teamclaude-cloud 1.8.0 → 1.9.0

package/src/index.js

@@ -6,8 +6,8 @@ import { createInterface } from 'node:readline';
 import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, getServerStatePath, writeServerState, readServerState, clearServerState, readQuotaCache, writeQuotaCacheSync, findConfigAccount, findAccount, findAccountIndex } from './config.js';
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
-import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
-import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudRefreshToken, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, keySource, reconcileRemovedAccounts } from './cloud.js';
+import { importCredentials, loginOAuth, fetchProfile, isTokenExpiringSoon, normalizeExpiresAt } from './oauth.js';
+import { cloudLogin, cloudValidateOwner, cloudRefreshSession, cloudPush, cloudPushUsage, cloudReportUsage, cloudPull, cloudReportToken, cloudKeyCreate, cloudKeyList, cloudKeyRevoke, cloudKeyMove, cloudGroupList, cloudGroupCreate, cloudGroupRename, cloudGroupDelete, cloudGroupSetAccounts, cloudAccountSetEnabled, buildUsageFromQuota, mergePulledAccounts, resolveCloud, DEFAULT_CLOUD, isDefaultCloudUrl, keySource, reconcileRemovedAccounts, createCloudRefreshHandler, isCloudManaged } from './cloud.js';
 import { TUI } from './tui.js';
 import { maskIf, maskEmail, maskEmailsIn } from './mask.js';
 
@@ -191,7 +191,7 @@ async function serverCommand() {
 
   // Persist refreshed tokens back to config (re-read from disk to avoid clobbering
   // accounts added externally, e.g. by `teamclaude import` while server is running)
-  accountManager.onTokenRefresh((idx, newTokens) => {
+  accountManager.onTokenRefresh((idx, newTokens, parentRefreshToken) => {
     const account = accountManager.accounts[idx];
     if (!account) return;
     // Keep the in-memory config.accounts in sync so a TUI saveConfig doesn't
@@ -204,7 +204,7 @@ async function serverCommand() {
       config.accounts[memIdx].refreshToken = newTokens.refreshToken;
       config.accounts[memIdx].expiresAt = newTokens.expiresAt;
     }
-    atomicConfigUpdate(diskConfig => {
+    const persist = atomicConfigUpdate(diskConfig => {
       // Persist ONLY the refreshed account's tokens. We deliberately do NOT ingest
       // disk-only accounts here: that loop existed to keep the old INDEX-based
       // matching aligned, but matching is identity-based now (findConfigAccount),
@@ -214,9 +214,34 @@ async function serverCommand() {
       // Match by UUID first, then by name — index may have shifted.
       const cfgIdx = findConfigAccount(diskConfig, account);
       if (cfgIdx >= 0) {
-        diskConfig.accounts[cfgIdx].accessToken = newTokens.accessToken;
-        diskConfig.accounts[cfgIdx].refreshToken = newTokens.refreshToken;
-        diskConfig.accounts[cfgIdx].expiresAt = newTokens.expiresAt;
+        // Freshest-wins: don't clobber a fresher token already on disk (a delayed T1
+        // callback after a concurrent pull/central refresh wrote a newer T2). Write when:
+        //   • the token differs from disk (skip identical — no-op), AND
+        //   • EITHER the disk still holds the exact PARENT we just rotated away
+        //     (supersedesParent → our token is unambiguously newer, even at an equal expiry
+        //     second — Anthropic invalidated that parent when newTokens was issued; this
+        //     fixes a same-second sequential refresh: proactive T1 → 401-forced T2 within
+        //     one expiry second leaving the invalid T1 on disk),
+        //   • OR disk is not fresher-or-equal by expiry (the cross-process freshest-wins).
+        // The remaining ambiguous case (equal expiry, DIFFERENT token that is NOT our parent)
+        // is a concurrent write we keep — and it's benign anyway: a cloud-managed account
+        // refreshes via the CLOUD (never the local refreshToken), and a non-cloud account is
+        // single-PC so it has no such concurrent write.
+        // NORMALIZE both before comparing — OAuth endpoints return seconds (~1.7e9), Claude Code
+        // credentials use milliseconds (~1.7e12). A raw compare makes a genuinely NEWER disk
+        // token stored in seconds look older than an ms value and get clobbered (restoring an
+        // invalidated refresh chain). See CLAUDE.md "expiresAt may arrive in seconds or ms".
+        const diskExp = normalizeExpiresAt(diskConfig.accounts[cfgIdx].expiresAt);
+        const newExp = normalizeExpiresAt(newTokens.expiresAt);
+        const diskTok = diskConfig.accounts[cfgIdx].refreshToken;
+        const sameToken = diskTok === newTokens.refreshToken;
+        const supersedesParent = parentRefreshToken && diskTok === parentRefreshToken;
+        const diskIsFresher = diskExp && newExp && diskExp >= newExp;
+        if (!sameToken && (supersedesParent || !diskIsFresher)) {
+          diskConfig.accounts[cfgIdx].accessToken = newTokens.accessToken;
+          diskConfig.accounts[cfgIdx].refreshToken = newTokens.refreshToken;
+          diskConfig.accounts[cfgIdx].expiresAt = newTokens.expiresAt;
+        }
       }
     }).catch(err => console.error(`[TeamClaude] Failed to save refreshed token: ${err.message}`));
     // Admin auto-push: if this machine can push (has a cloud login session), upload
@@ -227,33 +252,25 @@ async function serverCommand() {
     // token valid, so remove/re-add from a group restores a WORKING token, not a
     // stale one. Best-effort: cloud problems never affect the proxy.
     maybePushRefreshedToken(config, account, newTokens);
+    // Return the PERSIST promise so the AccountManager awaits the rotated token reaching disk
+    // before its _refreshPromise resolves. Otherwise a concurrent `cloud push` — whose onReload
+    // drains _refreshPromise, then snapshots refreshPushSnapshot(loadConfig()) — could read the
+    // PRE-rotation token off disk and upload a now-dead chain (invalid_grant for every consumer,
+    // the exact multi-PC poison this file exists to prevent). Already .catch()'d, so it never
+    // rejects the refresh. maybePushRefreshedToken stays fire-and-forget (best-effort).
+    return persist;
   });
 
-  // Cloud-centralized refresh: on a consumer (has a pull key), route token
-  // refreshes through the cloud so the SAME account used from multiple PCs is not
-  // rotated by each PC independently (which invalidates the others). The cloud does
-  // the single rotation; this PC only receives the fresh access token. Falls back
-  // to a local refresh if the cloud is unreachable (availability over strict
-  // single-authority — a brief local rotation is the accepted tradeoff).
-  if (config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY) {
-    accountManager.setRefreshHandler(async (account) => {
-      const cloud = resolveCloud(config);
-      const key = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
-      if (key && account.accountUuid) {
-        try {
-          const t = await cloudRefreshToken(cloud, key, account.accountUuid);
-          return {
-            accessToken: t.accessToken,
-            refreshToken: t.refreshToken || account.refreshToken,
-            expiresAt: t.expiresAt,
-          };
-        } catch (err) {
-          console.error(`[TeamClaude] Cloud refresh failed for "${account.name}", falling back to local: ${err.message}`);
-        }
-      }
-      return refreshAccessToken(account.refreshToken); // local fallback
-    });
-  }
+  // Cloud-centralized refresh: route token refreshes for cloud-managed accounts
+  // through the cloud so the SAME account used from multiple PCs is rotated exactly
+  // ONCE (by the cloud), never independently by each PC (which invalidates the
+  // others). A cloud-managed account is NEVER rotated locally — a local rotation
+  // would poison the token shared across PCs (Anthropic invalidates the previous
+  // refresh token on every rotation). See createCloudRefreshHandler for the full
+  // rationale. Non-cloud (locally-owned) accounts keep the local refresh. Set
+  // unconditionally: the handler internally decides per-account, so a pure-local
+  // install (no cloud config) behaves exactly as the default local refresh.
+  accountManager.setRefreshHandler(createCloudRefreshHandler(config));
 
