PatWatch

Small Windows desktop utility that watches the expiry of personal access tokens — Azure DevOps first, GitHub and anything else by hand — and warns before one runs out. Avalonia 11 / .NET 10, ops-console look, lives in the tray.

What it does

• Azure DevOps accounts — give PatWatch a PAT of its own for an organization and it lists every PAT of that user through the Token Admin API: name, scopes, created / expires, whether it is still valid. The PAT used for that needs full access or the "Token administration" scope (the API answers 401 otherwise). It is stored DPAPI-encrypted for the current user; the azdo-pat secret of the TomLabs vault (~/.tomlabs) can be taken over with one click.
• Tracked tokens — for what no API can list: a GitHub PAT, a token of an organization without a suitable PAT, a NuGet key, anything. Name, provider, where it is used, expiry date and optionally the token value itself. With the value stored PatWatch probes it on every check: Azure DevOps answers whether it still works, GitHub also reports the expiry date (github-authentication-token-expiration), so the date fills itself in.
• Status per token: OK, EXPIRING (within the warning window, 14 days by default), EXPIRED, REVOKED (the provider refuses it although its date has not passed), UNKNOWN (no date). Colours in the table, the sidebar dots and the header chips; the filters are Active (everything not expired or refused), Attention (expiring, expired, refused), Expired (expired and refused) and All, plus full-text search over name, organization, scopes and usage. An empty table always says how many tokens the filter is hiding.
• A refusal is explained rather than just coloured: the row's tooltip and the inspector spell out what was asked and what came back ("dev.azure.com/Lineup refused the token: it is revoked or expired, or it belongs to another organization or service"). A stored value that cannot be asked about sensibly — a token of a service PatWatch does not speak to — gets Don't ask the provider about this token, and only the date counts from then on.
• Background check every few hours while PatWatch runs — in the window or hidden in the tray — and a Windows toast once a day per token that needs attention. Start with Windows starts it minimized to the tray.
• The tray icon is the indicator: the key turns amber when a token expires within the warning window and red once one has expired, and its tooltip names the token that runs out first. The three variants are drawn by tools/Make-Icons.ps1 from the accent, warn and error colours of the theme.
• Ops-console UI: System / Light / Dark theme (System follows Windows live), command palette (Ctrl+K), Settings and Logs tabs, self-update from the TomLabs app store (stable = tagged releases, nightly = every push).

Keyboard

Files

PATWATCH_DATA_DIR=<folder> runs against another data folder (logs then go to <folder>\logs); PATWATCH_NOW=<ISO date> freezes the clock the statuses are evaluated against (UI fixtures).

Command line

PatWatch                 open the window
PatWatch --minimized     start hidden in the tray (what "Start with Windows" uses)
PatWatch --health        print {"status":"Healthy","version":"…","name":"patwatch"} and exit
PatWatch --headless      run without a window for scripted UI checks (see CLAUDE.md)

Build

git clone https://tomlabscloud.visualstudio.com/PatWatch/_git/PatWatch
dotnet build PatWatch.slnx
dotnet test tests/PatWatch.Tests/PatWatch.Tests.csproj
dotnet publish src/PatWatch/PatWatch.csproj -c Release        # portable self-contained PatWatch.exe

Releases are built by azure-pipelines.yml through the app store's publish-desktop-app.yml template: every push to master feeds the nightly channel, a v* tag the stable channel. The version comes from VersionPrefix in src/PatWatch/PatWatch.csproj and is shown in the window header. See CHANGELOG.md.

Why not the PAT Lifecycle API?

Azure DevOps has a newer _apis/tokens/pats API, but it accepts Microsoft Entra tokens only — not PATs, and not at all for organizations backed by a Microsoft account. The older Token Admin API (_apis/tokenadmin/…) works with a PAT that carries the vso.tokenadministration scope, which is what PatWatch uses. Where neither is available, track the token by hand.