troxy-cli 1.21.1 → 1.22.0

package/src/init.js

@@ -302,6 +302,17 @@ export async function runInit({ key, name } = {}) {
 
   await reprovisionKeyConsumers(key, agentName);
 
+  // Scan for local AI coding tools and (interactively) confirm the plan for
+  // each, so the dashboard shows real subscription cost, not token math.
+  // Non-fatal + TTY-gated inside runToolDetection - a scripted init never
+  // hangs and a scan failure never breaks setup.
+  try {
+    const { runToolDetection } = await import('./tool_detect.js');
+    await runToolDetection(key, { interactive: true });
+  } catch {
+    // Tool detection is a bonus, never a blocker for a successful init.
+  }
+
   console.log('\n  Your payments are now protected.');
   console.log('  Dashboard → https://dash.troxy.io');
   console.log('\n  For more information, visit https://docs.troxy.io\n');

package/src/mcp-server.js

@@ -12,6 +12,13 @@ const evaluateLogin   = (body, apiKey) => api.evaluateLogin(body, apiKey);
 const evaluateAction  = (body, apiKey) => api.evaluateAction(body, apiKey);
 const evaluateModel   = (body, apiKey) => api.evaluateModel(body, apiKey);
 const reportModelUsage = (body, apiKey) => api.reportModelUsage(body, apiKey);
+// Was missing entirely until 2026-08-15: every other checkpoint had an MCP
+// tool, this one did not, so no MCP-connected agent could ever call
+// /evaluate/secrets - not "the agent chose not to," there was nothing to
+// call. evaluate.py's other_checkpoints discovery (every response advertises
+// the other five) does mention it, but as a raw HTTP URL; useless to an
+// agent whose only way to reach Troxy is through the tools listed here.
+const evaluateSecrets = (body, apiKey) => api.evaluateSecrets(body, apiKey);
 
 export async function runMcp() {
   const config    = loadConfig();
@@ -374,6 +381,48 @@ export async function runMcp() {
           },
         },
       },
+      {
+        name: 'evaluate_secrets',
+        description:
+          'Evaluate whether content you are about to send, write, or publish should be allowed, blocked, or ' +
+          'escalated based on your Troxy policies. Troxy scans the content server-side for API keys, credit ' +
+          'card numbers, passwords, private keys, tokens, and personally identifiable information - you do ' +
+          'not pre-classify it yourself. Call this BEFORE you share a file, send a message, push code, upload ' +
+          'data, or write content to any external destination - anything that leaves the current context. ' +
+          'If you are unsure whether something counts as sensitive, call this anyway.',
+        inputSchema: {
+          type: 'object',
+          required: ['content'],
+          properties: {
+            content: {
+              type: 'string',
+              description: 'The text, code, or data you are about to send or write.',
+            },
+            destination: {
+              type: 'string',
+              description: 'Where it is going: a person, a repo, a channel, a service, or "public" if anyone can see it.',
+            },
+            action: {
+              type: 'string',
+              enum: ['send', 'push', 'upload', 'write', 'share'],
+              description: 'What you are doing with it.',
+            },
+            content_type: {
+              type: 'string',
+              enum: ['code', 'message', 'file', 'config', 'log', 'other'],
+              description: 'What it is.',
+            },
+            agent: {
+              type: 'string',
+              description: 'Name of the agent (optional).',
+            },
+            approval_token: {
+              type: 'string',
+              description: 'Approval token from a previous ESCALATE response. Include this to proceed after the user has approved.',
+            },
+          },
+        },
+      },
     ],
   }));
 
@@ -608,6 +657,38 @@ export async function runMcp() {
       };
     }
 
+    if (toolName === 'evaluate_secrets') {
+      if (agentName && !args.agent) args.agent = agentName;
+      let result;
+      try {
+        result = await evaluateSecrets(args, apiKey);
+      } catch (err) {
+        return { content: [{ type: 'text', text: `Troxy error: ${err.message}` }], isError: true };
+      }
+      if (result.error) {
+        return { content: [{ type: 'text', text: `Troxy error: ${result.error}` }], isError: true };
+      }
+      const { decision, reason, audit_id, approval_token, detections } = result;
+      const found = (detections || []).map(d => d.type).join(', ');
+      const detail = found ? ` Found: ${found}.` : '';
+      let secretsText;
+      switch (decision) {
+        case 'ALLOW':
+        case 'NOTIFY':
+          secretsText = `✓ Approved.${reason ? ` ${reason}` : ''}${detail} You may proceed. (audit: ${audit_id})`;
+          break;
+        case 'BLOCK':
+          secretsText = `✗ Blocked.${reason ? ` ${reason}` : ''}${detail} Do not send, write, or publish this content as-is. (audit: ${audit_id})`;
+          break;
+        case 'ESCALATE':
+          secretsText = `⏳ This requires human approval; a request has been sent to the account owner.${detail}\n\nApproval token: ${approval_token}\n\nNow call wait_for_approval(approval_token="${approval_token}") to automatically detect approval, then call evaluate_secrets again with the same arguments PLUS this approval_token. Do not proceed until it returns approved.`;
+          break;
+        default:
+          secretsText = JSON.stringify(result);
+      }
+      return { content: [{ type: 'text', text: secretsText }], isError: decision === 'BLOCK' };
+    }
+
     if (toolName !== 'evaluate_payment') {
       throw new Error(`Unknown tool: ${toolName}`);
     }

