troxy-cli 1.12.0 → 1.13.0

package/bin/troxy.js

@@ -116,10 +116,28 @@ switch (command) {
     const existing  = loadConfig() || {};
     const oldKey    = existing.apiKey;
     const oldPrefix = oldKey ? oldKey.substring(0, 11) : null;
-    const name = flags.name || null; // keep existing name if not specified
+    // Find the key being replaced BEFORE creating its successor: we need both
+    // its agent and its name.
+    const { tokens: existingTokens = [] } = await api.listTokens(jwt);
+    const currentToken = oldPrefix ? existingTokens.find(t => t.prefix === oldPrefix) : null;
+
+    // Rotation must keep the agent. Troxy issues an agent id when a key is
+    // created, and a key with no agent_id gets a brand NEW agent, which is
+    // right for `troxy init` and exactly wrong here: rotating would orphan
+    // every decision, policy and recommendation the agent had built up. That
+    // is the one case this whole identity model exists to serve.
+    const agentId = currentToken && currentToken.agent_id ? currentToken.agent_id : null;
+
+    // Keep the name too. Defaulting to 'Rotated key' renamed the agent on
+    // every rotation, so even before agent ids existed you lost your history
+    // and ended up with an agent literally called "Rotated key".
+    const name = flags.name || (currentToken && currentToken.name) || null;
 
     process.stdout.write('\n  Creating new key... ');
-    const result    = await api.createToken(jwt, { name: name || 'Rotated key' });
+    const result    = await api.createToken(jwt, {
+      name,
+      ...(agentId ? { agent_id: agentId } : {}),
+    });
     const newKey    = result.key;
     const newPrefix = result.prefix;
     console.log('✓');
@@ -136,9 +154,7 @@ switch (command) {
 
     if (oldPrefix) {
       process.stdout.write(`\n  Revoking old key ${oldPrefix}... `);
-      const { tokens = [] } = await api.listTokens(jwt);
-      const old = tokens.find(t => t.prefix === oldPrefix);
-      if (old) { await api.revokeToken(jwt, old.id); console.log('✓'); }
+      if (currentToken) { await api.revokeToken(jwt, currentToken.id); console.log('✓'); }
       else console.log('(already revoked)');
     }
 
@@ -146,6 +162,7 @@ switch (command) {
   Key rotated:
     Old:  ${oldPrefix ? oldPrefix + '... (revoked)' : '(none)'}
     New:  ${newPrefix}...
+    Agent: ${agentId ? `${name || 'unchanged'} (history and policies kept)` : 'new agent (no previous key found to carry over)'}
 
   New key (shown once, save it now):
     ${newKey}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Control layer for AI agents: check payments, emails, logins and destructive actions against your policies",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/tests/rotate-key.test.js

@@ -0,0 +1,80 @@
+/**
+ * `troxy rotate-key` must keep the agent.
+ *
+ * Troxy issues an agent id when a key is created, and a request with no
+ * agent_id deliberately gets a brand NEW agent. That is right for `troxy init`
+ * and exactly wrong for rotation: it orphans every decision, policy and
+ * recommendation the agent had accumulated, which is the one case the identity
+ * model exists to serve.
+ *
+ * It also has to keep the name. Defaulting to 'Rotated key' renamed the agent
+ * on every rotation, so even before agent ids existed you lost your history and
+ * ended up with an agent called "Rotated key".
+ *
+ * These assert on the request body the command builds, because that body is
+ * the entire contract with the server.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SRC = readFileSync(join(__dirname, '../../bin/troxy.js'), 'utf8');
+
+// The rotate-key case, isolated from the rest of the dispatcher.
+const ROTATE = SRC.slice(
+  SRC.indexOf("case 'rotate-key'"),
+  SRC.indexOf("case 'mcp'", SRC.indexOf("case 'rotate-key'")),
+);
+
+// Comments stripped, so a test that bans a string does not trip over the
+// comment explaining why the string is banned.
+const ROTATE_CODE = ROTATE
+  .replace(/\/\*[\s\S]*?\*\//g, '')
+  .replace(/^\s*\/\/.*$/gm, '');
+
+test('rotate-key sends the existing agent_id so the agent survives', () => {
+  assert.ok(
+    /agent_id:\s*agentId/.test(ROTATE),
+    'rotate-key must pass agent_id; without it the server mints a new agent and the old history is orphaned',
+  );
+  assert.ok(
+    /currentToken\s*&&\s*currentToken\.agent_id/.test(ROTATE),
+    'agent_id must come from the key being replaced, looked up by its prefix',
+  );
+});
+
+test('rotate-key no longer renames the agent to "Rotated key"', () => {
+  assert.ok(
+    !/['"]Rotated key['"]/.test(ROTATE_CODE),
+    'defaulting the name to "Rotated key" renames the agent on every rotation',
+  );
+  assert.ok(
+    /flags\.name\s*\|\|\s*\(currentToken && currentToken\.name\)/.test(ROTATE),
+    'rotation must keep the current name unless --name overrides it',
+  );
+});
+
+test('rotate-key looks the token up once, before creating its replacement', () => {
+  const listCalls = (ROTATE.match(/api\.listTokens\(/g) || []).length;
+  assert.strictEqual(
+    listCalls, 1,
+    `expected exactly one listTokens call, found ${listCalls}: the lookup has to happen before createToken so the agent id is known, and repeating it is a second round-trip for data already held`,
+  );
+  assert.ok(
+    ROTATE.indexOf('api.listTokens(') < ROTATE.indexOf('api.createToken('),
+    'the token must be resolved before the new key is created',
+  );
+});
+
+test('rotate-key still revokes the old key after re-pointing consumers', () => {
+  const reprovision = ROTATE.indexOf('reprovisionKeyConsumers(');
+  const revoke = ROTATE.indexOf('api.revokeToken(');
+  assert.ok(reprovision > -1 && revoke > -1, 'both steps must still be present');
+  assert.ok(
+    reprovision < revoke,
+    'consumers are re-pointed before the old key is revoked, otherwise every consumer keeps presenting a revoked key and control goes down',
+  );
+});