@foxden-app/foxclaw 0.5.9 → 0.5.11

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.5.11 - 2026-06-08
+
+### 中文
+- `/auth` 面板的 `Bot runtime` 现在显示 Telegram bot id，例如 `@WuguiAI2_Bot (bot8949529424)`，便于和 `~/.foxclaw/codex/telegram/<botid>/home` 对应。
+- `/auth` 面板新增“安全同步”按钮，并支持 `/auth sync safe`，可在全局空闲时安全打平本机多 bot auth，并把已校验的候选推送到跨节点 peer。
+- 本机 auth mirror 新增全量安全同步路径：只传播通过既有在线校验的刷新候选，同时补齐 canonical 中已知、同账号且更新的 runtime 副本。
+
+### English
+- The `/auth` panel now shows the Telegram bot id in `Bot runtime`, for example `@WuguiAI2_Bot (bot8949529424)`, making it easy to match the runtime with `~/.foxclaw/codex/telegram/<botid>/home`.
+- Added a Safe sync button to the `/auth` panel, plus `/auth sync safe`, to flatten same-node multi-bot auth while globally idle and push validated candidates to cross-node peers.
+- Added a full safe-sync path for the local auth mirror: it only propagates candidates that pass the existing online validation and fills runtime copies from newer same-account canonical candidates.
+
+## 0.5.10 - 2026-06-08
+
+### 中文
+- Telegram 输入队列改为 SQLite 持久化 FIFO，FoxClaw 重启后不再丢失排队中的 Codex 请求，并在 `/status` 中显示排队数量。
+- Telegram 图片和文件会先进入附件暂存区，支持媒体组归并、下一条文字自动带附件发给 Codex，以及“分析 / 清空”按钮操作。
+- 引导式 Plan 会话现在会持久化并在重启后恢复，减少长任务或确认流程被服务重启打断的风险。
+- `/update` 完成回报会从已安装包的 `CHANGELOG.md` 读取当前版本更新内容，让 Telegram 里直接看到这次升级改了什么。
+
+### English
+- Replaced the in-memory Telegram prompt queue with a persisted SQLite FIFO so queued Codex requests survive FoxClaw restarts, and `/status` now reports queued turn count.
+- Telegram photos and files are staged before dispatch, with media-group merging, next-message attachment consumption, and Analyze/Clear buttons.
+- Guided Plan sessions are persisted and restored after restart, reducing interruption risk for long-running or confirmation-based flows.
+- `/update` completion reports now read the installed package `CHANGELOG.md` entry for the target version so Telegram shows what changed in the upgrade.
+
 ## 0.5.9 - 2026-06-07
 
 ### 中文

package/README.md

@@ -39,6 +39,7 @@ FoxClaw（狸爪）的目标很直接：让你用手机控制本机的 Codex，
 - 已经装好，想系统了解 `/help`、`/setup`、`/threads`、`/watch`、`/auth` 和账号轮转？看 [用户手册](./docs/zh/user-manual.md)。
 - 想把同一组合法 ChatGPT auth 候选同步到多台机器？看 [跨节点 auth 同步配置指南](./docs/zh/cross-node-auth-sync.md)。
 - 想了解每个版本改了什么？看 [更新日志](./CHANGELOG.md)。
+- 维护者准备发版？看 [发布 runbook](./docs/zh/release.md)。
 - Git、Node、`.env` 都玩得转？直接往下看快速设置。
 - 卡住了？看 [故障排查](./docs/zh/troubleshooting.md)。
 

package/README_EN.md

@@ -39,6 +39,7 @@ FoxClaw is more than message forwarding. It provides Telegram panels for Codex w
 - Already installed and want the full command guide for `/help`, `/setup`, `/threads`, `/watch`, `/auth`, and auth rotation? Read the [User Manual](./docs/user-manual.md).
 - Want to sync the same legally owned ChatGPT auth candidate pool across multiple machines? Read the [Cross-Node Auth Sync Setup Guide](./docs/cross-node-auth-sync.md).
 - Want to see what changed in each release? Read the [Changelog](./CHANGELOG.md).
+- Maintaining a release? Use the [Release Runbook](./docs/release.md).
 - Already comfortable with Git, Node, and `.env` files? Use the quick setup below.
 - Something failed? Check [Troubleshooting](./docs/troubleshooting.md).
 

package/dist/auth/mirror.d.ts

@@ -52,6 +52,10 @@ export interface AuthMirrorSyncedEvent {
     status: AuthMirrorStatus;
     record: AuthMirrorCandidateRecord;
 }
+export interface AuthMirrorSyncAllResult {
+    synced: number;
+    skipped: number;
+}
 export interface AuthMirrorHooks {
     onSynced?: (event: AuthMirrorSyncedEvent) => Promise<void> | void;
 }
@@ -77,8 +81,10 @@ export declare class AuthCandidateMirror {
     readRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorCandidateRecord | null>;
     listNewestCandidates(): Promise<AuthMirrorCandidateRecord[]>;
     syncRuntimeCandidate(runtimeId: string, candidateName: string): Promise<boolean>;
+    syncAllRuntimeCandidates(): Promise<AuthMirrorSyncAllResult>;
     recoverRuntimeCandidate(runtimeId: string, candidateName: string): Promise<AuthMirrorRecovery | null>;
     private scan;
+    private distributeCanonicalCandidates;
     importExternalCandidate(candidateName: string, raw: string, source: {
         nodeId: string;
         label?: string | null;

