diff --git a/README.en.md b/README.en.md
index 6719a67f..ea4632c9 100644
--- a/README.en.md
+++ b/README.en.md
@@ -91,6 +91,7 @@ Injects a standalone "Usage" section at the bottom of Codex Desktop's "Toggle pi
 - **Injected system prompts follow the UI language**: the `apply_patch` chat-path rules + autocompact summarization prompt that this project injects for non-OpenAI providers track the `语言 / Language` setting (Chinese users → Chinese prompts, avoiding mixed-language model thinking); V4A keywords (`*** Begin Patch` / `@@ <header>` etc.) + Codex CLI error message originals stay in English (parser / matcher does not accept translations)
 - **Codex Desktop Theme (optional, off by default)**: Theme page ships 11 built-in anime themes (`carton` with a floating mascot, plus `changli` / `azurlane` / `nailin` / `zani` / `frost` / `nocturne` / `duet` / `rose` / `sonata` / `studio`), each individually colour-matched to its artwork (per-theme glass + accent). Injects design-token overrides (`--color-token-*` + the runtime `--color-*` layer) + a background image into Codex Desktop via CDP, covering chat / settings / collapsed-sidebar / popovers. Toggle is independent from Plugin Unlock; page reload re-applies automatically; disabling the toggle only clears the saved preference — any already-injected theme stays until the next Codex restart
 - **Usage panel inside Codex Desktop (optional, off by default)** (MOC-204): Settings → "Show usage in Codex" injects a collapsible "Usage" section at the bottom of Codex's "Toggle pinned summary" popup (the panel that contains Environment / Sources sections), showing up to 4 rows: ① **5-hour quota / weekly quota** — whitelisted providers only: **antigravity gemini series** reads from `cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary` (dual-window 5h + weekly, remaining% = remainingFraction×100); **GLM Coding Plan** (`bigmodel.cn` / `z.ai` coding hosts) reads from `monitor/usage/quota/limit` (apiKey auth, no Bearer prefix), returning 5h + weekly TOKENS_LIMIT records, converted as remaining% = 100 − usage%; **Xiaomi MiMo Token Plan** (`platform.xiaomimimo.com`) shows a monthly-plan remaining% progress bar — the plan quota is only accessible via a MiMo web session (httpOnly cookie), so you must click "Sign in to Xiaomi account" in the provider edit page first: the app opens an embedded webview for login, captures the session cookie, and the daemon uses it to query `/api/v1/tokenPlan/usage`; **DeepSeek** (`api.deepseek.com`) shows a ¥X balance numeric entry, read from the official `/user/balance` endpoint using the same API key (Bearer); **Kimi (月之暗面 / Moonshot PAYG, `api.moonshot.cn` / `.ai`)** shows balance numeric entries (available / cash / voucher, ¥/$ by host), read from the official `/v1/users/me/balance` using the same key (Bearer) — **note: the subscription-based `kimi-code` (`api.kimi.com/coding`) is a separate provider with no balance endpoint and is excluded**; **anyrouter** (`api.anyrouter.top`) shows a $X used-amount numeric entry, read from `/v1/dashboard/billing/usage` using the same key (Bearer; remaining balance is blocked by upstream anti-scraping so only the used amount is shown). Whitelist is determined by baseUrl host. Red warning ≤10% + reset time shown. Quota rows appear only when the active provider matches a whitelisted host; all others show no quota rows. ② **Context** — injected JS reads `contextUsage.usedTokens` + `contextWindow` directly from Codex's React fiber, available immediately for any existing conversation without a new turn; full window = contextWindow ÷ 0.95 (adds back the 5% reserve Codex hides); 1M models display "1M" not "1000k". ③ **Tokens (real-time rate · cumulative)** — rate estimated by a MutationObserver watching Codex's streaming text (2s sliding window, CJK-aware); cumulative total from Codex rollout. ④ **Cache hit rate** — from rollout cached_input/input. **③④ and the rate are all isolated per active conversation (MOC-230)**: injected JS reads the current `conversationId` from the React fiber and the daemon keys totals to that conversation's rollout (== filename uuid, not the most-recently-modified file), following conversation switches; shows "—" (never another conversation's data) when the id / its rollout can't be resolved. The "Usage" title is collapsible (chevron + localStorage-persisted). Injection uses periodic CDP pushes; re-attaches automatically after a Codex page reload or restart. Requires launching Codex through this app; restart Codex after toggling if already running.
+- **Codex mobile remote control (optional, off by default)** (MOC-249, M1): Settings → "Mobile remote control (Telegram)", fill in a Telegram Bot Token + an allowed-users whitelist (numeric user ids, comma-separated; only numeric ids are honored for security — usernames are mutable/reassignable and unsupported). When enabled, transfer runs a Telegram bot (pure HTTPS long-poll — no relay / public callback): authorized users message the bot from their phone to remotely drive the Codex launched by this app — transfer injects the prompt into Codex's composer (ProseMirror) over CDP, submits, and streams the reply back into the Telegram message. Commands: `/new` (new chat), `/stop` (stop current turn), `/status`, `/help`; plain text = one prompt turn. **⚠️ Remote control is equivalent to operating this machine remotely — only authorize your own account and keep the Bot Token safe**; requires launching Codex through this app (the toggle affects the debug port), restart Codex after toggling. M1 is conversational (if Codex needs to approve a command/tool, confirm on the desktop; approval-relay-to-phone is a later phase). The Windows Store (MSIX) build is unsupported due to the debug-port passthrough gap.
 - **System-proxy (VPN/ladder) connectivity detection** (MOC-114): the dashboard "Network Proxy" card shows live status — connected / disconnected / PAC auto-config / detecting. In relay real-account mode, the "Auto-unlock Codex Plugins" toggle gates on both conditions being met (valid account AND proxy reachable), preventing the silent-failure state where plugins spin and return 502s while the UI shows "logged in" because the proxy is down. Detection uses a short-timeout TCP connect to the proxy port only; chatgpt.com is never contacted.
 - **Built-in web fetch tool (web_fetch, MOC-144)**: Settings → "Built-in web fetch backend" — select `auto` (recommended; **defaults to `auto` since MOC-215, works out of the box** — new users get web_fetch / web_search without manually enabling it; web_fetch uses curl/wreq and needs no Chrome, web_search is still gated on Chrome readiness and never silently downloads) / `curl` / `wreq` / `headless` (**independent of** the Codex sandbox network toggle). Transfer automatically registers a `web_fetch` MCP tool with Codex, which the model can call directly to fetch web pages — `curl` uses standard HTTP, `wreq` bypasses Cloudflare TLS challenges, `headless` drives a headless Chrome to retrieve JS-rendered DOM (first-time headless use prompts to download chrome-headless-shell, ~86 MB, if Chrome is not installed). Beyond the three fetch backends, `web_fetch` also follows **HTML `meta refresh` / JS `location` redirects** (re-fetches the target URL, loop-protected to 3 hops) — curl/wreq/headless only follow HTTP 3xx and do not handle these client-side redirects; "placeholder" redirect pages (e.g. pages that bounce around Twitter/Substack blocks) are now automatically followed to the real destination (MOC-139). **`auto` tier (MOC-161)**: automatically escalates from curl → wreq → headless based on page-difficulty signals; remembers the last successful tier per origin so subsequent requests start there; downgrades to curl when no system proxy is reachable (wreq / headless rely on a proxy); first use of the headless tier still confirms the Chrome download. Switching tiers takes effect immediately (no restart needed); **toggling the feature on or off requires restarting Codex Desktop** for the network tools (web_fetch / web_search / read_url_local) to appear / disappear in Codex (since MOC-235 the MCP server stays registered to host `read_tool_artifact`; turning the network backend off just stops exposing those network tools rather than unloading the whole server). Fetched HTML is auto-converted to markdown before returning to the model (cleaner, fewer tokens; non-HTML responses pass through unchanged), and headless waits for networkIdle before capturing the rendered DOM (MOC-145). Headless fetches run with anti-detection stealth (strips `navigator.webdriver`, fakes `window.chrome`/plugins/WebGL, removes the `HeadlessChrome` UA token), passing passive-fingerprint / simple JS-challenge Cloudflare; interactive Turnstile/DataDome managed challenges still won't pass (MOC-152). On a CF JS-challenge page, headless now **waits in place for it to auto-clear** before reading (instead of returning the challenge page as content), and **persists the browser profile per origin** to reuse CF clearance cookies — a second fetch of the same site skips the repeat challenge and is faster (MOC-156). Before markdown conversion the page goes through **main-content extraction** (readability algorithm strips nav/header/footer/sidebar/ads, keeping only the article so large-page content is no longer crowded out by truncation; non-article pages fall back to the full page); **binary resources** (image / video / audio / PDF) and files over 16 MB are not downloaded and return a clear notice instead (no more garbage bytes / OOM) (MOC-152). `web_fetch` **returns the full extracted page text by default** (the current turn's tool output goes into the LLM context in full; the adapter layer automatically compresses older tool outputs to prevent context overflow; MOC-190) — no more pagination, no `offset` paging, no relevance-based `query` chunk selection, so precise content (code / schema / version numbers / figures) is never lost. If you fetched a URL earlier in the conversation and its content has since been folded/compressed in the context history, use **`read_url_local(url)`** to pull the full text from the in-process cache without re-fetching (cache TTL: 15 min). **More generally, when any tool's large output (shell / Feishu and other MCP / etc.) gets folded into a `[Tool output stored outside model context]` summary in history, the summary includes an `Artifact ID`, and the model can call `read_tool_artifact(artifact_id)` to retrieve that output's text** — read from the shared `tool_artifacts.db` (SQLite WAL, cross-process) that the proxy persists when compressing, so the model never re-runs a tool just to see history again; the retrieved content is visible only in the current turn and gets folded again next turn (no long-term context bloat); outputs over 90k chars are returned in pages (each below the proxy keep-full cap, with a trailer telling the model to page via `offset`) (MOC-235). These tools (`web_fetch` / `web_search` / `read_url_local` / `read_tool_artifact`) declare `readOnlyHint` (read-only), so Codex's auto-review guardian **skips approval** for them (`requires_mcp_tool_approval` short-circuits on the read-only hint) — network calls no longer incur a per-call risk-approval round-trip, removing that latency (MOC-172).
