chore: release v2.1.13-beta.1 (#491) by ndycode · Pull Request #494 · ndycode/codex-multi-auth

ndycode · 2026-05-31T02:28:33Z

Summary

Prerelease v2.1.13-beta.1, shipping the issue #491 multi-workspace work (merged in #493) to the npm beta dist-tag.

Bumps package.json, package-lock.json, and .codex-plugin/plugin.json to 2.1.13-beta.1, adds docs/releases/v2.1.13-beta.1.md, and repoints the current-prerelease links in README.md and docs/README.md.

Persist account workspaces / currentWorkspaceIndex (root-cause Zod-strip fix).
Surface the active workspace name in list / status labels and list every workspace under an account.
New workspace <account> [workspace] command (list + switch active workspace).
New login --org <org_id> flag to bind a specific workspace on demand.
Carries forward the pinned-503 diagnostic from v2.1.13-beta.0.

Release steps after merge

Tag v2.1.13-beta.1 on the squash-merge commit and gh release create as a prerelease using the notes file.
npm publish --tag beta (run separately with publish credentials).

Notes

Prerelease only; stable latest stays 2.1.12. Stable v2.1.13 waits on the issue [bug] 503 Service Unavailable #486 root cause.

Verification

npm run build - clean
Version consistent across package.json, package-lock.json, .codex-plugin/plugin.json (2.1.13-beta.1)
Full suite was green on the merged feature branch (npm test 4043 passed, 269 files)

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

prerelease version bump from v2.1.13-beta.0 → v2.1.13-beta.1, shipping multi-workspace support (#491/#493) to the npm beta dist-tag. all version fields are consistent across package.json, package-lock.json, and .codex-plugin/plugin.json; readme links and the new release notes file are coherent.

bumps the three version-bearing files and adds docs/releases/v2.1.13-beta.1.md with full feature, fix, and known-gap notes for the multi-workspace work.
login --org is documented to temporarily mutate process.env.CODEX_AUTH_ACCOUNT_ID and restore it afterward — a pattern worth watching for async-concurrency safety in the underlying impl.

Confidence Score: 4/5

safe to merge as a prerelease bump; the version files are consistent and the docs are accurate, but the underlying login --org env-var mutation pattern described in the notes carries a real async-concurrency and exception-safety risk in the feature code that shipped in #493.

the diff itself is mechanical — version strings and docs only — so merge risk is low. the concern is what the release notes document: login --org temporarily mutates a shared process env var without a try/finally guard visible in the notes, meaning a thrown exception or a concurrent async login call could leave CODEX_AUTH_ACCOUNT_ID set to the wrong org for the rest of the process, silently binding subsequent accounts to the wrong workspace.

docs/releases/v2.1.13-beta.1.md documents the env-var mutation pattern; the actual implementation from #493 should be verified for a try/finally restore guard and absence of concurrent call paths.

Important Files Changed

Filename	Overview
package.json	version bumped to 2.1.13-beta.1; no other changes
package-lock.json	both version entries updated to 2.1.13-beta.1, consistent with package.json
.codex-plugin/plugin.json	version bumped to 2.1.13-beta.1, consistent with package.json
docs/releases/v2.1.13-beta.1.md	new release notes file; accurately documents the Zod-strip fix, workspace features, and known gaps — but documents a process.env mutation pattern for login --org that warrants a concurrency note
README.md	prerelease link updated to v2.1.13-beta.1.md
docs/README.md	prerelease link updated to v2.1.13-beta.1.md

Sequence Diagram

sequenceDiagram
    participant User
    participant CLI
    participant LoginResolver
    participant Storage
    participant Env as process.env

    User->>CLI: "login --org <org_id>"
    CLI->>Env: "set CODEX_AUTH_ACCOUNT_ID = org_id"
    CLI->>LoginResolver: resolve(account)
    LoginResolver->>Storage: read accounts (Zod V3 schema)
    Note over Storage: workspaces / currentWorkspaceIndex now preserved (Zod-strip fix)
    Storage-->>LoginResolver: AccountMetadataV3 with workspaces[]
    LoginResolver-->>CLI: token + workspace binding
    CLI->>Env: restore CODEX_AUTH_ACCOUNT_ID (prev value)
    CLI->>Storage: persist updated account with workspace

    User->>CLI: "workspace <account> [workspace]"
    CLI->>Storage: read account workspaces[]
    alt workspace index provided
        CLI->>Storage: set currentWorkspaceIndex, persist
        CLI-->>User: switched to workspace name
    else no index
        CLI-->>User: list workspaces (active marked, disabled flagged)
    end

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
docs/releases/v2.1.13-beta.1.md:41-45
**`login --org` env-var mutation is a concurrency risk**

the notes say the impl sets `process.env.CODEX_AUTH_ACCOUNT_ID`, does the login, then restores it. node is single-threaded but async — if two `login --org` calls overlap on the event loop (e.g. a cli invocation racing an in-process retry), the second call can read the first call's value or clobber the restore, assigning the wrong workspace to the wrong account. a scoped parameter passed through the call chain would eliminate the risk entirely. also worth checking: the exception path — if the login resolver throws before the restore runs, the env var stays mutated for the rest of the process lifetime, which on windows could also affect any child-process token writes that inherit the env.

