teamclaude-cloud 1.4.2 → 1.5.0

package/README.md

@@ -35,7 +35,9 @@ Sign up there, then use the *same* account with `teamclaude cloud login` on the
 teamclaude cloud login --email <you@example.com>
 teamclaude cloud push
 
-# Groups: auth keys belong to a group (default "main"); accounts are allowed per GROUP.
+# Groups: an auth key belongs to ONE OR MORE groups (default "main"); accounts are
+# allowed per GROUP, and a key's pull returns the UNION of all its groups' accounts.
+# Assign a key to multiple groups from the dashboard (Auth Keys → group checkboxes).
 teamclaude cloud group list
 teamclaude cloud group create team-a
 teamclaude cloud group allow  team-a --accounts <uuid1>,<uuid2>   # order = priority (#0 first)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.4.2",
+  "version": "1.5.0",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/cloud.js

@@ -154,6 +154,19 @@ export async function cloudLogin(cloud, email, password) {
   };
 }
 
+/**
+ * Verify a session token actually authorizes as a cloud owner (GET /me). Used by
+ * `cloud login --token` to reject a forged/expired token BEFORE overwriting an
+ * existing working login. Returns true only on a 2xx owner response.
+ */
+export async function cloudValidateOwner(cloud) {
+  requireSession(cloud);
+  const res = await httpJson(`${fnBase(cloud)}/me`, {
+    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+  });
+  return res.ok;
+}
+
 /** Refresh an expired owner session. */
 export async function cloudRefreshSession(cloud, refreshToken) {
   assertSecureUrl(cloud.url);
@@ -403,6 +416,18 @@ export async function cloudKeyMove(cloud, id, groupId) {
   return res.data; // { ok, id, groupId, group }
 }
 
+/** Set the FULL set of groups a key belongs to (multi-group). Replaces the set. */
+export async function cloudKeySetGroups(cloud, id, groupIds) {
+  requireSession(cloud);
+  const res = await httpJson(`${fnBase(cloud)}/auth-keys/${encodeURIComponent(id)}/groups`, {
+    method: 'PUT',
+    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+    body: { groupIds },
+  });
+  if (!res.ok) throw new Error(`Key set-groups failed (${res.status}): ${describe(res.data)}`);
+  return res.data; // { ok, id, groupIds }
+}
+
 export async function cloudKeyList(cloud) {
   requireSession(cloud);
   const res = await httpJson(`${fnBase(cloud)}/auth-keys`, {
@@ -544,6 +569,22 @@ export async function cloudAccountSetEnabled(cloud, accountUuid, enabled) {
 export function mergePulledAccounts(config, pulled, source = null, allowed = null) {
   const summary = { added: 0, updated: 0, skipped: 0, removed: 0 };
   if (!Array.isArray(config.accounts)) config.accounts = [];
+  // Client-only local-disable overlay: a consumer may disable a pulled account OFFLINE.
+  // It is stored by accountUuid in config.cloud.localDisabled (persistent so the choice
+  // survives a prune+re-add) and is NEVER pushed or synced up — effective enabled =
+  // cloud_enabled (present in the pull's allow-set) AND NOT local_disabled. Re-enabling
+  // an admin-disabled account is impossible: it's absent from the pull → pruned below.
+  // Seed the set from any legacy enabled===false accounts so existing disables migrate.
+  const cloudCfg = config.cloud || (config.cloud = {});
+  const localDisabled = new Set(Array.isArray(cloudCfg.localDisabled) ? cloudCfg.localDisabled : []);
+  for (const x of config.accounts) {
+    if (x.enabled === false && x.accountUuid) localDisabled.add(x.accountUuid);
+  }
+  const applyOverlay = (acct) => {
+    // Only uuid-keyed accounts participate in the overlay; legacy no-uuid accounts
+    // keep their own `enabled` (they are never cloud-pulled anyway).
+    if (acct && acct.accountUuid) acct.enabled = !localDisabled.has(acct.accountUuid);
+  };
   const applyPriority = (target, incoming) => {
     if (!('priority' in incoming)) return; // pre-group cloud response — leave local as-is
     if (Number.isInteger(incoming.priority)) target.priority = incoming.priority;
@@ -577,6 +618,7 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
         subscriptionType: a.tier || undefined,
         enabled: true,
       };
+      applyOverlay(fresh); // honor an offline local-disable that survived a prune+re-add
       addSource(fresh);
       applyPriority(fresh, a);
       config.accounts.push(fresh);
@@ -584,6 +626,12 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
       continue;
     }
     const cur = config.accounts[idx];
+    // Carry a legacy local-disable forward: a locally-disabled row that had no uuid
+    // (so the seed above skipped it) is matched here by NAME and assigned the pull's
+    // uuid — record that uuid in the overlay BEFORE applyOverlay, or it would be
+    // re-enabled and put back into rotation (Codex HIGH).
+    if (cur.enabled === false) { const u = cur.accountUuid || a.accountUuid; if (u) localDisabled.add(u); }
+    applyOverlay(cur); // local-disable overlay is authoritative for `enabled`
     addSource(cur); // now managed by this key (so this key can prune it later)
     // A payload entry with no token at all (allowed-but-tokenless) must not clobber
     // a valid local token — only apply priority/metadata, keep the local token.
@@ -601,6 +649,7 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
       expiresAt: incomingExp,
       subscriptionType: a.tier || cur.subscriptionType,
     };
+    applyOverlay(config.accounts[idx]); // re-assert overlay on the rebuilt row
     applyPriority(config.accounts[idx], a);
     summary.updated++;
   }
@@ -628,6 +677,11 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
     });
     summary.removed = before - config.accounts.length;
   }
+  // Persist the (possibly seed-migrated) overlay set. Entries are kept even when the
+  // account is temporarily absent (admin-disabled → pruned) so the consumer's choice
+  // survives an admin disable→re-enable round-trip. The set only shrinks on an explicit
+  // `enable` (setEnabledCommand); it is bounded in practice by the user's own disables.
+  cloudCfg.localDisabled = [...localDisabled];
   return summary;
 }
 

