@foxden-app/foxclaw 0.4.0 → 0.4.1

package/dist/auth/mirror.d.ts

@@ -4,6 +4,7 @@ export interface AuthMirrorRuntime {
     label?: string;
     authDir: string;
     notify?: (message: string) => Promise<void>;
+    validate?: (context: AuthMirrorValidationContext) => Promise<AuthMirrorValidationResult | boolean>;
 }
 export interface AuthMirrorStatus {
     candidateName: string;
@@ -11,6 +12,15 @@ export interface AuthMirrorStatus {
     sourceLabel: string;
     syncedAt: string;
 }
+export interface AuthMirrorValidationContext {
+    candidateName: string;
+    accountId: string;
+    lastRefreshMs: number;
+}
+export interface AuthMirrorValidationResult {
+    ok: boolean;
+    reason?: string | null;
+}
 export declare class AuthCandidateMirror {
     private readonly canonicalDir;
     private readonly runtimes;
@@ -29,6 +39,7 @@ export declare class AuthCandidateMirror {
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
     private scan;
     private propagateValidatedCandidate;
+    private validateRuntimeCandidate;
     private withActivity;
     private ensureCanonicalDefaultCandidate;
     private collectCandidateNames;

package/dist/auth/mirror.js

@@ -96,6 +96,15 @@ export class AuthCandidateMirror {
         if (record.lastRefreshMs <= previousRefresh) {
             return false;
         }
+        const validation = await this.validateRuntimeCandidate(runtime, name, record);
+        if (!validation.ok) {
+            this.logger.warn('auth.mirror.validation_failed', {
+                runtimeId: runtime.id,
+                name,
+                reason: validation.reason ?? 'unknown',
+            });
+            return false;
+        }
         await atomicWrite(canonicalPath, record.raw);
         for (const target of this.runtimes) {
             if (target.id !== runtime.id) {
@@ -116,6 +125,25 @@ export class AuthCandidateMirror {
         await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
         return true;
     }
+    async validateRuntimeCandidate(runtime, name, record) {
+        if (!runtime.validate) {
+            return { ok: true };
+        }
+        try {
+            const result = await runtime.validate({
+                candidateName: name,
+                accountId: record.accountId,
+                lastRefreshMs: record.lastRefreshMs,
+            });
+            if (typeof result === 'boolean') {
+                return { ok: result };
+            }
+            return { ok: Boolean(result.ok), reason: result.reason ?? null };
+        }
+        catch (error) {
+            return { ok: false, reason: formatError(error) };
+        }
+    }
     async withActivity(operation) {
         this.activeOperations += 1;
         try {

package/dist/main.js

@@ -197,6 +197,7 @@ async function runServeCli() {
                 id: runtime.id,
                 label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
                 authDir: runtime.home,
+                validate: async (context) => validateRefreshedAuthCandidate(runtime, context.candidateName),
                 notify: async (message) => {
                     const chatId = store.getTelegramPrivateChatId(runtime.id);
                     if (chatId) {
@@ -412,6 +413,26 @@ async function runServeCli() {
         throw error;
     }
 }
+async function validateRefreshedAuthCandidate(runtime, candidateName) {
+    const authPath = path.join(runtime.home, 'auth.json');
+    const candidatePath = path.join(runtime.home, candidateName);
+    const [currentTarget, candidateTarget] = await Promise.all([
+        fs.promises.realpath(authPath).catch(() => null),
+        fs.promises.realpath(candidatePath).catch(() => null),
+    ]);
+    if (!currentTarget || !candidateTarget || currentTarget !== candidateTarget) {
+        return { ok: false, reason: 'candidate is not the current auth target' };
+    }
+    if (!runtime.app.isConnected()) {
+        return { ok: false, reason: 'source app-server is not connected' };
+    }
+    const account = await runtime.app.readAccount();
+    if (!account || account.type !== 'chatgpt' || account.requiresOpenaiAuth) {
+        return { ok: false, reason: 'source app-server did not report an active ChatGPT account' };
+    }
+    await runtime.app.readAccountRateLimits();
+    return { ok: true };
+}
 async function initConfig() {
     const envPath = process.env.FOXCLAW_ENV?.trim() || DEFAULT_ENV_PATH;
     fs.mkdirSync(path.dirname(envPath), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",