package/src/policies.js

@@ -1,39 +1,75 @@
 import readline               from 'readline';
+import { readFileSync }      from 'node:fs';
+import { fileURLToPath }     from 'node:url';
+import { dirname, join }     from 'node:path';
 import { api }               from './api.js';
 import { requireJwt } from './auth.js';
 import { table }             from './print.js';
 import { localTokenPrefix }  from './config.js';
+import { DOMAINS, DOMAIN_FIELDS, FIELD_SPECS, normalizeDomain, inferDomain, validateCondition } from './policy-fields.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const { templates: TEMPLATES } = JSON.parse(readFileSync(join(__dirname, 'data', 'templates.json'), 'utf8'));
 
 const DECISION_ICON = { ALLOW: '✓', BLOCK: '✗', ESCALATE: '⏳', NOTIFY: '~', TIERED: '⊕' };
 
+// The top-level `action` a policy is stored with is stale for essentially
+// every policy the dashboard's drawer builds - it defaults to ESCALATE and is
+// never updated once a policy is built branch-by-branch, which is how the
+// Rules section builds every one of them. `effective_action` is the server's
+// resolved value (added alongside the raw column, never replacing it - see
+// policies.py's _effective_action). Falling back to `p.action` here keeps
+// this CLI working against a server that hasn't deployed the field yet.
+export function _displayAction(p) {
+  return p.effective_action || p.action;
+}
+
 function _promptYN(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise(resolve => rl.question(question, ans => { rl.close(); resolve(ans.trim().toLowerCase() === 'y'); }));
 }
 
