@foxden-app/foxclaw 0.10.0 → 0.11.0

package/dist/main.js

@@ -9,7 +9,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { APP_HOME, buildCodexApiProviderOverrides, DEFAULT_CODEX_TELEGRAM_HOME, DEFAULT_ANTIGRAVITY_TELEGRAM_HOME, DEFAULT_ENV_PATH, DEFAULT_LOG_PATH, DEFAULT_STATUS_PATH, getLoadedEnvPath, loadConfig, loadEnv, } from './config.js';
 import { createAuthRefreshNotificationAggregator, } from './auth/notifications.js';
-import { getAntigravityTelegramCommands } from './i18n.js';
+import { getAntigravityTelegramCommands, getTelegramCommands } from './i18n.js';
 import { installBundledCodexSkills } from './codex_skills.js';
 import { acquireProcessLock, LockHeldError } from './lock.js';
 import { readRuntimeStatus, writeRuntimeStatus } from './runtime.js';
@@ -191,6 +191,9 @@ async function main() {
             ...(process.env.CODEX_CLI_BIN || resolveCommand('codex')
                 ? { codexCliBin: process.env.CODEX_CLI_BIN || resolveCommand('codex') }
                 : {}),
+            ...(process.env.AGY_CLI_BIN || resolveCommand('agy')
+                ? { agyCliBin: process.env.AGY_CLI_BIN || resolveCommand('agy') }
+                : {}),
             ...(notificationFile ? { notificationFile } : {}),
         };
         const outcome = performSelfUpdate(options);
@@ -346,7 +349,8 @@ async function runSendVoiceCli() {
         throw new Error('Telegram voice files must be 50MB or smaller.');
     }
     const inferredBotId = parsed.botId ?? inferTelegramBotId(process.env.CODEX_HOME) ?? inferTelegramBotId(config.codexHome);
-    const { botId, botToken } = resolveTelegramVoiceTarget(config.tgBotTokens, inferredBotId);
+    const allTokens = [...config.codexBotTokens, ...config.antigravityBotTokens];
+    const { botId, botToken } = resolveTelegramVoiceTarget(allTokens, inferredBotId);
     const { BridgeStore } = await import('./store/database.js');
     const store = new BridgeStore(config.storePath);
     let chatId = parsed.chatId;
@@ -391,7 +395,8 @@ async function runSendMediaCli() {
     }
     const plan = planTelegramOutboundMedia(filePath);
     const inferredBotId = parsed.botId ?? inferTelegramBotId(process.env.CODEX_HOME) ?? inferTelegramBotId(config.codexHome);
-    const { botId, botToken } = resolveTelegramVoiceTarget(config.tgBotTokens, inferredBotId);
+    const allTokens = [...config.codexBotTokens, ...config.antigravityBotTokens];
+    const { botId, botToken } = resolveTelegramVoiceTarget(allTokens, inferredBotId);
     const { BridgeStore } = await import('./store/database.js');
     const store = new BridgeStore(config.storePath);
     let chatId = parsed.chatId;
@@ -523,6 +528,17 @@ function formatRuntimeStatusSummary(status) {
     else if (status.codexHome) {
         lines.push(`Codex home: ${status.codexHome}`);
     }
+    const agyHomes = (status.bots ?? [])
+        .flatMap(bot => bot.antigravityHome ? [{ label: bot.username ? `@${bot.username}` : bot.id, home: bot.antigravityHome }] : []);
+    if (agyHomes.length > 1) {
+        lines.push('Antigravity homes:');
+        for (const { label, home } of agyHomes) {
+            lines.push(`  ${label}: ${home}`);
+        }
+    }
+    else if (agyHomes.length === 1) {
+        lines.push(`Antigravity home: ${agyHomes[0].home}`);
+    }
     if (status.codexAppServer) {
         lines.push(`App server: ${status.codexAppServer.running ? 'running' : 'stopped'}${status.codexAppServer.pid ? ` pid=${status.codexAppServer.pid}` : ''}${status.codexAppServer.port ? ` port=${status.codexAppServer.port}` : ''}`);
     }
@@ -589,7 +605,7 @@ function truncateStatusLine(value, maxLength) {
     return normalized.length <= maxLength ? normalized : `${normalized.slice(0, Math.max(0, maxLength - 1))}…`;
 }
 async function runServeCli() {
-    const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter }, { AuthCandidateMirror }, { CrossNodeAuthSync }, { OpencodeTelegramRuntime }, { AntigravityTelegramRuntime }, { UnifiedBridgeCore }, { AntigravityAppClient }, { AntigravityAuthManager },] = await Promise.all([
+    const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter }, { AuthCandidateMirror }, { CrossNodeAuthSync }, { OpencodeTelegramRuntime }, { UnifiedBridgeCore }, { AntigravityAppClient }, { AntigravityAuthManager, linkAntigravityAuthTokens },] = await Promise.all([
         import('./channels/bridge_messaging_router.js'),
         import('./channels/telegram/telegram_messaging_port.js'),
         import('./channels/weixin/weixin_channel_adapter.js'),
@@ -605,7 +621,6 @@ async function runServeCli() {
         import('./auth/mirror.js'),
         import('./auth/cross_node_sync.js'),
         import('./opencode/runtime.js'),
-        import('./antigravity/runtime.js'),
         import('./antigravity/controller.js'),
         import('./antigravity/client.js'),
         import('./antigravity/auth.js'),
@@ -624,12 +639,20 @@ async function runServeCli() {
     let activeAuthMirror = null;
     let activeAuthSync = null;
     let activeOpencodeRuntime = null;
-    const activeAntigravityRuntimes = [];
     let sharedCodexApp = null;
     let sharedAntigravityApp = null;
     let sharedAntigravityAuth = null;
     try {
         store = new BridgeStore(config.storePath);
+        const selfUpdater = createSelfUpdateRuntime({
+            entryPoint,
+            nodePath: process.execPath,
+            version: readPackageVersion(),
+            statusPath: config.statusPath,
+            logPath: path.join(APP_HOME, 'logs', 'update.log'),
+            codexCliBin: config.codexCliBin,
+            agyCliBin: config.antigravityCliBin,
+        });
         sharedAntigravityAuth = new AntigravityAuthManager(config.antigravityAuthDir, logger);
         sharedAntigravityApp = new AntigravityAppClient(config.antigravityCliBin, logger);
         if (config.codexCliBin) {
@@ -640,474 +663,226 @@ async function runServeCli() {
             await activeOpencodeRuntime.start();
             logger.info('opencode.bridge.started', activeOpencodeRuntime.getRuntimeStatus());
         }
-        if (config.antigravityBotTokens.length > 0) {
-            for (const token of config.antigravityBotTokens) {
-                const bot = new TelegramGateway(token, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger, true, getAntigravityTelegramCommands);
-                const id = await bot.initializeIdentity();
-                const username = await bot.resolveUsername();
-                const sharedDefaultRuntime = config.antigravityDefaultRuntimeBotToken
+        const totalBots = config.codexBotTokens.length + config.antigravityBotTokens.length;
+        const namespacedScopes = totalBots > 1;
+        const seeds = [];
+        const canonicalAuthDir = config.codexAuthDir ?? config.codexHome ?? path.join(os.homedir(), '.codex');
+        const specs = [
+            ...config.codexBotTokens.map((token, i) => ({
+                token,
+                backend: 'codex',
+                isDefaultRuntimeForBackend: config.tgDefaultRuntimeBotToken
+                    ? config.tgDefaultRuntimeBotToken === token
+                    : i === 0,
+            })),
+            ...config.antigravityBotTokens.map((token, i) => ({
+                token,
+                backend: 'antigravity',
+                isDefaultRuntimeForBackend: config.antigravityDefaultRuntimeBotToken
                     ? config.antigravityDefaultRuntimeBotToken === token
-                    : (token === config.antigravityBotTokens[0]);
-                let home;
-                let authDir;
-                let app;
-                let auth;
-                if (sharedDefaultRuntime) {
-                    home = os.homedir();
-                    authDir = config.antigravityAuthDir;
-                    app = sharedAntigravityApp;
-                    auth = sharedAntigravityAuth;
-                }
-                else {
-                    home = prepareTelegramBotHome(DEFAULT_ANTIGRAVITY_TELEGRAM_HOME, id, username, null);
-                    authDir = path.join(home, '.gemini', 'antigravity-cli');
-                    fs.mkdirSync(authDir, { recursive: true, mode: 0o700 });
-                    app = new AntigravityAppClient(config.antigravityCliBin, logger, { HOME: home });