 - **Built-in web search tool (web_search, MOC-12)**: when the built-in web fetch backend is on (non-off) and the machine has Chrome ready, transfer registers a `web_search` tool with Codex — the model passes a query string and gets back a structured list of results (title + real URL + snippet), forming a **two-step search**: `web_search` to find sources, then `web_fetch` to read content, eliminating the need to guess URLs. **Why this matters**: Codex sends an OpenAI server-side `web_search` tool each turn, but third-party chat providers (MiniMax / DeepSeek / GLM / Kimi, etc.) don't support it — the adapter drops it, leaving the model to scrape search engines or guess URLs (real-world success rate ~17%). This tool queries **DuckDuckGo + Bing in parallel and merges the results, deduped by normalized URL** (no API key required, data-centre / VPN-exit IP friendly; the two indexes complement each other so single-call coverage is noticeably broader than a single source, MOC-215; previously Bing was only a fallback when DDG failed, MOC-186), and **always uses headless** internally — DDG / Bing block plain HTTP with anti-bot challenges regardless of TLS fingerprint, so a real browser is required; the parallel fetch keeps wall-time ≈ the slower single engine rather than the sum, and either engine being blocked / empty still leaves the other usable. `web_search` always uses headless internally, but its **exposure / invocation only requires Chrome to be ready** (system Chrome / Edge / Chromium, or an already-downloaded built-in chrome-headless-shell) — decoupled from the web_fetch tier: users with system Chrome can use search under any non-off tier (incl. curl / wreq) without triggering a download; if neither is present it stays hidden and a call returns a hint to pick the headless tier to complete the first-time download (MOC-190). Ad results are filtered out; blocked / no-results states return explicit error messages (never silently empty). **Pagination (MOC-215)**: `web_search` returns only the first page (~10-20 results, not fetching multiple pages at once to avoid excessive headless latency); when the model needs more / different sources it uses the separate **`web_search_more`** tool (same query, `page=2/3…`) to fetch the next batch (via Bing's `first=` deep pages), with a tail hint in the result steering the model to paginate rather than re-run the same query — numeric string arguments are parsed leniently (models often send `page` as the string `"2"`) so pagination never silently falls back to page 1. DDG HTML parsing borrows from `duckduckgo_search` (Python).
diff --git a/README.md b/README.md
index dcb7f991..e5366ab0 100644
--- a/README.md
+++ b/README.md
@@ -91,6 +91,7 @@ Codex App Transfer 是一个面向 **OpenAI Codex APP** 的轻量桌面配置 +
 - **注入的 system prompts 跟随界面语言**:本项目对非 OpenAI provider 注入的 `apply_patch` chat-path 规则 + autocompact 总结提示词,跟设置里 `语言 / Language` 一致(中文用户 → 中文 prompt,避免模型中英混杂思考);V4A 关键字(`*** Begin Patch` / `@@ <header>` 等)+ Codex CLI 错误消息原文保英文(parser / matcher 不接受翻译)
 - **Codex Desktop 主题(可选,默认关)**:Theme 页内置 11 套动漫主题(`carton` 含浮动看板娘,其余 `changli` / `azurlane` / `nailin` / `zani` / `frost` / `nocturne` / `duet` / `rose` / `sonata` / `studio`),每套按背景图独立调出暗玻璃 + 强调色。通过 CDP 向 Codex Desktop 注入设计令牌覆盖(`--color-token-*` + 运行时 `--color-*` 层)+ 背景图,覆盖聊天 / 设置页 / 折叠侧栏 / 弹层等各视图。开关跟 Plugin Unlock 独立,page reload 自动重应用;关闭开关只落盘清除偏好,已注入主题保留至 Codex 下次重启自然消失
 - **Codex 内用量显示(可选,默认关)**(MOC-204):设置 → 「Codex 内显示用量信息」,在 Codex Desktop 顶栏「Toggle pinned summary」弹窗(含 Environment / Sources 等分区)底部注入独立「Usage」用量分区,最多 4 行:① **5 小时额度 / 每周额度**:仅白名单 provider 显示:**antigravity gemini 系**数据来自 `cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary` 双窗口**剩余**额度(remainingFraction×100);**GLM Coding Plan**(`bigmodel.cn`/`z.ai` coding 系)数据来自 `monitor/usage/quota/limit` 端点(apiKey 直接鉴权,不带 Bearer),返回 5h / 每周 TOKENS_LIMIT,已用% → 剩余% = 100-已用;**小米 MiMo Token Plan**(`platform.xiaomimimo.com`)显示月度套餐剩余%进度条,需在 provider 编辑页点「登录小米账号」按钮——套餐用量只在小米控制台、走 httpOnly session cookie,app 内嵌 webview 登录后抓取 cookie 存本地,daemon 带该 cookie 查询 `/api/v1/tokenPlan/usage`;**DeepSeek**(`api.deepseek.com`)显示余额 ¥X 数值条目,调官方 `/user/balance` 接口、与推理同一把 API key(Bearer);**Kimi(月之暗面 / Moonshot PAYG,`api.moonshot.cn`/`.ai`)**显示余额数值条目(可用 / 现金 / 赠金,按 host 记 ¥/$),调官方 `/v1/users/me/balance`、与推理同一把 key(Bearer)——**注:订阅制 `kimi-code`(`api.kimi.com/coding`)是另一个 provider、无此余额接口,不在此列**;**anyrouter**(`api.anyrouter.top`)显示已用额度 $X 数值条目,调 `/v1/dashboard/billing/usage`、与推理同一把 key(Bearer;账户余额受上游反爬限制仅展示已用量)。白名单均按 baseUrl host 判定。≤10% 红色预警 + 重置时刻;仅活动 provider 命中白名单时显示额度行,其余不显。② **上下文**:注入脚本直接从 Codex React fiber 读 `contextUsage.usedTokens / contextWindow`,有历史对话即立即显示(不需新对话);满窗口 = contextWindow÷0.95(加回 Codex 隐藏的 5% reserve);1M 模型显「1M」而非「1000k」。③ **Tokens(实时速率·累计)**:速率由 MutationObserver 监测 Codex 流式文本增量估算(2s 滑窗,CJK 感知);累计量来自 Codex rollout 文件。④ **缓存命中率**:来自 rollout 的 cached_input/input。**③④ + 速率均按活动对话隔离(MOC-230)**:注入脚本从 React fiber 读当前 `conversationId`,daemon 按该 id 取对应 rollout(== 文件名 uuid,非「最近修改」的文件),切对话即跟随、不串号;读不到 id / 无对应 rollout 显「—」(绝不显示别的对话数据)。「Usage」标题可折叠(chevron + localStorage 持久)。注入走 CDP 周期推送,页面刷新 / 重启后自动重挂;需通过本应用启动 Codex,若 Codex 已在运行需重启生效
+- **Codex 移动端远程控制(可选,默认关)**(MOC-249,M1):设置 → 「移动端远程控制(Telegram)」,填 Telegram Bot Token + 授权用户白名单(数字 user id,逗号分隔;出于安全只认数字 id,username 可被改/夺取不支持)。开启后 transfer 跑一个 Telegram bot(纯 HTTPS long-poll,不需 relay / 公网回调):授权用户在手机 Telegram 给 bot 发消息,即可远程驱动本应用启动的 Codex 跑一轮对话——transfer 经 CDP 把 prompt 灌进 Codex 输入框(ProseMirror)、提交、读流式输出回编到 Telegram 消息。命令 `/new`(新建对话)`/stop`(停止当前轮)`/status` `/help`,纯文本即一轮 prompt。**⚠️ 远程控制等同远程操作本机,务必只授权本人账号、妥善保管 Bot Token**;需通过本应用启动 Codex(开关影响调试端口),改开关后需重启 Codex 生效。M1 为对话问答式(Codex 若需批准命令/工具仍需桌面端确认;批准转发到手机为后续阶段)。Windows Store(MSIX)版因调试端口透传缺口暂不支持
 - **系统代理(梯子)连通性检测**(MOC-114):仪表盘「网络代理」卡实时显示系统代理是否活跃(已连接 / 未连接 / 自动配置 PAC / 检测中);relay 真实账号模式下「自动解锁 Codex Plugins」开关在账号有效且代理可达两条件同时满足时才激活,避免梯子没开时 plugins 静默全 502 却显示"已登录"的误导态。探测仅对代理端口做短超时 TCP 连通测试,不访问 chatgpt.com。
 - **内置联网抓取工具(web_fetch,MOC-144)**:设置页 → 「内置联网抓取工具」选 `auto`(推荐,**MOC-215 起默认 `auto`、开箱即用** —— 新装用户无需手动开启即可用 web_fetch / web_search;web_fetch 走 curl/wreq 不需 Chrome,web_search 仍受 Chrome 就绪 gate 保护、不静默下载) / `curl` / `wreq` / `headless`(**独立于** Codex 沙箱联网开关),transfer 自动往 Codex 注册 `web_fetch` MCP 工具,Codex 模型可直接调该工具抓取网页 —— `curl` 走标准 HTTP、`wreq` 绕 Cloudflare TLS 挑战、`headless` 驱动无头 Chrome 取 JS 渲染后 DOM(首次选 headless 若未装 Chrome 会弹窗确认下载 chrome-headless-shell, ~86 MB)。三档之外,`web_fetch` 还能跟随 **HTML meta refresh / JS `location` 跳转**(重定向到目标 URL 重抓,防循环最多 3 跳)——curl/wreq/headless 只处理 HTTP 3xx,不跟这类客户端重定向;绕 Twitter/Substack 等封锁的"占位跳转页"会自动跟随到真实内容页(MOC-139)。**`auto` 档(MOC-161)**:按页面难度自动从 curl 升级到 wreq 再到 headless,对每个域名记住上次成功档位(下次从该档起步省试错);系统代理不可达时自动压制至 curl(wreq / headless 依赖代理);首次用 headless 档同样弹窗确认 Chrome 下载。切档即时生效(无需重启);**改"开/关"状态后需重启 Codex Desktop** 才会让联网工具(web_fetch / web_search / read_url_local)在 Codex 里出现 / 消失(MOC-235 起该 MCP server 始终注册以托管 `read_tool_artifact`,关闭联网档只是不再暴露这几个联网工具,不再卸载整个 server)。抓到的 HTML 会自动转成 markdown 返给模型(更省 token、更干净;非 HTML 响应原样透传),headless 用 networkIdle 等渲染落定再取(MOC-145)。headless 抓取启用反检测 stealth(抹 `navigator.webdriver`、伪造 `window.chrome`/插件/WebGL、UA 去 `HeadlessChrome` 标记),可过被动指纹 / 简单 JS 挑战类 Cloudflare;交互式 Turnstile/DataDome 托管挑战仍过不了(MOC-152)。headless 遇 CF JS 挑战页会**原地等其自动解出**再读(而非立即把挑战页当正文返回),并**按域名持久化浏览器 profile** 复用 CF 放行 cookie —— 同一站点二次抓取跳过重复挑战、更快(MOC-156)。抓到的页转 markdown 前先做**正文抽取**(readability 算法剥 nav/页眉/页脚/侧栏/广告,只留正文,大页正文不再被截断挤掉;非文章页自动回退整页);图片 / 视频 / 音频 / PDF 等**二进制资源**与超 16 MB 大文件不下载、直接返提示(不再吐乱码 / 防 OOM)(MOC-152)。`web_fetch` **默认直接返回抓取到的完整正文**(当前轮全文进 LLM 上下文、adapter 层自动把历史轮的 tool 输出压缩以防撑爆;MOC-190)—— 不再分页、不再按 `offset` 翻页、不再按 `query` 相关性选块,精确信息(代码 / schema / 版本 / 数字)不丢。若较早抓取的某 URL 正文在对话历史里被折叠 / 压缩、需要回看完整原文,用 **`read_url_local(url)`** 从进程内缓存取回,不必重新联网(缓存 15 min)。**更进一步,任意工具(shell / 飞书等 MCP / 其它)的大输出在历史里被压成 `[Tool output stored outside model context]` 摘要时,摘要会给出 `Artifact ID`,模型可调 `read_tool_artifact(artifact_id)` 取回该输出原文** —— 读 proxy 压缩时落盘的共享 `tool_artifacts.db`(SQLite WAL,跨进程读),不必为回看历史而重跑工具;取回内容仅当前轮可见、下一轮再被自动折叠不长期占上下文;超 90k 字符的大输出分页返回(每块低于 proxy keep-full 上限,末尾提示用 `offset` 逐块读完整)(MOC-235)。这些工具(`web_fetch` / `web_search` / `read_url_local` / `read_tool_artifact`)均声明 `readOnlyHint`(只读),Codex 的 auto-review guardian 据此**跳过审批**(`requires_mcp_tool_approval` 命中只读直接放行),联网调用不再逐次触发风险审批往返、消除审批延迟(MOC-172)。
