@foxden-app/foxclaw 0.5.19 → 0.5.21

package/dist/i18n.d.ts

@@ -187,6 +187,8 @@ declare const MESSAGES: {
         readonly auth_repair_reverted: "Restored previous auth. The candidate still needs repair.";
         readonly auth_candidate_deleted: "Deleted auth candidate: {value}";
         readonly auth_candidate_deleted_short: "Auth deleted";
+        readonly auth_candidate_auto_deleted: "Auto-deleted unrecoverable auth candidate: {value}";
+        readonly auth_pool_summary: "Auth pool: total seen {total}, alive {alive}, invalid-deleted {deleted}.";
         readonly auth_delete_current_restarted: "The deleted candidate was current, so Codex app-server was restarted without it.";
         readonly auth_no_candidates: "No auth candidates found. Expected files like auth.json_personal in the auth dir.";
         readonly auth_choice_expired: "This auth list is no longer active";
@@ -195,6 +197,8 @@ declare const MESSAGES: {
         readonly auth_switching: "Switching Codex auth: {from} -> {to}...";
         readonly auth_switch_done: "Codex auth switched: {from} -> {to}.";
         readonly auth_switch_validation_failed: "Selected auth failed validation: {error}. Marked {value} for login repair.";
+        readonly auth_switch_validation_auto_deleted: "Selected auth failed validation: {error}. Auto-deleted {value}.";
+        readonly auth_switch_validation_auto_deleted_quiet: "Selected auth failed validation and was auto-deleted.";
         readonly auth_switch_validation_reverted: "Restored the previous auth after the failed switch.";
         readonly auth_recovered_newer_candidate: "Recovered a newer same-account credential for {value} from another Codex home before reload.";
         readonly auth_refresh_all_confirm_short: "Review refresh all risk first.";
@@ -211,8 +215,10 @@ declare const MESSAGES: {
         readonly auth_refresh_all_skipped: "Skipped non-ChatGPT/invalid candidates: {value}";
         readonly auth_refresh_all_failed: "Failed: {value}";
         readonly auth_auto_switching: "Codex auth problem detected ({error}). Switching: {from} -> {to}...";
+        readonly auth_auto_switching_quiet: "Codex auth problem detected ({error}). Selecting another maintained candidate...";
         readonly auth_auto_recovered_current: "Codex auth problem detected ({error}). Recovered a newer same-account credential for {value} and restarted Codex app-server.";
         readonly auth_auto_done: "Auto-switched Codex auth: {from} -> {to}.";
+        readonly auth_auto_done_quiet: "Codex auth problem handled with another maintained candidate.";
         readonly auth_auto_retrying: "Retrying the same request with the new auth...";
         readonly auth_auto_retry_thread_missing: "Auth was switched, but the original thread is no longer available ({threadId}). Retry was stopped to avoid creating duplicate sessions.";
         readonly auth_auto_no_candidate: "Codex auth problem detected ({error}), but no unused auth candidate is available.";
@@ -225,6 +231,7 @@ declare const MESSAGES: {
         readonly auth_add_reverted: "Restored previous auth.";
         readonly auth_add_missing_file: "Login completed, but the new auth file was not created: {value}";
         readonly auth_sync_disabled: "Cross-node auth sync is disabled.";
+        readonly auth_sync_validation_busy: "Auth sync is validating refreshed credentials and temporarily restarting Codex app-server. Wait a moment, then send this message again.";
         readonly auth_sync_test_sent: "Auth sync test complete: sent {sent}, replies {replied}.";
         readonly auth_sync_test_missing: "Missing replies: {value}";
         readonly auth_sync_push_blocked_active: "Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.";
@@ -262,6 +269,8 @@ declare const MESSAGES: {
         readonly button_auth_filter_all: "All";
         readonly button_auth_filter_enabled: "Enabled";
         readonly button_auth_filter_attention: "Attention";
+        readonly button_config_auth_auto_delete_on: "Auto-delete on";
+        readonly button_config_auth_auto_delete_off: "Auto-delete off";
         readonly another_turn_running: "Another turn is already running. Use /interrupt, /takeover, /queue, or wait.";
         readonly working: "Working...";
         readonly usage_open: "Usage: /open <n>";
@@ -592,6 +601,11 @@ declare const MESSAGES: {
         readonly features_empty: "No features found.";
         readonly config_title: "Config summary";
         readonly config_layers: "Config layers: {count}";
+        readonly config_foxclaw_title: "FoxClaw runtime config";
