teamclaude-cloud 1.5.0 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -309,6 +309,41 @@ async function serverCommand() {
         if (disabled) set.add(uuid); else set.delete(uuid);
         cloud.localDisabled = [...set];
       }),
+      // `p` in the dashboard = `teamclaude cloud push`, so the admin can register the
+      // server's live account tokens to the cloud without dropping to a shell. Only
+      // wired when a cloud config exists (else the footer hides the key). Uses the
+      // running AccountManager's LIVE tokens (freshest) and re-reads the cloud session
+      // from disk so a `cloud login` done after the server started is picked up.
+      cloudPush: config.cloud ? (async () => {
+        // Use the running server's LIVE tokens (freshest) for each account.
+        const accounts = (config.accounts || []).filter(a => a.type !== 'apikey').map(a => {
+          const am = (a.accountUuid && accountManager.accounts.find(x => x.accountUuid === a.accountUuid))
+            || accountManager.accounts.find(x => x.name === a.name);
+          return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
+        });
+        if (!accounts.length) throw new Error('No OAuth accounts to push');
+        // Prefer the AUTH KEY (push to your own tenant, no expiring owner login).
+        const fresh = (await loadConfig()) || config;
+        const key = fresh.cloud?.pullKey || config.cloud?.pullKey;
+        if (key) {
+          const r = await cloudPushViaKey(resolveCloud(fresh), key, accounts);
+          const na = r.notAllowed ? `, ${r.notAllowed} not in the key's group` : '';
+          const sk = r.skipped ? `, ${r.skipped} skipped` : '';
+          return { summary: `${r.updated} updated, ${r.unchanged} unchanged${na}${sk} (via auth key)` };
+        }
+        // No key — owner login (also creates new accounts) + usage snapshot.
+        const cloud = await ensureCloudSession(fresh);
+        if (!cloud?.session?.access_token) throw new Error('No auth key and not logged in — pull once with a key, or run `teamclaude cloud login`');
+        const usageByUuid = new Map();
+        const quotaCache = await readQuotaCache();
+        for (const entry of quotaCache?.accounts || []) {
+          if (!entry?.accountUuid) continue;
+          const usage = buildUsageFromQuota(entry);
+          if (usage) usageByUuid.set(entry.accountUuid, usage);
+        }
+        const r = await cloudPush(cloud, accounts, usageByUuid);
+        return { summary: `${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageByUuid.size ? `, usage ${r.usage ?? 0}` : ''}` };
+      }) : undefined,
     });
     hooks = {
       onRequestStart: (id, info) => tui.onRequestStart(id, info),
@@ -1554,6 +1589,17 @@ async function ensureCloudSession(config) {
     // atomicConfigUpdate's documented cross-process limitation).
     await _cloudSessionRefresh;
   }
+  // If the session is (still) expired and cannot be refreshed — a Google/SSO token
+  // login (`cloud login --token`) stores NO refresh token, so its ~1h token simply
+  // lapses — fail with an actionable message instead of letting the caller hit a
+  // bare 401 unauthorized.
+  const curExpMs = (Number(cloud.session.expires_at) || 0) * 1000;
+  if (curExpMs && Date.now() >= curExpMs) {
+    const hint = cloud.session.refresh_token
+      ? 'Run `teamclaude cloud login` to sign in again.'
+      : 'Re-copy the CLI login token from the dashboard (the "관리자 로그인" box in the Auth Keys section) and run `teamclaude cloud login --token`.';
+    throw new Error(`Cloud session expired. ${hint}`);
+  }
   return cloud;
 }
 
@@ -1681,14 +1727,42 @@ async function cloudLoginCommand(config) {
   console.log(`Logged in to cloud as ${email}.`);
 }
 
