@foxden-app/foxclaw 0.3.7 → 0.3.10

package/dist/controller/controller.d.ts

@@ -249,6 +249,8 @@ export declare class BridgeSessionCore {
     private retryTurnAfterAuthRotation;
     private selectNextCodexAuthCandidate;
     private listCodexAuthState;
+    private readCodexAuthSwitchLabels;
+    private codexAuthSwitchParams;
     private switchCodexAuthAndRestart;
     private buildNativeCollaborationMode;
     private buildCodexUsageStatusLines;

package/dist/controller/controller.js

@@ -3693,7 +3693,8 @@ export class BridgeSessionCore {
             await this.sendMessage(scopeId, renderAuthListMessage(locale, state, parseWeixinBridgeScope(scopeId) !== null));
             return;
         }
-        await this.sendMessage(scopeId, t(locale, 'auth_switching', { value: candidate.name }));
+        const switchLabels = await this.readCodexAuthSwitchLabels(candidate);
+        await this.sendMessage(scopeId, t(locale, 'auth_switching', this.codexAuthSwitchParams(locale, switchLabels.fromLabel, switchLabels.toLabel)));
         await this.switchCodexAuthAndRestart(scopeId, locale, candidate, false);
     }
     async handleAuthToggleCommand(scopeId, locale, args, disabled) {
@@ -4190,8 +4191,10 @@ export class BridgeSessionCore {
         }
         await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_choice_recorded'));
         this.pendingAuthChoiceLists.delete(localId);
+        const switchLabels = await this.readCodexAuthSwitchLabels(candidate);
+        const switchingMessage = t(locale, 'auth_switching', this.codexAuthSwitchParams(locale, switchLabels.fromLabel, switchLabels.toLabel));
         if (record.messageId !== null) {
-            await this.editMessage(event.scopeId, record.messageId, t(locale, 'auth_switching', { value: candidate.name }), []);
+            await this.editMessage(event.scopeId, record.messageId, switchingMessage, []);
         }
         await this.switchCodexAuthAndRestart(event.scopeId, locale, candidate, false);
     }
@@ -4207,16 +4210,17 @@ export class BridgeSessionCore {
         this.authRotationInProgress = true;
         try {
             const failedTargets = rotation.retry?.failedAuthTargets ?? this.authRotationFailedTargets;
-            const candidate = await this.selectNextCodexAuthCandidate(failedTargets);
+            const selection = await this.selectNextCodexAuthCandidate(failedTargets);
             const locale = this.localeForChat(rotation.scopeId);
-            if (!candidate) {
+            if (!selection) {
                 await this.sendMessage(rotation.scopeId, t(locale, 'auth_auto_no_candidate', {
                     error: formatShortStatusError(rotation.reason),
                 }));
                 return false;
             }
+            const { candidate, fromLabel, toLabel } = selection;
             await this.sendMessage(rotation.scopeId, t(locale, 'auth_auto_switching', {
-                value: candidate.name,
+                ...this.codexAuthSwitchParams(locale, fromLabel, toLabel),
                 error: formatShortStatusError(rotation.reason),
             }));
             await this.switchCodexAuthAndRestart(rotation.scopeId, locale, candidate, true);
@@ -4290,21 +4294,35 @@ export class BridgeSessionCore {
         for (let offset = 1; offset <= state.candidates.length; offset += 1) {
             const candidate = state.candidates[(currentIndex + offset + state.candidates.length) % state.candidates.length];
             if (candidate && !candidate.disabled && !failedTargets.has(candidate.path)) {
-                return candidate;
+                return { candidate, fromLabel: state.currentLabel, toLabel: await authPathDisplayLabel(candidate.path) };
             }
         }
-        return candidates[0] ?? null;
+        const candidate = candidates[0] ?? null;
+        return candidate ? { candidate, fromLabel: state.currentLabel, toLabel: await authPathDisplayLabel(candidate.path) } : null;
     }
     async listCodexAuthState() {
         return listCodexAuthState(this.store.listDisabledCodexAuthCandidateNames());
     }
+    async readCodexAuthSwitchLabels(candidate) {
+        const state = await this.listCodexAuthState();
+        return {
+            fromLabel: state.currentLabel,
+            toLabel: await authPathDisplayLabel(candidate.path),
+        };
+    }
+    codexAuthSwitchParams(locale, fromLabel, toLabel) {
+        return {
