onWatch v2.14.12

onWatch 2.14.12 fixes Codex accounts that stayed paused after re-authentication, makes OpenCode Go work with API keys, and redesigns the menubar quota cards.

Codex: paused accounts recover (#147)

A Codex account that paused after repeated auth failures never looked at its credentials again, so a fresh codex login could not lift the pause without restarting onWatch. Meanwhile the card kept showing old numbers and a negative "Resetting..." countdown.

• Re-auth resumes polling. While paused, onWatch watches the credential file. When it changes, the pause lifts and onWatch polls right away. If nothing changed, no network calls are made.
• Named profiles use the access token's expiry. Profile expiry was read from the id_token, which expires days before the access token. That made a valid profile look expired, the refresh failed every tick, and polling paused.
• A dead refresh token is not replayed. A bare 401 from the token endpoint now counts as terminal, and no proactive refresh runs while an account is paused. A recovery refresh only runs when the access token is actually expiring, at most once per backoff window, so onWatch can no longer rotate a valid token and log the Codex CLI out.
• Shared tokens are written back to ~/.codex/auth.json. When a named profile refreshes a token it shares with auth.json, the rotated token now also goes back to auth.json. Before, a profile refresh could leave the Codex CLI holding a spent refresh token. The write only happens if auth.json still holds the token that was consumed, so a newer CLI login is never overwritten.
• Paused and stale accounts are visible. The dashboard and menubar show a status dot with a tooltip ("Re-authentication required", or "Updates unavailable - last updated 2h ago") instead of looking live. A past reset reads "reset due".

OpenCode Go

• API-key mode reads quotas from /zen/go/v1/usage and shows the window status.
• onwatch setup now prompts for OpenCode Go and Command Code credentials.

Menubar

• Big ring tiles with the reset countdown inside the ring and full quota labels.
• Cards pack into up to 4 columns in their original order, and the popover height fits its content.
• A 100% reading shrinks so it no longer overlaps the ring stroke.

Also in this release

• Provider settings changed in the dashboard apply at runtime without overlapping agent runs.
• An explicit --db or absolute database path is kept as given instead of being redirected.
• Command Code has a history chart.
• Long insight values no longer overflow their card.
• Saved provider keys can be cleared from Settings.

Upgrading

onwatch update, or re-run the installer.

Thanks to @kats1123 for the detailed report on #147.

Full Changelog: v2.14.11...v2.14.12