@foxden-app/foxclaw 0.7.2 → 0.7.3

package/.env.example

@@ -1,5 +1,6 @@
 # Required for new installs: one or more bot tokens for this host.
 # Comma-separated bot tokens. By default, each bot gets an independent Codex runtime/auth selection.
+# Homes use ~/.foxclaw/codex/telegram/@TelegramUsername/home (old numeric paths remain as links).
 TG_BOT_TOKENS=<telegram_bot_token>
 # Backward-compatible single-runtime setup.
 # In TG_BOT_TOKENS mode, if this exact token is also present in TG_BOT_TOKENS,

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.7.3 - 2026-09-05
+
+### 中文
+- 修复代理或网络不稳时 Telegram、Codex RPC 和 WebSocket 可能长期无响应的问题：请求有明确截止时间，活动会话断连、恢复失败和 writer 冲突都会给出可继续操作的错误，不重放结果未知的请求。
+- 登录、auth add 和 auth repair 流程增加取消按钮；取消失败也释放本地流程，旧按钮和其他聊天不能误取消当前登录。
+- 新增 `/cli` 与 `foxclaw resume`，可让终端连接桥的同一 Codex app-server；`/watch` 继续只读，外部 CLI 的消息可用原生线程队列安全排队。
+- 新增 `/takeover --force <消息>`：可信 Telegram 用户二次确认后，可精确停止占用目标 thread 的本机交互式 CLI，验证锁释放并恢复原 thread 后再提交消息。进程、锁或 thread 身份变化时明确拒绝，不删除锁、不改写 session 文件。
+- 多 bot Codex 数据目录默认使用真实 `@Telegram用户名`。迁移既有数字目录并保留兼容链接，共享终端的 bot 使用同名目录入口指向原 home。
+- 并行读取用户名，断网重启沿用已有名称；媒体发送通过稳定身份记录保持正确路由，目录冲突明确报错。
+- auth 问号、修复和删除操作会重新读取最新状态；安全同步文案区分“已发送”和“远端已导入”，状态更新未生效时不再报告虚假成功。
+
+### English
+- Bound Telegram, Codex RPC, and WebSocket waits so unstable proxy or network links fail explicitly instead of hanging. Active-session disconnects, recovery failures, and writer conflicts now include actionable recovery guidance without replaying ambiguous requests.
+- Added cancel buttons to login, auth-add, and auth-repair flows. Local state is released even when cancellation fails, while stale or foreign-chat buttons cannot cancel the current login.
+- Added `/cli` and `foxclaw resume` to connect a terminal to the bridge's Codex app-server. `/watch` remains read-only and external CLI prompts use Codex's native thread queue.
+- Added `/takeover --force <message>` for a trusted Telegram user to confirm a precise local interactive-CLI handoff. FoxClaw revalidates process, lock, and thread identity, verifies lock release, resumes the original thread, and only then submits the prompt; it never deletes locks or edits session files.
+- Name multi-bot Codex homes after verified Telegram usernames, migrating numeric directories with compatibility links and preserving shared terminal homes.
+- Resolve usernames in parallel, reuse stored paths offline, preserve media routing through stable identity metadata, and reject directory conflicts.
+- Auth repair/question-mark/delete actions now refresh current state first. Safe-sync wording distinguishes dispatch from confirmed remote import, and unapplied state changes no longer report false success.
+
 ## 0.7.2 - 2026-08-30
 
 ### 中文

package/README.md

@@ -30,7 +30,7 @@ FoxClaw（狸爪）的目标很直接：让你用手机控制本机的 Codex 或
 
 ![FoxClaw Telegram 功能预览](./docs/assets/telegram-preview-zh.svg)
 
-手机端不是简单转发消息，而是给 Codex 的常用工作流做了 Telegram 面板：`/setup` 调模型、推理强度、Fast tier、权限和 Agent/Plan 模式；`/auth` 管理多个 Codex 登录候选，触发限制时自动轮转；`/threads`、`/watch` 和审批按钮用于切线程、观察进度和处理权限请求。
+手机端不是简单转发消息，而是给 Codex 的常用工作流做了 Telegram 面板：`/setup` 调模型、推理强度、Fast tier、权限和 Agent/Plan 模式；`/auth` 管理多个 Codex 登录候选，触发限制时自动轮转；`/threads`、`/watch` 和审批按钮用于切线程、观察进度和处理权限请求。终端 CLI 卡住且持有 thread 时，可信用户还可用 `/takeover --force <消息>` 核对 PID、目录并二次确认，将同一 thread 安全交给桥继续执行。
 