+            from: fromLabel ?? t(locale, 'none'),
+            to: toLabel,
+        };
+    }
     async switchCodexAuthAndRestart(scopeId, locale, candidate, automatic) {
-        await switchCodexAuth(candidate.path);
+        const result = await switchCodexAuth(candidate.path);
         this.authRotationFailedTargets.delete(candidate.path);
         this.pendingTurnErrors.clear();
         this.attachedThreads.clear();
         await this.app.restart();
-        const lines = [t(locale, automatic ? 'auth_auto_done' : 'auth_switch_done', { value: candidate.name })];
+        const lines = [t(locale, automatic ? 'auth_auto_done' : 'auth_switch_done', this.codexAuthSwitchParams(locale, result.fromLabel, result.toLabel))];
         lines.push(...await this.buildCodexUsageStatusLines(locale));
         await this.sendMessage(scopeId, lines.join('\n'));
     }
@@ -4599,8 +4617,8 @@ export class BridgeSessionCore {
             };
             const text = formatThreadsMessage(locale, threadLikes, binding.threadId, listState.searchTerm, listState);
             const keyboard = parseWeixinBridgeScope(scopeId)
-                ? buildThreadsKeyboard(locale, threadLikes)
-                : buildThreadListKeyboard(locale, threadLikes, listState);
+                ? buildThreadsKeyboard(locale, threadLikes, binding.threadId)
+                : buildThreadListKeyboard(locale, threadLikes, listState, binding.threadId);
             await this.editHtmlMessage(scopeId, event.messageId, text, keyboard);
         }
         let callbackText = t(locale, 'thread_opened');
@@ -5040,13 +5058,14 @@ export class BridgeSessionCore {
                 threadId: row.threadId,
                 name: row.name,
                 preview: row.preview,
+                cwd: row.cwd,
                 archived: row.archived,
             }));
             text += `\n\n${formatWeixinThreadsCopyPaste(locale, rows, searchTerm ?? null, offset)}`;
         }
         const keyboard = parseWeixinBridgeScope(scopeId)
-            ? buildThreadsKeyboard(locale, forDisplay)
-            : buildThreadListKeyboard(locale, forDisplay, presentationState);
+            ? buildThreadsKeyboard(locale, forDisplay, binding?.threadId ?? null)
+            : buildThreadListKeyboard(locale, forDisplay, presentationState, binding?.threadId ?? null);
         if (messageId !== undefined) {
             await this.editHtmlMessage(scopeId, messageId, text, keyboard);
             return;
@@ -6913,7 +6932,7 @@ async function listCodexAuthState(disabledNames = new Set()) {
         authDir,
         authPath,
         currentTargetPath,
-        currentLabel: currentTargetPath ? path.basename(currentTargetPath) : null,
+        currentLabel: currentTargetPath ? await authPathDisplayLabel(currentTargetPath) : null,
         candidates,
     };
 }
@@ -6946,6 +6965,27 @@ async function resolveCurrentAuthTarget(authDir, authPath) {
     }
     return authPath;
 }
+async function resolveAuthFinalTargetPath(startPath) {
+    let currentPath = startPath;
+    const seen = new Set();
+    for (let depth = 0; depth < 20; depth += 1) {
+        const absolutePath = path.resolve(currentPath);
+        if (seen.has(absolutePath)) {
+            return currentPath;
+        }
+        seen.add(absolutePath);
+        const stat = await fs.lstat(currentPath).catch(() => null);
+        if (!stat?.isSymbolicLink()) {
+            return currentPath;
+        }
+        const target = await fs.readlink(currentPath);
+        currentPath = path.resolve(path.dirname(currentPath), target);
+    }
+    return currentPath;
+}
+async function authPathDisplayLabel(authPath) {
+    return path.basename(await resolveAuthFinalTargetPath(authPath));
+}
 async function pointCodexAuthAtTarget(authDir, authPath, targetPath) {
     await fs.mkdir(authDir, { recursive: true });
     const tempLink = path.join(authDir, `.auth.json.${process.pid}.${Date.now()}.tmp`);
@@ -6965,6 +7005,10 @@ async function switchCodexAuth(targetPath) {
         throw new Error(`Auth candidate is no longer available: ${path.basename(targetPath)}`);
     }
     await pointCodexAuthAtTarget(state.authDir, state.authPath, candidate.path);
+    return {
+        fromLabel: state.currentLabel,
+        toLabel: await authPathDisplayLabel(candidate.path),
+    };
 }
 function renderAuthListMessage(locale, state, includeWeixinCopyPaste = false) {
     const lines = [