+        readonly config_auth_auto_delete_needs_repair: "Auto-delete unrecoverable auth candidates: {value}";
+        readonly config_auth_auto_delete_updated: "Auto-delete unrecoverable auth candidates set to: {value}";
+        readonly config_auth_auto_delete_usage: "Usage: /config auth_auto_delete <on|off>";
+        readonly config_env_update_failed: "Runtime setting changed, but updating {value} failed: {error}";
         readonly requirements_title: "Config requirements";
         readonly requirements_empty: "No config requirements are configured.";
         readonly provider_title: "Model provider capabilities";
@@ -861,6 +875,8 @@ declare const MESSAGES: {
         readonly auth_repair_reverted: "已恢复之前的 auth。该候选仍需要修复。";
         readonly auth_candidate_deleted: "已删除 auth 候选：{value}";
         readonly auth_candidate_deleted_short: "auth 已删除";
+        readonly auth_candidate_auto_deleted: "已自动剔除无法恢复的 auth 候选：{value}";
+        readonly auth_pool_summary: "auth 池：历史 {total}，存活 {alive}，因失效剔除 {deleted}。";
         readonly auth_delete_current_restarted: "被删除的候选是当前 auth，已在删除后重启 Codex app-server。";
         readonly auth_no_candidates: "没有找到 auth 候选文件。请在 auth 目录中放置类似 auth.json_personal 的文件。";
         readonly auth_choice_expired: "这个 auth 列表已经不再有效";
@@ -869,6 +885,8 @@ declare const MESSAGES: {
         readonly auth_switching: "正在切换 Codex auth：{from} -> {to}...";
         readonly auth_switch_done: "Codex auth 已切换：{from} -> {to}。";
         readonly auth_switch_validation_failed: "选中的 auth 验证失败：{error}。已将 {value} 标记为需要登录修复。";
+        readonly auth_switch_validation_auto_deleted: "选中的 auth 验证失败：{error}。已自动剔除 {value}。";
+        readonly auth_switch_validation_auto_deleted_quiet: "选中的 auth 验证失败，已自动剔除。";
         readonly auth_switch_validation_reverted: "已在切换失败后恢复到之前的 auth。";
         readonly auth_recovered_newer_candidate: "重载前已从其他 Codex home 恢复 {value} 的同账号较新凭据。";
         readonly auth_refresh_all_confirm_short: "请先确认刷新全部风险。";
@@ -885,8 +903,10 @@ declare const MESSAGES: {
         readonly auth_refresh_all_skipped: "已跳过非 ChatGPT/无效候选：{value}";
         readonly auth_refresh_all_failed: "失败：{value}";
         readonly auth_auto_switching: "检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...";
+        readonly auth_auto_switching_quiet: "检测到 Codex auth 问题（{error}），正在选择另一个维护中的候选...";
         readonly auth_auto_recovered_current: "检测到 Codex auth 问题（{error}），已为 {value} 恢复同账号较新凭据并重启 Codex app-server。";
         readonly auth_auto_done: "已自动切换 Codex auth：{from} -> {to}。";
+        readonly auth_auto_done_quiet: "Codex auth 问题已用另一个维护中的候选处理。";
         readonly auth_auto_retrying: "正在用新的 auth 重试同一条请求...";
         readonly auth_auto_retry_thread_missing: "Auth 已切换，但原线程已经不可用（{threadId}）。已停止重试，避免创建重复 session。";
         readonly auth_auto_no_candidate: "检测到 Codex auth 问题（{error}），但没有可用的未失败候选 auth。";
@@ -899,6 +919,7 @@ declare const MESSAGES: {
         readonly auth_add_reverted: "已恢复之前的 auth。";
         readonly auth_add_missing_file: "登录已完成，但没有创建新的 auth 文件：{value}";
         readonly auth_sync_disabled: "跨节点 auth 同步未启用。";
+        readonly auth_sync_validation_busy: "正在验证跨节点 auth，并临时重启 Codex app-server。请稍等片刻后再发送这条消息。";
         readonly auth_sync_test_sent: "auth sync 测试完成：已发送 {sent}，收到回应 {replied}。";
         readonly auth_sync_test_missing: "未回应：{value}";
         readonly auth_sync_push_blocked_active: "当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。";
@@ -936,6 +957,8 @@ declare const MESSAGES: {
         readonly button_auth_filter_all: "全部";
         readonly button_auth_filter_enabled: "已启用";
         readonly button_auth_filter_attention: "需关注";
+        readonly button_config_auth_auto_delete_on: "开启自动剔除";
+        readonly button_config_auth_auto_delete_off: "关闭自动剔除";
         readonly another_turn_running: "已经有一个回复在进行中。请先等待，或使用 /interrupt、/takeover、/queue。";
         readonly working: "处理中...";
         readonly usage_open: "用法：/open <编号>";
@@ -1266,6 +1289,11 @@ declare const MESSAGES: {
         readonly features_empty: "没有找到功能开关。";
         readonly config_title: "配置摘要";
         readonly config_layers: "配置层数：{count}";
+        readonly config_foxclaw_title: "FoxClaw 运行时配置";
+        readonly config_auth_auto_delete_needs_repair: "自动剔除无法恢复的 auth 候选：{value}";
+        readonly config_auth_auto_delete_updated: "自动剔除无法恢复的 auth 候选已设置为：{value}";
+        readonly config_auth_auto_delete_usage: "用法：/config auth_auto_delete <on|off>";
+        readonly config_env_update_failed: "运行时设置已改变，但更新 {value} 失败：{error}";
         readonly requirements_title: "配置要求";
         readonly requirements_empty: "当前没有配置要求。";
         readonly provider_title: "模型供应商能力";

