@foxden-app/foxclaw 0.5.71 → 0.5.72

package/.env.example

@@ -68,6 +68,7 @@ CODEX_CLI_BIN=/absolute/path/to/codex
 # put the node's contact token first and list peer contact @usernames below.
 # AUTH_SYNC_ENABLED=true
 # AUTH_SYNC_KEY=<shared-key-with-at-least-32-bytes>
+# Imported remote auth is not relayed; list every contact bot that must receive this node's auth directly.
 # AUTH_SYNC_PEERS=@other_node_bot,@third_node_bot
 # AUTH_SYNC_CLUSTER_ID=my-codex-auth-pool
 # AUTH_SYNC_NODE_ID=

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.5.72 - 2026-07-11
+
+### 中文
+- 完整适配 pnpm 11 隔离全局包布局：升级后从 pnpm 生成的 `foxclaw` shim 读取 `global/v11/<instance>/node_modules/.../dist/main.js` 真实入口，不再把 `pnpm root -g` 误当成包目录。
+- pnpm 管理的 FoxClaw 自更新现在按现有安装布局固定 pnpm major，避免 pnpm 10 安装误选 `PNPM_HOME/bin` 中的 pnpm 11；本次更新显式设置 `minimumReleaseAge=0`，确保刚发布的 `@latest` 不会被 pnpm 11 默认 24 小时发布年龄策略回退到旧版。
+
+### English
+- Fully supports pnpm 11's isolated global package layout. After installation, FoxClaw reads the real `global/v11/<instance>/node_modules/.../dist/main.js` target from pnpm's generated CLI shim instead of treating `pnpm root -g` as the package directory.
+- Self-update now pins the pnpm major to the existing installation layout, preventing a pnpm 10 installation from selecting pnpm 11 under `PNPM_HOME/bin`. The update also sets `minimumReleaseAge=0` so pnpm 11's default 24-hour release-age policy does not resolve `@latest` to an older FoxClaw release.
+
 ## 0.5.71 - 2026-07-11
 
 ### 中文

package/dist/update.d.ts

@@ -87,5 +87,6 @@ export declare function readPendingClusterUpdateBroadcast(filePath: string): Pen
 export declare function writePendingClusterUpdateBroadcast(filePath: string, value: PendingClusterUpdateBroadcast): void;
 export declare function clearPendingClusterUpdateBroadcast(filePath: string): void;
 export declare function resolveFoxclawEntryPointFromGlobalRoot(globalRoot: string, exists?: (target: string) => boolean): string | null;
+export declare function resolveFoxclawEntryPointFromPnpmHome(pnpmHome: string, exists?: (target: string) => boolean, readText?: (target: string) => string): string | null;
 export declare function extractReleaseNotes(changelog: string, version: string, locale: AppLocale): string[] | null;
 export {};

