@foxden-app/foxclaw 0.4.12 → 0.4.14

package/dist/main.js

@@ -141,7 +141,7 @@ Usage:
   foxclaw --help`);
 }
 async function runServeCli() {
-    const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter }, { AuthCandidateMirror },] = await Promise.all([
+    const [{ BridgeMessagingRouter }, { TelegramMessagingPort }, { WeixinChannelAdapter }, { WeixinMessagingPort }, { attachIlinkRuntimeFromBridgeLogger }, { loadWeixinAccount }, { Logger }, { BridgeStore }, { TelegramGateway }, { CodexAppClient }, { BridgeSessionCore }, { TelegramChannelAdapter }, { AuthCandidateMirror }, { CrossNodeAuthSync },] = await Promise.all([
         import('./channels/bridge_messaging_router.js'),
         import('./channels/telegram/telegram_messaging_port.js'),
         import('./channels/weixin/weixin_channel_adapter.js'),
@@ -155,6 +155,7 @@ async function runServeCli() {
         import('./controller/controller.js'),
         import('./channels/telegram/telegram_channel_adapter.js'),
         import('./auth/mirror.js'),
+        import('./auth/cross_node_sync.js'),
     ]);
     const config = loadConfig();
     const logger = new Logger(config.logLevel, config.logPath);
@@ -166,6 +167,7 @@ async function runServeCli() {
     let activeTelegramAdapters = [];
     let managedApps = [];
     let activeAuthMirror = null;
+    let activeAuthSync = null;
     try {
         store = new BridgeStore(config.storePath);
         if (config.tgMultiBotMode) {
@@ -206,6 +208,7 @@ async function runServeCli() {
                 const app = new CodexAppClient(runtimeConfig.codexCliBin, runtimeConfig.codexAppLaunchCmd, runtimeConfig.codexAppAutolaunch, runtimeConfig.codexAppServerStatePath, runtimeConfig.codexAppServerLogPath, logger, childEnv, sharedDefaultRuntime ? [] : ['cli_auth_credentials_store="file"']);
                 seeds.push({ id, home, authDir, sharedDefaultRuntime, config: runtimeConfig, bot, app });
             }
+            let authSync = null;
             const mirror = new AuthCandidateMirror(canonicalAuthDir, seeds.map((runtime) => ({
                 id: runtime.id,
                 label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
@@ -217,9 +220,12 @@ async function runServeCli() {
                         await runtime.bot.sendMessage(chatId, message);
                     }
                 },
-            })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'));
+            })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'), {
+                onSynced: async (event) => {
+                    await authSync?.publishCandidate(event.record.candidateName);
+                },
+            });
             await mirror.initialize();
-            mirror.start();
             activeAuthMirror = mirror;
             managedApps = seeds.map((runtime) => runtime.app);
             const selfUpdater = createSelfUpdateRuntime({
@@ -271,15 +277,35 @@ async function runServeCli() {
                         },
                     } : {}),
                     authMirror: mirror.getStatus(),
+                    authSync: authSync?.getStatus() ?? null,
                     lastUpdate: lastSelfUpdate,
                 });
             };
+            const authSyncLocalIdle = () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate())
+                && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
+                && mirror.isIdle();
             const coordinator = {
-                canSelfUpdate: () => runtimes.every((runtime) => runtime.core.isIdleForServiceUpdate())
-                    && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
-                    && mirror.isIdle(),
+                canSelfUpdate: () => authSyncLocalIdle()
+                    && (!authSync || authSync.isIdle()),
                 authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
-                recoverAuthCandidate: (runtimeId, candidateName) => mirror.recoverRuntimeCandidate(runtimeId, candidateName).then(recovery => recovery !== null),
+                recoverAuthCandidate: async (runtimeId, candidateName) => {
