v6.11.1

npm: https://www.npmjs.com/package/oc-codex-multi-auth/v/6.11.1

npx -y oc-codex-multi-auth@latest --modern
opencode auth login

Already installed? Refresh the cached package without touching your config:

npx -y oc-codex-multi-auth@latest update

Fixed

• warm no longer fails every account with HTTP 400. Two separate causes. The warm ping was pinned to gpt-5.4, which is no longer in the shipped model catalog and is actively removed from user config as a stale key, so accounts without that entitlement were never entitled to the model being pinged; the entry point is now gpt-5.5, the generally-available anchor the shared fallback chain already degrades toward. Separately, warmAccountWindow classified only 429 and dead-ended every other status, so an entitlement 400 could not recover the way live chat traffic does — a model_not_supported_with_chatgpt_account response now walks the shared fallback chain (gpt-5.5 → gpt-5.4 → gpt-5.4-mini → gpt-5.4-nano) under a bounded attempt budget derived from the chain itself. Warm failures also report the sanitized upstream body instead of a bare status code, so a failing account says why. Thanks @Grelo4ka. (#210)

• limits now shows actual usage instead of repeating the account list. The command computed rate-limit state but never rendered it, so its output was identical to list. Rendering alone would not have been enough: the stored reset timestamps stay empty until an account has already been rate-limited, and they are timestamps rather than the weekly and 5-hour usage the command advertises. limits now reads /wham/usage through the same runtime the in-conversation codex-limits tool uses, with matching workspace dedupe, window titles, and summaries. Per-account failures are reported inline and exit non-zero. Thanks @Grelo4ka. (#209)

  This makes limits a network call that can refresh a token, where it was previously a purely local read. rateLimitResetTimes remains in the --json payload for existing consumers, and --tag gates which accounts are contacted rather than only which are displayed.

Security

• Per-account errors from limits are redacted through the logger's token patterns before reaching stdout, JSON output, or CI logs. The OAuth refresh path can surface a raw upstream response body, and truncation alone does not protect bearer, JWT, or refresh-token material.

Internal

• CI runs npm run build before npm test. dist/ is gitignored and the standalone CLI tests load the compiled runtime from it, so the previous step order could not pass on a clean checkout — verified by removing dist/, which fails 12 of the 14 standalone tests.
• The warm request derives its reasoning effort from the request transformer's canonical clamp rather than keeping a private copy of the model rule, so the two cannot drift.

Full changelog: https://github.com/ndycode/oc-codex-multi-auth/blob/v6.11.1/CHANGELOG.md