comisai 1.0.34 → 1.0.36

package/node_modules/@comis/agent/dist/model/oauth-device-code.js

@@ -0,0 +1,302 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth device-code login for OpenAI Codex.
+ *
+ * Port of the upstream device-code reference module with Comis-specific
+ * adaptations:
+ *   1. ORIGINATOR header is the literal "comis".
+ *   2. The cosmetic version-header lookup is DROPPED — header is
+ *      informational; CLAUDE.md forbids reading runtime env in library code.
+ *   3. trimNonEmptyString is INLINE (3-line helper) per AGENTS.md §2.3.
+ *   4. resolveCodexAccessTokenExpiry is imported from Comis's
+ *      oauth-identity.ts module (same signature as the upstream variant).
+ *   5. Public boundary returns Result<T,E> per AGENTS.md §2.1 — internal
+ *      helpers still throw, but the top-level loginOpenAICodexDeviceCode
+ *      wraps everything in try/catch + rewriteOAuthError + narrowing.
+ *
+ * Protocol: OpenAI's proprietary 3-step device-code flow (NOT RFC 8628):
+ *   1. POST /api/accounts/deviceauth/usercode -> device_auth_id + user_code
+ *   2. Poll POST /api/accounts/deviceauth/token (403/404 = pending, 200 =
+ *      authorization_code + code_verifier; verifier comes FROM the server)
+ *   3. POST /oauth/token grant_type=authorization_code -> tokens
+ *
+ * This module never logs — the caller (oauth-login-runner.ts) is responsible
+ * for surfacing progress via prompter.log.info / Pino. Per AGENTS.md §2.4 no
+ * logger import.
+ *
+ * @module
+ */
+import { ok, err } from "@comis/shared";
+import { rewriteOAuthError } from "./oauth-errors.js";
+import { resolveCodexAccessTokenExpiry } from "./oauth-identity.js";
+// -------- Constants --------
+const OPENAI_AUTH_BASE_URL = "https://auth.openai.com";
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const OPENAI_CODEX_DEVICE_CODE_TIMEOUT_MS = 15 * 60_000;
+const OPENAI_CODEX_DEVICE_CODE_DEFAULT_INTERVAL_MS = 5_000;
+const OPENAI_CODEX_DEVICE_CODE_MIN_INTERVAL_MS = 1_000;
+const OPENAI_CODEX_DEVICE_CALLBACK_URL = `${OPENAI_AUTH_BASE_URL}/deviceauth/callback`;
+const ORIGINATOR = "comis";
+const VERIFICATION_URL = `${OPENAI_AUTH_BASE_URL}/codex/device`;
+// -------- Helpers (port verbatim from upstream, with Comis adaptations) --------
+/**
+ * INLINE 3-line helper per AGENTS.md §2.3 (rule of three not met — same
+ * shape as the helper in oauth-identity.ts but kept local to avoid coupling).
+ */
+function trimNonEmptyString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+/**
+ * Build the 3-key header set for the device-code flow.
+ * Adaptation vs upstream: drop the cosmetic version-header lookup
+ * (CLAUDE.md §2.2). Header values are fixed strings — no env reads.
+ */
+function resolveOpenAICodexDeviceCodeHeaders(contentType) {
+    return {
+        "Content-Type": contentType,
+        originator: ORIGINATOR,
+        "User-Agent": ORIGINATOR,
+    };
+}
+function normalizePositiveMilliseconds(value) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        return Math.trunc(value * 1000);
+    }
+    if (typeof value === "string" && /^\d+$/.test(value.trim())) {
+        const seconds = Number.parseInt(value.trim(), 10);
+        return seconds > 0 ? seconds * 1000 : undefined;
+    }
+    return undefined;
+}
+function normalizeTokenLifetimeMs(value) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        return Math.trunc(value * 1000);
+    }
+    if (typeof value === "string" && /^\d+$/.test(value.trim())) {
+        return Number.parseInt(value.trim(), 10) * 1000;
+    }
+    return undefined;
+}
+function parseJsonObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Strip ANSI/control characters from upstream error bodies before bubbling
+ * the message to a user-facing surface. Defends against terminal hijack via
+ * malicious error responses.
+ */
+function sanitizeDeviceCodeErrorText(value) {
+    const esc = String.fromCharCode(0x1b);
+    // eslint-disable-next-line security/detect-non-literal-regexp -- regex built from module constants only (String.fromCharCode literal); no user input reaches the constructor
+    const ansiCsiRegex = new RegExp(`${esc}\\[[\\u0020-\\u003f]*[\\u0040-\\u007e]`, "g");
+    // eslint-disable-next-line security/detect-non-literal-regexp -- regex built from module constants only
