v1.6.1 — the CLI stops acting as the wrong account

v1.6.1 — the CLI stops acting as the wrong account

First patch on the 1.6 stable line. Fixes only; the ACP feature train stays on the 1.7 preview line.

The CLI refuses an API key that isn't this machine's. A stray .env in the working directory could shadow the identity in ~/.co/keys.env, so a command run from the wrong directory silently read another account's mailbox and spent its credit. It now re-authenticates for this machine's key, or fails closed and points you at co auth. This is the root of the wrong-sender / wrong-mailbox reports.

co outlook read keeps the links in your mail. HTML messages had their <a href> stripped down to the visible text, which made per-recipient links (the ones with a token in the URL) impossible to recover. The address now stays.

A malformed token no longer crashes every command. A JWT whose claims aren't the shape the decoder expected used to take down the whole CLI.

pip install --upgrade connectonion