@foxden-app/foxclaw 0.3.18 → 0.3.19

package/dist/controller/controller.js

@@ -93,6 +93,7 @@ export class BridgeSessionCore {
     bot;
     app;
     selfUpdater;
+    coordinator;
     activeTurns = new Map();
     activeTurnsByTurnId = new Map();
     observedThreadWatchers = new Map();
@@ -131,13 +132,14 @@ export class BridgeSessionCore {
     /** Last threads-panel pagination state per scope (Telegram inline nav + /open index alignment). */
     threadListPresentationState = new Map();
     messaging;
-    constructor(config, store, logger, bot, app, outbound, selfUpdater = null) {
+    constructor(config, store, logger, bot, app, outbound, selfUpdater = null, coordinator = null) {
         this.config = config;
         this.store = store;
         this.logger = logger;
         this.bot = bot;
         this.app = app;
         this.selfUpdater = selfUpdater;
+        this.coordinator = coordinator;
         this.messaging = outbound;
     }
     /** Wire Telegram inbound events. Call before {@link startCodexApp}. */
@@ -323,6 +325,7 @@ export class BridgeSessionCore {
                 allowedChatId: this.config.tgAllowedChatId,
                 allowedTopicId: this.config.tgAllowedTopicId,
                 topicId: event.topicId,
+                requireExplicitGroupAddressing: this.config.tgRequireExplicitGroupAddressing,
             }),
             replyToBot: event.replyToBot,
         });
@@ -1563,6 +1566,16 @@ export class BridgeSessionCore {
                 return;
             }
             const lines = [t(locale, 'auth_add_done', { value: pendingAuthAdd.name })];
+            try {
+                await this.coordinator?.authCandidateUpdated?.(this.authRuntimeId(), pendingAuthAdd.name);
+            }
+            catch (error) {
+                this.logger.warn('codex.auth_candidate_sync_failed', {
+                    candidate: pendingAuthAdd.name,
+                    runtimeId: this.authRuntimeId(),
+                    error: toErrorMeta(error),
+                });
+            }
             lines.push(...await this.buildCodexUsageStatusLines(locale));
             await this.sendMessage(scopeId, lines.join('\n'));
             return;
@@ -1572,7 +1585,7 @@ export class BridgeSessionCore {
             : t(locale, 'login_failed', { error: params?.error ?? t(locale, 'unknown') }));
     }
     async restorePendingAuthAdd(record) {
-        const state = await listCodexAuthState();
+        const state = await this.listCodexAuthState();
         await this.restoreAuthAfterAddFailure(state.authDir, state.authPath, record.previousTargetPath);
     }
     async restoreAuthAfterAddFailure(authDir, authPath, previousTargetPath) {
@@ -1849,6 +1862,9 @@ export class BridgeSessionCore {
     }
     async restorePendingUserInputs() {
         for (const stored of this.store.listPendingUserInputs()) {
+            if (!this.ownsScope(stored.chatId)) {
+                continue;
+            }
             const record = parseStoredPendingUserInput(stored);
             if (!record) {
                 this.store.markPendingUserInputResolved(stored.localId);
@@ -2535,6 +2551,34 @@ export class BridgeSessionCore {
             resolver,
         };
     }
+    isIdleForServiceUpdate() {
+        return this.activeTurns.size === 0
+            && this.pendingApprovalMessages.size === 0
+            && this.pendingUserInputs.size === 0
+            && this.pendingMcpElicitations.size === 0
+            && this.pendingLoginsByScope.size === 0
+            && !this.authRotationInProgress;
+    }
+    hasLocalBlockingActivity() {
+        return !this.isIdleForServiceUpdate();
+    }
+    authRuntimeId() {
+        return this.config.tgScopeBotId ?? 'default';
+    }
+    ownsScope(scopeId) {
+        if (scopeId.startsWith(BRIDGE_SCOPE_WEIXIN_PREFIX)) {
+            return this.messaging.hasWeixinTransport;
+        }
+        if (!this.config.tgScopeBotId) {
+            return parseTelegramTargetFromBridgeScope(scopeId).botId === null;