package/dist/i18n.js

@@ -185,6 +185,8 @@ const MESSAGES = {
         auth_repair_reverted: 'Restored previous auth. The candidate still needs repair.',
         auth_candidate_deleted: 'Deleted auth candidate: {value}',
         auth_candidate_deleted_short: 'Auth deleted',
+        auth_candidate_auto_deleted: 'Auto-deleted unrecoverable auth candidate: {value}',
+        auth_pool_summary: 'Auth pool: total seen {total}, alive {alive}, invalid-deleted {deleted}.',
         auth_delete_current_restarted: 'The deleted candidate was current, so Codex app-server was restarted without it.',
         auth_no_candidates: 'No auth candidates found. Expected files like auth.json_personal in the auth dir.',
         auth_choice_expired: 'This auth list is no longer active',
@@ -193,6 +195,8 @@ const MESSAGES = {
         auth_switching: 'Switching Codex auth: {from} -> {to}...',
         auth_switch_done: 'Codex auth switched: {from} -> {to}.',
         auth_switch_validation_failed: 'Selected auth failed validation: {error}. Marked {value} for login repair.',
+        auth_switch_validation_auto_deleted: 'Selected auth failed validation: {error}. Auto-deleted {value}.',
+        auth_switch_validation_auto_deleted_quiet: 'Selected auth failed validation and was auto-deleted.',
         auth_switch_validation_reverted: 'Restored the previous auth after the failed switch.',
         auth_recovered_newer_candidate: 'Recovered a newer same-account credential for {value} from another Codex home before reload.',
         auth_refresh_all_confirm_short: 'Review refresh all risk first.',
@@ -209,8 +213,10 @@ const MESSAGES = {
         auth_refresh_all_skipped: 'Skipped non-ChatGPT/invalid candidates: {value}',
         auth_refresh_all_failed: 'Failed: {value}',
         auth_auto_switching: 'Codex auth problem detected ({error}). Switching: {from} -> {to}...',
+        auth_auto_switching_quiet: 'Codex auth problem detected ({error}). Selecting another maintained candidate...',
         auth_auto_recovered_current: 'Codex auth problem detected ({error}). Recovered a newer same-account credential for {value} and restarted Codex app-server.',
         auth_auto_done: 'Auto-switched Codex auth: {from} -> {to}.',
+        auth_auto_done_quiet: 'Codex auth problem handled with another maintained candidate.',
         auth_auto_retrying: 'Retrying the same request with the new auth...',
         auth_auto_retry_thread_missing: 'Auth was switched, but the original thread is no longer available ({threadId}). Retry was stopped to avoid creating duplicate sessions.',
         auth_auto_no_candidate: 'Codex auth problem detected ({error}), but no unused auth candidate is available.',
@@ -223,6 +229,7 @@ const MESSAGES = {
         auth_add_reverted: 'Restored previous auth.',
         auth_add_missing_file: 'Login completed, but the new auth file was not created: {value}',
         auth_sync_disabled: 'Cross-node auth sync is disabled.',
+        auth_sync_validation_busy: 'Auth sync is validating refreshed credentials and temporarily restarting Codex app-server. Wait a moment, then send this message again.',
         auth_sync_test_sent: 'Auth sync test complete: sent {sent}, replies {replied}.',
         auth_sync_test_missing: 'Missing replies: {value}',
         auth_sync_push_blocked_active: 'Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.',
@@ -260,6 +267,8 @@ const MESSAGES = {
         button_auth_filter_all: 'All',
         button_auth_filter_enabled: 'Enabled',
         button_auth_filter_attention: 'Attention',
+        button_config_auth_auto_delete_on: 'Auto-delete on',
+        button_config_auth_auto_delete_off: 'Auto-delete off',
         another_turn_running: 'Another turn is already running. Use /interrupt, /takeover, /queue, or wait.',
         working: 'Working...',
         usage_open: 'Usage: /open <n>',
@@ -590,6 +599,11 @@ const MESSAGES = {
         features_empty: 'No features found.',
         config_title: 'Config summary',
         config_layers: 'Config layers: {count}',
+        config_foxclaw_title: 'FoxClaw runtime config',
