teamclaude-cloud 1.4.1 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",
@@ -35,4 +35,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}

package/src/cloud.js

@@ -154,6 +154,19 @@ export async function cloudLogin(cloud, email, password) {
   };
 }
 
+/**
+ * Verify a session token actually authorizes as a cloud owner (GET /me). Used by
+ * `cloud login --token` to reject a forged/expired token BEFORE overwriting an
+ * existing working login. Returns true only on a 2xx owner response.
+ */
+export async function cloudValidateOwner(cloud) {
+  requireSession(cloud);
+  const res = await httpJson(`${fnBase(cloud)}/me`, {
+    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+  });
+  return res.ok;
+}
+
 /** Refresh an expired owner session. */
 export async function cloudRefreshSession(cloud, refreshToken) {
   assertSecureUrl(cloud.url);
@@ -305,6 +318,27 @@ export async function cloudRefreshToken(cloud, authKey, accountUuid, minRemainin
   };
 }
 
+/**
+ * Report a locally-rotated token back to the cloud (auth-key authenticated).
+ * When a consumer had to refresh a token LOCALLY (cloud refresh unreachable), it
+ * MUST push the rotated token back — otherwise the cloud keeps a now-dead refresh
+ * token and every other consumer (and the cloud's own /sync/refresh) fails with
+ * invalid_grant. Freshest-token-wins on the server, scoped to the key's group.
+ * Best-effort at the call site: a failure to report never breaks the local refresh.
+ */
+export async function cloudReportToken(cloud, authKey, accountUuid, { accessToken, refreshToken, expiresAt } = {}) {
+  requireCloud(cloud);
+  if (!authKey) throw new Error('Auth key required for token report.');
+  if (!accountUuid) throw new Error('accountUuid required for token report.');
+  const res = await httpJson(`${fnBase(cloud)}/sync/report-token`, {
+    method: 'POST',
+    headers: fnHeaders(cloud, { 'x-teamclaude-key': authKey }),
+    body: { accountUuid, accessToken, refreshToken, expiresAt: normalizeExpiresAt(expiresAt) || 0 },
+  });
+  if (!res.ok) throw new Error(`Cloud token report failed (${res.status}): ${describe(res.data)}`);
+  return { action: res.data.action || 'skipped' };
+}
+
 /**
  * Pull allowed accounts+tokens using an auth key (no owner session needed).
  * Returns `{ accounts, allowed, groupId, source }`:

package/src/index.js

@@ -7,7 +7,7 @@ import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConf
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
-import { cloudLogin, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
+import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
 
 const args = process.argv.slice(2);
@@ -1432,23 +1432,52 @@ const _autoPushInFlight = new Set();
  */
 async function maybePushRefreshedToken(config, account, newTokens) {
   const key = account.accountUuid || account.name;
+  const session = config.cloud && config.cloud.session;
+  // An owner session is USABLE if its access token is still valid OR it carries a
+  // refresh token (ensureCloudSession can renew it). A token-only login (Google/SSO)
+  // has NO refresh token, so once it expires it's unusable — treating it as usable
+  // would 401 the push and skip the key fallback, leaving the cloud with a dead
+  // refresh token (Codex HIGH). expires_at is seconds.
+  const ownerUsable = !!(session && session.access_token && (
+    (Number(session.expires_at || 0) * 1000) > Date.now() + 30_000 ||
+    (session.refresh_token && String(session.refresh_token).length > 0)
+  ));
+  const pullKey = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  const canKey = !!(pullKey && account.accountUuid);
+  if (!ownerUsable && !canKey) return; // nowhere to sync back to
   try {
-    if (!config.cloud || !config.cloud.session || !config.cloud.session.access_token) return; // not an admin/pusher
     if (_autoPushInFlight.has(key)) return;
     _autoPushInFlight.add(key);
-    const cloud = await ensureCloudSession(config).catch(() => config.cloud);
-    await cloudPush(cloud, [{
-      accountUuid: account.accountUuid,
-      name: account.name,
-      subscriptionType: account.subscriptionType,
-      tier: account.tier,
-      type: account.type,
-      accessToken: newTokens.accessToken,
-      refreshToken: newTokens.refreshToken,
-      expiresAt: newTokens.expiresAt,
-    }]);
+    if (ownerUsable) {
+      try {
+        const cloud = await ensureCloudSession(config).catch(() => config.cloud);
+        await cloudPush(cloud, [{
+          accountUuid: account.accountUuid,
+          name: account.name,
+          subscriptionType: account.subscriptionType,
+          tier: account.tier,
+          type: account.type,
+          accessToken: newTokens.accessToken,
+          refreshToken: newTokens.refreshToken,
+          expiresAt: newTokens.expiresAt,
+        }]);
+        return;
+      } catch (e) {
+        // Owner push failed (e.g. the short-lived token-login expired) — fall back
+        // to the key path so the rotation still reaches the cloud.
+        if (!canKey) throw e;
+      }
+    }
+    if (canKey) {
+      // Consumer / expired-owner path: key-authenticated write-back (freshest-wins).
+      await cloudReportToken(resolveCloud(config), pullKey, account.accountUuid, {
+        accessToken: newTokens.accessToken,
+        refreshToken: newTokens.refreshToken,
+        expiresAt: newTokens.expiresAt,
+      });
+    }
   } catch (err) {
-    console.error(`[TeamClaude] Cloud auto-push (token refresh) failed for ${account.name}: ${err.message}`);
+    console.error(`[TeamClaude] Cloud token sync-back failed for ${account.name}: ${err.message}`);
   } finally {
     _autoPushInFlight.delete(key);
   }
@@ -1457,14 +1486,34 @@ async function maybePushRefreshedToken(config, account, newTokens) {
 // ── cloud (SaaS token sync + auth-key control) ──────────────────
 
