@foxden-app/foxclaw 0.4.3 → 0.4.4

package/README.md

@@ -206,7 +206,7 @@ TG_BOT_TOKENS=123456:token_a,234567:token_b
 TG_BOT_TOKEN=123456:token_a
 ```
 
-FoxClaw 仍然只运行一个系统服务。默认情况下，它会为每个 bot 启动独立 `codex app-server` 和独立 `CODEX_HOME`。因此 A 私聊运行 turn 时，B 私聊仍可独立切换自己的 `/auth`。候选凭据由 FoxClaw 在登录或刷新验证后镜像同步，各 bot 的当前选择互不影响。每个 bot 首次私聊发送 `/help` 和 `/status`；`/auth` 会标明正在操作的 bot runtime，`/status` 会列出全部 bot 的连接、runtime 类型、当前 auth 和活动 turn 摘要。
+FoxClaw 仍然只运行一个系统服务。默认情况下，它会为每个 bot 启动独立 `codex app-server` 和独立 `CODEX_HOME`。因此 A 私聊运行 turn 时，B 私聊仍可独立切换自己的 `/auth`。候选凭据由 FoxClaw 在登录或刷新在线验证后镜像同步；切换或重载前还会从其他 Codex home 恢复同账号较新凭据。各 bot 的当前选择互不影响。每个 bot 首次私聊发送 `/help` 和 `/status`；`/auth` 会标明正在操作的 bot runtime，`/status` 会列出全部 bot 的连接、runtime 类型、当前 auth 和活动 turn 摘要。
 
 如果你需要一路 Telegram 与终端互通 session，把同一个 token 同时填入 `TG_BOT_TOKENS` 和 `TG_BOT_TOKEN`。这个 bot 使用默认 `CODEX_HOME`（未设置时通常是 `~/.codex`）和默认 auth，因此能看到终端 Codex 的本地线程；它不再享有隔离 runtime 的“互不影响”保证，切换 auth 会影响终端和其他默认 runtime。
 

package/README_EN.md

@@ -206,7 +206,7 @@ TG_BOT_TOKENS=123456:token_a,234567:token_b
 TG_BOT_TOKEN=123456:token_a
 ```
 
-FoxClaw remains one system service. By default, it starts an independent `codex app-server` and `CODEX_HOME` for each bot. While bot A is running a turn, bot B can switch its own `/auth` selection. Candidate credentials are mirrored only after validated login or refresh; current selections remain independent. Send `/help` and `/status` in a private chat with each bot after installation; `/auth` names the runtime being managed, and `/status` summarizes every bot's connection, runtime type, selected auth, and active turns.
+FoxClaw remains one system service. By default, it starts an independent `codex app-server` and `CODEX_HOME` for each bot. While bot A is running a turn, bot B can switch its own `/auth` selection. Candidate credentials are mirrored only after online-validated login or refresh; before switching or reloading, FoxClaw also restores a newer same-account credential from another Codex home when available. Current selections remain independent. Send `/help` and `/status` in a private chat with each bot after installation; `/auth` names the runtime being managed, and `/status` summarizes every bot's connection, runtime type, selected auth, and active turns.
 
 To keep one Telegram bot interoperable with terminal Codex sessions, put the same token in both `TG_BOT_TOKENS` and `TG_BOT_TOKEN`. That bot uses the default `CODEX_HOME` (usually `~/.codex` when unset) and default auth, so it can see local terminal sessions. It no longer has the isolated runtime guarantee: `/auth` switches also affect the terminal and other default runtimes.
 

