codex-multi-auth 1.3.2 → 2.0.1

package/README.md

@@ -3,28 +3,32 @@
 [![npm version](https://img.shields.io/npm/v/codex-multi-auth.svg)](https://www.npmjs.com/package/codex-multi-auth)
 [![npm downloads](https://img.shields.io/npm/dw/codex-multi-auth.svg)](https://www.npmjs.com/package/codex-multi-auth)
 
-Codex CLI-first multi-account OAuth manager for the official Codex CLI, including the `@openai/codex` npm launcher and native `codex` installs.
+Codex CLI-first multi-account OAuth manager for the official Codex CLI. The installed `codex` wrapper handles `codex auth ...` locally, forwards normal Codex commands to the official runtime, and can optionally route live Responses traffic through a localhost account-rotation proxy.
 
 <img width="1270" height="729" alt="2026-02-28 12_54_58-prompt txt ‎- Notepads" src="https://github.com/user-attachments/assets/0cecb77e-a6d3-432a-ba48-3577db0c7093" />
 
 
+
 > [!NOTE]
 > Legacy scoped prerelease package `@ndycode/codex-multi-auth` is migration-only.
 > Use `codex-multi-auth` for all new installs.
 
 ## What You Get
 
-- Canonical `codex auth ...` workflow for account login, switching, checks, and diagnostics
-- Multi-account OAuth pool with health-aware selection and automatic failover
-- Project-scoped account storage under `~/.codex/multi-auth/projects/<project-key>/...`
-- Interactive dashboard for account actions and settings
-- Experimental settings tab for staged sync, backup, and refresh-guard controls
-- Forecast, report, fix, and doctor commands for operational safety
-- Runtime counters, budget/cooldown state, and multi-auth probe visibility in `codex auth status` / `codex auth report`
-- Flagged account verification and restore flow
-- Session affinity and live account sync controls
-- Proactive refresh and preemptive quota deferral controls
-- Codex-oriented request/prompt compatibility with strict runtime handling
+- Canonical `codex auth ...` workflow for account login, switching, checks, and diagnostics
+- Official Codex CLI forwarding for all non-auth commands
+- Multi-account OAuth pool with health-aware selection and automatic failover
+- Project-scoped account storage under `~/.codex/multi-auth/projects/<project-key>/...`
+- Interactive dashboard for account actions and settings
+- Experimental settings tab for staged sync, backup, and refresh-guard controls
+- Forecast, report, fix, and doctor commands for operational safety
+- Runtime counters, budget/cooldown state, and multi-auth probe visibility in `codex auth status` / `codex auth report`
+- Default-on runtime Responses proxy for live account rotation inside forwarded Codex CLI/app sessions
+- Reversible packaged Codex app bind and user-level launcher routing helpers
+- Flagged account verification and restore flow
+- Session affinity and live account sync controls
+- Proactive refresh and preemptive quota deferral controls
+- Codex-oriented request/prompt compatibility with strict runtime handling
 - Stable docs set for install, config, troubleshooting, and upgrade paths
 
 ---
@@ -35,7 +39,7 @@ Codex CLI-first multi-account OAuth manager for the official Codex CLI, includin
 > [!CAUTION]
 > This project uses OAuth account credentials and is intended for personal development use.
 >
-> By using this plugin, you acknowledge:
+> By using this package, you acknowledge:
 > - This is an independent open-source project, not an official OpenAI product
 > - You are responsible for your own usage and policy compliance
 > - For production/commercial workloads, use the OpenAI Platform API
@@ -165,9 +169,10 @@ If browser launch is blocked, use the alternate login paths in [docs/getting-sta
 
 | Command | What it answers |
 | --- | --- |
-| `codex auth report --live --json` | How do I get the full machine-readable health report? |
-| `codex auth fix --live --model gpt-5-codex` | How do I run live repair probes with a chosen model? |
-| `codex auth why-selected --json` | Which account does the selector pick now, and why? |
+| `codex auth report --live --json` | How do I get the full machine-readable health report? |
+| `codex auth fix --live --model gpt-5.3-codex` | How do I run live repair probes with a chosen model? |
+| `codex auth why-selected --json` | Which account does the selector pick now, and why? |
+| `codex auth rotation status` | Is live runtime account rotation enabled for forwarded Codex sessions? |
 
 ### Reliability behavior
 
@@ -211,9 +216,11 @@ If browser launch is blocked, use the alternate login paths in [docs/getting-sta
 | Accounts | `~/.codex/multi-auth/openai-codex-accounts.json` |
 | Flagged accounts | `~/.codex/multi-auth/openai-codex-flagged-accounts.json` |
 | Quota cache | `~/.codex/multi-auth/quota-cache.json` |
-| Runtime observability | `~/.codex/multi-auth/runtime-observability.json` |
-| Logs | `~/.codex/multi-auth/logs/codex-plugin/` |
-| Per-project accounts | `~/.codex/multi-auth/projects/<project-key>/openai-codex-accounts.json` |
+| Runtime observability | `~/.codex/multi-auth/runtime-observability.json` |
+| Runtime app helper status | `~/.codex/multi-auth/runtime-rotation-app-helper.json` |
+| Persistent app bind state/logs | `~/.codex/multi-auth/app-bind/` |
+| Logs | `~/.codex/multi-auth/logs/codex-plugin/` |
+| Per-project accounts | `~/.codex/multi-auth/projects/<project-key>/openai-codex-accounts.json` |
 
 Override root with `CODEX_MULTI_AUTH_DIR=<path>`.
 