+                    const local = await mirror.recoverRuntimeCandidate(runtimeId, candidateName);
+                    if (local)
+                        return true;
+                    const current = await mirror.readRuntimeCandidate(runtimeId, candidateName)
+                        ?? await mirror.readNewestCandidate(candidateName);
+                    return await authSync?.requestRecovery(candidateName, {
+                        accountId: current?.accountId ?? null,
+                        lastRefreshMs: current?.lastRefreshMs ?? null,
+                    }) ?? false;
+                },
+                acquireAuthRefreshLease: (reason) => authSync?.acquireRefreshLease(reason)
+                    ?? Promise.resolve({ ok: true, leaseId: null }),
+                releaseAuthRefreshLease: (leaseId) => authSync?.releaseRefreshLease(leaseId)
+                    ?? Promise.resolve(),
+                getAuthSyncStatus: () => authSync?.getStatus() ?? null,
+                authSyncPushAll: () => authSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
+                authSyncTest: () => authSync?.testPeers() ?? Promise.resolve({ sent: 0 }),
                 statusUpdated: () => writeAggregateStatus(),
                 getServiceStatus: async () => ({
                     bots: await Promise.all(runtimes.map(async (runtime) => {
@@ -302,6 +328,7 @@ async function runServeCli() {
                         },
                     } : {}),
                     authMirror: mirror.getStatus(),
+                    authSync: authSync?.getStatus() ?? null,
                     lastUpdate: lastSelfUpdate,
                 }),
                 selfUpdateCompleted: (status) => {
@@ -324,6 +351,33 @@ async function runServeCli() {
                 weixinAdapter = new WeixinChannelAdapter(activeWeixinCore, store, config, logger);
             }
             activeTelegramAdapters = runtimes.map((runtime) => runtime.telegram);
+            if (config.authSyncEnabled) {
+                authSync = new CrossNodeAuthSync(buildAuthSyncConfig(config), logger, {
+                    send: async (peer, envelope) => {
+                        await seeds[0].bot.sendDocument(peer, `foxclaw-auth-sync-${Date.now()}.json`, Buffer.from(envelope, 'utf8'), 'FOXCLAW_AUTH_SYNC_V1');
+                    },
+                }, {
+                    readLocalCandidate: (candidateName) => mirror.readNewestCandidate(candidateName),
+                    listLocalCandidates: () => mirror.listNewestCandidates(),
+                    validateCandidate: async (candidateName, raw, expectedAccountId) => {
+                        if (!authSyncLocalIdle()) {
+                            return { ok: false, reason: 'runtime is not idle' };
+                        }
+                        const runtime = runtimes.find((entry) => entry.core.isIdleForServiceUpdate()) ?? runtimes[0] ?? null;
+                        if (!runtime) {
+                            return { ok: false, reason: 'no validation runtime is available' };
+                        }
+                        return runtime.core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
+                    },
+                    importCandidate: (candidateName, raw, source) => mirror.importExternalCandidate(candidateName, raw, source),
+                    isIdle: authSyncLocalIdle,
+                });
+                await authSync.initialize();
+                activeAuthSync = authSync;
+                attachTelegramAuthSync(seeds[0].bot, authSync, config, logger);
+                authSync.start();
+            }
+            mirror.start();
             process.on('unhandledRejection', (error) => {
                 logger.error('process.unhandled_rejection', { error: serializeError(error) });
             });
@@ -341,6 +395,7 @@ async function runServeCli() {
             logger.info('bridge.started', { bots: runtimes.map((runtime) => runtime.id) });
             const shutdown = async (signal) => {
                 logger.info('bridge.shutting_down', { signal });
+                authSync?.stop();
                 mirror.stop();
                 await weixinAdapter?.stop();
