Repository: Azure/azure-sdk-for-net
File: sdk/identity/Azure.Identity/src/Credentials/AzureDeveloperCliCredential.cs (C#)

Code before:
                }

                // If a claims challenge was provided we attempted to invoke 'azd auth token' including the claims so azd can persist them.
                // Since azd cannot complete the authentication non-interactively it returns an error instructing the user to run 'azd auth login'.
                // Surface explicit guidance to the caller (never fall through when part of a chain) so they can remediate the challenge.
                if (!string.IsNullOrWhiteSpace(context.Claims))
                {
                    string loginCommand = string.IsNullOrEmpty(tenantId)
                        ? "azd auth login"
                        : $"azd auth login --tenant-id {tenantId}";
                    throw new AuthenticationFailedException(string.Format(CultureInfo.InvariantCulture, ClaimsChallengeLoginFormat, loginCommand));
                }

                bool isWinError = errorText.StartsWith(WinAzdCliError, StringComparison.CurrentCultureIgnoreCase);

                bool isOtherOsError = AzdNotFoundPattern.IsMatch(errorText);

                if (isWinError || isOtherOsError)
                {
                    throw new CredentialUnavailableException(AzdCliNotInstalled);
                }

                // Detect the specific azd "not logged in" error pattern (not just any message mentioning "azd auth login")
                bool isAADSTSError = errorText.Contains("AADSTS");
                bool isAzdNotLoggedInError = errorText.IndexOf("Please run", StringComparison.OrdinalIgnoreCase) != -1 &&
                                             errorText.IndexOf("azd auth login", StringComparison.OrdinalIgnoreCase) != -1 &&
                                             errorText.IndexOf("command prompt", StringComparison.OrdinalIgnoreCase) != -1;

                if (isAzdNotLoggedInError && !isAADSTSError)
                {
                    throw new CredentialUnavailableException(AzdNotLogIn);
                }

                bool isRefreshTokenFailedError = errorText.IndexOf(AzdCliFailedError, StringComparison.OrdinalIgnoreCase) != -1 &&
                                                 errorText.IndexOf(RefreshTokeExpired, StringComparison.OrdinalIgnoreCase) != -1 ||
                                                 errorText.IndexOf("CLIInternalError", StringComparison.OrdinalIgnoreCase) != -1;

                if (isRefreshTokenFailedError)
                {
                    throw new CredentialUnavailableException(InteractiveLoginRequired);
                }

                if (_isChainedCredential)
                {
                    throw new CredentialUnavailableException($"{AzdCliFailedError} {Troubleshoot} {errorText}");
                }
                else
                {
                    throw new AuthenticationFailedException($"{AzdCliFailedError} {Troubleshoot} {errorText}");
                }
            }

Review comment (suggestion):
Be aware that azd versions < 1.23.0 provided an `azd login` command. See https://github.com/Azure/azure-dev/releases/tag/azure-dev-cli_1.23.0. I assume this code should handle that scenario too.

Code after:
                }

                // If a claims challenge was provided we attempted to invoke 'azd auth token' including the claims so azd can persist them.
                // Since azd cannot complete the authentication non-interactively it returns an error instructing the user to run 'azd auth login'.
                // Surface explicit guidance to the caller (never fall through when part of a chain) so they can remediate the challenge.
                if (!string.IsNullOrWhiteSpace(context.Claims))
                {
                    string loginCommand = string.IsNullOrEmpty(tenantId)
                        ? "azd auth login"
                        : $"azd auth login --tenant-id {tenantId}";
                    throw new AuthenticationFailedException(string.Format(CultureInfo.InvariantCulture, ClaimsChallengeLoginFormat, loginCommand));
                }

                bool isWinError = errorText.StartsWith(WinAzdCliError, StringComparison.CurrentCultureIgnoreCase);

                bool isOtherOsError = AzdNotFoundPattern.IsMatch(errorText);

                if (isWinError || isOtherOsError)
                {
                    throw new CredentialUnavailableException(AzdCliNotInstalled);
                }

                bool isAADSTSError = errorText.Contains("AADSTS");
                bool isLoginError  = errorText.IndexOf("azd auth login", StringComparison.OrdinalIgnoreCase) != -1;

                if (isLoginError && !isAADSTSError)
                {
                    throw new CredentialUnavailableException(AzdNotLogIn);
                }

                bool isRefreshTokenFailedError = errorText.IndexOf(AzdCliFailedError, StringComparison.OrdinalIgnoreCase) != -1 &&
                                                 errorText.IndexOf(RefreshTokeExpired, StringComparison.OrdinalIgnoreCase) != -1 ||
                                                 errorText.IndexOf("CLIInternalError", StringComparison.OrdinalIgnoreCase) != -1;

                if (isRefreshTokenFailedError)
                {
                    throw new CredentialUnavailableException(InteractiveLoginRequired);
                }

                if (_isChainedCredential)
                {
                    throw new CredentialUnavailableException($"{AzdCliFailedError} {Troubleshoot} {errorText}");
                }
                else
                {
                    throw new AuthenticationFailedException($"{AzdCliFailedError} {Troubleshoot} {errorText}");
                }
            }

            AccessToken token = DeserializeOutput(output);
            if (_logAccountDetails)