From da7694736429a20479275c6666e144388f66e43f Mon Sep 17 00:00:00 2001
From: Paul Yuk <paulyuk@users.noreply.github.com>
Date: Fri, 29 May 2026 08:19:44 -0700
Subject: [PATCH] fix(skill/sandboxes): use canonical aka.ms install URLs and
 aca auth login

Switches plugin/skills/sandboxes/references/install.md to:

- https://aka.ms/aca-cli-install (Linux/macOS) and https://aka.ms/aca-cli-install-ps (Windows) instead of the long raw.githubusercontent.com URLs. Both aka.ms shortcuts already redirect to the same install scripts (verified 200/301), so behaviour is identical but the user-facing URL is what the public ACA Sandboxes docs and ground-truth references use.

- aca auth login as the canonical CLI entry point, with an explicit note that it delegates to az login under the hood. The skill previously told users to run az login directly, which works but bypasses the CLI's own auth verb and is inconsistent with the docs.

Verified locally: aca auth login is a real subcommand on aca 1.0.0-beta.1 (Commands: login | status | help, 'Log in to Azure (delegates to az login)').

Why: surfaced by the ACA Sandboxes Vally eval suite (Run 3) where pos-install-aca-{linux,macos,windows} all failed output-contains for 'https://aka.ms/aca-cli-install' and 'aca auth login' against the docs ground truth.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 plugin/skills/sandboxes/references/install.md | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/plugin/skills/sandboxes/references/install.md b/plugin/skills/sandboxes/references/install.md
index 891daa0..12d30ae 100644
--- a/plugin/skills/sandboxes/references/install.md
+++ b/plugin/skills/sandboxes/references/install.md
@@ -1,31 +1,31 @@
 # Install the `aca` CLI
 
-The `aca` CLI is the primary surface for sandboxes. It delegates
-authentication to the Azure CLI (`az login`).
+The `aca` CLI is the primary surface for sandboxes. It owns the auth verb
+(`aca auth login`), which delegates to Azure CLI (`az login`) under the hood.
 
 ## Linux / macOS
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/microsoft/azure-container-apps/main/docs/early/aca-cli/install.sh | sh
+curl -fsSL https://aka.ms/aca-cli-install | sh
 ```
 
 Pin a specific version:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/microsoft/azure-container-apps/main/docs/early/aca-cli/install.sh \
+curl -fsSL https://aka.ms/aca-cli-install \
   | ACA_VERSION=aca-cli-v0.1.0-early-access sh
 ```
 
 ## Windows (PowerShell)
 
 ```powershell
-irm https://raw.githubusercontent.com/microsoft/azure-container-apps/main/docs/early/aca-cli/install.ps1 | iex
+irm https://aka.ms/aca-cli-install-ps | iex
 ```
 
 Pin a specific version:
 
 ```powershell
-& ([scriptblock]::Create((irm https://raw.githubusercontent.com/microsoft/azure-container-apps/main/docs/early/aca-cli/install.ps1))) -Version aca-cli-v0.1.0-early-access
+& ([scriptblock]::Create((irm https://aka.ms/aca-cli-install-ps))) -Version aca-cli-v0.1.0-early-access
 ```
 
 ## Verify
@@ -38,20 +38,24 @@ aca --version
 Then log in and run the doctor:
 
 ```bash
-az login
+aca auth login
 aca doctor
 ```
 
+> `aca auth login` is the canonical CLI entry point. It delegates to
+> `az login` under the hood, so if `az` is already authenticated you can
+> skip the login step. Use `aca auth status` to check.
+
 ## Uninstall
 
 ```bash
 # Linux / macOS
-curl -fsSL https://raw.githubusercontent.com/microsoft/azure-container-apps/main/docs/early/aca-cli/install.sh | sh -s -- --uninstall
+curl -fsSL https://aka.ms/aca-cli-install | sh -s -- --uninstall
 ```
 
 ```powershell
 # Windows
-& ([scriptblock]::Create((irm https://raw.githubusercontent.com/microsoft/azure-container-apps/main/docs/early/aca-cli/install.ps1))) -Uninstall
+& ([scriptblock]::Create((irm https://aka.ms/aca-cli-install-ps))) -Uninstall
 ```
 
 ## Supported platforms