comisai 1.0.34 → 1.0.37

package/node_modules/@comis/cli/dist/commands/providers.js

@@ -5,8 +5,7 @@
  * Provides `comis providers list` for browsing available providers from
  * the live pi-ai catalog (with daemon RPC + local fallback). Status
  * column indicates whether a provider's API key is resolvable from the
- * env (mirrors credential-resolver.ts Source B semantics from
- * 260501-2pz).
+ * env (mirrors credential-resolver.ts Source B semantics).
  *
  * Mirrors `commands/models.ts` shape -- RPC-first, local catalog
  * fallback, `--format` flag, no `set` subcommand (provider switching
@@ -64,9 +63,9 @@ async function getModelCount(provider) {
  * - `configured`  : pi-ai's `getEnvApiKey` resolves a non-empty key
  * - `missing key` : no env key found
  *
- * Mirrors `credential-resolver.ts` Source B semantics from 260501-2pz.
- * Status reflects only env-key presence; it does NOT include the key
- * value itself (T-260501-kqq-02 information-disclosure threat).
+ * Mirrors `credential-resolver.ts` Source B semantics. Status reflects
+ * only env-key presence; it does NOT include the key value itself
+ * (information-disclosure threat).
  */
 function getProviderStatus(provider) {
     if (KEYLESS_PROVIDERS.has(provider))
@@ -99,7 +98,7 @@ export function registerProvidersCommand(program) {
             }
             // Sequentially fetch model counts. With ~11-23 providers this
             // is acceptable (single-digit RPC roundtrips). N+1 batching is
-            // a v1.5 enhancement (T-260501-kqq-03 DoS disposition: accept).
+            // a v1.5 enhancement (DoS disposition: accept).
             const rows = [];
             for (const id of ids) {
                 const modelCount = await getModelCount(id);

package/node_modules/@comis/cli/dist/doctor/checks/oauth-health.d.ts

@@ -0,0 +1,39 @@
+/**
+ * OAuth health check for `comis doctor`.
+ *
+ * Per-profile diagnostics: JWT decode → expiry + numeric `secsUntilExpiry`;
+ * flag profiles expiring < 7 days as warn, expired as fail; surface
+ * schema-version mismatch from the file adapter's hard-fail verbatim
+ * (`port.list()` returns `err()` whose message already contains the version
+ * + remediation hint). Environmental sub-checks: ca-certificates bundle
+ * existence with distro-aware install hint, HTTPS_PROXY env-var heuristic
+ * (Node's built-in fetch ignores HTTPS_PROXY by default), TLS preflight
+ * against `auth.openai.com` (delegates to `runOAuthTlsPreflight`).
+ *
+ * Optional `--refresh-test` flag (default OFF): exercises a real OAuth
+ * refresh against the provider; rotates the refresh token at OpenAI's end
+ * as a side effect (--help warns the operator). Doctor does NOT persist
+ * the new credentials; the success suggestion warns the stored token is
+ * now stale.
+ *
+ * Storage mode handling: the CLI process cannot bootstrap the encrypted
+ * secrets store without `SECRETS_MASTER_KEY`, so when
+ * `appConfig.oauth.storage === "encrypted"` the per-profile sub-check
+ * returns a single skip finding pointing the operator at the daemon host.
+ *
+ * NEVER prints `profile.access` or `profile.refresh` in any DoctorFinding
+ * field. Identity labels go through `redactEmailForLog`. The token-leakage
+ * test in oauth-health.test.ts asserts no `TEST_LEAK_SENTINEL` substring
+ * leakage.
+ *
+ * @module
+ */
+import type { DoctorCheck } from "../types.js";
+/**
+ * Doctor check: OAuth subsystem health.
+ *
+ * Returns 4 baseline sub-checks (per-profile expiry × N + ca-certificates +
+ * HTTPS_PROXY + TLS preflight); +N when `context.refreshTest === true`.
+ * Never throws — every failure path returns a finding.
+ */
+export declare const oauthHealthCheck: DoctorCheck;

