@foxden-app/foxclaw 0.4.13 → 0.4.15

package/dist/auth/mirror.d.ts

@@ -12,6 +12,9 @@ export interface AuthMirrorStatus {
     sourceLabel: string;
     syncedAt: string;
 }
+export interface AuthMirrorExternalStatus extends AuthMirrorStatus {
+    remoteNodeId?: string | null;
+}
 export interface AuthMirrorRecovery {
     candidateName: string;
     sourceRuntimeId: string;
@@ -31,26 +34,55 @@ export interface ChatGptAuthMetadata {
     accountId: string;
     lastRefreshMs: number;
 }
+export interface ChatGptAuthRecord extends ChatGptAuthMetadata {
+    raw: string;
+}
+export interface AuthMirrorCandidateRecord extends ChatGptAuthRecord {
+    candidateName: string;
+    sourceRuntimeId: string;
+    sourceLabel: string;
+}
+export interface AuthMirrorImportResult {
+    ok: boolean;
+    imported: boolean;
+    reason?: string | null;
+    record?: AuthMirrorCandidateRecord;
+}
+export interface AuthMirrorSyncedEvent {
+    status: AuthMirrorStatus;
+    record: AuthMirrorCandidateRecord;
+}
+export interface AuthMirrorHooks {
+    onSynced?: (event: AuthMirrorSyncedEvent) => Promise<void> | void;
+}
 export declare class AuthCandidateMirror {
     private readonly canonicalDir;
     private readonly runtimes;
     private readonly logger;
     private readonly statusPath;
+    private readonly hooks;
     private timer;
     private readonly lastSyncedRefresh;
     private readonly lastValidationFailures;
     private readonly activeCandidateSyncs;
     private activeOperations;
     private lastStatus;
-    constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null);
+    constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null, hooks?: AuthMirrorHooks);
     initialize(): Promise<void>;
     start(): void;
     stop(): void;
     isIdle(): boolean;
     getStatus(): AuthMirrorStatus | null;
+    readNewestCandidate(candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
+    readRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
+    listNewestCandidates(): Promise<AuthMirrorCandidateRecord[]>;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
     recoverRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorRecovery | null>;
     private scan;
+    importExternalCandidate(candidateName: string, raw: string, source: {
+        nodeId: string;
+        label?: string | null;
+    }): Promise<AuthMirrorImportResult>;
     private propagateValidatedCandidate;
     private validateRuntimeCandidate;
     private withActivity;
@@ -59,6 +91,10 @@ export declare class AuthCandidateMirror {
     private collectAuthRecords;
     private reconcileCandidateAtStartup;
     private resolveCanonicalCurrentCandidate;
+    private findNewestRecord;
+    private runtimeLabel;
 }
 export declare function isAuthCandidateName(name: string): boolean;
+export declare function readChatGptAuthRecord(filePath: string): Promise<ChatGptAuthRecord | null>;
 export declare function readChatGptAuthMetadata(filePath: string): Promise<ChatGptAuthMetadata | null>;
+export declare function parseChatGptAuthMetadata(raw: string): ChatGptAuthMetadata | null;

package/dist/auth/mirror.js

@@ -6,17 +6,19 @@ export class AuthCandidateMirror {
     runtimes;
     logger;
     statusPath;
+    hooks;
     timer = null;
     lastSyncedRefresh = new Map();
     lastValidationFailures = new Map();
     activeCandidateSyncs = new Set();
     activeOperations = 0;
     lastStatus = null;
-    constructor(canonicalDir, runtimes, logger, statusPath = null) {
+    constructor(canonicalDir, runtimes, logger, statusPath = null, hooks = {}) {
         this.canonicalDir = canonicalDir;
         this.runtimes = runtimes;
         this.logger = logger;
         this.statusPath = statusPath;
+        this.hooks = hooks;
     }
     async initialize() {
         this.lastStatus = await readMirrorStatus(this.statusPath);
@@ -65,6 +67,51 @@ export class AuthCandidateMirror {
     getStatus() {
         return this.lastStatus;
     }
+    async readNewestCandidate(candidateName) {
+        if (!isAuthCandidateName(candidateName))
+            return null;
+        return this.withActivity(async () => this.findNewestRecord((entry) => entry.candidateName === candidateName));
+    }
+    async readRuntimeCandidate(runtimeId, candidateName) {
+        if (!isAuthCandidateName(candidateName))
