@foxden-app/foxclaw 0.5.76 → 0.5.78

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.5.78 - 2026-07-12
+
+### 中文
+- `/auth` 面板收敛为“设备登录”和“安全同步”两个维护入口，移除权限、重载 auth 和单独的全节点审计按钮。“安全同步”现在直接执行完整的全节点验证、最新有效副本协商、8 天临期刷新和最终分发；`/auth sync audit` 继续作为兼容别名。
+- 全节点审计现在也覆盖只存在于单个节点的旧候选：通过现有 AES-256-GCM 通道发送给其他节点做只验证、不导入的独立复核。任一节点验证有效就恢复并分发；没有有效结果且至少两个节点确认无效才标记 `?`。
+- Telegram `/status` 新增当前 bot 实际使用的 Codex Home，并与 `/auth`、`/threads` 等时效面板一样按 `TELEGRAM_PANEL_TTL_MS` 自动撤回，默认 5 分钟。
+- 完整支持 Codex 新增的 `max`、`ultra` 推理强度，包括模型能力读取、命令解析、设置持久化和下一轮请求透传，不再提示“未知推理强度”。
+
+### English
+- Simplified the `/auth` panel to Device login and Safe sync, removing the Permissions, Reload auth, and separate cluster-audit buttons. Safe sync now runs the complete all-node validation, newest-valid-copy reconciliation, 8-day stale refresh, and final distribution flow; `/auth sync audit` remains a compatibility alias.
+- All-node audits now cover legacy candidates found on only one node. The candidate is sent through the existing AES-256-GCM channel for independent validation without import. Any valid result restores and distributes it; it is marked `?` only when no valid result exists and at least two nodes reject it.
+- Telegram `/status` now shows the effective Codex Home for the current bot and expires through `TELEGRAM_PANEL_TTL_MS`, like `/auth` and `/threads`, with a five-minute default.
+- Added end-to-end support for the new Codex `max` and `ultra` reasoning efforts across model capability parsing, commands, persisted settings, and turn requests.
+
+## 0.5.77 - 2026-07-11
+
+### 中文
+- 修复跨节点升级广播触发的后台升级完成后，旧服务把内部 `cluster:*` scope 当成 Telegram scope 解析并反复记录 `Expected telegram: scope` 的问题。集群升级现在只记录完成状态并清理轮询文件，不再尝试向不存在的聊天发送回报。
+
+### English
+- Fixed cluster-broadcast updates repeatedly logging `Expected telegram: scope` after completion because the old service tried to parse the internal `cluster:*` scope as a Telegram destination. Cluster updates now record completion and clear the poll state without trying to send a chat reply to a non-chat scope.
+
 ## 0.5.76 - 2026-07-11
 
 ### 中文

package/dist/auth/cross_node_sync.d.ts

@@ -299,6 +299,7 @@ export declare class CrossNodeAuthSync {
     private readonly pendingLeases;
     private readonly pendingTests;
     private readonly pendingAudits;
+    private readonly pendingAuditVerifications;
     private seenNonces;
     private lastPeerActivityAt;
     private timer;
@@ -338,11 +339,17 @@ export declare class CrossNodeAuthSync {
     private handleMessage;
     private handleAuditRequest;
     private handleAuditResponse;
+    private handleAuditVerificationRequest;
+    private handleAuditVerificationResponse;
     private handleAuditApply;
     private applyAuditState;
     private buildAuditReport;
+    private verifySingleNodeInvalidCandidates;
+    private verifyBundlesIntoAuditReport;
+    private validateAuditBundle;
     private reconcileAuditReports;
     private finishPendingAudit;
+    private finishPendingAuditVerification;
     private handleServiceUpdateRequest;
     private handlePullRequest;
     private handlePullResponse;

