chore: release v2.1.13-beta.2 (#496) (#497) by ndycode · Pull Request #498 · ndycode/codex-multi-auth

ndycode · 2026-05-31T14:21:46Z

Summary

Release prerelease v2.1.13-beta.2 to the beta dist-tag. Bumps from the latest published version (2.1.13-beta.1) and ships the cascade OAuth token-invalidation fix for issue #495 (PRs #496, #497), already merged to main.

Stable latest (2.1.12) is unchanged; stable v2.1.13 remains gated on the issue #486 root cause.

What ships

fix: detect token invalidation in 401 responses and stop cascade rotation #496 — detect token invalidation in 401 responses and stop cascade rotation; monotonic 5-minute invalidation cooldown; session-affinity clear; minRotationIntervalMs sticky window.
fix(runtime): emit consistent token_invalidated body on upstream-401 path #497 — consistent { error: { message, code: "token_invalidated" } } body across both invalidation exit paths via a shared builder.

Version bump (4 locations + 2 doc links)

package.json / package-lock.json (root + packages[""]) → 2.1.13-beta.2
.codex-plugin/plugin.json → 2.1.13-beta.2
docs/releases/v2.1.13-beta.2.md — new release notes
README.md + docs/README.md — prerelease links repointed

Verification

tsc --noEmit: clean
npm run build (the prepublishOnly gate): clean
Full suite: 4062 tests pass (vitest run --maxWorkers=1)
Version coherent across all 4 files; no stray beta.1 references (except intentional carry-forward prose)

Publish (after merge)

npm publish --tag beta

🤖 Generated with Claude Code

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

pure version bump from 2.1.13-beta.1 to 2.1.13-beta.2 shipping the cascade oauth token-invalidation fix (prs #496 and #497, already merged to main). all four version locations are consistent and the release notes accurately document the monotonic cooldown, session-affinity clear, shared body builder, and minRotationIntervalMs sticky window.

version updated coherently across package.json, package-lock.json (both root and packages[""] entries), and .codex-plugin/plugin.json — no stray beta.1 references in versioned fields.
new docs/releases/v2.1.13-beta.2.md correctly describes the invalidation detection heuristics, the 5-minute cooldown env var (CODEX_AUTH_TOKEN_INVALIDATION_COOLDOWN_MS), and calls out the still-open [bug] 503 Service Unavailable #486 503 gap as a known limitation.

Confidence Score: 5/5

safe to merge — only version fields and documentation change; no source code, no token handling, no filesystem operations modified in this pr.

all four version locations are updated consistently, the lock file both root and packages[""] entries match, and the release notes accurately reflect the fixes already shipped in #496 and #497. nothing in this pr touches the runtime, auth flow, or any token handling path.

no files require special attention — all changes are mechanical version bumps or documentation.

Important Files Changed

Filename	Overview
package.json	version bumped from 2.1.13-beta.1 to 2.1.13-beta.2; no dependency or script changes
package-lock.json	both root and packages[""] entries updated to 2.1.13-beta.2; consistent with package.json
.codex-plugin/plugin.json	version field bumped to 2.1.13-beta.2; no other changes
docs/releases/v2.1.13-beta.2.md	new release notes accurately documenting the cascade-invalidation fix, monotonic cooldown, session-affinity clear, minRotationIntervalMs feature, and known gaps
README.md	prerelease link repointed from beta.1 to beta.2; no other changes
docs/README.md	docs index table updated to reference v2.1.13-beta.2.md; consistent with README.md change

Sequence Diagram

sequenceDiagram
    participant C as Client
    participant P as Rotation Proxy
    participant OAI as OpenAI API

    C->>P: POST /v1/responses (account A token)
    P->>OAI: forward with account A OAuth token
    OAI-->>P: 401 authentication token has been invalidated
    P->>P: detect invalidation phrase in body
    P->>P: apply 5-min monotonic cooldown on account A
    P->>P: clear session affinity for key
    P-->>C: "401 { error: { message, code: token_invalidated } }"
    Note over P: no cascade rotation — stops here

    C->>P: next request (new session)
    P->>P: select healthy account B (A still in cooldown)
    P->>OAI: forward with account B OAuth token
    OAI-->>P: 200 OK
    P->>P: refresh minRotationIntervalMs anchor for account B
    P-->>C: 200 OK (streamed)

_{Reviews (1): Last reviewed commit: "chore: release v2.1.13-beta.2 (#496) (#4..." | Re-trigger Greptile}

