@foxden-app/foxclaw 0.4.2 → 0.4.4

package/README.md

@@ -101,7 +101,7 @@ FoxClaw 只响应 `TG_ALLOWED_USER_ID` 的消息——把机器人拉进群不
 **多账号管理：**
 - Codex 账户管理：`/account`、`/quota`、`/login_device`、`/auth add <name>`
 - 触发用量限制时自动在本地 `auth.json_*` 之间切换认证——5 小时限制到了自动换号
-- `/auth` 面板查看、启用、禁用、切换候选账号
+- `/auth` 面板查看、启用、禁用、切换候选账号；多 bot 模式下会按账号 ID 汇总各 runtime 最近掌握的额度快照
 
 **线程与会话：**
 - `/threads`、`/open`、`/new`、`/where`、`/interrupt`——稳定的聊天-线程绑定
@@ -206,7 +206,7 @@ TG_BOT_TOKENS=123456:token_a,234567:token_b
 TG_BOT_TOKEN=123456:token_a
 ```
 
-FoxClaw 仍然只运行一个系统服务。默认情况下，它会为每个 bot 启动独立 `codex app-server` 和独立 `CODEX_HOME`。因此 A 私聊运行 turn 时，B 私聊仍可独立切换自己的 `/auth`。候选凭据由 FoxClaw 在登录或刷新验证后镜像同步，各 bot 的当前选择互不影响。每个 bot 首次私聊发送 `/help` 和 `/status`；`/auth` 会标明正在操作的 bot runtime，`/status` 会列出全部 bot 的连接、runtime 类型、当前 auth 和活动 turn 摘要。
+FoxClaw 仍然只运行一个系统服务。默认情况下，它会为每个 bot 启动独立 `codex app-server` 和独立 `CODEX_HOME`。因此 A 私聊运行 turn 时，B 私聊仍可独立切换自己的 `/auth`。候选凭据由 FoxClaw 在登录或刷新在线验证后镜像同步；切换或重载前还会从其他 Codex home 恢复同账号较新凭据。各 bot 的当前选择互不影响。每个 bot 首次私聊发送 `/help` 和 `/status`；`/auth` 会标明正在操作的 bot runtime，`/status` 会列出全部 bot 的连接、runtime 类型、当前 auth 和活动 turn 摘要。
 
 如果你需要一路 Telegram 与终端互通 session，把同一个 token 同时填入 `TG_BOT_TOKENS` 和 `TG_BOT_TOKEN`。这个 bot 使用默认 `CODEX_HOME`（未设置时通常是 `~/.codex`）和默认 auth，因此能看到终端 Codex 的本地线程；它不再享有隔离 runtime 的“互不影响”保证，切换 auth 会影响终端和其他默认 runtime。
 

package/README_EN.md

@@ -101,7 +101,7 @@ FoxClaw accepts messages only from `TG_ALLOWED_USER_ID`. Putting the bot in a gr
 **Multi-account management:**
 - Codex account controls: `/account`, `/quota`, `/login_device`, `/auth add <name>`
 - Automatic auth rotation across local `auth.json_*` files when a usage limit is hit — seamless account switching
-- `/auth` panel to view, enable, disable, and switch between candidate accounts
+- `/auth` panel to view, enable, disable, and switch between candidate accounts; in multi-bot mode it merges recent quota snapshots by account ID across runtimes
 
 **Threads and sessions:**
 - `/threads`, `/open`, `/new`, `/where`, `/interrupt` — sticky chat-to-thread binding
@@ -206,7 +206,7 @@ TG_BOT_TOKENS=123456:token_a,234567:token_b
 TG_BOT_TOKEN=123456:token_a
 ```
 
-FoxClaw remains one system service. By default, it starts an independent `codex app-server` and `CODEX_HOME` for each bot. While bot A is running a turn, bot B can switch its own `/auth` selection. Candidate credentials are mirrored only after validated login or refresh; current selections remain independent. Send `/help` and `/status` in a private chat with each bot after installation; `/auth` names the runtime being managed, and `/status` summarizes every bot's connection, runtime type, selected auth, and active turns.
+FoxClaw remains one system service. By default, it starts an independent `codex app-server` and `CODEX_HOME` for each bot. While bot A is running a turn, bot B can switch its own `/auth` selection. Candidate credentials are mirrored only after online-validated login or refresh; before switching or reloading, FoxClaw also restores a newer same-account credential from another Codex home when available. Current selections remain independent. Send `/help` and `/status` in a private chat with each bot after installation; `/auth` names the runtime being managed, and `/status` summarizes every bot's connection, runtime type, selected auth, and active turns.
 
