comisai 1.0.34 → 1.0.36

package/node_modules/@comis/agent/dist/model/oauth-identity.js

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth identity extraction for Codex JWTs.
+ *
+ * Decodes the access-token JWT payload (no signature verification — pi-ai's
+ * token exchange validated the source) and resolves the canonical identity
+ * for use in profile IDs.
+ *
+ * Verbatim port of OpenClaw's openai-codex-auth-identity.ts
+ * plus the email-redaction helper.
+ *
+ * @module
+ */
+const PROFILE_CLAIM_NS = "https://api.openai.com/profile";
+function trimNonEmptyString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+/**
+ * Decode the payload segment of a JWT.
+ * Returns null on any malformed input (wrong segment count, bad base64url,
+ * invalid JSON, non-object payload). Returning null is a sentinel, not
+ * silent error swallowing.
+ */
+export function decodeCodexJwtPayload(accessToken) {
+    if (typeof accessToken !== "string")
+        return null;
+    const parts = accessToken.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const decoded = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
+        const parsed = JSON.parse(decoded);
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the canonical stable subject for fallback profile naming.
+ * Priority: chatgpt_account_user_id > chatgpt_user_id > user_id > iss|sub > sub.
+ */
+export function resolveCodexStableSubject(payload) {
+    const candidates = [
+        trimNonEmptyString(payload.chatgpt_account_user_id),
+        trimNonEmptyString(payload.chatgpt_user_id),
+        trimNonEmptyString(payload.user_id),
+        (() => {
+            const iss = trimNonEmptyString(payload.iss);
+            const sub = trimNonEmptyString(payload.sub);
+            if (iss && sub)
+                return iss + "|" + sub;
+            return undefined;
+        })(),
+        trimNonEmptyString(payload.sub),
+    ];
+    for (const c of candidates)
+        if (c)
+            return c;
+    return undefined;
+}
+/**
+ * Resolve the canonical email + profileName for a Codex identity.
+ * Priority for email: explicit `opts.email` > JWT `https://api.openai.com/profile.email`.
+ * profileName = email when available, else `id-<base64url(stableSubject)>`.
+ */
+export function resolveCodexAuthIdentity(opts) {
+    const explicit = trimNonEmptyString(opts.email);
+    const payload = decodeCodexJwtPayload(opts.accessToken);
+    let email = explicit;
+    if (!email && payload) {
+        // eslint-disable-next-line security/detect-object-injection -- PROFILE_CLAIM_NS is a literal module constant, not user input
+        const profile = payload[PROFILE_CLAIM_NS];
+        if (profile !== null && typeof profile === "object" && !Array.isArray(profile)) {
+            email = trimNonEmptyString(profile.email);
+        }
+    }
+    if (email)
+        return { email, profileName: email };
+    if (payload) {
+        const subject = resolveCodexStableSubject(payload);
+        if (subject) {
+            const subjectB64 = Buffer.from(subject, "utf8").toString("base64url");
+            return { email: undefined, profileName: "id-" + subjectB64 };
+        }
+    }
+    return { email: undefined, profileName: undefined };
+}
+/**
+ * Extract the access-token expiry as milliseconds since epoch.
+ * The JWT exp claim is in seconds (RFC 7519); we multiply by 1000 to match
+ * pi-ai's OAuthCredentials.expires unit (ms).
+ * Accepts numeric `exp` and digit-only string `exp`.
+ */
+export function resolveCodexAccessTokenExpiry(accessToken) {
+    const payload = decodeCodexJwtPayload(accessToken);
+    if (!payload)
+        return undefined;
+    const expRaw = payload.exp;
+    let expSec;
+    if (typeof expRaw === "number" && Number.isFinite(expRaw)) {
+        expSec = expRaw;
+    }
+    else if (typeof expRaw === "string" && /^\d+$/.test(expRaw)) {
+        expSec = Number(expRaw);
+    }
+    if (expSec === undefined)
+        return undefined;
+    return expSec * 1000;
+}
+/**
+ * Semi-redact an email for safe inclusion in logs.
