chore(release): 2.8.1 by ndycode · Pull Request #651 · ndycode/codex-multi-auth

ndycode · 2026-08-02T10:30:22Z

Summary

Release commit for 2.8.1, already published to npm (npm view codex-multi-auth version → 2.8.1).

A corrective release: no new features, no configuration changes, nothing new written to disk.

Closes #647. Landed as #648, #649, and #650.

What Changed

Version stamps — package.json, package-lock.json, .codex-plugin/plugin.json, AGENTS.md, and the three docs/reference/*.md (package \x.y.z`)stamps. Test-count stats intest/AGENTS.mdandtest/README.md` refreshed to 5292 while they were being touched (they had been stale since 2.8.0).

Release notes — new docs/releases/v2.8.1.md, a CHANGELOG.md entry, and both README pointers moved to it. docs/README.md keeps v2.8.0.md in the archive list, since the docs portal is required to link every release note.

Why patch, not minor

2.8.0 was minor because it changed where the official CLI keeps its state — it began writing cli_auth_credentials_store into ~/.codex/config.toml proactively. 2.8.1 only corrects behaviour that was already meant to work, adds no settings, and changes no on-disk formats. That is the same shape as 2.7.1, which was also a patch.

Validation

npm run lint
npm run typecheck
npm test — 5288 passed, 4 skipped, 0 failed
npm test -- test/documentation.test.ts — 32/32
npm run build
npm run audit:ci — exits 0
npm run pack:check — 799 kB across 920 files

Additional Notes

The version bump and the release notes cannot be separated in this repo: test/documentation.test.ts requires docs/releases/v<version>.md to exist and be linked from both READMEs, so a bump on its own fails five documentation checks. Worth knowing for any future release that wants to stage the two.

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

this release commit stamps version 2.8.1 and publishes release notes for fixes already landed in earlier pull requests.

synchronizes package, plugin, reference, and test-suite version metadata.
adds the 2.8.1 changelog and release-note links.
refreshes documented vitest totals to 5,292.

Confidence Score: 5/5

the release-only changes appear safe to merge.

no blocking failure remains in the eligible follow-up scope.

Important Files Changed

Filename	Overview
package.json	updates the npm package version to 2.8.1 without changing runtime dependencies or package behavior.
package-lock.json	synchronizes the root package version; no dependency resolution changes are introduced.
docs/releases/v2.8.1.md	documents the corrective release, including prior wrapper, windows shutdown, and dependency fixes.
CHANGELOG.md	adds the 2.8.1 release entry and links the pull requests where the behavioral changes landed.
test/AGENTS.md	refreshes the documented vitest count and release version without changing coverage.
test/README.md	refreshes the documented vitest count and release version without changing coverage.

_{Reviews (2): Last reviewed commit: "docs(release): give 2.8.1 notes a runnab..." | Re-trigger Greptile}

Context used:

Knowledge Base — Build and Packaging

A corrective release. No new features and no configuration changes. Patch rather than minor: 2.8.0 was minor because it changed where the official CLI keeps its state. This one only corrects behaviour that was already meant to work, adds no settings, and writes nothing new to disk — the same shape as 2.7.1. mcodex resume and mcodex fork hung on a blank TUI whenever runtime rotation was enabled. Both are interactive TUI entry points that carry a forwarded subcommand, so 2.8.0's interactive classification — which matched only an invocation with no subcommand — missed them and left them on the shadow home, whose mirror deliberately omits the runtime SQLite state. Both now use the canonical-home transport, with rotation still enabled. The wrapper could also fail to return to the shell after an interrupted or non-zero exit, because helper shutdown left the detached helper's pipes referenced. Shutdown is now bounded and releases those handles. Separately, --help no longer starts a rotation transport for any request command. Also clears four high-severity advisories that were failing npm run audit:ci: hono 4.12.21 -> 4.12.33 and undici 6.25.0 -> 6.28.0, plus brace-expansion and postcss pinned through overrides for the dev graph. Closes #647. Landed as #648, #649, and #650. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0139f4WZCmWykXZcdEmWTusj

chatgpt-codex-connector · 2026-08-02T10:30:26Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-08-02T10:31:32Z

📝 Walkthrough

minor release with no new features, configuration changes, or on-disk formats. it fixes runtime-rotation hangs for resume and fork, ensures wrapper shutdown after interrupted or failed exits, and prevents rotation transport startup for request-command help. security risk is reduced by dependency updates for four high-severity advisories. regression coverage and validation are reported as successful, but the available summary does not identify specific test files or confirm windows-specific and concurrency coverage.

