teamclaude-cloud 1.5.6 → 1.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/config.js

@@ -160,3 +160,4 @@ export function atomicConfigUpdate(updater) {
   _configWriteChain = result.then(() => {}, () => {});
   return result;
 }
+

package/src/index.js

@@ -9,7 +9,7 @@ import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
 import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
 import { TUI } from './tui.js';
-import { maskIf, maskEmail } from './mask.js';
+import { maskIf, maskEmail, maskEmailsIn } from './mask.js';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -989,7 +989,7 @@ async function accountsCommand() {
     const src = a.source ? `, ${a.source}` : '';
     console.log(`  [${i + 1}] ${maskIf(a.name, config.maskMode)} (${status}${src})`);
     if (hasProfile && p.email && p.email !== a.name) console.log(`       Email: ${maskIf(p.email, config.maskMode)}`);
-    if (hasProfile && p.orgName) console.log(`       Org:   ${p.orgName}`);
+    if (hasProfile && p.orgName) console.log(`       Org:   ${maskEmailsIn(p.orgName, config.maskMode)}`);
     if (verbose && a.expiresAt) {
       const remaining = a.expiresAt - Date.now();
       if (remaining <= 0) {
@@ -1603,22 +1603,49 @@ async function ensureCloudSession(config) {
     // detection and loses its push (Codex HIGH). Serialize: all concurrent callers
     // share the SAME in-flight refresh instead of each rotating independently.
     if (!_cloudSessionRefresh) {
-      const rt = cloud.session.refresh_token;
       _cloudSessionRefresh = (async () => {
         try {
-          const s = await cloudRefreshSession(cloud, rt);
+          // #24: the owner session has ONE single-use rotating Supabase refresh token.
+          // A running server + a concurrent CLI can both try to rotate it — one wins,
+          // the other trips reuse detection. Rather than a cross-process FILE LOCK
+          // (whose steal/release edge-cases proved riskier than the rare race — Codex
+          // re-confirmed), RECOVER via freshest-wins: only when THE REFRESH ITSELF
+          // fails (a concurrent process may have already rotated), re-read disk and, if
+          // it holds a fresh DIFFERENT session for the SAME cloud, adopt it. Net: one
+          // rotation lands, the loser adopts it — no cascade, no lock.
+          let s;
+          try {
+            s = await cloudRefreshSession(cloud, cloud.session.refresh_token);
+          } catch (err) {
+            // The refresh failed. Did a concurrent process already rotate + persist a
+            // fresh session? (Scope the recovery to the REFRESH failure only — a
+            // successful refresh whose disk-write later fails must NOT fall in here and
+            // re-adopt the now-consumed old session.)
+            const disk = await loadConfig();
+            const ds = disk?.cloud?.session;
+            const dsExp = (Number(ds?.expires_at) || 0) * 1000;
+            if (disk?.cloud?.url === cloud.url && ds?.access_token
+              && ds.refresh_token && ds.refresh_token !== cloud.session.refresh_token
+              && dsExp && Date.now() + 30_000 < dsExp) {
+              cloud.session = ds; // a concurrent process already refreshed — adopt theirs
+              return ds;
+            }
+            throw err; // genuinely couldn't refresh (and nobody else did)
+          }
+          // Refresh succeeded → the new session is authoritative. Persisting it is
+          // best-effort: a disk-write failure must not discard the valid in-memory
+          // session (returning it keeps this process working; it re-persists next time).
           cloud.session = s;
-          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; })
+            .catch((e) => console.error(`[TeamClaude] Failed to persist refreshed cloud session: ${e.message}`));
           return s;
         } finally {
           _cloudSessionRefresh = null;
         }
       })();
     }
-    // NOTE: concurrent refreshes WITHIN this process share the single in-flight
-    // promise above (one rotation). Cross-PROCESS coordination is intentionally not
-    // done here — the codebase assumes a single proxy per config (see
-    // atomicConfigUpdate's documented cross-process limitation).
+    // Concurrent refreshes WITHIN this process share the single in-flight promise;
+    // the freshest-wins re-read above absorbs a cross-PROCESS rotation race.
     await _cloudSessionRefresh;
   }
   // If the session is (still) expired and cannot be refreshed — a Google/SSO token

package/src/mask.js

@@ -29,3 +29,12 @@ export function maskEmail(value) {
 export function maskIf(value, on) {
   return on ? maskEmail(value) : value;
 }
+
+// Mask every email SUBSTRING inside a free-form string (log lines, "X's Organization",
+// generic table cells) — non-email text is left intact. Use this where an email is
+// embedded in a larger string, not the whole value.
+const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+export function maskEmailsIn(value, on) {
+  if (!on || typeof value !== 'string') return value;
+  return value.replace(EMAIL_RE, (m) => maskEmail(m));
+}

package/src/tui.js

@@ -1,5 +1,5 @@
 import { importCredentials, fetchProfile } from './oauth.js';
-import { maskIf } from './mask.js';
+import { maskIf, maskEmailsIn } from './mask.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -214,8 +214,7 @@ export class TUI {
   // (Codex HIGH ×3). Covers TUI-generated lines AND redirected server/account-manager
   // console output, so ordinary request/activity logging can't bypass mask mode.
   _maskLog(s) {
-    if (this.config?.maskMode !== true || typeof s !== 'string') return s;
-    return s.replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, (m) => maskIf(m, true));
+    return maskEmailsIn(s, this.config?.maskMode === true);
   }
 
   // Mask a single account name for direct render (active-requests line, etc.).