v6.3.4

Fixed

• A dark account pool now recovers without hand-editing JSON. When a stored account is left with a stale auth-failure/network-error cooldown or stale rateLimitResetTimes (future-dated reset), it stays ineligible for rotation even though the credential is alive — so every account can go dark and normal requests fail while --pure works. codex-doctor --fix now clears that stale state on accounts whose token refresh succeeds, clears the stale TUI quota cache, and the recovery self-heals across restarts. (#173, fixes #171)
• codex-doctor --fix no longer fails silently when a credential is genuinely dead: a failed token refresh now reports N account(s) need re-login and points at opencode auth login, instead of leaving an all-dark pool unrepaired with no surfaced cause. (#177)
• codex-health now surfaces the same recovery diagnostics as codex-doctor (read-only): accounts blocked only by a stale cooldown/rate-limit (→ codex-doctor --fix) and disabled duplicate entries (→ codex-remove), plus staleRecoverableSlots / disabledDuplicateSlots in JSON output. (#177)
• A disabled accountIdSource: "token" duplicate (a re-login artifact) merging into the real org account by email no longer disables the canonical account. Storage dedup lets the org account's own enabled state govern the merge, so a single-account pool can no longer end up dark and unrecoverable; fail-closed is preserved for genuinely user-disabled accounts. (#180, fixes #171)
• Storage dedup now compares account emails case-insensitively, matching the codex-doctor/codex-health detectors. Previously User@Example.com and user@example.com escaped dedup yet were still flagged as removable, so the two layers disagreed on identity. (#181)
• codex-doctor and codex-health now surface a disabled account that holds a fresh login credential — the fingerprint of a recent re-login that landed on a disabled slot — so the user is told to re-enable it if intended instead of getting no signal. (#181)
• Caller-cancellation during a retry/backoff wait now surfaces as a proper AbortError carrying the caller's signal.reason, instead of an opaque new Error("Aborted") that dropped the cause. (#178)

Security

• Bumped hono to 4.12.26, resolving a high-severity Windows serve-static path traversal via encoded backslash (%5C) and four moderate advisories. This also clears the transitive @openauthjs/openauth advisory. (#173)
• Overrode vite to ^7.3.5 (high + moderate, dev/test toolchain), @babel/core to ^7.29.6 (low, no major bump), and brace-expansion 5.x to ^5.0.6 (moderate). npm audit now reports 0 vulnerabilities. (#173)

Notes

• The recovery is repaired via codex-doctor --fix (now also surfaced by codex-health), not automatic self-heal in the request path — a future-dated cooldown/rate-limit is only cleared on an explicit repair, since auto-clearing would undermine the legitimate 401/429 backoff.
• The Error: Aborted symptom reported on a clean pool (#176) had its sleep/backoff cancellation typed as a real AbortError, but the underlying root trigger is still being investigated and is tracked separately in #176.