teamclaude-cloud 1.5.4 → 1.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/config.js

@@ -86,6 +86,10 @@ export function createDefaultConfig() {
     // Hard caps that bound proxy memory under a request flood.
     overflowQueueMaxDepth: 256,        // max queued requests before 429
     maxRequestBytes: 33554432,         // 32 MiB max buffered request body, else 413
+    // Mask mode: hide account emails in CLI output (status/accounts/TUI). Display-only
+    // security posture (shoulder-surfing / screen-share). Toggle: `teamclaude mask on|off`
+    // or the TUI `m` key. Independent of the web dashboard's own mask toggle.
+    maskMode: false,
     accounts: [],
   };
 }

package/src/index.js

@@ -9,6 +9,7 @@ import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
 import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
+import { maskIf, maskEmail } from './mask.js';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -52,6 +53,10 @@ switch (command) {
     await accountsCommand();
     process.exit(0);
     break;
+  case 'mask':
+    await maskCommand();
+    process.exit(0);
+    break;
   case 'remove':
     await removeCommand();
     process.exit(0);
@@ -254,7 +259,7 @@ async function serverCommand() {
 
   if (useTUI) {
     tui = new TUI({
-      accountManager, config,
+      accountManager, config, version: currentVersion(),
       saveConfig: () => atomicConfigUpdate(async diskConfig => {
         // Write in-memory accounts as the authoritative state, preserving
         // extra disk-only fields (e.g. importFrom) where the account still exists.
@@ -309,6 +314,9 @@ async function serverCommand() {
         if (disabled) set.add(uuid); else set.delete(uuid);
         cloud.localDisabled = [...set];
       }),
+      // Persist the mask-mode flag (TUI `m`) atomically, re-reading disk so it merges
+      // with any concurrent token-refresh write instead of clobbering it.
+      setMask: (on) => atomicConfigUpdate(c => { c.maskMode = on === true; }),
       // `p` in the dashboard = `teamclaude cloud push`, so the admin can register the
       // server's live account tokens to the cloud without dropping to a shell. Only
       // wired when a cloud config exists (else the footer hides the key). Uses the
@@ -447,14 +455,15 @@ async function serverCommand() {
       }
     }
 
+    const ver = currentVersion();
     if (tui) {
       tui.start();
-      console.log(`Listening on port ${port} with ${accounts.length} account(s)`);
+      console.log(`TeamClaude${ver ? ` v${ver}` : ''} — listening on port ${port} with ${accounts.length} account(s)`);
     } else {
       const sep = '='.repeat(60);
       console.log('');
       console.log(sep);
-      console.log('  TeamClaude Proxy');
+      console.log(`  TeamClaude Proxy${ver ? `  v${ver}` : ''}`);
       console.log(sep);
       console.log(`  Port:       ${port}`);
       console.log(`  Accounts:   ${accounts.length}`);
@@ -462,7 +471,7 @@ async function serverCommand() {
       console.log(`  Upstream:   ${config.upstream || 'https://api.anthropic.com'}`);
       console.log('');
       accounts.forEach((a, i) => {
-        console.log(`  [${i + 1}] ${a.name} (${a.type})`);
+        console.log(`  [${i + 1}] ${maskIf(a.name, config.maskMode)} (${a.type})`);
       });
       console.log('');
       console.log('  Run Claude through proxy:  teamclaude run');
@@ -813,6 +822,29 @@ async function runCommand() {
   process.exit(result.status ?? 1);
 }
 
