codex-multi-auth 2.8.2 → 2.8.4

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.8.2",
+	"version": "2.8.4",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -392,7 +392,9 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.8.4.md](docs/releases/v2.8.4.md) — install via `npm i -g codex-multi-auth`
+- Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
+- Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
 - Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)
 - Previous stable: [docs/releases/v2.7.0.md](docs/releases/v2.7.0.md)
 - Previous stable: [docs/releases/v2.6.0.md](docs/releases/v2.6.0.md)

package/dist/lib/codex-manager/formatters/quota-formatters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-formatters.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/formatters/quota-formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,uBAAuB,EAGvB,MAAM,sBAAsB,CAAC;AAY9B,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmCzD;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,wBAAwB,EAClC,GAAG,SAAa,GACd,MAAM,CAGR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,GACpB,kBAAkB,CAgBpB;AAaD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,SAAa,EAChB,OAAO,GAAE,yBAA8B,GACrC,MAAM,CA6BR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,SAAa,EAChB,OAAO,GAAE,yBAA8B,GACrC,MAAM,CA6BR"}
+{"version":3,"file":"quota-formatters.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/formatters/quota-formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,uBAAuB,EAGvB,MAAM,sBAAsB,CAAC;AAY9B,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmCzD;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,wBAAwB,EAClC,GAAG,SAAa,GACd,MAAM,CAIR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,GACpB,kBAAkB,CAgBpB;AA8BD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAgCD,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,SAAa,EAChB,OAAO,GAAE,yBAA8B,GACrC,MAAM,CA6CR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,SAAa,EAChB,OAAO,GAAE,yBAA8B,GACrC,MAAM,CA6CR"}

package/dist/lib/codex-manager/formatters/quota-formatters.js

@@ -43,7 +43,8 @@ export function styleQuotaSummary(summary) {
 export function formatQuotaSnapshotForDashboard(snapshot, settings, now = Date.now()) {
     if (!settings.showQuotaDetails)
         return "live session OK";
-    return `live session OK (${formatCompactQuotaSnapshot(snapshot, now, { showReset: true })})`;
+    const summary = formatCompactQuotaSnapshot(snapshot, now, { showReset: true });
+    return summary ? `live session OK (${summary})` : "live session OK";
 }
 export function quotaCacheEntryToSnapshot(entry) {
     return {
@@ -72,17 +73,38 @@ function formatCompactQuotaWindowLabel(windowMinutes) {
         return `${windowMinutes / 60}h`;
     return `${windowMinutes}m`;
 }
+function isUninformativeFullQuotaWindow(windowMinutes, usedPercent, resetAtMs, now) {
+    if (formatCompactQuotaWindowLabel(windowMinutes) !== "quota")
+        return false;
+    if (typeof usedPercent !== "number" || !Number.isFinite(usedPercent)) {
+        return false;
+    }
+    const left = quotaLeftPercentFromUsed(usedPercent);
+    return (!formatQuotaResetAt(resetAtMs, now) &&
+        (left === undefined || left >= 100));
+}
 function formatCompactQuotaPart(windowMinutes, usedPercent, resetAtMs, options, now) {
     const label = formatCompactQuotaWindowLabel(windowMinutes);
     if (typeof usedPercent !== "number" || !Number.isFinite(usedPercent)) {
         return null;
     }
     const left = quotaLeftPercentFromUsed(usedPercent);
+    // The reset validity is computed regardless of showReset: it also feeds the
+    // uninformative-window check below, so hiding stays consistent across the
+    // compact (no-reset) and check (with-reset) surfaces.
+    const reset = formatQuotaResetAt(resetAtMs, now);
+    // An unlabeled window ("quota" — upstream reported no duration) that sits at
+    // 100% left with no reset timestamp carries no actionable signal; since the
+    // 2026-07/08 upstream limit changes it renders as a permanent "quota 100%"
+    // on every account. Hide exactly that shape: the segment reappears as soon
+    // as the window reports a duration, any depletion, or a reset time.
+    if (!reset && label === "quota" && (left === undefined || left >= 100)) {
+        return null;
+    }
     const part = `${label} ${left}%`;
     if (!options.showReset)
         return part;
     // A missing or malformed reset timestamp must never drop the percentage.
-    const reset = formatQuotaResetAt(resetAtMs, now);
     return reset ? `${part}, resets ${reset}` : part;
 }
 export function formatCompactQuotaSnapshot(snapshot, now = Date.now(), options = {}) {
@@ -99,6 +121,10 @@ export function formatCompactQuotaSnapshot(snapshot, now = Date.now(), options =
     if (parts.length > 0) {
         return parts.join(" | ");
     }
+    if (isUninformativeFullQuotaWindow(snapshot.primary.windowMinutes, snapshot.primary.usedPercent, snapshot.primary.resetAtMs, now) ||
+        isUninformativeFullQuotaWindow(snapshot.secondary.windowMinutes, snapshot.secondary.usedPercent, snapshot.secondary.resetAtMs, now)) {
+        return "";
+    }
     return formatQuotaSnapshotLine(snapshot);
 }
 export function formatAccountQuotaSummary(entry, now = Date.now(), options = {}) {
@@ -115,5 +141,9 @@ export function formatAccountQuotaSummary(entry, now = Date.now(), options = {})
     if (parts.length > 0) {
         return parts.join(" | ");
     }
+    if (isUninformativeFullQuotaWindow(entry.primary.windowMinutes, entry.primary.usedPercent, entry.primary.resetAtMs, now) ||
+        isUninformativeFullQuotaWindow(entry.secondary.windowMinutes, entry.secondary.usedPercent, entry.secondary.resetAtMs, now)) {
+        return "";
+    }
     return formatQuotaSnapshotLine(quotaCacheEntryToSnapshot(entry));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.8.2",
+	"version": "2.8.4",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",

