feat: add azd monitor --tail for in-terminal log streaming

[Copilot]

azd monitor currently only opens Azure Portal URLs in a browser. This adds --tail for direct CLI log streaming from deployed App Service, Azure Functions, and Container Apps resources.

# Stream logs from a deployed service (auto-discovers resources, prompts if multiple)
azd monitor --tail

Changes

• cmd/monitor.go — New --tail flag. When set, discovers deployed resources via existing resource group enumeration, filters to streamable types (Microsoft.Web/sites, Microsoft.App/containerApps), prompts for selection if multiple found, and streams logs to console.GetWriter() with Ctrl+C handling.

• pkg/azapi/appservice_logstream.go — AzureClient.GetAppServiceLogStream(): connects to Kudu SCM /api/logstream with bearer token auth. Covers both App Service and Functions targets (both are Microsoft.Web/sites).

• pkg/containerapps/logstream.go — containerAppService.GetLogStream(): resolves latest revision → lists replicas → reads ReplicaContainer.LogStreamEndpoint from the SDK → authenticates via GetAuthToken → streams response body.

• pkg/containerapps/container_app.go — Added GetLogStream to the ContainerAppService interface.

Design notes

• No azure.yaml / project config required — works purely from the provisioned environment, consistent with existing --live/--logs/--overview flags.
• Container Apps streaming uses the SDK-provided LogStreamEndpoint on ReplicaContainer + the stable GetAuthToken API, avoiding preview API versions.
• When --tail is not specified, existing behavior (default to --overview) is preserved.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• aka.ms
  • Triggering command: /home/REDACTED/work/azure-dev/azure-dev/cli/azd/azd /home/REDACTED/work/azure-dev/azure-dev/cli/azd/azd extension source add -n local -t file -l /home/REDACTED/work/azure-dev/azure-dev/cli/azd/extensions/registry.json -lang=go1.26 x_amd64/vet -I -DTNxMp6M -I x_amd64/vet --gdwarf-5 g/protobuf/types-atomic -o x_amd64/vet (dns block)
  • Triggering command: /home/REDACTED/work/azure-dev/azure-dev/cli/azd/azd /home/REDACTED/work/azure-dev/azure-dev/cli/azd/azd extension list --source local --output json x_amd64/vet -p g/grpc/grpclog -lang=go1.26 x_amd64/vet -I Wxv7f21s0 om/cenkalti/back-ifaceassert x_amd64/vet --gdwarf-5 go -o x_amd64/vet (dns block)
  • Triggering command: /home/REDACTED/work/azure-dev/azure-dev/cli/azd/azd /home/REDACTED/work/azure-dev/azure-dev/cli/azd/azd extension install azure.ai.agents --source local --version 0.1.18-preview -p t/message -lang=go1.16 x_amd64/vet -I q48QNS-ah pkg/mod/github.c-ifaceassert x_amd64/vet --gdwarf-5 g/protobuf/proto-atomic -o x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.