+ * Format: first 2 chars + ellipsis + last char of local-part, then "@" + full domain.
+ * Edge cases:
+ *  - undefined input → undefined
+ *  - input without "@" → returned unchanged
+ *  - 1-char local-part → "…@<domain>"
+ *  - 2-char local-part → "<first>…<last>@<domain>" (single char on each side)
+ */
+export function redactEmailForLog(email) {
+    if (email === undefined)
+        return undefined;
+    const atIdx = email.indexOf("@");
+    if (atIdx < 0)
+        return email;
+    const local = email.slice(0, atIdx);
+    const domain = email.slice(atIdx + 1);
+    if (local.length === 0)
+        return email;
+    if (local.length === 1)
+        return "…@" + domain;
+    if (local.length === 2)
+        return local.charAt(0) + "…" + local.charAt(1) + "@" + domain;
+    return local.slice(0, 2) + "…" + local.charAt(local.length - 1) + "@" + domain;
+}

package/node_modules/@comis/agent/dist/model/oauth-login-runner.d.ts

@@ -0,0 +1,99 @@
+/**
+ * OAuth login orchestrator for OpenAI Codex.
+ *
+ * Wraps pi-ai's loginOpenAICodex with VPS-aware handlers, manual-paste
+ * fallback (15s + 1s grace mirroring OpenClaw), and error rewriting for
+ * 2 user-friendly mappings (unsupported_region, callback_validation_failed)
+ * + 1 identity-decode error path. Returns Result<LoginRunnerSuccess, LoginError>
+ * per AGENTS.md §2.1 — never throws at the public boundary.
+ *
+ * Both the CLI (`comis auth login`) and wizard step 04 OpenAI OAuth branch
+ * import and call loginOpenAICodexOAuth — this is the single shared runner.
+ *
+ * Pi-ai (0.71.0) owns the protocol: PKCE generation, the local callback
+ * server (hardcoded 127.0.0.1:1455), the token exchange POST to
+ * https://auth.openai.com/oauth/token. This module owns the UX: browser-open
+ * vs manual-paste, fallback timing, error mapping, identity derivation via
+ * resolveCodexAuthIdentity.
+ *
+ * Logging discipline (CLAUDE.md): submodule: "oauth-login" on every call.
+ * NEVER log access tokens, refresh tokens, PKCE state, or callback `code`.
+ * Identity in success logs uses redactEmailForLog (semi-redacted).
+ *
+ * @module
+ */
+import type { Result } from "@comis/shared";
+import type { ComisLogger } from "@comis/infra";
+/**
+ * Minimal prompter shape used by the runner. Defined locally — the runner
+ * cannot import WizardPrompter from @comis/cli (cli depends on agent, not
+ * the reverse — AGENTS.md §1 hexagonal architecture).
+ *
+ * Production: @comis/cli's WizardPrompter STRUCTURALLY satisfies this
+ * (TypeScript structural typing); the CLI passes its WizardPrompter
+ * instance directly. Test: build a small mock object with the required
+ * methods.
+ */
+export interface RunnerPrompter {
+    text(opts: {
+        message: string;
+        placeholder?: string;
+        validate?: (value: string) => string | undefined;
+    }): Promise<string>;
+    spinner(): {
+        start(msg: string): void;
+        update(msg: string): void;
+        stop(msg: string): void;
+    };
+    log: {
+        info(msg: string): void;
+        warn(msg: string): void;
+    };
+}
+/** Inputs to the public loginOpenAICodexOAuth function. */
+export interface LoginRunnerParams {
+    prompter: RunnerPrompter;
+    isRemote: boolean;
+    /**
+     * Browser opener — typically `import open from "open"` from the consumer.
+     * Stubbed in tests with a vi.fn that captures the URL. Returns
+     * Promise<unknown> because the `open` package returns Promise<ChildProcess>
+     * which the runner does not consume.