+        }
+        try {
+            return parseTelegramTargetFromBridgeScope(scopeId).botId === this.config.tgScopeBotId;
+        }
+        catch {
+            return false;
+        }
+    }
     setActiveTurn(scopeId, turnId, active) {
         const key = activeTurnKey(scopeId, turnId);
         this.activeTurns.set(key, active);
@@ -2785,7 +2829,7 @@ export class BridgeSessionCore {
             }
         }
         for (const scopeId of this.store.findAllChatIdsByThreadId(threadId)) {
-            if (!this.messaging.canSendToScope(scopeId)) {
+            if (!this.ownsScope(scopeId) || !this.messaging.canSendToScope(scopeId)) {
                 continue;
             }
             scopes.add(scopeId);
@@ -2818,7 +2862,12 @@ export class BridgeSessionCore {
         return next;
     }
     updateStatus() {
-        writeRuntimeStatus(this.config.statusPath, this.getRuntimeStatus());
+        const status = this.getRuntimeStatus();
+        if (this.coordinator?.statusUpdated) {
+            this.coordinator.statusUpdated(status);
+            return;
+        }
+        writeRuntimeStatus(this.config.statusPath, status);
     }
     async sendMessage(scopeId, text, inlineKeyboard) {
         return this.messaging.sendPlain(scopeId, text, inlineKeyboard);
@@ -3653,7 +3702,7 @@ export class BridgeSessionCore {
         ].join('\n'));
     }
     async handleAuthReloadCommand(scopeId, locale) {
-        if (this.activeTurns.size > 0 || this.store.countPendingApprovals() > 0 || this.pendingUserInputs.size > 0 || this.pendingMcpElicitations.size > 0) {
+        if (this.hasLocalBlockingActivity()) {
             await this.sendMessage(scopeId, t(locale, 'auth_reload_blocked_active'));
             return;
         }
@@ -3670,7 +3719,7 @@ export class BridgeSessionCore {
             await this.sendMessage(scopeId, t(locale, 'update_unavailable'));
             return;
         }
-        if (this.activeTurns.size > 0 || this.store.countPendingApprovals() > 0 || this.pendingUserInputs.size > 0 || this.pendingMcpElicitations.size > 0) {
+        if (!this.isIdleForServiceUpdate() || this.store.countPendingApprovals() > 0 || this.store.countPendingUserInputs() > 0 || (this.coordinator?.canSelfUpdate && !this.coordinator.canSelfUpdate())) {
             await this.sendMessage(scopeId, t(locale, 'update_blocked_active'));
             return;
         }
@@ -3721,17 +3770,23 @@ export class BridgeSessionCore {
             this.scheduleSelfUpdateStatusPoll();
             return;
         }
+        if (!this.ownsScope(status.scopeId)) {
+            this.scheduleSelfUpdateStatusPoll();
+            return;
+        }
         await this.sendMessage(status.scopeId, this.formatSelfUpdateResult(status));
         await this.selfUpdater?.clearStatus();
     }
     formatSelfUpdateResult(status) {
         if (status.state === 'succeeded') {
-            return t(status.locale, 'update_succeeded', {
+            const result = t(status.locale, 'update_succeeded', {
                 from: status.fromVersion,
                 to: status.toVersion ?? t(status.locale, 'unknown'),
             });
+            return status.codexUpdate ? `${result}\n${status.codexUpdate}` : result;
         }
-        return t(status.locale, 'update_failed', { error: status.error ?? t(status.locale, 'unknown') });
+        const result = t(status.locale, 'update_failed', { error: status.error ?? t(status.locale, 'unknown') });
+        return status.codexUpdate ? `${result}\n${status.codexUpdate}` : result;
     }
     async handleAuthCommand(scopeId, locale, args) {
         const action = args[0]?.toLowerCase() ?? 'list';
@@ -3769,7 +3824,7 @@ export class BridgeSessionCore {
         record.messageId = messageId;
     }
     async handleAuthUseCommand(scopeId, locale, args) {
-        if (this.activeTurns.size > 0 || this.store.countPendingApprovals() > 0 || this.pendingUserInputs.size > 0 || this.pendingMcpElicitations.size > 0) {
+        if (this.hasLocalBlockingActivity()) {