package/node_modules/@comis/cli/dist/doctor/checks/oauth-health.js

@@ -0,0 +1,399 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OAuth health check for `comis doctor`.
+ *
+ * Per-profile diagnostics: JWT decode → expiry + numeric `secsUntilExpiry`;
+ * flag profiles expiring < 7 days as warn, expired as fail; surface
+ * schema-version mismatch from the file adapter's hard-fail verbatim
+ * (`port.list()` returns `err()` whose message already contains the version
+ * + remediation hint). Environmental sub-checks: ca-certificates bundle
+ * existence with distro-aware install hint, HTTPS_PROXY env-var heuristic
+ * (Node's built-in fetch ignores HTTPS_PROXY by default), TLS preflight
+ * against `auth.openai.com` (delegates to `runOAuthTlsPreflight`).
+ *
+ * Optional `--refresh-test` flag (default OFF): exercises a real OAuth
+ * refresh against the provider; rotates the refresh token at OpenAI's end
+ * as a side effect (--help warns the operator). Doctor does NOT persist
+ * the new credentials; the success suggestion warns the stored token is
+ * now stale.
+ *
+ * Storage mode handling: the CLI process cannot bootstrap the encrypted
+ * secrets store without `SECRETS_MASTER_KEY`, so when
+ * `appConfig.oauth.storage === "encrypted"` the per-profile sub-check
+ * returns a single skip finding pointing the operator at the daemon host.
+ *
+ * NEVER prints `profile.access` or `profile.refresh` in any DoctorFinding
+ * field. Identity labels go through `redactEmailForLog`. The token-leakage
+ * test in oauth-health.test.ts asserts no `TEST_LEAK_SENTINEL` substring
+ * leakage.
+ *
+ * @module
+ */
+import { stat, readFile } from "node:fs/promises";
+import { selectOAuthCredentialStore, redactEmailForLog, runOAuthTlsPreflight, rewriteOAuthError, } from "@comis/agent";
+import { formatRelativeExpiry } from "../../output/relative-time.js";
+const CATEGORY = "oauth";
+const NEAR_EXPIRY_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+const REFRESH_TEST_TIMEOUT_MS = 10_000;
+const TLS_PREFLIGHT_TIMEOUT_MS = 5_000;
+// Public OpenAI Codex client_id — same value pi-ai uses; using our own
+// would fingerprint Comis traffic in OpenAI's logs.
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CA_BUNDLE_PATHS = [
+    "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu
+    "/etc/ssl/cert.pem", // Alpine, macOS, FreeBSD
+    "/etc/pki/tls/certs/ca-bundle.crt", // RHEL/CentOS/Fedora
+    "/etc/ssl/ca-bundle.pem", // openSUSE
+];
+/**
+ * Doctor check: OAuth subsystem health.
+ *
+ * Returns 4 baseline sub-checks (per-profile expiry × N + ca-certificates +
+ * HTTPS_PROXY + TLS preflight); +N when `context.refreshTest === true`.
+ * Never throws — every failure path returns a finding.
+ */
+export const oauthHealthCheck = {
+    id: "oauth-health",
+    name: "OAuth",
+    run: async (context) => {
+        const findings = [];
+        // Sub-check 1: schema integrity + per-profile expiry (uses port.list())
+        findings.push(...(await checkProfiles(context)));
+        // Sub-check 2: ca-certificates bundle on disk
+        findings.push(await checkCaBundle());
+        // Sub-check 3: HTTPS_PROXY env-var heuristic
+        findings.push(checkHttpsProxyHeuristic());
+        // Sub-check 4: TLS preflight against auth.openai.com
+        findings.push(await checkTlsPreflight());
+        return findings;
+    },
+};
+// ---------------------------------------------------------------------------
+// Sub-check: per-profile expiry + schema-mismatch surfacing
+// ---------------------------------------------------------------------------
+async function checkProfiles(context) {
+    const findings = [];
+    const storage = (context.config?.oauth?.storage ?? "file");
+    if (storage === "encrypted") {
+        // CLI cannot bootstrap encrypted store without SECRETS_MASTER_KEY.
+        // Surface as skip + operator hint (doctor reads only the active store,
+        // does not cross-check inactive).
+        return [
+            {
+                category: CATEGORY,
+                check: "Profile store",
+                status: "skip",
+                message: "OAuth storage mode is 'encrypted' — doctor cannot read profiles from CLI",
+                suggestion: "Run doctor on the daemon host (with SECRETS_MASTER_KEY set), " +
+                    "or set oauth.storage to 'file' to use the plaintext file backend.",
+                repairable: false,
+            },
+        ];
+    }
+    // Open the store using the same selector daemon + auth CLI use.
+    let store;
+    try {
+        store = selectOAuthCredentialStore({
+            storage: "file",
+            dataDir: context.dataDir,
+        });
+    }
+    catch (e) {
+        return [
+            {
+                category: CATEGORY,
+                check: "Profile store",
+                status: "fail",
+                message: `Failed to open OAuth store: ${e instanceof Error ? e.message : String(e)}`,
+                repairable: false,
+            },
+        ];
+    }
+    // port.list() returns err() with the version-mismatch hint baked into
+    // the error message — surface verbatim. NO migration logic.
+    const listResult = await store.list();
+    if (!listResult.ok) {
+        findings.push({
+            category: CATEGORY,
+            check: "Profile schema",
+            status: "fail",