+    const osc8Regex = new RegExp(`${esc}\\]8;;.*?${esc}\\\\|${esc}\\]8;;${esc}\\\\`, "g");
+    const c0Start = String.fromCharCode(0x00);
+    const c0End = String.fromCharCode(0x1f);
+    const del = String.fromCharCode(0x7f);
+    const c1Start = String.fromCharCode(0x80);
+    const c1End = String.fromCharCode(0x9f);
+    // eslint-disable-next-line security/detect-non-literal-regexp -- regex built from module constants only
+    const controlCharsRegex = new RegExp(`[${c0Start}-${c0End}${del}${c1Start}-${c1End}]`, "g");
+    return value
+        .replace(osc8Regex, "")
+        .replace(ansiCsiRegex, "")
+        .replace(controlCharsRegex, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+function resolveNextDeviceCodePollDelayMs(intervalMs, deadlineMs) {
+    const remainingMs = Math.max(0, deadlineMs - Date.now());
+    return Math.min(Math.max(intervalMs, OPENAI_CODEX_DEVICE_CODE_MIN_INTERVAL_MS), remainingMs);
+}
+function formatDeviceCodeError(params) {
+    const body = parseJsonObject(params.bodyText);
+    const error = trimNonEmptyString(body?.error);
+    const description = trimNonEmptyString(body?.error_description);
+    const safeError = error ? sanitizeDeviceCodeErrorText(error) : undefined;
+    const safeDescription = description ? sanitizeDeviceCodeErrorText(description) : undefined;
+    if (safeError && safeDescription) {
+        return `${params.prefix}: ${safeError} (${safeDescription})`;
+    }
+    if (safeError) {
+        return `${params.prefix}: ${safeError}`;
+    }
+    const bodyText = sanitizeDeviceCodeErrorText(params.bodyText);
+    return bodyText
+        ? `${params.prefix}: HTTP ${params.status} ${bodyText}`
+        : `${params.prefix}: HTTP ${params.status}`;
+}
+async function requestOpenAICodexDeviceCode(fetchFn) {
+    const response = await fetchFn(`${OPENAI_AUTH_BASE_URL}/api/accounts/deviceauth/usercode`, {
+        method: "POST",
+        headers: resolveOpenAICodexDeviceCodeHeaders("application/json"),
+        body: JSON.stringify({
+            client_id: OPENAI_CODEX_CLIENT_ID,
+        }),
+    });
+    const bodyText = await response.text();
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new Error("OpenAI Codex device code login is not enabled for this server. Use ChatGPT OAuth instead.");
+        }
+        throw new Error(formatDeviceCodeError({
+            prefix: "OpenAI device code request failed",
+            status: response.status,
+            bodyText,
+        }));
+    }
+    const body = parseJsonObject(bodyText);
+    const deviceAuthId = trimNonEmptyString(body?.device_auth_id);
+    const userCode = trimNonEmptyString(body?.user_code) ?? trimNonEmptyString(body?.usercode);
+    if (!deviceAuthId || !userCode) {
+        throw new Error("OpenAI device code response was missing the device code or user code.");
+    }
+    return {
+        deviceAuthId,
+        userCode,
+        verificationUrl: VERIFICATION_URL,
+        intervalMs: normalizePositiveMilliseconds(body?.interval) ?? OPENAI_CODEX_DEVICE_CODE_DEFAULT_INTERVAL_MS,
+    };
+}
+async function pollOpenAICodexDeviceCode(params) {
+    const deadline = Date.now() + OPENAI_CODEX_DEVICE_CODE_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        const response = await params.fetchFn(`${OPENAI_AUTH_BASE_URL}/api/accounts/deviceauth/token`, {
+            method: "POST",
+            headers: resolveOpenAICodexDeviceCodeHeaders("application/json"),
+            body: JSON.stringify({
+                device_auth_id: params.deviceAuthId,
+                user_code: params.userCode,
+            }),
+        });
+        const bodyText = await response.text();
+        if (response.ok) {
+            const body = parseJsonObject(bodyText);
+            const authorizationCode = trimNonEmptyString(body?.authorization_code);
+            const codeVerifier = trimNonEmptyString(body?.code_verifier);
+            if (!authorizationCode || !codeVerifier) {
+                throw new Error("OpenAI device authorization response was missing the exchange code.");
+            }
+            return {
+                authorizationCode,
+                codeVerifier,
+            };
