@foxden-app/foxclaw 0.4.10 → 0.4.11

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.4.11 - 2026-06-02
+
+### 中文
+- `/auth` 面板改为每页 8 个候选，新增翻页、`全部 / 已启用 / 需关注` 筛选、文件名搜索和直接跳页命令，支持管理较大的本地候选清单。
+- 额度快照保存真实窗口时长与套餐类型，面板不再假定所有账号都有 5 小时和 7 天窗口；单一月额度账号可显示为 `30d:97`。
+- 候选摘要新增正常、额度偏低、额度耗尽、额度未知、长期未刷新、API key 和无效 auth 文件状态；超过约 8 天未刷新只作为维护提醒，不会触发批量保活刷新。
+
+### English
+- Paginated `/auth` at 8 candidates per page and added paging, `All / Enabled / Attention` filters, filename search, and direct page commands for larger local inventories.
+- Persisted observed quota-window lengths and plan types so the panel no longer assumes every account has 5-hour and 7-day windows; a single monthly allowance can render as `30d:97`.
+- Added ready, low-quota, exhausted, unknown, not-recently-refreshed, API-key, and invalid-auth-file summaries. The roughly 8-day stale hint remains informational and never triggers bulk keepalive refreshes.
+
 ## 0.4.10 - 2026-06-02
 
 ### 中文

package/README.md

@@ -16,7 +16,7 @@ FoxClaw（狸爪）的目标很直接：让你用手机控制本机的 Codex，
 
 1. **开源且接口完整** — Codex 是 OpenAI 开源的 CLI agent，并提供 `codex app-server`。FoxClaw 不是模拟终端输入，而是通过更完整的接口读取线程、切换模型、处理审批和恢复会话。
 2. **当前编码体验强** — FoxClaw 直接读取你本机 Codex 可用的模型列表；如果你的 Codex 环境已经有 GPT-5.5，就可以在手机端选择和使用它。对高强度编程工作流来说，Codex/GPT-5.5 的体感已经是很多人优先选择它的原因。
-3. **多账号额度切换** — 免费额度、一个月 Plus/Team 试用、多账号小额度都可以纳入本地 `auth.json_*` 候选。5 小时限制一到，FoxClaw 自动切换下一个可用账号、重启 app-server 并重试刚才的请求。
+3. **多账号额度切换** — 免费额度、Plus/Team 试用、多账号小额度都可以纳入本地 `auth.json_*` 候选。当前账号触发用量限制时，FoxClaw 自动切换下一个可用账号、重启 app-server 并重试刚才的请求。
 
 **适合这些场景：**
 
@@ -101,8 +101,8 @@ FoxClaw 只响应 `TG_ALLOWED_USER_ID` 的消息——把机器人拉进群不
 
 **多账号管理：**
 - Codex 账户管理：`/account`、`/quota`、`/login_device`、`/auth add <name>`
-- 触发用量限制时自动在本地 `auth.json_*` 之间切换认证——5 小时限制到了自动换号
-- `/auth` 面板查看、启用、禁用、切换候选账号；多 bot 模式下会按账号 ID 汇总各 runtime 最近掌握的额度快照
+- 触发用量限制时自动在本地 `auth.json_*` 之间切换认证
+- `/auth` 面板分页查看、筛选、启用、禁用、搜索和切换候选账号；额度按真实窗口展示，多 bot 模式下会按账号 ID 汇总各 runtime 最近掌握的额度快照
 
 **线程与会话：**
 - `/threads`、`/open`、`/new`、`/where`、`/interrupt`——稳定的聊天-线程绑定
@@ -119,7 +119,7 @@ FoxClaw 只响应 `TG_ALLOWED_USER_ID` 的消息——把机器人拉进群不
 
 ## 多账号切换
 
-FoxClaw 的一大特色是自动多账号切换。当一个账号的 5 小时用量限制触发时，FoxClaw 会自动切换到下一个可用账号继续工作。
+FoxClaw 的一大特色是自动多账号切换。当一个账号触发用量限制时，FoxClaw 会自动切换到下一个可用账号继续工作。
 
 设置方式：
 
@@ -128,6 +128,8 @@ FoxClaw 的一大特色是自动多账号切换。当一个账号的 5 小时用
 3. 用 `/auth` 查看所有候选账号状态。
 4. 用 `/auth enable <n>` / `/auth disable <n>` 控制哪些账号参与自动轮换。
 
+候选较多时，`/auth` 每页显示 8 个账号，并提供翻页、`全部 / 已启用 / 需关注` 筛选。也可以用 `/auth list <关键词>` 搜索文件名，或用 `/auth page <页码>` 直接跳页。额度窗口按 Codex 实际返回值展示，例如 `5h:20|7d:25` 或单月窗口 `30d:97`。
+
 当 Codex 报告用量限制错误时，FoxClaw 会自动：
 - 切换到下一个未失败的候选账号
 - 重启 app-server 加载新认证
@@ -258,7 +260,7 @@ FoxClaw 会把 `codex app-server` 作为 detached 子进程启动，记录其 pi
 - `/status`、`/account`、`/quota`、`/update`
 - `/quota_nudge <credits|usage_limit> confirm`
 - `/login_device`、`/login_cancel [id]`、`/logout confirm`
-- `/auth [list|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]`
+- `/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]`
 - `/threads [query]`、`/threads archived`、`/open <n>`
 - `/goal [objective|pause|resume|done|budget <tokens|off>|clear confirm]`
 - `/history [limit]`、`/files <query>`、`/remote`

package/README_EN.md

@@ -16,7 +16,7 @@ No public server required. FoxClaw runs on your own computer, talks to `codex ap
 
 1. **Open source with complete APIs** — Codex is OpenAI's open-source CLI agent and ships `codex app-server`. FoxClaw does not scrape a terminal; it uses the app-server interface to read threads, switch models, handle approvals, and resume sessions.
 2. **Strong current coding experience** — FoxClaw reads the model list from your local Codex app-server. If your Codex environment has GPT-5.5 available, you can select and use it from your phone. For many heavy coding workflows, Codex/GPT-5.5 is already the reason to choose this stack.
-3. **Multi-account quota rotation** — Free quota, trial Plus/Team accounts, and small account-specific allowances can all live as local `auth.json_*` candidates. When one account hits a 5-hour usage limit, FoxClaw switches to the next available account, restarts app-server, and retries the failed request.
+3. **Multi-account quota rotation** — Free quota, trial Plus/Team accounts, and small account-specific allowances can all live as local `auth.json_*` candidates. When one account hits a usage limit, FoxClaw switches to the next available account, restarts app-server, and retries the failed request.
 
 **Built for these scenarios:**
 
@@ -102,7 +102,7 @@ FoxClaw accepts messages only from `TG_ALLOWED_USER_ID`. Putting the bot in a gr
 **Multi-account management:**
 - Codex account controls: `/account`, `/quota`, `/login_device`, `/auth add <name>`
 - Automatic auth rotation across local `auth.json_*` files when a usage limit is hit — seamless account switching
-- `/auth` panel to view, enable, disable, and switch between candidate accounts; in multi-bot mode it merges recent quota snapshots by account ID across runtimes
+- Paginated `/auth` panel to filter, enable, disable, search, and switch candidate accounts; quota uses observed window lengths, and multi-bot mode merges recent snapshots by account ID across runtimes
 
 **Threads and sessions:**
 - `/threads`, `/open`, `/new`, `/where`, `/interrupt` — sticky chat-to-thread binding
@@ -119,7 +119,7 @@ FoxClaw accepts messages only from `TG_ALLOWED_USER_ID`. Putting the bot in a gr
 
 ## Multi-Account Rotation
 
-A key FoxClaw feature is automatic multi-account switching. When one account's 5-hour usage limit is triggered, FoxClaw automatically switches to the next available account and continues working.
+A key FoxClaw feature is automatic multi-account switching. When one account's usage limit is triggered, FoxClaw automatically switches to the next available account and continues working.
 
 Setup:
 
@@ -128,6 +128,8 @@ Setup:
 3. Use `/auth` to view all candidate account statuses.
 4. Use `/auth enable <n>` / `/auth disable <n>` to control which accounts participate in auto-rotation.
 
