@foxden-app/foxclaw 0.5.74 → 0.5.77

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.5.77 - 2026-07-11
+
+### 中文
+- 修复跨节点升级广播触发的后台升级完成后，旧服务把内部 `cluster:*` scope 当成 Telegram scope 解析并反复记录 `Expected telegram: scope` 的问题。集群升级现在只记录完成状态并清理轮询文件，不再尝试向不存在的聊天发送回报。
+
+### English
+- Fixed cluster-broadcast updates repeatedly logging `Expected telegram: scope` after completion because the old service tried to parse the internal `cluster:*` scope as a Telegram destination. Cluster updates now record completion and clear the poll state without trying to send a chat reply to a non-chat scope.
+
+## 0.5.76 - 2026-07-11
+
+### 中文
+- `/auth` 面板新增“全节点自检并同步”按钮，命令等价入口为 `/auth sync audit`。发起节点会申请跨节点刷新锁，通知所有已配置 peer 逐个通过 Codex usage 接口验证 auth，并在同一轮中汇总节点、有效候选、无效候选、未回应、忙碌和身份冲突状态。
+- 集群审计会在同名、同 account、同 ChatGPT 用户身份范围内采用最新且验证有效的副本，并分发给所有 peer。完整审计确认较新的副本无效时，允许经过验证的较旧有效副本替换它；任一节点未回应或忙碌时仍坚持普通的只接受更新副本规则。
+- 只有所有 peer 都回应、没有任何有效副本，并且至少两个节点独立确认无效时，才会把候选统一标记为 `?` 等待人工处理；有效副本导入后会恢复 active 状态并清除旧失败记录。
+- 临期主动刷新阈值由 9 天统一为 `last_refresh` 已满 8 天。集群自检完整结束后，由主动发起的 bot 刷新符合条件的已启用 ChatGPT auth，再向所有 peer 分发；同一节点的 canonical 和各 Codex home 副本都会参与检查，避免漏掉本机仍有效的旧副本。
+
+### English
+- Added **Check all nodes and reconcile auth** to the `/auth` panel, with `/auth sync audit` as the command equivalent. The initiating node acquires the cross-node refresh lease, asks every configured peer to validate each auth through the Codex usage endpoint, and summarizes responding, missing, busy, valid, invalid, and identity-conflicting states in one run.
+- Cluster audit selects the newest validated copy among same-name candidates with matching account and ChatGPT user identity, then distributes it to every peer. A validated older copy may replace a newer invalid copy only after a complete audit; missing or busy peers keep normal newer-only import semantics.
+- A candidate is marked `?` only when every peer responds, no valid copy exists, and at least two nodes independently confirm it invalid. Importing a valid copy restores the active state and clears stale failure records.
+- Unified proactive maintenance at `last_refresh` age 8 days instead of 9. After a complete audit, the initiating bot refreshes eligible enabled ChatGPT auth and distributes the result. Audits inspect canonical and per-Codex-home copies on each node so an older but still valid local copy is not overlooked.
+
 ## 0.5.74 - 2026-07-11
 
 ### 中文

package/dist/auth/cross_node_sync.d.ts

@@ -62,6 +62,19 @@ export interface AuthSyncValidationResult {
     ok: boolean;
     reason?: string | null;
 }
+export interface AuthSyncClusterAuditResult {
+    requestId: string;
+    nodesExpected: number;
+    nodesResponded: number;
+    missingPeers: string[];
+    busyNodes: string[];
+    checkedCandidates: number;
+    validCandidates: number;
+    invalidCandidates: number;
+    synchronizedCandidates: string[];
+    consensusInvalidCandidates: string[];
+    identityConflicts: string[];
+}
 export type AuthSyncRemoteImportMode = 'push' | 'pull';
 export type AuthSyncPullResponseResult = 'sent' | 'candidate_not_found' | 'account_mismatch' | 'not_newer';
 export type AuthSyncNotification = {
@@ -219,11 +232,18 @@ export type AuthSyncNotification = {
 export interface AuthSyncImportCallbacks {
     readLocalCandidate: (candidateName: string) => Promise<AuthMirrorCandidateRecord | null>;
     listLocalCandidates: () => Promise<AuthMirrorCandidateRecord[]>;
+    listLocalCandidateCopies?: () => Promise<AuthMirrorCandidateRecord[]>;
     validateCandidate: (candidateName: string, raw: string, expectedAccountId: string) => Promise<AuthSyncValidationResult>;
     importCandidate: (candidateName: string, raw: string, source: {
         nodeId: string;
         label?: string | null;
+        replaceExisting?: boolean;
     }) => Promise<AuthMirrorImportResult>;
+    markCandidateState?: (candidateName: string, state: 'active' | 'needs_repair', expected: {
+        accountId: string;
+        quotaIdentityId: string | null;
+        maxLastRefreshMs: number;
+    }) => Promise<boolean>;
     deleteLocalCandidate?: (candidateName: string, source: {
         nodeId: string;
         label?: string | null;
@@ -278,6 +298,7 @@ export declare class CrossNodeAuthSync {
     private readonly pendingPulls;
     private readonly pendingLeases;
     private readonly pendingTests;
+    private readonly pendingAudits;
     private seenNonces;
     private lastPeerActivityAt;
     private timer;
@@ -308,12 +329,20 @@ export declare class CrossNodeAuthSync {
     acquireRefreshLease(reason: string): Promise<AuthSyncLeaseResult>;
     releaseRefreshLease(leaseId: string | null): Promise<void>;
     testPeers(): Promise<AuthSyncTestResult>;
+    auditCluster(): Promise<AuthSyncClusterAuditResult>;
     publishServiceUpdateRequest(targetVersion: string | null): Promise<{
         sent: number;
         peers: string[];
     }>;
     handleIncomingEnvelope(rawEnvelope: string, peer: AuthSyncPeerIdentity): Promise<boolean>;
     private handleMessage;
+    private handleAuditRequest;
+    private handleAuditResponse;
+    private handleAuditApply;
+    private applyAuditState;
+    private buildAuditReport;
+    private reconcileAuditReports;
+    private finishPendingAudit;
     private handleServiceUpdateRequest;
     private handlePullRequest;
     private handlePullResponse;