+// ── mask mode ───────────────────────────────────────────────
+
+// `teamclaude mask [on|off|toggle]` — flip the display-only mask that hides account
+// emails in status/accounts/TUI output. Persisted in config (freshest-wins safe via
+// atomicConfigUpdate re-read). Independent of the web dashboard's own mask toggle.
+async function maskCommand() {
+  const arg = (args[1] || '').toLowerCase();
+  let target;
+  if (['on', 'true', '1'].includes(arg)) target = true;
+  else if (['off', 'false', '0'].includes(arg)) target = false;
+  else if (arg === '' || arg === 'toggle') target = null; // toggle current
+  else { console.error('Usage: teamclaude mask [on|off|toggle]'); process.exit(1); }
+
+  const updated = await atomicConfigUpdate((cfg) => {
+    cfg.maskMode = target === null ? !(cfg.maskMode === true) : target;
+    return cfg;
+  });
+  const on = updated.maskMode === true;
+  console.log(`Mask mode: ${on ? 'ON' : 'OFF'} — account emails are ${on ? 'hidden' : 'shown'} in CLI output.`);
+  const first = updated.accounts?.[0]?.name;
+  if (first) console.log(`  example: ${maskIf(first, on)}  (masked: ${maskEmail(first)})`);
+}
+
 // ── status ──────────────────────────────────────────────────
 
 async function statusCommand() {
@@ -842,7 +874,7 @@ async function statusCommand() {
       const current = acct.name === data.currentAccount ? ' *' : '';
 
       const disabledTag = acct.enabled === false ? ' [disabled]' : '';
-      console.log(`  ${acct.name} (${acct.type})${current}${disabledTag}`);
+      console.log(`  ${maskIf(acct.name, config.maskMode)} (${acct.type})${current}${disabledTag}`);
       console.log(`    Status:   ${acct.status}${acct.enabled === false ? ' (disabled — out of rotation)' : ''}`);
       if (acct.priority != null) console.log(`    Priority: ${acct.priority} (lower = preferred)`);
       if (acct.maxConcurrent != null) {
@@ -946,7 +978,7 @@ async function accountsCommand() {
     const p = profiles[i];
 
     if (a.type === 'apikey') {
-      console.log(`  [${i + 1}] ${a.name} (apikey)  ${a.apiKey?.slice(0, 15)}...`);
+      console.log(`  [${i + 1}] ${maskIf(a.name, config.maskMode)} (apikey)  ${a.apiKey?.slice(0, 15)}...`);
       continue;
     }
 
@@ -955,8 +987,8 @@ async function accountsCommand() {
     const tier = hasProfile ? (p.hasClaudeMax ? 'Max' : p.hasClaudePro ? 'Pro' : 'subscription') : null;
     const status = hasProfile ? `Claude ${tier}` : `unknown (${p?.error || 'no token'})`;
     const src = a.source ? `, ${a.source}` : '';
-    console.log(`  [${i + 1}] ${a.name} (${status}${src})`);
-    if (hasProfile && p.email && p.email !== a.name) console.log(`       Email: ${p.email}`);
+    console.log(`  [${i + 1}] ${maskIf(a.name, config.maskMode)} (${status}${src})`);
+    if (hasProfile && p.email && p.email !== a.name) console.log(`       Email: ${maskIf(p.email, config.maskMode)}`);
     if (hasProfile && p.orgName) console.log(`       Org:   ${p.orgName}`);
     if (verbose && a.expiresAt) {
       const remaining = a.expiresAt - Date.now();
@@ -1156,6 +1188,8 @@ Commands:
                       admin disabled in the cloud — that stays excluded)
   priority <name> <n> Set selection priority (lower = preferred; "auto" to return
                       to automatic ordering — weekly reset soonest drained first)
+  mask [on|off]       Toggle mask mode — hide account emails in CLI/TUI output
+                      (display-only security; ma*******73@gmail.com). No arg = toggle
   push                Shortcut for "cloud push" — upload local tokens to the cloud
   api <path>          Call an API endpoint with account credentials
   cloud <sub>         Cloud SaaS: sync tokens + group/auth-key based token control