updates version 2.8.0 to 2.8.1 across package metadata and documentation, including .codex-plugin/plugin.json:1, package.json:3, and docs/reference/commands.md:1.
documents the runtime-rotation fixes and upgrade guidance in CHANGELOG.md:1 and docs/releases/v2.8.1.md:1.
refreshes test statistics from 5,277 to 5,292 in test/AGENTS.md:1 and test/README.md:1.
updates hono, undici, brace-expansion, and postcss to address high-severity audit advisories.
reviewers should focus on the canonical-home TUI path for resume and fork, bounded wrapper shutdown after interruption or failed exit, and transport lifecycle cleanup.
linting, type checking, tests, build, audit, and package checks passed.

Walkthrough

the pull request publishes version 2.8.1. it updates package metadata, release notes, stable-release links, reference documentation, and documented test statistics.

Changes

release metadata and documentation

Layer / File(s)	Summary
version references `.codex-plugin/plugin.json`, `package.json`, `AGENTS.md`, `docs/reference/*`	version references changed from 2.8.0 to 2.8.1.
release notes and stable links `CHANGELOG.md`, `docs/releases/v2.8.1.md`, `README.md`, `docs/README.md`	the 2.8.1 release notes describe runtime-rotation, shutdown, help-command, dependency, and regression-test changes. stable-release links now point to v2.8.1.
test documentation updates `test/AGENTS.md`, `test/README.md`	documented test totals changed from 5,277 to 5,292, and the documented version changed to 2.8.1.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

ndycode/codex-multi-auth#648: implements the runtime-rotation and wrapper-shutdown fixes documented by this release.

Suggested labels: bug

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	the title identifies the 2.8.1 release and uses a valid chore scope, but its summary is not written in lowercase imperative form.	Change the summary to a lowercase imperative phrase, such as "prepare 2.8.1 release".
Linked Issues check	❓ Inconclusive	the release files document `#647`, but no runtime implementation or regression coverage is reviewable; `test/AGENTS.md:9` only updates statistics, leaving windows and concurrency behavior unverified.	provide reviewable source changes or links and regression tests for resume/fork, bounded shutdown, windows behavior, and shutdown concurrency.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	the changes are limited to release metadata, documentation, release notes, and test statistics that support the 2.8.1 release.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	the description covers the release scope, changes, validation, and rationale, but it omits the required risk and rollback section and governance checklist.

📋 Issue Planner

Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).

View plan for ticket: #647

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch release/2.8.1

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch release/2.8.1

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/releases/v2.8.1.md`:
- Around line 50-56: The upgrade notes in the “Upgrade notes” section should
distinguish “no migration required” from “no action required”: retain that no
migration or settings changes are needed, but add the command users should run
to install v2.8.1 and state the expected result that `resume` works without the
`CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0` workaround and account rotation
remains enabled. Follow the documentation template by including the relevant
quick path, troubleshooting guidance if installation or resume fails, and any
new npm scripts if applicable.

In `@package.json`:
- Line 3: Restore the package.json undici dependency to the repository-required
exact version 6.25.0; update docs/releases/v2.8.1.md lines 44-46 and
CHANGELOG.md line 20 to remove or correct the 6.25.0-to-6.28.0 upgrade
documentation, unless the policy is explicitly approved and updated instead.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: daa34fc4-6616-42b7-8e6c-1ca91ae32551

📥 Commits

Reviewing files that changed from the base of the PR and between a7befb0 and 69f33c8.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (12)

.codex-plugin/plugin.json
AGENTS.md
CHANGELOG.md
README.md
docs/README.md
docs/reference/commands.md
docs/reference/public-api.md
docs/reference/settings.md
docs/releases/v2.8.1.md
package.json
test/AGENTS.md
test/README.md

📜 Review details

🧰 Additional context used

📓 Path-based instructions (17)

docs/**/*.md

📄 CodeRabbit inference engine (docs/STYLE_GUIDE.md)

docs/**/*.md: User-facing documentation should follow the page template: Title and one-line lead, Quick path commands, Core operational workflow, Troubleshooting or failure handling, and Related links
Use short sections and scan-friendly tables in documentation where they improve clarity
Prefer direct, actionable language in documentation
Use runnable command examples in documentation
Explain expected outcomes after critical commands in documentation
Keep terminology consistent with runtime names in documentation
Avoid speculative language when behavior is deterministic in documentation
Put the user problem in the first paragraph before implementation detail
Use descriptive page titles such as codex-multi-auth Features instead of generic titles on public docs
Do not repeat keyword lists in every section; search terms should appear only where they help a developer understand the page
Canonical command family is codex-multi-auth ...
Canonical runtime root is ~/.codex/multi-auth
Runtime rotation must be described as default-on unless the release policy changes
Legacy command/path references belong only in migration contexts in documentation
Compatibility aliases (codex multi auth, codex multi-auth, codex multiauth) belong only in command reference, troubleshooting, or migration contexts
Keep command flags aligned with runtime usage text in documentation
Avoid non-runnable command snippets in documentation
Avoid conflicting path guidance across documentation
Avoid legacy-first onboarding language in documentation