 const HELP = {
-  list:         `  troxy policies list\n\n  Lists all policies in your account with their action, scope, status, and conditions.\n`,
-  describe:     `  troxy policies describe --name <policy-name>\n\n  Shows full details for a single policy.\n\n  Options:\n    --name   Name of the policy (use single quotes for names with special chars)\n`,
-  create:       `  troxy policies create --name <name> --action <action> [options]\n  troxy policies create --describe "<plain English>"\n\n  Creates a new policy. Login required.\n\n  AI builder:\n    --describe "<text>"   Describe the policy in plain English (e.g. "block\n                          Amazon purchases over $200") and Troxy AI drafts\n                          it for you to confirm. Rate-limited per day.\n\n  Manual (required):\n    --name     Policy name\n    --action   ALLOW, BLOCK, NOTIFY, or ESCALATE\n\n  Manual (optional conditions):\n    --field      Field to match: amount, merchant_name, tx_per_day\n    --operator   eq, neq, gt, gte, lt, lte, contains, starts_with, not_contains, between\n    --value      Comparison value (e.g. 500, amazon)\n    --value2     Upper bound for 'between' operator\n\n  Priority:\n    --priority <n>   Explicit priority number (default: auto, max+10)\n                     Lower number = higher priority (evaluated first).\n\n  Scope (default: all agents, every MCP plus Troxy Chat):\n    --mcp <name>       Scope to one or more MCPs (comma-separated).\n                       Run 'troxy mcps list' to see MCP names.\n    --chat             Include Troxy Chat. Implied by default; combine with\n                       --mcp to scope to specific MCPs *and* chat, or use\n                       alone to scope to Troxy Chat only (no MCPs).\n    --no-chat          Exclude Troxy Chat from this policy's scope.\n\n  Examples:\n    troxy policies create --describe "block Amazon purchases over $200"\n    troxy policies create --name "Block large" --action BLOCK --field amount --operator gte --value 500\n    troxy policies create --name "Block Amazon" --action BLOCK --field merchant_name --operator contains --value amazon\n    troxy policies create --name "Cap volume" --action BLOCK --field tx_per_day --operator gt --value 20\n    troxy policies create --name "Allow Wiki" --action ALLOW --priority 5 --field merchant_name --operator contains --value Wiki\n    troxy policies create --name "Laptop only" --action BLOCK --mcp "My Laptop" --field amount --operator gte --value 100\n    troxy policies create --name "Multi-agent" --action BLOCK --mcp "My Laptop,Server" --field amount --operator gte --value 100\n    troxy policies create --name "Chat only" --action ESCALATE --chat --field amount --operator gte --value 200\n    troxy policies create --name "MCPs, no chat" --action BLOCK --no-chat --field merchant_name --operator contains --value casino\n`,
-  'set-priority': `  troxy policies set-priority --name <policy-name> --priority <n>\n\n  Changes the priority of a policy. Lower number = higher priority (evaluated first).\n\n  Options:\n    --name       Name of the policy\n    --priority   New priority number (e.g. 10, 20, 50)\n\n  Example:\n    troxy policies set-priority --name "Block Wiki" --priority 5\n`,
-  resume:       `  troxy policies resume --name <policy-name>\n\n  Resumes a paused policy.\n\n  Options:\n    --name   Name of the policy to resume\n`,
-  pause:        `  troxy policies pause --name <policy-name>\n\n  Pauses a policy without deleting it. The policy stops firing until you resume it.\n\n  Options:\n    --name   Name of the policy to pause\n`,
-  delete:       `  troxy policies delete --name <policy-name>\n\n  Permanently deletes a policy.\n\n  Options:\n    --name   Name of the policy to delete\n`,
+  list: `  troxy policies list [--org]\n\n  Lists policies. --org lists your organization's policies (any member can read them) instead of your personal ones.\n`,
+  describe: `  troxy policies describe --name <policy-name> [--org]\n\n  Shows full details for a single policy.\n\n  Options:\n    --name   Name of the policy (use single quotes for names with special chars)\n    --org    Look up an org policy instead of a personal one\n`,
+  create: `  troxy policies create --name <name> --action <action> --domain <domain> [options]\n  troxy policies create --name <name> --action <action> --template "<template label>"\n  troxy policies create --describe "<plain English>"\n\n  Creates a new policy. Login required.\n\n  Checkpoints (--domain), one per Troxy checkpoint - what the policy is about:\n    payment       paying, buying, sending money            (/evaluate)\n    comms         messages on any channel (email, Slack...) (/evaluate/email)\n    access        logging in or signing up on a site        (/evaluate/login)\n    destructive   deletes, exports, permission/access changes, other consequential actions (/evaluate/action)\n    model         the agent's own model, tokens, cost       (/evaluate/model)\n    secrets       content scanned for secrets before it leaves (/evaluate/secrets)\n\n  Run 'troxy policies fields --domain <domain>' to see the exact fields and\n  operators each checkpoint supports - the same table the server checks\n  against, so nothing here can drift from what actually fires.