+     */
+    openUrl: (url: string) => Promise<unknown>;
+    /** Optional logger — callers without one get a no-op fallback. */
+    logger?: ComisLogger;
+    /**
+     * Login method. "browser" (default) uses pi-ai's loginOpenAICodex with
+     * local-callback-server + manual-paste fallback; "device-code" uses the
+     * OpenAI proprietary 3-step device-code flow (no clipboard, suitable for
+     * SSH sessions). Only "openai-codex" supports "device-code"; the CLI
+     * rejects other providers at parse time.
+     */
+    method?: "browser" | "device-code";
+}
+/** Error codes returned by the runner. */
+export interface LoginError {
+    code: "unsupported_region" | "callback_validation_failed" | "callback_timeout" | "identity_decode_failed";
+    message: string;
+    hint: string;
+}
+/** Successful-login payload — caller persists this via OAuthCredentialStorePort. */
+export interface LoginRunnerSuccess {
+    access: string;
+    refresh: string;
+    expires: number;
+    accountId?: string;
+    email?: string;
+    displayName?: string;
+    /** Canonical "openai-codex:<email>" or "openai-codex:id-<base64url>" form. */
+    profileId: string;
+}
+/**
+ * Run the interactive OAuth login for OpenAI Codex.
+ *
+ * Returns ok({access, refresh, expires, accountId?, email?, displayName?,
+ * profileId}) on success, err({code, message, hint}) on failure. NEVER
+ * throws — the caller pattern-matches on result.ok.
+ */
+export declare function loginOpenAICodexOAuth(params: LoginRunnerParams): Promise<Result<LoginRunnerSuccess, LoginError>>;

package/node_modules/@comis/agent/dist/model/oauth-login-runner.js

@@ -0,0 +1,374 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth login orchestrator for OpenAI Codex.
+ *
+ * Wraps pi-ai's loginOpenAICodex with VPS-aware handlers, manual-paste
+ * fallback (15s + 1s grace mirroring OpenClaw), and error rewriting for
+ * 2 user-friendly mappings (unsupported_region, callback_validation_failed)
+ * + 1 identity-decode error path. Returns Result<LoginRunnerSuccess, LoginError>
+ * per AGENTS.md §2.1 — never throws at the public boundary.
+ *
+ * Both the CLI (`comis auth login`) and wizard step 04 OpenAI OAuth branch
+ * import and call loginOpenAICodexOAuth — this is the single shared runner.
+ *
+ * Pi-ai (0.71.0) owns the protocol: PKCE generation, the local callback
+ * server (hardcoded 127.0.0.1:1455), the token exchange POST to
+ * https://auth.openai.com/oauth/token. This module owns the UX: browser-open
+ * vs manual-paste, fallback timing, error mapping, identity derivation via
+ * resolveCodexAuthIdentity.
+ *
+ * Logging discipline (CLAUDE.md): submodule: "oauth-login" on every call.
+ * NEVER log access tokens, refresh tokens, PKCE state, or callback `code`.
+ * Identity in success logs uses redactEmailForLog (semi-redacted).
+ *
+ * @module
+ */
+import { ok, err } from "@comis/shared";
+import { loginOpenAICodex } from "@mariozechner/pi-ai/oauth";
+import { resolveCodexAuthIdentity, redactEmailForLog, } from "./oauth-identity.js";
+import { rewriteOAuthError } from "./oauth-errors.js";
+import { loginOpenAICodexDeviceCode, } from "./oauth-device-code.js";
+// ---------------------------------------------------------------------------
+// Internal types + constants
+// ---------------------------------------------------------------------------
+const PROVIDER = "openai-codex";
+const ORIGINATOR = "comis"; // NOT "openclaw"
+/**
+ * Manual-paste fallback timing — exact mirror of OpenClaw's
+ * provider-openai-codex-oauth.ts:15-16 constants.