+For larger inventories, `/auth` shows 8 candidates per page with paging and `All / Enabled / Attention` filters. Use `/auth list <keyword>` to search filenames or `/auth page <n>` to jump directly. Quota windows use the values reported by Codex, for example `5h:20|7d:25` or a single monthly window such as `30d:97`.
+
 When Codex reports a usage-limit error, FoxClaw automatically:
 - Switches to the next non-failed candidate account
 - Restarts app-server to load the new auth
@@ -258,7 +260,7 @@ No static Codex app-server port is required in normal installs.
 - `/status`, `/account`, `/quota`, `/update`
 - `/quota_nudge <credits|usage_limit> confirm`
 - `/login_device`, `/login_cancel [id]`, `/logout confirm`
-- `/auth [list|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]`
+- `/auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]`
 - `/threads [query]`, `/threads archived`, `/open <n>`
 - `/goal [objective|pause|resume|done|budget <tokens|off>|clear confirm]`
 - `/history [limit]`, `/files <query>`, `/remote`

package/dist/controller/controller.d.ts

@@ -279,6 +279,7 @@ export declare class BridgeSessionCore {
     private listSkillsForScope;
     private requireReadyBinding;
     private handleAuthPanelActionCallback;
+    private handleAuthListViewCallback;
     private handleAuthToggleCallback;
     private handleAuthSwitchCallback;
     private maybeRunPendingAuthRotation;