 - **内置 web_search 搜索工具(MOC-12)**:启用「内置联网抓取工具」(非 off)且本机 Chrome 就绪后,transfer 往 Codex 注册 `web_search` 工具 —— 模型给关键词即返回结构化结果列表(标题 + 真实 URL + 摘要),配合 `web_fetch` 组成**两段式联网**:先 `web_search` 找信息源、再 `web_fetch` 抓正文,免去模型瞎猜 URL。**为什么需要**:Codex 默认每轮发的 OpenAI server-side `web_search` 在第三方 chat provider(MiniMax / DeepSeek / GLM / Kimi 等)上游不被支持、被协议层 drop,模型只能退化到自己抓搜索引擎页 / 猜 URL(真机实测成功率仅 ~17%)。本工具走 **DuckDuckGo + Bing 双引擎并行检索、按 URL 归一化去重后交错合并**(免 key、对数据中心 / VPN 出口 IP 友好;两家索引互补、单次覆盖面较单源明显更全,MOC-215;此前 Bing 仅在 DDG 失败时兜底 MOC-186),且**内部固定 headless** 浏览器代搜 —— DDG / Bing 对纯 HTTP 请求反爬拦截(无论 TLS 指纹多真),必须真浏览器跑 JS;并行抓取故 wall-time ≈ 单家而非求和,任一引擎被拦 / 无结果时另一家仍可用。`web_search` 内部固定 headless,但其**暴露 / 调用只要求本机 Chrome 就绪**(系统装了 Chrome / Edge / Chromium,或已下载内置 chrome-headless-shell)—— 与 web_fetch 档位解耦:系统有 Chrome 的用户在任意非 off 档(含 curl / wreq)都能用 search 且不触发下载;两者皆无则不暴露、调用返回提示引导去 headless 档完成首次下载(MOC-190)。结果自动过滤广告;反爬拦截 / 无结果时返回明确提示(不静默吐空)。**翻页(MOC-215)**:`web_search` 只返第 1 页(约一二十条,不一次扩抓多页以免 headless 延迟过高);模型需要更多 / 不同来源时用独立工具 **`web_search_more`(同 query, page=2/3…)** 取下一批(走 Bing `first=` 深页),结果尾部附诱导提示引导模型主动翻页而非用同一 query 重复搜 —— 工具参数对数字字符串(模型常把 `page` 传成 `"2"`)做宽容解析,避免翻页静默退回第 1 页。DDG HTML 解析模式借鉴 `duckduckgo_search`(Python)上游。
diff --git a/frontend/index.html b/frontend/index.html
index e6de2f90..423ea54e 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -517,6 +517,23 @@ <h3 data-i18n="usage.cacheModal.title">缓存命中分布</h3>
               <p class="settings-note" data-i18n="settings.codexQuotaEnabledHint">在 Codex 的固定摘要(pinned summary)弹窗底部显示用量面板:上下文占用、Tokens 速率与累计(所有 provider),以及 5 小时 / 每周额度(仅支持的 provider)。需 Codex 通过本应用启动;若 Codex 已在运行,改动开关后需重启 Codex 生效。</p>
             </div>
           </div>
+          <div class="settings-row settings-row-stack">
+            <strong data-i18n="settings.codexRemoteControlEnabled">移动端远程控制(Telegram)</strong>
+            <div>
+              <label class="switch-label only-switch"><input type="checkbox" id="codexRemoteControlEnabled"><span class="switch-ui"></span></label>
+              <p class="settings-note" data-i18n="settings.codexRemoteControlEnabledHint">开启后 transfer 跑一个 Telegram bot:授权用户在手机上给 bot 发消息,即可远程驱动本应用启动的 Codex 跑一轮对话并流式收到回复。需 Codex 通过本应用启动;改动开关后需重启 Codex 生效。⚠️ 远程控制等同远程操作本机,务必只授权本人账号、妥善保管 Bot Token。</p>
+              <div style="margin-top:10px;">
+                <label data-i18n="settings.codexRemoteControlBotToken" style="display:block;font-size:13px;margin-bottom:4px;">Bot Token</label>
+                <input type="password" id="codexRemoteControlBotToken" autocomplete="off" placeholder="123456:ABC-DEF...">
+                <p class="settings-note" data-i18n="settings.codexRemoteControlBotTokenHint">从 Telegram @BotFather 创建 bot 后拿到的 HTTP API token。</p>
+              </div>
+              <div style="margin-top:10px;">
+                <label data-i18n="settings.codexRemoteControlAllowedUsers" style="display:block;font-size:13px;margin-bottom:4px;">授权用户白名单</label>
+                <input type="text" id="codexRemoteControlAllowedUsers" autocomplete="off" placeholder="123456789, 987654321">
+                <p class="settings-note" data-i18n="settings.codexRemoteControlAllowedUsersHint">允许控制的 Telegram 数字 user id,逗号分隔。出于安全只认数字 id(username 可被改/夺取,不支持)。未授权用户给 bot 发消息时会收到自己的数字 id,方便你加进来。</p>
+              </div>
+            </div>
+          </div>
           <!-- MOC-104 强制开启二次确认弹窗(高延迟警告)。Tauri webview 的 window.confirm
                不稳定,用 app 自己的 codex-modal 保证可见 -->
           <div class="codex-modal-backdrop" id="realAccountForceEnableModal" hidden>
diff --git a/frontend/js/app.js b/frontend/js/app.js
index 8c02a3df..58b0dcef 100644
--- a/frontend/js/app.js
+++ b/frontend/js/app.js
@@ -2666,6 +2666,9 @@
    $("#autoUnlockCodexPlugins").checked = forceUnlockPersisted;
     $("#autoWakeCodexPet").checked = settings.autoWakeCodexPet !== false;
     $("#codexQuotaEnabled").checked = settings.codexQuotaEnabled === true;
+    if ($("#codexRemoteControlEnabled")) $("#codexRemoteControlEnabled").checked = settings.codexRemoteControlEnabled === true;
+    if ($("#codexRemoteControlBotToken")) $("#codexRemoteControlBotToken").value = settings.codexRemoteControlBotToken || "";
+    if ($("#codexRemoteControlAllowedUsers")) $("#codexRemoteControlAllowedUsers").value = Array.isArray(settings.codexRemoteControlAllowedUsers) ? settings.codexRemoteControlAllowedUsers.join(", ") : "";
    $("#exposeAllProviderModels").checked = !!settings.exposeAllProviderModels;
     showGrayPresets = settings.showGrayProviders === true;
     $("#showGrayProviders").checked = showGrayPresets;
@@ -3257,6 +3260,12 @@
      autoUnlockCodexPlugins: forceUnlockPersisted,
       autoWakeCodexPet: $("#autoWakeCodexPet")?.checked !== false,
       codexQuotaEnabled: $("#codexQuotaEnabled")?.checked === true,
+      codexRemoteControlEnabled: $("#codexRemoteControlEnabled")?.checked === true,
+      codexRemoteControlBotToken: ($("#codexRemoteControlBotToken")?.value || "").trim(),
+      codexRemoteControlAllowedUsers: ($("#codexRemoteControlAllowedUsers")?.value || "")
+        .split(/[\s,]+/)
+        .map((s) => s.trim())
+        .filter(Boolean),
      exposeAllProviderModels: $("#exposeAllProviderModels")?.checked || false,
       showGrayProviders: $("#showGrayProviders")?.checked || false,
       restoreCodexOnExit: $("#restoreCodexOnExit")?.checked !== false,
@@ -8626,6 +8635,11 @@
     // daemon 走 CDP,Codex 启动时才决定是否带调试端口(should_attach_debug_port);
     // Codex 已无端口运行时开开关不会即时生效,需重启 Codex(hint 已注明)。
     $("#codexQuotaEnabled")?.addEventListener("change", saveSettingsFromForm);
+    // [MOC-249] 远程控制开关/凭据:持久化即可,daemon 每 tick 自取;开关同样影响
+    // should_attach_debug_port(开后需重启 Codex 才带调试端口,hint 已注明)。
+    $("#codexRemoteControlEnabled")?.addEventListener("change", saveSettingsFromForm);
+    $("#codexRemoteControlBotToken")?.addEventListener("change", saveSettingsFromForm);
+    $("#codexRemoteControlAllowedUsers")?.addEventListener("change", saveSettingsFromForm);
     // [MOC-185] 诊断模式开关 = session 级一次性:**纯运行时**起/停查看器服务 + 切按钮可见性,
     // **不再 saveSettingsFromForm 持久化开关态**(退出 transfer 即关、启动不自启)。
     // 注意:api() 对后端返回的 `success:false`(含 bind 失败)会 **throw**(api.js:28),
diff --git a/frontend/js/i18n.js b/frontend/js/i18n.js
index 410d0266..063cfa71 100644
--- a/frontend/js/i18n.js
+++ b/frontend/js/i18n.js
@@ -555,6 +555,12 @@
       "settings.autoUnlockCodexPluginsHint": "此功能需要通过本应用内启动 Codex 才能正常使用。点击右侧「重启 Codex」可直接重启 Codex 并触发自动注入。注意:Plugins / MCP 工具仅在协议转发路径(`apiFormat=openai_chat / anthropic_messages / gemini_native` 等)生效;Responses 直连 provider(`apiFormat=responses`,如 OpenAI 官方)走字节级 passthrough,MCP `namespace` 工具包不展平,部分上游会忽略导致工具列表静默丢失。",
       "settings.codexQuotaEnabled": "Codex 内显示用量信息",
       "settings.codexQuotaEnabledHint": "在 Codex 的固定摘要(pinned summary)弹窗底部显示用量面板:上下文占用、Tokens 速率与累计(所有 provider),以及 5 小时 / 每周额度(仅支持的 provider)。需 Codex 通过本应用启动;若 Codex 已在运行,改动开关后需重启 Codex 生效。",
+      "settings.codexRemoteControlEnabled": "移动端远程控制(Telegram)",
+      "settings.codexRemoteControlEnabledHint": "开启后 transfer 跑一个 Telegram bot:授权用户在手机上给 bot 发消息,即可远程驱动本应用启动的 Codex 跑一轮对话并流式收到回复。需 Codex 通过本应用启动;改动开关后需重启 Codex 生效。⚠️ 远程控制等同远程操作本机,务必只授权本人账号、妥善保管 Bot Token。",
+      "settings.codexRemoteControlBotToken": "Bot Token",
+      "settings.codexRemoteControlBotTokenHint": "从 Telegram @BotFather 创建 bot 后拿到的 HTTP API token。",
+      "settings.codexRemoteControlAllowedUsers": "授权用户白名单",
+      "settings.codexRemoteControlAllowedUsersHint": "允许控制的 Telegram **数字 user id**,逗号分隔。出于安全只认数字 id(username 可被改/夺取,不支持)。未授权用户给 bot 发消息时会收到自己的数字 id,方便你加进来。",
       "settings.autoUnlockRestartCodex": "重启 Codex",
       "settings.pluginUnlockRuntimeStatus": "运行时状态：未检测",
       "settings.pluginUnlockRuntimeStatusPrefix": "运行时状态：",
@@ -1282,6 +1288,12 @@
       "settings.autoUnlockCodexPluginsHint": "Codex must be launched from this app for plugin unlock to work. Click \"Restart Codex\" on the right to relaunch Codex now and trigger injection. Note: Plugins / MCP tools only take effect on protocol-translation routes (`apiFormat=openai_chat / anthropic_messages / gemini_native` etc.); Responses-direct providers (`apiFormat=responses`, e.g. OpenAI official) use byte-level passthrough and do NOT flatten the MCP `namespace` tool bundle — some upstreams silently drop the tool list.",