\n\n  From a template (fastest, matches the dashboard's own template library):\n    --template "<label>"   Exact template label - run 'troxy policies templates' to list them\n    --value / --value2     Override the template's default threshold (only when it has exactly one condition)\n    --action                Override the template's default action\n\n  Manual, single condition:\n    --domain     Required whenever --field is given, unless --field is one of\n                 the original payment fields (amount, merchant_name, tx_per_day),\n                 which still default to --domain payment for old scripts.\n    --field      Field to match - see 'troxy policies fields --domain <domain>'\n    --operator   eq, neq, gt, gte, lt, lte, contains, starts_with, not_contains, between\n    --value      Comparison value\n    --value2     Upper bound for 'between'\n\n  Manual, multiple conditions:\n    --and "field=X,operator=Y,value=Z"   Repeatable. ANDs onto the single --field condition (if any).\n    --or  "field=X,operator=Y,value=Z"   Repeatable. Each becomes its own alternative branch (any\n                                         --and conditions apply to every branch); all branches share --action.\n\n  Raw (full expressiveness, for scripting):\n    --json '<JSON>'   {\"conditions\": [...], \"or_conditions\": [...]} exactly as the API expects.\n                       Cannot be combined with --field/--and/--or/--template.\n\n  AI builder (needs an org AI key; --domain payment or comms only - the other four\n  checkpoints aren't covered by this endpoint yet, use --template or a manual condition):\n    --describe "<text>"   Describe the policy in plain English and Troxy AI drafts it for you to confirm.\n    --domain              payment (default) or comms - which allowlist the AI drafts against.\n\n  Priority:\n    --priority <n>   Explicit priority number (default: auto, max+10). Lower = evaluated first.\n\n  Scope (personal policies only; default: all agents, every MCP plus Troxy Chat):\n    --mcp <name>   Scope to one or more MCPs (comma-separated). Run 'troxy mcps list' for names.\n    --chat         Include Troxy Chat. Implied by default; combine with --mcp for MCPs *and* chat.\n    --no-chat      Exclude Troxy Chat.\n\n  Org policies (applies to every member; requires admin):\n    --org   Create an org-wide policy instead of a personal one. No --mcp/--chat scoping - it's org-wide.\n\n  Examples:\n    troxy policies create --name "Block a secret going public" --template "Block a secret going somewhere public"\n    troxy policies create --name "Cap over 100" --action BLOCK --domain payment --field amount --operator gt --value 100\n    troxy policies create --name "Signups" --action ESCALATE --domain access --field login_action --operator eq --value signup\n    troxy policies create --name "Big exports" --action BLOCK --domain destructive --field action_verb --operator eq --value export --and "field=resource,operator=contains,value=customer"\n    troxy policies create --name "Personal domains" --action BLOCK --domain comms --or "field=recipient_domain,operator=contains,value=gmail.com" --or "field=recipient_domain,operator=contains,value=yahoo.com"\n    troxy policies create --name "Lock down secrets" --action BLOCK --domain secrets --field has_api_key --operator eq --value true --org\n`,
+  fields: `  troxy policies fields [--domain <domain>]\n\n  Lists the fields, operators and allowed values each checkpoint actually supports -\n  the same table the server validates against, so this can never offer something\n  that saves and then never fires. Omit --domain to see all six.\n`,
+  templates: `  troxy policies templates [--category "<name>"] [--search "<text>"]\n\n  Lists the built-in policy templates (the same ones on the dashboard's\n  Policies page). Use a template's exact label with 'policies create --template'.\n`,
+  test: `  troxy policies test --domain <domain> --example '<JSON>' [condition flags]\n\n  Dry-runs a condition against an example event - the same "would this rule\n  fire?" check the dashboard's policy drawer offers, without saving anything.\n  Nothing is written: no audit row, no notification, no pending approval.\n\n  Takes the same condition flags as 'create' (--field/--operator/--value/--and/--or/--json/--template),\n  plus:\n    --example '<JSON>'   The event to test against, shaped like what that checkpoint receives.\n                          e.g. --domain payment --example '{\"amount\": 150}'\n\n  Examples:\n    troxy policies test --domain payment --field amount --operator gt --value 100 --example '{"amount": 150}'\n    troxy policies test --domain secrets --field has_api_key --operator eq --value true --example '{"has_api_key": true}'\n`,
+  'set-priority': `  troxy policies set-priority --name <policy-name> --priority <n> [--org]\n\n  Changes the priority of a policy. Lower number = higher priority (evaluated first).\n\n  Options:\n    --name       Name of the policy\n    --priority   New priority number (e.g. 10, 20, 50)\n    --org        Target an org policy (requires admin)\n\n  Example:\n    troxy policies set-priority --name "Block Wiki" --priority 5\n`,
+  resume: `  troxy policies resume --name <policy-name> [--org]\n\n  Resumes a paused policy.\n\n  Options:\n    --name   Name of the policy to resume\n    --org    Target an org policy (requires admin)\n`,
+  pause: `  troxy policies pause --name <policy-name> [--org]\n\n  Pauses a policy without deleting it. The policy stops firing until you resume it.\n\n  Options:\n    --name   Name of the policy to pause\n    --org    Target an org policy (requires admin)\n`,
+  delete: `  troxy policies delete --name <policy-name> [--org]\n\n  Permanently deletes a policy.\n\n  Options:\n    --name   Name of the policy to delete\n    --org    Target an org policy (requires admin)\n`,
 };
 