package/dist/auth/cross_node_sync.js

@@ -7,6 +7,7 @@ const ENVELOPE_MAGIC = 'foxclaw-auth-sync';
 const NONCE_RETENTION_MS = 7 * 24 * 60 * 60_000;
 const PULL_TIMEOUT_MS = 12_000;
 const TEST_TIMEOUT_MS = 8_000;
+const AUDIT_TIMEOUT_MS = 5 * 60_000;
 const LEASE_TIMEOUT_MS = 8_000;
 const LEASE_TTL_MS = 10 * 60_000;
 const REMOTE_ACCESS_TOKEN_MIN_TTL_MS = 60_000;
@@ -25,6 +26,7 @@ export class CrossNodeAuthSync {
     pendingPulls = new Map();
     pendingLeases = new Map();
     pendingTests = new Map();
+    pendingAudits = new Map();
     seenNonces = new Map();
     lastPeerActivityAt = new Map();
     timer = null;
@@ -132,6 +134,7 @@ export class CrossNodeAuthSync {
             && this.pendingPulls.size === 0
             && this.pendingLeases.size === 0
             && this.pendingTests.size === 0
+            && this.pendingAudits.size === 0
             && this.activeLocalLease === null
             && this.activeRemoteLease === null;
     }
@@ -475,6 +478,63 @@ export class CrossNodeAuthSync {
         }
         return resultPromise;
     }
+    async auditCluster() {
+        const requestId = crypto.randomUUID();
+        const peers = [...this.peers];
+        const localReportPromise = this.buildAuditReport();
+        const remoteReportsPromise = new Promise((resolve) => {
+            if (!this.isReady() || peers.length === 0) {
+                resolve({ reports: new Map(), missing: [] });
+                return;
+            }
+            const timer = setTimeout(() => this.finishPendingAudit(requestId), AUDIT_TIMEOUT_MS);
+            timer.unref();
+            this.pendingAudits.set(requestId, {
+                peers,
+                reports: new Map(),
+                resolve,
+                timer,
+                finished: false,
+            });
+        });
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.request',
+            stage: 'started',
+            peer: null,
+            requestId,
+            candidateName: null,
+            detail: `peers=${peers.join(', ') || 'none'}`,
+        });
+        if (this.isReady() && peers.length > 0) {
+            try {
+                await this.sendToAll({ kind: 'audit.request', requestId, requestedAt: new Date().toISOString() });
+            }
+            catch (error) {
+                const pending = this.pendingAudits.get(requestId);
+                if (pending) {
+                    clearTimeout(pending.timer);
+                    this.pendingAudits.delete(requestId);
+                    pending.finished = true;
+                    pending.resolve({ reports: pending.reports, missing: pending.peers.filter(peer => !pending.reports.has(peer)) });
+                }
+                throw error;
+            }
+        }
+        const [localReport, remote] = await Promise.all([localReportPromise, remoteReportsPromise]);
+        const reports = [localReport, ...remote.reports.values()];
+        const result = await this.reconcileAuditReports(requestId, reports, remote.missing);
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.request',
+            stage: 'completed',
+            peer: null,
+            requestId,
+            candidateName: null,
+            detail: `responded=${result.nodesResponded}/${result.nodesExpected}; synchronized=${result.synchronizedCandidates.length}; repair=${result.consensusInvalidCandidates.length}`,
+        });
+        return result;
+    }
     async publishServiceUpdateRequest(targetVersion) {
         if (!this.isReady()) {
             return { sent: 0, peers: [] };
@@ -575,6 +635,18 @@ export class CrossNodeAuthSync {
                     this.recordEvent({ direction: 'in', kind: 'lease.release', stage: 'released', peer: normalizePeerIdentity(peer), requestId: message.leaseId, candidateName: null, detail: null });
                 }
                 return;
+            case 'audit.request':
+                await this.handleAuditRequest(message, normalizePeerIdentity(peer));
+                return;
+            case 'audit.response':
+                this.handleAuditResponse(message, normalizePeerIdentity(peer));
+                return;
+            case 'audit.apply':
+                await this.handleAuditApply(message, senderNodeId, sourceLabel, normalizePeerIdentity(peer));
+                return;
+            case 'audit.state':
+                await this.applyAuditState(message);
+                return;
             case 'service.update.request':
                 await this.handleServiceUpdateRequest(message, senderNodeId, sourceLabel, normalizePeerIdentity(peer));
                 return;
@@ -582,6 +654,224 @@ export class CrossNodeAuthSync {
                 return;
         }
     }
+    async handleAuditRequest(message, peer) {
+        const report = await this.buildAuditReport();
+        await this.sendToPeer(peer, { kind: 'audit.response', requestId: message.requestId, report });
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.response',
+            stage: 'sent',
+            peer,
+            requestId: message.requestId,
+            candidateName: null,
+            detail: `${report.status}; records=${report.records.length}`,
+        });
+    }
+    handleAuditResponse(message, peer) {
+        const pending = this.pendingAudits.get(message.requestId);
+        if (!pending || pending.finished || !isValidAuditReport(message.report))
+            return;
+        const matchedPeer = this.matchConfiguredPeer(peer) ?? peer;
+        pending.reports.set(matchedPeer, message.report);
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.response',
+            stage: 'received',
+            peer: matchedPeer,
+            requestId: message.requestId,
+            candidateName: null,
+            detail: `${message.report.status}; records=${message.report.records.length}; node=${message.report.nodeId}`,
+        });
+        if (pending.peers.every(peerName => pending.reports.has(peerName))) {
+            this.finishPendingAudit(message.requestId);
+        }
+    }
+    async handleAuditApply(message, senderNodeId, sourceLabel, peer) {
+        const outcome = await this.validateAndImport({ ...message.bundle, requestId: message.requestId }, senderNodeId, sourceLabel, peer, 'push', message.replaceExisting);
+        if (!outcome.ok)
+            return;
+        const bundle = message.bundle;
+        const stateRestored = await this.callbacks.markCandidateState?.(bundle.candidateName, 'active', {
+            accountId: bundle.accountId,
+            quotaIdentityId: bundle.quotaIdentityId ?? null,
+            maxLastRefreshMs: bundle.lastRefreshMs,
+        });
+        if (stateRestored && this.clearCandidateFailure(bundle.candidateName)) {
+            await this.writeState();
+        }
+    }
+    async applyAuditState(message) {
+        const applied = await this.callbacks.markCandidateState?.(message.candidateName, message.state, {
+            accountId: message.accountId,
+            quotaIdentityId: message.quotaIdentityId,
+            maxLastRefreshMs: message.maxLastRefreshMs,
+        });
+        if (applied && message.state === 'active' && this.clearCandidateFailure(message.candidateName)) {
+            await this.writeState();
+        }
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.state',
+            stage: message.state,
+            peer: null,
+            requestId: message.requestId,
+            candidateName: message.candidateName,
+            detail: null,
+        });
+    }
+    async buildAuditReport() {
+        if (!this.callbacks.isIdle()) {
+            return {
+                nodeId: this.nodeId ?? 'local',
+                status: 'busy',
+                records: [],
+                reason: 'runtime is not idle',
+            };
+        }
+        const records = [];
+        const candidates = await (this.callbacks.listLocalCandidateCopies?.() ?? this.callbacks.listLocalCandidates());
+        for (const candidate of candidates) {
+            const bundle = bundleFromRecord(candidate);
+            const expiresAt = readAccessTokenExpiresAtMs(candidate.raw);
+            let validation;
+            if (expiresAt === null || expiresAt <= Date.now() + REMOTE_ACCESS_TOKEN_MIN_TTL_MS) {
+                validation = { ok: false, reason: 'access token is expired or missing exp' };
+            }
+            else {
+                validation = await this.callbacks.validateCandidate(candidate.candidateName, candidate.raw, candidate.accountId);
+            }
+            records.push({
+                candidateName: candidate.candidateName,
+                accountId: candidate.accountId,
+                quotaIdentityId: candidate.quotaIdentityId ?? null,
+                lastRefreshMs: candidate.lastRefreshMs,
+                status: validation.ok ? 'valid' : 'invalid',
+                reason: validation.ok ? null : validation.reason ?? 'usage validation failed',
+                bundle: validation.ok ? bundle : null,
+            });
+        }
+        return {
+            nodeId: this.nodeId ?? 'local',
+            status: 'completed',
+            records,
+            reason: null,
+        };
+    }
+    async reconcileAuditReports(requestId, reports, missingPeers) {
+        const completedReports = reports.filter(report => report.status === 'completed');
+        const busyNodes = reports.filter(report => report.status === 'busy').map(report => report.nodeId);
+        const byCandidate = new Map();
+        for (const report of completedReports) {
+            for (const record of report.records) {
+                const entries = byCandidate.get(record.candidateName) ?? [];
+                entries.push({ report, record });
+                byCandidate.set(record.candidateName, entries);
+            }
+        }
+        const synchronizedCandidates = [];
+        const consensusInvalidCandidates = [];
+        const identityConflicts = [];
+        const completeAudit = missingPeers.length === 0 && busyNodes.length === 0;
+        let validCandidates = 0;
+        let invalidCandidates = 0;
+        for (const [candidateName, entries] of byCandidate) {
+            const identities = new Set(entries.map(({ record }) => auditIdentityKey(record.accountId, record.quotaIdentityId)));
+            if (identities.size !== 1) {
+                identityConflicts.push(candidateName);
+                continue;
+            }
+            const valid = entries
+                .filter(({ record }) => record.status === 'valid' && record.bundle !== null)
+                .sort((left, right) => right.record.lastRefreshMs - left.record.lastRefreshMs);
+            if (valid.length > 0) {
+                validCandidates += 1;
+                const selected = valid[0];
+                const bundle = selected.record.bundle;
+                const currentLocal = await this.callbacks.readLocalCandidate(candidateName);
+                let locallyValidated = selected.report.nodeId === this.nodeId
+                    && currentLocal?.lastRefreshMs === bundle.lastRefreshMs
+                    && sha256(currentLocal.raw) === bundle.authSha256;
+                if (!locallyValidated) {
+                    const outcome = await this.validateAndImport({ ...bundle, requestId }, selected.report.nodeId, selected.report.nodeId, selected.report.nodeId, 'push', completeAudit);
+                    locallyValidated = outcome.ok;
+                }
+                if (!locallyValidated)
+                    continue;
+                const stateRestored = await this.callbacks.markCandidateState?.(candidateName, 'active', {
+                    accountId: bundle.accountId,
+                    quotaIdentityId: bundle.quotaIdentityId ?? null,
+                    maxLastRefreshMs: bundle.lastRefreshMs,
+                });
+                if (stateRestored && this.clearCandidateFailure(candidateName)) {
+                    await this.writeState();
+                }
+                if (this.isReady()) {
+                    await this.sendToAll({ kind: 'audit.apply', requestId, bundle, replaceExisting: completeAudit });
+                    await this.sendToAll({
+                        kind: 'audit.state',
+                        requestId,
+                        candidateName,
+                        state: 'active',
+                        accountId: bundle.accountId,
+                        quotaIdentityId: bundle.quotaIdentityId ?? null,
+                        maxLastRefreshMs: bundle.lastRefreshMs,
+                    });
+                }
+                synchronizedCandidates.push(candidateName);
+                continue;
+            }
+            invalidCandidates += 1;
+            const invalidEntries = entries.filter(({ record }) => record.status === 'invalid');
+            const invalidNodes = new Set(invalidEntries.map(({ report }) => report.nodeId));
+            const consensusReached = completeAudit
+                && invalidNodes.size >= 2
+                && invalidEntries.length === entries.length;
+            if (!consensusReached)
+                continue;
+            const latest = invalidEntries.reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
+            if (!latest)
+                continue;
+            const expected = {
+                accountId: latest.record.accountId,
+                quotaIdentityId: latest.record.quotaIdentityId,
+                maxLastRefreshMs: latest.record.lastRefreshMs,
+            };
+            await this.callbacks.markCandidateState?.(candidateName, 'needs_repair', expected);
+            if (this.isReady()) {
+                await this.sendToAll({
+                    kind: 'audit.state',
+                    requestId,
+                    candidateName,
+                    state: 'needs_repair',
+                    ...expected,
+                });
+            }
+            consensusInvalidCandidates.push(candidateName);
+        }
+        return {
+            requestId,
+            nodesExpected: this.peers.length + 1,
+            nodesResponded: reports.length,
+            missingPeers,
+            busyNodes,
+            checkedCandidates: byCandidate.size,
+            validCandidates,
+            invalidCandidates,
+            synchronizedCandidates,
+            consensusInvalidCandidates,
+            identityConflicts,
+        };
+    }
+    finishPendingAudit(requestId) {
+        const pending = this.pendingAudits.get(requestId);
+        if (!pending || pending.finished)
+            return;
+        pending.finished = true;
+        clearTimeout(pending.timer);
+        this.pendingAudits.delete(requestId);
+        const missing = pending.peers.filter(peer => !pending.reports.has(peer));
+        pending.resolve({ reports: pending.reports, missing });
+    }
     async handleServiceUpdateRequest(message, senderNodeId, sourceLabel, peer) {
         let result = {
             accepted: false,
@@ -1036,7 +1326,7 @@ export class CrossNodeAuthSync {
             reason: result.reason ?? 'candidate was already absent',
         });
     }
-    async validateAndImport(bundle, sourceNodeId, sourceLabel, fromPeer, mode) {
+    async validateAndImport(bundle, sourceNodeId, sourceLabel, fromPeer, mode, replaceExisting = false) {
         const source = sourceLabel ?? fromPeer;
         if (!isValidBundle(bundle)) {
             return this.rejectImport(bundle, sourceNodeId, source, fromPeer, mode, 'remote bundle shape is invalid');
@@ -1062,6 +1352,7 @@ export class CrossNodeAuthSync {
         const result = await this.callbacks.importCandidate(bundle.candidateName, bundle.rawAuth, {
             nodeId: sourceNodeId,
             label: source,
+            replaceExisting,
         });
         if (!result.ok) {
             return this.rejectImport(bundle, sourceNodeId, source, fromPeer, mode, `remote candidate import failed for ${bundle.candidateName}: ${result.reason ?? 'unknown'}`);
@@ -1414,6 +1705,26 @@ function isValidBundle(value) {
         && typeof value.rawAuth === 'string'
         && typeof value.authSha256 === 'string';
 }
+function isValidAuditReport(value) {
+    return Boolean(value)
+        && typeof value.nodeId === 'string'
+        && (value.status === 'completed' || value.status === 'busy')
+        && Array.isArray(value.records)
+        && (typeof value.reason === 'string' || value.reason === null)
+        && value.records.every(record => (typeof record.candidateName === 'string'
+            && isAuthCandidateName(record.candidateName)
+            && typeof record.accountId === 'string'
+            && (typeof record.quotaIdentityId === 'string' || record.quotaIdentityId === null)
+            && typeof record.lastRefreshMs === 'number'
+            && Number.isFinite(record.lastRefreshMs)
+            && (record.status === 'valid' || record.status === 'invalid')
+            && (typeof record.reason === 'string' || record.reason === null)
+            && (record.bundle === null || isValidBundle(record.bundle))
+            && (record.status !== 'valid' || record.bundle !== null)));
+}
+function auditIdentityKey(accountId, quotaIdentityId) {
+    return `${accountId}\u0000${quotaIdentityId || accountId}`;
+}
 function quotaIdentitiesCompatible(accountId, left, right) {
     if (!left || !right || left === accountId || right === accountId) {
         return true;
@@ -1522,6 +1833,10 @@ function requestIdFromMessage(message) {
         case 'delete.candidate':
         case 'test.ping':
         case 'test.pong':
+        case 'audit.request':
+        case 'audit.response':
+        case 'audit.apply':
+        case 'audit.state':
         case 'service.update.request':
             return message.requestId;
         case 'lease.request':
@@ -1542,6 +1857,10 @@ function candidateNameFromMessage(message) {
             return message.candidateName;
         case 'pull.response':
             return message.bundle?.candidateName ?? null;
+        case 'audit.apply':
+            return message.bundle.candidateName;
+        case 'audit.state':
+            return message.candidateName;
         default:
             return null;
     }

