mpai v0.4.19

Large Codex sessions stay fast and private in shared terminal rooms.

• Tail visible user/assistant messages directly from the host-local Codex rollout.
• Bound transcript windows before they cross the tailnet.
• Exclude tool records, Codex internal context, and ambient app/browser context.
• Preserve named teammate attribution and a finite managed transport ceiling.

Verified against a real 170.6 MB Codex task: 0.77-second host read versus the previous payload failure. All 61 tests and CodeQL pass.

SHA-256: 66bd09930d40c1459a04fb3b66bbcf619d41d1837d1e0af3446d21d77706d565

mpai v0.4.18

Correct first-room timing across upgrades.

• Only invites created by a timing-aware release are eligible for automatic measurement.
• Existing invites stay unmeasured instead of treating a post-upgrade read as the first-ever room.
• No collaboration content or identifiers are collected or submitted.

Install:

brew install godfaddaai/tap/mpai && mpai start

Artifact SHA-256: 3d2ccd6391815b41147b3b79ef228c9375e7aa6cc5143e04bb1fe41990cfc6bb

mpai v0.4.17

Measure first shared-room activation without shipping collaboration data.

• Records one host-local timestamp after the first successful authorized room read.
• Privacy-safe receipts expose only elapsed minutes and a count.
• Cohort reports use the measured value automatically, with an override for older installs.
• Failed and unshared reads do not record; repeat reads cannot move the timestamp.
• No automatic telemetry or submission.

Install:

brew install godfaddaai/tap/mpai && mpai start

Artifact SHA-256: 4a6a9558a82346804ae906ec24c7dad0366c470f27bb68535bf1ee1ef1244c6f

mpai v0.4.16

Public-alpha cohort learning is now review-first and explicitly consented from the terminal. mpai cohort-report previews fixed-choice activation and reliability metadata locally; --submit posts exactly that preview through the user's authenticated GitHub CLI after confirmation, and non-interactive use additionally requires --yes. Arbitrary collaboration content is rejected before the public boundary. All 54 behavioral tests pass. SHA-256: 2e5a464497319166e9f44510ab186f950122a35dad2c1a1b15037e9feb96966b

mpai v0.4.15

Shared rooms now recover promptly when a teammate disconnects or a provider stalls. Cancels exact provider work when a prompt stream closes, uses supported Codex App Server interruption, terminates disconnected or silent Claude resume children, releases the per-session lock, and records the failed turn. All 52 behavioral tests pass. SHA-256: 5d444f115324013e24cdc317a2b05407c9f249c596a7f9085176c62bf9eec523

mpai v0.4.14

One guided host command

The host-side first-room path is now:

mpai start --name "Maya" --with "Alex"

It verifies a fresh host, discovers existing Codex and Claude Code sessions, asks the host to select exactly one, creates a participant invite scoped only to that session, and prints the teammate’s version-pinned no-install command. Existing hosts can omit --name; automation can use --session SESSION_ID.

Safety remains private by default: every other session stays private, and non-interactive use without an explicit session stops before creating an invite.

SHA-256: 41b3f52819859c817bbe066703c708f3eaed8907e80471adf99a61c1c8a8e096

mpai v0.4.13 — one-paste teammate join

One-paste first room

A teammate can now join the exact shared AI room from the invite with one version-pinned npx command—no global install and no background host service:

npx --yes https://github.com/godfaddaai/multiplayer-ai/releases/download/v0.4.13/multiplayer-ai-0.4.13.tgz join mpai://YOUR_INVITE --no-service --attach

The command claims the named, session-scoped invite, stores the teammate identity and credential, renders the transcript, and attaches to the room. Homebrew and npm remain available for permanent installs.

Verification

• Full suite: 47/47 passing on Node 20 and Node 22
• CodeQL: passing
• Release metadata and formula pinned to v0.4.13
• Artifact SHA-256: 4f32501188f3d0ec54fd99627bf454785c5d1305680e8fe2deb869f1ae212b7c

See CHANGELOG.md for the complete release notes.

mpai v0.4.12

Paste once into the ready room.

• Session-scoped invite handoffs now print a join command with --attach.
• That one command establishes the teammate identity, stores the peer credential, verifies the exact shared session, and opens its live terminal room.
• Plain join remains non-interactive for older, empty, multi-session, and automation flows.

Verified with 46/46 behavioral tests, syntax checks, Node 20 and Node 22 CI, CodeQL, an isolated package install, and candidate SHA-256 d925f1890964d8fe04c53ee181afff240b8945a3be5df0356d271979d055b513.

mpai v0.4.11

Shortens the safe first-room path without broadening access.

• Adds mpai invite --name TEAMMATE --role participant --session SESSION_ID.
• Creates the invite with exactly that session already shared.
• Keeps every other session private and rejects contradictory all-session scope.
• Passes 46 behavioral tests, Node 20/22 CI, CodeQL, and an isolated package install.

SHA-256: bff743c95d37219b0ad663294b13f8e040ca376a60c359f8733a6b261bc2f77c

mpai 0.4.10 — security hardening

Public-alpha security hardening for the invite-authentication boundary.

Fixed

• Bearer authorization parsing is length-bounded and accepts only the generated invite token alphabet.
• The attacker-controlled polynomial regular-expression path reported by CodeQL is removed.
• Oversized, malformed, and non-Bearer credentials are regression-tested while valid generated invites still work.

Install

brew install godfaddaai/tap/mpai
# exact Node.js fallback
npm install --global https://github.com/godfaddaai/multiplayer-ai/releases/download/v0.4.10/multiplayer-ai-0.4.10.tgz

Proof

• Full suite: 44/44 tests on Node 20 and Node 22 in CI run 30796935452.
• CodeQL extended scan run 30796935472 completed successfully with zero open alerts.
• Exact release asset SHA-256: 4a0ddb1fbe72175272cd0beabb7ac7247473ac06fb49fe1be5d42eedce57a79c.
• The tag and artifact are built from commit 6f3b63d7f46d28a9fefb836738db6a64b9ed4dbd.
• Isolated GitHub-asset install reported 0.4.10 from both mpai and multiplayer-ai.
• Homebrew run 30797200745 installed, executed, tested, uninstalled, and removed both CLI links on clean macOS 26 and Linux.
• Reagan and Hudson upgraded their existing prefixes and restarted matching 0.4.10 services; reciprocal shared-session reads remained intact.