-export async function runPolicies([sub, ...args], flags) {
+export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
   if (flags.help || flags.h) {
-    console.log('\n' + (HELP[sub] || `  troxy policies <subcommand> [options]\n\n  Subcommands:\n    list           List all policies\n    describe       Show details for a policy\n    create         Create a new policy\n    set-priority   Change a policy's priority\n    pause          Pause a policy (it stops firing until you resume it)\n    resume         Resume a paused policy\n    delete         Delete a policy\n\n  Run 'troxy policies <subcommand> --help' for subcommand help.\n`));
+    console.log('\n' + (HELP[sub] || `  troxy policies <subcommand> [options]\n\n  Subcommands:\n    list           List all policies\n    describe       Show details for a policy\n    create         Create a new policy\n    templates      List the built-in templates\n    fields         List the fields/operators each checkpoint supports\n    test           Dry-run a condition without saving it\n    set-priority   Change a policy's priority\n    pause          Pause a policy (it stops firing until you resume it)\n    resume         Resume a paused policy\n    delete         Delete a policy\n\n  Any personal-policy subcommand also takes --org, to act on your organization's policies instead (admin required to write).\n\n  Run 'troxy policies <subcommand> --help' for subcommand help.\n`));
     process.exit(0);
   }
 
+  // Local, no login and no network - just reads the vendored spec/template files.
+  if (sub === 'fields') { _printFields(flags); return; }
+  if (sub === 'templates') { _printTemplates(flags); return; }
+
   // Read-only subcommands work with a login session
-  const readOnly = !sub || sub === 'list' || sub === 'describe';
+  const readOnly = !sub || sub === 'list' || sub === 'describe' || sub === 'test';
 