package/dist/auth/mirror.d.ts

@@ -95,6 +95,7 @@ export declare class AuthCandidateMirror {
     readNewestCandidate(candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
     readRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
     listNewestCandidates(): Promise<AuthMirrorCandidateRecord[]>;
+    listCandidateCopies(): Promise<AuthMirrorCandidateRecord[]>;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
     deleteCandidate(candidateName: string): Promise<boolean>;
     syncAllRuntimeCandidates(): Promise<AuthMirrorSyncAllResult>;
@@ -104,6 +105,7 @@ export declare class AuthCandidateMirror {
     importExternalCandidate(candidateName: string, raw: string, source: {
         nodeId: string;
         label?: string | null;
+        replaceExisting?: boolean;
     }): Promise<AuthMirrorImportResult>;
     private propagateValidatedCandidate;
     private validateRuntimeCandidate;

package/dist/auth/mirror.js

@@ -118,6 +118,28 @@ export class AuthCandidateMirror {
             return [...byName.values()].sort((a, b) => a.candidateName.localeCompare(b.candidateName));
         });
     }
+    async listCandidateCopies() {
+        return this.withActivity(async () => {
+            const copies = [];
+            const seen = new Set();
+            for (const entry of await this.collectAuthRecords()) {
+                if (!isAuthCandidateName(entry.candidateName))
+                    continue;
+                const key = `${entry.candidateName}\u0000${entry.record.accountId}\u0000${entry.record.quotaIdentityId}\u0000${entry.record.lastRefreshMs}\u0000${entry.record.raw}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                copies.push({
+                    ...entry.record,
+                    candidateName: entry.candidateName,
+                    sourceRuntimeId: entry.runtimeId,
+                    sourceLabel: this.runtimeLabel(entry.runtimeId),
+                });
+            }
+            return copies.sort((left, right) => (left.candidateName.localeCompare(right.candidateName)
+                || right.lastRefreshMs - left.lastRefreshMs));
+        });
+    }
     async syncRuntimeCandidate(runtimeId, candidateName) {
         if (!isAuthCandidateName(candidateName))
             return false;
@@ -280,7 +302,7 @@ export class AuthCandidateMirror {
                 }
                 const newest = existing.reduce((current, entry) => (!current || entry.record.lastRefreshMs > current.record.lastRefreshMs ? entry : current), null);
                 const previousRefresh = Math.max(newest?.record.lastRefreshMs ?? 0, this.lastSyncedRefresh.get(candidateName) ?? 0);
-                if (metadata.lastRefreshMs <= previousRefresh) {
+                if (metadata.lastRefreshMs <= previousRefresh && !source.replaceExisting) {
                     return { ok: true, imported: false, reason: 'local candidate is already newer or equal' };
                 }
                 await atomicWrite(path.join(this.canonicalDir, candidateName), raw);

package/dist/controller/controller.d.ts

@@ -1,6 +1,7 @@
 import type { AppConfig } from '../config.js';
 import type { Logger } from '../logger.js';
 import type { BridgeStore } from '../store/database.js';
+import { type AuthSyncClusterAuditResult } from '../auth/cross_node_sync.js';
 import type { RuntimeStatus } from '../types.js';
 import type { TelegramGateway, TelegramTextEvent } from '../telegram/gateway.js';
 import { BridgeMessagingRouter } from '../channels/bridge_messaging_router.js';
@@ -36,6 +37,7 @@ export interface CoreCoordinator {
         replied: number;
         missing: string[];
     }>;
+    authSyncAudit?: () => Promise<AuthSyncClusterAuditResult | null>;
     statusUpdated?: (status: RuntimeStatus) => void;
     getServiceStatus?: () => Promise<{
         currentVersion?: string;
@@ -240,6 +242,7 @@ export declare class BridgeSessionCore {
     private editRichInternalMessage;
     private editAuthPanelMessage;
     private scheduleStalePanelDeletion;
+    private pauseStalePanelDeletion;
     private deleteMessage;
     private sendTyping;
     private sendObservedCliUserMessage;
@@ -313,6 +316,7 @@ export declare class BridgeSessionCore {
     private handleAuthCommand;
     private handleAuthSyncCommand;
     private runAuthSafeSyncAll;
+    private runAuthClusterAudit;
     private handleAuthRefreshAllCommand;
     private handleAuthUseCommand;
     private handleAuthToggleCommand;

