[codex] Fix auth callback timeout and today filtering

internal/app/task.go

@@ -127,7 +127,10 @@ func (a TaskApp) findTask(ctx context.Context, ref string, projectRef string) (d
 }
 
 func (a TaskApp) Today(ctx context.Context) ([]domain.Task, map[string]string, error) {
-	return a.List(ctx, ListTasksInput{Today: true})
+	return a.List(ctx, ListTasksInput{
+		Statuses: []domain.TaskStatus{domain.StatusOpen},
+		Today:    true,
+	})
 }
 
 func resolveTaskReference(ref string, tasks []domain.Task) (domain.Task, error) {

internal/app/task_test.go

@@ -161,6 +161,35 @@ func TestTaskAppListFiltersToday(t *testing.T) {
 	}
 }
 
+func TestTaskAppTodayRequestsOpenTasks(t *testing.T) {
+	now := time.Date(2026, 4, 9, 9, 0, 0, 0, time.Local)
+	due := time.Date(2026, 4, 9, 17, 0, 0, 0, time.Local)
+	client := &recordingTaskAPI{
+		filterTasks: []domain.Task{
+			{ID: "today", Title: "Today", ProjectID: "p1", Status: domain.StatusOpen, DueDate: &due},
+			{ID: "completed", Title: "Done", ProjectID: "p1", Status: domain.StatusCompleted, DueDate: &due},
+		},
+	}
+	taskApp := TaskApp{
+		Auth:   stubTokenSource{},
+		Client: client,
+		Now: func() time.Time {
+			return now
+		},
+	}
+
+	tasks, _, err := taskApp.Today(context.Background())
+	if err != nil {
+		t.Fatalf("Today() error = %v", err)
+	}
+	if len(tasks) != 1 || tasks[0].ID != "today" {
+		t.Fatalf("tasks = %#v, want only open today task", tasks)
+	}
+	if got := client.lastFilter.StatusCodes(); len(got) != 1 || got[0] != int(domain.StatusOpen) {
+		t.Fatalf("lastFilter.StatusCodes() = %v, want [%d]", got, domain.StatusOpen)
+	}
+}
+
 func TestTaskAppListFiltersOverdue(t *testing.T) {
 	now := time.Date(2026, 4, 9, 9, 0, 0, 0, time.Local)
 	yesterday := time.Date(2026, 4, 8, 18, 0, 0, 0, time.Local)

internal/auth/service_test.go

@@ -335,30 +335,33 @@ func TestServiceLoginAcceptsAutomaticLocalCallback(t *testing.T) {
 		t.Fatalf("Listen() error = %v", err)
 	}
 	addr := l.Addr().String()
-	_ = l.Close()
+	t.Cleanup(func() {
+		_ = l.Close()
+	})
 
 	state := "state-1"
 	store := &memoryTokenStore{}
 	browser := &stubBrowser{}
 	out := &bytes.Buffer{}
 	manualIn, manualWriter := io.Pipe()
 	defer manualWriter.Close()
+	listenerReady := make(chan struct{})
 
 	done := make(chan struct{})
 	go func() {
 		defer close(done)
-		for len(browser.urls) == 0 {
-			time.Sleep(10 * time.Millisecond)
-		}
+		<-listenerReady
 		callbackURL := "http://" + addr + "/callback?code=code-1&state=" + state
-		resp, err := http.Get(callbackURL)
+		resp, err := (&http.Client{Timeout: time.Second}).Get(callbackURL)
 		if err != nil {
 			t.Errorf("http.Get() error = %v", err)
 			return
 		}
 		_ = resp.Body.Close()
 	}()
 
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
 	token, err := Service{
 		Exchanger: Exchanger{
 			HTTPClient: tokenServer.Client(),
@@ -369,7 +372,14 @@ func TestServiceLoginAcceptsAutomaticLocalCallback(t *testing.T) {
 		In:          manualIn,
 		Out:         out,
 		StateSource: func() string { return state },
-	}.Login(context.Background(), LoginInput{
+		Listen: func(network, address string) (net.Listener, error) {
+			if network != "tcp" || address != addr {
+				t.Fatalf("Listen(%q, %q), want tcp %s", network, address, addr)
+			}
+			close(listenerReady)
+			return l, nil
+		},
+	}.Login(ctx, LoginInput{
 		ClientID:     "client-1",
 		ClientSecret: "secret-1",
 		RedirectURL:  "http://" + addr + "/callback",