@foxden-app/foxclaw 0.4.12 → 0.4.14

package/dist/auth/mirror.d.ts

@@ -12,6 +12,9 @@ export interface AuthMirrorStatus {
     sourceLabel: string;
     syncedAt: string;
 }
+export interface AuthMirrorExternalStatus extends AuthMirrorStatus {
+    remoteNodeId?: string | null;
+}
 export interface AuthMirrorRecovery {
     candidateName: string;
     sourceRuntimeId: string;
@@ -31,26 +34,55 @@ export interface ChatGptAuthMetadata {
     accountId: string;
     lastRefreshMs: number;
 }
+export interface ChatGptAuthRecord extends ChatGptAuthMetadata {
+    raw: string;
+}
+export interface AuthMirrorCandidateRecord extends ChatGptAuthRecord {
+    candidateName: string;
+    sourceRuntimeId: string;
+    sourceLabel: string;
+}
+export interface AuthMirrorImportResult {
+    ok: boolean;
+    imported: boolean;
+    reason?: string | null;
+    record?: AuthMirrorCandidateRecord;
+}
+export interface AuthMirrorSyncedEvent {
+    status: AuthMirrorStatus;
+    record: AuthMirrorCandidateRecord;
+}
+export interface AuthMirrorHooks {
+    onSynced?: (event: AuthMirrorSyncedEvent) => Promise<void> | void;
+}
 export declare class AuthCandidateMirror {
     private readonly canonicalDir;
     private readonly runtimes;
     private readonly logger;
     private readonly statusPath;
+    private readonly hooks;
     private timer;
     private readonly lastSyncedRefresh;
     private readonly lastValidationFailures;
     private readonly activeCandidateSyncs;
     private activeOperations;
     private lastStatus;
-    constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null);
+    constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null, hooks?: AuthMirrorHooks);
     initialize(): Promise<void>;
     start(): void;
     stop(): void;
     isIdle(): boolean;
     getStatus(): AuthMirrorStatus | null;
+    readNewestCandidate(candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
+    readRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
+    listNewestCandidates(): Promise<AuthMirrorCandidateRecord[]>;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
     recoverRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorRecovery | null>;
     private scan;
+    importExternalCandidate(candidateName: string, raw: string, source: {
+        nodeId: string;
+        label?: string | null;
+    }): Promise<AuthMirrorImportResult>;
     private propagateValidatedCandidate;
     private validateRuntimeCandidate;
     private withActivity;
@@ -59,6 +91,10 @@ export declare class AuthCandidateMirror {
     private collectAuthRecords;
     private reconcileCandidateAtStartup;
     private resolveCanonicalCurrentCandidate;
+    private findNewestRecord;
+    private runtimeLabel;
 }
 export declare function isAuthCandidateName(name: string): boolean;
+export declare function readChatGptAuthRecord(filePath: string): Promise<ChatGptAuthRecord | null>;
 export declare function readChatGptAuthMetadata(filePath: string): Promise<ChatGptAuthMetadata | null>;
+export declare function parseChatGptAuthMetadata(raw: string): ChatGptAuthMetadata | null;