package/dist/auth/cross_node_sync.js

@@ -27,6 +27,7 @@ export class CrossNodeAuthSync {
     pendingLeases = new Map();
     pendingTests = new Map();
     pendingAudits = new Map();
+    pendingAuditVerifications = new Map();
     seenNonces = new Map();
     lastPeerActivityAt = new Map();
     timer = null;
@@ -523,6 +524,7 @@ export class CrossNodeAuthSync {
         }
         const [localReport, remote] = await Promise.all([localReportPromise, remoteReportsPromise]);
         const reports = [localReport, ...remote.reports.values()];
+        await this.verifySingleNodeInvalidCandidates(requestId, reports);
         const result = await this.reconcileAuditReports(requestId, reports, remote.missing);
         this.recordEvent({
             direction: 'local',
@@ -641,6 +643,12 @@ export class CrossNodeAuthSync {
             case 'audit.response':
                 this.handleAuditResponse(message, normalizePeerIdentity(peer));
                 return;
+            case 'audit.verify.request':
+                await this.handleAuditVerificationRequest(message, normalizePeerIdentity(peer));
+                return;
+            case 'audit.verify.response':
+                this.handleAuditVerificationResponse(message, normalizePeerIdentity(peer));
+                return;
             case 'audit.apply':
                 await this.handleAuditApply(message, senderNodeId, sourceLabel, normalizePeerIdentity(peer));
                 return;
@@ -686,6 +694,62 @@ export class CrossNodeAuthSync {
             this.finishPendingAudit(message.requestId);
         }
     }
+    async handleAuditVerificationRequest(message, peer) {
+        let report;
+        if (!this.callbacks.isIdle()) {
+            report = { nodeId: this.nodeId ?? 'local', status: 'busy', records: [], reason: 'runtime is not idle' };
+        }
+        else {
+            const records = [];
+            const bundles = Array.isArray(message.bundles)
+                ? message.bundles.filter(bundle => isValidBundle(bundle) && sha256(bundle.rawAuth) === bundle.authSha256)
+                : [];
+            for (const bundle of bundles) {
+                const validation = await this.validateAuditBundle(bundle);
+                records.push({
+                    candidateName: bundle.candidateName,
+                    authSha256: bundle.authSha256,
+                    status: validation.ok ? 'valid' : 'invalid',
+                    reason: validation.ok ? null : validation.reason ?? 'usage validation failed',
+                });
+            }
+            report = { nodeId: this.nodeId ?? 'local', status: 'completed', records, reason: null };
+        }
+        await this.sendToPeer(peer, {
+            kind: 'audit.verify.response',
+            requestId: message.requestId,
+            verificationId: message.verificationId,
+            report,
+        });
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.verify.response',
+            stage: 'sent',
+            peer,
+            requestId: message.requestId,
+            candidateName: null,
+            detail: `${report.status}; records=${report.records.length}`,
+        });
+    }
+    handleAuditVerificationResponse(message, peer) {
+        const pending = this.pendingAuditVerifications.get(message.verificationId);
+        if (!pending || pending.finished || !isValidAuditVerificationReport(message.report))
+            return;
+        const matchedPeer = this.matchConfiguredPeer(peer) ?? peer;
+        pending.reports.set(matchedPeer, message.report);
+        this.recordEvent({
+            direction: 'local',
+            kind: 'audit.verify.response',
+            stage: 'received',
+            peer: matchedPeer,
+            requestId: message.requestId,
+            candidateName: null,
+            detail: `${message.report.status}; records=${message.report.records.length}; node=${message.report.nodeId}`,
+        });
+        if (pending.peers.every(peerName => pending.reports.has(peerName))) {
+            this.finishPendingAuditVerification(message.verificationId);
+        }
+    }
     async handleAuditApply(message, senderNodeId, sourceLabel, peer) {
         const outcome = await this.validateAndImport({ ...message.bundle, requestId: message.requestId }, senderNodeId, sourceLabel, peer, 'push', message.replaceExisting);
         if (!outcome.ok)
@@ -747,7 +811,7 @@ export class CrossNodeAuthSync {
                 lastRefreshMs: candidate.lastRefreshMs,
                 status: validation.ok ? 'valid' : 'invalid',
                 reason: validation.ok ? null : validation.reason ?? 'usage validation failed',
-                bundle: validation.ok ? bundle : null,
+                bundle,
             });
         }
         return {
@@ -757,6 +821,107 @@ export class CrossNodeAuthSync {
             reason: null,
         };
     }
+    async verifySingleNodeInvalidCandidates(requestId, reports) {
+        const completedReports = reports.filter(report => report.status === 'completed');
+        const entries = new Map();
+        for (const report of completedReports) {
+            for (const record of report.records) {
+                const candidateEntries = entries.get(record.candidateName) ?? [];
+                candidateEntries.push({ report, record });
+                entries.set(record.candidateName, candidateEntries);
+            }
+        }
+        const bundles = [];
+        for (const candidateEntries of entries.values()) {
+            if (candidateEntries.some(entry => entry.record.status === 'valid'))
+                continue;
+            const invalidNodes = new Set(candidateEntries.map(entry => entry.report.nodeId));
+            if (invalidNodes.size >= 2)
+                continue;
+            const latest = candidateEntries
+                .filter(entry => entry.record.bundle !== null)
+                .sort((left, right) => right.record.lastRefreshMs - left.record.lastRefreshMs)[0];
+            if (latest?.record.bundle)
+                bundles.push(latest.record.bundle);
+        }
+        if (bundles.length === 0)
+            return;
+        const localReport = completedReports.find(report => report.nodeId === this.nodeId);
+        if (localReport) {
+            await this.verifyBundlesIntoAuditReport(localReport, bundles);