package/dist/auth/mirror.js

@@ -126,6 +126,28 @@ export class AuthCandidateMirror {
             return false;
         return this.withActivity(() => this.propagateValidatedCandidate(runtime, candidateName));
     }
+    async syncAllRuntimeCandidates() {
+        return this.withActivity(async () => {
+            let synced = 0;
+            let skipped = 0;
+            for (const runtime of this.runtimes) {
+                const names = await listAuthCandidateNames(runtime.authDir);
+                for (const name of names) {
+                    if (await this.propagateValidatedCandidate(runtime, name)) {
+                        synced += 1;
+                    }
+                    else {
+                        skipped += 1;
+                    }
+                }
+            }
+            const distributed = await this.distributeCanonicalCandidates();
+            return {
+                synced: synced + distributed.synced,
+                skipped: skipped + distributed.skipped,
+            };
+        });
+    }
     async recoverRuntimeCandidate(runtimeId, candidateName) {
         if (!isAuthCandidateName(candidateName))
             return null;
@@ -169,6 +191,33 @@ export class AuthCandidateMirror {
             }
         });
     }
+    async distributeCanonicalCandidates() {
+        let synced = 0;
+        let skipped = 0;
+        for (const name of await listAuthCandidateNames(this.canonicalDir)) {
+            const canonical = await readChatGptAuthRecord(path.join(this.canonicalDir, name));
+            if (!canonical) {
+                skipped += this.runtimes.length;
+                continue;
+            }
+            for (const runtime of this.runtimes) {
+                const destinationPath = path.join(runtime.authDir, name);
+                const destination = await readChatGptAuthRecord(destinationPath);
+                if (destination && destination.accountId !== canonical.accountId) {
+                    skipped += 1;
+                    this.logger.warn('auth.mirror.distribution_conflict', { runtimeId: runtime.id, name });
+                    continue;
+                }
+                if (destination && destination.lastRefreshMs >= canonical.lastRefreshMs) {
+                    skipped += 1;
+                    continue;
+                }
+                await atomicWrite(destinationPath, canonical.raw);
+                synced += 1;
+            }
+        }
+        return { synced, skipped };
+    }
     async importExternalCandidate(candidateName, raw, source) {
         if (!isAuthCandidateName(candidateName)) {
             return { ok: false, imported: false, reason: 'invalid candidate name' };

package/dist/controller/controller.d.ts

@@ -19,6 +19,12 @@ export interface CoreCoordinator {
     }>;
     releaseAuthRefreshLease?: (leaseId: string | null) => Promise<void>;
     getAuthSyncStatus?: () => RuntimeStatus['authSync'];
+    authSyncSafeAll?: () => Promise<{
+        localSynced: number;
+        localSkipped: number;
+        sent: number;
+        skipped: number;
+    }>;
     authSyncPushAll?: () => Promise<{
         sent: number;
         skipped: number;
@@ -50,11 +56,9 @@ export declare class BridgeSessionCore {
     private activeTurns;
     private activeTurnsByTurnId;
     private observedThreadWatchers;
-    private queuedPrompts;
     private pendingTurnErrors;
     private pendingUserInputs;
     private pendingMcpElicitations;
-    private pendingPlanImplementations;
     private pendingLoginsByScope;
     private pendingLoginScopesById;
     private pendingAuthAddsByLoginId;
@@ -159,6 +163,8 @@ export declare class BridgeSessionCore {
     private maybeSendPlanImplementationPrompt;
     private findPendingPlanImplementation;
     private clearPlanImplementationPromptsForScope;
+    private pendingPlanImplementationFromSession;
+    private restoreGuidedPlanSessions;
     private hasPendingUserInputForTurn;
     private finalizeUserInputsForTurn;
     private handlePlanImplementationCallback;
@@ -173,8 +179,15 @@ export declare class BridgeSessionCore {
     private createBinding;
     private startTurnWithRecovery;
     private buildTurnInput;
+    private buildTurnInputFromStagedAttachments;
     private resolveServiceTierForTurn;
     private stageAttachments;
+    private handleTelegramAttachmentBatch;
+    private consumePendingAttachmentBatchWithText;
+    private handleAttachmentBatchCallback;
+    private consumePendingAttachmentBatch;
+    private startTurnFromPreparedAttachmentBatch;
+    private renderAttachmentBatchCard;
     private registerActiveTurn;
     private createActiveTurnState;
     getCurrentAuthLabel(): Promise<string | null>;
@@ -247,7 +260,11 @@ export declare class BridgeSessionCore {
     private handleActiveTurnInboundMessage;
     private queuePromptAfterActiveTurn;
     private steerActiveTurn;
+    private enqueuePreparedTurnInput;
+    private startBoundTurnFromQueuedInput;
     private startQueuedPromptIfPresent;
+    private recoverQueuedTurns;
+    private markQueuedTurnCompleted;
     private handleModeCommand;
     private handleActiveTurnMessageModeCommand;
     private handleGoalCommand;
@@ -263,6 +280,7 @@ export declare class BridgeSessionCore {
     private clearSelfUpdateStatusPoll;
     private pollSelfUpdateStatus;
     private formatSelfUpdateResult;
+    private formatSelfUpdateReleaseNotes;
     private formatCodexUpdateResult;
     private scheduleProactiveAuthRefresh;
     private clearProactiveAuthRefreshTimer;
@@ -271,6 +289,7 @@ export declare class BridgeSessionCore {
     private notifyProactiveAuthRefresh;
     private handleAuthCommand;
     private handleAuthSyncCommand;
+    private runAuthSafeSyncAll;
     private handleAuthRefreshAllCommand;
     private handleAuthUseCommand;
     private handleAuthToggleCommand;