 To keep one Telegram bot interoperable with terminal Codex sessions, put the same token in both `TG_BOT_TOKENS` and `TG_BOT_TOKEN`. That bot uses the default `CODEX_HOME` (usually `~/.codex` when unset) and default auth, so it can see local terminal sessions. It no longer has the isolated runtime guarantee: `/auth` switches also affect the terminal and other default runtimes.
 

package/dist/auth/mirror.d.ts

@@ -12,6 +12,12 @@ export interface AuthMirrorStatus {
     sourceLabel: string;
     syncedAt: string;
 }
+export interface AuthMirrorRecovery {
+    candidateName: string;
+    sourceRuntimeId: string;
+    sourceCandidateName: string;
+    lastRefreshMs: number;
+}
 export interface AuthMirrorValidationContext {
     candidateName: string;
     accountId: string;
@@ -21,6 +27,10 @@ export interface AuthMirrorValidationResult {
     ok: boolean;
     reason?: string | null;
 }
+export interface ChatGptAuthMetadata {
+    accountId: string;
+    lastRefreshMs: number;
+}
 export declare class AuthCandidateMirror {
     private readonly canonicalDir;
     private readonly runtimes;
@@ -28,6 +38,7 @@ export declare class AuthCandidateMirror {
     private readonly statusPath;
     private timer;
     private readonly lastSyncedRefresh;
+    private readonly lastValidationFailures;
     private activeOperations;
     private lastStatus;
     constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null);
@@ -37,13 +48,16 @@ export declare class AuthCandidateMirror {
     isIdle(): boolean;
     getStatus(): AuthMirrorStatus | null;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
+    recoverRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorRecovery | null>;
     private scan;
     private propagateValidatedCandidate;
     private validateRuntimeCandidate;
     private withActivity;
     private ensureCanonicalDefaultCandidate;
     private collectCandidateNames;
+    private collectAuthRecords;
     private reconcileCandidateAtStartup;
     private resolveCanonicalCurrentCandidate;
 }
 export declare function isAuthCandidateName(name: string): boolean;
+export declare function readChatGptAuthMetadata(filePath: string): Promise<ChatGptAuthMetadata | null>;

package/dist/auth/mirror.js

@@ -8,6 +8,7 @@ export class AuthCandidateMirror {
     statusPath;
     timer = null;
     lastSyncedRefresh = new Map();
+    lastValidationFailures = new Map();
     activeOperations = 0;
     lastStatus = null;
     constructor(canonicalDir, runtimes, logger, statusPath = null) {
@@ -71,6 +72,39 @@ export class AuthCandidateMirror {
             return false;
         return this.withActivity(() => this.propagateValidatedCandidate(runtime, candidateName));
     }
+    async recoverRuntimeCandidate(runtimeId, candidateName) {
+        if (!isAuthCandidateName(candidateName))
+            return null;
+        const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
+        if (!runtime)
+            return null;
+        return this.withActivity(async () => {
+            const destinationPath = path.join(runtime.authDir, candidateName);
+            const destination = await readChatGptAuthRecord(destinationPath);
+            if (!destination)
+                return null;
+            const sources = await this.collectAuthRecords();
+            const newest = sources
+                .filter(entry => entry.record.accountId === destination.accountId)
+                .reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+            if (!newest || newest.record.lastRefreshMs <= destination.lastRefreshMs) {
+                return null;
+            }
+            await atomicWrite(destinationPath, newest.record.raw);
+            this.logger.info('auth.mirror.recovered', {
+                runtimeId,
+                candidateName,
+                sourceRuntimeId: newest.runtimeId,
+                sourceCandidateName: newest.candidateName,
+            });
+            return {
+                candidateName,
+                sourceRuntimeId: newest.runtimeId,
+                sourceCandidateName: newest.candidateName,
+                lastRefreshMs: newest.record.lastRefreshMs,
+            };
+        });
+    }
     async scan() {
         await this.withActivity(async () => {
             for (const runtime of this.runtimes) {
@@ -98,13 +132,20 @@ export class AuthCandidateMirror {
         }
         const validation = await this.validateRuntimeCandidate(runtime, name, record);
         if (!validation.ok) {
-            this.logger.warn('auth.mirror.validation_failed', {
-                runtimeId: runtime.id,
-                name,
-                reason: validation.reason ?? 'unknown',
-            });
+            const reason = validation.reason ?? 'unknown';
+            const failureKey = `${runtime.id}:${name}`;
+            const failureValue = `${record.lastRefreshMs}:${reason}`;
+            if (this.lastValidationFailures.get(failureKey) !== failureValue) {
+                this.lastValidationFailures.set(failureKey, failureValue);
+                this.logger.warn('auth.mirror.validation_failed', {
+                    runtimeId: runtime.id,
+                    name,
+                    reason,
+                });
+            }
             return false;
         }
+        this.lastValidationFailures.delete(`${runtime.id}:${name}`);
         await atomicWrite(canonicalPath, record.raw);
         for (const target of this.runtimes) {
             if (target.id !== runtime.id) {
@@ -174,6 +215,23 @@ export class AuthCandidateMirror {
         }
         return [...all];
     }
+    async collectAuthRecords() {
+        const directories = [
+            { runtimeId: 'canonical', authDir: this.canonicalDir },
+            ...this.runtimes.map(runtime => ({ runtimeId: runtime.id, authDir: runtime.authDir })),
+        ];
+        const records = [];
+        for (const directory of directories) {
+            const names = new Set(['auth.json', ...await listAuthCandidateNames(directory.authDir)]);
+            for (const candidateName of names) {
+                const record = await readChatGptAuthRecord(path.join(directory.authDir, candidateName));
+                if (record) {
+                    records.push({ runtimeId: directory.runtimeId, candidateName, record });
+                }
+            }
+        }
+        return records;
+    }
     async reconcileCandidateAtStartup(name) {
         const paths = [
             path.join(this.canonicalDir, name),
@@ -216,12 +274,31 @@ async function listAuthCandidateNames(dir) {
 async function readChatGptAuthRecord(filePath) {
     try {
         const raw = await fs.readFile(filePath, 'utf8');
+        const metadata = parseChatGptAuthMetadata(raw);
+        if (!metadata)
+            return null;
+        return { raw, ...metadata };
+    }
+    catch {
+        return null;
+    }
+}
+export async function readChatGptAuthMetadata(filePath) {
+    try {
+        return parseChatGptAuthMetadata(await fs.readFile(filePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function parseChatGptAuthMetadata(raw) {
+    try {
         const parsed = JSON.parse(raw);
         const accountId = typeof parsed.tokens?.account_id === 'string' ? parsed.tokens.account_id : '';
         const lastRefreshMs = typeof parsed.last_refresh === 'string' ? Date.parse(parsed.last_refresh) : NaN;
         if (!accountId || !Number.isFinite(lastRefreshMs))
             return null;
-        return { raw, accountId, lastRefreshMs };
+        return { accountId, lastRefreshMs };
     }
     catch {
         return null;