       "settings.codexQuotaEnabled": "Show usage in Codex",
       "settings.codexQuotaEnabledHint": "Shows a usage panel at the bottom of Codex's pinned summary popup: context usage and token rate/total (all providers), plus 5-hour / weekly quota (supported providers only). Codex must be launched from this app; if Codex is already running, restart Codex after toggling.",
+      "settings.codexRemoteControlEnabled": "Mobile remote control (Telegram)",
+      "settings.codexRemoteControlEnabledHint": "When enabled, transfer runs a Telegram bot: authorized users message the bot from their phone to remotely drive the Codex launched by this app — one prompt per turn, with the reply streamed back. Codex must be launched from this app; restart Codex after toggling. ⚠️ Remote control is equivalent to operating this machine remotely — only authorize your own account and keep the Bot Token safe.",
+      "settings.codexRemoteControlBotToken": "Bot Token",
+      "settings.codexRemoteControlBotTokenHint": "The HTTP API token you get after creating a bot via Telegram @BotFather.",
+      "settings.codexRemoteControlAllowedUsers": "Allowed users",
+      "settings.codexRemoteControlAllowedUsersHint": "Telegram **numeric user ids** allowed to control, comma-separated. For security only numeric ids are honored (usernames are mutable/reassignable and are not supported). Unauthorized users who message the bot get their own numeric id back so you can add them.",
       "settings.autoUnlockRestartCodex": "Restart Codex",
       "settings.pluginUnlockRuntimeStatus": "Runtime status: not detected",
       "settings.pluginUnlockRuntimeStatusPrefix": "Runtime status: ",
diff --git a/src-tauri/src/admin/services/desktop/process.rs b/src-tauri/src/admin/services/desktop/process.rs
index ab09fc9c..78336a55 100644
--- a/src-tauri/src/admin/services/desktop/process.rs
+++ b/src-tauri/src/admin/services/desktop/process.rs
@@ -426,7 +426,14 @@ fn should_attach_debug_port() -> Vec<String> {
         .and_then(|s| s.get("codexQuotaEnabled"))
         .and_then(|v| v.as_bool())
         .unwrap_or(false);
-    if !plugin_unlock_needs_port && !theme_enabled && !quota_enabled {
+    // [MOC-249] 移动端远程控制 daemon 经 CDP 驱动 Codex 发对话/读输出,开启时同样要端口。
+    let remote_control_enabled = cfg
+        .as_ref()
+        .and_then(|c| c.get("settings"))
+        .and_then(|s| s.get("codexRemoteControlEnabled"))
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    if !plugin_unlock_needs_port && !theme_enabled && !quota_enabled && !remote_control_enabled {
         return vec![];
     }
 
diff --git a/src-tauri/src/codex_remote/driver.rs b/src-tauri/src/codex_remote/driver.rs
new file mode 100644
index 00000000..5ff450a8
--- /dev/null
+++ b/src-tauri/src/codex_remote/driver.rs
@@ -0,0 +1,308 @@
+//! CodexDriver —— 通过 CDP `Runtime.evaluate` 驱动 Codex Desktop 的 renderer
+//! 发对话、读流式输出(MOC-249 移动端远程控制 M1)。
+//!
+//! **可行性已 spike 实证**(2026-06-16,Codex 26.609 / Chromium 149):
+//! - composer = 底部唯一可见 `div.ProseMirror[contenteditable]`(ProseMirror 编辑器)
+//! - 灌字 = `focus()` + `document.execCommand('insertText')`(回退 `beforeinput/input`)
+//! - 提交 = 点 `button[class*="size-token-button-compose"]`(回退爬 fiber 调 `handleSubmit()`)
+//! - 读输出 = `[data-local-conversation-final-assistant]`(剥用户气泡+时间戳),兜底用
+//!   `[data-user-message-bubble]` + 排除 composer 的滚动容器(codex-e2e-test skill 实证)
+//! - 完成判定 = `[data-local-conversation-final-assistant]` 就绪(final_ready)优先,
+//!   `isSubmitting===false` 兜底 —— isSubmitting 在 streaming/Thinking 阶段会提前读 false
+//!
+//! **边界**(spike 实证):页面 CSP `connect-src` 只放 chatgpt/openai/mapbox,注入 JS
+//! 开不了外部 WS → 对外 bot 长连接必须 Rust 侧(见 [`super::telegram`]);renderer 纯
+//! 浏览器沙箱(无 Node)。详见 memory `reference_codex_renderer_drive_feasibility`。
+//!
+//! 复用 [`crate::codex_theme_injector`] 的 CDP 原语(`locate_main_window_ws` /
+//! `make_msg` / `drain_until_response`)与 [`crate::codex_plugin_unlocker::CDP_PORT`]。
+//!
+//! **抗脆弱**:所有 selector / fiber 路径集中在本文件 [`SELECTORS`] 注释区;Codex 升级
+//! 漂移时只改这里。bump [`DRIVER_SCHEMA_VERSION`] 便于排查。
+
+use futures::{SinkExt, StreamExt};
+use serde_json::{json, Value};
+use tokio_tungstenite::{connect_async, tungstenite::Message as WsMessage};
+
+use crate::codex_theme_injector::{drain_until_response, locate_main_window_ws, make_msg};
+
+/// selector/fiber 契约版本(Codex renderer 结构变化时 bump,纯排查标记)。
+pub const DRIVER_SCHEMA_VERSION: u32 = 1;
+
+/// 关键 selector(集中管理,Codex 升级回归只改这里):
+/// - composer:`.ProseMirror`
+/// - 发送钮:`button[class*="size-token-button-compose"]`
+/// - 用户气泡:`[class*="bg-token-foreground/5"][class*="rounded-2"]`
+/// - 新建对话:`[aria-label^="Start new chat"]`
+const SELECTORS: &str = "see module doc";
+const _: &str = SELECTORS;
+
+/// 一轮对话当前快照。
+#[derive(Debug, Clone, Default)]
+pub struct Snapshot {
+    /// composer(`.ProseMirror`)是否在当前视图。
+    pub composer_present: bool,
+    /// composer fiber 的 `isSubmitting`:true=模型正在跑,false=空闲,None=读不到。
+    pub submitting: Option<bool>,
+    /// 末个用户气泡之后的 transcript 文本(= 最近一轮 assistant 输出,已轻清洗)。
+    pub reply: Option<String>,
+    /// `[data-local-conversation-final-assistant]` 在场且有非空文本 —— Codex 在**最终**
+    /// assistant 答案渲染好后才打这个标记(Thinking/streaming 阶段不在)。比 `isSubmitting`
+    /// 更可靠的「本轮已结束」信号(isSubmitting 在 streaming 阶段会提前读 false);用于
+    /// fiber 漂移、读不到 submitting 时的完成判定(codex-e2e-test skill 实证)。
+    pub final_ready: bool,
+}
+
+/// 一次 CDP `Runtime.evaluate`(连接→发→drain→关),返回 JS 的 `returnByValue` 结果。
+/// 每调用新建连接(与 [`crate::codex_quota_injector`] 的 `evaluate_once` 同策略)。
+async fn cdp_eval(script: &str) -> Result<Option<Value>, String> {
+    let ws_url = locate_main_window_ws().await.map_err(|e| e.to_string())?;
+    let (ws_stream, _) = connect_async(&ws_url).await.map_err(|e| e.to_string())?;
+    let (mut write, mut read) = ws_stream.split();
+    let (msg, _) = make_msg(
+        1,
+        "Runtime.evaluate",
+        json!({ "expression": script, "returnByValue": true }),
+    );
+    write
+        .send(WsMessage::Text(msg.into()))
+        .await
+        .map_err(|e| e.to_string())?;
+    let value = drain_until_response(&mut read, 1).await?;
+    let _ = write.close().await;
+    Ok(value)
+}
+
+/// 注入页里复用的小工具(fiber 定位 + isSubmitting 读取),拼进各脚本前缀。
+const JS_HELPERS: &str = r#"
+function __crFiberOf(el){ if(!el) return null; for(var k in el){ if(k.indexOf('__reactFiber$')===0) return el[k]; } return null; }
+function __crComposer(){ return document.querySelector('.ProseMirror'); }
+function __crSubmitting(){
+  var pm=__crComposer(); if(!pm) return null;
+  var el=pm, f=null; while(el && !(f=__crFiberOf(el))) el=el.parentElement;
+  var d=0; while(f && d<22){ var p=f.memoizedProps; if(p && typeof p.isSubmitting==='boolean') return p.isSubmitting; f=f.return; d++; }
+  return null;
+}
+"#;
+
+/// 读快照:composer 在否 + isSubmitting + finalReady + 最近一轮 assistant 文本。
+/// 提取与完成信号(codex-e2e-test skill 实证):
+/// - finalReady = `[data-local-conversation-final-assistant]` 在场且有非空文本(最终答案
+///   渲染好才出),作完成信号优于 isSubmitting(后者 streaming 阶段提前读 false)。
+/// - reply 优先取 final-assistant(剥用户气泡 + 时间戳叶子);兜底用 `data-user-message-bubble`
+///   + **排除 composer** 的滚动容器(避免圈进 Approve/模型选择/Thinking 噪声)。
+const JS_SNAPSHOT: &str = r#"
+(function(){
+  var pm=__crComposer();
+  var out={ present: !!pm, submitting: __crSubmitting(), reply: null, finalReady: false };
+  var ub=document.querySelectorAll('[data-user-message-bubble]');
+  var lastUser=ub.length?ub[ub.length-1]:null;
+  var fa=document.querySelectorAll('[data-local-conversation-final-assistant]');
+  if(fa.length){
+    var faNode=fa[fa.length-1];
+    // final-assistant 必须**在最新用户消息之后**才算本轮结果(bot-review P2):否则 Codex
+    // 残留的上一轮最终答案会让「新 prompt 仍在 thinking」时 finalReady 误判 true、秒完成。
+    var isAfter = !lastUser || (lastUser.compareDocumentPosition(faNode) & 4); // FOLLOWING
+    if(isAfter){
+      var clone=faNode.cloneNode(true);