package/scripts/codex.js

@@ -76,6 +76,8 @@ const APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV =
 	"CODEX_MULTI_AUTH_REAL_CODEX_HOME";
 const APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV =
 	"CODEX_MULTI_AUTH_APP_ROTATION_USE_CANONICAL_HOME";
+const APP_RUNTIME_HELPER_INSTALL_APP_SERVER_SHIM_ENV =
+	"CODEX_MULTI_AUTH_APP_ROTATION_INSTALL_APP_SERVER_SHIM";
 const APP_SERVER_CONFIG_ARGS_ENV =
 	"CODEX_MULTI_AUTH_APP_SERVER_CONFIG_ARGS_JSON";
 const APP_RUNTIME_HELPER_STATUS_FILE =
@@ -1769,6 +1771,10 @@ async function forwardToRealCodex(codexBin, rawArgs, baseEnv = process.env) {
 			compatibility,
 			rawArgs,
 		);
+		if (runtimeProxyContext.startupError) {
+			console.error(runtimeProxyContext.startupError);
+			return 1;
+		}
 		const result = await forwardToRealCodexOnce(
 			codexBin,
 			runtimeProxyContext.args,
@@ -4058,17 +4064,30 @@ async function runRuntimeRotationAppHelper(identityToken = "") {
 					clientApiKey,
 					configTomlModule,
 				);
-		const appServerConfigArgs = useCanonicalHome
-			? [
-					...(runtimeContext.args ?? []),
-					"-c",
-					`model_provider=${configTomlModule.tomlStringLiteral(RUNTIME_ROTATION_PROXY_PROVIDER_ID)}`,
-				]
-			: [];
-		appServerShimDir = installRuntimeRotationAppServerCliShim(
-			runtimeContext.env,
-			appServerConfigArgs,
-		);
+		// The shim only exists so a Codex process that spawns its own
+		// `codex app-server` through `CODEX_CLI_PATH` — the desktop app — gets that
+		// spawn routed back through the wrapper. Installing it is not free and not
+		// inert: it copies the node image into a per-pid directory and stamps
+		// `CODEX_CLI_PATH`, `NODE_OPTIONS` and `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`
+		// onto the environment every forwarded child inherits. A wrapper-invoked
+		// `app-server` is already launched with the rotation overrides on its own
+		// command line, so it must not pay for or inherit any of that (#659).
+		const installAppServerShim =
+			(process.env[APP_RUNTIME_HELPER_INSTALL_APP_SERVER_SHIM_ENV] ?? "1").trim() !==
+			"0";
+		if (installAppServerShim) {
+			const appServerConfigArgs = useCanonicalHome
+				? [
+						...(runtimeContext.args ?? []),
+						"-c",
+						`model_provider=${configTomlModule.tomlStringLiteral(RUNTIME_ROTATION_PROXY_PROVIDER_ID)}`,
+					]
+				: [];
+			appServerShimDir = installRuntimeRotationAppServerCliShim(
+				runtimeContext.env,
+				appServerConfigArgs,
+			);
+		}