             await this.sendMessage(scopeId, t(locale, 'auth_reload_blocked_active'));
             return;
         }
@@ -3807,7 +3862,7 @@ export class BridgeSessionCore {
             await this.sendMessage(scopeId, renderAuthListMessage(locale, state, parseWeixinBridgeScope(scopeId) !== null));
             return;
         }
-        this.store.setCodexAuthCandidateDisabled(candidate.name, disabled);
+        this.store.setCodexAuthCandidateDisabled(candidate.name, disabled, this.authRuntimeId());
         await this.sendMessage(scopeId, t(locale, disabled ? 'auth_candidate_disabled' : 'auth_candidate_enabled', {
             value: candidate.name,
         }));
@@ -3825,7 +3880,7 @@ export class BridgeSessionCore {
         return latest;
     }
     async handleAuthAddCommand(scopeId, locale, args) {
-        if (this.activeTurns.size > 0 || this.store.countPendingApprovals() > 0 || this.pendingUserInputs.size > 0 || this.pendingMcpElicitations.size > 0) {
+        if (this.hasLocalBlockingActivity()) {
             await this.sendMessage(scopeId, t(locale, 'auth_reload_blocked_active'));
             return;
         }
@@ -4259,7 +4314,7 @@ export class BridgeSessionCore {
             return;
         }
         const disabled = !candidate.disabled;
-        this.store.setCodexAuthCandidateDisabled(candidate.name, disabled);
+        this.store.setCodexAuthCandidateDisabled(candidate.name, disabled, this.authRuntimeId());
         const state = await this.listCodexAuthState();
         record.candidates = state.candidates;
         await this.messaging.answerCallback(event.callbackQueryId, t(locale, disabled ? 'auth_candidate_disabled_short' : 'auth_candidate_enabled_short'));
@@ -4277,7 +4332,7 @@ export class BridgeSessionCore {
             await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_choice_mismatch'));
             return;
         }
-        if (this.activeTurns.size > 0 || this.store.countPendingApprovals() > 0 || this.pendingUserInputs.size > 0 || this.pendingMcpElicitations.size > 0) {
+        if (this.hasLocalBlockingActivity()) {
             await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_reload_blocked_active'));
             return;
         }
@@ -4299,7 +4354,7 @@ export class BridgeSessionCore {
         if (!this.pendingAuthRotation || this.authRotationInProgress) {
             return false;
         }
-        if (this.activeTurns.size > 0 || this.store.countPendingApprovals() > 0 || this.pendingUserInputs.size > 0 || this.pendingMcpElicitations.size > 0) {
+        if (this.hasLocalBlockingActivity()) {
             return false;
         }
         const rotation = this.pendingAuthRotation;
@@ -4398,13 +4453,19 @@ export class BridgeSessionCore {
         return candidate ? { candidate, fromLabel: state.currentLabel, toLabel: await authPathDisplayLabel(candidate.path) } : null;
     }
     async listCodexAuthState() {
-        const state = await listCodexAuthState(this.store.listDisabledCodexAuthCandidateNames());
+        const state = await listCodexAuthState(this.store.listDisabledCodexAuthCandidateNames(this.authRuntimeId()), this.resolveAuthDir());
         const snapshots = await this.readCodexAuthQuotaSnapshots();
         state.candidates.forEach((candidate) => {
             candidate.quota = snapshots[candidate.name] ?? null;
         });
         return state;
     }
+    resolveAuthDir() {
+        return this.config.codexAuthDir
+            ?? (this.config.tgMultiBotMode ? this.config.codexHome : null)
+            ?? process.env.CODEX_AUTH_DIR
+            ?? path.join(os.homedir(), '.codex');
+    }
     async readCodexAuthSwitchLabels(candidate) {
         const state = await this.listCodexAuthState();
         return {
@@ -4419,7 +4480,7 @@ export class BridgeSessionCore {
         };
     }
     async switchCodexAuthAndRestart(scopeId, locale, candidate, automatic) {
-        const result = await switchCodexAuth(candidate.path);