+ */
+const localManualFallbackDelayMs = 15_000;
+const localManualFallbackGraceMs = 1_000;
+const validateRequiredInput = (value) => value.trim().length > 0 ? undefined : "Required";
+// ---------------------------------------------------------------------------
+// Internal: VPS-aware OAuth handlers (port from OpenClaw provider-oauth-flow.ts;
+// replace runtime.log with prompter.log.info)
+// ---------------------------------------------------------------------------
+function createVpsAwareOAuthHandlers(params) {
+    const manualPromptMessage = params.manualPromptMessage ?? "Paste the redirect URL";
+    let manualCodePromise;
+    return {
+        onAuth: async ({ url }) => {
+            if (params.isRemote) {
+                params.spin.stop("OAuth URL ready");
+                // Use prompter.log.info, NOT prompter.note, mid-spinner (clack note
+                // tears apart spinner display).
+                params.prompter.log.info(`\nOpen this URL in your LOCAL browser:\n\n${url}\n`);
+                manualCodePromise = params.prompter.text({
+                    message: manualPromptMessage,
+                    validate: validateRequiredInput,
+                });
+                return;
+            }
+            params.spin.update(params.localBrowserMessage);
+            await params.openUrl(url);
+            params.prompter.log.info(`Open: ${url}`);
+        },
+        onPrompt: async (prompt) => {
+            if (manualCodePromise)
+                return manualCodePromise;
+            return params.prompter.text({
+                message: prompt.message,
+                placeholder: prompt.placeholder,
+                validate: validateRequiredInput,
+            });
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Internal: Manual-paste fallback race (port from OpenClaw
+// provider-openai-codex-oauth.ts:15-131)
+// ---------------------------------------------------------------------------
+function waitForDelayOrLoginSettle(params) {
+    return new Promise((resolve) => {
+        let finished = false;
+        const finish = (outcome) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timeoutHandle);
+            resolve(outcome);
+        };
+        const timeoutHandle = setTimeout(() => finish("delay"), params.delayMs);
+        params.waitForLoginToSettle.then(() => finish("settled"), () => finish("settled"));
+    });
+}
+function createNeverSettlingPromptResult() {
+    return new Promise(() => undefined);
+}
+function createManualCodeInputHandler(params) {
+    if (params.isRemote) {
+        return async () => params.onPrompt({
+            message: "Paste the authorization code (or full redirect URL):",
+        });
+    }
+    return async () => {
+        if (!params.hasBrowserAuthStarted()) {
+            params.spin.update("Local OAuth callback was unavailable. Paste the redirect URL to continue…");
+            return params.onPrompt({
+                message: "Paste the authorization code (or full redirect URL):",
+            });
+        }
+        const outcome = await waitForDelayOrLoginSettle({
+            delayMs: localManualFallbackDelayMs,
+            waitForLoginToSettle: params.waitForLoginToSettle,
+        });
+        if (outcome === "settled")
+            return createNeverSettlingPromptResult();
+        const settledDuringGraceWindow = await waitForDelayOrLoginSettle({
+            delayMs: localManualFallbackGraceMs,
+            waitForLoginToSettle: params.waitForLoginToSettle,
+        });
+        if (settledDuringGraceWindow === "settled")
+            return createNeverSettlingPromptResult();
+        params.spin.update("Browser callback did not finish. Paste the redirect URL to continue…");
+        return params.onPrompt({
+            message: "Paste the authorization code (or full redirect URL):",
+        });
+    };
+}
+// ---------------------------------------------------------------------------
+// Internal: Error rewriting — moved to ./oauth-errors.ts.
+// The shared module exposes 6 cases (vs the 3 + default this runner originally
+// shipped); the 2 new cases (invalid_grant, refresh_token_reused) only fire
+// from the refresh path, never from interactive login. We narrow back to
+// LoginError["code"] at the call sites via narrowToLoginError() below.
+// ---------------------------------------------------------------------------
+/**
+ * Narrow a (broader) `OAuthErrorCode` back to the 4-case `LoginError["code"]`
+ * union the runner promises at its public boundary. The login flow itself
+ * cannot produce `invalid_grant` or `refresh_token_reused` (those are
+ * refresh-only failures), but the shared classifier accepts both — coerce
+ * defensively to the timeout default. Exhaustive `switch` ensures any future
+ * `OAuthErrorCode` addition surfaces as a TypeScript compile error.