package/dist/auth/mirror.js

@@ -6,17 +6,19 @@ export class AuthCandidateMirror {
     runtimes;
     logger;
     statusPath;
+    hooks;
     timer = null;
     lastSyncedRefresh = new Map();
     lastValidationFailures = new Map();
     activeCandidateSyncs = new Set();
     activeOperations = 0;
     lastStatus = null;
-    constructor(canonicalDir, runtimes, logger, statusPath = null) {
+    constructor(canonicalDir, runtimes, logger, statusPath = null, hooks = {}) {
         this.canonicalDir = canonicalDir;
         this.runtimes = runtimes;
         this.logger = logger;
         this.statusPath = statusPath;
+        this.hooks = hooks;
     }
     async initialize() {
         this.lastStatus = await readMirrorStatus(this.statusPath);
@@ -65,6 +67,51 @@ export class AuthCandidateMirror {
     getStatus() {
         return this.lastStatus;
     }
+    async readNewestCandidate(candidateName) {
+        if (!isAuthCandidateName(candidateName))
+            return null;
+        return this.withActivity(async () => this.findNewestRecord((entry) => entry.candidateName === candidateName));
+    }
+    async readRuntimeCandidate(runtimeId, candidateName) {
+        if (!isAuthCandidateName(candidateName))
+            return null;
+        return this.withActivity(async () => {
+            const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
+            const authDir = runtimeId === 'canonical' ? this.canonicalDir : runtime?.authDir;
+            if (!authDir)
+                return null;
+            const record = await readChatGptAuthRecord(path.join(authDir, candidateName));
+            if (!record)
+                return null;
+            return {
+                ...record,
+                candidateName,
+                sourceRuntimeId: runtimeId,
+                sourceLabel: runtime?.label ?? runtimeId,
+            };
+        });
+    }
+    async listNewestCandidates() {
+        return this.withActivity(async () => {
+            const byName = new Map();
+            for (const entry of await this.collectAuthRecords()) {
+                if (!isAuthCandidateName(entry.candidateName))
+                    continue;
+                const sourceLabel = this.runtimeLabel(entry.runtimeId);
+                const candidate = {
+                    ...entry.record,
+                    candidateName: entry.candidateName,
+                    sourceRuntimeId: entry.runtimeId,
+                    sourceLabel,
+                };
+                const current = byName.get(entry.candidateName);
+                if (!current || candidate.lastRefreshMs > current.lastRefreshMs) {
+                    byName.set(entry.candidateName, candidate);
+                }
+            }
+            return [...byName.values()].sort((a, b) => a.candidateName.localeCompare(b.candidateName));
+        });
+    }
     async syncRuntimeCandidate(runtimeId, candidateName) {
         if (!isAuthCandidateName(candidateName))
             return false;
@@ -116,6 +163,64 @@ export class AuthCandidateMirror {
             }
         });
     }
+    async importExternalCandidate(candidateName, raw, source) {
+        if (!isAuthCandidateName(candidateName)) {
+            return { ok: false, imported: false, reason: 'invalid candidate name' };
+        }
+        return this.withActivity(async () => {
+            if (this.activeCandidateSyncs.has(candidateName)) {
+                return { ok: false, imported: false, reason: 'candidate sync already active' };
+            }
+            this.activeCandidateSyncs.add(candidateName);
+            try {
+                const metadata = parseChatGptAuthMetadata(raw);
+                if (!metadata) {
+                    return { ok: false, imported: false, reason: 'invalid ChatGPT auth payload' };
+                }
+                const existing = (await this.collectAuthRecords())
+                    .filter(entry => entry.candidateName === candidateName);
+                const conflicting = existing.find(entry => entry.record.accountId !== metadata.accountId);
+                if (conflicting) {
+                    return { ok: false, imported: false, reason: 'same candidate belongs to a different account' };
+                }
+                const newest = existing.reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+                const previousRefresh = Math.max(newest?.record.lastRefreshMs ?? 0, this.lastSyncedRefresh.get(candidateName) ?? 0);
+                if (metadata.lastRefreshMs <= previousRefresh) {
+                    return { ok: true, imported: false, reason: 'local candidate is already newer or equal' };
+                }
+                await atomicWrite(path.join(this.canonicalDir, candidateName), raw);
+                for (const target of this.runtimes) {
+                    await atomicWrite(path.join(target.authDir, candidateName), raw);
+                }
+                this.lastSyncedRefresh.set(candidateName, metadata.lastRefreshMs);
+                const sourceLabel = source.label?.trim() || source.nodeId;
+                this.lastStatus = {
+                    candidateName,
+                    sourceRuntimeId: `remote:${source.nodeId}`,
+                    sourceLabel,
+                    syncedAt: new Date().toISOString(),
+                };
+                await writeMirrorStatus(this.statusPath, this.lastStatus);
+                this.logger.info('auth.mirror.remote_imported', { candidateName, sourceNodeId: source.nodeId });
+                const message = `${candidateName} has been synchronized from remote node ${sourceLabel}.`;
+                await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
+                return {
+                    ok: true,
+                    imported: true,
+                    record: {
+                        raw,
+                        ...metadata,
+                        candidateName,
+                        sourceRuntimeId: `remote:${source.nodeId}`,
+                        sourceLabel,
+                    },
+                };
+            }
+            finally {
+                this.activeCandidateSyncs.delete(candidateName);
+            }
+        });
+    }
     async propagateValidatedCandidate(runtime, name) {
         if (this.activeCandidateSyncs.has(name)) {
             return false;
@@ -170,6 +275,15 @@ export class AuthCandidateMirror {
             this.logger.info('auth.mirror.synced', { sourceRuntimeId: runtime.id, name });
             const message = `${name} has been refreshed by ${sourceLabel} and synchronized to the other Codex homes.`;
             await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
+            await this.hooks.onSynced?.({
+                status: this.lastStatus,
+                record: {
+                    ...record,
+                    candidateName: name,
+                    sourceRuntimeId: runtime.id,
+                    sourceLabel,
+                },
+            });
             return true;
         }
         finally {
@@ -269,6 +383,25 @@ export class AuthCandidateMirror {
         const name = path.basename(finalPath);
         return isAuthCandidateName(name) ? name : null;
     }
+    async findNewestRecord(predicate) {
+        const newest = (await this.collectAuthRecords())
+            .filter(predicate)
+            .reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+        if (!newest)
+            return null;
+        return {
+            ...newest.record,
+            candidateName: newest.candidateName,
+            sourceRuntimeId: newest.runtimeId,
+            sourceLabel: this.runtimeLabel(newest.runtimeId),
+        };
+    }
+    runtimeLabel(runtimeId) {
+        if (runtimeId === 'canonical')
+            return 'canonical';
+        const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
+        return runtime?.label ?? runtimeId;
+    }
 }
 export function isAuthCandidateName(name) {
     return name !== 'auth.json'
@@ -281,7 +414,7 @@ async function listAuthCandidateNames(dir) {
         .filter((entry) => (entry.isFile() || entry.isSymbolicLink()) && isAuthCandidateName(entry.name))
         .map((entry) => entry.name);
 }
-async function readChatGptAuthRecord(filePath) {
+export async function readChatGptAuthRecord(filePath) {
     try {
         const raw = await fs.readFile(filePath, 'utf8');
         const metadata = parseChatGptAuthMetadata(raw);
@@ -301,7 +434,7 @@ export async function readChatGptAuthMetadata(filePath) {
         return null;
     }
 }
-function parseChatGptAuthMetadata(raw) {
+export function parseChatGptAuthMetadata(raw) {
     try {
         const parsed = JSON.parse(raw);
         const accountId = typeof parsed.tokens?.account_id === 'string' ? parsed.tokens.account_id : '';