+            return null;
+        return this.withActivity(async () => {
+            const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
+            const authDir = runtimeId === 'canonical' ? this.canonicalDir : runtime?.authDir;
+            if (!authDir)
+                return null;
+            const record = await readChatGptAuthRecord(path.join(authDir, candidateName));
+            if (!record)
+                return null;
+            return {
+                ...record,
+                candidateName,
+                sourceRuntimeId: runtimeId,
+                sourceLabel: runtime?.label ?? runtimeId,
+            };
+        });
+    }
+    async listNewestCandidates() {
+        return this.withActivity(async () => {
+            const byName = new Map();
+            for (const entry of await this.collectAuthRecords()) {
+                if (!isAuthCandidateName(entry.candidateName))
+                    continue;
+                const sourceLabel = this.runtimeLabel(entry.runtimeId);
+                const candidate = {
+                    ...entry.record,
+                    candidateName: entry.candidateName,
+                    sourceRuntimeId: entry.runtimeId,
+                    sourceLabel,
+                };
+                const current = byName.get(entry.candidateName);
+                if (!current || candidate.lastRefreshMs > current.lastRefreshMs) {
+                    byName.set(entry.candidateName, candidate);
+                }
+            }
+            return [...byName.values()].sort((a, b) => a.candidateName.localeCompare(b.candidateName));
+        });
+    }
     async syncRuntimeCandidate(runtimeId, candidateName) {
         if (!isAuthCandidateName(candidateName))
             return false;
@@ -116,6 +163,64 @@ export class AuthCandidateMirror {
             }
         });
     }
+    async importExternalCandidate(candidateName, raw, source) {
+        if (!isAuthCandidateName(candidateName)) {
+            return { ok: false, imported: false, reason: 'invalid candidate name' };
+        }
+        return this.withActivity(async () => {
+            if (this.activeCandidateSyncs.has(candidateName)) {
+                return { ok: false, imported: false, reason: 'candidate sync already active' };
+            }
+            this.activeCandidateSyncs.add(candidateName);
+            try {
+                const metadata = parseChatGptAuthMetadata(raw);
+                if (!metadata) {
+                    return { ok: false, imported: false, reason: 'invalid ChatGPT auth payload' };
+                }
+                const existing = (await this.collectAuthRecords())
+                    .filter(entry => entry.candidateName === candidateName);
+                const conflicting = existing.find(entry => entry.record.accountId !== metadata.accountId);
+                if (conflicting) {
+                    return { ok: false, imported: false, reason: 'same candidate belongs to a different account' };
+                }
+                const newest = existing.reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+                const previousRefresh = Math.max(newest?.record.lastRefreshMs ?? 0, this.lastSyncedRefresh.get(candidateName) ?? 0);
+                if (metadata.lastRefreshMs <= previousRefresh) {
+                    return { ok: true, imported: false, reason: 'local candidate is already newer or equal' };
+                }
+                await atomicWrite(path.join(this.canonicalDir, candidateName), raw);
+                for (const target of this.runtimes) {
+                    await atomicWrite(path.join(target.authDir, candidateName), raw);
+                }
+                this.lastSyncedRefresh.set(candidateName, metadata.lastRefreshMs);
+                const sourceLabel = source.label?.trim() || source.nodeId;
+                this.lastStatus = {
+                    candidateName,
+                    sourceRuntimeId: `remote:${source.nodeId}`,
+                    sourceLabel,
+                    syncedAt: new Date().toISOString(),
+                };
+                await writeMirrorStatus(this.statusPath, this.lastStatus);
+                this.logger.info('auth.mirror.remote_imported', { candidateName, sourceNodeId: source.nodeId });
