teamclaude-cloud 1.5.5 → 1.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.5",
+  "version": "1.5.7",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -9,7 +9,7 @@ import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
 import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
-import { maskIf, maskEmail } from './mask.js';
+import { maskIf, maskEmail, maskEmailsIn } from './mask.js';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -989,7 +989,7 @@ async function accountsCommand() {
     const src = a.source ? `, ${a.source}` : '';
     console.log(`  [${i + 1}] ${maskIf(a.name, config.maskMode)} (${status}${src})`);
     if (hasProfile && p.email && p.email !== a.name) console.log(`       Email: ${maskIf(p.email, config.maskMode)}`);
-    if (hasProfile && p.orgName) console.log(`       Org:   ${p.orgName}`);
+    if (hasProfile && p.orgName) console.log(`       Org:   ${maskEmailsIn(p.orgName, config.maskMode)}`);
     if (verbose && a.expiresAt) {
       const remaining = a.expiresAt - Date.now();
       if (remaining <= 0) {

package/src/mask.js

@@ -29,3 +29,12 @@ export function maskEmail(value) {
 export function maskIf(value, on) {
   return on ? maskEmail(value) : value;
 }
+
+// Mask every email SUBSTRING inside a free-form string (log lines, "X's Organization",
+// generic table cells) — non-email text is left intact. Use this where an email is
+// embedded in a larger string, not the whole value.
+const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+export function maskEmailsIn(value, on) {
+  if (!on || typeof value !== 'string') return value;
+  return value.replace(EMAIL_RE, (m) => maskEmail(m));
+}

package/src/tui.js

@@ -1,5 +1,5 @@
 import { importCredentials, fetchProfile } from './oauth.js';
-import { maskIf } from './mask.js';
+import { maskIf, maskEmailsIn } from './mask.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -201,12 +201,25 @@ export class TUI {
   }
 
   _addLog(msg) {
-    msg = msg.replace(/^\[TeamClaude\]\s*/, '');
-    this.log.unshift({ t: timestamp(), msg });
+    // Store RAW; masking is applied at RENDER time (_maskLog) so a mid-session mask
+    // toggle re-masks already-buffered lines too (Codex HIGH: buffered logs stayed raw).
+    this.log.unshift({ t: timestamp(), msg: msg.replace(/^\[TeamClaude\]\s*/, '') });
     if (this.log.length > 200) this.log.length = 200;
     if (this.running) this.render();
   }
 
+  // Mask every email in a log line when mask mode is on — applied at RENDER time. Uses
+  // an email REGEX (not the current account list) so it also masks a just-deleted
+  // account's name and can't partially expose one email that is a substring of another
+  // (Codex HIGH ×3). Covers TUI-generated lines AND redirected server/account-manager
+  // console output, so ordinary request/activity logging can't bypass mask mode.
+  _maskLog(s) {
+    return maskEmailsIn(s, this.config?.maskMode === true);
+  }
+
+  // Mask a single account name for direct render (active-requests line, etc.).
+  _mn(name) { return maskIf(name, this.config?.maskMode === true); }
+
   // ── input handling ─────────────────────────────────
 
   _onData(d) {
@@ -736,7 +749,7 @@ export class TUI {
     for (const [, r] of this.active) {
       const el = ((now - r.started) / 1000).toFixed(1);
       const sp = cyan(SPINNER[this.frame]);
-      const a = r.account ? ` → ${r.account}` : '';
+      const a = r.account ? ` → ${this._mn(r.account)}` : '';
       lines.push(` ${sp} ${gray(r.t)}  ${r.method} ${r.path}${a} ${dim(`(${el}s...)`)}`);
     }
 
@@ -744,7 +757,7 @@ export class TUI {
     const footerH = 2;
     const space = Math.max(0, H - lines.length - footerH);
     for (let i = 0; i < space && i < this.log.length; i++) {
-      lines.push(`   ${gray(this.log[i].t)}  ${this.log[i].msg}`);
+      lines.push(`   ${gray(this.log[i].t)}  ${this._maskLog(this.log[i].msg)}`);
     }
 
     // Pad to fill