package/dist/auth/mirror.d.ts

@@ -12,6 +12,12 @@ export interface AuthMirrorStatus {
     sourceLabel: string;
     syncedAt: string;
 }
+export interface AuthMirrorRecovery {
+    candidateName: string;
+    sourceRuntimeId: string;
+    sourceCandidateName: string;
+    lastRefreshMs: number;
+}
 export interface AuthMirrorValidationContext {
     candidateName: string;
     accountId: string;
@@ -32,6 +38,7 @@ export declare class AuthCandidateMirror {
     private readonly statusPath;
     private timer;
     private readonly lastSyncedRefresh;
+    private readonly lastValidationFailures;
     private activeOperations;
     private lastStatus;
     constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null);
@@ -41,12 +48,14 @@ export declare class AuthCandidateMirror {
     isIdle(): boolean;
     getStatus(): AuthMirrorStatus | null;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
+    recoverRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorRecovery | null>;
     private scan;
     private propagateValidatedCandidate;
     private validateRuntimeCandidate;
     private withActivity;
     private ensureCanonicalDefaultCandidate;
     private collectCandidateNames;
+    private collectAuthRecords;
     private reconcileCandidateAtStartup;
     private resolveCanonicalCurrentCandidate;
 }

package/dist/auth/mirror.js

@@ -8,6 +8,7 @@ export class AuthCandidateMirror {
     statusPath;
     timer = null;
     lastSyncedRefresh = new Map();
+    lastValidationFailures = new Map();
     activeOperations = 0;
     lastStatus = null;
     constructor(canonicalDir, runtimes, logger, statusPath = null) {
@@ -71,6 +72,39 @@ export class AuthCandidateMirror {
             return false;
         return this.withActivity(() => this.propagateValidatedCandidate(runtime, candidateName));
     }
+    async recoverRuntimeCandidate(runtimeId, candidateName) {
+        if (!isAuthCandidateName(candidateName))
+            return null;
+        const runtime = this.runtimes.find((entry) => entry.id === runtimeId);
+        if (!runtime)
+            return null;
+        return this.withActivity(async () => {
+            const destinationPath = path.join(runtime.authDir, candidateName);
+            const destination = await readChatGptAuthRecord(destinationPath);
+            if (!destination)
+                return null;
+            const sources = await this.collectAuthRecords();
+            const newest = sources
+                .filter(entry => entry.record.accountId === destination.accountId)
+                .reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+            if (!newest || newest.record.lastRefreshMs <= destination.lastRefreshMs) {
+                return null;
+            }
+            await atomicWrite(destinationPath, newest.record.raw);
+            this.logger.info('auth.mirror.recovered', {
+                runtimeId,
+                candidateName,
+                sourceRuntimeId: newest.runtimeId,
+                sourceCandidateName: newest.candidateName,
+            });
+            return {
+                candidateName,
+                sourceRuntimeId: newest.runtimeId,
+                sourceCandidateName: newest.candidateName,
+                lastRefreshMs: newest.record.lastRefreshMs,
+            };
+        });
+    }
     async scan() {
         await this.withActivity(async () => {
             for (const runtime of this.runtimes) {
@@ -98,13 +132,20 @@ export class AuthCandidateMirror {
         }
         const validation = await this.validateRuntimeCandidate(runtime, name, record);
         if (!validation.ok) {
-            this.logger.warn('auth.mirror.validation_failed', {
-                runtimeId: runtime.id,
-                name,
-                reason: validation.reason ?? 'unknown',
-            });
+            const reason = validation.reason ?? 'unknown';
+            const failureKey = `${runtime.id}:${name}`;
+            const failureValue = `${record.lastRefreshMs}:${reason}`;
+            if (this.lastValidationFailures.get(failureKey) !== failureValue) {
+                this.lastValidationFailures.set(failureKey, failureValue);
+                this.logger.warn('auth.mirror.validation_failed', {
+                    runtimeId: runtime.id,
+                    name,
+                    reason,
+                });
+            }
             return false;
         }
+        this.lastValidationFailures.delete(`${runtime.id}:${name}`);
         await atomicWrite(canonicalPath, record.raw);
         for (const target of this.runtimes) {
             if (target.id !== runtime.id) {
@@ -174,6 +215,23 @@ export class AuthCandidateMirror {
         }
         return [...all];
     }
+    async collectAuthRecords() {
+        const directories = [
+            { runtimeId: 'canonical', authDir: this.canonicalDir },
+            ...this.runtimes.map(runtime => ({ runtimeId: runtime.id, authDir: runtime.authDir })),
+        ];
+        const records = [];
+        for (const directory of directories) {
+            const names = new Set(['auth.json', ...await listAuthCandidateNames(directory.authDir)]);
+            for (const candidateName of names) {
+                const record = await readChatGptAuthRecord(path.join(directory.authDir, candidateName));
+                if (record) {
+                    records.push({ runtimeId: directory.runtimeId, candidateName, record });
+                }
+            }
+        }
+        return records;
+    }
     async reconcileCandidateAtStartup(name) {
         const paths = [
             path.join(this.canonicalDir, name),