 ## 从这里开始
 

package/README_EN.md

@@ -30,7 +30,7 @@ No public server required. FoxClaw runs on your own computer, talks to `codex ap
 
 ![FoxClaw Telegram feature preview](./docs/assets/telegram-preview-en.svg)
 
-FoxClaw is more than message forwarding. It provides Telegram panels for Codex workflows: `/setup` adjusts model, reasoning, Fast tier, access, and Agent/Plan mode; `/auth` manages multiple Codex auth candidates and rotates them on usage limits; `/threads`, `/watch`, and approval buttons handle thread switching, progress monitoring, and permission requests.
+FoxClaw is more than message forwarding. It provides Telegram panels for Codex workflows: `/setup` adjusts model, reasoning, Fast tier, access, and Agent/Plan mode; `/auth` manages multiple Codex auth candidates and rotates them on usage limits; `/threads`, `/watch`, and approval buttons handle thread switching, progress monitoring, and permission requests. If a local interactive Codex CLI is stuck while holding a thread, the trusted Telegram user can use `/takeover --force <message>`, verify its PID and working directory, and explicitly confirm a safe handoff to the bridge.
 
 ## Start Here
 

package/dist/auth/cross_node_sync.js

@@ -776,11 +776,11 @@ export class CrossNodeAuthSync {
         this.recordEvent({
             direction: 'local',
             kind: 'audit.state',
-            stage: message.state,
+            stage: applied ? message.state : 'skipped',
             peer: null,
             requestId: message.requestId,
             candidateName: message.candidateName,
-            detail: null,
+            detail: applied ? null : 'local candidate did not match the audited identity or refresh timestamp',
         });
     }
     async buildAuditReport() {

package/dist/codex_app/client.d.ts

@@ -78,6 +78,7 @@ export declare class CodexAppClient extends EventEmitter {
     private port;
     private connected;
     private userAgent;
+    private readonly requestTimeoutMs;
     constructor(codexCliBin: string, launchCommand: string, autolaunch: boolean, serverStatePath: string, serverLogPath: string, logger: Logger, childEnv?: NodeJS.ProcessEnv | null, appServerConfigOverrides?: readonly string[]);
     isConnected(): boolean;
     getUserAgent(): string | null;