package/dist/controller/controller.js

@@ -27,6 +27,9 @@ const DEFAULT_COLLABORATION_MODE = 'default';
 const CODEX_LOCAL_USAGE_REFRESH_MS = 30 * 60_000;
 const CODEX_LOCAL_USAGE_SNAPSHOT_FILENAME = 'codex-local-usage.json';
 const CODEX_AUTH_QUOTA_SNAPSHOT_FILENAME = 'codex-auth-quota.json';
+const CODEX_AUTH_LIST_PAGE_SIZE = 8;
+const CODEX_AUTH_LOW_QUOTA_PERCENT = 10;
+const CODEX_AUTH_STALE_CREDENTIAL_DAYS = 8;
 const USER_INPUT_SUBMITTED_NOTICE_MS = 90_000;
 const SELF_UPDATE_STATUS_POLL_MS = 1000;
 const PLAN_IMPLEMENTATION_CODING_MESSAGE = 'Implement the plan.';
@@ -1010,6 +1013,21 @@ export class BridgeSessionCore {
             await this.handleAuthToggleCallback(event, authToggleMatch[1], Number.parseInt(authToggleMatch[2], 10), locale);
             return;
         }
+        const authPageMatch = /^auth:([a-f0-9]+):page:(prev|next)$/.exec(event.data);
+        if (authPageMatch) {
+            await this.handleAuthListViewCallback(event, authPageMatch[1], authPageMatch[2], locale);
+            return;
+        }
+        const authFilterMatch = /^auth:([a-f0-9]+):filter:(all|enabled|attention)$/.exec(event.data);
+        if (authFilterMatch) {
+            await this.handleAuthListViewCallback(event, authFilterMatch[1], authFilterMatch[2], locale);
+            return;
+        }
+        const authClearSearchMatch = /^auth:([a-f0-9]+):clear_search$/.exec(event.data);
+        if (authClearSearchMatch) {
+            await this.handleAuthListViewCallback(event, authClearSearchMatch[1], 'clear_search', locale);
+            return;
+        }
         const authActionMatch = /^auth:([a-f0-9]+):(login_device|reload|refresh_all_confirm|refresh_all_cancel|refresh_all)$/.exec(event.data);
         if (authActionMatch) {
             await this.handleAuthPanelActionCallback(event, authActionMatch[1], authActionMatch[2], locale);
@@ -3893,21 +3911,16 @@ export class BridgeSessionCore {
             await this.handleAuthToggleCommand(scopeId, locale, args.slice(1), action === 'disable');
             return;
         }
-        if (action !== 'list') {
+        const listRequest = parseCodexAuthListRequest(action, args);
+        if (!listRequest) {
             await this.sendMessage(scopeId, t(locale, 'usage_auth'));
             return;
         }
         const state = await this.listCodexAuthState();
         await this.refreshCurrentCodexAuthQuota(state);
-        const record = {
-            localId: crypto.randomBytes(8).toString('hex'),
-            chatId: scopeId,
-            messageId: null,
-            candidates: state.candidates,
-            createdAt: Date.now(),
-        };
+        const record = createPendingAuthChoiceList(scopeId, state.candidates, listRequest);
         this.pendingAuthChoiceLists.set(record.localId, record);
-        const messageId = await this.sendMessage(scopeId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null), authChoiceKeyboard(locale, record));
+        const messageId = await this.sendMessage(scopeId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null, record), authChoiceKeyboard(locale, record));
         record.messageId = messageId;
     }
     async handleAuthRefreshAllCommand(scopeId, locale, confirmed = false) {
@@ -3918,13 +3931,7 @@ export class BridgeSessionCore {
         if (!confirmed) {
             const state = await this.listCodexAuthState();
             await this.applySharedCodexAuthQuotaSnapshots(state);
-            const record = {
-                localId: crypto.randomBytes(8).toString('hex'),
-                chatId: scopeId,
-                messageId: null,
-                candidates: state.candidates,
-                createdAt: Date.now(),
-            };
+            const record = createPendingAuthChoiceList(scopeId, state.candidates);
             this.pendingAuthChoiceLists.set(record.localId, record);
             const messageId = await this.sendMessage(scopeId, t(locale, 'auth_refresh_all_confirm_message'), authRefreshAllConfirmKeyboard(locale, record));
             record.messageId = messageId;
@@ -3934,15 +3941,9 @@ export class BridgeSessionCore {
         const result = await this.refreshAllCodexAuthCandidates();
         const state = await this.listCodexAuthState();
         await this.applySharedCodexAuthQuotaSnapshots(state);
-        const record = {
-            localId: crypto.randomBytes(8).toString('hex'),
-            chatId: scopeId,
-            messageId: null,
-            candidates: state.candidates,
-            createdAt: Date.now(),
-        };
+        const record = createPendingAuthChoiceList(scopeId, state.candidates);
         this.pendingAuthChoiceLists.set(record.localId, record);
-        const messageId = await this.sendMessage(scopeId, `${formatAuthRefreshAllResult(locale, result)}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null)}`, authChoiceKeyboard(locale, record));
+        const messageId = await this.sendMessage(scopeId, `${formatAuthRefreshAllResult(locale, result)}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null, record)}`, authChoiceKeyboard(locale, record));
         record.messageId = messageId;
     }
     async handleAuthUseCommand(scopeId, locale, args) {
@@ -4435,7 +4436,7 @@ export class BridgeSessionCore {
             record.candidates = state.candidates;
             record.createdAt = Date.now();
             if (record.messageId !== null) {
-                await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null), authChoiceKeyboard(locale, record));
+                await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record), authChoiceKeyboard(locale, record));
             }
             return;
         }
@@ -4454,13 +4455,46 @@ export class BridgeSessionCore {
             record.candidates = state.candidates;
             record.createdAt = Date.now();
             if (record.messageId !== null) {
-                await this.editMessage(event.scopeId, record.messageId, `${formatAuthRefreshAllResult(locale, result)}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null)}`, authChoiceKeyboard(locale, record));
+                await this.editMessage(event.scopeId, record.messageId, `${formatAuthRefreshAllResult(locale, result)}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record)}`, authChoiceKeyboard(locale, record));
             }
             return;
         }
         await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_reload_restarting'));
         await this.handleAuthReloadCommand(event.scopeId, locale);
     }
+    async handleAuthListViewCallback(event, localId, action, locale) {
+        const record = this.pendingAuthChoiceLists.get(localId);
+        if (!record) {
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_choice_expired'));
+            return;
+        }
+        if (record.chatId !== event.scopeId || (record.messageId !== null && record.messageId !== event.messageId)) {
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_choice_mismatch'));
+            return;
+        }
+        if (action === 'prev') {
+            record.offset = Math.max(0, record.offset - record.pageSize);
+        }
+        else if (action === 'next') {
+            record.offset += record.pageSize;
+        }
+        else if (action === 'clear_search') {
+            record.searchTerm = null;
+            record.offset = 0;
+        }
+        else {
+            record.filter = action;
+            record.offset = 0;
+        }
+        const state = await this.listCodexAuthState();
+        record.candidates = state.candidates;
+        record.createdAt = Date.now();
+        clampCodexAuthListOffset(record);
+        await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'decision_recorded'));
+        if (record.messageId !== null) {
+            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record), authChoiceKeyboard(locale, record));
+        }
+    }
     async handleAuthToggleCallback(event, localId, index, locale) {
         const record = this.pendingAuthChoiceLists.get(localId);
         if (!record) {
@@ -4480,9 +4514,10 @@ export class BridgeSessionCore {
         this.store.setCodexAuthCandidateDisabled(candidate.name, disabled, this.authRuntimeId());
         const state = await this.listCodexAuthState();
         record.candidates = state.candidates;
+        clampCodexAuthListOffset(record);
         await this.messaging.answerCallback(event.callbackQueryId, t(locale, disabled ? 'auth_candidate_disabled_short' : 'auth_candidate_enabled_short'));
         if (record.messageId !== null) {
-            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null), authChoiceKeyboard(locale, record));
+            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record), authChoiceKeyboard(locale, record));
         }
     }
     async handleAuthSwitchCallback(event, localId, index, locale) {
@@ -4515,8 +4550,9 @@ export class BridgeSessionCore {
         await this.refreshCurrentCodexAuthQuota(state);
         record.candidates = state.candidates;
         record.createdAt = Date.now();
+        clampCodexAuthListOffset(record);
         if (record.messageId !== null) {
-            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null), authChoiceKeyboard(locale, record));
+            await this.editMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record), authChoiceKeyboard(locale, record));
         }
     }
     async maybeRunPendingAuthRotation() {
@@ -5009,6 +5045,12 @@ export class BridgeSessionCore {
     async readCodexAuthCandidateAccountIds(candidates) {
         const entries = await Promise.all(candidates.map(async (candidate) => {
