Codestin Search App

ndycode · 2026-06-09T17:44:43Z

Summary

Part 2 of the repo-wide audit (see #517 for part 1). Three small, independent packaging corrections — each one verified against the actual npm behavior before changing.

Changes

engines.node: >=18.0.0 → >=18.17.0
[email protected] (a direct dependency) requires Node >=18.17. The previous floor advertised support the dependency tree can't actually deliver — npm install on 18.0–18.16 would warn/fail at the undici level while this package claimed compatibility. Doc claims in CONTRIBUTING.md, docs/getting-started.md, and AGENTS.md are synced.
Remove peerDependencies.typescript: "^5"
The published package ships compiled dist/ JS + .d.ts. Consumers never need the TypeScript compiler at runtime or to consume the types; the peer range only produced install-time peer warnings for JS-only users. TypeScript remains a devDependency (^5.9.3).
Delete .npmignore
npm ignores .npmignore entirely when package.json#files is present (which it is). The file was dead config that could mislead contributors into thinking it gates the tarball; the files allowlist + scripts/check-pack-budget.mjs are the real controls.

package-lock.json is updated surgically (root entry only) to avoid unrelated lockfile churn from npm version drift.

Testing

npm install resolves cleanly; npm ls --omit=dev clean ✅
test/documentation.test.ts (enforces docs/package coherence) ✅
node scripts/check-pack-budget.mjs → pack budget ok, 1,022,387 bytes / 1,101 files ✅
test/install-codex-auth.test.ts: 2 pre-existing sandbox-only failures (identical on clean main), everything else passes ✅

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

Generated by Claude Code

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

three independent packaging corrections: tighten the engines.node floor to >=18.17.0 (matching what [email protected] actually requires), drop the typescript peer dep (the package ships compiled dist/ + .d.ts so consumers never need the compiler), and delete the now-dead .npmignore (superseded by the package.json#files allowlist). docs are synced across AGENTS.md, CONTRIBUTING.md, and docs/getting-started.md.

engines.node bump — >=18.0.0 → >=18.17.0; eliminates the false-compatibility window where npm install on node 18.0–18.16 would fail at the undici level while this package claimed support.
peerDependencies.typescript removal — no longer warns JS-only consumers about an unnecessary peer; typescript stays as a devDependency.
.npmignore deletion — removes misleading dead config; files array in package.json and scripts/check-pack-budget.mjs remain the sole tarball controls. CONTRIBUTING.md now explicitly directs contributors to node 20.19+/22.13+, neatly side-stepping the >=18.18 transitive dev-dep floor raised in the previous review thread.

Confidence Score: 5/5

safe to merge — all three changes are well-scoped packaging corrections with no runtime behavior impact.

changes are purely metadata and docs: an engines floor bump that correctly reflects an existing dependency constraint, removal of a peer dep that was never functionally required, and deletion of a dead file that npm was already ignoring. no source code or auth logic is touched, no token handling paths change, and the lockfile update is surgical (root entry only). the previous review thread concern about >=18.18 for dev toolchain is fully addressed by directing contributors to node 20+ rather than trying to thread the 18.x patch-version needle.

no files require special attention — all changes are consistent and straightforward.

Important Files Changed

Filename	Overview
package.json	removes `peerDependencies.typescript` and bumps `engines.node` to `>=18.17.0`; both changes are correct — compiled dist ships its own `.d.ts` files and [email protected] mandates the 18.17 floor
package-lock.json	surgical root-entry-only update to mirror package.json — engines bumped and peerDependencies block dropped, no unrelated lockfile churn
.npmignore	correctly deleted — npm ignores `.npmignore` when `package.json#files` is present, which it is; `files` allowlist plus `check-pack-budget.mjs` are the real tarball controls
CONTRIBUTING.md	cleanly separates consumer floor (`>=18.17`) from dev requirement (`20.19+` / `22.13+`), making the previous >=18.18 transitive-devDep mismatch a non-issue by steering contributors off Node 18 entirely
AGENTS.md	convention comment updated from `Node >= 18` to `Node >= 18.17`, consistent with the engines change
docs/getting-started.md	prerequisites updated from `18+` to `18.17+`; keeps docs in sync with the new engines floor

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[npm install codex-multi-auth] --> B{Node version?}
    B -- "< 18.17" --> C[❌ engines mismatch\[email protected] fails]
    B -- ">= 18.17" --> D[✅ install succeeds]
    D --> E{User type?}
    E -- "JS consumer" --> F[uses compiled dist/ + .d.ts\nno typescript peer dep warning]
    E -- "TS consumer" --> G[uses compiled dist/ + .d.ts\nbrings own typescript]
    E -- "contributor" --> H[needs Node 20.19+ / 22.13+\nfor vitest + eslint dev toolchain]
    D --> I[tarball contents]
    I --> J[package.json#files allowlist\n+ check-pack-budget.mjs]
    J -- ".npmignore deleted" --> K[no misleading dead config]