+        config_auth_auto_delete_needs_repair: 'Auto-delete unrecoverable auth candidates: {value}',
+        config_auth_auto_delete_updated: 'Auto-delete unrecoverable auth candidates set to: {value}',
+        config_auth_auto_delete_usage: 'Usage: /config auth_auto_delete <on|off>',
+        config_env_update_failed: 'Runtime setting changed, but updating {value} failed: {error}',
         requirements_title: 'Config requirements',
         requirements_empty: 'No config requirements are configured.',
         provider_title: 'Model provider capabilities',
@@ -859,6 +873,8 @@ const MESSAGES = {
         auth_repair_reverted: '已恢复之前的 auth。该候选仍需要修复。',
         auth_candidate_deleted: '已删除 auth 候选：{value}',
         auth_candidate_deleted_short: 'auth 已删除',
+        auth_candidate_auto_deleted: '已自动剔除无法恢复的 auth 候选：{value}',
+        auth_pool_summary: 'auth 池：历史 {total}，存活 {alive}，因失效剔除 {deleted}。',
         auth_delete_current_restarted: '被删除的候选是当前 auth，已在删除后重启 Codex app-server。',
         auth_no_candidates: '没有找到 auth 候选文件。请在 auth 目录中放置类似 auth.json_personal 的文件。',
         auth_choice_expired: '这个 auth 列表已经不再有效',
@@ -867,6 +883,8 @@ const MESSAGES = {
         auth_switching: '正在切换 Codex auth：{from} -> {to}...',
         auth_switch_done: 'Codex auth 已切换：{from} -> {to}。',
         auth_switch_validation_failed: '选中的 auth 验证失败：{error}。已将 {value} 标记为需要登录修复。',
+        auth_switch_validation_auto_deleted: '选中的 auth 验证失败：{error}。已自动剔除 {value}。',
+        auth_switch_validation_auto_deleted_quiet: '选中的 auth 验证失败，已自动剔除。',
         auth_switch_validation_reverted: '已在切换失败后恢复到之前的 auth。',
         auth_recovered_newer_candidate: '重载前已从其他 Codex home 恢复 {value} 的同账号较新凭据。',
         auth_refresh_all_confirm_short: '请先确认刷新全部风险。',
@@ -883,8 +901,10 @@ const MESSAGES = {
         auth_refresh_all_skipped: '已跳过非 ChatGPT/无效候选：{value}',
         auth_refresh_all_failed: '失败：{value}',
         auth_auto_switching: '检测到 Codex auth 问题（{error}），正在切换：{from} -> {to}...',
+        auth_auto_switching_quiet: '检测到 Codex auth 问题（{error}），正在选择另一个维护中的候选...',
         auth_auto_recovered_current: '检测到 Codex auth 问题（{error}），已为 {value} 恢复同账号较新凭据并重启 Codex app-server。',
         auth_auto_done: '已自动切换 Codex auth：{from} -> {to}。',
+        auth_auto_done_quiet: 'Codex auth 问题已用另一个维护中的候选处理。',
         auth_auto_retrying: '正在用新的 auth 重试同一条请求...',
         auth_auto_retry_thread_missing: 'Auth 已切换，但原线程已经不可用（{threadId}）。已停止重试，避免创建重复 session。',
         auth_auto_no_candidate: '检测到 Codex auth 问题（{error}），但没有可用的未失败候选 auth。',
@@ -897,6 +917,7 @@ const MESSAGES = {
         auth_add_reverted: '已恢复之前的 auth。',
         auth_add_missing_file: '登录已完成，但没有创建新的 auth 文件：{value}',
         auth_sync_disabled: '跨节点 auth 同步未启用。',
+        auth_sync_validation_busy: '正在验证跨节点 auth，并临时重启 Codex app-server。请稍等片刻后再发送这条消息。',
         auth_sync_test_sent: 'auth sync 测试完成：已发送 {sent}，收到回应 {replied}。',
         auth_sync_test_missing: '未回应：{value}',
         auth_sync_push_blocked_active: '当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。',
@@ -934,6 +955,8 @@ const MESSAGES = {
         button_auth_filter_all: '全部',
         button_auth_filter_enabled: '已启用',
         button_auth_filter_attention: '需关注',
+        button_config_auth_auto_delete_on: '开启自动剔除',
+        button_config_auth_auto_delete_off: '关闭自动剔除',
         another_turn_running: '已经有一个回复在进行中。请先等待，或使用 /interrupt、/takeover、/queue。',
         working: '处理中...',
         usage_open: '用法：/open <编号>',
@@ -1264,6 +1287,11 @@ const MESSAGES = {
         features_empty: '没有找到功能开关。',
         config_title: '配置摘要',
         config_layers: '配置层数：{count}',
+        config_foxclaw_title: 'FoxClaw 运行时配置',
+        config_auth_auto_delete_needs_repair: '自动剔除无法恢复的 auth 候选：{value}',
+        config_auth_auto_delete_updated: '自动剔除无法恢复的 auth 候选已设置为：{value}',
+        config_auth_auto_delete_usage: '用法：/config auth_auto_delete <on|off>',
+        config_env_update_failed: '运行时设置已改变，但更新 {value} 失败：{error}',
         requirements_title: '配置要求',
         requirements_empty: '当前没有配置要求。',
         provider_title: '模型供应商能力',

