@foxden-app/foxclaw 0.4.8 → 0.4.10

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.4.10 - 2026-06-02
+
+### 中文
+- 从 `/auth` 面板移除“刷新全部”按钮，避免高风险 refresh token 轮换操作被日常面板误触。
+- 保留 `/auth refresh all` 和 `/auth refresh all confirm` 命令入口，继续要求显式风险确认后才会执行刷新全部。
+
+### English
+- Removed the Refresh all button from the `/auth` panel to avoid accidental use of the high-risk refresh-token rotation maintenance action.
+- Kept `/auth refresh all` and `/auth refresh all confirm` as command entry points, still requiring explicit risk confirmation before refresh all runs.
+
+## 0.4.9 - 2026-06-02
+
+### 中文
+- 修复 ChatGPT auth 到期自动刷新后，主动同步和后台镜像扫描竞态导致同一候选重复发送镜像广播的问题。
+
+### English
+- Fixed duplicate auth mirror broadcasts when an automatic ChatGPT auth refresh was observed by both the direct sync path and the background mirror scan.
+
 ## 0.4.8 - 2026-06-02
 
 ### 中文

package/dist/auth/mirror.d.ts

@@ -39,6 +39,7 @@ export declare class AuthCandidateMirror {
     private timer;
     private readonly lastSyncedRefresh;
     private readonly lastValidationFailures;
+    private readonly activeCandidateSyncs;
     private activeOperations;
     private lastStatus;
     constructor(canonicalDir: string, runtimes: AuthMirrorRuntime[], logger: Logger, statusPath?: string | null);

package/dist/auth/mirror.js

@@ -9,6 +9,7 @@ export class AuthCandidateMirror {
     timer = null;
     lastSyncedRefresh = new Map();
     lastValidationFailures = new Map();
+    activeCandidateSyncs = new Set();
     activeOperations = 0;
     lastStatus = null;
     constructor(canonicalDir, runtimes, logger, statusPath = null) {
@@ -116,55 +117,64 @@ export class AuthCandidateMirror {
         });
     }
     async propagateValidatedCandidate(runtime, name) {
-        const sourcePath = path.join(runtime.authDir, name);
-        const record = await readChatGptAuthRecord(sourcePath);
-        if (!record)
-            return false;
-        const canonicalPath = path.join(this.canonicalDir, name);
-        const canonical = await readChatGptAuthRecord(canonicalPath);
-        if (canonical && canonical.accountId !== record.accountId) {
-            this.logger.warn('auth.mirror.account_conflict', { runtimeId: runtime.id, name });
-            return false;
-        }
-        const previousRefresh = Math.max(canonical?.lastRefreshMs ?? 0, this.lastSyncedRefresh.get(name) ?? 0);
-        if (record.lastRefreshMs <= previousRefresh) {
+        if (this.activeCandidateSyncs.has(name)) {
             return false;
         }
-        const validation = await this.validateRuntimeCandidate(runtime, name, record);
-        if (!validation.ok) {
-            const reason = validation.reason ?? 'unknown';
-            const failureKey = `${runtime.id}:${name}`;
-            const failureValue = `${record.lastRefreshMs}:${reason}`;
-            if (this.lastValidationFailures.get(failureKey) !== failureValue) {
-                this.lastValidationFailures.set(failureKey, failureValue);
-                this.logger.warn('auth.mirror.validation_failed', {
-                    runtimeId: runtime.id,
-                    name,
-                    reason,
-                });
+        this.activeCandidateSyncs.add(name);
+        try {
+            const sourcePath = path.join(runtime.authDir, name);
+            const record = await readChatGptAuthRecord(sourcePath);
+            if (!record)
+                return false;
+            const canonicalPath = path.join(this.canonicalDir, name);
+            const canonical = await readChatGptAuthRecord(canonicalPath);
+            if (canonical && canonical.accountId !== record.accountId) {
+                this.logger.warn('auth.mirror.account_conflict', { runtimeId: runtime.id, name });
+                return false;
             }
-            return false;
-        }
-        this.lastValidationFailures.delete(`${runtime.id}:${name}`);
-        await atomicWrite(canonicalPath, record.raw);
-        for (const target of this.runtimes) {
-            if (target.id !== runtime.id) {
-                await atomicWrite(path.join(target.authDir, name), record.raw);
+            const previousRefresh = Math.max(canonical?.lastRefreshMs ?? 0, this.lastSyncedRefresh.get(name) ?? 0);
+            if (record.lastRefreshMs <= previousRefresh) {
+                return false;
+            }
+            const validation = await this.validateRuntimeCandidate(runtime, name, record);
+            if (!validation.ok) {
+                const reason = validation.reason ?? 'unknown';
+                const failureKey = `${runtime.id}:${name}`;
+                const failureValue = `${record.lastRefreshMs}:${reason}`;
+                if (this.lastValidationFailures.get(failureKey) !== failureValue) {
+                    this.lastValidationFailures.set(failureKey, failureValue);
+                    this.logger.warn('auth.mirror.validation_failed', {
+                        runtimeId: runtime.id,
+                        name,
+                        reason,
+                    });
+                }
+                return false;
             }
+            this.lastValidationFailures.delete(`${runtime.id}:${name}`);
+            await atomicWrite(canonicalPath, record.raw);
+            for (const target of this.runtimes) {
+                if (target.id !== runtime.id) {
+                    await atomicWrite(path.join(target.authDir, name), record.raw);
+                }
+            }
+            this.lastSyncedRefresh.set(name, record.lastRefreshMs);
+            const sourceLabel = runtime.label ?? runtime.id;
+            this.lastStatus = {
+                candidateName: name,
+                sourceRuntimeId: runtime.id,
+                sourceLabel,
+                syncedAt: new Date().toISOString(),
+            };
+            await writeMirrorStatus(this.statusPath, this.lastStatus);
+            this.logger.info('auth.mirror.synced', { sourceRuntimeId: runtime.id, name });
+            const message = `${name} has been refreshed by ${sourceLabel} and synchronized to the other Codex homes.`;
+            await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
+            return true;
+        }
+        finally {
+            this.activeCandidateSyncs.delete(name);
         }
-        this.lastSyncedRefresh.set(name, record.lastRefreshMs);
-        const sourceLabel = runtime.label ?? runtime.id;
-        this.lastStatus = {
-            candidateName: name,
-            sourceRuntimeId: runtime.id,
-            sourceLabel,
-            syncedAt: new Date().toISOString(),
-        };
-        await writeMirrorStatus(this.statusPath, this.lastStatus);
-        this.logger.info('auth.mirror.synced', { sourceRuntimeId: runtime.id, name });
-        const message = `${name} has been refreshed by ${sourceLabel} and synchronized to the other Codex homes.`;
-        await Promise.allSettled(this.runtimes.map((target) => target.notify?.(message)));
-        return true;
     }
     async validateRuntimeCandidate(runtime, name, record) {
         if (!runtime.validate) {

