@foxden-app/foxclaw 0.4.5 → 0.4.6

package/CHANGELOG.md

@@ -0,0 +1,181 @@
+# Changelog
+
+All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
+
+## 0.4.6 - 2026-06-01
+
+### 中文
+- 新增公开 `CHANGELOG.md`，让 GitHub 项目首页和 npm 包都能直接看到版本更新记录。
+- README 增加更新日志入口，并将 `CHANGELOG.md` 纳入 npm 发布包。
+- 发布 workflow 增加 GitHub Release 创建/更新步骤，后续 tag 发布会自动带上对应版本说明。
+
+### English
+- Added a public `CHANGELOG.md` so release notes are visible from GitHub and the npm package.
+- Linked the changelog from the README and included it in the npm package contents.
+- Added GitHub Release creation/update to the publish workflow so future version tags carry release notes automatically.
+
+## 0.4.5 - 2026-06-01
+
+### 中文
+- `/auth` 面板点击切换账号后会刷新原消息并保留按钮，方便连续切换多个候选账号。
+- 回归测试覆盖同一个面板上连续切换的行为。
+
+### English
+- The `/auth` panel now refreshes the original message and keeps its buttons after switching accounts, making consecutive switches practical.
+- Added regression coverage for repeated switches from the same panel.
+
+## 0.4.4 - 2026-06-01
+
+### 中文
+- 多 bot 模式下，切换或重载认证前会从其他 bot home 和规范凭据目录恢复同账号的较新可用候选。
+- 认证同步前增加在线 usage 验证，避免只看 `last_refresh` 时传播已经失效的凭据。
+- 登录/刷新成功后继续将同账号新凭据镜像到其他 runtime，解决某个 bot 仍拿到旧 401 凭据的问题。
+
+### English
+- In multi-bot mode, auth switch/reload now recovers a newer same-account candidate from other bot homes or the canonical auth directory before restart.
+- Added online usage validation before syncing refreshed credentials, avoiding propagation based only on `last_refresh`.
+- Successful login/refresh still mirrors the validated same-account credential to other runtimes, fixing stale 401 credentials in sibling bots.
+
+## 0.4.3 - 2026-05-29
+
+### 中文
+- `/auth` 在多 bot 模式下会按 ChatGPT account id 汇总各 runtime 最近掌握的额度快照。
+- 不同 bot 使用不同 auth 时，面板可以互补展示更完整的 5 小时/7 天额度信息。
+
+### English
+- `/auth` now merges recent quota snapshots by ChatGPT account id across runtimes in multi-bot mode.
+- When different bots use different auth candidates, the panel can present a more complete 5-hour/7-day quota view.
+
+## 0.4.2 - 2026-05-28
+
+### 中文
+- 支持把 `TG_BOT_TOKENS` 中的一个 bot 标记为默认/终端共享 runtime。
+- 当 `TG_BOT_TOKEN` 精确匹配复数 token 中的一个值时，该 bot 使用终端默认 `CODEX_HOME` 和默认 auth，其他 bot 继续隔离。
+- 文档补充共享 runtime 的配置方式和注意事项。
+
+### English
+- Added support for marking one `TG_BOT_TOKENS` bot as the default/shared-terminal runtime.
+- When `TG_BOT_TOKEN` exactly matches one token in the multi-token list, that bot uses the terminal/default `CODEX_HOME` and auth while the others stay isolated.
+- Updated docs with shared-runtime setup guidance.
+
+## 0.4.1 - 2026-05-28
+
+### 中文
+- 认证候选刷新后，镜像同步前会校验同账号和可用性，降低错误凭据扩散风险。
+- 增加认证刷新验证相关测试。
+
+### English
+- Refreshed auth candidates are validated for same-account usability before mirroring, reducing the risk of spreading bad credentials.
+- Added tests for refreshed auth validation.
+
+## 0.4.0 - 2026-05-27
+
+### 中文
+- 完善多 Telegram bot 隔离 runtime 的状态展示、验收路径和文档。
