teamclaude-cloud 1.4.3 → 1.5.1

package/README.md

@@ -35,7 +35,9 @@ Sign up there, then use the *same* account with `teamclaude cloud login` on the
 teamclaude cloud login --email <you@example.com>
 teamclaude cloud push
 
-# Groups: auth keys belong to a group (default "main"); accounts are allowed per GROUP.
+# Groups: an auth key belongs to ONE OR MORE groups (default "main"); accounts are
+# allowed per GROUP, and a key's pull returns the UNION of all its groups' accounts.
+# Assign a key to multiple groups from the dashboard (Auth Keys → group checkboxes).
 teamclaude cloud group list
 teamclaude cloud group create team-a
 teamclaude cloud group allow  team-a --accounts <uuid1>,<uuid2>   # order = priority (#0 first)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.4.3",
+  "version": "1.5.1",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/cloud.js

@@ -416,6 +416,18 @@ export async function cloudKeyMove(cloud, id, groupId) {
   return res.data; // { ok, id, groupId, group }
 }
 
+/** Set the FULL set of groups a key belongs to (multi-group). Replaces the set. */
+export async function cloudKeySetGroups(cloud, id, groupIds) {
+  requireSession(cloud);
+  const res = await httpJson(`${fnBase(cloud)}/auth-keys/${encodeURIComponent(id)}/groups`, {
+    method: 'PUT',
+    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+    body: { groupIds },
+  });
+  if (!res.ok) throw new Error(`Key set-groups failed (${res.status}): ${describe(res.data)}`);
+  return res.data; // { ok, id, groupIds }
+}
+
 export async function cloudKeyList(cloud) {
   requireSession(cloud);
   const res = await httpJson(`${fnBase(cloud)}/auth-keys`, {
@@ -557,6 +569,22 @@ export async function cloudAccountSetEnabled(cloud, accountUuid, enabled) {
 export function mergePulledAccounts(config, pulled, source = null, allowed = null) {
   const summary = { added: 0, updated: 0, skipped: 0, removed: 0 };
   if (!Array.isArray(config.accounts)) config.accounts = [];
+  // Client-only local-disable overlay: a consumer may disable a pulled account OFFLINE.
+  // It is stored by accountUuid in config.cloud.localDisabled (persistent so the choice
+  // survives a prune+re-add) and is NEVER pushed or synced up — effective enabled =
+  // cloud_enabled (present in the pull's allow-set) AND NOT local_disabled. Re-enabling
+  // an admin-disabled account is impossible: it's absent from the pull → pruned below.
+  // Seed the set from any legacy enabled===false accounts so existing disables migrate.
+  const cloudCfg = config.cloud || (config.cloud = {});
+  const localDisabled = new Set(Array.isArray(cloudCfg.localDisabled) ? cloudCfg.localDisabled : []);
+  for (const x of config.accounts) {
+    if (x.enabled === false && x.accountUuid) localDisabled.add(x.accountUuid);
+  }
+  const applyOverlay = (acct) => {
+    // Only uuid-keyed accounts participate in the overlay; legacy no-uuid accounts
+    // keep their own `enabled` (they are never cloud-pulled anyway).
+    if (acct && acct.accountUuid) acct.enabled = !localDisabled.has(acct.accountUuid);
+  };
   const applyPriority = (target, incoming) => {
     if (!('priority' in incoming)) return; // pre-group cloud response — leave local as-is
     if (Number.isInteger(incoming.priority)) target.priority = incoming.priority;
@@ -590,6 +618,7 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
         subscriptionType: a.tier || undefined,
         enabled: true,
       };
+      applyOverlay(fresh); // honor an offline local-disable that survived a prune+re-add
       addSource(fresh);
       applyPriority(fresh, a);
       config.accounts.push(fresh);
@@ -597,6 +626,12 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
       continue;
     }
     const cur = config.accounts[idx];
+    // Carry a legacy local-disable forward: a locally-disabled row that had no uuid
+    // (so the seed above skipped it) is matched here by NAME and assigned the pull's
+    // uuid — record that uuid in the overlay BEFORE applyOverlay, or it would be
+    // re-enabled and put back into rotation (Codex HIGH).
+    if (cur.enabled === false) { const u = cur.accountUuid || a.accountUuid; if (u) localDisabled.add(u); }
+    applyOverlay(cur); // local-disable overlay is authoritative for `enabled`
     addSource(cur); // now managed by this key (so this key can prune it later)
     // A payload entry with no token at all (allowed-but-tokenless) must not clobber
     // a valid local token — only apply priority/metadata, keep the local token.
@@ -614,6 +649,7 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
       expiresAt: incomingExp,
       subscriptionType: a.tier || cur.subscriptionType,
     };
+    applyOverlay(config.accounts[idx]); // re-assert overlay on the rebuilt row
     applyPriority(config.accounts[idx], a);
     summary.updated++;
   }
@@ -641,6 +677,11 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
     });
     summary.removed = before - config.accounts.length;
   }
+  // Persist the (possibly seed-migrated) overlay set. Entries are kept even when the
+  // account is temporarily absent (admin-disabled → pruned) so the consumer's choice
+  // survives an admin disable→re-enable round-trip. The set only shrinks on an explicit
+  // `enable` (setEnabledCommand); it is bounded in practice by the user's own disables.
+  cloudCfg.localDisabled = [...localDisabled];
   return summary;
 }
 

