@foxden-app/foxclaw 0.3.19 → 0.4.0

package/.env.example

@@ -1,4 +1,4 @@
-# Required: one or more bot tokens for this host
+# Required for new installs: one or more bot tokens for this host
 # Comma-separated bot tokens. Each bot gets an independent Codex runtime/auth selection.
 TG_BOT_TOKENS=<telegram_bot_token>
 # Backward-compatible single-runtime setup:
@@ -14,7 +14,9 @@ TG_ALLOWED_CHAT_ID=
 # Leave empty to use the whole allowed group as the default scope
 TG_ALLOWED_TOPIC_ID=
 
-# Optional Codex Desktop bridge settings
+# Optional Codex Desktop bridge settings.
+# In TG_BOT_TOKENS mode isolated Telegram runtimes start app-server directly and
+# do not auto-launch Codex Desktop; this remains applicable to the default/Weixin runtime.
 CODEX_APP_AUTOLAUNCH=true
 CODEX_APP_LAUNCH_CMD=codex app
 # Optional: persist the managed app-server pid/port and collect its stdout/stderr

package/README.md

@@ -40,7 +40,7 @@ FoxClaw（狸爪）的目标很直接：让你用手机控制本机的 Codex，
 - Git、Node、`.env` 都玩得转？直接往下看快速设置。
 - 卡住了？看 [故障排查](./docs/zh/troubleshooting.md)。
 
-最低要求：一个 Telegram bot token、你的 Telegram 数字用户 ID、Node.js 24+、一份已登录的 `codex` CLI。首次安装大约 10–20 分钟。
+最低要求：一个或多个 Telegram bot token、你的 Telegram 数字用户 ID、Node.js 24+、一份已登录的 `codex` CLI。首次安装大约 10–20 分钟。新安装请使用 `TG_BOT_TOKENS`；`TG_BOT_TOKEN` 只用于兼容旧的单 runtime 配置。
 
 **30 秒体验**：启动 FoxClaw 后，给你的 Telegram 机器人发一句 `List files in DEFAULT_CWD`。Codex 会在本地检查那个目录，然后把结果发回 Telegram。
 
@@ -93,7 +93,7 @@ FoxClaw 只响应 `TG_ALLOWED_USER_ID` 的消息——把机器人拉进群不
 
 **核心能力：**
 - 通过 Telegram 私聊、群组、话题控制本地 Codex
-- 可选微信/iLink 通道，复用同一套桥接核心
+- 可选微信/iLink 通道；在多 Telegram bot 模式下仍使用原默认 Codex runtime，不与隔离 bot 会话混用
 - 手机上完整管理 Codex 线程生命周期：创建、重命名、归档、fork、回滚、compact、review、diff
 - 命令、文件变更、细粒度权限审批的内联按钮——手机上一键审批
 - MCP elicitation 卡片——工具在 turn 中提出结构化问题时展示
@@ -203,7 +203,7 @@ TG_ALLOWED_TOPIC_ID=42
 TG_BOT_TOKENS=123456:token_a,234567:token_b
 ```
 
-FoxClaw 仍然只运行一个系统服务，但会为每个 bot 启动独立 `codex app-server` 和独立 `CODEX_HOME`。因此 A 私聊运行 turn 时，B 私聊仍可独立切换自己的 `/auth`。候选凭据由 FoxClaw 在登录或刷新验证后镜像同步，各 bot 的当前选择互不影响。
+FoxClaw 仍然只运行一个系统服务，但会为每个 bot 启动独立 `codex app-server` 和独立 `CODEX_HOME`。因此 A 私聊运行 turn 时，B 私聊仍可独立切换自己的 `/auth`。候选凭据由 FoxClaw 在登录或刷新验证后镜像同步，各 bot 的当前选择互不影响。每个 bot 首次私聊发送 `/help` 和 `/status`；`/auth` 会标明正在操作的 bot runtime，`/status` 会列出全部 bot 的连接、当前 auth 和活动 turn 摘要。
 
 **怎么找群组和话题 ID：**
 
@@ -239,7 +239,7 @@ CODEX_APP_SYNC_ON_OPEN=true
 CODEX_APP_SYNC_ON_TURN_COMPLETE=false
 ```
 
-FoxClaw 会把 `codex app-server` 作为 detached 子进程启动，记录其 pid 和端口。使用 `TG_BOT_TOKENS` 时，每个 bot 都有自己的 app-server 与 Codex home；重启时如果对应进程还活着就直接重连，否则拉起新进程。`/auth_reload` 和认证切换只重启发起操作的 bot runtime。
+FoxClaw 会把 `codex app-server` 作为 detached 子进程启动，记录其 pid 和端口。使用 `TG_BOT_TOKENS` 时，每个 bot 都有自己的 app-server 与 Codex home，并在该隔离 runtime 内强制使用文件凭据存储；隔离 bot 不自动拉起 Codex Desktop，避免多个新 home 同时初始化桌面状态。重启时如果对应进程还活着就直接重连，否则拉起新进程。`/auth_reload` 和认证切换只重启发起操作的 bot runtime。
 
 一般不需要手动固定 app-server 端口。
 
@@ -284,7 +284,7 @@ WX_ALLOWED_ILINK_USER_IDS=
 foxclaw weixin-login
 ```
 
-微信运行时文件在 `~/.foxclaw/weixin`。
+微信运行时文件在 `~/.foxclaw/weixin`。启用 `TG_BOT_TOKENS` 时，微信继续连接默认 Codex runtime 与原 home，不会查看或恢复隔离 Telegram bot 的线程。
 
 ## Codex Skill
 

package/README_EN.md

@@ -40,7 +40,7 @@ FoxClaw is more than message forwarding. It provides Telegram panels for Codex w
 - Already comfortable with Git, Node, and `.env` files? Use the quick setup below.
 - Something failed? Check [Troubleshooting](./docs/troubleshooting.md).
 
-The minimum install needs only a Telegram bot token, your numeric Telegram user id, Node.js 24+, and a logged-in `codex` CLI. A first install usually takes 10–20 minutes.
+The minimum install needs one or more Telegram bot tokens, your numeric Telegram user id, Node.js 24+, and a logged-in `codex` CLI. A first install usually takes 10–20 minutes. New installs should use `TG_BOT_TOKENS`; `TG_BOT_TOKEN` exists only for legacy single-runtime compatibility.
 
 **30-second demo**: after FoxClaw is running, send `List files in DEFAULT_CWD` to your Telegram bot. FoxClaw asks local Codex to inspect that folder on your computer and sends the answer back to Telegram.
 
@@ -93,7 +93,7 @@ FoxClaw accepts messages only from `TG_ALLOWED_USER_ID`. Putting the bot in a gr
 
 **Core capabilities:**
 - Telegram private chat, group, and topic control for your local Codex
-- Optional Weixin/iLink channel sharing the same bridge core
+- Optional Weixin/iLink channel; in multi-Telegram mode it stays on the original default Codex runtime rather than sharing an isolated bot session
 - Full thread lifecycle management from mobile: create, rename, archive, fork, rollback, compact, review, diff
 - Inline approval buttons for commands, file changes, and granular permissions — one tap to approve
 - MCP elicitation cards for structured questions raised by tools during a turn
@@ -203,7 +203,7 @@ Parallel bot example:
 TG_BOT_TOKENS=123456:token_a,234567:token_b
 ```
 
-FoxClaw remains one system service, but starts an independent `codex app-server` and `CODEX_HOME` for each bot. While bot A is running a turn, bot B can switch its own `/auth` selection. Candidate credentials are mirrored only after validated login or refresh; current selections remain independent.
+FoxClaw remains one system service, but starts an independent `codex app-server` and `CODEX_HOME` for each bot. While bot A is running a turn, bot B can switch its own `/auth` selection. Candidate credentials are mirrored only after validated login or refresh; current selections remain independent. Send `/help` and `/status` in a private chat with each bot after installation; `/auth` names the runtime being managed, and `/status` summarizes every bot's connection, selected auth, and active turns.
 
 **How to find group and topic IDs:**
 
@@ -239,7 +239,7 @@ CODEX_APP_SYNC_ON_OPEN=true
 CODEX_APP_SYNC_ON_TURN_COMPLETE=false
 ```
 
-FoxClaw starts `codex app-server` as a detached, bridge-managed process and records its pid and port. With `TG_BOT_TOKENS`, each bot has its own app-server and Codex home. On restart, FoxClaw reconnects to each live recorded app-server or starts a replacement. `/auth_reload` and auth switching restart only the requesting bot runtime.
+FoxClaw starts `codex app-server` as a detached, bridge-managed process and records its pid and port. With `TG_BOT_TOKENS`, each bot has its own app-server and Codex home, and its isolated runtime is forced to use file-backed credentials. Isolated Telegram runtimes do not auto-launch Codex Desktop, avoiding simultaneous desktop-state initialization for fresh homes. On restart, FoxClaw reconnects to each live recorded app-server or starts a replacement. `/auth_reload` and auth switching restart only the requesting bot runtime.
 
 No static Codex app-server port is required in normal installs.
 
@@ -284,7 +284,7 @@ Run the QR login helper once after building:
 foxclaw weixin-login
 ```
 
-Weixin runtime files default to `~/.foxclaw/weixin`.
+Weixin runtime files default to `~/.foxclaw/weixin`. When `TG_BOT_TOKENS` is enabled, Weixin continues to use the default Codex runtime and original home; it does not inspect or resume isolated Telegram bot threads.
 