package/dist/controller/presentation.d.ts

@@ -33,12 +33,12 @@ export interface ThreadListPresentationState {
     archived?: boolean;
 }
 export declare function formatThreadsMessage(locale: AppLocale, threads: ThreadLike[], currentThreadId: string | null, searchTerm?: string | null, listState?: ThreadListPresentationState): string;
-export declare function buildThreadsKeyboard(locale: AppLocale, threads: ThreadLike[]): Array<Array<{
+export declare function buildThreadsKeyboard(locale: AppLocale, threads: ThreadLike[], currentThreadId?: string | null): Array<Array<{
     text: string;
     callback_data: string;
 }>>;
 /** Threads keyboard plus Prev/Next and optional clear-filter row (Telegram only). */
-export declare function buildThreadListKeyboard(locale: AppLocale, threads: ThreadLike[], listState: ThreadListPresentationState): Array<Array<{
+export declare function buildThreadListKeyboard(locale: AppLocale, threads: ThreadLike[], listState: ThreadListPresentationState, currentThreadId?: string | null): Array<Array<{
     text: string;
     callback_data: string;
 }>>;
@@ -51,6 +51,7 @@ export interface WeixinCopyPasteThreadRow {
     threadId: string;
     name: string | null;
     preview: string;
+    cwd?: string | null;
     archived?: boolean;
 }
 export declare function formatWeixinThreadsCopyPaste(locale: AppLocale, threads: WeixinCopyPasteThreadRow[], searchTerm?: string | null, 

package/dist/controller/presentation.js

@@ -24,7 +24,7 @@ export function formatThreadsMessage(locale, threads, currentThreadId, searchTer
         }));
     }
     if (currentThread) {
-        const currentTitle = truncate(compactWhitespace(currentThread.name || currentThread.preview || t(locale, 'empty')), 40);
+        const currentTitle = truncate(formatThreadDisplayName(locale, currentThread), 40);
         headerLines.push(t(locale, 'threads_current', { title: escapeTelegramHtml(currentTitle) }));
         headerLines.push(escapeTelegramHtml([
             formatCwd(locale, currentThread.cwd),
@@ -32,13 +32,16 @@ export function formatThreadsMessage(locale, threads, currentThreadId, searchTer
             formatStatusLabel(locale, currentThread.status),
         ].filter(Boolean).join(' | ')));
     }
+    headerLines.push('', ...threads.map((thread, index) => formatThreadListLine(locale, thread, currentThreadId, index)));
     return headerLines.join('\n');
 }
-export function buildThreadsKeyboard(locale, threads) {
+export function buildThreadsKeyboard(locale, threads, currentThreadId = null) {
     return threads.flatMap((thread, index) => {
         const ordinal = typeof thread.index === 'number' ? thread.index : index + 1;
+        const selected = currentThreadId === thread.threadId;
+        const prefix = selected ? '✅ ' : '';
         const openRow = [{
-                text: `🧵 ${ordinal}. ${truncate(compactWhitespace(thread.name || thread.preview || t(locale, 'empty')), 28)}`,
+                text: `${prefix}${ordinal}. ${truncate(formatThreadDisplayName(locale, thread), 48)}`,
                 callback_data: `thread:open:${thread.threadId}`,
             }];
         const actionRow = thread.archived
@@ -52,9 +55,15 @@ export function buildThreadsKeyboard(locale, threads) {
         return [openRow, actionRow];
     });
 }
+function formatThreadListLine(locale, thread, currentThreadId, index) {
+    const ordinal = typeof thread.index === 'number' ? thread.index : index + 1;
+    const prefix = currentThreadId === thread.threadId ? '✅ ' : '';
+    const title = truncate(formatThreadDisplayName(locale, thread), 72);
+    return `${prefix}${ordinal}. ${escapeTelegramHtml(title)}`;
+}
 /** Threads keyboard plus Prev/Next and optional clear-filter row (Telegram only). */
-export function buildThreadListKeyboard(locale, threads, listState) {
-    const rows = buildThreadsKeyboard(locale, threads);
+export function buildThreadListKeyboard(locale, threads, listState, currentThreadId = null) {
+    const rows = buildThreadsKeyboard(locale, threads, currentThreadId);
     rows.push([{ text: t(locale, 'button_new_thread'), callback_data: 'thread:new' }]);
     const navigationRow = [];
     if (listState.hasPreviousPage) {
@@ -142,7 +151,7 @@ pageOffset = 0) {
         for (let i = 0; i < threads.length; i += 1) {
             const index = pageOffset + i + 1;
             const thread = threads[i];
-            const title = truncate(compactWhitespace(thread.name || thread.preview || t(locale, 'empty')), 40);
+            const title = truncate(formatThreadDisplayName(locale, thread), 40);
             lines.push(`${index}. ${title}`);
             if (thread.archived) {
                 lines.push(`/thread_unarchive ${index}`);
@@ -534,6 +543,11 @@ function formatCwd(locale, cwd) {
     const base = path.basename(cwd);
     return base || cwd;
 }
+function formatThreadDisplayName(locale, thread) {
+    const folder = compactWhitespace(formatCwd(locale, thread.cwd ?? null));
+    const title = compactWhitespace(thread.name || thread.preview || t(locale, 'empty'));
+    return `${folder}|${title}`;
+}
 function compactWhitespace(value) {
     return value.replace(/\s+/g, ' ').trim();
 }

