chore(release): cut v2.3.0 stable by ndycode · Pull Request #610 · ndycode/codex-multi-auth

ndycode · 2026-06-14T21:51:11Z

Summary

Cut v2.3.0 stable — promotes the 2.3.0-beta line to stable and ships the three runtime-rotation durability fixes merged after beta.3:

fix(rotation): break stale-recovery deadlock on transient account state #607 — break the stale-recovery deadlock on persisted transient account state (fixes [bug] Unable to use program #606, the reported permanent-503 bug)
fix(rotation): persist cooldown when account has no resolvable accountId #608 — persist cooldown when an account has no resolvable accountId
fix(rotation): persist rate-limit window in short-retry 429 path #609 — persist the rate-limit window in the short-retry 429 path

These three share one root-cause class (transient state is serialized to disk, so every mutation site must schedule a write); all mutation sites were audited and these were the gaps.

What Changed

Version-coupled manifests bumped 2.3.0-beta.3 → 2.3.0:

package.json, package-lock.json, .codex-plugin/plugin.json, AGENTS.md
README.md + docs/README.md release portals: v2.3.0 listed as current stable; beta.3/beta.2 demoted to prior prerelease; v2.2.2 demoted to prior stable
CHANGELOG.md entry added
docs/releases/v2.3.0.md created (required by documentation.test.ts coupling assertions)

No source code changes — the fixes already landed via #607/#608/#609. This PR is the release metadata bump only.

Validation

npm run lint
npm run typecheck
npm test (4920 passed, 3 skipped, 0 failures)
npm test -- test/documentation.test.ts (26 passed — version coupling verified)
npm run build
npm run pack:check (codex-multi-auth@2.3.0, 1,062,597 bytes / 1201 files — within budget)

Docs and Governance Checklist

README updated (release portal — current stable now v2.3.0)
docs/getting-started.md updated (no onboarding change)
docs/features.md updated (no capability change)
relevant docs/reference/* pages updated (no command/setting change)
docs/upgrade.md updated (no migration behavior change)
SECURITY.md and CONTRIBUTING.md reviewed for alignment

Risk and Rollback

Risk level: low. Metadata/docs only; the functional changes were each independently reviewed and merged.
Rollback plan: revert this commit (does not touch runtime code).

🤖 Generated with Claude Code

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

metadata-only release cut promoting 2.3.0-beta.3 to stable 2.3.0. no source code changes — the three durability fixes (#607, #608, #609) already landed via their own prs.

version bumped to 2.3.0 across package.json, package-lock.json, .codex-plugin/plugin.json, and AGENTS.md
CHANGELOG.md entry added and docs/releases/v2.3.0.md created (required by documentation.test.ts coupling assertions)
release portals in README.md and docs/README.md updated: v2.3.0 is current stable, v2.2.2 and the beta series demoted accordingly

Confidence Score: 4/5

safe to merge — pure metadata bump with no runtime code changes; the only issue is a changelog date one day ahead of the actual cut date.

all eight changed files are version strings, release notes, and doc portal updates. no source, config, or test logic is touched. the single finding is the CHANGELOG.md entry dated 2026-06-15 when the pr is being merged on 2026-06-14.

CHANGELOG.md — the release date is one day in the future and should be corrected before tagging.

Important Files Changed

Filename	Overview
package.json	version bumped from `2.3.0-beta.3` to `2.3.0`; no other changes
package-lock.json	lockfile version fields updated to match `2.3.0`; no dependency changes
.codex-plugin/plugin.json	plugin version bumped to `2.3.0`; no other fields changed
CHANGELOG.md	new `[2.3.0]` entry added; date is `2026-06-15` but cut date is `2026-06-14`
AGENTS.md	package version header updated to `2.3.0`; no content changes
README.md	release portal updated: `v2.3.0` listed as current stable, `v2.2.2` demoted to previous stable, beta line removed
docs/README.md	release table updated: `v2.3.0` as current stable, `v2.3.0-beta.3` demoted to prior prerelease, `v2.2.2` demoted to prior stable
docs/releases/v2.3.0.md	new release notes file created for v2.3.0; content is accurate and matches CHANGELOG and PR description

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["2.3.0-beta.3 (HEAD before PR)"] --> B["Version bump in\npackage.json / package-lock.json\n.codex-plugin/plugin.json / AGENTS.md"]
    B --> C["CHANGELOG.md entry added\n[2.3.0] - 2026-06-15"]
    B --> D["docs/releases/v2.3.0.md created\n(documentation.test.ts coupling)"]
    B --> E["README.md + docs/README.md\nrelease portals updated"]
    C --> F["2.3.0 stable published\nnpm i -g codex-multi-auth"]
    D --> F
    E --> F
    F --> G["latest dist-tag"]
    A --> H["Prior fixes already merged\n#607 stale-recovery deadlock\n#608 missing-accountId cooldown\n#609 short-retry 429 persist"]
    H --> F

