Reuse TeamCity account credentials from JetBrains IDE plugin

[sugdyzhekov]

Area

Configuration (parameters, projects)

Problem or use case

When a user already has the JetBrains TeamCity IDE plugin configured (in IntelliJ IDEA, GoLand, etc.), they have already authenticated with their TeamCity server. Currently, teamcity CLI requires separate authentication via teamcity auth login, which means the user must re-enter server URL and credentials even though this information is already stored by the IDE plugin.

This creates unnecessary friction, especially for users who:

• Work across terminal and IDE frequently
• Have multiple TeamCity server configurations in their IDE
• Want a zero-config CLI experience when the IDE plugin is already set up

Proposed solution

On first run (or when no credentials are configured), teamcity CLI should detect and offer to import TeamCity connection settings from JetBrains IDE plugin configuration.

Possible behavior:

# Automatic detection during login
$ teamcity auth login
Found TeamCity server credentials in IntelliJ IDEA plugin:
  1. https://build.example.com (user: john.doe)
  2. https://ci.internal.org (user: jdoe)
Use these credentials? [Y/n]: 

# Or as an explicit import command
$ teamcity auth import --from-ide
Imported 2 server configurations from JetBrains IDE plugin.

The IDE plugin stores server connections in its configuration (typically under ~/.config/JetBrains/<Product>/options/ or the platform-specific equivalent). The CLI could read these to bootstrap its own configuration.

Key considerations:

• Support all major JetBrains IDEs (IntelliJ IDEA, GoLand, WebStorm, etc.)
• Handle multiple IDE installations and versions
• Respect token-based and password-based auth stored by the plugin
• Fall back gracefully if no IDE plugin data is found

Alternatives considered

• Shared credential store: Both CLI and IDE plugin could use a common OS keychain entry, but this would require changes on the plugin side as well.
• Environment variables: Users can set TEAMCITY_URL and TEAMCITY_TOKEN, but this is manual and doesn't leverage existing IDE config.

Contribution

• I'd be willing to submit a PR for this feature

[tiulpin]

Blocker: OAuth scope mismatch between CLI and IJ plugin

Before implementing credential sharing, the OAuth scopes need to be unified.

IJ plugin requests 5 scopes (TeamCityOAuthRequest.kt):
RUN_BUILD, VIEW_PROJECT, VIEW_BUILD_CONFIGURATION_SETTINGS, PATCH_BUILD_SOURCES, VIEW_AGENT_DETAILS

CLI requests 17 scopes (pkce.go):
The same 5 plus 12 more: CANCEL_BUILD, TAG_BUILD, COMMENT_BUILD, PIN_UNPIN_BUILD, REORDER_BUILD_QUEUE, PAUSE_ACTIVATE_BUILD_CONFIGURATION, EDIT_PROJECT, ENABLE_DISABLE_AGENT, AUTHORIZE_AGENT, ADMINISTER_AGENT, CONNECT_TO_AGENT, MANAGE_AGENT_POOLS

Both store tokens in the OS keychain (PasswordSafe on plugin side, go-keyring on CLI side). The simplest approach would be to have the CLI fall back to the plugin's keychain entry (TeamCity/<url>) when its own (tc:<url>) has no token. But the plugin's token is too narrow — most CLI commands beyond run list / run start would get 403s.

Action needed: Align the IJ plugin to request the same scopes as the CLI (or a shared superset). Once tokens have the same permissions, credential reuse becomes straightforward.