+        }
+        if (response.status === 403 || response.status === 404) {
+            await new Promise((resolve) => setTimeout(resolve, resolveNextDeviceCodePollDelayMs(params.intervalMs, deadline)));
+            continue;
+        }
+        throw new Error(formatDeviceCodeError({
+            prefix: "OpenAI device authorization failed",
+            status: response.status,
+            bodyText,
+        }));
+    }
+    throw new Error("OpenAI device authorization timed out after 15 minutes.");
+}
+async function exchangeOpenAICodexDeviceCode(params) {
+    const response = await params.fetchFn(`${OPENAI_AUTH_BASE_URL}/oauth/token`, {
+        method: "POST",
+        headers: resolveOpenAICodexDeviceCodeHeaders("application/x-www-form-urlencoded"),
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code: params.authorizationCode,
+            redirect_uri: OPENAI_CODEX_DEVICE_CALLBACK_URL,
+            client_id: OPENAI_CODEX_CLIENT_ID,
+            code_verifier: params.codeVerifier,
+        }),
+    });
+    const bodyText = await response.text();
+    if (!response.ok) {
+        throw new Error(formatDeviceCodeError({
+            prefix: "OpenAI device token exchange failed",
+            status: response.status,
+            bodyText,
+        }));
+    }
+    const body = parseJsonObject(bodyText);
+    const access = trimNonEmptyString(body?.access_token);
+    const refresh = trimNonEmptyString(body?.refresh_token);
+    if (!access || !refresh) {
+        throw new Error("OpenAI token exchange succeeded but did not return OAuth tokens.");
+    }
+    const expiresInMs = normalizeTokenLifetimeMs(body?.expires_in);
+    const expires = expiresInMs !== undefined
+        ? Date.now() + expiresInMs
+        : (resolveCodexAccessTokenExpiry(access) ?? Date.now());
+    return {
+        access,
+        refresh,
+        expires,
+    };
+}
+/**
+ * Narrow the (broader) OAuthErrorCode catalogue back to the 4-case
+ * LoginError["code"] union the public boundary promises. Mirror of
+ * oauth-login-runner.ts:269-281 — duplicated verbatim because each call
+ * site has a distinct LoginError-shaped union (rule of three not met).
+ */
+function narrowToLoginError(code) {
+    switch (code) {
+        case "unsupported_region":
+        case "callback_validation_failed":
+        case "callback_timeout":
+        case "identity_decode_failed":
+            return code;
+        case "invalid_grant":
+        case "refresh_token_reused":
+            return "callback_timeout";
+    }
+}
+// -------- Public boundary --------
+/**
+ * Run the OpenAI Codex device-code flow end-to-end.
+ *
+ * Returns ok({ access, refresh, expires }) on success, err({ code, message,
+ * hint }) on failure. NEVER throws — internal helpers throw, the boundary
+ * wraps everything in try/catch and pipes through rewriteOAuthError +
+ * narrowToLoginError.
+ */
+export async function loginOpenAICodexDeviceCode(params) {
+    const fetchFn = params.fetchFn ?? fetch;
+    try {
+        params.onProgress?.("Requesting device code…");
+        const deviceCode = await requestOpenAICodexDeviceCode(fetchFn);
+        await params.onVerification({
+            verificationUrl: deviceCode.verificationUrl,
+            userCode: deviceCode.userCode,
+            expiresInMs: OPENAI_CODEX_DEVICE_CODE_TIMEOUT_MS,
+        });
+        params.onProgress?.("Waiting for device authorization…");
+        const authorization = await pollOpenAICodexDeviceCode({
+            fetchFn,
+            deviceAuthId: deviceCode.deviceAuthId,
+            userCode: deviceCode.userCode,
+            intervalMs: deviceCode.intervalMs,
+        });
+        params.onProgress?.("Exchanging device code…");
+        const creds = await exchangeOpenAICodexDeviceCode({
+            fetchFn,
+            authorizationCode: authorization.authorizationCode,
+            codeVerifier: authorization.codeVerifier,
+        });
+        return ok(creds);
+    }
+    catch (caught) {
+        const rewritten = rewriteOAuthError(caught);
+        return err({
+            code: narrowToLoginError(rewritten.code),
+            message: rewritten.userMessage,
+            hint: rewritten.hint,
+        });
+    }
+}