package/src/mask.js

@@ -0,0 +1,31 @@
+// Account-identifier masking for "mask mode" — a security posture that hides
+// account emails from shoulder-surfers / screen shares. Pure, zero-dependency.
+//
+// Rule (from the product spec, with the canonical example maestrobs73@gmail.com →
+// ma*******73@gmail.com):
+//   - Only the local part (before '@') is masked; the domain is kept intact.
+//   - local length >= 7 : first 2 chars + '*' × (n-4) + last 2 chars.
+//   - local length <= 6 : first 2 chars + '*' × (n-2)   (no trailing reveal — too short).
+//   - local length <= 2 : returned unchanged (nothing meaningful to mask).
+//   - No '@' (not an email): the whole string is treated as the local part.
+//
+// The SAME algorithm is mirrored in public/app.js (browser) — keep them in sync.
+
+export function maskEmail(value) {
+  if (typeof value !== 'string' || value.length === 0) return value;
+  const at = value.indexOf('@');
+  const local = at >= 0 ? value.slice(0, at) : value;
+  const domain = at >= 0 ? value.slice(at) : ''; // includes the leading '@'
+  const n = local.length;
+  let masked;
+  if (n <= 2) masked = local;
+  else if (n <= 6) masked = local.slice(0, 2) + '*'.repeat(n - 2);
+  else masked = local.slice(0, 2) + '*'.repeat(n - 4) + local.slice(n - 2);
+  return masked + domain;
+}
+
+// Convenience: mask only when the flag is on. Every account-name display site calls
+// this so new/removed accounts are masked uniformly with no per-site special-casing.
+export function maskIf(value, on) {
+  return on ? maskEmail(value) : value;
+}

package/src/tui.js

@@ -1,4 +1,5 @@
 import { importCredentials, fetchProfile } from './oauth.js';
+import { maskIf } from './mask.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -114,15 +115,17 @@ function timestamp() {
 // ── TUI class ────────────────────────────────────────────────
 
 export class TUI {
-  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit, setLocalDisabled, cloudPush }) {
+  constructor({ accountManager, config, saveConfig, syncAccounts, refreshQuota, onQuit, setLocalDisabled, cloudPush, setMask, version }) {
     this.am = accountManager;
     this.config = config;
+    this.version = version;   // optional: shown in the TUI header
     this.saveConfig = saveConfig;
     this.syncAccounts = syncAccounts;
     this.refreshQuota = refreshQuota;  // optional: forced fleet quota re-measure (R)
     this.onQuit = onQuit;
     this.setLocalDisabled = setLocalDisabled;  // optional: persist offline local-disable overlay (by uuid) to disk (fresh-read merge)
     this.cloudPush = cloudPush;                 // optional: push account tokens to the cloud (`p`) — returns {pushed,updated,skipped,usage}
+    this.setMask = setMask;                     // optional: persist mask-mode flag to disk (fresh-read merge)
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -198,12 +201,26 @@ export class TUI {
   }
 
   _addLog(msg) {
-    msg = msg.replace(/^\[TeamClaude\]\s*/, '');
-    this.log.unshift({ t: timestamp(), msg });
+    // Store RAW; masking is applied at RENDER time (_maskLog) so a mid-session mask
+    // toggle re-masks already-buffered lines too (Codex HIGH: buffered logs stayed raw).
+    this.log.unshift({ t: timestamp(), msg: msg.replace(/^\[TeamClaude\]\s*/, '') });
     if (this.log.length > 200) this.log.length = 200;
     if (this.running) this.render();
   }
 
+  // Mask every email in a log line when mask mode is on — applied at RENDER time. Uses
+  // an email REGEX (not the current account list) so it also masks a just-deleted
+  // account's name and can't partially expose one email that is a substring of another
+  // (Codex HIGH ×3). Covers TUI-generated lines AND redirected server/account-manager
+  // console output, so ordinary request/activity logging can't bypass mask mode.
+  _maskLog(s) {
+    if (this.config?.maskMode !== true || typeof s !== 'string') return s;
+    return s.replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, (m) => maskIf(m, true));
+  }
+
+  // Mask a single account name for direct render (active-requests line, etc.).
+  _mn(name) { return maskIf(name, this.config?.maskMode === true); }
+
   // ── input handling ─────────────────────────────────
 