             const metadata = await readChatGptAuthMetadata(candidate.path);
+            candidate.credentialKind = metadata
+                ? 'chatgpt'
+                : await isCodexApiKeyAuthCandidate(candidate.path)
+                    ? 'api-key'
+                    : 'invalid';
+            candidate.credentialLastRefreshMs = metadata?.lastRefreshMs ?? null;
             return [candidate.name, metadata?.accountId ?? null];
         }));
         const accountIds = new Map();
@@ -5038,7 +5080,7 @@ export class BridgeSessionCore {
             if (parsed && typeof parsed === 'object') {
                 for (const [name, value] of Object.entries(parsed)) {
                     if (isCodexAuthQuotaSnapshot(value)) {
-                        this.authQuotaSnapshots[name] = value;
+                        this.authQuotaSnapshots[name] = normalizeCodexAuthQuotaSnapshot(value);
                     }
                 }
             }
@@ -7547,6 +7589,8 @@ async function listCodexAuthState(disabledNames = new Set(), explicitAuthDir = n
             isCurrent: currentTargetPath === candidatePath,
             disabled: disabledNames.has(entry.name),
             mtimeMs: stat.mtimeMs,
+            credentialKind: 'invalid',
+            credentialLastRefreshMs: null,
             quota: null,
         });
     }
@@ -7565,6 +7609,15 @@ function isCodexAuthCandidateName(name) {
     }
     return name.startsWith('auth.json_') || name.startsWith('auth.json.') || name.startsWith('auth.json-');
 }
+async function isCodexApiKeyAuthCandidate(candidatePath) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(candidatePath, 'utf8'));
+        return typeof parsed.openai_api_key === 'string' && parsed.openai_api_key.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
 function codexAuthCandidateNameFromAddName(raw) {
     const normalized = raw.trim();
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(normalized)) {
@@ -7657,7 +7710,75 @@ async function switchCodexAuth(targetPath, explicitAuthDir = null) {
         toLabel: await authPathDisplayLabel(candidate.path),
     };
 }
-function renderAuthListMessage(locale, state, botLabel = null, includeWeixinCopyPaste = false) {
+function parseCodexAuthListRequest(action, args) {
+    if (action === 'list') {
+        return { searchTerm: args.slice(1).join(' ').trim() || null };
+    }
+    if (action === 'filter') {
+        const filter = args[1]?.toLowerCase();
+        return filter === 'all' || filter === 'enabled' || filter === 'attention'
+            ? { filter }
+            : null;
+    }
+    if (action === 'page') {
+        const page = Number.parseInt(args[1] ?? '', 10);
+        return Number.isFinite(page) && page > 0
+            ? { offset: (page - 1) * CODEX_AUTH_LIST_PAGE_SIZE }
+            : null;
+    }
+    return null;
+}
+function createPendingAuthChoiceList(chatId, candidates, view = {}) {
+    const record = {
+        localId: crypto.randomBytes(8).toString('hex'),
+        chatId,
+        messageId: null,
+        candidates,
+        createdAt: Date.now(),
+        offset: Math.max(0, view.offset ?? 0),
+        pageSize: CODEX_AUTH_LIST_PAGE_SIZE,
+        filter: view.filter ?? 'all',
+        searchTerm: view.searchTerm?.trim() || null,
+    };
+    clampCodexAuthListOffset(record);
+    return record;
+}
+function clampCodexAuthListOffset(view) {
+    const filteredCount = filterCodexAuthCandidates(view.candidates, view).length;
+    const finalOffset = filteredCount > 0
+        ? Math.floor((filteredCount - 1) / view.pageSize) * view.pageSize
+        : 0;
+    view.offset = Math.min(Math.max(0, view.offset), finalOffset);
+}
+function codexAuthListPage(candidates, view) {
+    const pageSize = Math.max(1, view?.pageSize ?? CODEX_AUTH_LIST_PAGE_SIZE);
+    const filter = view?.filter ?? 'all';
+    const searchTerm = view?.searchTerm?.trim() || null;
+    const indexed = filterCodexAuthCandidates(candidates, { filter, searchTerm });
+    const finalOffset = indexed.length > 0
+        ? Math.floor((indexed.length - 1) / pageSize) * pageSize
+        : 0;
+    const offset = Math.min(Math.max(0, view?.offset ?? 0), finalOffset);
+    return {
+        visible: indexed.slice(offset, offset + pageSize),
+        filteredCount: indexed.length,
+        offset,
+        pageIndex: Math.floor(offset / pageSize),
+        pageCount: Math.max(1, Math.ceil(indexed.length / pageSize)),
+        filter,
+        searchTerm,
+    };
+}
+function filterCodexAuthCandidates(candidates, view) {
+    const searchTerm = view.searchTerm?.trim().toLowerCase() || null;
+    return candidates
+        .map((candidate, index) => ({ candidate, index }))
+        .filter(({ candidate }) => !searchTerm || candidate.name.toLowerCase().includes(searchTerm))
+        .filter(({ candidate }) => view.filter === 'all'
+        || (view.filter === 'enabled' && !candidate.disabled)
+        || (view.filter === 'attention' && codexAuthCandidateNeedsAttention(candidate)));
+}
+function renderAuthListMessage(locale, state, botLabel = null, includeWeixinCopyPaste = false, view = null) {
     const lines = [
         t(locale, 'auth_list_title'),
     ];
@@ -7674,24 +7795,42 @@ function renderAuthListMessage(locale, state, botLabel = null, includeWeixinCopy
     }
     lines.push(t(locale, 'auth_candidate_count', { value: state.candidates.length }));
     lines.push(t(locale, 'auth_quota_legend'));
-    state.candidates.forEach((candidate, index) => {
+    const page = codexAuthListPage(state.candidates, view);
+    if (page.searchTerm) {
+        lines.push(t(locale, 'auth_search', { value: page.searchTerm }));
+    }
+    if (page.filter !== 'all') {
+        lines.push(t(locale, 'auth_filter', { value: formatCodexAuthFilter(locale, page.filter) }));
+    }
+    if (page.filteredCount !== state.candidates.length || page.pageCount > 1) {
+        lines.push(t(locale, 'auth_page', {
+            from: page.filteredCount === 0 ? 0 : page.offset + 1,
+            to: page.offset + page.visible.length,
+            filtered: page.filteredCount,
+            total: state.candidates.length,
+            page: page.pageIndex + 1,
+            pages: page.pageCount,
+        }));
+    }
+    if (page.visible.length === 0) {
+        lines.push(t(locale, 'auth_no_matches'));
+    }
+    page.visible.forEach(({ candidate, index }) => {
         const marker = candidate.isCurrent ? ' *' : '';
-        const status = candidate.disabled
-            ? t(locale, 'auth_candidate_status_disabled')
-            : t(locale, 'auth_candidate_status_enabled');
-        lines.push(`${index + 1}. ${formatAuthQuotaPrefix(candidate.quota)}|${candidate.name}${marker} [${status}]`);
+        lines.push(`${index + 1}. ${formatAuthQuotaPrefix(locale, candidate.quota)}|${candidate.name}${marker} ${formatCodexAuthCandidateStatus(locale, candidate)}`);
     });
     if (includeWeixinCopyPaste) {
-        lines.push('', t(locale, 'weixin_copy_paste_divider'), t(locale, 'weixin_copy_auth_title'), ...state.candidates.map((_candidate, index) => `/auth use ${index + 1}`), ...state.candidates.map((candidate, index) => candidate.disabled
+        lines.push('', t(locale, 'weixin_copy_paste_divider'), t(locale, 'weixin_copy_auth_title'), ...page.visible.map(({ index }) => `/auth use ${index + 1}`), ...page.visible.map(({ candidate, index }) => candidate.disabled
             ? `/auth enable ${index + 1}`
-            : `/auth disable ${index + 1}`), '/login_device', '/auth reload', '/permissions');
+            : `/auth disable ${index + 1}`), '/auth filter all', '/auth filter enabled', '/auth filter attention', '/auth list <keyword>', '/login_device', '/auth reload', '/permissions');
     }
     return lines.join('\n');
 }
 function authChoiceKeyboard(locale, record) {
-    const rows = record.candidates.map((candidate, index) => [
+    const page = codexAuthListPage(record.candidates, record);
+    const rows = page.visible.map(({ candidate, index }) => [
         {
-            text: clipButtonText(`${candidate.isCurrent ? '✅ ' : '🔐 '}${formatAuthQuotaPrefix(candidate.quota)}|${candidate.name}${candidate.disabled ? ' · off' : ''}`),
+            text: clipButtonText(`${candidate.isCurrent ? '✅ ' : '🔐 '}${formatAuthQuotaPrefix(locale, candidate.quota)}|${candidate.name}${candidate.disabled ? ' · off' : ''}`),
             callback_data: `auth:${record.localId}:${index}`,
         },
         {
@@ -7699,6 +7838,24 @@ function authChoiceKeyboard(locale, record) {
             callback_data: `auth:${record.localId}:toggle:${index}`,
         },
     ]);
+    const navigationRow = [];
+    if (page.offset > 0) {
+        navigationRow.push({ text: t(locale, 'button_prev_page'), callback_data: `auth:${record.localId}:page:prev` });
+    }
+    if (page.offset + page.visible.length < page.filteredCount) {
+        navigationRow.push({ text: t(locale, 'button_next_page'), callback_data: `auth:${record.localId}:page:next` });
+    }
+    if (navigationRow.length > 0) {
+        rows.push(navigationRow);
+    }
+    rows.push([
+        authFilterButton(locale, record, 'all'),
+        authFilterButton(locale, record, 'enabled'),
+        authFilterButton(locale, record, 'attention'),
+    ]);
+    if (record.searchTerm) {
+        rows.push([{ text: t(locale, 'button_clear_filter'), callback_data: `auth:${record.localId}:clear_search` }]);
+    }
     rows.push([
         { text: t(locale, 'button_permissions'), callback_data: 'nav:permissions' },
         { text: t(locale, 'button_login_device'), callback_data: `auth:${record.localId}:login_device` },