   if (readOnly) {
     const jwt = requireJwt();
     switch (sub || 'list') {
       case 'list': {
+        if (flags.org) {
+          const org = await _resolveOrgContext(jwt, false);
+          const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+          if (!policies.length) { console.log(`\n  No org policies yet in ${org.name}.\n`); return; }
+          console.log(`\n  Organization: ${org.name}`);
+          table(
+            ['#', 'Name', 'Domain', 'Action', 'Status', 'Conditions'],
+            policies.map(p => [p.priority, p.name, p.domain, _displayAction(p), p.enabled ? 'active' : 'paused', _condSummary(p)]),
+          );
+          break;
+        }
         const data = await api.agentPolicies(jwt, localTokenPrefix());
         const policies = data?.policies || [];
         if (!policies.length) { console.log('\n  No policies yet.\n'); return; }
@@ -43,7 +79,7 @@ export async function runPolicies([sub, ...args], flags) {
           policies.map(p => [
             p.priority,
             p.name,
-            p.action,
+            _displayAction(p),
             p.scope,
             p.enabled ? 'active' : 'paused',
             _condSummary(p),
@@ -56,6 +92,23 @@ export async function runPolicies([sub, ...args], flags) {
       case 'describe': {
         const name = flags.name;
         if (!name) { console.error('  --name is required  (tip: use single quotes for names with special chars)\n'); process.exit(1); }
+        if (flags.org) {
+          const org = await _resolveOrgContext(jwt, false);
+          const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+          const p = policies.find(x => x.name.toLowerCase() === name.toLowerCase());
+          if (!p) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
+          console.log(`
+  Name:          ${p.name}
+  Domain:        ${p.domain}
+  Action:        ${_displayAction(p)}
+  Priority:      ${p.priority}
+  Status:        ${p.enabled ? 'active' : 'paused'}
+  Scope:         org-wide (${org.name})
+  Conditions:    ${_condDetail(p)}
+  Created:       ${new Date(p.created_at).toLocaleDateString()}
+`);
+          break;
+        }
         const data = await api.agentPolicies(jwt, localTokenPrefix());
         const p = (data?.policies || []).find(x => x.name.toLowerCase() === name.toLowerCase());
         if (!p) { console.error(`  Policy "${name}" not found\n`); process.exit(1); }
@@ -63,7 +116,7 @@ export async function runPolicies([sub, ...args], flags) {
         const mcpList = p.mcps.length ? p.mcps.map(m => m.name).join(', ') : (p.global ? 'all MCPs' : 'none');
         console.log(`
   Name:          ${p.name}
-  Action:        ${p.action}
+  Action:        ${_displayAction(p)}
   Priority:      ${p.priority}
   Status:        ${p.enabled ? 'active' : 'paused'}
   Scope:         ${p.scope}
@@ -75,6 +128,31 @@ export async function runPolicies([sub, ...args], flags) {
 `);
         break;
       }
+
+      case 'test': {
+        let example;
+        try { example = flags.example ? JSON.parse(flags.example) : {}; }
+        catch { console.error('  --example must be valid JSON, e.g. --example \'{"amount": 150}\'\n'); process.exit(1); }
+
+        const { domain, action, conditions, or_conditions } = _buildConditionsFromFlags(flags, multiFlags, { requireAction: false });
+        const result = await api.previewPolicy(jwt, { domain, action: action || 'ESCALATE', conditions, or_conditions, example });
+
+        if (result.would_fire) {
+          console.log(`\n  ${DECISION_ICON[result.decision] || '?'} Would fire: ${result.decision}`);
+        } else {
+          console.log(`\n  — Would NOT fire (falls through to the agent's own default action)`);
+        }
+        (result.branches || []).forEach((b, i) => {
+          console.log(`\n  Branch ${i + 1} (${b.action})${b.matched ? ' ✓ matched' : ''}`);
+          (b.conditions || []).forEach(c => {
+            const mark = c.matched ? '✓' : '✗';
+            const note = c.field_present_in_example === false ? '  (this field is not in --example - it reads as empty)' : '';
+            console.log(`    ${mark}  ${c.field} ${c.operator} ${c.value ?? ''}${note}`);
+          });
+        });
+        console.log();
+        break;
+      }
     }
     return;
   }
@@ -85,10 +163,22 @@ export async function runPolicies([sub, ...args], flags) {
   switch (sub) {
     case 'create': {
       if (flags.describe) {
+        if (flags.org) { console.error('\n  --describe (AI builder) does not support --org yet. Build the policy manually or apply a template.\n'); process.exit(1); }
+        // handle_ai_policy (the backend endpoint this hits) only knows two field
+        // allowlists, gated on a single is_email boolean - unlike the six-domain
+        // condition translator create's other paths use. Nothing here used to
+        // set it, so --describe silently ran every request through the payment
+        // allowlist regardless of what was actually described: an email policy
+        // would get its proposed fields dropped as "not allowed" one by one.
+        const describeDomain = flags.domain ? normalizeDomain(flags.domain) : 'payment';
+        if (!['payment', 'comms'].includes(describeDomain)) {
+          console.error(`\n  --describe only supports --domain payment or comms (the AI builder does not cover the other checkpoints yet - try --template or build the condition manually instead).\n`);
+          process.exit(1);
+        }
         process.stdout.write('\n  Asking Troxy AI to build this policy... ');
         const { tokens = [] } = await api.listTokens(jwt);
         const mcps = tokens.map(t => ({ id: t.id, name: t.name || t.agent_name || t.prefix }));
-        const draft = await api.aiPolicy(jwt, { text: flags.describe, mcps });
+        const draft = await api.aiPolicy(jwt, { text: flags.describe, mcps, is_email: describeDomain === 'comms' });
         if (draft.error) { console.log('✗'); console.error(`\n  ${draft.error}\n`); process.exit(1); }
         console.log('✓\n');
         console.log(`  Name:       ${draft.name}`);
@@ -114,36 +204,19 @@ export async function runPolicies([sub, ...args], flags) {
       }
 