                 await activeWeixinCore?.stop();
@@ -372,7 +427,85 @@ async function runServeCli() {
             logPath: path.join(APP_HOME, 'logs', 'update.log'),
             codexCliBin: config.codexCliBin,
         });
-        const core = new BridgeSessionCore(config, store, logger, bot, app, outbound, selfUpdater);
+        let singleAuthSync = null;
+        let singleMirror = null;
+        let core = null;
+        const singleAuthDir = config.codexAuthDir ?? config.codexHome ?? process.env.CODEX_AUTH_DIR ?? path.join(os.homedir(), '.codex');
+        const singleAuthSyncLocalIdle = () => Boolean(core?.isIdleForServiceUpdate())
+            && (!singleMirror || singleMirror.isIdle());
+        const singleCoordinator = config.authSyncEnabled ? {
+            canSelfUpdate: () => singleAuthSyncLocalIdle()
+                && (!singleAuthSync || singleAuthSync.isIdle()),
+            authCandidateUpdated: (runtimeId, candidateName) => singleMirror?.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined) ?? Promise.resolve(),
+            recoverAuthCandidate: async (runtimeId, candidateName) => {
+                const local = await singleMirror?.recoverRuntimeCandidate(runtimeId, candidateName) ?? null;
+                if (local)
+                    return true;
+                const current = await singleMirror?.readRuntimeCandidate(runtimeId, candidateName)
+                    ?? await singleMirror?.readNewestCandidate(candidateName)
+                    ?? null;
+                return await singleAuthSync?.requestRecovery(candidateName, {
+                    accountId: current?.accountId ?? null,
+                    lastRefreshMs: current?.lastRefreshMs ?? null,
+                }) ?? false;
+            },
+            acquireAuthRefreshLease: (reason) => singleAuthSync?.acquireRefreshLease(reason)
+                ?? Promise.resolve({ ok: true, leaseId: null }),
+            releaseAuthRefreshLease: (leaseId) => singleAuthSync?.releaseRefreshLease(leaseId)
+                ?? Promise.resolve(),
+            getAuthSyncStatus: () => singleAuthSync?.getStatus() ?? null,
+            authSyncPushAll: () => singleAuthSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
+            authSyncTest: () => singleAuthSync?.testPeers() ?? Promise.resolve({ sent: 0 }),
+            statusUpdated: (status) => {
+                writeRuntimeStatus(config.statusPath, {
+                    ...status,
+                    authMirror: singleMirror?.getStatus() ?? null,
+                    authSync: singleAuthSync?.getStatus() ?? null,
+                });
+            },
+        } : null;
+        if (config.authSyncEnabled) {
+            singleMirror = new AuthCandidateMirror(singleAuthDir, [{
+                    id: 'default',
+                    label: bot.username ? `@${bot.username}` : 'default',
+                    authDir: singleAuthDir,
+                    validate: async (context) => validateRefreshedAuthCandidate({
+                        id: 'default',
+                        authDir: singleAuthDir,
+                        app,
+                    }, context.candidateName),
+                }], logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'), {
+                onSynced: async (event) => {
+                    await singleAuthSync?.publishCandidate(event.record.candidateName);
+                },
+            });
+            await singleMirror.initialize();
+            activeAuthMirror = singleMirror;
+        }
+        core = new BridgeSessionCore(config, store, logger, bot, app, outbound, selfUpdater, singleCoordinator);
+        if (config.authSyncEnabled && singleMirror) {
+            singleAuthSync = new CrossNodeAuthSync(buildAuthSyncConfig(config), logger, {
+                send: async (peer, envelope) => {
+                    await bot.sendDocument(peer, `foxclaw-auth-sync-${Date.now()}.json`, Buffer.from(envelope, 'utf8'), 'FOXCLAW_AUTH_SYNC_V1');
+                },
+            }, {
+                readLocalCandidate: (candidateName) => singleMirror.readNewestCandidate(candidateName),
