failed to read environment from config: {Error}", ex.Message);
-                }
+            }
+            catch (Exception ex)
+            {
+                logger.LogDebug("Failed to read environment from config: {Error}", ex.Message);
             }
 
             return new Agent365ToolingService(configService, authService, logger, environment);
@@ -394,7 +399,10 @@ private static void ConfigureServices(IServiceCollection services, LogLevel mini
 
         // Register Azure CLI service
         services.AddSingleton<IAzureCliService, AzureCliService>();
-        
+
+        // Register execution context logger (used when --verbose or A365_SHOW_CONTEXT=1)
+        services.AddSingleton<IExecutionContextLogger, ExecutionContextLogger>();
+
         // Register confirmation provider for user prompts
         services.AddSingleton<IConfirmationProvider, ConsoleConfirmationProvider>();
 
@@ -433,5 +441,38 @@ private static string DetectCommandName(string[] args)
             .Replace(" ", "-")
             .Replace("_", "-");
     }
+
+    /// <summary>
+    /// Resolves the absolute path to a365.config.json from CLI arguments.
+    /// Handles both "--config path" and "--config=path" forms.
+    /// Empty or whitespace --config values fall back to the default "a365.config.json"
+    /// in the working directory so diagnostics never report the current directory as a config file.
+    /// </summary>
+    internal static string ResolveConfigPath(string[] args)
+    {
+        ArgumentNullException.ThrowIfNull(args);
+
+        for (var i = 0; i < args.Length; i++)
+        {
+            string? raw = null;
+
+            if ((args[i] == "--config" || args[i] == "-c") && i < args.Length - 1)
+                raw = args[i + 1];
+            else if (args[i].StartsWith("--config=", StringComparison.Ordinal))
+                raw = args[i]["--config=".Length..];
+
+            if (raw is not null)
+            {
+                if (string.IsNullOrWhiteSpace(raw))
+                    return Path.Combine(Environment.CurrentDirectory, ConfigConstants.DefaultConfigFileName);
+
+                return Path.IsPathRooted(raw)
+                    ? raw
+                    : Path.Combine(Environment.CurrentDirectory, raw);
+            }
+        }
+
+        return Path.Combine(Environment.CurrentDirectory, ConfigConstants.DefaultConfigFileName);
+    }
 }
 

src/Microsoft.Agents.A365.DevTools.Cli/Services/AuthenticationService.cs

@@ -63,6 +63,9 @@ public class AuthenticationService : IAuthenticationService
 {
     private readonly ILogger<AuthenticationService> _logger;
     private readonly string _tokenCachePath;
+    private readonly object _authContextLogLock = new();
+    private string? _lastLoggedUser;
+    private string? _lastLoggedTenant;
 
     public AuthenticationService(ILogger<AuthenticationService> logger)
     {
@@ -168,13 +171,15 @@ public async Task<string> GetAccessTokenAsync(
                                 }
                                 else
                                 {
+                                    LogAuthenticationContext(cachedToken.AccessToken, cachedToken.TenantId, userId, resourceUrl, fromCache: true);
                                     _logger.LogDebug("Using cached authentication token for {ResourceUrl} (tenant: {TenantId})",
                                         resourceUrl, tenantId);
                                     return cachedToken.AccessToken;
                                 }
                             }
                             else
                             {
+                                LogAuthenticationContext(cachedToken.AccessToken, cachedToken.TenantId, userId, resourceUrl, fromCache: true);
                                 _logger.LogDebug("Using cached authentication token for {ResourceUrl} (tenant: {TenantId})",
                                     resourceUrl, tenantId);
                                 return cachedToken.AccessToken;
@@ -183,6 +188,7 @@ public async Task<string> GetAccessTokenAsync(
                     }
                     else
                     {
+                        LogAuthenticationContext(cachedToken.AccessToken, cachedToken.TenantId, userId, resourceUrl, fromCache: true);
                         _logger.LogDebug("Using cached authentication token for {ResourceUrl}", resourceUrl);
                         return cachedToken.AccessToken;
                     }
@@ -212,6 +218,7 @@ public async Task<string> GetAccessTokenAsync(
                 _logger.LogDebug(
                     "Authentication returned token for {ReturnedUser} but {RequestedUser} was requested. Not caching.",
                     returnedUpn, userId);
+                LogAuthenticationContext(token.AccessToken, token.TenantId, userId, resourceUrl, fromCache: false);
                 // Return the token as-is — it may still be valid for this call.
                 // Do not write it to cache under the userId key.
                 return token.AccessToken;
@@ -220,6 +227,7 @@ public async Task<string> GetAccessTokenAsync(
 
