Use ./app.sh for local build, test, verification, and release workflows.
Use cma commands for account operations.
Common orchestration examples:
./app.sh --smoke
./app.sh --verify
./app.sh --verify-sandbox
./app.sh --build
./app.sh --release
./app.sh --publish-release --draft --notes-file docs/release-notes.md
./app.sh --run -- versionThin wrapper commands:
./test.sh quick
./test.sh full
./test.sh prerelease
./test.sh publish -- --notes-file docs/release-notes.mdRelease-related app.sh flags:
--verify-sandboxrun the full verify matrix inside a temp HOME/XDG/CODEX sandbox--releasebuilddist/*artifacts anddist/sha256sums.txt--publish-releaseverify in sandbox, build release artifacts, then create a GitHub release--tag <tag>override the default tagv<cmd/VERSION>--draftcreate the GitHub release as a draft--notes-file <path>supply release notes for GitHub release creation
Recommended draft-first flow:
./app.sh --verify-sandbox
./app.sh --release
./app.sh --publish-release --draft --notes-file docs/release-notes.md
gh release edit v$(cat cmd/VERSION) --draft=falsecma --helpSelectors are resolved in this order:
- Exact
all(only for commands that accept multiple accounts, such asusage). - 1-based list index (
1,2, ...). - Exact account ID.
- Exact alias.
- Exact display name.
- Unique prefix of ID, alias, or display name.
If no match exists, commands return a selector-not-found error. If multiple prefix matches exist, commands return an ambiguous-selector error.
backup and restore use this source format:
prompt
Prompts for a passphrase.env:VAR
Reads passphrase bytes from environment variableVAR.hash:<hex>
Decodes raw bytes from a hex string.pass:<literal>
Uses literal text directly. This is blocked unless--allow-plain-pass-argis set.
List saved accounts, aliases, and active marker.
cma listFetch usage and print confidence tier.
cma usage all
cma usage workShow version and public project links.
Flags:
--shortprint version string only
cma version
cma version --shortDefault output:
cma version: <version>
repository: https://github.com/prakersh/codexmultiauth
support: https://buymeacoffee.com/prakersh
Version source behavior:
- default value comes from
cmd/VERSION - build can override with ldflags (
cmd.Version,cmd.Commit,cmd.Date)
Save current Codex auth into encrypted vault.
Flags:
--namedisplay name--aliasescomma-separated aliases
cma save
cma save --name work --aliases main,teamRun Codex login and save resulting auth.
Flags:
--namedisplay name--aliasescomma-separated aliases--device-authuse device auth flow
cma new
cma new --device-auth --name personalActivate selected saved account in Codex auth store.
cma activate 1
cma activate workDelete a saved account. If it is active, CLI asks for confirmation.
cma delete personalWrite encrypted backup artifact.
Flags:
--allow-plain-pass-argallowspass:<literal>
cma backup prompt nightly
cma backup env:CMA_PASS /absolute/path/snap.cma.bak
cma backup hash:736563726574 nightlyRestore accounts from encrypted backup.
Flags:
--allrestore all candidates atomically--conflict ask|overwrite|skip|renameconflict policy (defaultask)--allow-plain-pass-argallowspass:<literal>
Without --all, CLI prompts for account selection from backup candidates.
cma restore prompt nightly
cma restore env:CMA_PASS nightly --all --conflict overwrite
cma restore hash:736563726574 /abs/path/snap.cma.bak --conflict renameLaunch interactive terminal UI.
cma tui