Harden auth and output

Security-sensitive data and sinks must be hardened before use. Concretely:

1) Auth/token validity guarantees

• When returning or printing OAuth/bearer tokens, ensure the token is proactively refreshed if it’s close to expiring.
• Implement this in the shared auth path (e.g., getAuth) so all call sites benefit, using a refresh threshold that matches real provider behavior (e.g., provider-specific skew rather than a one-size-fits-all 30 minutes).

2) Sanitize strings embedded into terminal escape sequences

• Before constructing OSC 8 (or other control-sequence) hyperlinks, strip control characters from any untrusted URL/string (e.g., remove \x00-\x1f and \x7f).

3) Use secure, permissioned temp locations

• Prefer an app-controlled temp root (respecting a canonical directory helper / env override) with strict permissions (e.g., 0700).
• Create a unique subdirectory per invocation/session to prevent cross-process stomping.
• Avoid relying on raw tmpdir() unless you can enforce the same security model.

Example (sanitizing OSC 8 link URLs):

function stripControlChars(s: string): string {
  return s.replace(/[\x00-\x1f\x7f]/g, "");
}

const href = stripControlChars(token.href ?? "");
const osc8Open = `\x1b]8;;${href}\x07`;
const osc8Close = `\x1b]8;;\x07`;