@karpeleslab/teamclaude 1.0.8 → 1.1.0

package/README.md

@@ -24,7 +24,7 @@ Sits transparently between Claude Code and the Anthropic API, managing multiple
 - **Enable/disable accounts** — temporarily pause an account without removing it (`teamclaude disable`/`enable`, or `d` in the TUI); re-enabling also clears a stuck error state
 - **Quota persistence** — observed quota survives restarts (saved to a sibling state file), so rotation state isn't lost on restart; stale windows are discarded automatically
 - **Optional quota probe** — off by default; when enabled, periodically refreshes idle accounts' quota from the usage endpoint (no message spend), and surfaces the Sonnet weekly bucket
-- **Optional MITM proxy mode** — `teamclaude run --mitm` routes claude via an HTTPS forward proxy with a local CA so even hardcoded `api.anthropic.com` endpoints (e.g. the Claude Design MCP) get the real token injected
+- **MITM proxy mode (default)** — `teamclaude run` routes claude via an HTTPS forward proxy with a local CA so even hardcoded `api.anthropic.com` endpoints (e.g. the Claude Design MCP) get the real token injected; pass `--no-mitm` for base-URL routing only
 - **Optional sx.org proxy mode** — off by default; set an [sx.org](https://sx.org) API key in the TUI settings screen (`g`) and TeamClaude auto-provisions a residential proxy to change the egress IP and work around IP-based `429`s. Three modes (`m` to cycle): **always** (route all upstream traffic), **on 429 only** (stay direct, fail over to the proxy after a 429), or **off** (keep the key but don't use it). TLS stays end-to-end with Anthropic (the proxy only relays ciphertext)
 - **Request logging** — optional full request/response logging for debugging
 - **Zero dependencies** — uses only Node.js built-in modules
@@ -138,6 +138,12 @@ teamclaude run
 
 `run` probes the proxy first: if it's up, Claude Code is routed through it; if it's **not** running, `claude` is launched directly so nothing breaks.
 
+Since **1.1.0**, `run` defaults to [MITM forward-proxy mode](#mitm-proxy-mode-default) so even hardcoded `api.anthropic.com` endpoints (e.g. the Claude Design MCP) are intercepted. To keep the previous base-URL-only behavior, pass `--no-mitm`:
+
+```bash
+teamclaude run --no-mitm
+```
+
 Or manually set the environment:
 
 ```bash
@@ -255,14 +261,18 @@ You can also set the interval live from the TUI settings screen (`g` → `p`), a
 
 It reads each OAuth account's utilization from Anthropic's usage endpoint (`/api/oauth/usage`), which reports quota **without consuming any message quota**. Minimum interval is 30s. Changing it takes effect on a running server immediately (no restart). When enabled, it also surfaces the **Sonnet 7-day** bucket as an extra bar in the TUI / `status` (when your plan exposes it).
 
-### MITM proxy mode (optional, off by default)
+### MITM proxy mode (default)
 
-The normal reverse-proxy only intercepts what `ANTHROPIC_BASE_URL` covers. Some Claude Code features (e.g. the **Claude Design MCP**) use a **hardcoded** `https://api.anthropic.com` URL that ignores that variable, so they bypass the proxy. MITM proxy mode captures those too.
+The plain reverse-proxy only intercepts what `ANTHROPIC_BASE_URL` covers. Some Claude Code features (e.g. the **Claude Design MCP**) use a **hardcoded** `https://api.anthropic.com` URL that ignores that variable, so they bypass the proxy. MITM proxy mode captures those too, which is why it's the default for `teamclaude run` (and the shell alias):
+
+```bash
+teamclaude run -- <claude args...>
+```
 
-Run claude with the `--mitm` flag:
+To opt out and route via `ANTHROPIC_BASE_URL` only, pass `--no-mitm`:
 
 ```bash
-teamclaude run --mitm -- <claude args...>
+teamclaude run --no-mitm -- <claude args...>
 ```
 
 That launches claude pointed at teamclaude as an **HTTPS forward proxy** (`HTTPS_PROXY`) and trusts a locally-generated CA (`NODE_EXTRA_CA_CERTS`). For an intercepted host, teamclaude **dials the real upstream first, mirrors its negotiated ALPN** (HTTP/2 or HTTP/1.1), then terminates TLS toward claude with the same protocol and relays the traffic **as transparently as possible** — rewriting only what it must:
@@ -271,7 +281,7 @@ That launches claude pointed at teamclaude as an **HTTPS forward proxy** (`HTTPS
 - the **`account_uuid`** inside `metadata.user_id` → the active account's UUID (so the body agrees with the injected token);
 - and it reads `anthropic-ratelimit-*` from responses for quota.
