I think you're best off not upgrading for the time being. It seems like the old auth still works server-side but the the new auth is very, very busted if you are not on a personal plan.

But good news: you can fake out codex-rs into thinking it's not headless by unsetting all SSH environment variables and setting DISPLAY=foo to recover the old behavior.