package/src/config.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
+import { readFile, writeFile, mkdir, rm, rename } from 'node:fs/promises';
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
@@ -113,9 +113,16 @@ export async function loadOrCreateConfig() {
 export async function saveConfig(config) {
   const path = getConfigPath();
   await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+  // Atomic write: a reader (loadConfig from another process — which does NOT take the
+  // config lock) must never observe a half-written file. Write a temp then rename
+  // (atomic on the same filesystem) so a read sees either the whole old or whole new.
+  const tmp = path + '.' + process.pid + '.' + randomBytes(4).toString('hex') + '.tmp';
+  await writeFile(tmp, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+  try { await rename(tmp, path); }
+  catch (err) { try { await rm(tmp, { force: true }); } catch { /* best-effort */ } throw err; }
 }
 
+
 /**
  * Atomically update the config: re-reads from disk, calls updater(config),
  * then saves. Returns the updated config. This prevents overwriting changes
@@ -126,9 +133,12 @@ export async function saveConfig(config) {
  * — e.g. a background token refresh and a TUI save/delete — would each read the same
  * snapshot and the later write would clobber the earlier one's change (resurrecting a
  * just-deleted account, or dropping a freshly-refreshed token). Chaining makes each
- * cycle observe the previous cycle's write. Cross-PROCESS races remain (the
- * single-proxy design assumption); a CLI write while the server runs is reconciled on
- * the next reload.
+ * cycle observe the previous cycle's write. saveConfig writes atomically (temp +
+ * rename) so a concurrent reader never sees a half-written file. Cross-PROCESS races
+ * (a running server's live-pull merge vs. a concurrent CLI write) remain the
+ * single-proxy design assumption — a CLI write while the server runs is reconciled on
+ * the next reload; a hand-rolled lockfile was evaluated and rejected (its steal/
+ * release edge-cases are riskier than the rare, recoverable race it would remove).
  */
 let _configWriteChain = Promise.resolve();
 

package/src/index.js

@@ -7,7 +7,7 @@ import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConf
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
-import { cloudLogin, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
+import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
 