 ## Codex Skill
 

package/dist/auth/mirror.d.ts

@@ -1,22 +1,35 @@
 import type { Logger } from '../logger.js';
 export interface AuthMirrorRuntime {
     id: string;
+    label?: string;
     authDir: string;
     notify?: (message: string) => Promise<void>;
 }
+export interface AuthMirrorStatus {
+    candidateName: string;
+    sourceRuntimeId: string;
+    sourceLabel: string;
+    syncedAt: string;
+}
 export declare class AuthCandidateMirror {
     private readonly canonicalDir;
     private readonly runtimes;
     private readonly logger;
+    private readonly statusPath;
     private timer;
     private readonly lastSyncedRefresh;
-    constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger);
+    private activeOperations;
+    private lastStatus;
+    constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null);
     initialize(): Promise<void>;
     start(): void;
     stop(): void;
+    isIdle(): boolean;
+    getStatus(): AuthMirrorStatus | null;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
     private scan;
     private propagateValidatedCandidate;
+    private withActivity;
     private ensureCanonicalDefaultCandidate;
     private collectCandidateNames;
     private reconcileCandidateAtStartup;

package/dist/auth/mirror.js

@@ -5,14 +5,19 @@ export class AuthCandidateMirror {
     canonicalDir;
     runtimes;
     logger;
+    statusPath;
     timer = null;
     lastSyncedRefresh = new Map();
-    constructor(canonicalDir, runtimes, logger) {
+    activeOperations = 0;
+    lastStatus = null;
+    constructor(canonicalDir, runtimes, logger, statusPath = null) {
         this.canonicalDir = canonicalDir;
         this.runtimes = runtimes;
         this.logger = logger;
+        this.statusPath = statusPath;
     }
     async initialize() {
+        this.lastStatus = await readMirrorStatus(this.statusPath);
         await fs.mkdir(this.canonicalDir, { recursive: true, mode: 0o700 });
         await this.ensureCanonicalDefaultCandidate();
         const candidateNames = await this.collectCandidateNames();
@@ -52,21 +57,29 @@ export class AuthCandidateMirror {
         clearInterval(this.timer);
         this.timer = null;
     }
+    isIdle() {
+        return this.activeOperations === 0;
+    }
+    getStatus() {
+        return this.lastStatus;
+    }
     async syncRuntimeCandidate(runtimeId, candidateName) {
         if (!isAuthCandidateName(candidateName))
             return false;
         const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
         if (!runtime)
             return false;
-        return this.propagateValidatedCandidate(runtime, candidateName);
+        return this.withActivity(() => this.propagateValidatedCandidate(runtime, candidateName));
     }
     async scan() {
-        for (const runtime of this.runtimes) {
-            const names = await listAuthCandidateNames(runtime.authDir);
-            for (const name of names) {
-                await this.propagateValidatedCandidate(runtime, name);
+        await this.withActivity(async () => {
+            for (const runtime of this.runtimes) {
+                const names = await listAuthCandidateNames(runtime.authDir);
+                for (const name of names) {
+                    await this.propagateValidatedCandidate(runtime, name);
+                }
             }
-        }
+        });
     }
     async propagateValidatedCandidate(runtime, name) {
         const sourcePath = path.join(runtime.authDir, name);
@@ -90,11 +103,28 @@ export class AuthCandidateMirror {
             }
         }
         this.lastSyncedRefresh.set(name, record.lastRefreshMs);
+        const sourceLabel = runtime.label ?? runtime.id;
+        this.lastStatus = {
+            candidateName: name,
+            sourceRuntimeId: runtime.id,
+            sourceLabel,
+            syncedAt: new Date().toISOString(),
+        };
+        await writeMirrorStatus(this.statusPath, this.lastStatus);
         this.logger.info('auth.mirror.synced', { sourceRuntimeId: runtime.id, name });
-        const message = `${name} has been refreshed by ${runtime.id} and synchronized to the other Codex homes.`;
+        const message = `${name} has been refreshed by ${sourceLabel} and synchronized to the other Codex homes.`;
         await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
         return true;
     }
+    async withActivity(operation) {
+        this.activeOperations += 1;
+        try {
+            return await operation();
+        }
+        finally {
+            this.activeOperations -= 1;
+        }
+    }
     async ensureCanonicalDefaultCandidate() {
         const names = await listAuthCandidateNames(this.canonicalDir);
         if (names.length > 0)
@@ -197,3 +227,33 @@ async function exists(filePath) {
 function formatError(error) {
     return error instanceof Error ? error.message : String(error);
 }
+async function readMirrorStatus(statusPath) {
+    if (!statusPath)
+        return null;
+    try {
+        const parsed = JSON.parse(await fs.readFile(statusPath, 'utf8'));
+        if (typeof parsed.candidateName !== 'string'
+            || typeof parsed.sourceRuntimeId !== 'string'
+            || typeof parsed.sourceLabel !== 'string'
+            || typeof parsed.syncedAt !== 'string') {
+            return null;
+        }
+        return {
+            candidateName: parsed.candidateName,
+            sourceRuntimeId: parsed.sourceRuntimeId,
+            sourceLabel: parsed.sourceLabel,
+            syncedAt: parsed.syncedAt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function writeMirrorStatus(statusPath, status) {
+    if (!statusPath)
+        return;
+    await fs.mkdir(path.dirname(statusPath), { recursive: true, mode: 0o700 });
+    const temporary = `${statusPath}.${process.pid}.${Date.now()}.tmp`;
+    await fs.writeFile(temporary, `${JSON.stringify(status, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await fs.rename(temporary, statusPath);
+}

package/dist/codex_app/client.d.ts

@@ -58,6 +58,7 @@ interface CodexAppServerRuntimeStatus {
 interface StopOptions {
     terminateServer?: boolean;
 }
+export declare function buildCodexAppServerArgs(port: number, configOverrides?: readonly string[]): string[];
 export declare class CodexAppClient extends EventEmitter {
     private readonly codexCliBin;
     private readonly launchCommand;
@@ -66,6 +67,7 @@ export declare class CodexAppClient extends EventEmitter {
     private readonly serverLogPath;
     private readonly logger;
     private readonly childEnv;
+    private readonly appServerConfigOverrides;
     private child;
     private socket;
     private requestId;
@@ -76,7 +78,7 @@ export declare class CodexAppClient extends EventEmitter {
     private port;
     private connected;
     private userAgent;
-    constructor(codexCliBin: string, launchCommand: string, autolaunch: boolean, serverStatePath: string, serverLogPath: string, logger: Logger, childEnv?: NodeJS.ProcessEnv | null);
+    constructor(codexCliBin: string, launchCommand: string, autolaunch: boolean, serverStatePath: string, serverLogPath: string, logger: Logger, childEnv?: NodeJS.ProcessEnv | null, appServerConfigOverrides?: readonly string[]);
     isConnected(): boolean;
     getUserAgent(): string | null;
     getServerStatus(): CodexAppServerRuntimeStatus;

package/dist/codex_app/client.js

@@ -6,6 +6,14 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { buildThreadDeepLink, openUrl } from './deeplink.js';
 const CLIENT_VERSION = readPackageVersion();
+export function buildCodexAppServerArgs(port, configOverrides = []) {
+    const args = ['app-server'];
+    for (const override of configOverrides) {
+        args.push('-c', override);
+    }
+    args.push('--listen', `ws://127.0.0.1:${port}`);
+    return args;
+}
 export class CodexAppClient extends EventEmitter {
     codexCliBin;
     launchCommand;
@@ -14,6 +22,7 @@ export class CodexAppClient extends EventEmitter {
     serverLogPath;
     logger;
     childEnv;
+    appServerConfigOverrides;
     child = null;
     socket = null;
     requestId = 0;
@@ -24,7 +33,7 @@ export class CodexAppClient extends EventEmitter {
     port = null;
     connected = false;
     userAgent = null;
-    constructor(codexCliBin, launchCommand, autolaunch, serverStatePath, serverLogPath, logger, childEnv = null) {
+    constructor(codexCliBin, launchCommand, autolaunch, serverStatePath, serverLogPath, logger, childEnv = null, appServerConfigOverrides = []) {
         super();
         this.codexCliBin = codexCliBin;
         this.launchCommand = launchCommand;
@@ -33,6 +42,7 @@ export class CodexAppClient extends EventEmitter {
         this.serverLogPath = serverLogPath;
         this.logger = logger;
         this.childEnv = childEnv;
+        this.appServerConfigOverrides = appServerConfigOverrides;
     }
     isConnected() {
         return this.connected;
@@ -474,10 +484,11 @@ export class CodexAppClient extends EventEmitter {
             launcher.unref();
         }
         this.port = await reservePort();
+        const serverArgs = buildCodexAppServerArgs(this.port, this.appServerConfigOverrides);
         const [stdoutFd, stderrFd] = this.openServerLogFiles();
         let child;
         try {
-            child = spawn(this.codexCliBin, ['app-server', '--listen', `ws://127.0.0.1:${this.port}`], {
+            child = spawn(this.codexCliBin, serverArgs, {
                 detached: true,
                 stdio: ['ignore', stdoutFd, stderrFd],
                 env: this.childEnv ? { ...process.env, ...this.childEnv } : process.env,
@@ -496,7 +507,7 @@ export class CodexAppClient extends EventEmitter {
         this.writeServerState({
             pid: child.pid,
             port: this.port,
-            command: `${this.codexCliBin} app-server --listen ws://127.0.0.1:${this.port}`,
+            command: [this.codexCliBin, ...serverArgs].join(' '),
             logPath: this.serverLogPath,
             bridgePid: process.pid,
             startedAt: new Date().toISOString(),

