v6.10.1
Published to npm as oc-codex-multi-auth@6.10.1.
npm install -g oc-codex-multi-auth@6.10.1
Fixed
Account verification no longer bricks the pool by consuming single-use refresh tokens (#205)
codex-health, codex-doctor --fix, and codex-refresh verify an account by exchanging its refresh token, which OpenAI rotates and invalidates on use — but health and doctor treated verification as read-only and never persisted the rotated credential. The consumed token stayed on disk, so the next load returned refresh_token_reused for every verified account and the pool went dark until re-login.
All three tools now persist the rotated credential in a storage transaction before reporting health, through a shared refresh/persist path that skips intentionally-disabled accounts without touching their token, propagates a rotated token shared by workspace-sibling records, and reconciles concurrent storage changes by stable account identity rather than list position. codex-doctor --fix reloads diagnostics after applying fixes so reported health can never contradict the live verification result, and flags refresh-verification failures as blocked with a re-login next step. The cached account-manager reload used by the account tools and the account.select handler now flushes the outgoing manager's pending save and disposes its shutdown handler before swapping in the reloaded instance — preventing a shutdown-handler leak and a lost-update that could overwrite the freshly rotated tokens — and degrades gracefully if the reload fails.
Contributed by @lubshad.
OAuth success page renders correctly under the strict callback CSP (#206)
The post-login "authentication complete" page relied on inline scripts, external Google Fonts, and inline styles that the strict Content-Security-Policy blocked, leaving an unstyled white page that exposed raw unicode escape sequences. It is now a compact static page whose single stylesheet is bound to a per-request CSP nonce, with the policy tightened to default-src 'none' plus explicit script-src 'none', frame-ancestors 'none', base-uri 'none', and form-action 'none', and Cache-Control: no-store / Referrer-Policy: no-referrer added to the callback response. No external font or script is loaded.
Contributed by @lubshad.