-                    auth = new AntigravityAuthManager(authDir, logger);
-                }
-                const runtimeConfig = {
-                    ...config,
-                    antigravityBotToken: token,
-                    antigravityBotTokens: [token],
-                    tgScopeBotId: id,
-                    antigravityAuthDir: authDir,
-                };
-                const runtime = new AntigravityTelegramRuntime(runtimeConfig, store, logger, {
-                    botToken: token,
-                    botId: id,
-                    botUsername: username ?? undefined,
-                    sharedDefaultRuntime,
-                    home,
-                    authDir,
-                    codexApp: sharedCodexApp ?? undefined,
-                    app,
-                    auth,
-                });
-                await runtime.start();
-                activeAntigravityRuntimes.push(runtime);
-                logger.info('antigravity.bridge.started', runtime.getRuntimeStatus());
+                    : i === 0,
+            })),
+        ];
+        const identities = await Promise.all(specs.map(async (spec) => {
+            const bot = new TelegramGateway(spec.token, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger, namespacedScopes, spec.backend === 'antigravity' ? getAntigravityTelegramCommands : getTelegramCommands);
+            const id = await bot.initializeIdentity();
+            const username = await bot.resolveUsername();
+            return { ...spec, bot, id, username };
+        }));
+        for (const { token, backend, isDefaultRuntimeForBackend, bot, id, username } of identities) {
+            if (seeds.some((runtime) => runtime.id === id)) {
+                throw new Error(`Duplicate Telegram bot identity detected: ${id}`);
             }
-        }
-        if (config.tgMultiBotMode) {
-            const seeds = [];
-            const canonicalAuthDir = config.codexAuthDir ?? config.codexHome ?? path.join(os.homedir(), '.codex');
-            const identities = await Promise.all(config.tgBotTokens.map(async (token) => {
-                const bot = new TelegramGateway(token, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger, true);
-                const id = await bot.initializeIdentity();
-                const username = await bot.resolveUsername();
-                return { token, bot, id, username };
-            }));
-            for (const { token, bot, id, username } of identities) {
-                if (seeds.some((runtime) => runtime.id === id)) {
-                    throw new Error(`TG_BOT_TOKENS contains duplicate Telegram bot identity: ${id}`);
-                }
-                const sharedDefaultRuntime = config.tgDefaultRuntimeBotToken === token;
-                const home = prepareTelegramBotHome(DEFAULT_CODEX_TELEGRAM_HOME, id, username, sharedDefaultRuntime ? (config.codexHome ?? path.join(os.homedir(), '.codex')) : null);
-                const authDir = sharedDefaultRuntime ? canonicalAuthDir : home;
-                if (!sharedDefaultRuntime) {
-                    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
-                }
-                installBundledCodexSkills(packageRoot, home);
-                const runtimeConfig = {
-                    ...config,
-                    tgBotToken: token,
-                    tgBotTokens: [token],
-                    tgScopeBotId: id,
-                    codexAuthDir: sharedDefaultRuntime ? config.codexAuthDir : home,
-                    codexHome: home,
-                    codexAppAutolaunch: sharedDefaultRuntime ? config.codexAppAutolaunch : false,
-                    codexAppServerStatePath: sharedDefaultRuntime
-                        ? config.codexAppServerStatePath
-                        : path.join(APP_HOME, 'runtime', `codex-app-server-${id}.json`),
-                    codexAppServerLogPath: sharedDefaultRuntime
-                        ? config.codexAppServerLogPath
-                        : path.join(APP_HOME, 'logs', `codex-app-server-${id}.log`),
-                };
-                const childEnv = { CODEX_HOME: home };
-                const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, childEnv, [
+            // Codex environment
+            const isCodexDefault = backend === 'codex' && isDefaultRuntimeForBackend;
+            const codexHome = isCodexDefault
+                ? (config.codexHome ?? path.join(os.homedir(), '.codex'))
+                : prepareTelegramBotHome(DEFAULT_CODEX_TELEGRAM_HOME, id, username, null);
+            const codexAuthDir = isCodexDefault ? (config.codexAuthDir ?? codexHome) : codexHome;
+            if (!isCodexDefault) {
+                fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+            }
+            installBundledCodexSkills(packageRoot, codexHome);
+            const codexAppAutolaunch = isCodexDefault ? config.codexAppAutolaunch : false;
+            const codexAppServerStatePath = isCodexDefault
+                ? config.codexAppServerStatePath
+                : path.join(APP_HOME, 'runtime', `codex-app-server-${id}.json`);
+            const codexAppServerLogPath = isCodexDefault
+                ? config.codexAppServerLogPath
+                : path.join(APP_HOME, 'logs', `codex-app-server-${id}.log`);
+            const codexApp = (isCodexDefault && sharedCodexApp)
+                ? sharedCodexApp
+                : new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, codexAppAutolaunch, codexAppServerStatePath, codexAppServerLogPath, logger, { CODEX_HOME: codexHome }, [
                     ...codexApiProviderOverrides,
-                    ...(sharedDefaultRuntime ? [] : ['cli_auth_credentials_store="file"']),
+                    ...(isCodexDefault ? [] : ['cli_auth_credentials_store="file"']),
                 ]);
-                seeds.push({ id, home, authDir, sharedDefaultRuntime, config: runtimeConfig, bot, app });
-            }
-            let authSync = null;
-            const authRuntimeIds = seeds.map((runtime) => runtime.id);
-            const mirror = new AuthCandidateMirror(canonicalAuthDir, seeds.map((runtime) => ({
-                id: runtime.id,
-                label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
-                authDir: runtime.authDir,
-                validate: async (context) => validateRefreshedAuthCandidate(runtime, context.candidateName),
-                notify: createAuthMirrorNotifier(store, runtime.id, runtime.bot, authNotificationAggregator, {
-                    quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
-                    suppressBackgroundNotifications: () => true,
-                }),
-            })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'), {
-                onSynced: async (event) => {
-                    await authSync?.publishCandidate(event.record.candidateName);
-                },
-                onRemoteImported: (event) => {
-                    restoreImportedAuthCandidateState(store, event.record.candidateName, authRuntimeIds);
-                },
-            });
-            await mirror.initialize();
-            activeAuthMirror = mirror;
-            managedApps = seeds.map((runtime) => runtime.app);
-            const selfUpdater = createSelfUpdateRuntime({
-                entryPoint,
-                nodePath: process.execPath,
-                version: readPackageVersion(),
-                statusPath: config.statusPath,
-                logPath: path.join(APP_HOME, 'logs', 'update.log'),
-                codexCliBin: config.codexCliBin,
-                agyCliBin: config.antigravityCliBin,
-            });
-            const lastSelfUpdatePath = path.join(APP_HOME, 'runtime', 'last-self-update.json');
-            let lastSelfUpdate = readSelfUpdateStatus(lastSelfUpdatePath);
-            const runtimes = [];
-            const localAuthRefreshLease = createLocalAuthRefreshLease();
-            const writeAggregateStatus = (running = true) => {
-                const statuses = runtimes.map((runtime) => runtime.core.getRuntimeStatus());
-                const weixinStatus = activeWeixinCore?.getRuntimeStatus() ?? null;