@@ -230,9 +237,14 @@ Selected runtime/environment overrides:
 | Variable | Effect |
 | --- | --- |
 | `CODEX_MULTI_AUTH_DIR` | Override settings/accounts root |
-| `CODEX_MULTI_AUTH_CONFIG_PATH` | Alternate config file path |
-| `CODEX_MODE=0/1` | Disable/enable Codex mode |
-| `CODEX_TUI_V2=0/1` | Disable/enable TUI v2 |
+| `CODEX_MULTI_AUTH_CONFIG_PATH` | Alternate config file path |
+| `CODEX_MODE=0/1` | Disable/enable Codex mode |
+| `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0/1` | Opt out/in of live Responses proxy rotation for forwarded Codex CLI/app sessions |
+| `CODEX_MULTI_AUTH_APP_ROTATION_IDLE_MS=<ms>` | Override automatic Codex app helper idle shutdown |
+| `CODEX_MULTI_AUTH_APP_BIND_INSTALL=0/1` | Opt out/in of packaged Codex app bind self-heal during install/update or rotation enable |
+| `CODEX_MULTI_AUTH_APP_LAUNCHER_INSTALL=0/1` | Opt out/in of routing supported app shortcuts during install/update or rotation enable |
+| `CODEX_MULTI_AUTH_AUTO_UPDATE=0/1` | Opt out/in of best-effort global package auto-update checks |
+| `CODEX_TUI_V2=0/1` | Disable/enable TUI v2 |
 | `CODEX_TUI_COLOR_PROFILE=truecolor|ansi256|ansi16` | TUI color profile |
 | `CODEX_TUI_GLYPHS=ascii|unicode|auto` | TUI glyph style |
 | `CODEX_AUTH_BACKGROUND_RESPONSES=0/1` | Opt in/out of stateful Responses `background: true` compatibility |
@@ -247,7 +259,9 @@ codex auth check
 codex auth forecast --live
 ```
 
-Responses background mode stays opt-in. Enable `backgroundResponses` in settings or `CODEX_AUTH_BACKGROUND_RESPONSES=1` only for callers that intentionally send `background: true`, because those requests switch from stateless `store=false` routing to stateful `store=true`. See [docs/upgrade.md](docs/upgrade.md) for rollout guidance.
+Responses background mode stays opt-in. Enable `backgroundResponses` in settings or `CODEX_AUTH_BACKGROUND_RESPONSES=1` only for callers that intentionally send `background: true`, because those requests switch from stateless `store=false` routing to stateful `store=true`. See [docs/upgrade.md](docs/upgrade.md) for rollout guidance.
+
+Runtime rotation is enabled by default for request-bearing wrapper-launched Codex sessions. Global install/update self-heals supported packaged Codex app binds and user-level launcher routing when possible, while `codex auth rotation enable` remains the explicit repair command. `codex auth rotation disable` turns the setting off and removes the persistent app bind. Set `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`, `CODEX_MULTI_AUTH_APP_BIND_INSTALL=0`, `CODEX_MULTI_AUTH_APP_LAUNCHER_INSTALL=0`, or `CODEX_MULTI_AUTH_AUTO_UPDATE=0` to opt out of the matching default behavior.
 
 ---
 
@@ -333,9 +347,9 @@ codex auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v1.3.2.md](docs/releases/v1.3.2.md)
-- Previous stable: [docs/releases/v1.3.1.md](docs/releases/v1.3.1.md)
-- Earlier stable: [docs/releases/v1.3.0.md](docs/releases/v1.3.0.md)
+- Current stable: [docs/releases/v2.0.1.md](docs/releases/v2.0.1.md)
+- Previous stable: [docs/releases/v1.3.2.md](docs/releases/v1.3.2.md)
+- Earlier stable: [docs/releases/v1.3.1.md](docs/releases/v1.3.1.md)
 - Full release archive: [docs/README.md#release-history](docs/README.md#release-history)
 - Archived prerelease: [docs/releases/v0.1.0-beta.0.md](docs/releases/v0.1.0-beta.0.md)
 

package/config/README.md

@@ -1,6 +1,6 @@
 # Config Templates
 
-These files are example model/provider templates for `codex-multi-auth`.
+These files are optional model/provider templates for host/plugin configurations that still load `codex-multi-auth` directly. The normal wrapper workflow uses `codex auth ...` and does not require these templates.
 
 ## Primary (Codex-named)
 
@@ -12,12 +12,12 @@ These files are example model/provider templates for `codex-multi-auth`.
 
 ## Notes
 
-- These templates are optional for the OAuth account manager flow.
-- Core auth commands use `codex auth login`.
+- These templates are optional for the OAuth account manager flow and the runtime rotation proxy.
+- Core auth commands use `codex auth login`.
 
 ## Defaults Included
 
-- GPT-5.x Codex model families
+- Current documented OpenAI/Codex model families (`gpt-5.5`, `gpt-5.4`, and `gpt-5.3-codex`)
 - `store: false`
 - `include: ["reasoning.encrypted_content"]`
 - Sensible fallback behavior for unsupported model entitlements