package/dist/controller/controller.d.ts

@@ -9,6 +9,7 @@ import type { SelfUpdateRuntime, SelfUpdateStatus } from '../update.js';
 export interface CoreCoordinator {
     canSelfUpdate?: () => boolean;
     authCandidateUpdated?: (runtimeId: string, candidateName: string) => Promise<void>;
+    recoverAuthCandidate?: (runtimeId: string, candidateName: string) => Promise<boolean>;
     statusUpdated?: (status: RuntimeStatus) => void;
     getServiceStatus?: () => Promise<{
         bots: NonNullable<RuntimeStatus['bots']>;
@@ -285,6 +286,8 @@ export declare class BridgeSessionCore {
     private readCodexAuthSwitchLabels;
     private codexAuthSwitchParams;
     private switchCodexAuthAndRestart;
+    private recoverCodexAuthCandidate;
+    private syncCodexAuthCandidate;
     private buildNativeCollaborationMode;
     private buildCodexUsageStatusLines;
     private buildCodexLocalUsageStatusLines;
@@ -295,6 +298,9 @@ export declare class BridgeSessionCore {
     private refreshCodexLocalUsageStats;
     private codexLocalUsageSnapshotPath;
     private refreshCurrentCodexAuthQuota;
+    private applySharedCodexAuthQuotaSnapshots;
+    private readCodexAuthCandidateAccountIds;
+    private codexAuthQuotaSnapshotMatchesAccount;
     private readCodexAuthQuotaSnapshots;
     private writeCodexAuthQuotaSnapshots;
     private codexAuthQuotaSnapshotPath;