 		lastRequestCount = proxyServer.getStatus?.().totalRequests ?? 0;
 		publishStatus("running");
 		process.stdout.write(
@@ -4194,6 +4213,8 @@ function startRuntimeRotationAppHelper(baseContext, options = {}) {
 			[APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV]: realCodexHome,
 			[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV]:
 				options.useCanonicalHome === true ? "1" : "0",
+			[APP_RUNTIME_HELPER_INSTALL_APP_SERVER_SHIM_ENV]:
+				options.installAppServerShim === false ? "0" : "1",
 		};
 		const helper = spawn(
 			process.execPath,
@@ -4227,6 +4248,12 @@ function startRuntimeRotationAppHelper(baseContext, options = {}) {
 		}, APP_RUNTIME_HELPER_LAUNCH_TIMEOUT_MS);
 		helper.stdout?.setEncoding("utf8");
 		helper.stdout?.on("data", (chunk) => {
+			// Keep consuming after startup settles so the helper never blocks on a
+			// full pipe, but stop accumulating: `app-server` holds this parent open
+			// for the resident server's whole life, so a buffer that only ever grows
+			// is a leak, and re-parsing the retained ready line on every later chunk
+			// is pure waste.
+			if (settled) return;
 			stdoutBuffer += chunk;
 			const newlineIndex = stdoutBuffer.indexOf("\n");
 			if (newlineIndex < 0) return;
@@ -4249,6 +4276,7 @@ function startRuntimeRotationAppHelper(baseContext, options = {}) {
 		});
 		helper.stderr?.setEncoding("utf8");
 		helper.stderr?.on("data", (chunk) => {
+			if (settled) return;
 			stderrBuffer += chunk;
 		});
 		helper.once("error", fail);
@@ -4268,11 +4296,17 @@ async function createRuntimeRotationAppHelperContext(
 	configTomlModule,
 	options = {},
 ) {
-	const startedAt = Date.now();
 	const { helper, message } = await startRuntimeRotationAppHelper(
 		baseContext,
 		options,
 	);
+	// Start the grace clock once the helper is ready, not before it is launched.
+	// Launching is bounded by APP_RUNTIME_HELPER_LAUNCH_TIMEOUT_MS (15s), so a
+	// cold or loaded machine could otherwise burn the whole 5s window before the
+	// forwarded command had run at all, and `codex app` — which relies on the
+	// window rather than an explicit `detachOnExit` — would kill the helper it
+	// had just handed the desktop app off to.
+	const startedAt = Date.now();
 	const helperEnv = message.env ?? {};
 	const helperShimDir =
 		typeof helperEnv.CODEX_CLI_PATH === "string" &&
@@ -4284,9 +4318,16 @@ async function createRuntimeRotationAppHelperContext(
 		: [];
 	const detachGraceMs = resolveRuntimeRotationAppHelperDetachGraceMs(baseContext.env);
 