package/dist/i18n.d.ts

@@ -133,10 +133,10 @@ declare const MESSAGES: {
         readonly auth_choice_expired: "This auth list is no longer active";
         readonly auth_choice_mismatch: "Auth choice does not match this message";
         readonly auth_choice_recorded: "Auth selected";
-        readonly auth_switching: "Switching Codex auth to {value}...";
-        readonly auth_switch_done: "Codex auth switched to {value}.";
-        readonly auth_auto_switching: "Codex auth problem detected ({error}). Switching to {value}...";
-        readonly auth_auto_done: "Auto-switched Codex auth to {value}.";
+        readonly auth_switching: "Switching Codex auth: {from} -> {to}...";
+        readonly auth_switch_done: "Codex auth switched: {from} -> {to}.";
+        readonly auth_auto_switching: "Codex auth problem detected ({error}). Switching: {from} -> {to}...";
+        readonly auth_auto_done: "Auto-switched Codex auth: {from} -> {to}.";
         readonly auth_auto_retrying: "Retrying the same request with the new auth...";
         readonly auth_auto_retry_thread_missing: "Auth was switched, but the original thread is no longer available ({threadId}). Retry was stopped to avoid creating duplicate sessions.";
         readonly auth_auto_no_candidate: "Codex auth problem detected ({error}), but no unused auth candidate is available.";
@@ -683,10 +683,10 @@ declare const MESSAGES: {
         readonly auth_choice_expired: "这个 auth 列表已经不再有效";
         readonly auth_choice_mismatch: "这个 auth 选择按钮不属于当前消息";
         readonly auth_choice_recorded: "已选择 auth";
-        readonly auth_switching: "正在切换 Codex auth 到 {value}...";
-        readonly auth_switch_done: "Codex auth 已切换到 {value}。";
-        readonly auth_auto_switching: "检测到 Codex auth 问题（{error}），正在切换到 {value}...";
-        readonly auth_auto_done: "已自动切换 Codex auth 到 {value}。";
+        readonly auth_switching: "正在切换 Codex auth：{from} -> {to}...";
+        readonly auth_switch_done: "Codex auth 已切换：{from} -> {to}。";
+        readonly auth_auto_switching: "检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...";
+        readonly auth_auto_done: "已自动切换 Codex auth：{from} -> {to}。";
         readonly auth_auto_retrying: "正在用新的 auth 重试同一条请求...";
         readonly auth_auto_retry_thread_missing: "Auth 已切换，但原线程已经不可用（{threadId}）。已停止重试，避免创建重复 session。";
         readonly auth_auto_no_candidate: "检测到 Codex auth 问题（{error}），但没有可用的未失败候选 auth。";