package/dist/controller/controller.js

@@ -41,7 +41,7 @@ const CODEX_AUTH_QUOTA_SNAPSHOT_FILENAME = 'codex-auth-quota.json';
 const CODEX_AUTH_LIST_PAGE_SIZE = 8;
 const CODEX_AUTH_LOW_QUOTA_PERCENT = 10;
 const CODEX_AUTH_STALE_CREDENTIAL_DAYS = 8;
-const CODEX_AUTH_PROACTIVE_REFRESH_DAYS = 9;
+const CODEX_AUTH_PROACTIVE_REFRESH_DAYS = 8;
 const CODEX_AUTH_PROACTIVE_REFRESH_INTERVAL_MS = 60 * 60_000;
 const CODEX_AUTH_PROACTIVE_REFRESH_INITIAL_DELAY_MS = 5 * 60_000;
 const USER_INPUT_SUBMITTED_NOTICE_MS = 90_000;
@@ -1136,7 +1136,7 @@ export class BridgeSessionCore {
             await this.handleAuthListViewCallback(event, authClearSearchMatch[1], 'clear_search', locale);
             return;
         }
-        const authActionMatch = /^auth:([a-f0-9]+):(login_device|reload|safe_sync|refresh_all_confirm|refresh_all_cancel|refresh_all)$/.exec(event.data);
+        const authActionMatch = /^auth:([a-f0-9]+):(login_device|reload|safe_sync|cluster_audit|refresh_all_confirm|refresh_all_cancel|refresh_all)$/.exec(event.data);
         if (authActionMatch) {
             await this.handleAuthPanelActionCallback(event, authActionMatch[1], authActionMatch[2], locale);
             return;
@@ -3468,6 +3468,14 @@ export class BridgeSessionCore {
         timer.unref();
         this.stalePanelDeleteTimers.set(key, timer);
     }
+    pauseStalePanelDeletion(scopeId, messageId) {
+        const key = `${scopeId}:${messageId}`;
+        const timer = this.stalePanelDeleteTimers.get(key);
+        if (!timer)
+            return;
+        clearTimeout(timer);
+        this.stalePanelDeleteTimers.delete(key);
+    }
     async deleteMessage(scopeId, messageId) {
         await this.messaging.deleteMessage(scopeId, messageId);
     }
@@ -4647,6 +4655,11 @@ export class BridgeSessionCore {
             this.scheduleSelfUpdateStatusPoll();
             return;
         }
+        if (status.scopeId.startsWith('cluster:')) {
+            this.coordinator?.selfUpdateCompleted?.(status);
+            await this.selfUpdater?.clearStatus();
+            return;
+        }
         if (!this.ownsScope(status.scopeId)) {
             this.scheduleSelfUpdateStatusPoll();
             return;
@@ -4935,6 +4948,20 @@ export class BridgeSessionCore {
             await this.sendMessage(scopeId, message);
             return;
         }
+        if (action === 'audit' || action === 'check') {
+            if (!this.canRunGlobalAuthRefresh()) {
+                await this.sendMessage(scopeId, t(locale, 'auth_cluster_audit_blocked_active'));
+                return;
+            }
+            await this.sendMessage(scopeId, t(locale, 'auth_cluster_audit_starting'));
+            const outcome = await this.runAuthClusterAudit();
+            if (!outcome) {
+                await this.sendMessage(scopeId, t(locale, 'auth_sync_disabled'));
+                return;
+            }
+            await this.sendRichInternalMessage(scopeId, '/auth sync audit', formatAuthClusterAuditResult(locale, outcome));
+            return;
+        }
         if (action === 'safe' || (action === 'push' && args[1]?.toLowerCase() === 'all')) {
             if (!this.canRunGlobalAuthRefresh()) {
                 await this.sendMessage(scopeId, t(locale, 'auth_sync_push_blocked_active'));
@@ -4965,6 +4992,48 @@ export class BridgeSessionCore {
             ? { localSynced: 0, localSkipped: 0, sent: pushResult.sent, skipped: pushResult.skipped }
             : null;
     }
+    async runAuthClusterAudit() {
+        if (!this.coordinator?.authSyncAudit)
+            return null;
+        const lease = await this.coordinator.acquireAuthRefreshLease?.('cluster auth audit and stale refresh');
+        if (lease && !lease.ok) {
+            throw new UserFacingError(lease.reason ?? 'cluster auth audit lease was not granted');
+        }
+        try {
+            const audit = await this.coordinator.authSyncAudit();
+            if (!audit)
+                return null;
+            const refresh = { refreshed: [], skipped: [], failed: [] };
+            let refreshSkippedReason = null;
+            const complete = audit.nodesResponded === audit.nodesExpected
+                && audit.missingPeers.length === 0
+                && audit.busyNodes.length === 0;
+            if (complete) {
+                const state = await this.listCodexAuthState();
+                const staleNames = new Set(state.candidates
+                    .filter(candidate => (!candidate.disabled
+                    && candidate.state !== 'needs_repair'
+                    && candidate.credentialKind === 'chatgpt'
+                    && candidate.credentialLastRefreshMs !== null
+                    && candidate.credentialLastRefreshMs <= Date.now() - CODEX_AUTH_PROACTIVE_REFRESH_DAYS * 24 * 60 * 60_000))
+                    .map(candidate => candidate.name));
+                if (staleNames.size > 0) {
+                    const refreshed = await this.refreshCodexAuthCandidates(staleNames);
+                    refresh.refreshed.push(...refreshed.refreshed);
+                    refresh.skipped.push(...refreshed.skipped);
+                    refresh.failed.push(...refreshed.failed);
+                }
+            }
+            else {
+                refreshSkippedReason = 'cluster audit was incomplete';
+            }
+            const push = await this.coordinator.authSyncPushAll?.() ?? { sent: 0, skipped: 0 };
+            return { audit, refresh, push, refreshSkippedReason };
+        }
+        finally {
+            await this.coordinator.releaseAuthRefreshLease?.(lease?.leaseId ?? null);
+        }
+    }
     async handleAuthRefreshAllCommand(scopeId, locale, confirmed = false) {
         if (!this.canRunGlobalAuthRefresh()) {
             await this.sendMessage(scopeId, t(locale, 'auth_refresh_all_blocked_active'));
@@ -5756,6 +5825,42 @@ export class BridgeSessionCore {
             }
             return;
         }
+        if (action === 'cluster_audit') {
+            if (!this.canRunGlobalAuthRefresh()) {
+                await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_cluster_audit_blocked_active'));
+                return;
+            }
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_cluster_audit_starting'));
+            if (record.messageId !== null) {
+                await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_cluster_audit_starting'), []);
+                this.pauseStalePanelDeletion(event.scopeId, record.messageId);
+            }
+            let outcome;
+            try {
+                outcome = await this.runAuthClusterAudit();
+            }
+            catch (error) {
+                if (record.messageId !== null) {
+                    await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_cluster_audit_failed', { error: formatUserError(error) }), authChoiceKeyboard(locale, record));
+                }
+                return;
+            }
+            if (!outcome) {
+                if (record.messageId !== null) {
+                    await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_sync_disabled'), authChoiceKeyboard(locale, record));
+                }
+                return;
+            }
+            const state = await this.listCodexAuthState();
+            await this.applySharedCodexAuthQuotaSnapshots(state);
+            record.candidates = state.candidates;
+            record.createdAt = Date.now();
+            clampCodexAuthListOffset(record);
+            if (record.messageId !== null) {
+                await this.editAuthPanelMessage(event.scopeId, record.messageId, `${formatAuthClusterAuditResult(locale, outcome)}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record)}`, authChoiceKeyboard(locale, record));
+            }
+            return;
+        }
         if (action === 'refresh_all') {
             if (!this.canRunGlobalAuthRefresh()) {
                 await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_refresh_all_blocked_active'));
@@ -10392,6 +10497,9 @@ function authChoiceKeyboard(locale, record) {
         { text: t(locale, 'button_permissions'), callback_data: 'nav:permissions' },
         { text: t(locale, 'button_login_device'), callback_data: `auth:${record.localId}:login_device` },
     ]);
+    rows.push([
+        { text: t(locale, 'button_auth_cluster_audit'), callback_data: `auth:${record.localId}:cluster_audit` },
+    ]);
     rows.push([
         { text: t(locale, 'button_auth_safe_sync'), callback_data: `auth:${record.localId}:safe_sync` },
         { text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` },
@@ -10507,6 +10615,39 @@ function formatAuthRefreshAllResult(locale, result, mode = 'manual') {
     }
     return lines.join('\n');
 }
+function formatAuthClusterAuditResult(locale, outcome) {
+    const { audit, refresh, push } = outcome;
+    const lines = [t(locale, 'auth_cluster_audit_summary', {
+            responded: audit.nodesResponded,
+            expected: audit.nodesExpected,
+            checked: audit.checkedCandidates,
+            valid: audit.validCandidates,
+            invalid: audit.invalidCandidates,
+        })];
+    if (audit.synchronizedCandidates.length > 0) {
+        lines.push(t(locale, 'auth_cluster_audit_synced', { value: audit.synchronizedCandidates.join(', ') }));
+    }
+    if (audit.consensusInvalidCandidates.length > 0) {
+        lines.push(t(locale, 'auth_cluster_audit_repair', { value: audit.consensusInvalidCandidates.join(', ') }));
+    }
+    if (audit.missingPeers.length > 0) {
+        lines.push(t(locale, 'auth_cluster_audit_missing', { value: audit.missingPeers.join(', ') }));
+    }
+    if (audit.busyNodes.length > 0) {
+        lines.push(t(locale, 'auth_cluster_audit_busy', { value: audit.busyNodes.join(', ') }));
+    }
+    if (audit.identityConflicts.length > 0) {
+        lines.push(t(locale, 'auth_cluster_audit_conflicts', { value: audit.identityConflicts.join(', ') }));
+    }
+    if (outcome.refreshSkippedReason) {
+        lines.push(t(locale, 'auth_cluster_audit_refresh_skipped'));
+    }
+    else {
+        lines.push(formatAuthRefreshAllResult(locale, refresh, 'proactive'));
+    }
+    lines.push(t(locale, 'auth_cluster_audit_push', { sent: push.sent, skipped: push.skipped }));
+    return lines.join('\n');
+}
 function formatAuthSyncStatus(locale, status, proactiveRefresh = null) {
     if (!status?.enabled) {
         return t(locale, 'auth_sync_disabled');