package/dist/controller/controller.js

@@ -3,6 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { normalizeLocale, t } from '../i18n.js';
+import { readChatGptAuthMetadata } from '../auth/mirror.js';
 import { parseCommand } from './commands.js';
 import { buildAccessSettingsKeyboard, buildModelSettingsKeyboard, buildSetupPanelKeyboard, buildThreadListKeyboard, buildThreadsKeyboard, clampEffortToModel, formatAccessPresetLabel, formatActiveTurnMessageModeLabel, formatAccessSettingsMessage, formatApprovalPolicyLabel, formatCollaborationModeLabel, formatModelSettingsMessage, formatSandboxModeLabel, formatServiceTierStatusLabel, formatSetupPanelMessage, formatThreadContextSummary, formatThreadsMessage, formatWeixinAccessCopyPaste, formatWeixinModelCopyPaste, formatWeixinThreadsCopyPaste, formatWeixinWhereNavCopyPaste, formatWhereMessage, normalizeRequestedEffort, resolveCurrentModel, resolveActiveTurnMessageMode, resolveRequestedModel, } from './presentation.js';
 import { clampServiceTierToModel, resolveFastTierForModel } from './service_tier.js';
@@ -3761,10 +3762,20 @@ export class BridgeSessionCore {
             return;
         }
         await this.sendMessage(scopeId, t(locale, 'auth_reload_restarting'));
+        const currentCandidate = (await this.listCodexAuthState()).candidates.find(candidate => candidate.isCurrent) ?? null;
+        const recovered = currentCandidate
+            ? await this.recoverCodexAuthCandidate(currentCandidate.name)
+            : false;
         this.pendingTurnErrors.clear();
         this.attachedThreads.clear();
         await this.app.restart();
+        if (currentCandidate) {
+            await this.syncCodexAuthCandidate(currentCandidate.name);
+        }
         const lines = [t(locale, 'auth_reload_done')];
+        if (recovered) {
+            lines.push(t(locale, 'auth_recovered_newer_candidate', { value: currentCandidate.name }));
+        }
         lines.push(...await this.buildCodexUsageStatusLines(locale));
         await this.sendMessage(scopeId, lines.join('\n'));
     }
@@ -4510,9 +4521,15 @@ export class BridgeSessionCore {
     async listCodexAuthState() {
         const state = await listCodexAuthState(this.store.listDisabledCodexAuthCandidateNames(this.authRuntimeId()), this.resolveAuthDir());
         const snapshots = await this.readCodexAuthQuotaSnapshots();
+        const candidateAccountIds = await this.readCodexAuthCandidateAccountIds(state.candidates);
         state.candidates.forEach((candidate) => {
-            candidate.quota = snapshots[candidate.name] ?? null;
+            const candidateAccountId = candidateAccountIds.get(candidate.name) ?? null;
+            const snapshot = snapshots[candidate.name] ?? null;
+            candidate.quota = this.codexAuthQuotaSnapshotMatchesAccount(snapshot, candidateAccountId)
+                ? snapshot
+                : null;
         });
+        await this.applySharedCodexAuthQuotaSnapshots(state, candidateAccountIds);
         return state;
     }
     resolveAuthDir() {
@@ -4535,15 +4552,48 @@ export class BridgeSessionCore {
         };
     }
     async switchCodexAuthAndRestart(scopeId, locale, candidate, automatic) {
+        const recovered = await this.recoverCodexAuthCandidate(candidate.name);
         const result = await switchCodexAuth(candidate.path, this.resolveAuthDir());
         this.authRotationFailedTargets.delete(candidate.path);
         this.pendingTurnErrors.clear();
         this.attachedThreads.clear();
         await this.app.restart();
+        await this.syncCodexAuthCandidate(candidate.name);
         const lines = [t(locale, automatic ? 'auth_auto_done' : 'auth_switch_done', this.codexAuthSwitchParams(locale, result.fromLabel, result.toLabel))];
+        if (recovered) {
+            lines.push(t(locale, 'auth_recovered_newer_candidate', { value: candidate.name }));
+        }
         lines.push(...await this.buildCodexUsageStatusLines(locale));
         await this.sendMessage(scopeId, lines.join('\n'));
     }
+    async recoverCodexAuthCandidate(candidateName) {
+        if (!this.coordinator?.recoverAuthCandidate) {
+            return false;
+        }
+        try {
+            return await this.coordinator.recoverAuthCandidate(this.authRuntimeId(), candidateName);
+        }
+        catch (error) {
+            this.logger.warn('codex.auth_candidate_recovery_failed', {
+                candidate: candidateName,
+                runtimeId: this.authRuntimeId(),
+                error: toErrorMeta(error),
+            });
+            return false;
+        }
+    }
+    async syncCodexAuthCandidate(candidateName) {
+        try {
+            await this.coordinator?.authCandidateUpdated?.(this.authRuntimeId(), candidateName);
+        }
+        catch (error) {
+            this.logger.warn('codex.auth_candidate_sync_failed', {
+                candidate: candidateName,
+                runtimeId: this.authRuntimeId(),
+                error: toErrorMeta(error),
+            });
+        }
+    }
     async buildNativeCollaborationMode(settings, cwd, modeOverride) {
         const mode = resolveCollaborationMode(modeOverride === undefined ? settings?.collaborationMode ?? null : modeOverride);
         try {
@@ -4741,19 +4791,68 @@ export class BridgeSessionCore {
             return;
         }
         try {
+            const metadata = await readChatGptAuthMetadata(candidate.path);
             const snapshot = selectCodexRateLimitSnapshot(await this.app.readAccountRateLimits());
             if (!snapshot) {
                 return;
             }