package/dist/main.js

@@ -253,7 +253,9 @@ async function runServeCli() {
                 label: runtime.bot.username ? `@${runtime.bot.username}` : runtime.id,
                 authDir: runtime.authDir,
                 validate: async (context) => validateRefreshedAuthCandidate(runtime, context.candidateName),
-                notify: createAuthMirrorNotifier(store, runtime.id, runtime.bot, authNotificationAggregator),
+                notify: createAuthMirrorNotifier(store, runtime.id, runtime.bot, authNotificationAggregator, {
+                    quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
+                }),
             })), logger, path.join(APP_HOME, 'runtime', 'auth-mirror.json'), {
                 onSynced: async (event) => {
                     await authSync?.publishCandidate(event.record.candidateName);
@@ -324,7 +326,10 @@ async function runServeCli() {
                 canSelfUpdate: () => authSyncLocalIdle()
                     && (authSync ? authSync.isIdle() : localAuthRefreshLease.isIdle()),
                 authCandidateUpdated: (runtimeId, candidateName) => mirror.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined),
-                authCandidateDeleted: (_runtimeId, candidateName) => mirror.deleteCandidate(candidateName).then(() => undefined),
+                authCandidateDeleted: async (_runtimeId, candidateName, reason = null) => {
+                    await mirror.deleteCandidate(candidateName);
+                    await authSync?.publishCandidateDeletion(candidateName, reason);
+                },
                 recoverAuthCandidate: async (runtimeId, candidateName, options = {}) => {
                     const local = await mirror.recoverRuntimeCandidate(runtimeId, candidateName);
                     if (local)
@@ -424,8 +429,22 @@ async function runServeCli() {
                         return runtime.core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
                     },
                     importCandidate: (candidateName, raw, source) => mirror.importExternalCandidate(candidateName, raw, source),
+                    deleteLocalCandidate: async (candidateName, source) => {
+                        if (!authSyncLocalIdle()) {
+                            return { ok: false, deleted: false, reason: 'runtime is not idle' };
+                        }
+                        await mirror.deleteCandidate(candidateName);
+                        store.deleteCodexAuthCandidate(candidateName);
+                        await Promise.all(runtimes.map(runtime => runtime.core.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null)));
+                        if (activeWeixinCore) {
+                            await activeWeixinCore.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null);
+                        }
+                        return { ok: true, deleted: true, reason: source.reason ?? null };
+                    },
                     isIdle: authSyncLocalIdle,
-                    notify: createAuthSyncNotifier(store, authSyncTransportBot.bot, authNotificationAggregator),
+                    notify: createAuthSyncNotifier(store, authSyncTransportBot.bot, authNotificationAggregator, {
+                        quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
+                    }),
                 });
                 await authSync.initialize();
                 activeAuthSync = authSync;
@@ -494,7 +513,10 @@ async function runServeCli() {
             canSelfUpdate: () => singleAuthSyncLocalIdle()
                 && (singleAuthSync ? singleAuthSync.isIdle() : singleLocalAuthRefreshLease.isIdle()),
             authCandidateUpdated: (runtimeId, candidateName) => singleMirror?.syncRuntimeCandidate(runtimeId, candidateName).then(() => undefined) ?? Promise.resolve(),
-            authCandidateDeleted: (_runtimeId, candidateName) => singleMirror?.deleteCandidate(candidateName).then(() => undefined) ?? Promise.resolve(),
+            authCandidateDeleted: async (_runtimeId, candidateName, reason = null) => {
+                await singleMirror?.deleteCandidate(candidateName);
+                await singleAuthSync?.publishCandidateDeletion(candidateName, reason);
+            },
             recoverAuthCandidate: async (runtimeId, candidateName, options = {}) => {
                 const local = await singleMirror?.recoverRuntimeCandidate(runtimeId, candidateName) ?? null;
                 if (local)
@@ -570,8 +592,19 @@ async function runServeCli() {
                     return core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
                 },
                 importCandidate: (candidateName, raw, source) => singleMirror.importExternalCandidate(candidateName, raw, source),
+                deleteLocalCandidate: async (candidateName, source) => {
+                    if (!singleAuthSyncLocalIdle()) {
+                        return { ok: false, deleted: false, reason: 'runtime is not idle' };
+                    }
+                    await singleMirror.deleteCandidate(candidateName);
+                    store.deleteCodexAuthCandidate(candidateName);
+                    await core.handleExternalCodexAuthCandidateDeleted(candidateName, source.reason ?? null);
+                    return { ok: true, deleted: true, reason: source.reason ?? null };
+                },
                 isIdle: singleAuthSyncLocalIdle,
-                notify: createAuthSyncNotifier(store, bot, authNotificationAggregator),
+                notify: createAuthSyncNotifier(store, bot, authNotificationAggregator, {
+                    quietAuthPoolMode: () => config.authAutoDeleteNeedsRepair,
+                }),
             });
             await singleAuthSync.initialize();
             activeAuthSync = singleAuthSync;
@@ -641,8 +674,10 @@ async function runServeCli() {
         throw error;
     }
 }
-function createAuthMirrorNotifier(store, botId, bot, aggregator) {
+function createAuthMirrorNotifier(store, botId, bot, aggregator, options = {}) {
     return async (event) => {
+        if (options.quietAuthPoolMode?.())
+            return;
         const privateScope = store.getTelegramPrivateScope(botId);
         if (!privateScope)
             return;
@@ -654,7 +689,27 @@ function createAuthMirrorNotifier(store, botId, bot, aggregator) {
         }, event);
     };
 }
-function createAuthSyncNotifier(store, bot, aggregator) {
+function createAuthSyncNotifier(store, bot, aggregator, options = {}) {
+    const poolSummaryQueues = new Map();
+    const enqueuePoolSummary = (destination) => {
+        const existing = poolSummaryQueues.get(destination.key);
+        if (existing) {
+            clearTimeout(existing.timer);
+        }
+        const timer = setTimeout(() => {
+            const queued = poolSummaryQueues.get(destination.key);
+            if (!queued)
+                return;
+            poolSummaryQueues.delete(destination.key);
+            void queued.sendMessage(formatAuthPoolSummary(queued.locale, store.getCodexAuthPoolStats())).catch(() => undefined);
+        }, 2_000);
+        timer.unref();