_{Reviews (2): Last reviewed commit: "docs(contributing): distinguish runtime ..." | Re-trigger Greptile}

…d .npmignore - engines.node >=18.0.0 -> >=18.17.0: undici 6.x requires Node >=18.17, so the old floor advertised support the dependency tree cannot deliver - remove peerDependencies.typescript: the published package ships compiled dist/ JS and .d.ts files; consumers never need the TS compiler installed, and the peer range only added install-time warnings for JS-only users - delete .npmignore: npm ignores it entirely when package.json "files" is present (which it is), so the file was dead config that could mislead contributors into thinking it gates the tarball - sync the Node-floor claims in CONTRIBUTING.md, docs/getting-started.md, and AGENTS.md https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

chatgpt-codex-connector · 2026-06-09T17:44:48Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-06-09T17:45:16Z

📝 Walkthrough

Walkthrough

the pr bumps the minimum node.js version from 18.0.0 to 18.17.0 across the package engine declaration and all user-facing documentation. four ranges updated: package.json engines constraint, plus matching updates to AGENTS.md, CONTRIBUTING.md, and getting-started documentation.

Node.js 18.17 Minimum Version Requirement

Layer / File(s)	Summary
Package engine requirement `package.json`	`engines.node` field enforces Node.js >=18.17.0, narrowing the supported version range from >=18.0.0.
Documentation updates `AGENTS.md`, `CONTRIBUTING.md`, `docs/getting-started.md`	all docs reflecting runtime prerequisites now specify Node.js 18.17+ instead of 18+.

Estimated Code Review Effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	title exceeds 72 character limit (81 chars) and violates conventional commits length requirement.	shorten to ≤72 chars; e.g., 'chore(packaging): bump engines, remove dead npmignore' (54 chars).

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description is comprehensive and follows the template structure with all critical sections: summary, detailed changes, validation checklist completion evidence, and testing verification.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/audit-02-packaging-hygiene

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch claude/audit-02-packaging-hygiene

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 155: Update the package.json engines.node entry to ">=18.17.0" (change
the existing "node" floor to match [email protected]) and update the CI workflow
that defines the Node matrix (the job that uses node-version) to include
"18.17.x" alongside existing 20.x and 22.x so tests run against the new minimum;
target the engines.node key in package.json and the node-version matrix entries
in your CI workflow file.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9b4d00eb-6d6f-4e56-a8c6-2f9ab11b8f9e

📥 Commits

Reviewing files that changed from the base of the PR and between 98d9819 and 8d86954.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.npmignore
AGENTS.md
CONTRIBUTING.md
docs/getting-started.md
package.json

💤 Files with no reviewable changes (1)

.npmignore

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Greptile Review

🧰 Additional context used

📓 Path-based instructions (4)

**

⚙️ CodeRabbit configuration file

**: # PROJECT KNOWLEDGE BASE

Generated: 2026-04-25
Commit: a87e005
Branch: main
Package version: 2.2.0

OVERVIEW

codex-multi-auth is a Codex CLI-first OAuth account manager and optional forwarding wrapper for the official Codex CLI. The installed codex-multi-auth entrypoint handles account-management commands locally, codex-multi-auth-codex forwards official Codex commands through this package's wrapper when explicitly used, and runtime rotation can route live Responses traffic through a localhost account-rotation proxy by default. The plugin-host entrypoint remains exported for compatibility, but the primary product surface is the account manager, optional wrapper, storage, runtime proxy, and repair tooling.

STRUCTURE
./
├── scripts/
│   ├── codex.js              # codex-multi-auth-codex wrapper, official CLI forwarder, shadow CODEX_HOME/runtime proxy setup
│   ├── codex-multi-auth.js   # standalone package CLI entrypoint
│   ├── codex-routing.js      # auth command and compatibility alias routing
│   ├── codex-bin-resolver.js # official Codex binary discovery
│   ├── codex-app-router.js   # persistent localhost router for packaged Codex app bind
│   └── codex-app-launcher.js # reversible user-level app launcher routing helper
├── index.ts                  # optional plugin-host runtime entry
├── lib/                      # core runtime logic (see lib/AGENTS.md)
│   ├── auth/                 # OAuth flow, PKCE, callback server
│   ├── runtime/              # Codex CLI/app integration helpers, app bind, live sync, runtime observability
│   ├── request/              # request transform, SSE, failover, backoff
│   ├── storage/              # path resolution, migrations, backups, restore, import/export
│   ├── codex-cli/            # Codex CLI state sync and writer helpers
│   ├── codex-manager/        # command modules and settings panels
│   ├── prompts/              # model-family prompts, GitHub ETag cache
│   ├── recovery/             # conve...