 // Refresh the owner session if it is expiring; persist the new session.
+let _cloudSessionRefresh = null; // coalesce concurrent owner-session refreshes
 async function ensureCloudSession(config) {
   const cloud = config.cloud;
   if (!cloud || !cloud.session || !cloud.session.access_token) return cloud;
   const expMs = (Number(cloud.session.expires_at) || 0) * 1000; // Supabase expires_at is seconds
   if (expMs && Date.now() + 60_000 >= expMs && cloud.session.refresh_token) {
-    const s = await cloudRefreshSession(cloud, cloud.session.refresh_token);
-    cloud.session = s;
-    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+    // The owner session has ONE single-use rotating Supabase refresh token. If two
+    // account rotations refresh it concurrently, one wins and the other trips reuse
+    // detection and loses its push (Codex HIGH). Serialize: all concurrent callers
+    // share the SAME in-flight refresh instead of each rotating independently.
+    if (!_cloudSessionRefresh) {
+      const rt = cloud.session.refresh_token;
+      _cloudSessionRefresh = (async () => {
+        try {
+          const s = await cloudRefreshSession(cloud, rt);
+          cloud.session = s;
+          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+          return s;
+        } finally {
+          _cloudSessionRefresh = null;
+        }
+      })();
+    }
+    // NOTE: concurrent refreshes WITHIN this process share the single in-flight
+    // promise above (one rotation). Cross-PROCESS coordination is intentionally not
+    // done here — the codebase assumes a single proxy per config (see
+    // atomicConfigUpdate's documented cross-process limitation).
+    await _cloudSessionRefresh;
   }
   return cloud;
 }
@@ -1484,6 +1533,7 @@ async function cloudCommand() {
       console.log('Cloud commands (SaaS token sync + auth-key control):');
       console.log('  teamclaude cloud pull   --key <auth-key>    Pull allowed tokens (key-only — no login)');
       console.log('  teamclaude cloud login  --email <e> [--password <p>]   (admin, to push)');
+      console.log('  teamclaude cloud login  --token   (Google/SSO — paste the token from the dashboard at the prompt)');
       console.log('  teamclaude cloud push                       Push local account tokens to the cloud');
       console.log('  teamclaude cloud key create [--label <l>] [--accounts uuid1,uuid2]');
       console.log('  teamclaude cloud key list');
@@ -1493,11 +1543,88 @@ async function cloudCommand() {
   }
 }
 
