@rikcodes/teamclaude 1.1.19-rik.1 → 1.1.19-rik.3

package/README.md

@@ -24,9 +24,9 @@
 > Already have upstream installed globally? Run `npm uninstall -g @karpeleslab/teamclaude` first —
 > both packages provide the `teamclaude` command.
 >
-> Branch: `rik/soonest-weekly-pool`. Everything else matches upstream.
+> Branch: `rik/main`. Everything else matches upstream.
 
-[![CI](https://github.com/rikbrown/teamclaude/actions/workflows/ci.yml/badge.svg?branch=rik/soonest-weekly-pool)](https://github.com/rikbrown/teamclaude/actions/workflows/ci.yml)
+[![CI](https://github.com/rikbrown/teamclaude/actions/workflows/ci.yml/badge.svg?branch=rik/main)](https://github.com/rikbrown/teamclaude/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/@rikcodes/teamclaude.svg)](https://www.npmjs.com/package/@rikcodes/teamclaude)
 [![node](https://img.shields.io/node/v/@rikcodes/teamclaude.svg)](https://nodejs.org)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -190,12 +190,12 @@ Versions are `<upstream base>-rik.<n>`, e.g. `1.1.19-rik.1`. The self-updater or
 
 1. Rebase onto the upstream release you want as the base, if any.
 2. Bump `version` in `package.json` and commit.
-3. Push to `rik/soonest-weekly-pool` — the Publish workflow runs the tests, publishes to npm, and cuts a GitHub release.
+3. Push to `rik/main` — the Publish workflow runs the tests, publishes to npm, and cuts a GitHub release.
 
 The workflow authenticates with npm Trusted Publishing (OIDC), which needs a one-time setup on npmjs.com: `@rikcodes/teamclaude` → Settings → Trusted Publisher → GitHub Actions, owner `rikbrown`, repo `teamclaude`, workflow `publish.yml`. Until that exists, publish by hand:
 
 ```bash
-pnpm publish --publish-branch rik/soonest-weekly-pool --tag latest --otp=<code>
+pnpm publish --publish-branch rik/main --tag latest --otp=<code>
 ```
 
 A prerelease version always needs an explicit `--tag`, and `latest` is the tag the self-updater reads.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.19-rik.1",
+  "version": "1.1.19-rik.3",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/claude-env.js

@@ -26,11 +26,50 @@ export function validPort(port) {
   return n;
 }
 
+// The loopback entries every launched client gets. They keep the client's own
+// localhost traffic out of the proxy: a forward to loopback is refused
+// (forward-target.js), so a client that proxied it would get a 403 instead of
+// its own dev server.
+export const LOOPBACK_NO_PROXY = ['localhost', '127.0.0.1', '::1'];
+
+/** True if `value` names `*` — "proxy nothing" — among its entries. */
+export function bypassesAllHosts(value) {
+  return String(value ?? '').split(',').some((entry) => entry.trim() === '*');
+}
+
+/**
+ * The NO_PROXY a launched client gets: ours, plus whatever the operator had.
+ *
+ * Replacing theirs broke the case the list exists for. A local dev host is
+ * rarely spelled `localhost` — `*.test` and friends resolve to 127.0.0.1
+ * through a local resolver — so with only our three entries the client proxies
+ * it, the proxy refuses the loopback forward, and the client retries the 403 on
+ * a loop. Their entries are kept verbatim (a leading dot or a `host:port` is
+ * theirs to mean), deduped case-insensitively, ours first.
+ *
+ * `*` is the one entry dropped: it routes every host around the proxy,
+ * api.anthropic.com included, which silently turns the launch into a direct run
+ * — no rotation, the operator's own quota. `--no-mitm` is how that is asked for.
+ */
+export function mergeNoProxy(...inherited) {
+  const seen = new Set();
+  const out = [];
+  const entries = inherited.flatMap((value) => String(value ?? '').split(','));
+  for (const entry of [...LOOPBACK_NO_PROXY, ...entries]) {
+    const host = entry.trim();
+    if (!host || host === '*' || seen.has(host.toLowerCase())) continue;
+    seen.add(host.toLowerCase());
+    out.push(host);
+  }
+  return out.join(',');
+}
+
 // Build the shell `export` lines that point Claude Code — or any tool that
 // spawns it, e.g. an agent multiplexer — at the proxy. This is the same
 // environment `teamclaude run` sets up, but emitted for `eval "$(teamclaude
 // env)"` instead of launching claude directly. Pure and side-effect free so it
-// can be unit-tested; the caller resolves the port, cert path, and holdSeconds.
+// can be unit-tested; the caller resolves the port, cert path, holdSeconds and
+// the NO_PROXY the invoking shell already had.
 //
 // MITM (forward-proxy) mode is the default, matching `teamclaude run`: it routes
 // ALL of claude's traffic through the proxy — even hardcoded api.anthropic.com
@@ -101,7 +140,7 @@ export function buildCustomModelVars(customModels) {
   return vars;
 }
 