Files:

CONTRIBUTING.md
package.json
docs/getting-started.md
AGENTS.md

package.json

📄 CodeRabbit inference engine (SECURITY.md)

package.json: Pin hono dependency to version 4.12.21 or later to avoid vulnerabilities (GHSA-3hrh-pfw6-9m5x, GHSA-2gcr-mfcq-wcc3, GHSA-xrhx-7g5j-rcj5, GHSA-f577-qrjj-4474)
Pin rollup dependency to version ^4.59.0 or later to avoid vulnerabilities in the Vite and Vitest transitive dependency graph

Files:

package.json

docs/**/*.md

📄 CodeRabbit inference engine (docs/STYLE_GUIDE.md)

docs/**/*.md: User-facing documentation should follow the page template: Title and one-line lead, Quick path commands, Core operational workflow, Troubleshooting or failure handling, and Related links
Use short sections and scan-friendly tables in documentation where they improve clarity
Prefer direct, actionable language in documentation
Use runnable command examples in documentation
Explain expected outcomes after critical commands in documentation
Keep terminology consistent with runtime names in documentation
Avoid speculative language when behavior is deterministic in documentation
Put the user problem in the first paragraph before implementation detail
Use descriptive page titles such as codex-multi-auth Features instead of generic titles on public docs
Do not repeat keyword lists in every section; search terms should appear only where they help a developer understand the page
Canonical command family is codex-multi-auth ...
Canonical runtime root is ~/.codex/multi-auth
Runtime rotation must be described as default-on unless the release policy changes
Legacy command/path references belong only in migration contexts in documentation
Compatibility aliases (codex multi auth, codex multi-auth, codex multiauth) belong only in command reference, troubleshooting, or migration contexts
Keep command flags aligned with runtime usage text in documentation
Avoid non-runnable command snippets in documentation
Avoid conflicting path guidance across documentation
Avoid legacy-first onboarding language in documentation

docs/**/*.md: Documentation should follow the structure defined in DOCUMENTATION.md governance contract, with clear sections for Getting Started, Daily Use, Release History, Repair, Reference, Maintainer Docs, and Governance
All documentation must reference governance files (README.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md) in a Governance section

Files:

docs/getting-started.md

docs/**

⚙️ CodeRabbit configuration file

keep README, SECURITY, and docs consistent with actual CLI flags and workflows. whenever behavior changes, require updated upgrade notes and mention new npm scripts.

Files:

docs/getting-started.md

⚙️ CodeRabbit configuration file

docs/**: # Documentation Architecture

Canonical governance for repository documentation quality and consistency.

Documentation Layers

Layer Audience Primary goal

Product entry New operators and search visitors Explain the project quickly, prioritize the right concepts first, and complete first successful login/check

User operations Daily users Configure, run, recover, and report issues safely

Reference Power users and maintainers Exact command, setting, and path lookup

Development Contributors and maintainers Internal architecture, flow, tests, and ownership

Source of Truth Map

Scope File

Project entry README.md

Docs portal docs/README.md

Daily operator landing docs/index.md

Onboarding docs/getting-started.md

FAQ docs/faq.md

Public architecture overview docs/architecture.md

Feature map docs/features.md

Configuration guide docs/configuration.md

Troubleshooting guide docs/troubleshooting.md

Privacy and data handling docs/privacy.md

Upgrade and migration docs/upgrade.md

Command reference docs/reference/commands.md

Public API contract docs/reference/public-api.md

Error contract reference docs/reference/error-contracts.md

Settings reference docs/reference/settings.md

Storage path reference docs/reference/storage-paths.md

Docs style contract docs/STYLE_GUIDE.md

Docs governance (this file) docs/DOCUMENTATION.md

Architecture internals docs/development/ARCHITECTURE.md

Runtime rotation implementation guide docs/development/ARCHITECTURE.md

GitHub metadata guidance docs/development/GITHUB_DISCOVERABILITY.md

IA/findability audit (2026-03-01) docs/development/IA_FINDABILITY_AUDIT_2026-03-01.md

Config fields internals docs/development/CONFIG_FIELDS.md

Config flow internals `docs/development/CONF...