-                const authProactiveRefresh = newestAuthProactiveRefreshStatus([...statuses, ...(weixinStatus ? [weixinStatus] : [])]);
-                const first = statuses[0] ?? null;
-                writeRuntimeStatus(config.statusPath, {
-                    running,
-                    connected: running
-                        && statuses.every((status) => status.connected)
-                        && (!weixinStatus || weixinStatus.connected),
-                    userAgent: first?.userAgent ?? null,
-                    codexHome: first?.codexHome ?? null,
-                    ...(first?.codexAppServer ? { codexAppServer: first.codexAppServer } : {}),
-                    botUsername: first?.botUsername ?? null,
-                    currentBindings: store.countBindings(),
-                    pendingApprovals: store.countPendingApprovals(),
-                    pendingUserInputs: store.countPendingUserInputs(),
-                    queuedTurns: store.countQueuedTurnInputs(),
-                    activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0)
-                        + (weixinStatus?.activeTurns ?? 0),
-                    lastError: statuses.find((status) => status.lastError)?.lastError
-                        ?? weixinStatus?.lastError
-                        ?? null,
-                    updatedAt: new Date().toISOString(),
-                    channels: { telegram: running, weixin: running && config.wxEnabled },
-                    bots: runtimes.map((runtime, index) => ({
-                        id: runtime.id,
-                        username: statuses[index]?.botUsername ?? runtime.bot.username,
-                        connected: running && Boolean(statuses[index]?.connected),
-                        activeTurns: running ? (statuses[index]?.activeTurns ?? 0) : 0,
-                        runtimeKind: runtime.sharedDefaultRuntime ? 'default' : 'isolated',
-                        codexHome: statuses[index]?.codexHome ?? runtime.home,
-                        ...(statuses[index]?.codexAppServer ? { codexAppServer: statuses[index].codexAppServer } : {}),
-                    })),
-                    ...(weixinStatus ? {
-                        weixinRuntime: {
-                            connected: running && weixinStatus.connected,
-                            activeTurns: running ? weixinStatus.activeTurns : 0,
-                            ...(weixinStatus.codexAppServer ? { codexAppServer: weixinStatus.codexAppServer } : {}),
-                        },
-                    } : {}),
-                    ...(activeAntigravityRuntimes.length > 0 ? {
-                        antigravityBots: activeAntigravityRuntimes.map((runtime) => {
-                            const status = runtime.getRuntimeStatus();
-                            return {
-                                id: runtime.id,
-                                username: status.botUsername ?? runtime.botGateway.username,
-                                connected: running && Boolean(status.connected),
-                                activeTurns: running ? (status.activeTurns ?? 0) : 0,
-                                runtimeKind: runtime.isSharedDefaultRuntime ? 'default' : 'isolated',
-                                home: runtime.botHome,
-                                authDir: runtime.authDirectory,
-                            };
-                        }),
-                    } : {}),
-                    authMirror: mirror.getStatus(),
-                    authSync: authSync?.getStatus() ?? null,
-                    authProactiveRefresh,
-                    lastUpdate: lastSelfUpdate,
-                });
-            };
-            const authSyncLocalIdle = () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate())
-                && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
-                && mirror.isIdle();
-            const clusterUpdateScheduler = createClusterUpdateScheduler({
-                selfUpdater,
-                canUpdate: () => authSyncLocalIdle()
-                    && (authSync ? authSync.isIdle() : localAuthRefreshLease.isIdle()),
-                currentVersion: readPackageVersion,
-                logger,
-            });
-            const coordinator = {
-                canSelfUpdate: () => authSyncLocalIdle()
-                    && (authSync ? authSync.isIdle() : localAuthRefreshLease.isIdle()),
-                authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
-                authCandidateDeleted: async (_runtimeId, candidateName, reason = null) => {
-                    await mirror.deleteCandidate(candidateName);
-                    await authSync?.publishCandidateDeletion(candidateName, reason);
-                },
-                recoverAuthCandidate: async (runtimeId, candidateName, options = {}) => {
-                    const local = await mirror.recoverRuntimeCandidate(runtimeId, candidateName);
-                    if (local)
-                        return true;
-                    if (options.crossNode === false)
-                        return false;
-                    const current = await mirror.readRuntimeCandidate(runtimeId, candidateName)
-                        ?? await mirror.readNewestCandidate(candidateName);
-                    return await authSync?.requestRecovery(candidateName, {
-                        accountId: current?.accountId ?? null,
-                        quotaIdentityId: current?.quotaIdentityId ?? null,
-                        lastRefreshMs: current?.lastRefreshMs ?? null,
-                    }) ?? false;
-                },
-                acquireAuthRefreshLease: (reason) => authSync?.acquireRefreshLease(reason)
-                    ?? localAuthRefreshLease.acquire(reason),
-                releaseAuthRefreshLease: (leaseId) => authSync?.releaseRefreshLease(leaseId)
-                    ?? localAuthRefreshLease.release(leaseId),
-                getAuthSyncStatus: () => authSync?.getStatus() ?? null,
-                authSyncSafeAll: async () => {
-                    const local = await mirror.syncAllRuntimeCandidates();
-                    const remote = await authSync?.pushAll() ?? { sent: 0, skipped: 0 };
-                    return {
-                        localSynced: local.synced,
-                        localSkipped: local.skipped,
-                        sent: remote.sent,
-                        skipped: remote.skipped,
-                    };
-                },
-                authSyncPushAll: () => authSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
-                authSyncTest: () => authSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
-                authSyncAudit: () => authSync?.auditCluster() ?? Promise.resolve(null),
-                statusUpdated: () => writeAggregateStatus(),
-                getServiceStatus: async () => ({
-                    currentVersion: readPackageVersion(),
-                    bots: await Promise.all(runtimes.map(async (runtime) => {
-                        const status = runtime.core.getRuntimeStatus();
-                        return {
-                            id: runtime.id,
-                            username: status.botUsername ?? runtime.bot.username,
-                            connected: status.connected,
-                            activeTurns: status.activeTurns,
-                            runtimeKind: runtime.sharedDefaultRuntime ? 'default' : 'isolated',
-                            currentAuth: await runtime.core.getCurrentAuthLabel().catch(() => null),
-                            codexHome: status.codexHome ?? runtime.home,
-                            ...(status.codexAppServer ? { codexAppServer: status.codexAppServer } : {}),
-                        };
-                    })),
-                    ...(activeWeixinCore ? {
-                        weixinRuntime: {
-                            connected: activeWeixinCore.getRuntimeStatus().connected,
-                            activeTurns: activeWeixinCore.getRuntimeStatus().activeTurns,
-                            codexAppServer: activeWeixinCore.getRuntimeStatus().codexAppServer,
-                        },
-                    } : {}),