+        }
+        if (!this.isReady())
+            return;
+        const verificationId = crypto.randomUUID();
+        const remoteReports = await new Promise((resolve) => {
+            const timer = setTimeout(() => this.finishPendingAuditVerification(verificationId), AUDIT_TIMEOUT_MS);
+            timer.unref();
+            this.pendingAuditVerifications.set(verificationId, {
+                peers: [...this.peers],
+                reports: new Map(),
+                resolve,
+                timer,
+                finished: false,
+            });
+            void this.sendToAll({ kind: 'audit.verify.request', requestId, verificationId, bundles }).catch(() => {
+                this.finishPendingAuditVerification(verificationId);
+            });
+        });
+        const bundlesByHash = new Map(bundles.map(bundle => [bundle.authSha256, bundle]));
+        for (const verification of remoteReports.values()) {
+            if (verification.status !== 'completed')
+                continue;
+            let target = completedReports.find(report => report.nodeId === verification.nodeId);
+            if (!target) {
+                target = { nodeId: verification.nodeId, status: 'completed', records: [], reason: null };
+                reports.push(target);
+                completedReports.push(target);
+            }
+            for (const record of verification.records) {
+                const bundle = bundlesByHash.get(record.authSha256);
+                if (!bundle || bundle.candidateName !== record.candidateName)
+                    continue;
+                if (record.status === 'valid') {
+                    target.records = target.records.filter(existing => existing.candidateName !== record.candidateName);
+                }
+                else if (target.records.some(existing => existing.candidateName === record.candidateName)) {
+                    continue;
+                }
+                target.records.push({
+                    candidateName: bundle.candidateName,
+                    accountId: bundle.accountId,
+                    quotaIdentityId: bundle.quotaIdentityId ?? null,
+                    lastRefreshMs: bundle.lastRefreshMs,
+                    status: record.status,
+                    reason: record.reason,
+                    bundle,
+                });
+            }
+        }
+    }
+    async verifyBundlesIntoAuditReport(report, bundles) {
+        for (const bundle of bundles) {
+            if (report.records.some(record => record.candidateName === bundle.candidateName))
+                continue;
+            const validation = await this.validateAuditBundle(bundle);
+            report.records.push({
+                candidateName: bundle.candidateName,
+                accountId: bundle.accountId,
+                quotaIdentityId: bundle.quotaIdentityId ?? null,
+                lastRefreshMs: bundle.lastRefreshMs,
+                status: validation.ok ? 'valid' : 'invalid',
+                reason: validation.ok ? null : validation.reason ?? 'usage validation failed',
+                bundle,
+            });
+        }
+    }
+    async validateAuditBundle(bundle) {
+        const expiresAt = readAccessTokenExpiresAtMs(bundle.rawAuth);
+        if (expiresAt === null || expiresAt <= Date.now() + REMOTE_ACCESS_TOKEN_MIN_TTL_MS) {
+            return { ok: false, reason: 'access token is expired or missing exp' };
+        }
+        return this.callbacks.validateCandidate(bundle.candidateName, bundle.rawAuth, bundle.accountId);
+    }
     async reconcileAuditReports(requestId, reports, missingPeers) {
         const completedReports = reports.filter(report => report.status === 'completed');
         const busyNodes = reports.filter(report => report.status === 'busy').map(report => report.nodeId);
@@ -872,6 +1037,15 @@ export class CrossNodeAuthSync {
         const missing = pending.peers.filter(peer => !pending.reports.has(peer));
         pending.resolve({ reports: pending.reports, missing });
     }
+    finishPendingAuditVerification(verificationId) {
+        const pending = this.pendingAuditVerifications.get(verificationId);
+        if (!pending || pending.finished)
+            return;
+        pending.finished = true;
+        clearTimeout(pending.timer);
+        this.pendingAuditVerifications.delete(verificationId);
+        pending.resolve(pending.reports);
+    }
     async handleServiceUpdateRequest(message, senderNodeId, sourceLabel, peer) {
         let result = {
             accepted: false,
@@ -1722,6 +1896,18 @@ function isValidAuditReport(value) {
             && (record.bundle === null || isValidBundle(record.bundle))
             && (record.status !== 'valid' || record.bundle !== null)));
 }
+function isValidAuditVerificationReport(value) {
+    return Boolean(value)
+        && typeof value.nodeId === 'string'
+        && (value.status === 'completed' || value.status === 'busy')
+        && Array.isArray(value.records)
+        && (typeof value.reason === 'string' || value.reason === null)
+        && value.records.every(record => (typeof record.candidateName === 'string'
+            && isAuthCandidateName(record.candidateName)
+            && typeof record.authSha256 === 'string'
+            && (record.status === 'valid' || record.status === 'invalid')
+            && (typeof record.reason === 'string' || record.reason === null)));
+}
 function auditIdentityKey(accountId, quotaIdentityId) {
     return `${accountId}\u0000${quotaIdentityId || accountId}`;
 }
@@ -1835,6 +2021,8 @@ function requestIdFromMessage(message) {
         case 'test.pong':
         case 'audit.request':
         case 'audit.response':
+        case 'audit.verify.request':
+        case 'audit.verify.response':
         case 'audit.apply':
         case 'audit.state':
         case 'service.update.request':
@@ -1859,6 +2047,8 @@ function candidateNameFromMessage(message) {
             return message.bundle?.candidateName ?? null;
         case 'audit.apply':
             return message.bundle.candidateName;
+        case 'audit.verify.request':
+            return message.bundles.length === 1 ? message.bundles[0]?.candidateName ?? null : null;
         case 'audit.state':
             return message.candidateName;
         default:

package/dist/codex_app/client.js

@@ -1199,7 +1199,7 @@ function normalizeCollaborationMode(value) {
     return value === 'default' || value === 'plan' ? value : null;
 }
 function normalizeReasoningEffort(value) {
-    return typeof value === 'string' && ['none', 'minimal', 'low', 'medium', 'high', 'xhigh'].includes(value)
+    return typeof value === 'string' && ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(value)
         ? value
         : null;
 }

package/dist/controller/controller.js

@@ -523,7 +523,11 @@ export class BridgeSessionCore {
                 }
                 lines.push(...codexUsageLines);
                 lines.push(...codexLocalUsageLines);
-                await this.sendRichInternalMessage(scopeId, '/status', lines.join('\n'));
+                lines.splice(5, 0, t(locale, 'status_codex_home', {
+                    value: this.config.codexHome ?? path.join(os.homedir(), '.codex'),
+                }));
+                const messageId = await this.sendRichInternalMessage(scopeId, '/status', lines.join('\n'));
+                this.scheduleStalePanelDeletion(scopeId, messageId);
                 return;
             }
             case 'account': {
@@ -4655,6 +4659,11 @@ export class BridgeSessionCore {
             this.scheduleSelfUpdateStatusPoll();
             return;
         }
+        if (status.scopeId.startsWith('cluster:')) {
+            this.coordinator?.selfUpdateCompleted?.(status);
+            await this.selfUpdater?.clearStatus();
+            return;
+        }
         if (!this.ownsScope(status.scopeId)) {
             this.scheduleSelfUpdateStatusPoll();
             return;
@@ -4943,7 +4952,7 @@ export class BridgeSessionCore {
             await this.sendMessage(scopeId, message);
             return;
         }
-        if (action === 'audit' || action === 'check') {
+        if (action === 'audit' || action === 'check' || action === 'safe') {
             if (!this.canRunGlobalAuthRefresh()) {
                 await this.sendMessage(scopeId, t(locale, 'auth_cluster_audit_blocked_active'));
                 return;
@@ -4954,10 +4963,10 @@ export class BridgeSessionCore {
                 await this.sendMessage(scopeId, t(locale, 'auth_sync_disabled'));
                 return;
             }
-            await this.sendRichInternalMessage(scopeId, '/auth sync audit', formatAuthClusterAuditResult(locale, outcome));
+            await this.sendRichInternalMessage(scopeId, '/auth sync safe', formatAuthClusterAuditResult(locale, outcome));
             return;
         }
-        if (action === 'safe' || (action === 'push' && args[1]?.toLowerCase() === 'all')) {
+        if (action === 'push' && args[1]?.toLowerCase() === 'all') {
             if (!this.canRunGlobalAuthRefresh()) {
                 await this.sendMessage(scopeId, t(locale, 'auth_sync_push_blocked_active'));
                 return;
@@ -5798,8 +5807,20 @@ export class BridgeSessionCore {
             if (record.messageId !== null) {
                 await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_sync_safe_starting'), []);
             }
-            const result = await this.runAuthSafeSyncAll();
-            if (!result) {
+            if (record.messageId !== null) {
+                this.pauseStalePanelDeletion(event.scopeId, record.messageId);
+            }
+            let outcome;
+            try {
+                outcome = await this.runAuthClusterAudit();
+            }
+            catch (error) {
+                if (record.messageId !== null) {
+                    await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_cluster_audit_failed', { error: formatUserError(error) }), authChoiceKeyboard(locale, record));
+                }
+                return;
+            }
+            if (!outcome) {
                 if (record.messageId !== null) {
                     await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_sync_disabled'), authChoiceKeyboard(locale, record));
                 }
@@ -5811,12 +5832,7 @@ export class BridgeSessionCore {
             record.createdAt = Date.now();
             clampCodexAuthListOffset(record);
             if (record.messageId !== null) {
-                await this.editAuthPanelMessage(event.scopeId, record.messageId, `${t(locale, 'auth_sync_safe_done', {
-                    localSynced: result.localSynced,
-                    localSkipped: result.localSkipped,
-                    sent: result.sent,
-                    skipped: result.skipped,
-                })}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record)}`, authChoiceKeyboard(locale, record));
+                await this.editAuthPanelMessage(event.scopeId, record.messageId, `${formatAuthClusterAuditResult(locale, outcome)}\n\n${renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record)}`, authChoiceKeyboard(locale, record));
             }
             return;
         }
@@ -10488,17 +10504,8 @@ function authChoiceKeyboard(locale, record) {
     if (record.searchTerm) {
         rows.push([{ text: t(locale, 'button_clear_filter'), callback_data: `auth:${record.localId}:clear_search` }]);
     }
-    rows.push([
-        { text: t(locale, 'button_permissions'), callback_data: 'nav:permissions' },
-        { text: t(locale, 'button_login_device'), callback_data: `auth:${record.localId}:login_device` },
-    ]);
-    rows.push([
-        { text: t(locale, 'button_auth_cluster_audit'), callback_data: `auth:${record.localId}:cluster_audit` },
-    ]);
-    rows.push([
-        { text: t(locale, 'button_auth_safe_sync'), callback_data: `auth:${record.localId}:safe_sync` },
-        { text: t(locale, 'button_auth_reload'), callback_data: `auth:${record.localId}:reload` },
-    ]);
+    rows.push([{ text: t(locale, 'button_login_device'), callback_data: `auth:${record.localId}:login_device` }]);
+    rows.push([{ text: t(locale, 'button_auth_safe_sync'), callback_data: `auth:${record.localId}:safe_sync` }]);
     return rows;
 }
 function formatCodexAuthCandidateDisplayName(name) {

package/dist/controller/presentation.js

@@ -542,7 +542,9 @@ export function normalizeRequestedEffort(value) {
         || normalized === 'low'
         || normalized === 'medium'
         || normalized === 'high'
-        || normalized === 'xhigh') {
+        || normalized === 'xhigh'
+        || normalized === 'max'
+        || normalized === 'ultra') {
         return normalized;
     }
     return null;