+        poolSummaryQueues.set(destination.key, {
+            locale: destination.locale,
+            sendMessage: destination.sendMessage,
+            timer,
+        });
+    };
     return async (event) => {
         if (!bot.identity)
             return;
@@ -667,6 +722,12 @@ function createAuthSyncNotifier(store, bot, aggregator) {
             locale,
             sendMessage: (text) => bot.sendMessage(privateScope.chatId, text),
         };
+        if (options.quietAuthPoolMode?.() && isQuietAuthPoolNotification(event)) {
+            if (shouldSendQuietAuthPoolSummary(event)) {
+                enqueuePoolSummary(destination);
+            }
+            return;
+        }
         if (aggregator.enqueueAuthSync(destination, event)) {
             return;
         }
@@ -676,6 +737,45 @@ function createAuthSyncNotifier(store, bot, aggregator) {
 function authNotificationDestinationKey(botId, chatId) {
     return `${botId}:${chatId}`;
 }
+function formatAuthPoolSummary(locale, stats) {
+    return locale === 'zh'
+        ? `auth 池：历史 ${stats.totalSeen}，存活 ${stats.alive}，因失效剔除 ${stats.deletedInvalid}。`
+        : `Auth pool: total seen ${stats.totalSeen}, alive ${stats.alive}, invalid-deleted ${stats.deletedInvalid}.`;
+}
+function isQuietAuthPoolNotification(event) {
+    switch (event.kind) {
+        case 'candidate_publish_started':
+        case 'candidate_publish_completed':
+        case 'push_all_started':
+        case 'push_all_completed':
+        case 'remote_bundle_received':
+        case 'remote_import_imported':
+        case 'remote_import_skipped':
+        case 'candidate_delete_sent':
+        case 'remote_delete_received':
+        case 'remote_delete_deleted':
+        case 'remote_delete_skipped':
+        case 'recovery_started':
+        case 'recovery_peer_empty':
+        case 'recovery_peer_bundle_received':
+        case 'recovery_failed':
+        case 'pull_request_received':
+        case 'pull_response_sent':
+            return true;
+        default:
+            return false;
+    }
+}
+function shouldSendQuietAuthPoolSummary(event) {
+    switch (event.kind) {
+        case 'candidate_delete_sent':
+        case 'remote_delete_deleted':
+        case 'remote_delete_skipped':
+            return true;
+        default:
+            return false;
+    }
+}
 function formatAuthSyncNotification(locale, event) {
     const peers = 'peers' in event ? formatPeerList(event.peers, locale) : '';
     if (locale === 'zh') {
@@ -704,6 +804,23 @@ function formatAuthSyncNotification(locale, event) {
                 return `${event.mode === 'pull' ? '跨节点拉取未改动本机文件' : '收到跨节点 auth 但未写盘'}：${event.candidateName}\n来源：${formatSource(event.sourceLabel, event.sourceNodeId)}\n原因：${event.reason}`;
             case 'remote_import_failed':
                 return `${event.mode === 'pull' ? '跨节点拉取导入失败' : '跨节点 auth 导入失败'}：${event.candidateName}\n来源：${formatSource(event.sourceLabel, event.sourceNodeId)}\n原因：${event.reason}\n需要注意：如果其他候选也无法恢复，请人工介入重新登录或刷新这个 auth。`;
+            case 'candidate_delete_sent':
+                return `跨节点 auth 删除已发出：${event.candidateName}\nPeer：${peers}${event.reason ? `\n原因：${event.reason}` : ''}`;
+            case 'candidate_delete_failed':
+                return `跨节点 auth 删除发送失败：${event.candidateName}\nPeer：${peers}\n原因：${event.reason}`;
+            case 'remote_delete_received':
+                return [
+                    `收到跨节点 auth 删除：${event.candidateName}`,
+                    `来源：${formatSource(event.sourceLabel, event.sourceNodeId)}，peer ${event.peer}`,
+                    `处理：${event.queued ? `本机忙，已排队等待空闲后删除；当前待删除 ${event.queueLength}` : '本机空闲，正在删除同名候选'}`,
+                    event.reason ? `原因：${event.reason}` : null,
+                ].filter(Boolean).join('\n');
+            case 'remote_delete_deleted':
+                return `已执行跨节点 auth 删除：${event.candidateName}\n来源：${formatSource(event.sourceLabel, event.sourceNodeId)}${event.reason ? `\n原因：${event.reason}` : ''}`;
+            case 'remote_delete_skipped':
+                return `跨节点 auth 删除未改动本机文件：${event.candidateName}\n来源：${formatSource(event.sourceLabel, event.sourceNodeId)}\n原因：${event.reason}`;
+            case 'remote_delete_failed':
+                return `跨节点 auth 删除失败：${event.candidateName}\n来源：${formatSource(event.sourceLabel, event.sourceNodeId)}\n原因：${event.reason}`;
             case 'recovery_started':
                 return `auth 恢复开始：${event.candidateName}\nRequest：${event.requestId}\n处理：同节点没有可用较新副本，正在向跨节点 peer 查询：${peers}，最长等待 ${event.timeoutMs}ms`;
             case 'recovery_peer_empty':
@@ -753,6 +870,23 @@ function formatAuthSyncNotification(locale, event) {
             return `${event.mode === 'pull' ? 'Cross-node pull did not change local files' : 'Received cross-node auth but did not write it'}: ${event.candidateName}\nSource: ${formatSource(event.sourceLabel, event.sourceNodeId)}\nReason: ${event.reason}`;
         case 'remote_import_failed':
             return `${event.mode === 'pull' ? 'Cross-node pull import failed' : 'Cross-node auth import failed'}: ${event.candidateName}\nSource: ${formatSource(event.sourceLabel, event.sourceNodeId)}\nReason: ${event.reason}\nAttention: if no other candidate can recover this account, run device login or refresh this auth manually.`;
+        case 'candidate_delete_sent':
+            return `Cross-node auth delete sent: ${event.candidateName}\nPeers: ${peers}${event.reason ? `\nReason: ${event.reason}` : ''}`;
+        case 'candidate_delete_failed':
+            return `Cross-node auth delete send failed: ${event.candidateName}\nPeers: ${peers}\nReason: ${event.reason}`;
+        case 'remote_delete_received':
+            return [
+                `Received cross-node auth delete: ${event.candidateName}`,
+                `Source: ${formatSource(event.sourceLabel, event.sourceNodeId)}, peer ${event.peer}`,
+                `Action: ${event.queued ? `queued until this node is idle; pending deletes ${event.queueLength}` : 'deleting the matching local candidate'}`,
+                event.reason ? `Reason: ${event.reason}` : null,
+            ].filter(Boolean).join('\n');
+        case 'remote_delete_deleted':
+            return `Applied cross-node auth delete: ${event.candidateName}\nSource: ${formatSource(event.sourceLabel, event.sourceNodeId)}${event.reason ? `\nReason: ${event.reason}` : ''}`;
+        case 'remote_delete_skipped':
+            return `Cross-node auth delete did not change local files: ${event.candidateName}\nSource: ${formatSource(event.sourceLabel, event.sourceNodeId)}\nReason: ${event.reason}`;
+        case 'remote_delete_failed':
+            return `Cross-node auth delete failed: ${event.candidateName}\nSource: ${formatSource(event.sourceLabel, event.sourceNodeId)}\nReason: ${event.reason}`;
         case 'recovery_started':
             return `Auth recovery started: ${event.candidateName}\nRequest: ${event.requestId}\nAction: no newer same-node copy was available; querying cross-node peers: ${peers}; timeout ${event.timeoutMs}ms`;
         case 'recovery_peer_empty':

package/dist/store/database.d.ts

@@ -38,6 +38,11 @@ export interface CodexAuthQuotaSnapshotRecord {
     secondaryRemainingPercent: number | null;
     updatedAt: number;
 }
+export interface CodexAuthPoolStats {
+    totalSeen: number;
+    alive: number;
+    deletedInvalid: number;
+}
 export type CodexAuthCandidateState = 'active' | 'needs_repair';
 export declare class BridgeStore {
     private db;
@@ -125,6 +130,10 @@ export declare class BridgeStore {
     setCodexAuthCandidateDisabled(name: string, disabled: boolean, runtimeId?: string): void;
     setCodexAuthCandidateState(name: string, state: CodexAuthCandidateState, runtimeId?: string): void;
     deleteCodexAuthCandidate(name: string): void;
+    recordCodexAuthPoolInventory(names: string[]): void;
+    recordCodexAuthCandidateInvalidDelete(name: string, reason?: string | null): void;
+    recordCodexAuthCandidateRemoved(name: string, reason?: string | null): void;
+    getCodexAuthPoolStats(): CodexAuthPoolStats;
     setCodexAuthQuotaSnapshot(runtimeId: string, candidateName: string, accountId: string, quotaIdentityId: string, snapshot: Pick<CodexAuthQuotaSnapshotRecord, 'capturedAtMs' | 'planType' | 'primaryWindowDurationMins' | 'primaryRemainingPercent' | 'secondaryWindowDurationMins' | 'secondaryRemainingPercent'>): void;
     listCodexAuthQuotaSnapshots(quotaIdentityIds: string[]): CodexAuthQuotaSnapshotRecord[];
     private ensureColumn;

package/dist/store/database.js

@@ -197,6 +197,14 @@ export class BridgeStore {
       );
       CREATE INDEX IF NOT EXISTS codex_auth_quota_snapshots_account_idx
         ON codex_auth_quota_snapshots(account_id);
+      CREATE TABLE IF NOT EXISTS codex_auth_pool_history (
+        name TEXT PRIMARY KEY,
+        first_seen_at INTEGER NOT NULL,
+        last_seen_at INTEGER NOT NULL,
+        deleted_at INTEGER,
+        delete_reason TEXT,
+        invalid_delete_count INTEGER NOT NULL DEFAULT 0
+      );
     `);
         this.ensureColumn('thread_cache', 'name', 'TEXT');
         this.ensureColumn('thread_cache', 'model_provider', 'TEXT');
@@ -217,6 +225,7 @@ export class BridgeStore {
         this.ensureColumn('codex_auth_quota_snapshots', 'primary_window_duration_mins', 'REAL');
         this.ensureColumn('codex_auth_quota_snapshots', 'secondary_window_duration_mins', 'REAL');
         this.ensureColumn('codex_auth_quota_snapshots', 'quota_identity_id', "TEXT NOT NULL DEFAULT ''");
+        this.ensureColumn('codex_auth_pool_history', 'invalid_delete_count', 'INTEGER NOT NULL DEFAULT 0');
         this.db.prepare(`
       UPDATE codex_auth_quota_snapshots
       SET quota_identity_id = account_id
@@ -896,6 +905,84 @@ export class BridgeStore {
         this.db.prepare('DELETE FROM codex_auth_candidate_runtime WHERE name = ?').run(name);
         this.db.prepare('DELETE FROM codex_auth_quota_snapshots WHERE candidate_name = ?').run(name);
     }
+    recordCodexAuthPoolInventory(names) {
+        if (names.length === 0) {
+            return;
+        }
+        const now = Date.now();
+        const upsert = this.db.prepare(`
+      INSERT INTO codex_auth_pool_history (name, first_seen_at, last_seen_at, deleted_at, delete_reason, invalid_delete_count)
+      VALUES (?, ?, ?, NULL, NULL, 0)
+      ON CONFLICT(name) DO UPDATE SET
+        last_seen_at = excluded.last_seen_at,
+        deleted_at = NULL,
+        delete_reason = NULL
+    `);
+        const seen = new Set(names);
+        this.db.exec('BEGIN');
+        try {
+            for (const name of seen) {
+                upsert.run(name, now, now);
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    recordCodexAuthCandidateInvalidDelete(name, reason = null) {
+        const now = Date.now();
+        this.db.prepare(`
+      INSERT INTO codex_auth_pool_history (
+        name,
+        first_seen_at,
+        last_seen_at,
+        deleted_at,
+        delete_reason,
+        invalid_delete_count
+      )
+      VALUES (?, ?, ?, ?, ?, 1)
+      ON CONFLICT(name) DO UPDATE SET
+        last_seen_at = excluded.last_seen_at,
+        deleted_at = excluded.deleted_at,
+        delete_reason = excluded.delete_reason,
+        invalid_delete_count = codex_auth_pool_history.invalid_delete_count
+          + CASE WHEN codex_auth_pool_history.deleted_at IS NULL THEN 1 ELSE 0 END
+    `).run(name, now, now, now, reason);
+    }
+    recordCodexAuthCandidateRemoved(name, reason = null) {
+        const now = Date.now();
+        this.db.prepare(`
+      INSERT INTO codex_auth_pool_history (
+        name,
+        first_seen_at,
+        last_seen_at,
+        deleted_at,
+        delete_reason,
+        invalid_delete_count
+      )
+      VALUES (?, ?, ?, ?, ?, 0)
+      ON CONFLICT(name) DO UPDATE SET
+        last_seen_at = excluded.last_seen_at,
+        deleted_at = excluded.deleted_at,
+        delete_reason = excluded.delete_reason
+    `).run(name, now, now, now, reason);
+    }
+    getCodexAuthPoolStats() {
+        const row = this.db.prepare(`
+      SELECT
+        COUNT(*) AS total_seen,
+        COALESCE(SUM(CASE WHEN deleted_at IS NULL THEN 1 ELSE 0 END), 0) AS alive,
+        COALESCE(SUM(invalid_delete_count), 0) AS deleted_invalid
+      FROM codex_auth_pool_history
+    `).get();
+        return {
+            totalSeen: Number(row?.total_seen ?? 0),
+            alive: Number(row?.alive ?? 0),
+            deletedInvalid: Number(row?.deleted_invalid ?? 0),
+        };
+    }
     setCodexAuthQuotaSnapshot(runtimeId, candidateName, accountId, quotaIdentityId, snapshot) {
         this.db.prepare(`
       INSERT INTO codex_auth_quota_snapshots (