 const args = process.argv.slice(2);
@@ -76,6 +76,12 @@ switch (command) {
     await cloudCommand();
     process.exit(0);
     break;
+  case 'push':
+    // Shortcut for `teamclaude cloud push` — upload this machine's OAuth account
+    // tokens (+ usage snapshot) to the cloud under the logged-in user's own tenant.
+    await cloudPushCommand(await loadOrCreateConfig());
+    process.exit(0);
+    break;
   case 'update':
     await updateCommand();
     process.exit(0);
@@ -279,6 +285,10 @@ async function serverCommand() {
         // reload (R) / restart via syncAccountsFromDisk — not merged here, since we
         // can't distinguish "added externally" from "deleted locally" at save time.
         diskConfig.accounts = mapped;
+        // NOTE: cloud.localDisabled is maintained at the point of an EXPLICIT toggle
+        // (TUI _doToggleEnabled / CLI enable-disable), NOT reconciled from the account
+        // set here — a blanket "enabled!==false → clear overlay" would wrongly drop a
+        // disable when a pruned account is re-imported with its default enabled=true.
       }),
       syncAccounts: async () => {
         const diskConfig = await loadConfig();
@@ -290,6 +300,15 @@ async function serverCommand() {
       // this closure never runs before the binding is initialized.
       refreshQuota: () => server.refreshQuotaAll(),
       onQuit: () => { server.close(() => process.exit(0)); },
+      // Persist an offline local-disable toggle (by uuid) to disk atomically, re-reading
+      // the config so it merges with any concurrent CLI/pull change to cloud.localDisabled
+      // instead of overwriting it from the TUI's in-memory copy. Never pushed to the cloud.
+      setLocalDisabled: (uuid, disabled) => atomicConfigUpdate(c => {
+        const cloud = c.cloud || (c.cloud = {});
+        const set = new Set(Array.isArray(cloud.localDisabled) ? cloud.localDisabled : []);
+        if (disabled) set.add(uuid); else set.delete(uuid);
+        cloud.localDisabled = [...set];
+      }),
     });
     hooks = {
       onRequestStart: (id, info) => tui.onRequestStart(id, info),
@@ -1026,11 +1045,29 @@ async function setEnabledCommand(enabled) {
   let found = false;
   const config = await atomicConfigUpdate(cfg => {
     const acct = cfg.accounts.find(a => a.name === name);
-    if (acct) { acct.enabled = enabled; found = true; }
+    if (acct) {
+      acct.enabled = enabled;
+      found = true;
+      // Maintain the persistent, client-only local-disable overlay (by uuid). This is
+      // an OFFLINE choice — never pushed or synced to the cloud — and it survives a pull
+      // prune+re-add. A cloud-disabled account is pruned (absent here), so `enable` can't
+      // find it → the admin's disable cannot be overridden by the client.
+      if (acct.accountUuid) {
+        const cloud = cfg.cloud || (cfg.cloud = {});
+        const set = new Set(Array.isArray(cloud.localDisabled) ? cloud.localDisabled : []);
+        if (enabled) set.delete(acct.accountUuid); else set.add(acct.accountUuid);
+        cloud.localDisabled = [...set];
+      }
+    }
   });
   if (!found) { console.error(`Account "${name}" not found`); process.exit(1); }
   console.log(`${enabled ? 'Enabled' : 'Disabled'} account "${name}"`);
-  if (!enabled) console.log('  (excluded from active rotation; in-flight requests still finish)');
+  if (!enabled) console.log('  (excluded from active rotation, offline-only — not pushed or synced to the cloud; in-flight requests still finish)');
+  // Honesty about the authority model (HIGH): `enable` clears only the LOCAL override.
+  // The cloud allow-set still governs — an account the admin disabled in the cloud is
+  // pruned on the next pull (a running server re-applies this every sync interval), so
+  // this re-enable is effective only while the account is still cloud-allowed.
+  else console.log('  (local override cleared; the cloud allow-set still governs — a pull/live-sync re-applies any admin cloud-disable)');
   await noteRunningServerReload(config);
 }
 