+        const result = await switchCodexAuth(candidate.path, this.resolveAuthDir());
         this.authRotationFailedTargets.delete(candidate.path);
         this.pendingTurnErrors.clear();
         this.attachedThreads.clear();
@@ -4610,14 +4671,14 @@ export class BridgeSessionCore {
         await this.localUsageRefresh;
     }
     async refreshCodexLocalUsageStats() {
-        const stats = await readCodexLocalUsageStats();
+        const stats = await readCodexLocalUsageStats(this.config.codexHome ?? undefined);
         const snapshot = { computedAtMs: Date.now(), stats };
         this.localUsageCache = snapshot;
         this.localUsageCacheLoaded = true;
         await writeCodexLocalUsageSnapshot(this.codexLocalUsageSnapshotPath(), snapshot);
     }
     codexLocalUsageSnapshotPath() {
-        return path.join(path.dirname(this.config.statusPath), CODEX_LOCAL_USAGE_SNAPSHOT_FILENAME);
+        return path.join(path.dirname(this.config.statusPath), this.runtimeSnapshotFilename(CODEX_LOCAL_USAGE_SNAPSHOT_FILENAME));
     }
     async refreshCurrentCodexAuthQuota(state) {
         const candidate = state.candidates.find(entry => entry.isCurrent);
@@ -4669,7 +4730,13 @@ export class BridgeSessionCore {
         await fs.rename(temporaryPath, snapshotPath);
     }
     codexAuthQuotaSnapshotPath() {
-        return path.join(path.dirname(this.config.statusPath), CODEX_AUTH_QUOTA_SNAPSHOT_FILENAME);
+        return path.join(path.dirname(this.config.statusPath), this.runtimeSnapshotFilename(CODEX_AUTH_QUOTA_SNAPSHOT_FILENAME));
+    }
+    runtimeSnapshotFilename(filename) {
+        if (!this.config.tgScopeBotId) {
+            return filename;
+        }
+        return filename.replace(/\.json$/, `-${this.config.tgScopeBotId}.json`);
     }
     async sendThreadContextSummary(scopeId, locale, threadId) {
         try {
@@ -5588,6 +5655,9 @@ export class BridgeSessionCore {
     }
     async cleanupStaleTurnPreviews() {
         for (const preview of this.store.listActiveTurnPreviews()) {
+            if (!this.ownsScope(preview.scopeId)) {
+                continue;
+            }
             if (!this.messaging.canSendToScope(preview.scopeId)) {
                 this.store.removeActiveTurnPreview(preview.turnId);
                 this.logger.info('telegram.preview_dropped_disabled_channel', {
@@ -7119,11 +7189,11 @@ function parseActiveTurnKey(key) {
         turnId: decodeURIComponent(key.slice(split + 1)),
     };
 }
-function codexAuthDir() {
-    return process.env.CODEX_AUTH_DIR || path.join(os.homedir(), '.codex');
+function codexAuthDir(explicitAuthDir = null) {
+    return explicitAuthDir || process.env.CODEX_AUTH_DIR || path.join(os.homedir(), '.codex');
 }
-async function listCodexAuthState(disabledNames = new Set()) {
-    const authDir = codexAuthDir();
+async function listCodexAuthState(disabledNames = new Set(), explicitAuthDir = null) {
+    const authDir = codexAuthDir(explicitAuthDir);
     const authPath = path.join(authDir, 'auth.json');
     const currentTargetPath = await resolveCurrentAuthTarget(authDir, authPath);
     const candidates = [];
@@ -7222,8 +7292,8 @@ async function pointCodexAuthAtTarget(authDir, authPath, targetPath) {
         throw error;
     }
 }
-async function switchCodexAuth(targetPath) {
-    const state = await listCodexAuthState();
+async function switchCodexAuth(targetPath, explicitAuthDir = null) {
+    const state = await listCodexAuthState(new Set(), explicitAuthDir);
     const candidate = state.candidates.find(entry => entry.path === targetPath);
     if (!candidate) {
         throw new Error(`Auth candidate is no longer available: ${path.basename(targetPath)}`);

package/dist/core/bridge_scope.d.ts

@@ -7,12 +7,15 @@ export interface WeixinBridgeScope {
     accountId: string;
     fromUserId: string;
 }
+export interface TelegramBridgeTarget extends TelegramScope {
+    botId: string | null;
+}
 export declare function isBridgeScopedKey(key: string): boolean;
