teamclaude-cloud 1.6.0 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -61,6 +61,11 @@ export class AccountManager {
       // means "no preference" — selection then falls back to use-or-lose. So a
       // config with no priorities behaves exactly as before.
       priority: Number.isFinite(acct.priority) ? Math.floor(acct.priority) : null,
+      // Provenance: an account that belongs to a personal (private) cloud group
+      // carries cloudPrivate (set by mergePulledAccounts from the pull response's
+      // `personal` flag). Surfaced so the dashboard/status can label it "private"
+      // vs a shared/fleet account.
+      isPrivate: acct.cloudPrivate === true,
       quota: emptyQuota(),
       usage: {
         totalInputTokens: 0,
@@ -1054,6 +1059,7 @@ export class AccountManager {
       status: 'active',
       enabled: acctData.enabled !== false,
       priority: Number.isFinite(acctData.priority) ? Math.floor(acctData.priority) : null,
+      isPrivate: acctData.cloudPrivate === true,
       quota: emptyQuota(),
       usage: { totalInputTokens: 0, totalOutputTokens: 0, totalRequests: 0, lastUsed: null },
       rateLimitedUntil: null,
@@ -1210,9 +1216,12 @@ export class AccountManager {
   importQuotaState(saved) {
     for (const s of Array.isArray(saved) ? saved : []) {
       if (!s || typeof s !== 'object') continue;
+      // Identity match: UUID-bearing snapshot → UUID only; UUID-less → legacy-only
+      // name (a UUID-less snapshot can't restore its quota onto a different
+      // same-name account that owns a UUID).
       const a = s.accountUuid
         ? this.accounts.find(x => x.accountUuid === s.accountUuid)
-        : this.accounts.find(x => x.name === s.name);
+        : this.accounts.find(x => !x.accountUuid && x.name === s.name);
       if (!a) continue;
       if (s.quota && typeof s.quota === 'object') {
         // Merge over emptyQuota so a cache written by an older version (missing
@@ -1251,6 +1260,7 @@ export class AccountManager {
         type: a.type,
         status: a.status,
         enabled: a.enabled !== false,
+        isPrivate: a.isPrivate === true,
         priority: a.priority ?? null,
         // Deep-copy the nested modelWeekly map — the shallow quota spread would
         // otherwise hand callers a live reference into account state.

package/src/cloud.js

@@ -593,6 +593,14 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
     if (Number.isInteger(incoming.priority)) target.priority = incoming.priority;
     else delete target.priority; // null → automatic ordering
   };
+  // Personal-group (private) display flag from the pull response. Authoritative when
+  // the server sends `personal` (a pull can move an account in/out of a personal
+  // group); left untouched on a pre-personal server response so it isn't wiped.
+  const applyPrivate = (target, incoming) => {
+    if (!('personal' in incoming)) return;
+    if (incoming.personal === true) target.cloudPrivate = true;
+    else delete target.cloudPrivate;
+  };
   // Multi-source tagging: an account can be managed by several keys (a consumer
   // using >1 key whose groups overlap). Each key adds its source; an account is
   // only pruned once NO managing key still allows it (Codex round 4 R4-3).
@@ -624,6 +632,7 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
       applyOverlay(fresh); // honor an offline local-disable that survived a prune+re-add
       addSource(fresh);
       applyPriority(fresh, a);
+      applyPrivate(fresh, a);
       config.accounts.push(fresh);
       summary.added++;
       continue;
@@ -638,9 +647,9 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
     addSource(cur); // now managed by this key (so this key can prune it later)
     // A payload entry with no token at all (allowed-but-tokenless) must not clobber
     // a valid local token — only apply priority/metadata, keep the local token.
-    if (!hasAnyToken(a)) { applyPriority(cur, a); summary.skipped++; continue; }
+    if (!hasAnyToken(a)) { applyPriority(cur, a); applyPrivate(cur, a); summary.skipped++; continue; }
     const curExp = normalizeExpiresAt(cur.expiresAt) || 0;
-    if (curExp > incomingExp) { applyPriority(cur, a); summary.skipped++; continue; } // local token fresher — keep it
+    if (curExp > incomingExp) { applyPriority(cur, a); applyPrivate(cur, a); summary.skipped++; continue; } // local token fresher — keep it
     config.accounts[idx] = {
       ...cur,
       accountUuid: a.accountUuid || cur.accountUuid,
@@ -654,6 +663,7 @@ export function mergePulledAccounts(config, pulled, source = null, allowed = nul
     };
     applyOverlay(config.accounts[idx]); // re-assert overlay on the rebuilt row
     applyPriority(config.accounts[idx], a);
+    applyPrivate(config.accounts[idx], a);
     summary.updated++;
   }
   // Prune: only when the server sent an authoritative allow-set (`allowed`). Never

package/src/config.js

@@ -63,6 +63,48 @@ export function writeQuotaCacheSync(data) {
   } catch { /* best-effort — a failed snapshot must never break the proxy */ }
 }
 