+                const message = `${candidateName} has been synchronized from remote node ${sourceLabel}.`;
+                await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
+                return {
+                    ok: true,
+                    imported: true,
+                    record: {
+                        raw,
+                        ...metadata,
+                        candidateName,
+                        sourceRuntimeId: `remote:${source.nodeId}`,
+                        sourceLabel,
+                    },
+                };
+            }
+            finally {
+                this.activeCandidateSyncs.delete(candidateName);
+            }
+        });
+    }
     async propagateValidatedCandidate(runtime, name) {
         if (this.activeCandidateSyncs.has(name)) {
             return false;
@@ -170,6 +275,15 @@ export class AuthCandidateMirror {
             this.logger.info('auth.mirror.synced', { sourceRuntimeId: runtime.id, name });
             const message = `${name} has been refreshed by ${sourceLabel} and synchronized to the other Codex homes.`;
             await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
+            await this.hooks.onSynced?.({
+                status: this.lastStatus,
+                record: {
+                    ...record,
+                    candidateName: name,
+                    sourceRuntimeId: runtime.id,
+                    sourceLabel,
+                },
+            });
             return true;
         }
         finally {
@@ -269,6 +383,25 @@ export class AuthCandidateMirror {
         const name = path.basename(finalPath);
         return isAuthCandidateName(name) ? name : null;
     }
+    async findNewestRecord(predicate) {
+        const newest = (await this.collectAuthRecords())
+            .filter(predicate)
+            .reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+        if (!newest)
+            return null;
+        return {
+            ...newest.record,
+            candidateName: newest.candidateName,
+            sourceRuntimeId: newest.runtimeId,
+            sourceLabel: this.runtimeLabel(newest.runtimeId),
+        };
+    }
+    runtimeLabel(runtimeId) {
+        if (runtimeId === 'canonical')
+            return 'canonical';
+        const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
+        return runtime?.label ?? runtimeId;
+    }
 }
 export function isAuthCandidateName(name) {
     return name !== 'auth.json'
@@ -281,7 +414,7 @@ async function listAuthCandidateNames(dir) {
         .filter((entry) => (entry.isFile() || entry.isSymbolicLink()) && isAuthCandidateName(entry.name))
         .map((entry) => entry.name);
 }
-async function readChatGptAuthRecord(filePath) {
+export async function readChatGptAuthRecord(filePath) {
     try {
         const raw = await fs.readFile(filePath, 'utf8');
         const metadata = parseChatGptAuthMetadata(raw);
@@ -301,7 +434,7 @@ export async function readChatGptAuthMetadata(filePath) {
         return null;
     }
 }
-function parseChatGptAuthMetadata(raw) {
+export function parseChatGptAuthMetadata(raw) {
     try {
         const parsed = JSON.parse(raw);
         const accountId = typeof parsed.tokens?.account_id === 'string' ? parsed.tokens.account_id : '';

package/dist/config.d.ts

@@ -8,6 +8,8 @@ export declare const DEFAULT_LOCK_PATH: string;
 export declare const DEFAULT_CODEX_APP_SERVER_STATE_PATH: string;
 export declare const DEFAULT_CODEX_APP_SERVER_LOG_PATH: string;
 export declare const DEFAULT_CODEX_TELEGRAM_HOME: string;
+export declare const DEFAULT_AUTH_SYNC_STATE_PATH: string;
+export declare const DEFAULT_AUTH_SYNC_TEMP_DIR: string;
 export declare const DEFAULT_ENV_PATH: string;
 export declare function resolveEnvPath(): string;
 export declare function getLoadedEnvPath(): string | null;
@@ -51,6 +53,14 @@ export interface AppConfig {
     weixinMediaDir: string;
     /** Optional `SKRouteTag` header for some IDC deployments. */
     wxIlinkRouteTag: string | null;
+    authSyncEnabled: boolean;
+    authSyncTransport: 'telegram-private';
+    authSyncKey: string | null;
+    authSyncPeers: string[];
+    authSyncNodeId: string | null;
+    authSyncClusterId: string;
+    authSyncStatePath: string;
+    authSyncTempDir: string;
 }
 export declare function loadConfig(): AppConfig;