package/src/config.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
+import { readFile, writeFile, mkdir, rm, rename } from 'node:fs/promises';
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
@@ -113,9 +113,16 @@ export async function loadOrCreateConfig() {
 export async function saveConfig(config) {
   const path = getConfigPath();
   await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+  // Atomic write: a reader (loadConfig from another process — which does NOT take the
+  // config lock) must never observe a half-written file. Write a temp then rename
+  // (atomic on the same filesystem) so a read sees either the whole old or whole new.
+  const tmp = path + '.' + process.pid + '.' + randomBytes(4).toString('hex') + '.tmp';
+  await writeFile(tmp, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+  try { await rename(tmp, path); }
+  catch (err) { try { await rm(tmp, { force: true }); } catch { /* best-effort */ } throw err; }
 }
 
+
 /**
  * Atomically update the config: re-reads from disk, calls updater(config),
  * then saves. Returns the updated config. This prevents overwriting changes
@@ -126,9 +133,12 @@ export async function saveConfig(config) {
  * — e.g. a background token refresh and a TUI save/delete — would each read the same
  * snapshot and the later write would clobber the earlier one's change (resurrecting a
  * just-deleted account, or dropping a freshly-refreshed token). Chaining makes each
- * cycle observe the previous cycle's write. Cross-PROCESS races remain (the
- * single-proxy design assumption); a CLI write while the server runs is reconciled on
- * the next reload.
+ * cycle observe the previous cycle's write. saveConfig writes atomically (temp +
+ * rename) so a concurrent reader never sees a half-written file. Cross-PROCESS races
+ * (a running server's live-pull merge vs. a concurrent CLI write) remain the
+ * single-proxy design assumption — a CLI write while the server runs is reconciled on
+ * the next reload; a hand-rolled lockfile was evaluated and rejected (its steal/
+ * release edge-cases are riskier than the rare, recoverable race it would remove).
  */
 let _configWriteChain = Promise.resolve();
 