package/dist/i18n.d.ts

@@ -147,7 +147,7 @@ declare const MESSAGES: {
         readonly auth_reload_done: "Codex app-server restarted. Current auth has been reloaded.";
         readonly auth_reload_blocked_active: "Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.";
         readonly usage_auth: "Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <name>]";
-        readonly usage_auth_sync: "Usage: /auth sync <status|events [filter]|trace <requestId>|test|safe|push all>";
+        readonly usage_auth_sync: "Usage: /auth sync <status|events [filter]|trace <requestId>|test|audit|safe|push all>";
         readonly usage_auth_add: "Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.";
         readonly auth_list_title: "Codex auth files:";
         readonly auth_bot: "Bot runtime: {value}";
@@ -213,7 +213,7 @@ declare const MESSAGES: {
         readonly auth_refresh_all_blocked_active: "Cannot refresh all auth candidates while any runtime, approval, input, login, or auth mirror write is active. Wait or use /interrupt first.";
         readonly auth_refresh_all_lease_failed: "Cross-node refresh lock was not granted: {error}";
         readonly auth_refresh_all_done: "Auth refresh all complete: {refreshed} refreshed, {skipped} skipped, {failed} failed.";
-        readonly auth_proactive_refresh_starting: "Proactive auth refresh started for candidates older than 9 days: {value}";
+        readonly auth_proactive_refresh_starting: "Proactive auth refresh started for candidates last refreshed at least 8 days ago: {value}";
         readonly auth_proactive_refresh_lease_failed: "Proactive auth refresh skipped because the cross-node refresh lock was not granted: {error}";
         readonly auth_proactive_refresh_done: "Proactive auth refresh complete: {refreshed} refreshed, {skipped} skipped, {failed} failed.";
         readonly auth_refresh_all_refreshed: "Refreshed: {value}";
@@ -247,6 +247,17 @@ declare const MESSAGES: {
         readonly auth_sync_push_blocked_active: "Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.";
         readonly auth_sync_safe_starting: "Safely syncing auth across local bot runtimes and cross-node peers...";
         readonly auth_sync_safe_done: "Safe auth sync complete: local synced {localSynced}, local skipped {localSkipped}; cross-node sent {sent}, skipped {skipped}.";
+        readonly auth_cluster_audit_starting: "Asking all auth-sync peers to validate accounts, reconcile the newest usable credentials, and refresh credentials at least 8 days old...";
+        readonly auth_cluster_audit_blocked_active: "Cluster auth check requires every local runtime, approval, input, login, and auth mirror write to be idle.";
+        readonly auth_cluster_audit_failed: "Cluster auth check failed: {error}";
+        readonly auth_cluster_audit_summary: "Cluster auth check: nodes {responded}/{expected}; accounts checked {checked}, usable {valid}, unusable {invalid}.";
+        readonly auth_cluster_audit_synced: "Newest usable auth distributed: {value}";
+        readonly auth_cluster_audit_repair: "Marked for manual repair after multi-node consensus: {value}";
+        readonly auth_cluster_audit_missing: "No response: {value}";
+        readonly auth_cluster_audit_busy: "Busy nodes: {value}";
+        readonly auth_cluster_audit_conflicts: "Identity conflicts left unchanged: {value}";
+        readonly auth_cluster_audit_refresh_skipped: "Stale refresh skipped because the cluster check was incomplete.";
+        readonly auth_cluster_audit_push: "Final distribution: sent {sent}, skipped {skipped}.";
         readonly auth_sync_push_done: "Auth sync push complete: sent {sent}, skipped {skipped}.";
         readonly auth_sync_status_title: "Cross-node auth sync:";
         readonly auth_sync_status_node: "Node: {value}";
@@ -272,6 +283,7 @@ declare const MESSAGES: {
         readonly button_login_device: "🔑 Login";
         readonly button_auth_reload: "🔄 Reload auth";
         readonly button_auth_safe_sync: "🧷 Safe sync";
+        readonly button_auth_cluster_audit: "🩺 Check all nodes and reconcile auth";
         readonly button_auth_refresh_all_confirm: "⚠️ Accept risk & refresh";
         readonly button_auth_repair_login: "🔑 Login repair";
         readonly button_auth_delete: "🗑️ Delete";
@@ -858,7 +870,7 @@ declare const MESSAGES: {
         readonly auth_reload_done: "Codex app-server 已重启，当前 auth 已重新读取。";
         readonly auth_reload_blocked_active: "当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。";
         readonly usage_auth: "用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <名称>]";
-        readonly usage_auth_sync: "用法：/auth sync <status|events [过滤]|trace <requestId>|test|safe|push all>";
+        readonly usage_auth_sync: "用法：/auth sync <status|events [过滤]|trace <requestId>|test|audit|safe|push all>";
         readonly usage_auth_add: "用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。";
         readonly auth_list_title: "Codex auth 文件：";
         readonly auth_bot: "Bot runtime：{value}";
@@ -924,7 +936,7 @@ declare const MESSAGES: {
         readonly auth_refresh_all_blocked_active: "当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能刷新全部 auth。请先等待，或使用 /interrupt。";
         readonly auth_refresh_all_lease_failed: "跨节点刷新锁未授予：{error}";
         readonly auth_refresh_all_done: "全部 auth 刷新完成：已刷新 {refreshed}，已跳过 {skipped}，失败 {failed}。";
-        readonly auth_proactive_refresh_starting: "开始主动刷新超过 9 天未更新的 auth 候选：{value}";
+        readonly auth_proactive_refresh_starting: "开始主动刷新上次刷新时间已满 8 天的 auth 候选：{value}";
         readonly auth_proactive_refresh_lease_failed: "主动 auth 刷新已跳过：跨节点刷新锁未授予：{error}";
         readonly auth_proactive_refresh_done: "主动 auth 刷新完成：已刷新 {refreshed}，已跳过 {skipped}，失败 {failed}。";
         readonly auth_refresh_all_refreshed: "已刷新：{value}";
@@ -958,6 +970,17 @@ declare const MESSAGES: {
         readonly auth_sync_push_blocked_active: "当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。";
         readonly auth_sync_safe_starting: "正在安全同步本机多 bot runtime 和跨节点 auth...";
         readonly auth_sync_safe_done: "安全 auth 同步完成：本机同步 {localSynced}，本机跳过 {localSkipped}；跨节点发送 {sent}，跳过 {skipped}。";
+        readonly auth_cluster_audit_starting: "正在通知所有 auth sync 节点逐账号自检，协商最新有效凭据，并由本节点刷新已满 8 天的 auth...";
+        readonly auth_cluster_audit_blocked_active: "集群 auth 自检要求本机所有 runtime、审批、待输入、登录和 auth 镜像写入均为空闲。";
+        readonly auth_cluster_audit_failed: "集群 auth 自检失败：{error}";
+        readonly auth_cluster_audit_summary: "集群 auth 自检：节点 {responded}/{expected}；检查账号 {checked}，有效 {valid}，无有效副本 {invalid}。";
+        readonly auth_cluster_audit_synced: "已采用并分发最新有效 auth：{value}";
+        readonly auth_cluster_audit_repair: "多节点确认无效，已标记问号等待人工处理：{value}";
+        readonly auth_cluster_audit_missing: "未回应节点：{value}";
+        readonly auth_cluster_audit_busy: "忙碌节点：{value}";
+        readonly auth_cluster_audit_conflicts: "账号身份冲突，保持原状：{value}";
+        readonly auth_cluster_audit_refresh_skipped: "集群自检不完整，本次未执行临期 auth 刷新。";
+        readonly auth_cluster_audit_push: "最终分发：已发送 {sent}，已跳过 {skipped}。";
         readonly auth_sync_push_done: "auth 同步推送完成：已发送 {sent}，已跳过 {skipped}。";
         readonly auth_sync_status_title: "跨节点 auth 同步：";
         readonly auth_sync_status_node: "节点：{value}";
@@ -983,6 +1006,7 @@ declare const MESSAGES: {
         readonly button_login_device: "🔑 设备登录";
         readonly button_auth_reload: "🔄 重载 auth";
         readonly button_auth_safe_sync: "🧷 安全同步";
+        readonly button_auth_cluster_audit: "🩺 全节点自检并同步";
         readonly button_auth_refresh_all_confirm: "⚠️ 接受风险并刷新";
         readonly button_auth_repair_login: "🔑 登录修复";
         readonly button_auth_delete: "🗑️ 删除";

package/dist/i18n.js

@@ -145,7 +145,7 @@ const MESSAGES = {
         auth_reload_done: 'Codex app-server restarted. Current auth has been reloaded.',
         auth_reload_blocked_active: 'Cannot reload Codex auth while a turn, approval, or question is active. Wait or use /interrupt first.',
         usage_auth: 'Usage: /auth [list [keyword]|filter <all|enabled|attention>|page <n>|use <n>|enable <n>|disable <n>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <name>]',
-        usage_auth_sync: 'Usage: /auth sync <status|events [filter]|trace <requestId>|test|safe|push all>',
+        usage_auth_sync: 'Usage: /auth sync <status|events [filter]|trace <requestId>|test|audit|safe|push all>',
         usage_auth_add: 'Usage: /auth add <name>. Use letters, numbers, dot, dash, or underscore.',
         auth_list_title: 'Codex auth files:',
         auth_bot: 'Bot runtime: {value}',
@@ -211,7 +211,7 @@ const MESSAGES = {
         auth_refresh_all_blocked_active: 'Cannot refresh all auth candidates while any runtime, approval, input, login, or auth mirror write is active. Wait or use /interrupt first.',
         auth_refresh_all_lease_failed: 'Cross-node refresh lock was not granted: {error}',
         auth_refresh_all_done: 'Auth refresh all complete: {refreshed} refreshed, {skipped} skipped, {failed} failed.',
-        auth_proactive_refresh_starting: 'Proactive auth refresh started for candidates older than 9 days: {value}',
+        auth_proactive_refresh_starting: 'Proactive auth refresh started for candidates last refreshed at least 8 days ago: {value}',
         auth_proactive_refresh_lease_failed: 'Proactive auth refresh skipped because the cross-node refresh lock was not granted: {error}',
         auth_proactive_refresh_done: 'Proactive auth refresh complete: {refreshed} refreshed, {skipped} skipped, {failed} failed.',
         auth_refresh_all_refreshed: 'Refreshed: {value}',
@@ -245,6 +245,17 @@ const MESSAGES = {
         auth_sync_push_blocked_active: 'Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.',
         auth_sync_safe_starting: 'Safely syncing auth across local bot runtimes and cross-node peers...',
         auth_sync_safe_done: 'Safe auth sync complete: local synced {localSynced}, local skipped {localSkipped}; cross-node sent {sent}, skipped {skipped}.',
+        auth_cluster_audit_starting: 'Asking all auth-sync peers to validate accounts, reconcile the newest usable credentials, and refresh credentials at least 8 days old...',
+        auth_cluster_audit_blocked_active: 'Cluster auth check requires every local runtime, approval, input, login, and auth mirror write to be idle.',
+        auth_cluster_audit_failed: 'Cluster auth check failed: {error}',
+        auth_cluster_audit_summary: 'Cluster auth check: nodes {responded}/{expected}; accounts checked {checked}, usable {valid}, unusable {invalid}.',
+        auth_cluster_audit_synced: 'Newest usable auth distributed: {value}',
+        auth_cluster_audit_repair: 'Marked for manual repair after multi-node consensus: {value}',
+        auth_cluster_audit_missing: 'No response: {value}',
+        auth_cluster_audit_busy: 'Busy nodes: {value}',
+        auth_cluster_audit_conflicts: 'Identity conflicts left unchanged: {value}',
+        auth_cluster_audit_refresh_skipped: 'Stale refresh skipped because the cluster check was incomplete.',
+        auth_cluster_audit_push: 'Final distribution: sent {sent}, skipped {skipped}.',
         auth_sync_push_done: 'Auth sync push complete: sent {sent}, skipped {skipped}.',
         auth_sync_status_title: 'Cross-node auth sync:',
         auth_sync_status_node: 'Node: {value}',
@@ -270,6 +281,7 @@ const MESSAGES = {
         button_login_device: '🔑 Login',
         button_auth_reload: '🔄 Reload auth',
         button_auth_safe_sync: '🧷 Safe sync',
+        button_auth_cluster_audit: '🩺 Check all nodes and reconcile auth',
         button_auth_refresh_all_confirm: '⚠️ Accept risk & refresh',
         button_auth_repair_login: '🔑 Login repair',
         button_auth_delete: '🗑️ Delete',
@@ -856,7 +868,7 @@ const MESSAGES = {
         auth_reload_done: 'Codex app-server 已重启，当前 auth 已重新读取。',
         auth_reload_blocked_active: '当前有回复、审批或问题在进行中，不能重载 Codex auth。请先等待，或使用 /interrupt。',
         usage_auth: '用法：/auth [list [关键词]|filter <all|enabled|attention>|page <页码>|use <编号>|enable <编号>|disable <编号>|reload|refresh all [confirm]|sync <status|test|safe|push all>|add <名称>]',
-        usage_auth_sync: '用法：/auth sync <status|events [过滤]|trace <requestId>|test|safe|push all>',
+        usage_auth_sync: '用法：/auth sync <status|events [过滤]|trace <requestId>|test|audit|safe|push all>',
         usage_auth_add: '用法：/auth add <名称>。名称只能包含字母、数字、点、短横线或下划线。',
         auth_list_title: 'Codex auth 文件：',
         auth_bot: 'Bot runtime：{value}',
@@ -922,7 +934,7 @@ const MESSAGES = {
         auth_refresh_all_blocked_active: '当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能刷新全部 auth。请先等待，或使用 /interrupt。',
         auth_refresh_all_lease_failed: '跨节点刷新锁未授予：{error}',
         auth_refresh_all_done: '全部 auth 刷新完成：已刷新 {refreshed}，已跳过 {skipped}，失败 {failed}。',
-        auth_proactive_refresh_starting: '开始主动刷新超过 9 天未更新的 auth 候选：{value}',
+        auth_proactive_refresh_starting: '开始主动刷新上次刷新时间已满 8 天的 auth 候选：{value}',
         auth_proactive_refresh_lease_failed: '主动 auth 刷新已跳过：跨节点刷新锁未授予：{error}',
         auth_proactive_refresh_done: '主动 auth 刷新完成：已刷新 {refreshed}，已跳过 {skipped}，失败 {failed}。',
         auth_refresh_all_refreshed: '已刷新：{value}',
@@ -956,6 +968,17 @@ const MESSAGES = {
         auth_sync_push_blocked_active: '当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。',
         auth_sync_safe_starting: '正在安全同步本机多 bot runtime 和跨节点 auth...',
         auth_sync_safe_done: '安全 auth 同步完成：本机同步 {localSynced}，本机跳过 {localSkipped}；跨节点发送 {sent}，跳过 {skipped}。',
+        auth_cluster_audit_starting: '正在通知所有 auth sync 节点逐账号自检，协商最新有效凭据，并由本节点刷新已满 8 天的 auth...',
+        auth_cluster_audit_blocked_active: '集群 auth 自检要求本机所有 runtime、审批、待输入、登录和 auth 镜像写入均为空闲。',
+        auth_cluster_audit_failed: '集群 auth 自检失败：{error}',
+        auth_cluster_audit_summary: '集群 auth 自检：节点 {responded}/{expected}；检查账号 {checked}，有效 {valid}，无有效副本 {invalid}。',
+        auth_cluster_audit_synced: '已采用并分发最新有效 auth：{value}',
+        auth_cluster_audit_repair: '多节点确认无效，已标记问号等待人工处理：{value}',
+        auth_cluster_audit_missing: '未回应节点：{value}',
+        auth_cluster_audit_busy: '忙碌节点：{value}',
+        auth_cluster_audit_conflicts: '账号身份冲突，保持原状：{value}',
+        auth_cluster_audit_refresh_skipped: '集群自检不完整，本次未执行临期 auth 刷新。',
+        auth_cluster_audit_push: '最终分发：已发送 {sent}，已跳过 {skipped}。',
         auth_sync_push_done: 'auth 同步推送完成：已发送 {sent}，已跳过 {skipped}。',
         auth_sync_status_title: '跨节点 auth 同步：',
         auth_sync_status_node: '节点：{value}',
@@ -981,6 +1004,7 @@ const MESSAGES = {
         button_login_device: '🔑 设备登录',
         button_auth_reload: '🔄 重载 auth',
         button_auth_safe_sync: '🧷 安全同步',
+        button_auth_cluster_audit: '🩺 全节点自检并同步',
         button_auth_refresh_all_confirm: '⚠️ 接受风险并刷新',
         button_auth_repair_login: '🔑 登录修复',
         button_auth_delete: '🗑️ 删除',