-                    authMirror: mirror.getStatus(),
-                    authSync: authSync?.getStatus() ?? null,
-                    authProactiveRefresh: newestAuthProactiveRefreshStatus([
-                        ...runtimes.map(runtime => runtime.core.getRuntimeStatus()),
-                        ...(activeWeixinCore ? [activeWeixinCore.getRuntimeStatus()] : []),
-                    ]),
-                    lastUpdate: lastSelfUpdate,
-                }),
-                selfUpdateCompleted: (status) => {
-                    lastSelfUpdate = status;
-                    writeSelfUpdateStatus(lastSelfUpdatePath, status);
-                    writeAggregateStatus();
-                },
-            };
-            for (const seed of seeds) {
-                const telegramMessaging = new TelegramMessagingPort(seed.bot);
-                const outbound = new BridgeMessagingRouter(telegramMessaging, null);
-                const codexCore = new BridgeSessionCore(seed.config, store, logger, seed.bot, seed.app, outbound, selfUpdater, coordinator, false);
-                const core = new UnifiedBridgeCore(seed.config, store, logger, seed.bot, sharedAntigravityApp ?? undefined, sharedAntigravityAuth ?? undefined, telegramMessaging, {
-                    codexApp: seed.app,
-                    codexCore,
-                    antigravityApp: sharedAntigravityApp ?? undefined,
-                    antigravityAuth: sharedAntigravityAuth ?? undefined,
-                    defaultBackendId: 'codex',
-                });
-                runtimes.push({ ...seed, core, telegram: new TelegramChannelAdapter(core) });
+            // Antigravity environment
+            const isAntigravityDefault = backend === 'antigravity' && isDefaultRuntimeForBackend;
+            let antigravityHome;
+            let antigravityAuthDir;
+            let antigravityApp;
+            let antigravityAuth;
+            if (isAntigravityDefault) {
+                antigravityHome = os.homedir();
+                antigravityAuthDir = config.antigravityAuthDir;
+                antigravityApp = sharedAntigravityApp;
+                antigravityAuth = sharedAntigravityAuth;
             }
-            if (config.wxEnabled) {
-                const weixinApp = new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, config.codexAppAutolaunch, config.codexAppServerStatePath, config.codexAppServerLogPath, logger, null, codexApiProviderOverrides);
-                const outbound = new BridgeMessagingRouter(new TelegramMessagingPort(seeds[0].bot), new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id)));
-                activeWeixinCore = new BridgeSessionCore(config, store, logger, seeds[0].bot, weixinApp, outbound, selfUpdater, coordinator, false);
-                managedApps.push(weixinApp);
-                weixinAdapter = new WeixinChannelAdapter(activeWeixinCore, store, config, logger);
+            else {
+                antigravityHome = prepareTelegramBotHome(DEFAULT_ANTIGRAVITY_TELEGRAM_HOME, id, username, null);
+                antigravityAuthDir = path.join(antigravityHome, '.gemini', 'antigravity-cli');
+                fs.mkdirSync(antigravityAuthDir, { recursive: true, mode: 0o700 });
+                linkAntigravityAuthTokens(config.antigravityAuthDir, antigravityAuthDir);
+                antigravityApp = new AntigravityAppClient(config.antigravityCliBin, logger, { HOME: antigravityHome });
+                antigravityAuth = new AntigravityAuthManager(antigravityAuthDir, logger);
             }
-            activeTelegramAdapters = runtimes.map((runtime) => runtime.telegram);
-            if (config.authSyncEnabled) {
-                const authSyncTransportBot = seeds[0];
-                const authSyncTransportLabel = authSyncTransportBot.bot.username
-                    ? `@${authSyncTransportBot.bot.username}`
-                    : authSyncTransportBot.id;
-                authSync = new CrossNodeAuthSync(buildAuthSyncConfig(config, authSyncTransportLabel), logger, {
-                    send: async (peer, envelope) => {
-                        await authSyncTransportBot.bot.sendDocument(peer, `foxclaw-auth-sync-${Date.now()}.json`, Buffer.from(envelope, 'utf8'), 'FOXCLAW_AUTH_SYNC_V1');
-                    },
-                }, {
-                    readLocalCandidate: (candidateName) => mirror.readNewestCandidate(candidateName),
-                    listLocalCandidates: () => mirror.listNewestCandidates(),
-                    listLocalCandidateCopies: () => mirror.listCandidateCopies(),
-                    validateCandidate: async (candidateName, raw, expectedAccountId) => {
-                        if (!authSyncLocalIdle()) {
-                            return { ok: false, reason: 'runtime is not idle' };
-                        }
-                        const runtime = runtimes.find((entry) => entry.core.isIdleForServiceUpdate()) ?? runtimes[0] ?? null;
-                        if (!runtime) {
-                            return { ok: false, reason: 'no validation runtime is available' };
-                        }
-                        return runtime.core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
-                    },
-                    importCandidate: (candidateName, raw, source) => mirror.importExternalCandidate(candidateName, raw, source),
-                    markCandidateState: (candidateName, state, expected) => markAuditedAuthCandidateState(store, mirror, candidateName, state, expected, authRuntimeIds),
-                    deleteLocalCandidate: async (candidateName, source) => {
-                        if (!authSyncLocalIdle()) {
-                            return { ok: false, deleted: false, reason: 'runtime is not idle' };
-                        }
-                        await mirror.deleteCandidate(candidateName);
-                        store.deleteCodexAuthCandidate(candidateName);
-                        await Promise.all(runtimes.map(runtime => runtime.core.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null)));
-                        if (activeWeixinCore) {
-                            await activeWeixinCore.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null);
-                        }
-                        return { ok: true, deleted: true, reason: source.reason ?? null };
-                    },
-                    scheduleServiceUpdate: (source) => clusterUpdateScheduler.schedule(source),
-                    isIdle: authSyncLocalIdle,
-                    notify: createAuthSyncNotifier(store, authSyncTransportBot.bot, authNotificationAggregator, {
-                        quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
-                        suppressBackgroundNotifications: () => true,
-                    }),
-                });
-                await authSync.initialize();
-                activeAuthSync = authSync;
-                attachTelegramAuthSync(authSyncTransportBot.bot, authSync, config, logger);
-                authSync.start();
-                void publishPendingClusterUpdateBroadcast(authSync, logger);
+            const runtimeConfig = {
+                ...config,
+                tgBotToken: token,
+                tgBotTokens: [token],
+                tgScopeBotId: id,
+                codexAuthDir,
+                codexHome,
+                antigravityHome,
+                antigravityAuthDir,
+                codexAppAutolaunch,
+                codexAppServerStatePath,
+                codexAppServerLogPath,
+            };
+            if (namespacedScopes && (isCodexDefault || isAntigravityDefault)) {
+                store.migrateTelegramUnnamespacedScope(id, config.tgAllowedUserId);
             }
-            mirror.start();
-            process.on('unhandledRejection', (error) => {
-                logger.error('process.unhandled_rejection', { error: serializeError(error) });
-            });
-            process.on('uncaughtException', (error) => {
-                logger.error('process.uncaught_exception', { error: serializeError(error) });
+            seeds.push({
+                id,
+                username,
+                home: codexHome,