package/src/index.js

@@ -76,6 +76,12 @@ switch (command) {
     await cloudCommand();
     process.exit(0);
     break;
+  case 'push':
+    // Shortcut for `teamclaude cloud push` — upload this machine's OAuth account
+    // tokens (+ usage snapshot) to the cloud under the logged-in user's own tenant.
+    await cloudPushCommand(await loadOrCreateConfig());
+    process.exit(0);
+    break;
   case 'update':
     await updateCommand();
     process.exit(0);
@@ -279,6 +285,10 @@ async function serverCommand() {
         // reload (R) / restart via syncAccountsFromDisk — not merged here, since we
         // can't distinguish "added externally" from "deleted locally" at save time.
         diskConfig.accounts = mapped;
+        // NOTE: cloud.localDisabled is maintained at the point of an EXPLICIT toggle
+        // (TUI _doToggleEnabled / CLI enable-disable), NOT reconciled from the account
+        // set here — a blanket "enabled!==false → clear overlay" would wrongly drop a
+        // disable when a pruned account is re-imported with its default enabled=true.
       }),
       syncAccounts: async () => {
         const diskConfig = await loadConfig();
@@ -290,6 +300,39 @@ async function serverCommand() {
       // this closure never runs before the binding is initialized.
       refreshQuota: () => server.refreshQuotaAll(),
       onQuit: () => { server.close(() => process.exit(0)); },
+      // Persist an offline local-disable toggle (by uuid) to disk atomically, re-reading
+      // the config so it merges with any concurrent CLI/pull change to cloud.localDisabled
+      // instead of overwriting it from the TUI's in-memory copy. Never pushed to the cloud.
+      setLocalDisabled: (uuid, disabled) => atomicConfigUpdate(c => {
+        const cloud = c.cloud || (c.cloud = {});
+        const set = new Set(Array.isArray(cloud.localDisabled) ? cloud.localDisabled : []);
+        if (disabled) set.add(uuid); else set.delete(uuid);
+        cloud.localDisabled = [...set];
+      }),
+      // `p` in the dashboard = `teamclaude cloud push`, so the admin can register the
+      // server's live account tokens to the cloud without dropping to a shell. Only
+      // wired when a cloud config exists (else the footer hides the key). Uses the
+      // running AccountManager's LIVE tokens (freshest) and re-reads the cloud session
+      // from disk so a `cloud login` done after the server started is picked up.
+      cloudPush: config.cloud ? (async () => {
+        const fresh = (await loadConfig()) || config;
+        const cloud = await ensureCloudSession(fresh);
+        if (!cloud?.session?.access_token) throw new Error('Not logged in to cloud — run `teamclaude cloud login`');
+        const accounts = (config.accounts || []).filter(a => a.type !== 'apikey').map(a => {
+          const am = (a.accountUuid && accountManager.accounts.find(x => x.accountUuid === a.accountUuid))
+            || accountManager.accounts.find(x => x.name === a.name);
+          return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
+        });
+        if (!accounts.length) throw new Error('No OAuth accounts to push');
+        const usageByUuid = new Map();
+        const quotaCache = await readQuotaCache();
+        for (const entry of quotaCache?.accounts || []) {
+          if (!entry?.accountUuid) continue;
+          const usage = buildUsageFromQuota(entry);
+          if (usage) usageByUuid.set(entry.accountUuid, usage);
+        }
+        return await cloudPush(cloud, accounts, usageByUuid);
+      }) : undefined,
     });
     hooks = {
       onRequestStart: (id, info) => tui.onRequestStart(id, info),
@@ -1026,11 +1069,29 @@ async function setEnabledCommand(enabled) {
   let found = false;
   const config = await atomicConfigUpdate(cfg => {
     const acct = cfg.accounts.find(a => a.name === name);
-    if (acct) { acct.enabled = enabled; found = true; }
+    if (acct) {
+      acct.enabled = enabled;
+      found = true;
+      // Maintain the persistent, client-only local-disable overlay (by uuid). This is
+      // an OFFLINE choice — never pushed or synced to the cloud — and it survives a pull
+      // prune+re-add. A cloud-disabled account is pruned (absent here), so `enable` can't
+      // find it → the admin's disable cannot be overridden by the client.
+      if (acct.accountUuid) {
+        const cloud = cfg.cloud || (cfg.cloud = {});
+        const set = new Set(Array.isArray(cloud.localDisabled) ? cloud.localDisabled : []);
+        if (enabled) set.delete(acct.accountUuid); else set.add(acct.accountUuid);
+        cloud.localDisabled = [...set];
+      }
+    }
   });
   if (!found) { console.error(`Account "${name}" not found`); process.exit(1); }
   console.log(`${enabled ? 'Enabled' : 'Disabled'} account "${name}"`);
-  if (!enabled) console.log('  (excluded from active rotation; in-flight requests still finish)');
+  if (!enabled) console.log('  (excluded from active rotation, offline-only — not pushed or synced to the cloud; in-flight requests still finish)');
+  // Honesty about the authority model (HIGH): `enable` clears only the LOCAL override.
+  // The cloud allow-set still governs — an account the admin disabled in the cloud is
+  // pruned on the next pull (a running server re-applies this every sync interval), so
+  // this re-enable is effective only while the account is still cloud-allowed.
+  else console.log('  (local override cleared; the cloud allow-set still governs — a pull/live-sync re-applies any admin cloud-disable)');
   await noteRunningServerReload(config);
 }
 