package/dist/i18n.js

@@ -131,10 +131,10 @@ const MESSAGES = {
         auth_choice_expired: 'This auth list is no longer active',
         auth_choice_mismatch: 'Auth choice does not match this message',
         auth_choice_recorded: 'Auth selected',
-        auth_switching: 'Switching Codex auth to {value}...',
-        auth_switch_done: 'Codex auth switched to {value}.',
-        auth_auto_switching: 'Codex auth problem detected ({error}). Switching to {value}...',
-        auth_auto_done: 'Auto-switched Codex auth to {value}.',
+        auth_switching: 'Switching Codex auth: {from} -> {to}...',
+        auth_switch_done: 'Codex auth switched: {from} -> {to}.',
+        auth_auto_switching: 'Codex auth problem detected ({error}). Switching: {from} -> {to}...',
+        auth_auto_done: 'Auto-switched Codex auth: {from} -> {to}.',
         auth_auto_retrying: 'Retrying the same request with the new auth...',
         auth_auto_retry_thread_missing: 'Auth was switched, but the original thread is no longer available ({threadId}). Retry was stopped to avoid creating duplicate sessions.',
         auth_auto_no_candidate: 'Codex auth problem detected ({error}), but no unused auth candidate is available.',
@@ -681,10 +681,10 @@ const MESSAGES = {
         auth_choice_expired: '这个 auth 列表已经不再有效',
         auth_choice_mismatch: '这个 auth 选择按钮不属于当前消息',
         auth_choice_recorded: '已选择 auth',
-        auth_switching: '正在切换 Codex auth 到 {value}...',
-        auth_switch_done: 'Codex auth 已切换到 {value}。',
-        auth_auto_switching: '检测到 Codex auth 问题（{error}），正在切换到 {value}...',
-        auth_auto_done: '已自动切换 Codex auth 到 {value}。',
+        auth_switching: '正在切换 Codex auth：{from} -> {to}...',
+        auth_switch_done: 'Codex auth 已切换：{from} -> {to}。',
+        auth_auto_switching: '检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...',
+        auth_auto_done: '已自动切换 Codex auth：{from} -> {to}。',
         auth_auto_retrying: '正在用新的 auth 重试同一条请求...',
         auth_auto_retry_thread_missing: 'Auth 已切换，但原线程已经不可用（{threadId}）。已停止重试，避免创建重复 session。',
         auth_auto_no_candidate: '检测到 Codex auth 问题（{error}），但没有可用的未失败候选 auth。',

package/dist/main.js

@@ -8,7 +8,8 @@ import { fileURLToPath } from 'node:url';
 import { APP_HOME, DEFAULT_ENV_PATH, DEFAULT_LOG_PATH, DEFAULT_STATUS_PATH, getLoadedEnvPath, loadConfig, loadEnv, } from './config.js';
 import { acquireProcessLock, LockHeldError } from './lock.js';
 import { readRuntimeStatus, writeRuntimeStatus } from './runtime.js';
-const command = process.argv[2] || 'serve';
+const rawCommand = process.argv[2];
+const command = rawCommand || 'serve';
 loadEnv();
 const packageRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const entryPoint = fileURLToPath(import.meta.url);
@@ -23,6 +24,14 @@ const PROXY_ENV_KEYS = [
     'no_proxy',
 ];
 async function main() {
+    if (isVersionCommand(command)) {
+        console.log(readPackageVersion());
+        return;
+    }
+    if (isHelpCommand(command)) {
+        printUsage();
+        return;
+    }
     if (command === 'init') {
         await initConfig();
         return;
@@ -73,9 +82,44 @@ async function main() {
         await runWeixinLoginCli();
         return;
     }
+    if (command !== 'serve') {
+        console.error(`Unknown command: ${command}`);
+        printUsage();
+        process.exit(1);
+    }
     requireNode24(command);
     await runServeCli();
 }
+function isVersionCommand(value) {
+    return value === 'version' || value === '--version' || value === '-v' || value === '-V';
+}
+function isHelpCommand(value) {
+    return value === 'help' || value === '--help' || value === '-h';
+}
+function readPackageVersion() {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+        return typeof pkg.version === 'string' && pkg.version.trim() ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+function printUsage() {
+    console.log(`FoxClaw ${readPackageVersion()}
+
+Usage:
+  foxclaw [serve]
+  foxclaw init
+  foxclaw doctor
+  foxclaw status
+  foxclaw start|restart|stop
+  foxclaw install-systemd|uninstall-systemd
+  foxclaw install-launchd
+  foxclaw weixin-login [account-id]
+  foxclaw --version
+  foxclaw --help`);
+}
 async function runServeCli() {
     const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter },] = await Promise.all([
         import('./channels/bridge_messaging_router.js'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.3.7",
+  "version": "0.3.10",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",
@@ -49,7 +49,7 @@
     "install-launchd": "node dist/main.js install-launchd",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
-    "test": "node --test --import tsx \"src/**/*.test.ts\"",
+    "test": "node --test --import tsx $(find src -name '*.test.ts' -print)",
     "prepack": "npm run build"
   },
   "dependencies": {

