v6.18.0

https://www.npmjs.com/package/oc-codex-multi-auth/v/6.18.0

npx oc-codex-multi-auth@6.18.0 install

Added

Paid Credits are protected from a spent subscription quota (#245, contributed by @PENEKhun).

Every enabled account is polled through the existing bounded quota monitor, 30 minutes by default, with no per-request usage call added. When a 5-hour or weekly subscription quota reads as exhausted, a rotation block is persisted across all model families, so round-robin skips that account before a later request can spend Credits at Credit rates.

{
  "quotaNotifications": {
    "autoProtectCredits": false   // opt out; default is true
  }
}

CODEX_AUTH_AUTO_PROTECT_CREDITS=0 does the same. This is on by default, so upgrading turns on periodic usage polling for every account.

Usage-endpoint errors and rate limits fail open and retry on the next interval, so throttling there can never turn into a routing block. Stale account-manager caches are invalidated across processes at the moment a rotation persists. Manual codex-limits checks remain immediate protection.

Fixed

A model id naming an Object.prototype member crashed the request path (#250).

resolveUnsupportedCodexFallbackModel looks the chain up as chain[currentModel], and currentModel comes from the caller's body.model. Reproduced against 6.17.0:

model: "constructor"  ->  TypeError: targets is not iterable
model: "__proto__"    ->  TypeError: targets is not iterable

On a plain object chain["constructor"] returns the Object constructor, not undefined: truthy, .length of 1, so the targets.length === 0 guard passed it straight into for...of. The chain is null-prototype now and the guard checks Array.isArray, which also covers a customChain value that is not an array. A customChain key named __proto__ previously reassigned a plain object's prototype instead of adding a row; the null prototype fixes that as well.

Astra's request shape is read from the catalog rather than inferred (#248).

6.17.0 shipped hours before openai/codex published a gpt-6-astra entry, so use_responses_lite had to be guessed and was hedged behind CODEX_AUTH_ASTRA_RESPONSES_LITE. The entry landed in ed391d4d and confirms the guess:

use_responses_lite:  true
tool_mode:           code_mode_only
multi_agent_version: v2
efforts:             low, medium, high, xhigh, max, ultra

Membership is read now and CODEX_AUTH_ASTRA_RESPONSES_LITE is removed, because it existed only to hedge a value that is no longer unverifiable.

Two fields in that entry corrected the 6.17.0 notes. base_instructions is an empty string where every sibling carries 11k to 21k characters, so Astra keeps reading its prompt file instead of picking up catalog text as those notes claimed. And visibility: "hide" puts Astra behind the same flag used to keep the Daybreak tiers out of the shipped templates. Astra stays in them because the outcomes differ rather than the flag: Astra has an auto-fallback chain, so an unentitled account costs one round trip and lands on a working model, where a Daybreak request hard-fails by design.

The quota monitor hung any test that drains fake timers (#245). With credit protection on by default the monitor polls wherever the plugin is constructed, and its timer re-arms itself, so vi.runAllTimersAsync() never emptied the queue and Vitest aborted at 10000 timers. Production behaviour is unchanged: a self-rescheduling unref'd 30-minute timer is only pathological when a test advances the clock artificially.

Security

Five dependency advisories cleared, four of them high (#249).

package	was	now	advisory
toml	4.1.1	4.3.0	uncontrolled recursion; prototype pollution
browserslist	4.28.2	4.28.8	unbounded memory growth; prototype write
fflate	0.8.2	0.8.3	infinite loop on malformed ZIP64 (dev-only)

All transitive, and every patched version already satisfied the range its parent requested, so the fix is a lockfile refresh with no overrides entry and no direct-dependency bump. npm audit reports zero vulnerabilities.

Internal

The documentation count check derived nothing: it asserted literal strings against the installer, so a template change left it green while the installer advertised counts the templates no longer had. It derives every count from the two config JSONs now, and checks each count quoted anywhere in current documentation against them.