package/node_modules/@comis/agent/dist/model/oauth-env.d.ts

@@ -0,0 +1,33 @@
+/**
+ * VPS / headless environment detection.
+ *
+ * Pure function: given the env block + optional override, returns true when
+ * the current process is on a remote/headless host (no DISPLAY, SSH session,
+ * etc.) and should fall back to manual-paste OAuth instead of opening a
+ * browser via the `open` package.
+ *
+ * Plumbing: --remote / --local CLI flags map to `force: "remote" | "local"`
+ * so operators can override the heuristic when it guesses wrong (e.g. tmux
+ * over SSH where DISPLAY is set by tunneling but they still want manual paste).
+ *
+ * @module
+ */
+/** Input shape for isRemoteEnvironment. Pure: no process.env reads internally. */
+export interface IsRemoteEnvironmentInput {
+    /** The env block to inspect — typically process.env at the call site. */
+    env: NodeJS.ProcessEnv;
+    /** CLI flag override: "remote" forces true; "local" forces false; absent = heuristic. */
+    force?: "remote" | "local";
+}
+/**
+ * Decide whether to skip browser-open and go straight to manual-paste.
+ *
+ * Heuristic (simplified from OpenClaw's remote-env.ts — no WAYLAND_DISPLAY,
+ * no isWSLEnv check; Comis is Linux-only per CLAUDE.md):
+ *   - force === "remote" → true
+ *   - force === "local"  → false
+ *   - SSH_CLIENT or SSH_TTY present → true
+ *   - !DISPLAY → true
+ *   - else → false
+ */
+export declare function isRemoteEnvironment(input: IsRemoteEnvironmentInput): boolean;

package/node_modules/@comis/agent/dist/model/oauth-env.js

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * VPS / headless environment detection.
+ *
+ * Pure function: given the env block + optional override, returns true when
+ * the current process is on a remote/headless host (no DISPLAY, SSH session,
+ * etc.) and should fall back to manual-paste OAuth instead of opening a
+ * browser via the `open` package.
+ *
+ * Plumbing: --remote / --local CLI flags map to `force: "remote" | "local"`
+ * so operators can override the heuristic when it guesses wrong (e.g. tmux
+ * over SSH where DISPLAY is set by tunneling but they still want manual paste).
+ *
+ * @module
+ */
+/**
+ * Decide whether to skip browser-open and go straight to manual-paste.
+ *
+ * Heuristic (simplified from OpenClaw's remote-env.ts — no WAYLAND_DISPLAY,
+ * no isWSLEnv check; Comis is Linux-only per CLAUDE.md):
+ *   - force === "remote" → true
+ *   - force === "local"  → false
+ *   - SSH_CLIENT or SSH_TTY present → true
+ *   - !DISPLAY → true
+ *   - else → false
+ */
+export function isRemoteEnvironment(input) {
+    if (input.force === "remote")
+        return true;
+    if (input.force === "local")
+        return false;
+    const env = input.env;
+    if (env.SSH_CLIENT || env.SSH_TTY)
+        return true;
+    if (!env.DISPLAY)
+        return true;
+    return false;
+}