package/dist/main.js

@@ -755,6 +755,7 @@ async function runServeCli() {
                 },
                 authSyncPushAll: () => authSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
                 authSyncTest: () => authSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
+                authSyncAudit: () => authSync?.auditCluster() ?? Promise.resolve(null),
                 statusUpdated: () => writeAggregateStatus(),
                 getServiceStatus: async () => ({
                     currentVersion: readPackageVersion(),
@@ -818,6 +819,7 @@ async function runServeCli() {
                 }, {
                     readLocalCandidate: (candidateName) => mirror.readNewestCandidate(candidateName),
                     listLocalCandidates: () => mirror.listNewestCandidates(),
+                    listLocalCandidateCopies: () => mirror.listCandidateCopies(),
                     validateCandidate: async (candidateName, raw, expectedAccountId) => {
                         if (!authSyncLocalIdle()) {
                             return { ok: false, reason: 'runtime is not idle' };
@@ -829,6 +831,7 @@ async function runServeCli() {
                         return runtime.core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
                     },
                     importCandidate: (candidateName, raw, source) => mirror.importExternalCandidate(candidateName, raw, source),
+                    markCandidateState: (candidateName, state, expected) => markAuditedAuthCandidateState(store, mirror, candidateName, state, expected, authRuntimeIds),
                     deleteLocalCandidate: async (candidateName, source) => {
                         if (!authSyncLocalIdle()) {
                             return { ok: false, deleted: false, reason: 'runtime is not idle' };
@@ -961,6 +964,7 @@ async function runServeCli() {
             },
             authSyncPushAll: () => singleAuthSync?.pushAll() ?? Promise.resolve({ sent: 0, skipped: 0 }),
             authSyncTest: () => singleAuthSync?.testPeers() ?? Promise.resolve({ sent: 0, replied: 0, missing: [] }),
+            authSyncAudit: () => singleAuthSync?.auditCluster() ?? Promise.resolve(null),
             statusUpdated: (status) => {
                 writeRuntimeStatus(config.statusPath, {
                     ...status,
@@ -1000,6 +1004,7 @@ async function runServeCli() {
             }, {
                 readLocalCandidate: (candidateName) => singleMirror.readNewestCandidate(candidateName),
                 listLocalCandidates: () => singleMirror.listNewestCandidates(),
+                listLocalCandidateCopies: () => singleMirror.listCandidateCopies(),
                 validateCandidate: async (candidateName, raw, expectedAccountId) => {
                     if (!singleAuthSyncLocalIdle()) {
                         return { ok: false, reason: 'runtime is not idle' };
@@ -1007,6 +1012,7 @@ async function runServeCli() {
                     return core.validateExternalCodexAuthCandidate(candidateName, raw, expectedAccountId);
                 },
                 importCandidate: (candidateName, raw, source) => singleMirror.importExternalCandidate(candidateName, raw, source),
+                markCandidateState: (candidateName, state, expected) => markAuditedAuthCandidateState(store, singleMirror, candidateName, state, expected, ['default']),
                 deleteLocalCandidate: async (candidateName, source) => {
                     if (!singleAuthSyncLocalIdle()) {
                         return { ok: false, deleted: false, reason: 'runtime is not idle' };
@@ -1101,6 +1107,29 @@ function restoreImportedAuthCandidateState(store, candidateName, runtimeIds) {
         store.setCodexAuthCandidateDisabled(candidateName, false, runtimeId);
     }
 }
+async function markAuditedAuthCandidateState(store, mirror, candidateName, state, expected, runtimeIds) {
+    const record = await mirror.readNewestCandidate(candidateName);
+    if (!record || record.accountId !== expected.accountId || record.lastRefreshMs > expected.maxLastRefreshMs) {
+        return false;
+    }
+    if (expected.quotaIdentityId
+        && expected.quotaIdentityId !== expected.accountId
+        && record.quotaIdentityId !== record.accountId
+        && record.quotaIdentityId !== expected.quotaIdentityId) {
+        return false;
+    }
+    store.setCodexAuthCandidateState(candidateName, state);
+    if (state === 'active') {
+        store.setCodexAuthCandidateDisabled(candidateName, false);
+    }
+    for (const runtimeId of runtimeIds) {
+        store.setCodexAuthCandidateState(candidateName, state, runtimeId);
+        if (state === 'active') {
+            store.setCodexAuthCandidateDisabled(candidateName, false, runtimeId);
+        }
+    }
+    return true;
+}
 function createAuthMirrorNotifier(store, botId, bot, aggregator, options = {}) {
     return async (event) => {
         if (options.suppressBackgroundNotifications?.())

package/docs/cross-node-auth-sync.md

@@ -10,7 +10,7 @@ Use it when:
 
 - You legally own and maintain the ChatGPT accounts and auth files.
 - Multiple machines run FoxClaw, and each machine has at least one Telegram bot.
-- You want auth files to stay fresh across nodes, and you allow FoxClaw to proactively refresh enabled ChatGPT candidates whose `last_refresh` is older than 9 days after it obtains the cross-node refresh lease.
+- You want auth files to stay fresh across nodes, and you allow FoxClaw to proactively refresh enabled ChatGPT candidates whose `last_refresh` is at least 8 days old after it obtains the cross-node refresh lease.
 - The recommended default is one contact bot per node for cross-node sync. Other bots on the same node continue to use local auth mirroring.
 
 Do not use it when:
@@ -25,7 +25,7 @@ Cross-node sync combines three active paths:
 
 - **Push**: after local login, Codex automatic refresh, or `/auth refresh all confirm` succeeds and passes usage validation, FoxClaw sends the newer candidate to peers.
 - **Pull**: before auth switch or reload, FoxClaw first searches local runtimes for a newer candidate. If none exists, it asks peers for a newer same-name, same-account candidate.
-- **Lease**: before `/auth refresh all confirm` or the background 9-day proactive refresh rotates refresh tokens, FoxClaw requests a cross-node refresh lease. Any busy, denying, or non-responsive peer blocks the refresh.
+- **Lease**: before `/auth refresh all confirm`, the background 8-day proactive refresh, or the `/auth` cluster check rotates refresh tokens, FoxClaw requests a cross-node refresh lease. Any busy, denying, or non-responsive peer blocks the refresh.
 
 Safety boundaries:
 
@@ -153,6 +153,16 @@ Auth sync test complete: sent 1, replies 1.
 
 If it shows `Missing replies: @peer_bot`, Telegram delivery may have succeeded, but the peer did not receive, decrypt, pass allowlist validation, or run the same auth sync configuration.
 