         // Cache the token with the appropriate cache key
         await CacheTokenAsync(cacheKey, token);
+        LogAuthenticationContext(token.AccessToken, token.TenantId, userId, resourceUrl, fromCache: false);
 
         return token.AccessToken;
     }
@@ -685,6 +693,21 @@ protected virtual TokenCredential CreateDeviceCodeCredential(string clientId, st
     }
 
     private static string? TryExtractUpnFromJwt(string? jwt)
+    {
+        foreach (var claim in new[] { "upn", "preferred_username", "unique_name" })
+        {
+            var value = TryExtractClaimFromJwt(jwt, claim);
+            if (!string.IsNullOrWhiteSpace(value))
+                return value;
+        }
+
+        return null;
+    }
+
+    private static string? TryExtractTenantIdFromJwt(string? jwt)
+        => TryExtractClaimFromJwt(jwt, "tid");
+
+    private static string? TryExtractClaimFromJwt(string? jwt, string claimName)
     {
         if (string.IsNullOrWhiteSpace(jwt)) return null;
         try
@@ -698,17 +721,48 @@ protected virtual TokenCredential CreateDeviceCodeCredential(string clientId, st
             payload = payload.PadRight(payload.Length + (4 - payload.Length % 4) % 4, '=');
             var bytes = Convert.FromBase64String(payload);
             using var doc = JsonDocument.Parse(bytes);
-            if (doc.RootElement.TryGetProperty("upn", out var upn) && !string.IsNullOrWhiteSpace(upn.GetString()))
-                return upn.GetString();
-            if (doc.RootElement.TryGetProperty("preferred_username", out var pref) && !string.IsNullOrWhiteSpace(pref.GetString()))
-                return pref.GetString();
-            if (doc.RootElement.TryGetProperty("unique_name", out var uniqueName) && !string.IsNullOrWhiteSpace(uniqueName.GetString()))
-                return uniqueName.GetString();
+            return doc.RootElement.TryGetProperty(claimName, out var claim) && claim.ValueKind == JsonValueKind.String
+                ? claim.GetString()
+                : null;
         }
-        catch { } // Static helper — no logger access. Caller logs via ResolveLoginHintFromCacheAsync.
+        catch { } // Static helper — no logger access. Callers log when needed.
         return null;
     }
 
+    private void LogAuthenticationContext(
+        string accessToken,
+        string? fallbackTenantId,
+        string? fallbackUserId,
+        string resourceUrl,
+        bool fromCache)
+    {
+        var user = TryExtractUpnFromJwt(accessToken) ?? fallbackUserId ?? "(unknown)";
+        var tenant = TryExtractTenantIdFromJwt(accessToken) ?? fallbackTenantId ?? "(unknown)";
+
+        lock (_authContextLogLock)
+        {
+            var changed = !string.Equals(_lastLoggedUser, user, StringComparison.OrdinalIgnoreCase)
+                || !string.Equals(_lastLoggedTenant, tenant, StringComparison.OrdinalIgnoreCase);
+
+            if (changed)
+            {
+                _lastLoggedUser = user;
+                _lastLoggedTenant = tenant;
+                _logger.LogInformation(
+                    "Authentication context: API calls will use user {User} in tenant {TenantId} ({Source})",
+                    user,
+                    tenant,
+                    fromCache ? "cached token" : "interactive sign-in");
+            }
+        }
+
+        _logger.LogDebug(
+            "Resolved access token for {ResourceUrl} using user {User} in tenant {TenantId}",
+            resourceUrl,
+            user,
+            tenant);
+    }
+
     /// <summary>
     /// Clears cached authentication token(s)
     /// </summary>