Organize repository documentation according to the defined layers: product entry, user operations, reference, and development.

docs/**/*.md: Do not describe codex-multi-auth as replacing @openai/codex or publishing the global codex binary; preserve the official CLI's ownership of codex.
Use codex-multi-auth for account management, and reserve codex-multi-auth-codex or mcodex for intentionally forwarding official Codex commands th...

Files:

docs/reference/public-api.md
docs/reference/settings.md
docs/reference/commands.md
docs/README.md
docs/releases/v2.8.1.md

docs/reference/**/*.md

📄 CodeRabbit inference engine (docs/STYLE_GUIDE.md)

New flags/settings/paths must be reflected in docs/reference/*

docs/reference/**/*.md: Keep command, API, error-contract, settings, and storage-path details in the canonical reference documentation.
Document compatibility aliases (codex multi auth, codex multi-auth, and codex multiauth) only in command-reference, troubleshooting, or migration sections.

Document codex-multi-auth as the primary account-manager CLI, with compatibility aliases and the four published binaries (codex-multi-auth, codex-multi-auth-codex, codex-multi-auth-app-launcher, and mcodex).

Files:

docs/reference/public-api.md
docs/reference/settings.md
docs/reference/commands.md

docs/**/*.{md,mdx}

📄 CodeRabbit inference engine (docs/troubleshooting.md)

Document that codex-multi-auth-codex is the optional forwarding wrapper, while codex-multi-auth is the canonical account-manager command family; the package does not publish a global codex binary.

Document the canonical command names, runtime paths, configuration precedence, storage migration behavior, and upgrade procedures consistently across the referenced documentation.

Files:

docs/reference/public-api.md
docs/reference/settings.md
docs/reference/commands.md
docs/README.md
docs/releases/v2.8.1.md

docs/reference/**/*

📄 CodeRabbit inference engine (docs/reference/public-api.md)

For intentional contract breaks, update affected reference documentation, including command, settings, storage-path, or error-contract documentation as applicable.

Files:

docs/reference/public-api.md
docs/reference/settings.md
docs/reference/commands.md

docs/**

⚙️ CodeRabbit configuration file

keep README, SECURITY, and docs consistent with actual CLI flags and workflows. whenever behavior changes, require updated upgrade notes and mention new npm scripts.

Files:

docs/reference/public-api.md
docs/reference/settings.md
docs/reference/commands.md
docs/README.md
docs/releases/v2.8.1.md

**/package.json

📄 CodeRabbit inference engine (SECURITY.md)

**/package.json: Pin hono to version 4.12.21 or higher to avoid vulnerabilities GHSA-3hrh-pfw6-9m5x, GHSA-2gcr-mfcq-wcc3, GHSA-xrhx-7g5j-rcj5, and GHSA-f577-qrjj-4474 (Set-Cookie injection, app.mount() path-decoding, IPv6 IP-restriction bypass, and JWT scheme-acceptance issues)
Pin rollup to version ^4.59.0 or higher to avoid vulnerabilities in the <4.59.0 range as surfaced by npm audit, keeping the Vite and Vitest transitive dependency graph secure
Pin undici exactly to version 6.25.0 as it is the only runtime HTTP dependency and its dispatcher behavior is part of the rotation proxy's tested surface. Move to undici 7.x only after Node 18 support is dropped

Files:

package.json

docs/{README.md,docs/index.md,docs/README.md}

📄 CodeRabbit inference engine (docs/STYLE_GUIDE.md)

Root README and docs landing pages should naturally include Codex CLI, multi-account OAuth, account switching, health checks, runtime rotation, diagnostics, and recovery when those topics are in scope

Files:

docs/README.md

docs/{README.md,package.json,docs/development/GITHUB_DISCOVERABILITY.md}

📄 CodeRabbit inference engine (docs/STYLE_GUIDE.md)

Keep the repository description, package description, README lead, and docs/development/GITHUB_DISCOVERABILITY.md aligned

Files:

docs/README.md

docs/**/README.md