package/dist/i18n.d.ts

@@ -95,6 +95,7 @@ declare const MESSAGES: {
         readonly status_user_agent: "Codex/FoxClaw agent: {value}";
         readonly status_current_thread: "Current thread: {value}";
         readonly status_configured_model: "Configured model: {value}";
+        readonly status_codex_home: "Codex home: {value}";
         readonly status_configured_effort: "Configured effort: {value}";
         readonly status_fast: "Fast: {value}";
         readonly status_collaboration_mode: "Mode: {value}";
@@ -245,7 +246,7 @@ declare const MESSAGES: {
         readonly auth_sync_test_sent: "Auth sync test complete: sent {sent}, replies {replied}.";
         readonly auth_sync_test_missing: "Missing replies: {value}";
         readonly auth_sync_push_blocked_active: "Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.";
-        readonly auth_sync_safe_starting: "Safely syncing auth across local bot runtimes and cross-node peers...";
+        readonly auth_sync_safe_starting: "Auditing every node, selecting the newest valid auth, and safely synchronizing the cluster...";
         readonly auth_sync_safe_done: "Safe auth sync complete: local synced {localSynced}, local skipped {localSkipped}; cross-node sent {sent}, skipped {skipped}.";
         readonly auth_cluster_audit_starting: "Asking all auth-sync peers to validate accounts, reconcile the newest usable credentials, and refresh credentials at least 8 days old...";
         readonly auth_cluster_audit_blocked_active: "Cluster auth check requires every local runtime, approval, input, login, and auth mirror write to be idle.";
@@ -282,7 +283,7 @@ declare const MESSAGES: {
         readonly auth_sync_trace_missing: "Usage: /auth sync trace <requestId>";
         readonly button_login_device: "🔑 Login";
         readonly button_auth_reload: "🔄 Reload auth";
-        readonly button_auth_safe_sync: "🧷 Safe sync";
+        readonly button_auth_safe_sync: "🩺 Safe sync";
         readonly button_auth_cluster_audit: "🩺 Check all nodes and reconcile auth";
         readonly button_auth_refresh_all_confirm: "⚠️ Accept risk & refresh";
         readonly button_auth_repair_login: "🔑 Login repair";
@@ -394,7 +395,7 @@ declare const MESSAGES: {
         readonly effort_adjusted_model: "Effort {effort} is not supported by {model}, so it was adjusted.";
         readonly effort_change_blocked: "Cannot change reasoning effort while a turn is active. Use /interrupt or wait.";
         readonly effort_reset: "Configured effort reset to server default.";
-        readonly usage_effort: "Usage: /effort <none|minimal|low|medium|high|xhigh|default>\nOr just use /models and tap buttons.";
+        readonly usage_effort: "Usage: /effort <none|minimal|low|medium|high|xhigh|max|ultra|default>\nOr just use /models and tap buttons.";
         readonly model_does_not_support_effort: "{model} does not support {effort}.\nSupported: {supported}";
         readonly effort_configured: "Configured effort: {effort}";
         readonly usage_fast: "Usage: /fast <on|off|toggle>";
@@ -818,6 +819,7 @@ declare const MESSAGES: {
         readonly status_user_agent: "Codex/FoxClaw 标识：{value}";
         readonly status_current_thread: "当前线程：{value}";
         readonly status_configured_model: "已配置模型：{value}";
+        readonly status_codex_home: "Codex Home：{value}";
         readonly status_configured_effort: "已配置推理强度：{value}";
         readonly status_fast: "Fast：{value}";
         readonly status_collaboration_mode: "模式：{value}";
@@ -968,7 +970,7 @@ declare const MESSAGES: {
         readonly auth_sync_test_sent: "auth sync 测试完成：已发送 {sent}，收到回应 {replied}。";
         readonly auth_sync_test_missing: "未回应：{value}";
         readonly auth_sync_push_blocked_active: "当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。";
-        readonly auth_sync_safe_starting: "正在安全同步本机多 bot runtime 和跨节点 auth...";
+        readonly auth_sync_safe_starting: "正在自检全部节点、选择最新有效 auth，并安全同步整个集群...";
         readonly auth_sync_safe_done: "安全 auth 同步完成：本机同步 {localSynced}，本机跳过 {localSkipped}；跨节点发送 {sent}，跳过 {skipped}。";
         readonly auth_cluster_audit_starting: "正在通知所有 auth sync 节点逐账号自检，协商最新有效凭据，并由本节点刷新已满 8 天的 auth...";
         readonly auth_cluster_audit_blocked_active: "集群 auth 自检要求本机所有 runtime、审批、待输入、登录和 auth 镜像写入均为空闲。";
@@ -1005,7 +1007,7 @@ declare const MESSAGES: {
         readonly auth_sync_trace_missing: "用法：/auth sync trace <requestId>";
         readonly button_login_device: "🔑 设备登录";
         readonly button_auth_reload: "🔄 重载 auth";
-        readonly button_auth_safe_sync: "🧷 安全同步";
+        readonly button_auth_safe_sync: "🩺 安全同步";
         readonly button_auth_cluster_audit: "🩺 全节点自检并同步";
         readonly button_auth_refresh_all_confirm: "⚠️ 接受风险并刷新";
         readonly button_auth_repair_login: "🔑 登录修复";
@@ -1117,7 +1119,7 @@ declare const MESSAGES: {
         readonly effort_adjusted_model: "{model} 不支持 {effort}，所以已自动调整推理强度。";
         readonly effort_change_blocked: "当前有回复在进行中，暂时不能切换推理强度。请先等待，或使用 /interrupt。";
         readonly effort_reset: "推理强度已重置为服务端默认值。";
-        readonly usage_effort: "用法：/effort <none|minimal|low|medium|high|xhigh|default>\n或者直接使用 /models 点按钮。";
+        readonly usage_effort: "用法：/effort <none|minimal|low|medium|high|xhigh|max|ultra|default>\n或者直接使用 /models 点按钮。";
         readonly model_does_not_support_effort: "{model} 不支持 {effort}。\n支持的强度：{supported}";
         readonly effort_configured: "已配置推理强度：{effort}";
         readonly usage_fast: "用法：/fast <on|off|toggle>";