+      clone.querySelectorAll('[data-user-message-bubble]').forEach(function(n){ n.remove(); });
+      clone.querySelectorAll('*').forEach(function(n){ if(!n.children.length && /^\s*\d{1,2}:\d{2}\s?(AM|PM)\s*$/i.test(n.textContent||'')) n.remove(); });
+      var t=(clone.innerText||'').trim();
+      if(t){ out.reply=t; out.finalReady=true; }
+    }
+  }
+  if(lastUser){
+    var cont=lastUser, picked=null;
+    for(var i=0;i<16 && cont.parentElement;i++){
+      var c=cont.parentElement;
+      if(c.querySelector('.ProseMirror')) break;
+      cont=c;
+      var r=c.getBoundingClientRect();
+      if(r.width>380 && c.scrollHeight>c.clientHeight+20) picked=c;
+    }
+    var box=picked||cont;
+    var full=box.innerText||''; var key=(lastUser.innerText||'').slice(0,60); var idx=key?full.lastIndexOf(key):-1;
+    if(out.reply==null) out.reply = idx>=0 ? full.slice(idx + (lastUser.innerText||'').length) : null;
+  }
+  return out;
+})()
+"#;
+
+/// 点「新建对话」按钮(任意一个匹配的;远程控制 M1 单项目,取第一个即可)。
+const JS_NEW_CHAT: &str = r#"
+(function(){
+  var b=document.querySelector('[aria-label^="Start new chat"]')||document.querySelector('[aria-label*="new chat" i]');
+  if(b){ b.click(); return {clicked:true}; }
+  return {clicked:false};
+})()
+"#;
+
+/// 提交当前 composer:优先点发送钮,disabled / 缺失则爬 fiber 调 `handleSubmit()`。
+const JS_SUBMIT: &str = r#"
+(function(){
+  var sb=document.querySelector('button[class*="size-token-button-compose"]');
+  if(sb && !(sb.disabled===true || sb.getAttribute('aria-disabled')==='true')){ sb.click(); return {via:'button'}; }
+  var pm=__crComposer(); if(!pm) return {via:'none', err:'no composer'};
+  var el=pm, f=null; while(el && !(f=__crFiberOf(el))) el=el.parentElement;
+  var d=0, hs=null;
+  while(f && d<24){ var p=f.memoizedProps; if(p && typeof p.handleSubmit==='function'){ hs=p.handleSubmit; break; } f=f.return; d++; }
+  if(hs){ try{ hs(); return {via:'handleSubmit'}; }catch(e){ return {via:'handleSubmit', err:String(e)}; } }
+  return {via:'none'};
+})()
+"#;
+
+/// 停止当前轮:优先 fiber `onStop()`。按钮回退**仅在确实正在跑(isSubmitting）时**
+/// 才点 —— 该 selector 与发送钮同一个,空闲时它是「发送」,点了会把 composer 草稿当
+/// 新一轮提交(bot-review P2)。空闲且无 onStop → 返 `none`(无可停)。
+const JS_STOP: &str = r#"
+(function(){
+  var pm=__crComposer(); var el=pm, f=null;
+  while(el && !(f=__crFiberOf(el))) el=el.parentElement;
+  var d=0; while(f && d<24){ var p=f.memoizedProps; if(p && typeof p.onStop==='function'){ try{ p.onStop(); return {via:'onStop'}; }catch(e){} } f=f.return; d++; }
+  if(__crSubmitting()===true){
+    var sb=document.querySelector('button[class*="size-token-button-compose"]');
+    if(sb){ sb.click(); return {via:'button'}; }
+  }
+  return {via:'none'};
+})()
+"#;
+
+/// 读当前快照。
+pub async fn snapshot() -> Result<Snapshot, String> {
+    let script = format!("{JS_HELPERS}\n{JS_SNAPSHOT}");
+    let v = cdp_eval(&script).await?.unwrap_or(Value::Null);
+    Ok(Snapshot {
+        composer_present: v.get("present").and_then(Value::as_bool).unwrap_or(false),
+        submitting: v.get("submitting").and_then(Value::as_bool),
+        reply: v
+            .get("reply")
+            .and_then(Value::as_str)
+            .map(clean_reply)
+            .filter(|s| !s.is_empty()),
+        final_ready: v
+            .get("finalReady")
+            .and_then(Value::as_bool)
+            .unwrap_or(false),
+    })
+}
+
+/// 点新建对话。返回是否点中。
+pub async fn new_chat() -> Result<bool, String> {
+    let v = cdp_eval(JS_NEW_CHAT).await?.unwrap_or(Value::Null);
+    Ok(v.get("clicked").and_then(Value::as_bool).unwrap_or(false))
+}
+
+/// 把 `text` 灌进 composer。**先全选替换**(`selectNodeContents` 不 collapse →
+/// `execCommand('insertText')` 替换掉任何残留草稿),避免「残留草稿 + 远程指令」一起
+/// 被提交、执行非预期文本。灌完**校验** composer 文本与目标一致(空白不敏感,容忍
+/// ProseMirror 对多行的换行规整),不一致返 Err 让上层中止、不提交。
+pub async fn set_input(text: &str) -> Result<String, String> {
+    let lit = serde_json::to_string(text).map_err(|e| e.to_string())?;
+    let script = format!(
+        r#"{JS_HELPERS}
+(function(){{
+  var pm=__crComposer(); if(!pm) return {{ok:false, err:'no composer'}};
+  var TEXT={lit};
+  function norm(s){{ return (s||'').replace(/\s+/g,''); }}
+  pm.focus();
+  // 全选现有内容(含旧草稿)→ insertText 直接替换(不 collapse)
+  try{{ var sel=window.getSelection(); sel.removeAllRanges(); var r=document.createRange(); r.selectNodeContents(pm); sel.addRange(r); }}catch(e){{}}
+  try{{ document.execCommand('insertText', false, TEXT); }}catch(e){{}}
+  // 若不匹配(execCommand 失败 / 未替换干净):显式清空 + beforeinput/input 回退
+  if(norm(pm.textContent) !== norm(TEXT)){{
+    try{{ var s2=window.getSelection(); s2.removeAllRanges(); var r2=document.createRange(); r2.selectNodeContents(pm); s2.addRange(r2); document.execCommand('delete'); }}catch(e){{}}
+    try{{
+      pm.dispatchEvent(new InputEvent('beforeinput',{{inputType:'insertText',data:TEXT,bubbles:true,cancelable:true}}));
+      pm.dispatchEvent(new InputEvent('input',{{inputType:'insertText',data:TEXT,bubbles:true}}));
+    }}catch(e){{}}
+  }}
+  return {{ok: norm(pm.textContent) === norm(TEXT), text: pm.textContent}};
+}})()"#
+    );
+    let v = cdp_eval(&script).await?.unwrap_or(Value::Null);
+    if let Some(err) = v.get("err").and_then(Value::as_str) {
+        return Err(format!("set_input: {err}"));
+    }
+    let text_in = v.get("text").and_then(Value::as_str).unwrap_or("");
+    // 校验入框内容(空白不敏感)== 目标,防残留草稿混入被提交
+    if v.get("ok").and_then(Value::as_bool) != Some(true) {
+        return Err(format!(
+            "composer 内容与目标不一致(可能有残留草稿),已中止以防提交非预期文本;当前: {:?}",
+            text_in.chars().take(60).collect::<String>()
+        ));
+    }
+    Ok(text_in.to_string())
+}
+
+/// 提交当前 composer。返回提交途径(`button` / `handleSubmit`)。
+/// JS 侧带 `err` 字段(`via:'none'` 无入口,或 `via:'handleSubmit'` 调用抛异常)一律
+/// 透出为 Err —— 否则 handleSubmit 抛异常仍被当成功,导致流式循环空转到超时。
+pub async fn submit() -> Result<String, String> {
+    let script = format!("{JS_HELPERS}\n{JS_SUBMIT}");
+    let v = cdp_eval(&script).await?.unwrap_or(Value::Null);
+    let via = v.get("via").and_then(Value::as_str).unwrap_or("none");
+    if let Some(err) = v.get("err").and_then(Value::as_str) {
+        return Err(format!("submit 失败({via}): {err}"));
+    }
+    if via == "none" {
+        return Err("submit 失败: 没有可用的提交入口".to_string());
+    }
+    Ok(via.to_string())
+}
+
+/// 停止当前轮。
+pub async fn stop() -> Result<String, String> {
+    let script = format!("{JS_HELPERS}\n{JS_STOP}");
+    let v = cdp_eval(&script).await?.unwrap_or(Value::Null);
+    Ok(v.get("via")
+        .and_then(Value::as_str)
+        .unwrap_or("none")
+        .to_string())
+}
+
+/// 轻清洗 transcript 尾段:去掉 Codex 的时间戳行(`3:47 PM`)与 `Worked for Xs` 行,
+/// 折叠多余空行。M1 够用,精细化留 M2。
+fn clean_reply(raw: &str) -> String {
+    let mut lines: Vec<&str> = Vec::new();
+    for line in raw.lines() {
+        let t = line.trim();
+        if t.is_empty() {
+            continue;
+        }
+        // 形如 "3:47 PM" / "11:02 AM" 的时间戳行
+        let is_ts = t.len() <= 9
+            && (t.ends_with("AM") || t.ends_with("PM"))
+            && t.chars().next().is_some_and(|c| c.is_ascii_digit());
+        if is_ts {
+            continue;
+        }
+        // "Worked for 0s" / "Worked for 1m 3s" 等状态行;流式思考/批准占位
+        if t.starts_with("Worked for ") || t == "Thinking" || t == "Approve for me" {
+            continue;
+        }
+        lines.push(t);
+    }
+    lines.join("\n")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn clean_reply_strips_timestamps_and_status() {
+        let raw = "3:47 PM\nWorked for 0s\n\n远程链路已连通\n3:47 PM";
+        assert_eq!(clean_reply(raw), "远程链路已连通");
+    }
+
+    #[test]
+    fn clean_reply_keeps_multiline_body() {
+        let raw = "11:02 AM\n第一行\n第二行\nWorked for 2s";
+        assert_eq!(clean_reply(raw), "第一行\n第二行");
+    }
+
+    #[test]
+    fn clean_reply_empty_stays_empty() {
+        assert_eq!(clean_reply("\n\n  \n"), "");
+    }
+}
diff --git a/src-tauri/src/codex_remote/mod.rs b/src-tauri/src/codex_remote/mod.rs
new file mode 100644
index 00000000..f7f1fdff
--- /dev/null
+++ b/src-tauri/src/codex_remote/mod.rs
@@ -0,0 +1,579 @@
+//! Codex 移动端远程控制 —— Telegram Bot Channel daemon(MOC-249 M1)。
+//!