-export function buildClaudeEnvLines({ port, useMitm = true, caPath = null, holdSeconds = 0, account = null, proxyApiKey = '', customModels = null }) {
+export function buildClaudeEnvLines({ port, useMitm = true, caPath = null, holdSeconds = 0, account = null, proxyApiKey = '', customModels = null, inheritedNoProxy = null }) {
   const lines = [];
   const pin = (account || '').trim();
   // The port is interpolated unquoted into URLs the shell evals, so it has to
@@ -111,13 +150,16 @@ export function buildClaudeEnvLines({ port, useMitm = true, caPath = null, holdS
   if (useMitm) {
     const userinfo = pin ? `${encodePinComponent(pin)}:${encodePinComponent(proxyApiKey || '')}@` : '';
     const proxyUrl = `http://${userinfo}127.0.0.1:${port}`;
+    const noProxy = mergeNoProxy(inheritedNoProxy);
     lines.push(
       `export HTTPS_PROXY=${proxyUrl}`,
       `export HTTP_PROXY=${proxyUrl}`,
       `export https_proxy=${proxyUrl}`,
       `export http_proxy=${proxyUrl}`,
-      'export NO_PROXY=localhost,127.0.0.1,::1',
-      'export no_proxy=localhost,127.0.0.1,::1',
+      // Quoted like the CA path below: the value now carries whatever the
+      // operator's own NO_PROXY held, and this line is eval'd.
+      `export NO_PROXY=${shellQuote(noProxy)}`,
+      `export no_proxy=${shellQuote(noProxy)}`,
     );
     // Quoted: the path is under $HOME (or XDG_CONFIG_HOME), which can carry a
     // space or a quote, and this line is eval'd.

package/src/index.js

@@ -39,7 +39,7 @@ import { autoUpdate, checkForUpdate, currentVersion, runUpdate, installKind, PKG
 import { renderStatus, formatPercent } from './status-renderer.js';
 import { sanitizeText } from './safe-text.js';
 import { ClientUsageTracker, UsageDimensionTracker } from './client-usage.js';
-import { buildClaudeEnvLines, buildCustomModelAgents, buildCustomModelSettings, buildCustomModelVars, encodePinComponent } from './claude-env.js';
+import { buildClaudeEnvLines, buildCustomModelAgents, buildCustomModelSettings, buildCustomModelVars, bypassesAllHosts, encodePinComponent, mergeNoProxy } from './claude-env.js';
 import { serviceKind, installService, uninstallService, serviceStatus, renderService, logPath } from './service.js';
 import { formatTerminalTitle, titleSequence, TITLE_STACK_PUSH, TITLE_STACK_POP } from './terminal-title.js';
 import { getUpstreamProxy, describeProxy, describeSelfProxy } from './upstream-proxy.js';
@@ -953,6 +953,9 @@ async function envCommand() {
       port, useMitm, caPath, holdSeconds: config.holdSeconds,
       account, proxyApiKey: config.proxy?.apiKey || '',
       customModels: config.customModels,
+      // The shell doing the eval keeps its own NO_PROXY entries; re-running is
+      // idempotent, since the merged value is what it will have next time.
+      inheritedNoProxy: [process.env.NO_PROXY, process.env.no_proxy].filter(Boolean).join(','),
     });
   } catch (err) {
     // A bad proxy.port. Nothing reaches stdout: the shell is eval'ing it.
@@ -1032,7 +1035,13 @@ async function runCommand() {
         : '';
       const proxyUrl = `http://${userinfo}127.0.0.1:${port}`;
       env.HTTPS_PROXY = env.HTTP_PROXY = env.https_proxy = env.http_proxy = proxyUrl;
-      env.NO_PROXY = env.no_proxy = 'localhost,127.0.0.1,::1';
+      // Keep the operator's own NO_PROXY and add ours — see mergeNoProxy. Both
+      // spellings are read: a tool that set only one still meant it.
+      const inheritedNoProxy = [process.env.NO_PROXY, process.env.no_proxy];
+      env.NO_PROXY = env.no_proxy = mergeNoProxy(...inheritedNoProxy);
+      if (inheritedNoProxy.some(bypassesAllHosts)) {
+        console.error('[TeamClaude] NO_PROXY=* ignored: it would send api.anthropic.com around the proxy (no rotation). Use --no-mitm for a direct launch.');
+      }
       env.NODE_EXTRA_CA_CERTS = caPath;
       if (tcAcct) console.error(`[TeamClaude] Pinned to account "${tcAcct}" (TC_ACCT)`);
       else if (pinnedBase) {