-            const quota = authQuotaSnapshotFromRateLimit(snapshot);
+            const quota = authQuotaSnapshotFromRateLimit(snapshot, metadata?.accountId ?? null);
             candidate.quota = quota;
             this.authQuotaSnapshots[candidate.name] = quota;
+            if (metadata?.accountId) {
+                this.store.setCodexAuthQuotaSnapshot(this.authRuntimeId(), candidate.name, metadata.accountId, quota);
+            }
             await this.writeCodexAuthQuotaSnapshots();
+            await this.applySharedCodexAuthQuotaSnapshots(state);
+            await this.syncCodexAuthCandidate(candidate.name);
         }
         catch (error) {
             this.logger.warn('codex.auth_quota_refresh_failed', { error: formatUserError(error) });
         }
     }
+    async applySharedCodexAuthQuotaSnapshots(state, candidateAccountIds) {
+        const accountIds = candidateAccountIds ?? await this.readCodexAuthCandidateAccountIds(state.candidates);
+        const uniqueAccountIds = [...new Set(accountIds.values())];
+        if (uniqueAccountIds.length === 0) {
+            return;
+        }
+        const snapshotsByAccount = new Map();
+        for (const record of this.store.listCodexAuthQuotaSnapshots(uniqueAccountIds)) {
+            if (!isFiniteCodexAuthQuotaSnapshotRecord(record)) {
+                continue;
+            }
+            snapshotsByAccount.set(record.accountId, mergeCodexAuthQuotaSnapshots(snapshotsByAccount.get(record.accountId) ?? null, codexAuthQuotaSnapshotFromRecord(record)));
+        }
+        for (const candidate of state.candidates) {
+            const accountId = accountIds.get(candidate.name);
+            if (!accountId) {
+                continue;
+            }
+            candidate.quota = mergeCodexAuthQuotaSnapshots(candidate.quota, snapshotsByAccount.get(accountId) ?? null);
+        }
+    }
+    async readCodexAuthCandidateAccountIds(candidates) {
+        const entries = await Promise.all(candidates.map(async (candidate) => {
+            const metadata = await readChatGptAuthMetadata(candidate.path);
+            return [candidate.name, metadata?.accountId ?? null];
+        }));
+        const accountIds = new Map();
+        for (const [name, accountId] of entries) {
+            if (accountId) {
+                accountIds.set(name, accountId);
+            }
+        }
+        return accountIds;
+    }
+    codexAuthQuotaSnapshotMatchesAccount(snapshot, accountId) {
+        if (!snapshot) {
+            return false;
+        }
+        if (!snapshot.accountId) {
+            return accountId === null;
+        }
+        return accountId !== null && snapshot.accountId === accountId;
+    }
     async readCodexAuthQuotaSnapshots() {
         if (this.authQuotaSnapshotsLoaded) {
             return this.authQuotaSnapshots;
@@ -7934,13 +8033,50 @@ function formatRemainingUsagePercent(usedPercent) {
     const remainingPercent = remainingUsagePercent(usedPercent);
     return remainingPercent === null ? '?' : formatUsagePercent(remainingPercent);
 }
-function authQuotaSnapshotFromRateLimit(snapshot) {
+function authQuotaSnapshotFromRateLimit(snapshot, accountId = null) {
     return {
         capturedAtMs: Date.now(),
+        accountId,
         primaryRemainingPercent: snapshot.primary ? remainingUsagePercent(snapshot.primary.usedPercent) : null,
         secondaryRemainingPercent: snapshot.secondary ? remainingUsagePercent(snapshot.secondary.usedPercent) : null,
     };
 }
+function codexAuthQuotaSnapshotFromRecord(record) {
+    return {
+        capturedAtMs: record.capturedAtMs,
+        accountId: record.accountId,
+        primaryRemainingPercent: record.primaryRemainingPercent,
+        secondaryRemainingPercent: record.secondaryRemainingPercent,
+    };
+}
+function mergeCodexAuthQuotaSnapshots(current, incoming) {
+    if (!current) {
+        return incoming;
+    }
+    if (!incoming) {
+        return current;
+    }
+    return {
+        capturedAtMs: Math.max(current.capturedAtMs, incoming.capturedAtMs),
+        accountId: current.accountId ?? incoming.accountId ?? null,
+        primaryRemainingPercent: fresherNullableQuotaValue(current.primaryRemainingPercent, current.capturedAtMs, incoming.primaryRemainingPercent, incoming.capturedAtMs),
+        secondaryRemainingPercent: fresherNullableQuotaValue(current.secondaryRemainingPercent, current.capturedAtMs, incoming.secondaryRemainingPercent, incoming.capturedAtMs),
+    };
+}
+function fresherNullableQuotaValue(currentValue, currentCapturedAtMs, incomingValue, incomingCapturedAtMs) {
+    if (currentValue === null) {
+        return incomingValue;
+    }
+    if (incomingValue === null) {
+        return currentValue;
+    }
+    return incomingCapturedAtMs >= currentCapturedAtMs ? incomingValue : currentValue;
+}
+function isFiniteCodexAuthQuotaSnapshotRecord(record) {
+    return Number.isFinite(record.capturedAtMs)
+        && isNullableFiniteNumber(record.primaryRemainingPercent)
+        && isNullableFiniteNumber(record.secondaryRemainingPercent);
+}
 function remainingUsagePercent(usedPercent) {
     if (!Number.isFinite(usedPercent)) {
         return null;
@@ -7962,6 +8098,7 @@ function isCodexAuthQuotaSnapshot(value) {
     const snapshot = value;
     return typeof snapshot.capturedAtMs === 'number'
         && Number.isFinite(snapshot.capturedAtMs)
+        && (snapshot.accountId === undefined || snapshot.accountId === null || typeof snapshot.accountId === 'string')
         && isNullableFiniteNumber(snapshot.primaryRemainingPercent)
         && isNullableFiniteNumber(snapshot.secondaryRemainingPercent);
 }