package/node_modules/@comis/agent/dist/model/oauth-errors.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Error catalogue for OpenAI Codex OAuth flows.
+ *
+ * Pure classification: maps an unknown error (typically thrown by pi-ai's
+ * loginOpenAICodex / refreshOpenAICodexToken or our own wrappers) into a
+ * discriminated record used by both the login runner and the doctor's
+ * refresh-test.
+ *
+ * The substring matchers for `refresh_token_reused` are lifted from
+ * OpenClaw's auth-profiles/oauth.ts:117-123 (battle-tested in production
+ * for ~6 months).
+ *
+ * CRITICAL ORDERING: refresh_token_reused MUST be tested BEFORE
+ * invalid_grant — refresh_token_reused is a SPECIFIC kind of
+ * invalid_grant; the more-specific matcher must win.
+ *
+ * Field convention (CLAUDE.md): `errorKind` mirrors `code` 1:1 so Pino
+ * log calls can use `{ errorKind: result.errorKind, hint: result.hint }`
+ * directly without remapping.
+ *
+ * @module
+ */
+/** Discriminator union for the 6 classifiable OAuth error cases. */
+export type OAuthErrorCode = "unsupported_region" | "callback_validation_failed" | "invalid_grant" | "refresh_token_reused" | "identity_decode_failed" | "callback_timeout";
+/** Output record carrying both UX-facing text and Pino-log-field values. */
+export interface RewrittenOAuthError {
+    /** Discriminator. Also the `errorKind` value used in Pino logs + event payloads. */
+    code: OAuthErrorCode;
+    /** Mirror of `code` so logs can use `errorKind:` consistently per CLAUDE.md. */
+    errorKind: string;
+    /** Concrete, paste-ready message for CLI stderr. */
+    userMessage: string;
+    /** Shorter operator-action recommendation. Goes into Pino `hint` field. */
+    hint: string;
+}
+/**
+ * Classify an unknown error into a `RewrittenOAuthError`. Pure; never throws.
+ * Non-Error inputs are coerced via `String(err)` (defensive — covers
+ * primitives, null, undefined, and objects without a `.message` field).
+ */
+export declare function rewriteOAuthError(err: unknown): RewrittenOAuthError;

package/node_modules/@comis/agent/dist/model/oauth-errors.js

@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Error catalogue for OpenAI Codex OAuth flows.
+ *
+ * Pure classification: maps an unknown error (typically thrown by pi-ai's
+ * loginOpenAICodex / refreshOpenAICodexToken or our own wrappers) into a
+ * discriminated record used by both the login runner and the doctor's
+ * refresh-test.
+ *
+ * The substring matchers for `refresh_token_reused` are lifted from
+ * OpenClaw's auth-profiles/oauth.ts:117-123 (battle-tested in production
+ * for ~6 months).
+ *
+ * CRITICAL ORDERING: refresh_token_reused MUST be tested BEFORE
+ * invalid_grant — refresh_token_reused is a SPECIFIC kind of
+ * invalid_grant; the more-specific matcher must win.
+ *
+ * Field convention (CLAUDE.md): `errorKind` mirrors `code` 1:1 so Pino
+ * log calls can use `{ errorKind: result.errorKind, hint: result.hint }`
+ * directly without remapping.
+ *
+ * @module
+ */
+/**
+ * Classify an unknown error into a `RewrittenOAuthError`. Pure; never throws.
+ * Non-Error inputs are coerced via `String(err)` (defensive — covers
+ * primitives, null, undefined, and objects without a `.message` field).
+ */
+export function rewriteOAuthError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    // CRITICAL ORDERING: refresh_token_reused FIRST — it is a SPECIFIC kind
+    // of invalid_grant. Match the more specific pattern before the generic.
+    // Substring set verbatim from OpenClaw auth-profiles/oauth.ts:117-123.
+    if (/refresh_token_reused/i.test(message) ||
+        /refresh token has already been used/i.test(message) ||
+        /already been used to generate a new access token/i.test(message)) {
+        return {
+            code: "refresh_token_reused",
+            errorKind: "refresh_token_reused",
+            userMessage: "Refresh token was reused. The OpenAI account has been auto-locked for security. " +
+                "Re-authenticate with: comis auth login --provider openai-codex",
+            hint: "refresh_token_reused — re-login required",
+        };
+    }
+    if (/invalid_grant/i.test(message)) {
+        return {
+            code: "invalid_grant",
+            errorKind: "invalid_grant",
+            userMessage: "Refresh token was rejected by OpenAI (invalid_grant). " +
+                "Re-authenticate with: comis auth login --provider openai-codex",
+            hint: "invalid_grant — re-login required",
+        };
+    }
+    if (/unsupported_country_region_territory/i.test(message)) {
+        return {
+            code: "unsupported_region",
+            errorKind: "unsupported_region",
+            userMessage: "OpenAI rejected the request for this country, region, or network route. " +
+                "If you normally use a proxy, verify HTTPS_PROXY, HTTP_PROXY, or ALL_PROXY is set " +
+                "for the Comis process. NOTE: Node's built-in fetch does NOT honor HTTPS_PROXY " +
+                "by default (see docs/operations/proxy.mdx).",
+            hint: "Set HTTPS_PROXY to a US-region proxy and retry",
+        };
+    }
+    if (/state mismatch|missing authorization code/i.test(message)) {
+        return {
+            code: "callback_validation_failed",
+            errorKind: "callback_validation_failed",
+            userMessage: "Browser callback validation failed (likely a stale browser tab). Retry the login flow.",
+            hint: "Browser callback validation failed — retry",
+        };
+    }
+    if (/Failed to extract accountId/i.test(message)) {
+        return {
+            code: "identity_decode_failed",
+            errorKind: "identity_decode_failed",
+            userMessage: "The OAuth response did not contain a parseable identity claim. " +
+                "Re-run login or open an issue if the problem persists.",
+            hint: "JWT had no identity claim",
+        };
+    }
+    return {
+        code: "callback_timeout",
+        errorKind: "callback_timeout",
+        userMessage: message,
+        hint: "Restart the login flow",
+    };
+}