package/dist/codex_app/client.js

@@ -33,6 +33,7 @@ export class CodexAppClient extends EventEmitter {
     port = null;
     connected = false;
     userAgent = null;
+    requestTimeoutMs = 30_000;
     constructor(codexCliBin, launchCommand, autolaunch, serverStatePath, serverLogPath, logger, childEnv = null, appServerConfigOverrides = []) {
         super();
         this.codexCliBin = codexCliBin;
@@ -577,6 +578,9 @@ export class CodexAppClient extends EventEmitter {
                 port: state.port,
                 error: error instanceof Error ? error.message : String(error),
             });
+            if (isProcessAlive(state.pid)) {
+                throw new Error(`Managed Codex app-server pid ${state.pid} is alive but unreachable; retry the connection or explicitly restart it.`, { cause: error });
+            }
             this.clearServerStateForPid(state.pid);
             return false;
         }
@@ -588,11 +592,18 @@ export class CodexAppClient extends EventEmitter {
             try {
                 await new Promise((resolve, reject) => {
                     const ws = new WebSocket(url);
+                    const timer = setTimeout(() => {
+                        ws.close();
+                        reject(new Error('WebSocket handshake timed out'));
+                    }, 2000);
                     const onError = (event) => {
+                        clearTimeout(timer);
                         ws.close();
                         reject(new Error(`WebSocket connect failed: ${String(event.type)}`));
                     };
                     ws.addEventListener('open', () => {
+                        clearTimeout(timer);
+                        ws.removeEventListener('error', onError);
                         this.socket = ws;
                         this.connected = true;
                         ws.addEventListener('message', message => this.handleMessage(String(message.data)));
@@ -608,7 +619,12 @@ export class CodexAppClient extends EventEmitter {
                             });
                         });
                         ws.addEventListener('error', err => {
-                            this.logger.warn('codex.ws.error', String(err.message ?? 'unknown'));
+                            this.logger.warn('codex.ws.error', { message: err.message || 'WebSocket transport error', port: this.port });
+                            if (this.socket === ws) {
+                                this.socket = null;
+                                ws.close();
+                                this.handleDisconnect({ source: 'websocket-error', port: this.port });
+                            }
                         });
                         resolve();
                     }, { once: true });
@@ -649,8 +665,22 @@ export class CodexAppClient extends EventEmitter {
         }
         const id = String(++this.requestId);
         return new Promise((resolve, reject) => {
-            this.pending.set(id, { resolve, reject });
-            this.send({ jsonrpc: '2.0', id, method, params });
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                this.logger.warn('codex.request_timeout', { method, timeoutMs: this.requestTimeoutMs });
+                reject(new Error(`Codex request timed out: ${method}. The result is unknown; check /status or use foxclaw resume before retrying.`));
+            }, this.requestTimeoutMs);
+            this.pending.set(id, {
+                resolve: (value) => { clearTimeout(timer); resolve(value); },
+                reject: (error) => { clearTimeout(timer); reject(error); },
+            });
+            try {
+                this.send({ jsonrpc: '2.0', id, method, params });
+            }
+            catch (error) {
+                this.pending.get(id)?.reject(error);
+                this.pending.delete(id);
+            }
         });
     }
     send(payload) {
@@ -690,6 +720,7 @@ export class CodexAppClient extends EventEmitter {
         }
     }
     handleDisconnect(meta) {
+        this.logger.warn('codex.disconnected', meta);
         if (this.connected) {
             this.connected = false;
         }
@@ -711,7 +742,7 @@ export class CodexAppClient extends EventEmitter {
         this.reconnectTimer = setTimeout(async () => {
             this.reconnectTimer = null;
             try {
-                await this.startServer();
+                await this.start();
             }
             catch (error) {
                 this.logger.error('codex.reconnect_failed', { error: String(error) });

package/dist/codex_app/force_takeover.d.ts

@@ -0,0 +1,12 @@
+export interface ExternalWriterIdentity {
+    pid: number;
+    startTime: string;
+    exe: string;
+    lockDevice: string;
+    lockInode: string;
+    cwd: string;
+}
+export declare const externalWriterControl: {
+    inspect(home: string, threadId: string): Promise<ExternalWriterIdentity>;
+    stop(home: string, threadId: string, expected: ExternalWriterIdentity): Promise<void>;
+};

package/dist/codex_app/force_takeover.js

@@ -0,0 +1,27 @@
+import { execFile } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const helper = fileURLToPath(new URL('../../scripts/force-takeover.py', import.meta.url));
+async function runHelper(home, threadId, expected) {
+    if (process.platform !== 'linux')
+        throw new Error('Force takeover requires Linux/WSL with pidfd support');
+    const args = [helper, home, threadId];
+    if (expected)
+        args.push(JSON.stringify(expected));
+    const { stdout } = await execFileAsync('python3', args, { timeout: 12_000, maxBuffer: 16_384 });
+    const response = JSON.parse(stdout);
+    if (!response.ok)
+        throw new Error(response.error ?? 'External writer inspection failed');
+    return response.result;
+}
+export const externalWriterControl = {
+    async inspect(home, threadId) {
+        return await runHelper(home, threadId);
+    },
+    async stop(home, threadId, expected) {
+        const result = await runHelper(home, threadId, expected);
+        if (result.stopped !== true)
+            throw new Error('CLI stop was not confirmed');
+    },
+};