package/dist/controller/controller.d.ts

@@ -9,6 +9,7 @@ import type { SelfUpdateRuntime, SelfUpdateStatus } from '../update.js';
 export interface CoreCoordinator {
     canSelfUpdate?: () => boolean;
     authCandidateUpdated?: (runtimeId: string, candidateName: string) => Promise<void>;
+    recoverAuthCandidate?: (runtimeId: string, candidateName: string) => Promise<boolean>;
     statusUpdated?: (status: RuntimeStatus) => void;
     getServiceStatus?: () => Promise<{
         bots: NonNullable<RuntimeStatus['bots']>;
@@ -285,6 +286,8 @@ export declare class BridgeSessionCore {
     private readCodexAuthSwitchLabels;
     private codexAuthSwitchParams;
     private switchCodexAuthAndRestart;
+    private recoverCodexAuthCandidate;
+    private syncCodexAuthCandidate;
     private buildNativeCollaborationMode;
     private buildCodexUsageStatusLines;
     private buildCodexLocalUsageStatusLines;

package/dist/controller/controller.js

@@ -3762,10 +3762,20 @@ export class BridgeSessionCore {
             return;
         }
         await this.sendMessage(scopeId, t(locale, 'auth_reload_restarting'));
+        const currentCandidate = (await this.listCodexAuthState()).candidates.find(candidate => candidate.isCurrent) ?? null;
+        const recovered = currentCandidate
+            ? await this.recoverCodexAuthCandidate(currentCandidate.name)
+            : false;
         this.pendingTurnErrors.clear();
         this.attachedThreads.clear();
         await this.app.restart();
+        if (currentCandidate) {
+            await this.syncCodexAuthCandidate(currentCandidate.name);
+        }
         const lines = [t(locale, 'auth_reload_done')];
+        if (recovered) {
+            lines.push(t(locale, 'auth_recovered_newer_candidate', { value: currentCandidate.name }));
+        }
         lines.push(...await this.buildCodexUsageStatusLines(locale));
         await this.sendMessage(scopeId, lines.join('\n'));
     }
@@ -4542,15 +4552,48 @@ export class BridgeSessionCore {
         };
     }
     async switchCodexAuthAndRestart(scopeId, locale, candidate, automatic) {
+        const recovered = await this.recoverCodexAuthCandidate(candidate.name);
         const result = await switchCodexAuth(candidate.path, this.resolveAuthDir());
         this.authRotationFailedTargets.delete(candidate.path);
         this.pendingTurnErrors.clear();
         this.attachedThreads.clear();
         await this.app.restart();
+        await this.syncCodexAuthCandidate(candidate.name);
         const lines = [t(locale, automatic ? 'auth_auto_done' : 'auth_switch_done', this.codexAuthSwitchParams(locale, result.fromLabel, result.toLabel))];
+        if (recovered) {
+            lines.push(t(locale, 'auth_recovered_newer_candidate', { value: candidate.name }));
+        }
         lines.push(...await this.buildCodexUsageStatusLines(locale));
         await this.sendMessage(scopeId, lines.join('\n'));
     }
+    async recoverCodexAuthCandidate(candidateName) {
+        if (!this.coordinator?.recoverAuthCandidate) {
+            return false;
+        }
+        try {
+            return await this.coordinator.recoverAuthCandidate(this.authRuntimeId(), candidateName);
+        }
+        catch (error) {
+            this.logger.warn('codex.auth_candidate_recovery_failed', {
+                candidate: candidateName,
+                runtimeId: this.authRuntimeId(),
+                error: toErrorMeta(error),
+            });
+            return false;
+        }
+    }
+    async syncCodexAuthCandidate(candidateName) {
+        try {
+            await this.coordinator?.authCandidateUpdated?.(this.authRuntimeId(), candidateName);
+        }
+        catch (error) {
+            this.logger.warn('codex.auth_candidate_sync_failed', {
+                candidate: candidateName,
+                runtimeId: this.authRuntimeId(),
+                error: toErrorMeta(error),
+            });
+        }
+    }
     async buildNativeCollaborationMode(settings, cwd, modeOverride) {
         const mode = resolveCollaborationMode(modeOverride === undefined ? settings?.collaborationMode ?? null : modeOverride);
         try {
@@ -4761,6 +4804,7 @@ export class BridgeSessionCore {
             }
             await this.writeCodexAuthQuotaSnapshots();
             await this.applySharedCodexAuthQuotaSnapshots(state);
+            await this.syncCodexAuthCandidate(candidate.name);
         }
         catch (error) {
             this.logger.warn('codex.auth_quota_refresh_failed', { error: formatUserError(error) });