+                listLocalCandidates: () => singleMirror.listNewestCandidates(),
+                validateCandidate: async (candidateName, raw, expectedAccountId) => {
+                    if (!singleAuthSyncLocalIdle()) {
+                        return { ok: false, reason: 'runtime is not idle' };
+                    }
+                    return core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
+                },
+                importCandidate: (candidateName, raw, source) => singleMirror.importExternalCandidate(candidateName, raw, source),
+                isIdle: singleAuthSyncLocalIdle,
+            });
+            await singleAuthSync.initialize();
+            activeAuthSync = singleAuthSync;
+            attachTelegramAuthSync(bot, singleAuthSync, config, logger);
+            singleAuthSync.start();
+            singleMirror.start();
+        }
         const telegram = new TelegramChannelAdapter(core);
         managedApps = [app];
         activeTelegramAdapters = [telegram];
@@ -392,6 +525,8 @@ async function runServeCli() {
         logger.info('bridge.started', core.getRuntimeStatus());
         const shutdown = async (signal) => {
             logger.info('bridge.shutting_down', { signal });
+            singleAuthSync?.stop();
+            singleMirror?.stop();
             await weixinAdapter?.stop();
             await telegram.stop();
             writeRuntimeStatus(config.statusPath, {
@@ -419,6 +554,7 @@ async function runServeCli() {
         process.on('SIGTERM', () => void shutdown('SIGTERM'));
     }
     catch (error) {
+        activeAuthSync?.stop();
         activeAuthMirror?.stop();
         await weixinAdapter?.stop().catch(() => { });
         await activeWeixinCore?.stop().catch(() => { });
@@ -429,6 +565,54 @@ async function runServeCli() {
         throw error;
     }
 }
+const AUTH_SYNC_TELEGRAM_CAPTION = 'FOXCLAW_AUTH_SYNC_V1';
+function buildAuthSyncConfig(config) {
+    return {
+        enabled: config.authSyncEnabled,
+        transport: config.authSyncTransport,
+        key: config.authSyncKey,
+        peers: config.authSyncPeers,
+        nodeId: config.authSyncNodeId,
+        clusterId: config.authSyncClusterId,
+        statePath: config.authSyncStatePath,
+        tempDir: config.authSyncTempDir,
+    };
+}
+function attachTelegramAuthSync(bot, sync, config, logger) {
+    bot.on('peerDocument', (event) => {
+        void handleTelegramAuthSyncDocument(bot, sync, config, logger, event).catch((error) => {
+            logger.warn('auth.sync.telegram_document_failed', { error: serializeError(error) });
+        });
+    });
+}
+async function handleTelegramAuthSyncDocument(bot, sync, config, logger, event) {
+    const fileName = event.attachment.fileName ?? '';
+    if (event.text.trim() !== AUTH_SYNC_TELEGRAM_CAPTION && !fileName.startsWith('foxclaw-auth-sync-')) {
+        return;
+    }
+    const remoteFile = await bot.getFile(event.attachment.fileId);
+    if (!remoteFile.file_path) {
+        throw new Error('Telegram did not return file_path for auth sync document');
+    }
+    await fs.promises.mkdir(config.authSyncTempDir, { recursive: true, mode: 0o700 });
+    const destination = path.join(config.authSyncTempDir, `inbound-${process.pid}-${Date.now()}-${event.messageId}.json`);
+    try {
+        await bot.downloadResolvedFile(remoteFile.file_path, destination);
+        const raw = await fs.promises.readFile(destination, 'utf8');
+        const handled = await sync.handleIncomingEnvelope(raw, {
+            userId: event.userId,
+            username: event.username,
+        });
+        if (handled) {
+            logger.info('auth.sync.telegram_document_handled', {
+                peer: event.username ? `@${event.username}` : event.userId,
+            });
+        }
+    }
+    finally {
+        await fs.promises.rm(destination, { force: true }).catch(() => undefined);
+    }
+}
 async function validateRefreshedAuthCandidate(runtime, candidateName) {
     const authPath = path.join(runtime.authDir, 'auth.json');
     const candidatePath = path.join(runtime.authDir, candidateName);

