v6.22.0

Added

• The credential store is now snapshotted before every significant write, landing in backups/codex-credential-snapshot-*.json (mode 0600 on POSIX only). Best-effort: a failed snapshot only warns and the write still goes through. Configurable retention via credentialSnapshotsMaxCount (default 10), disable with credentialSnapshots: false. (#262, thanks @Nowaker)
• The plugin now tracks which build of itself OpenCode loaded (installed package vs. working checkout). Update checks are skipped for checkout builds, and codex-status/codex-doctor report the running build. (#260, thanks @Nowaker)
• The status line can now show the whole account pool at once with quotaStatus.mode: "overview", plus a new "resets" mode for banked reset credits and quotaDisplay: "used" for percent-consumed. (#261, thanks @Nowaker)

Fixed

• The test suite could write to a developer's real ~/.opencode account store; it now runs in an isolated temp HOME with a storage guard against real-home writes. (#258, thanks @Nowaker)
• A short configured wait (like a 5-second retryAfter) no longer aborts a request hours early; the retry budget now charges in proportion to the actual wait. (#258, thanks @Nowaker)
• A failed account-file reload no longer empties a working pool; an empty read against a non-empty incumbent is now retried instead of replacing it. (#258, thanks @Nowaker)
• The installer no longer replaces a registered local checkout (file:///path/to/oc-codex-multi-auth) with the published package name on reinstall; a registered path that no longer exists is kept but flagged with a warning. (#259, thanks @Nowaker)
• Cache eviction could escape the OpenCode cache via a symlinked cache root; it now refuses to evict when the cache root resolves through a symlink. (#259)
• ChatGPT Business seats sharing one workspace account id now render distinguishably instead of looking like duplicates. (#263, thanks @Nowaker)
• The pool quota line no longer misreports as "fully spent" when one account's fetch fails; that account now keeps its last known reading marked stale. (#261)

Internal

• Widened the origin-history lock retry budget so concurrent OpenCode startups don't lose their sighting record. (#260)
• CODEX_AUTH_CREDENTIAL_SNAPSHOTS_MAX_COUNT now validates as an integer with a minimum instead of silently clamping bad values. (#262)