package/dist/controller/controller.d.ts

@@ -5,11 +5,18 @@ import type { RuntimeStatus } from '../types.js';
 import type { TelegramGateway, TelegramTextEvent } from '../telegram/gateway.js';
 import { BridgeMessagingRouter } from '../channels/bridge_messaging_router.js';
 import type { CodexAppClient } from '../codex_app/client.js';
-import type { SelfUpdateRuntime } from '../update.js';
+import type { SelfUpdateRuntime, SelfUpdateStatus } from '../update.js';
 export interface CoreCoordinator {
     canSelfUpdate?: () => boolean;
     authCandidateUpdated?: (runtimeId: string, candidateName: string) => Promise<void>;
     statusUpdated?: (status: RuntimeStatus) => void;
+    getServiceStatus?: () => Promise<{
+        bots: NonNullable<RuntimeStatus['bots']>;
+        weixinRuntime?: RuntimeStatus['weixinRuntime'];
+        authMirror?: RuntimeStatus['authMirror'];
+        lastUpdate?: SelfUpdateStatus | null;
+    }>;
+    selfUpdateCompleted?: (status: SelfUpdateStatus) => void;
 }
 export declare class BridgeSessionCore {
     private readonly config;
@@ -19,6 +26,7 @@ export declare class BridgeSessionCore {
     private readonly app;
     private readonly selfUpdater;
     private readonly coordinator;
+    private readonly ownsTelegramRuntime;
     private activeTurns;
     private activeTurnsByTurnId;
     private observedThreadWatchers;
@@ -57,7 +65,7 @@ export declare class BridgeSessionCore {
     /** Last threads-panel pagination state per scope (Telegram inline nav + /open index alignment). */
     private threadListPresentationState;
     private readonly messaging;
-    constructor(config: AppConfig, store: BridgeStore, logger: Logger, bot: TelegramGateway, app: CodexAppClient, outbound: BridgeMessagingRouter, selfUpdater?: SelfUpdateRuntime | null, coordinator?: CoreCoordinator | null);
+    constructor(config: AppConfig, store: BridgeStore, logger: Logger, bot: TelegramGateway, app: CodexAppClient, outbound: BridgeMessagingRouter, selfUpdater?: SelfUpdateRuntime | null, coordinator?: CoreCoordinator | null, ownsTelegramRuntime?: boolean);
     /** Wire Telegram inbound events. Call before {@link startCodexApp}. */
     registerTelegramInboundHandlers(): void;
     /**
@@ -146,9 +154,11 @@ export declare class BridgeSessionCore {
     private stageAttachments;
     private registerActiveTurn;
     private createActiveTurnState;
+    getCurrentAuthLabel(): Promise<string | null>;
     isIdleForServiceUpdate(): boolean;
     private hasLocalBlockingActivity;
     private authRuntimeId;
+    private authDisplayBotLabel;
     private ownsScope;
     private setActiveTurn;
     private getActiveTurn;

package/dist/controller/controller.js

@@ -94,6 +94,7 @@ export class BridgeSessionCore {
     app;
     selfUpdater;
     coordinator;
+    ownsTelegramRuntime;
     activeTurns = new Map();
     activeTurnsByTurnId = new Map();
     observedThreadWatchers = new Map();
@@ -132,7 +133,7 @@ export class BridgeSessionCore {
     /** Last threads-panel pagination state per scope (Telegram inline nav + /open index alignment). */
     threadListPresentationState = new Map();
     messaging;
-    constructor(config, store, logger, bot, app, outbound, selfUpdater = null, coordinator = null) {
+    constructor(config, store, logger, bot, app, outbound, selfUpdater = null, coordinator = null, ownsTelegramRuntime = true) {
         this.config = config;
         this.store = store;
         this.logger = logger;
@@ -140,6 +141,7 @@ export class BridgeSessionCore {
         this.app = app;
         this.selfUpdater = selfUpdater;
         this.coordinator = coordinator;
+        this.ownsTelegramRuntime = ownsTelegramRuntime;
         this.messaging = outbound;
     }
     /** Wire Telegram inbound events. Call before {@link startCodexApp}. */
@@ -198,13 +200,13 @@ export class BridgeSessionCore {
             this.logger.warn('codex.local_usage_background_refresh_failed', { error: formatUserError(error) });
         });
         this.updateStatus();
+        this.scheduleSelfUpdateStatusPoll(0);
     }
     /** Begin Telegram Bot API long-polling after handlers and Codex are ready. */
     async startTelegramPolling() {
         await this.bot.start();
         this.botUsername = this.bot.username;
         this.updateStatus();
-        this.scheduleSelfUpdateStatusPoll(0);
     }
     /** Telegram-only default startup (single channel). */
     async start() {
@@ -258,7 +260,7 @@ export class BridgeSessionCore {
             lastError: this.lastError,
             updatedAt: new Date().toISOString(),
             channels: {
-                telegram: true,
+                telegram: this.ownsTelegramRuntime,
                 weixin: Boolean(this.config.wxEnabled && this.messaging.hasWeixinTransport),
             },
         };
@@ -360,10 +362,13 @@ export class BridgeSessionCore {
                 const binding = this.store.getBinding(scopeId);
                 const settings = this.store.getChatSettings(scopeId);
                 const access = this.resolveEffectiveAccess(scopeId, settings);
-                const [fastStatus, codexUsageLines, codexLocalUsageLines] = await Promise.all([
+                const [fastStatus, codexUsageLines, codexLocalUsageLines, serviceStatus] = await Promise.all([
                     this.resolveFastStatusLabel(locale, settings),
                     this.buildCodexUsageStatusLines(locale),
                     this.buildCodexLocalUsageStatusLines(locale),
+                    this.config.tgMultiBotMode
+                        ? (this.coordinator?.getServiceStatus?.() ?? Promise.resolve(null))
+                        : Promise.resolve(null),
                 ]);
                 const appServer = this.app.getServerStatus();
                 const appServerLabel = appServer.pid && appServer.port
@@ -392,6 +397,43 @@ export class BridgeSessionCore {
                     t(locale, 'status_pending_user_inputs', { value: this.store.countPendingUserInputs() }),
                     t(locale, 'status_active_turns', { value: this.activeTurns.size }),
                 ];
+                if (serviceStatus) {
+                    lines.push('', t(locale, 'status_runtime_overview'));
+                    for (const runtime of serviceStatus.bots) {
+                        lines.push(t(locale, 'status_runtime_bot', {
+                            bot: runtime.username ? `@${runtime.username}` : runtime.id,
+                            connected: t(locale, runtime.connected ? 'yes' : 'no'),
+                            auth: runtime.currentAuth ?? t(locale, 'none'),
+                            turns: runtime.activeTurns,
+                        }));
+                    }
+                    if (serviceStatus.weixinRuntime) {
+                        lines.push(t(locale, 'status_runtime_weixin', {
+                            connected: t(locale, serviceStatus.weixinRuntime.connected ? 'yes' : 'no'),
+                            turns: serviceStatus.weixinRuntime.activeTurns,
+                        }));
+                    }
+                    lines.push(serviceStatus.authMirror
+                        ? t(locale, 'status_auth_mirror_synced', {
+                            candidate: serviceStatus.authMirror.candidateName,
+                            source: serviceStatus.authMirror.sourceLabel,
+                            time: serviceStatus.authMirror.syncedAt,
+                        })
+                        : t(locale, 'status_auth_mirror_none'));
+                    if (serviceStatus.lastUpdate) {
+                        lines.push(t(locale, 'status_last_update', {
+                            from: serviceStatus.lastUpdate.fromVersion,
+                            to: serviceStatus.lastUpdate.toVersion ?? t(locale, 'unknown'),
+                            time: serviceStatus.lastUpdate.updatedAt,
+                        }));
+                        if (serviceStatus.lastUpdate.codexUpdate) {
+                            lines.push(t(locale, 'status_last_codex_update', { value: serviceStatus.lastUpdate.codexUpdate }));
+                        }
+                    }
+                    else {
+                        lines.push(t(locale, 'status_last_update_none'));
+                    }
+                }
                 lines.push(...codexUsageLines);
                 lines.push(...codexLocalUsageLines);
                 await this.sendMessage(scopeId, lines.join('\n'));
@@ -2551,6 +2593,9 @@ export class BridgeSessionCore {
             resolver,
         };
     }
+    async getCurrentAuthLabel() {
+        return (await this.listCodexAuthState()).currentLabel;
+    }
     isIdleForServiceUpdate() {
         return this.activeTurns.size === 0
             && this.pendingApprovalMessages.size === 0
@@ -2565,10 +2610,18 @@ export class BridgeSessionCore {
     authRuntimeId() {
         return this.config.tgScopeBotId ?? 'default';
     }
+    authDisplayBotLabel() {
+        if (!this.config.tgScopeBotId)
+            return null;
+        return this.botUsername ? `@${this.botUsername}` : this.config.tgScopeBotId;
+    }
     ownsScope(scopeId) {
         if (scopeId.startsWith(BRIDGE_SCOPE_WEIXIN_PREFIX)) {
             return this.messaging.hasWeixinTransport;
         }
+        if (!this.ownsTelegramRuntime) {
+            return false;
+        }
         if (!this.config.tgScopeBotId) {
             return parseTelegramTargetFromBridgeScope(scopeId).botId === null;
         }
@@ -3774,6 +3827,7 @@ export class BridgeSessionCore {
             this.scheduleSelfUpdateStatusPoll();
             return;
         }
+        this.coordinator?.selfUpdateCompleted?.(status);
         await this.sendMessage(status.scopeId, this.formatSelfUpdateResult(status));
         await this.selfUpdater?.clearStatus();
     }
@@ -3820,7 +3874,7 @@ export class BridgeSessionCore {
             createdAt: Date.now(),
         };
         this.pendingAuthChoiceLists.set(record.localId, record);
-        const messageId = await this.sendMessage(scopeId, renderAuthListMessage(locale, state, parseWeixinBridgeScope(scopeId) !== null), authChoiceKeyboard(locale, record));
+        const messageId = await this.sendMessage(scopeId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null), authChoiceKeyboard(locale, record));
         record.messageId = messageId;
     }
     async handleAuthUseCommand(scopeId, locale, args) {
@@ -3842,7 +3896,7 @@ export class BridgeSessionCore {
         if (!candidate) {
             await this.sendMessage(scopeId, t(locale, 'auth_choice_expired'));
             const state = await this.listCodexAuthState();
-            await this.sendMessage(scopeId, renderAuthListMessage(locale, state, parseWeixinBridgeScope(scopeId) !== null));
+            await this.sendMessage(scopeId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null));
             return;
         }
         const switchLabels = await this.readCodexAuthSwitchLabels(candidate);
@@ -3859,7 +3913,7 @@ export class BridgeSessionCore {
         const candidate = state.candidates[index - 1];
         if (!candidate) {
             await this.sendMessage(scopeId, t(locale, 'auth_choice_expired'));
-            await this.sendMessage(scopeId, renderAuthListMessage(locale, state, parseWeixinBridgeScope(scopeId) !== null));
+            await this.sendMessage(scopeId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null));
             return;
         }
         this.store.setCodexAuthCandidateDisabled(candidate.name, disabled, this.authRuntimeId());
@@ -4319,7 +4373,7 @@ export class BridgeSessionCore {
         record.candidates = state.candidates;
         await this.messaging.answerCallback(event.callbackQueryId, t(locale, disabled ? 'auth_candidate_disabled_short' : 'auth_candidate_enabled_short'));
         if (record.messageId !== null) {
-            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, parseWeixinBridgeScope(event.scopeId) !== null), authChoiceKeyboard(locale, record));
+            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null), authChoiceKeyboard(locale, record));
         }
     }
     async handleAuthSwitchCallback(event, localId, index, locale) {
@@ -7304,12 +7358,14 @@ async function switchCodexAuth(targetPath, explicitAuthDir = null) {
         toLabel: await authPathDisplayLabel(candidate.path),
     };
 }
-function renderAuthListMessage(locale, state, includeWeixinCopyPaste = false) {
+function renderAuthListMessage(locale, state, botLabel = null, includeWeixinCopyPaste = false) {
     const lines = [
         t(locale, 'auth_list_title'),
-        t(locale, 'auth_current', { value: state.currentLabel ?? t(locale, 'none') }),
-        t(locale, 'auth_dir', { value: state.authDir }),
     ];
+    if (botLabel) {
+        lines.push(t(locale, 'auth_bot', { value: botLabel }));
+    }
+    lines.push(t(locale, 'auth_current', { value: state.currentLabel ?? t(locale, 'none') }), t(locale, 'auth_dir', { value: state.authDir }));
     if (state.candidates.length === 0) {
         lines.push(t(locale, 'auth_no_candidates'));
         if (includeWeixinCopyPaste) {

