v2.2.6

CodexSwitcher v2.2.6

• Safe Codex relaunch — Account switching no longer kills Codex's bundled background runtime with SIGTERM, which was triggering Codex's crash screen
• No-session restart rule — If Codex is open and no session is currently active, CodexSwitcher now closes and reopens the full Codex app automatically so the new account is applied cleanly
• Active-session protection — If Codex still has active session activity, CodexSwitcher skips the automatic relaunch instead of interrupting work

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.2.6-signed.zip

v2.2.5

CodexSwitcher v2.2.5

• Crash-screen recovery — If Codex shows its An error has occurred page after a background account refresh, CodexSwitcher now auto-clicks Reload so the window recovers without manual intervention
• UI-stays-open hotfix — The background cutover path now includes automatic window recovery instead of leaving the user on the SIGTERM crash page

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.2.5-signed.zip

v2.2.4

CodexSwitcher v2.2.4

• Background Codex refresh — Account switching now refreshes Codex's bundled app-server in the background so the window stays open while the new account is loaded
• Limit-stuck recovery — Switched accounts no longer depend on a full visible Codex relaunch to escape stale you hit limit local sessions
• Drag-to-reorder accounts — Account rows in the menu can now be picked up and moved anywhere in the stack, with the new order persisted across launches
• Appearance settings screen — Added a dedicated Settings view with theme mode, text size, text family, accent color presets, and a live preview card
• Theme-aware menu polish — Menu highlights, active indicators, progress bars, and analytics summary accents now follow the selected appearance preset
• Switch reliability foundation — Added typed switch decision records, readiness evaluation, bounded decision persistence, and safer manual override behavior so automatic and manual switching are both more explainable
• Unified diagnostics timeline — Added a diagnostics layer that merges switch decisions, automation events, reconciliation anomalies, alerts, and data-quality signals into one bounded operational timeline
• Workflow intelligence — Added read-only local Codex thread intelligence from state_5.sqlite with recent thread activity, repo hot spots, and open spawn-edge visibility in the analytics window
• Power-user guidance — Added contextual next-action recommendations and remembered analytics history tab state so returning users can move faster through the app
• Diagnostics export expansion — JSON audit exports now include diagnostics summary and timeline data without leaking prompt text or local project paths
• Midnight session counting fix — Session usage tracking now scans day boundaries correctly, fixing the release-blocking cache regression test around midnight
• Regression coverage — Added targeted tests for diagnostics timeline generation, workflow summary loading, recommendation logic, expanded analytics export payloads, and corrected session-usage caching behavior

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.2.4-signed.zip

v2.2.3

CodexSwitcher v2.2.3

• Background Codex refresh — Account switching now refreshes Codex's bundled app-server in the background so the window stays open while the new account is loaded
• Limit-stuck recovery — Switched accounts no longer depend on a full visible Codex relaunch to escape stale you hit limit local sessions
• Version metadata sync — Bundle version now matches the published v2.2.3 release again
• Midnight session counting fix — Session usage tracking now scans day boundaries correctly, fixing the release-blocking cache regression test around midnight

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.2.3-signed.zip

v2.2.2

CodexSwitcher v2.2.2

• Launch crash fix — Moved the notification permission request out of AppStore initialization so the menu bar app no longer aborts during early startup on some macOS setups
• Safer permission bootstrap — Notification authorization is now requested from a deferred, one-shot launch bootstrap instead of eager singleton construction
• Regression coverage — Added targeted tests for deferred notification permission scheduling and single-run gating

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.2.2-signed.zip

v2.2.1 — Security Hardening & Bug Fixes

Bug Fixes

Weekly-zero exhausted display (High)

When an account's weekly limit reaches 0%, it was incorrectly shown as Safe if the 5-hour window still showed 100%. The weekly budget gates the 5-hour budget — no requests can succeed once weekly is exhausted. Both the risk label and the health dot now correctly show Exhausted / red in this state.

Auth permission hardening (Medium)

The re-login flow (reloginAuthChanged) was not applying 0o600 permissions to the updated profile auth file, leaving it potentially world-readable under a permissive umask. Now consistent with captureCurrentAuth and activate.

