teamclaude-cloud 1.5.1 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -315,15 +315,25 @@ async function serverCommand() {
       // running AccountManager's LIVE tokens (freshest) and re-reads the cloud session
       // from disk so a `cloud login` done after the server started is picked up.
       cloudPush: config.cloud ? (async () => {
-        const fresh = (await loadConfig()) || config;
-        const cloud = await ensureCloudSession(fresh);
-        if (!cloud?.session?.access_token) throw new Error('Not logged in to cloud — run `teamclaude cloud login`');
+        // Use the running server's LIVE tokens (freshest) for each account.
         const accounts = (config.accounts || []).filter(a => a.type !== 'apikey').map(a => {
           const am = (a.accountUuid && accountManager.accounts.find(x => x.accountUuid === a.accountUuid))
             || accountManager.accounts.find(x => x.name === a.name);
           return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
         });
         if (!accounts.length) throw new Error('No OAuth accounts to push');
+        // Prefer the AUTH KEY (push to your own tenant, no expiring owner login).
+        const fresh = (await loadConfig()) || config;
+        const key = fresh.cloud?.pullKey || config.cloud?.pullKey;
+        if (key) {
+          const r = await cloudPushViaKey(resolveCloud(fresh), key, accounts);
+          const na = r.notAllowed ? `, ${r.notAllowed} not in the key's group` : '';
+          const sk = r.skipped ? `, ${r.skipped} skipped` : '';
+          return { summary: `${r.updated} updated, ${r.unchanged} unchanged${na}${sk} (via auth key)` };
+        }
+        // No key — owner login (also creates new accounts) + usage snapshot.
+        const cloud = await ensureCloudSession(fresh);
+        if (!cloud?.session?.access_token) throw new Error('No auth key and not logged in — pull once with a key, or run `teamclaude cloud login`');
         const usageByUuid = new Map();
         const quotaCache = await readQuotaCache();
         for (const entry of quotaCache?.accounts || []) {
@@ -331,7 +341,8 @@ async function serverCommand() {
           const usage = buildUsageFromQuota(entry);
           if (usage) usageByUuid.set(entry.accountUuid, usage);
         }
-        return await cloudPush(cloud, accounts, usageByUuid);
+        const r = await cloudPush(cloud, accounts, usageByUuid);
+        return { summary: `${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageByUuid.size ? `, usage ${r.usage ?? 0}` : ''}` };
       }) : undefined,
     });
     hooks = {
@@ -1578,6 +1589,17 @@ async function ensureCloudSession(config) {
     // atomicConfigUpdate's documented cross-process limitation).
     await _cloudSessionRefresh;
   }
+  // If the session is (still) expired and cannot be refreshed — a Google/SSO token
+  // login (`cloud login --token`) stores NO refresh token, so its ~1h token simply
+  // lapses — fail with an actionable message instead of letting the caller hit a
+  // bare 401 unauthorized.
+  const curExpMs = (Number(cloud.session.expires_at) || 0) * 1000;
+  if (curExpMs && Date.now() >= curExpMs) {
+    const hint = cloud.session.refresh_token
+      ? 'Run `teamclaude cloud login` to sign in again.'
+      : 'Re-copy the CLI login token from the dashboard (the "관리자 로그인" box in the Auth Keys section) and run `teamclaude cloud login --token`.';
+    throw new Error(`Cloud session expired. ${hint}`);
+  }
   return cloud;
 }
 
@@ -1705,14 +1727,42 @@ async function cloudLoginCommand(config) {
   console.log(`Logged in to cloud as ${email}.`);
 }
 
+// Push account tokens to the cloud using an AUTH KEY — no owner login needed. Reuses
+// the key-authenticated, group-scoped, freshest-wins /sync/report-token path, so the
+// tokens land in the KEY'S OWNER tenant (your personal key → your own account). This
+// UPDATES accounts already registered + in the key's group; an account the key can't
+// pull is reported as "not in the key's group" (create it via an owner login once).
+async function cloudPushViaKey(cloud, key, accounts) {
+  const r = { updated: 0, unchanged: 0, notAllowed: 0, skipped: 0 };
+  for (const a of accounts) {
+    if (!a.accountUuid || !a.accessToken || !a.refreshToken) { r.skipped++; continue; }
+    try {
+      const res = await cloudReportToken(cloud, key, a.accountUuid, { accessToken: a.accessToken, refreshToken: a.refreshToken, expiresAt: a.expiresAt });
+      if (res.action === 'updated') r.updated++; else r.unchanged++;
+    } catch (e) {
+      if (/\(40[34]\)/.test(e.message)) r.notAllowed++; else r.skipped++; // 403 not in group / 404 unknown account
+    }
+  }
+  return r;
+}
+
 async function cloudPushCommand(config) {
-  const cloud = await ensureCloudSession(config);
-  if (!cloud?.session?.access_token) { console.error('Not logged in. Run `teamclaude cloud login`.'); process.exit(1); }
   const accounts = (config.accounts || []).filter(a => a.type !== 'apikey');
   if (!accounts.length) { console.error('No OAuth accounts to push.'); process.exit(1); }
-  // Ride the proxy's quota snapshot (<config>.quota.json) along so the cloud
-  // dashboard can show 5h/7d/Fable utilization. Absence is fine — usage rows
-  // are simply not written (the dashboard shows "no data", not a fake zero).
+  // Prefer the AUTH KEY: pushing to your own tenant is the key's job — no separate,
+  // short-lived owner login required (the key is the credential, same as pull).
+  const key = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  if (key) {
+    const r = await cloudPushViaKey(resolveCloud(config), key, accounts);
+    const na = r.notAllowed ? `, ${r.notAllowed} not in the key's group` : '';
+    const sk = r.skipped ? `, ${r.skipped} skipped (no/expired token)` : '';
+    console.log(`Pushed tokens via auth key: ${r.updated} updated, ${r.unchanged} unchanged${na}${sk}.`);
+    return;
+  }
+  // No auth key — fall back to an owner login (which also CREATES new accounts) and
+  // rides the quota snapshot so the dashboard can show utilization.
+  const cloud = await ensureCloudSession(config);
+  if (!cloud?.session?.access_token) { console.error('No auth key found and not logged in. Pull once with `teamclaude cloud pull --key <key>`, or `teamclaude cloud login`.'); process.exit(1); }
   const usageByUuid = new Map();
   const quotaCache = await readQuotaCache();
   for (const entry of quotaCache?.accounts || []) {

package/src/tui.js

@@ -399,8 +399,7 @@ export class TUI {
     try {
       this._addLog('Pushing account tokens to the cloud...');
       const r = await this.cloudPush();
-      const usageNote = (r && r.usage != null) ? `, usage ${r.usage}` : '';
-      this._addLog(`Cloud push: ${r?.pushed ?? 0} new, ${r?.updated ?? 0} updated, ${r?.skipped ?? 0} skipped${usageNote}`);
+      this._addLog(`Cloud push: ${r?.summary ?? 'done'}`);
     } catch (e) {
       this._addLog(`Cloud push failed: ${e.message}`);
     }