package/dist/i18n.d.ts

@@ -118,18 +118,27 @@ declare const MESSAGES: {
         readonly status_codex_local_usage_unavailable: "Codex local history: unavailable ({error})";
         readonly status_codex_credits: "Codex credits: {value}";
         readonly status_codex_limit_reached: "Codex limit: {value}";
+        readonly status_runtime_overview: "Telegram bot runtimes:";
+        readonly status_runtime_bot: "- {bot}: connected {connected}, auth {auth}, active turns {turns}";
+        readonly status_runtime_weixin: "- Weixin default runtime: connected {connected}, active turns {turns}";
+        readonly status_auth_mirror_none: "Last auth mirror: none recorded";
+        readonly status_auth_mirror_synced: "Last auth mirror: {candidate} from {source} at {time}";
+        readonly status_last_update_none: "Last service update: none recorded";
+        readonly status_last_update: "Last service update: {from} -> {to} at {time}";
+        readonly status_last_codex_update: "Last Codex update: {value}";
         readonly update_started: "FoxClaw update started. I will report here after installation, checks, and service restart complete.";
         readonly update_succeeded: "FoxClaw updated and restarted: {from} -> {to}.";
         readonly update_failed: "FoxClaw update failed: {error}\nRun foxclaw update in a terminal for details.";
         readonly update_unavailable: "Self-update is unavailable in this runtime. Run foxclaw update in a terminal.";
         readonly update_already_running: "A FoxClaw update is already running. I will report here when it finishes.";
-        readonly update_blocked_active: "Cannot update FoxClaw while a turn, approval, or question is active. Wait or use /interrupt first.";
+        readonly update_blocked_active: "Cannot update FoxClaw while a runtime activity or auth mirror write is active. Wait or use /interrupt first.";
         readonly auth_reload_restarting: "Restarting Codex app-server to reload auth...";
         readonly auth_reload_done: "Codex app-server restarted. Current auth has been reloaded.";
         readonly auth_reload_blocked_active: "Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.";
         readonly usage_auth: "Usage: /auth [list|use <n>|enable <n>|disable <n>|reload|add <name>]";
         readonly usage_auth_add: "Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.";
         readonly auth_list_title: "Codex auth files:";
+        readonly auth_bot: "Bot runtime: {value}";
         readonly auth_current: "Current auth: {value}";
         readonly auth_dir: "Auth dir: {value}";
         readonly auth_candidate_count: "Candidates: {value}";
@@ -682,18 +691,27 @@ declare const MESSAGES: {
         readonly status_codex_local_usage_unavailable: "Codex 本地历史：无法获取（{error}）";
         readonly status_codex_credits: "Codex 额度：{value}";
         readonly status_codex_limit_reached: "Codex 限制：{value}";
+        readonly status_runtime_overview: "Telegram bot 运行时：";
+        readonly status_runtime_bot: "- {bot}：连接 {connected}，auth {auth}，进行中回复 {turns}";
+        readonly status_runtime_weixin: "- 微信默认运行时：连接 {connected}，进行中回复 {turns}";
+        readonly status_auth_mirror_none: "最近 auth 镜像：暂无记录";
+        readonly status_auth_mirror_synced: "最近 auth 镜像：{candidate} 由 {source} 于 {time} 同步";
+        readonly status_last_update_none: "最近服务升级：暂无记录";
+        readonly status_last_update: "最近服务升级：{from} -> {to}（{time}）";
+        readonly status_last_codex_update: "最近 Codex 升级：{value}";
         readonly update_started: "已开始升级 FoxClaw。安装、自检和服务重启完成后，我会在这里回报结果。";
         readonly update_succeeded: "FoxClaw 已升级并重启：{from} -> {to}。";
         readonly update_failed: "FoxClaw 升级失败：{error}\n请在终端运行 foxclaw update 查看详情。";
         readonly update_unavailable: "当前运行方式不支持自升级，请在终端运行 foxclaw update。";
         readonly update_already_running: "FoxClaw 升级已经在进行中，结束后我会在这里回报结果。";
-        readonly update_blocked_active: "当前有回复、审批或问题在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。";
+        readonly update_blocked_active: "当前有 runtime 操作或 auth 镜像写入在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。";
         readonly auth_reload_restarting: "正在重启 Codex app-server 以重新读取 auth...";
         readonly auth_reload_done: "Codex app-server 已重启，当前 auth 已重新读取。";
         readonly auth_reload_blocked_active: "当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。";
         readonly usage_auth: "用法：/auth [list|use <编号>|enable <编号>|disable <编号>|reload|add <名称>]";
         readonly usage_auth_add: "用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。";
         readonly auth_list_title: "Codex auth 文件：";
+        readonly auth_bot: "Bot runtime：{value}";
         readonly auth_current: "当前 auth：{value}";
         readonly auth_dir: "Auth 目录：{value}";
         readonly auth_candidate_count: "候选数量：{value}";