 /** Wrap legacy Telegram inner scope (`chat::topic`) for storage and routing. */
-export declare function toTelegramBridgeScopeId(telegramInnerScopeId: string): string;
+export declare function toTelegramBridgeScopeId(telegramInnerScopeId: string, botId?: string | null): string;
 /** Strip `telegram:` prefix; returns `null` if not a Telegram bridge scope. */
 export declare function telegramInnerScopeFromBridge(bridgeScopeId: string): string | null;
-export declare function parseTelegramTargetFromBridgeScope(bridgeScopeId: string): TelegramScope;
+export declare function parseTelegramTargetFromBridgeScope(bridgeScopeId: string): TelegramBridgeTarget;
 /** Parse `weixin:<accountId>:<from_user_id>`; returns `null` if not a Weixin scope. */
 export declare function parseWeixinBridgeScope(bridgeScopeId: string): WeixinBridgeScope | null;
 export declare function toWeixinBridgeScopeId(accountId: string, fromUserId: string): string;

package/dist/core/bridge_scope.js

@@ -7,8 +7,8 @@ export function isBridgeScopedKey(key) {
     return key.startsWith(BRIDGE_SCOPE_TELEGRAM_PREFIX) || key.startsWith(BRIDGE_SCOPE_WEIXIN_PREFIX);
 }
 /** Wrap legacy Telegram inner scope (`chat::topic`) for storage and routing. */
-export function toTelegramBridgeScopeId(telegramInnerScopeId) {
-    return `${BRIDGE_SCOPE_TELEGRAM_PREFIX}${telegramInnerScopeId}`;
+export function toTelegramBridgeScopeId(telegramInnerScopeId, botId = null) {
+    return `${BRIDGE_SCOPE_TELEGRAM_PREFIX}${botId ? `${botId}:` : ''}${telegramInnerScopeId}`;
 }
 /** Strip `telegram:` prefix; returns `null` if not a Telegram bridge scope. */
 export function telegramInnerScopeFromBridge(bridgeScopeId) {
@@ -22,7 +22,11 @@ export function parseTelegramTargetFromBridgeScope(bridgeScopeId) {
     if (inner === null) {
         throw new Error(`Expected ${BRIDGE_SCOPE_TELEGRAM_PREFIX} scope, got: ${bridgeScopeId}`);
     }
-    return parseTelegramScopeId(inner);
+    const namespaced = /^(bot\d+):(.*)$/.exec(inner);
+    if (!namespaced) {
+        return { ...parseTelegramScopeId(inner), botId: null };
+    }
+    return { ...parseTelegramScopeId(namespaced[2]), botId: namespaced[1] };
 }
 /** Parse `weixin:<accountId>:<from_user_id>`; returns `null` if not a Weixin scope. */
 export function parseWeixinBridgeScope(bridgeScopeId) {

package/dist/main.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { createInterface } from 'node:readline/promises';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { APP_HOME, DEFAULT_ENV_PATH, DEFAULT_LOG_PATH, DEFAULT_STATUS_PATH, getLoadedEnvPath, loadConfig, loadEnv, } from './config.js';
+import { APP_HOME, DEFAULT_CODEX_TELEGRAM_HOME, DEFAULT_ENV_PATH, DEFAULT_LOG_PATH, DEFAULT_STATUS_PATH, getLoadedEnvPath, loadConfig, loadEnv, } from './config.js';
 import { acquireProcessLock, LockHeldError } from './lock.js';
 import { readRuntimeStatus, writeRuntimeStatus } from './runtime.js';
 import { refreshFoxclawExecStartDropIns, removeFoxclawExecStartDropIns } from './systemd.js';
@@ -61,6 +62,9 @@ async function main() {
             entryPoint,
             nodePath: process.execPath,
             version: readPackageVersion(),
+            ...(process.env.CODEX_CLI_BIN || resolveCommand('codex')
+                ? { codexCliBin: process.env.CODEX_CLI_BIN || resolveCommand('codex') }
+                : {}),
             ...(notificationFile ? { notificationFile } : {}),
         };
         const outcome = performSelfUpdate(options);
@@ -137,7 +141,7 @@ Usage:
   foxclaw --help`);
 }
 async function runServeCli() {
-    const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter },] = await Promise.all([
+    const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter }, { AuthCandidateMirror },] = await Promise.all([
         import('./channels/bridge_messaging_router.js'),
         import('./channels/telegram/telegram_messaging_port.js'),
         import('./channels/weixin/weixin_channel_adapter.js'),
@@ -150,6 +154,7 @@ async function runServeCli() {
         import('./codex_app/client.js'),