+            message: listResult.error.message, // e.g. "version mismatch: ... Hint: delete X and re-run comis auth login"
+            repairable: false,
+        });
+        return findings; // can't iterate profiles after schema-mismatch
+    }
+    if (listResult.value.length === 0) {
+        findings.push({
+            category: CATEGORY,
+            check: "Profile inventory",
+            status: "skip",
+            message: "No OAuth profiles stored",
+            repairable: false,
+        });
+        return findings;
+    }
+    // Per-profile expiry + identity reporting; +refresh-test when opted in.
+    for (const profile of listResult.value) {
+        findings.push(profileExpiryFinding(profile));
+        if (context.refreshTest === true) {
+            findings.push(await refreshTestFinding(profile));
+        }
+    }
+    return findings;
+}
+/**
+ * Build a DoctorFinding for a single profile's expiry status.
+ *
+ * Status ladder:
+ *   - msUntilExpiry <= 0  → fail (re-login required)
+ *   - msUntilExpiry < 7d  → warn (refresh proactively)
+ *   - else                → pass
+ *
+ * Always populates the literal numeric field `secsUntilExpiry`.
+ * Sign is preserved (negative for already-expired) so consumers can
+ * distinguish "expired 1h ago" from "expired 30d ago" without parsing
+ * the human-readable message.
+ */
+function profileExpiryFinding(profile) {
+    const msUntilExpiry = profile.expires - Date.now();
+    const secsUntilExpiry = Math.floor(msUntilExpiry / 1000);
+    const identityLabel = redactEmailForLog(profile.email) ?? profile.profileId;
+    // CRITICAL: NEVER include profile.access or profile.refresh in any
+    // DoctorFinding field. Use only profileId, redacted email, and the
+    // expiry timestamp.
+    if (msUntilExpiry <= 0) {
+        return {
+            category: CATEGORY,
+            check: `Profile ${profile.profileId}`,
+            status: "fail",
+            message: `Profile ${profile.profileId} (${identityLabel}) expired ${formatRelativeExpiry(profile.expires)}`,
+            suggestion: `Re-authenticate: comis auth login --provider ${profile.provider}`,
+            repairable: false,
+            secsUntilExpiry,
+        };
+    }
+    if (msUntilExpiry < NEAR_EXPIRY_THRESHOLD_MS) {
+        return {
+            category: CATEGORY,
+            check: `Profile ${profile.profileId}`,
+            status: "warn",
+            message: `Profile ${profile.profileId} (${identityLabel}) expires in ${formatRelativeExpiry(profile.expires)}`,
+            suggestion: `Refresh proactively: comis auth login --provider ${profile.provider}`,
+            repairable: false,
+            secsUntilExpiry,
+        };
+    }
+    return {
+        category: CATEGORY,
+        check: `Profile ${profile.profileId}`,
+        status: "pass",
+        message: `Profile ${profile.profileId} (${identityLabel}) expires in ${formatRelativeExpiry(profile.expires)}`,
+        repairable: false,
+        secsUntilExpiry,
+    };
+}
+/**
+ * Run a real OAuth refresh against `auth.openai.com` per profile.
+ *
+ * Opt-in only (gated by `--refresh-test` flag); --help text in
+ * `commands/doctor.ts` warns operator. Doctor does NOT persist the new
+ * tokens — subsequent LLM calls will hit refresh_token_reused on the
+ * stored (now-stale) token.
+ *
+ * Duplicates ~30 LoC of refresh-POST machinery from
+ * `refreshOpenAICodexTokenLocal`. Per AGENTS.md §2.3 rule of three, two
+ * call-sites is below the extraction threshold — duplicate over premature
+ * abstraction.
+ *
+ * NEVER prints `profile.refresh` in any returned finding.
+ */
+async function refreshTestFinding(profile) {
+    const identityLabel = redactEmailForLog(profile.email) ?? profile.profileId;
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: profile.refresh,
+        client_id: OPENAI_CODEX_CLIENT_ID,
+    });
+    try {
+        const response = await fetch(OPENAI_TOKEN_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+            signal: AbortSignal.timeout(REFRESH_TEST_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            let parsed = {};
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                // Body wasn't JSON — fall back to status code.
+            }
+            const classifyMessage = parsed.error_description ?? parsed.error ?? `HTTP ${response.status}`;
+            const rewritten = rewriteOAuthError(new Error(classifyMessage));
+            return {
+                category: CATEGORY,
+                check: `Profile ${profile.profileId} refresh test`,
+                status: "fail",
+                message: `Refresh test for ${identityLabel} failed (${rewritten.errorKind}): ${rewritten.userMessage}`,
+                suggestion: rewritten.hint,
+                repairable: false,
+            };
+        }
+        // Success: token rotated at OpenAI's end. We are NOT persisting —
+        // surface the side effect explicitly.
+        return {
+            category: CATEGORY,
+            check: `Profile ${profile.profileId} refresh test`,
+            status: "pass",
+            message: `Refresh test for ${identityLabel} succeeded`,
+            suggestion: "WARNING: refresh token at OpenAI was rotated. The stored token " +
+                "is now stale; the next LLM call will trigger a real refresh.",
+            repairable: false,
+        };
+    }
+    catch (e) {
+        return {
+            category: CATEGORY,