+The `/auth` panel also provides **Check all nodes and reconcile auth** (`/auth sync audit`). It asks every configured peer to validate every local candidate against the usage endpoint, then:
+
+- selects the newest usage-validated copy for each same-name, same-account and same-user identity and distributes it to every peer;
+- allows a validated older copy to replace a newer timestamped copy only when the newer copy failed this explicit audit;
+- marks a candidate `?` only when every peer responded, no node has a valid copy, and at least two nodes independently reported it invalid;
+- leaves candidates unchanged when any peer is missing or busy, or when account/user identities conflict;
+- refreshes enabled ChatGPT candidates whose `last_refresh` is at least 8 days old on the initiating node, then distributes the refreshed copies.
+
+The audit reaches all entries in the initiating node's `AUTH_SYNC_PEERS`. Use reciprocal full-mesh peer lists when every node must participate in one operation.
+
 3. Use a low-risk candidate for the first broadcast. Make sure every runtime is idle, then run on node A:
 
 ```text
@@ -209,4 +219,4 @@ With cross-node sync enabled, this command first requests a cross-node refresh l
 
 **Should I periodically run `/auth refresh all confirm` as keepalive?**
 
-Do not force it manually on a schedule. Codex refreshes automatically when access tokens expire, and FoxClaw now proactively refreshes enabled ChatGPT candidates whose `last_refresh` is older than 9 days after the node is globally idle and obtains the cross-node refresh lease. `/auth refresh all confirm` remains a manual maintenance command for cases where you explicitly accept refresh-token rotation risk.
+Do not force it manually on a schedule. Codex refreshes automatically when access tokens expire, and FoxClaw proactively refreshes enabled ChatGPT candidates whose `last_refresh` is at least 8 days old after the node is globally idle and obtains the cross-node refresh lease. `/auth refresh all confirm` remains a manual maintenance command for cases where you explicitly accept refresh-token rotation risk.

package/docs/devlogs//346/212/200/346/234/257/351/200/232/350/256/257/01./346/212/212 Codex /345/270/246/345/210/260/346/234/200/345/220/216/344/270/200/345/205/254/351/207/214/357/274/232FoxClaw /347/232/204 auth /347/224/237/345/221/275/345/221/250/346/234/237/344/270/216/350/267/250/350/212/202/347/202/271/345/220/214/346/255/245.md"

@@ -80,7 +80,7 @@ OpenAI 没有公开 ChatGPT refresh token 的固定有效期，也没有公开
 所以 FoxClaw 的策略更克制：
 
 - `/auth refresh all` 是人工维护命令，需要显式确认风险；
-- 已启用 ChatGPT 候选 `last_refresh` 超过 9 天时，后台才主动关注；
+- 已启用 ChatGPT 候选 `last_refresh` 已满 8 天时，后台才主动关注；
 - 主动刷新必须等所有 runtime 空闲，没有审批、待输入、登录流程和 auth 镜像写入；
 - 如果启用跨节点同步，刷新前还要先拿到跨节点刷新锁。
 
@@ -133,7 +133,7 @@ FoxClaw 用 Telegram Bot-to-Bot 做了一套低频控制面。
 
 1. **Push**：本节点登录、Codex 自动刷新或手动刷新成功，并通过 usage 验证后，把较新的候选加密推给 peer。
 2. **Pull**：本节点发现当前候选不可用，先查同节点镜像；如果没有可用较新副本，再向 peer 请求同名同账号的较新候选。
-3. **Lease**：凡是会旋转 refresh token 的操作，例如 `/auth refresh all confirm` 或后台 9 天主动刷新，必须先申请跨节点刷新锁。任一 peer 忙碌、拒绝或超时，都阻止本轮刷新。
+3. **Lease**：凡是会旋转 refresh token 的操作，例如 `/auth refresh all confirm`、后台 8 天主动刷新或集群 auth 自检，必须先申请跨节点刷新锁。任一 peer 忙碌、拒绝或超时，都阻止本轮刷新。
 
 这里最重要的是克制。
 

package/docs/user-manual.md

@@ -439,11 +439,13 @@ Quota remaining: window:percent|auth
 
 The right-side `✅` / `⏸️` button controls whether the candidate participates in auto-rotation. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `--` means no quota snapshot has been observed for that candidate yet. Health summaries distinguish ready, low quota, quota exhausted, quota unknown, not recently refreshed, API key, invalid auth file, and needs login repair states.
 
+The **Check all nodes and reconcile auth** button asks every configured auth-sync peer to validate its candidates. FoxClaw adopts the newest valid copy, distributes it, marks an account `?` only after complete multi-node invalid consensus, and has the initiating node refresh enabled ChatGPT credentials last refreshed at least 8 days ago. Missing, busy, or identity-conflicting peers prevent invalid marking and stale refresh for that run.
+
 When an auth candidate has already failed while in use and FoxClaw cannot recover a newer same-account credential from local mirror or cross-node sync, it is marked as `needs login repair`. These candidates are skipped by auto-rotation and proactive refresh, and are hidden from the `Enabled` filter. Their row shows a `?` action. Tapping it opens two choices: Login repair starts device-code login with that candidate selected; Delete removes the candidate from canonical storage and all local bot runtimes, and clears cached quota for it.
 
 `/auth refresh all` is a command-only maintenance action because ChatGPT refresh tokens are rotated. It is allowed only when every Telegram runtime, the Weixin runtime, approvals, inputs, logins, and auth mirroring are idle. The command first shows a risk confirmation: if OpenAI/Codex consumes an old refresh token but the new token cannot be saved because of network, process, or disk failure, that candidate may require device login or phone verification again. After confirmation, FoxClaw visits every ChatGPT candidate, asks Codex to force-refresh tokens with `account/read refreshToken=true`, verifies the result through the usage endpoint, mirrors successful candidates, restores the original current auth, and shows a summary.
 
-OpenAI does not publish a fixed ChatGPT refresh-token lifetime or an old-token replay grace period. Codex refreshes automatically when an access token approaches expiry; when it cannot parse the access-token `exp`, current Codex uses a `last_refresh` fallback of about 8 days. The panel labels candidates without a refresh record in that interval as `not recently refreshed`. FoxClaw also checks once per hour in the background: if an enabled ChatGPT candidate has a `last_refresh` older than 9 days, FoxClaw proactively refreshes that batch only when every runtime is idle, no approvals/inputs/logins/auth mirror writes are active, and the node holds the cross-node refresh lease. The private bot chat shows one proactive-refresh status message and edits it to the final result. Newer candidates continue through same-node mirroring and cross-node sync, and bursty mirror/cross-node refresh notices are grouped into short summary messages.
+OpenAI does not publish a fixed ChatGPT refresh-token lifetime or an old-token replay grace period. Codex refreshes automatically when an access token approaches expiry; when it cannot parse the access-token `exp`, current Codex uses a `last_refresh` fallback of about 8 days. The panel labels candidates without a refresh record in that interval as `not recently refreshed`. FoxClaw also checks once per hour in the background: if an enabled ChatGPT candidate has a `last_refresh` at least 8 days old, FoxClaw proactively refreshes that batch only when every runtime is idle, no approvals/inputs/logins/auth mirror writes are active, and the node holds the cross-node refresh lease. The private bot chat shows one proactive-refresh status message and edits it to the final result. Newer candidates continue through same-node mirroring and cross-node sync, and bursty mirror/cross-node refresh notices are grouped into short summary messages.
 
 ### 6.4 Cross-Node Auth Sync
 
@@ -480,14 +482,14 @@ Safety boundaries:
 - FoxClaw only accepts sync files from bots listed in `AUTH_SYNC_PEERS`; wrong key, cluster, nonce, or payload validation never writes files.
 - Remote imports wait for global local idleness, temporarily switch to the candidate for app-server usage validation, and only then write the candidate.
 - A same-name candidate known to belong to a different account id, or to a different identifiable ChatGPT user/email under the same account, is never overwritten.
-- Cross-node recovery only pulls an already-held valid peer copy and does not rotate refresh tokens during recovery. If no peer has a usable copy, it stops and asks you to maintain auth manually. The background 9-day proactive refresh separately requests the cross-node refresh lease and skips that cycle if the lease is not granted.
+- Cross-node recovery only pulls an already-held valid peer copy and does not rotate refresh tokens during recovery. If no peer has a usable copy, it stops and asks you to maintain auth manually. The background 8-day proactive refresh separately requests the cross-node refresh lease and skips that cycle if the lease is not granted.
 - When `AUTH_AUTO_DELETE_NEEDS_REPAIR=true` is enabled, or the same option is turned on in `/config`, unrecoverable candidates are deleted and propagated to peers with a delete tombstone. Private notifications collapse to an auth-pool summary: total seen, alive, and invalid-deleted.
 
 Dual-active behavior:
 
 - Push: after local login, Codex automatic refresh, or `/auth refresh all` succeeds and passes local mirror validation, the newer candidate is encrypted and pushed to peers.
 - Pull: before auth switch or reload, FoxClaw first searches local runtimes for a newer same-account candidate; if none is found, it asks peers for a newer same-name same-account copy.
-- Lease: `/auth refresh all confirm` and the background 9-day proactive refresh request a cross-node refresh lease before rotating tokens. Any busy, denying, or non-responsive peer blocks the refresh.
+- Lease: `/auth refresh all confirm`, the background 8-day proactive refresh, and the cluster audit request a cross-node refresh lease before rotating tokens. Any busy, denying, or non-responsive peer blocks the refresh.
 
 Commands:
 
@@ -495,6 +497,7 @@ Commands:
 - `/auth sync events [filter]`: show recent sync event records, optionally filtered by candidate, peer, request id, kind, stage, or detail.
 - `/auth sync trace <requestId>`: show recent records for one request id or event id.
 - `/auth sync test`: send an encrypted ping and wait for peer pong replies to verify peer config, shared key, and Bot-to-Bot private messages.
+- `/auth sync audit`: run the same validate, reconcile, consensus, stale-refresh, and distribution flow as the `/auth` cluster-check button.
 - `/auth sync push all`: manually broadcast all locally verified candidates without refreshing tokens. “Sent” does not mean the peer imported files; check `/auth sync status` and `/auth` on the peer.
 
 Equivalent commands:

package/docs/zh/cross-node-auth-sync.md

@@ -10,7 +10,7 @@
 
 - 这些 ChatGPT 账号和 auth 文件都由你合法拥有和维护。
 - 多台机器都运行 FoxClaw，并且每台机器至少有一个 Telegram bot。
-- 你希望 auth 文件在节点间自动保持较新，并允许 FoxClaw 在已启用 ChatGPT 候选 `last_refresh` 超过 9 天时，持有跨节点刷新锁后主动刷新。
+- 你希望 auth 文件在节点间自动保持较新，并允许 FoxClaw 在已启用 ChatGPT 候选 `last_refresh` 已满 8 天时，持有跨节点刷新锁后主动刷新。
 - 默认推荐每台机器只选择一个“联系人 bot”参与跨节点同步；同一节点内其他 bot 继续使用原本的本机 auth 镜像。
 
 不适合：
@@ -25,7 +25,7 @@
 
 - **Push**：本节点登录、Codex 自动刷新或 `/auth refresh all confirm` 成功并通过本机 usage 验证后，把较新的候选加密发送给 peer。
 - **Pull**：本节点切换或重载 auth 前，如果本机其他 runtime 没有更新副本，会向 peer 请求同名、同账号的较新候选。
-- **Lease**：执行会旋转 refresh token 的 `/auth refresh all confirm` 或后台 9 天主动刷新前，先向 peer 申请跨节点刷新锁；任一 peer 忙碌、拒绝或无响应都会阻止刷新。
+- **Lease**：执行会旋转 refresh token 的 `/auth refresh all confirm`、后台 8 天主动刷新或 `/auth` 集群自检前，先向 peer 申请跨节点刷新锁；任一 peer 忙碌、拒绝或无响应都会阻止刷新。
 
 安全边界：
 
@@ -153,6 +153,16 @@ auth sync 测试完成：已发送 1，收到回应 1。
 
 如果显示 `未回应：@peer_bot`，说明 Telegram 发送可能成功，但对方没有成功接收、解密、通过 allowlist，或没有运行同一组 auth sync 配置。
 
+`/auth` 面板还提供 **全节点自检并同步**（命令等价入口是 `/auth sync audit`）。它会让所有已配置 peer 用 usage 接口逐个验证本机候选，然后：
+
+- 对同名、同 account、同 ChatGPT 用户身份的候选，选择最新且验证有效的副本并分发给所有 peer；
+- 只有显式审计已经证明时间戳更晚的副本无效时，才允许经过验证的较旧有效副本替换它；
+- 仅当所有 peer 都回应、没有任何有效副本，且至少两个节点独立判定无效时，才把候选标为 `?`；
+- 任一 peer 未回应、忙碌或账号/用户身份冲突时，不做无效裁决；
+- 由发起节点刷新 `last_refresh` 已满 8 天的已启用 ChatGPT 候选，再把刷新结果分发给所有 peer。
+
+一次审计覆盖发起节点 `AUTH_SYNC_PEERS` 中的全部联系人。要让每个节点都参与同一次操作，请使用相互 allowlist 的全互联 peer 配置。
+
 3. 用低风险候选做第一次广播。先确认所有 bot runtime 空闲，然后在节点 A 执行：
 