package/dist/i18n.js

@@ -116,18 +116,27 @@ const MESSAGES = {
         status_codex_local_usage_unavailable: 'Codex local history: unavailable ({error})',
         status_codex_credits: 'Codex credits: {value}',
         status_codex_limit_reached: 'Codex limit: {value}',
+        status_runtime_overview: 'Telegram bot runtimes:',
+        status_runtime_bot: '- {bot}: connected {connected}, auth {auth}, active turns {turns}',
+        status_runtime_weixin: '- Weixin default runtime: connected {connected}, active turns {turns}',
+        status_auth_mirror_none: 'Last auth mirror: none recorded',
+        status_auth_mirror_synced: 'Last auth mirror: {candidate} from {source} at {time}',
+        status_last_update_none: 'Last service update: none recorded',
+        status_last_update: 'Last service update: {from} -> {to} at {time}',
+        status_last_codex_update: 'Last Codex update: {value}',
         update_started: 'FoxClaw update started. I will report here after installation, checks, and service restart complete.',
         update_succeeded: 'FoxClaw updated and restarted: {from} -> {to}.',
         update_failed: 'FoxClaw update failed: {error}\nRun foxclaw update in a terminal for details.',
         update_unavailable: 'Self-update is unavailable in this runtime. Run foxclaw update in a terminal.',
         update_already_running: 'A FoxClaw update is already running. I will report here when it finishes.',
-        update_blocked_active: 'Cannot update FoxClaw while a turn, approval, or question is active. Wait or use /interrupt first.',
+        update_blocked_active: 'Cannot update FoxClaw while a runtime activity or auth mirror write is active. Wait or use /interrupt first.',
         auth_reload_restarting: 'Restarting Codex app-server to reload auth...',
         auth_reload_done: 'Codex app-server restarted. Current auth has been reloaded.',
         auth_reload_blocked_active: 'Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.',
         usage_auth: 'Usage: /auth [list|use <n>|enable <n>|disable <n>|reload|add <name>]',
         usage_auth_add: 'Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.',
         auth_list_title: 'Codex auth files:',
+        auth_bot: 'Bot runtime: {value}',
         auth_current: 'Current auth: {value}',
         auth_dir: 'Auth dir: {value}',
         auth_candidate_count: 'Candidates: {value}',
@@ -680,18 +689,27 @@ const MESSAGES = {
         status_codex_local_usage_unavailable: 'Codex 本地历史：无法获取（{error}）',
         status_codex_credits: 'Codex 额度：{value}',
         status_codex_limit_reached: 'Codex 限制：{value}',
+        status_runtime_overview: 'Telegram bot 运行时：',
+        status_runtime_bot: '- {bot}：连接 {connected}，auth {auth}，进行中回复 {turns}',
+        status_runtime_weixin: '- 微信默认运行时：连接 {connected}，进行中回复 {turns}',
+        status_auth_mirror_none: '最近 auth 镜像：暂无记录',
+        status_auth_mirror_synced: '最近 auth 镜像：{candidate} 由 {source} 于 {time} 同步',
+        status_last_update_none: '最近服务升级：暂无记录',
+        status_last_update: '最近服务升级：{from} -> {to}（{time}）',
+        status_last_codex_update: '最近 Codex 升级：{value}',
         update_started: '已开始升级 FoxClaw。安装、自检和服务重启完成后，我会在这里回报结果。',
         update_succeeded: 'FoxClaw 已升级并重启：{from} -> {to}。',
         update_failed: 'FoxClaw 升级失败：{error}\n请在终端运行 foxclaw update 查看详情。',
         update_unavailable: '当前运行方式不支持自升级，请在终端运行 foxclaw update。',
         update_already_running: 'FoxClaw 升级已经在进行中，结束后我会在这里回报结果。',
-        update_blocked_active: '当前有回复、审批或问题在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。',
+        update_blocked_active: '当前有 runtime 操作或 auth 镜像写入在进行中，不能升级 FoxClaw。请先等待，或使用 /interrupt。',
         auth_reload_restarting: '正在重启 Codex app-server 以重新读取 auth...',
         auth_reload_done: 'Codex app-server 已重启，当前 auth 已重新读取。',
         auth_reload_blocked_active: '当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。',
         usage_auth: '用法：/auth [list|use <编号>|enable <编号>|disable <编号>|reload|add <名称>]',
         usage_auth_add: '用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。',
         auth_list_title: 'Codex auth 文件：',
+        auth_bot: 'Bot runtime：{value}',
         auth_current: '当前 auth：{value}',
         auth_dir: 'Auth 目录：{value}',
         auth_candidate_count: '候选数量：{value}',