 
-Everything else is copied byte-for-byte (HTTP/2 is handled with a built-in HPACK codec so the only header changed is the auth one). Any host other than the upstream is blind-tunnelled. The server accepts *both* base-URL and proxy clients at once, so instances launched with and without `--mitm` can share one server.
+Everything else is copied byte-for-byte (HTTP/2 is handled with a built-in HPACK codec so the only header changed is the auth one). Any host other than the upstream is blind-tunnelled. The server accepts *both* base-URL and proxy clients at once, so instances launched with and without `--no-mitm` can share one server.
 
 Trust model:
 - The CA is generated locally, stored in the config dir, and trusted **only** by the claude process you launch via `teamclaude run` (through `NODE_EXTRA_CA_CERTS`) — it is **never** added to your system trust store. The leaf private key is `0600`; the CA private key is never written to disk.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karpeleslab/teamclaude",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "description": "Multi-account Claude proxy with automatic quota-based rotation",
   "type": "module",
   "main": "src/index.js",
@@ -23,6 +23,14 @@
     "multi-account"
   ],
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KarpelesLab/teamclaude.git"
+  },
+  "bugs": {
+    "url": "https://github.com/KarpelesLab/teamclaude/issues"
+  },
+  "homepage": "https://github.com/KarpelesLab/teamclaude#readme",
   "engines": {
     "node": ">=18.0.0"
   },

package/src/index.js

@@ -444,13 +444,18 @@ async function envCommand() {
 async function runCommand() {
   const config = await loadOrCreateConfig();
 
-  // Args after 'run'. teamclaude flags (e.g. --mitm) are recognized only before
-  // an optional `--` separator; everything after `--` goes verbatim to claude.
+  // Args after 'run'. teamclaude flags (e.g. --no-mitm) are recognized only
+  // before an optional `--` separator; everything after `--` goes verbatim to
+  // claude. MITM forward-proxy mode is the default so hardcoded api.anthropic.com
+  // endpoints are intercepted too; --no-mitm opts back into base-URL-only routing.
+  // --mitm is still accepted (now a no-op) for backward compatibility.
   const rest = args.slice(1);
   const sep = rest.indexOf('--');
   const tcFlags = sep >= 0 ? rest.slice(0, sep) : rest;
-  const useMitm = tcFlags.includes('--mitm');
-  const claudeArgs = sep >= 0 ? rest.slice(sep + 1) : rest.filter(a => a !== '--mitm');
+  const useMitm = !tcFlags.includes('--no-mitm');
+  const claudeArgs = sep >= 0
+    ? rest.slice(sep + 1)
+    : rest.filter(a => a !== '--mitm' && a !== '--no-mitm');
 
   // Route through the proxy only when it's actually up; otherwise launch claude
   // directly so a stopped proxy doesn't break `claude`. This is what lets the
@@ -564,7 +569,7 @@ async function accountsCommand() {
       a.refreshToken = newTokens.refreshToken;
       a.expiresAt = newTokens.expiresAt;
       configDirty = true;
-    } catch (err) {
+    } catch {
       // refresh failed — fetchProfile will report the specific error
     }
   }));
@@ -884,10 +889,11 @@ Commands:
   login               OAuth login via browser
   login --api         Add an API key account
   env                 Print env vars to use with Claude
-  run [--mitm] [-- args...]
-                      Run Claude Code through the proxy (direct if it's down);
-                      --mitm routes via an HTTPS forward proxy + local CA so even
-                      hardcoded api.anthropic.com endpoints are intercepted
+  run [--no-mitm] [-- args...]