         import('./controller/controller.js'),
         import('./channels/telegram/telegram_channel_adapter.js'),
+        import('./auth/mirror.js'),
     ]);
     const config = loadConfig();
     const logger = new Logger(config.logLevel, config.logPath);
@@ -157,8 +162,132 @@ async function runServeCli() {
     const processLock = acquireProcessLock(config.lockPath);
     let store = null;
     let weixinAdapter = null;
+    let activeTelegramAdapters = [];
+    let managedApps = [];
+    let activeAuthMirror = null;
     try {
         store = new BridgeStore(config.storePath);
+        if (config.tgMultiBotMode) {
+            const seeds = [];
+            for (const token of config.tgBotTokens) {
+                const bot = new TelegramGateway(token, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger, true);
+                const id = await bot.initializeIdentity();
+                if (seeds.some((runtime) => runtime.id === id)) {
+                    throw new Error(`TG_BOT_TOKENS contains duplicate Telegram bot identity: ${id}`);
+                }
+                const home = path.join(DEFAULT_CODEX_TELEGRAM_HOME, id, 'home');
+                fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+                const runtimeConfig = {
+                    ...config,
+                    tgBotToken: token,
+                    tgBotTokens: [token],
+                    tgScopeBotId: id,
+                    codexAuthDir: home,
+                    codexHome: home,
+                    codexAppServerStatePath: path.join(APP_HOME, 'runtime', `codex-app-server-${id}.json`),
+                    codexAppServerLogPath: path.join(APP_HOME, 'logs', `codex-app-server-${id}.log`),
+                };
+                const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, { CODEX_HOME: home });
+                seeds.push({ id, home, config: runtimeConfig, bot, app });
+            }
+            const canonicalAuthDir = config.codexAuthDir ?? config.codexHome ?? path.join(os.homedir(), '.codex');
+            const mirror = new AuthCandidateMirror(canonicalAuthDir, seeds.map((runtime) => ({
+                id: runtime.id,
+                authDir: runtime.home,
+                notify: async (message) => {
+                    const chatId = store.getTelegramPrivateChatId(runtime.id);
+                    if (chatId) {
+                        await runtime.bot.sendMessage(chatId, message);
+                    }
+                },
+            })), logger);
+            await mirror.initialize();
+            mirror.start();
+            activeAuthMirror = mirror;
+            managedApps = seeds.map((runtime) => runtime.app);
+            const selfUpdater = createSelfUpdateRuntime({
+                entryPoint,
+                nodePath: process.execPath,
+                version: readPackageVersion(),
+                statusPath: config.statusPath,
+                logPath: path.join(APP_HOME, 'logs', 'update.log'),
+                codexCliBin: config.codexCliBin,
+            });
+            const runtimes = [];
+            const writeAggregateStatus = (running = true) => {
+                const statuses = runtimes.map((runtime) => runtime.core.getRuntimeStatus());
+                const first = statuses[0] ?? null;
+                writeRuntimeStatus(config.statusPath, {
+                    running,
+                    connected: running && statuses.every((status) => status.connected),
+                    userAgent: first?.userAgent ?? null,
+                    ...(first?.codexAppServer ? { codexAppServer: first.codexAppServer } : {}),
+                    botUsername: first?.botUsername ?? null,
+                    currentBindings: store.countBindings(),
+                    pendingApprovals: store.countPendingApprovals(),
+                    pendingUserInputs: store.countPendingUserInputs(),
+                    activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0),
