teamclaude-cloud 1.5.7 → 1.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.7",
+  "version": "1.5.8",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/config.js

@@ -160,3 +160,4 @@ export function atomicConfigUpdate(updater) {
   _configWriteChain = result.then(() => {}, () => {});
   return result;
 }
+

package/src/index.js

@@ -1603,22 +1603,49 @@ async function ensureCloudSession(config) {
     // detection and loses its push (Codex HIGH). Serialize: all concurrent callers
     // share the SAME in-flight refresh instead of each rotating independently.
     if (!_cloudSessionRefresh) {
-      const rt = cloud.session.refresh_token;
       _cloudSessionRefresh = (async () => {
         try {
-          const s = await cloudRefreshSession(cloud, rt);
+          // #24: the owner session has ONE single-use rotating Supabase refresh token.
+          // A running server + a concurrent CLI can both try to rotate it — one wins,
+          // the other trips reuse detection. Rather than a cross-process FILE LOCK
+          // (whose steal/release edge-cases proved riskier than the rare race — Codex
+          // re-confirmed), RECOVER via freshest-wins: only when THE REFRESH ITSELF
+          // fails (a concurrent process may have already rotated), re-read disk and, if
+          // it holds a fresh DIFFERENT session for the SAME cloud, adopt it. Net: one
+          // rotation lands, the loser adopts it — no cascade, no lock.
+          let s;
+          try {
+            s = await cloudRefreshSession(cloud, cloud.session.refresh_token);
+          } catch (err) {
+            // The refresh failed. Did a concurrent process already rotate + persist a
+            // fresh session? (Scope the recovery to the REFRESH failure only — a
+            // successful refresh whose disk-write later fails must NOT fall in here and
+            // re-adopt the now-consumed old session.)
+            const disk = await loadConfig();
+            const ds = disk?.cloud?.session;
+            const dsExp = (Number(ds?.expires_at) || 0) * 1000;
+            if (disk?.cloud?.url === cloud.url && ds?.access_token
+              && ds.refresh_token && ds.refresh_token !== cloud.session.refresh_token
+              && dsExp && Date.now() + 30_000 < dsExp) {
+              cloud.session = ds; // a concurrent process already refreshed — adopt theirs
+              return ds;
+            }
+            throw err; // genuinely couldn't refresh (and nobody else did)
+          }
+          // Refresh succeeded → the new session is authoritative. Persisting it is
+          // best-effort: a disk-write failure must not discard the valid in-memory
+          // session (returning it keeps this process working; it re-persists next time).
           cloud.session = s;
-          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; })
+            .catch((e) => console.error(`[TeamClaude] Failed to persist refreshed cloud session: ${e.message}`));
           return s;
         } finally {
           _cloudSessionRefresh = null;
         }
       })();
     }
-    // NOTE: concurrent refreshes WITHIN this process share the single in-flight
-    // promise above (one rotation). Cross-PROCESS coordination is intentionally not
-    // done here — the codebase assumes a single proxy per config (see
-    // atomicConfigUpdate's documented cross-process limitation).
+    // Concurrent refreshes WITHIN this process share the single in-flight promise;
+    // the freshest-wins re-read above absorbs a cross-PROCESS rotation race.
     await _cloudSessionRefresh;
   }
   // If the session is (still) expired and cannot be refreshed — a Google/SSO token