+//! 形态:transfer Rust 端跑一个 Telegram bot(纯 HTTPS long-poll,无 relay / 公网回调,
+//! 绕开 Codex renderer CSP),收到授权用户的消息后用 [`driver`] 经 CDP 驱动 Codex 跑一轮,
+//! 流式把 assistant 输出回编到 Telegram 消息。手机端 = 用户已有的 Telegram app。
+//!
+//! **M1 范围**:对话问答式(纯文本→prompt),命令 `/help /status /new /stop`;鉴权走
+//! settings 白名单(`/bind` 码流程 + 工具批准转发留 M2)。**暂不支持工具执行**:prompt
+//! 直接进 Codex,若 Codex 要跑命令会卡在桌面批准 UI(M2 做批准转发)。
+//!
+//! 开关:settings `codexRemoteControlEnabled`(默认关)+ `codexRemoteControlBotToken`。
+//! 见 [`crate::admin::services::desktop::process::should_attach_debug_port`](远程控制开
+//! 启时让 Codex 带 `--remote-debugging-port` 起,与 quota/theme 共用同一 CDP 端口)。
+
+pub mod driver;
+pub mod telegram;
+
+use serde_json::Value;
+use telegram::{Message, TelegramClient};
+use tokio::time::Duration;
+
+/// getUpdates long-poll 服务端挂起秒数。
+const LONG_POLL_SECS: u64 = 25;
+/// 一轮对话流式轮询间隔(Telegram editMessageText 限速,不宜更密)。
+const STREAM_POLL: Duration = Duration::from_millis(1200);
+/// 一轮对话最长等待轮数(≈ MAX_POLLS × STREAM_POLL,超时收尾)。
+const MAX_POLLS: u32 = 180; // ≈ 3.6 min
+/// Telegram 单条消息字符上限(留余量)。
+const TG_MAX_CHARS: usize = 3800;
+
+/// 全局轮次锁:一台 Codex 同一时刻只驱动一轮(第二个 prompt 排队等)。
+/// `/stop` `/status` 等快命令**不**取此锁,故能在长轮次进行中插队。
+static TURN_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+fn settings() -> Option<Value> {
+    crate::admin::registry_io::load()
+        .ok()
+        .and_then(|c| c.get("settings").cloned())
+}
+
+fn enabled() -> bool {
+    settings()
+        .as_ref()
+        .and_then(|s| s.get("codexRemoteControlEnabled"))
+        .and_then(Value::as_bool)
+        .unwrap_or(false)
+}
+
+fn bot_token() -> Option<String> {
+    settings()
+        .as_ref()
+        .and_then(|s| s.get("codexRemoteControlBotToken"))
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(str::to_owned)
+}
+
+/// 授权用户白名单(**仅数字 user id 生效**,bot-review P1)。仍兼容旧配置里残留的
+/// `@username` 项(剥 `@` 后保留),但它们匹配不到任何数字 id、不再授权。
+fn allowed_users() -> Vec<String> {
+    settings()
+        .as_ref()
+        .and_then(|s| s.get("codexRemoteControlAllowedUsers"))
+        .and_then(Value::as_array)
+        .map(|arr| {
+            arr.iter()
+                .filter_map(Value::as_str)
+                .map(|s| s.trim().trim_start_matches('@').to_owned())
+                .filter(|s| !s.is_empty())
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// 仅按**稳定的数字 user id** 鉴权(bot-review P1):Telegram username 可改 / 被重分配,
+/// 用 username 鉴权会让放弃或夺取该 handle 的新持有者获得本机远程控制权。白名单里的
+/// 非数字项(@username)不再生效(`allowed_users` 已剥 `@`,非数字串匹配不到任何 id)。
+fn is_authorized(msg: &Message, allow: &[String]) -> bool {
+    let Some(from) = &msg.from else {
+        return false;
+    };
+    let id = from.id.to_string();
+    allow.iter().any(|a| a == &id)
+}
+
+/// Telegram bot daemon 主循环。开关关 / 无 token 时空转;开启后长轮询并分发。
+pub async fn run_remote_control_daemon() {
+    loop {
+        if !enabled() {
+            tokio::time::sleep(Duration::from_secs(3)).await;
+            continue;
+        }
+        let Some(token) = bot_token() else {
+            tokio::time::sleep(Duration::from_secs(3)).await;
+            continue;
+        };
+        let client = match TelegramClient::new(token.clone(), LONG_POLL_SECS) {
+            Ok(c) => c,
+            Err(e) => {
+                tracing::warn!("[RemoteControl] Telegram client 构建失败: {e}");
+                tokio::time::sleep(Duration::from_secs(5)).await;
+                continue;
+            }
+        };
+        // offset 每个 bot 会话独立重置:Telegram update_id 是 per-bot 的,换 token 后
+        // 复用旧 offset 会让 getUpdates 跳过新 bot 的(可能更小的)update_id → 新 token
+        // 看着像死的(bot-review P2)。Telegram 不会重投已确认 update,重置到 0 安全。
+        let mut offset: i64 = 0;
+        // **丢弃积压**(bot-review P2):功能关闭/无 token 期间 daemon 不 getUpdates,
+        // Telegram 会留存这些消息(最长 24h);offset=0 起会把「关闭期间 / 发信人尚未进
+        // 白名单时」发的指令当 live 命令立即执行(重放)。会话启动先用 offset=-1(取队尾
+        // 最后一条、遗忘之前所有)把 offset 推到最新之后,只接受**启用之后**到达的消息。
+        // drain **必须成功**才进 live loop —— 失败(如 Telegram 短暂不可达)就退避重试,
+        // 绝不以 offset=0 进 live loop,否则下一次成功 poll 会重放积压(bot-review P2)。
+        let mut drained = false;
+        for attempt in 0..6 {
+            if !enabled() || bot_token().as_deref() != Some(token.as_str()) {
+                break;
+            }
+            match client.get_updates(-1, 0).await {
+                Ok(updates) => {
+                    if let Some(max_id) = updates.iter().map(|u| u.update_id).max() {
+                        offset = max_id + 1;
+                        tracing::info!("[RemoteControl] 丢弃启用前积压,offset 起于 {offset}");
+                    }
+                    drained = true;
+                    break;
+                }
+                Err(e) => {
+                    let wait = (3u64 << attempt.min(4)).min(60);
+                    tracing::warn!(
+                        "[RemoteControl] 初始 drain 失败(第 {} 次,{wait}s 后重试): {e}",
+                        attempt + 1
+                    );
+                    tokio::time::sleep(Duration::from_secs(wait)).await;
+                }
+            }
+        }
+        if !drained {
+            // drain 始终失败:不进 live loop(避免 offset=0 重放积压),回外层整体重建。
+            tracing::warn!("[RemoteControl] 初始 drain 持续失败,本次不进 live loop,稍后重建会话");
+            continue;
+        }
+        tracing::info!(
+            "[RemoteControl] Telegram bot daemon 已启动 (driver schema v{})",
+            driver::DRIVER_SCHEMA_VERSION
+        );
+        // 内层长轮询循环:开关关闭 / token 变更时退出回外层重建。
+        // 连续错误用指数退避(3→6→…→封顶 60s)避免永久错误(如 token 失效)下
+        // 3s 一轮刷屏空转;日志降频(首次 warn,后续 debug)。
+        let mut err_backoff: u64 = 0;
+        loop {
+            if !enabled() || bot_token().as_deref() != Some(token.as_str()) {
+                tracing::info!("[RemoteControl] 配置变更,重建 bot 会话");
+                break;
+            }
+            match client.get_updates(offset, LONG_POLL_SECS).await {
+                Ok(updates) => {
+                    err_backoff = 0;
+                    // long-poll 期间(最长 25s)用户可能关开关 / 换 token:这批 update 属于
+                    // 旧会话,丢弃并回外层重建,避免「发给已停用/旧 bot 的指令仍驱动 Codex」
+                    // (bot-review P2)。回内层 loop 顶,顶部 stale 检查会 break。
+                    if !enabled() || bot_token().as_deref() != Some(token.as_str()) {
+                        continue;
+                    }
+                    for u in updates {
+                        offset = offset.max(u.update_id + 1);
+                        if let Some(msg) = u.message {
+                            // spawn:长轮次不阻塞长轮询(否则 /stop 在轮次中收不到)
+                            let client2 = client.clone();
+                            tokio::spawn(async move { handle_message(&client2, msg).await });
+                        }
+                    }
+                }
+                Err(e) => {
+                    if err_backoff == 0 {
+                        tracing::warn!("[RemoteControl] getUpdates 错误(将退避重试): {e}");
+                        err_backoff = 3;
+                    } else {
+                        err_backoff = (err_backoff * 2).min(60);
+                        tracing::debug!(
+                            "[RemoteControl] getUpdates 持续错误,退避 {err_backoff}s: {e}"
+                        );
+                    }
+                    tokio::time::sleep(Duration::from_secs(err_backoff)).await;
+                }
+            }
+        }
+    }
+}
+
+/// 仅私聊可驱动:非 private(群/超级群/频道)拒绝;kind 缺失(老 API)按私聊放行。
+fn is_drivable_chat(msg: &Message) -> bool {
+    msg.chat.kind.as_deref().map_or(true, |k| k == "private")
+}
+
+async fn handle_message(client: &TelegramClient, msg: Message) {
+    let chat_id = msg.chat.id;
+    // 仅私聊驱动(bot-review P2):bot 被拉进群/超级群/频道时,群内消息不应驱动 Codex。
+    // 非 private 静默忽略(不在群里刷屏)。
+    if !is_drivable_chat(&msg) {
+        return;
+    }
+    let sender_id = msg.from.as_ref().map(|f| f.id);
+    if !is_authorized(&msg, &allowed_users()) {
+        let id = sender_id
+            .map(|i| i.to_string())
+            .unwrap_or_else(|| "?".into());
+        notify(
+            client,
+            chat_id,
+            &format!(
+                "⛔ 未授权。请在 transfer 设置的「远程控制白名单」加入你的**数字 user id**,再重试:\n\
+                 • user id = {id}\n(出于安全,只按数字 id 授权,不支持 @username)"
+            ),
+        )
+        .await;
+        return;
+    }
+    let Some(sender_id) = sender_id else {
+        return;
+    };
+
+    let text = msg.text.unwrap_or_default();
+    let text = text.trim();
+    if text.is_empty() {
+        return;
+    }
+    if let Some(cmd) = text.strip_prefix('/') {
+        handle_command(client, chat_id, cmd).await;
+    } else {
+        run_turn(client, chat_id, sender_id, text).await;
+    }
+}
+
+async fn handle_command(client: &TelegramClient, chat_id: i64, cmd: &str) {
+    // 去掉 Telegram 的 @botname 后缀,取首 token 作命令名
+    let name = cmd.split_whitespace().next().unwrap_or("");
+    let name = name.split('@').next().unwrap_or(name).to_lowercase();
+    let reply = match name.as_str() {