+ */
+function narrowToLoginError(code) {
+    switch (code) {
+        case "unsupported_region":
+        case "callback_validation_failed":
+        case "callback_timeout":
+        case "identity_decode_failed":
+            return code;
+        case "invalid_grant":
+        case "refresh_token_reused":
+            // Login flow does not produce these (refresh-only failures); coerce.
+            return "callback_timeout";
+    }
+}
+// ---------------------------------------------------------------------------
+// Public boundary
+// ---------------------------------------------------------------------------
+const NO_OP_LOGGER = {
+    info: () => undefined,
+    warn: () => undefined,
+    debug: () => undefined,
+    error: () => undefined,
+    trace: () => undefined,
+    fatal: () => undefined,
+    audit: () => undefined,
+    child: () => NO_OP_LOGGER,
+};
+/**
+ * Shared identity-derivation + LoginRunnerSuccess builder used by both
+ * the browser flow and the device-code flow. Extracted on the third
+ * caller per AGENTS.md §2.3 rule-of-three.
+ *
+ * Returns ok(success) on identity success; err(identity_decode_failed)
+ * when neither email nor profileName can be derived from the JWT.
+ *
+ * NEVER logs the access/refresh values — only the resulting identity
+ * (semi-redacted via redactEmailForLog) and durationMs.
+ */
+function deriveLoginRunnerSuccess(creds, logger) {
+    const identity = resolveCodexAuthIdentity({ accessToken: creds.access });
+    const identityKey = identity.email ?? identity.profileName;
+    if (!identityKey) {
+        const rewritten = rewriteOAuthError(new Error("Failed to extract accountId from token"));
+        logger.warn({
+            provider: PROVIDER,
+            errorKind: rewritten.code,
+            hint: rewritten.hint,
+            submodule: "oauth-login",
+        }, "OAuth login failed — identity could not be derived");
+        return err({
+            code: narrowToLoginError(rewritten.code),
+            message: rewritten.userMessage,
+            hint: rewritten.hint,
+        });
+    }
+    const profileId = `${PROVIDER}:${identityKey}`;
+    const success = {
+        access: creds.access,
+        refresh: creds.refresh,
+        expires: creds.expires,
+        accountId: creds.accountId,
+        email: identity.email,
+        displayName: identity.profileName,
+        profileId,
+    };
+    return ok(success);
+}
+/**
+ * Run the interactive OAuth login for OpenAI Codex.
+ *
+ * Returns ok({access, refresh, expires, accountId?, email?, displayName?,
+ * profileId}) on success, err({code, message, hint}) on failure. NEVER
+ * throws — the caller pattern-matches on result.ok.
+ */
+export async function loginOpenAICodexOAuth(params) {
+    const logger = params.logger ?? NO_OP_LOGGER;
+    const startedAt = Date.now();
+    // Device-code dispatch. Only "openai-codex" supports device-code today;
+    // the CLI rejects other providers at parse time.
+    if (params.method === "device-code") {
+        return loginOpenAICodexDeviceCodeRunner(params, logger);
+    }
+    logger.info({ provider: PROVIDER, isRemote: params.isRemote, submodule: "oauth-login" }, "OAuth login starting");
+    // Spinner lifecycle — start now; handlers update/stop it in their flow.
+    const spin = params.prompter.spinner();
+    spin.start(params.isRemote ? "Preparing OAuth URL..." : "Opening browser for OAuth...");
+    // Track whether the browser-callback path actually opened — feeds the
+    // manual-paste fallback's hasBrowserAuthStarted() check.