package/dist/i18n.d.ts

@@ -157,6 +157,7 @@ declare const MESSAGES: {
         readonly auth_choice_recorded: "Auth selected";
         readonly auth_switching: "Switching Codex auth: {from} -> {to}...";
         readonly auth_switch_done: "Codex auth switched: {from} -> {to}.";
+        readonly auth_recovered_newer_candidate: "Recovered a newer same-account credential for {value} from another Codex home before reload.";
         readonly auth_auto_switching: "Codex auth problem detected ({error}). Switching: {from} -> {to}...";
         readonly auth_auto_done: "Auto-switched Codex auth: {from} -> {to}.";
         readonly auth_auto_retrying: "Retrying the same request with the new auth...";
@@ -732,6 +733,7 @@ declare const MESSAGES: {
         readonly auth_choice_recorded: "已选择 auth";
         readonly auth_switching: "正在切换 Codex auth：{from} -> {to}...";
         readonly auth_switch_done: "Codex auth 已切换：{from} -> {to}。";
+        readonly auth_recovered_newer_candidate: "重载前已从其他 Codex home 恢复 {value} 的同账号较新凭据。";
         readonly auth_auto_switching: "检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...";
         readonly auth_auto_done: "已自动切换 Codex auth：{from} -> {to}。";
         readonly auth_auto_retrying: "正在用新的 auth 重试同一条请求...";

package/dist/i18n.js

@@ -155,6 +155,7 @@ const MESSAGES = {
         auth_choice_recorded: 'Auth selected',
         auth_switching: 'Switching Codex auth: {from} -> {to}...',
         auth_switch_done: 'Codex auth switched: {from} -> {to}.',
+        auth_recovered_newer_candidate: 'Recovered a newer same-account credential for {value} from another Codex home before reload.',
         auth_auto_switching: 'Codex auth problem detected ({error}). Switching: {from} -> {to}...',
         auth_auto_done: 'Auto-switched Codex auth: {from} -> {to}.',
         auth_auto_retrying: 'Retrying the same request with the new auth...',
@@ -730,6 +731,7 @@ const MESSAGES = {
         auth_choice_recorded: '已选择 auth',
         auth_switching: '正在切换 Codex auth：{from} -> {to}...',
         auth_switch_done: 'Codex auth 已切换：{from} -> {to}。',
+        auth_recovered_newer_candidate: '重载前已从其他 Codex home 恢复 {value} 的同账号较新凭据。',
         auth_auto_switching: '检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...',
         auth_auto_done: '已自动切换 Codex auth：{from} -> {to}。',
         auth_auto_retrying: '正在用新的 auth 重试同一条请求...',