       const name   = flags.name;
-      const action = (flags.action || '').toUpperCase();
-      if (!name)   { console.error('  --name is required\n');   process.exit(1); }
-      if (!action) { console.error('  --action is required\n'); process.exit(1); }
-      if (!['ALLOW','BLOCK','ESCALATE','NOTIFY'].includes(action)) {
-        console.error('  --action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n');
-        process.exit(1);
-      }
-      const VALID_FIELDS = ['amount', 'merchant_name', 'tx_per_day'];
-      const FIELD_OPERATORS = {
-        amount:        ['lt', 'lte', 'gt', 'gte', 'eq', 'between'],
-        merchant_name: ['eq', 'neq', 'contains', 'not_contains', 'starts_with'],
-        tx_per_day:    ['lt', 'lte', 'gt', 'gte'],
-      };
-      const conditions = [];
-      if (flags.field) {
-        if (!VALID_FIELDS.includes(flags.field)) {
-          console.error(`  --field must be one of: ${VALID_FIELDS.join(', ')}\n`); process.exit(1);
-        }
-        if (!flags.operator) { console.error('  --operator is required with --field\n'); process.exit(1); }
-        const validOps = FIELD_OPERATORS[flags.field];
-        if (!validOps.includes(flags.operator)) {
-          console.error(`  --operator for ${flags.field} must be one of: ${validOps.join(', ')}\n`); process.exit(1);
-        }
-        if (flags.value == null) { console.error('  --value is required with --field\n'); process.exit(1); }
-        if (flags.operator === 'between' && flags.value2 == null) {
-          console.error('  --value2 is required with --operator between\n'); process.exit(1);
-        }
-        const cond = { field: flags.field, operator: flags.operator, value: flags.value };
-        if (flags.value2 != null) cond.value2 = flags.value2;
-        conditions.push(cond);
+      if (!name) { console.error('  --name is required\n'); process.exit(1); }
+
+      const { domain, action, conditions, or_conditions } = _buildConditionsFromFlags(flags, multiFlags, { requireAction: true });
+
+      if (flags.org) {
+        const org = await _resolveOrgContext(jwt, true);
+        const priority = flags.priority != null ? parseInt(flags.priority, 10) : undefined;
+        if (flags.priority != null && isNaN(priority)) { console.error('  --priority must be a number\n'); process.exit(1); }
+        const body = { name, action, domain, conditions, or_conditions, enabled: true };
+        if (priority != null) body.priority = priority;
+        const policy = await api.createOrgPolicy(jwt, org.id, body);
+        console.log(`\n  Org policy "${policy.name}" created ✓  (priority: ${policy.priority}, applies to every member of ${org.name})\n`);
+        break;
       }
 
       if (flags.chat && flags['no-chat']) {
@@ -189,7 +262,7 @@ export async function runPolicies([sub, ...args], flags) {
       if (flags.priority != null && isNaN(priority)) {
         console.error('  --priority must be a number\n'); process.exit(1);
       }
-      const body = { name, action, conditions, enabled: true, global: isGlobal, mcp_ids: mcpIds, applies_to_chat: appliesToChat };
+      const body = { name, action, domain, conditions, or_conditions, enabled: true, global: isGlobal, mcp_ids: mcpIds, applies_to_chat: appliesToChat };
       if (priority != null) body.priority = priority;
       const policy = await api.createPolicy(jwt, body);
       let scope;
@@ -200,13 +273,22 @@ export async function runPolicies([sub, ...args], flags) {
         if (appliesToChat) parts.push('Troxy Chat');
         scope = parts.length ? parts.join(', ') : 'no agents';
       }
-      console.log(`\n  Policy "${policy.name}" created ✓  (priority: ${policy.priority}, scope: ${scope})\n`);
+      console.log(`\n  Policy "${policy.name}" created ✓  (priority: ${policy.priority}, checkpoint: ${domain}, scope: ${scope})\n`);
       break;
     }
 
     case 'delete': {
       const name = flags.name;
       if (!name) { console.error('  --name is required\n'); process.exit(1); }
+      if (flags.org) {
+        const org = await _resolveOrgContext(jwt, true);
+        const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+        const policy = policies.find(p => p.name === name);
+        if (!policy) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
+        await api.deleteOrgPolicy(jwt, org.id, policy.id);
+        console.log(`\n  Org policy "${name}" deleted ✓\n`);
+        break;
+      }
       const { policies = [] } = await api.listPolicies(jwt);
       const policy = policies.find(p => p.name === name);
       if (!policy) { console.error(`  Policy "${name}" not found\n`); process.exit(1); }
@@ -226,6 +308,15 @@ export async function runPolicies([sub, ...args], flags) {
     case 'resume': {
       const name = flags.name;
       if (!name) { console.error('  --name is required\n'); process.exit(1); }
+      if (flags.org) {
+        const org = await _resolveOrgContext(jwt, true);
+        const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+        const policy = policies.find(p => p.name === name);
+        if (!policy) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
+        await api.updateOrgPolicy(jwt, org.id, policy.id, { enabled: sub === 'resume' });
+        console.log(`\n  Org policy "${name}" ${sub}d ✓\n`);
+        break;
+      }
       const { policies = [] } = await api.listPolicies(jwt);
       const policy = policies.find(p => p.name === name);
       if (!policy) { console.error(`  Policy "${name}" not found\n`); process.exit(1); }
@@ -249,6 +340,15 @@ export async function runPolicies([sub, ...args], flags) {
       if (flags.priority == null) { console.error('  --priority is required\n'); process.exit(1); }
       const priority = parseInt(flags.priority, 10);
       if (isNaN(priority)) { console.error('  --priority must be a number\n'); process.exit(1); }
+      if (flags.org) {
+        const org = await _resolveOrgContext(jwt, true);
+        const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+        const policy = policies.find(p => p.name === name);
+        if (!policy) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
+        await api.updateOrgPolicy(jwt, org.id, policy.id, { priority });
+        console.log(`\n  Org policy "${name}" priority set to ${priority} ✓\n`);
+        break;
+      }
       const { policies = [] } = await api.listPolicies(jwt);
       const policy = policies.find(p => p.name === name);
       if (!policy) { console.error(`  Policy "${name}" not found\n`); process.exit(1); }
@@ -269,11 +369,206 @@ export async function runPolicies([sub, ...args], flags) {
 
     default:
       console.error(`  Unknown subcommand: ${sub}`);
-      console.error('  Usage: troxy policies [list|describe|create|set-priority|delete|enable|disable]\n');
+      console.error('  Usage: troxy policies [list|describe|create|templates|fields|test|set-priority|pause|resume|delete]\n');
       process.exit(1);
   }
 }
 