+/**
+ * Find the index of a config account matching `account`. Returns -1 when none match.
+ *
+ * Identity rules (the sync/dedup key used across the proxy):
+ *  - A record that HAS an accountUuid matches ONLY by that UUID. It does NOT fall
+ *    back to a name match, because two genuinely distinct accounts can share a
+ *    display name — a name fallback there would cross-apply one account's token /
+ *    enabled / priority / cloudSources (an access-control tag) onto the other.
+ *    If a UUID-bearing record's UUID isn't present, it's a new/different account.
+ *  - Name is the fallback identity ONLY for legacy records that carry no UUID.
+ *
+ * Written as explicit numeric branches on purpose: an inline
+ * `account.accountUuid && findIndex(...)` yields `false` for a UUID-less account,
+ * and `false >= 0` is `true` in JS — which would misattribute the match to index 0.
+ */
+export function findAccountIndex(accounts, account) {
+  if (account.accountUuid) {
+    const byUuid = accounts.findIndex(a => a.accountUuid === account.accountUuid);
+    if (byUuid >= 0) return byUuid;
+  }
+  // Legacy-only name fallback (both for a UUID-less incoming record and for a
+  // UUID-bearing one whose UUID isn't present yet). It matches ONLY a UUID-LESS
+  // same-name entry (`!a.accountUuid`):
+  //  - UUID-bearing incoming → this is a legacy UPGRADE (the same account named "X"
+  //    gaining a UUID via re-import); we adopt the existing legacy entry in place
+  //    instead of appending a duplicate that shares one credential.
+  //  - It never matches a DIFFERENT-UUID same-name entry (that entry owns a UUID),
+  //    so two distinct accounts sharing a display name can't cross-apply
+  //    token / enabled / priority / cloudSources.
+  return accounts.findIndex(a => !a.accountUuid && a.name === account.name);
+}
+
+export function findConfigAccount(config, account) {
+  return findAccountIndex(config.accounts, account);
+}
+
+// Object-returning variant for call sites that want the entry, not its index.
+export function findAccount(accounts, account) {
+  const i = findAccountIndex(accounts, account);
+  return i >= 0 ? accounts[i] : null;
+}
+
 export function createDefaultConfig() {
   return {
     proxy: {

package/src/index.js

@@ -3,7 +3,7 @@
 import { spawnSync } from 'node:child_process';
 import { unlinkSync, readFileSync, writeFileSync } from 'node:fs';
 import { createInterface } from 'node:readline';
-import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, getServerStatePath, writeServerState, readServerState, clearServerState, readQuotaCache, writeQuotaCacheSync } from './config.js';
+import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, getServerStatePath, writeServerState, readServerState, clearServerState, readQuotaCache, writeQuotaCacheSync, findConfigAccount, findAccount, findAccountIndex } from './config.js';
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
@@ -183,6 +183,10 @@ async function serverCommand() {
     // initialized before this ever runs: the snapshot writers are registered
     // inside the listen callback.)
     probeTemplate: server.exportProbeTemplate?.() ?? null,
+    // The Fable-window (model-weekly) probe shape, persisted separately so R and
+    // the top-up can refresh the Fable limit right after a restart — even once a
+    // low-tier request has replaced the general template above.
+    modelWeeklyTemplate: server.exportModelWeeklyTemplate?.() ?? null,
   });
 