package/dist/main.js

@@ -279,6 +279,7 @@ async function runServeCli() {
                     && (!activeWeixinCore || activeWeixinCore.isIdleForServiceUpdate())
                     && mirror.isIdle(),
                 authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
+                recoverAuthCandidate: (runtimeId, candidateName) => mirror.recoverRuntimeCandidate(runtimeId, candidateName).then(recovery => recovery !== null),
                 statusUpdated: () => writeAggregateStatus(),
                 getServiceStatus: async () => ({
                     bots: await Promise.all(runtimes.map(async (runtime) => {
@@ -441,11 +442,10 @@ async function validateRefreshedAuthCandidate(runtime, candidateName) {
     if (!runtime.app.isConnected()) {
         return { ok: false, reason: 'source app-server is not connected' };
     }
-    const account = await runtime.app.readAccount();
-    if (!account || account.type !== 'chatgpt' || account.requiresOpenaiAuth) {
-        return { ok: false, reason: 'source app-server did not report an active ChatGPT account' };
+    const rateLimits = await runtime.app.readAccountRateLimits();
+    if (!rateLimits) {
+        return { ok: false, reason: 'source app-server did not return ChatGPT rate limits' };
     }
-    await runtime.app.readAccountRateLimits();
     return { ok: true };
 }
 async function initConfig() {

package/docs/user-manual.md

@@ -359,7 +359,7 @@ FoxClaw recognizes candidate names in these forms:
 - `auth.json.<name>`
 - `auth.json-<name>`
 
-`auth.json` is what Codex currently uses. When switching accounts, FoxClaw points `auth.json` at one candidate. Candidate contents are Codex-generated JSON and should not be hand-written. In multi-bot mode, FoxClaw mirrors a candidate only when its account identity matches and its refresh timestamp is newer, preventing a same-name candidate from overwriting a different account.
+`auth.json` is what Codex currently uses. When switching accounts, FoxClaw points `auth.json` at one candidate. Candidate contents are Codex-generated JSON and should not be hand-written. In multi-bot mode, FoxClaw mirrors a candidate only when its account identity matches, its refresh timestamp is newer, and the active app-server verifies it against the ChatGPT usage endpoint, preventing a same-name candidate from overwriting a different account. Before an auth switch or reload, FoxClaw also searches the other Codex homes for a newer credential with the same account ID, restores it into the requesting runtime, then verifies and mirrors it after restart.
 
 If you already have a working `auth.json`, you can save it as a candidate:
 

package/docs/zh/user-manual.md

@@ -359,7 +359,7 @@ FoxClaw 识别这些候选文件名：
 - `auth.json.<name>`
 - `auth.json-<name>`
 
-`auth.json` 是 Codex 当前使用的文件。切换账号时，FoxClaw 会把 `auth.json` 指向某个候选文件。候选文件内容是 Codex CLI 生成的 JSON，不建议手写这些字段。多 bot 镜像只在能校验同一账号标识且刷新时间更新时复制候选，避免同名候选意外覆盖成另一个账号。
+`auth.json` 是 Codex 当前使用的文件。切换账号时，FoxClaw 会把 `auth.json` 指向某个候选文件。候选文件内容是 Codex CLI 生成的 JSON，不建议手写这些字段。多 bot 镜像只在账号标识一致、刷新时间更新，并且由当前 app-server 通过 ChatGPT 用量接口在线验证时复制候选，避免同名候选意外覆盖成另一个账号。切换或重载 auth 之前，FoxClaw 还会在其他 Codex home 中查找同账号 ID 的较新凭据，先恢复到发起操作的 runtime，再在重启后验证并镜像。
 
 如果你已经有一个可用的 `auth.json`，可以先备份成候选：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",

package/skills/foxclaw/SKILL.md

@@ -66,6 +66,7 @@ Telegram behavior:
 - `TG_ALLOWED_CHAT_ID` and `TG_ALLOWED_TOPIC_ID` choose the default group or topic scope; they do not disable private chat
 - when `TG_BOT_TOKENS` contains multiple bots, one FoxClaw service starts independent Codex app-servers and auth selections per bot
 - isolated Telegram runtimes use independent `CODEX_HOME` directories and file-backed credentials; they do not share Codex sessions
+- refreshed ChatGPT candidates are mirrored only after online usage-endpoint validation; before auth switch or reload, a runtime restores any newer same-account credential found in another Codex home
 - if `TG_BOT_TOKEN` is also set to one exact token from `TG_BOT_TOKENS`, that bot uses the default/shared-terminal runtime instead of an isolated Telegram home
 - if Weixin is enabled alongside multiple Telegram bots, it remains on the default Codex runtime instead of borrowing a Telegram bot runtime
 - in a group with multiple configured bots, address a bot by mention, reply, or suffixed command such as `/status@botname`