+// Decode a JWT payload (base64url) without verifying — we only read exp/email to
+// stamp the stored session; the server verifies the token on every request.
+function decodeJwtPayload(token) {
+  try {
+    const part = String(token).split('.')[1] || '';
+    const b64 = part.replace(/-/g, '+').replace(/_/g, '/');
+    return JSON.parse(Buffer.from(b64, 'base64').toString('utf8')) || {};
+  } catch {
+    return {};
+  }
+}
+
 async function cloudLoginCommand(config) {
   // url/anon-key default to the built-in public endpoint — only --email/--password
   // are required for the owner (admin) login.
   const url = argValue('--url') || config.cloud?.url || process.env.SUPABASE_URL || DEFAULT_CLOUD.url;
   const anonKey = argValue('--anon-key') || config.cloud?.anonKey || process.env.SUPABASE_ANON_KEY || DEFAULT_CLOUD.anonKey;
+
+  // Token login: for Google / SSO owners who have NO password. The dashboard's
+  // "Copy CLI token" button copies just the access token; run `teamclaude cloud
+  // login --token` and PASTE it at the prompt. Reading from stdin keeps the owner
+  // token out of argv / shell history (Codex HIGH). A `--token <value>` (or env)
+  // is still accepted for scripting.
+  const tokenFlag = args.includes('--token');
+  const tokenArg = argValue('--token');
+  let token = (tokenArg && tokenArg !== '-' && !tokenArg.startsWith('--')) ? tokenArg : process.env.TEAMCLAUDE_CLOUD_TOKEN || '';
+  if (!token && tokenFlag) {
+    if (process.stdin.isTTY) {
+      // Read WITHOUT echo via raw mode — the owner token must never land in the
+      // terminal's visible scrollback or a screen recording (Codex HIGH). Raw mode
+      // disables the TTY driver's echo; we buffer chars ourselves and print nothing.
+      token = (await new Promise((resolve) => {
+        process.stderr.write('Paste cloud access token (input hidden): ');
+        const stdin = process.stdin;
+        stdin.setRawMode?.(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        let buf = '';
+        const onData = (chunk) => {
+          for (const ch of chunk) {
+            if (ch === '\n' || ch === '\r' || ch === '\u0004') {  // Enter / EOF -> done
+              stdin.removeListener('data', onData);
+              stdin.setRawMode?.(false); stdin.pause();
+              process.stderr.write('\n');
+              return resolve(buf);
+            }
+            if (ch === '\u0003') { stdin.setRawMode?.(false); process.stderr.write('\n'); process.exit(1); } // Ctrl-C
+            else if (ch === '\u007f' || ch === '\b') buf = buf.slice(0, -1); // backspace
+            else buf += ch;
+          }
+        };
+        stdin.on('data', onData);
+      })).trim();
+    } else {
+      // Piped (e.g. pbpaste | teamclaude cloud login --token): read from stdin.
+      token = (await new Promise((resolve) => {
+        let d = ''; process.stdin.on('data', c => (d += c)); process.stdin.on('end', () => resolve(d));
+      })).trim();
+    }
+  }
+  if (token) {
+    const payload = decodeJwtPayload(token);
+    const expSec = Number(payload.exp) || Math.floor(Date.now() / 1000) + 3600; // JWT exp (seconds)
+    const email = payload.email || payload?.user_metadata?.email || config.cloud?.email || null;
+    // Access token ONLY — never store the browser's refresh token. Supabase refresh
+    // tokens are single-use rotating; sharing one between the browser and the CLI
+    // would make them rotate-conflict and revoke each other (reuse detection). So
+    // this is a short-lived (~1h) login — enough to push; re-copy when it expires.
+    const session = { access_token: token, refresh_token: '', expires_at: expSec };
+    // Validate the token actually authorizes as an owner BEFORE overwriting any
+    // existing login — a forged/expired token (or a bogus future `exp`) must not
+    // silently replace a working session.
+    const ok = await cloudValidateOwner({ url, anonKey, session }).catch(() => false);
+    if (!ok) {
+      console.error('Token login failed — the token is invalid or expired. Re-copy "CLI login" from the web dashboard.');
+      process.exit(1);
+    }
+    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), url, anonKey, email, session }; });
+    console.log(`Logged in to cloud${email ? ` as ${email}` : ''} (token, short-lived ~1h — re-copy from the dashboard when it expires).`);
+    return;
+  }
+
   const email = argValue('--email') || config.cloud?.email || process.env.TEAMCLAUDE_CLOUD_EMAIL;
   let password = argValue('--password') || process.env.TEAMCLAUDE_CLOUD_PASSWORD;
   if (!email) {