+        "start" | "help" | "帮助" => HELP_TEXT.to_string(),
+        "status" | "状态" => match driver::snapshot().await {
+            Ok(s) => format!(
+                "📟 Codex 状态\n• composer: {}\n• 运行中: {}",
+                if s.composer_present {
+                    "在场"
+                } else {
+                    "不在场"
+                },
+                match s.submitting {
+                    Some(true) => "是",
+                    Some(false) => "否",
+                    None => "未知",
+                }
+            ),
+            Err(e) => format!("⚠️ 读取状态失败:{e}\n(确认 Codex.app 正在运行)"),
+        },
+        // /new 取 TURN_LOCK(try_lock):有轮次进行中则拒绝,避免并发点新建把活动对话
+        // 从正在跑的 run_turn 下面换掉(bot-review P2)。/status /stop 仍 bypass(正确)。
+        "new" | "新建" => match TURN_LOCK.try_lock() {
+            Ok(_guard) => match driver::new_chat().await {
+                Ok(true) => "🆕 已新建对话".to_string(),
+                Ok(false) => "未找到新建按钮(当前视图可能不支持)".to_string(),
+                Err(e) => format!("⚠️ 新建失败:{e}"),
+            },
+            Err(_) => "⏳ 有一轮对话正在进行,请先 /stop 或等它结束再 /new。".to_string(),
+        },
+        "stop" | "停止" => match driver::stop().await {
+            Ok(via) if via == "none" => "ℹ️ 当前没有正在进行的轮次,无需停止。".to_string(),
+            Ok(via) => format!("🛑 已发送停止({via})"),
+            Err(e) => format!("⚠️ 停止失败:{e}"),
+        },
+        other => format!("未知命令 /{other}。发送 /help 看可用命令。"),
+    };
+    notify(client, chat_id, &reply).await;
+}
+
+/// 给用户回消息(best-effort);失败仅 log(回消息通道都断了无更优雅补救)。
+/// 区别于 `let _ =` 静默吞咽:至少留痕,便于区分「用户没收到」vs「我没发出去」。
+async fn notify(client: &TelegramClient, chat_id: i64, text: &str) {
+    if let Err(e) = client.send_message(chat_id, text).await {
+        tracing::warn!(chat_id, "[RemoteControl] 回复发送失败: {e}");
+    }
+}
+
+const HELP_TEXT: &str = "🤖 Codex 远程控制\n\
+    直接发消息 = 给 Codex 当前对话发一轮 prompt。\n\n\
+    命令:\n\
+    /new 新建对话\n\
+    /stop 停止当前轮\n\
+    /status 查看 Codex 状态\n\
+    /help 帮助\n\n\
+    注:M1 为对话问答式;若 Codex 需要批准命令/工具,请到桌面端确认(批准转发到手机为 M2)。";
+
+/// 驱动 Codex 跑一轮并流式回发。取 [`TURN_LOCK`] 串行化(一台 Codex 一次一轮)。
+/// `sender_id` = 发起者数字 user id,用于取锁后重新鉴权(排队期间可能被移出白名单)。
+async fn run_turn(client: &TelegramClient, chat_id: i64, sender_id: i64, prompt: &str) {
+    let _guard = TURN_LOCK.lock().await;
+    // 排队等锁期间(前一轮可能跑数分钟)配置 / 白名单可能变 → 取到锁后**重查**:
+    // 关开关 / 发起者已被移出白名单,则取消本次,不驱动 Codex(bot-review P2)。
+    let still_authorized = allowed_users().iter().any(|a| a == &sender_id.to_string());
+    if !enabled() || !still_authorized {
+        notify(
+            client,
+            chat_id,
+            "ℹ️ 远程控制已关闭或你已不在白名单,本次指令已取消。",
+        )
+        .await;
+        return;
+    }
+
+    // 1) 确保 composer 在场(不在则新建对话)。new_chat 失败/没找到按钮必须显式
+    //    告知并 return —— 否则下游 set_input 退化成误导性的「输入失败」。
+    match driver::snapshot().await {
+        // 初始已在跑(桌面端有一轮进行中)→ 拒绝注入(bot-review P2):此时发送钮是停止钮,
+        // set_input/submit 会覆盖草稿并停掉桌面轮次。此处未驱动任何东西,释放锁安全。
+        Ok(s) if s.submitting == Some(true) => {
+            notify(
+                client,
+                chat_id,
+                "⏳ Codex 桌面端有一轮正在进行,请等它结束、或在桌面停止后再发。",
+            )
+            .await;
+            return;
+        }
+        Ok(s) if !s.composer_present => match driver::new_chat().await {
+            Ok(true) => tokio::time::sleep(Duration::from_millis(1500)).await,
+            Ok(false) => {
+                notify(
+                    client,
+                    chat_id,
+                    "⚠️ 当前 Codex 视图没有输入框,也找不到「新建对话」按钮。请在桌面端打开一个对话后重试。",
+                )
+                .await;
+                return;
+            }
+            Err(e) => {
+                tracing::warn!("[RemoteControl] new_chat 失败: {e}");
+                notify(
+                    client,
+                    chat_id,
+                    &format!("⚠️ 无法新建对话:{e}\n(确认 Codex.app 正在运行)"),
+                )
+                .await;
+                return;
+            }
+        },
+        Ok(_) => {}
+        Err(e) => {
+            notify(
+                client,
+                chat_id,
+                &format!("⚠️ Codex 未就绪:{e}\n(确认 Codex.app 正在运行)"),
+            )
+            .await;
+            return;
+        }
+    }
+
+    // 2) 灌 prompt + 提交
+    if let Err(e) = driver::set_input(prompt).await {
+        notify(client, chat_id, &format!("⚠️ 输入失败:{e}")).await;
+        return;
+    }
+    tokio::time::sleep(Duration::from_millis(350)).await;
+    if let Err(e) = driver::submit().await {
+        notify(client, chat_id, &format!("⚠️ 提交失败:{e}")).await;
+        return;
+    }
+
+    // 3) 占位消息 + 流式编辑。占位发送失败**不 return**(submit 已让 Codex 起跑,return
+    //    会放锁让下条 prompt 驱动同页,bot-review P2):msg_id 置 None,无流式但仍持锁轮询
+    //    到 Codex 空闲。
+    let msg_id: Option<i64> = match client.send_message(chat_id, "▍ 正在处理…").await {
+        Ok(id) => Some(id),
+        Err(e) => {
+            tracing::warn!("[RemoteControl] 占位消息发送失败,改为静默持锁轮询到 Codex 空闲: {e}");
+            None
+        }
+    };
+    // 不变量(bot-review P2):TURN_LOCK 必须持到 Codex 真正空闲(submitting==false)/
+    // CDP 不可达 / MAX_POLLS 才释放 —— 绝不在本地轮次仍在跑时 return/break 放锁,否则
+    // 下一条 prompt 会驱动同一页面、破坏 one-turn-at-a-time。故所有「无文本/编辑失败」
+    // 情形只发一次提示,继续持锁轮询,不提前 return。
+    let mut last_sent = String::new(); // 已成功编辑进 Telegram 的内容
+    let mut last_seen = String::new(); // Codex 上一轮观察到的内容(稳定性判定,与编辑解耦)
+    let mut stable: u32 = 0;
+    let mut read_err_streak: u32 = 0;
+    let mut edit_err_streak: u32 = 0;
+    let mut give_up_edit = false; // 编辑连续失败 → 停止编辑但继续持锁轮询
+    let mut saw_running = false; // submitting 出现过 Some(true)(模型确实起跑)
+    let mut warned_no_text = false; // 「无文本」提示只发一次
+    let mut completed = false; // 是否经「真实 idle 证据」正常完成(区别于超时/CDP 断)
+    for i in 0..MAX_POLLS {
+        tokio::time::sleep(STREAM_POLL).await;
+        let snap = match driver::snapshot().await {
+            Ok(s) => {
+                read_err_streak = 0;
+                s
+            }
+            Err(_) => {
+                read_err_streak += 1;
+                if read_err_streak >= 5 {
+                    break; // Codex 退出/CDP 断 → 已不可驱动,释放锁安全
+                }
+                continue;
+            }
+        };
+        if snap.submitting == Some(true) {
+            saw_running = true;
+        }
+        let trimmed = truncate_tg(&snap.reply.unwrap_or_default());
+        // 稳定性按「Codex 观察到的内容是否变化」算,与能否成功编辑解耦
+        if trimmed == last_seen {
+            stable += 1;
+        } else {
+            stable = 0;
+            last_seen = trimmed.clone();
+        }
+        // 流式编辑(占位消息存在且未放弃时):C1 —— 仅成功才推进 last_sent;连续失败熔断
+        // 但**不 return**,改为停止编辑、继续持锁轮询到 Codex 空闲。
+        if let Some(mid) = msg_id {
+            if !give_up_edit && !trimmed.is_empty() && trimmed != last_sent {
+                match client.edit_message_text(chat_id, mid, &trimmed).await {
+                    Ok(()) => {
+                        last_sent = trimmed;
+                        edit_err_streak = 0;
+                    }
+                    Err(e) => {
+                        edit_err_streak += 1;
+                        tracing::warn!(
+                            chat_id,
+                            fail = edit_err_streak,
+                            "[RemoteControl] editMessageText 失败: {e}"
+                        );
+                        if edit_err_streak >= 3 {
+                            give_up_edit = true;
+                            let _ = client
+                                .send_message(
+                                    chat_id,
+                                    "⚠️ 流式更新中断(bot 可能被限流/踢出/token 失效)。Codex 仍在本地继续,完成前不接受新指令;可发 /stop 中止。",
+                                )
+                                .await;
+                        }
+                    }
+                }
+            }
+        }
+        // H1:长时间无文本时给一次提示(不再 return —— 必须持锁到 Codex 空闲)
+        if last_sent.is_empty() && !warned_no_text && ((i >= 15 && !saw_running) || i >= 40) {
+            warned_no_text = true;
+            let msg = if !saw_running {
+                "⏳ Codex 还没开始响应,可能在桌面端等你批准命令/工具(M1 不支持远程批准)。完成前不接受新指令;到桌面确认,或发 /stop 中止。"
+            } else {
+                "⏳ Codex 已开始但暂无文本输出(可能在跑工具或等批准)。完成前不接受新指令;发 /status 查看或 /stop 中止。"
+            };
+            let _ = client.send_message(chat_id, msg).await;
+        }
+        // 完成判定(bot-review P2):必须有**结束证据**,不在仍可能运行时放锁。
+        // ① done_final:Codex 给最终 assistant 答案打了 final-assistant 标记(streaming /
+        //    Thinking / 跑工具 / 等批准期间**不在**)+ 内容稳定 —— 最可靠的结束信号
+        //    (codex-e2e-test skill 实证),作主判据。
+        // ② done_idle_corroborated:submitting==false **本身在 streaming 阶段也会误读 false**
+        //    (见 driver Snapshot 文档),故不能 2 轮即收;要求长稳(8 轮 ≈10s 无变化)+ 非空
+        //    文本作佐证,才把它当结束 —— 覆盖「无 final 标记但确已结束」的兜底。
+        // 两者都拿不到(submitting 漂移 + 无 final 标记 + 无文本,如纯工具轮)→ 不提前完成,
+        // 持锁等到 MAX_POLLS,由循环后的「超时仍在跑则 stop」兜底,绝不在仍在跑时放锁。
+        let done_final = snap.final_ready && stable >= 2;