package/dist/i18n.js

@@ -93,6 +93,7 @@ const MESSAGES = {
         status_user_agent: 'Codex/FoxClaw agent: {value}',
         status_current_thread: 'Current thread: {value}',
         status_configured_model: 'Configured model: {value}',
+        status_codex_home: 'Codex home: {value}',
         status_configured_effort: 'Configured effort: {value}',
         status_fast: 'Fast: {value}',
         status_collaboration_mode: 'Mode: {value}',
@@ -243,7 +244,7 @@ const MESSAGES = {
         auth_sync_test_sent: 'Auth sync test complete: sent {sent}, replies {replied}.',
         auth_sync_test_missing: 'Missing replies: {value}',
         auth_sync_push_blocked_active: 'Cannot push auth sync while any runtime, approval, input, login, or auth mirror write is active.',
-        auth_sync_safe_starting: 'Safely syncing auth across local bot runtimes and cross-node peers...',
+        auth_sync_safe_starting: 'Auditing every node, selecting the newest valid auth, and safely synchronizing the cluster...',
         auth_sync_safe_done: 'Safe auth sync complete: local synced {localSynced}, local skipped {localSkipped}; cross-node sent {sent}, skipped {skipped}.',
         auth_cluster_audit_starting: 'Asking all auth-sync peers to validate accounts, reconcile the newest usable credentials, and refresh credentials at least 8 days old...',
         auth_cluster_audit_blocked_active: 'Cluster auth check requires every local runtime, approval, input, login, and auth mirror write to be idle.',
@@ -280,7 +281,7 @@ const MESSAGES = {
         auth_sync_trace_missing: 'Usage: /auth sync trace <requestId>',
         button_login_device: '🔑 Login',
         button_auth_reload: '🔄 Reload auth',
-        button_auth_safe_sync: '🧷 Safe sync',
+        button_auth_safe_sync: '🩺 Safe sync',
         button_auth_cluster_audit: '🩺 Check all nodes and reconcile auth',
         button_auth_refresh_all_confirm: '⚠️ Accept risk & refresh',
         button_auth_repair_login: '🔑 Login repair',
@@ -392,7 +393,7 @@ const MESSAGES = {
         effort_adjusted_model: 'Effort {effort} is not supported by {model}, so it was adjusted.',
         effort_change_blocked: 'Cannot change reasoning effort while a turn is active. Use /interrupt or wait.',
         effort_reset: 'Configured effort reset to server default.',
-        usage_effort: 'Usage: /effort <none|minimal|low|medium|high|xhigh|default>\nOr just use /models and tap buttons.',
+        usage_effort: 'Usage: /effort <none|minimal|low|medium|high|xhigh|max|ultra|default>\nOr just use /models and tap buttons.',
         model_does_not_support_effort: '{model} does not support {effort}.\nSupported: {supported}',
         effort_configured: 'Configured effort: {effort}',
         usage_fast: 'Usage: /fast <on|off|toggle>',
@@ -816,6 +817,7 @@ const MESSAGES = {
         status_user_agent: 'Codex/FoxClaw 标识：{value}',
         status_current_thread: '当前线程：{value}',
         status_configured_model: '已配置模型：{value}',
+        status_codex_home: 'Codex Home：{value}',
         status_configured_effort: '已配置推理强度：{value}',
         status_fast: 'Fast：{value}',
         status_collaboration_mode: '模式：{value}',
@@ -966,7 +968,7 @@ const MESSAGES = {
         auth_sync_test_sent: 'auth sync 测试完成：已发送 {sent}，收到回应 {replied}。',
         auth_sync_test_missing: '未回应：{value}',
         auth_sync_push_blocked_active: '当前有任一 runtime、审批、待输入、登录或 auth 镜像写入在进行中，不能推送 auth 同步。',
-        auth_sync_safe_starting: '正在安全同步本机多 bot runtime 和跨节点 auth...',
+        auth_sync_safe_starting: '正在自检全部节点、选择最新有效 auth，并安全同步整个集群...',
         auth_sync_safe_done: '安全 auth 同步完成：本机同步 {localSynced}，本机跳过 {localSkipped}；跨节点发送 {sent}，跳过 {skipped}。',
         auth_cluster_audit_starting: '正在通知所有 auth sync 节点逐账号自检，协商最新有效凭据，并由本节点刷新已满 8 天的 auth...',
         auth_cluster_audit_blocked_active: '集群 auth 自检要求本机所有 runtime、审批、待输入、登录和 auth 镜像写入均为空闲。',
@@ -1003,7 +1005,7 @@ const MESSAGES = {
         auth_sync_trace_missing: '用法：/auth sync trace <requestId>',
         button_login_device: '🔑 设备登录',
         button_auth_reload: '🔄 重载 auth',
-        button_auth_safe_sync: '🧷 安全同步',
+        button_auth_safe_sync: '🩺 安全同步',
         button_auth_cluster_audit: '🩺 全节点自检并同步',
         button_auth_refresh_all_confirm: '⚠️ 接受风险并刷新',
         button_auth_repair_login: '🔑 登录修复',
@@ -1115,7 +1117,7 @@ const MESSAGES = {
         effort_adjusted_model: '{model} 不支持 {effort}，所以已自动调整推理强度。',
         effort_change_blocked: '当前有回复在进行中，暂时不能切换推理强度。请先等待，或使用 /interrupt。',
         effort_reset: '推理强度已重置为服务端默认值。',
-        usage_effort: '用法：/effort <none|minimal|low|medium|high|xhigh|default>\n或者直接使用 /models 点按钮。',
+        usage_effort: '用法：/effort <none|minimal|low|medium|high|xhigh|max|ultra|default>\n或者直接使用 /models 点按钮。',
         model_does_not_support_effort: '{model} 不支持 {effort}。\n支持的强度：{supported}',
         effort_configured: '已配置推理强度：{effort}',
         usage_fast: '用法：/fast <on|off|toggle>',

package/dist/types.d.ts

@@ -11,7 +11,7 @@ export type SandboxModeValue = 'read-only' | 'workspace-write' | 'danger-full-ac
 export type AccessPresetValue = 'read-only' | 'default' | 'full-access';
 export type CollaborationModeValue = 'default' | 'plan';
 export type ActiveTurnMessageMode = 'steer' | 'queue';
-export type ReasoningEffortValue = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+export type ReasoningEffortValue = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | 'ultra';
 export type ThreadStatusKind = 'active' | 'idle' | 'notLoaded' | 'systemError';
 export interface ChatSessionSettings {
     /** Bridge scope id (e.g. `telegram:…`). */

package/docs/cross-node-auth-sync.md

@@ -153,11 +153,11 @@ Auth sync test complete: sent 1, replies 1.
 