   const port = config.proxy.port;
   const useTUI = process.stdout.isTTY && process.stdin.isTTY;
@@ -332,10 +349,19 @@ async function serverCommand() {
           return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
         });
         if (!accounts.length) throw new Error('No OAuth accounts to push');
+        const _pushLock = await acquirePushLock(); // serialize with any CLI/TUI push (no concurrent-share race)
+        try {
         // Prefer the AUTH KEY (push to your own tenant, no expiring owner login) —
         // it CREATES + updates accounts. Fall back to an owner session only if no key.
         const fresh = (await loadConfig()) || config;
-        const key = fresh.cloud?.pullKey || config.cloud?.pullKey;
+        // Derive the key ONLY from fresh disk (endpoint-consistent) + the endpoint-bound env key.
+        // NEVER fall back to the live in-memory config.cloud.pullKey: if the endpoint was just
+        // retargeted (e.g. to an attacker URL) its keys are cleared on disk, but the stale live
+        // key would then be POSTed to the NEW `resolveCloud(fresh)` endpoint below — key + token
+        // exfiltration. envAuthKey is default-URL-only, so it can't leak to a custom endpoint.
+        const key = fresh.cloud?.pullKey
+          || (fresh.cloud?.pullKeys && Object.values(fresh.cloud.pullKeys).find(Boolean))
+          || envAuthKey(fresh);
         const usageByUuid = new Map();
         const quotaCache = await readQuotaCache();
         for (const entry of quotaCache?.accounts || []) {
@@ -343,14 +369,61 @@ async function serverCommand() {
           const usage = buildUsageFromQuota(entry);
           if (usage) usageByUuid.set(entry.accountUuid, usage);
         }
-        let cloud, authKey = null;
-        if (key) { cloud = resolveCloud(fresh); authKey = key; }
-        else {
-          cloud = await ensureCloudSession(fresh);
-          if (!cloud?.session?.access_token) throw new Error('No auth key and not logged in — pull once with a key, or run `teamclaude cloud login`');
+        // Require an auth key: an owner-session-only push would mark accounts cloud-shared
+        // with NO key to refresh them → they go permanently unavailable at expiry (see the
+        // CLI cloudPushCommand rationale). Refuse rather than share un-refreshable accounts.
+        if (!key) throw new Error('cloud push에는 auth key가 필요합니다 — 공유 계정은 키가 있어야 갱신됩니다. `teamclaude cloud pull --key <key>` 로 키를 받으세요.');
+        const cloud = resolveCloud(fresh);
+        const authKey = key;
+        // Protect these accounts BEFORE uploading them (mark cloud-shared + propagate to
+        // the live fleet via reload), THEN push — same protect-then-share + CAS-revert-on-
+        // definitive-4xx contract as the CLI `cloud push` path (markAccountsCloudPushed /
+        // unmarkAccountsCloudPushed). Without this a bad-key/rejected push would leave the
+        // (unshared) accounts permanently cloud-managed and unrefreshable.
+        const mark = await markAccountsCloudPushed(config, accounts);
+        // Fail closed if a running proxy could not be protected before sharing (else it
+        // would local-rotate the now-shared token — poison). abortPushIfUnprotected reverts
+        // the marks + logs; throw here so the TUI push action surfaces the failure (can't
+        // process.exit inside the live server).
+        if (await abortPushIfUnprotected(config, mark)) {
+          throw new Error('보호 실패로 푸시 중단 — `teamclaude restart` 후 재시도하세요');
+        }
+        // In-flight-refresh drain: protection above made these accounts cloudManaged so the
+        // proxy starts NO new local rotations — but a rotation that BEGAN just before
+        // protection may still be settling. Await those so the snapshot below can't publish a
+        // T0 the proxy is about to invalidate by rotating to T1 (which would poison the cloud
+        // with T0). In-process only; the CLI path relies on the cloud freshest-wins + the
+        // cloudManaged-gated maybePushRefreshedToken re-push (see known limitation in docs).
+        await Promise.all(accountManager.accounts.map(a => a._refreshPromise).filter(Boolean));
+        // TOCTOU guard: re-read the freshest LIVE tokens AFTER protection + drain. account-
+        // Manager is in-process here, so its credentials are the freshest — no disk-write lag.
+        const pushAccounts = accounts.map(a => {
+          const am = findAccount(accountManager.accounts, a);
+          // Removed from the live fleet (concurrent revocation/removal) → omit, don't
+          // resurrect a revoked account by re-sharing the stale snapshot object.
+          return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : null;
+        }).filter(Boolean);
+        let r;
+        try {
+          r = await cloudPush(cloud, pushAccounts, usageByUuid, authKey);
+        } catch (err) {
+          if (isDefinitivePushRejection(err)) await revertMarksAfterRejection(config, mark, cloud, authKey);
+          throw err;
+        }
+        // Reconcile not-stored skips (key path only — pull needs a key): drop the
+        // cloudPushed mark from any account the key can't actually manage, so it isn't
+        // left falsely cloud-managed and unrefreshable. Keeps staler skips (cloud-stored).
+        if (authKey && mark && mark.pushed?.length) {
+          try {
+            const { accounts: pulledBack } = await cloudPull(cloud, authKey);
+            const confirmed = new Set((pulledBack || []).map(a => a.accountUuid).filter(Boolean));
+            await reconcileCloudPushedMarks(config, mark, confirmed, authKey);
+          } catch { /* transient re-pull failure — keep marks (dominant skip=staler is correct) */ }
         }
-        const r = await cloudPush(cloud, accounts, usageByUuid, authKey);
         return { summary: `${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageByUuid.size ? `, usage ${r.usage ?? 0}` : ''}${authKey ? ' (via auth key)' : ''}` };
+        } finally {
+          releasePushLock(_pushLock);
+        }
       }) : undefined,
     });
     hooks = {
@@ -368,7 +441,76 @@ async function serverCommand() {
   // route BOTH through the one serialized applyDiskToFleet chain (below) so they can't
   // interleave — an older apply must not reconcile a removal while a newer one re-adds
   // from a stale snapshot (Codex HIGH). Each run re-reads disk fresh.
-  hooks.onReload = () => applyDiskToFleet(config, accountManager);
+  // Start the cloud live-sync + recovery timers once cloud config exists. Callable from
+  // startup AND onReload so a server that began PURE-LOCAL (no config.cloud at all) still
+  // starts enforcing revocation after a later `cloud pull --key` adds cloud config —
+  // otherwise it would serve the pulled accounts indefinitely without polling for
+  // revocation (auth-revocation bypass until restart). Idempotent (guard flag).
+  // Manage each timer's lifecycle across reloads WITHOUT one-shot "started" flags (a proxy that
+  // began with an interval of 0 created no timer; a one-shot flag would block a later reload from
+  // ever starting it) — but ALSO without live restart-on-value-change: tearing down and recreating
+  // a running loop leaves the OLD loop's in-flight async tick racing the new one (it can merge
+  // OLD-endpoint results into a retargeted config). So we only START (0→positive) and STOP
+  // (positive→0). An interval VALUE change (e.g. 30s→60s, both positive) applies on the next
+  // restart — it's a tuning knob, not a security boundary; only the →0 opt-out must be live.
+  let _stopCloudSync = null;
+  let _cloudExitHooked = false;
+  let _recoverTimer = null;
+  function ensureCloudTimers() {
+    // Start when there's a cloud config OR an ambient env auth key that authorizes the DEFAULT
+    // endpoint — an env-only deployment (TEAMCLAUDE_AUTH_KEY, no config.cloud) must still
+    // live-sync so key revocation / group changes are polled and enforced. envAuthKey returns
+    // the env key only for the default endpoint (never for a custom URL), so this can't arm the
+    // loop to POST an env key to an attacker endpoint.
+    if (!config.cloud && !envAuthKey(config)) return;
+    const cloudKey = config.cloud?.pullKey
+      || (config.cloud?.pullKeys && Object.values(config.cloud.pullKeys).find(Boolean))
+      || envAuthKey(config); // endpoint-bound: never send the env key to a custom URL
+    const cloudSyncIntervalMs = Number.isFinite(config.cloudSyncIntervalMs)
+      ? Math.max(0, config.cloudSyncIntervalMs) : 30_000;
+    if (cloudSyncIntervalMs > 0 && !_stopCloudSync) {
+      _stopCloudSync = startCloudSyncLoop(config, accountManager, cloudKey, cloudSyncIntervalMs);
+      if (!_cloudExitHooked) { _cloudExitHooked = true; process.on('exit', () => { try { _stopCloudSync?.(); } catch { /* nothing to do on exit */ } }); }
+      console.log(`[TeamClaude] Cloud live-sync every ${Math.round(cloudSyncIntervalMs / 1000)}s (token/group changes + key revocation apply automatically)`);
+    } else if (cloudSyncIntervalMs === 0 && _stopCloudSync) {
+      // Opt-out took effect on a live reload — stop at once (stop() also aborts an in-flight tick).
+      _stopCloudSync();
+      _stopCloudSync = null;
+      console.log('[TeamClaude] Cloud live-sync disabled (cloudSyncIntervalMs=0) — applied to the running server.');
+    }
+    const recoverIntervalMs = Number.isFinite(config.recoverIntervalMs)
+      ? Math.max(0, config.recoverIntervalMs) : 300_000;
+    if (recoverIntervalMs > 0 && !_recoverTimer) {
+      _recoverTimer = setInterval(() => {
+        for (const account of accountManager.accounts) {
+          if (account.status === 'error' && account.type === 'oauth'
+              && (account.cloudManaged === true || isCloudManaged(config, account))) {
+            accountManager.ensureTokenFresh(account, true).catch(() => { /* stays error until the cloud token heals */ });
+          }
+        }
+      }, recoverIntervalMs);
+      _recoverTimer.unref();
+    } else if (recoverIntervalMs === 0 && _recoverTimer) {
+      clearInterval(_recoverTimer); // live opt-out (the recovery re-probe is a plain idempotent timer)
+      _recoverTimer = null;
+    }
+  }
+
+  // Live-reload hook (both TUI and headless): a local CLI edit POSTs /teamclaude/reload
+  // so its change applies to THIS running server immediately. Also (re)start the cloud
+  // timers if the reload just introduced cloud config.
+  hooks.onReload = async () => {
+    const r = await applyDiskToFleet(config, accountManager);
+    ensureCloudTimers();
+    // Drain in-flight token refreshes before responding. A cross-process `cloud push`
+    // (via noteRunningServerReload → this endpoint, which the server awaits) can't await
+    // the proxy's _refreshPromise itself; by waiting it out HERE, the push's post-reload
+    // snapshot reads the ALREADY-rotated token on disk instead of a T0 the proxy is about
+    // to invalidate (push/refresh race). applyDiskToFleet already applied any cloudPushed
+    // protection, so no NEW local rotation starts — this just settles the one in flight.
+    await Promise.all(accountManager.accounts.map(a => a._refreshPromise).filter(Boolean));
+    return r;
+  };
 
   // If a TeamClaude server is already running on this config's port, don't try to
   // bind on top of it — point the user at stop/restart instead of a raw EADDRINUSE.
@@ -415,19 +557,16 @@ async function serverCommand() {
     process.on('exit', saveQuotaSnapshot);
     setInterval(saveQuotaSnapshot, 60_000).unref();
 
-    // Live cloud sync: if this proxy was populated from the cloud (a stored pull
-    // key), keep it in sync with the cloud while running — token/group changes and
-    // key revocation apply automatically, no restart. Polling (zero-dep); cloud
-    // outage is non-blocking (transient errors keep the last-known accounts).
-    const cloudKey = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
-    const cloudSyncIntervalMs = Number.isFinite(config.cloudSyncIntervalMs)
-      ? Math.max(0, config.cloudSyncIntervalMs)
-      : 30_000; // 0 disables
-    if (cloudKey && cloudSyncIntervalMs > 0) {
-      const stopCloudSync = startCloudSyncLoop(config, accountManager, resolveCloud(config), cloudKey, cloudSyncIntervalMs);
-      process.on('exit', () => { try { stopCloudSync(); } catch { /* nothing to do on exit */ } });
-      console.log(`[TeamClaude] Cloud live-sync every ${Math.round(cloudSyncIntervalMs / 1000)}s (token/group changes + key revocation apply automatically)`);
-    }
+    // The auth key that also drives the usage sync below (usage report uses the same key
+    // as pull/refresh). Derive from pullKeys too: if the last-used pullKey was revoked
+    // while OTHER keys remain, cloud.pullKey is cleared but those keys still manage
+    // accounts. The cloud live-sync + revocation-recovery timers themselves are started
+    // by ensureCloudTimers() (defined near onReload) — a single idempotent path so a proxy
+    // that began PURE-LOCAL starts them after a later `cloud pull --key` without a restart.
+    const cloudKey = config.cloud?.pullKey
+      || (config.cloud?.pullKeys && Object.values(config.cloud.pullKeys).find(Boolean))
+      || envAuthKey(config); // endpoint-bound: never send the env key to a custom URL
+    ensureCloudTimers();
 
     // Live usage sync: the proxies that actually USE the accounts report the live
     // 5h/7d/Fable numbers they observe, so the dashboard reflects real-time usage —
@@ -454,11 +593,23 @@ async function serverCommand() {
             if (!Object.keys(usageByUuid).length) return; // nothing measured yet
             const snapshot = JSON.stringify(usageByUuid);
             if (snapshot === lastUsageJson) return; // unchanged since last report — skip
-            if (cloudKey) {
-              await cloudReportUsage(resolveCloud(config), cloudKey, usageByUuid);
+            // Resolve the endpoint AND the key FRESH each tick — NEVER reuse the key captured at
+            // startup. A live `cloud login --url <new>` / `cloud pull --url <new>` retargets
+            // config.cloud (and its endpoint-change handling drops the OLD endpoint's keys), so a
+            // captured key would be POSTed as x-teamclaude-key to the NEW (possibly attacker) URL
+            // — key exfiltration. envAuthKey is endpoint-bound (default URL only), so the derived
+            // key is always valid for the current endpoint.
+            const cloud = resolveCloud(config);
+            const curKey = config.cloud?.pullKey
+              || (config.cloud?.pullKeys && Object.values(config.cloud.pullKeys).find(Boolean))
+              || envAuthKey(config);
+            if (curKey) {
+              await cloudReportUsage(cloud, curKey, usageByUuid);
+            } else if (config.cloud?.session?.access_token) {
+              const s = await ensureCloudSession(config).catch(() => config.cloud);
+              await cloudPushUsage(s, usageByUuid);
             } else {
-              const cloud = await ensureCloudSession(config).catch(() => config.cloud);
-              await cloudPushUsage(cloud, usageByUuid);
+              return; // no credential valid for the current endpoint — nothing to report
             }
             lastUsageJson = snapshot;
           } catch (err) {
@@ -892,7 +1043,7 @@ async function statusCommand() {
       const current = acct.name === data.currentAccount ? ' *' : '';
 
       const disabledTag = acct.enabled === false ? ' [disabled]' : '';
-      const privateTag = acct.isPrivate ? ' [private]' : '';
+      const privateTag = acct.isPrivate ? ' [🔑 private]' : '';
       console.log(`  ${maskIf(acct.name, config.maskMode)} (${acct.type})${current}${privateTag}${disabledTag}`);
       console.log(`    Status:   ${acct.status}${acct.enabled === false ? ' (disabled — out of rotation)' : ''}`);
       if (acct.priority != null) console.log(`    Priority: ${acct.priority} (lower = preferred)`);
@@ -943,22 +1094,59 @@ async function accountsCommand() {
     return;
   }
 
-  // Refresh expired tokens before fetching profiles
-  let configDirty = false;
+  // Refresh expiring tokens before fetching profiles — route through the cloud refresh
+  // handler, NOT a raw local refreshAccessToken(): a cloud-managed (shared) account must
+  // be refreshed via the cloud, never rotated locally, or this command would poison the
+  // token shared across PCs (the exact bug this change prevents). The handler local-
+  // refreshes only non-cloud accounts; a cloud-managed refresh that fails just throws and
+  // is skipped here (fetchProfile then reports the expired-token error) — no rotation.
+  const acctRefresh = createCloudRefreshHandler(config);
+  const refreshed = [];
   await Promise.all(config.accounts.map(async (a) => {
     if (a.type !== 'oauth' || !a.refreshToken) return;
     if (!isTokenExpiringSoon(a.expiresAt)) return;
     try {
-      const newTokens = await refreshAccessToken(a.refreshToken);
-      a.accessToken = newTokens.accessToken;
+      const parentRefreshToken = a.refreshToken; // the token we're rotating away (parent)
+      const newTokens = await acctRefresh(a);
+      a.accessToken = newTokens.accessToken;   // in-memory only, for the profile fetch below
       a.refreshToken = newTokens.refreshToken;
       a.expiresAt = newTokens.expiresAt;
-      configDirty = true;
+      refreshed.push({ account: a, newTokens, parentRefreshToken });
     } catch {
-      // refresh failed — fetchProfile will report the specific error
+      // refresh failed (or cloud-managed + cloud unreachable — deliberately NOT rotated
+      // locally) — fetchProfile will report the specific error
     }
   }));
-  if (configDirty) await saveConfig(config);
+  // Persist ONLY the refreshed accounts' tokens, matched by identity (UUID→name) — never
+  // saveConfig the whole in-memory copy: a concurrent `cloud pull` may have pruned a
+  // revoked account or written a cloudPushed provenance mark, and a full-config overwrite
+  // would resurrect/undo that (→ a later local rotation of a shared token after restart).
+  if (refreshed.length) {
+    await atomicConfigUpdate(diskConfig => {
+      for (const { account, newTokens, parentRefreshToken } of refreshed) {
+        const i = findConfigAccount(diskConfig, account);
+        if (i < 0) continue;
+        // Freshest-wins with the same parent-token exception as the server's onTokenRefresh
+        // persist: skip identical tokens (no-op); overwrite when disk still holds the exact
+        // PARENT we just rotated away (our token is then unambiguously newer even at an equal
+        // expiry second); otherwise keep a disk token that's fresher-or-equal by expiry (a
+        // concurrent `cloud pull`/other PC wrote it). Anthropic invalidates the previous
+        // refresh token on rotation, so writing a staler chain can brick the account.
+        // Normalize both (seconds vs ms) before comparing — else a newer seconds-based disk token
+        // is misread as stale and a staler chain overwrites it (bricking risk). See CLAUDE.md.
+        const diskExp = normalizeExpiresAt(diskConfig.accounts[i].expiresAt);
+        const newExp = normalizeExpiresAt(newTokens.expiresAt);
+        const diskTok = diskConfig.accounts[i].refreshToken;
+        if (diskTok === newTokens.refreshToken) continue; // already identical
+        const supersedesParent = parentRefreshToken && diskTok === parentRefreshToken;
+        const diskIsFresher = diskExp && newExp && diskExp >= newExp;
+        if (!supersedesParent && diskIsFresher) continue;
+        diskConfig.accounts[i].accessToken = newTokens.accessToken;
+        diskConfig.accounts[i].refreshToken = newTokens.refreshToken;
+        diskConfig.accounts[i].expiresAt = newTokens.expiresAt;
+      }
+    });
+  }
 
   // Fetch profiles in parallel for all OAuth accounts
   const profiles = await Promise.all(
@@ -1113,9 +1301,26 @@ async function removeCommand() {
 // ── enable / disable / priority ─────────────────────────────
 
 /** Note that changes apply to a running server only after a reload/restart. */
+// Returns { serverFound, reloaded }: serverFound=false means no proxy is running (nothing
+// to protect); serverFound=true+reloaded=false means a proxy IS running but did NOT pick
+// up the just-written config — callers that share tokens (cloud push) must fail closed on
+// that, or the live proxy keeps cloudManaged=false and could local-rotate a now-shared
+// token (protect-then-share bypass). Existing callers that ignore the return are unaffected.
+// The ambient env auth key (TEAMCLAUDE_AUTH_KEY) carries no endpoint binding, so it's
+// presumed issued for the DEFAULT public cloud. Offer it ONLY when the resolved endpoint IS
+// the default — never auto-send it to a custom/self-hosted URL the config points at: a
+// tricked `cloud pull --url <attacker>` (or a config edit) would otherwise exfiltrate the
+// key via the background sync/refresh/usage/auto-push loops. Custom clouds bind their key
+// per-endpoint via `cloud pull --key` (endpoint-scoped pullKeys), which these loops use.
+function envAuthKey(config) {
+  const k = process.env.TEAMCLAUDE_AUTH_KEY;
+  if (!k) return undefined;
+  return isDefaultCloudUrl(resolveCloud(config).url) ? k : undefined; // trailing-slash tolerant
+}
+
 async function noteRunningServerReload(config) {
   const running = await findRunningServer(config).catch(() => null);
-  if (!running) return;
+  if (!running) return { serverFound: false, reloaded: false };
   // Tell the running server to apply the just-written config change RIGHT NOW
   // (localhost-only endpoint), instead of waiting for its next cloud-sync tick.
   try {
@@ -1125,10 +1330,11 @@ async function noteRunningServerReload(config) {
     if (res.ok) {
       await res.json().catch(() => ({}));
       console.log('  Applied to the running server immediately.');
-      return;
+      return { serverFound: true, reloaded: true };
     }
   } catch { /* server unreachable mid-shutdown — fall back to the manual hint */ }
   console.log('  A server is running — apply with: teamclaude restart (or "R" in the TUI).');
+  return { serverFound: true, reloaded: false };
 }
 
 async function setEnabledCommand(enabled) {
@@ -1292,6 +1498,15 @@ async function upsertOAuthAccount(config, name, creds, source = 'unknown') {
     const prev = config.accounts[idx];
     if (prev.enabled !== undefined) account.enabled = prev.enabled;
     if (prev.priority !== undefined) account.priority = prev.priority;
+    // CRITICAL: preserve cloud provenance/display too. A re-auth/re-import replaces the TOKEN, not
+    // the account's cloud-sharing status. Dropping cloudSources/cloudPushed would make a
+    // cloud-managed (shared) account look LOCAL after restart → the refresh handler would then
+    // rotate its now-shared refresh token LOCALLY and poison the chain for every other PC (the
+    // exact multi-PC invalid_grant failure the single-authority design exists to prevent), and it
+    // would no longer be held on key revocation. cloudPrivate is a display flag, preserved likewise.
+    if (Array.isArray(prev.cloudSources) && prev.cloudSources.length) account.cloudSources = prev.cloudSources;
+    if (prev.cloudPushed) account.cloudPushed = prev.cloudPushed;
+    if (prev.cloudPrivate) account.cloudPrivate = prev.cloudPrivate;
     config.accounts[idx] = account;
     console.log(`Updated account "${name}"`);
   } else {
@@ -1343,19 +1558,38 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
     // `teamclaude disable`/`priority` set while the server runs. setEnabled drains
     // the overflow queue when re-enabling so a freed-up account is used at once.
     if (mgr) {
-      const wantEnabled = diskAcct.enabled !== false;
+      // `diskEnabled` is what disk PERSISTS (user/CLI intent). `wantEnabled` is the LIVE target:
+      // a live-only revocation hold (`_revHeld`, set by the sync loop when a key managing this
+      // account 403s) forces it disabled WITHOUT touching disk — otherwise an UNRELATED key's
+      // successful pull (which runs this reconcile) would re-enable an account solely authorized
+      // by a still-revoked key (auth-revocation bypass). The hold is cleared ONLY by
+      // clearRevocationHold when an AUTHORIZING source's own pull succeeds. The two are kept
+      // SEPARATE so the hold is applied to the live fleet but NEVER mirrored to persistable
+      // config (see the memAcct mirror below).
+      const diskEnabled = diskAcct.enabled !== false;
+      const wantEnabled = diskEnabled && !mgr._revHeld;
       if (mgr.enabled !== wantEnabled) accountManager.setEnabled(mgr, wantEnabled);
       const diskPriority = Number.isFinite(diskAcct.priority) ? Math.floor(diskAcct.priority) : null;
       if (mgr.priority !== diskPriority) accountManager.setPriority(mgr, diskPriority);
       // Provenance can change while running (a cloud pull moves an account in/out of
       // a personal group), so refresh the private flag on reload too.
       mgr.isPrivate = diskAcct.cloudPrivate === true;
+      // Same for cloud-management provenance — keep the live-object flag in step with
+      // disk so a pull (cloudSources) or push (cloudPushed) that starts sharing an
+      // account is reflected. Either provenance means the token is cloud-shared.
+      mgr.cloudManaged = (Array.isArray(diskAcct.cloudSources) && diskAcct.cloudSources.length > 0) || !!diskAcct.cloudPushed;
       // Mirror the applied state into the in-memory config copy too. Otherwise a
       // later TUI saveConfig (for any unrelated op) would spread the pre-sync
       // enabled/priority over the disk value and silently revert a CLI change.
+      // Mirror DISK's OWN enabled (`diskEnabled`), NOT the `_revHeld`-adjusted live value — the
+      // revocation hold is LIVE-ONLY and must never be persisted: a TUI saveConfig writing
+      // enabled:false would convert a transient 403 hold into a durable disable, and
+      // mergePulledAccounts would then seed that into localDisabled (sticky forever, breaking
+      // recovery). clearRevocationHold reads this mem value, so keeping it at disk's truth lets
+      // an authorizing recovery re-enable correctly.
       const memAcct = memConfig.accounts[memIdx];
       if (memAcct) {
-        if (wantEnabled) delete memAcct.enabled; else memAcct.enabled = false;
+        if (diskEnabled) delete memAcct.enabled; else memAcct.enabled = false;
         if (diskPriority === null) delete memAcct.priority; else memAcct.priority = diskPriority;
         // cloudSources (prune scoping) and cloudPrivate (personal-group display) are
         // both authoritative on disk — a cloud pull tags/untags them. Mirror both, or
@@ -1371,6 +1605,15 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
         } else {
           delete memAcct.cloudPrivate;
         }
+        // cloudPushed (explicit `cloud push` provenance) is authoritative on disk too;
+        // mirror the VALUE (a per-push generation marker or true) so it survives a later
+        // saveConfig, keeps the account cloud-managed, and preserves the generation used
+        // by a pending push's compare-and-swap revert.
+        if (diskAcct.cloudPushed) {
+          memAcct.cloudPushed = diskAcct.cloudPushed;
+        } else {
+          delete memAcct.cloudPushed;
+        }
       }
     }
 
@@ -1418,8 +1661,11 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
         mgr.refreshToken !== freshCred.refreshToken;
       // Don't overwrite in-memory credentials with staler ones from disk
       // (e.g. after a TUI import updated the AM before saveConfig wrote to disk)
-      const diskIsStaler = freshCred.expiresAt && mgr.expiresAt &&
-        freshCred.expiresAt < mgr.expiresAt;
+      // Normalize both (seconds vs ms) before comparing — a seconds-based disk value would else
+      // always look "staler" than an ms live value and never apply a genuinely newer disk token.
+      const freshExpN = normalizeExpiresAt(freshCred.expiresAt);
+      const mgrExpN = normalizeExpiresAt(mgr.expiresAt);
+      const diskIsStaler = freshExpN && mgrExpN && freshExpN < mgrExpN;
       if (changed && !diskIsStaler) {
         accountManager.updateAccountTokens(mgr.index, freshCred);
         console.log(`[TeamClaude] Refreshed credentials for "${mgr.name}"`);
@@ -1430,6 +1676,74 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
       console.log(`[TeamClaude] Updated API key for "${mgr.name}"`);
     }
   }
+  // Keep the running config's cloud keys in step with disk so the refresh handler
+  // (which closed over this config object) selects the right per-account key after
+  // ANOTHER CLI pulls a new key mid-run. Without this, a freshly-pulled key's accounts
+  // would keep refreshing with the stale in-memory key and 403 until restart. Merge
+  // (never drop) pullKeys — a key still authorizes its accounts until explicitly revoked.
+  if (diskConfig.cloud && typeof diskConfig.cloud === 'object') {
+    memConfig.cloud = memConfig.cloud || {};
+    // Mirror the cloud ENDPOINT (url/anonKey) too, not just the keys. A server that began
+    // PURE-LOCAL has no memConfig.cloud.url; if a later `cloud pull --key` targeted a
+    // CUSTOM/self-hosted cloud, copying only the key would leave resolveCloud() falling back
+    // to DEFAULT_CLOUD — and the sync/refresh loops would then POST the freshly-pulled key
+    // to the wrong (default) server, leaking it. Copy the endpoint the key was pulled from.
+    // 🔒 If the endpoint CHANGED (a pull retargeted a different cloud URL), REPLACE the live
+    // key set with disk's instead of merging — merging would keep keys issued for the OLD
+    // endpoint and the sync loop would then POST them to the NEW endpoint (key exfiltration).
+    // cloudPullCommand already dropped old-endpoint keys on disk for this case; mirror that.
+    // An ABSENT url (either side) = the implicit DEFAULT endpoint — normalize BOTH before
+    // comparing so an endpoint change is detected in EITHER direction: legacy/default (no url)
+    // → custom, AND custom → default via a url REMOVAL. Without normalizing the disk side, a
+    // config whose custom `cloud.url` is deleted keeps its old custom keys live, and the next
+    // sync/usage/refresh tick (now resolving DEFAULT) POSTs those custom-endpoint keys to the
+    // default server — key exfiltration.
+    const diskUrlN = typeof diskConfig.cloud.url === 'string' ? diskConfig.cloud.url : DEFAULT_CLOUD.url;
+    const memUrlN = memConfig.cloud.url || DEFAULT_CLOUD.url;
+    const endpointChanged = memUrlN !== diskUrlN;
+    if (typeof diskConfig.cloud.url === 'string') memConfig.cloud.url = diskConfig.cloud.url;
+    else if (endpointChanged) delete memConfig.cloud.url; // disk removed url → mem back to implicit default
+    if (typeof diskConfig.cloud.anonKey === 'string') memConfig.cloud.anonKey = diskConfig.cloud.anonKey;
+    // Mirror the singular pullKey — SET it when disk has one, but also DELETE a stale live one
+    // when disk intentionally removed it on an endpoint change (cloud login/pull --url clears
+    // old-endpoint keys). Without the delete, a retargeted proxy keeps the OLD key live and the
+    // usage/live-sync/refresh loops POST it to the NEW (possibly attacker) URL — key exfiltration.
+    if (typeof diskConfig.cloud.pullKey === 'string') memConfig.cloud.pullKey = diskConfig.cloud.pullKey;
+    else if (endpointChanged) delete memConfig.cloud.pullKey;
+    if (diskConfig.cloud.pullKeys && typeof diskConfig.cloud.pullKeys === 'object') {
+      memConfig.cloud.pullKeys = endpointChanged
+        ? { ...diskConfig.cloud.pullKeys }
+        : { ...(memConfig.cloud.pullKeys || {}), ...diskConfig.cloud.pullKeys };
+    } else if (endpointChanged) {
+      memConfig.cloud.pullKeys = {};
+    }
+    // Drop the endpoint-scoped owner session (JWT) on an endpoint change, so the live
+    // auto-push/refresh loops can't send the OLD endpoint's owner JWT to the NEW URL.
+    // (cloudPullCommand already cleared it on disk for this case; mirror that to the fleet.)
+    if (endpointChanged) delete memConfig.cloud.session;
+    // Bump the cloud-config GENERATION whenever the endpoint OR the key set changes. An in-flight
+    // cloud-sync pull captures this generation at its start and re-checks it inside the atomic
+    // merge; a bare URL check would MISS an A→B→A retarget (URL returns to A) or a same-endpoint
+    // key change, letting a delayed old-scope allow-set merge and re-enable obsolete-scope
+    // accounts (Codex). Fingerprint = url + sorted key sources + pullKey.
+    const _fp = (memConfig.cloud.url || '') + '|'
+      + Object.keys(memConfig.cloud.pullKeys || {}).sort().join(',') + '|'
+      + (memConfig.cloud.pullKey || '');
+    if (_fp !== _cloudIdentityFp) { _cloudIdentityFp = _fp; _cloudConfigGen++; }
+    // A key may have just become available (e.g. an owner-session server that ran
+    // `cloud pull --key …`). Immediately re-probe cloud-managed accounts stuck in
+    // 'error' so they recover NOW — even if the pull returned the same (still-expired)
+    // access token (changed === false), ensureTokenFresh refreshes through the cloud
+    // with the newly-authorized key and clears the error, without waiting for the
+    // recovery timer's next tick or a restart. Coalesced + best-effort.
+    if (memConfig.cloud.pullKey || (memConfig.cloud.pullKeys && Object.keys(memConfig.cloud.pullKeys).length)) {
+      for (const mgr of accountManager.accounts) {
+        if (mgr.status === 'error' && mgr.type === 'oauth' && mgr.cloudManaged === true) {
+          accountManager.ensureTokenFresh(mgr, true).catch(() => { /* stays error until a key/cloud recovers */ });
+        }
+      }
+    }
+  }
   return added;
 }
 
@@ -1453,46 +1767,232 @@ function applyDiskToFleet(config, accountManager) {
 
 // ── live cloud sync (running server ⇄ cloud) ────────────────
 
+// Revocation policy — a 403 NEVER triggers a destructive action, only a reversible one.
+// A 403 is inherently ambiguous: a real key revocation, OR an auth/policy outage, a buggy
+// custom endpoint, or a server regression. Pruning accounts (or deleting the stored key) on
+// a 403 would be irreversible local credential loss on a mere outage — the shared
+// refresh-token chain can't be rebuilt without a re-pull (irreversible-mutation-uncertain-
+// outcome; external-probe-gate-classification: 401/403 = HOLD, never a definitive verdict).
+// So on ANY 403 we ONLY DISABLE the key's accounts (a reversible, live-only hold):
+//   • transient/outage → the key recovers, a successful pull lifts the hold, accounts resume;
+//   • genuine revocation → accounts stay disabled (safe — not serving) and their tokens
+//     naturally expire to `error` (cloud refresh keeps 403ing). No serving, no poison, no loss.
+// Account REMOVAL happens EXCLUSIVELY through the server's authoritative allow-set on a
+// SUCCESSFUL (200) pull (mergePulledAccounts) — the one signal that definitively says
+// "this account is no longer in your group." That is the only place a cloud-managed account
+// is pruned, and it is never driven by a 403.
+
+// On a 403 for a key, STOP serving the accounts it manages — a REVERSIBLE, live-only disable
+// (never persisted to disk), so a revoked key can't keep proxying and a transient 403 costs
+// only a serving pause, not credential loss. A user's explicit disable is persisted
+// (enabled:false / localDisabled), so this never resurrects it (we only ever set enabled=false
+// here) and the recovery re-enable respects the persisted state. Scope: accounts tagged by
+// this key's source (cloudSources), plus freshly-PUSHED (cloudPushed) accounts whose reconcile
+// hasn't tagged a source yet. `_revHeld` prevents an UNRELATED key's successful pull from
+// re-enabling an account only THIS (revoked) key authorized. Idempotent per tick.
+function disableKeyAccounts(config, accountManager, key) {
+  const src = keySource(key);
+  for (const a of config.accounts || []) {
+    const bySource = Array.isArray(a.cloudSources) && a.cloudSources.includes(src);
+    // A freshly-PUSHED account (cloudPushed) whose post-push reconcile pull hasn't yet tagged
+    // cloudSources has no source to match, but its token IS cloud-shared and could have been
+    // pushed via THIS key. Disable it too (reversible — a valid key's pull re-enables it) so a
+    // key revoked in that reconcile window can't keep it proxying (Codex: push→reconcile-fail→
+    // revoke bypass). Over-disabling a multi-key account here is a harmless flap — a surviving
+    // key's own successful poll re-enables it in the same/next tick.
+    const pushedUnreconciled = !!a.cloudPushed && !(Array.isArray(a.cloudSources) && a.cloudSources.length > 0);
+    if (!(bySource || pushedUnreconciled)) continue;
+    const idx = findConfigAccount({ accounts: accountManager.accounts }, a);
+    if (idx >= 0) {
+      // Mark a live-only revocation hold so a LATER reconcile driven by an UNRELATED key's
+      // successful pull can't re-enable it (see syncAccountsFromDisk). Cleared only by
+      // clearRevocationHold when an authorizing source's own pull confirms the account.
+      accountManager.accounts[idx]._revHeld = true;
+      if (accountManager.accounts[idx].enabled !== false) accountManager.setEnabled(accountManager.accounts[idx], false);
+    }
+  }
+}
+
+// A successful pull for `source` re-authorizes the accounts that source manages — lift the
+// revocation hold on exactly those (an account is authorized-by-source once its cloudSources
+// includes it, which the just-completed merge tags) and re-enable them, respecting a persisted
+// user/disk disable. A DIFFERENT key's success never reaches accounts it doesn't authorize, so
+// an account solely managed by a still-revoked key stays held (no revocation bypass).
+function clearRevocationHold(config, accountManager, source) {
+  if (source == null) return;
+  for (const a of config.accounts || []) {
+    if (!(Array.isArray(a.cloudSources) && a.cloudSources.includes(source))) continue;
+    const idx = findConfigAccount({ accounts: accountManager.accounts }, a);
+    if (idx >= 0 && accountManager.accounts[idx]._revHeld) {
+      delete accountManager.accounts[idx]._revHeld;
+      if (a.enabled !== false) accountManager.setEnabled(accountManager.accounts[idx], true);
+    }
+  }
+}
+
+// After a SUCCESSFUL (200) pull with an authoritative allow-set, put a revocation hold on any
+// freshly-PUSHED account (cloudPushed) that (a) hasn't been reconciled yet (no cloudSources) AND
+// (b) is NOT in this pull's allow-set. Its post-push reconcile never tagged a source, so the
+// normal cloudSources-scoped prune (mergePulledAccounts) can't see it — a group-removed push
+// orphan would otherwise keep proxying on its still-valid token until expiry (revocation bypass).
+// The hold is REVERSIBLE: if the account actually belongs to ANOTHER key, that key's own pull
+// tags cloudSources (mergePulledAccounts adds it for allow-set members) AND clearRevocationHold
+// lifts the hold; if it was genuinely removed, it stays disabled (not serving) until its token
+// expires to `error`. Accounts already carrying cloudSources are handled by the normal prune, so
+// this only ever touches the untagged push-orphan window. Needs an authoritative allow-set — an
+// older server that omits it can't scope safely, so we skip (never disable on an absent allow-set).
+function holdUnauthorizedPushOrphans(config, accountManager, allowed) {
+  if (!Array.isArray(allowed)) return;
+  const allowSet = new Set(allowed);
+  for (const a of config.accounts || []) {
+    const unreconciled = !!a.cloudPushed && !(Array.isArray(a.cloudSources) && a.cloudSources.length > 0);
+    if (!unreconciled) continue;
+    if (allowSet.has(a.accountUuid) || allowSet.has(a.name)) continue; // this pull authorizes it → it's being reconciled, not orphaned
+    const idx = findConfigAccount({ accounts: accountManager.accounts }, a);
+    if (idx >= 0) {
+      accountManager.accounts[idx]._revHeld = true;
+      if (accountManager.accounts[idx].enabled !== false) accountManager.setEnabled(accountManager.accounts[idx], false);
+    }
+  }
+}
+
+// Cloud-config GENERATION — bumped by syncAccountsFromDisk whenever the endpoint or key set
+// changes. A cloud-sync pull captures the generation at its start and re-checks it (inside the
+// atomic merge) so a delayed pull can't merge a stale allow-set into a config that has since been
+// retargeted — including an A→B→A round-trip a plain URL comparison would miss.
+let _cloudConfigGen = 0;
+let _cloudIdentityFp = null;
+
 // One cloud-sync pass: re-pull with the stored key and reconcile the live fleet.
-// Returns { stop } — stop=true means the key is revoked and the loop must end.
-// Failure classification (irreversible-mutation 3-way): revoked(403) → drop the
-// key's accounts and stop; transient(5xx/network) → keep last-known accounts and
-// retry next interval (cloud outage must NOT block the local proxy).
-async function syncFromCloudOnce(config, accountManager, cloud, key) {
+// Returns { result }: 'ok' (reconciled — a successful pull's authoritative allow-set is the
+// ONLY thing that prunes accounts), 'transient' (5xx/network — kept last-known accounts, retry
+// next interval so a cloud outage never blocks the local proxy), 'auth403' (a 403 — the caller
+// only DISABLES the key's accounts, reversibly; never prunes on a 403), or 'aborted' (the loop
+// was stopped/retargeted while cloudPull was in flight — bail before mutating so this pass can't
+// merge OLD-endpoint results into a config that has since been retargeted). `isCurrent` is the
+// loop's liveness check.
+async function syncFromCloudOnce(config, accountManager, cloud, key, isCurrent) {
   let pulled, allowed, source;
   try {
     ({ accounts: pulled, allowed, source } = await cloudPull(cloud, key));
   } catch (err) {
-    if (err && err.revoked) {
-      // Revoke: prune every account this key manages (mergePulledAccounts with an
-      // empty allow-set drops this key's source and removes now-unmanaged accounts).
-      const src = keySource(key);
-      await atomicConfigUpdate(c => { mergePulledAccounts(c, [], src, []); });
-      const { removed } = await applyDiskToFleet(config, accountManager); // via the shared chain
-      console.error(`[TeamClaude] Cloud auth key revoked — removed ${removed} account(s). The proxy will refuse new requests until you re-pull with a valid key.`);
-      return { stop: true };
-    }
+    if (err && err.revoked) return { result: 'auth403' }; // HOLD — loop counts persistence
     console.error(`[TeamClaude] Cloud sync skipped (transient — keeping current accounts): ${err.message}`);
-    return { stop: false };
-  }
-  await atomicConfigUpdate(c => { mergePulledAccounts(c, pulled, source, allowed); });
+    return { result: 'transient' };
+  }
+  if (isCurrent && !isCurrent()) return { result: 'aborted' }; // early bail: stopped/retargeted mid-pull
+  // Authoritative re-check INSIDE the serialized write: the loop is NOT stopped on an endpoint/key
+  // retarget (only on interval→0), so `isCurrent` (=!stopped) alone can't catch a concurrent
+  // `cloud pull --url B`. Verify the DISK config still points at the endpoint we pulled FROM,
+  // atomically with the merge — else A's allow-set would be merged into a retargeted-to-B config
+  // (re-adding A's accounts / source-A authorization after a retarget/revocation). resolveCloud(c)
+  // reflects the authoritative disk state including any retarget that just landed.
+  let merged = false;
+  await atomicConfigUpdate(c => {
+    // Re-validate INSIDE the serialized write: the config GENERATION must be unchanged since this
+    // pull started (isCurrent — catches endpoint/key retarget incl. A→B→A) AND the authoritative
+    // disk endpoint must still match the one we pulled FROM. Either mismatch → drop the stale pull.
+    if ((isCurrent && !isCurrent()) || resolveCloud(c).url !== cloud.url) return;
+    mergePulledAccounts(c, pulled, source, allowed);
+    merged = true;
+  });
+  if (!merged) return { result: 'aborted' };
   // Reconcile through the shared serialized chain so a concurrent /reload can't interleave.
   await applyDiskToFleet(config, accountManager);
-  return { stop: false };
+  // This source just proved valid AND re-authorized its accounts (merge re-tagged their
+  // cloudSources) — lift any revocation hold on exactly those, so a transiently-403'd key that
+  // recovered resumes serving. Runs AFTER applyDiskToFleet (which kept held accounts disabled).
+  clearRevocationHold(config, accountManager, source);
+  // A group-removed push orphan (cloudPushed, never reconciled) is invisible to the
+  // cloudSources-scoped prune — hold it (reversibly) if this authoritative pull doesn't list it.
+  holdUnauthorizedPushOrphans(config, accountManager, allowed);
+  return { result: 'ok' };
 }
 
 // Start the periodic live-sync loop. Returns a stop() function. The timer is
 // unref'd (never keeps the process alive) and non-overlapping (a slow pull won't
-// stack). On revoke it self-cancels.
-function startCloudSyncLoop(config, accountManager, cloud, key, intervalMs) {
+// stack). It polls EVERY key that manages accounts here (a multi-key fleet), not just
+// the last pullKey — otherwise revoking a non-last key would never stop its accounts
+// from being served (key-based revocation bypass). A revoked key prunes its own
+// accounts and is dropped; the loop keeps polling the rest and only self-cancels when
+// no keys remain. For a single-key install this is exactly the old behavior.
+function startCloudSyncLoop(config, accountManager, key, intervalMs) {
   let timer = null;
   let running = false;
+  let stopped = false; // set by stop() — an in-flight tick checks this after each await so it can't
+                       // mutate the (possibly retargeted) config after the loop was torn down.
+  // Seed with the UNION of pullKeys AND the current pullKey — never pullKeys alone. A valid
+  // current key absent from the map (e.g. an older CLI wrote only cloud.pullKey while an
+  // existing config kept an older pullKeys map) would otherwise never be polled, so its
+  // revocation/group changes would never prune its accounts. Set dedups the overlap.
+  const seed = [...(config.cloud?.pullKeys ? Object.values(config.cloud.pullKeys) : []), key, envAuthKey(config)];
+  const activeKeys = new Set(seed.filter(Boolean));
+  const auth403Streak = new Map(); // key -> true while in a 403 hold episode (log-once marker; a 403 never prunes)
   const tick = async () => {
-    if (running) return;
+    if (running || stopped) return;
     running = true;
     try {
-      const r = await syncFromCloudOnce(config, accountManager, cloud, key);
-      if (r.stop && timer) { clearInterval(timer); timer = null; }
+      // Resolve the cloud endpoint FRESH each tick from the (possibly reloaded) config —
+      // NEVER capture it once. A live `cloud pull` can change config.cloud.url (e.g. a
+      // server that began pure-local, or re-pointed to a self-hosted cloud); a stale
+      // captured endpoint would keep polling the OLD server and — worse — a 403 from the
+      // wrong endpoint for a still-valid key would be misread as revocation and PRUNE the
+      // live accounts. resolveCloud spreads config.cloud over DEFAULT_CLOUD each call.
+      const cloud = resolveCloud(config);
+      // RECONCILE the poll set to the CURRENT persisted keys each tick — add newly-pulled
+      // keys AND DROP any no longer present. On an endpoint change syncAccountsFromDisk
+      // REPLACES config.cloud.pullKeys (old-endpoint keys removed); an add-only merge would
+      // keep a stale key A in this closure and POST it as x-teamclaude-key to the NEW
+      // (possibly attacker) URL — key exfiltration. Reconciling down closes that.
+      // Include the ambient env auth key (endpoint-bound: envAuthKey returns it ONLY for the
+      // default endpoint, never a custom URL) so an env-only deployment keeps polling for
+      // revocation/group changes — otherwise `current` (built solely from pullKey/pullKeys)
+      // would drop the seeded env key on the first tick and never live-sync it.
+      const envK = envAuthKey(config);
+      const current = new Set([
+        ...(config.cloud?.pullKeys ? Object.values(config.cloud.pullKeys).filter(Boolean) : []),
+        ...(config.cloud?.pullKey ? [config.cloud.pullKey] : []),
+        ...(envK ? [envK] : []),
+      ]);
+      for (const k of [...activeKeys]) if (!current.has(k)) activeKeys.delete(k); // drop stale (endpoint change / revoked)
+      for (const k of current) activeKeys.add(k);                                 // pick up newly-pulled keys
+      for (const k of [...auth403Streak.keys()]) if (!activeKeys.has(k)) auth403Streak.delete(k); // clear 403-hold markers for keys no longer polled
+      for (const k of [...activeKeys]) {
+        if (stopped) return; // loop torn down mid-iteration — start no new work
+        // isCurrent: bail if the loop was stopped OR the cloud config was retargeted since this
+        // tick captured `cloud` — checked by GENERATION (catches an A→B→A round-trip and same-
+        // endpoint key changes a URL comparison would miss). The updater re-checks the generation
+        // against the authoritative disk state too.
+        const genAtStart = _cloudConfigGen;
+        const r = await syncFromCloudOnce(config, accountManager, cloud, k, () => !stopped && _cloudConfigGen === genAtStart);
+        if (stopped) return; // stopped during this key's pull — don't act on a stale result
+        if (r.result === 'auth403') {
+          // A 403 is AMBIGUOUS (a real revocation OR an auth/policy outage, a buggy custom
+          // endpoint, a server regression), so take NO destructive action: DISABLE the key's
+          // accounts (reversible, live-only) and keep polling. If the key recovers, a successful
+          // pull lifts the hold and the accounts resume; if it's genuinely revoked they stay
+          // disabled (not serving) until their tokens expire to `error`. The ONLY thing that
+          // removes a cloud-managed account is the server's authoritative allow-set on a future
+          // SUCCESSFUL (200) pull — never a 403 (irreversible-mutation-uncertain-outcome). Log
+          // once per 403 episode (the map is a per-key "already-logged" marker, reset on any
+          // non-403 outcome below and swept when a key leaves the poll set).
+          disableKeyAccounts(config, accountManager, k);
+          if (!auth403Streak.has(k)) {
+            console.error('[TeamClaude] Cloud pull 403 for a key — its accounts disabled (not serving) until the key recovers or the server drops them from your group on a successful sync. Not pruned: a 403 is never treated as a definitive revocation.');
+          }
+          auth403Streak.set(k, true);
+        } else {
+          // 'ok' or 'transient' — end the 403 episode (a later 403 logs afresh). A successful
+          // pull has already lifted the hold on the accounts its allow-set re-authorized.
+          auth403Streak.delete(k);
+        }
+      }
+      // Do NOT self-cancel when activeKeys empties (all keys revoked): a later
+      // `cloud pull --key NEW` adds a key to config.cloud.pullKeys, and the top of the
+      // next tick re-seeds activeKeys from it — so revocation is still enforced for the
+      // new key. Self-cancelling would leave a re-keyed proxy polling nothing until a
+      // restart (auth-revocation bypass). An idle tick over an empty set is a cheap
+      // no-op; the timer is unref'd and cleared by stop() on process exit.
     } catch (e) {
       console.error(`[TeamClaude] Cloud sync error: ${e.message}`);
     } finally {
@@ -1501,7 +2001,17 @@ function startCloudSyncLoop(config, accountManager, cloud, key, intervalMs) {
   };
   timer = setInterval(tick, intervalMs);
   timer.unref?.();
-  return () => { if (timer) { clearInterval(timer); timer = null; } };
+  // Poll ONCE immediately on start, not only after the first full interval. The 403-hold is
+  // live-only, so a restart that lands during a key revocation begins with the account enabled
+  // on disk; an immediate poll re-applies the disable within ~one pull instead of leaving a
+  // serving window up to `intervalMs` wide. The `running` guard makes this safe against the
+  // interval's first fire. (A proxy with live-sync disabled — intervalMs 0 — has opted out of
+  // live revocation enforcement entirely, so there is nothing to poll.)
+  setImmediate(() => { tick().catch(() => { /* tick already logs its own errors */ }); });
+  // stop(): cancel the interval AND set `stopped` so an already-running tick bails at its next
+  // await-boundary check instead of merging a stale pull into a config that has since been
+  // retargeted (endpoint/key change) or after the loop was disabled (cloudSyncIntervalMs=0).
+  return () => { stopped = true; if (timer) { clearInterval(timer); timer = null; } };
 }
 
 // ── self-update (public npm) ────────────────────────────────
@@ -1583,7 +2093,21 @@ async function resolveAccounts(config) {
           const creds = await importCredentials(acct.importFrom);
           // Carry accountUuid through so the live account can be matched UUID-first
           // on sync (otherwise it stays null and a name change misroutes the update).
-          accounts.push({ name: acct.name, type: 'oauth', accountUuid: acct.accountUuid, maxConcurrent: acct.maxConcurrent, enabled: acct.enabled, priority: acct.priority, ...creds });
+          // Carry cloud provenance (cloudSources/cloudPushed/pullKey/pullKeys) too: an
+          // imported account can itself be cloud-managed, and the AccountManager derives
+          // the live `cloudManaged` flag from these. Dropping them here would leave an
+          // imported cloud account with cloudManaged=false — so if its config row is
+          // removed by a revocation while it's held in-flight, createCloudRefreshHandler
+          // finds no provenance and falls back to LOCAL rotation, reintroducing the exact
+          // divergent-token poisoning this fix exists to prevent. The live flag survives
+          // config-row removal; the raw fields don't hurt a non-cloud import (undefined).
+          accounts.push({
+            name: acct.name, type: 'oauth', accountUuid: acct.accountUuid,
+            maxConcurrent: acct.maxConcurrent, enabled: acct.enabled, priority: acct.priority,
+            cloudSources: acct.cloudSources, cloudPushed: acct.cloudPushed,
+            pullKey: acct.pullKey, pullKeys: acct.pullKeys,
+            ...creds,
+          });
           console.log(`Imported "${acct.name}" from ${acct.importFrom}`);
         } catch (err) {
           console.error(`Failed to import "${acct.name}": ${err.message}`);
@@ -1616,6 +2140,15 @@ const _autoPushInFlight = new Set();
  * consumer). Never throws — cloud problems must not affect the running proxy.
  */
 async function maybePushRefreshedToken(config, account, newTokens) {
+  // ONLY sync back cloud-managed (shared) accounts. Auto-pushing a purely LOCAL account
+  // would SHARE its freshly locally-rotated token to the cloud WITHOUT marking cloudPushed
+  // provenance — this PC would then stay cloudManaged=false and keep local-rotating the
+  // now-shared token on every future refresh, poisoning the cloud/other-PC chain (the exact
+  // single-authority violation this feature prevents). A local account has no cloud copy to
+  // keep fresh, so there is nothing to sync back. (A cloud-managed account is refreshed
+  // centrally via cloudRefreshToken, so this re-push is a harmless belt-and-suspenders.)
+  const cloudManaged = account.cloudManaged === true || isCloudManaged(config, account);
+  if (!cloudManaged) return;
   const key = account.accountUuid || account.name;
   const session = config.cloud && config.cloud.session;
   // An owner session is USABLE if its access token is still valid OR it carries a
@@ -1627,7 +2160,7 @@ async function maybePushRefreshedToken(config, account, newTokens) {
     (Number(session.expires_at || 0) * 1000) > Date.now() + 30_000 ||
     (session.refresh_token && String(session.refresh_token).length > 0)
   ));
-  const pullKey = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  const pullKey = config.cloud?.pullKey || envAuthKey(config); // endpoint-bound env key
   const canKey = !!(pullKey && account.accountUuid);
   if (!ownerUsable && !canKey) return; // nowhere to sync back to
   try {
@@ -1843,7 +2376,20 @@ async function cloudLoginCommand(config) {
       console.error('Token login failed — the token is invalid or expired. Re-copy "CLI login" from the web dashboard.');
       process.exit(1);
     }
-    await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), url, anonKey, email, session }; });
+    await atomicConfigUpdate(c => {
+      // An ABSENT prior url = the implicit DEFAULT endpoint — treat it as DEFAULT_CLOUD.url so a
+      // legacy/default config (has keys, no explicit url) switching to a custom `--url` is
+      // correctly detected as an endpoint change (else its keys survive and get POSTed there).
+      const endpointChanged = (c.cloud?.url || DEFAULT_CLOUD.url) !== url;
+      c.cloud = { ...(c.cloud || {}), url, anonKey, email, session };
+      // Login to a DIFFERENT endpoint → drop keys issued for the OLD one, or the sync/refresh
+      // loops would POST them to the new URL (key exfiltration). session is set fresh above.
+      if (endpointChanged) { delete c.cloud.pullKey; delete c.cloud.pullKeys; }
+    });
+    // Apply to a running proxy NOW (like cloud pull/logout do). Otherwise the live server keeps
+    // the OLD endpoint/session/key until a manual reload/restart — and on an endpoint change that
+    // means it could keep POSTing the old key to the old URL (or the new one via a stale live key).
+    await noteRunningServerReload(config).catch(() => {});
     console.log(`Logged in to cloud${email ? ` as ${email}` : ''} (token, short-lived ~1h — re-copy from the dashboard when it expires).`);
     return;
   }
@@ -1861,17 +2407,256 @@ async function cloudLoginCommand(config) {
     rl.close();
   }
   const session = await cloudLogin({ url, anonKey }, email, password);
-  await atomicConfigUpdate(c => { c.cloud = { ...(c.cloud || {}), url, anonKey, email, session }; });
+  await atomicConfigUpdate(c => {
+    // Same endpoint-change key-clearing as the token branch (the password path had none): a
+    // login that retargets a DIFFERENT endpoint — including a switch away from the implicit
+    // default (absent url) — must DROP keys issued for the OLD one, or the sync/refresh loops
+    // would POST them to the new URL (key exfiltration).
+    const endpointChanged = (c.cloud?.url || DEFAULT_CLOUD.url) !== url;
+    c.cloud = { ...(c.cloud || {}), url, anonKey, email, session };
+    if (endpointChanged) { delete c.cloud.pullKey; delete c.cloud.pullKeys; }
+  });
+  // Apply to a running proxy NOW so it doesn't keep using the old endpoint/session/key.
+  await noteRunningServerReload(config).catch(() => {});
   console.log(`Logged in to cloud as ${email}.`);
 }
 
+// Tag pushed accounts as cloud-shared (cloudPushed) so this PC — the origin that
+// authenticated them locally and therefore has no cloudSources — is also recognized
+// as cloud-managed and refuses a local rotation. Without this, the pusher would keep
+// local-rotating a token now shared via the cloud and poison it for every puller.
+// Only a DEFINITIVE pre-commit rejection (HTTP 4xx: bad/expired key, plan limit, bad
+// request) proves the upload stored nothing. A 5xx / timeout / network error is AMBIGUOUS
+// — the cloud may have committed the token even though the client saw a failure — so its
+// mark is NEVER reverted.
+function isDefinitivePushRejection(err) {
+  const s = err && err.status;
+  return Number.isInteger(s) && s >= 400 && s < 500;
+}
+
+// Mark accounts cloud-shared (cloudPushed) BEFORE they are uploaded (protect-then-share),
+// so there is never a window where the token is in the cloud (shared) but the running proxy
+// still thinks it's local and would rotate it. It stamps ONLY cloudPushed here — the
+// key-source revocation tag (cloudSources[keySource(pushKey)]) is added POST-SUCCESS in
+// reconcileCloudPushedMarks, NOT at mark time: tagging cloudSources on an account not yet in
+// the cloud would make the 30s live-sync's pull (which doesn't see it yet) treat it as
+// revoked-from-group and PRUNE it (a premature-delete race).
+// Returns { gen, owned, pushed, isProtected }: `pushed` = ALL account UUIDs in this push
+// (used by the post-success reconcile to tag cloudSources — even on accounts already
+// cloudPushed by a prior push); `owned` = UUIDs whose cloudPushed WE newly stamped (so a
+// failed/rejected upload reverts only what it added — CAS on gen).
+async function markAccountsCloudPushed(config, pushedAccounts) {
+  const uuids = new Set(pushedAccounts.map(a => a.accountUuid).filter(Boolean));
+  if (!uuids.size) return null;
+  const gen = `g${Date.now().toString(36)}.${process.pid.toString(36)}.${Math.random().toString(36).slice(2, 10)}`;
+  const owned = [];
+  await atomicConfigUpdate(c => {
+    for (const a of c.accounts || []) {
+      // Stamp cloudPushed only on accounts not already cloud-shared — never overwrite an
+      // existing mark (another push's live generation, or a `true` from a prior share).
+      if (a.accountUuid && uuids.has(a.accountUuid) && !a.cloudPushed) { a.cloudPushed = gen; owned.push(a.accountUuid); }
+    }
+  });
+  // Apply the flag to a RUNNING proxy NOW (onReload → syncAccountsFromDisk updates the
+  // live account.cloudManaged) instead of waiting for its next cloud-sync tick.
+  // `isProtected` is false ONLY when a proxy IS running but failed to reload: then its
+  // live accounts stay cloudManaged=false and would local-rotate the token we're about to
+  // share (poison). The caller must fail closed on that. No server running → protected
+  // (nothing to poison); reload ok → protected.
+  const reload = await noteRunningServerReload(config).catch(() => ({ serverFound: false, reloaded: false }));
+  const isProtected = reload.reloaded || !reload.serverFound;
+  return { gen, owned, pushed: [...uuids], isProtected };
+}
+
+// Blind revert: remove ONLY the cloudPushed marks WE stamped (CAS on the exact gen). No
+// cloudSources involved — mark time never adds it (see markAccountsCloudPushed), so there is
+// nothing to strip and no risk of removing a source a concurrent pull legitimately owns.
+async function unmarkAccountsCloudPushed(config, mark) {
+  if (!mark || !mark.owned || !mark.owned.length) return;
+  const owned = new Set(mark.owned);
+  await atomicConfigUpdate(c => {
+    for (const a of c.accounts || []) {
+      if (a.accountUuid && owned.has(a.accountUuid) && a.cloudPushed === mark.gen) delete a.cloudPushed;
+    }
+  });
+  await noteRunningServerReload(config).catch(() => {});
+}
+
+// After a SUCCESSFUL push, re-pull with the same key to learn which of the just-pushed
+// accounts the key can ACTUALLY manage (confirmedUuids), then:
+//   • CONFIRMED (stored) → ADD the key's cloudSources tag now — post-upload, so the account
+//     is already in the cloud and the live-sync's pull returns it (no premature prune). This
+//     is what makes a later revocation of the key prune the account (403 path keys on
+//     cloudSources). Done for EVERY pushed account (incl. ones already cloudPushed by a prior
+//     push), so an already-marked account also gains the successful key's source. If this
+//     reconcile fails transiently the NEXT normal sync tick still sets cloudSources (its pull
+//     tags every returned account) — a ≤one-interval revocation-attribution delay, documented.
+//   • NOT confirmed (out-of-group / not-stored skip) AND we newly marked it (owned) → remove
+//     the cloudPushed mark (CAS on gen), so it isn't left falsely cloud-managed/unrefreshable.
+async function reconcileCloudPushedMarks(config, mark, confirmedUuids, pushKey) {
+  if (!mark || !mark.pushed || !mark.pushed.length) return;
+  const pushed = new Set(mark.pushed);
+  const owned = new Set(mark.owned || []);
+  const src = pushKey ? keySource(pushKey) : null;
+  let dropped = 0;
+  await atomicConfigUpdate(c => {
+    for (const a of c.accounts || []) {
+      if (!a.accountUuid || !pushed.has(a.accountUuid)) continue;
+      if (confirmedUuids.has(a.accountUuid)) {
+        if (src) { // stored → tag cloudSources for revocation-prune (idempotent, ALL pushed)
+          if (!Array.isArray(a.cloudSources)) a.cloudSources = [];
+          if (!a.cloudSources.includes(src)) a.cloudSources.push(src);
+        }
+      } else if (owned.has(a.accountUuid) && a.cloudPushed === mark.gen) { // not stored + we marked → un-mark
+        delete a.cloudPushed;
+        dropped++;
+      }
+    }
+  });
+  await noteRunningServerReload(config).catch(() => {});
+  if (dropped) console.log(`  ${dropped} account(s) not stored under this key — cloud-managed mark reverted (they refresh locally).`);
+}
+
+// Revert our marks after a DEFINITIVE 4xx (our push stored nothing). When a key is available,
+// reconcile via re-pull: a CONCURRENT push may have shared some of these accounts (then the
+// re-pull confirms them → they're correctly kept + tagged), while the rest (truly not stored)
+// have their cloudPushed removed. No key → blind cloudPushed-only revert. (The push path now
+// always has a key, so the no-key branch is a defensive fallback.)
+async function revertMarksAfterRejection(config, mark, cloud, key) {
+  if (!mark || (!mark.owned?.length && !mark.pushed?.length)) return;
+  if (key) {
+    try {
+      const { accounts: pulledBack } = await cloudPull(cloud, key);
+      const confirmed = new Set((pulledBack || []).map(a => a.accountUuid).filter(Boolean));
+      await reconcileCloudPushedMarks(config, mark, confirmed, key);
+      return;
+    } catch { /* re-pull failed — fall through to blind revert (definitive 4xx: our push stored nothing) */ }
+  }
+  await unmarkAccountsCloudPushed(config, mark);
+}
+
+// Fail closed if a running proxy could not be protected before we share the token: revert
+// our marks and abort. Returns true if the caller should stop (already reverted + logged).
+async function abortPushIfUnprotected(config, mark) {
+  if (mark && mark.isProtected === false) {
+    await unmarkAccountsCloudPushed(config, mark);
+    console.error('푸시 중단: 실행 중인 프록시에 보호 플래그를 적용하지 못했습니다 (공유 전 보호 실패).');
+    console.error('  `teamclaude restart` 후 다시 시도하세요 — 지금 업로드하면 프록시가 공유 토큰을 로컬 회전시켜 오염될 수 있습니다.');
+    return true;
+  }
+  return false;
+}
+
+// Machine-wide push lock: serialize `cloud push` (CLI + TUI) so two pushes never run
+// concurrently. Concurrency is the root of the push-path races — a second push can share an
+// account the first stamped (owning no mark), then the first's revert leaves it shared-but-
+// unmanaged (poison). Serializing eliminates the whole class. Atomic O_EXCL create; a stale
+// lock (holder pid dead) is stolen. Best-effort release; a lingering lock after a crash is
+// reclaimed by the next acquirer's stale check.
+function pushLockPath() { return getConfigPath().replace(/\.json$/, '') + '.push.lock'; }
+// A LIVE holder PID is never stolen — stealing a legitimately slow/hung push (age-based steal)
+// would let a second process acquire the lock and push CONCURRENTLY, exactly the stale-token-chain
+// race the lock prevents (poison is worse than a block). Only a DEAD/unparseable holder is stale.
+// Known rare edge (documented): if a push is SIGKILLed and its PID is later REUSED by an unrelated
+// live process (or the recorded pid is an init/PID-1 artifact), the lock blocks push on this
+// machine until the stale `<config>.push.lock` file is removed manually.
+function _lockHolderAlive(path) {
+  let holder = null;
+  try { holder = JSON.parse(readFileSync(path, 'utf8')); } catch { return { alive: false, holder: null }; }
+  if (!holder || !holder.pid) return { alive: false, holder };
+  try { process.kill(holder.pid, 0); return { alive: true, holder }; } catch { return { alive: false, holder }; }
+}
+function _acquireFileLock() {
+  const path = pushLockPath();
+  const payload = JSON.stringify({ pid: process.pid, at: new Date().toISOString() });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      writeFileSync(path, payload, { flag: 'wx', mode: 0o600 }); // atomic exclusive create
+      return path;
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+      const { alive, holder } = _lockHolderAlive(path);
+      // A LIVE holder is another process (the in-process mutex below guarantees no
+      // concurrent same-process acquire ever reaches here) → contention, don't steal.
+      // A dead holder — OR our own pid, which can only be a LEFTOVER from this process's
+      // already-finished previous push (the mutex serialized it) — is stale → reclaim.
+      if (alive && holder.pid !== process.pid) {
+        throw new Error('Another `teamclaude cloud push` is in progress on this machine — retry when it finishes.');
+      }
+      try { unlinkSync(path); } catch { /* raced with another reclaimer — retry */ }
+    }
+  }
+  throw new Error('Could not acquire the push lock (contention) — retry shortly.');
+}
+// In-process serialization: chain acquires on a module-level promise so two pushes in the
+// SAME process (e.g. two TUI `p` presses before the first completes) serialize instead of
+// the second stealing the first's live same-pid FILE lock and running concurrently. The
+// file lock adds cross-process serialization on top. Returns an opaque handle.
+let _pushMutex = Promise.resolve();
+async function acquirePushLock() {
+  let releaseMutex;
+  const prev = _pushMutex;
+  _pushMutex = new Promise(res => { releaseMutex = res; });
+  await prev; // wait for any in-process push to finish
+  try {
+    const path = _acquireFileLock();
+    return { path, releaseMutex };
+  } catch (err) {
+    releaseMutex(); // couldn't take the cross-process lock — free the in-process mutex
+    throw err;
+  }
+}
+function releasePushLock(handle) {
+  if (!handle) return;
+  try {
+    const holder = JSON.parse(readFileSync(handle.path, 'utf8'));
+    if (holder && holder.pid === process.pid) unlinkSync(handle.path); // only remove OUR lock
+  } catch { /* already gone / corrupt / stolen — nothing to do */ }
+  finally { handle.releaseMutex?.(); } // always free the in-process mutex
+}
+
+// Re-read the freshest tokens for the push payload AFTER protection. markAccountsCloudPushed
+// made these accounts cloudManaged on the running proxy, so it will no longer local-rotate
+// them — but it MAY have rotated one in the pre-protection window (T0→T1), persisting T1 to
+// disk. Uploading the pre-protection snapshot (T0) would make the cloud authoritative for a
+// rotated-away, now-invalid chain (Anthropic invalidates the previous refresh token on
+// rotation), bricking every consumer. Rebuild from the freshest on-disk token per account.
+function refreshPushSnapshot(freshCfg, accounts) {
+  const byId = new Map();
+  for (const a of (freshCfg?.accounts || [])) {
+    if (a.accountUuid) byId.set('u:' + a.accountUuid, a);
+    if (!byId.has('n:' + a.name)) byId.set('n:' + a.name, a);
+  }
+  return accounts.map(a => {
+    // A UUID-bearing account matches by UUID ONLY — never fall back to name. Otherwise, if a
+    // concurrent pull/revocation replaced u1 with a DIFFERENT same-name account u2, we'd
+    // upload u2's tokens under stale u1 (credential cross-store / revoked-account resurrect).
+    // Only a legacy UUID-less account falls back to a name match.
+    const f = a.accountUuid ? byId.get('u:' + a.accountUuid) : byId.get('n:' + a.name);
+    // Account no longer on disk → a concurrent `cloud pull`/revocation REMOVED it between
+    // our snapshot and now. OMIT it from the payload rather than re-uploading the stale
+    // original object — that would resurrect/re-share a token the control plane just revoked.
+    if (!f) return null;
+    return f.accessToken
+      ? { ...a, accessToken: f.accessToken, refreshToken: f.refreshToken, expiresAt: f.expiresAt }
+      : a;
+  }).filter(Boolean);
+}
+
 async function cloudPushCommand(config) {
   const accounts = (config.accounts || []).filter(a => a.type !== 'apikey');
   if (!accounts.length) { console.error('No OAuth accounts to push.'); process.exit(1); }
+  const _pushLock = await acquirePushLock(); // serialize pushes machine-wide (no concurrent-share race)
+  try {
   // Prefer the AUTH KEY: pushing to your own tenant is the key's job — no separate,
   // short-lived owner login required (the key is the credential, same as pull). This
   // CREATES + updates accounts in the key's owner tenant (freshest-wins + plan limits).
-  const key = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
+  // Env key is endpoint-bound: don't send it (nor the account tokens) to a custom URL.
+  // Fall back to pullKeys too: after the primary pullKey is revoked but another authorized
+  // key remains, push must still work (else a false "no key" refusal = management outage).
+  const key = config.cloud?.pullKey
+    || (config.cloud?.pullKeys && Object.values(config.cloud.pullKeys).find(Boolean))
+    || envAuthKey(config);
   if (key) {
     const usageByUuid = new Map();
     const quotaCache = await readQuotaCache();
@@ -1880,45 +2665,104 @@ async function cloudPushCommand(config) {
       const usage = buildUsageFromQuota(entry);
       if (usage) usageByUuid.set(entry.accountUuid, usage);
     }
-    const r = await cloudPush(resolveCloud(config), accounts, usageByUuid, key);
+    // Protect FIRST (mark cloud-shared + propagate to a running proxy), THEN upload — so
+    // the token is never shared-but-unprotected. On a DEFINITIVE 4xx (nothing stored) the
+    // mark is compare-and-swap reverted so an unshared account isn't left unrefreshable;
+    // an ambiguous 5xx/timeout keeps the mark (may be committed → don't re-open poison).
+    const mark = await markAccountsCloudPushed(config, accounts);
+    if (await abortPushIfUnprotected(config, mark)) process.exit(1);
+    // TOCTOU guard: upload the freshest tokens as of AFTER protection, not the pre-mark
+    // snapshot the proxy may have rotated away in the pre-protection window.
+    const pushAccounts = refreshPushSnapshot(await loadConfig(), accounts);
+    let r;
+    try {
+      r = await cloudPush(resolveCloud(config), pushAccounts, usageByUuid, key);
+    } catch (err) {
+      if (isDefinitivePushRejection(err)) await revertMarksAfterRejection(config, mark, resolveCloud(config), key);
+      throw err;
+    }
+    // Reconcile marks to what the key can actually manage (drops not-stored skips; keeps
+    // staler skips, which ARE cloud-stored). Re-pull with the same key; on a transient
+    // re-pull failure keep the marks (push succeeded, and the dominant skip is staler).
+    if (mark && mark.pushed?.length) {
+      try {
+        const { accounts: pulledBack } = await cloudPull(resolveCloud(config), key);
+        const confirmed = new Set((pulledBack || []).map(a => a.accountUuid).filter(Boolean));
+        await reconcileCloudPushedMarks(config, mark, confirmed, key);
+      } catch { /* transient re-pull failure — keep marks (dominant skip=staler is correctly cloud-managed) */ }
+    }
     const usageNote = usageByUuid.size ? `, usage ${r.usage ?? 0}/${usageByUuid.size}` : '';
     console.log(`Pushed to your account via auth key: ${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageNote}.`);
     return;
   }
-  // No auth key — fall back to an owner login (which also CREATES new accounts) and
-  // rides the quota snapshot so the dashboard can show utilization.
-  const cloud = await ensureCloudSession(config);
-  if (!cloud?.session?.access_token) { console.error('No auth key found and not logged in. Pull once with `teamclaude cloud pull --key <key>`, or `teamclaude cloud login`.'); process.exit(1); }
-  const usageByUuid = new Map();
-  const quotaCache = await readQuotaCache();
-  for (const entry of quotaCache?.accounts || []) {
-    if (!entry?.accountUuid) continue;
-    const usage = buildUsageFromQuota(entry);
-    if (usage) usageByUuid.set(entry.accountUuid, usage);
+  // No auth key → REFUSE. An owner-session-only push would mark the accounts cloud-shared
+  // (cloudPushed) but leaves NO key to refresh them: at expiry createCloudRefreshHandler
+  // refuses a local rotation (single-authority) and has no key for the cloud refresh, so the
+  // accounts go permanently unavailable — an availability regression on accounts that were
+  // refreshing fine locally before the push. Sharing accounts that can't be kept fresh is
+  // worse than not sharing. Require a key (it's also what keeps them refreshable for every
+  // consumer). The key path above already CREATES accounts + rides the usage snapshot, so no
+  // capability is lost — a key does everything the old owner-session push did, correctly.
+  console.error('cloud push에는 auth key가 필요합니다 — 공유된 계정은 키가 있어야 갱신(refresh)됩니다.');
+  console.error('  (owner 세션만으로 push하면 그 계정들이 만료 시 갱신 불가로 사용 불가가 됩니다 — availability 회귀.)');
+  console.error('  `teamclaude cloud pull --key <key>` 로 키를 받은 뒤 다시 push 하세요 (또는 대시보드에서 키 발급).');
+  process.exit(1);
+  } finally {
+    releasePushLock(_pushLock);
   }
-  const r = await cloudPush(cloud, accounts, usageByUuid);
-  const usageNote = usageByUuid.size ? `, usage ${r.usage ?? 0}/${usageByUuid.size}` : ' (no quota snapshot — start the server once to measure usage)';
-  console.log(`Pushed ${r.pushed} new, updated ${r.updated}, skipped ${r.skipped} (stale/invalid)${usageNote}.`);
 }
 
 async function cloudPullCommand(config) {
   // Consumer side: the auth key IS the credential — no owner `cloud login` needed.
   // resolveCloud() supplies the built-in public endpoint, so this works right after install.
   const cloud = resolveCloud(config);
-  const key = argValue('--key') || process.env.TEAMCLAUDE_AUTH_KEY;
-  if (!key) { console.error('Auth key required (--key or TEAMCLAUDE_AUTH_KEY).'); process.exit(1); }
+  // Auto-fill the ambient env key ONLY for the DEFAULT endpoint — an explicit --key is
+  // required to pull from a custom/self-hosted URL, so a config pointed at an attacker
+  // endpoint can't silently harvest the env key issued for the real (default) cloud.
+  const key = argValue('--key')
+    || (isDefaultCloudUrl(cloud.url) ? process.env.TEAMCLAUDE_AUTH_KEY : undefined); // trailing-slash tolerant
+  if (!key) { console.error('Auth key required (--key or TEAMCLAUDE_AUTH_KEY; a custom --url needs an explicit --key).'); process.exit(1); }
   const { accounts: pulled, allowed, source } = await cloudPull(cloud, key);
   const updated = await atomicConfigUpdate(c => {
     c._pullSummary = mergePulledAccounts(c, pulled, source, allowed);
     // Persist the endpoint + auth key so a running `server` can re-pull on its own
     // (live sync). The key is the consumer's own credential; config is written 0o600.
-    c.cloud = { ...(c.cloud || {}), url: cloud.url, anonKey: cloud.anonKey, pullKey: key };
+    // pullKeys accumulates a { keySource(key) -> key } store across pulls so a
+    // multi-key fleet can refresh each account with the key that pulled it (its
+    // cloudSources), not just this last pullKey (selectRefreshKey).
+    //
+    // 🔒 Keys are scoped to the ENDPOINT they were issued for. If this pull targets a
+    // DIFFERENT cloud URL than the stored one, DROP the old-endpoint keys instead of merging
+    // — otherwise the sync loop would POST keys issued for endpoint A to endpoint B, letting
+    // a malicious/custom endpoint harvest prior auth keys (key exfiltration). Same endpoint →
+    // accumulate (multi-key fleet on one cloud).
+    // An ABSENT prior url = the implicit DEFAULT endpoint — treat it as DEFAULT_CLOUD.url so a
+    // legacy/default config (has keys, no explicit url) pulling from a custom `--url` is detected
+    // as an endpoint change and its old-endpoint keys are dropped (not merged onto the new URL).
+    const endpointChanged = (c.cloud?.url || DEFAULT_CLOUD.url) !== cloud.url;
+    c.cloud = {
+      ...(c.cloud || {}),
+      url: cloud.url, anonKey: cloud.anonKey, pullKey: key,
+      pullKeys: endpointChanged
+        ? { [keySource(key)]: key }
+        : { ...(c.cloud?.pullKeys || {}), [keySource(key)]: key },
+    };
+    // The owner session (JWT) is endpoint-scoped too — drop it on an endpoint change so the
+    // auto-push/refresh loops can't send the OLD endpoint's owner JWT (and account tokens) to
+    // the NEW (possibly attacker) URL.
+    if (endpointChanged) delete c.cloud.session;
   });
   const s = updated._pullSummary || { added: 0, updated: 0, skipped: 0, removed: 0 };
   await atomicConfigUpdate(c => { delete c._pullSummary; });
+  // Apply to a RUNNING proxy NOW: without this the live server keeps stale config until
+  // its next sync tick — and a server that started WITHOUT a key never had a sync/recovery
+  // loop to pick this pull up at all (it would retain errored cloud-managed accounts until
+  // a restart). onReload → syncAccountsFromDisk mirrors the new pullKeys and re-probes
+  // errored cloud-managed accounts with the freshly-authorized key.
+  await noteRunningServerReload(config).catch(() => {});
   const removedNote = s.removed ? `, ${s.removed} removed (revoked from group)` : '';
   console.log(`Pulled ${pulled.length} allowed account(s): +${s.added} added, ${s.updated} updated, ${s.skipped} kept-local (fresher)${removedNote}.`);
-  console.log('A running `teamclaude server` will keep this in sync automatically (token/group changes + key revocation apply live).');
+  console.log('A running `teamclaude server` picks this up immediately (token/group changes + key revocation apply live).');
 }
 
 /** Resolve a group by name or id against the cloud's group list. */