troxy-cli 1.11.1 → 1.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Control layer for AI agents: check payments, emails, logins and destructive actions against your policies",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/api.js

@@ -75,6 +75,7 @@ export const api = {
   evaluateLogin: (body, apiKey) => request('POST', '/evaluate/login', { apiKey, body }),
   evaluateAction: (body, apiKey) => request('POST', '/evaluate/action', { apiKey, body }),
   selfRevoke: (apiKey) => request('POST', '/mcp/self-revoke', { apiKey }),
+  revokeAllOthers: (apiKey) => request('POST', '/mcp/revoke-all-others', { apiKey }),
   confirmPayment: (auditId, body, apiKey) => request('POST', `/payments/${auditId}/confirm`, { apiKey, body }),
   waitApprovalStatus: (token) => request('GET', `/approvals/${encodeURIComponent(token)}/wait`),
 

package/src/uninstall.js

@@ -87,12 +87,15 @@ function removeMcpEntries() {
 export async function runUninstall() {
   console.log('\n  Troxy: Uninstall\n');
 
-  const answer = await prompt('  This will remove Troxy from this machine. Continue? (y/N): ');
+  const answer = await prompt('  This will remove Troxy from this machine and revoke ALL your agent keys. Continue? (y/N): ');
   if (answer.toLowerCase() !== 'y') {
     console.log('\n  Cancelled.\n');
     process.exit(0);
   }
 
+  const cfg = loadConfig();
+  const apiKey = cfg?.apiKey;
+
   // 1. Stop and remove background service
   process.stdout.write('  Stopping background service...  ');
   const removed = removeService();
@@ -108,24 +111,45 @@ export async function runUninstall() {
     console.log('none found');
   }
 
-  // 3. Revoke the API key. /mcp/self-revoke only lets a key revoke the exact
-  // token it authenticates as — it can't touch or list any other token — so
-  // this doesn't need a login/JWT, the key on disk is enough.
-  const cfg = loadConfig();
-  if (cfg?.apiKey) {
-    const prefix = cfg.apiKey.slice(0, 12) + '...';
-    process.stdout.write(`  Revoking API key ${prefix}...  `);
+  // 3. Revoke all OTHER agent keys (cloud agents, other machines) using the
+  // local API key for auth — no troxy login needed. The key proves identity
+  // to the server, and /mcp/revoke-all-others kills every other active token
+  // for the same user. We do this BEFORE self-revoke so the key is still valid
+  // to make the call.
+  if (apiKey) {
+    process.stdout.write('  Revoking other agents...         ');
+    try {
+      const result = await api.revokeAllOthers(apiKey);
+      if (result.count > 0) {
+        console.log(`✓  (${result.count} agent${result.count > 1 ? 's' : ''})`);
+        for (const a of result.revoked) {
+          const conn = a.connection_type || 'local';
+          console.log(`    • ${a.name}  (${conn})`);
+        }
+      } else {
+        console.log('✓  (none found)');
+      }
+    } catch (err) {
+      console.log('✗');
+      console.log(`     Couldn't revoke other agents (${err.message}).`);
+      console.log('     Go to dash.troxy.io → API Keys to revoke them manually.\n');
+    }
+
+    // 4. Revoke THIS machine's API key (self-revoke). Done after revoke-all-others
+    // because self-revoke kills the key we're using to authenticate.
+    const prefix = apiKey.slice(0, 12) + '...';
+    process.stdout.write(`  Revoking local API key ${prefix}...  `);
     try {
-      await api.selfRevoke(cfg.apiKey);
+      await api.selfRevoke(apiKey);
       console.log('✓');
     } catch (err) {
       console.log('✗');
       console.log(`     Couldn't revoke automatically (${err.message}).`);
-      console.log('     Go to dash.troxy.io → Settings → API Keys to revoke it.\n');
+      console.log('     Go to dash.troxy.io → API Keys to revoke it.\n');
     }
   }
 
-  // 4. Delete ~/.troxy config
+  // 5. Delete ~/.troxy config
   process.stdout.write('  Removing config (~/.troxy)...  ');
   const configDir = path.join(os.homedir(), '.troxy');
   if (fs.existsSync(configDir)) {
@@ -135,7 +159,7 @@ export async function runUninstall() {
     console.log('not found');
   }
 
-  // 5. Remove npm package
+  // 6. Remove npm package
   process.stdout.write('  Uninstalling troxy CLI...      ');
   try {
     execSync('npm uninstall -g troxy-cli 2>/dev/null || npm uninstall -g troxy 2>/dev/null', { stdio: 'pipe' });
@@ -144,5 +168,5 @@ export async function runUninstall() {
     console.log('skipped (run manually: sudo npm uninstall -g troxy-cli)');
   }
 
-  console.log('\n  Troxy removed. Your payments are no longer protected by Troxy.\n');
+  console.log('\n  Troxy removed. All agent keys revoked. Your AI agents are no longer protected by Troxy.\n');
 }