test: fix flaky #163 email-masking property test (real assertion bug) (#179)

The "masked email never contains the full local part" property test was
seed-flaky in CI. Root cause is a fragile assertion, not the masker:
`expect(masked.includes(local)).toBe(false)` false-positives in two classes
fast-check eventually generates —

  1. local part repeats in the preserved domain: "abc@abc.com" -> "ab***@abc.com"
     (the kept domain legitimately contains "abc");
  2. local part contains the mask character itself: "a.*@a.aa" -> "a.***@a.aa"
     (kept "a." + a "*" from the "***" mask reconstructs the local "a.*").

Neither is a real leak — the masker correctly reveals at most the first 2
local chars. Replaced the substring heuristic with an assertion of the exact
masking contract: masked local === first min(2,len) chars + "***", checked on
the local segment only (domain is preserved verbatim by design). Added
deterministic regression cases covering both tricky classes.

Verified seed-independent: a 200k-run local probe of the exact-shape invariant
passes; full suite green (2538 passed, 1 skipped) with no flake. No production
code change.

Co-authored-by: neil <neil@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `codex-doctor --fix` no longer fails silently when a stored credential is genuinely dead: a failed token refresh now reports `N account(s) need re-login` and points the user at `opencode auth login`, instead of leaving an all-dark pool unrepaired with no surfaced cause. (#171)
 - `codex-health` now surfaces the same recovery diagnostics as `codex-doctor` (read-only): it flags accounts blocked only by a stale cooldown/rate-limit (pointing at `codex-doctor --fix`) and disabled token-source duplicates (pointing at `codex-remove`), and includes `staleRecoverableSlots` / `disabledDuplicateSlots` in JSON output. This addresses the part of the issue that named `codex-health` explicitly. (#171)
 - Caller-cancellation during a retry/backoff wait now surfaces as a proper `AbortError` carrying the caller's `signal.reason`, instead of an opaque `new Error("Aborted")` that dropped the cause. This aligns the retry-wait path with the fetch path and the `isAbortError` convention in `lib/codex-usage.ts`, improving diagnosability of the `Error: Aborted` symptom. (#176)
+- Fixed a flaky email-masking property test (#163) that intermittently failed CI: the assertion used a fragile `masked.includes(local)` substring check that false-positived when the local part repeats in the preserved domain (`abc@abc.com`) or contains the mask character itself (`a.*@a.aa` → `a.***`). It now asserts the exact masking contract (masked local = first ≤2 chars + `***`), with deterministic regression cases. No production code change.
 
 ### Security
 - Bumped `hono` to 4.12.26, resolving a high-severity Windows `serve-static` path traversal via encoded backslash (`%5C`) and four moderate advisories (GHSA-88fw-hqm2-52qc, GHSA-j6c9-x7qj-28xf, GHSA-rv63-4mwf-qqc2, GHSA-wgpf-jwqj-8h8p, GHSA-wwfh-h76j-fc44). This also clears the transitive `@openauthjs/openauth` advisory inherited via hono.

test/property/redaction.property.test.ts

@@ -24,27 +24,51 @@ const arbOpaqueSecret = fc
   .filter((s) => s.trim().length >= 8);
 
 describe("DEEP STRESS: email masking invariant (#163)", () => {
-  it("masked email never contains the full local part", () => {
+  it("masked email reveals at most the first 2 local chars", () => {
     fc.assert(
       fc.property(arbEmail, (email) => {
         const masked = maskEmailForDisplay(email);
         if (!masked) return true;
         const atIndex = email.indexOf("@");
         const local = email.slice(0, atIndex);
-        // The full local part must not appear verbatim unless it is <= 2 chars
-        // (the masker intentionally keeps up to the first 2 chars).
-        if (local.length > 2) {
-          expect(masked.includes(local)).toBe(false);
-        }
-        // Domain is preserved for distinguishability.
         const domain = email.slice(atIndex);
+        // The masker contract is: masked local = first min(2, len) chars + "***".
+        // We assert that EXACT shape rather than a substring check, because a
+        // substring check is fragile when the local part itself contains the
+        // mask characters (e.g. "a.*@a.aa" -> "a.***@a.aa", where the local
+        // "a.*" reappears as the kept "a." plus a "*" from the mask). The real
+        // security property is that no more than the first 2 local chars survive.
+        const maskedAtIndex = masked.indexOf("@");
+        const maskedLocal =
+          maskedAtIndex >= 0 ? masked.slice(0, maskedAtIndex) : masked;
+        const expectedRevealed = local.slice(0, Math.min(2, local.length));
+        expect(maskedLocal).toBe(`${expectedRevealed}***`);
+        // Domain is preserved verbatim for distinguishability.
         expect(masked.endsWith(domain)).toBe(true);
         return true;
       }),
       { numRuns: 500 },
     );
   });
 
+  // Deterministic regression for the two classes that previously made the
+  // property test seed-flaky: (1) the local part also occurs in the domain
+  // (abc@abc.com), and (2) the local part contains the mask character itself
+  // (a.*@a.aa -> a.***). Both broke a naive substring check; the real contract
+  // is that the masked local reveals at most the first 2 chars. (#163)
+  it("reveals at most the first 2 local chars in tricky cases", () => {
+    const cases: Array<[string, string]> = [
+      ["abc@abc.com", "ab***@abc.com"],
+      ["tom@tom.io", "to***@tom.io"],
+      ["xyz@sub.xyz.org", "xy***@sub.xyz.org"],
+      ["a.*@a.aa", "a.***@a.aa"],
+      ["a@a.com", "a***@a.com"],
+    ];
+    for (const [email, expected] of cases) {
+      expect(maskEmailForDisplay(email)).toBe(expected);
+    }
+  });
+
   it("resolveDisplayEmail with masking enabled never returns the raw email (len>3 local)", () => {
     fc.assert(
       fc.property(arbEmail, (email) => {