+            check: `Profile ${profile.profileId} refresh test`,
+            status: "fail",
+            message: `Refresh test for ${identityLabel} threw: ${e instanceof Error ? e.message : String(e)}`,
+            suggestion: "Check network reachability to auth.openai.com and retry without " +
+                "--refresh-test for a pure-local check.",
+            repairable: false,
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// Sub-check: ca-certificates bundle existence + distro-aware install hint
+// ---------------------------------------------------------------------------
+async function checkCaBundle() {
+    for (const p of CA_BUNDLE_PATHS) {
+        try {
+            await stat(p);
+            return {
+                category: CATEGORY,
+                check: "ca-certificates",
+                status: "pass",
+                message: `CA bundle present at ${p}`,
+                repairable: false,
+            };
+        }
+        catch {
+            // Try next path
+        }
+    }
+    const os = await readOsRelease();
+    return {
+        category: CATEGORY,
+        check: "ca-certificates",
+        status: "fail",
+        message: "No system CA bundle found at any standard location -- TLS verification will fail",
+        suggestion: caCertificatesInstallHint(os),
+        repairable: false,
+    };
+}
+async function readOsRelease(path = "/etc/os-release") {
+    try {
+        const text = await readFile(path, "utf-8");
+        const map = new Map();
+        for (const line of text.split("\n")) {
+            const m = line.match(/^([A-Z_]+)=(.*)$/);
+            if (m)
+                map.set(m[1], m[2].replace(/^"|"$/g, ""));
+        }
+        const id = map.get("ID") ?? "";
+        const idLike = (map.get("ID_LIKE") ?? "").split(/\s+/).filter(Boolean);
+        return { id, idLike };
+    }
+    catch {
+        return null;
+    }
+}
+function caCertificatesInstallHint(os) {
+    if (!os) {
+        return "Install ca-certificates via your distro's package manager and retry";
+    }
+    const idChain = [os.id, ...os.idLike];
+    if (idChain.includes("alpine")) {
+        return "apk add ca-certificates && update-ca-certificates";
+    }
+    if (idChain.includes("debian") || idChain.includes("ubuntu")) {
+        return "sudo apt-get install -y ca-certificates && sudo update-ca-certificates";
+    }
+    if (idChain.includes("fedora") ||
+        idChain.includes("rhel") ||
+        idChain.includes("centos")) {
+        return "sudo dnf install -y ca-certificates && sudo update-ca-trust";
+    }
+    if (idChain.includes("arch")) {
+        return "sudo pacman -S ca-certificates && sudo trust extract-compat";
+    }
+    if (idChain.includes("suse") || idChain.includes("opensuse")) {
+        return "sudo zypper install ca-certificates && sudo update-ca-certificates";
+    }
+    return "Install ca-certificates via your distro's package manager and retry";
+}
+// ---------------------------------------------------------------------------
+// Sub-check: HTTPS_PROXY env-var heuristic
+// ---------------------------------------------------------------------------
+function checkHttpsProxyHeuristic() {
+    // eslint-disable-next-line no-restricted-syntax -- CLI bootstrap before SecretManager
+    const httpsProxy = process.env["HTTPS_PROXY"] ?? process.env["https_proxy"];
+    if (!httpsProxy) {
+        return {
+            category: CATEGORY,
+            check: "HTTPS_PROXY",
+            status: "pass",
+            message: "HTTPS_PROXY not set (no proxy expected)",
+            repairable: false,
+        };
+    }
+    return {
+        category: CATEGORY,
+        check: "HTTPS_PROXY",
+        status: "warn",
+        message: `HTTPS_PROXY is set (${httpsProxy}) but Node's built-in fetch ignores it by default`,
+        suggestion: "Either install undici and call setGlobalDispatcher(new EnvHttpProxyAgent()) at startup, " +
+            "or rely on a system-wide proxy. See docs/operations/proxy.md.",
+        repairable: false,
+    };
+}
+// ---------------------------------------------------------------------------
+// Sub-check: TLS preflight
+// ---------------------------------------------------------------------------
+async function checkTlsPreflight() {
+    const result = await runOAuthTlsPreflight({
+        timeoutMs: TLS_PREFLIGHT_TIMEOUT_MS,
+    });
+    if (result.ok) {
+        return {
+            category: CATEGORY,
+            check: "TLS preflight",
+            status: "pass",
+            message: "TLS handshake to auth.openai.com succeeded",
+            repairable: false,
+        };
+    }
+    if (result.kind === "tls-cert") {
+        return {
+            category: CATEGORY,
+            check: "TLS preflight",
+            status: "fail",
+            message: `TLS certificate validation failed: ${result.code ?? "unknown"} (${result.message})`,
+            suggestion: caCertificatesInstallHint(await readOsRelease()),
+            repairable: false,
+        };
+    }
+    return {
+        category: CATEGORY,
+        check: "TLS preflight",
+        status: "warn",
+        message: `Network probe to auth.openai.com failed: ${result.message}`,
+        suggestion: "Verify DNS, firewall, and proxy settings. Doctor cannot distinguish " +
+            "transient failures from persistent network failures.",
+        repairable: false,
+    };
+}

