troxy-cli 1.16.0 → 1.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Control layer for AI agents: check payments, emails, logins and destructive actions against your policies",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/mcp-server.js

@@ -51,7 +51,18 @@ export async function runMcp() {
         // its own is the agent's own prediction, and the dashboard labels every
         // agent that never reports back as unverified, so the instruction has
         // to make the second call as non-optional as the first.
-        'You MUST also call the evaluate_model tool when you begin a substantial task and whenever you switch model or effort level partway through it, giving the exact model id and how many tokens you expect to use. Do not run the task without first receiving an ALLOW or NOTIFY decision; if BLOCK, pick a cheaper or smaller model and call evaluate_model again with the new id. Then, when the task finishes, you MUST call report_model_usage with the audit_id from that decision and the real token total from your model API. Both halves are required: without the second call Troxy has only your prediction, and the account owner is shown that this agent\'s costs are unverified. Report the true number even when it is far above your estimate.',
+        //
+        // The previous wording gated this on whether the task felt big
+        // enough, which was a judgment call, not a rule. Driven live: the
+        // same agent, same session, called evaluate_model to review two
+        // source files, then minutes later pulled real data from an actual
+        // connected business (orders, customer messages, an artifact) and
+        // called nothing. Both were real work by any reasonable reading. The
+        // old wording meant whatever the model felt like in the moment, and
+        // Token Optimization is supposed to be a precise record, not a mood.
+        // The trigger below is mechanical instead: did this turn use a tool,
+        // yes or no. That is a fact you can check, not a judgment you make.
+        'You MUST also call the evaluate_model tool at the start of ANY turn where you will use one or more tools of any kind — reading or writing a file, running a command, browsing, calling an external API, anything beyond a plain text reply — and whenever you switch model or effort level partway through the turn. This is not a judgment call about how the turn feels: if you are about to use a tool, call evaluate_model first, every time, regardless of how small the turn seems. A turn that is pure conversation with no tool use at all is the only kind that does not need it. Give the exact model id and how many tokens you expect to use. Do not use any tool without first receiving an ALLOW or NOTIFY decision; if BLOCK, pick a cheaper or smaller model and call evaluate_model again with the new id. Then, at the end of that same turn, you MUST call report_model_usage with the audit_id from that decision and the real token total from your model API. Both halves are required: without the second call Troxy has only your prediction, and the account owner is shown that this agent\'s costs are unverified. Report the true number even when it is far above your estimate.',
     },
     { capabilities: { tools: {} } },
   );
@@ -268,8 +279,9 @@ export async function runMcp() {
         description:
           'Evaluate whether running a task on a given AI model should be allowed, blocked, or escalated ' +
           'based on your Troxy policies, and record what it is expected to cost. ' +
-          'Call this when you start a task and whenever you switch model or effort level mid-task. ' +
-          'Returns an audit_id. Keep it: you must pass it to report_model_usage when the task finishes.',
+          'Call this at the start of any turn where you will use a tool of any kind, and whenever you switch model or effort level mid-turn. ' +
+          'This is mechanical, not a judgment call: tool use in this turn means call it, no tool use means you can skip it. ' +
+          'Returns an audit_id. Keep it: you must pass it to report_model_usage at the end of the turn.',
         inputSchema: {
           type: 'object',
           required: ['model'],
@@ -309,8 +321,8 @@ export async function runMcp() {
       {
         name: 'report_model_usage',
         description:
-          'Report how many tokens a task ACTUALLY used, once it has finished. ' +
-          'Call this after every ALLOW or NOTIFY from evaluate_model, using the audit_id it returned. ' +
+          'Report how many tokens the turn ACTUALLY used, once it has finished. ' +
+          'Call this after every ALLOW or NOTIFY from evaluate_model, using the audit_id it returned — no judgment call, every approved evaluate_model gets a matching report. ' +
           'Without it Troxy only has your prediction, and the account owner is told, per agent, that its figures are unverified. ' +
           'Report the real number even when it is far above what you estimated: the gap is the point.',
         inputSchema: {
@@ -489,7 +501,7 @@ export async function runMcp() {
       // Every non-blocked branch repeats the audit_id and the instruction to
       // report back. Half the value of this checkpoint is the second call, and
       // an agent that is only told "approved" has no reason to make it.
-      const followUp = ` When the task finishes, call report_model_usage(audit_id="${audit_id}", actual_tokens=<real total>).`;
+      const followUp = ` When this turn finishes, call report_model_usage(audit_id="${audit_id}", actual_tokens=<real total>).`;
       let modelText;
       switch (decision) {
         case 'ALLOW':

package/src/tests/model-checkpoint.test.js

@@ -132,3 +132,37 @@ test('the version is read from package.json, not hardcoded', () => {
     'CLI_VERSION is not derived from package.json',
   );
 });
+
+test('the checkpoint trigger is mechanical, not a judgment call', () => {
+  // "When you begin a substantial task" was tried first and driven live: the
+  // same agent, same session, called evaluate_model to review two source
+  // files, then minutes later pulled real data from an actual connected
+  // business (orders, customer messages, an artifact) and called nothing.
+  // Both were real work. "Substantial" meant whatever the model felt like in
+  // the moment, which is not what a precise cost record can be built on.
+  // Sliced from the opening quote of the instructions STRING, not the
+  // instructions: field or file start, so the explanatory code comment
+  // above it (which deliberately quotes the retired word for context) does
+  // not trip this check.
+  const instructions = src.slice(src.indexOf("'You are connected to Troxy"), src.indexOf('capabilities'));
+  assert.ok(
+    !/substantial/i.test(instructions),
+    'the instructions still gate the checkpoint on "substantial", a judgment '
+    + 'call proven inconsistent on the same agent in the same session',
+  );
+  assert.ok(
+    /tool/i.test(instructions) && /every time/i.test(instructions),
+    'the instructions do not state a mechanical, checkable trigger (tool use) '
+    + 'to replace the judgment call that was removed',
+  );
+});
+
+test('evaluate_model\'s own tool description matches the mechanical trigger', () => {
+  // The top-level instructions are what an agent reads once; the tool
+  // description is what it sees every time it considers calling this
+  // specific tool. Both have to agree, or whichever one it reads last wins.
+  const schema = src.slice(src.indexOf("name: 'evaluate_model'"));
+  const desc = schema.slice(0, schema.indexOf('inputSchema'));
+  assert.ok(!/substantial/i.test(desc), 'the tool description still says "substantial"');
+  assert.ok(/tool/i.test(desc), 'the tool description does not mention the tool-use trigger');
+});