teamclaude-cloud 1.4.2 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/cloud.js

@@ -154,6 +154,19 @@ export async function cloudLogin(cloud, email, password) {
   };
 }
 
+/**
+ * Verify a session token actually authorizes as a cloud owner (GET /me). Used by
+ * `cloud login --token` to reject a forged/expired token BEFORE overwriting an
+ * existing working login. Returns true only on a 2xx owner response.
+ */
+export async function cloudValidateOwner(cloud) {
+  requireSession(cloud);
+  const res = await httpJson(`${fnBase(cloud)}/me`, {
+    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+  });
+  return res.ok;
+}
+
 /** Refresh an expired owner session. */
 export async function cloudRefreshSession(cloud, refreshToken) {
   assertSecureUrl(cloud.url);

package/src/index.js

@@ -7,7 +7,7 @@ import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConf
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
-import { cloudLogin, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
+import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
 
 const args = process.argv.slice(2);
@@ -1432,30 +1432,44 @@ const _autoPushInFlight = new Set();
  */
 async function maybePushRefreshedToken(config, account, newTokens) {
   const key = account.accountUuid || account.name;
-  const hasOwner = !!(config.cloud && config.cloud.session && config.cloud.session.access_token);
+  const session = config.cloud && config.cloud.session;
+  // An owner session is USABLE if its access token is still valid OR it carries a
+  // refresh token (ensureCloudSession can renew it). A token-only login (Google/SSO)
+  // has NO refresh token, so once it expires it's unusable — treating it as usable
+  // would 401 the push and skip the key fallback, leaving the cloud with a dead
+  // refresh token (Codex HIGH). expires_at is seconds.
+  const ownerUsable = !!(session && session.access_token && (
+    (Number(session.expires_at || 0) * 1000) > Date.now() + 30_000 ||
+    (session.refresh_token && String(session.refresh_token).length > 0)
+  ));
   const pullKey = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
-  // Nothing to sync back to unless we're an admin (owner session) OR a consumer
-  // with a pull key. A consumer that rotated a token LOCALLY (cloud refresh was
-  // unreachable) MUST report it back, or the cloud keeps a now-dead refresh token
-  // and every consumer — plus the cloud's own /sync/refresh — fails invalid_grant.
-  if (!hasOwner && !(pullKey && account.accountUuid)) return;
+  const canKey = !!(pullKey && account.accountUuid);
+  if (!ownerUsable && !canKey) return; // nowhere to sync back to
   try {
     if (_autoPushInFlight.has(key)) return;
     _autoPushInFlight.add(key);
-    if (hasOwner) {
-      const cloud = await ensureCloudSession(config).catch(() => config.cloud);
-      await cloudPush(cloud, [{
-        accountUuid: account.accountUuid,
-        name: account.name,
-        subscriptionType: account.subscriptionType,
-        tier: account.tier,
-        type: account.type,
-        accessToken: newTokens.accessToken,
-        refreshToken: newTokens.refreshToken,
-        expiresAt: newTokens.expiresAt,
-      }]);
-    } else {
-      // Consumer path: key-authenticated write-back (freshest-wins on the server).
+    if (ownerUsable) {
+      try {
+        const cloud = await ensureCloudSession(config).catch(() => config.cloud);
+        await cloudPush(cloud, [{
+          accountUuid: account.accountUuid,
+          name: account.name,
+          subscriptionType: account.subscriptionType,
+          tier: account.tier,
+          type: account.type,
+          accessToken: newTokens.accessToken,
+          refreshToken: newTokens.refreshToken,
+          expiresAt: newTokens.expiresAt,
+        }]);
+        return;
+      } catch (e) {
+        // Owner push failed (e.g. the short-lived token-login expired) — fall back
+        // to the key path so the rotation still reaches the cloud.
+        if (!canKey) throw e;
+      }
+    }
+    if (canKey) {
+      // Consumer / expired-owner path: key-authenticated write-back (freshest-wins).
       await cloudReportToken(resolveCloud(config), pullKey, account.accountUuid, {
         accessToken: newTokens.accessToken,
         refreshToken: newTokens.refreshToken,
@@ -1472,14 +1486,34 @@ async function maybePushRefreshedToken(config, account, newTokens) {
 // ── cloud (SaaS token sync + auth-key control) ──────────────────
 
 // Refresh the owner session if it is expiring; persist the new session.
+let _cloudSessionRefresh = null; // coalesce concurrent owner-session refreshes
 async function ensureCloudSession(config) {
   const cloud = config.cloud;
   if (!cloud || !cloud.session || !cloud.session.access_token) return cloud;
   const expMs = (Number(cloud.session.expires_at) || 0) * 1000; // Supabase expires_at is seconds
   if (expMs && Date.now() + 60_000 >= expMs && cloud.session.refresh_token) {
-    const s = await cloudRefreshSession(cloud, cloud.session.refresh_token);
-    cloud.session = s;
-    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+    // The owner session has ONE single-use rotating Supabase refresh token. If two
+    // account rotations refresh it concurrently, one wins and the other trips reuse
+    // detection and loses its push (Codex HIGH). Serialize: all concurrent callers
+    // share the SAME in-flight refresh instead of each rotating independently.
+    if (!_cloudSessionRefresh) {
+      const rt = cloud.session.refresh_token;
+      _cloudSessionRefresh = (async () => {
+        try {
+          const s = await cloudRefreshSession(cloud, rt);
+          cloud.session = s;
+          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+          return s;
+        } finally {
+          _cloudSessionRefresh = null;
+        }
+      })();
+    }
+    // NOTE: concurrent refreshes WITHIN this process share the single in-flight
+    // promise above (one rotation). Cross-PROCESS coordination is intentionally not
+    // done here — the codebase assumes a single proxy per config (see
+    // atomicConfigUpdate's documented cross-process limitation).
+    await _cloudSessionRefresh;
   }
   return cloud;
 }
@@ -1499,6 +1533,7 @@ async function cloudCommand() {
       console.log('Cloud commands (SaaS token sync + auth-key control):');
       console.log('  teamclaude cloud pull   --key <auth-key>    Pull allowed tokens (key-only — no login)');
       console.log('  teamclaude cloud login  --email <e> [--password <p>]   (admin, to push)');
+      console.log('  teamclaude cloud login  --token   (Google/SSO — paste the token from the dashboard at the prompt)');
       console.log('  teamclaude cloud push                       Push local account tokens to the cloud');
       console.log('  teamclaude cloud key create [--label <l>] [--accounts uuid1,uuid2]');
       console.log('  teamclaude cloud key list');
@@ -1508,11 +1543,88 @@ async function cloudCommand() {
   }
 }
 