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
CHANGELOG.md:10
the changelog entry is dated `2026-06-15` but today is `2026-06-14`. the pr is being cut today, so the date is one day in the future. this will show up as a future-dated entry in changelog tooling and any consumers that parse/sort by date.

```suggestion
## [2.3.0] - 2026-06-14
```

_{Reviews (1): Last reviewed commit: "chore(release): cut v2.3.0 stable" | Re-trigger Greptile}

Promote the 2.3.0-beta line to stable and ship three runtime-rotation durability fixes landed after beta.3: - #607: break stale-recovery deadlock on persisted transient account state (fixes #606) - #608: persist cooldown when an account has no resolvable accountId - #609: persist rate-limit window in the short-retry 429 path Version-coupled manifests bumped 2.3.0-beta.3 -> 2.3.0 (package.json, package-lock.json, .codex-plugin/plugin.json, AGENTS.md), release portal links updated in README.md and docs/README.md (v2.3.0 current stable, beta.3/beta.2 demoted to prior prerelease), CHANGELOG entry added, and docs/releases/v2.3.0.md created. documentation.test.ts coupling assertions green. Full suite 4920 pass / 3 skip / 0 fail; lint + tsc clean; pack budget ok (codex-multi-auth@2.3.0, 1062597 bytes / 1201 files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector · 2026-06-14T21:51:15Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-06-14T21:52:17Z

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f59839f3-92da-4270-ad4e-0d44790789a4

📥 Commits

Reviewing files that changed from the base of the PR and between f9abbe0 and 02ed50f.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

.codex-plugin/plugin.json
AGENTS.md
CHANGELOG.md
README.md
docs/README.md
docs/releases/v2.3.0.md
package.json

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (14)

**/package.json

📄 CodeRabbit inference engine (SECURITY.md)

**/package.json: Pin hono to version 4.12.21 or higher to avoid vulnerabilities GHSA-3hrh-pfw6-9m5x, GHSA-2gcr-mfcq-wcc3, GHSA-xrhx-7g5j-rcj5, and GHSA-f577-qrjj-4474 (Set-Cookie injection, app.mount() path-decoding, IPv6 IP-restriction bypass, and JWT scheme-acceptance issues)
Pin rollup to version ^4.59.0 or higher to avoid vulnerabilities in the <4.59.0 range as surfaced by npm audit, keeping the Vite and Vitest transitive dependency graph secure
Pin undici exactly to version 6.25.0 as it is the only runtime HTTP dependency and its dispatcher behavior is part of the rotation proxy's tested surface. Move to undici 7.x only after Node 18 support is dropped

Files:

package.json

package.json

📄 CodeRabbit inference engine (README.md)

Keep npm postinstall scripts side-effect-free; only print a short notice and avoid running automated commands (especially in CI or non-interactive installs)

Files:

package.json

**

⚙️ CodeRabbit configuration file

**: # PROJECT KNOWLEDGE BASE

Generated: 2026-04-25
Commit: a87e005
Validated: 2026-06-10 against commit 98d9819 (repo audit; claims re-checked against the tree, content not regenerated)
Branch: main
Package version: 2.3.0-beta.3

OVERVIEW

codex-multi-auth is a Codex CLI-first OAuth account manager and optional forwarding wrapper for the official Codex CLI. The installed codex-multi-auth entrypoint handles account-management commands locally, codex-multi-auth-codex forwards official Codex commands through this package's wrapper when explicitly used, and runtime rotation can route live Responses traffic through a localhost account-rotation proxy by default. The plugin-host entrypoint remains exported for compatibility, but the primary product surface is the account manager, optional wrapper, storage, runtime proxy, and repair tooling.

STRUCTURE
./
├── scripts/
│   ├── codex.js              # codex-multi-auth-codex wrapper, official CLI forwarder, shadow CODEX_HOME/runtime proxy setup
│   ├── codex-multi-auth.js   # standalone package CLI entrypoint
│   ├── codex-routing.js      # auth command and compatibility alias routing
│   ├── codex-bin-resolver.js # official Codex binary discovery
│   ├── codex-app-router.js   # persistent localhost router for packaged Codex app bind
│   └── codex-app-launcher.js # reversible user-level app launcher routing helper
├── index.ts                  # optional plugin-host runtime entry
├── lib/                      # core runtime logic (see lib/AGENTS.md)
│   ├── auth/                 # OAuth flow, PKCE, callback server
│   ├── runtime/              # Codex CLI/app integration helpers, app bind, live sync, runtime observability
│   ├── request/              # request transform, SSE, failover, backoff
│   ├── storage/              # path resolution, migrations, backups, restore, import/export
│   ├── codex-cli/            # Codex CLI state sync and writer helpers
│   ├── codex-manager/        # command modules and...

Files:

package.json
AGENTS.md
CHANGELOG.md
README.md
docs/README.md
docs/releases/v2.3.0.md

docs/{README.md,docs/**/*.md}