+// Push account tokens to the cloud using an AUTH KEY — no owner login needed. Reuses
+// the key-authenticated, group-scoped, freshest-wins /sync/report-token path, so the
+// tokens land in the KEY'S OWNER tenant (your personal key → your own account). This
+// UPDATES accounts already registered + in the key's group; an account the key can't
+// pull is reported as "not in the key's group" (create it via an owner login once).
+async function cloudPushViaKey(cloud, key, accounts) {
+  const r = { updated: 0, unchanged: 0, notAllowed: 0, skipped: 0 };
+  for (const a of accounts) {
+    if (!a.accountUuid || !a.accessToken || !a.refreshToken) { r.skipped++; continue; }
+    try {
+      const res = await cloudReportToken(cloud, key, a.accountUuid, { accessToken: a.accessToken, refreshToken: a.refreshToken, expiresAt: a.expiresAt });
+      if (res.action === 'updated') r.updated++; else r.unchanged++;
+    } catch (e) {
+      if (/\(40[34]\)/.test(e.message)) r.notAllowed++; else r.skipped++; // 403 not in group / 404 unknown account
+    }
+  }
+  return r;
+}
+
 async function cloudPushCommand(config) {
-  const cloud = await ensureCloudSession(config);
-  if (!cloud?.session?.access_token) { console.error('Not logged in. Run `teamclaude cloud login`.'); process.exit(1); }
   const accounts = (config.accounts || []).filter(a => a.type !== 'apikey');
   if (!accounts.length) { console.error('No OAuth accounts to push.'); process.exit(1); }
-  // Ride the proxy's quota snapshot (<config>.quota.json) along so the cloud
-  // dashboard can show 5h/7d/Fable utilization. Absence is fine — usage rows
-  // are simply not written (the dashboard shows "no data", not a fake zero).
+  // Prefer the AUTH KEY: pushing to your own tenant is the key's job — no separate,
+  // short-lived owner login required (the key is the credential, same as pull).
+  const key = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  if (key) {
+    const r = await cloudPushViaKey(resolveCloud(config), key, accounts);
+    const na = r.notAllowed ? `, ${r.notAllowed} not in the key's group` : '';
+    const sk = r.skipped ? `, ${r.skipped} skipped (no/expired token)` : '';
+    console.log(`Pushed tokens via auth key: ${r.updated} updated, ${r.unchanged} unchanged${na}${sk}.`);
+    return;
+  }
+  // No auth key — fall back to an owner login (which also CREATES new accounts) and
+  // rides the quota snapshot so the dashboard can show utilization.
+  const cloud = await ensureCloudSession(config);
+  if (!cloud?.session?.access_token) { console.error('No auth key found and not logged in. Pull once with `teamclaude cloud pull --key <key>`, or `teamclaude cloud login`.'); process.exit(1); }
   const usageByUuid = new Map();
   const quotaCache = await readQuotaCache();
   for (const entry of quotaCache?.accounts || []) {

package/src/tui.js

@@ -114,7 +114,7 @@ function timestamp() {
 // ── TUI class ────────────────────────────────────────────────
 
 export class TUI {
-  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit, setLocalDisabled }) {
+  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit, setLocalDisabled, cloudPush }) {
     this.am = accountManager;
     this.config = config;
     this.saveConfig = saveConfig;
@@ -122,6 +122,7 @@ export class TUI {
     this.refreshQuota = refreshQuota;  // optional: forced fleet quota re-measure (R)
     this.onQuit = onQuit;
     this.setLocalDisabled = setLocalDisabled;  // optional: persist offline local-disable overlay (by uuid) to disk (fresh-read merge)
+    this.cloudPush = cloudPush;                 // optional: push account tokens to the cloud (`p`) — returns {pushed,updated,skipped,usage}
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -263,6 +264,7 @@ export class TUI {
     if (k === 'q') { this.stop(); this.onQuit?.(); return; }
     if (k === 'a') { this.mode = 'add'; return; }
     if (k === 'R') { this._doSync(); return; }
+    if (k === 'p') { this._doPush(); return; }
 
     if (this.am.accounts.length === 0) return;
 
@@ -390,6 +392,19 @@ export class TUI {
     }
   }
 
+  // `p` — push this machine's account tokens (+ usage snapshot) to the cloud, the
+  // same as `teamclaude push` / `teamclaude cloud push`, without leaving the dashboard.
+  async _doPush() {
+    if (!this.cloudPush) { this._addLog('Cloud push unavailable (no cloud config)'); return; }
+    try {
+      this._addLog('Pushing account tokens to the cloud...');
+      const r = await this.cloudPush();
+      this._addLog(`Cloud push: ${r?.summary ?? 'done'}`);
+    } catch (e) {
+      this._addLog(`Cloud push failed: ${e.message}`);
+    }
+  }
+
   async _doImport() {
     try {
       this._addLog('Importing credentials...');
@@ -835,8 +850,11 @@ export class TUI {
 
   _renderFooter() {
     switch (this.mode) {
-      case 'normal':
-        return ` ${dim('↑↓')} select  ${bold('s')}witch  ${bold('e')}nable/disable  ${bold('o')}rder  ${bold('d')}elete  ${bold('a')}dd  ${bold('R')}eload  ${bold('q')}uit`;
+      case 'normal': {
+        // `p`ush is only shown when a cloud config is present (the callback is wired).
+        const push = this.cloudPush ? `  ${bold('p')}ush` : '';
+        return ` ${dim('↑↓')} select  ${bold('s')}witch  ${bold('e')}nable/disable  ${bold('o')}rder  ${bold('d')}elete  ${bold('a')}dd${push}  ${bold('R')}eload  ${bold('q')}uit`;
+      }
       case 'select':
         return ` ${dim('↑↓')} select  ${bold('Enter')} delete  ${bold('Esc')} cancel`;
       case 'order':