@@ -1081,10 +1142,12 @@ Commands:
   status              Show proxy & account status (live)
   accounts            List configured accounts
   remove <name>       Remove an account
-  disable <name>      Disable an account (excluded from rotation)
-  enable <name>       Re-enable a disabled account
+  disable <name>      Disable an account (offline-only; never pushed/synced to cloud)
+  enable <name>       Re-enable a locally-disabled account (cannot re-enable one the
+                      admin disabled in the cloud — that stays excluded)
   priority <name> <n> Set selection priority (lower = preferred; "auto" to return
                       to automatic ordering — weekly reset soonest drained first)
+  push                Shortcut for "cloud push" — upload local tokens to the cloud
   api <path>          Call an API endpoint with account credentials
   cloud <sub>         Cloud SaaS: sync tokens + group/auth-key based token control
                         cloud login   --url <u> --anon-key <k> --email <e> [--password <p>]

package/src/tui.js

@@ -114,13 +114,15 @@ function timestamp() {
 // ── TUI class ────────────────────────────────────────────────
 
 export class TUI {
-  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit }) {
+  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit, setLocalDisabled, cloudPush }) {
     this.am = accountManager;
     this.config = config;
     this.saveConfig = saveConfig;
     this.syncAccounts = syncAccounts;
     this.refreshQuota = refreshQuota;  // optional: forced fleet quota re-measure (R)
     this.onQuit = onQuit;
+    this.setLocalDisabled = setLocalDisabled;  // optional: persist offline local-disable overlay (by uuid) to disk (fresh-read merge)
+    this.cloudPush = cloudPush;                 // optional: push account tokens to the cloud (`p`) — returns {pushed,updated,skipped,usage}
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -262,6 +264,7 @@ export class TUI {
     if (k === 'q') { this.stop(); this.onQuit?.(); return; }
     if (k === 'a') { this.mode = 'add'; return; }
     if (k === 'R') { this._doSync(); return; }
+    if (k === 'p') { this._doPush(); return; }
 
     if (this.am.accounts.length === 0) return;
 
@@ -389,6 +392,20 @@ export class TUI {
     }
   }
 
+  // `p` — push this machine's account tokens (+ usage snapshot) to the cloud, the
+  // same as `teamclaude push` / `teamclaude cloud push`, without leaving the dashboard.
+  async _doPush() {
+    if (!this.cloudPush) { this._addLog('Cloud push unavailable (no cloud config)'); return; }
+    try {
+      this._addLog('Pushing account tokens to the cloud...');
+      const r = await this.cloudPush();
+      const usageNote = (r && r.usage != null) ? `, usage ${r.usage}` : '';
+      this._addLog(`Cloud push: ${r?.pushed ?? 0} new, ${r?.updated ?? 0} updated, ${r?.skipped ?? 0} skipped${usageNote}`);
+    } catch (e) {
+      this._addLog(`Cloud push failed: ${e.message}`);
+    }
+  }
+
   async _doImport() {
     try {
       this._addLog('Importing credentials...');
@@ -518,6 +535,14 @@ export class TUI {
       || this.config.accounts.find(a => a.name === amAcct.name);
     if (cfg) cfg.enabled = newEnabled;
     await this.saveConfig(this.config);
+    // Maintain the offline local-disable overlay (cloud.localDisabled, by uuid) at the
+    // point of this EXPLICIT toggle. Do it through setLocalDisabled, which re-reads the
+    // config from DISK and flips only this uuid — so it merges with a CLI/pull change
+    // instead of overwriting the disk set from the TUI's (possibly stale) in-memory
+    // copy, and it actually persists (the account-only saveConfig callback does not
+    // write cloud.localDisabled). Never pushed or synced to the cloud.
+    const uuid = amAcct.accountUuid || cfg?.accountUuid;
+    if (uuid && this.setLocalDisabled) await this.setLocalDisabled(uuid, !newEnabled);
     this._addLog(`${newEnabled ? 'Enabled' : 'Disabled'} "${amAcct.name}"`);
   }
 
@@ -826,8 +851,11 @@ export class TUI {
 
   _renderFooter() {
     switch (this.mode) {
-      case 'normal':
-        return ` ${dim('↑↓')} select  ${bold('s')}witch  ${bold('e')}nable/disable  ${bold('o')}rder  ${bold('d')}elete  ${bold('a')}dd  ${bold('R')}eload  ${bold('q')}uit`;
+      case 'normal': {
+        // `p`ush is only shown when a cloud config is present (the callback is wired).
+        const push = this.cloudPush ? `  ${bold('p')}ush` : '';
+        return ` ${dim('↑↓')} select  ${bold('s')}witch  ${bold('e')}nable/disable  ${bold('o')}rder  ${bold('d')}elete  ${bold('a')}dd${push}  ${bold('R')}eload  ${bold('q')}uit`;
+      }
       case 'select':
         return ` ${dim('↑↓')} select  ${bold('Enter')} delete  ${bold('Esc')} cancel`;
       case 'order':