+                      Run Claude Code through the proxy (direct if it's down).
+                      Routes via an HTTPS forward proxy + local CA by default, so
+                      even hardcoded api.anthropic.com endpoints are intercepted;
+                      --no-mitm uses base-URL routing only
   alias               Print a shell alias so plain 'claude' routes via the proxy
                       (--install to write it to your shell rc; --uninstall to remove)
   status              Show proxy & account status (live)
@@ -909,10 +915,10 @@ Options:
                       --json '{"accessToken":"...","refreshToken":"...","expiresAt":1234}'
   --log-to DIR        Log full requests/responses to DIR (server, one file per request)
   --headless          Run the server without the interactive TUI (for backgrounding)
-  --mitm              (run) route claude via the HTTPS forward proxy + local CA
+  --no-mitm           (run) skip the forward proxy; route via ANTHROPIC_BASE_URL only
 
 The server always accepts both base-URL and proxy/CONNECT clients, so instances
-launched with and without --mitm can share one server.
+launched with and without --no-mitm can share one server.
 
 A running server re-syncs accounts from config on POST /teamclaude/reload
 (local only). add/login/enable/disable/priority trigger it automatically.
@@ -1117,7 +1123,7 @@ function argValue(flag) {
   return (i >= 0 && args[i + 1]) ? args[i + 1] : null;
 }
 
-// Hostname of the configured upstream (the host MITM-intercepts under `run --mitm`).
+// Hostname of the configured upstream (the host MITM-intercepts under `run`).
 function upstreamHost(config) {
   try { return new URL(config.upstream || 'https://api.anthropic.com').hostname; }
   catch { return 'api.anthropic.com'; }

package/src/oauth.js

@@ -149,15 +149,15 @@ export async function fetchProfile(accessToken) {
 }
 
 // Normalize one usage bucket from the /api/oauth/usage payload into
-// { utilization: 0-1, resetAt: ms-epoch }. Tolerant of field-name and
-// percentage/fraction and seconds/ms variations across payload versions.
+// { utilization: 0-1, resetAt: ms-epoch }. The endpoint reports utilization
+// as a percentage in the 0-100 range, so 1 means 1%, not 100%.
 export function normalizeUsageBucket(bucket) {
   if (!bucket || typeof bucket !== 'object') return null;
 
   const rawPct = bucket.used_percentage ?? bucket.utilization ?? bucket.usedPercentage;
   const parsedPct = typeof rawPct === 'number' ? rawPct : parseFloat(rawPct);
   const utilization = Number.isFinite(parsedPct)
-    ? (parsedPct > 1 ? parsedPct / 100 : parsedPct)
+    ? parsedPct / 100
     : null;
 
   const rawReset = bucket.resets_at ?? bucket.resetsAt ?? bucket.reset_at ?? bucket.resetAt;

package/src/tui.js

@@ -8,6 +8,7 @@ const ESC = '\x1b[';
 const RESET = `${ESC}0m`;
 const BOLD = `${ESC}1m`;
 const DIM = `${ESC}2m`;
+const REV = `${ESC}7m`;   // reverse video — used for the BIOS-style settings cursor
 
 const bold = s => `${BOLD}${s}${RESET}`;
 const dim = s => `${DIM}${s}${RESET}`;
@@ -129,9 +130,11 @@ export class TUI {
     this.mode = 'normal';    // normal | select | add | input | settings
     this.selAction = null;   // switch | remove
     this.selIdx = 0;
+    this.setIdx = 0;         // cursor row on the settings screen (BIOS-style nav)
     this.inputPrompt = '';
     this.inputBuf = '';
     this.inputCb = null;
+    this.inputReturn = 'normal'; // mode to fall back to when an input is cancelled
     this.frame = 0;
     this.running = false;
     this.timer = null;
@@ -208,6 +211,8 @@ export class TUI {
   _onData(d) {
     if (d === '\x1b[A') return this._key('up');
     if (d === '\x1b[B') return this._key('down');
+    if (d === '\x1b[C') return this._key('right');
+    if (d === '\x1b[D') return this._key('left');
     if (d === '\x1b') return this._key('esc');
     if (d === '\r' || d === '\n') return this._key('enter');
     if (d === '\x03') return this._key('ctrl-c');
@@ -241,33 +246,118 @@ export class TUI {
     }
     else if (k === 'a') { this.mode = 'add'; }
     else if (k === 'R') { this._doSync(); }
-    else if (k === 'g' && this.sx) { this.mode = 'settings'; this._loadSxBalance(); }
+    else if (k === 'g' && this.sx) { this.mode = 'settings'; this.setIdx = 0; this._loadSxBalance(); }
+  }
+
+  // Navigable rows on the settings screen, top to bottom. Both the renderer and
+  // the key handler build this list so the cursor and the display stay in sync.