   _onData(d) {
@@ -265,6 +282,7 @@ export class TUI {
     if (k === 'a') { this.mode = 'add'; return; }
     if (k === 'R') { this._doSync(); return; }
     if (k === 'p') { this._doPush(); return; }
+    if (k === 'm') { this._doToggleMask(); return; }
 
     if (this.am.accounts.length === 0) return;
 
@@ -405,6 +423,16 @@ export class TUI {
     }
   }
 
+  // `m` toggles mask mode — hides account emails in the account list (display-only
+  // security). Persisted to disk via setMask (fresh-read atomic merge) so it survives
+  // restart, mirroring the local-disable overlay.
+  _doToggleMask() {
+    const on = !(this.config.maskMode === true);
+    this.config.maskMode = on;
+    this.setMask?.(on);
+    this._addLog(`Mask mode ${on ? 'ON' : 'OFF'} — account emails ${on ? 'hidden' : 'shown'}`);
+  }
+
   async _doImport() {
     try {
       this._addLog('Importing credentials...');
@@ -675,7 +703,7 @@ export class TUI {
     const lines = [];
 
     // ── Header
-    const left = bold(' TeamClaude');
+    const left = bold(' TeamClaude') + (this.version ? dim(` v${this.version}`) : '');
     const port = this.config.proxy?.port || 3456;
     const right = `Port ${port} ${green('▲')} `;
     lines.push(left + ' '.repeat(Math.max(1, W - vw(left) - vw(right))) + right);
@@ -722,7 +750,7 @@ export class TUI {
     for (const [, r] of this.active) {
       const el = ((now - r.started) / 1000).toFixed(1);
       const sp = cyan(SPINNER[this.frame]);
-      const a = r.account ? ` → ${r.account}` : '';
+      const a = r.account ? ` → ${this._mn(r.account)}` : '';
       lines.push(` ${sp} ${gray(r.t)}  ${r.method} ${r.path}${a} ${dim(`(${el}s...)`)}`);
     }
 
@@ -730,7 +758,7 @@ export class TUI {
     const footerH = 2;
     const space = Math.max(0, H - lines.length - footerH);
     for (let i = 0; i < space && i < this.log.length; i++) {
-      lines.push(`   ${gray(this.log[i].t)}  ${this.log[i].msg}`);
+      lines.push(`   ${gray(this.log[i].t)}  ${this._maskLog(this.log[i].msg)}`);
     }
 
     // Pad to fill
@@ -767,8 +795,8 @@ export class TUI {
     // sizes are small; a 3rd digit just widens the gutter for 100+ accounts).
     const num = gray(String(pos + 1).padStart(2) + '.');
 
-    // Name (bold if selected)
-    const rawName = a.name.slice(0, 12).padEnd(12);
+    // Name (bold if selected). Masked when mask mode is on (display-only security).
+    const rawName = maskIf(a.name, this.config?.maskMode === true).slice(0, 12).padEnd(12);
     const name = isSel ? bold(rawName) : rawName;
 
     // Type
@@ -853,7 +881,9 @@ export class TUI {
       case 'normal': {
         // `p`ush is only shown when a cloud config is present (the callback is wired).
         const push = this.cloudPush ? `  ${bold('p')}ush` : '';
-        return ` ${dim('↑↓')} select  ${bold('s')}witch  ${bold('e')}nable/disable  ${bold('o')}rder  ${bold('d')}elete  ${bold('a')}dd${push}  ${bold('R')}eload  ${bold('q')}uit`;
+        // `m`ask reflects the current state so the user can see it's on at a glance.
+        const mask = `  ${bold('m')}ask:${this.config?.maskMode === true ? green('on') : dim('off')}`;
+        return ` ${dim('↑↓')} select  ${bold('s')}witch  ${bold('e')}nable/disable  ${bold('o')}rder  ${bold('d')}elete  ${bold('a')}dd${push}${mask}  ${bold('R')}eload  ${bold('q')}uit`;
       }
       case 'select':
         return ` ${dim('↑↓')} select  ${bold('Enter')} delete  ${bold('Esc')} cancel`;