teamclaude-cloud 1.5.7 → 1.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.7",
+  "version": "1.6.0",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/config.js

@@ -160,3 +160,4 @@ export function atomicConfigUpdate(updater) {
   _configWriteChain = result.then(() => {}, () => {});
   return result;
 }
+

package/src/index.js

@@ -358,6 +358,16 @@ async function serverCommand() {
     };
   }
 
+  // Live-reload hook (both TUI and headless): a local CLI edit POSTs /teamclaude/reload
+  // so its change (enable/disable/remove/priority) applies to THIS running server
+  // immediately, instead of waiting for the next cloud-sync tick. Re-reads disk and
+  // applies through the same path as TUI "R" / a sync tick.
+  // The /teamclaude/reload endpoint and the cloud-sync loop both reconcile disk→fleet;
+  // route BOTH through the one serialized applyDiskToFleet chain (below) so they can't
+  // interleave — an older apply must not reconcile a removal while a newer one re-adds
+  // from a stale snapshot (Codex HIGH). Each run re-reads disk fresh.
+  hooks.onReload = () => applyDiskToFleet(config, accountManager);
+
   // If a TeamClaude server is already running on this config's port, don't try to
   // bind on top of it — point the user at stop/restart instead of a raw EADDRINUSE.
   const existing = await findRunningServer(config);
@@ -1067,7 +1077,6 @@ async function apiCommand() {
 // ── remove ──────────────────────────────────────────────────
 
 async function removeCommand() {
-  const config = await loadOrCreateConfig();
   const name = args[1];
 
   if (!name) {
@@ -1075,27 +1084,42 @@ async function removeCommand() {
     process.exit(1);
   }
 
-  const idx = config.accounts.findIndex(a => a.name === name);
-  if (idx < 0) {
+  // atomicConfigUpdate re-reads disk before writing, so a concurrent token-refresh
+  // write (from a running server) can't resurrect the just-removed account.
+  let found = false;
+  const config = await atomicConfigUpdate((c) => {
+    const idx = (c.accounts || []).findIndex(a => a.name === name);
+    if (idx < 0) return; // not present on the fresh disk copy — no write
+    c.accounts.splice(idx, 1);
+    found = true;
+  });
+  if (!found) {
     console.error(`Account "${name}" not found`);
     process.exit(1);
   }
-
-  config.accounts.splice(idx, 1);
-  await saveConfig(config);
   console.log(`Removed account "${name}"`);
+  await noteRunningServerReload(config); // drop it from the running server now (not next sync)
 }
 
 // ── enable / disable / priority ─────────────────────────────
 
 /** Note that changes apply to a running server only after a reload/restart. */
-function noteRunningServerReload(config) {
-  return findRunningServer(config).then(running => {
-    if (running) {
-      console.log('A server is running — apply now with: teamclaude restart');
-      console.log('  (or press "R" in the TUI to reload from config).');
+async function noteRunningServerReload(config) {
+  const running = await findRunningServer(config).catch(() => null);
+  if (!running) return;
+  // Tell the running server to apply the just-written config change RIGHT NOW
+  // (localhost-only endpoint), instead of waiting for its next cloud-sync tick.
+  try {
+    const res = await fetch(`http://127.0.0.1:${running.port}/teamclaude/reload`, {
+      method: 'POST', headers: { 'x-api-key': config.proxy.apiKey },
+    });
+    if (res.ok) {
+      await res.json().catch(() => ({}));
+      console.log('  Applied to the running server immediately.');
+      return;
     }
-  }).catch(() => {});
+  } catch { /* server unreachable mid-shutdown — fall back to the manual hint */ }
+  console.log('  A server is running — apply with: teamclaude restart (or "R" in the TUI).');
 }
 
 async function setEnabledCommand(enabled) {
@@ -1368,6 +1392,24 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
   return added;
 }
 
+// Serialized disk→fleet reconcile. The /teamclaude/reload endpoint (onReload) AND the
+// cloud-sync loop both apply disk to the live fleet; routing both through this one chain
+// stops them interleaving — an older apply reconciling a removal while a newer one re-adds
+// from a stale snapshot (Codex HIGH). Each run re-reads disk fresh, so the last-executed
+// run reflects the freshest config. Failure of one run doesn't stall the chain.
+let _fleetApplyChain = Promise.resolve();
+function applyDiskToFleet(config, accountManager) {
+  const run = _fleetApplyChain.then(async () => {
+    const disk = await loadConfig();
+    if (!disk) return { reloaded: 0, removed: 0 };
+    const reloaded = await syncAccountsFromDisk(disk, config, accountManager); // add / token / enable / priority
+    const removed = reconcileRemovedAccounts(disk, config, accountManager);    // removal (remove / group shrink)
+    return { reloaded, removed };
+  }, () => ({ reloaded: 0, removed: 0 }));
+  _fleetApplyChain = run.then(() => {}, () => {}); // keep the chain non-rejecting
+  return run;
+}
+
 // ── live cloud sync (running server ⇄ cloud) ────────────────
 