+  // Rows are conditional (sx.org rows only when that build feature is present),
+  // so always index through the returned array — never hard-code positions.
+  _settingsFields() {
+    const fields = [];
+
+    fields.push({
+      id: 'threshold',
+      label: 'Switch threshold',
+      hint: '←→ ±1%',
+      value: () => {
+        const thr = this.am.switchThreshold ?? this.config.switchThreshold ?? 0.98;
+        return green(`${Math.round(thr * 100)}%`);
+      },
+      left: () => this._nudgeThreshold(-1),
+      right: () => this._nudgeThreshold(+1),
+      enter: () => this._promptInput('Switch threshold % (1-100)', v => this._doSetThreshold(v.trim())),
+    });
+
+    fields.push({
+      id: 'probe',
+      label: 'Quota probe',
+      hint: '←→ ±30s',
+      value: () => {
+        const probe = this.config.quotaProbeSeconds || 0;
+        return probe > 0 ? green(`${probe}s`) : gray('off (passive)');
+      },
+      left: () => this._nudgeProbe(-30),
+      right: () => this._nudgeProbe(+30),
+      enter: () => this._promptInput('Quota probe seconds (0=off, min 30)', v => this._doSetProbe(v.trim())),
+    });
+
+    if (this.sx) {
+      fields.push({
+        id: 'sxmode',
+        label: 'sx.org mode',
+        hint: '←→ cycle',
+        value: () => {
+          const mode = this.sx.getMode();
+          return mode === 'always' ? green('always')
+            : mode === '429' ? cyan('on 429 only')
+            : gray('off');
+        },
+        left: () => this._cycleSxMode(-1),
+        right: () => this._cycleSxMode(+1),
+        enter: () => this._cycleSxMode(+1),
+      });
+
+      fields.push({
+        id: 'sxkey',
+        label: 'sx.org API key',
+        hint: 'Enter to set',
+        value: () => {
+          const key = this.config.sx?.apiKey;
+          return key ? key.slice(0, 4) + '…' + key.slice(-4) : dim('(not set)');
+        },
+        enter: () => this._promptInput('sx.org API key', v => this._doSetSxKey(v.trim())),
+      });
+
+      if (this.config.sx?.apiKey) {
+        fields.push({
+          id: 'sxclear',
+          label: 'Clear sx.org key',
+          hint: 'Enter to clear',
+          value: () => dim('—'),
+          enter: () => this._doClearSxKey(),
+        });
+      }
+    }
+
+    return fields;
   }
 
   _keySettings(k) {
-    if (k === 't') {
-      this.mode = 'input';
-      this.inputPrompt = 'Switch threshold % (1-100)';
-      this.inputBuf = '';
-      this.inputCb = v => { if (v) this._doSetThreshold(v.trim()); };
-    }
-    else if (k === 'p') {
-      this.mode = 'input';
-      this.inputPrompt = 'Quota probe seconds (0=off, min 30)';
-      this.inputBuf = '';
-      this.inputCb = v => { if (v) this._doSetProbe(v.trim()); };
-    }
-    else if (k === 'k') {
-      this.mode = 'input';
-      this.inputPrompt = 'sx.org API key';
-      this.inputBuf = '';
-      this.inputCb = v => { if (v) this._doSetSxKey(v.trim()); };
-    }
-    else if (k === 'm') { this._doCycleSxMode(); }
-    else if (k === 'x') { this._doClearSxKey(); }
+    const fields = this._settingsFields();
+    const n = fields.length;
+    if (n > 0 && this.setIdx >= n) this.setIdx = n - 1;
+    const f = fields[this.setIdx];
+
+    if (k === 'up' || k === 'k') this.setIdx = (this.setIdx - 1 + n) % n;
+    else if (k === 'down' || k === 'j') this.setIdx = (this.setIdx + 1) % n;
+    else if (k === 'left') f?.left?.();
+    else if (k === 'right') f?.right?.();
+    else if (k === 'enter') f?.enter?.();
     else if (k === 'esc' || k === 'q') { this.mode = 'normal'; }
   }
 
+  // Open the text-input prompt and return to the settings screen afterward.