package/node_modules/@comis/cli/dist/doctor/types.d.ts

@@ -23,6 +23,17 @@ export interface DoctorFinding {
     readonly message: string;
     readonly suggestion?: string;
     readonly repairable: boolean;
+    /**
+     * Numeric seconds until profile expiry.
+     *
+     * Exposed as a structured numeric so JSON-format consumers (log
+     * aggregators, dashboards) can compare it against thresholds without
+     * parsing the human-readable `message` string. Only `oauth-health.ts`
+     * `profileExpiryFinding` populates this; all other doctor-check findings
+     * leave it undefined. Value is `Math.floor(msUntilExpiry / 1000)`
+     * (negative for already-expired profiles to preserve sign-of-direction).
+     */
+    readonly secsUntilExpiry?: number;
 }
 /**
  * A doctor check that can be executed against a diagnostic context.
@@ -47,6 +58,14 @@ export interface DoctorContext {
     readonly dataDir: string;
     readonly daemonPidFile: string;
     readonly gatewayUrl?: string;
+    /**
+     * Opt-in refresh-test toggle from the `--refresh-test` flag on
+     * `comis doctor`. When true, the OAuth health check performs a real
+     * refresh against the provider per profile -- a side effect that rotates
+     * the refresh token at OpenAI's end (default OFF; --help warns the
+     * operator).
+     */
+    readonly refreshTest?: boolean;
 }
 /**
  * Aggregated result of running all doctor checks.