 If it shows `Missing replies: @peer_bot`, Telegram delivery may have succeeded, but the peer did not receive, decrypt, pass allowlist validation, or run the same auth sync configuration.
 
-The `/auth` panel also provides **Check all nodes and reconcile auth** (`/auth sync audit`). It asks every configured peer to validate every local candidate against the usage endpoint, then:
+The `/auth` panel's **Safe sync** action (`/auth sync safe`; `/auth sync audit` remains a compatibility alias) performs the complete all-node audit and reconciliation flow. It asks every configured peer to validate every local candidate against the usage endpoint, then:
 
 - selects the newest usage-validated copy for each same-name, same-account and same-user identity and distributes it to every peer;
 - allows a validated older copy to replace a newer timestamped copy only when the newer copy failed this explicit audit;
-- marks a candidate `?` only when every peer responded, no node has a valid copy, and at least two nodes independently reported it invalid;
+- sends a single-node invalid candidate through the encrypted channel for validation-only checks on other nodes, without importing it, and marks it `?` only when no valid result exists and at least two nodes independently report it invalid;
 - leaves candidates unchanged when any peer is missing or busy, or when account/user identities conflict;
 - refreshes enabled ChatGPT candidates whose `last_refresh` is at least 8 days old on the initiating node, then distributes the refreshed copies.
 

package/docs/user-manual.md

@@ -268,7 +268,7 @@ foxclaw send-media /absolute/path/output.mp4 "caption"
 It controls:
 
 - Model: server default, or a model returned by app-server.
-- Reasoning effort: for example `low`, `medium`, `high`, or `xhigh`, depending on model support.
+- Reasoning effort: for example `low`, `medium`, `high`, `xhigh`, `max`, or `ultra`, depending on model support.
 - Fast tier: available when supported by the selected model.
 - Access: `read-only`, `default`, or `full-access`.
 - Mode: `Agent` or `Plan`.
@@ -433,13 +433,13 @@ Quota remaining: window:percent|auth
 [✅ 20|25|personal] [✅]
 [🔐 —|—|team]       [✅]
 [☑️ All] [Enabled] [Attention]
-[🛡️ Access]             [🔑 Login]
-[🔄 Reload auth]
+[🔑 Login]
+[🩺 Safe sync]
 ```
 
 The right-side `✅` / `⏸️` button controls whether the candidate participates in auto-rotation. Tapping it toggles enabled/disabled, and the refreshed list shows the new state. Tapping a candidate switches auth, restarts that runtime, and refreshes the same panel with its buttons intact so you can switch again immediately. `--` means no quota snapshot has been observed for that candidate yet. Health summaries distinguish ready, low quota, quota exhausted, quota unknown, not recently refreshed, API key, invalid auth file, and needs login repair states.
 
-The **Check all nodes and reconcile auth** button asks every configured auth-sync peer to validate its candidates. FoxClaw adopts the newest valid copy, distributes it, marks an account `?` only after complete multi-node invalid consensus, and has the initiating node refresh enabled ChatGPT credentials last refreshed at least 8 days ago. Missing, busy, or identity-conflicting peers prevent invalid marking and stale refresh for that run.
+The **Safe sync** button asks every configured auth-sync peer to validate candidates, adopts the newest valid same-account copy, and distributes it. A candidate that exists on only one node is sent to other nodes for validation only, without being imported; it is marked `?` only when no node validates it and at least two nodes independently reject it. The initiating node also refreshes enabled ChatGPT credentials last refreshed at least 8 days ago. Missing, busy, or identity-conflicting peers prevent stale refresh for that run.
 
 When an auth candidate has already failed while in use and FoxClaw cannot recover a newer same-account credential from local mirror or cross-node sync, it is marked as `needs login repair`. These candidates are skipped by auto-rotation and proactive refresh, and are hidden from the `Enabled` filter. Their row shows a `?` action. Tapping it opens two choices: Login repair starts device-code login with that candidate selected; Delete removes the candidate from canonical storage and all local bot runtimes, and clears cached quota for it.
 
@@ -497,7 +497,7 @@ Commands:
 - `/auth sync events [filter]`: show recent sync event records, optionally filtered by candidate, peer, request id, kind, stage, or detail.
 - `/auth sync trace <requestId>`: show recent records for one request id or event id.
 - `/auth sync test`: send an encrypted ping and wait for peer pong replies to verify peer config, shared key, and Bot-to-Bot private messages.
-- `/auth sync audit`: run the same validate, reconcile, consensus, stale-refresh, and distribution flow as the `/auth` cluster-check button.
+- `/auth sync safe`: run the same all-node validation, reconciliation, invalid verification, stale-refresh, and distribution flow as the `/auth` Safe sync button. `/auth sync audit` remains a compatibility alias.
 - `/auth sync push all`: manually broadcast all locally verified candidates without refreshing tokens. “Sent” does not mean the peer imported files; check `/auth sync status` and `/auth` on the peer.
 
 Equivalent commands:

package/docs/zh/cross-node-auth-sync.md

@@ -153,11 +153,11 @@ auth sync 测试完成：已发送 1，收到回应 1。
 
 如果显示 `未回应：@peer_bot`，说明 Telegram 发送可能成功，但对方没有成功接收、解密、通过 allowlist，或没有运行同一组 auth sync 配置。
 
-`/auth` 面板还提供 **全节点自检并同步**（命令等价入口是 `/auth sync audit`）。它会让所有已配置 peer 用 usage 接口逐个验证本机候选，然后：
+`/auth` 面板的 **安全同步**（命令等价入口是 `/auth sync safe`，旧的 `/auth sync audit` 仍兼容）会执行完整的全节点自检与同步。它会让所有已配置 peer 用 usage 接口逐个验证本机候选，然后：
 
 - 对同名、同 account、同 ChatGPT 用户身份的候选，选择最新且验证有效的副本并分发给所有 peer；
 - 只有显式审计已经证明时间戳更晚的副本无效时，才允许经过验证的较旧有效副本替换它；
-- 仅当所有 peer 都回应、没有任何有效副本，且至少两个节点独立判定无效时，才把候选标为 `?`；
+- 对只存在于单个节点的无效候选，会通过加密通道交给其他节点做只验证、不导入的复核；没有任何有效结果且至少两个节点独立判定无效时，才把候选标为 `?`；
 - 任一 peer 未回应、忙碌或账号/用户身份冲突时，不做无效裁决；
 - 由发起节点刷新 `last_refresh` 已满 8 天的已启用 ChatGPT 候选，再把刷新结果分发给所有 peer。
 

package/docs/zh/user-manual.md

@@ -268,7 +268,7 @@ foxclaw send-media /absolute/path/output.mp4 "说明"
 它能配置：
 
 - 模型：使用服务端默认模型，或选择 app-server 返回的模型。
-- reasoning effort：例如 `low`、`medium`、`high`、`xhigh`，取决于模型支持情况。
+- reasoning effort：例如 `low`、`medium`、`high`、`xhigh`、`max` 或 `ultra`，取决于模型支持情况。
 - Fast tier：模型支持时可开关 fast 服务档。
 - Access：`read-only`、`default`、`full-access`。
 - Mode：`Agent` 或 `Plan`。
@@ -433,13 +433,13 @@ Candidates: 2
 [✅ 20|25|personal] [✅]
 [🔐 —|—|team]       [✅]
 [☑️ 全部] [已启用] [需关注]
-[🛡️ Access]             [🔑 设备登录]
-[🔄 Reload auth]
+[🔑 设备登录]
+[🩺 安全同步]
 ```
 
