[lia-by-librechat]

Summary

Prepare public npm delivery for @librechat/code, which is not publicly available on npm. Existing releases publish repository/Helm artifacts only.

• Stage 0.1.0-rc.1, public provenance metadata and LICENSE/NOTICE. Remove stale compiler output before packing.
• Make lc-code the primary executable and help/setup command; retain librechat-code as an alias to the same entry point. Package identity, stored state, signing domains and existing log prefixes remain unchanged.
• Add separate code-v<package-version> tags and manual dispatch. Manual runs default to verification only; publication requires successful main CI for the exact commit.
• Pack once, verify contents/size/SHA-512, and install that tarball outside the checkout across Linux/macOS x64/ARM and Node 22/24. Exercise exports, both executable aliases, native FFI, signatures and executor IPC.
• Publish the same bytes with npm OIDC under the npm environment gate. RCs use next; stable releases use latest. Conflicting bytes and backwards channel moves fail closed; identical retries make no changes.

No runtime migration or weaker sandbox/storage checks. No npm publication, remote release tag, environment or account setting changed.

Current-head verification

Head: 19ea392b7e3573a02b588743050fa738ee079704. Independent review complete for this exact head, no findings. Pack Worker and all five installed-artifact platform jobs passed; publishing correctly skipped. Service CI passed on this head. Remaining image checks are still pending.

• Worker build/no-emit check passed on Node 24.16.0.
• 25 release guards, 7 naming/terminal tests, and 88 project/identity/protocol/recovery regressions passed.
• Real pack/verify and clean-consumer smoke passed. Tarball: 375,294 bytes. Both installed names share executable/help/setup/error behavior.
• Existing workflow validation and reproducibility checks passed on the preceding release head; workflow and prepack logic are unchanged by the alias update.
• No full local enrollment, actual sandbox execution, real npm/OIDC publication or account setup. Cross-platform artifact verification runs in CI.

One-time release setup

After merging, configure the GitHub npm environment with required reviewers and release-ref restrictions. Bootstrap the first package under next using the verified artifact and a maintainer's npm authentication, then configure npm trusted publishing for repository LibreChat-AI/code-interpreter, workflow code-package.yml, environment npm. No long-lived publishing token is required by this workflow.

Run a main-branch dispatch with the committed version and publish: false to prepare/test an artifact without publication. Later explicit publishes use a matching code-v... tag or a main dispatch with publish: true. Repository v... tags remain independent.

[lia-by-librechat]

Review head: 7fa906b. Adds opt-in npm release automation for the existing worker, exact-artifact cross-platform smoke checks, immutable retry guards, prerelease metadata and legal files. Local release guards, protocol regressions, build/no-emit, actionlint, reproducibility and clean-consumer native IPC checks passed. No npm publication, release tag, environment or npm account setting was changed.

[lia-by-librechat]

Independent review complete for 7fa906b: no findings. Pack Worker and all five installed-tarball platform jobs pass; publishing correctly skipped. Local checks: build/no-emit, 25 release guards, 82 protocol/identity/recovery regressions, actionlint, reproducibility, installed imports/bin/native FFI/executor IPC. Service CI failed in Bun download (HTTP 504), before tests; retry follows when GitHub permits. No npm package or release tag was published.

[lia-by-librechat]

Review head: 19ea392. Makes lc-code the primary npm executable and help/setup command. librechat-code remains an alias to the same entry point. Package identity, stored state, signing domains, and existing log prefixes are unchanged. Added installed-artifact checks for both aliases, identical help/setup output and failure behavior. Typecheck, 25 release guards, 7 naming/terminal checks, 88 focused regressions and clean-consumer smoke passed locally. Fresh exact-head independent review and CI are running; nothing was published to npm.

[lia-by-librechat]

Independent review completed for 19ea392: no findings. lc-code is the primary command; librechat-code remains a compatibility alias. Both installed names passed all five artifact-platform jobs. Local checks: build/no-emit, 25 release guards, 7 CLI naming/terminal tests, 88 project/identity/protocol/recovery regressions, and clean-consumer native IPC smoke. Service CI now passes; remaining image checks are pending. Full enrollment, real sandbox execution and npm/OIDC publication were not run for this naming change. Nothing published to npm.

[danny-avila]

@codex review the latest head, final review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T22:36:30.895958Z	19ea392	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 19ea392b7e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".