### Issue 2 of 2
docs/releases/v2.1.13-beta.1.md:50-57
**missing vitest coverage for env-var restore under failure**

the test list covers argument parsing and missing-value handling for `login --org`, but doesn't mention a case where the login resolver throws mid-flight and we verify `CODEX_AUTH_ACCOUNT_ID` is still restored to its prior value (or `undefined`). given the mutation pattern described above, a regression here would silently corrupt subsequent logins in the same process without any test catching it.

_{Reviews (1): Last reviewed commit: "chore: release v2.1.13-beta.1 (#491)" | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

Prerelease that ships the multi-workspace support for a single email from issue #491 (PR #493) to npm under the `beta` dist-tag: persist account workspaces, surface the active workspace in list/status, a new `workspace <account> [workspace]` command to list and switch workspaces, and a `login --org <org_id>` flag to bind a specific workspace on demand. Also carries the pinned-account 503 diagnostic from v2.1.13-beta.0. Stable v2.1.13 will land once the issue #486 root cause is identified and patched.

chatgpt-codex-connector · 2026-05-31T02:28:39Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-05-31T02:29:22Z

📝 Walkthrough

This is a low-risk, prerelease maintenance PR that bumps version numbers from 2.1.13-beta.0 to 2.1.13-beta.1 across package.json, package-lock.json, .codex-plugin/plugin.json, and creates corresponding release notes. All version updates are consistent, and documentation links are correctly updated in README files to point to the new v2.1.13-beta.1 release notes.

The actual feature work (multi-workspace support, persistence fixes, new commands, and login workflow enhancements) was already completed and tested in the merged feature branch (#493) with full test suite passing (4043 tests across 269 files). This PR merely formalizes the prerelease version and documentation; there are no new code changes, security concerns, or data-loss risks introduced here. Since this is a prerelease under the beta dist-tag, the stable latest version (2.1.12) remains unaffected, and users must explicitly opt-in to test this version. After merge, the squash-merge commit should be tagged as v2.1.13-beta.1 and published to npm with --tag beta.

Walkthrough

version bump from 2.1.13-beta.0 to 2.1.13-beta.1 updates plugin.json and package.json manifests, adds release notes documenting multi-workspace support with email-based workspaces keyed by org_id, and updates README and docs references to point to the new release notes.

Changes

Version 2.1.13-beta.1 Release

Layer / File(s)	Summary
Version manifest updates `.codex-plugin/plugin.json`, `package.json`	Plugin and package manifest `version` fields incremented from `2.1.13-beta.0` to `2.1.13-beta.1`.
Release documentation and references `docs/releases/v2.1.13-beta.1.md`, `README.md`, `docs/README.md`	New release notes file v2.1.13-beta.1.md created documenting multi-workspace support keyed by org_id, persistence fixes for `workspaces` and `currentWorkspaceIndex`, improved account label formatting, workspace-aware `status`/`list` command behavior, new `workspace <account> [workspace]` command, and `login --org <org_id>` / `--org=<id>` binding. README and docs README links updated to point to new release notes instead of beta.0.

Estimated Code Review Effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	title follows conventional commits format with type 'chore', scope omitted, and summary under 72 chars describing the release action.
Description check	✅ Passed	description covers summary, contents, release steps, and verification; validation and docs checklists present but unchecked, which is acceptable for release PRs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch release/v2.1.13-beta.1

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch release/v2.1.13-beta.1

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

greptile-apps · 2026-05-31T02:30:31Z

+- `login --org <org_id>` (and `--org=<id>`) binds a login to a specific
+  workspace/org. It reuses the `CODEX_AUTH_ACCOUNT_ID` override that every login
+  resolver already honors, scoped to the invocation and restored afterward, so a
+  second workspace can be registered on demand instead of always resolving to the
+  default org.


login --org env-var mutation is a concurrency risk

the notes say the impl sets process.env.CODEX_AUTH_ACCOUNT_ID, does the login, then restores it. node is single-threaded but async — if two login --org calls overlap on the event loop (e.g. a cli invocation racing an in-process retry), the second call can read the first call's value or clobber the restore, assigning the wrong workspace to the wrong account. a scoped parameter passed through the call chain would eliminate the risk entirely. also worth checking: the exception path — if the login resolver throws before the restore runs, the env var stays mutated for the rest of the process lifetime, which on windows could also affect any child-process token writes that inherit the env.

