- Added
codex-multi-auth unpinto clear the manual pin set byswitch, bumpaffinityGenerationso the proxy invalidates session affinity on the next request, and resume hybrid rotation. codex-multi-auth statusnow surfaces the pinned account index and warns when the runtime is using a different account than the pin requests.codex-multi-auth switch <index>now writespinnedAccountIndexthat the proxy honors before session affinity, hybrid scoring, and pool fallback;bestclears the pin.
statusno longer printsPinned: account NaNfor corrupt pins; the guard tightens toNumber.isInteger, shows the raw stored value, and points atunpin.
- Runtime rotation proxy now honors manual switch on the Codex Desktop app via a content-hash-keyed per-path read of the storage file; the pinned path is exempt from
markSwitched/saveToDiskDebounced/syncCodexCliActiveSelectionForIndex. - Session affinity no longer locks the desktop app to one account for 20 minutes;
affinityGenerationbumps fromswitch/unpin/besttriggerSessionAffinityStore.clearAll()beforechooseAccount, including for the in-flight request. - When the pinned account is unavailable, the proxy now returns HTTP 503 with
error.code = codex_pinned_account_unavailableinstead of silently rotating. AccountManager.buildStorageSnapshotno longer wipespinnedAccountIndex/affinityGenerationon routine debounced saves; it refreshes from disk before serializing.- Concurrent
affinityGenerationincrements across CLI processes are now atomic viaMath.max(inMemory, disk) + 1. unpinnow usessaveAccountsWithRetryso a transient Windows file lock cannot silently lose the user's intent.- Replaced a synchronous busy-wait in
readStorageMetaFromDiskwith a single read plus per-path content-hash cache fallback that preserves the last snapshot on transient errors. - Runtime rotation proxy storage cache is now a
Map<string, StorageMetaSnapshot>keyed by absolute path, fixing cross-instance and cross-worker pin leakage.