Seamless verification flow restored (High)

attemptSeamlessSwitch was unconditionally restarting Codex after every account switch, contradicting the "restart-free by default, restart fallback" design and making the .verifying state machine unreachable. The flow now enters the verifying state and only restarts Codex if a rate-limit signal is detected within 45 seconds — matching the original intent.

Auth watcher first-run safety (Medium)

watchAuthFileForNewLogin silently dropped the file watcher on machines where ~/.codex/auth.json didn't exist yet (open(O_EVTONLY) returns -1). Now creates the parent directory and an empty placeholder file before opening so the watcher always attaches on first run.

Switch history attribution (Medium)

A failed switch attempt could write a history entry before knowing whether activation succeeded, corrupting analytics attribution. History is now only written from finalizeActivation after verification passes.

Tests

• 10 new unit tests for ProfileManager JWT claim extraction
• 6 new unit tests for RateLimitForecaster covering the weekly-zero gate and surrounding cases

Full Changelog

v2.2.0...v2.2.1

v2.2.0 — Reconciliation Ledger + Code Refactor + Keyboard Shortcuts

CodexSwitcher v2.2.0

Reconciliation Ledger

• ReconciliationEngine — provider vs local token discrepancies explained with 7 reason codes: matched_activity, idle_drain, switch_boundary_overlap, low_local_usage, missing_provider_sample, below_noise_floor, sample_reset_or_counter_jump
• Confidence levels: high / medium / low with forensic ledger UI in Analytics window
• Sortable ledger with summary pills, reason codes, and row drilldown
• CSV / JSON export now carries reconciliation rows and policy metadata

Switch Improvements

• Proactive thresholds — auto-switch triggers at weekly ≤ 5% or 5-hour ≤ 7% instead of waiting for hard exhaustion
• Unsafe manual switch guard — Switch Now and direct selection skip accounts already below safe thresholds
• Guaranteed Codex restart — account switches always restart Codex so the CLI doesn't stay pinned to the exhausted account

New Feature: Keyboard Shortcuts

• ⌘1–⌘9 — switch directly to any account while the popover is open

Code Health

• AppStore.swift: 1480 → 503 lines, split into 6 focused extension files
• MenuContentView.swift: 1232 → 319 lines, split into 3 extension files
• 77 tests, all passing

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.2.0-signed.zip

v2.1.4

CodexSwitcher v2.1.4

• Reconciliation ledger UI — The analytics window now shows a sortable forensic ledger with summary pills, reason codes, confidence labels, and row drilldown
• Forensic export hardening — CSV/JSON exports now carry reconciliation rows and policy metadata without prompt text or local project paths
• Proactive switch thresholds — Automatic switching now reacts at weekly <= 5% or 5-hour <= 7% instead of waiting for hard exhaustion
• Guaranteed Codex cutover — Account switches restart a running Codex process so the active CLI does not stay pinned to the exhausted account
• Unsafe manual switch guard — Manual selection and Switch Now now skip accounts that are already below safe weekly/5-hour thresholds, avoiding pointless restarts
• Legacy cleanup — Old audit generation logic has been retired internally while compatibility export fields remain bounded for migration

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.1.4-signed.zip

v2.1.3

CodexSwitcher v2.1.3

• Audit export — Added direct CSV and JSON export for trust/audit data from the analytics window
• Provider delta evidence — Export payload now captures audit summary, full drain event rows, and timeline points for offline inspection
• Idle drain forensics — Idle-window suspicious drops can now be shared and reviewed outside the app instead of staying only in the UI
• Audit exporter tests — Added regression coverage for CSV column layout and JSON audit payload structure

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.1.3-signed.zip

v2.1.2

CodexSwitcher v2.1.2

• Trust-first analytics — Per-account confidence wording now reflects fetch health instead of implying provider correctness
• Usage audit layer — Consecutive rate-limit snapshots are compared against local usage records to flag explained, weak, and unattributed drain events
• Idle drain detection — The analytics window now calls out limit drops that happen while no local Codex activity is observed
• Drain timeline — Added a compact timeline so suspicious provider-side capacity drops can be inspected over time
• History declutter — Removed the large automation confidence and attention blocks from History so the analytics window owns detailed diagnostics
• Analytics regression coverage — Added targeted tests for unattributed drain, explained drain, idle windows, and audit timeline generation

Release

• Developer ID signed
• Apple notarized
• Asset: CodexSwitcher-v2.1.2-signed.zip