package/dist/i18n.d.ts

@@ -157,6 +157,7 @@ declare const MESSAGES: {
         readonly auth_choice_recorded: "Auth selected";
         readonly auth_switching: "Switching Codex auth: {from} -> {to}...";
         readonly auth_switch_done: "Codex auth switched: {from} -> {to}.";
+        readonly auth_recovered_newer_candidate: "Recovered a newer same-account credential for {value} from another Codex home before reload.";
         readonly auth_auto_switching: "Codex auth problem detected ({error}). Switching: {from} -> {to}...";
         readonly auth_auto_done: "Auto-switched Codex auth: {from} -> {to}.";
         readonly auth_auto_retrying: "Retrying the same request with the new auth...";
@@ -732,6 +733,7 @@ declare const MESSAGES: {
         readonly auth_choice_recorded: "已选择 auth";
         readonly auth_switching: "正在切换 Codex auth：{from} -> {to}...";
         readonly auth_switch_done: "Codex auth 已切换：{from} -> {to}。";
+        readonly auth_recovered_newer_candidate: "重载前已从其他 Codex home 恢复 {value} 的同账号较新凭据。";
         readonly auth_auto_switching: "检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...";
         readonly auth_auto_done: "已自动切换 Codex auth：{from} -> {to}。";
         readonly auth_auto_retrying: "正在用新的 auth 重试同一条请求...";

package/dist/i18n.js

@@ -155,6 +155,7 @@ const MESSAGES = {
         auth_choice_recorded: 'Auth selected',
         auth_switching: 'Switching Codex auth: {from} -> {to}...',
         auth_switch_done: 'Codex auth switched: {from} -> {to}.',
+        auth_recovered_newer_candidate: 'Recovered a newer same-account credential for {value} from another Codex home before reload.',
         auth_auto_switching: 'Codex auth problem detected ({error}). Switching: {from} -> {to}...',
         auth_auto_done: 'Auto-switched Codex auth: {from} -> {to}.',
         auth_auto_retrying: 'Retrying the same request with the new auth...',
@@ -730,6 +731,7 @@ const MESSAGES = {
         auth_choice_recorded: '已选择 auth',
         auth_switching: '正在切换 Codex auth：{from} -> {to}...',
         auth_switch_done: 'Codex auth 已切换：{from} -> {to}。',
+        auth_recovered_newer_candidate: '重载前已从其他 Codex home 恢复 {value} 的同账号较新凭据。',
         auth_auto_switching: '检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...',
         auth_auto_done: '已自动切换 Codex auth：{from} -> {to}。',
         auth_auto_retrying: '正在用新的 auth 重试同一条请求...',

package/dist/main.js

@@ -279,6 +279,7 @@ async function runServeCli() {
                     && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
                     && mirror.isIdle(),
                 authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
+                recoverAuthCandidate: (runtimeId, candidateName) => mirror.recoverRuntimeCandidate(runtimeId, candidateName).then(recovery => recovery !== null),
                 statusUpdated: () => writeAggregateStatus(),
                 getServiceStatus: async () => ({
                     bots: await Promise.all(runtimes.map(async (runtime) => {
@@ -441,11 +442,10 @@ async function validateRefreshedAuthCandidate(runtime, candidateName) {
     if (!runtime.app.isConnected()) {
         return { ok: false, reason: 'source app-server is not connected' };
     }
-    const account = await runtime.app.readAccount();
-    if (!account || account.type !== 'chatgpt' || account.requiresOpenaiAuth) {
-        return { ok: false, reason: 'source app-server did not report an active ChatGPT account' };
+    const rateLimits = await runtime.app.readAccountRateLimits();
+    if (!rateLimits) {
+        return { ok: false, reason: 'source app-server did not return ChatGPT rate limits' };
     }
-    await runtime.app.readAccountRateLimits();
     return { ok: true };
 }
 async function initConfig() {