package/node_modules/@comis/cli/dist/index.d.ts

@@ -21,3 +21,4 @@ export { registerResetCommand } from "./commands/reset.js";
 export { registerSignalSetupCommand } from "./commands/signal-setup.js";
 export { registerSecretsCommand } from "./commands/secrets.js";
 export { registerUninstallCommand } from "./commands/uninstall.js";
+export { credentialsStep } from "./wizard/steps/04-credentials.js";

package/node_modules/@comis/cli/dist/index.js

@@ -25,10 +25,16 @@ export { registerResetCommand } from "./commands/reset.js";
 export { registerSignalSetupCommand } from "./commands/signal-setup.js";
 export { registerSecretsCommand } from "./commands/secrets.js";
 export { registerUninstallCommand } from "./commands/uninstall.js";
+// Wizard steps — exported for integration tests in
+// test/integration/oauth-login.test.ts which dynamically imports
+// `credentialsStep` to drive the wizard-state assertion end-to-end
+// against the mock OAuth server.
+export { credentialsStep } from "./wizard/steps/04-credentials.js";
 // ── Dead Export Audit ─────────────────────────────────────────────────
-// Total exports: 29 (28 value, 1 type)
-// Exports with external consumers: 1
+// Total exports: 30 (29 value, 1 type)
+// Exports with external consumers: 2
 //   - withClient (test/integration/env-vars-unit.test.ts, test/integration/env-vars-daemon.test.ts)
+//   - credentialsStep (consumed by test/integration/oauth-login.test.ts)
 // Exports with zero external consumers: 28
 //   All register* command exports and output utilities are consumed only by the CLI's
 //   own main.ts binary (not importable as @comis/cli by other packages).
@@ -37,7 +43,7 @@ export { registerUninstallCommand } from "./commands/uninstall.js";
 // Types (1):
 //   RpcClient
 //
-// Values (28):
+// Values (29):
 //   createRpcClient, withClient, success, error, warn, info, json,
 //   renderTable, renderKeyValue, withSpinner, registerDaemonCommand,
 //   registerConfigCommand, registerAgentCommand, registerChannelCommand,
@@ -45,4 +51,4 @@ export { registerUninstallCommand } from "./commands/uninstall.js";
 //   registerInitCommand, registerConfigureCommand, registerStatusCommand,
 //   registerHealthCommand, registerModelsCommand, registerPm2Command,
 //   registerSessionsCommand, registerResetCommand, registerSignalSetupCommand,
-//   registerSecretsCommand
+//   registerSecretsCommand, credentialsStep

package/node_modules/@comis/cli/dist/output/relative-time.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Relative-time formatter for OAuth expiry rendering.
+ *
+ * Produces compact strings like "5m", "27d", or "expired" for UI tables.
+ * Used by `comis auth list` (expiresIn column) and `comis auth status`
+ * (per-provider nextExpiry field).
+ *
+ * Branches:
+ *   - delta <= 0       → "expired"
+ *   - delta < 1h       → "<m>m" (e.g., "5m", "32m")
+ *   - 1h <= delta < 1d → "<h>h"
+ *   - delta >= 1d      → "<d>d"
+ *
+ * @module
+ */
+/**
+ * Format the time-until-expiry for an absolute epoch-ms expiry timestamp.
+ *
+ * @param expiresAtMs - Absolute epoch-ms when the credential expires
+ * @param now - Reference "now" (defaulted to Date.now() — overridable for tests)
+ * @returns "expired" | "<n>m" | "<n>h" | "<n>d"
+ */
+export declare function formatRelativeExpiry(expiresAtMs: number, now?: number): string;