package/dist/controller/controller.js

@@ -7703,10 +7703,7 @@ function authChoiceKeyboard(locale, record) {
         { text: t(locale, 'button_permissions'), callback_data: 'nav:permissions' },
         { text: t(locale, 'button_login_device'), callback_data: `auth:${record.localId}:login_device` },
     ]);
-    rows.push([
-        { text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` },
-        { text: t(locale, 'button_auth_refresh_all'), callback_data: `auth:${record.localId}:refresh_all` },
-    ]);
+    rows.push([{ text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` }]);
     return rows;
 }
 function authRefreshAllConfirmKeyboard(locale, record) {

package/dist/i18n.d.ts

@@ -182,7 +182,6 @@ declare const MESSAGES: {
         readonly auth_add_missing_file: "Login completed, but the new auth file was not created: {value}";
         readonly button_login_device: "🔑 Login";
         readonly button_auth_reload: "🔄 Reload auth";
-        readonly button_auth_refresh_all: "🔁 Refresh all";
         readonly button_auth_refresh_all_confirm: "⚠️ Accept risk & refresh";
         readonly button_auth_enable: "✅";
         readonly button_auth_disable: "⏸️";
@@ -769,7 +768,6 @@ declare const MESSAGES: {
         readonly auth_add_missing_file: "登录已完成，但没有创建新的 auth 文件：{value}";
         readonly button_login_device: "🔑 设备登录";
         readonly button_auth_reload: "🔄 重载 auth";
-        readonly button_auth_refresh_all: "🔁 刷新全部";
         readonly button_auth_refresh_all_confirm: "⚠️ 接受风险并刷新";
         readonly button_auth_enable: "✅";
         readonly button_auth_disable: "⏸️";

package/dist/i18n.js

@@ -180,7 +180,6 @@ const MESSAGES = {
         auth_add_missing_file: 'Login completed, but the new auth file was not created: {value}',
         button_login_device: '🔑 Login',
         button_auth_reload: '🔄 Reload auth',
-        button_auth_refresh_all: '🔁 Refresh all',
         button_auth_refresh_all_confirm: '⚠️ Accept risk & refresh',
         button_auth_enable: '✅',
         button_auth_disable: '⏸️',
@@ -767,7 +766,6 @@ const MESSAGES = {
         auth_add_missing_file: '登录已完成，但没有创建新的 auth 文件：{value}',
         button_login_device: '🔑 设备登录',
         button_auth_reload: '🔄 重载 auth',
-        button_auth_refresh_all: '🔁 刷新全部',
         button_auth_refresh_all_confirm: '⚠️ 接受风险并刷新',
         button_auth_enable: '✅',
         button_auth_disable: '⏸️',

package/docs/user-manual.md

@@ -389,7 +389,7 @@ If the login is cancelled or fails, FoxClaw tries to restore the previous auth t
 
 ### 6.3 The `/auth` Panel
 
-`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, reload, and Refresh all. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota. When multiple bot runtimes have recently used the same ChatGPT account, FoxClaw combines their cached quota snapshots by verified account ID, so one bot's `/auth` panel can show quota information learned by another bot without mixing different accounts.
+`/auth` lists candidate accounts, the current account, and the auth directory. It also provides buttons for switching, disabling, login, and reload. In multi-bot mode the panel names the `@botname` runtime being managed, because private chats, groups, and topics on one bot share that bot's current auth. The `5h|7d` numbers before each filename are the last recorded remaining percentages for the two quota windows; the current auth is refreshed when the panel opens, while other candidates are not switched merely to query quota. When multiple bot runtimes have recently used the same ChatGPT account, FoxClaw combines their cached quota snapshots by verified account ID, so one bot's `/auth` panel can show quota information learned by another bot without mixing different accounts.
 
 Approximation:
 
@@ -405,10 +405,12 @@ Quota remaining: 5h|7d|auth
 [✅ 20|25|auth.json_personal] [✅]
 [🔐 --|--|auth.json_team]     [✅]
 [🛡️ Access]             [🔑 Login]
-[🔄 Reload auth]        [🔁 Refresh all]
+[🔄 Reload auth]
 ```
 
-The right-side `✅` / `⏸️` button shows the current state. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `Refresh all` is a maintenance action: it is allowed only when every Telegram runtime, the Weixin runtime, approvals, inputs, logins, and auth mirroring are idle. The first tap only shows a risk confirmation: ChatGPT refresh tokens are rotated, so if OpenAI/Codex consumes an old refresh token but the new token cannot be saved because of network, process, or disk failure, that candidate may require device login or phone verification again. After confirmation, FoxClaw visits every ChatGPT candidate in the panel, asks Codex to force-refresh tokens with `account/read refreshToken=true`, verifies the result through the usage endpoint, mirrors successful candidates, restores the original current auth, and refreshes the panel with a summary. `--|--` means no quota snapshot has been observed for that candidate yet.
+The right-side `✅` / `⏸️` button shows the current state. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `--|--` means no quota snapshot has been observed for that candidate yet.
+
+`/auth refresh all` is a command-only maintenance action because ChatGPT refresh tokens are rotated. It is allowed only when every Telegram runtime, the Weixin runtime, approvals, inputs, logins, and auth mirroring are idle. The command first shows a risk confirmation: if OpenAI/Codex consumes an old refresh token but the new token cannot be saved because of network, process, or disk failure, that candidate may require device login or phone verification again. After confirmation, FoxClaw visits every ChatGPT candidate, asks Codex to force-refresh tokens with `account/read refreshToken=true`, verifies the result through the usage endpoint, mirrors successful candidates, restores the original current auth, and shows a summary.
 
 Equivalent commands:
 
@@ -417,7 +419,7 @@ Equivalent commands:
 - `/auth enable <n>`: let candidate n participate in auto-rotation.
 - `/auth disable <n>`: skip candidate n during auto-rotation.
 - `/auth reload` or `/auth_reload`: restart app-server and reload the current `auth.json`.
-- `/auth refresh all`: show the same risk confirmation as the panel's Refresh all button.
+- `/auth refresh all`: show the refresh-token rotation risk confirmation.
 - `/auth refresh all confirm`: run Refresh all after accepting the token-rotation risk.
 
 If the requesting bot runtime has active turns, pending approvals, pending user inputs, or MCP elicitations, FoxClaw refuses manual auth switching to avoid changing accounts mid-request; another idle bot is unaffected.

package/docs/zh/user-manual.md

@@ -389,7 +389,7 @@ cp -L ~/.codex/auth.json ~/.codex/auth.json_personal
 
 ### 6.3 `/auth` 面板
 
-`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录、重载和刷新全部。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。如果多个 bot runtime 最近使用过同一个 ChatGPT 账号，FoxClaw 会按已验证的账号 ID 合并它们缓存到的额度快照，因此一个 bot 的 `/auth` 面板可以显示另一个 bot 掌握到的额度信息，同时不会把不同账号混在一起。
+`/auth` 会列出候选账号、当前账号和 auth 目录，并提供按钮切换、禁用、登录和重载。多 bot 模式中，面板顶部还会显示当前正在管理的 `@botname`，因为该 bot 内的私聊、群聊和话题共享同一个当前 auth。每个候选名前的 `5h|7d` 数字表示上次记录到的两个额度窗口剩余百分比；当前 auth 会在打开面板时刷新，其他候选不会为了查询额度被自动切换。如果多个 bot runtime 最近使用过同一个 ChatGPT 账号，FoxClaw 会按已验证的账号 ID 合并它们缓存到的额度快照，因此一个 bot 的 `/auth` 面板可以显示另一个 bot 掌握到的额度信息，同时不会把不同账号混在一起。
 
 示意：
 
@@ -405,10 +405,12 @@ Candidates: 2
 [✅ 20|25|auth.json_personal] [✅]
 [🔐 --|--|auth.json_team]     [✅]
 [🛡️ Access]             [🔑 设备登录]
-[🔄 Reload auth]        [🔁 刷新全部]
+[🔄 Reload auth]
 ```
 
-右侧 `✅` / `⏸️` 表示当前状态。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`刷新全部` 是维护操作：只有所有 Telegram runtime、微信 runtime、审批、待输入、登录流程和 auth 镜像写入都空闲时才允许执行。第一次点击只会显示风险确认：ChatGPT refresh token 会被轮换，如果 OpenAI/Codex 已经消费旧 refresh token，但因为网络、进程或磁盘故障导致新 token 没能成功保存，该候选可能需要重新设备登录，甚至重新手机号验证。确认后，它会逐个访问面板里的 ChatGPT 候选，让 Codex 通过 `account/read refreshToken=true` 强制刷新 token，再用 usage 接口验证，成功后镜像到其他 bot home，最后恢复原本的当前 auth 并刷新面板摘要。`--|--` 表示该候选还没有额度历史快照。
+右侧 `✅` / `⏸️` 表示当前状态。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`--|--` 表示该候选还没有额度历史快照。
+
+`/auth refresh all` 是仅命令入口的维护操作，因为 ChatGPT refresh token 会被轮换。只有所有 Telegram runtime、微信 runtime、审批、待输入、登录流程和 auth 镜像写入都空闲时才允许执行。命令会先显示风险确认：如果 OpenAI/Codex 已经消费旧 refresh token，但因为网络、进程或磁盘故障导致新 token 没能成功保存，该候选可能需要重新设备登录，甚至重新手机号验证。确认后，它会逐个访问 ChatGPT 候选，让 Codex 通过 `account/read refreshToken=true` 强制刷新 token，再用 usage 接口验证，成功后镜像到其他 bot home，最后恢复原本的当前 auth 并显示摘要。
 
 命令等价用法：
 
@@ -417,7 +419,7 @@ Candidates: 2
 - `/auth enable <n>`：让第 n 个候选参与自动轮转。
 - `/auth disable <n>`：禁用第 n 个候选，自动轮转会跳过它。
 - `/auth reload` 或 `/auth_reload`：重启 app-server，重新加载当前 `auth.json`。
-- `/auth refresh all`：显示与面板“刷新全部”相同的风险确认。
+- `/auth refresh all`：显示 refresh token 轮换风险确认。
 - `/auth refresh all confirm`：接受 token 轮换风险后执行刷新全部。
 
 切换 auth 时，如果当前 bot runtime 还有活跃 turn、待审批、待用户输入或 MCP elicitation，FoxClaw 会先拒绝切换，避免中途换号破坏正在进行的请求；另一个空闲 bot 不受影响。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",

package/skills/foxclaw/SKILL.md

@@ -67,7 +67,7 @@ Telegram behavior:
 - when `TG_BOT_TOKENS` contains multiple bots, one FoxClaw service starts independent Codex app-servers and auth selections per bot
 - isolated Telegram runtimes use independent `CODEX_HOME` directories and file-backed credentials; they do not share Codex sessions
 - refreshed ChatGPT candidates are mirrored only after online usage-endpoint validation; before auth switch or reload, a runtime restores any newer same-account credential found in another Codex home
-- `/auth` includes a Refresh all panel button; it requires explicit token-rotation risk confirmation, then force-refreshes every ChatGPT candidate through Codex `account/read refreshToken=true`, validates usage, mirrors successful candidates, and restores the original current auth while every runtime is globally idle
+- `/auth refresh all` remains a command-only maintenance action, not a panel button; it requires explicit token-rotation risk confirmation, then force-refreshes every ChatGPT candidate through Codex `account/read refreshToken=true`, validates usage, mirrors successful candidates, and restores the original current auth while every runtime is globally idle
 - if `TG_BOT_TOKEN` is also set to one exact token from `TG_BOT_TOKENS`, that bot uses the default/shared-terminal runtime instead of an isolated Telegram home
 - if Weixin is enabled alongside multiple Telegram bots, it remains on the default Codex runtime instead of borrowing a Telegram bot runtime
 - in a group with multiple configured bots, address a bot by mention, reply, or suffixed command such as `/status@botname`