@@ -1081,10 +1118,12 @@ Commands:
   status              Show proxy & account status (live)
   accounts            List configured accounts
   remove <name>       Remove an account
-  disable <name>      Disable an account (excluded from rotation)
-  enable <name>       Re-enable a disabled account
+  disable <name>      Disable an account (offline-only; never pushed/synced to cloud)
+  enable <name>       Re-enable a locally-disabled account (cannot re-enable one the
+                      admin disabled in the cloud — that stays excluded)
   priority <name> <n> Set selection priority (lower = preferred; "auto" to return
                       to automatic ordering — weekly reset soonest drained first)
+  push                Shortcut for "cloud push" — upload local tokens to the cloud
   api <path>          Call an API endpoint with account credentials
   cloud <sub>         Cloud SaaS: sync tokens + group/auth-key based token control
                         cloud login   --url <u> --anon-key <k> --email <e> [--password <p>]
@@ -1432,30 +1471,44 @@ const _autoPushInFlight = new Set();
  */
 async function maybePushRefreshedToken(config, account, newTokens) {
   const key = account.accountUuid || account.name;
-  const hasOwner = !!(config.cloud && config.cloud.session && config.cloud.session.access_token);
+  const session = config.cloud && config.cloud.session;
+  // An owner session is USABLE if its access token is still valid OR it carries a
+  // refresh token (ensureCloudSession can renew it). A token-only login (Google/SSO)
+  // has NO refresh token, so once it expires it's unusable — treating it as usable
+  // would 401 the push and skip the key fallback, leaving the cloud with a dead
+  // refresh token (Codex HIGH). expires_at is seconds.
+  const ownerUsable = !!(session && session.access_token && (
+    (Number(session.expires_at || 0) * 1000) > Date.now() + 30_000 ||
+    (session.refresh_token && String(session.refresh_token).length > 0)
+  ));
   const pullKey = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
-  // Nothing to sync back to unless we're an admin (owner session) OR a consumer
-  // with a pull key. A consumer that rotated a token LOCALLY (cloud refresh was
-  // unreachable) MUST report it back, or the cloud keeps a now-dead refresh token
-  // and every consumer — plus the cloud's own /sync/refresh — fails invalid_grant.
-  if (!hasOwner && !(pullKey && account.accountUuid)) return;
+  const canKey = !!(pullKey && account.accountUuid);
+  if (!ownerUsable && !canKey) return; // nowhere to sync back to
   try {
     if (_autoPushInFlight.has(key)) return;
     _autoPushInFlight.add(key);
-    if (hasOwner) {
-      const cloud = await ensureCloudSession(config).catch(() => config.cloud);
-      await cloudPush(cloud, [{
-        accountUuid: account.accountUuid,
-        name: account.name,
-        subscriptionType: account.subscriptionType,
-        tier: account.tier,
-        type: account.type,
-        accessToken: newTokens.accessToken,
-        refreshToken: newTokens.refreshToken,
-        expiresAt: newTokens.expiresAt,
-      }]);
-    } else {
-      // Consumer path: key-authenticated write-back (freshest-wins on the server).
+    if (ownerUsable) {
+      try {
+        const cloud = await ensureCloudSession(config).catch(() => config.cloud);
+        await cloudPush(cloud, [{
+          accountUuid: account.accountUuid,
+          name: account.name,
+          subscriptionType: account.subscriptionType,
+          tier: account.tier,
+          type: account.type,
+          accessToken: newTokens.accessToken,
+          refreshToken: newTokens.refreshToken,
+          expiresAt: newTokens.expiresAt,
+        }]);
+        return;
+      } catch (e) {
+        // Owner push failed (e.g. the short-lived token-login expired) — fall back
+        // to the key path so the rotation still reaches the cloud.
+        if (!canKey) throw e;
+      }
+    }
+    if (canKey) {
+      // Consumer / expired-owner path: key-authenticated write-back (freshest-wins).
       await cloudReportToken(resolveCloud(config), pullKey, account.accountUuid, {
         accessToken: newTokens.accessToken,
         refreshToken: newTokens.refreshToken,
@@ -1472,14 +1525,34 @@ async function maybePushRefreshedToken(config, account, newTokens) {
 // ── cloud (SaaS token sync + auth-key control) ──────────────────
 
