teamclaude-cloud 1.5.1 → 1.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/cloud.js

@@ -218,8 +218,11 @@ export function buildUsageFromQuota(entry) {
  * `usageByUuid` (optional Map/object accountUuid → usage from buildUsageFromQuota)
  * rides along so the dashboard can show 5h/7d/Fable utilization.
  */
-export async function cloudPush(cloud, accounts, usageByUuid = null) {
-  requireSession(cloud);
+export async function cloudPush(cloud, accounts, usageByUuid = null, authKey = null) {
+  // Auth: an auth key (push to the key's OWNER tenant, no owner login) OR the owner
+  // session. The key path only needs the endpoint (requireCloud), not a session.
+  if (authKey) requireCloud(cloud); else requireSession(cloud);
+  const authHeader = authKey ? { 'x-teamclaude-key': authKey } : { Authorization: `Bearer ${cloud.session.access_token}` };
   const usageOf = (uuid) => {
     if (!usageByUuid || !uuid) return undefined;
     const u = usageByUuid instanceof Map ? usageByUuid.get(uuid) : usageByUuid[uuid];
@@ -239,7 +242,7 @@ export async function cloudPush(cloud, accounts, usageByUuid = null) {
   };
   const res = await httpJson(`${fnBase(cloud)}/sync/push`, {
     method: 'POST',
-    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+    headers: fnHeaders(cloud, authHeader),
     body: payload,
   });
   if (!res.ok) throw new Error(`Cloud push failed (${res.status}): ${describe(res.data)}`);

package/src/index.js

@@ -315,15 +315,17 @@ async function serverCommand() {
       // running AccountManager's LIVE tokens (freshest) and re-reads the cloud session
       // from disk so a `cloud login` done after the server started is picked up.
       cloudPush: config.cloud ? (async () => {
-        const fresh = (await loadConfig()) || config;
-        const cloud = await ensureCloudSession(fresh);
-        if (!cloud?.session?.access_token) throw new Error('Not logged in to cloud — run `teamclaude cloud login`');
+        // Use the running server's LIVE tokens (freshest) for each account.
         const accounts = (config.accounts || []).filter(a => a.type !== 'apikey').map(a => {
           const am = (a.accountUuid && accountManager.accounts.find(x => x.accountUuid === a.accountUuid))
             || accountManager.accounts.find(x => x.name === a.name);
           return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
         });
         if (!accounts.length) throw new Error('No OAuth accounts to push');
+        // Prefer the AUTH KEY (push to your own tenant, no expiring owner login) —
+        // it CREATES + updates accounts. Fall back to an owner session only if no key.
+        const fresh = (await loadConfig()) || config;
+        const key = fresh.cloud?.pullKey || config.cloud?.pullKey;
         const usageByUuid = new Map();
         const quotaCache = await readQuotaCache();
         for (const entry of quotaCache?.accounts || []) {
@@ -331,7 +333,14 @@ async function serverCommand() {
           const usage = buildUsageFromQuota(entry);
           if (usage) usageByUuid.set(entry.accountUuid, usage);
         }
-        return await cloudPush(cloud, accounts, usageByUuid);
+        let cloud, authKey = null;
+        if (key) { cloud = resolveCloud(fresh); authKey = key; }
+        else {
+          cloud = await ensureCloudSession(fresh);
+          if (!cloud?.session?.access_token) throw new Error('No auth key and not logged in — pull once with a key, or run `teamclaude cloud login`');
+        }
+        const r = await cloudPush(cloud, accounts, usageByUuid, authKey);
+        return { summary: `${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageByUuid.size ? `, usage ${r.usage ?? 0}` : ''}${authKey ? ' (via auth key)' : ''}` };
       }) : undefined,
     });
     hooks = {
@@ -894,7 +903,7 @@ async function accountsCommand() {
       a.refreshToken = newTokens.refreshToken;
       a.expiresAt = newTokens.expiresAt;
       configDirty = true;
-    } catch (err) {
+    } catch {
       // refresh failed — fetchProfile will report the specific error
     }
   }));
@@ -1578,6 +1587,17 @@ async function ensureCloudSession(config) {
     // atomicConfigUpdate's documented cross-process limitation).
     await _cloudSessionRefresh;
   }
+  // If the session is (still) expired and cannot be refreshed — a Google/SSO token
+  // login (`cloud login --token`) stores NO refresh token, so its ~1h token simply
+  // lapses — fail with an actionable message instead of letting the caller hit a
+  // bare 401 unauthorized.
+  const curExpMs = (Number(cloud.session.expires_at) || 0) * 1000;
+  if (curExpMs && Date.now() >= curExpMs) {
+    const hint = cloud.session.refresh_token
+      ? 'Run `teamclaude cloud login` to sign in again.'
+      : 'Re-copy the CLI login token from the dashboard (the "관리자 로그인" box in the Auth Keys section) and run `teamclaude cloud login --token`.';
+    throw new Error(`Cloud session expired. ${hint}`);
+  }
   return cloud;
 }
 