package/dist/main.js

@@ -10,7 +10,7 @@ import { APP_HOME, DEFAULT_CODEX_TELEGRAM_HOME, DEFAULT_ENV_PATH, DEFAULT_LOG_PA
 import { acquireProcessLock, LockHeldError } from './lock.js';
 import { readRuntimeStatus, writeRuntimeStatus } from './runtime.js';
 import { refreshFoxclawExecStartDropIns, removeFoxclawExecStartDropIns } from './systemd.js';
-import { createSelfUpdateRuntime, inferPnpmHomeFromEntryPoint, performSelfUpdate } from './update.js';
+import { createSelfUpdateRuntime, inferPnpmHomeFromEntryPoint, performSelfUpdate, readSelfUpdateStatus, writeSelfUpdateStatus, } from './update.js';
 const rawCommand = process.argv[2];
 const command = rawCommand || 'serve';
 loadEnv();
@@ -162,6 +162,7 @@ async function runServeCli() {
     const processLock = acquireProcessLock(config.lockPath);
     let store = null;
     let weixinAdapter = null;
+    let activeWeixinCore = null;
     let activeTelegramAdapters = [];
     let managedApps = [];
     let activeAuthMirror = null;
@@ -184,15 +185,17 @@ async function runServeCli() {
                     tgScopeBotId: id,
                     codexAuthDir: home,
                     codexHome: home,
+                    codexAppAutolaunch: false,
                     codexAppServerStatePath: path.join(APP_HOME, 'runtime', `codex-app-server-${id}.json`),
                     codexAppServerLogPath: path.join(APP_HOME, 'logs', `codex-app-server-${id}.log`),
                 };
-                const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, { CODEX_HOME: home });
+                const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, { CODEX_HOME: home }, ['cli_auth_credentials_store="file"']);
                 seeds.push({ id, home, config: runtimeConfig, bot, app });
             }
             const canonicalAuthDir = config.codexAuthDir ?? config.codexHome ?? path.join(os.homedir(), '.codex');
             const mirror = new AuthCandidateMirror(canonicalAuthDir, seeds.map((runtime) => ({
                 id: runtime.id,
+                label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
                 authDir: runtime.home,
                 notify: async (message) => {
                     const chatId = store.getTelegramPrivateChatId(runtime.id);
@@ -200,7 +203,7 @@ async function runServeCli() {
                         await runtime.bot.sendMessage(chatId, message);
                     }
                 },
-            })), logger);
+            })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'));
             await mirror.initialize();
             mirror.start();
             activeAuthMirror = mirror;
@@ -213,21 +216,29 @@ async function runServeCli() {
                 logPath: path.join(APP_HOME, 'logs', 'update.log'),
                 codexCliBin: config.codexCliBin,
             });
+            const lastSelfUpdatePath = path.join(APP_HOME, 'runtime', 'last-self-update.json');
+            let lastSelfUpdate = readSelfUpdateStatus(lastSelfUpdatePath);
             const runtimes = [];
             const writeAggregateStatus = (running = true) => {
                 const statuses = runtimes.map((runtime) => runtime.core.getRuntimeStatus());
+                const weixinStatus = activeWeixinCore?.getRuntimeStatus() ?? null;
                 const first = statuses[0] ?? null;
                 writeRuntimeStatus(config.statusPath, {
                     running,
-                    connected: running && statuses.every((status) => status.connected),
+                    connected: running
+                        && statuses.every((status) => status.connected)
+                        && (!weixinStatus || weixinStatus.connected),
                     userAgent: first?.userAgent ?? null,
                     ...(first?.codexAppServer ? { codexAppServer: first.codexAppServer } : {}),
                     botUsername: first?.botUsername ?? null,
                     currentBindings: store.countBindings(),
                     pendingApprovals: store.countPendingApprovals(),
                     pendingUserInputs: store.countPendingUserInputs(),
-                    activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0),
-                    lastError: statuses.find((status) => status.lastError)?.lastError ?? null,
+                    activeTurns: statuses.reduce((sum, status) => sum + status.activeTurns, 0)
+                        + (weixinStatus?.activeTurns ?? 0),
+                    lastError: statuses.find((status) => status.lastError)?.lastError
+                        ?? weixinStatus?.lastError
+                        ?? null,
                     updatedAt: new Date().toISOString(),
                     channels: { telegram: running, weixin: running && config.wxEnabled },
                     bots: runtimes.map((runtime, index) => ({
@@ -237,24 +248,63 @@ async function runServeCli() {
                         activeTurns: running ? (statuses[index]?.activeTurns ?? 0) : 0,
                         ...(statuses[index]?.codexAppServer ? { codexAppServer: statuses[index].codexAppServer } : {}),
                     })),
+                    ...(weixinStatus ? {
+                        weixinRuntime: {
+                            connected: running && weixinStatus.connected,
+                            activeTurns: running ? weixinStatus.activeTurns : 0,
+                            ...(weixinStatus.codexAppServer ? { codexAppServer: weixinStatus.codexAppServer } : {}),
+                        },
+                    } : {}),
+                    authMirror: mirror.getStatus(),
+                    lastUpdate: lastSelfUpdate,
                 });
             };
             const coordinator = {
-                canSelfUpdate: () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate()),
+                canSelfUpdate: () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate())
+                    && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
+                    && mirror.isIdle(),
                 authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
                 statusUpdated: () => writeAggregateStatus(),
+                getServiceStatus: async () => ({
+                    bots: await Promise.all(runtimes.map(async (runtime) => {
+                        const status = runtime.core.getRuntimeStatus();
+                        return {
+                            id: runtime.id,
+                            username: status.botUsername ?? runtime.bot.username,
+                            connected: status.connected,
+                            activeTurns: status.activeTurns,
+                            currentAuth: await runtime.core.getCurrentAuthLabel().catch(() => null),
+                            ...(status.codexAppServer ? { codexAppServer: status.codexAppServer } : {}),
+                        };
+                    })),
+                    ...(activeWeixinCore ? {
+                        weixinRuntime: {
+                            connected: activeWeixinCore.getRuntimeStatus().connected,
+                            activeTurns: activeWeixinCore.getRuntimeStatus().activeTurns,
+                            codexAppServer: activeWeixinCore.getRuntimeStatus().codexAppServer,
+                        },
+                    } : {}),
+                    authMirror: mirror.getStatus(),
+                    lastUpdate: lastSelfUpdate,
+                }),
+                selfUpdateCompleted: (status) => {
+                    lastSelfUpdate = status;
+                    writeSelfUpdateStatus(lastSelfUpdatePath, status);
+                    writeAggregateStatus();
+                },
             };
-            for (const [index, seed] of seeds.entries()) {
+            for (const seed of seeds) {
                 const telegramMessaging = new TelegramMessagingPort(seed.bot);
-                const weixinMessaging = index === 0 && config.wxEnabled
-                    ? new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id))
-                    : null;
-                const outbound = new BridgeMessagingRouter(telegramMessaging, weixinMessaging);
+                const outbound = new BridgeMessagingRouter(telegramMessaging, null);
                 const core = new BridgeSessionCore(seed.config, store, logger, seed.bot, seed.app, outbound, selfUpdater, coordinator);
                 runtimes.push({ ...seed, core, telegram: new TelegramChannelAdapter(core) });
             }
             if (config.wxEnabled) {
-                weixinAdapter = new WeixinChannelAdapter(runtimes[0].core, store, runtimes[0].config, logger);
+                const weixinApp = new CodexAppClient(config.codexCliBin, config.codexAppLaunchCmd, config.codexAppAutolaunch, config.codexAppServerStatePath, config.codexAppServerLogPath, logger);
+                const outbound = new BridgeMessagingRouter(new TelegramMessagingPort(seeds[0].bot), new WeixinMessagingPort(store, (id) => loadWeixinAccount(config.weixinAccountsDir, id)));
+                activeWeixinCore = new BridgeSessionCore(config, store, logger, seeds[0].bot, weixinApp, outbound, selfUpdater, coordinator, false);
+                managedApps.push(weixinApp);
+                weixinAdapter = new WeixinChannelAdapter(activeWeixinCore, store, config, logger);
             }
             activeTelegramAdapters = runtimes.map((runtime) => runtime.telegram);
             process.on('unhandledRejection', (error) => {
@@ -267,6 +317,7 @@ async function runServeCli() {
                 await runtime.telegram.start();
             }
             if (weixinAdapter) {
+                await activeWeixinCore.startCodexApp();
                 await weixinAdapter.start();
             }
             writeAggregateStatus();
@@ -275,10 +326,11 @@ async function runServeCli() {
                 logger.info('bridge.shutting_down', { signal });
                 mirror.stop();
                 await weixinAdapter?.stop();
+                await activeWeixinCore?.stop();
                 await Promise.all(runtimes.map((runtime) => runtime.telegram.stop()));
                 writeAggregateStatus(false);
-                await Promise.all(runtimes.map((runtime) => runtime.app.stop({ terminateServer: true }).catch((error) => {
-                    logger.warn('codex.app-server.stop_failed', { runtimeId: runtime.id, error: serializeError(error) });
+                await Promise.all(managedApps.map((app) => app.stop({ terminateServer: true }).catch((error) => {
+                    logger.warn('codex.app-server.stop_failed', { error: serializeError(error) });
                 })));
                 store?.close();
                 processLock.release();
@@ -352,6 +404,7 @@ async function runServeCli() {
     catch (error) {
         activeAuthMirror?.stop();
         await weixinAdapter?.stop().catch(() => { });
+        await activeWeixinCore?.stop().catch(() => { });
         await Promise.allSettled(activeTelegramAdapters.map((adapter) => adapter.stop()));
         await Promise.allSettled(managedApps.map((app) => app.stop({ terminateServer: true })));
         store?.close();

package/dist/types.d.ts

@@ -345,6 +345,25 @@ export interface RuntimeStatus {
         username: string | null;
         connected: boolean;
         activeTurns: number;
+        currentAuth?: string | null;
         codexAppServer?: RuntimeStatus['codexAppServer'];
     }>;
+    weixinRuntime?: {
+        connected: boolean;
+        activeTurns: number;
+        codexAppServer?: RuntimeStatus['codexAppServer'];
+    };
+    authMirror?: {
+        candidateName: string;
+        sourceRuntimeId: string;
+        sourceLabel: string;
+        syncedAt: string;
+    } | null;
+    lastUpdate?: {
+        state: string;
+        fromVersion: string;
+        toVersion: string | null;
+        codexUpdate?: string | null;
+        updatedAt: string;
+    } | null;
 }

package/docs/agent-assisted-install.md

@@ -17,7 +17,7 @@ Optional later:
 - `TG_ALLOWED_CHAT_ID`
 - `TG_ALLOWED_TOPIC_ID`
 
-Use private Telegram chat first. Configure groups/topics only after private chat works.
+Use private Telegram chat first. Configure groups/topics only after private chat works. Multiple tokens mean independent Codex runtimes inside one service; validate each bot privately.
 
 ## Copy-Paste Prompt
 
@@ -45,11 +45,12 @@ Tasks:
 5. Run foxclaw init, then write ~/.foxclaw/.env. Never print or commit the bot token.
 6. Run foxclaw doctor.
 7. Start FoxClaw with foxclaw start.
-8. Ask me to send /help and /status to the Telegram bot.
+8. Ask me to send /help, /status, and /auth privately to each configured Telegram bot; confirm /auth names that bot runtime.
 9. Verify the final state:
    - foxclaw.service is active/enabled on Linux
    - foxclaw status works
 10. Report the commands used, the final status, and the log command I should use if something stops working. Redact TG_BOT_TOKENS and never print the full token or full .env content.
+11. If multiple bots are enabled, confirm foxclaw status lists independent app-servers; group-chat tests must mention or reply to the intended bot.
 ```
 
 ## Safety Notes

package/docs/install-for-beginners.md

@@ -123,7 +123,7 @@ npm install -g @foxden-app/foxclaw
 foxclaw init
 ```
 
-This creates the config file at `~/.foxclaw/.env` and prompts for the Telegram bot token, your numeric Telegram user id, and the default workspace.
+This creates the config file at `~/.foxclaw/.env` and prompts for one or more comma-separated Telegram bot tokens, your numeric Telegram user id, and the default workspace. New installs use `TG_BOT_TOKENS`; legacy `TG_BOT_TOKEN` is only for existing single-bot configurations.
 
 If you prefer pnpm:
 
@@ -154,6 +154,14 @@ DEFAULT_SANDBOX_MODE=workspace-write
 
 Keep `TG_ALLOWED_CHAT_ID=` and `TG_ALLOWED_TOPIC_ID=` empty for the first install. Do not delete those lines; leaving them empty means private-chat mode.
 