 ```text
@@ -209,4 +219,4 @@ auth sync 测试完成：已发送 1，收到回应 1。
 
 **要不要定期 `/auth refresh all confirm` 保活**
 
-不要手动定期强刷。Codex 会按 access token 到期自动刷新；FoxClaw 也会在已启用 ChatGPT 候选 `last_refresh` 超过 9 天时，等全局空闲并拿到跨节点刷新锁后主动刷新。`/auth refresh all confirm` 仍然是人工维护命令，用于你明确接受 refresh token 轮换风险的场景。
+不要手动定期强刷。Codex 会按 access token 到期自动刷新；FoxClaw 也会在已启用 ChatGPT 候选 `last_refresh` 已满 8 天时，等全局空闲并拿到跨节点刷新锁后主动刷新。`/auth refresh all confirm` 仍然是人工维护命令，用于你明确接受 refresh token 轮换风险的场景。

package/docs/zh/user-manual.md

@@ -439,11 +439,13 @@ Candidates: 2
 
 右侧 `✅` / `⏸️` 表示当前是否参与自动轮转。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`--` 表示该候选还没有额度历史快照。健康摘要会区分正常、额度偏低、额度耗尽、额度未知、长期未刷新、API key、无效 auth 文件和需要登录修复。
 
+**全节点自检并同步** 按钮会通知所有已配置 auth-sync peer 验证本机候选。FoxClaw 会采用并分发最新有效副本；只有完整的多节点无效共识才会标记 `?`；`last_refresh` 已满 8 天的已启用 ChatGPT auth 由发起节点刷新后再分发。存在未回应、忙碌或身份冲突节点时，本轮不会做无效裁决和临期刷新。
+
 当某个候选在实际使用中已经失败，并且 FoxClaw 无法从本机 mirror 或跨节点同步恢复同账号较新凭据时，会标为“需要登录修复”。这类候选不会参与自动轮转和后台主动刷新，也不会出现在“已启用”筛选里。它的按钮会显示 `?`。点击后有两个选择：`登录修复` 会在选中该候选的状态下启动设备码登录；`删除` 会从 canonical 和所有本机 bot runtime 中删除这个候选，并清理它的额度缓存。
 
 `/auth refresh all` 是仅命令入口的维护操作，因为 ChatGPT refresh token 会被轮换。只有所有 Telegram runtime、微信 runtime、审批、待输入、登录流程和 auth 镜像写入都空闲时才允许执行。命令会先显示风险确认：如果 OpenAI/Codex 已经消费旧 refresh token，但因为网络、进程或磁盘故障导致新 token 没能成功保存，该候选可能需要重新设备登录，甚至重新手机号验证。确认后，它会逐个访问 ChatGPT 候选，让 Codex 通过 `account/read refreshToken=true` 强制刷新 token，再用 usage 接口验证，成功后镜像到其他 bot home，最后恢复原本的当前 auth 并显示摘要。
 
-OpenAI 没有公开 ChatGPT refresh token 的固定有效期或旧 token 重放宽限期。Codex 会在 access token 临近到期时自动刷新；如果 access token 里无法解析 `exp`，Codex 当前使用 `last_refresh` 超过约 8 天作为兜底刷新条件。面板把超过 8 天没有刷新记录的候选标为“长期未刷新”。FoxClaw 还会在后台每小时检查一次：已启用的 ChatGPT 候选如果 `last_refresh` 超过 9 天，会在所有 runtime 空闲、没有审批/待输入/登录/auth 镜像写入，并且拿到跨节点刷新锁后，主动刷新这一批候选。私聊里会显示一条主动刷新状态消息，并在结束时编辑成最终结果；较新的候选会继续镜像和跨节点同步，成批出现的镜像/跨节点刷新通知会合并成简短汇总。
+OpenAI 没有公开 ChatGPT refresh token 的固定有效期或旧 token 重放宽限期。Codex 会在 access token 临近到期时自动刷新；如果 access token 里无法解析 `exp`，Codex 当前使用 `last_refresh` 超过约 8 天作为兜底刷新条件。面板把超过 8 天没有刷新记录的候选标为“长期未刷新”。FoxClaw 还会在后台每小时检查一次：已启用的 ChatGPT 候选如果 `last_refresh` 已满 8 天，会在所有 runtime 空闲、没有审批/待输入/登录/auth 镜像写入，并且拿到跨节点刷新锁后，主动刷新这一批候选。私聊里会显示一条主动刷新状态消息，并在结束时编辑成最终结果；较新的候选会继续镜像和跨节点同步，成批出现的镜像/跨节点刷新通知会合并成简短汇总。
 
 ### 6.4 跨节点 auth 同步
 
@@ -480,14 +482,14 @@ AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 - 只接收 `AUTH_SYNC_PEERS` 中 peer bot 发来的同步文件；密钥、cluster、nonce 或 payload 校验失败时不会写盘。
 - 远端导入必须等本机全局空闲，再临时切换到待验证 auth、重启 app-server、读取 usage 验证成功后才写入候选。
 - 同名候选如果已知属于不同 account id，或属于同一 account 下不同的可识别 ChatGPT 用户/邮箱，永远拒绝覆盖。
-- 跨节点恢复只拉取 peer 已持有的有效副本，不会在恢复过程中直接轮换 refresh token；找不到有效副本时会停止，提示你人工维护授权。后台 9 天主动刷新会单独申请跨节点刷新锁，拿不到锁就跳过本轮。
+- 跨节点恢复只拉取 peer 已持有的有效副本，不会在恢复过程中直接轮换 refresh token；找不到有效副本时会停止，提示你人工维护授权。后台 8 天主动刷新会单独申请跨节点刷新锁，拿不到锁就跳过本轮。
 - 如果开启 `AUTH_AUTO_DELETE_NEEDS_REPAIR=true` 或在 `/config` 中打开自动剔除，无法恢复的候选会直接删除并向 peer 传播删除 tombstone；私聊通知会压缩为 auth 池摘要：历史总数、存活数、因失效剔除数。
 
 双主动流程：
 
 - push：本节点登录、Codex 自动刷新或 `/auth refresh all` 成功并通过本机镜像验证后，会主动把较新的候选加密推送给 peer。
 - pull：本节点切换或重载 auth 前如果发现本地候选不是最新，会先查本机其他 runtime；仍找不到时，再向 peer 拉取同名同账号的较新副本。
-- lease：执行会旋转 refresh token 的 `/auth refresh all confirm` 或后台 9 天主动刷新前，会向 peer 申请跨节点刷新锁。任一 peer 忙碌、拒绝或无响应都会阻止刷新。
+- lease：执行会旋转 refresh token 的 `/auth refresh all confirm`、后台 8 天主动刷新或集群自检前，会向 peer 申请跨节点刷新锁。任一 peer 忙碌、拒绝或无响应都会阻止刷新。
 
 命令：
 
@@ -495,6 +497,7 @@ AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 - `/auth sync events [过滤]`：查看最近同步事件，可按候选名、peer、request id、事件类型、阶段或详情过滤。
 - `/auth sync trace <requestId>`：查看某个 request id 或事件 id 的最近流水。
 - `/auth sync test`：发送加密 ping 并等待 peer 返回 pong，确认 peer、共享密钥和 Bot-to-Bot 私聊可用。
+- `/auth sync audit`：执行与 `/auth` 面板“全节点自检并同步”按钮相同的验证、协商、无效共识、临期刷新和分发流程。
 - `/auth sync push all`：手动广播当前节点已验证的全部候选，不刷新 token；“已发送”不等于对端已经导入，需要在 peer 上看 `/auth sync status` 和 `/auth`。
 
 命令等价用法：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.5.74",
+  "version": "0.5.77",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",