@@ -7706,6 +7863,66 @@ function authChoiceKeyboard(locale, record) {
     rows.push([{ text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` }]);
     return rows;
 }
+function authFilterButton(locale, record, filter) {
+    const label = t(locale, `button_auth_filter_${filter}`);
+    return {
+        text: record.filter === filter ? `☑️ ${label}` : label,
+        callback_data: `auth:${record.localId}:filter:${filter}`,
+    };
+}
+function codexAuthCandidateHealth(candidate) {
+    if (candidate.disabled) {
+        return 'disabled';
+    }
+    if (candidate.credentialKind === 'api-key') {
+        return 'api-key';
+    }
+    if (candidate.credentialKind === 'invalid') {
+        return 'invalid';
+    }
+    const remaining = [
+        candidate.quota?.primaryRemainingPercent,
+        candidate.quota?.secondaryRemainingPercent,
+    ].filter((value) => typeof value === 'number' && Number.isFinite(value));
+    if (remaining.some(value => value <= 0)) {
+        return 'exhausted';
+    }
+    if (remaining.some(value => value <= CODEX_AUTH_LOW_QUOTA_PERCENT)) {
+        return 'low';
+    }
+    if (candidate.credentialLastRefreshMs !== null
+        && candidate.credentialLastRefreshMs < Date.now() - CODEX_AUTH_STALE_CREDENTIAL_DAYS * 24 * 60 * 60_000) {
+        return 'stale';
+    }
+    if (remaining.length === 0) {
+        return 'unknown';
+    }
+    return 'ready';
+}
+function codexAuthCandidateNeedsAttention(candidate) {
+    const health = codexAuthCandidateHealth(candidate);
+    return health === 'stale'
+        || health === 'unknown'
+        || health === 'low'
+        || health === 'exhausted'
+        || health === 'invalid';
+}
+function formatCodexAuthCandidateStatus(locale, candidate) {
+    const details = [];
+    if (candidate.quota?.planType) {
+        details.push(formatPlanTypeLabel(candidate.quota.planType));
+    }
+    details.push(t(locale, `auth_candidate_health_${codexAuthCandidateHealth(candidate)}`));
+    if (candidate.credentialLastRefreshMs !== null) {
+        details.push(t(locale, 'auth_candidate_last_refresh', {
+            value: formatCompactAge(locale, Date.now() - candidate.credentialLastRefreshMs),
+        }));
+    }
+    return `[${details.join(' · ')}]`;
+}
+function formatCodexAuthFilter(locale, filter) {
+    return t(locale, `auth_filter_${filter}`);
+}
 function authRefreshAllConfirmKeyboard(locale, record) {
     return [
         [{ text: t(locale, 'button_auth_refresh_all_confirm'), callback_data: `auth:${record.localId}:refresh_all_confirm` }],
@@ -8249,6 +8466,33 @@ function formatRateLimitWindowLabel(locale, window, fallback) {
     }
     return locale === 'zh' ? `${formatCompactNumber(minutes)}分钟` : `${formatCompactNumber(minutes)}m window`;
 }
+function formatCompactRateLimitWindowLabel(locale, minutes, fallback) {
+    if (!minutes || minutes <= 0) {
+        return fallback === 'primary'
+            ? (locale === 'zh' ? '短' : 'P')
+            : (locale === 'zh' ? '长' : 'S');
+    }
+    if (minutes % 1440 === 0) {
+        return `${formatCompactNumber(minutes / 1440)}d`;
+    }
+    if (minutes % 60 === 0) {
+        return `${formatCompactNumber(minutes / 60)}h`;
+    }
+    return `${formatCompactNumber(minutes)}m`;
+}
+function formatCompactAge(locale, ageMs) {
+    const minutes = Math.max(0, ageMs) / 60_000;
+    if (minutes >= 1440) {
+        const days = Math.floor(minutes / 1440);
+        return locale === 'zh' ? `${days}天前` : `${days}d ago`;
+    }
+    if (minutes >= 60) {
+        const hours = Math.floor(minutes / 60);
+        return locale === 'zh' ? `${hours}小时前` : `${hours}h ago`;
+    }
+    const roundedMinutes = Math.floor(minutes);
+    return locale === 'zh' ? `${roundedMinutes}分钟前` : `${roundedMinutes}m ago`;
+}
 function formatUsagePercent(value) {
     if (!Number.isFinite(value)) {
         return '?';
@@ -8263,7 +8507,10 @@ function authQuotaSnapshotFromRateLimit(snapshot, accountId = null) {
     return {
         capturedAtMs: Date.now(),
         accountId,
+        planType: snapshot.planType,
+        primaryWindowDurationMins: snapshot.primary?.windowDurationMins ?? null,
         primaryRemainingPercent: snapshot.primary ? remainingUsagePercent(snapshot.primary.usedPercent) : null,
+        secondaryWindowDurationMins: snapshot.secondary?.windowDurationMins ?? null,
         secondaryRemainingPercent: snapshot.secondary ? remainingUsagePercent(snapshot.secondary.usedPercent) : null,
     };
 }
@@ -8271,7 +8518,10 @@ function codexAuthQuotaSnapshotFromRecord(record) {
     return {
         capturedAtMs: record.capturedAtMs,
         accountId: record.accountId,
+        planType: record.planType,
+        primaryWindowDurationMins: record.primaryWindowDurationMins,
         primaryRemainingPercent: record.primaryRemainingPercent,
+        secondaryWindowDurationMins: record.secondaryWindowDurationMins,
         secondaryRemainingPercent: record.secondaryRemainingPercent,
     };
 }
@@ -8282,25 +8532,19 @@ function mergeCodexAuthQuotaSnapshots(current, incoming) {
     if (!incoming) {
         return current;
     }
+    const freshest = incoming.capturedAtMs >= current.capturedAtMs ? incoming : current;
+    const older = freshest === incoming ? current : incoming;
     return {
-        capturedAtMs: Math.max(current.capturedAtMs, incoming.capturedAtMs),
-        accountId: current.accountId ?? incoming.accountId ?? null,
-        primaryRemainingPercent: fresherNullableQuotaValue(current.primaryRemainingPercent, current.capturedAtMs, incoming.primaryRemainingPercent, incoming.capturedAtMs),
-        secondaryRemainingPercent: fresherNullableQuotaValue(current.secondaryRemainingPercent, current.capturedAtMs, incoming.secondaryRemainingPercent, incoming.capturedAtMs),
+        ...freshest,
+        accountId: freshest.accountId ?? older.accountId ?? null,
     };
 }
-function fresherNullableQuotaValue(currentValue, currentCapturedAtMs, incomingValue, incomingCapturedAtMs) {
-    if (currentValue === null) {
-        return incomingValue;
-    }
-    if (incomingValue === null) {
-        return currentValue;
-    }
-    return incomingCapturedAtMs >= currentCapturedAtMs ? incomingValue : currentValue;
-}
 function isFiniteCodexAuthQuotaSnapshotRecord(record) {
     return Number.isFinite(record.capturedAtMs)
+        && isNullableString(record.planType)
+        && isNullableFiniteNumber(record.primaryWindowDurationMins)
         && isNullableFiniteNumber(record.primaryRemainingPercent)
+        && isNullableFiniteNumber(record.secondaryWindowDurationMins)
         && isNullableFiniteNumber(record.secondaryRemainingPercent);
 }
 function remainingUsagePercent(usedPercent) {
@@ -8309,13 +8553,18 @@ function remainingUsagePercent(usedPercent) {
     }
     return Math.max(0, Math.min(100, 100 - usedPercent));
 }
-function formatAuthQuotaPrefix(snapshot) {
+function formatAuthQuotaPrefix(locale, snapshot) {
     if (!snapshot) {
-        return '--|--';
+        return '--';
     }
-    const primary = snapshot.primaryRemainingPercent === null ? '--' : formatUsagePercent(snapshot.primaryRemainingPercent);
-    const secondary = snapshot.secondaryRemainingPercent === null ? '--' : formatUsagePercent(snapshot.secondaryRemainingPercent);
-    return `${primary}|${secondary}`;
+    const windows = [
+        [snapshot.primaryWindowDurationMins, snapshot.primaryRemainingPercent, 'primary'],
+        [snapshot.secondaryWindowDurationMins, snapshot.secondaryRemainingPercent, 'secondary'],
+    ];
+    const values = windows
+        .filter(([duration, remaining]) => duration !== null || remaining !== null)
+        .map(([duration, remaining, fallback]) => (`${formatCompactRateLimitWindowLabel(locale, duration, fallback)}:${remaining === null ? '--' : formatUsagePercent(remaining)}`));
+    return values.length > 0 ? values.join('|') : '--';
 }
 function isCodexAuthQuotaSnapshot(value) {
     if (!value || typeof value !== 'object') {
@@ -8325,12 +8574,29 @@ function isCodexAuthQuotaSnapshot(value) {
     return typeof snapshot.capturedAtMs === 'number'
         && Number.isFinite(snapshot.capturedAtMs)
         && (snapshot.accountId === undefined || snapshot.accountId === null || typeof snapshot.accountId === 'string')
+        && (snapshot.planType === undefined || isNullableString(snapshot.planType))
+        && (snapshot.primaryWindowDurationMins === undefined || isNullableFiniteNumber(snapshot.primaryWindowDurationMins))
         && isNullableFiniteNumber(snapshot.primaryRemainingPercent)
+        && (snapshot.secondaryWindowDurationMins === undefined || isNullableFiniteNumber(snapshot.secondaryWindowDurationMins))
         && isNullableFiniteNumber(snapshot.secondaryRemainingPercent);
 }
+function normalizeCodexAuthQuotaSnapshot(snapshot) {
+    return {
+        capturedAtMs: snapshot.capturedAtMs,
+        accountId: snapshot.accountId ?? null,
+        planType: snapshot.planType ?? null,
+        primaryWindowDurationMins: snapshot.primaryWindowDurationMins ?? null,
+        primaryRemainingPercent: snapshot.primaryRemainingPercent,
+        secondaryWindowDurationMins: snapshot.secondaryWindowDurationMins ?? null,
+        secondaryRemainingPercent: snapshot.secondaryRemainingPercent,
+    };
+}
 function isNullableFiniteNumber(value) {
     return value === null || (typeof value === 'number' && Number.isFinite(value));
 }
+function isNullableString(value) {
+    return value === null || typeof value === 'string';
+}
 function formatCompactNumber(value) {
     return Number.isInteger(value) ? String(value) : value.toFixed(1).replace(/\.0$/, '');
 }