package/dist/store/database.d.ts

@@ -24,6 +24,15 @@ export interface PendingUserInputStoredRecord {
     submittedAt: number | null;
     resolvedAt: number | null;
 }
+export interface CodexAuthQuotaSnapshotRecord {
+    runtimeId: string;
+    candidateName: string;
+    accountId: string;
+    capturedAtMs: number;
+    primaryRemainingPercent: number | null;
+    secondaryRemainingPercent: number | null;
+    updatedAt: number;
+}
 export declare class BridgeStore {
     private db;
     constructor(dbPath: string);
@@ -77,5 +86,7 @@ export declare class BridgeStore {
     setWeixinContextToken(scopeId: string, contextToken: string): void;
     listDisabledCodexAuthCandidateNames(runtimeId?: string): Set<string>;
     setCodexAuthCandidateDisabled(name: string, disabled: boolean, runtimeId?: string): void;
+    setCodexAuthQuotaSnapshot(runtimeId: string, candidateName: string, accountId: string, snapshot: Pick<CodexAuthQuotaSnapshotRecord, 'capturedAtMs' | 'primaryRemainingPercent' | 'secondaryRemainingPercent'>): void;
+    listCodexAuthQuotaSnapshots(accountIds: string[]): CodexAuthQuotaSnapshotRecord[];
     private ensureColumn;
 }

package/dist/store/database.js

@@ -123,6 +123,18 @@ export class BridgeStore {
         updated_at INTEGER NOT NULL,
         PRIMARY KEY (runtime_id, name)
       );
+      CREATE TABLE IF NOT EXISTS codex_auth_quota_snapshots (
+        runtime_id TEXT NOT NULL,
+        candidate_name TEXT NOT NULL,
+        account_id TEXT NOT NULL,
+        captured_at_ms INTEGER NOT NULL,
+        primary_remaining_percent REAL,
+        secondary_remaining_percent REAL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (runtime_id, candidate_name)
+      );
+      CREATE INDEX IF NOT EXISTS codex_auth_quota_snapshots_account_idx
+        ON codex_auth_quota_snapshots(account_id);
     `);
         this.ensureColumn('thread_cache', 'name', 'TEXT');
         this.ensureColumn('thread_cache', 'model_provider', 'TEXT');
@@ -509,6 +521,54 @@ export class BridgeStore {
       ON CONFLICT(name) DO UPDATE SET disabled = excluded.disabled, updated_at = excluded.updated_at
     `).run(name, disabled ? 1 : 0, Date.now());
     }
+    setCodexAuthQuotaSnapshot(runtimeId, candidateName, accountId, snapshot) {
+        this.db.prepare(`
+      INSERT INTO codex_auth_quota_snapshots (
+        runtime_id,
+        candidate_name,
+        account_id,
+        captured_at_ms,
+        primary_remaining_percent,
+        secondary_remaining_percent,
+        updated_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(runtime_id, candidate_name) DO UPDATE SET
+        account_id = excluded.account_id,
+        captured_at_ms = excluded.captured_at_ms,
+        primary_remaining_percent = excluded.primary_remaining_percent,
+        secondary_remaining_percent = excluded.secondary_remaining_percent,
+        updated_at = excluded.updated_at
+    `).run(runtimeId, candidateName, accountId, snapshot.capturedAtMs, snapshot.primaryRemainingPercent, snapshot.secondaryRemainingPercent, Date.now());
+    }
+    listCodexAuthQuotaSnapshots(accountIds) {
+        const uniqueAccountIds = [...new Set(accountIds.filter(Boolean))];
+        if (uniqueAccountIds.length === 0) {
+            return [];
+        }
+        const placeholders = uniqueAccountIds.map(() => '?').join(', ');
+        const rows = this.db.prepare(`
+      SELECT
+        runtime_id,
+        candidate_name,
+        account_id,
+        captured_at_ms,
+        primary_remaining_percent,
+        secondary_remaining_percent,
+        updated_at
+      FROM codex_auth_quota_snapshots
+      WHERE account_id IN (${placeholders})
+    `).all(...uniqueAccountIds);
+        return rows.map(row => ({
+            runtimeId: String(row.runtime_id),
+            candidateName: String(row.candidate_name),
+            accountId: String(row.account_id),
+            capturedAtMs: Number(row.captured_at_ms),
+            primaryRemainingPercent: nullableNumber(row.primary_remaining_percent),
+            secondaryRemainingPercent: nullableNumber(row.secondary_remaining_percent),
+            updatedAt: Number(row.updated_at),
+        }));
+    }
     ensureColumn(table, column, definition) {
         const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
         if (columns.some(entry => entry.name === column)) {
@@ -517,6 +577,13 @@ export class BridgeStore {
         this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
     }
 }
+function nullableNumber(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    const numberValue = Number(value);
+    return Number.isFinite(numberValue) ? numberValue : null;
+}
 function normalizeCollaborationMode(value) {
     return value === 'default' || value === 'plan' ? value : null;
 }

package/docs/user-manual.md

@@ -359,7 +359,7 @@ FoxClaw recognizes candidate names in these forms:
 - `auth.json.<name>`
 - `auth.json-<name>`
 