@@ -1706,13 +1726,29 @@ async function cloudLoginCommand(config) {
 }
 
 async function cloudPushCommand(config) {
-  const cloud = await ensureCloudSession(config);
-  if (!cloud?.session?.access_token) { console.error('Not logged in. Run `teamclaude cloud login`.'); process.exit(1); }
   const accounts = (config.accounts || []).filter(a => a.type !== 'apikey');
   if (!accounts.length) { console.error('No OAuth accounts to push.'); process.exit(1); }
-  // Ride the proxy's quota snapshot (<config>.quota.json) along so the cloud
-  // dashboard can show 5h/7d/Fable utilization. Absence is fine — usage rows
-  // are simply not written (the dashboard shows "no data", not a fake zero).
+  // Prefer the AUTH KEY: pushing to your own tenant is the key's job — no separate,
+  // short-lived owner login required (the key is the credential, same as pull). This
+  // CREATES + updates accounts in the key's owner tenant (freshest-wins + plan limits).
+  const key = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  if (key) {
+    const usageByUuid = new Map();
+    const quotaCache = await readQuotaCache();
+    for (const entry of quotaCache?.accounts || []) {
+      if (!entry?.accountUuid) continue;
+      const usage = buildUsageFromQuota(entry);
+      if (usage) usageByUuid.set(entry.accountUuid, usage);
+    }
+    const r = await cloudPush(resolveCloud(config), accounts, usageByUuid, key);
+    const usageNote = usageByUuid.size ? `, usage ${r.usage ?? 0}/${usageByUuid.size}` : '';
+    console.log(`Pushed to your account via auth key: ${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageNote}.`);
+    return;
+  }
+  // No auth key — fall back to an owner login (which also CREATES new accounts) and
+  // rides the quota snapshot so the dashboard can show utilization.
+  const cloud = await ensureCloudSession(config);
+  if (!cloud?.session?.access_token) { console.error('No auth key found and not logged in. Pull once with `teamclaude cloud pull --key <key>`, or `teamclaude cloud login`.'); process.exit(1); }
   const usageByUuid = new Map();
   const quotaCache = await readQuotaCache();
   for (const entry of quotaCache?.accounts || []) {

package/src/tui.js

@@ -399,8 +399,7 @@ export class TUI {
     try {
       this._addLog('Pushing account tokens to the cloud...');
       const r = await this.cloudPush();
-      const usageNote = (r && r.usage != null) ? `, usage ${r.usage}` : '';
-      this._addLog(`Cloud push: ${r?.pushed ?? 0} new, ${r?.updated ?? 0} updated, ${r?.skipped ?? 0} skipped${usageNote}`);
+      this._addLog(`Cloud push: ${r?.summary ?? 'done'}`);
     } catch (e) {
       this._addLog(`Cloud push failed: ${e.message}`);
     }