package/dist/i18n.d.ts

@@ -137,16 +137,32 @@ declare const MESSAGES: {
         readonly auth_reload_restarting: "Restarting Codex app-server to reload auth...";
         readonly auth_reload_done: "Codex app-server restarted. Current auth has been reloaded.";
         readonly auth_reload_blocked_active: "Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.";
-        readonly usage_auth: "Usage: /auth [list|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]";
+        readonly usage_auth: "Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]";
         readonly usage_auth_add: "Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.";
         readonly auth_list_title: "Codex auth files:";
         readonly auth_bot: "Bot runtime: {value}";
         readonly auth_current: "Current auth: {value}";
         readonly auth_dir: "Auth dir: {value}";
         readonly auth_candidate_count: "Candidates: {value}";
-        readonly auth_quota_legend: "Quota remaining: 5h|7d|auth";
+        readonly auth_quota_legend: "Quota remaining: window:percent|auth";
+        readonly auth_search: "Search: {value}";
+        readonly auth_filter: "Filter: {value}";
+        readonly auth_filter_all: "all";
+        readonly auth_filter_enabled: "enabled";
+        readonly auth_filter_attention: "attention";
+        readonly auth_page: "Showing {from}-{to} of {filtered} matched candidates ({total} total), page {page}/{pages}";
+        readonly auth_no_matches: "No auth candidates match this view.";
         readonly auth_candidate_status_enabled: "enabled";
         readonly auth_candidate_status_disabled: "disabled";
+        readonly auth_candidate_health_disabled: "disabled";
+        readonly auth_candidate_health_ready: "ready";
+        readonly auth_candidate_health_low: "low quota";
+        readonly auth_candidate_health_exhausted: "quota exhausted";
+        readonly auth_candidate_health_stale: "not recently refreshed";
+        readonly auth_candidate_health_unknown: "quota unknown";
+        readonly 'auth_candidate_health_api-key': "API key";
+        readonly auth_candidate_health_invalid: "invalid auth file";
+        readonly auth_candidate_last_refresh: "refreshed {value}";
         readonly auth_candidate_enabled: "Enabled auth candidate for auto-rotation: {value}";
         readonly auth_candidate_disabled: "Disabled auth candidate for auto-rotation: {value}";
         readonly auth_candidate_enabled_short: "Auth enabled";
@@ -185,6 +201,9 @@ declare const MESSAGES: {
         readonly button_auth_refresh_all_confirm: "⚠️ Accept risk & refresh";
         readonly button_auth_enable: "✅";
         readonly button_auth_disable: "⏸️";
+        readonly button_auth_filter_all: "All";
+        readonly button_auth_filter_enabled: "Enabled";
+        readonly button_auth_filter_attention: "Attention";
         readonly another_turn_running: "Another turn is already running. Use /interrupt, /takeover, /queue, or wait.";
         readonly working: "Working...";
         readonly usage_open: "Usage: /open <n>";
@@ -723,16 +742,32 @@ declare const MESSAGES: {
         readonly auth_reload_restarting: "正在重启 Codex app-server 以重新读取 auth...";
         readonly auth_reload_done: "Codex app-server 已重启，当前 auth 已重新读取。";
         readonly auth_reload_blocked_active: "当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。";
-        readonly usage_auth: "用法：/auth [list|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|add <名称>]";
+        readonly usage_auth: "用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|add <名称>]";
         readonly usage_auth_add: "用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。";
         readonly auth_list_title: "Codex auth 文件：";
         readonly auth_bot: "Bot runtime：{value}";
         readonly auth_current: "当前 auth：{value}";
         readonly auth_dir: "Auth 目录：{value}";
         readonly auth_candidate_count: "候选数量：{value}";
-        readonly auth_quota_legend: "额度剩余：5h|7d|auth";
+        readonly auth_quota_legend: "额度剩余：窗口:百分比|auth";
+        readonly auth_search: "搜索：{value}";
+        readonly auth_filter: "筛选：{value}";
+        readonly auth_filter_all: "全部";
+        readonly auth_filter_enabled: "已启用";
+        readonly auth_filter_attention: "需关注";
+        readonly auth_page: "当前显示 {from}-{to}，匹配 {filtered} / 总计 {total}，第 {page}/{pages} 页";
+        readonly auth_no_matches: "当前视图没有匹配的 auth 候选。";
         readonly auth_candidate_status_enabled: "启用";
         readonly auth_candidate_status_disabled: "禁用";
+        readonly auth_candidate_health_disabled: "已禁用";
+        readonly auth_candidate_health_ready: "正常";
+        readonly auth_candidate_health_low: "额度偏低";
+        readonly auth_candidate_health_exhausted: "额度耗尽";
+        readonly auth_candidate_health_stale: "长期未刷新";
+        readonly auth_candidate_health_unknown: "额度未知";
+        readonly 'auth_candidate_health_api-key': "API key";
+        readonly auth_candidate_health_invalid: "auth 文件无效";
+        readonly auth_candidate_last_refresh: "刷新于 {value}";
         readonly auth_candidate_enabled: "已启用 auth 候选自动轮换：{value}";
         readonly auth_candidate_disabled: "已禁用 auth 候选自动轮换：{value}";
         readonly auth_candidate_enabled_short: "auth 已启用";
@@ -771,6 +806,9 @@ declare const MESSAGES: {
         readonly button_auth_refresh_all_confirm: "⚠️ 接受风险并刷新";
         readonly button_auth_enable: "✅";
         readonly button_auth_disable: "⏸️";
+        readonly button_auth_filter_all: "全部";
+        readonly button_auth_filter_enabled: "已启用";
+        readonly button_auth_filter_attention: "需关注";
         readonly another_turn_running: "已经有一个回复在进行中。请先等待，或使用 /interrupt、/takeover、/queue。";
         readonly working: "处理中...";
         readonly usage_open: "用法：/open <编号>";

package/dist/i18n.js

@@ -135,16 +135,32 @@ const MESSAGES = {
         auth_reload_restarting: 'Restarting Codex app-server to reload auth...',
         auth_reload_done: 'Codex app-server restarted. Current auth has been reloaded.',
         auth_reload_blocked_active: 'Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.',
-        usage_auth: 'Usage: /auth [list|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]',
+        usage_auth: 'Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|add <name>]',
         usage_auth_add: 'Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.',
         auth_list_title: 'Codex auth files:',
         auth_bot: 'Bot runtime: {value}',
         auth_current: 'Current auth: {value}',
         auth_dir: 'Auth dir: {value}',
         auth_candidate_count: 'Candidates: {value}',
-        auth_quota_legend: 'Quota remaining: 5h|7d|auth',
+        auth_quota_legend: 'Quota remaining: window:percent|auth',
+        auth_search: 'Search: {value}',
+        auth_filter: 'Filter: {value}',
+        auth_filter_all: 'all',
+        auth_filter_enabled: 'enabled',
+        auth_filter_attention: 'attention',
+        auth_page: 'Showing {from}-{to} of {filtered} matched candidates ({total} total), page {page}/{pages}',
+        auth_no_matches: 'No auth candidates match this view.',
         auth_candidate_status_enabled: 'enabled',
         auth_candidate_status_disabled: 'disabled',
+        auth_candidate_health_disabled: 'disabled',
+        auth_candidate_health_ready: 'ready',
+        auth_candidate_health_low: 'low quota',
+        auth_candidate_health_exhausted: 'quota exhausted',
+        auth_candidate_health_stale: 'not recently refreshed',
+        auth_candidate_health_unknown: 'quota unknown',
+        'auth_candidate_health_api-key': 'API key',
+        auth_candidate_health_invalid: 'invalid auth file',
+        auth_candidate_last_refresh: 'refreshed {value}',
         auth_candidate_enabled: 'Enabled auth candidate for auto-rotation: {value}',
         auth_candidate_disabled: 'Disabled auth candidate for auto-rotation: {value}',
         auth_candidate_enabled_short: 'Auth enabled',
@@ -183,6 +199,9 @@ const MESSAGES = {
         button_auth_refresh_all_confirm: '⚠️ Accept risk & refresh',
         button_auth_enable: '✅',
         button_auth_disable: '⏸️',
+        button_auth_filter_all: 'All',
+        button_auth_filter_enabled: 'Enabled',
+        button_auth_filter_attention: 'Attention',
         another_turn_running: 'Another turn is already running. Use /interrupt, /takeover, /queue, or wait.',
         working: 'Working...',
         usage_open: 'Usage: /open <n>',
@@ -721,16 +740,32 @@ const MESSAGES = {
         auth_reload_restarting: '正在重启 Codex app-server 以重新读取 auth...',
         auth_reload_done: 'Codex app-server 已重启，当前 auth 已重新读取。',
         auth_reload_blocked_active: '当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。',
-        usage_auth: '用法：/auth [list|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|add <名称>]',
+        usage_auth: '用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|add <名称>]',
         usage_auth_add: '用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。',
         auth_list_title: 'Codex auth 文件：',
         auth_bot: 'Bot runtime：{value}',
         auth_current: '当前 auth：{value}',
         auth_dir: 'Auth 目录：{value}',
         auth_candidate_count: '候选数量：{value}',
-        auth_quota_legend: '额度剩余：5h|7d|auth',
+        auth_quota_legend: '额度剩余：窗口:百分比|auth',
+        auth_search: '搜索：{value}',
+        auth_filter: '筛选：{value}',
+        auth_filter_all: '全部',
+        auth_filter_enabled: '已启用',
+        auth_filter_attention: '需关注',
+        auth_page: '当前显示 {from}-{to}，匹配 {filtered} / 总计 {total}，第 {page}/{pages} 页',
+        auth_no_matches: '当前视图没有匹配的 auth 候选。',
         auth_candidate_status_enabled: '启用',
         auth_candidate_status_disabled: '禁用',
+        auth_candidate_health_disabled: '已禁用',
+        auth_candidate_health_ready: '正常',
+        auth_candidate_health_low: '额度偏低',
+        auth_candidate_health_exhausted: '额度耗尽',
+        auth_candidate_health_stale: '长期未刷新',
+        auth_candidate_health_unknown: '额度未知',
+        'auth_candidate_health_api-key': 'API key',
+        auth_candidate_health_invalid: 'auth 文件无效',
+        auth_candidate_last_refresh: '刷新于 {value}',
         auth_candidate_enabled: '已启用 auth 候选自动轮换：{value}',
         auth_candidate_disabled: '已禁用 auth 候选自动轮换：{value}',
         auth_candidate_enabled_short: 'auth 已启用',
@@ -769,6 +804,9 @@ const MESSAGES = {
         button_auth_refresh_all_confirm: '⚠️ 接受风险并刷新',
         button_auth_enable: '✅',
         button_auth_disable: '⏸️',
+        button_auth_filter_all: '全部',
+        button_auth_filter_enabled: '已启用',
+        button_auth_filter_attention: '需关注',
         another_turn_running: '已经有一个回复在进行中。请先等待，或使用 /interrupt、/takeover、/queue。',
         working: '处理中...',
         usage_open: '用法：/open <编号>',