+  _promptInput(prompt, cb) {
+    this.mode = 'input';
+    this.inputReturn = 'settings';
+    this.inputPrompt = prompt;
+    this.inputBuf = '';
+    this.inputCb = v => { if (v) cb(v); };
+  }
+
+  _nudgeThreshold(deltaPct) {
+    const cur = Math.round((this.am.switchThreshold ?? this.config.switchThreshold ?? 0.98) * 100);
+    const next = Math.max(1, Math.min(100, cur + deltaPct));
+    if (next !== cur) this._doSetThreshold(String(next));
+  }
+
+  _nudgeProbe(deltaSec) {
+    const cur = this.config.quotaProbeSeconds || 0;
+    const next = Math.max(0, cur + deltaSec);
+    if (next !== cur) this._doSetProbe(String(next));
+  }
+
   async _doSetThreshold(input) {
     const pct = Number(input);
     if (!Number.isFinite(pct) || pct < 1 || pct > 100) {
@@ -322,6 +412,7 @@ export class TUI {
     if (k === 'i') { this._doImport(); this.mode = 'normal'; }
     else if (k === 'k') {
       this.mode = 'input';
+      this.inputReturn = 'normal';
       this.inputPrompt = 'API key';
       this.inputBuf = '';
       this.inputCb = v => { if (v) this._doAddKey(v); };
@@ -333,10 +424,10 @@ export class TUI {
     if (k === 'enter') {
       const cb = this.inputCb;
       const v = this.inputBuf;
-      this.mode = 'normal'; this.inputCb = null; this.inputBuf = '';
+      this.mode = this.inputReturn; this.inputCb = null; this.inputBuf = '';
       cb?.(v);
     }
-    else if (k === 'esc') { this.mode = 'normal'; this.inputCb = null; this.inputBuf = ''; }
+    else if (k === 'esc') { this.mode = this.inputReturn; this.inputCb = null; this.inputBuf = ''; }
     else if (k === 'bs') { this.inputBuf = this.inputBuf.slice(0, -1); }
     else if (k.length === 1) { this.inputBuf += k; }
   }
@@ -383,11 +474,11 @@ export class TUI {
     if (this.running) this.render();
   }
 
-  // Cycle off → on-429 → always. Keeps the API key, so the user can disable
-  // sx.org without deconfiguring it.
-  async _doCycleSxMode() {
+  // Cycle off → on-429 → always (dir +1) or the reverse (dir -1). Keeps the API
+  // key, so the user can disable sx.org without deconfiguring it.
+  async _cycleSxMode(dir = 1) {
     const order = ['off', '429', 'always'];
-    const next = order[(order.indexOf(this.sx.getMode()) + 1) % order.length];
+    const next = order[(order.indexOf(this.sx.getMode()) + dir + order.length) % order.length];
     this.config.sx = { ...(this.config.sx || {}), mode: next };
     try { await this.saveConfig(this.config); }
     catch (e) { this._addLog(`Failed to save: ${e.message}`); }
@@ -672,37 +763,53 @@ export class TUI {
   }
 
   _renderSettings(lines) {
+    const fields = this._settingsFields();
+    if (this.setIdx >= fields.length) this.setIdx = Math.max(0, fields.length - 1);
+    const selId = fields[this.setIdx]?.id;
+    const byId = id => fields.find(f => f.id === id);
+
+    // Render a navigable setting row with a BIOS-style highlight bar on the
+    // cursor row. Read-only info rows pass field=null and never highlight.