+                authDir: codexAuthDir,
+                sharedDefaultRuntime: isCodexDefault || isAntigravityDefault,
+                config: runtimeConfig,
+                bot,
+                app: codexApp,
+                antigravityApp,
+                antigravityAuth,
+                antigravityHome,
+                antigravityAuthDir,
+                defaultBackend: backend,
             });
-            for (const runtime of runtimes) {
-                await runtime.telegram.start();
-            }
-            if (weixinAdapter) {
-                await activeWeixinCore.startCodexApp();
-                await weixinAdapter.start();
-            }
-            writeAggregateStatus();
-            logger.info('bridge.started', { bots: runtimes.map((runtime) => runtime.id) });
-            const shutdown = async (signal) => {
-                logger.info('bridge.shutting_down', { signal });
-                await authNotificationAggregator.flushAll();
-                authSync?.stop();
-                mirror.stop();
-                await weixinAdapter?.stop();
-                await activeWeixinCore?.stop();
-                await Promise.all(runtimes.map((runtime) => runtime.telegram.stop()));
-                await activeOpencodeRuntime?.stop();
-                await Promise.all(activeAntigravityRuntimes.map((runtime) => runtime.stop().catch(() => { })));
-                writeAggregateStatus(false);
-                const allManaged = [...managedApps, ...(sharedCodexApp ? [sharedCodexApp] : [])];
-                await Promise.all(allManaged.map((app) => app.stop({ terminateServer: true }).catch((error) => {
-                    logger.warn('codex.app-server.stop_failed', { error: serializeError(error) });
-                })));
-                store?.close();
-                processLock.release();
-                process.exit(0);
-            };
-            process.on('SIGINT', () => void shutdown('SIGINT'));
-            process.on('SIGTERM', () => void shutdown('SIGTERM'));
-            return;
         }
-        const singleCodexHome = config.codexHome ?? path.join(os.homedir(), '.codex');
-        installBundledCodexSkills(packageRoot, singleCodexHome);
-        const bot = new TelegramGateway(config.tgBotToken, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger);
-        const app = sharedCodexApp ?? new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, config.codexAppAutolaunch, config.codexAppServerStatePath, config.codexAppServerLogPath, logger, config.codexHome ? { CODEX_HOME: config.codexHome } : null, codexApiProviderOverrides);
-        const telegramMessaging = new TelegramMessagingPort(bot);
-        const weixinMessaging = config.wxEnabled
-            ? new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id))
-            : null;
-        const outbound = new BridgeMessagingRouter(telegramMessaging, weixinMessaging);
-        void outbound;
-        const selfUpdater = createSelfUpdateRuntime({
-            entryPoint,
-            nodePath: process.execPath,
-            version: readPackageVersion(),
-            statusPath: config.statusPath,
-            logPath: path.join(APP_HOME, 'logs', 'update.log'),
-            codexCliBin: config.codexCliBin,
-            agyCliBin: config.antigravityCliBin,
+        let authSync = null;
+        const authRuntimeIds = seeds.map((runtime) => runtime.id);
+        const mirror = new AuthCandidateMirror(canonicalAuthDir, seeds.map((runtime) => ({
+            id: runtime.id,
+            label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
+            authDir: runtime.authDir,
+            validate: async (context) => validateRefreshedAuthCandidate(runtime, context.candidateName),
+            notify: createAuthMirrorNotifier(store, runtime.id, runtime.bot, authNotificationAggregator, {
+                quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
+                suppressBackgroundNotifications: () => true,
+            }),
+        })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'), {
+            onSynced: async (event) => {
+                await authSync?.publishCandidate(event.record.candidateName);
+            },
+            onRemoteImported: (event) => {
+                restoreImportedAuthCandidateState(store, event.record.candidateName, authRuntimeIds);
+            },
         });
-        let singleAuthSync = null;
-        let singleMirror = null;
-        let core = null;
-        const writeSingleStatus = (running = true) => {
-            const coreStatus = core?.getRuntimeStatus();
+        await mirror.initialize();
+        activeAuthMirror = mirror;
+        managedApps = seeds.map((runtime) => runtime.app);
+        const lastSelfUpdatePath = path.join(APP_HOME, 'runtime', 'last-self-update.json');
+        let lastSelfUpdate = readSelfUpdateStatus(lastSelfUpdatePath);
+        const runtimes = [];
+        const localAuthRefreshLease = createLocalAuthRefreshLease();
+        const writeAggregateStatus = (running = true) => {
+            const statuses = runtimes.map((runtime) => runtime.core.getRuntimeStatus());
+            const weixinStatus = activeWeixinCore?.getRuntimeStatus() ?? null;
+            const authProactiveRefresh = newestAuthProactiveRefreshStatus([...statuses, ...(weixinStatus ? [weixinStatus] : [])]);
+            const first = statuses[0] ?? null;
             writeRuntimeStatus(config.statusPath, {
                 running,
-                connected: running && Boolean(coreStatus?.connected),
-                userAgent: coreStatus?.userAgent ?? app.getUserAgent(),
-                codexHome: coreStatus?.codexHome ?? singleCodexHome,
-                ...(coreStatus?.codexAppServer ? { codexAppServer: coreStatus.codexAppServer } : app.getServerStatus() ? { codexAppServer: app.getServerStatus() } : {}),
-                botUsername: coreStatus?.botUsername ?? bot.username,
-                currentBindings: store?.countBindings() ?? 0,
-                pendingApprovals: store?.countPendingApprovals() ?? 0,
-                pendingUserInputs: store?.countPendingUserInputs() ?? 0,
-                queuedTurns: store?.countQueuedTurnInputs() ?? 0,
-                activeTurns: coreStatus?.activeTurns ?? 0,
-                lastError: null,
+                connected: running
+                    && statuses.every((status) => status.connected)
+                    && (!weixinStatus || weixinStatus.connected),
+                userAgent: first?.userAgent ?? null,
+                codexHome: first?.codexHome ?? null,
+                ...(first?.codexAppServer ? { codexAppServer: first.codexAppServer } : {}),
+                botUsername: first?.botUsername ?? null,
+                currentBindings: store.countBindings(),
+                pendingApprovals: store.countPendingApprovals(),
+                pendingUserInputs: store.countPendingUserInputs(),
+                queuedTurns: store.countQueuedTurnInputs(),
+                activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0)
+                    + (weixinStatus?.activeTurns ?? 0),
+                lastError: statuses.find((status) => status.lastError)?.lastError
+                    ?? weixinStatus?.lastError
+                    ?? null,
                 updatedAt: new Date().toISOString(),
                 channels: { telegram: running, weixin: running && config.wxEnabled },
-                authMirror: singleMirror?.getStatus() ?? null,
-                authSync: singleAuthSync?.getStatus() ?? null,
+                bots: runtimes.map((runtime, index) => ({
+                    id: runtime.id,
+                    username: statuses[index]?.botUsername ?? runtime.bot.username,
+                    connected: running && Boolean(statuses[index]?.connected),
+                    activeTurns: running ? (statuses[index]?.activeTurns ?? 0) : 0,
+                    runtimeKind: runtime.sharedDefaultRuntime ? 'default' : 'isolated',
+                    defaultBackend: runtime.defaultBackend,
+                    codexHome: statuses[index]?.codexHome ?? runtime.home,
+                    antigravityHome: runtime.antigravityHome,
+                    ...(statuses[index]?.codexAppServer ? { codexAppServer: statuses[index].codexAppServer } : {}),