Prerelease that ships the cascade OAuth token-invalidation fix from issue #495 to npm under the `beta` dist-tag: the 401 handler now detects explicit token-invalidation responses and returns them to the client instead of rotating through every account (the rotation itself was tripping OpenAI's anti-abuse detection and invalidating accounts in sequence). Invalidated accounts get a monotonic 5-minute cooldown, session affinity is cleared, and both invalidation exit paths emit a consistent token_invalidated error body. Also adds a configurable minRotationIntervalMs sticky window. Carries forward multi-workspace support (beta.1) and the pinned-account 503 diagnostic (beta.0). Stable v2.1.13 will land once the issue #486 root cause is identified and patched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-05-31T14:21:52Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-05-31T14:22:34Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9b1e7e36-4c76-4d89-b793-705d70147685

📥 Commits

Reviewing files that changed from the base of the PR and between f7f5932 and da2d33c.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.codex-plugin/plugin.json
README.md
docs/README.md
docs/releases/v2.1.13-beta.2.md
package.json

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📝 Walkthrough

This is a low-severity release PR that publishes prerelease v2.1.13-beta.2 to the npm beta dist-tag, bumping versions from 2.1.13-beta.1. The PR contains only version number updates and documentation changes—no functional code alterations—as the underlying OAuth token-invalidation fixes for issue #495 were already merged in PRs #496 and #497. Full test suite verification (4062 passing tests) and build checks confirm stability; no security, data-loss, or regression risks are introduced.

Changes:

Version bumps in .codex-plugin/plugin.json, package.json, and package-lock.json (2.1.13-beta.1 → 2.1.13-beta.2)
Updated prerelease links in README.md and docs/README.md to point to new release notes document
Added docs/releases/v2.1.13-beta.2.md with release notes documenting the token-invalidation fix, monotonic cooldown mechanism, session affinity clearing, minRotationIntervalMs sticky-window configuration, and consistent error response format

Walkthrough

version fields bumped across plugin.json, package.json, and readme links from beta.1 to beta.2. new release notes document describes token invalidation detection, monotonic cooldown behavior, rotation window stickiness, test coverage expectations, and remaining unfixed issues.

Changes

Release v2.1.13-beta.2

Layer / File(s)	Summary
Version and manifest synchronization `.codex-plugin/plugin.json`, `package.json`, `README.md`, `docs/README.md`	plugin.json and package.json version fields bumped 2.1.13-beta.1 → 2.1.13-beta.2. readme reference links updated to point to the new beta.2 release notes document.
Release notes documentation for beta.2 `docs/releases/v2.1.13-beta.2.md`	new release doc fully specifies the prerelease scope: 401 handler detects token-invalidation phrases in response body and returns `token_invalidated` 401 without rotating to next account. monotonic ~5-minute cooldown applied on invalidation with session affinity cleared. both invalidation exit paths emit consistent `{ error: { message, code: "token_invalidated" } }` via shared builder. `minRotationIntervalMs` sticky window feature reduces token changes on back-to-back requests after successful serves. test coverage expectations listed. explicitly notes issue `#486` 503 root cause unfixed and required for stable v2.1.13.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

this is a version bump and documentation-only pr. manifest fields are straightforward. release notes describe design decisions already implemented elsewhere (per the context), so no code changes to validate here.

flag: the release notes describe sophisticated behavior around token invalidation cooldown and session affinity clearing, but this pr contains zero implementation or test code changes. if the actual runtime changes for issue #495 (401 handler phrase detection, monotonic cooldown, shared error builder, minRotationIntervalMs) landed in a prior commit, that prior pr should have included explicit regression tests for windows-specific header casing (http headers vary by platform), concurrent request races during invalidation boundary windows, and sticky window refresh timing under load. the documentation alone cannot verify those were shipped. recommend cross-checking the implementation pr to confirm token invalidation path has proper synchronization for concurrent serves.

Possibly related PRs

ndycode/codex-multi-auth#341: both prs update version-driven release documentation pointers and bump package.json version to keep manifest and release-notes links consistent.

Suggested labels

bug

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/release-v2.1.13-beta.2

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch chore/release-v2.1.13-beta.2

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ndycode merged commit 70ab38a into main May 31, 2026
1 of 2 checks passed

Navigation Menu

chore: release v2.1.13-beta.2 (#496) (#497) - #498

chore: release v2.1.13-beta.2 (#496) (#497)#498
ndycode merged 1 commit into
mainfrom
chore/release-v2.1.13-beta.2

ndycode commented May 31, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented May 31, 2026

Uh oh!

coderabbitai Bot commented May 31, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ndycode commented May 31, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What ships

Version bump (4 locations + 2 doc links)

Verification

Publish (after merge)

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

chatgpt-codex-connector Bot commented May 31, 2026

Uh oh!

coderabbitai Bot commented May 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ndycode commented May 31, 2026 •

edited by greptile-apps Bot

Loading

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

coderabbitai Bot commented May 31, 2026 •

edited

Loading