package/node_modules/@comis/cli/dist/output/relative-time.js

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Relative-time formatter for OAuth expiry rendering.
+ *
+ * Produces compact strings like "5m", "27d", or "expired" for UI tables.
+ * Used by `comis auth list` (expiresIn column) and `comis auth status`
+ * (per-provider nextExpiry field).
+ *
+ * Branches:
+ *   - delta <= 0       → "expired"
+ *   - delta < 1h       → "<m>m" (e.g., "5m", "32m")
+ *   - 1h <= delta < 1d → "<h>h"
+ *   - delta >= 1d      → "<d>d"
+ *
+ * @module
+ */
+const MS_PER_MIN = 60_000;
+const MS_PER_HOUR = 60 * MS_PER_MIN;
+const MS_PER_DAY = 24 * MS_PER_HOUR;
+/**
+ * Format the time-until-expiry for an absolute epoch-ms expiry timestamp.
+ *
+ * @param expiresAtMs - Absolute epoch-ms when the credential expires
+ * @param now - Reference "now" (defaulted to Date.now() — overridable for tests)
+ * @returns "expired" | "<n>m" | "<n>h" | "<n>d"
+ */
+export function formatRelativeExpiry(expiresAtMs, now = Date.now()) {
+    const delta = expiresAtMs - now;
+    if (delta <= 0)
+        return "expired";
+    if (delta < MS_PER_HOUR)
+        return `${Math.floor(delta / MS_PER_MIN)}m`;
+    if (delta < MS_PER_DAY)
+        return `${Math.floor(delta / MS_PER_HOUR)}h`;
+    return `${Math.floor(delta / MS_PER_DAY)}d`;
+}

package/node_modules/@comis/cli/dist/wizard/non-interactive.js

@@ -56,12 +56,21 @@ export function validateNonInteractiveOptions(opts) {
     if (!opts.provider || opts.provider.trim().length === 0) {
         throw new NonInteractiveError("--provider is required in non-interactive mode", "provider");
     }
+    // openai-codex requires interactive OAuth login (browser callback,
+    // device-code prompt, or manual paste). Non-interactive mode has no
+    // way to drive the OAuth flow, so reject up front with a clear hint
+    // pointing at `comis auth login --method device-code`. Placed BEFORE
+    // the soft "unknown provider" warning so the literal error fires
+    // even though openai-codex IS in the pi-ai catalog.
+    if (opts.provider === "openai-codex") {
+        throw new NonInteractiveError("openai-codex requires interactive login; run `comis init` interactively or run `comis auth login --provider openai-codex --method device-code` separately.", "provider");
+    }
     // Soft validation: warn for unknown providers but do not throw.
-    // Daemon-side guards (260501-2pz credential-resolver, 260501-gyy
-    // builtin-provider-guard) catch genuinely-invalid providers downstream
-    // when the agent attempts to use the config. This loosening enables
-    // forward compat when a new pi-ai version adds a provider before
-    // comis releases. The "custom" provider is always allowed (synthetic).
+    // Daemon-side guards (credential-resolver, builtin-provider-guard)
+    // catch genuinely-invalid providers downstream when the agent
+    // attempts to use the config. This loosening enables forward compat
+    // when a new pi-ai version adds a provider before comis releases.
+    // The "custom" provider is always allowed (synthetic).
     if (opts.provider !== "custom") {
         try {
             const catalog = createModelCatalog();
@@ -160,9 +169,9 @@ export function buildNonInteractiveState(opts) {
     };
     // Model selection -- delegate to daemon when not specified.
     // The literal "default" is resolved at agent-execution time via the
-    // pi-ai catalog (builtin-provider-guard.ts:45 baseUrl pattern). Pre-
-    // 260501-kqq, this read a hardcoded provider->model map; that lookup
-    // was removed -- the daemon decides at runtime.
+    // pi-ai catalog (builtin-provider-guard.ts:45 baseUrl pattern). The
+    // previous hardcoded provider->model map was removed -- the daemon
+    // decides at runtime.
     const model = opts.model ?? "default";
     // Channel configs
     const channels = [];

package/node_modules/@comis/cli/dist/wizard/steps/03-provider.js

@@ -37,7 +37,8 @@ import { loadProvidersWithFallback } from "../../client/provider-list.js";
  */
 const PROVIDER_UI_HINTS = {
     anthropic: { label: "Anthropic (Claude)", hint: "Recommended for agents", category: "recommended" },
-    openai: { label: "OpenAI (GPT)", hint: "GPT-4o, o1, o3 models", category: "recommended" },
+    openai: { label: "OpenAI (GPT)", hint: "GPT-4o, o1, o3 — API key (pay per token)", category: "recommended" },
+    "openai-codex": { label: "OpenAI Codex", hint: "ChatGPT/Codex subscription — OAuth login", category: "recommended" },
     google: { label: "Google (Gemini)", hint: "Gemini models", category: "other" },
     groq: { label: "Groq", hint: "Fast inference (Llama, Mixtral)", category: "other" },
     mistral: { label: "Mistral", hint: "Mistral models", category: "other" },