+- 补充多 bot auth 镜像、独立 `CODEX_HOME`、群聊点名规则和全局 `/update` 空闲检查说明。
+
+### English
+- Completed status reporting, validation paths, and docs for isolated multi-Telegram-bot runtimes.
+- Documented multi-bot auth mirroring, independent `CODEX_HOME`, group addressing rules, and global `/update` idle checks.
+
+## 0.3.19 - 2026-05-27
+
+### 中文
+- 支持一个 FoxClaw 服务同时运行多个 Telegram bot，每个 bot 拥有独立 Codex app-server、独立 `CODEX_HOME`、独立会话和独立当前 auth。
+- Telegram scope 加入 bot namespace，避免私聊、群聊、按钮回调和附件处理串线。
+- 新增认证候选镜像协调器，仅同步经过校验的同账号候选文件，不共享 Codex sessions。
+- `/update` 改为全服务空闲检查，并会尝试同步升级 npm/pnpm 管理的 Codex CLI。
+
+### English
+- Added support for running multiple Telegram bots in one FoxClaw service, with independent Codex app-servers, `CODEX_HOME` directories, sessions, and active auth selections.
+- Added bot namespaces to Telegram scopes so private chats, groups, callbacks, and media handling do not cross runtimes.
+- Added an auth candidate mirror coordinator that syncs validated same-account candidates without sharing Codex sessions.
+- Made `/update` a global idle-checked operation and added npm/pnpm-managed Codex CLI update attempts.
+
+## 0.3.18 - 2026-05-27
+
+### 中文
+- 修正 Codex 本地答复吞吐统计口径。
+
+### English
+- Corrected local Codex response throughput metrics.
+
+## 0.3.17 - 2026-05-26
+
+### 中文
+- 修复 GitHub 发布流程的 checkout 鉴权失败。
+
+### English
+- Fixed checkout authentication failure in the GitHub release workflow.
+
+## 0.3.16 - 2026-05-26
+
+### 中文
+- 缓存 `/status` 本地用量统计快照，减少状态页等待时间并优化响应。
+
+### English
+- Cached local usage statistics for `/status`, reducing wait time and improving responsiveness.
+
+## 0.3.15 - 2026-05-26
+
+### 中文
+- 修复 pnpm 全局安装下 `/update` 对 Codex CLI 真实安装路径的识别。
+
+### English
+- Fixed `/update` detection of the real Codex CLI install path under pnpm global installs.
+
+## 0.3.14 - 2026-05-26
+
+### 中文
+- 新增 FoxClaw 一键自升级和聊天内 `/update` 命令。
+
+### English
+- Added one-command FoxClaw self-update and the chat `/update` command.
+
+## 0.3.13 - 2026-05-26
+
+### 中文
+- 新增 Codex 输出速度展示和线程上下文回显。
+
+### English
+- Added Codex output throughput display and thread context echoes.
+
+## 0.3.12 - 2026-05-26
+
+### 中文
+- 简化 FoxClaw 代理服务配置。
+
+### English
+- Simplified FoxClaw proxy service configuration.
+
+## 0.3.11 - 2026-05-26
+
+### 中文
+- 修复 systemd 安装时覆盖旧版本路径的问题。
+
+### English
+- Fixed systemd install behavior that could overwrite an older version path incorrectly.
+
+## 0.3.10 - 2026-05-26
+
+### 中文
+- 支持 npm 发布令牌回退，用于 trusted publishing 不可用时的补发路径。
+
+### English
+- Added npm token fallback support for manual recovery when trusted publishing is unavailable.
+
+## 0.1.1 - 2026-03-06
+
+### 中文
+- 显式解析 Codex 二进制路径，提升运行时定位可靠性。
+
+### English
+- Resolved the Codex binary path explicitly for more reliable runtime startup.
+
+## 0.1.0 - 2026-03-06
+
+### 中文
+- 初始化 Telegram Codex app bridge。
+
+### English
+- Bootstrapped the Telegram Codex app bridge.

