Release v6.11.0 · ndycode/oc-codex-multi-auth

npx -y oc-codex-multi-auth@latest --modern
opencode auth login

Already installed? Refresh the cached package without touching your config:

npx -y oc-codex-multi-auth@latest update

Added

A cache-only update command and a provider-preserving install --plugin-only mode. Updating no longer runs the provider/model installer, and manual update notifications now recommend the config-safe command. Thanks @lubshad. (#207)

Default install now manages only the OpenCode/TUI plugin entries and preserves provider.openai. Model catalogs require an explicit --modern, --full, or --legacy. Installer writes and backups are skipped when the merged configuration is semantically unchanged, plugin-only mode refuses to replace a malformed config, dry-run diffs report changed paths without printing values, and managed cache cleanup covers both bare and @latest layouts with retries for transient Windows locks. Thanks @lubshad. (#207)

If you install without a flag, --variant reasoning presets and gpt-5.5-fast are not written — those come only from the shipped catalogs. Use --modern if you want them.

Terminal quota checks no longer send a synthetic model request. Checking quotas previously POSTed a "quota ping" completion to /codex/responses, cycling through candidate models just to scrape rate-limit headers. It now reads the model-independent /wham/usage endpoint and formats the shared usage windows, plan type, credits, and limits, handling free-plan accounts without selecting a model at all. Deactivated-workspace and invalidated-token responses still normalize to the errors that flag an account for codex-doctor --fix. Thanks @lubshad. (#208)
Install documentation corrected for the new plugin-only default across the getting-started quickstart, config/README.md, CONFIG_FIELDS.md, troubleshooting.md, and the ARCHITECTURE.md CLI diagram.

All outstanding dependency advisories cleared; npm run audit:ci reports 0 vulnerabilities.
- hono → 4.12.32: hono/jsx cross-request context disclosure, server-side XSS via the cx() escaping bypass, and a header de-duplication defect. Also clears the advisory inherited by @openauthjs/openauth.
- seroval / seroval-plugins → 1.5.6: critical fromJSON() promise-resolver type confusion that could invoke attacker-controlled methods during deserialization (CVSS 9.8), reached through solid-js.
- brace-expansion and postcss pinned to patched releases.

Full changelog: https://github.com/ndycode/oc-codex-multi-auth/blob/v6.11.0/CHANGELOG.md