+// Decode a JWT payload (base64url) without verifying — we only read exp/email to
+// stamp the stored session; the server verifies the token on every request.
+function decodeJwtPayload(token) {
+  try {
+    const part = String(token).split('.')[1] || '';
+    const b64 = part.replace(/-/g, '+').replace(/_/g, '/');
+    return JSON.parse(Buffer.from(b64, 'base64').toString('utf8')) || {};
+  } catch {
+    return {};
+  }
+}
+
 async function cloudLoginCommand(config) {
   // url/anon-key default to the built-in public endpoint — only --email/--password
   // are required for the owner (admin) login.
   const url = argValue('--url') || config.cloud?.url || process.env.SUPABASE_URL || DEFAULT_CLOUD.url;
   const anonKey = argValue('--anon-key') || config.cloud?.anonKey || process.env.SUPABASE_ANON_KEY || DEFAULT_CLOUD.anonKey;
+
+  // Token login: for Google / SSO owners who have NO password. The dashboard's
+  // "Copy CLI token" button copies just the access token; run `teamclaude cloud
+  // login --token` and PASTE it at the prompt. Reading from stdin keeps the owner
+  // token out of argv / shell history (Codex HIGH). A `--token <value>` (or env)
+  // is still accepted for scripting.
+  const tokenFlag = args.includes('--token');
+  const tokenArg = argValue('--token');
+  let token = (tokenArg && tokenArg !== '-' && !tokenArg.startsWith('--')) ? tokenArg : process.env.TEAMCLAUDE_CLOUD_TOKEN || '';
+  if (!token && tokenFlag) {
+    if (process.stdin.isTTY) {
+      // Read WITHOUT echo via raw mode — the owner token must never land in the
+      // terminal's visible scrollback or a screen recording (Codex HIGH). Raw mode
+      // disables the TTY driver's echo; we buffer chars ourselves and print nothing.
+      token = (await new Promise((resolve) => {
+        process.stderr.write('Paste cloud access token (input hidden): ');
+        const stdin = process.stdin;
+        stdin.setRawMode?.(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        let buf = '';
+        const onData = (chunk) => {
+          for (const ch of chunk) {
+            if (ch === '\n' || ch === '\r' || ch === '\u0004') {  // Enter / EOF -> done
+              stdin.removeListener('data', onData);
+              stdin.setRawMode?.(false); stdin.pause();
+              process.stderr.write('\n');
+              return resolve(buf);
+            }
+            if (ch === '\u0003') { stdin.setRawMode?.(false); process.stderr.write('\n'); process.exit(1); } // Ctrl-C
+            else if (ch === '\u007f' || ch === '\b') buf = buf.slice(0, -1); // backspace
+            else buf += ch;
+          }
+        };
+        stdin.on('data', onData);
+      })).trim();
+    } else {
+      // Piped (e.g. pbpaste | teamclaude cloud login --token): read from stdin.
+      token = (await new Promise((resolve) => {
+        let d = ''; process.stdin.on('data', c => (d += c)); process.stdin.on('end', () => resolve(d));
+      })).trim();
+    }
+  }
+  if (token) {
+    const payload = decodeJwtPayload(token);
+    const expSec = Number(payload.exp) || Math.floor(Date.now() / 1000) + 3600; // JWT exp (seconds)
+    const email = payload.email || payload?.user_metadata?.email || config.cloud?.email || null;
+    // Access token ONLY — never store the browser's refresh token. Supabase refresh
+    // tokens are single-use rotating; sharing one between the browser and the CLI
+    // would make them rotate-conflict and revoke each other (reuse detection). So
+    // this is a short-lived (~1h) login — enough to push; re-copy when it expires.
+    const session = { access_token: token, refresh_token: '', expires_at: expSec };
+    // Validate the token actually authorizes as an owner BEFORE overwriting any
+    // existing login — a forged/expired token (or a bogus future `exp`) must not
+    // silently replace a working session.
+    const ok = await cloudValidateOwner({ url, anonKey, session }).catch(() => false);
+    if (!ok) {
+      console.error('Token login failed — the token is invalid or expired. Re-copy "CLI login" from the web dashboard.');
+      process.exit(1);
+    }
+    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), url, anonKey, email, session }; });
+    console.log(`Logged in to cloud${email ? ` as ${email}` : ''} (token, short-lived ~1h — re-copy from the dashboard when it expires).`);
+    return;
+  }
+
   const email = argValue('--email') || config.cloud?.email || process.env.TEAMCLAUDE_CLOUD_EMAIL;
   let password = argValue('--password') || process.env.TEAMCLAUDE_CLOUD_PASSWORD;
   if (!email) {