package/dist/controller/controller.d.ts

@@ -66,6 +66,9 @@ export declare class BridgeSessionCore {
     private pendingUserInputs;
     private pendingMcpElicitations;
     private pendingLoginsByScope;
+    private externalWriterControl;
+    private forceTakeoversInProgress;
+    private pendingForceTakeovers;
     private pendingLoginScopesById;
     private pendingAuthAddsByLoginId;
     private latestTurnDiffs;
@@ -287,6 +290,8 @@ export declare class BridgeSessionCore {
     private applyObservedSessionEvents;
     private applyObservedTurnSnapshot;
     private handleTakeoverCommand;
+    private prepareForceTakeover;
+    private handleForceTakeoverCallback;
     private handleQueueCommand;
     private handleActiveTurnInboundMessage;
     private queueObservedThreadMessage;
@@ -341,6 +346,7 @@ export declare class BridgeSessionCore {
     private handleVoiceCallback;
     private sendVoiceForText;
     private handleLoginDeviceCommand;
+    private loginCancelKeyboard;
     private handleLoginCancelCommand;
     private handleLogoutCommand;
     private handleSteerCommand;
@@ -377,6 +383,7 @@ export declare class BridgeSessionCore {
     private requireReadyBinding;
     private handleAuthPanelActionCallback;
     private handleAuthListViewCallback;
+    private refreshRepairedAuthChoice;
     private handleAuthRepairMenuCallback;
     private handleAuthRepairActionCallback;
     private handleAuthToggleCallback;