package/src/provider.js

@@ -199,3 +199,23 @@ export function upstreamFor(account, configuredUpstream) {
 export function rewritesBody(account) {
   return PROVIDERS[providerOf(account)].rewritesBody;
 }
+
+/** Whether `account` is served by a process on this machine rather than by a
+ *  vendor endpoint — typically a local translating proxy in front of another
+ *  backend.
+ *
+ *  Keyed on the upstream resolving to loopback. Pairing the account against a
+ *  declared local process does not generalise: such a declaration carries a
+ *  COMMAND rather than a port, and the port sits inside its argv, where every
+ *  program spells it differently. A loopback upstream says the same thing
+ *  directly, and says it for a hand-started process too. A remote third-party
+ *  backend (DeepSeek, GLM) keeps a public host and is not caught.
+ */
+export function isLocalUpstream(account) {
+  if (!account?.upstream) return false;
+  let hostname;
+  try { hostname = new URL(account.upstream).hostname; }
+  catch { return false; } // not a URL we can judge — treat it as a normal account
+  const host = hostname.replace(/^\[|\]$/g, '').toLowerCase(); // URL brackets IPv6
+  return host === 'localhost' || host === '::1' || /^127\./.test(host);
+}

package/src/tui.js

@@ -15,6 +15,7 @@ import { resolveMaxUsage } from './model.js';
 import { formatProjection } from './quota-projection.js';
 import { parseProxyUrl, proxyToUrl, describeProxy, describeSelfProxy, resolveUpstreamProxy, setUpstreamProxy, getUpstreamProxy } from './upstream-proxy.js';
 import { sanitizeText, safeLine } from './safe-text.js';
+import { isLocalUpstream } from './provider.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -757,7 +758,7 @@ export class TUI {
         label: 'Remove account',
         hint: 'Enter to pick',
         value: () => dim('—'),
-        enter: () => { this.mode = 'select'; this.selAction = 'remove'; this.selIdx = 0; this.selReturn = 'settings'; },
+        enter: () => { this.mode = 'select'; this.selAction = 'remove'; this.selIdx = this._displayOrder()[0] ?? 0; this.selReturn = 'settings'; },
       });
     }
 
@@ -910,9 +911,13 @@ export class TUI {
   }
 
   _keySelect(k) {
-    const len = this.am.accounts.length;
-    if (k === 'up' || k === 'k') this.selIdx = Math.max(0, this.selIdx - 1);
-    else if (k === 'down' || k === 'j') this.selIdx = Math.min(len - 1, this.selIdx + 1);
+    // Step through the rows AS DRAWN (_displayOrder), while selIdx itself stays
+    // a manager index — everything it feeds (switch, toggle, remove, route pins)
+    // addresses an account by that index, not by its position on screen.
+    const order = this._displayOrder();
+    const pos = order.indexOf(this.selIdx);
+    if (k === 'up' || k === 'k') this.selIdx = order[Math.max(0, pos - 1)] ?? this.selIdx;
+    else if (k === 'down' || k === 'j') this.selIdx = order[Math.min(order.length - 1, pos + 1)] ?? this.selIdx;
     // Tab / ←→ (switch only): cycle which route the pick applies to. null = the
     // global default account; each getRoutes() entry = a per-route manual pin.
     // ↑↓ move within the account list, so ←→ are free to move across targets.
@@ -1504,7 +1509,7 @@ export class TUI {
         fable: anyFable ? this.am.previewRouteIndex('claude-fable-5') : null,
         sonnet: anySonnet ? this.am.previewRouteIndex('claude-sonnet-4-6') : null,
       };
-      for (let i = 0; i < this.am.accounts.length; i++) {
+      for (const i of this._displayOrder()) {
         const b = budgets.get(categoryOf(this.am.accounts[i]));
         lines.push(this._renderAcct(i, b.bw, b.showBoth, routes, genRoutes, familyTarget, b.showFamily, nameW));
       }
@@ -1559,6 +1564,29 @@ export class TUI {
     this._paint(buf, force);
   }
 
+  /** Manager indices in the order the rows are drawn: accounts served by a
+   *  local process last, every other account left where it is.
+   *
+   *  A local backend (a translating proxy in front of another vendor, say) is
+   *  infrastructure rather than a seat to rotate between, so it reads as noise
+   *  wedged among the accounts that do rotate. Config order cannot keep it out
+   *  of the way on its own, because a newly added account is appended AFTER it
+   *  and puts it back in the middle.
+   *
+   *  Display only. `selIdx`, `currentIndex`, session pins and route entries all
+   *  stay manager indices, so nothing about selection or routing moves with the
+   *  rows — see _keySelect, which walks this order but still stores an index.
+   */
+  _displayOrder() {
+    return this.am.accounts
+      .map((_, i) => i)
+      .sort((x, y) => {
+        const sx = isLocalUpstream(this.am.accounts[x]) ? 1 : 0;
+        const sy = isLocalUpstream(this.am.accounts[y]) ? 1 : 0;
+        return sx - sy || x - y; // ties keep list order, so the sort is stable
+      });
+  }
+
   _renderAcct(idx, bw, showBoth, routes = this.am.getRoutes(), genRoutes = routes.filter(r => routeFamily(r) === null), familyTarget = {}, showFamily = true, nameW = NAME_MIN) {
     const a = this.am.accounts[idx];
     const isCur = idx === this.am.currentIndex;