package/dist/telegram/api.d.ts

@@ -10,5 +10,11 @@ export interface TelegramRemoteFile {
     file_path?: string;
 }
 export declare function callTelegramApi<T>(botToken: string, method: string, body: Record<string, unknown>): Promise<TelegramApiResult<T>>;
+export declare function callTelegramMultipartApi<T>(botToken: string, method: string, fields: Record<string, string>, files: Array<{
+    fieldName: string;
+    filename: string;
+    contents: Buffer;
+    contentType: string;
+}>): Promise<TelegramApiResult<T>>;
 export declare function getTelegramFile(botToken: string, fileId: string): Promise<TelegramRemoteFile>;
 export declare function downloadTelegramFile(botToken: string, remoteFilePath: string, destinationPath: string): Promise<number>;

package/dist/telegram/api.js

@@ -39,6 +39,53 @@ export async function callTelegramApi(botToken, method, body) {
         request.end();
     });
 }
+export async function callTelegramMultipartApi(botToken, method, fields, files) {
+    const boundary = `foxclaw-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    const parts = [];
+    for (const [name, value] of Object.entries(fields)) {
+        parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${escapeMultipartName(name)}"\r\n\r\n${value}\r\n`, 'utf8'));
+    }
+    for (const file of files) {
+        parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${escapeMultipartName(file.fieldName)}"; filename="${escapeMultipartName(file.filename)}"\r\nContent-Type: ${file.contentType}\r\n\r\n`, 'utf8'));
+        parts.push(file.contents);
+        parts.push(Buffer.from('\r\n', 'utf8'));
+    }
+    parts.push(Buffer.from(`--${boundary}--\r\n`, 'utf8'));
+    const payload = Buffer.concat(parts);
+    return new Promise((resolve, reject) => {
+        const request = https.request({
+            host: API_HOST,
+            port: 443,
+            path: `/bot${botToken}/${method}`,
+            method: 'POST',
+            family: 4,
+            headers: {
+                'content-type': `multipart/form-data; boundary=${boundary}`,
+                'content-length': payload.length,
+            },
+        }, (response) => {
+            const chunks = [];
+            response.on('data', (chunk) => {
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            response.on('end', () => {
+                try {
+                    const text = Buffer.concat(chunks).toString('utf8');
+                    resolve(JSON.parse(text));
+                }
+                catch (error) {
+                    reject(new Error(`Failed to parse Telegram response: ${String(error)}`));
+                }
+            });
+        });
+        request.on('error', reject);
+        request.setTimeout(20_000, () => {
+            request.destroy(new Error(`Telegram API request timed out for ${method}`));
+        });
+        request.write(payload);
+        request.end();
+    });
+}
 export async function getTelegramFile(botToken, fileId) {
     const result = await callTelegramApi(botToken, 'getFile', { file_id: fileId });
     if (!result.ok || !result.result) {
@@ -87,3 +134,6 @@ export async function downloadTelegramFile(botToken, remoteFilePath, destination
         response?.destroy();
     }
 }
+function escapeMultipartName(value) {
+    return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('\r', '').replaceAll('\n', '');
+}

package/dist/telegram/gateway.d.ts

@@ -17,6 +17,14 @@ export interface TelegramTextEvent {
     replyToBot: boolean;
     languageCode?: string;
 }
+export interface TelegramPeerDocumentEvent {
+    chatId: string;
+    userId: string;
+    username: string | null;
+    messageId: number;
+    text: string;
+    attachment: TelegramInboundAttachment;
+}
 export interface TelegramCallbackEvent {
     chatId: string;
     topicId: number | null;
@@ -53,6 +61,7 @@ export declare class TelegramGateway extends EventEmitter {
         text: string;
         callback_data: string;
     }>>, messageThreadId?: number | null): Promise<number>;
+    sendDocument(chatId: string, filename: string, contents: Buffer, caption?: string): Promise<number>;
     sendMessageDraft(chatId: string, draftId: number, text: string, messageThreadId?: number | null): Promise<void>;
     editMessage(chatId: string, messageId: number, text: string, inlineKeyboard?: Array<Array<{
         text: string;