package/dist/controller/controller.js

@@ -2,6 +2,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { externalWriterControl } from '../codex_app/force_takeover.js';
 import { TELEGRAM_VOICE_MAX_BYTES, TELEGRAM_VOICE_SUPPORTED_EXTENSIONS, telegramVoiceContentType, } from '../voice/files.js';
 import { normalizeLocale, t } from '../i18n.js';
 import { chatGptAuthMetadataMatchesCandidateName, parseChatGptAuthMetadata, readChatGptAuthRecord, readChatGptAuthMetadata, } from '../auth/mirror.js';
@@ -64,6 +65,8 @@ const DYNAMIC_HELP_COMMANDS = [
     { key: 'quota', line: '/quota' },
     { key: 'update', line: '/update' },
     { key: 'login_device', line: '/login_device' },
+    { key: 'login_cancel', line: '/login_cancel' },
+    { key: 'cli', line: '/cli' },
     { key: 'threads_archived', line: '/threads archived [query]' },
     { key: 'open', line: '/open <n>' },
     { key: 'goal', line: '/goal [objective|pause|resume|done|budget <tokens|off>|clear confirm]' },
@@ -122,6 +125,9 @@ export class BridgeSessionCore {
     pendingUserInputs = new Map();
     pendingMcpElicitations = new Map();
     pendingLoginsByScope = new Map();
+    externalWriterControl = externalWriterControl;
+    forceTakeoversInProgress = new Set();
+    pendingForceTakeovers = new Map();
     pendingLoginScopesById = new Map();
     pendingAuthAddsByLoginId = new Map();
     latestTurnDiffs = new Map();
@@ -182,9 +188,7 @@ export class BridgeSessionCore {
             this.updateStatus();
         });
         this.bot.on('text', (event) => {
-            void this.withLock(event.scopeId, async () => this.handleText(event)).catch((error) => {
-                void this.handleAsyncError('telegram.text', error, event.scopeId);
-            });
+            this.dispatchInboundLikeTelegramText(event);
         });
         this.bot.on('callback', (event) => {
             void this.handleCallback(event).catch((error) => {
@@ -197,7 +201,14 @@ export class BridgeSessionCore {
      * (used by the Weixin adapter).
      */
     dispatchInboundLikeTelegramText(event) {
-        void this.withLock(event.scopeId, async () => this.handleText(event)).catch((error) => {
+        const command = event.attachments.length === 0 ? parseCommand(event.text) : null;
+        const name = command?.name;
+        // Recovery commands must remain reachable while a normal command is waiting.
+        // handleText still performs normal addressing and authorization checks.
+        const urgent = name && (['status', 'cli', 'login_cancel', 'interrupt'].includes(name)
+            || (name === 'auth' && command?.args[0] === 'sync' && ['status', 'events', 'trace'].includes(command.args[1] ?? 'status')));
+        const task = urgent ? this.handleText(event) : this.withLock(event.scopeId, async () => this.handleText(event));
+        void task.catch((error) => {
             void this.handleAsyncError('channel.text', error, event.scopeId);
         });
     }
@@ -230,6 +241,15 @@ export class BridgeSessionCore {
             this.attachedThreads.clear();
             this.threadTokenUsageAlerts.clear();
             if (!this.stopping) {
+                if (!this.codexReconnectPending) {
+                    for (const scopeId of new Set([...this.activeTurns.values()].filter(active => !active.isObserved).map(active => active.scopeId))) {
+                        const locale = this.localeForChat(scopeId);
+                        void this.sendMessage(scopeId, locale === 'zh'
+                            ? 'Codex 连接中断，正在重连。任务结果尚未确认，请先用 /status 检查；也可用 /cli 从本机继续。'
+                            : 'Codex disconnected; reconnecting. The task result is unconfirmed. Check /status or use /cli locally.')
+                            .catch(error => this.logger.warn('codex.disconnect_notice_failed', { scopeId, error: toErrorMeta(error) }));
+                    }
+                }
                 this.codexReconnectPending = true;
                 this.pauseAppSnapshotWatchers();
             }
@@ -582,6 +602,20 @@ export class BridgeSessionCore {
                 await this.handleLoginCancelCommand(scopeId, locale, args);
                 return;
             }
+            case 'cli': {
+                const binding = this.store.getBinding(scopeId);
+                const server = this.app.getServerStatus();
+                if (!server.running || !server.port) {
+                    await this.sendMessage(scopeId, locale === 'zh' ? 'Codex 服务不可用，请在本机检查 foxclaw status。' : 'Codex server unavailable. Check foxclaw status locally.');
+                    return;
+                }
+                const threadArg = binding ? ` ${JSON.stringify(binding.threadId)}` : '';
+                await this.sendMessage(scopeId, (locale === 'zh'
+                    ? '在运行桥的这台机器上执行，进入同一个 Codex 服务后可中断或继续会话：\n'
+                    : 'Run on the bridge host to interrupt or continue in the same Codex server:\n')
+                    + `codex resume --remote ws://127.0.0.1:${server.port}${threadArg}`);
+                return;
+            }
             case 'logout': {
                 await this.handleLogoutCommand(scopeId, locale, args);
                 return;
@@ -1072,6 +1106,21 @@ export class BridgeSessionCore {
     async handleCallback(event) {