+                })),
+                ...(weixinStatus ? {
+                    weixinRuntime: {
+                        connected: running && weixinStatus.connected,
+                        activeTurns: running ? weixinStatus.activeTurns : 0,
+                        ...(weixinStatus.codexAppServer ? { codexAppServer: weixinStatus.codexAppServer } : {}),
+                    },
+                } : {}),
+                authMirror: mirror.getStatus(),
+                authSync: authSync?.getStatus() ?? null,
+                authProactiveRefresh,
+                lastUpdate: lastSelfUpdate,
             });
         };
-        const singleAuthDir = config.codexAuthDir ?? config.codexHome ?? process.env.CODEX_AUTH_DIR ?? path.join(os.homedir(), '.codex');
-        const singleLocalAuthRefreshLease = createLocalAuthRefreshLease();
-        const singleAuthSyncLocalIdle = () => Boolean(core?.isIdleForServiceUpdate())
-            && (!singleMirror || singleMirror.isIdle());
-        const singleClusterUpdateScheduler = createClusterUpdateScheduler({
+        const authSyncLocalIdle = () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate())
+            && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
+            && mirror.isIdle();
+        const clusterUpdateScheduler = createClusterUpdateScheduler({
             selfUpdater,
-            canUpdate: () => singleAuthSyncLocalIdle()
-                && (singleAuthSync ? singleAuthSync.isIdle() : singleLocalAuthRefreshLease.isIdle()),
+            canUpdate: () => authSyncLocalIdle()
+                && (authSync ? authSync.isIdle() : localAuthRefreshLease.isIdle()),
             currentVersion: readPackageVersion,
             logger,
         });
-        const singleCoordinator = config.authSyncEnabled ? {
-            canSelfUpdate: () => singleAuthSyncLocalIdle()
-                && (singleAuthSync ? singleAuthSync.isIdle() : singleLocalAuthRefreshLease.isIdle()),
-            authCandidateUpdated: (runtimeId, candidateName) => singleMirror?.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined) ?? Promise.resolve(),
+        const coordinator = {
+            canSelfUpdate: () => authSyncLocalIdle()
+                && (authSync ? authSync.isIdle() : localAuthRefreshLease.isIdle()),
+            authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
             authCandidateDeleted: async (_runtimeId, candidateName, reason = null) => {
-                await singleMirror?.deleteCandidate(candidateName);
-                await singleAuthSync?.publishCandidateDeletion(candidateName, reason);
+                await mirror.deleteCandidate(candidateName);
+                await authSync?.publishCandidateDeletion(candidateName, reason);
             },
             recoverAuthCandidate: async (runtimeId, candidateName, options = {}) => {
-                const local = await singleMirror?.recoverRuntimeCandidate(runtimeId, candidateName) ?? null;
+                const local = await mirror.recoverRuntimeCandidate(runtimeId, candidateName);
                 if (local)
                     return true;
                 if (options.crossNode === false)
                     return false;
-                const current = await singleMirror?.readRuntimeCandidate(runtimeId, candidateName)
-                    ?? await singleMirror?.readNewestCandidate(candidateName)
-                    ?? null;
-                return await singleAuthSync?.requestRecovery(candidateName, {
+                const current = await mirror.readRuntimeCandidate(runtimeId, candidateName)
+                    ?? await mirror.readNewestCandidate(candidateName);
+                return await authSync?.requestRecovery(candidateName, {
                     accountId: current?.accountId ?? null,
                     quotaIdentityId: current?.quotaIdentityId ?? null,
                     lastRefreshMs: current?.lastRefreshMs ?? null,
                 }) ?? false;
             },
-            acquireAuthRefreshLease: (reason) => singleAuthSync?.acquireRefreshLease(reason)
-                ?? singleLocalAuthRefreshLease.acquire(reason),
-            releaseAuthRefreshLease: (leaseId) => singleAuthSync?.releaseRefreshLease(leaseId)
-                ?? singleLocalAuthRefreshLease.release(leaseId),
-            getAuthSyncStatus: () => singleAuthSync?.getStatus() ?? null,
+            acquireAuthRefreshLease: (reason) => authSync?.acquireRefreshLease(reason)
+                ?? localAuthRefreshLease.acquire(reason),
+            releaseAuthRefreshLease: (leaseId) => authSync?.releaseRefreshLease(leaseId)
+                ?? localAuthRefreshLease.release(leaseId),
+            getAuthSyncStatus: () => authSync?.getStatus() ?? null,
             authSyncSafeAll: async () => {
-                const local = await singleMirror?.syncAllRuntimeCandidates() ?? { synced: 0, skipped: 0 };
-                const remote = await singleAuthSync?.pushAll() ?? { sent: 0, skipped: 0 };
+                const local = await mirror.syncAllRuntimeCandidates();
+                const remote = await authSync?.pushAll() ?? { sent: 0, skipped: 0 };
                 return {
                     localSynced: local.synced,
                     localSkipped: local.skipped,
@@ -1115,131 +890,148 @@ async function runServeCli() {
                     skipped: remote.skipped,
                 };
             },
-            authSyncPushAll: () => singleAuthSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
-            authSyncTest: () => singleAuthSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
-            authSyncAudit: () => singleAuthSync?.auditCluster() ?? Promise.resolve(null),
-            statusUpdated: (_status) => {
-                void _status;
-                writeSingleStatus(true);
+            authSyncPushAll: () => authSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
+            authSyncTest: () => authSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
+            authSyncAudit: () => authSync?.auditCluster() ?? Promise.resolve(null),
+            statusUpdated: () => writeAggregateStatus(),
+            getServiceStatus: async () => ({
+                currentVersion: readPackageVersion(),
+                bots: await Promise.all(runtimes.map(async (runtime) => {
+                    const status = runtime.core.getRuntimeStatus();
+                    return {
+                        id: runtime.id,
+                        username: status.botUsername ?? runtime.bot.username,
+                        connected: status.connected,
+                        activeTurns: status.activeTurns,
+                        runtimeKind: runtime.sharedDefaultRuntime ? 'default' : 'isolated',
+                        currentAuth: await runtime.core.getCurrentAuthLabel().catch(() => null),
+                        codexHome: status.codexHome ?? runtime.home,
+                        ...(status.codexAppServer ? { codexAppServer: status.codexAppServer } : {}),
+                    };
+                })),
+                ...(activeWeixinCore ? {
+                    weixinRuntime: {
+                        connected: activeWeixinCore.getRuntimeStatus().connected,
+                        activeTurns: activeWeixinCore.getRuntimeStatus().activeTurns,
+                        codexAppServer: activeWeixinCore.getRuntimeStatus().codexAppServer,
+                    },
+                } : {}),
+                authMirror: mirror.getStatus(),
+                authSync: authSync?.getStatus() ?? null,
+                authProactiveRefresh: newestAuthProactiveRefreshStatus([
+                    ...runtimes.map(runtime => runtime.core.getRuntimeStatus()),
+                    ...(activeWeixinCore ? [activeWeixinCore.getRuntimeStatus()] : []),
+                ]),
+                lastUpdate: lastSelfUpdate,
+            }),
+            selfUpdateCompleted: (status) => {
+                lastSelfUpdate = status;
+                writeSelfUpdateStatus(lastSelfUpdatePath, status);
+                writeAggregateStatus();
             },
-        } : null;
-        if (config.authSyncEnabled) {
-            singleMirror = new AuthCandidateMirror(singleAuthDir, [{