package/dist/telegram/gateway.js

@@ -1,6 +1,6 @@
 import { EventEmitter } from 'node:events';
 import crypto from 'node:crypto';
-import { callTelegramApi, downloadTelegramFile, getTelegramFile } from './api.js';
+import { callTelegramApi, callTelegramMultipartApi, downloadTelegramFile, getTelegramFile } from './api.js';
 import { getTelegramCommands } from '../i18n.js';
 import { toTelegramBridgeScopeId } from '../core/bridge_scope.js';
 import { createTelegramScopeId } from './scope.js';
@@ -56,6 +56,21 @@ export class TelegramGateway extends EventEmitter {
     async sendHtmlMessage(chatId, text, inlineKeyboard, messageThreadId) {
         return this.sendMessageWithOptions(chatId, text, inlineKeyboard, 'HTML', messageThreadId);
     }
+    async sendDocument(chatId, filename, contents, caption) {
+        const result = await callTelegramMultipartApi(this.botToken, 'sendDocument', {
+            chat_id: chatId,
+            ...(caption ? { caption } : {}),
+        }, [{
+                fieldName: 'document',
+                filename,
+                contents,
+                contentType: 'application/json',
+            }]);
+        if (!result.ok || !result.result) {
+            throw new Error(result.description || 'Failed to send Telegram document');
+        }
+        return result.result.message_id;
+    }
     async sendMessageDraft(chatId, draftId, text, messageThreadId) {
         const result = await callTelegramApi(this.botToken, 'sendMessageDraft', {
             chat_id: chatId,
@@ -197,8 +212,24 @@ export class TelegramGateway extends EventEmitter {
     }
     async handleUpdate(update) {
         if (update.message && update.message.from && this.isAllowedChat(update.message.chat)) {
-            if (String(update.message.from.id) !== this.allowedUserId)
+            if (String(update.message.from.id) !== this.allowedUserId) {
+                if (update.message.chat.type === 'private') {
+                    const text = update.message.text ?? update.message.caption ?? '';
+                    const attachments = extractAttachments(update.message);
+                    const document = attachments.find((attachment) => attachment.kind === 'document');
+                    if (document) {
+                        this.emit('peerDocument', {
+                            chatId: String(update.message.chat.id),
+                            userId: String(update.message.from.id),
+                            username: update.message.from.username ?? null,
+                            text,
+                            messageId: update.message.message_id,
+                            attachment: document,
+                        });
+                    }
+                }
                 return;
+            }
             const attachments = extractAttachments(update.message);
             const text = update.message.text ?? update.message.caption ?? '';
             const topicId = update.message.message_thread_id ?? null;

package/dist/types.d.ts

@@ -360,11 +360,27 @@ export interface RuntimeStatus {
         sourceLabel: string;
         syncedAt: string;
     } | null;
+    authSync?: {
+        enabled: boolean;
+        nodeId: string | null;
+        peers: string[];
+        pendingImports: number;
+        lastSentAt: string | null;
+        lastReceivedAt: string | null;
+        lastImportedAt: string | null;
+        lastImportCandidate: string | null;
+        lastPullAt: string | null;
+        lastPullCandidate: string | null;
+        lastError: string | null;
+        activeLeaseId: string | null;
+    } | null;
     lastUpdate?: {
         state: string;
         fromVersion: string;
         toVersion: string | null;
         codexUpdate?: string | null;
+        codexFromVersion?: string | null;
+        codexToVersion?: string | null;
         updatedAt: string;
     } | null;
 }

package/dist/update.d.ts

@@ -7,6 +7,8 @@ export interface SelfUpdateStatus {
     fromVersion: string;
     toVersion: string | null;
     codexUpdate?: string | null;
+    codexFromVersion?: string | null;
+    codexToVersion?: string | null;
     error: string | null;
     updatedAt: string;
 }