         const scopeId = event.scopeId;
         const locale = this.localeForChat(scopeId, event.languageCode);
+        if (this.forceTakeoversInProgress.has(scopeId)) {
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'force_takeover_busy'));
+            return;
+        }
+        const forceTakeoverMatch = /^takeover:(confirm|cancel):([a-f0-9]+)$/.exec(event.data);
+        if (forceTakeoverMatch) {
+            await this.handleForceTakeoverCallback(event, locale, forceTakeoverMatch[1], forceTakeoverMatch[2]);
+            return;
+        }
+        const loginCancelMatch = /^login:cancel:(.+)$/.exec(event.data);
+        if (loginCancelMatch) {
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'button_cancel'));
+            await this.handleLoginCancelCommand(scopeId, locale, [loginCancelMatch[1]]);
+            return;
+        }
         const interruptMatch = /^turn:interrupt:(.+)$/.exec(event.data);
         if (interruptMatch) {
             await this.handleTurnInterruptCallback(event, interruptMatch[1], locale);
@@ -3654,7 +3703,9 @@ export class BridgeSessionCore {
         if (!scopeId)
             return;
         try {
-            await this.sendMessage(scopeId, t(this.localeForChat(scopeId), 'bridge_error', { error: formatUserError(error) }));
+            const locale = this.localeForChat(scopeId);
+            const hint = isThreadActiveWriterError(error) ? `\n${t(locale, 'force_takeover_hint')}` : '';
+            await this.sendMessage(scopeId, t(locale, 'bridge_error', { error: formatUserError(error) }) + hint);
         }
         catch (notifyError) {
             this.logger.error('telegram.error_notification_failed', { error: toErrorMeta(notifyError), scopeId });
@@ -3887,7 +3938,7 @@ export class BridgeSessionCore {
             }
         }
         for (const active of [...this.activeTurns.values()]) {
-            if (recoveredScopes.has(active.scopeId) || !this.getActiveTurn(active.scopeId, active.turnId)) {
+            if (active.isObserved || recoveredScopes.has(active.scopeId) || !this.getActiveTurn(active.scopeId, active.turnId)) {
                 continue;
             }
             try {
@@ -3900,6 +3951,10 @@ export class BridgeSessionCore {
                     turnId: active.turnId,
                     error: toErrorMeta(error),
                 });
+                await this.sendMessage(active.scopeId, this.localeForChat(active.scopeId) === 'zh'
+                    ? '连接已恢复，但无法确认原任务状态。任务未自动重发，请用 /cli 检查原会话后再继续。'
+                    : 'Connected again, but the original task state could not be confirmed. It was not resent. Use /cli to inspect the session.')
+                    .catch(notifyError => this.logger.warn('codex.recovery_notice_failed', { error: toErrorMeta(notifyError) }));
             }
         }
         await this.recoverQueuedTurns();
@@ -4246,6 +4301,10 @@ export class BridgeSessionCore {
         }
     }
     async handleTakeoverCommand(event, locale, args) {
+        if (args[0] === '--force') {
+            await this.prepareForceTakeover(event, locale, args.slice(1).join(' ').trim());
+            return;
+        }
         const scopeId = event.scopeId;
         const nextPrompt = args.join(' ').trim();
         if (!nextPrompt) {
@@ -4263,10 +4322,113 @@ export class BridgeSessionCore {
                 await this.requestInterrupt(active);
             }
             await this.sendMessage(scopeId, t(locale, 'interrupt_requested_waiting'));
-            await active.completion;
+            let timer;
+            try {
+                await Promise.race([
+                    active.completion,
+                    new Promise((_, reject) => {
+                        timer = setTimeout(() => reject(new Error(locale === 'zh'
+                            ? '等待中断完成超时，尚未发送新任务。请用 /status 检查，或用 /cli 从终端恢复。'
+                            : 'Interrupt confirmation timed out. No replacement task was sent. Check /status or use /cli to recover.')), 30_000);
+                    }),
+                ]);
+            }
+            finally {
+                clearTimeout(timer);
+            }
         }
         await this.startBoundTurnFromEvent(event, locale, nextPrompt);
     }
+    async prepareForceTakeover(event, locale, prompt) {
+        const scopeId = event.scopeId;
+        this.pendingForceTakeovers.delete(scopeId);
+        if (!prompt) {
+            await this.sendMessage(scopeId, t(locale, 'usage_takeover'));
+            return;
+        }
+        if (!scopeId.startsWith('telegram:') || event.userId !== this.config.tgAllowedUserId) {
+            await this.sendMessage(scopeId, t(locale, 'force_takeover_trusted_telegram_only'));
+            return;
+        }
+        const binding = this.store.getBinding(scopeId);
+        if (!binding) {
+            await this.sendMessage(scopeId, t(locale, 'watch_no_thread_bound'));
+            return;
+        }
+        const home = this.config.codexHome ?? process.env.CODEX_HOME ?? path.join(os.homedir(), '.codex');
+        try {
+            const writer = await this.externalWriterControl.inspect(home, binding.threadId);
+            const id = crypto.randomBytes(8).toString('hex');
+            this.pendingForceTakeovers.set(scopeId, {