+Start with one bot. To add three independent Codex lanes later, put the tokens on the same line:
+
+```dotenv
+TG_BOT_TOKENS=123456789:token_a,234567890:token_b,345678901:token_c
+```
+
+FoxClaw still installs one service, but each bot receives its own app-server, session home, and current auth selection. After startup, privately send `/help` and `/status` to each bot.
+
 `DEFAULT_CWD` must be a real folder. Examples:
 
 ```dotenv
@@ -280,7 +288,7 @@ Update FoxClaw later:
 foxclaw update
 ```
 
-You can also send `/update` in an authorized Telegram chat. When every bot is idle with no approval or question active, it attempts to update an npm/pnpm-managed Codex CLI, upgrades FoxClaw, checks, restarts the service, and reports the result after restart.
+You can also send `/update` in an authorized Telegram chat. When every Telegram bot runtime, an enabled Weixin default runtime, and auth mirror writes are idle, it attempts to update an npm/pnpm-managed Codex CLI, upgrades FoxClaw, checks, restarts the service, and reports the result through the bot that started it.
 
 ## Next Step
 

package/docs/troubleshooting.md

@@ -182,6 +182,18 @@ Bridge logs are stored here:
 tail -f ~/.foxclaw/logs/service.log
 ```
 
+## Checking Multi-Bot Mode
+
+After configuring `TG_BOT_TOKENS`, `foxclaw status` should contain one bot id, connection status, and independent app-server for each token. Send `/status` privately to any bot to see the runtime summary; send `/auth` to confirm the panel names the current `@botname` and its auth directory.
+
+Each isolated app-server log is stored at:
+
+```bash
+tail -f ~/.foxclaw/logs/codex-app-server-bot<id>.log
+```
+
+When multiple bots share a group, unaddressed messages intentionally do not trigger them; mention `@botname`, reply to the intended bot, or send `/status@botname`. When enabled, Weixin stays on the default Codex runtime and does not appear inside an isolated Telegram bot's thread list.
+
 ## ChatGPT Backend 403 Or Unable To Load Site
 
 If Telegram shows `ChatGPT backend 403 Forbidden`, or the app-server log contains `Unable to load site`, `cf-ray`, or `chatgpt.com/backend-api`, the auth file is not necessarily broken. The service process is usually reaching ChatGPT with the wrong network/proxy/IP.

package/docs/user-manual.md

@@ -230,10 +230,10 @@ Later commands are sorted by recent usage. Plain text, photos, and files continu
 
 ### 3.2 `/status`, `/account`, `/quota`, `/update`
 
-- `/status`: FoxClaw, app-server, current thread binding, model, access, and Codex usage summary. Local session, token, and visible-reply-throughput metrics use a background-generated historical snapshot instead of scanning large logs during the request; throughput is computed end-to-end for completed turns, excluding reasoning tokens while including waiting and tool execution time.
+- `/status`: FoxClaw, app-server, current thread binding, model, access, and Codex usage summary. In multi-bot mode it also lists every bot's connection, current auth, active turns, and the most recent auth mirror and service/Codex update outcomes. Local session, token, and visible-reply-throughput metrics use a background-generated historical snapshot instead of scanning large logs during the request; throughput is computed end-to-end for completed turns, excluding reasoning tokens while including waiting and tool execution time.
 - `/account`: current Codex account.
 - `/quota`: Codex usage and quota window.
-- `/update`: upgrade FoxClaw, attempt to update an npm/pnpm-managed Codex CLI, run checks, and restart the service; it refuses while any bot runtime has a turn, approval, or question active, then reports the result after restart.
+- `/update`: upgrade FoxClaw, attempt to update an npm/pnpm-managed Codex CLI, run checks, and restart the service; it refuses while any Telegram bot runtime, an enabled Weixin default runtime, or an auth mirror write is busy, then reports the result through the initiating bot after restart.
 
 ### 3.3 `/config`, `/requirements`, `/provider`
 
@@ -335,7 +335,7 @@ Watch mode mirrors live turn progress and approval requests. The watching chat i
 
 ## 6. Codex Login And Auth Rotation
 
-This is a key FoxClaw feature. Codex auth is usually stored at `~/.codex/auth.json`. FoxClaw stores multiple accounts as candidate files and switches which candidate the active `auth.json` points to. In `TG_BOT_TOKENS` mode, each bot has an isolated Codex home, app-server, and current candidate, so bots can run and switch accounts independently; validated login/refresh credentials are safely mirrored between bot homes.
+This is a key FoxClaw feature. Codex auth is usually stored at `~/.codex/auth.json`. FoxClaw stores multiple accounts as candidate files and switches which candidate the active `auth.json` points to. In `TG_BOT_TOKENS` mode, each bot has an isolated Codex home, app-server, and current candidate, so bots can run and switch accounts independently; isolated Telegram runtimes force file-backed credential storage. Validated login/refresh credentials are safely mirrored between bot homes, but sessions are never shared.
 
 ### 6.1 File Format
 
@@ -387,7 +387,7 @@ If the login is cancelled or fails, FoxClaw tries to restore the previous auth t
 
 ### 6.3 The `/auth` Panel
 
-`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota.
+`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota.
 
 Approximation:
 

package/docs/zh/agent-assisted-install.md

@@ -17,7 +17,7 @@
 - `TG_ALLOWED_CHAT_ID`
 - `TG_ALLOWED_TOPIC_ID`
 
-第一次请先用 Telegram 私聊跑通。群组和话题模式等私聊稳定后再开。
+第一次请先用 Telegram 私聊跑通。群组和话题模式等私聊稳定后再开。多个 token 表示同一服务内多个独立 Codex runtime；每个 bot 都必须单独完成私聊验收。
 
 ## 复制给 agent 的安装提示词
 
@@ -44,11 +44,12 @@ DEFAULT_CWD=<把绝对工作目录粘贴在这里>
 5. 运行 foxclaw init，然后写入 ~/.foxclaw/.env。不要打印或提交 bot token。
 6. 运行 foxclaw doctor。
 7. 用 foxclaw start 启动 FoxClaw。
-8. 让我在 Telegram bot 里发送 /help 和 /status。
+8. 让我在每个已配置的 Telegram bot 私聊里发送 /help、/status 和 /auth；确认 /auth 显示对应 bot runtime。
 9. 验证最终状态：
    - Linux 上 foxclaw.service 处于 active/enabled
    - foxclaw status 可以正常输出
 10. 汇报执行过的命令、最终状态和后续看日志的命令。请隐藏 TG_BOT_TOKENS，不要打印完整 token 或完整 .env。
+11. 如果启用了多个 bot，确认 foxclaw status 列出独立 app-server；群聊测试必须点名或回复目标 bot。
 ```
 
 ## 安全注意事项

package/docs/zh/foxclaw-skill.md

@@ -14,11 +14,13 @@
 2. 让 Codex 使用 `skills/foxclaw`。
 3. 如果是远程机器，提供 SSH 目标。
 4. 让 Codex 执行安装、写配置、跑 `foxclaw doctor`。
-5. 启动服务后，在 Telegram bot 里发送 `/help` 和 `/status` 验证。
+5. 启动服务后，在每个配置的 Telegram bot 私聊里发送 `/help`、`/status` 和 `/auth` 验证。
 
 ## 注意事项
 
 - 不要让 agent 把完整 bot token 打印到日志或提交到仓库。
 - 第一次请先用私聊模式跑通。
+- 多个 token 会在同一服务中建立多个独立 Codex home、session 与 auth 选择；群组中必须点名或回复目标 bot。
+- 同时启用微信时，微信仍使用默认 Codex runtime，不共享隔离 Telegram bot 的线程。
 - 不要把整个 home 目录或根目录作为首次 `DEFAULT_CWD`。
 - 只有在 `doctor` 通过、服务已启动、Telegram 首条消息验证通过后，才算安装完成。

package/docs/zh/install-for-beginners.md

@@ -121,7 +121,7 @@ npm install -g @foxden-app/foxclaw
 foxclaw init
 ```
 
-这会创建默认配置文件 `~/.foxclaw/.env`，并提示你填写 Telegram bot token、Telegram 数字用户 ID 和默认工作目录。
+这会创建默认配置文件 `~/.foxclaw/.env`，并提示你填写一个或多个 Telegram bot token（多个用英文逗号分隔）、Telegram 数字用户 ID 和默认工作目录。新安装使用 `TG_BOT_TOKENS`；旧的 `TG_BOT_TOKEN` 仅用于兼容已有单 bot 配置。
 
 如果你用 pnpm：
 
@@ -152,6 +152,14 @@ DEFAULT_SANDBOX_MODE=workspace-write
 
 `TG_ALLOWED_CHAT_ID=` 和 `TG_ALLOWED_TOPIC_ID=` 第一次保持为空，不要删掉这两行；留空表示私聊模式。
 
+只有一个 bot 时先按上面的配置跑通即可。需要三条互不打断的 Codex 会话时，把多个 token 写在同一行：
+
+```dotenv
+TG_BOT_TOKENS=123456789:token_a,234567890:token_b,345678901:token_c
+```
+
+FoxClaw 仍只安装一个服务，但每个 bot 会有独立 app-server、会话目录和当前 auth。服务启动后请分别私聊每个 bot 发送 `/help` 与 `/status`。
+
 `DEFAULT_CWD` 必须是真实存在的目录，例如：
 