   // Persist refreshed tokens back to config (re-read from disk to avoid clobbering
@@ -268,19 +272,18 @@ async function serverCommand() {
           // Match the live account by IDENTITY — never by array index:
           // resolveAccounts() can skip a tokenless/bad config entry, so
           // config.accounts and accountManager.accounts are not index-aligned, and
-          // an index map would overlay the wrong account's credentials. Two-phase
-          // (UUID first, then name): a single `uuid===x || name===x` find could
-          // return an earlier same-name account before reaching the real UUID match.
-          const am = (a.accountUuid && accountManager.accounts.find(x => x.accountUuid === a.accountUuid))
-            || accountManager.accounts.find(x => x.name === a.name);
+          // an index map would overlay the wrong account's credentials. Identity
+          // match: UUID-bearing → UUID only; UUID-less → legacy-only name (so a
+          // UUID-bearing record whose UUID isn't live can't name-hijack a different
+          // same-name account and cross-apply its credentials).
+          const am = findAccount(accountManager.accounts, a);
           const live = am ? {
             ...a,
             accessToken: am.credential,
             refreshToken: am.refreshToken,
             expiresAt: am.expiresAt,
           } : a;
-          const diskAcct = (a.accountUuid && diskConfig.accounts.find(d => d.accountUuid === a.accountUuid))
-            || diskConfig.accounts.find(d => d.name === a.name);
+          const diskAcct = findAccount(diskConfig.accounts, a);
           return diskAcct ? { ...diskAcct, ...live } : live;
         });
         // The TUI's in-memory config is authoritative for the account SET (an
@@ -325,8 +328,7 @@ async function serverCommand() {
       cloudPush: config.cloud ? (async () => {
         // Use the running server's LIVE tokens (freshest) for each account.
         const accounts = (config.accounts || []).filter(a => a.type !== 'apikey').map(a => {
-          const am = (a.accountUuid && accountManager.accounts.find(x => x.accountUuid === a.accountUuid))
-            || accountManager.accounts.find(x => x.name === a.name);
+          const am = findAccount(accountManager.accounts, a);
           return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
         });
         if (!accounts.length) throw new Error('No OAuth accounts to push');
@@ -387,6 +389,12 @@ async function serverCommand() {
   if (quotaCache?.probeTemplate && server.importProbeTemplate?.(quotaCache.probeTemplate)) {
     console.log('[TeamClaude] Restored warm-up probe template');
   }
+  // Restore the Fable-window probe shape too, so R / the top-up can refresh the
+  // Fable limit on a freshly restarted idle proxy without waiting for fresh
+  // Fable traffic to re-seed it.
+  if (quotaCache?.modelWeeklyTemplate && server.importModelWeeklyTemplate?.(quotaCache.modelWeeklyTemplate)) {
+    console.log('[TeamClaude] Restored Fable-window probe template');
+  }
   // Catch bind-time errors (e.g. EADDRINUSE) only. Once the socket is bound we
   // remove this handler so a later runtime 'error' isn't misreported as a
   // listen failure and exit the whole proxy.
@@ -884,7 +892,8 @@ async function statusCommand() {
       const current = acct.name === data.currentAccount ? ' *' : '';
 
       const disabledTag = acct.enabled === false ? ' [disabled]' : '';
-      console.log(`  ${maskIf(acct.name, config.maskMode)} (${acct.type})${current}${disabledTag}`);
+      const privateTag = acct.isPrivate ? ' [private]' : '';
+      console.log(`  ${maskIf(acct.name, config.maskMode)} (${acct.type})${current}${privateTag}${disabledTag}`);
       console.log(`    Status:   ${acct.status}${acct.enabled === false ? ' (disabled — out of rotation)' : ''}`);
       if (acct.priority != null) console.log(`    Priority: ${acct.priority} (lower = preferred)`);
       if (acct.maxConcurrent != null) {
@@ -1272,11 +1281,10 @@ async function upsertOAuthAccount(config, name, creds, source = 'unknown') {
     expiresAt: creds.expiresAt,
   };
 
-  // Deduplicate: match by UUID first, then by name
-  let idx = profile?.accountUuid
-    ? config.accounts.findIndex(a => a.accountUuid === profile.accountUuid)
-    : -1;
-  if (idx < 0) idx = config.accounts.findIndex(a => a.name === name);
+  // Deduplicate by identity: UUID-bearing → UUID only; UUID-less → legacy-only name
+  // (a UUID-bearing profile whose UUID isn't present is a NEW account, not a
+  // same-name hijack). Same contract as the TUI import path.
+  const idx = findAccountIndex(config.accounts, { accountUuid: profile?.accountUuid, name });
 
   if (idx >= 0) {
     // Re-credentialing an existing account must not wipe its manual routing
@@ -1296,17 +1304,7 @@ async function upsertOAuthAccount(config, name, creds, source = 'unknown') {
 }
 
 // ── config sync helpers ─────────────────────────────────────
-
-/**
- * Find a config account entry matching an in-memory account (by UUID, then name).
- */
-function findConfigAccount(diskConfig, account) {
-  if (account.accountUuid) {
-    const idx = diskConfig.accounts.findIndex(a => a.accountUuid === account.accountUuid);
-    if (idx >= 0) return idx;
-  }
-  return diskConfig.accounts.findIndex(a => a.name === account.name);
-}
+// findConfigAccount lives in config.js (pure + unit-tested for the UUID-less case).
 