package/dist/update.js

@@ -13,7 +13,9 @@ export function inferPnpmHomeFromEntryPoint(entryPoint) {
     const normalizedEntryPoint = entryPoint.replace(/\\/g, '/');
     const globalMarker = '/global/';
     const globalIndex = normalizedEntryPoint.indexOf(globalMarker);
-    if (globalIndex <= 0 || !normalizedEntryPoint.includes('/.pnpm/')) {
+    const pnpm10Layout = normalizedEntryPoint.includes('/.pnpm/');
+    const pnpm11Layout = /\/global\/v\d+\/[^/]+\/node_modules\/@foxden-app\/foxclaw\//.test(normalizedEntryPoint);
+    if (globalIndex <= 0 || (!pnpm10Layout && !pnpm11Layout)) {
         return null;
     }
     return normalizedEntryPoint.slice(0, globalIndex);
@@ -32,23 +34,6 @@ export function inferPnpmFallbackPackageFromEntryPoint(entryPoint) {
 export function resolveSelfUpdateInstaller(entryPoint, nodePath = process.execPath, exists = fs.existsSync, env = process.env) {
     const pnpmHome = inferPnpmHomeFromEntryPoint(entryPoint);
     if (pnpmHome) {
-        const commandName = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm';
-        const candidates = executableCandidates(commandName, nodePath, env, [
-            path.join(pnpmHome, commandName),
-            path.join(pnpmHome, 'bin', commandName),
-            env.PNPM_HOME?.trim() ? path.join(env.PNPM_HOME.trim(), commandName) : '',
-            env.PNPM_HOME?.trim() ? path.join(env.PNPM_HOME.trim(), 'bin', commandName) : '',
-        ]);
-        const pnpmCommand = candidates.find((candidate) => exists(candidate));
-        if (pnpmCommand) {
-            return {
-                manager: 'pnpm',
-                command: pnpmCommand,
-                installArgs: ['add', '--global', PACKAGE_SPEC],
-                rootArgs: ['root', '--global'],
-                pnpmHome,
-            };
-        }
         const npmCommandName = process.platform === 'win32' ? 'npm.cmd' : 'npm';
         const npmCommand = executableCandidates(npmCommandName, nodePath, env)
             .find((candidate) => exists(candidate)) ?? npmCommandName;
@@ -56,8 +41,8 @@ export function resolveSelfUpdateInstaller(entryPoint, nodePath = process.execPa
         return {
             manager: 'pnpm',
             command: npmCommand,
-            installArgs: ['exec', '--yes', `--package=${fallbackPackage}`, '--', 'pnpm', 'add', '--global', PACKAGE_SPEC],
-            rootArgs: ['exec', '--yes', `--package=${fallbackPackage}`, '--', 'pnpm', 'root', '--global'],
+            installArgs: ['exec', '--yes', `--package=${fallbackPackage}`, '--', 'pnpm', '--config.minimum-release-age=0', 'add', '--global', PACKAGE_SPEC],
+            rootArgs: ['exec', '--yes', `--package=${fallbackPackage}`, '--', 'pnpm', '--config.minimum-release-age=0', 'root', '--global'],
             pnpmHome,
         };
     }
@@ -493,6 +478,29 @@ export function resolveFoxclawEntryPointFromGlobalRoot(globalRoot, exists = fs.e
     ];
     return candidates.find(candidate => exists(candidate)) ?? null;
 }
+export function resolveFoxclawEntryPointFromPnpmHome(pnpmHome, exists = fs.existsSync, readText = (target) => fs.readFileSync(target, 'utf8')) {
+    const shimCandidates = [
+        path.join(pnpmHome, process.platform === 'win32' ? 'foxclaw.cmd' : 'foxclaw'),
+        path.join(pnpmHome, 'bin', process.platform === 'win32' ? 'foxclaw.cmd' : 'foxclaw'),
+    ];
+    for (const shim of shimCandidates) {
+        if (!exists(shim))
+            continue;
+        let contents = '';
+        try {
+            contents = readText(shim);
+        }
+        catch {
+            continue;
+        }
+        const matches = contents.match(/(?:[A-Za-z]:[\\/]|\/)[^\r\n"']*?[\\/]node_modules[\\/]@foxden-app[\\/]foxclaw[\\/]dist[\\/]main\.js/g);
+        const entryPoint = matches?.at(-1) ?? null;
+        if (entryPoint && exists(entryPoint)) {
+            return entryPoint;
+        }
+    }
+    return null;
+}
 function resolveUpdatedEntryPoint(installer, env) {
     const result = spawnSync(installer.command, installer.rootArgs, { encoding: 'utf8', env });
     if (result.error) {
@@ -505,7 +513,10 @@ function resolveUpdatedEntryPoint(installer, env) {
     if (!globalRoot) {
         throw new Error(`Could not locate the updated global package root using ${installer.manager}.`);
     }
-    const updatedEntryPoint = resolveFoxclawEntryPointFromGlobalRoot(globalRoot);
+    const updatedEntryPoint = (installer.pnpmHome
+        ? resolveFoxclawEntryPointFromPnpmHome(installer.pnpmHome)
+        : null)
+        ?? resolveFoxclawEntryPointFromGlobalRoot(globalRoot);
     if (!updatedEntryPoint) {
         throw new Error(`Updated FoxClaw entry point was not found below ${globalRoot} (checked direct and node_modules layouts).`);
     }

package/docs/cross-node-auth-sync.md

@@ -113,6 +113,8 @@ For more peers, separate bot usernames with commas:
 AUTH_SYNC_PEERS=@foxclaw_node_a_bot,@foxclaw_node_b_bot,@foxclaw_node_c_bot
 ```
 
+Auth imported from a remote peer is not automatically forwarded to other peers, which prevents synchronization loops. A star topology therefore guarantees only direct leaf-to-hub synchronization. If auth newly produced on any leaf must reach every node, every contact bot must list all other contact bots in `AUTH_SYNC_PEERS`, with matching reciprocal allowlists on those peers.
+
 Generate a shared key with a password manager or `openssl`:
 
 ```bash

package/docs/zh/cross-node-auth-sync.md

@@ -113,6 +113,8 @@ AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 AUTH_SYNC_PEERS=@foxclaw_node_a_bot,@foxclaw_node_b_bot,@foxclaw_node_c_bot
 ```
 
+远端导入的 auth 不会再次自动转发给本节点的其他 peer，以避免同步环路。因此星形拓扑只保证每个叶子与中心节点直接互通；如果任意叶子节点产生的新 auth 都要到达所有节点，每个联系人 bot 都必须把其他联系人 bot 列入 `AUTH_SYNC_PEERS`，并在对端做对称 allowlist 配置。
+
 建议用密码管理器或 `openssl` 生成共享密钥：
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.5.71",
+  "version": "0.5.72",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",