https://www.npmjs.com/package/codex-multi-auth/v/2.26.0

npm i -g codex-multi-auth@2.26.0

The runtime proxy and local bridge route native Decisions API requests to API and ZDR credentials, and a successful codex-multi-auth resets redeem now reaches a running router, including a hard-pinned one, without a restart. (#758, #759, #760, #761)

• Native Decisions API routing: the runtime proxy accepts POST /v1/decisions and POST /decisions, and the authenticated local bridge forwards /v1/decisions. Typed predicate, choice, and score requests go to the selected credential's regional endpoint and are never converted to Responses or chat. Answers, refusals, and provider usage pass through unchanged. Select api/<model> or zdr/<model> explicitly, and declare supported_endpoints: ["/v1/decisions"] in that credential's model profile. PSP and subscription routes are not used. See Decisions API routing. (#759)
• Decisions failover: failover stays within the selected pool and region. A credential rejected with 401, 403, or a permanent quota 429 is skipped for the rest of the request, and a pool where every credential returns 401 or 403 answers 503 decisions_pool_unavailable. Only confirmed temporary rate_limit_exceeded 429s are retried. When the pool's shortest cooldown outlasts the 60-second deadline, the caller gets 429 with Retry-After. Credentials with a fresh catalog are tried before cold ones are discovered. Unsupported-endpoint answers move to the next credential and are cached for five minutes. (#759)
• Decisions usage: usage is recorded under a new decisions operation with the provider's token counts. Endpoint pricing is unknown, so cost stays null, never zero or a Responses price. Answers are buffered up to 64 MiB; a larger one returns 502 decisions_response_too_large. (#759)

• Decisions and cost budgets: a cost budget can't be evaluated while unpriced usage is in its window, and every budget counts all ledger rows. So while any --cost budget exists, Decisions requests are refused with 403 policy_blocked before inference. Use --requests or --tokens budgets to allow them. (#759)
• Reset-credit state version 3: completed receipts are kept per workspace with generations that don't depend on the clock. Older binaries reject version 3 state rather than drop receipts, so upgrade the CLI and router together and restart the router after upgrading. Version 1 and 2 state stays readable. Upgrade notes. (#760)

• Manual resets reach running routers: after resets redeem, a running provider or native router, including a hard pin, used to keep returning 503 until its cached quota deadline. The next blocked Responses request now reads the reset receipt and runs a fresh read-only quota check. Unpinned requests check only when no account is usable, and concurrent requests share that check. No extra reset credit is spent. A failed check keeps the block and retries after a delay that starts at five seconds and backs off to five minutes. A newer 429 for the same quota still needs a new receipt. Healthy requests skip the check, and authentication and model-specific blocks stay in place. (#760)
• Workspace-scoped quota deadlines: rate-limit deadlines and pending redemptions are tracked per serving workspace, so one workspace's late 429 or pending redemption can't block another's recovery. Deadlines survive restarts and account reloads. (#760)

• vitest updated to 5.0.5 for Dependabot alerts. (#758)
• The local bridge checklist lists /v1/decisions. (#761)

• @bayan9 for native Decisions API routing (#759).
• @danpetruk for manual reset propagation to running routers (#760).