 /**
  * Sync accounts from disk config: add new accounts and refresh credentials
@@ -1316,10 +1314,11 @@ function findConfigAccount(diskConfig, account) {
 async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
   let added = 0;
   for (const diskAcct of diskConfig.accounts) {
-    const matchByUuid = diskAcct.accountUuid &&
-      memConfig.accounts.findIndex(a => a.accountUuid === diskAcct.accountUuid);
-    const matchByName = memConfig.accounts.findIndex(a => a.name === diskAcct.name);
-    const memIdx = (matchByUuid >= 0 ? matchByUuid : null) ?? (matchByName >= 0 ? matchByName : -1);
+    // Match the disk entry to an in-memory account (UUID-bearing → UUID only;
+    // UUID-less → name). The previous inline form let `false >= 0` misattribute a
+    // UUID-less disk entry to in-memory index 0 — corrupting enabled/priority/
+    // cloudSources on the wrong account.
+    const memIdx = findConfigAccount(memConfig, diskAcct);
 
     if (memIdx < 0) {
       // New account discovered on disk — add to running server
@@ -1330,11 +1329,14 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
       continue;
     }
 
-    // Find the corresponding AccountManager entry — UUID first, then name, so a
-    // disk entry whose UUID and name resolve to *different* live accounts can't
-    // misattribute the update to the name-match when a UUID-match exists.
-    const mgr = (diskAcct.accountUuid && accountManager.accounts.find(a => a.accountUuid === diskAcct.accountUuid))
-      || accountManager.accounts.find(a => a.name === diskAcct.name);
+    // Resolve the live AccountManager entry with the SAME identity contract as
+    // findConfigAccount above (UUID-bearing → UUID only; UUID-less → name). Using
+    // one helper for both keeps mgr and memIdx from diverging onto *different*
+    // accounts — otherwise a disk entry {uuid:B,name:X} whose UUID isn't live yet
+    // would let memIdx pick config-B while mgr name-matched live-A, cross-applying
+    // B's token / enabled / priority / cloudSources (an access-control tag) onto A.
+    const mgrIdx = findConfigAccount({ accounts: accountManager.accounts }, diskAcct);
+    const mgr = mgrIdx >= 0 ? accountManager.accounts[mgrIdx] : undefined;
 
     // Apply enable/disable + priority from disk FIRST — independent of credential
     // re-resolution below. A failed re-import (freshCred null) must NOT strand a
@@ -1345,6 +1347,9 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
       if (mgr.enabled !== wantEnabled) accountManager.setEnabled(mgr, wantEnabled);
       const diskPriority = Number.isFinite(diskAcct.priority) ? Math.floor(diskAcct.priority) : null;
       if (mgr.priority !== diskPriority) accountManager.setPriority(mgr, diskPriority);
+      // Provenance can change while running (a cloud pull moves an account in/out of
+      // a personal group), so refresh the private flag on reload too.
+      mgr.isPrivate = diskAcct.cloudPrivate === true;
       // Mirror the applied state into the in-memory config copy too. Otherwise a
       // later TUI saveConfig (for any unrelated op) would spread the pre-sync
       // enabled/priority over the disk value and silently revert a CLI change.
@@ -1352,6 +1357,20 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
       if (memAcct) {
         if (wantEnabled) delete memAcct.enabled; else memAcct.enabled = false;
         if (diskPriority === null) delete memAcct.priority; else memAcct.priority = diskPriority;
+        // cloudSources (prune scoping) and cloudPrivate (personal-group display) are
+        // both authoritative on disk — a cloud pull tags/untags them. Mirror both, or
+        // a later TUI saveConfig would overlay the stale in-memory value onto disk
+        // and resurrect a source tag / private flag a pull just changed.
+        if (Array.isArray(diskAcct.cloudSources) && diskAcct.cloudSources.length > 0) {
+          memAcct.cloudSources = diskAcct.cloudSources;
+        } else {
+          delete memAcct.cloudSources;
+        }
+        if (diskAcct.cloudPrivate === true) {
+          memAcct.cloudPrivate = true;
+        } else {
+          delete memAcct.cloudPrivate;
+        }
       }
     }
 
@@ -1370,7 +1389,29 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
       freshCred = { apiKey: diskAcct.apiKey };
     }
 
-    if (!freshCred || !mgr) continue;
+    if (!freshCred) continue;
+
+    // In config (memIdx >= 0) but not live: it was skipped at startup as tokenless
+    // and now has a credential on disk. Add it to rotation without waiting for a
+    // restart, merging the freshly-resolved credential (covers the importFrom path
+    // where diskAcct carries no inline token). Mirrors the new-account branch.
+    if (!mgr) {
+      // `mgr` was resolved before the importCredentials() await above, which yields
+      // the event loop — a concurrent reload (TUI R / /teamclaude/reload / cloud
+      // sync) may have already added this account. Re-resolve against the live set
+      // immediately before the SYNCHRONOUS addAccount: the re-check and push run
+      // with no await between them, so at most one sync adds the UUID (no duplicate
+      // that would double effective concurrency/quota for one credential).
+      if (findConfigAccount({ accounts: accountManager.accounts }, diskAcct) < 0) {
+        const creds = freshCred.apiKey
+          ? { apiKey: freshCred.apiKey }
+          : { accessToken: freshCred.accessToken, refreshToken: freshCred.refreshToken, expiresAt: freshCred.expiresAt };
+        accountManager.addAccount({ ...diskAcct, ...creds });
+        added++;
+        console.log(`[TeamClaude] Added now-credentialed account "${diskAcct.name}" to rotation`);
+      }
+      continue;
+    }
 