+// ── Org context ──────────────────────────────────────────────────────────
+
+async function _resolveOrgContext(jwt, needAdmin) {
+  const { org } = await api.currentOrg(jwt);
+  if (!org) {
+    console.error('\n  --org was passed, but you are not in an organization.\n');
+    process.exit(1);
+  }
+  if (needAdmin && org.role !== 'admin') {
+    console.error(`\n  Org policies require admin access. You are a '${org.role}' in ${org.name}.\n`);
+    process.exit(1);
+  }
+  return org;
+}
+
+// ── Condition building, shared by create and test ──────────────────────────
+
+// "field=amount,operator=gt,value=100[,value2=200]" -> {field,operator,value,value2?}
+function _parseMiniCondition(str, flagName) {
+  const out = {};
+  for (const pair of String(str).split(',')) {
+    const eq = pair.indexOf('=');
+    if (eq === -1) continue;
+    out[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+  }
+  if (!out.field || !out.operator || out.value == null) {
+    console.error(`\n  ${flagName} needs field=, operator= and value= - got: "${str}"\n`);
+    process.exit(1);
+  }
+  return out;
+}
+
+function _condObj(c) {
+  const out = { field: c.field, operator: c.operator, value: c.value };
+  if (c.value2 != null) out.value2 = c.value2;
+  return out;
+}
+
+function _validateOrExit(domain, c) {
+  const err = validateCondition(domain, c.field, c.operator, c.value, c.value2);
+  if (err) { console.error(`\n  ${err}\n`); process.exit(1); }
+}
+
+// Exported for direct testing (src/tests/policies-create.test.js) - these two
+// carry all the domain/field/operator/value validation logic in this file,
+// and testing them by driving the full CLI command through a mocked network
+// would hide failures behind console-output diffing instead of asserting on
+// the actual request body that would have been sent.
+export function _findTemplate(label) {
+  const exact = TEMPLATES.find(t => t.label.toLowerCase() === label.toLowerCase());
+  if (exact) return exact;
+  const needle = label.toLowerCase();
+  const close = TEMPLATES.filter(t => t.label.toLowerCase().includes(needle)).slice(0, 5);
+  console.error(`\n  No template called "${label}".`);
+  if (close.length) {
+    console.error('  Did you mean:');
+    close.forEach(t => console.error(`    - ${t.label}`));
+  } else {
+    console.error("  Run 'troxy policies templates' to see all of them.");
+  }
+  console.error();
+  process.exit(1);
+}
+
+/**
+ * Builds {domain, action, conditions, or_conditions} from create/test's flags.
+ * Exits with a clear error on anything invalid - nothing here should ever
+ * reach the server with a condition the vendored spec already knows is bad.
+ */
+export function _buildConditionsFromFlags(flags, multiFlags, { requireAction }) {
+  const exclusiveFlags = ['template', 'json', 'field', 'and', 'or'];
+  const given = exclusiveFlags.filter(f => flags[f] != null || (multiFlags[f] || []).length);
+  const usesTemplate = given.includes('template');
+  const usesJson = given.includes('json');
+  if (usesTemplate && given.some(f => f !== 'template')) {
+    console.error('\n  --template cannot be combined with --field/--and/--or/--json. Use --value/--value2/--action to adjust it instead.\n');
+    process.exit(1);
+  }
+  if (usesJson && given.some(f => f !== 'json')) {
+    console.error('\n  --json cannot be combined with --field/--and/--or/--template.\n');
+    process.exit(1);
+  }
+
+  const action = (flags.action || '').toUpperCase();
+  if (requireAction && !action && !usesTemplate) { console.error('  --action is required\n'); process.exit(1); }
+  if (action && !['ALLOW', 'BLOCK', 'ESCALATE', 'NOTIFY'].includes(action)) {
+    console.error('  --action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n'); process.exit(1);
+  }
+
+  if (usesTemplate) {
+    const t = _findTemplate(flags.template);
+    const domain = t.domain;
+    const finalAction = action || t.action;
+    let conditions = t.conditions.map(_condObj);
+    let or_conditions = t.or_conditions.map(b => ({ action: b.action, conditions: b.conditions.map(_condObj) }));
+
+    if (flags.value != null) {
+      const totalConds = conditions.length + or_conditions.reduce((n, b) => n + b.conditions.length, 0);
+      if (totalConds !== 1) {
+        console.error(`\n  "${t.label}" has ${totalConds} condition(s) - --value only works on a template with exactly one. Use --json to customize this one, or add it as-is and edit it later.\n`);
+        process.exit(1);
+      }
+      if (conditions.length === 1) conditions = [{ ...conditions[0], value: flags.value, ...(flags.value2 != null ? { value2: flags.value2 } : {}) }];
+      else or_conditions = [{ ...or_conditions[0], conditions: [{ ...or_conditions[0].conditions[0], value: flags.value, ...(flags.value2 != null ? { value2: flags.value2 } : {}) }] }];
+    } else if (flags.value2 != null) {
+      console.error('\n  --value2 requires --value.\n'); process.exit(1);
+    }
+
+    for (const c of conditions) _validateOrExit(domain, c);
+    for (const b of or_conditions) for (const c of b.conditions) _validateOrExit(domain, c);
+    return { domain, action: finalAction, conditions, or_conditions };
+  }
+
+  if (usesJson) {
+    let parsed;
+    try { parsed = JSON.parse(flags.json); }
+    catch { console.error('\n  --json must be valid JSON: {"conditions": [...], "or_conditions": [...]}\n'); process.exit(1); }
+    const domain = normalizeDomain(flags.domain);
+    if (!domain) { console.error(`\n  --domain is required with --json (one of: ${DOMAINS.join(', ')})\n`); process.exit(1); }
+    const conditions = (parsed.conditions || []).map(_condObj);
+    const or_conditions = (parsed.or_conditions || []).map(b => ({ action: b.action, conditions: (b.conditions || []).map(_condObj) }));
+    for (const c of conditions) _validateOrExit(domain, c);
+    for (const b of or_conditions) for (const c of b.conditions) _validateOrExit(domain, c);
+    return { domain, action, conditions, or_conditions };
+  }
+
+  // Manual: --field (single) plus repeatable --and (AND'd in) and --or (branches).
+  let domain = normalizeDomain(flags.domain);
+  if (!domain && flags.field) domain = inferDomain(flags.field);
+  if (!domain && (multiFlags.and || multiFlags.or || []).length) {
+    console.error(`\n  --domain is required (one of: ${DOMAINS.join(', ')})\n`); process.exit(1);
+  }
+  if (!domain) domain = 'payment'; // nothing given at all: a plain catch-all payment policy, same as before this change
+
+  const singleField = flags.field
+    ? { field: flags.field, operator: flags.operator, value: flags.value, ...(flags.value2 != null ? { value2: flags.value2 } : {}) }
+    : null;
+  const andSpecs = (multiFlags.and || []).map(s => _parseMiniCondition(s, '--and'));
+  const orSpecs = (multiFlags.or || []).map(s => _parseMiniCondition(s, '--or'));
+  const baseAnd = [...(singleField ? [singleField] : []), ...andSpecs];
+
+  for (const c of baseAnd) _validateOrExit(domain, c);
+  for (const c of orSpecs) _validateOrExit(domain, c);
+
+  if (orSpecs.length === 0) {
+    return { domain, action, conditions: baseAnd, or_conditions: [] };
+  }
+  return {
+    domain, action,
+    conditions: [],
+    or_conditions: orSpecs.map(o => ({ action, conditions: [...baseAnd, o] })),
+  };
+}
+
+// ── Local, offline listings ─────────────────────────────────────────────────
+
+function _printFields(flags) {
+  const domain = flags.domain ? normalizeDomain(flags.domain) : null;
+  if (flags.domain && !domain) { console.error(`\n  Unknown domain "${flags.domain}" (one of: ${DOMAINS.join(', ')})\n`); process.exit(1); }
+  const domainsToShow = domain ? [domain] : DOMAINS;
+  for (const d of domainsToShow) {
+    console.log(`\n  ${d}`);
+    const fields = DOMAIN_FIELDS[d] || [];
+    table(
+      ['Field', 'Operators', 'Values'],
+      fields.map(f => {
+        const spec = FIELD_SPECS[f] || {};
+        const values = spec.kind === 'bool' ? 'true, false' : (spec.values || []).join(', ');
+        return [f, (spec.ops || []).join(', '), values];
+      }),
+    );
+  }
+  console.log();
+}
+
+function _printTemplates(flags) {
+  let list = TEMPLATES;
+  if (flags.category) {
+    const needle = String(flags.category).toLowerCase();
+    list = list.filter(t => t.category.toLowerCase().includes(needle));
+  }
+  if (flags.search) {
+    const needle = String(flags.search).toLowerCase();
+    list = list.filter(t => t.label.toLowerCase().includes(needle) || (t.desc || '').toLowerCase().includes(needle));
+  }
+  if (!list.length) { console.log('\n  No templates match.\n'); return; }
+  console.log();
+  let lastCategory = null;
+  for (const t of list) {
+    if (t.category !== lastCategory) { console.log(`  ${t.category}`); lastCategory = t.category; }
+    console.log(`    ${t.action.padEnd(8)} ${t.label}`);
+  }
+  console.log(`\n  ${list.length} template(s). Use one with:  troxy policies create --name "..." --template "<label>"\n`);
+}
+
 const _isAny = x => !x.field || x.field === 'any' || x.operator === 'any';
 
 function _condSummary(p) {