 export declare function selectDefaultRuntimeBotToken(configuredTokens: string[], legacyToken: string | null): string | null;

package/dist/config.js

@@ -11,6 +11,8 @@ export const DEFAULT_LOCK_PATH = path.join(APP_HOME, 'runtime', 'bridge.lock');
 export const DEFAULT_CODEX_APP_SERVER_STATE_PATH = path.join(APP_HOME, 'runtime', 'codex-app-server.json');
 export const DEFAULT_CODEX_APP_SERVER_LOG_PATH = path.join(APP_HOME, 'logs', 'codex-app-server.log');
 export const DEFAULT_CODEX_TELEGRAM_HOME = path.join(APP_HOME, 'codex', 'telegram');
+export const DEFAULT_AUTH_SYNC_STATE_PATH = path.join(APP_HOME, 'runtime', 'auth-sync.json');
+export const DEFAULT_AUTH_SYNC_TEMP_DIR = path.join(APP_HOME, 'runtime', 'auth-sync');
 export const DEFAULT_ENV_PATH = path.join(APP_HOME, '.env');
 let envLoaded = false;
 let loadedEnvPath = null;
@@ -85,6 +87,14 @@ export function loadConfig() {
         weixinSyncBufDir: process.env.WEIXIN_SYNC_BUF_DIR || path.join(APP_HOME, 'weixin', 'sync-buf'),
         weixinMediaDir: process.env.WEIXIN_MEDIA_DIR || path.join(APP_HOME, 'weixin', 'media'),
         wxIlinkRouteTag: optional('WX_ILINK_ROUTE_TAG'),
+        authSyncEnabled: boolEnv('AUTH_SYNC_ENABLED', false),
+        authSyncTransport: 'telegram-private',
+        authSyncKey: optional('AUTH_SYNC_KEY'),
+        authSyncPeers: parseCommaSeparatedIds(process.env.AUTH_SYNC_PEERS),
+        authSyncNodeId: optional('AUTH_SYNC_NODE_ID'),
+        authSyncClusterId: process.env.AUTH_SYNC_CLUSTER_ID?.trim() || 'default',
+        authSyncStatePath: process.env.AUTH_SYNC_STATE_PATH || DEFAULT_AUTH_SYNC_STATE_PATH,
+        authSyncTempDir: process.env.AUTH_SYNC_TEMP_DIR || DEFAULT_AUTH_SYNC_TEMP_DIR,
     };
     ensureAppDirs(config);
     return config;
@@ -102,7 +112,11 @@ export function ensureAppDirs(config) {
         path.dirname(config.lockPath),
         path.dirname(config.codexAppServerStatePath),
         path.dirname(config.codexAppServerLogPath),
+        path.dirname(config.authSyncStatePath),
     ];
+    if (config.authSyncEnabled) {
+        dirs.push(config.authSyncTempDir);
+    }
     if (config.wxEnabled) {
         dirs.push(config.weixinAccountsDir, config.weixinSyncBufDir, config.weixinMediaDir);
     }

package/dist/controller/controller.d.ts

@@ -10,11 +10,26 @@ export interface CoreCoordinator {
     canSelfUpdate?: () => boolean;
     authCandidateUpdated?: (runtimeId: string, candidateName: string) => Promise<void>;
     recoverAuthCandidate?: (runtimeId: string, candidateName: string) => Promise<boolean>;
+    acquireAuthRefreshLease?: (reason: string) => Promise<{
+        ok: boolean;
+        leaseId: string | null;
+        reason?: string | null;
+    }>;
+    releaseAuthRefreshLease?: (leaseId: string | null) => Promise<void>;
+    getAuthSyncStatus?: () => RuntimeStatus['authSync'];
+    authSyncPushAll?: () => Promise<{
+        sent: number;
+        skipped: number;
+    }>;
+    authSyncTest?: () => Promise<{
+        sent: number;
+    }>;
     statusUpdated?: (status: RuntimeStatus) => void;
     getServiceStatus?: () => Promise<{
         bots: NonNullable<RuntimeStatus['bots']>;
         weixinRuntime?: RuntimeStatus['weixinRuntime'];
         authMirror?: RuntimeStatus['authMirror'];
+        authSync?: RuntimeStatus['authSync'];
         lastUpdate?: SelfUpdateStatus | null;
     }>;
     selfUpdateCompleted?: (status: SelfUpdateStatus) => void;
@@ -157,6 +172,10 @@ export declare class BridgeSessionCore {
     private registerActiveTurn;
     private createActiveTurnState;
     getCurrentAuthLabel(): Promise<string | null>;
+    validateExternalCodexAuthCandidate(candidateName: string, rawAuth: string, expectedAccountId: string): Promise<{
+        ok: boolean;
+        reason?: string | null;
+    }>;
     isIdleForServiceUpdate(): boolean;
     private hasLocalBlockingActivity;
     private authRuntimeId;
@@ -240,6 +259,7 @@ export declare class BridgeSessionCore {
     private formatSelfUpdateResult;
     private formatCodexUpdateResult;
     private handleAuthCommand;
+    private handleAuthSyncCommand;
     private handleAuthRefreshAllCommand;
     private handleAuthUseCommand;
     private handleAuthToggleCommand;

package/dist/controller/controller.js

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { normalizeLocale, t } from '../i18n.js';