package/skills/foxclaw/SKILL.md

@@ -1,6 +1,6 @@
 ---
-name: foxclaw
-description: Deploy, configure, and validate FoxClaw on macOS, locally or over SSH. Use when Codex needs to clone or update the FoxClaw repo, collect Telegram bot and chat/topic values, write `.env`, enable a launchd service, and guide the user through the first Telegram message test. Trigger on requests about trusted chat interfaces controlling local Codex, copying FoxClaw to another Mac, remote FoxClaw deployment, or turning this repo into an installable Codex skill.
+name: foxclaw
+description: Deploy, configure, validate, develop, and release FoxClaw. Use when Codex needs to clone or update the FoxClaw repo, collect Telegram values, write `.env`, enable launchd/systemd, guide first-message tests, or perform FoxClaw repo wrap-up actions such as Chinese commit messages, push, npm publish, and local install/service update.
 ---
 
 # FoxClaw
@@ -158,10 +158,47 @@ Do this whenever the bridge has been started:
    - privacy mode still on
    - bot not admin in group
 
-Do not describe the setup as "done" until this smoke test has either passed or been blocked by missing Telegram-side access.
-
-## Resources
-
-- [references/telegram-setup.md](./references/telegram-setup.md): Telegram-side checklist and ID discovery
+Do not describe the setup as "done" until this smoke test has either passed or been blocked by missing Telegram-side access.
+
+## Development Wrap-Up
+
+Use this checklist when the user asks for standard closing actions, release wrap-up, local install updates, npm publish, or says things like "收尾动作", "中文 commit msg", "push", "npm publish", or "本地安装更新".
+
+1. Inspect scope before staging:
+   - `git status -sb`
+   - `git diff --stat`
+   - `git diff --name-status`
+2. Run the relevant verification with Node 24+. If the system `node` is older, prepend the known Node 24 bin path or use the repo's documented Node 24 shell.
+   - Code changes: `npm run typecheck`, `npm run lint`, `npm test`
+   - Package/release changes: also run `npm pack --dry-run`
+   - Skill-only changes: validate the skill folder, then run `npm pack --dry-run`
+3. Build before any local service restart:
+   - `npm run build`
+4. Commit intentionally:
+   - Stage only the changed files that belong to the task.
+   - Use a Chinese commit message when the user asked in Chinese or explicitly said "中文 commit msg".
+   - Never stage unrelated local changes.
+5. Push the current branch after a successful commit:
+   - `git push origin <branch>`
+6. Refresh the local install when requested:
+   - If the user has a pnpm global FoxClaw install, prefer `pnpm add -g <repo-path>` so the global `foxclaw` points at the local repo.
+   - Rebuild before restarting because local linked installs run `dist/main.js`.
+   - Refresh systemd with the existing service env path, for example `FOXCLAW_ENV=<existing-env> <node24> dist/main.js install-systemd`. Do not run `install-systemd` from the repo without `FOXCLAW_ENV`, because it may rewrite the service to use the repo `.env`.
+   - For macOS launchd, use the launchd install/start path from this skill and verify with `node dist/main.js status`.
+   - Verify the running service reports the expected FoxClaw version in `status`.
+   - If `doctor` fails only because `DEFAULT_CWD` is missing, report that separately; do not treat it as evidence that the service update failed.
+7. Publish to npm when requested:
+   - Prefer GitHub Actions trusted publishing via `.github/workflows/publish.yml`: bump and commit the package version, push `main`, then push a matching `v<version>` tag. The tag version must match `package.json`.
+   - Configure npmjs.com trusted publishing for `foxden-app/foxclaw` and workflow `publish.yml`; do not store npm tokens if OIDC trusted publishing is available.
+   - Temporary fallback: store an npm automation/bypass-2FA token as the GitHub Actions secret `NPM_TOKEN`. Never print the token or commit it.
+   - Check `npm whoami` and `npm view @foxden-app/foxclaw version`.
+   - If the target version is already published, bump with `npm version patch --no-git-tag-version` before validation and commit.
+   - Manual fallback only: run `BROWSER=true npm publish` in a TTY.
+   - If npm returns `ENEEDAUTH`, report that npm publish is blocked by registry login and leave the package unreported as published.
+   - Never print npm tokens or `.npmrc` auth values.
+
+## Resources
+
+- [references/telegram-setup.md](./references/telegram-setup.md): Telegram-side checklist and ID discovery
 - `scripts/bootstrap_host.py`: install and configure the bridge on the current Mac
 - `scripts/bootstrap_remote.py`: run the same bootstrap on another Mac over SSH