package/dist/store/database.d.ts

@@ -29,7 +29,10 @@ export interface CodexAuthQuotaSnapshotRecord {
     candidateName: string;
     accountId: string;
     capturedAtMs: number;
+    planType: string | null;
+    primaryWindowDurationMins: number | null;
     primaryRemainingPercent: number | null;
+    secondaryWindowDurationMins: number | null;
     secondaryRemainingPercent: number | null;
     updatedAt: number;
 }
@@ -86,7 +89,7 @@ export declare class BridgeStore {
     setWeixinContextToken(scopeId: string, contextToken: string): void;
     listDisabledCodexAuthCandidateNames(runtimeId?: string): Set<string>;
     setCodexAuthCandidateDisabled(name: string, disabled: boolean, runtimeId?: string): void;
-    setCodexAuthQuotaSnapshot(runtimeId: string, candidateName: string, accountId: string, snapshot: Pick<CodexAuthQuotaSnapshotRecord, 'capturedAtMs' | 'primaryRemainingPercent' | 'secondaryRemainingPercent'>): void;
+    setCodexAuthQuotaSnapshot(runtimeId: string, candidateName: string, accountId: string, snapshot: Pick<CodexAuthQuotaSnapshotRecord, 'capturedAtMs' | 'planType' | 'primaryWindowDurationMins' | 'primaryRemainingPercent' | 'secondaryWindowDurationMins' | 'secondaryRemainingPercent'>): void;
     listCodexAuthQuotaSnapshots(accountIds: string[]): CodexAuthQuotaSnapshotRecord[];
     private ensureColumn;
 }

package/dist/store/database.js

@@ -128,7 +128,10 @@ export class BridgeStore {
         candidate_name TEXT NOT NULL,
         account_id TEXT NOT NULL,
         captured_at_ms INTEGER NOT NULL,
+        plan_type TEXT,
+        primary_window_duration_mins REAL,
         primary_remaining_percent REAL,
+        secondary_window_duration_mins REAL,
         secondary_remaining_percent REAL,
         updated_at INTEGER NOT NULL,
         PRIMARY KEY (runtime_id, candidate_name)
@@ -148,6 +151,9 @@ export class BridgeStore {
         this.ensureColumn('pending_approvals', 'payload_json', 'TEXT');
         this.ensureColumn('pending_user_inputs', 'status', "TEXT NOT NULL DEFAULT 'pending'");
         this.ensureColumn('pending_user_inputs', 'submitted_at', 'INTEGER');
+        this.ensureColumn('codex_auth_quota_snapshots', 'plan_type', 'TEXT');
+        this.ensureColumn('codex_auth_quota_snapshots', 'primary_window_duration_mins', 'REAL');
+        this.ensureColumn('codex_auth_quota_snapshots', 'secondary_window_duration_mins', 'REAL');
         migrateLegacyBridgeScopeIds(this.db);
     }
     getTelegramOffset(botKey) {
@@ -528,18 +534,24 @@ export class BridgeStore {
         candidate_name,
         account_id,
         captured_at_ms,
+        plan_type,
+        primary_window_duration_mins,
         primary_remaining_percent,
+        secondary_window_duration_mins,
         secondary_remaining_percent,
         updated_at
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(runtime_id, candidate_name) DO UPDATE SET
         account_id = excluded.account_id,
         captured_at_ms = excluded.captured_at_ms,
+        plan_type = excluded.plan_type,
+        primary_window_duration_mins = excluded.primary_window_duration_mins,
         primary_remaining_percent = excluded.primary_remaining_percent,
+        secondary_window_duration_mins = excluded.secondary_window_duration_mins,
         secondary_remaining_percent = excluded.secondary_remaining_percent,
         updated_at = excluded.updated_at
-    `).run(runtimeId, candidateName, accountId, snapshot.capturedAtMs, snapshot.primaryRemainingPercent, snapshot.secondaryRemainingPercent, Date.now());
+    `).run(runtimeId, candidateName, accountId, snapshot.capturedAtMs, snapshot.planType, snapshot.primaryWindowDurationMins, snapshot.primaryRemainingPercent, snapshot.secondaryWindowDurationMins, snapshot.secondaryRemainingPercent, Date.now());
     }
     listCodexAuthQuotaSnapshots(accountIds) {
         const uniqueAccountIds = [...new Set(accountIds.filter(Boolean))];
@@ -553,7 +565,10 @@ export class BridgeStore {
         candidate_name,
         account_id,
         captured_at_ms,
+        plan_type,
+        primary_window_duration_mins,
         primary_remaining_percent,
+        secondary_window_duration_mins,
         secondary_remaining_percent,
         updated_at
       FROM codex_auth_quota_snapshots
@@ -564,7 +579,10 @@ export class BridgeStore {
             candidateName: String(row.candidate_name),
             accountId: String(row.account_id),
             capturedAtMs: Number(row.captured_at_ms),
+            planType: nullableString(row.plan_type),
+            primaryWindowDurationMins: nullableNumber(row.primary_window_duration_mins),
             primaryRemainingPercent: nullableNumber(row.primary_remaining_percent),
+            secondaryWindowDurationMins: nullableNumber(row.secondary_window_duration_mins),
             secondaryRemainingPercent: nullableNumber(row.secondary_remaining_percent),
             updatedAt: Number(row.updated_at),
         }));
@@ -584,6 +602,9 @@ function nullableNumber(value) {
     const numberValue = Number(value);
     return Number.isFinite(numberValue) ? numberValue : null;
 }
+function nullableString(value) {
+    return typeof value === 'string' && value.trim() ? value : null;
+}
 function normalizeCollaborationMode(value) {
     return value === 'default' || value === 'plan' ? value : null;
 }

package/docs/user-manual.md

@@ -389,7 +389,9 @@ If the login is cancelled or fails, FoxClaw tries to restore the previous auth t
 
 ### 6.3 The `/auth` Panel
 
-`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota. When multiple bot runtimes have recently used the same ChatGPT account, FoxClaw combines their cached quota snapshots by verified account ID, so one bot's `/auth` panel can show quota information learned by another bot without mixing different accounts.
+`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The panel shows 8 candidates per page and supports paging, `All / Enabled / Attention` filters, and `/auth list <keyword>` filename search for large local inventories. `/auth use <n>` always uses the full-list candidate number, independent of panel paging.
+
+Each filename is prefixed with observed `window:remaining-percent` values. For example, a Plus account may show `5h:20|7d:25`, while an account with one monthly window may show `30d:97`. The current auth quota is refreshed when the panel opens; other candidates are not switched merely to query quota. When multiple bot runtimes have recently used the same ChatGPT account, FoxClaw combines their cached quota snapshots by verified account ID, so one bot's `/auth` panel can show quota information learned by another bot without mixing different accounts.
 