-import { readChatGptAuthMetadata } from '../auth/mirror.js';
+import { parseChatGptAuthMetadata, readChatGptAuthMetadata } from '../auth/mirror.js';
 import { parseCommand } from './commands.js';
 import { buildAccessSettingsKeyboard, buildModelSettingsKeyboard, buildSetupPanelKeyboard, buildThreadListKeyboard, buildThreadsKeyboard, clampEffortToModel, formatAccessPresetLabel, formatActiveTurnMessageModeLabel, formatAccessSettingsMessage, formatApprovalPolicyLabel, formatCollaborationModeLabel, formatModelSettingsMessage, formatSandboxModeLabel, formatServiceTierStatusLabel, formatSetupPanelMessage, formatThreadContextSummary, formatThreadsMessage, formatWeixinAccessCopyPaste, formatWeixinModelCopyPaste, formatWeixinThreadsCopyPaste, formatWeixinWhereNavCopyPaste, formatWhereMessage, normalizeRequestedEffort, resolveCurrentModel, resolveActiveTurnMessageMode, resolveRequestedModel, } from './presentation.js';
 import { clampServiceTierToModel, resolveFastTierForModel } from './service_tier.js';
@@ -427,6 +427,16 @@ export class BridgeSessionCore {
                             time: serviceStatus.authMirror.syncedAt,
                         })
                         : t(locale, 'status_auth_mirror_none'));
+                    if (serviceStatus.authSync?.enabled) {
+                        lines.push(t(locale, 'status_auth_sync', {
+                            node: serviceStatus.authSync.nodeId ?? t(locale, 'unknown'),
+                            peers: serviceStatus.authSync.peers.length,
+                            pending: serviceStatus.authSync.pendingImports,
+                        }));
+                        if (serviceStatus.authSync.lastError) {
+                            lines.push(t(locale, 'status_auth_sync_error', { value: serviceStatus.authSync.lastError }));
+                        }
+                    }
                     if (serviceStatus.lastUpdate) {
                         lines.push(t(locale, 'status_last_update', {
                             from: serviceStatus.lastUpdate.fromVersion,
@@ -2619,6 +2629,55 @@ export class BridgeSessionCore {
     async getCurrentAuthLabel() {
         return (await this.listCodexAuthState()).currentLabel;
     }
+    async validateExternalCodexAuthCandidate(candidateName, rawAuth, expectedAccountId) {
+        if (!this.isIdleForServiceUpdate()) {
+            return { ok: false, reason: 'runtime is not idle' };
+        }
+        const metadata = parseChatGptAuthMetadata(rawAuth);
+        if (!metadata || metadata.accountId !== expectedAccountId) {
+            return { ok: false, reason: 'remote auth account id mismatch' };
+        }
+        const state = await this.listCodexAuthState();
+        const existing = state.candidates.find(candidate => candidate.name === candidateName) ?? null;
+        if (existing) {
+            const existingMetadata = await readChatGptAuthMetadata(existing.path);
+            if (existingMetadata && existingMetadata.accountId !== expectedAccountId) {
+                return { ok: false, reason: 'same candidate belongs to a different account' };
+            }
+        }
+        const authStat = await fs.lstat(state.authPath).catch(() => null);
+        const originalRegularAuth = authStat?.isFile()
+            ? await fs.readFile(state.authPath, 'utf8').catch(() => null)
+            : null;
+        const tempPath = path.join(state.authDir, `.auth-sync-validate-${process.pid}-${Date.now()}.json`);
+        try {
+            await fs.writeFile(tempPath, rawAuth, { encoding: 'utf8', mode: 0o600 });
+            await pointCodexAuthAtTarget(state.authDir, state.authPath, tempPath);
+            this.pendingTurnErrors.clear();
+            this.attachedThreads.clear();
+            await this.app.restart();
+            const account = await this.app.readAccount(false);
+            const rateLimits = await this.app.readAccountRateLimits();
+            if (!account || !rateLimits || !selectCodexRateLimitSnapshot(rateLimits)) {
+                return { ok: false, reason: 'Codex did not validate ChatGPT usage for remote auth' };
+            }
+            return { ok: true };
+        }
+        catch (error) {
+            return { ok: false, reason: formatUserError(error) };
+        }
+        finally {