package/dist/update.js

@@ -132,6 +132,8 @@ export function readSelfUpdateStatus(statusFile) {
             fromVersion: parsed.fromVersion,
             toVersion: typeof parsed.toVersion === 'string' ? parsed.toVersion : null,
             ...(typeof parsed.codexUpdate === 'string' ? { codexUpdate: parsed.codexUpdate } : {}),
+            ...(typeof parsed.codexFromVersion === 'string' ? { codexFromVersion: parsed.codexFromVersion } : {}),
+            ...(typeof parsed.codexToVersion === 'string' ? { codexToVersion: parsed.codexToVersion } : {}),
             error: typeof parsed.error === 'string' ? parsed.error : null,
             updatedAt: parsed.updatedAt,
         };
@@ -161,6 +163,8 @@ export function createSelfUpdateRuntime(options) {
                 fromVersion: options.version,
                 toVersion: null,
                 codexUpdate: null,
+                codexFromVersion: null,
+                codexToVersion: null,
                 error: null,
                 updatedAt: new Date().toISOString(),
             });
@@ -182,6 +186,8 @@ export function createSelfUpdateRuntime(options) {
                     fromVersion: options.version,
                     toVersion: null,
                     codexUpdate: null,
+                    codexFromVersion: null,
+                    codexToVersion: null,
                     error: formatError(error),
                     updatedAt: new Date().toISOString(),
                 });
@@ -205,7 +211,7 @@ export function performSelfUpdate(options) {
     let codexUpdate = null;
     try {
         codexUpdate = updateManagedCodexCli(options.codexCliBin ?? env.CODEX_CLI_BIN ?? '', options.nodePath, env);
-        console.log(`[UPDATE] ${codexUpdate}`);
+        console.log(`[UPDATE] ${codexUpdate.message}`);
         const installer = resolveSelfUpdateInstaller(options.entryPoint, options.nodePath, fs.existsSync, env);
         const installerEnv = buildInstallerEnv(options.entryPoint, installer, env);
         console.log(`[UPDATE] Installing ${PACKAGE_SPEC} with ${installer.manager}...`);
@@ -236,22 +242,52 @@ export function performSelfUpdate(options) {
     }
 }
 function updateManagedCodexCli(codexCliBin, nodePath, env) {
+    const fromVersion = readCodexCliVersion(codexCliBin, env);
     if (!codexCliBin) {
-        return 'Codex CLI update skipped: CODEX_CLI_BIN is not configured.';
+        return {
+            message: 'Codex CLI update skipped: CODEX_CLI_BIN is not configured.',
+            fromVersion,
+            toVersion: fromVersion,
+        };
     }
     const installer = resolveCodexUpdateInstaller(codexCliBin, nodePath, fs.existsSync, env);
     if (!installer) {
-        return 'Codex CLI update skipped: configured installation is not a recognized global npm/pnpm package.';
+        return {
+            message: 'Codex CLI update skipped: configured installation is not a recognized global npm/pnpm package.',
+            fromVersion,
+            toVersion: fromVersion,
+        };
     }
     try {
         const installerEnv = buildInstallerEnv(fs.realpathSync(codexCliBin), installer, env);
         runInherited(installer.command, installer.installArgs, installerEnv);
-        return `Codex CLI updated with ${installer.manager}.`;
+        return {
+            message: `Codex CLI updated with ${installer.manager}.`,
+            fromVersion,
+            toVersion: readCodexCliVersion(codexCliBin, installerEnv) ?? fromVersion,
+        };
     }
     catch (error) {
-        return `Codex CLI update failed without blocking FoxClaw update: ${formatError(error)}`;
+        return {
+            message: `Codex CLI update failed without blocking FoxClaw update: ${formatError(error)}`,
+            fromVersion,
+            toVersion: readCodexCliVersion(codexCliBin, env) ?? fromVersion,
+        };
     }
 }
+function readCodexCliVersion(codexCliBin, env) {
+    if (!codexCliBin) {
+        return null;
+    }
+    const result = spawnSync(codexCliBin, ['--version'], { encoding: 'utf8', env });
+    if (result.error || result.status !== 0) {
+        return null;
+    }
+    return parseCodexCliVersion(`${result.stdout}\n${result.stderr}`);
+}
+function parseCodexCliVersion(output) {
+    return output.match(/\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\b/)?.[0] ?? null;
+}
 function executableCandidates(commandName, nodePath, env, preferred = []) {
     return [
         ...preferred,
@@ -329,7 +365,9 @@ function completeNotification(notificationFile, state, toVersion, codexUpdate, e
         ...pending,
         state,
         toVersion,
-        codexUpdate,
+        codexUpdate: codexUpdate?.message ?? null,
+        codexFromVersion: codexUpdate?.fromVersion ?? null,
+        codexToVersion: codexUpdate?.toVersion ?? null,
         error,
         updatedAt: new Date().toISOString(),
     });