+    const row = field => {
+      const selected = field && field.id === selId;
+      const label = (field ? field.label : '').padEnd(16);
+      const value = field ? field.value() : '';
+      if (selected) {
+        const hint = field.hint ? `   ${dim(field.hint)}` : '';
+        const inner = rpad(` ${label}  ${strip(value)} `, 34);
+        return `  ${cyan('▸')}${REV}${inner}${RESET}${hint}`;
+      }
+      return `    ${dim(label)}  ${value}`;
+    };
+    // A plain read-only info line (not selectable), aligned with the rows above.
+    const info = (label, value) => `    ${dim(label.padEnd(16))}  ${value}`;
+
     lines.push('');
     // ── Rotation
-    const thr = this.am.switchThreshold ?? this.config.switchThreshold ?? 0.98;
     lines.push(bold('  Rotation') + dim('  — switch accounts when quota crosses the threshold'));
-    lines.push(`  Switch at:  ${green(`${Math.round(thr * 100)}%`)}  ${dim('utilization')}`);
+    lines.push(row(byId('threshold')));
     lines.push('');
     // ── Quota probe
-    const probe = this.config.quotaProbeSeconds || 0;
     lines.push(bold('  Quota probe') + dim('  — refresh idle accounts from the usage endpoint'));
-    lines.push(`  Interval:   ${probe > 0 ? green(`${probe}s`) : gray('off (passive)')}`);
+    lines.push(row(byId('probe')));
     lines.push('');
     // ── sx.org
     lines.push(bold('  sx.org proxy') + dim('  — route upstream via a residential IP (429 workaround)'));
     lines.push('');
     if (!this.sx) { lines.push(yellow('  Unavailable in this build.')); return; }
     const key = this.config.sx?.apiKey;
-    const masked = key ? key.slice(0, 4) + '…' + key.slice(-4) : dim('(not set)');
     const mode = this.sx.getMode();
-    const modeStr = mode === 'always' ? green('always')
-      : mode === '429' ? cyan('on 429 only')
-      : gray('off');
     const p = this.sx.getProxy?.();
     const proxyStr = mode === 'off' ? gray('—')
       : this.sx.isProvisioned() ? green(`${p.host}:${p.port}`)
       : key ? yellow('not provisioned')
       : gray('no key');
     const b = this.sxBalance;
-    lines.push(`  Mode:     ${modeStr}`);
-    lines.push(`  API key:  ${masked}`);
-    lines.push(`  Proxy:    ${proxyStr}`);
-    lines.push(`  Balance:  ${b ? green('$' + Number(b.balance).toFixed(4)) : dim('…')}`);
+    lines.push(row(byId('sxmode')));
+    lines.push(row(byId('sxkey')));
+    lines.push(info('Proxy', proxyStr));
+    lines.push(info('Balance', b ? green('$' + Number(b.balance).toFixed(4)) : dim('…')));
+    if (byId('sxclear')) lines.push(row(byId('sxclear')));
     lines.push('');
     lines.push(dim('  always    tunnel ALL upstream traffic through sx.org'));
     lines.push(dim('  on 429    only retry through sx.org after a 429 (fresh IP)'));
@@ -716,7 +823,7 @@ export class TUI {
       case 'normal':
         return ` ${bold('s')}witch  ${bold('a')}dd  ${bold('r')}emove  ${bold('d')}isable  ${bold('R')}eload  ${bold('g')} settings  ${bold('q')}uit`;
       case 'settings':
-        return ` ${bold('t')} threshold  ${bold('p')} probe  ${bold('m')} sx-mode  ${bold('k')} sx-key  ${bold('x')} clear-key  ${bold('Esc')} back`;
+        return ` ${dim('↑↓')} navigate  ${dim('←→')} change  ${bold('Enter')} edit  ${bold('Esc')} back`;
       case 'select': {
         const act = this.selAction === 'switch' ? 'switch'
           : this.selAction === 'toggle' ? 'enable/disable'