v0.15.1 — plugin launches the published npm tarball

Patch release on top of v0.15.0. Fixes how the plugin starts its MCP server.

What changed

v0.15.0 fixed Failed to reconnect to Plugin:codex-flow:codex: -32000 by having .mcp.json install dependencies and compile on first start. That works, but it makes the very first connection depend on npm and the network at exactly the moment the client is waiting for a handshake — on a cold npm cache the dependency download, not the compile, dominates.

.mcp.json now runs the published tarball:

{ "command": "npx", "args": ["-y", "@anhnguyen0905/codex-mcp@0.15.1"] }

The npm package ships a prebuilt dist/, so nothing is compiled at install time. Measured against the real registry: an initialize handshake returns serverInfo 0.15.1 in 0.69s.

This is the first release published to npm since 0.3.2 — that registry lag is exactly why the npx form was dropped back in 0.10.0, and publishing again is what makes it viable now.

Pinned, not @latest

The version is pinned so a plugin release cannot drift onto a server build it was never tested against. Because pinning adds one more place a release can forget to bump, scripts/check-release-consistency.mjs now reads the pin out of .mcp.json and compares it against package.json; extractMcpPinnedVersion returns undefined for a non-pinned launcher so switching back to a local-build config does not fail the gate.

Upgrading

/plugin update codex-flow@codex-mcp

Then restart Claude Code and confirm with claude mcp list or codex_health.

Known red

Three Windows-only test failures (liveView, tailProgress) predate this release — they assert POSIX chmod modes, POSIX-legal path characters, and Darwin window-close behavior. Ubuntu and macOS are green on Node 20 and 22.