+    let hasBrowserAuthStarted = false;
+    let resolveLoginSettled;
+    const waitForLoginToSettle = new Promise((resolve) => {
+        resolveLoginSettled = resolve;
+    });
+    const handlers = createVpsAwareOAuthHandlers({
+        isRemote: params.isRemote,
+        prompter: params.prompter,
+        spin,
+        openUrl: params.openUrl,
+        localBrowserMessage: "Browser opened. Waiting for OAuth callback...",
+    });
+    // Wrap onAuth to flip hasBrowserAuthStarted in local mode.
+    const onAuth = async (event) => {
+        logger.debug({
+            submodule: "oauth-login",
+            // Log URL but redact the state param.
+            url: event.url.replace(/state=[^&]+/, "state=***"),
+        }, "OAuth authorize URL ready");
+        if (!params.isRemote)
+            hasBrowserAuthStarted = true;
+        return handlers.onAuth(event);
+    };
+    const onManualCodeInput = createManualCodeInputHandler({
+        isRemote: params.isRemote,
+        onPrompt: handlers.onPrompt,
+        spin,
+        waitForLoginToSettle,
+        hasBrowserAuthStarted: () => hasBrowserAuthStarted,
+    });
+    try {
+        const creds = await loginOpenAICodex({
+            onAuth,
+            onPrompt: handlers.onPrompt,
+            onManualCodeInput,
+            onProgress: (msg) => spin.update(msg),
+            originator: ORIGINATOR,
+        });
+        // Identity derivation via shared helper (rule-of-three: browser, device-code,
+        // device-code-on-failure all converge on this exact identity-derivation path).
+        const successResult = deriveLoginRunnerSuccess({
+            access: creds.access,
+            refresh: creds.refresh,
+            expires: creds.expires,
+            accountId: creds.accountId,
+        }, logger);
+        if (!successResult.ok) {
+            spin.stop("OAuth login failed");
+            resolveLoginSettled();
+            return successResult;
+        }
+        spin.stop("OAuth login complete");
+        logger.info({
+            provider: PROVIDER,
+            profileId: successResult.value.profileId,
+            durationMs: Date.now() - startedAt,
+            identity: redactEmailForLog(successResult.value.email) ??
+                successResult.value.displayName ??
+                `id-${creds.accountId ?? "<unknown>"}`,
+            submodule: "oauth-login",
+        }, "OAuth login complete");
+        resolveLoginSettled();
+        return successResult;
+    }
+    catch (caught) {
+        spin.stop("OAuth login failed");
+        const rewritten = rewriteOAuthError(caught);
+        logger.warn({
+            provider: PROVIDER,
+            errorKind: rewritten.code,
+            hint: rewritten.hint,
+            err: caught,
+            submodule: "oauth-login",
+        }, "OAuth login failed");
+        resolveLoginSettled();
+        return err({
+            code: narrowToLoginError(rewritten.code),
+            message: rewritten.userMessage,
+            hint: rewritten.hint,
+        });
+    }
+}
+/**
+ * Device-code login runner.
+ *
+ * Wraps loginOpenAICodexDeviceCode in the LoginRunnerSuccess shape so
+ * the CLI/wizard can pattern-match on the same result type regardless
+ * of method. Owns the spinner UX: start, transition on verification
+ * prompt, restart for polling, stop on completion.
+ *
+ * NEVER logs or surfaces tokens, userCode, or verifier values. Identity
+ * derivation reuses the shared deriveLoginRunnerSuccess helper.