-`auth.json` is what Codex currently uses. When switching accounts, FoxClaw points `auth.json` at one candidate. Candidate contents are Codex-generated JSON and should not be hand-written. In multi-bot mode, FoxClaw mirrors a candidate only when its account identity matches and its refresh timestamp is newer, preventing a same-name candidate from overwriting a different account.
+`auth.json` is what Codex currently uses. When switching accounts, FoxClaw points `auth.json` at one candidate. Candidate contents are Codex-generated JSON and should not be hand-written. In multi-bot mode, FoxClaw mirrors a candidate only when its account identity matches, its refresh timestamp is newer, and the active app-server verifies it against the ChatGPT usage endpoint, preventing a same-name candidate from overwriting a different account. Before an auth switch or reload, FoxClaw also searches the other Codex homes for a newer credential with the same account ID, restores it into the requesting runtime, then verifies and mirrors it after restart.
 
 If you already have a working `auth.json`, you can save it as a candidate:
 
@@ -389,7 +389,7 @@ If the login is cancelled or fails, FoxClaw tries to restore the previous auth t
 
 ### 6.3 The `/auth` Panel
 
-`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota.
+`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota. When multiple bot runtimes have recently used the same ChatGPT account, FoxClaw combines their cached quota snapshots by verified account ID, so one bot's `/auth` panel can show quota information learned by another bot without mixing different accounts.
 
 Approximation:
 

package/docs/zh/user-manual.md

@@ -359,7 +359,7 @@ FoxClaw 识别这些候选文件名：
 - `auth.json.<name>`
 - `auth.json-<name>`
 
-`auth.json` 是 Codex 当前使用的文件。切换账号时，FoxClaw 会把 `auth.json` 指向某个候选文件。候选文件内容是 Codex CLI 生成的 JSON，不建议手写这些字段。多 bot 镜像只在能校验同一账号标识且刷新时间更新时复制候选，避免同名候选意外覆盖成另一个账号。
+`auth.json` 是 Codex 当前使用的文件。切换账号时，FoxClaw 会把 `auth.json` 指向某个候选文件。候选文件内容是 Codex CLI 生成的 JSON，不建议手写这些字段。多 bot 镜像只在账号标识一致、刷新时间更新，并且由当前 app-server 通过 ChatGPT 用量接口在线验证时复制候选，避免同名候选意外覆盖成另一个账号。切换或重载 auth 之前，FoxClaw 还会在其他 Codex home 中查找同账号 ID 的较新凭据，先恢复到发起操作的 runtime，再在重启后验证并镜像。
 
 如果你已经有一个可用的 `auth.json`，可以先备份成候选：
 
@@ -389,7 +389,7 @@ cp -L ~/.codex/auth.json ~/.codex/auth.json_personal
 
 ### 6.3 `/auth` 面板
 
-`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。
+`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。如果多个 bot runtime 最近使用过同一个 ChatGPT 账号，FoxClaw 会按已验证的账号 ID 合并它们缓存到的额度快照，因此一个 bot 的 `/auth` 面板可以显示另一个 bot 掌握到的额度信息，同时不会把不同账号混在一起。
 
 示意：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",

package/skills/foxclaw/SKILL.md

@@ -66,6 +66,7 @@ Telegram behavior:
 - `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` choose the default group or topic scope; they do not disable private chat
 - when `TG_BOT_TOKENS` contains multiple bots, one FoxClaw service starts independent Codex app-servers and auth selections per bot
 - isolated Telegram runtimes use independent `CODEX_HOME` directories and file-backed credentials; they do not share Codex sessions
+- refreshed ChatGPT candidates are mirrored only after online usage-endpoint validation; before auth switch or reload, a runtime restores any newer same-account credential found in another Codex home
 - if `TG_BOT_TOKEN` is also set to one exact token from `TG_BOT_TOKENS`, that bot uses the default/shared-terminal runtime instead of an isolated Telegram home
 - if Weixin is enabled alongside multiple Telegram bots, it remains on the default Codex runtime instead of borrowing a Telegram bot runtime
 - in a group with multiple configured bots, address a bot by mention, reply, or suffixed command such as `/status@botname`
@@ -146,7 +147,7 @@ After either bootstrap path:
    - the bot is an admin in the group
    - the configured `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` match the target group/topic
 5. If group or topic mode is enabled, also verify that private chat still responds for the configured `TG_ALLOWED_USER_ID`.
-6. With multiple bots, send `/status` and `/auth` privately to each bot; verify the status lists each app-server and the auth panel names the intended bot runtime.
+6. With multiple bots, send `/status` and `/auth` privately to each bot; verify the status lists each app-server, the auth panel names the intended bot runtime, and `/auth` quota snapshots are combined only for matching ChatGPT account IDs.
 
 ## First Telegram Message Check