 右侧 `✅` / `⏸️` 表示当前是否参与自动轮转。点一下会切换启用/禁用，列表刷新后图标会随状态变化。点击候选会切换 auth、重启对应 runtime，并在原消息上刷新面板且保留按钮，因此可以立即连续切换。`--` 表示该候选还没有额度历史快照。健康摘要会区分正常、额度偏低、额度耗尽、额度未知、长期未刷新、API key、无效 auth 文件和需要登录修复。
 
-**全节点自检并同步** 按钮会通知所有已配置 auth-sync peer 验证本机候选。FoxClaw 会采用并分发最新有效副本；只有完整的多节点无效共识才会标记 `?`；`last_refresh` 已满 8 天的已启用 ChatGPT auth 由发起节点刷新后再分发。存在未回应、忙碌或身份冲突节点时，本轮不会做无效裁决和临期刷新。
+**安全同步** 按钮会通知所有已配置 auth-sync peer 验证候选，采用并分发同账号最新有效副本。只存在于一台机器的无效候选也会交给其他节点做只验证、不导入的复核；没有任何节点验证有效且至少两个节点独立确认无效后才标记 `?`。`last_refresh` 已满 8 天的已启用 ChatGPT auth 由发起节点刷新后再分发。存在未回应、忙碌或身份冲突节点时，本轮不会做临期刷新。
 
 当某个候选在实际使用中已经失败，并且 FoxClaw 无法从本机 mirror 或跨节点同步恢复同账号较新凭据时，会标为“需要登录修复”。这类候选不会参与自动轮转和后台主动刷新，也不会出现在“已启用”筛选里。它的按钮会显示 `?`。点击后有两个选择：`登录修复` 会在选中该候选的状态下启动设备码登录；`删除` 会从 canonical 和所有本机 bot runtime 中删除这个候选，并清理它的额度缓存。
 
@@ -497,7 +497,7 @@ AUTH_AUTO_DELETE_NEEDS_REPAIR=false
 - `/auth sync events [过滤]`：查看最近同步事件，可按候选名、peer、request id、事件类型、阶段或详情过滤。
 - `/auth sync trace <requestId>`：查看某个 request id 或事件 id 的最近流水。
 - `/auth sync test`：发送加密 ping 并等待 peer 返回 pong，确认 peer、共享密钥和 Bot-to-Bot 私聊可用。
-- `/auth sync audit`：执行与 `/auth` 面板“全节点自检并同步”按钮相同的验证、协商、无效共识、临期刷新和分发流程。
+- `/auth sync safe`：执行与 `/auth` 面板“安全同步”按钮相同的全节点验证、协商、无效复核、临期刷新和分发流程。`/auth sync audit` 保留为兼容别名。
 - `/auth sync push all`：手动广播当前节点已验证的全部候选，不刷新 token；“已发送”不等于对端已经导入，需要在 peer 上看 `/auth sync status` 和 `/auth`。
 
 命令等价用法：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.5.76",
+  "version": "0.5.78",
   "description": "Foxden local execution claw for controlling Codex from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",