 Approximation:
 
@@ -398,23 +400,28 @@ Codex auth
 Current: auth.json_personal
 Auth dir: /home/alice/.codex
 Candidates: 2
-Quota remaining: 5h|7d|auth
-1. 20|25|auth.json_personal * [enabled]
-2. --|--|auth.json_team [enabled]
+Quota remaining: window:percent|auth
+1. 5h:20|7d:25|auth.json_personal * [Plus · ready · refreshed 2h ago]
+2. --|auth.json_team [quota unknown]
 
-[✅ 20|25|auth.json_personal] [✅]
-[🔐 --|--|auth.json_team]     [✅]
+[✅ 5h:20|7d:25|auth.json_personal] [✅]
+[🔐 --|auth.json_team]              [✅]
+[☑️ All] [Enabled] [Attention]
 [🛡️ Access]             [🔑 Login]
 [🔄 Reload auth]
 ```
 
-The right-side `✅` / `⏸️` button shows the current state. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `--|--` means no quota snapshot has been observed for that candidate yet.
+The right-side `✅` / `⏸️` button controls whether the candidate participates in auto-rotation. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `--` means no quota snapshot has been observed for that candidate yet. Health summaries distinguish ready, low quota, quota exhausted, quota unknown, not recently refreshed, API key, and invalid auth file states.
 
 `/auth refresh all` is a command-only maintenance action because ChatGPT refresh tokens are rotated. It is allowed only when every Telegram runtime, the Weixin runtime, approvals, inputs, logins, and auth mirroring are idle. The command first shows a risk confirmation: if OpenAI/Codex consumes an old refresh token but the new token cannot be saved because of network, process, or disk failure, that candidate may require device login or phone verification again. After confirmation, FoxClaw visits every ChatGPT candidate, asks Codex to force-refresh tokens with `account/read refreshToken=true`, verifies the result through the usage endpoint, mirrors successful candidates, restores the original current auth, and shows a summary.
 
+OpenAI does not publish a fixed ChatGPT refresh-token lifetime or an old-token replay grace period. Codex refreshes automatically when an access token approaches expiry; when it cannot parse the access-token `exp`, current Codex uses a `last_refresh` fallback of about 8 days. The panel labels candidates without a refresh record in that interval as `not recently refreshed`, but this is only a maintenance hint. It does not prove expiry and does not trigger bulk keepalive refreshes. Do not use `/auth refresh all` as a routine keepalive command.
+
 Equivalent commands:
 
-- `/auth` or `/auth list`: show candidates.
+- `/auth` or `/auth list [keyword]`: show candidates, optionally filtered by filename.
+- `/auth filter <all|enabled|attention>`: show all, enabled, or attention-needed candidates.
+- `/auth page <n>`: open a specific page directly.
 - `/auth use <n>`: switch to candidate n and restart app-server.
 - `/auth enable <n>`: let candidate n participate in auto-rotation.
 - `/auth disable <n>`: skip candidate n during auto-rotation.

package/docs/zh/user-manual.md

@@ -389,7 +389,9 @@ cp -L ~/.codex/auth.json ~/.codex/auth.json_personal
 
 ### 6.3 `/auth` 面板
 
-`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。如果多个 bot runtime 最近使用过同一个 ChatGPT 账号，FoxClaw 会按已验证的账号 ID 合并它们缓存到的额度快照，因此一个 bot 的 `/auth` 面板可以显示另一个 bot 掌握到的额度信息，同时不会把不同账号混在一起。
+`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。面板每页显示 8 个候选，支持翻页、`全部 / 已启用 / 需关注` 筛选和 `/auth list <关键词>` 文件名搜索，适合管理较大的本地候选清单。命令 `/auth use <n>` 的编号始终对应完整候选列表，不会因为分页变化。
+
+每个候选名前的 `窗口:剩余百分比` 来自最近一次观察到的真实额度窗口，例如 Plus 账号可能显示 `5h:20|7d:25`，只有一个月度窗口的账号可能显示 `30d:97`。当前 auth 会在打开面板时刷新额度；其他候选不会为了查询额度被自动切换。如果多个 bot runtime 最近使用过同一个 ChatGPT 账号，FoxClaw 会按已验证的账号 ID 合并它们缓存到的额度快照，因此一个 bot 的 `/auth` 面板可以显示另一个 bot 掌握到的额度信息，同时不会把不同账号混在一起。
 
 示意：
 
@@ -398,23 +400,28 @@ Codex auth
 Current: auth.json_personal
 Auth dir: /home/alice/.codex
 Candidates: 2
-额度剩余：5h|7d|auth
-1. 20|25|auth.json_personal * [enabled]
-2. --|--|auth.json_team [enabled]
+额度剩余：窗口:百分比|auth
+1. 5h:20|7d:25|auth.json_personal * [Plus · 正常 · 刷新于 2小时前]
+2. --|auth.json_team [额度未知]
 
-[✅ 20|25|auth.json_personal] [✅]
-[🔐 --|--|auth.json_team]     [✅]
+[✅ 5h:20|7d:25|auth.json_personal] [✅]
+[🔐 --|auth.json_team]              [✅]
+[☑️ 全部] [已启用] [需关注]
 [🛡️ Access]             [🔑 设备登录]
 [🔄 Reload auth]
 ```
 
-右侧 `✅` / `⏸️` 表示当前状态。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`--|--` 表示该候选还没有额度历史快照。
+右侧 `✅` / `⏸️` 表示当前是否参与自动轮转。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`--` 表示该候选还没有额度历史快照。健康摘要会区分正常、额度偏低、额度耗尽、额度未知、长期未刷新、API key 和无效 auth 文件。
 
 `/auth refresh all` 是仅命令入口的维护操作，因为 ChatGPT refresh token 会被轮换。只有所有 Telegram runtime、微信 runtime、审批、待输入、登录流程和 auth 镜像写入都空闲时才允许执行。命令会先显示风险确认：如果 OpenAI/Codex 已经消费旧 refresh token，但因为网络、进程或磁盘故障导致新 token 没能成功保存，该候选可能需要重新设备登录，甚至重新手机号验证。确认后，它会逐个访问 ChatGPT 候选，让 Codex 通过 `account/read refreshToken=true` 强制刷新 token，再用 usage 接口验证，成功后镜像到其他 bot home，最后恢复原本的当前 auth 并显示摘要。
 
+OpenAI 没有公开 ChatGPT refresh token 的固定有效期或旧 token 重放宽限期。Codex 会在 access token 临近到期时自动刷新；如果 access token 里无法解析 `exp`，Codex 当前使用 `last_refresh` 超过约 8 天作为兜底刷新条件。面板把超过 8 天没有刷新记录的候选标为“长期未刷新”，但这只是维护提醒，不代表 refresh token 已经过期，也不会触发批量保活刷新。不要把 `/auth refresh all` 当作日常保活命令。
+
 命令等价用法：
 
-- `/auth` 或 `/auth list`：查看候选。
+- `/auth` 或 `/auth list [关键词]`：查看候选，可按文件名搜索。
+- `/auth filter <all|enabled|attention>`：筛选全部、已启用或需关注候选。
+- `/auth page <页码>`：直接查看指定页。
 - `/auth use <n>`：切到第 n 个候选并重启 app-server。
 - `/auth enable <n>`：让第 n 个候选参与自动轮转。
 - `/auth disable <n>`：禁用第 n 个候选，自动轮转会跳过它。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.4.10",
+  "version": "0.4.11",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",

package/skills/foxclaw/SKILL.md

@@ -67,6 +67,8 @@ Telegram behavior:
 - when `TG_BOT_TOKENS` contains multiple bots, one FoxClaw service starts independent Codex app-servers and auth selections per bot
 - isolated Telegram runtimes use independent `CODEX_HOME` directories and file-backed credentials; they do not share Codex sessions
 - refreshed ChatGPT candidates are mirrored only after online usage-endpoint validation; before auth switch or reload, a runtime restores any newer same-account credential found in another Codex home
+- `/auth` paginates large candidate inventories at 8 rows per page, supports all/enabled/attention filters and filename search, and renders the actual observed quota windows rather than assuming every account has 5-hour and 7-day windows
+- treat the `/auth` `not recently refreshed` state as a maintenance hint only: OpenAI does not publish a fixed ChatGPT refresh-token lifetime or replay grace period, and FoxClaw must not add routine bulk keepalive refreshes
 - `/auth refresh all` remains a command-only maintenance action, not a panel button; it requires explicit token-rotation risk confirmation, then force-refreshes every ChatGPT candidate through Codex `account/read refreshToken=true`, validates usage, mirrors successful candidates, and restores the original current auth while every runtime is globally idle
 - if `TG_BOT_TOKEN` is also set to one exact token from `TG_BOT_TOKENS`, that bot uses the default/shared-terminal runtime instead of an isolated Telegram home
 - if Weixin is enabled alongside multiple Telegram bots, it remains on the default Codex runtime instead of borrowing a Telegram bot runtime