package/README.md

@@ -37,6 +37,7 @@ FoxClaw（狸爪）的目标很直接：让你用手机控制本机的 Codex，
 - 手头有 Codex、OpenClaw、QwenPaw、Hermes、OpenCode、Kimi CLI 之类能跑 shell 的 agent？推荐走 [Agent 辅助安装](./docs/zh/agent-assisted-install.md)。
 - 对 Node、Telegram 机器人、Codex CLI 不太熟？看 [新手安装指南](./docs/zh/install-for-beginners.md)。
 - 已经装好，想系统了解 `/help`、`/setup`、`/threads`、`/watch`、`/auth` 和账号轮转？看 [用户手册](./docs/zh/user-manual.md)。
+- 想了解每个版本改了什么？看 [更新日志](./CHANGELOG.md)。
 - Git、Node、`.env` 都玩得转？直接往下看快速设置。
 - 卡住了？看 [故障排查](./docs/zh/troubleshooting.md)。
 

package/README_EN.md

@@ -37,6 +37,7 @@ FoxClaw is more than message forwarding. It provides Telegram panels for Codex w
 - Already have a shell-capable agent such as Codex, OpenClaw, QwenPaw, Hermes, OpenCode, or Kimi CLI? Use the [Agent-Assisted Install](./docs/agent-assisted-install.md) first. This is the recommended path.
 - New to Node, Telegram bots, or Codex CLI? Use the [Beginner Install Guide](./docs/install-for-beginners.md).
 - Already installed and want the full command guide for `/help`, `/setup`, `/threads`, `/watch`, `/auth`, and auth rotation? Read the [User Manual](./docs/user-manual.md).
+- Want to see what changed in each release? Read the [Changelog](./CHANGELOG.md).
 - Already comfortable with Git, Node, and `.env` files? Use the quick setup below.
 - Something failed? Check [Troubleshooting](./docs/troubleshooting.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",
@@ -15,6 +15,7 @@
     ".env.example",
     "README.md",
     "README_EN.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "private": false,

package/skills/foxclaw/SKILL.md

@@ -188,6 +188,7 @@ Use this checklist when the user asks for standard closing actions, release wrap
    - For this repo, prefer a bilingual one-line subject in the form `中文 | English`.
    - Put Chinese first, keep the English half semantically equivalent, and keep both halves concise.
    - For release commits, use the same format, for example `发布 0.4.0：支持多机器人隔离 | Release 0.4.0: support multi-bot isolation`.
+   - Update `CHANGELOG.md` for any published version, using bilingual Chinese and English notes.
    - Never stage unrelated local changes.
 5. Push the current branch after a successful commit:
    - `git push origin <branch>`
@@ -202,12 +203,14 @@ Use this checklist when the user asks for standard closing actions, release wrap
    - `/update` now attempts to update globally npm/pnpm-managed Codex CLI installations and refuses to restart while any configured Telegram runtime, enabled Weixin default runtime, or auth mirror write is busy.
 7. Publish to npm when requested:
    - Prefer GitHub Actions trusted publishing via `.github/workflows/publish.yml`: bump and commit the package version, push `main`, then push a matching `v<version>` tag. The tag version must match `package.json`.
+   - Ensure the matching changelog section exists before pushing the version tag; the publish workflow uses it to create or update the GitHub Release.
    - Treat `workflow_dispatch` only as a retry path from an existing matching release tag; do not manually run publishing from `main`.
    - Configure npmjs.com trusted publishing for `foxden-app/foxclaw` and workflow `publish.yml`; do not store npm tokens if OIDC trusted publishing is available.
    - Temporary fallback: store an npm automation/bypass-2FA token as the GitHub Actions secret `NPM_TOKEN`. Never print the token or commit it.
    - Check `npm whoami` and `npm view @foxden-app/foxclaw version`.
    - If the target version is already published, bump with `npm version patch --no-git-tag-version` before validation and commit.
    - If a workflow fails before `npm publish`, inspect that failed GitHub Actions step before attributing it to npm trusted publishing.
+   - After publishing, verify both `npm view @foxden-app/foxclaw version` and the GitHub Release page for the pushed tag.
    - Manual fallback only: run `BROWSER=true npm publish` in a TTY.
    - If npm returns `ENEEDAUTH`, report that npm publish is blocked by registry login and leave the package unreported as published.
    - Never print npm tokens or `.npmrc` auth values.