package/docs/cross-node-auth-sync.md

@@ -92,6 +92,7 @@ AUTH_SYNC_KEY=<shared key with at least 32 bytes>
 AUTH_SYNC_CLUSTER_ID=my-codex-auth-pool
 AUTH_SYNC_NODE_ID=workstation-a
 AUTH_SYNC_PEERS=@foxclaw_node_b_bot
+AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 ```
 
 Node B:
@@ -103,6 +104,7 @@ AUTH_SYNC_KEY=<shared key with at least 32 bytes>
 AUTH_SYNC_CLUSTER_ID=my-codex-auth-pool
 AUTH_SYNC_NODE_ID=workstation-b
 AUTH_SYNC_PEERS=@foxclaw_node_a_bot
+AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 ```
 
 For more peers, separate bot usernames with commas:
@@ -166,7 +168,9 @@ Confirm that pending imports were processed, or that the candidate exists or has
 
 Note: `/auth sync push all` saying “sent” only means this node successfully handed encrypted packages to Telegram. It does not prove the peer wrote files. The peer imports only when it is globally idle, usage validation succeeds, same-name candidates belong to the same account id and compatible ChatGPT user/email identity, and the remote `last_refresh` is newer than the local copy. If the local file is already equal or newer, it will not change and `Last import` may remain empty.
 
-When cross-node sync is enabled, the contact bot private chat receives node-level notifications: local auth updates and the peers being contacted, received remote bundles and whether they were queued or immediately validated, import success/skip/failure reasons, recovery peer queries and peer replies, and a manual-intervention notice when every peer lacks an importable copy. Refresh/send/import bursts are grouped into short summaries so one candidate update does not produce separate start, receive, mirror-write, and completion messages. Recovery and manual-intervention notices remain explicit. Notifications never include auth contents, tokens, or encrypted bundle payloads.
+When cross-node sync is enabled, the contact bot private chat receives node-level notifications: local auth updates and the peers being contacted, received remote bundles and whether they were queued or immediately validated, import success/skip/failure reasons, recovery peer queries and peer replies, and a manual-intervention notice when every peer lacks an importable copy. Refresh/send/import bursts are grouped into short summaries so one candidate update does not produce separate start, receive, mirror-write, and completion messages. Recovery and manual-intervention notices remain explicit. Remote import validation temporarily restarts the local Codex app-server; during that restart window FoxClaw treats the runtime as non-idle and asks ordinary messages to be resent shortly instead of running them against a restarting bridge. Notifications never include auth contents, tokens, or encrypted bundle payloads.
+
+For a resource-rich pool where individual candidate maintenance is not important, enable `AUTH_AUTO_DELETE_NEEDS_REPAIR=true` or toggle it with `/config auth_auto_delete on`. Candidates that cannot be recovered and would otherwise be marked for repair are deleted locally, a delete tombstone is sent to peers, and candidate-level sync/delete chatter is collapsed into an auth-pool summary.
 
 Starting in 0.5.2, `/auth sync status` separates sync-system `Last error` from per-auth `Candidate failures`. For example, a remote candidate that returns `token_invalidated` or has an expired access token is recorded under that candidate name only; current `auth.json` health is still determined by validating the current auth usage. `local candidate is already newer or equal` is a normal skip, not an error.