package/skills/foxclaw/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "FoxClaw"
-  short_description: "Install, configure, and validate Telegram Codex bridges"
-  default_prompt: "Use $foxclaw to clone the FoxClaw repo, collect Telegram values, write .env, start the service, and verify it with a first Telegram message."
+interface:
+  display_name: "FoxClaw"
+  short_description: "Install, validate, update, and release FoxClaw bridges"
+  default_prompt: "Use $foxclaw to clone or update FoxClaw, configure Telegram values, validate service health, or finish repo changes with commit, push, npm publish, and local install refresh."

package/skills/npm-publish/SKILL.md

@@ -5,7 +5,7 @@ description: Publish npm packages safely, especially packages that require npm 2
 
 # NPM Publish
 
-Use this skill to publish an npm package from a repo. Prefer the normal no-2FA publish path first. Fall back to npm web-auth only when npm explicitly prompts for it.
+Use this skill to publish an npm package from a repo. Prefer CI trusted publishing when the repository has a publish workflow. Prefer the normal no-2FA publish path first only when CI publishing is not available. Fall back to npm web-auth only when npm explicitly prompts for it.
 
 ## Release Checklist
 
@@ -43,6 +43,40 @@ Use this skill to publish an npm package from a repo. Prefer the normal no-2FA p
 
 ## Publish Flow
 
+### GitHub Actions Trusted Publishing
+
+Use this path when the repo has `.github/workflows/publish.yml` and npmjs.com has a trusted publisher configured for the package.
+
+1. Verify the package version is not already published:
+   ```bash
+   npm view <package-name> version
+   ```
+
+2. If needed, bump the package version and commit it before tagging:
+   ```bash
+   npm version patch --no-git-tag-version
+   git add package.json package-lock.json
+   git commit -m "<Chinese release message when appropriate>"
+   git push origin <branch>
+   ```
+
+3. Publish by pushing a matching version tag:
+   ```bash
+   git tag v<package-version>
+   git push origin v<package-version>
+   ```
+
+4. Watch the GitHub Actions `Publish` workflow. It must run lint, typecheck, tests, `npm pack --dry-run`, then `npm publish --access public` through trusted publishing.
+
+5. Verify the registry after the workflow succeeds:
+   ```bash
+   npm view <package-name> version
+   ```
+
+Do not store or print npm tokens when trusted publishing is available. If trusted publishing is not configured on npmjs.com, the workflow can use a GitHub Actions secret named `NPM_TOKEN` as a temporary fallback. Store only automation/bypass-2FA tokens there, never paste tokens in chat or commit them.
+
+### Manual Publish
+
 1. Start publish in a TTY and disable local browser opening. This works both when npm publishes directly and when it asks for web auth:
    ```bash
    BROWSER=true npm publish