 // Refresh the owner session if it is expiring; persist the new session.
+let _cloudSessionRefresh = null; // coalesce concurrent owner-session refreshes
 async function ensureCloudSession(config) {
   const cloud = config.cloud;
   if (!cloud || !cloud.session || !cloud.session.access_token) return cloud;
   const expMs = (Number(cloud.session.expires_at) || 0) * 1000; // Supabase expires_at is seconds
   if (expMs && Date.now() + 60_000 >= expMs && cloud.session.refresh_token) {
-    const s = await cloudRefreshSession(cloud, cloud.session.refresh_token);
-    cloud.session = s;
-    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+    // The owner session has ONE single-use rotating Supabase refresh token. If two
+    // account rotations refresh it concurrently, one wins and the other trips reuse
+    // detection and loses its push (Codex HIGH). Serialize: all concurrent callers
+    // share the SAME in-flight refresh instead of each rotating independently.
+    if (!_cloudSessionRefresh) {
+      const rt = cloud.session.refresh_token;
+      _cloudSessionRefresh = (async () => {
+        try {
+          const s = await cloudRefreshSession(cloud, rt);
+          cloud.session = s;
+          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+          return s;
+        } finally {
+          _cloudSessionRefresh = null;
+        }
+      })();
+    }
+    // NOTE: concurrent refreshes WITHIN this process share the single in-flight
+    // promise above (one rotation). Cross-PROCESS coordination is intentionally not
+    // done here — the codebase assumes a single proxy per config (see
+    // atomicConfigUpdate's documented cross-process limitation).
+    await _cloudSessionRefresh;
   }
   return cloud;
 }
@@ -1499,6 +1572,7 @@ async function cloudCommand() {
       console.log('Cloud commands (SaaS token sync + auth-key control):');
       console.log('  teamclaude cloud pull   --key <auth-key>    Pull allowed tokens (key-only — no login)');
       console.log('  teamclaude cloud login  --email <e> [--password <p>]   (admin, to push)');
+      console.log('  teamclaude cloud login  --token   (Google/SSO — paste the token from the dashboard at the prompt)');
       console.log('  teamclaude cloud push                       Push local account tokens to the cloud');
       console.log('  teamclaude cloud key create [--label <l>] [--accounts uuid1,uuid2]');
       console.log('  teamclaude cloud key list');
@@ -1508,11 +1582,88 @@ async function cloudCommand() {
   }
 }
 