+            await restoreCodexAuthTarget(state.authDir, state.authPath, state.currentTargetPath, originalRegularAuth).catch((error) => {
+                this.logger.warn('codex.auth_sync_restore_failed', { error: toErrorMeta(error) });
+            });
+            await fs.rm(tempPath, { force: true }).catch(() => undefined);
+            this.pendingTurnErrors.clear();
+            this.attachedThreads.clear();
+            await this.app.restart().catch((error) => {
+                this.logger.warn('codex.auth_sync_restart_restore_failed', { error: toErrorMeta(error) });
+            });
+        }
+    }
     isIdleForServiceUpdate() {
         return this.activeTurns.size === 0
             && this.pendingApprovalMessages.size === 0
@@ -3894,6 +3953,10 @@ export class BridgeSessionCore {
     }
     async handleAuthCommand(scopeId, locale, args) {
         const action = args[0]?.toLowerCase() ?? 'list';
+        if (action === 'sync') {
+            await this.handleAuthSyncCommand(scopeId, locale, args.slice(1));
+            return;
+        }
         if (action === 'reload' || action === 'restart') {
             await this.handleAuthReloadCommand(scopeId, locale);
             return;
@@ -3934,6 +3997,39 @@ export class BridgeSessionCore {
         const messageId = await this.sendMessage(scopeId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(scopeId) !== null, record), authChoiceKeyboard(locale, record));
         record.messageId = messageId;
     }
+    async handleAuthSyncCommand(scopeId, locale, args) {
+        const action = args[0]?.toLowerCase() ?? 'status';
+        if (action === 'status') {
+            await this.sendMessage(scopeId, formatAuthSyncStatus(locale, this.coordinator?.getAuthSyncStatus?.() ?? null));
+            return;
+        }
+        if (action === 'test') {
+            const result = await this.coordinator?.authSyncTest?.();
+            if (!result) {
+                await this.sendMessage(scopeId, t(locale, 'auth_sync_disabled'));
+                return;
+            }
+            await this.sendMessage(scopeId, t(locale, 'auth_sync_test_sent', { count: result.sent }));
+            return;
+        }
+        if (action === 'push' && args[1]?.toLowerCase() === 'all') {
+            if (!this.canRunGlobalAuthRefresh()) {
+                await this.sendMessage(scopeId, t(locale, 'auth_sync_push_blocked_active'));
+                return;
+            }
+            const result = await this.coordinator?.authSyncPushAll?.();
+            if (!result) {
+                await this.sendMessage(scopeId, t(locale, 'auth_sync_disabled'));
+                return;
+            }
+            await this.sendMessage(scopeId, t(locale, 'auth_sync_push_done', {
+                sent: result.sent,
+                skipped: result.skipped,
+            }));
+            return;
+        }
+        await this.sendMessage(scopeId, t(locale, 'usage_auth_sync'));
+    }
     async handleAuthRefreshAllCommand(scopeId, locale, confirmed = false) {
         if (!this.canRunGlobalAuthRefresh()) {
             await this.sendMessage(scopeId, t(locale, 'auth_refresh_all_blocked_active'));
@@ -3949,7 +4045,18 @@ export class BridgeSessionCore {
             return;
         }
         await this.sendMessage(scopeId, t(locale, 'auth_refresh_all_starting'));
-        const result = await this.refreshAllCodexAuthCandidates();
+        const lease = await this.coordinator?.acquireAuthRefreshLease?.('auth refresh all');
+        if (lease && !lease.ok) {
+            await this.sendMessage(scopeId, t(locale, 'auth_refresh_all_lease_failed', { error: lease.reason ?? t(locale, 'unknown') }));
+            return;
+        }
+        let result;
+        try {
+            result = await this.refreshAllCodexAuthCandidates();
+        }
+        finally {
+            await this.coordinator?.releaseAuthRefreshLease?.(lease?.leaseId ?? null);
+        }
         const state = await this.listCodexAuthState();
         await this.applySharedCodexAuthQuotaSnapshots(state);
         const record = createPendingAuthChoiceList(scopeId, state.candidates);
@@ -4460,7 +4567,20 @@ export class BridgeSessionCore {
             if (record.messageId !== null) {
                 await this.editMessage(event.scopeId, record.messageId, t(locale, 'auth_refresh_all_starting'), []);
             }
