Skip to content

v6.3.0

Choose a tag to compare

View all tags
@ndycode ndycode released this 06 Jun 07:08
· 366 commits to main since this release
v6.3.0
258cba8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Added

  • Mask account emails across all display surfaces (#164) — maskEmail now applies to command output, the interactive auth menu, delete/refresh confirmations, the standalone login menu, the interactive account picker, and runtime rotation/auth-failure messages, not just the TUI quota status. Raw emails remain only in opt-in --includeSensitive JSON.

Fixed

  • 16 deep-audit findings (#165) — data-loss, rotation, redaction, and concurrency bugs:
    • Transient refresh failures (network/5xx) no longer trigger permanent account removal.
    • Keychain load no longer swallows forward-compat (UNSUPPORTED_SCHEMA_VERSION / V2) errors.
    • Workspace-deactivation removes only the deactivated workspace, not refresh-token siblings.
    • Refresh-token rotation propagates to sibling org-variant accounts.
    • runAccountCheck / email hydration writes are transactional (no lost updates).
    • Health/token-bucket/backoff trackers remap on account removal (no misattributed rotation state).
    • Token-bucket depletion rotates instead of aborting the whole pool.
    • Empty-response retry actually retries (was a no-op 503 for single-account).
    • retry_after_ms vs retry_after scaled correctly.
    • Stream-stall/SSE exceptions refund the token and rotate.
    • codex-diff redaction is key-aware (opaque tokens no longer leak).
    • Flagged storage uses the keychain when CODEX_KEYCHAIN=1.
    • Logger masks emails domain-preserving and adds cookie headers to the sensitive set.

Internal

  • Deep stress suite (#166) — property-based and concurrency tests for the audited subsystems, each mutation-verified.

Full test suite: 2487 passing.

Assets 2
Loading