     if (freshCred.accessToken) {
       const changed = mgr.credential !== freshCred.accessToken ||

package/src/server.js

@@ -58,6 +58,12 @@ export function createProxyServer(accountManager, config, hooks = {}) {
     : 5 * 60 * 1000;
   const WARMUP_PROBE_TIMEOUT_MS = 15_000;
   let probeTemplate = null;   // committed { model, version, beta, system } — only after a 2xx
+  let mwTemplate = null;      // last shape known to elicit the model-weekly (Fable 7d_oi) window,
+                             // kept in a SEPARATE slot so low-tier traffic (which legitimately
+                             // replaces probeTemplate) can't erase the fleet's ability to probe
+                             // the Fable limit. Without this, the first low-tier request after a
+                             // restart downgrades the restored template and R/top-up can no longer
+                             // refresh Fable until fresh Fable traffic happens to flow through.
   let warmupInFlight = false; // guard against overlapping fan-outs
   let warmupClosed = false;   // set on server close: stop scheduling, abort in-flight probes
   const warmupAbort = new AbortController();
@@ -78,7 +84,11 @@ export function createProxyServer(accountManager, config, hooks = {}) {
       model: json.model,
       version: req.headers['anthropic-version'] || '2023-06-01',
       beta: req.headers['anthropic-beta'] || null,
-      system: json.system ?? null,
+      // Sanitize at the single capture point so BOTH the general and the Fable
+      // template store only the canonical OAuth identifier — never the client's
+      // secret-bearing project/CLAUDE.md context. Every probe (warm-up, R,
+      // top-up) then replays a secret-free system to every account.
+      system: sanitizeProbeSystem(json.system ?? null),
     };
   }
 
@@ -94,6 +104,19 @@ export function createProxyServer(accountManager, config, hooks = {}) {
   function commitProbeTemplate(candidate, status, elicitsModelWeekly = false) {
     if (!activeWarmup || warmupClosed) return;
     if (!(status >= 200 && status < 300)) return; // only trust an accepted shape
+    // A shape whose own response carried a model-scoped weekly window is the only
+    // thing that can probe the Fable (7d_oi) limit. Keep it in its own slot,
+    // refreshed from fresh evidence, so the general probeTemplate below can follow
+    // the newest tier (and be replaced by low-tier traffic) WITHOUT losing the
+    // ability to refresh Fable. A restored mwTemplate is simply overwritten by the
+    // next fresh Fable commit; if its model was retired it 4xx's and the per-account
+    // _mwProbes cap retires it (needsModelWeekly), then real Fable traffic re-seeds.
+    // candidate.system is already sanitized (stageProbeTemplate) to the canonical
+    // identifier block only — no client project/CLAUDE.md secret is stored here or
+    // persisted to the snapshot.
+    if (elicitsModelWeekly) {
+      mwTemplate = { model: candidate.model, version: candidate.version, beta: candidate.beta, system: candidate.system };
+    }
     // A template RESTORED from the last run's snapshot is provisional: it let
     // probes work before any traffic, but upstream accepted it in a previous
     // process — the model may have been retired since. The first freshly
@@ -116,6 +139,43 @@ export function createProxyServer(accountManager, config, hooks = {}) {
     return JSON.stringify(b);
   }
 
+  // Build the probe's system WITHOUT persisting or replaying ANY client text.
+  // A captured system may carry tenant secrets — not only in later blocks, but
+  // appended after a valid identifier prefix ("You are Claude Code\nSECRET=…") or
+  // as the whole string. A prefix/first-block match is therefore only a SIGNAL
+  // that this was a Claude-Code OAuth request; when it matches we emit our OWN
+  // fixed canonical identifier constant (proxy-controlled, zero client
+  // characters), else null. This makes leakage impossible by construction: no
+  // client-provided byte is ever stored in the snapshot or sent to another
+  // account. A null (systemless) probe may 4xx → the _mwProbes/_partialProbes
+  // caps retire it; that only means "no probe-measured quota until real traffic",
+  // never a leak. If the canonical constant isn't accepted upstream, warm-up
+  // degrades gracefully to real-traffic measurement (a quality tradeoff, not a
+  // security one — chosen deliberately: no secret may ever cross accounts).
+  const CLAUDE_CODE_SYSTEM_PREFIX = 'You are Claude Code';
+  const CLAUDE_CODE_SYSTEM = "You are Claude Code, Anthropic's official CLI for Claude.";
+  function sanitizeProbeSystem(system) {
+    const looksLikeId = (v) => typeof v === 'string' && v.startsWith(CLAUDE_CODE_SYSTEM_PREFIX);
+    let firstText = null;
+    if (typeof system === 'string') firstText = system;
+    else if (Array.isArray(system) && system.length) {
+      const b0 = system[0];
+      firstText = typeof b0 === 'string' ? b0 : (b0 && typeof b0 === 'object' ? b0.text : null);
+    }
+    return looksLikeId(firstText) ? [{ type: 'text', text: CLAUDE_CODE_SYSTEM }] : null;
+  }
+
+  // The shape to replay when probing the model-weekly (Fable) window: prefer the
+  // live general template if it already elicits the window, else the dedicated
+  // mwTemplate (which survives low-tier template churn and restarts). null when
+  // no Fable-eliciting shape has ever been observed — nothing can probe Fable then.
+  // mwTemplate carries its OWN sanitized system (the canonical identifier block
+  // only — see commitProbeTemplate), so it needs no borrowing: it's both
+  // OAuth-acceptable and secret-free.
+  function modelWeeklyTemplate() {
+    return probeTemplate && probeTemplate._elicitsModelWeekly ? probeTemplate : mwTemplate;
+  }
+
   // A probe fetch is bounded by BOTH a timeout and server-close, so a scheduled or
   // in-flight probe can't keep sending a credentialed request after teardown.
   // Returns { signal, cleanup }: the caller MUST call cleanup() when the probe
@@ -159,8 +219,12 @@ export function createProxyServer(accountManager, config, hooks = {}) {
   //    capacity 429 could not.
   //  - Learns ONLY from a response upstream accepted (2xx) or an account-level
   //    quota 429 ('rejected') — a 4xx / non-exhaustion 429 / 5xx never mutates state.
-  async function warmupAccount(account, { force = false } = {}) {
-    if (!probeTemplate || warmupClosed || account._warming) return;
+  async function warmupAccount(account, { force = false, template = null } = {}) {
+    // `template` overrides the shape to replay (used by the model-weekly top-up /
+    // R Fable pass, which must probe with a Fable-eliciting shape even when the
+    // live general template is a lower tier). Defaults to the general template.
+    const tmpl = template || probeTemplate;
+    if (!tmpl || warmupClosed || account._warming) return;
     // Don't refresh from a background probe; skip an OAuth account that needs one.
     if (account.type === 'oauth' && isTokenExpiringSoon(account.expiresAt)) return;
     // Re-confirm it's still an available, unmeasured, idle candidate — unless
@@ -172,13 +236,13 @@ export function createProxyServer(accountManager, config, hooks = {}) {
     account._warming = true;
     const probe = probeSignal();
     try {
-      const headers = { 'content-type': 'application/json', 'anthropic-version': probeTemplate.version };
-      if (probeTemplate.beta) headers['anthropic-beta'] = probeTemplate.beta;
+      const headers = { 'content-type': 'application/json', 'anthropic-version': tmpl.version };
+      if (tmpl.beta) headers['anthropic-beta'] = tmpl.beta;
       if (account.type === 'oauth') headers['authorization'] = `Bearer ${account.credential}`;
       else headers['x-api-key'] = account.credential;
 
       const res = await fetch(`${upstream}/v1/messages`, {
-        method: 'POST', headers, body: buildProbeBody(probeTemplate), signal: probe.signal,
+        method: 'POST', headers, body: buildProbeBody(tmpl), signal: probe.signal,
       });
       const rl = {};
       for (const [k, v] of res.headers.entries()) {
@@ -227,6 +291,13 @@ export function createProxyServer(accountManager, config, hooks = {}) {
         // permanently even after upstream recovers.
         account._partialProbes = (account._partialProbes || 0) + 1;
         account._lastFruitlessProbeAt = Date.now(); // paces the slow retry backstop
+        // Also cap the model-weekly budget: a Fable-shape probe that 4xx's (e.g. a
+        // restored template whose model was retired → 404) never reaches the
+        // success branch above, so without this `_mwProbes` would never increment
+        // and needsModelWeekly() would re-probe the retired model every interval
+        // forever. A deterministic-fruitless outcome retires the Fable probe too;
+        // a later success (window populated / window swept) resets it.
+        account._mwProbes = (account._mwProbes || 0) + 1;
       }
     } catch (err) {
       // Best-effort: leave the account unmeasured (exactly as before warm-up).
@@ -270,9 +341,22 @@ export function createProxyServer(accountManager, config, hooks = {}) {
     // Renew both probe budgets — R is an explicit "measure everything now".
     for (const a of alive) { a._partialProbes = 0; a._mwProbes = 0; }
     const outcomes = await Promise.all(alive.map(a => warmupAccount(a, { force: true })));
+    // Fable pass: if the live general template can't elicit the model-weekly
+    // window but a shape that can survives (mwTemplate — possibly from before a
+    // restart + low-tier churn), probe the accounts still missing the window with
+    // it. This closes the "R refreshes everything except the Fable limit" gap.
+    // When the general template already elicits Fable, the pass above did it, so
+    // modelWeeklyTemplate() returns probeTemplate and this branch is skipped.
+    const mw = modelWeeklyTemplate();
+    if (mw && !(probeTemplate && probeTemplate._elicitsModelWeekly)) {
+      const mwTargets = alive.filter(a =>
+        a.type === 'oauth' && !a._warming && Object.keys(a.quota.modelWeekly).length === 0);
+      await Promise.all(mwTargets.map(a => warmupAccount(a, { force: true, template: mw })));
+    }
     // Honest accounting: `targets` is what the user asked to refresh, `measured`
     // is what actually got fresh data — the TUI reports M/N, never a blanket
-    // "refreshed N" while probes silently skipped or failed.
+    // "refreshed N" while probes silently skipped or failed. (The supplemental
+    // Fable pass only fills a secondary window; it doesn't change these counts.)
     return { targets: targets.length, measured: outcomes.filter(Boolean).length };
   }
 
@@ -285,12 +369,17 @@ export function createProxyServer(accountManager, config, hooks = {}) {
   // that exact account is idle. Force-probes so the fully-measured guard doesn't
   // exclude them; still skips in-flight/disabled/error accounts.
   async function topUpModelWeekly() {
-    if (!activeWarmup || warmupClosed || !probeTemplate || !probeTemplate._elicitsModelWeekly) return;
+    if (!activeWarmup || warmupClosed) return;
+    // Probe with a Fable-eliciting shape: the general template if it is one, else
+    // the dedicated mwTemplate — so the top-up keeps working even after low-tier
+    // traffic has replaced the general template (the common post-restart case).
+    const mw = modelWeeklyTemplate();
+    if (!mw) return;
     const targets = accountManager.accounts.filter(a =>
       a.enabled !== false && a.status !== 'error' && a.inflight === 0 && !a._warming
       && accountManager.needsModelWeekly(a));
     if (!targets.length) return;
-    await Promise.all(targets.map(a => warmupAccount(a, { force: true })));
+    await Promise.all(targets.map(a => warmupAccount(a, { force: true, template: mw })));
   }
 
   // Probe every currently-unmeasured idle account in parallel. Guarded so two
@@ -511,13 +600,35 @@ export function createProxyServer(accountManager, config, hooks = {}) {
       model: t.model,
       version: typeof t.version === 'string' && t.version ? t.version : '2023-06-01',
       beta: typeof t.beta === 'string' && t.beta ? t.beta : null,
-      system: t.system ?? null,
+      // Re-sanitize on restore (defence in depth: a snapshot from an older build
+      // could hold a full, secret-bearing system).
+      system: sanitizeProbeSystem(t.system),
       _elicitsModelWeekly: t._elicitsModelWeekly === true,
       _restored: true,
     };
     return true;
   };
 
+  // The Fable-window template is persisted separately so that after a restart the
+  // fleet can refresh Fable via R / top-up even before fresh Fable traffic flows
+  // (and even once a low-tier request replaces the general probeTemplate). It has
+  // no _restored/_elicits flags: it is always a Fable-eliciting shape, and the
+  // next fresh Fable commit overwrites it.
+  server.exportModelWeeklyTemplate = () => (mwTemplate ? { ...mwTemplate } : null);
+  server.importModelWeeklyTemplate = (t) => {
+    if (!activeWarmup || warmupClosed || mwTemplate) return false;
+    if (!t || typeof t !== 'object' || typeof t.model !== 'string' || !t.model) return false;
+    mwTemplate = {
+      model: t.model,
+      version: typeof t.version === 'string' && t.version ? t.version : '2023-06-01',
+      beta: typeof t.beta === 'string' && t.beta ? t.beta : null,
+      // Re-sanitize on restore (defence in depth: a snapshot from an older build
+      // could hold a full system). Only the canonical identifier block survives.
+      system: sanitizeProbeSystem(t.system),
+    };
+    return true;
+  };
+
   return server;
 }
 

package/src/tui.js

@@ -1,5 +1,6 @@
 import { importCredentials, fetchProfile } from './oauth.js';
 import { maskIf, maskEmailsIn } from './mask.js';
+import { findAccount, findAccountIndex } from './config.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -463,11 +464,10 @@ export class TUI {
         expiresAt: creds.expiresAt,
       };
 
-      // Deduplicate: match by UUID first, then by name
-      let idx = profile?.accountUuid
-        ? this.config.accounts.findIndex(a => a.accountUuid === profile.accountUuid)
-        : -1;
-      if (idx < 0) idx = this.config.accounts.findIndex(a => a.name === name);
+      // Deduplicate by identity: UUID-bearing → UUID only; UUID-less → legacy-only
+      // name (a UUID-bearing profile whose UUID isn't present is a NEW account, not
+      // a same-name hijack).
+      const idx = findAccountIndex(this.config.accounts, { accountUuid: profile?.accountUuid, name });
 
       if (idx >= 0) {
         // Preserve manual routing settings across a re-import (the new entry
@@ -482,8 +482,7 @@ export class TUI {
         // which can point at a different live account when a tokenless config entry
         // was skipped at load (config.accounts is not index-aligned with
         // accountManager.accounts).
-        const amAcct = (prev.accountUuid && this.am.accounts.find(a => a.accountUuid === prev.accountUuid))
-          || this.am.accounts.find(a => a.name === prev.name);
+        const amAcct = findAccount(this.am.accounts, prev);
         if (amAcct) {
           amAcct.credential = creds.accessToken;
           amAcct.refreshToken = creds.refreshToken;
@@ -531,10 +530,9 @@ export class TUI {
     // Splice the config entry by IDENTITY, not by the AccountManager index —
     // config.accounts can hold more entries than AccountManager (tokenless accounts
     // are skipped at load), so the AM index may delete a different config entry.
-    // Two-phase (UUID first, then name): a single `uuid===c || name===c` predicate
-    // could match an earlier same-name entry before the real UUID match.
-    let cfgIdx = uuid ? this.config.accounts.findIndex(c => c.accountUuid === uuid) : -1;
-    if (cfgIdx < 0) cfgIdx = this.config.accounts.findIndex(c => c.name === name);
+    // Identity match (UUID-bearing → UUID only; UUID-less → legacy-only name) so a
+    // remove can't splice out a different same-name account.
+    const cfgIdx = findAccountIndex(this.config.accounts, { accountUuid: uuid, name });
     if (cfgIdx >= 0) this.config.accounts.splice(cfgIdx, 1);
     // Drop a cursor anchor that pointed at the removed account; _selected()
     // falls back to the remembered position on the next keypress/render.
@@ -555,10 +553,9 @@ export class TUI {
     // 1:1 onto config.accounts. Matching by UUID/name avoids corrupting a
     // different config entry.
     this.am.setEnabled(amAcct, newEnabled);
-    // Match the config entry UUID-first, then name — an OR match could persist the
-    // flag onto the wrong entry when a UUID and a name resolve to different accounts.
-    const cfg = (amAcct.accountUuid && this.config.accounts.find(a => a.accountUuid === amAcct.accountUuid))
-      || this.config.accounts.find(a => a.name === amAcct.name);
+    // Match the config entry by identity (UUID-bearing → UUID only; UUID-less →
+    // legacy-only name) so the flag can't persist onto a different same-name entry.
+    const cfg = findAccount(this.config.accounts, amAcct);
     if (cfg) cfg.enabled = newEnabled;
     await this.saveConfig(this.config);
     // Maintain the offline local-disable overlay (cloud.localDisabled, by uuid) at the
@@ -658,8 +655,7 @@ export class TUI {
       // display index may not map 1:1 onto config.accounts. Write `null` (not a
       // deleted key) to clear, so the saveConfig `{...diskAcct, ...live}` merge
       // can't let a stale disk priority survive.
-      const cfg = (a.accountUuid && this.config.accounts.find(c => c.accountUuid === a.accountUuid))
-        || this.config.accounts.find(c => c.name === a.name);
+      const cfg = findAccount(this.config.accounts, a);
       if (cfg) cfg.priority = want;
     }
     // Persist via the coalescing saver: rapid ↑/↓ presses mutate synchronously but
@@ -865,6 +861,10 @@ export class TUI {
       // badges stay column-aligned across mixed account types.
       line += l3 ? `  ${l3} ${bar(r3, bw, t3)}` : ' '.repeat(6 + bw);
     }
+    // Provenance badge: an account in a personal (private) cloud group is tagged
+    // "private" so it's distinguishable from a shared/fleet account. Appended (like
+    // the rank badge) so it never disrupts the fixed-width columns / quota bars.
+    if (a.isPrivate) line += `  ${cyan('private')}`;
     // Order badge: ranked accounts show their 1-based position (#1 = most
     // preferred). While ordering, unranked accounts are labelled "auto" so the
     // two groups (pinned order vs use-or-lose) are visible. Appended last so it