-            const result = await this.refreshAllCodexAuthCandidates();
+            const lease = await this.coordinator?.acquireAuthRefreshLease?.('auth refresh all');
+            if (lease && !lease.ok) {
+                if (record.messageId !== null) {
+                    await this.editMessage(event.scopeId, record.messageId, t(locale, 'auth_refresh_all_lease_failed', { error: lease.reason ?? t(locale, 'unknown') }), authChoiceKeyboard(locale, record));
+                }
+                return;
+            }
+            let result;
+            try {
+                result = await this.refreshAllCodexAuthCandidates();
+            }
+            finally {
+                await this.coordinator?.releaseAuthRefreshLease?.(lease?.leaseId ?? null);
+            }
             const state = await this.listCodexAuthState();
             await this.applySharedCodexAuthQuotaSnapshots(state);
             record.candidates = state.candidates;
@@ -4578,8 +4698,27 @@ export class BridgeSessionCore {
         this.authRotationInProgress = true;
         try {
             const failedTargets = rotation.retry?.failedAuthTargets ?? this.authRotationFailedTargets;
-            const selection = await this.selectNextCodexAuthCandidate(failedTargets);
             const locale = this.localeForChat(rotation.scopeId);
+            const current = (await this.listCodexAuthState()).candidates.find(candidate => candidate.isCurrent) ?? null;
+            if (current) {
+                const recoveredCurrent = await this.recoverCodexAuthCandidate(current.name);
+                if (recoveredCurrent) {
+                    await this.sendMessage(rotation.scopeId, t(locale, 'auth_auto_recovered_current', {
+                        value: current.name,
+                        error: formatShortStatusError(rotation.reason),
+                    }));
+                    this.pendingTurnErrors.clear();
+                    this.attachedThreads.clear();
+                    await this.app.restart();
+                    await this.syncCodexAuthCandidate(current.name);
+                    if (rotation.retry) {
+                        await this.retryTurnAfterAuthRotation(rotation.scopeId, locale, rotation.retry);
+                        return true;
+                    }
+                    return false;
+                }
+            }
+            const selection = await this.selectNextCodexAuthCandidate(failedTargets);
             if (!selection) {
                 await this.sendMessage(rotation.scopeId, t(locale, 'auth_auto_no_candidate', {
                     error: formatShortStatusError(rotation.reason),
@@ -7971,6 +8110,36 @@ function formatAuthRefreshAllResult(locale, result) {
     }
     return lines.join('\n');
 }
+function formatAuthSyncStatus(locale, status) {
+    if (!status?.enabled) {
+        return t(locale, 'auth_sync_disabled');
+    }
+    const lines = [
+        t(locale, 'auth_sync_status_title'),
+        t(locale, 'auth_sync_status_node', { value: status.nodeId ?? t(locale, 'unknown') }),
+        t(locale, 'auth_sync_status_peers', { value: status.peers.length === 0 ? t(locale, 'none') : status.peers.join(', ') }),
+        t(locale, 'auth_sync_status_pending', { value: status.pendingImports }),
+        t(locale, 'auth_sync_status_sent', { value: status.lastSentAt ?? t(locale, 'none') }),
+        t(locale, 'auth_sync_status_received', { value: status.lastReceivedAt ?? t(locale, 'none') }),
+        t(locale, 'auth_sync_status_imported', {
+            value: status.lastImportedAt
+                ? `${status.lastImportCandidate ?? t(locale, 'unknown')} @ ${status.lastImportedAt}`
+                : t(locale, 'none'),
+        }),
+        t(locale, 'auth_sync_status_pull', {
+            value: status.lastPullAt
+                ? `${status.lastPullCandidate ?? t(locale, 'unknown')} @ ${status.lastPullAt}`
+                : t(locale, 'none'),
+        }),
+    ];
+    if (status.activeLeaseId) {
+        lines.push(t(locale, 'auth_sync_status_lease', { value: status.activeLeaseId }));
+    }
+    if (status.lastError) {
+        lines.push(t(locale, 'auth_sync_status_error', { value: status.lastError }));
+    }
+    return lines.join('\n');
+}
 function normalizeHelpUsageKey(name) {
     const normalized = name.toLowerCase();
     switch (normalized) {