+	// An explicit `detachOnExit: false` is a decision, not a default: a resident
+	// server owns its proxy for its whole lifetime, and leaving the helper behind
+	// on a short-lived run — a client attaches, runs one query, disconnects —
+	// strands it for the full idle timeout with nobody left to refresh its
+	// activity clock. Only an unset `detachOnExit` falls back to the grace window.
 	const cleanup = async ({ exitCode } = {}) => {
 		const livedMs = Date.now() - startedAt;
-		if (exitCode === 0 && (options.detachOnExit === true || livedMs < detachGraceMs)) {
+		const detachWithinGrace =
+			options.detachOnExit !== false && livedMs < detachGraceMs;
+		if (exitCode === 0 && (options.detachOnExit === true || detachWithinGrace)) {
 			helper.stdout?.destroy();
 			helper.stderr?.destroy();
 			helper.unref();
@@ -4321,6 +4362,11 @@ async function createRuntimeRotationAppHelperContext(
 			...baseContext.env,
 			...helperEnv,
 		},
+		// Without the app-server shim there is no `CODEX_MULTI_AUTH_APP_SERVER_ACCOUNT_LABEL`
+		// in the forwarded environment, so the caller has to ask for the
+		// `account/read` / `getAuthStatus` / `account/rateLimits/read` rewriting
+		// explicitly. Only the shadow branch used to set it.
+		proxyAppServerAccountRead: options.proxyAppServerAccountRead === true,
 		cleanup: async (details) => {
 			try {
 				await cleanup(details);
@@ -4348,14 +4394,56 @@ async function createRuntimeRotationProxyContextIfEnabled(
 		return baseContext;
 	}
 
+	// A helper that cannot start is a hard failure for these branches — unlike the
+	// shadow path below, there is no rotation-off shape left to degrade into. Turn
+	// it into a diagnostic and a nonzero exit rather than an unhandled rejection,
+	// and release the compatibility shadow home the caller already built.
+	const startAppHelperContext = async (options) => {
+		try {
+			return await createRuntimeRotationAppHelperContext(
+				baseContext,
+				configTomlModule,
+				options,
+			);
+		} catch (error) {
+			try {
+				baseContext.cleanup?.();
+			} catch {
+				// Best-effort cleanup only; report the original failure.
+			}
+			return {
+				startupError: `codex-multi-auth runtime rotation helper failed to start: ${
+					error instanceof Error ? error.message : String(error)
+				}`,
+			};
+		}
+	};
+
+	// `app-server` is a resident process, and the shadow home cannot host one: the
+	// mirror links directories, so Codex's lstat-strict check on
+	// `<CODEX_HOME>/app-server-control` refuses to start, and a server that does
+	// start serves every attached client a frozen snapshot of the thread index for
+	// its whole life. Same reasoning that moved `resume`/`fork` in #648 (#659).
+	if (isCodexAppServerCommand(rawArgs)) {
+		return startAppHelperContext({
+			// A resident server owns its proxy for its whole lifetime.
+			detachOnExit: false,
+			useCanonicalHome: true,
+			// Nothing here spawns `codex app-server` through `CODEX_CLI_PATH`; the
+			// server is launched with the rotation overrides already on its command
+			// line. See the shim gate in `runRuntimeRotationAppHelper`.
+			installAppServerShim: false,
+			proxyAppServerAccountRead: true,
+		});
+	}
 	if (isCodexAppCommand(rawArgs)) {
-		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule);
+		return startAppHelperContext();
 	}
 	if (
 		isCodexInteractiveTuiCommand(rawArgs) ||
 		isCodexInteractiveResumeCommand(rawArgs)
 	) {
-		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule, {
+		return startAppHelperContext({
 			detachOnExit: true,
 			useCanonicalHome: true,
 		});