-                    id: 'default',
-                    label: bot.username ? `@${bot.username}` : 'default',
-                    authDir: singleAuthDir,
-                    validate: async (context) => validateRefreshedAuthCandidate({
-                        id: 'default',
-                        authDir: singleAuthDir,
-                        app,
-                    }, context.candidateName),
-                }], logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'), {
-                onSynced: async (event) => {
-                    await singleAuthSync?.publishCandidate(event.record.candidateName);
-                },
-                onRemoteImported: (event) => {
-                    restoreImportedAuthCandidateState(store, event.record.candidateName, ['default']);
-                },
+        };
+        for (const seed of seeds) {
+            const telegramMessaging = new TelegramMessagingPort(seed.bot);
+            const outbound = new BridgeMessagingRouter(telegramMessaging, null);
+            const codexCore = new BridgeSessionCore(seed.config, store, logger, seed.bot, seed.app, outbound, selfUpdater, coordinator, false);
+            const core = new UnifiedBridgeCore(seed.config, store, logger, seed.bot, seed.antigravityApp, seed.antigravityAuth, telegramMessaging, {
+                codexApp: seed.app,
+                codexCore,
+                antigravityApp: seed.antigravityApp,
+                antigravityAuth: seed.antigravityAuth,
+                defaultBackendId: seed.defaultBackend,
+                selfUpdater,
             });
-            await singleMirror.initialize();
-            activeAuthMirror = singleMirror;
+            runtimes.push({ ...seed, core, telegram: new TelegramChannelAdapter(core) });
         }
-        const singleOutbound = new BridgeMessagingRouter(telegramMessaging, null);
-        const singleCodexCore = new BridgeSessionCore(config, store, logger, bot, app, singleOutbound, selfUpdater, singleCoordinator, false);
-        core = new UnifiedBridgeCore(config, store, logger, bot, sharedAntigravityApp ?? undefined, sharedAntigravityAuth ?? undefined, telegramMessaging, {
-            codexApp: app,
-            codexCore: singleCodexCore,
-            antigravityApp: sharedAntigravityApp ?? undefined,
-            antigravityAuth: sharedAntigravityAuth ?? undefined,
-            defaultBackendId: 'codex',
-        });
-        if (config.authSyncEnabled && singleMirror) {
-            await bot.initializeIdentity();
-            singleAuthSync = new CrossNodeAuthSync(buildAuthSyncConfig(config, bot.username ? `@${bot.username}` : 'default'), logger, {
+        if (config.wxEnabled) {
+            const weixinApp = new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, config.codexAppAutolaunch, config.codexAppServerStatePath, config.codexAppServerLogPath, logger, null, codexApiProviderOverrides);
+            const outbound = new BridgeMessagingRouter(new TelegramMessagingPort(seeds[0].bot), new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id)));
+            activeWeixinCore = new BridgeSessionCore(config, store, logger, seeds[0].bot, weixinApp, outbound, selfUpdater, coordinator, false);
+            managedApps.push(weixinApp);
+            weixinAdapter = new WeixinChannelAdapter(activeWeixinCore, store, config, logger);
+        }
+        activeTelegramAdapters = runtimes.map((runtime) => runtime.telegram);
+        if (config.authSyncEnabled) {
+            const authSyncTransportBot = seeds[0];
+            const authSyncTransportLabel = authSyncTransportBot.bot.username
+                ? `@${authSyncTransportBot.bot.username}`
+                : authSyncTransportBot.id;
+            authSync = new CrossNodeAuthSync(buildAuthSyncConfig(config, authSyncTransportLabel), logger, {
                 send: async (peer, envelope) => {
-                    await bot.sendDocument(peer, `foxclaw-auth-sync-${Date.now()}.json`, Buffer.from(envelope, 'utf8'), 'FOXCLAW_AUTH_SYNC_V1');
+                    await authSyncTransportBot.bot.sendDocument(peer, `foxclaw-auth-sync-${Date.now()}.json`, Buffer.from(envelope, 'utf8'), 'FOXCLAW_AUTH_SYNC_V1');
                 },
             }, {
-                readLocalCandidate: (candidateName) => singleMirror.readNewestCandidate(candidateName),
-                listLocalCandidates: () => singleMirror.listNewestCandidates(),
-                listLocalCandidateCopies: () => singleMirror.listCandidateCopies(),
+                readLocalCandidate: (candidateName) => mirror.readNewestCandidate(candidateName),
+                listLocalCandidates: () => mirror.listNewestCandidates(),
+                listLocalCandidateCopies: () => mirror.listCandidateCopies(),
                 validateCandidate: async (candidateName, raw, expectedAccountId) => {
-                    if (!singleAuthSyncLocalIdle()) {
+                    if (!authSyncLocalIdle()) {
                         return { ok: false, reason: 'runtime is not idle' };
                     }
-                    return core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
+                    const runtime = runtimes.find((entry) => entry.core.isIdleForServiceUpdate()) ?? runtimes[0] ?? null;
+                    if (!runtime) {
+                        return { ok: false, reason: 'no validation runtime is available' };
+                    }
+                    return runtime.core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
                 },
-                importCandidate: (candidateName, raw, source) => singleMirror.importExternalCandidate(candidateName, raw, source),
-                markCandidateState: (candidateName, state, expected) => markAuditedAuthCandidateState(store, singleMirror, candidateName, state, expected, ['default']),
+                importCandidate: (candidateName, raw, source) => mirror.importExternalCandidate(candidateName, raw, source),
+                markCandidateState: (candidateName, state, expected) => markAuditedAuthCandidateState(store, mirror, candidateName, state, expected, authRuntimeIds),
                 deleteLocalCandidate: async (candidateName, source) => {
-                    if (!singleAuthSyncLocalIdle()) {
+                    if (!authSyncLocalIdle()) {
                         return { ok: false, deleted: false, reason: 'runtime is not idle' };
                     }
-                    await singleMirror.deleteCandidate(candidateName);
+                    await mirror.deleteCandidate(candidateName);
                     store.deleteCodexAuthCandidate(candidateName);
-                    await core.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null);
+                    await Promise.all(runtimes.map(runtime => runtime.core.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null)));
+                    if (activeWeixinCore) {
+                        await activeWeixinCore.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null);
+                    }
                     return { ok: true, deleted: true, reason: source.reason ?? null };
                 },
-                scheduleServiceUpdate: (source) => singleClusterUpdateScheduler.schedule(source),
-                isIdle: singleAuthSyncLocalIdle,
-                notify: createAuthSyncNotifier(store, bot, authNotificationAggregator, {
+                scheduleServiceUpdate: (source) => clusterUpdateScheduler.schedule(source),
+                isIdle: authSyncLocalIdle,
+                notify: createAuthSyncNotifier(store, authSyncTransportBot.bot, authNotificationAggregator, {
                     quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
                     suppressBackgroundNotifications: () => true,
                 }),
             });
-            await singleAuthSync.initialize();
-            activeAuthSync = singleAuthSync;
-            attachTelegramAuthSync(bot, singleAuthSync, config, logger);
-            singleAuthSync.start();
-            void publishPendingClusterUpdateBroadcast(singleAuthSync, logger);
-            singleMirror.start();
-        }
-        const telegram = new TelegramChannelAdapter(core);
-        managedApps = [app];