 // One cloud-sync pass: re-pull with the stored key and reconcile the live fleet.
@@ -1385,8 +1427,7 @@ async function syncFromCloudOnce(config, accountManager, cloud, key) {
       // empty allow-set drops this key's source and removes now-unmanaged accounts).
       const src = keySource(key);
       await atomicConfigUpdate(c => { mergePulledAccounts(c, [], src, []); });
-      const disk = await loadConfig();
-      const removed = disk ? reconcileRemovedAccounts(disk, config, accountManager) : 0;
+      const { removed } = await applyDiskToFleet(config, accountManager); // via the shared chain
       console.error(`[TeamClaude] Cloud auth key revoked — removed ${removed} account(s). The proxy will refuse new requests until you re-pull with a valid key.`);
       return { stop: true };
     }
@@ -1394,11 +1435,8 @@ async function syncFromCloudOnce(config, accountManager, cloud, key) {
     return { stop: false };
   }
   await atomicConfigUpdate(c => { mergePulledAccounts(c, pulled, source, allowed); });
-  const disk = await loadConfig();
-  if (disk) {
-    await syncAccountsFromDisk(disk, config, accountManager);      // add / token-refresh / enable / priority
-    reconcileRemovedAccounts(disk, config, accountManager);        // removal (group shrink)
-  }
+  // Reconcile through the shared serialized chain so a concurrent /reload can't interleave.
+  await applyDiskToFleet(config, accountManager);
   return { stop: false };
 }
 
@@ -1603,22 +1641,49 @@ async function ensureCloudSession(config) {
     // detection and loses its push (Codex HIGH). Serialize: all concurrent callers
     // share the SAME in-flight refresh instead of each rotating independently.
     if (!_cloudSessionRefresh) {
-      const rt = cloud.session.refresh_token;
       _cloudSessionRefresh = (async () => {
         try {
-          const s = await cloudRefreshSession(cloud, rt);
+          // #24: the owner session has ONE single-use rotating Supabase refresh token.
+          // A running server + a concurrent CLI can both try to rotate it — one wins,
+          // the other trips reuse detection. Rather than a cross-process FILE LOCK
+          // (whose steal/release edge-cases proved riskier than the rare race — Codex
+          // re-confirmed), RECOVER via freshest-wins: only when THE REFRESH ITSELF
+          // fails (a concurrent process may have already rotated), re-read disk and, if
+          // it holds a fresh DIFFERENT session for the SAME cloud, adopt it. Net: one
+          // rotation lands, the loser adopts it — no cascade, no lock.
+          let s;
+          try {
+            s = await cloudRefreshSession(cloud, cloud.session.refresh_token);
+          } catch (err) {
+            // The refresh failed. Did a concurrent process already rotate + persist a
+            // fresh session? (Scope the recovery to the REFRESH failure only — a
+            // successful refresh whose disk-write later fails must NOT fall in here and
+            // re-adopt the now-consumed old session.)
+            const disk = await loadConfig();
+            const ds = disk?.cloud?.session;
+            const dsExp = (Number(ds?.expires_at) || 0) * 1000;
+            if (disk?.cloud?.url === cloud.url && ds?.access_token
+              && ds.refresh_token && ds.refresh_token !== cloud.session.refresh_token
+              && dsExp && Date.now() + 30_000 < dsExp) {
+              cloud.session = ds; // a concurrent process already refreshed — adopt theirs
+              return ds;
+            }
+            throw err; // genuinely couldn't refresh (and nobody else did)
+          }
+          // Refresh succeeded → the new session is authoritative. Persisting it is
+          // best-effort: a disk-write failure must not discard the valid in-memory
+          // session (returning it keeps this process working; it re-persists next time).
           cloud.session = s;
-          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; });
+          await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), session: s }; })
+            .catch((e) => console.error(`[TeamClaude] Failed to persist refreshed cloud session: ${e.message}`));
           return s;
         } finally {
           _cloudSessionRefresh = null;
         }
       })();
     }
-    // NOTE: concurrent refreshes WITHIN this process share the single in-flight
-    // promise above (one rotation). Cross-PROCESS coordination is intentionally not
-    // done here — the codebase assumes a single proxy per config (see
-    // atomicConfigUpdate's documented cross-process limitation).
+    // Concurrent refreshes WITHIN this process share the single in-flight promise;
+    // the freshest-wins re-read above absorbs a cross-PROCESS rotation race.
     await _cloudSessionRefresh;
   }
   // If the session is (still) expired and cannot be refreshed — a Google/SSO token

package/src/server.js

@@ -345,6 +345,22 @@ export function createProxyServer(accountManager, config, hooks = {}) {
         return;
       }
 
+      // Reload endpoint — a local CLI edit (enable/disable/remove/priority) POSTs here
+      // so the change applies to the running server IMMEDIATELY instead of waiting for
+      // the next cloud-sync tick. Localhost-only (it mutates live rotation state).
+      if (req.method === 'POST' && req.url === '/teamclaude/reload') {
+        if (!isLocal) { res.writeHead(403, { 'Content-Type': 'application/json' }); res.end('{"error":"localhost only"}'); return; }
+        try {
+          const r = (await hooks.onReload?.()) || { reloaded: 0 };
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, ...r }));
+        } catch (e) {
+          res.writeHead(500, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: String(e?.message || e) }));
+        }
+        return;
+      }
+
       // Everything below buffers a request body (the OAuth relay AND the proxied
       // path) → global admission control to bound proxy memory: inFlightProxied
       // may not exceed the fleet's useful capacity (sum of per-account caps +
@@ -1240,7 +1256,7 @@ function computeRetryAfter(accounts, threshold = 0.98) {
     if (acct.enabled === false || acct.status === 'error') continue;
     // freeAt = max(throttle, every over-threshold quota reset). The account is
     // blocked until the LAST of these clears; taking the min across accounts
-    // then gives the soonest the fleet has anything to serve.
+    // then gives the soonest the fleet will have capacity to serve.
     let freeAt = 0;
     if (acct.rateLimitedUntil) freeAt = Math.max(freeAt, new Date(acct.rateLimitedUntil).getTime());
     const q = acct.quota || {};