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/releases/v2.1.13-beta.1.md Line: 41-45 Comment: **`login --org` env-var mutation is a concurrency risk** the notes say the impl sets `process.env.CODEX_AUTH_ACCOUNT_ID`, does the login, then restores it. node is single-threaded but async — if two `login --org` calls overlap on the event loop (e.g. a cli invocation racing an in-process retry), the second call can read the first call's value or clobber the restore, assigning the wrong workspace to the wrong account. a scoped parameter passed through the call chain would eliminate the risk entirely. also worth checking: the exception path — if the login resolver throws before the restore runs, the env var stays mutated for the rest of the process lifetime, which on windows could also affect any child-process token writes that inherit the env. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-05-31T02:30:33Z

+
+- Schema round-trip preservation and a workspace-load regression that locks the
+  fix in place.
+- Label disambiguation coverage and `formatWorkspaceLines` output coverage
+  (active marker, disabled annotation, indentation).
+- Nine `workspace`-command cases (list, switch, persistence, already-active
+  no-op, disabled rejection, out-of-range and non-numeric indices).
+- `login --org` argument parsing and missing-value handling.


missing vitest coverage for env-var restore under failure

the test list covers argument parsing and missing-value handling for login --org, but doesn't mention a case where the login resolver throws mid-flight and we verify CODEX_AUTH_ACCOUNT_ID is still restored to its prior value (or undefined). given the mutation pattern described above, a regression here would silently corrupt subsequent logins in the same process without any test catching it.

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/releases/v2.1.13-beta.1.md Line: 50-57 Comment: **missing vitest coverage for env-var restore under failure** the test list covers argument parsing and missing-value handling for `login --org`, but doesn't mention a case where the login resolver throws mid-flight and we verify `CODEX_AUTH_ACCOUNT_ID` is still restored to its prior value (or `undefined`). given the mutation pattern described above, a regression here would silently corrupt subsequent logins in the same process without any test catching it. How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docs/releases/v2.1.13-beta.1.md (1)
68-72: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

add required release-links block to this release note.

this note is missing the required pointers for current prerelease, current stable, prior stable, and archived release notes.
proposed patch
 ## Refs
 
 - Issue `#491` — `[feature] Support registering multiple workspaces for the same email`
 - PR `#493` — `feat: support multiple workspaces for the same email (`#491`)`
+
+## Release Track Links
+
+- Current prerelease: [v2.1.13-beta.1](./v2.1.13-beta.1.md)
+- Current stable: [v2.1.12](./v2.1.12.md)
+- Prior stable: [v2.1.11](./v2.1.11.md)
+- Archived release notes: [v1.3.1](./v1.3.1.md)
as per coding guidelines: "`docs/releases/*.md`: release notes should be organized in the releases/ directory with semantic versioning filenames ... and include current prerelease, current stable, prior stable, and archived release notes".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/releases/v2.1.13-beta.1.md` around lines 68 - 72, The release note file
v2.1.13-beta.1.md is missing the required release-links block; update this
document (near the top, e.g., above or below the "## Refs" section) to include
the standardized release-links block with explicit pointers for current
prerelease, current stable, prior stable, and archived release notes (use the
repository's canonical filenames/URLs for each target), ensuring labels match
the project's release-note format and that the block is present in the
v2.1.13-beta.1.md file.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/releases/v2.1.13-beta.1.md`:
- Around line 68-72: The release note file v2.1.13-beta.1.md is missing the
required release-links block; update this document (near the top, e.g., above or
below the "## Refs" section) to include the standardized release-links block
with explicit pointers for current prerelease, current stable, prior stable, and
archived release notes (use the repository's canonical filenames/URLs for each
target), ensuring labels match the project's release-note format and that the
block is present in the v2.1.13-beta.1.md file.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5078f4b8-3887-47d5-93e5-e2a92f692e2c

📥 Commits

Reviewing files that changed from the base of the PR and between 7ecb4ad and a8530ba.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.codex-plugin/plugin.json
README.md
docs/README.md
docs/releases/v2.1.13-beta.1.md
package.json

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Greptile Review

🧰 Additional context used

📓 Path-based instructions (10)

docs/{README.md,docs/**/*.md}