feat: OAuth auto-refresh, Codex session resume, MCP injection, and secret sanitization

- Add token-refresh module that auto-renews Claude OAuth tokens 30min before expiry
- Fix Codex session loss on service restart by resuming previous sessions
- Inject nanoclaw MCP server into Codex config.toml for send_message/schedule_task
- Sanitize ANTHROPIC_API_KEY and CLAUDE_CODE_OAUTH_TOKEN from Codex subprocess env

src/token-refresh.ts

@@ -0,0 +1,212 @@
+/**
+ * OAuth Token Auto-Refresh for Claude Code
+ *
+ * Periodically checks ~/.claude/.credentials.json and refreshes
+ * the access token before it expires. This solves the known issue
+ * where Claude Code CLI fails to auto-refresh in headless environments.
+ *
+ * Endpoint and client_id extracted from Claude Code CLI binary.
+ */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+import { logger } from './logger.js';
+
+const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+const FALLBACK_TOKEN_URL = 'https://api.anthropic.com/v1/oauth/token';
+const CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const DEFAULT_SCOPES = [
+  'user:profile',
+  'user:inference',
+  'user:sessions:claude_code',
+  'user:mcp_servers',
+];
+
+// Check every 5 minutes, refresh if within 30 minutes of expiry
+const CHECK_INTERVAL_MS = 5 * 60 * 1000;
+const REFRESH_BEFORE_EXPIRY_MS = 30 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 15_000;
+
+interface OAuthCredentials {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  scopes: string[];
+  subscriptionType?: string;
+  rateLimitTier?: string;
+}
+
+interface CredentialsFile {
+  claudeAiOauth: OAuthCredentials;
+}
+
+interface TokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  expires_in: number;
+  scope?: string;
+}
+
+function getCredentialsPath(): string {
+  return path.join(os.homedir(), '.claude', '.credentials.json');
+}
+
+function readCredentials(): CredentialsFile | null {
+  const credsPath = getCredentialsPath();
+  try {
+    if (!fs.existsSync(credsPath)) return null;
+    return JSON.parse(fs.readFileSync(credsPath, 'utf-8'));
+  } catch (err) {
+    logger.warn({ err }, 'Failed to read Claude credentials');
+    return null;
+  }
+}
+
+function writeCredentials(creds: CredentialsFile): void {
+  const credsPath = getCredentialsPath();
+  const tempPath = `${credsPath}.tmp`;
+  fs.writeFileSync(tempPath, JSON.stringify(creds, null, 2), { mode: 0o600 });
+  fs.renameSync(tempPath, credsPath);
+}
+
+async function refreshToken(
+  refreshTokenStr: string,
+  scopes: string[],
+): Promise<TokenResponse> {
+  const body = JSON.stringify({
+    grant_type: 'refresh_token',
+    refresh_token: refreshTokenStr,
+    client_id: CLIENT_ID,
+    scope: (scopes.length > 0 ? scopes : DEFAULT_SCOPES).join(' '),
+  });
+
+  const headers = { 'Content-Type': 'application/json' };
+
+  // Try primary endpoint first, then fallback
+  for (const url of [TOKEN_URL, FALLBACK_TOKEN_URL]) {
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(
+        () => controller.abort(),
+        REQUEST_TIMEOUT_MS,
+      );
+
+      const res = await fetch(url, {
+        method: 'POST',
+        headers,
+        body,
+        signal: controller.signal,
+      });
+
+      clearTimeout(timeout);
+
+      if (res.status === 200) {
+        return (await res.json()) as TokenResponse;
+      }
+
+      const errText = await res.text().catch(() => '');
+      logger.warn(
+        { url, status: res.status, body: errText.slice(0, 200) },
+        'Token refresh failed at endpoint',
+      );
+    } catch (err) {
+      logger.warn(
+        { url, err: err instanceof Error ? err.message : String(err) },
+        'Token refresh request error',
+      );
+    }
+  }
+
+  throw new Error('Token refresh failed on all endpoints');
+}
+
+async function checkAndRefresh(): Promise<void> {
+  const creds = readCredentials();
+  if (!creds?.claudeAiOauth) return;
+
+  const { expiresAt, refreshToken: rt } = creds.claudeAiOauth;
+  if (!rt) {
+    logger.debug('No refresh token in credentials, skipping');
+    return;
+  }
+
+  const now = Date.now();
+  const remaining = expiresAt - now;
+
+  if (remaining > REFRESH_BEFORE_EXPIRY_MS) {
+    logger.debug(
+      { remainingMin: Math.round(remaining / 60000) },
+      'Token still valid, no refresh needed',
+    );
+    return;
+  }
+
+  const isExpired = remaining <= 0;
+  logger.info(
+    { remainingMin: Math.round(remaining / 60000), isExpired },
+    'Refreshing Claude OAuth token',
+  );
+
+  try {
+    const response = await refreshToken(
+      rt,
+      creds.claudeAiOauth.scopes || DEFAULT_SCOPES,
+    );
+
+    creds.claudeAiOauth.accessToken = response.access_token;
+    creds.claudeAiOauth.refreshToken = response.refresh_token || rt;
+    creds.claudeAiOauth.expiresAt = now + response.expires_in * 1000;
+
+    if (response.scope) {
+      creds.claudeAiOauth.scopes = response.scope.split(' ');
+    }
+
+    writeCredentials(creds);
+
+    const newExpiryMin = Math.round(response.expires_in / 60);
+    logger.info(
+      { expiresInMin: newExpiryMin },
+      'Claude OAuth token refreshed successfully',
+    );
+  } catch (err) {
+    logger.error(
+      { err: err instanceof Error ? err.message : String(err) },
+      'Failed to refresh Claude OAuth token — manual re-login may be required',
+    );
+  }
+}
+
+let refreshInterval: ReturnType<typeof setInterval> | null = null;
+
+export function startTokenRefreshLoop(): void {
+  // Only run if credentials file exists (skip for API key-only setups)
+  const creds = readCredentials();
+  if (!creds?.claudeAiOauth) {
+    logger.info('No OAuth credentials found, token refresh disabled');
+    return;
+  }
+
+  logger.info(
+    { checkIntervalMin: CHECK_INTERVAL_MS / 60000 },
+    'Token auto-refresh started',
+  );
+
+  // Check immediately on startup
+  checkAndRefresh().catch((err) =>
+    logger.error({ err }, 'Initial token refresh check failed'),
+  );
+
+  refreshInterval = setInterval(() => {
+    checkAndRefresh().catch((err) =>
+      logger.error({ err }, 'Token refresh check failed'),
+    );
+  }, CHECK_INTERVAL_MS);
+}
+
+export function stopTokenRefreshLoop(): void {
+  if (refreshInterval) {
+    clearInterval(refreshInterval);
+    refreshInterval = null;
+  }
+}