Files:

docs/getting-started.md

🧠 Learnings (1)

📓 Common learnings

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Ensure Node.js version is 18.17 or higher

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Install the official openai/codex CLI as a prerequisite before installing codex-multi-auth

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Use the browser-first OAuth flow (Open Browser option) as the default login method for codex-multi-auth

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Use the device-code flow (--device-auth flag) for headless, remote, SSH, or container environments where browser access is unavailable

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Use the manual login path (--manual flag) only when device auth is unavailable or when handling OAuth callbacks manually

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Store account data under ~/.codex/multi-auth by default, or under $CODEX_MULTI_AUTH_DIR/backups if the storage root is overridden

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Enable runtime rotation by default for request-bearing sessions launched through codex-multi-auth-codex or a configured app bind

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Use project-scoped account pools stored under ~/.codex/multi-auth/projects/<project-key>/openai-codex-accounts.json when project-level account isolation is needed

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Share the same account pool across linked Git worktrees without creating separate pools per worktree path

Learnt from: CR
Repo: ndycode/codex-multi-auth

Timestamp: 2026-06-09T17:45:16.353Z
Learning: Run codex-multi-auth doctor --fix to restore stale account state

🔇 Additional comments (3)

AGENTS.md (1)

76-76: LGTM!

CONTRIBUTING.md (1)

32-32: LGTM!

docs/getting-started.md (1)

9-9: LGTM!

…loor Review follow-up: >=18.17.0 is the floor to run the published package (driven by undici), but the dev toolchain does not support Node 18 at all (vitest requires ^20.0.0||^22||>=24, eslint ^20.19||^22.13||>=24), so contributors need Node 20+. This is also why CI tests on 20.x/22.x and why an 18.17 CI job is not feasible. https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

This was referenced Jun 9, 2026

ci: pin all workflow actions to commit SHAs #519

Merged

docs: fix stale command names, version drift, and duplicate doc-portal rows #520

Merged

greptile-apps Bot reviewed Jun 9, 2026

View reviewed changes

Comment thread CONTRIBUTING.md Outdated

coderabbitai Bot requested changes Jun 9, 2026

View reviewed changes

Comment thread package.json

ndycode mentioned this pull request Jun 10, 2026

chore(hooks): run typecheck in pre-commit, drop deprecated husky bootstrap #521

Merged

ndycode mentioned this pull request Jun 10, 2026

docs(audit): 2026-06-10 repository architecture & best-practices audit #522

Merged

coderabbitai Bot approved these changes Jun 10, 2026

View reviewed changes

This was referenced Jun 10, 2026

ci: add Node 18.x runtime-smoke job to validate the engines floor #523

Closed

docs(security): record the undici exact-pin rationale #529

Merged

ndycode merged commit d9790f8 into main Jun 10, 2026
2 checks passed

Navigation Menu

chore(packaging): align engines, drop typescript peer dep, remove dead .npmignore - #518

chore(packaging): align engines, drop typescript peer dep, remove dead .npmignore#518
ndycode merged 2 commits into
mainfrom
claude/audit-02-packaging-hygiene

ndycode commented Jun 9, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jun 9, 2026

Uh oh!

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading

Walkthrough

Estimated Code Review Effort

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

coderabbitai Bot left a comment

OVERVIEW

STRUCTURE

Documentation Layers

Source of Truth Map

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Layer	Audience	Primary goal
Product entry	New operators and search visitors	Explain the project quickly, prioritize the right concepts first, and complete first successful login/check
User operations	Daily users	Configure, run, recover, and report issues safely
Reference	Power users and maintainers	Exact command, setting, and path lookup
Development	Contributors and maintainers	Internal architecture, flow, tests, and ownership

Scope	File
Project entry	`README.md`
Docs portal	`docs/README.md`
Daily operator landing	`docs/index.md`
Onboarding	`docs/getting-started.md`
FAQ	`docs/faq.md`
Public architecture overview	`docs/architecture.md`
Feature map	`docs/features.md`
Configuration guide	`docs/configuration.md`
Troubleshooting guide	`docs/troubleshooting.md`
Privacy and data handling	`docs/privacy.md`
Upgrade and migration	`docs/upgrade.md`
Command reference	`docs/reference/commands.md`
Public API contract	`docs/reference/public-api.md`
Error contract reference	`docs/reference/error-contracts.md`
Settings reference	`docs/reference/settings.md`
Storage path reference	`docs/reference/storage-paths.md`
Docs style contract	`docs/STYLE_GUIDE.md`
Docs governance (this file)	`docs/DOCUMENTATION.md`
Architecture internals	`docs/development/ARCHITECTURE.md`
Runtime rotation implementation guide	`docs/development/ARCHITECTURE.md`
GitHub metadata guidance	`docs/development/GITHUB_DISCOVERABILITY.md`
IA/findability audit (2026-03-01)	`docs/development/IA_FINDABILITY_AUDIT_2026-03-01.md`
Config fields internals	`docs/development/CONFIG_FIELDS.md`
Config flow internals	`docs/development/CONF...

Conversation

ndycode commented Jun 9, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

chatgpt-codex-connector Bot commented Jun 9, 2026

Uh oh!

coderabbitai Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated Code Review Effort

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

OVERVIEW

STRUCTURE

Documentation Layers

Source of Truth Map

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ndycode commented Jun 9, 2026 •

edited by greptile-apps Bot

Loading

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading