@foxden-app/foxclaw 0.5.10 → 0.5.12

package/dist/controller/controller.js

@@ -1065,7 +1065,7 @@ export class BridgeSessionCore {
             await this.handleAuthListViewCallback(event, authClearSearchMatch[1], 'clear_search', locale);
             return;
         }
-        const authActionMatch = /^auth:([a-f0-9]+):(login_device|reload|refresh_all_confirm|refresh_all_cancel|refresh_all)$/.exec(event.data);
+        const authActionMatch = /^auth:([a-f0-9]+):(login_device|reload|safe_sync|refresh_all_confirm|refresh_all_cancel|refresh_all)$/.exec(event.data);
         if (authActionMatch) {
             await this.handleAuthPanelActionCallback(event, authActionMatch[1], authActionMatch[2], locale);
             return;
@@ -2956,7 +2956,7 @@ export class BridgeSessionCore {
     authDisplayBotLabel() {
         if (!this.config.tgScopeBotId)
             return null;
-        return this.botUsername ? `@${this.botUsername}` : this.config.tgScopeBotId;
+        return this.botUsername ? `@${this.botUsername} (${this.config.tgScopeBotId})` : this.config.tgScopeBotId;
     }
     ownsScope(scopeId) {
         if (scopeId.startsWith(BRIDGE_SCOPE_WEIXIN_PREFIX)) {
@@ -4467,17 +4467,19 @@ export class BridgeSessionCore {
             await this.sendMessage(scopeId, message);
             return;
         }
-        if (action === 'push' && args[1]?.toLowerCase() === 'all') {
+        if (action === 'safe' || (action === 'push' && args[1]?.toLowerCase() === 'all')) {
             if (!this.canRunGlobalAuthRefresh()) {
                 await this.sendMessage(scopeId, t(locale, 'auth_sync_push_blocked_active'));
                 return;
             }
-            const result = await this.coordinator?.authSyncPushAll?.();
+            const result = await this.runAuthSafeSyncAll();
             if (!result) {
                 await this.sendMessage(scopeId, t(locale, 'auth_sync_disabled'));
                 return;
             }
-            await this.sendMessage(scopeId, t(locale, 'auth_sync_push_done', {
+            await this.sendMessage(scopeId, t(locale, 'auth_sync_safe_done', {
+                localSynced: result.localSynced,
+                localSkipped: result.localSkipped,
                 sent: result.sent,
                 skipped: result.skipped,
             }));
@@ -4485,6 +4487,16 @@ export class BridgeSessionCore {
         }
         await this.sendMessage(scopeId, t(locale, 'usage_auth_sync'));
     }
+    async runAuthSafeSyncAll() {
+        const safeResult = await this.coordinator?.authSyncSafeAll?.();
+        if (safeResult) {
+            return safeResult;
+        }
+        const pushResult = await this.coordinator?.authSyncPushAll?.();
+        return pushResult
+            ? { localSynced: 0, localSkipped: 0, sent: pushResult.sent, skipped: pushResult.skipped }
+            : null;
+    }
     async handleAuthRefreshAllCommand(scopeId, locale, confirmed = false) {
         if (!this.canRunGlobalAuthRefresh()) {
             await this.sendMessage(scopeId, t(locale, 'auth_refresh_all_blocked_active'));
@@ -4993,6 +5005,37 @@ export class BridgeSessionCore {
             await this.handleLoginDeviceCommand(event.scopeId, locale);
             return;
         }
+        if (action === 'safe_sync') {
+            if (!this.canRunGlobalAuthRefresh()) {
+                await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_sync_push_blocked_active'));
+                return;
+            }
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_sync_safe_starting'));
+            if (record.messageId !== null) {
+                await this.editMessage(event.scopeId, record.messageId, t(locale, 'auth_sync_safe_starting'), []);
+            }
+            const result = await this.runAuthSafeSyncAll();
+            if (!result) {
+                if (record.messageId !== null) {
+                    await this.editMessage(event.scopeId, record.messageId, t(locale, 'auth_sync_disabled'), authChoiceKeyboard(locale, record));
+                }
+                return;
+            }
+            const state = await this.listCodexAuthState();
+            await this.applySharedCodexAuthQuotaSnapshots(state);
+            record.candidates = state.candidates;
+            record.createdAt = Date.now();
+            clampCodexAuthListOffset(record);
+            if (record.messageId !== null) {
+                await this.editMessage(event.scopeId, record.messageId, `${t(locale, 'auth_sync_safe_done', {
+                    localSynced: result.localSynced,
+                    localSkipped: result.localSkipped,
+                    sent: result.sent,
+                    skipped: result.skipped,
+                })}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record)}`, authChoiceKeyboard(locale, record));
+            }
+            return;
+        }
         if (action === 'refresh_all') {
             if (!this.canRunGlobalAuthRefresh()) {
                 await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_refresh_all_blocked_active'));
@@ -5267,15 +5310,15 @@ export class BridgeSessionCore {
     async listCodexAuthState() {
         const state = await listCodexAuthState(this.store.listDisabledCodexAuthCandidateNames(this.authRuntimeId()), this.resolveAuthDir());
         const snapshots = await this.readCodexAuthQuotaSnapshots();
-        const candidateAccountIds = await this.readCodexAuthCandidateAccountIds(state.candidates);
+        const candidateQuotaIdentities = await this.readCodexAuthCandidateQuotaIdentities(state.candidates);
         state.candidates.forEach((candidate) => {
-            const candidateAccountId = candidateAccountIds.get(candidate.name) ?? null;
+            const candidateQuotaIdentity = candidateQuotaIdentities.get(candidate.name) ?? null;
             const snapshot = snapshots[candidate.name] ?? null;
-            candidate.quota = this.codexAuthQuotaSnapshotMatchesAccount(snapshot, candidateAccountId)
+            candidate.quota = this.codexAuthQuotaSnapshotMatchesIdentity(snapshot, candidateQuotaIdentity)
                 ? snapshot
                 : null;
         });
-        await this.applySharedCodexAuthQuotaSnapshots(state, candidateAccountIds);
+        await this.applySharedCodexAuthQuotaSnapshots(state, candidateQuotaIdentities);
         return state;
     }
     resolveAuthDir() {
@@ -5384,13 +5427,13 @@ export class BridgeSessionCore {
                         throw new Error('Codex did not return ChatGPT rate limits after refresh');
                     }
                     const after = await readChatGptAuthMetadata(candidate.path);
-                    if (!after || after.accountId !== before.accountId) {
-                        throw new Error('refreshed auth account id did not match the original candidate');
+                    if (!after || !chatGptAuthMetadataCompatible(before, after)) {
+                        throw new Error('refreshed auth identity did not match the original candidate');
                     }
                     if (after.lastRefreshMs <= before.lastRefreshMs) {
                         throw new Error('Codex did not advance last_refresh');
                     }
-                    await this.recordCodexAuthQuotaSnapshot(candidate.name, after.accountId, snapshot);
+                    await this.recordCodexAuthQuotaSnapshot(candidate.name, after, snapshot);
                     await this.syncCodexAuthCandidate(candidate.name);
                     result.refreshed.push(candidate.name);
                 }
@@ -5616,9 +5659,9 @@ export class BridgeSessionCore {
             if (!snapshot) {
                 return;
             }
-            const quota = authQuotaSnapshotFromRateLimit(snapshot, metadata?.accountId ?? null);
+            const quota = authQuotaSnapshotFromRateLimit(snapshot, metadata?.accountId ?? null, metadata?.quotaIdentityId ?? null);
             candidate.quota = quota;
-            await this.recordCodexAuthQuotaSnapshot(candidate.name, metadata?.accountId ?? null, snapshot);
+            await this.recordCodexAuthQuotaSnapshot(candidate.name, metadata, snapshot);
             await this.applySharedCodexAuthQuotaSnapshots(state);
             await this.syncCodexAuthCandidate(candidate.name);
         }
@@ -5626,36 +5669,36 @@ export class BridgeSessionCore {
             this.logger.warn('codex.auth_quota_refresh_failed', { error: formatUserError(error) });
         }
     }
-    async applySharedCodexAuthQuotaSnapshots(state, candidateAccountIds) {
-        const accountIds = candidateAccountIds ?? await this.readCodexAuthCandidateAccountIds(state.candidates);
-        const uniqueAccountIds = [...new Set(accountIds.values())];
-        if (uniqueAccountIds.length === 0) {
+    async applySharedCodexAuthQuotaSnapshots(state, candidateQuotaIdentities) {
+        const quotaIdentities = candidateQuotaIdentities ?? await this.readCodexAuthCandidateQuotaIdentities(state.candidates);
+        const uniqueQuotaIdentityIds = [...new Set([...quotaIdentities.values()].map(identity => identity.quotaIdentityId))];
+        if (uniqueQuotaIdentityIds.length === 0) {
             return;
         }
-        const snapshotsByAccount = new Map();
-        for (const record of this.store.listCodexAuthQuotaSnapshots(uniqueAccountIds)) {
+        const snapshotsByIdentity = new Map();
+        for (const record of this.store.listCodexAuthQuotaSnapshots(uniqueQuotaIdentityIds)) {
             if (!isFiniteCodexAuthQuotaSnapshotRecord(record)) {
                 continue;
             }
-            snapshotsByAccount.set(record.accountId, mergeCodexAuthQuotaSnapshots(snapshotsByAccount.get(record.accountId) ?? null, codexAuthQuotaSnapshotFromRecord(record)));
+            snapshotsByIdentity.set(record.quotaIdentityId, mergeCodexAuthQuotaSnapshots(snapshotsByIdentity.get(record.quotaIdentityId) ?? null, codexAuthQuotaSnapshotFromRecord(record)));
         }
         for (const candidate of state.candidates) {
-            const accountId = accountIds.get(candidate.name);
-            if (!accountId) {
+            const quotaIdentity = quotaIdentities.get(candidate.name);
+            if (!quotaIdentity) {
                 continue;
             }
-            candidate.quota = mergeCodexAuthQuotaSnapshots(candidate.quota, snapshotsByAccount.get(accountId) ?? null);
+            candidate.quota = mergeCodexAuthQuotaSnapshots(candidate.quota, snapshotsByIdentity.get(quotaIdentity.quotaIdentityId) ?? null);
         }
     }
-    async recordCodexAuthQuotaSnapshot(candidateName, accountId, snapshot) {
-        const quota = authQuotaSnapshotFromRateLimit(snapshot, accountId);
+    async recordCodexAuthQuotaSnapshot(candidateName, metadata, snapshot) {
+        const quota = authQuotaSnapshotFromRateLimit(snapshot, metadata?.accountId ?? null, metadata?.quotaIdentityId ?? null);
         this.authQuotaSnapshots[candidateName] = quota;
-        if (accountId) {
-            this.store.setCodexAuthQuotaSnapshot(this.authRuntimeId(), candidateName, accountId, quota);
+        if (metadata) {
+            this.store.setCodexAuthQuotaSnapshot(this.authRuntimeId(), candidateName, metadata.accountId, metadata.quotaIdentityId, quota);
         }
         await this.writeCodexAuthQuotaSnapshots();
     }
-    async readCodexAuthCandidateAccountIds(candidates) {
+    async readCodexAuthCandidateQuotaIdentities(candidates) {
         const entries = await Promise.all(candidates.map(async (candidate) => {
             const metadata = await readChatGptAuthMetadata(candidate.path);
             candidate.credentialKind = metadata
@@ -5664,24 +5707,28 @@ export class BridgeSessionCore {
                     ? 'api-key'
                     : 'invalid';
             candidate.credentialLastRefreshMs = metadata?.lastRefreshMs ?? null;
-            return [candidate.name, metadata?.accountId ?? null];
+            return [candidate.name, metadata ? {
+                    accountId: metadata.accountId,
+                    quotaIdentityId: metadata.quotaIdentityId,
+                } : null];
         }));
-        const accountIds = new Map();
-        for (const [name, accountId] of entries) {
-            if (accountId) {
-                accountIds.set(name, accountId);
+        const quotaIdentities = new Map();
+        for (const [name, quotaIdentity] of entries) {
+            if (quotaIdentity) {
+                quotaIdentities.set(name, quotaIdentity);
             }
         }
-        return accountIds;
+        return quotaIdentities;
     }
-    codexAuthQuotaSnapshotMatchesAccount(snapshot, accountId) {
+    codexAuthQuotaSnapshotMatchesIdentity(snapshot, identity) {
         if (!snapshot) {
             return false;
         }
-        if (!snapshot.accountId) {
-            return accountId === null;
+        const snapshotIdentityId = snapshot.quotaIdentityId ?? snapshot.accountId ?? null;
+        if (!snapshotIdentityId) {
+            return identity === null;
         }
-        return accountId !== null && snapshot.accountId === accountId;
+        return identity !== null && snapshotIdentityId === identity.quotaIdentityId;
     }
     async readCodexAuthQuotaSnapshots() {
         if (this.authQuotaSnapshotsLoaded) {
@@ -8409,7 +8456,7 @@ function renderAuthListMessage(locale, state, botLabel = null, includeWeixinCopy
     if (state.candidates.length === 0) {
         lines.push(t(locale, 'auth_no_candidates'));
         if (includeWeixinCopyPaste) {
-            lines.push('', t(locale, 'weixin_copy_paste_divider'), t(locale, 'weixin_copy_auth_title'), '/login_device', '/auth reload', '/permissions');
+            lines.push('', t(locale, 'weixin_copy_paste_divider'), t(locale, 'weixin_copy_auth_title'), '/login_device', '/auth sync safe', '/auth reload', '/permissions');
         }
         return lines.join('\n');
     }
@@ -8442,7 +8489,7 @@ function renderAuthListMessage(locale, state, botLabel = null, includeWeixinCopy
     if (includeWeixinCopyPaste) {
         lines.push('', t(locale, 'weixin_copy_paste_divider'), t(locale, 'weixin_copy_auth_title'), ...page.visible.map(({ index }) => `/auth use ${index + 1}`), ...page.visible.map(({ candidate, index }) => candidate.disabled
             ? `/auth enable ${index + 1}`
-            : `/auth disable ${index + 1}`), '/auth filter all', '/auth filter enabled', '/auth filter attention', '/auth list <keyword>', '/login_device', '/auth reload', '/permissions');
+            : `/auth disable ${index + 1}`), '/auth filter all', '/auth filter enabled', '/auth filter attention', '/auth list <keyword>', '/login_device', '/auth sync safe', '/auth reload', '/permissions');
     }
     return lines.join('\n');
 }
@@ -8480,7 +8527,10 @@ function authChoiceKeyboard(locale, record) {
         { text: t(locale, 'button_permissions'), callback_data: 'nav:permissions' },
         { text: t(locale, 'button_login_device'), callback_data: `auth:${record.localId}:login_device` },
     ]);
-    rows.push([{ text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` }]);
+    rows.push([
+        { text: t(locale, 'button_auth_safe_sync'), callback_data: `auth:${record.localId}:safe_sync` },
+        { text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` },
+    ]);
     return rows;
 }
 function formatCodexAuthCandidateDisplayName(name) {
@@ -9322,10 +9372,11 @@ function formatRemainingUsagePercent(usedPercent) {
     const remainingPercent = remainingUsagePercent(usedPercent);
     return remainingPercent === null ? '?' : formatUsagePercent(remainingPercent);
 }
-function authQuotaSnapshotFromRateLimit(snapshot, accountId = null) {
+function authQuotaSnapshotFromRateLimit(snapshot, accountId = null, quotaIdentityId = null) {
     return {
         capturedAtMs: Date.now(),
         accountId,
+        quotaIdentityId,
         planType: snapshot.planType,
         primaryWindowDurationMins: snapshot.primary?.windowDurationMins ?? null,
         primaryRemainingPercent: snapshot.primary ? remainingUsagePercent(snapshot.primary.usedPercent) : null,
@@ -9337,6 +9388,7 @@ function codexAuthQuotaSnapshotFromRecord(record) {
     return {
         capturedAtMs: record.capturedAtMs,
         accountId: record.accountId,
+        quotaIdentityId: record.quotaIdentityId,
         planType: record.planType,
         primaryWindowDurationMins: record.primaryWindowDurationMins,
         primaryRemainingPercent: record.primaryRemainingPercent,
@@ -9356,6 +9408,7 @@ function mergeCodexAuthQuotaSnapshots(current, incoming) {
     return {
         ...freshest,
         accountId: freshest.accountId ?? older.accountId ?? null,
+        quotaIdentityId: freshest.quotaIdentityId ?? older.quotaIdentityId ?? null,
     };
 }
 function isFiniteCodexAuthQuotaSnapshotRecord(record) {
@@ -9404,6 +9457,7 @@ function isCodexAuthQuotaSnapshot(value) {
     return typeof snapshot.capturedAtMs === 'number'
         && Number.isFinite(snapshot.capturedAtMs)
         && (snapshot.accountId === undefined || snapshot.accountId === null || typeof snapshot.accountId === 'string')
+        && (snapshot.quotaIdentityId === undefined || snapshot.quotaIdentityId === null || typeof snapshot.quotaIdentityId === 'string')
         && (snapshot.planType === undefined || isNullableString(snapshot.planType))
         && (snapshot.primaryWindowDurationMins === undefined || isNullableFiniteNumber(snapshot.primaryWindowDurationMins))
         && isNullableFiniteNumber(snapshot.primaryRemainingPercent)
@@ -9414,6 +9468,7 @@ function normalizeCodexAuthQuotaSnapshot(snapshot) {
     return {
         capturedAtMs: snapshot.capturedAtMs,
         accountId: snapshot.accountId ?? null,
+        quotaIdentityId: snapshot.quotaIdentityId ?? snapshot.accountId ?? null,
         planType: snapshot.planType ?? null,
         primaryWindowDurationMins: snapshot.primaryWindowDurationMins ?? null,
         primaryRemainingPercent: snapshot.primaryRemainingPercent,
@@ -9421,6 +9476,15 @@ function normalizeCodexAuthQuotaSnapshot(snapshot) {
         secondaryRemainingPercent: snapshot.secondaryRemainingPercent,
     };
 }
+function chatGptAuthMetadataCompatible(left, right) {
+    if (left.accountId !== right.accountId) {
+        return false;
+    }
+    if (left.quotaIdentityId === left.accountId || right.quotaIdentityId === right.accountId) {
+        return true;
+    }
+    return left.quotaIdentityId === right.quotaIdentityId;
+}
 function isNullableFiniteNumber(value) {
     return value === null || (typeof value === 'number' && Number.isFinite(value));
 }

package/dist/i18n.d.ts

@@ -143,8 +143,8 @@ declare const MESSAGES: {
         readonly auth_reload_restarting: "Restarting Codex app-server to reload auth...";
         readonly auth_reload_done: "Codex app-server restarted. Current auth has been reloaded.";
         readonly auth_reload_blocked_active: "Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.";
-        readonly usage_auth: "Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|sync <status|test|push all>|add <name>]";
-        readonly usage_auth_sync: "Usage: /auth sync <status|events [filter]|trace <requestId>|test|push all>";
+        readonly usage_auth: "Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <name>]";
+        readonly usage_auth_sync: "Usage: /auth sync <status|events [filter]|trace <requestId>|test|safe|push all>";
         readonly usage_auth_add: "Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.";
         readonly auth_list_title: "Codex auth files:";
         readonly auth_bot: "Bot runtime: {value}";
@@ -212,6 +212,8 @@ declare const MESSAGES: {
         readonly auth_sync_test_sent: "Auth sync test complete: sent {sent}, replies {replied}.";
         readonly auth_sync_test_missing: "Missing replies: {value}";
         readonly auth_sync_push_blocked_active: "Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.";
+        readonly auth_sync_safe_starting: "Safely syncing auth across local bot runtimes and cross-node peers...";
+        readonly auth_sync_safe_done: "Safe auth sync complete: local synced {localSynced}, local skipped {localSkipped}; cross-node sent {sent}, skipped {skipped}.";
         readonly auth_sync_push_done: "Auth sync push complete: sent {sent}, skipped {skipped}.";
         readonly auth_sync_status_title: "Cross-node auth sync:";
         readonly auth_sync_status_node: "Node: {value}";
@@ -235,6 +237,7 @@ declare const MESSAGES: {
         readonly auth_sync_trace_missing: "Usage: /auth sync trace <requestId>";
         readonly button_login_device: "🔑 Login";
         readonly button_auth_reload: "🔄 Reload auth";
+        readonly button_auth_safe_sync: "🧷 Safe sync";
         readonly button_auth_refresh_all_confirm: "⚠️ Accept risk & refresh";
         readonly button_auth_enable: "✅";
         readonly button_auth_disable: "⏸️";
@@ -796,8 +799,8 @@ declare const MESSAGES: {
         readonly auth_reload_restarting: "正在重启 Codex app-server 以重新读取 auth...";
         readonly auth_reload_done: "Codex app-server 已重启，当前 auth 已重新读取。";
         readonly auth_reload_blocked_active: "当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。";
-        readonly usage_auth: "用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|sync <status|test|push all>|add <名称>]";
-        readonly usage_auth_sync: "用法：/auth sync <status|events [过滤]|trace <requestId>|test|push all>";
+        readonly usage_auth: "用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <名称>]";
+        readonly usage_auth_sync: "用法：/auth sync <status|events [过滤]|trace <requestId>|test|safe|push all>";
         readonly usage_auth_add: "用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。";
         readonly auth_list_title: "Codex auth 文件：";
         readonly auth_bot: "Bot runtime：{value}";
@@ -865,6 +868,8 @@ declare const MESSAGES: {
         readonly auth_sync_test_sent: "auth sync 测试完成：已发送 {sent}，收到回应 {replied}。";
         readonly auth_sync_test_missing: "未回应：{value}";
         readonly auth_sync_push_blocked_active: "当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。";
+        readonly auth_sync_safe_starting: "正在安全同步本机多 bot runtime 和跨节点 auth...";
+        readonly auth_sync_safe_done: "安全 auth 同步完成：本机同步 {localSynced}，本机跳过 {localSkipped}；跨节点发送 {sent}，跳过 {skipped}。";
         readonly auth_sync_push_done: "auth 同步推送完成：已发送 {sent}，已跳过 {skipped}。";
         readonly auth_sync_status_title: "跨节点 auth 同步：";
         readonly auth_sync_status_node: "节点：{value}";
@@ -888,6 +893,7 @@ declare const MESSAGES: {
         readonly auth_sync_trace_missing: "用法：/auth sync trace <requestId>";
         readonly button_login_device: "🔑 设备登录";
         readonly button_auth_reload: "🔄 重载 auth";
+        readonly button_auth_safe_sync: "🧷 安全同步";
         readonly button_auth_refresh_all_confirm: "⚠️ 接受风险并刷新";
         readonly button_auth_enable: "✅";
         readonly button_auth_disable: "⏸️";

package/dist/i18n.js

@@ -141,8 +141,8 @@ const MESSAGES = {
         auth_reload_restarting: 'Restarting Codex app-server to reload auth...',
         auth_reload_done: 'Codex app-server restarted. Current auth has been reloaded.',
         auth_reload_blocked_active: 'Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.',
-        usage_auth: 'Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|sync <status|test|push all>|add <name>]',
-        usage_auth_sync: 'Usage: /auth sync <status|events [filter]|trace <requestId>|test|push all>',
+        usage_auth: 'Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <name>]',
+        usage_auth_sync: 'Usage: /auth sync <status|events [filter]|trace <requestId>|test|safe|push all>',
         usage_auth_add: 'Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.',
         auth_list_title: 'Codex auth files:',
         auth_bot: 'Bot runtime: {value}',
@@ -210,6 +210,8 @@ const MESSAGES = {
         auth_sync_test_sent: 'Auth sync test complete: sent {sent}, replies {replied}.',
         auth_sync_test_missing: 'Missing replies: {value}',
         auth_sync_push_blocked_active: 'Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.',
+        auth_sync_safe_starting: 'Safely syncing auth across local bot runtimes and cross-node peers...',
+        auth_sync_safe_done: 'Safe auth sync complete: local synced {localSynced}, local skipped {localSkipped}; cross-node sent {sent}, skipped {skipped}.',
         auth_sync_push_done: 'Auth sync push complete: sent {sent}, skipped {skipped}.',
         auth_sync_status_title: 'Cross-node auth sync:',
         auth_sync_status_node: 'Node: {value}',
@@ -233,6 +235,7 @@ const MESSAGES = {
         auth_sync_trace_missing: 'Usage: /auth sync trace <requestId>',
         button_login_device: '🔑 Login',
         button_auth_reload: '🔄 Reload auth',
+        button_auth_safe_sync: '🧷 Safe sync',
         button_auth_refresh_all_confirm: '⚠️ Accept risk & refresh',
         button_auth_enable: '✅',
         button_auth_disable: '⏸️',
@@ -794,8 +797,8 @@ const MESSAGES = {
         auth_reload_restarting: '正在重启 Codex app-server 以重新读取 auth...',
         auth_reload_done: 'Codex app-server 已重启，当前 auth 已重新读取。',
         auth_reload_blocked_active: '当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。',
-        usage_auth: '用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|sync <status|test|push all>|add <名称>]',
-        usage_auth_sync: '用法：/auth sync <status|events [过滤]|trace <requestId>|test|push all>',
+        usage_auth: '用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <名称>]',
+        usage_auth_sync: '用法：/auth sync <status|events [过滤]|trace <requestId>|test|safe|push all>',
         usage_auth_add: '用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。',
         auth_list_title: 'Codex auth 文件：',
         auth_bot: 'Bot runtime：{value}',
@@ -863,6 +866,8 @@ const MESSAGES = {
         auth_sync_test_sent: 'auth sync 测试完成：已发送 {sent}，收到回应 {replied}。',
         auth_sync_test_missing: '未回应：{value}',
         auth_sync_push_blocked_active: '当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。',
+        auth_sync_safe_starting: '正在安全同步本机多 bot runtime 和跨节点 auth...',
+        auth_sync_safe_done: '安全 auth 同步完成：本机同步 {localSynced}，本机跳过 {localSkipped}；跨节点发送 {sent}，跳过 {skipped}。',
         auth_sync_push_done: 'auth 同步推送完成：已发送 {sent}，已跳过 {skipped}。',
         auth_sync_status_title: '跨节点 auth 同步：',
         auth_sync_status_node: '节点：{value}',
@@ -886,6 +891,7 @@ const MESSAGES = {
         auth_sync_trace_missing: '用法：/auth sync trace <requestId>',
         button_login_device: '🔑 设备登录',
         button_auth_reload: '🔄 重载 auth',
+        button_auth_safe_sync: '🧷 安全同步',
         button_auth_refresh_all_confirm: '⚠️ 接受风险并刷新',
         button_auth_enable: '✅',
         button_auth_disable: '⏸️',

package/dist/main.js

@@ -334,6 +334,7 @@ async function runServeCli() {
                         ?? await mirror.readNewestCandidate(candidateName);
                     return await authSync?.requestRecovery(candidateName, {
                         accountId: current?.accountId ?? null,
+                        quotaIdentityId: current?.quotaIdentityId ?? null,
                         lastRefreshMs: current?.lastRefreshMs ?? null,
                     }) ?? false;
                 },
@@ -342,6 +343,16 @@ async function runServeCli() {
                 releaseAuthRefreshLease: (leaseId) => authSync?.releaseRefreshLease(leaseId)
                     ?? localAuthRefreshLease.release(leaseId),
                 getAuthSyncStatus: () => authSync?.getStatus() ?? null,
+                authSyncSafeAll: async () => {
+                    const local = await mirror.syncAllRuntimeCandidates();
+                    const remote = await authSync?.pushAll() ?? { sent: 0, skipped: 0 };
+                    return {
+                        localSynced: local.synced,
+                        localSkipped: local.skipped,
+                        sent: remote.sent,
+                        skipped: remote.skipped,
+                    };
+                },
                 authSyncPushAll: () => authSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
                 authSyncTest: () => authSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
                 statusUpdated: () => writeAggregateStatus(),
@@ -492,6 +503,7 @@ async function runServeCli() {
                     ?? null;
                 return await singleAuthSync?.requestRecovery(candidateName, {
                     accountId: current?.accountId ?? null,
+                    quotaIdentityId: current?.quotaIdentityId ?? null,
                     lastRefreshMs: current?.lastRefreshMs ?? null,
                 }) ?? false;
             },
@@ -500,6 +512,16 @@ async function runServeCli() {
             releaseAuthRefreshLease: (leaseId) => singleAuthSync?.releaseRefreshLease(leaseId)
                 ?? singleLocalAuthRefreshLease.release(leaseId),
             getAuthSyncStatus: () => singleAuthSync?.getStatus() ?? null,
+            authSyncSafeAll: async () => {
+                const local = await singleMirror?.syncAllRuntimeCandidates() ?? { synced: 0, skipped: 0 };
+                const remote = await singleAuthSync?.pushAll() ?? { sent: 0, skipped: 0 };
+                return {
+                    localSynced: local.synced,
+                    localSkipped: local.skipped,
+                    sent: remote.sent,
+                    skipped: remote.skipped,
+                };
+            },
             authSyncPushAll: () => singleAuthSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
             authSyncTest: () => singleAuthSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
             statusUpdated: (status) => {

package/dist/store/database.d.ts

@@ -28,6 +28,7 @@ export interface CodexAuthQuotaSnapshotRecord {
     runtimeId: string;
     candidateName: string;
     accountId: string;
+    quotaIdentityId: string;
     capturedAtMs: number;
     planType: string | null;
     primaryWindowDurationMins: number | null;
@@ -117,7 +118,7 @@ export declare class BridgeStore {
     setWeixinContextToken(scopeId: string, contextToken: string): void;
     listDisabledCodexAuthCandidateNames(runtimeId?: string): Set<string>;
     setCodexAuthCandidateDisabled(name: string, disabled: boolean, runtimeId?: string): void;
-    setCodexAuthQuotaSnapshot(runtimeId: string, candidateName: string, accountId: string, snapshot: Pick<CodexAuthQuotaSnapshotRecord, 'capturedAtMs' | 'planType' | 'primaryWindowDurationMins' | 'primaryRemainingPercent' | 'secondaryWindowDurationMins' | 'secondaryRemainingPercent'>): void;
-    listCodexAuthQuotaSnapshots(accountIds: string[]): CodexAuthQuotaSnapshotRecord[];
+    setCodexAuthQuotaSnapshot(runtimeId: string, candidateName: string, accountId: string, quotaIdentityId: string, snapshot: Pick<CodexAuthQuotaSnapshotRecord, 'capturedAtMs' | 'planType' | 'primaryWindowDurationMins' | 'primaryRemainingPercent' | 'secondaryWindowDurationMins' | 'secondaryRemainingPercent'>): void;
+    listCodexAuthQuotaSnapshots(quotaIdentityIds: string[]): CodexAuthQuotaSnapshotRecord[];
     private ensureColumn;
 }

package/dist/store/database.js

@@ -182,6 +182,7 @@ export class BridgeStore {
         runtime_id TEXT NOT NULL,
         candidate_name TEXT NOT NULL,
         account_id TEXT NOT NULL,
+        quota_identity_id TEXT NOT NULL DEFAULT '',
         captured_at_ms INTEGER NOT NULL,
         plan_type TEXT,
         primary_window_duration_mins REAL,
@@ -209,6 +210,16 @@ export class BridgeStore {
         this.ensureColumn('codex_auth_quota_snapshots', 'plan_type', 'TEXT');
         this.ensureColumn('codex_auth_quota_snapshots', 'primary_window_duration_mins', 'REAL');
         this.ensureColumn('codex_auth_quota_snapshots', 'secondary_window_duration_mins', 'REAL');
+        this.ensureColumn('codex_auth_quota_snapshots', 'quota_identity_id', "TEXT NOT NULL DEFAULT ''");
+        this.db.prepare(`
+      UPDATE codex_auth_quota_snapshots
+      SET quota_identity_id = account_id
+      WHERE quota_identity_id = ''
+    `).run();
+        this.db.exec(`
+      CREATE INDEX IF NOT EXISTS codex_auth_quota_snapshots_quota_identity_idx
+        ON codex_auth_quota_snapshots(quota_identity_id);
+    `);
         migrateLegacyBridgeScopeIds(this.db);
     }
     getTelegramOffset(botKey) {
@@ -839,12 +850,13 @@ export class BridgeStore {
       ON CONFLICT(name) DO UPDATE SET disabled = excluded.disabled, updated_at = excluded.updated_at
     `).run(name, disabled ? 1 : 0, Date.now());
     }
-    setCodexAuthQuotaSnapshot(runtimeId, candidateName, accountId, snapshot) {
+    setCodexAuthQuotaSnapshot(runtimeId, candidateName, accountId, quotaIdentityId, snapshot) {
         this.db.prepare(`
       INSERT INTO codex_auth_quota_snapshots (
         runtime_id,
         candidate_name,
         account_id,
+        quota_identity_id,
         captured_at_ms,
         plan_type,
         primary_window_duration_mins,
@@ -853,9 +865,10 @@ export class BridgeStore {
         secondary_remaining_percent,
         updated_at
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(runtime_id, candidate_name) DO UPDATE SET
         account_id = excluded.account_id,
+        quota_identity_id = excluded.quota_identity_id,
         captured_at_ms = excluded.captured_at_ms,
         plan_type = excluded.plan_type,
         primary_window_duration_mins = excluded.primary_window_duration_mins,
@@ -863,19 +876,20 @@ export class BridgeStore {
         secondary_window_duration_mins = excluded.secondary_window_duration_mins,
         secondary_remaining_percent = excluded.secondary_remaining_percent,
         updated_at = excluded.updated_at
-    `).run(runtimeId, candidateName, accountId, snapshot.capturedAtMs, snapshot.planType, snapshot.primaryWindowDurationMins, snapshot.primaryRemainingPercent, snapshot.secondaryWindowDurationMins, snapshot.secondaryRemainingPercent, Date.now());
+    `).run(runtimeId, candidateName, accountId, quotaIdentityId, snapshot.capturedAtMs, snapshot.planType, snapshot.primaryWindowDurationMins, snapshot.primaryRemainingPercent, snapshot.secondaryWindowDurationMins, snapshot.secondaryRemainingPercent, Date.now());
     }
-    listCodexAuthQuotaSnapshots(accountIds) {
-        const uniqueAccountIds = [...new Set(accountIds.filter(Boolean))];
-        if (uniqueAccountIds.length === 0) {
+    listCodexAuthQuotaSnapshots(quotaIdentityIds) {
+        const uniqueQuotaIdentityIds = [...new Set(quotaIdentityIds.filter(Boolean))];
+        if (uniqueQuotaIdentityIds.length === 0) {
             return [];
         }
-        const placeholders = uniqueAccountIds.map(() => '?').join(', ');
+        const placeholders = uniqueQuotaIdentityIds.map(() => '?').join(', ');
         const rows = this.db.prepare(`
       SELECT
         runtime_id,
         candidate_name,
         account_id,
+        quota_identity_id,
         captured_at_ms,
         plan_type,
         primary_window_duration_mins,
@@ -884,12 +898,13 @@ export class BridgeStore {
         secondary_remaining_percent,
         updated_at
       FROM codex_auth_quota_snapshots
-      WHERE account_id IN (${placeholders})
-    `).all(...uniqueAccountIds);
+      WHERE quota_identity_id IN (${placeholders})
+    `).all(...uniqueQuotaIdentityIds);
         return rows.map(row => ({
             runtimeId: String(row.runtime_id),
             candidateName: String(row.candidate_name),
             accountId: String(row.account_id),
+            quotaIdentityId: String(row.quota_identity_id),
             capturedAtMs: Number(row.captured_at_ms),
             planType: nullableString(row.plan_type),
             primaryWindowDurationMins: nullableNumber(row.primary_window_duration_mins),

package/docs/cross-node-auth-sync.md

@@ -33,7 +33,7 @@ Safety boundaries:
 - FoxClaw only accepts sync files from bots listed in `AUTH_SYNC_PEERS`.
 - Wrong `AUTH_SYNC_KEY`, cluster, nonce, or payload validation never writes files.
 - Remote imports wait for global local idleness, then run temporary usage validation before writing a candidate.
-- A same-name candidate known to belong to a different account id is never overwritten.
+- A same-name candidate known to belong to a different account id, or to a different identifiable ChatGPT user/email under the same account, is never overwritten.
 - Sync packets do not create reply chains. FoxClaw filters by packet type, nonce, and peer allowlist to avoid bot-to-bot loops.
 
 Telegram's official Bot Features documentation says private bot-to-bot messaging requires Bot-to-Bot Communication Mode on both sender and recipient, and it calls out loop-prevention requirements. See https://core.telegram.org/bots/features#bot-to-bot-communication
@@ -164,7 +164,7 @@ If it shows `Missing replies: @peer_bot`, Telegram delivery may have succeeded,
 
 Confirm that pending imports were processed, or that the candidate exists or has a newer timestamp.
 
-Note: `/auth sync push all` saying “sent” only means this node successfully handed encrypted packages to Telegram. It does not prove the peer wrote files. The peer imports only when it is globally idle, usage validation succeeds, same-name candidates belong to the same account id, and the remote `last_refresh` is newer than the local copy. If the local file is already equal or newer, it will not change and `Last import` may remain empty.
+Note: `/auth sync push all` saying “sent” only means this node successfully handed encrypted packages to Telegram. It does not prove the peer wrote files. The peer imports only when it is globally idle, usage validation succeeds, same-name candidates belong to the same account id and compatible ChatGPT user/email identity, and the remote `last_refresh` is newer than the local copy. If the local file is already equal or newer, it will not change and `Last import` may remain empty.
 
 When cross-node sync is enabled, the contact bot private chat receives node-level notifications: local auth updates and the peers being contacted, received remote bundles and whether they were queued or immediately validated, import success/skip/failure reasons, recovery peer queries and peer replies, and a manual-intervention notice when every peer lacks an importable copy. Notifications never include auth contents, tokens, or encrypted bundle payloads.
 
@@ -198,7 +198,7 @@ With cross-node sync enabled, this command first requests a cross-node refresh l
 
 - The local node may not be globally idle. Active turns, approvals, inputs, login flows, and mirror writes make imports wait.
 - Usage validation failure rejects the write.
-- Same-name candidates from different account ids are refused.
+- Same-name candidates from different account ids, or from different identifiable ChatGPT users/emails under the same account, are refused.
 - Run `/auth sync events <candidate>` or `/auth sync trace <requestId>` to see the receive, validation, skip, or failure records kept by FoxClaw.
 
 **Should I periodically run `/auth refresh all confirm` as keepalive?**