+        let done_idle_corroborated =
+            snap.submitting == Some(false) && stable >= 8 && !last_seen.is_empty();
+        if done_final || done_idle_corroborated {
+            completed = true;
+            break;
+        }
+    }
+    // 循环退出三种:completed(正常完成)/ read_err_streak(Codex 不可达,释放安全)/
+    // MAX_POLLS 耗尽(可能仍在跑)。后两者取末张快照确认:仍 submitting==true → stop 中止
+    // 再释放锁(bot-review P2:超时仍在跑就放锁会让下条 prompt 驱动同一页面)。
+    if !completed {
+        if let Ok(s) = driver::snapshot().await {
+            if s.submitting == Some(true) {
+                let _ = driver::stop().await;
+                let _ = client
+                    .send_message(
+                        chat_id,
+                        "⏱ 轮次超过时长上限仍在运行,已发送停止以释放远程控制(可重发指令)。",
+                    )
+                    .await;
+            }
+        }
+    }
+    if last_sent.is_empty() {
+        if let Some(mid) = msg_id {
+            if let Err(e) = client
+                .edit_message_text(chat_id, mid, "（本轮无文本输出或超时,可发 /status 查看)")
+                .await
+            {
+                tracing::warn!(chat_id, "[RemoteControl] 收尾编辑失败: {e}");
+            }
+        }
+    }
+}
+
+/// 截断到 Telegram 单条上限(按字符,UTF-8 安全)。
+fn truncate_tg(s: &str) -> String {
+    let s = s.trim();
+    if s.chars().count() <= TG_MAX_CHARS {
+        return s.to_owned();
+    }
+    let head: String = s.chars().take(TG_MAX_CHARS).collect();
+    format!("{head}\n…（已截断)")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use telegram::{Chat, User};
+
+    fn msg_from(id: i64) -> Message {
+        msg_in_chat(id, Some("private"))
+    }
+
+    fn msg_in_chat(id: i64, chat_kind: Option<&str>) -> Message {
+        Message {
+            chat: Chat {
+                id: 100,
+                kind: chat_kind.map(str::to_owned),
+            },
+            from: Some(User { id }),
+            text: Some("hi".into()),
+        }
+    }
+
+    #[test]
+    fn only_private_chats_drivable() {
+        assert!(is_drivable_chat(&msg_in_chat(1, Some("private"))));
+        assert!(is_drivable_chat(&msg_in_chat(1, None))); // kind 缺失放行
+        assert!(!is_drivable_chat(&msg_in_chat(1, Some("group"))));
+        assert!(!is_drivable_chat(&msg_in_chat(1, Some("supergroup"))));
+        assert!(!is_drivable_chat(&msg_in_chat(1, Some("channel"))));
+    }
+
+    #[test]
+    fn authorized_by_numeric_id() {
+        let allow = vec!["12345".to_string()];
+        assert!(is_authorized(&msg_from(12345), &allow));
+        assert!(!is_authorized(&msg_from(99999), &allow));
+    }
+
+    #[test]
+    fn username_entries_never_authorize() {
+        // bot-review P1:白名单里的 @username(非数字)项绝不授权,只认稳定数字 id。
+        let allow = vec!["alice".to_string(), "@bob".to_string()];
+        assert!(!is_authorized(&msg_from(1), &allow));
+        assert!(!is_authorized(&msg_from(42), &allow));
+    }
+
+    #[test]
+    fn unauthorized_when_no_from() {
+        let allow = vec!["1".to_string()];
+        let mut m = msg_from(1);
+        m.from = None;
+        assert!(!is_authorized(&m, &allow));
+    }
+
+    #[test]
+    fn truncate_keeps_short() {
+        assert_eq!(truncate_tg("  hi  "), "hi");
+    }
+
+    #[test]
+    fn truncate_caps_long() {
+        let long = "x".repeat(5000);
+        let out = truncate_tg(&long);
+        assert!(out.chars().count() <= TG_MAX_CHARS + 12);
+        assert!(out.ends_with("已截断)"));
+    }
+}
diff --git a/src-tauri/src/codex_remote/telegram.rs b/src-tauri/src/codex_remote/telegram.rs
new file mode 100644
index 00000000..5b192539
--- /dev/null
+++ b/src-tauri/src/codex_remote/telegram.rs
@@ -0,0 +1,150 @@
+//! Telegram Bot API 客户端(MOC-249 移动端远程控制 M1)。
+//!
+//! 纯 HTTPS long-poll —— 不需要 relay / 公网回调 / webhook,绕开 Codex renderer 的
+//! CSP(对外连接放 Rust 侧)。只用到三个 method:`getUpdates`(收)、`sendMessage` +
+//! `editMessageText`(发 + 流式编辑)。
+//!
+//! 端点 `https://api.telegram.org/bot<token>/<method>`,响应统一信封
+//! `{ok, result?, description?}`。
+
+use serde::Deserialize;
+
+const API_BASE: &str = "https://api.telegram.org";
+
+/// 一条入站更新(只关心普通文本消息;callback_query 等留 M2)。
+#[derive(Debug, Clone, Deserialize)]
+pub struct Update {
+    pub update_id: i64,
+    #[serde(default)]
+    pub message: Option<Message>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Message {
+    pub chat: Chat,
+    #[serde(default)]
+    pub from: Option<User>,
+    #[serde(default)]
+    pub text: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Chat {
+    pub id: i64,
+    /// Telegram chat 类型:`private` / `group` / `supergroup` / `channel`。
+    /// 远程控制只接受 `private`(防 bot 被拉进群后群内消息驱动 Codex)。
+    #[serde(default, rename = "type")]
+    pub kind: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct User {
+    pub id: i64,
+}
+
+#[derive(Deserialize)]
+struct ApiEnvelope<T> {
+    ok: bool,
+    result: Option<T>,
+    description: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct SentMessage {
+    message_id: i64,
+}
+
+/// Telegram bot 客户端。`http` 的超时必须 > long-poll timeout(否则 getUpdates 自断)。
+#[derive(Clone)]
+pub struct TelegramClient {
+    token: String,
+    http: reqwest::Client,
+}
+
+impl TelegramClient {
+    /// `long_poll_secs` = getUpdates 服务端挂起秒数;http 超时取其 + 10s 余量。
+    pub fn new(token: impl Into<String>, long_poll_secs: u64) -> Result<Self, String> {
+        let http = reqwest::Client::builder()
+            .timeout(std::time::Duration::from_secs(long_poll_secs + 10))
+            .connect_timeout(std::time::Duration::from_secs(10))
+            .build()
+            .map_err(|e| e.to_string())?;
+        Ok(Self {
+            token: token.into(),
+            http,
+        })
+    }
+
+    fn url(&self, method: &str) -> String {
+        format!("{API_BASE}/bot{}/{method}", self.token)
+    }
+
+    async fn call<T: for<'de> Deserialize<'de>>(
+        &self,
+        method: &str,
+        body: serde_json::Value,
+    ) -> Result<T, String> {
+        // `without_url()`:reqwest::Error 的 Display 含完整请求 URL,而 URL 里嵌着
+        // `/bot<token>/`(授予远程控制权的凭据)。错误串会进日志 / 回给用户,必须先剥 URL
+        // 防 token 泄露(bot-review P1)。
+        let resp = self
+            .http
+            .post(self.url(method))
+            .json(&body)
+            .send()
+            .await
+            .map_err(|e| format!("{method} 网络错误: {}", e.without_url()))?;
+        let env: ApiEnvelope<T> = resp
+            .json()
+            .await
+            .map_err(|e| format!("{method} 解析失败: {}", e.without_url()))?;
+        if !env.ok {
+            return Err(format!(
+                "{method} API 错误: {}",
+                env.description.unwrap_or_default()
+            ));
+        }
+        env.result.ok_or_else(|| format!("{method} 响应缺 result"))
+    }
+
+    /// long-poll 拉更新。`offset` = 上次最大 update_id + 1(已确认的不再下发)。
+    pub async fn get_updates(&self, offset: i64, timeout_secs: u64) -> Result<Vec<Update>, String> {
+        self.call(
+            "getUpdates",
+            serde_json::json!({
+                "offset": offset,
+                "timeout": timeout_secs,
+                "allowed_updates": ["message"],
+            }),
+        )
+        .await
+    }
+
+    /// 发文本,返回新消息的 message_id(供后续 [`Self::edit_message_text`] 流式编辑)。
+    pub async fn send_message(&self, chat_id: i64, text: &str) -> Result<i64, String> {
+        let sent: SentMessage = self
+            .call(
+                "sendMessage",
+                serde_json::json!({ "chat_id": chat_id, "text": text }),
+            )
+            .await?;
+        Ok(sent.message_id)
+    }
+
+    /// 编辑已发消息的文本(流式回复:占位消息随 assistant 输出增量更新)。
+    /// Telegram 对「内容未变」的编辑会回 400,调用方应跳过无变化的编辑。
+    pub async fn edit_message_text(
+        &self,
+        chat_id: i64,
+        message_id: i64,
+        text: &str,
+    ) -> Result<(), String> {
+        let _: serde_json::Value = self
+            .call(
+                "editMessageText",
+                serde_json::json!({ "chat_id": chat_id, "message_id": message_id, "text": text }),
+            )
+            .await?;
+        Ok(())
+    }
+}
diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs
index 92ff2c59..eadff1bb 100644
--- a/src-tauri/src/main.rs
+++ b/src-tauri/src/main.rs
@@ -8,6 +8,7 @@ mod anyrouter_quota;
 mod codex_plugin_unlocker;
 mod codex_quota_injector;
 mod codex_real_account;
+mod codex_remote;
 mod codex_theme_injector;
 mod deepseek_quota;
 mod glm_quota;
@@ -152,6 +153,10 @@ fn main() {
             // 开关关 / CDP 不可达时 tick 内静默跳过,常驻无负担。
             tauri::async_runtime::spawn(codex_quota_injector::run_quota_daemon());
 
+            // [MOC-249] 移动端远程控制 daemon:开关开 + 配了 Telegram bot token 时,
+            // 长轮询收手机指令,经 CDP 驱动 Codex 跑一轮并流式回发。关 / 无 token 时空转。
+            tauri::async_runtime::spawn(codex_remote::run_remote_control_daemon());
+
             // [MOC-231] GC 旧的上下文明细缓存(context-breakdown/<uuid>.json,每对话一个;
             // >14 天的陈旧对话删除,下次有请求会重建)。fire-and-forget,不阻塞 startup。
             tauri::async_runtime::spawn(async {