+                    lastError: statuses.find((status) => status.lastError)?.lastError ?? null,
+                    updatedAt: new Date().toISOString(),
+                    channels: { telegram: running, weixin: running && config.wxEnabled },
+                    bots: runtimes.map((runtime, index) => ({
+                        id: runtime.id,
+                        username: statuses[index]?.botUsername ?? runtime.bot.username,
+                        connected: running && Boolean(statuses[index]?.connected),
+                        activeTurns: running ? (statuses[index]?.activeTurns ?? 0) : 0,
+                        ...(statuses[index]?.codexAppServer ? { codexAppServer: statuses[index].codexAppServer } : {}),
+                    })),
+                });
+            };
+            const coordinator = {
+                canSelfUpdate: () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate()),
+                authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
+                statusUpdated: () => writeAggregateStatus(),
+            };
+            for (const [index, seed] of seeds.entries()) {
+                const telegramMessaging = new TelegramMessagingPort(seed.bot);
+                const weixinMessaging = index === 0 && config.wxEnabled
+                    ? new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id))
+                    : null;
+                const outbound = new BridgeMessagingRouter(telegramMessaging, weixinMessaging);
+                const core = new BridgeSessionCore(seed.config, store, logger, seed.bot, seed.app, outbound, selfUpdater, coordinator);
+                runtimes.push({ ...seed, core, telegram: new TelegramChannelAdapter(core) });
+            }
+            if (config.wxEnabled) {
+                weixinAdapter = new WeixinChannelAdapter(runtimes[0].core, store, runtimes[0].config, logger);
+            }
+            activeTelegramAdapters = runtimes.map((runtime) => runtime.telegram);
+            process.on('unhandledRejection', (error) => {
+                logger.error('process.unhandled_rejection', { error: serializeError(error) });
+            });
+            process.on('uncaughtException', (error) => {
+                logger.error('process.uncaught_exception', { error: serializeError(error) });
+            });
+            for (const runtime of runtimes) {
+                await runtime.telegram.start();
+            }
+            if (weixinAdapter) {
+                await weixinAdapter.start();
+            }
+            writeAggregateStatus();
+            logger.info('bridge.started', { bots: runtimes.map((runtime) => runtime.id) });
+            const shutdown = async (signal) => {
+                logger.info('bridge.shutting_down', { signal });
+                mirror.stop();
+                await weixinAdapter?.stop();
+                await Promise.all(runtimes.map((runtime) => runtime.telegram.stop()));
+                writeAggregateStatus(false);
+                await Promise.all(runtimes.map((runtime) => runtime.app.stop({ terminateServer: true }).catch((error) => {
+                    logger.warn('codex.app-server.stop_failed', { runtimeId: runtime.id, error: serializeError(error) });
+                })));
+                store?.close();
+                processLock.release();
+                process.exit(0);
+            };
+            process.on('SIGINT', () => void shutdown('SIGINT'));
+            process.on('SIGTERM', () => void shutdown('SIGTERM'));
+            return;
+        }
         const bot = new TelegramGateway(config.tgBotToken, config.tgAllowedUserId, config.tgAllowedChatId, config.telegramPollIntervalMs, store, logger);
         const app = new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, config.codexAppAutolaunch, config.codexAppServerStatePath, config.codexAppServerLogPath, logger);
         const telegramMessaging = new TelegramMessagingPort(bot);
@@ -172,9 +301,12 @@ async function runServeCli() {
             version: readPackageVersion(),