package/dist/config.d.ts

@@ -8,6 +8,8 @@ export declare const DEFAULT_LOCK_PATH: string;
 export declare const DEFAULT_CODEX_APP_SERVER_STATE_PATH: string;
 export declare const DEFAULT_CODEX_APP_SERVER_LOG_PATH: string;
 export declare const DEFAULT_CODEX_TELEGRAM_HOME: string;
+export declare const DEFAULT_AUTH_SYNC_STATE_PATH: string;
+export declare const DEFAULT_AUTH_SYNC_TEMP_DIR: string;
 export declare const DEFAULT_ENV_PATH: string;
 export declare function resolveEnvPath(): string;
 export declare function getLoadedEnvPath(): string | null;
@@ -51,6 +53,14 @@ export interface AppConfig {
     weixinMediaDir: string;
     /** Optional `SKRouteTag` header for some IDC deployments. */
     wxIlinkRouteTag: string | null;
+    authSyncEnabled: boolean;
+    authSyncTransport: 'telegram-private';
+    authSyncKey: string | null;
+    authSyncPeers: string[];
+    authSyncNodeId: string | null;
+    authSyncClusterId: string;
+    authSyncStatePath: string;
+    authSyncTempDir: string;
 }
 export declare function loadConfig(): AppConfig;
 export declare function selectDefaultRuntimeBotToken(configuredTokens: string[], legacyToken: string | null): string | null;