 ```dotenv
@@ -278,7 +286,7 @@ foxclaw uninstall-systemd
 foxclaw update
 ```
 
-也可以在已授权的 Telegram 私聊里发送 `/update`。它会在所有 bot 都没有运行中回复、审批或待确认问题时，尝试升级 npm/pnpm 安装的 Codex CLI，完成 FoxClaw 升级、自检和服务重启，并在重启后回报结果。
+也可以在已授权的 Telegram 私聊里发送 `/update`。它会在所有 Telegram bot、已启用的微信默认 runtime 和 auth 镜像写入都空闲时，尝试升级 npm/pnpm 安装的 Codex CLI，完成 FoxClaw 升级、自检和服务重启，并在发起命令的 bot 中回报结果。
 
 如果 `~/.foxclaw/.env` 已经存在，`foxclaw init` 会先询问是否更新 Telegram 和工作目录相关字段，其它配置保持不变。
 

package/docs/zh/troubleshooting.md

@@ -183,6 +183,18 @@ Bridge 日志默认在：
 tail -f ~/.foxclaw/logs/service.log
 ```
 
+## 多 bot 模式核查
+
+配置 `TG_BOT_TOKENS` 后，`foxclaw status` 的 `bots` 列表应为每个 token 显示一个 bot id、连接状态和独立 app-server。私聊任一 bot 发送 `/status` 会显示全部 runtime 摘要；发送 `/auth` 应显示当前 `@botname` 和该 bot 的 auth 目录。
+
+每个隔离 app-server 的日志路径为：
+
+```bash
+tail -f ~/.foxclaw/logs/codex-app-server-bot<id>.log
+```
+
+群组里配置了多个 bot 时，普通未点名消息不会触发它们；使用 `@botname`、回复目标 bot，或 `/status@botname`。微信启用后仍使用默认 Codex runtime，不会出现在某个 Telegram bot 的隔离线程中。
+
 ## ChatGPT 后端 403 或 Unable to load site
 
 如果 Telegram 里看到 `ChatGPT backend 403 Forbidden`，或者 app-server 日志里出现 `Unable to load site`、`cf-ray`、`chatgpt.com/backend-api`，通常不是 `auth.json` 文件坏了，而是服务进程访问 ChatGPT 后端时没有走正确网络。

package/docs/zh/user-manual.md

@@ -230,10 +230,10 @@ TG_ALLOWED_TOPIC_ID=42
 
 ### 3.2 `/status`、`/account`、`/quota`、`/update`
 
-- `/status`：查看 FoxClaw、app-server、当前绑定线程、模型、权限和 Codex 用量摘要。本地 session/Token/可见答复吞吐使用后台生成的历史快照，避免状态查询现场扫描大量日志；答复吞吐按完成轮次端到端耗时计算，排除推理 token，但包含等待与工具执行时间。
+- `/status`：查看 FoxClaw、app-server、当前绑定线程、模型、权限和 Codex 用量摘要。多 bot 模式还会列出所有 bot 的连接、当前 auth、活动 turn，以及最近一次 auth 镜像和服务/Codex 升级结果。本地 session/Token/可见答复吞吐使用后台生成的历史快照，避免状态查询现场扫描大量日志；答复吞吐按完成轮次端到端耗时计算，排除推理 token，但包含等待与工具执行时间。
 - `/account`：查看当前 Codex 登录账号。
 - `/quota`：查看 Codex 用量和额度窗口。
-- `/update`：升级 FoxClaw，并尝试升级 npm/pnpm 安装的 Codex CLI，然后自检和重启服务；任意 bot runtime 有运行中回复、审批或待确认问题时都会拒绝执行，重启后会回报结果。
+- `/update`：升级 FoxClaw，并尝试升级 npm/pnpm 安装的 Codex CLI，然后自检和重启服务；任意 Telegram bot、启用的微信默认 runtime 或 auth 镜像写入不空闲时都会拒绝执行，重启后通过发起命令的 bot 回报结果。
 
 ### 3.3 `/config`、`/requirements`、`/provider`
 
@@ -335,7 +335,7 @@ FoxClaw 的聊天是“绑定线程”的。你在手机上打开某个 Codex
 
 ## 6. Codex 登录和 auth 轮转
 
-这是 FoxClaw 的特色功能。Codex 的登录状态通常保存在 `~/.codex/auth.json`。FoxClaw 把多个账号保存成候选文件，并通过切换 `auth.json` 指向哪个候选来换号。启用 `TG_BOT_TOKENS` 多 bot 模式后，每个 bot 使用独立 Codex home、独立 app-server 和独立当前候选，因此可以并行运行、单独切号；已验证的登录/刷新凭据会安全镜像到其他 bot home。
+这是 FoxClaw 的特色功能。Codex 的登录状态通常保存在 `~/.codex/auth.json`。FoxClaw 把多个账号保存成候选文件，并通过切换 `auth.json` 指向哪个候选来换号。启用 `TG_BOT_TOKENS` 多 bot 模式后，每个 bot 使用独立 Codex home、独立 app-server 和独立当前候选，因此可以并行运行、单独切号；隔离 Telegram runtime 会强制使用文件凭据存储。已验证的登录/刷新凭据会安全镜像到其他 bot home，但不会共享 session。
 
 ### 6.1 文件格式
 
@@ -387,7 +387,7 @@ cp -L ~/.codex/auth.json ~/.codex/auth.json_personal
 
 ### 6.3 `/auth` 面板
 
-`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。
+`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。
 
 示意：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.3.19",
+  "version": "0.4.0",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",

package/skills/foxclaw/SKILL.md

@@ -65,6 +65,8 @@ Telegram behavior:
 - private chat with `TG_ALLOWED_USER_ID` remains available even when `TG_ALLOWED_CHAT_ID` or `TG_ALLOWED_TOPIC_ID` is set
 - `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` choose the default group or topic scope; they do not disable private chat
 - when `TG_BOT_TOKENS` contains multiple bots, one FoxClaw service starts independent Codex app-servers and auth selections per bot
+- isolated Telegram runtimes use independent `CODEX_HOME` directories and file-backed credentials; they do not share Codex sessions
+- if Weixin is enabled alongside multiple Telegram bots, it remains on the default Codex runtime instead of borrowing a Telegram bot runtime
 - in a group with multiple configured bots, address a bot by mention, reply, or suffixed command such as `/status@botname`
 
 If `TG_ALLOWED_CHAT_ID` or `TG_ALLOWED_TOPIC_ID` is missing, read [references/telegram-setup.md](./references/telegram-setup.md) and explicitly guide the user through collecting it.
@@ -142,7 +144,8 @@ After either bootstrap path:
    - `privacy mode` is disabled
    - the bot is an admin in the group
    - the configured `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` match the target group/topic
-5. If group or topic mode is enabled, also verify that private chat still responds for the configured `TG_ALLOWED_USER_ID`.
+5. If group or topic mode is enabled, also verify that private chat still responds for the configured `TG_ALLOWED_USER_ID`.
+6. With multiple bots, send `/status` and `/auth` privately to each bot; verify the status lists each app-server and the auth panel names the intended bot runtime.
 
 ## First Telegram Message Check
 
@@ -192,7 +195,7 @@ Use this checklist when the user asks for standard closing actions, release wrap
    - For macOS launchd, use the launchd install/start path from this skill and verify with `node dist/main.js status`.
    - Verify the running service reports the expected FoxClaw version in `status`.
    - If `doctor` fails only because `DEFAULT_CWD` is missing, report that separately; do not treat it as evidence that the service update failed.
-   - `/update` now attempts to update globally npm/pnpm-managed Codex CLI installations and refuses to restart while any configured bot runtime is busy.
+   - `/update` now attempts to update globally npm/pnpm-managed Codex CLI installations and refuses to restart while any configured Telegram runtime, enabled Weixin default runtime, or auth mirror write is busy.
 7. Publish to npm when requested:
    - Prefer GitHub Actions trusted publishing via `.github/workflows/publish.yml`: bump and commit the package version, push `main`, then push a matching `v<version>` tag. The tag version must match `package.json`.
    - Treat `workflow_dispatch` only as a retry path from an existing matching release tag; do not manually run publishing from `main`.

package/skills/foxclaw/references/telegram-setup.md

@@ -34,6 +34,7 @@ Behavior:
 - `TG_ALLOWED_CHAT_ID` + `TG_ALLOWED_TOPIC_ID`: that topic becomes the default scope
 - Private chat with `TG_ALLOWED_USER_ID` still works in every mode above
 - Multiple tokens start independent Codex runtimes in one FoxClaw service; group messages must mention or reply to the intended bot
+- Each bot keeps its own Codex home, sessions, and current auth selection; verify it privately with `/status` and `/auth`
 
 If multiple bots share one group, keep the same `TG_ALLOWED_CHAT_ID`; use explicit `@botname` mentions or replies. Separate topics are still useful for organization.
 
@@ -71,8 +72,9 @@ If the bridge is still polling, it may consume the update before you inspect it.
 
 After the bridge is started:
 
-1. Private chat mode:
-   - send `/help` to the bot in private chat
+1. Private chat mode:
+   - send `/help` to the bot in private chat
+   - for each configured bot, send `/status` and `/auth` and confirm its isolated runtime is shown
    - send one plain-language message such as `show /status`
 2. Group mode:
    - send `/help` in the configured group or default topic