             statusPath: config.statusPath,
             logPath: path.join(APP_HOME, 'logs', 'update.log'),
+            codexCliBin: config.codexCliBin,
         });
         const core = new BridgeSessionCore(config, store, logger, bot, app, outbound, selfUpdater);
         const telegram = new TelegramChannelAdapter(core);
+        managedApps = [app];
+        activeTelegramAdapters = [telegram];
         if (config.wxEnabled) {
             weixinAdapter = new WeixinChannelAdapter(core, store, config, logger);
         }
@@ -218,7 +350,10 @@ async function runServeCli() {
         process.on('SIGTERM', () => void shutdown('SIGTERM'));
     }
     catch (error) {
+        activeAuthMirror?.stop();
         await weixinAdapter?.stop().catch(() => { });
+        await Promise.allSettled(activeTelegramAdapters.map((adapter) => adapter.stop()));
+        await Promise.allSettled(managedApps.map((app) => app.stop({ terminateServer: true })));
         store?.close();
         processLock.release();
         throw error;
@@ -264,15 +399,15 @@ async function configureEnvInteractively(envPath, existed) {
         const skipped = [];
         const warnings = [];
         Object.assign(updates, await maybeSaveProxyEnvFromShell(rl, envPath));
-        const token = sanitizeEnvInput(await rl.question('Telegram bot token (TG_BOT_TOKEN): '));
-        if (token) {
-            updates.TG_BOT_TOKEN = token;
-            if (!/^\d+:[A-Za-z0-9_-]+$/.test(token)) {
-                warnings.push('TG_BOT_TOKEN does not look like a standard Telegram bot token.');
+        const tokens = sanitizeEnvInput(await rl.question('Telegram bot token(s), comma-separated (TG_BOT_TOKENS): '));
+        if (tokens) {
+            updates.TG_BOT_TOKENS = tokens;
+            if (tokens.split(',').map((token) => token.trim()).some((token) => !/^\d+:[A-Za-z0-9_-]+$/.test(token))) {
+                warnings.push('One or more TG_BOT_TOKENS values do not look like standard Telegram bot tokens.');
             }
         }
         else {
-            skipped.push('TG_BOT_TOKEN');
+            skipped.push('TG_BOT_TOKENS');
         }
         const userId = sanitizeEnvInput(await rl.question('Telegram numeric user ID (TG_ALLOWED_USER_ID): '));
         if (userId) {
@@ -486,7 +621,7 @@ function runDoctorChecks() {
     const checks = [
         ['node >= 24', Number(process.versions.node.split('.')[0]) >= 24],
         ['codex cli available', hasConfiguredCodexBin(configuredCodexBin) || hasCommand('codex')],
-        ['telegram bot token configured', Boolean(process.env.TG_BOT_TOKEN)],
+        ['telegram bot token(s) configured', Boolean(process.env.TG_BOT_TOKENS?.trim() || process.env.TG_BOT_TOKEN?.trim())],
         ['telegram allowed user configured', Boolean(process.env.TG_ALLOWED_USER_ID)],
     ];
     if (process.env.WX_ENABLED === 'true' || process.env.WX_ENABLED === '1') {

package/dist/store/database.d.ts

@@ -29,6 +29,8 @@ export declare class BridgeStore {
     constructor(dbPath: string);
     getTelegramOffset(botKey: string): number;
     setTelegramOffset(botKey: string, updateId: number): void;
+    rememberTelegramPrivateScope(botId: string, scopeId: string, chatId: string): void;
+    getTelegramPrivateChatId(botId: string): string | null;
     getBinding(chatId: string): ThreadBinding | null;
     setBinding(chatId: string, threadId: string, cwd: string | null): void;
     clearBinding(chatId: string): void;
@@ -73,7 +75,7 @@ export declare class BridgeStore {
     private writeChatSettings;
     getWeixinContextToken(scopeId: string): string | null;
     setWeixinContextToken(scopeId: string, contextToken: string): void;
-    listDisabledCodexAuthCandidateNames(): Set<string>;
-    setCodexAuthCandidateDisabled(name: string, disabled: boolean): void;
+    listDisabledCodexAuthCandidateNames(runtimeId?: string): Set<string>;
+    setCodexAuthCandidateDisabled(name: string, disabled: boolean, runtimeId?: string): void;
     private ensureColumn;
 }