Experimenting [Claude Code Action](https://github.com/anthropics/claude-code-action)

Refactor conditions to check author association for triggering Claude actions.

Removed concurrency settings to allow multiple runs.

Add interactive browser sign-in for Azure Service Bus namespaces using Microsoft Entra ID, addressing issue #607.

Features:
- Authentication selector in Connect dialog (SAS / Azure Active Directory)
- Interactive browser sign-in via MSAL with persistent token cache
- Saved Entra connections persist metadata only (endpoint, auth mode, tenant ID, transport type, entity path) - no secrets stored
- Blank tenant now defaults to organizations for work or school accounts
- Azure Active Directory mode now scopes browsing to queues, topics, and subscriptions only
- Public Azure cloud only (sovereign clouds not supported)

Implementation:
- AadCredentialFactory normalizes blank tenants to organizations and shares credential instances
- ServiceBusNamespace parses and builds AAD connection strings
- ConnectForm enforces Service Bus-only AAD scope in UI
- MainForm skips Event Hubs, Notification Hubs, and Relay surfaces for AAD connections

Tests: 96 passing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add Entra ID (AAD) authentication support for Event Hub namespaces

- Add EventHubsAudience constant and audience-parameterized overloads in AadCredentialFactory
- Implement scope probe+fallback in Connect() to auto-detect Event Hub namespaces
- Replace CreateWithAzureActiveDirectory with MessagingFactory+AMQP for EventHubClient creation
- Enable Event Hub entity selection in ConnectForm for AAD connections
- Remove !isAad guard from Event Hub loading in MainForm
- Add UnauthorizedAccessException to non-retriable exceptions in RetryHelper
- Add 5 new unit tests for audience-aware caching and EventHub scope

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Cache EH MessagingFactory to avoid per-call AMQP connection overhead

Create a dedicated eventHubMessagingFactory during Connect() for Event Hub
namespaces and reuse it in CreateEventHubClient(), instead of creating a
new MessagingFactory (and AMQP connection) on every call. This prevents
connection leaks when Send Events creates multiple clients in a loop.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add resilience: auto-recreate stale EH MessagingFactory

Check IsClosed before use and catch connection-related exceptions
(MessagingCommunicationException, ObjectDisposedException,
OperationCanceledException) to recreate the factory and retry once.
Extracted CreateEventHubMessagingFactory() helper for reuse.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix PR review issues: EH namespace guard, lighter scope probe, safer error detection, thread-safe factory

- Guard loadQueues/loadTopics with !IsEventHubNamespace to prevent errors on EH namespaces
- Use GetQueues("1=2") for scope probe to avoid paging all queues on large namespaces
- Replace fragile string match "Unauthorized" with status codes "401"/"40100"
- Capture eventHubMessagingFactory in local variable to fix TOCTOU race condition

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix reconnect state leak and EH loading on SB namespaces

- Reset IsEventHubNamespace and eventHubMessagingFactory at start of
  Connect() so SAS-after-AAD reconnects don't carry stale EH state
- Gate Event Hub loading in ShowEntities on confirmed IsEventHubNamespace
  for AAD connections, preventing spurious EH enumeration on SB namespaces
- Update ConnectFormAadTests to expect EventHubEntities in AAD entity list

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix EntityPath bug: load only specified entity, handle type mismatches

When EntityPath is provided (e.g., an event hub name), the app now:
- Catches MessagingException in GetQueues/GetTopics when EntityPath
  refers to a different entity type (returns empty list instead of throwing)
- Loads only the specific event hub via GetEventHubAsync when EntityPath
  is set, instead of enumerating all event hubs
- Exposes EntityPath property on ServiceBusHelper for MainForm access

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix scope probe: revert to unfiltered GetQueues() call

The 1=2 filter is invalid OData syntax for Service Bus, causing
400 Bad Request errors on Service Bus namespaces. Revert to the
original GetQueues() call without a filter for scope validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Optimize scope probe: use QueueExists instead of GetQueues

Replace GetQueues() with QueueExists("$") for the
AAD token scope validation probe. This issues a single REST call for
one (non-existent) entity path instead of enumerating all queues,
making the scope check much faster on large namespaces.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add defensive try-catch for EH EntityPath loading in MainForm

When EntityPath refers to a non-existent event hub or wrong entity type,
GetEventHubAsync now catches MessagingException and returns an empty list
instead of propagating the error. Mirrors the pattern in ServiceBusQueue
and ServiceBusTopic.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Improve log messages for namespace type and EntityPath errors

- Log 'event hub namespace' vs 'service bus namespace' based on detected type
- Log warning when EntityPath doesn't match any event hub

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove temp summary file from repo

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix thread safety in factory caching, narrow EntityPath catches

- Add lock around eventHubMessagingFactory access in CreateEventHubClient
  to prevent TOCTOU race and factory leak under concurrent calls
- Narrow catch from MessagingException to non-transient only (!IsTransient)
  in ServiceBusQueue and ServiceBusTopic EntityPath handling
- Add WriteToLog in catch blocks for diagnosability

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove local summary file

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix duplicate EntityPath log messages on connect

Moved entity-not-found logging from ServiceBusQueue/ServiceBusTopic catch
blocks into MainForm.ShowEntities(). These utility methods are called from
both ShowEntities() and DashboardControl.LoadDataAsync(), causing each
'not a queue/topic' message to appear twice.

The catch blocks now return empty lists silently with comments explaining
that logging is the caller's responsibility. ShowEntities() logs once per
entity type when EntityPath is set and the result is empty.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Narrow scope probe to audience-mismatch only

Replace broad 401/40100 catch with IsAudienceMismatchException() helper
that distinguishes audience-mismatch (40104/InvalidAudience) from
permission-denied (40301/Manage claim required). Generic 401 still
falls through for backward compatibility when no specific substatus
is present. Prevents SB namespace misclassification as Event Hub when
user has correct audience but lacks Manage permission.

Add 5 unit tests covering all classification branches.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Close old EventHub factory before replacing it

Add ReplaceEventHubFactory() helper that Close()s the previous
MessagingFactory before assigning the new one. Applied at all three
replacement sites: reconnect reset, stale-factory retry, and initial
EH connect. Prevents AMQP connection leaks on reconnect or factory
recreation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Wrap ReplaceEventHubFactory calls in lock for TOCTOU safety

Connect() calls ReplaceEventHubFactory at two sites (reconnect reset
and initial EH connect) without holding eventHubFactoryLock. While the
UI-thread model protects these today, wrap them in the lock for
consistency with the stale-factory retry path and future safety.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>