+ */
+async function loginOpenAICodexDeviceCodeRunner(params, logger) {
+    const startedAt = Date.now();
+    logger.info({
+        provider: PROVIDER,
+        isRemote: params.isRemote,
+        method: "device-code",
+        submodule: "oauth-login",
+    }, "Device-code OAuth login starting");
+    const spin = params.prompter.spinner();
+    spin.start("Requesting device code…");
+    const result = await loginOpenAICodexDeviceCode({
+        onVerification: (prompt) => {
+            spin.stop("Device code ready");
+            params.prompter.log.info("\nOpen this URL on any device (your phone, another desktop, etc.):\n\n" +
+                `  ${prompt.verificationUrl}\n\n` +
+                `Enter the code: ${prompt.userCode}\n\n` +
+                "(this code expires in 15 minutes)\n");
+            spin.start("Waiting for authorization (polling every 5s)…");
+        },
+        onProgress: (msg) => {
+            spin.update(msg);
+        },
+    });
+    if (!result.ok) {
+        spin.stop("OAuth login failed");
+        logger.warn({
+            provider: PROVIDER,
+            errorKind: result.error.code,
+            hint: result.error.hint,
+            submodule: "oauth-login",
+        }, "Device-code login failed");
+        return err(result.error);
+    }
+    const successResult = deriveLoginRunnerSuccess(result.value, logger);
+    if (!successResult.ok) {
+        spin.stop("OAuth login failed");
+        return successResult;
+    }
+    spin.stop("OAuth login complete");
+    logger.info({
+        provider: PROVIDER,
+        profileId: successResult.value.profileId,
+        durationMs: Date.now() - startedAt,
+        identity: redactEmailForLog(successResult.value.email) ??
+            successResult.value.displayName ??
+            "id-unknown",
+        submodule: "oauth-login",
+    }, "Device-code login complete");
+    return successResult;
+}

package/node_modules/@comis/agent/dist/model/oauth-tls-preflight.d.ts

@@ -0,0 +1,58 @@
+/**
+ * OAuth TLS preflight for OpenAI Codex `auth.openai.com`.
+ *
+ * Issues a single 5-second `fetch` GET against the OAuth authorize endpoint
+ * and classifies failures as `tls-cert` (system CA bundle missing/broken;
+ * fixable via `apt install ca-certificates` etc.) or `network` (DNS,
+ * firewall, proxy — operator action required).
+ *
+ * Verbatim port of OpenClaw's provider-openai-codex-oauth-tls.ts minus the
+ * Homebrew prefix-resolution branch and minus the `note()` UI (caller decides
+ * how to surface the result; this module is pure).
+ *
+ * The probe URL uses the public OpenAI Codex client_id
+ * `app_EMoamEEZ73f0CkXaXp7hrann` (NOT a Comis-distinct value) to avoid
+ * fingerprinting in OpenAI logs.
+ *
+ * This module never logs — the caller is responsible for surfacing
+ * the result via Pino (daemon) or DoctorFinding (CLI). Per AGENTS.md §2.4
+ * no `@comis/infra` import.
+ *
+ * @module
+ */
+/** Discriminator for non-OK preflight outcomes. */
+export type TlsPreflightFailureKind = "tls-cert" | "network";
+/**
+ * Discriminated union returned by runOAuthTlsPreflight.
+ *
+ * NOTE on Result<T,E> deviation: this shape predates AGENTS.md §2.1 in
+ * the OpenClaw port. Callers pattern-match on `.kind` for actionable
+ * routing, which is more ergonomic than `.error.kind`.
+ */
+export type TlsPreflightResult = {
+    ok: true;
+} | {
+    ok: false;
+    kind: TlsPreflightFailureKind;
+    /** OpenSSL error code when available (e.g. UNABLE_TO_GET_ISSUER_CERT_LOCALLY). */
+    code?: string;
+    /** Raw error string for log `err` field — safe to surface to operators. */
+    message: string;
+};
+/** Options for the preflight probe. */
+export interface RunOAuthTlsPreflightOptions {
+    /** Defaults to 5000 ms (matches OpenClaw doctor variant; daemon-boot caller passes 4000). */
+    timeoutMs?: number;
+    /** Dependency-injected fetch — used by tests; defaults to globalThis.fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Issue a single TLS preflight GET against auth.openai.com/oauth/authorize.
+ *
+ * Resolves to {ok:true} on any HTTP response (302 included — that's the
+ * expected success path with redirect:"manual"). Resolves to {ok:false,
+ * kind, code?, message} on fetch error.
+ *
+ * Never throws.
+ */
+export declare function runOAuthTlsPreflight(opts?: RunOAuthTlsPreflightOptions): Promise<TlsPreflightResult>;