+// Decode a JWT payload (base64url) without verifying — we only read exp/email to
+// stamp the stored session; the server verifies the token on every request.
+function decodeJwtPayload(token) {
+  try {
+    const part = String(token).split('.')[1] || '';
+    const b64 = part.replace(/-/g, '+').replace(/_/g, '/');
+    return JSON.parse(Buffer.from(b64, 'base64').toString('utf8')) || {};
+  } catch {
+    return {};
+  }
+}
+
 async function cloudLoginCommand(config) {
   // url/anon-key default to the built-in public endpoint — only --email/--password
   // are required for the owner (admin) login.
   const url = argValue('--url') || config.cloud?.url || process.env.SUPABASE_URL || DEFAULT_CLOUD.url;
   const anonKey = argValue('--anon-key') || config.cloud?.anonKey || process.env.SUPABASE_ANON_KEY || DEFAULT_CLOUD.anonKey;
+
+  // Token login: for Google / SSO owners who have NO password. The dashboard's
+  // "Copy CLI token" button copies just the access token; run `teamclaude cloud
+  // login --token` and PASTE it at the prompt. Reading from stdin keeps the owner
+  // token out of argv / shell history (Codex HIGH). A `--token <value>` (or env)
+  // is still accepted for scripting.
+  const tokenFlag = args.includes('--token');
+  const tokenArg = argValue('--token');
+  let token = (tokenArg && tokenArg !== '-' && !tokenArg.startsWith('--')) ? tokenArg : process.env.TEAMCLAUDE_CLOUD_TOKEN || '';
+  if (!token && tokenFlag) {
+    if (process.stdin.isTTY) {
+      // Read WITHOUT echo via raw mode — the owner token must never land in the
+      // terminal's visible scrollback or a screen recording (Codex HIGH). Raw mode
+      // disables the TTY driver's echo; we buffer chars ourselves and print nothing.
+      token = (await new Promise((resolve) => {
+        process.stderr.write('Paste cloud access token (input hidden): ');
+        const stdin = process.stdin;
+        stdin.setRawMode?.(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        let buf = '';
+        const onData = (chunk) => {
+          for (const ch of chunk) {
+            if (ch === '\n' || ch === '\r' || ch === '\u0004') {  // Enter / EOF -> done
+              stdin.removeListener('data', onData);
+              stdin.setRawMode?.(false); stdin.pause();
+              process.stderr.write('\n');
+              return resolve(buf);
+            }
+            if (ch === '\u0003') { stdin.setRawMode?.(false); process.stderr.write('\n'); process.exit(1); } // Ctrl-C
+            else if (ch === '\u007f' || ch === '\b') buf = buf.slice(0, -1); // backspace
+            else buf += ch;
+          }
+        };
+        stdin.on('data', onData);
+      })).trim();
+    } else {
+      // Piped (e.g. pbpaste | teamclaude cloud login --token): read from stdin.
+      token = (await new Promise((resolve) => {
+        let d = ''; process.stdin.on('data', c => (d += c)); process.stdin.on('end', () => resolve(d));
+      })).trim();
+    }
+  }
+  if (token) {
+    const payload = decodeJwtPayload(token);
+    const expSec = Number(payload.exp) || Math.floor(Date.now() / 1000) + 3600; // JWT exp (seconds)
+    const email = payload.email || payload?.user_metadata?.email || config.cloud?.email || null;
+    // Access token ONLY — never store the browser's refresh token. Supabase refresh
+    // tokens are single-use rotating; sharing one between the browser and the CLI
+    // would make them rotate-conflict and revoke each other (reuse detection). So
+    // this is a short-lived (~1h) login — enough to push; re-copy when it expires.
+    const session = { access_token: token, refresh_token: '', expires_at: expSec };
+    // Validate the token actually authorizes as an owner BEFORE overwriting any
+    // existing login — a forged/expired token (or a bogus future `exp`) must not
+    // silently replace a working session.
+    const ok = await cloudValidateOwner({ url, anonKey, session }).catch(() => false);
+    if (!ok) {
+      console.error('Token login failed — the token is invalid or expired. Re-copy "CLI login" from the web dashboard.');
+      process.exit(1);
+    }
+    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), url, anonKey, email, session }; });
+    console.log(`Logged in to cloud${email ? ` as ${email}` : ''} (token, short-lived ~1h — re-copy from the dashboard when it expires).`);
+    return;
+  }
+
   const email = argValue('--email') || config.cloud?.email || process.env.TEAMCLAUDE_CLOUD_EMAIL;
   let password = argValue('--password') || process.env.TEAMCLAUDE_CLOUD_PASSWORD;
   if (!email) {

package/src/tui.js

@@ -114,13 +114,14 @@ function timestamp() {
 // ── TUI class ────────────────────────────────────────────────
 
 export class TUI {
-  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit }) {
+  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit, setLocalDisabled }) {
     this.am = accountManager;
     this.config = config;
     this.saveConfig = saveConfig;
     this.syncAccounts = syncAccounts;
     this.refreshQuota = refreshQuota;  // optional: forced fleet quota re-measure (R)
     this.onQuit = onQuit;
+    this.setLocalDisabled = setLocalDisabled;  // optional: persist offline local-disable overlay (by uuid) to disk (fresh-read merge)
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -518,6 +519,14 @@ export class TUI {
       || this.config.accounts.find(a => a.name === amAcct.name);
     if (cfg) cfg.enabled = newEnabled;
     await this.saveConfig(this.config);
+    // Maintain the offline local-disable overlay (cloud.localDisabled, by uuid) at the
+    // point of this EXPLICIT toggle. Do it through setLocalDisabled, which re-reads the
+    // config from DISK and flips only this uuid — so it merges with a CLI/pull change
+    // instead of overwriting the disk set from the TUI's (possibly stale) in-memory
+    // copy, and it actually persists (the account-only saveConfig callback does not
+    // write cloud.localDisabled). Never pushed or synced to the cloud.
+    const uuid = amAcct.accountUuid || cfg?.accountUuid;
+    if (uuid && this.setLocalDisabled) await this.setLocalDisabled(uuid, !newEnabled);
     this._addLog(`${newEnabled ? 'Enabled' : 'Disabled'} "${amAcct.name}"`);
   }