v2.8.2
August 13, 2026 · View on GitHub
Five bug fixes across login, uninstall, diagnostics, and quota handling. Nothing to migrate.
npm i -g codex-multi-auth
Fixes
Manual and incognito login works again. When you can't use the automatic browser flow, the login command now shows you the complete authorization URL — and pasting the callback back in no longer fails with a confusing state-mismatch error (#652).
Uninstall points at the right package. The instructions were sending people to the old scoped package name, which can't remove what's actually installed. Cleanup also clears legacy caches, config entries, and launcher metadata, retrying through the transient Windows file locks that used to leave things behind (#653).
why-selected now matches what actually happens. It was showing you a winning account that the rotation proxy would never have picked. It now runs the same availability gates and policy inputs as the real thing, so paused, drained, policy-blocked, token-invalid, and quota-excluded accounts show up properly (#654).
Revoked accounts stay out of rotation. When a provider reports a token as invalid, the account is now marked token-invalid — re-login needed everywhere you'd look — status, health checks, forecasts, diagnostics — and stays out of routing instead of rejoining the pool after a short cooldown. Logging in again clears it (#655).
Exhausted weekly and monthly quotas wait for the real reset. An account with days left on its window was cycling back into rotation after a flat two-hour fallback and immediately getting a 429. It now defers until the actual reset timestamp when the provider gives a trustworthy one, falling back to the old behaviour when it doesn't (#656).
Under the hood
Rotation helpers now verify they own a process before shutting it down — identity token, timestamp, command, and script path all have to match — so an unrelated process is never mistaken for one of ours. On Windows, app-server shims use their own codex.exe copy rather than hard-linking the running Node image, so cleanup isn't blocked by a file lock.
If an account shows token-invalid
codex-multi-auth login
The marker clears after a successful login or refresh.
To remove the package
codex-multi-auth uninstall
npm uninstall -g codex-multi-auth