package/node_modules/@comis/agent/dist/model/oauth-identity.d.ts

@@ -0,0 +1,53 @@
+/**
+ * OAuth identity extraction for Codex JWTs.
+ *
+ * Decodes the access-token JWT payload (no signature verification — pi-ai's
+ * token exchange validated the source) and resolves the canonical identity
+ * for use in profile IDs.
+ *
+ * Verbatim port of OpenClaw's openai-codex-auth-identity.ts
+ * plus the email-redaction helper.
+ *
+ * @module
+ */
+/**
+ * Decode the payload segment of a JWT.
+ * Returns null on any malformed input (wrong segment count, bad base64url,
+ * invalid JSON, non-object payload). Returning null is a sentinel, not
+ * silent error swallowing.
+ */
+export declare function decodeCodexJwtPayload(accessToken: string): Record<string, unknown> | null;
+/**
+ * Resolve the canonical stable subject for fallback profile naming.
+ * Priority: chatgpt_account_user_id > chatgpt_user_id > user_id > iss|sub > sub.
+ */
+export declare function resolveCodexStableSubject(payload: Record<string, unknown>): string | undefined;
+/**
+ * Resolve the canonical email + profileName for a Codex identity.
+ * Priority for email: explicit `opts.email` > JWT `https://api.openai.com/profile.email`.
+ * profileName = email when available, else `id-<base64url(stableSubject)>`.
+ */
+export declare function resolveCodexAuthIdentity(opts: {
+    accessToken: string;
+    email?: string;
+}): {
+    email?: string;
+    profileName?: string;
+};
+/**
+ * Extract the access-token expiry as milliseconds since epoch.
+ * The JWT exp claim is in seconds (RFC 7519); we multiply by 1000 to match
+ * pi-ai's OAuthCredentials.expires unit (ms).
+ * Accepts numeric `exp` and digit-only string `exp`.
+ */
+export declare function resolveCodexAccessTokenExpiry(accessToken: string): number | undefined;
+/**
+ * Semi-redact an email for safe inclusion in logs.
+ * Format: first 2 chars + ellipsis + last char of local-part, then "@" + full domain.
+ * Edge cases:
+ *  - undefined input → undefined
+ *  - input without "@" → returned unchanged
+ *  - 1-char local-part → "…@<domain>"
+ *  - 2-char local-part → "<first>…<last>@<domain>" (single char on each side)
+ */
+export declare function redactEmailForLog(email: string | undefined): string | undefined;