+                id, expiresAt: Date.now() + 60_000, event, threadId: binding.threadId, home, prompt, writer,
+            });
+            await this.sendMessage(scopeId, t(locale, 'force_takeover_confirm', {
+                threadId: binding.threadId, pid: String(writer.pid), cwd: writer.cwd, prompt,
+            }), [[
+                    { text: t(locale, 'button_force_takeover'), callback_data: `takeover:confirm:${id}` },
+                    { text: t(locale, 'button_cancel'), callback_data: `takeover:cancel:${id}` },
+                ]]);
+        }
+        catch (error) {
+            this.pendingForceTakeovers.delete(scopeId);
+            await this.sendMessage(scopeId, t(locale, 'force_takeover_failed', { error: formatUserError(error) }));
+        }
+    }
+    async handleForceTakeoverCallback(event, locale, action, id) {
+        const scopeId = event.scopeId;
+        const pending = this.pendingForceTakeovers.get(scopeId);
+        if (!pending || pending.id !== id || pending.event.userId !== event.userId
+            || event.userId !== this.config.tgAllowedUserId || pending.expiresAt <= Date.now()) {
+            await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'force_takeover_expired'));
+            return;
+        }
+        // Claim before any await: duplicate callbacks cannot stop or submit twice.
+        this.pendingForceTakeovers.delete(scopeId);
+        await this.messaging.answerCallback(event.callbackQueryId, t(locale, action === 'cancel' ? 'button_cancel' : 'button_force_takeover'));
+        if (action === 'cancel') {
+            await this.sendMessage(scopeId, t(locale, 'force_takeover_cancelled'));
+            return;
+        }
+        await this.withLock(scopeId, async () => {
+            if (pending.expiresAt <= Date.now() || this.store.getBinding(scopeId)?.threadId !== pending.threadId) {
+                await this.sendMessage(scopeId, t(locale, 'force_takeover_expired'));
+                return;
+            }
+            if (this.externalAuthValidationInProgress) {
+                await this.sendMessage(scopeId, t(locale, 'auth_sync_validation_busy'));
+                return;
+            }
+            this.forceTakeoversInProgress.add(scopeId);
+            this.turnStartInProgress += 1;
+            try {
+                try {
+                    await this.sendMessage(scopeId, t(locale, 'force_takeover_stopping', { pid: String(pending.writer.pid) }));
+                    await this.externalWriterControl.stop(pending.home, pending.threadId, pending.writer);
+                    this.logger.warn('codex.external_writer_stopped', { scopeId, threadId: pending.threadId, pid: pending.writer.pid });
+                    await this.stopWatchingScopeThread(scopeId);
+                    this.attachedThreads.delete(attachedThreadKey(scopeId, pending.threadId));
+                    // Never replace a missing thread with an unrelated new conversation.
+                    const binding = this.store.getBinding(scopeId);
+                    if (binding?.threadId !== pending.threadId)
+                        throw new Error(t(locale, 'force_takeover_expired'));
+                    await this.ensureThreadReady(scopeId, binding, { recoverMissingThread: false });
+                }
+                catch (error) {
+                    await this.sendMessage(scopeId, t(locale, 'force_takeover_failed', { error: formatUserError(error) }));
+                    return;
+                }
+                this.store.cancelQueuedTurnInputs(scopeId);
+                await this.sendMessage(scopeId, t(locale, 'force_takeover_acquired', { threadId: pending.threadId }));
+                // Normal turn-start error handling preserves ambiguous submission failures;
+                // do not automatically retry a possibly accepted prompt.
+                await this.startBoundTurnFromEvent(pending.event, locale, pending.prompt);
+            }
+            finally {
+                this.forceTakeoversInProgress.delete(scopeId);
+                this.turnStartInProgress -= 1;
+            }
+        });
+    }
     async handleQueueCommand(event, locale, args) {
         const scopeId = event.scopeId;
         const nextPrompt = args.join(' ').trim();
@@ -5376,7 +5538,7 @@ export class BridgeSessionCore {
                 t(locale, 'login_code', { value: login.userCode }),
                 t(locale, 'login_id', { value: login.loginId }),
                 t(locale, 'login_cancel_hint', { value: login.loginId }),
-            ].join('\n'));
+            ].join('\n'), this.loginCancelKeyboard(login.loginId, locale));
         }
         catch (error) {
             await this.restoreAuthAfterAddFailure(state.authDir, state.authPath, state.currentTargetPath);
@@ -5419,7 +5581,7 @@ export class BridgeSessionCore {
                 t(locale, 'login_code', { value: login.userCode }),
                 t(locale, 'login_id', { value: login.loginId }),
                 t(locale, 'login_cancel_hint', { value: login.loginId }),
-            ].join('\n'));
+            ].join('\n'), this.loginCancelKeyboard(login.loginId, locale));
         }
         catch (error) {
             await this.restoreAuthAfterAddFailure(state.authDir, state.authPath, state.currentTargetPath);