package/dist/config.js

@@ -11,6 +11,8 @@ export const DEFAULT_LOCK_PATH = path.join(APP_HOME, 'runtime', 'bridge.lock');
 export const DEFAULT_CODEX_APP_SERVER_STATE_PATH = path.join(APP_HOME, 'runtime', 'codex-app-server.json');
 export const DEFAULT_CODEX_APP_SERVER_LOG_PATH = path.join(APP_HOME, 'logs', 'codex-app-server.log');
 export const DEFAULT_CODEX_TELEGRAM_HOME = path.join(APP_HOME, 'codex', 'telegram');
+export const DEFAULT_AUTH_SYNC_STATE_PATH = path.join(APP_HOME, 'runtime', 'auth-sync.json');
+export const DEFAULT_AUTH_SYNC_TEMP_DIR = path.join(APP_HOME, 'runtime', 'auth-sync');
 export const DEFAULT_ENV_PATH = path.join(APP_HOME, '.env');
 let envLoaded = false;
 let loadedEnvPath = null;
@@ -85,6 +87,14 @@ export function loadConfig() {
         weixinSyncBufDir: process.env.WEIXIN_SYNC_BUF_DIR || path.join(APP_HOME, 'weixin', 'sync-buf'),
         weixinMediaDir: process.env.WEIXIN_MEDIA_DIR || path.join(APP_HOME, 'weixin', 'media'),
         wxIlinkRouteTag: optional('WX_ILINK_ROUTE_TAG'),
+        authSyncEnabled: boolEnv('AUTH_SYNC_ENABLED', false),
+        authSyncTransport: 'telegram-private',
+        authSyncKey: optional('AUTH_SYNC_KEY'),
+        authSyncPeers: parseCommaSeparatedIds(process.env.AUTH_SYNC_PEERS),
+        authSyncNodeId: optional('AUTH_SYNC_NODE_ID'),
+        authSyncClusterId: process.env.AUTH_SYNC_CLUSTER_ID?.trim() || 'default',
+        authSyncStatePath: process.env.AUTH_SYNC_STATE_PATH || DEFAULT_AUTH_SYNC_STATE_PATH,
+        authSyncTempDir: process.env.AUTH_SYNC_TEMP_DIR || DEFAULT_AUTH_SYNC_TEMP_DIR,
     };
     ensureAppDirs(config);
     return config;
@@ -102,7 +112,11 @@ export function ensureAppDirs(config) {
         path.dirname(config.lockPath),
         path.dirname(config.codexAppServerStatePath),
         path.dirname(config.codexAppServerLogPath),
+        path.dirname(config.authSyncStatePath),
     ];
+    if (config.authSyncEnabled) {
+        dirs.push(config.authSyncTempDir);
+    }
     if (config.wxEnabled) {
         dirs.push(config.weixinAccountsDir, config.weixinSyncBufDir, config.weixinMediaDir);
     }

package/dist/controller/controller.d.ts

@@ -10,11 +10,26 @@ export interface CoreCoordinator {
     canSelfUpdate?: () => boolean;
     authCandidateUpdated?: (runtimeId: string, candidateName: string) => Promise<void>;
     recoverAuthCandidate?: (runtimeId: string, candidateName: string) => Promise<boolean>;
+    acquireAuthRefreshLease?: (reason: string) => Promise<{
+        ok: boolean;
+        leaseId: string | null;
+        reason?: string | null;
+    }>;
+    releaseAuthRefreshLease?: (leaseId: string | null) => Promise<void>;
+    getAuthSyncStatus?: () => RuntimeStatus['authSync'];
+    authSyncPushAll?: () => Promise<{
+        sent: number;
+        skipped: number;
+    }>;
+    authSyncTest?: () => Promise<{
+        sent: number;
+    }>;
     statusUpdated?: (status: RuntimeStatus) => void;
     getServiceStatus?: () => Promise<{
         bots: NonNullable<RuntimeStatus['bots']>;
         weixinRuntime?: RuntimeStatus['weixinRuntime'];
         authMirror?: RuntimeStatus['authMirror'];
+        authSync?: RuntimeStatus['authSync'];
         lastUpdate?: SelfUpdateStatus | null;
     }>;
     selfUpdateCompleted?: (status: SelfUpdateStatus) => void;
@@ -157,6 +172,10 @@ export declare class BridgeSessionCore {
     private registerActiveTurn;
     private createActiveTurnState;
     getCurrentAuthLabel(): Promise<string | null>;
+    validateExternalCodexAuthCandidate(candidateName: string, rawAuth: string, expectedAccountId: string): Promise<{
+        ok: boolean;
+        reason?: string | null;
+    }>;
     isIdleForServiceUpdate(): boolean;
     private hasLocalBlockingActivity;
     private authRuntimeId;
@@ -238,7 +257,9 @@ export declare class BridgeSessionCore {
     private clearSelfUpdateStatusPoll;
     private pollSelfUpdateStatus;
     private formatSelfUpdateResult;
+    private formatCodexUpdateResult;
     private handleAuthCommand;
+    private handleAuthSyncCommand;
     private handleAuthRefreshAllCommand;
     private handleAuthUseCommand;
     private handleAuthToggleCommand;