-        activeTelegramAdapters = [telegram];
-        if (config.wxEnabled) {
-            weixinAdapter = new WeixinChannelAdapter(core, store, config, logger);
+            await authSync.initialize();
+            activeAuthSync = authSync;
+            attachTelegramAuthSync(authSyncTransportBot.bot, authSync, config, logger);
+            authSync.start();
+            void publishPendingClusterUpdateBroadcast(authSync, logger);
         }
+        mirror.start();
         process.on('unhandledRejection', (error) => {
             logger.error('process.unhandled_rejection', { error: serializeError(error) });
         });
         process.on('uncaughtException', (error) => {
             logger.error('process.uncaught_exception', { error: serializeError(error) });
         });
-        await telegram.start();
+        for (const runtime of runtimes) {
+            await runtime.telegram.start();
+        }
         if (weixinAdapter) {
+            await activeWeixinCore.startCodexApp();
             await weixinAdapter.start();
         }
-        writeSingleStatus(true);
-        logger.info('bridge.started', core.getRuntimeStatus());
+        writeAggregateStatus();
+        logger.info('bridge.started', { bots: runtimes.map((runtime) => runtime.id) });
         const shutdown = async (signal) => {
             logger.info('bridge.shutting_down', { signal });
             await authNotificationAggregator.flushAll();
-            singleAuthSync?.stop();
-            singleMirror?.stop();
+            authSync?.stop();
+            mirror.stop();
             await weixinAdapter?.stop();
-            await telegram.stop();
+            await activeWeixinCore?.stop();
+            await Promise.all(runtimes.map((runtime) => runtime.telegram.stop()));
             await activeOpencodeRuntime?.stop();
-            await Promise.all(activeAntigravityRuntimes.map((runtime) => runtime.stop().catch(() => { })));
-            writeRuntimeStatus(config.statusPath, {
-                running: false,
-                connected: false,
-                userAgent: app.getUserAgent(),
-                codexHome: singleCodexHome,
-                codexAppServer: app.getServerStatus(),
-                botUsername: bot.username,
-                currentBindings: 0,
-                pendingApprovals: 0,
-                pendingUserInputs: 0,
-                queuedTurns: 0,
-                activeTurns: 0,
-                lastError: null,
-                updatedAt: new Date().toISOString(),
-                channels: { telegram: false, weixin: false },
-            });
-            await app.stop({ terminateServer: true }).catch((error) => {
+            writeAggregateStatus(false);
+            const allManaged = [...managedApps, ...(sharedCodexApp ? [sharedCodexApp] : [])];
+            await Promise.all(allManaged.map((app) => app.stop({ terminateServer: true }).catch((error) => {
                 logger.warn('codex.app-server.stop_failed', { error: serializeError(error) });
-            });
+            })));
             store?.close();
             processLock.release();
             process.exit(0);
@@ -1255,7 +1047,6 @@ async function runServeCli() {
         await activeWeixinCore?.stop().catch(() => { });
         await Promise.allSettled(activeTelegramAdapters.map((adapter) => adapter.stop()));
         await activeOpencodeRuntime?.stop().catch(() => { });
-        await Promise.allSettled(activeAntigravityRuntimes.map((runtime) => runtime.stop()));
         await Promise.allSettled(managedApps.map((app) => app.stop({ terminateServer: true })));
         store?.close();
         processLock.release();
@@ -1716,15 +1507,22 @@ async function configureEnvInteractively(envPath, existed) {
         const skipped = [];
         const warnings = [];
         Object.assign(updates, await maybeSaveProxyEnvFromShell(rl, envPath));
-        const tokens = sanitizeEnvInput(await rl.question('Telegram bot token(s), comma-separated (TG_BOT_TOKENS): '));
-        if (tokens) {
-            updates.TG_BOT_TOKENS = tokens;
-            if (tokens.split(',').map((token) => token.trim()).some((token) => !/^\d+:[A-Za-z0-9_-]+$/.test(token))) {
-                warnings.push('One or more TG_BOT_TOKENS values do not look like standard Telegram bot tokens.');
+        const codexTokens = sanitizeEnvInput(await rl.question('Codex Telegram bot token(s), comma-separated (CODEX_BOT_TOKENS): '));
+        if (codexTokens) {
+            updates.CODEX_BOT_TOKENS = codexTokens;
+            if (codexTokens.split(',').map((token) => token.trim()).some((token) => !/^\d+:[A-Za-z0-9_-]+$/.test(token))) {
+                warnings.push('One or more CODEX_BOT_TOKENS values do not look like standard Telegram bot tokens.');
             }
         }
         else {
-            skipped.push('TG_BOT_TOKENS');
+            skipped.push('CODEX_BOT_TOKENS');
+        }
+        const agyTokens = sanitizeEnvInput(await rl.question('Antigravity Telegram bot token(s), comma-separated (ANTIGRAVITY_BOT_TOKENS) [optional]: '));
+        if (agyTokens) {
+            updates.ANTIGRAVITY_BOT_TOKENS = agyTokens;
+            if (agyTokens.split(',').map((token) => token.trim()).some((token) => !/^\d+:[A-Za-z0-9_-]+$/.test(token))) {
+                warnings.push('One or more ANTIGRAVITY_BOT_TOKENS values do not look like standard Telegram bot tokens.');
+            }
         }
         const userId = sanitizeEnvInput(await rl.question('Telegram numeric user ID (TG_ALLOWED_USER_ID): '));
         if (userId) {
@@ -1935,32 +1733,29 @@ function stopService() {
 }
 function runDoctorChecks() {
     const configuredCodexBin = process.env.CODEX_CLI_BIN;
+    const codexTokens = [
+        ...(process.env.CODEX_BOT_TOKENS ?? '').split(','),
+        process.env.CODEX_BOT_TOKEN ?? '',
+    ].map((value) => value.trim()).filter(Boolean);
+    const antigravityTokens = [
+        ...(process.env.ANTIGRAVITY_BOT_TOKENS ?? '').split(','),
+        process.env.ANTIGRAVITY_BOT_TOKEN ?? '',
+    ].map((value) => value.trim()).filter(Boolean);
     const checks = [
         ['node >= 24', Number(process.versions.node.split('.')[0]) >= 24],
         ['codex cli available', hasConfiguredCommand(configuredCodexBin, 'codex')],
-        ['telegram bot token(s) configured', Boolean(process.env.TG_BOT_TOKENS?.trim() || process.env.TG_BOT_TOKEN?.trim())],
+        ['telegram bot token(s) configured', codexTokens.length > 0 || antigravityTokens.length > 0],
         ['telegram allowed user configured', Boolean(process.env.TG_ALLOWED_USER_ID)],
     ];
     if (process.env.OPENCODE_BOT_TOKEN?.trim()) {
         const configuredOpencodeBin = process.env.OPENCODE_CLI_BIN;
         checks.push(['opencode cli available', hasConfiguredCommand(configuredOpencodeBin, 'opencode')]);
-        const codexTokens = [
-            ...(process.env.TG_BOT_TOKENS ?? '').split(','),
-            process.env.TG_BOT_TOKEN ?? '',
-        ].map((value) => value.trim()).filter(Boolean);
-        checks.push(['OpenCode uses an independent Telegram bot', !codexTokens.includes(process.env.OPENCODE_BOT_TOKEN.trim())]);
+        const allOtherTokens = [...codexTokens, ...antigravityTokens];
+        checks.push(['OpenCode uses an independent Telegram bot', !allOtherTokens.includes(process.env.OPENCODE_BOT_TOKEN.trim())]);
     }
-    const antigravityTokens = [
-        ...(process.env.ANTIGRAVITY_BOT_TOKENS ?? '').split(','),
-        process.env.ANTIGRAVITY_BOT_TOKEN ?? '',
-    ].map((value) => value.trim()).filter(Boolean);
     if (antigravityTokens.length > 0) {
         const configuredAgyBin = process.env.ANTIGRAVITY_CLI_BIN;
         checks.push(['antigravity (agy) cli available', hasConfiguredCommand(configuredAgyBin, 'agy')]);
-        const codexTokens = [
-            ...(process.env.TG_BOT_TOKENS ?? '').split(','),
-            process.env.TG_BOT_TOKEN ?? '',
-        ].map((value) => value.trim()).filter(Boolean);
         const hasConflict = antigravityTokens.some((t) => codexTokens.includes(t));
         checks.push(['Antigravity uses independent Telegram bot(s)', !hasConflict]);
         const authDir = process.env.ANTIGRAVITY_AUTH_DIR || path.join(os.homedir(), '.gemini', 'antigravity-cli');