@@ -5584,6 +5746,11 @@ export class BridgeSessionCore {
         }
     }
     async handleLoginDeviceCommand(scopeId, locale) {
+        const pendingLoginId = this.pendingLoginsByScope.get(scopeId);
+        if (pendingLoginId) {
+            await this.sendMessage(scopeId, t(locale, 'login_cancel_hint', { value: pendingLoginId }), this.loginCancelKeyboard(pendingLoginId, locale));
+            return;
+        }
         const login = await this.app.startDeviceLogin();
         const oldLoginId = this.pendingLoginsByScope.get(scopeId);
         if (oldLoginId) {
@@ -5598,24 +5765,41 @@ export class BridgeSessionCore {
             t(locale, 'login_code', { value: login.userCode }),
             t(locale, 'login_id', { value: login.loginId }),
             t(locale, 'login_cancel_hint', { value: login.loginId }),
-        ].join('\n'));
+        ].join('\n'), this.loginCancelKeyboard(login.loginId, locale));
+    }
+    loginCancelKeyboard(loginId, locale) {
+        return [[{ text: t(locale, 'button_cancel'), callback_data: `login:cancel:${loginId}` }]];
     }
     async handleLoginCancelCommand(scopeId, locale, args) {
         const loginId = args[0]?.trim() || this.pendingLoginsByScope.get(scopeId) || null;
-        if (!loginId) {
+        if (!loginId || this.pendingLoginsByScope.get(scopeId) !== loginId) {
             await this.sendMessage(scopeId, t(locale, 'login_cancel_no_pending'));
             return;
         }
         const pendingAuthAdd = this.pendingAuthAddsByLoginId.get(loginId) ?? null;
-        await this.app.cancelLogin(loginId);
+        // Claim cancellation before awaiting RPC: completion notifications may arrive first.
         this.pendingLoginsByScope.delete(scopeId);
         this.pendingLoginScopesById.delete(loginId);
         this.pendingAuthAddsByLoginId.delete(loginId);
+        let cancelError;
+        try {
+            await this.app.cancelLogin(loginId);
+        }
+        catch (error) {
+            cancelError = error;
+            this.logger.warn('codex.login_cancel_failed', { error: toErrorMeta(error) });
+        }
         if (pendingAuthAdd) {
             await this.restorePendingAuthAdd(pendingAuthAdd);
             await this.sendMessage(scopeId, t(locale, 'auth_add_cancelled'));
             return;
         }
+        if (cancelError) {
+            await this.sendMessage(scopeId, locale === 'zh'
+                ? '已退出本地登录流程，但未能确认服务端取消。请勿继续使用旧验证码；可重新登录或用 /codex_restart 重置登录服务。'
+                : 'Local login flow cleared, but server cancellation is unconfirmed. Do not use the old code; start a new login or use /codex_restart.');
+            return;
+        }
         await this.sendMessage(scopeId, t(locale, 'login_cancelled'));
     }
     async handleLogoutCommand(scopeId, locale, args) {
@@ -6162,6 +6346,20 @@ export class BridgeSessionCore {
             await this.editAuthPanelMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record), authChoiceKeyboard(locale, record));
         }
     }
+    async refreshRepairedAuthChoice(event, record, candidateName, locale) {
+        const state = await this.listCodexAuthState();
+        if (state.candidates.find(candidate => candidate.name === candidateName)?.state === 'needs_repair')
+            return false;
+        record.candidates = state.candidates;
+        record.createdAt = Date.now();
+        clampCodexAuthListOffset(record);
+        await this.messaging.answerCallback(event.callbackQueryId, locale === 'zh'
+            ? '授权状态已变化，已刷新面板。' : 'Auth state changed; panel refreshed.');
+        if (record.messageId !== null) {
+            await this.editAuthPanelMessage(event.scopeId, record.messageId, renderAuthListMessage(locale, state, this.authDisplayBotLabel(), parseWeixinBridgeScope(event.scopeId) !== null, record), authChoiceKeyboard(locale, record));
+        }
+        return true;
+    }
     async handleAuthRepairMenuCallback(event, localId, index, locale) {
         const record = this.pendingAuthChoiceLists.get(localId);
         if (!record) {
@@ -6177,6 +6375,8 @@ export class BridgeSessionCore {
             await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'unsupported_action'));
             return;
         }
+        if (await this.refreshRepairedAuthChoice(event, record, candidate.name, locale))
+            return;
         await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'auth_repair_actions_short'));
         if (record.messageId !== null) {
             await this.editAuthPanelMessage(event.scopeId, record.messageId, t(locale, 'auth_repair_actions_message', { value: formatCodexAuthCandidateDisplayName(candidate.name) }), authRepairKeyboard(locale, record, index));
@@ -6197,6 +6397,8 @@ export class BridgeSessionCore {
             await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'unsupported_action'));
             return;
         }
+        if (action !== 'cancel' && await this.refreshRepairedAuthChoice(event, record, candidate.name, locale))
+            return;
         if (action === 'cancel') {
             await this.messaging.answerCallback(event.callbackQueryId, t(locale, 'decision_recorded'));
             const state = await this.listCodexAuthState();