troxy-cli 1.23.0 → 1.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.23.0",
+  "version": "1.25.0",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/init.js

@@ -47,7 +47,7 @@ export async function refreshHostedInstructions(key) {
   return true;
 }
 
-export async function reprovisionKeyConsumers(key, agentName) {
+export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null) {
   const platform = process.platform;
   const { detected, hasOpenClaw, hasClaude, none } = detectMcpClients();
 
@@ -100,6 +100,7 @@ export async function reprovisionKeyConsumers(key, agentName) {
       } catch (err) {
         console.log(`    • Claude Code usage capture  ✗  (${err.message})`);
       }
+      await maybeEnableClaudeCodeProxy(proxyOptIn);
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -239,7 +240,10 @@ const MCP_CLIENTS = [
   },
 ];
 
-export async function runInit({ key, name } = {}) {
+export async function runInit({ key, name, proxy } = {}) {
+  // undefined (flag never passed) -> null, so reprovisionKeyConsumers can
+  // tell "not decided, ask interactively" apart from an explicit --proxy.
+  const proxyOptIn = proxy === undefined ? null : Boolean(proxy);
   if (!key || !key.startsWith('txy-')) {
     console.error('\n  Error: --key is required and must start with txy-');
     console.error('  Usage: npx troxy-cli init --key txy-...\n');
@@ -300,7 +304,7 @@ export async function runInit({ key, name } = {}) {
     // Non-fatal: the daemon's own heartbeat will retry this later.
   }
 
-  await reprovisionKeyConsumers(key, agentName);
+  await reprovisionKeyConsumers(key, agentName, proxyOptIn);
 
   // Scan for local AI coding tools and (interactively) confirm the plan for
   // each, so the dashboard shows real subscription cost, not token math.
@@ -559,6 +563,67 @@ export function patchClaudeCodeHooks(
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
 }
 
+// checklist #17 ("one-command proxy setup") - routes Claude Code's model
+// calls through Troxy's model-proxy instead of straight to Anthropic, so
+// evaluate_model's advisory model-swap suggestions become real, enforced
+// savings instead of just advice an agent can ignore. proxy.troxy.io is a
+// small Cloudflare Worker (troxy-proxy-gateway) in front of the model-proxy
+// Lambda - see that repo's README for why a plain custom domain doesn't
+// work here.
+export function troxyModelProxyBaseUrl() {
+  return 'https://proxy.troxy.io';
+}
+
+// Two real, verified side effects of setting ANTHROPIC_BASE_URL (confirmed
+// against Anthropic's own docs, code.claude.com/docs/en/env-vars,
+// 2026-08-29), which is why this is opt-in with a warning rather than
+// silently turned on for every Claude Code user this function runs against:
+//   1. MCP tool search is disabled by default once the base URL isn't
+//      api.anthropic.com, unless ENABLE_TOOL_SEARCH=true is also set - the
+//      model-proxy already forwards tool_reference blocks fine (it's a
+//      pure JSON pass-through), so this is set alongside, not worked around.
+//   2. Remote Control is disabled while the base URL points elsewhere
+//      (Claude Code v2.1.196+) - nothing to configure around this one, it's
+//      just true while the proxy is active, hence the up-front warning.
+export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUrl()) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
+  if (!config.env) config.env = {};
+  config.env.ANTHROPIC_BASE_URL = baseUrl;
+  config.env.ENABLE_TOOL_SEARCH = 'true';
+
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// Opt-in only (Gilad, 2026-08-29): the Remote Control tradeoff is real and
+// user-visible, so this must be a deliberate yes, never a default-on
+// behavior change slipped into an ordinary init run.
+//   proxyOptIn === true  -> --proxy was passed explicitly, enable without asking
+//   proxyOptIn === null  -> not passed; ask interactively if there's a TTY,
+//                           otherwise skip (a scripted/CI init must never hang
+//                           on a prompt, and silence must never mean yes)
+async function maybeEnableClaudeCodeProxy(proxyOptIn) {
+  let enable = proxyOptIn === true;
+  if (proxyOptIn === null && process.stdin.isTTY) {
+    console.log("\n  Route Claude Code's model calls through Troxy for automatic cost");
+    console.log('  optimization? Troxy can swap in a cheaper model when it finds an');
+    console.log('  opportunity, not just suggest one.');
+    console.log("  Trade-off: while this is on, Claude Code's Remote Control feature is");
+    console.log('  disabled (Anthropic disables it whenever the API base URL points');
+    console.log('  anywhere other than api.anthropic.com).');
+    const answer = await prompt('  Enable? (y/N): ');
+    enable = /^y(es)?$/i.test(answer);
+  }
+  if (!enable) return;
+  try {
+    patchClaudeCodeProxy(claudeCodeSettingsPath());
+    console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
+  } catch (err) {
+    console.log(`    • Claude Code model proxy  ✗  (${err.message})`);
+  }
+}
+
 // Detects Claude Code the same way the daemon detects OpenClaw: by whether
 // its own CLI is on PATH, since (unlike the other five clients) there is no
 // single marker *file* whose mere existence means "Claude Code is

package/src/mcp-server.js

@@ -578,17 +578,23 @@ export async function runMcp() {
       if (result.error) {
         return { content: [{ type: 'text', text: `Troxy error: ${result.error}` }], isError: true };
       }
-      const { decision, reason, audit_id, approval_token } = result;
+      const { decision, reason, audit_id, approval_token, suggested_model, suggestion_reason } = result;
       const what = `${args.model}${args.effort ? ` at ${args.effort} effort` : ''}`;
       // Every non-blocked branch repeats the audit_id and the instruction to
       // report back. Half the value of this checkpoint is the second call, and
       // an agent that is only told "approved" has no reason to make it.
       const followUp = ` When this turn finishes, call report_model_usage(audit_id="${audit_id}", actual_tokens=<real total>).`;
+      // Advisory only, dark-shipped per org - most orgs never see this field.
+      // Same "call again with the new id" pattern a BLOCK already teaches,
+      // just optional here: the call is still approved either way.
+      const suggestionText = suggested_model
+        ? ` Suggestion: ${suggestion_reason || `${suggested_model} would likely work just as well here.`} If you'd like to use it, call evaluate_model again with model="${suggested_model}" — no obligation, this run is already approved as-is.`
+        : '';
       let modelText;
       switch (decision) {
         case 'ALLOW':
         case 'NOTIFY':
-          modelText = `✓ Approved: ${what}.${reason ? ` ${reason}` : ''} You may run it.${followUp} (audit: ${audit_id})`;
+          modelText = `✓ Approved: ${what}.${reason ? ` ${reason}` : ''} You may run it.${followUp}${suggestionText} (audit: ${audit_id})`;
           break;
         case 'BLOCK':
           modelText = `✗ Blocked: ${what}.${reason ? ` ${reason}` : ''} Do not use this model for this task. Choose a cheaper or smaller model and call evaluate_model again with the new model id. (audit: ${audit_id})`;

package/src/tests/claude-code-proxy.test.js

@@ -0,0 +1,71 @@
+// Checklist #17 ("one-command proxy setup"): patchClaudeCodeProxy writes
+// ANTHROPIC_BASE_URL + ENABLE_TOOL_SEARCH into Claude Code's global
+// settings.json `env` block, so its own model calls route through
+// proxy.troxy.io instead of straight to Anthropic. This is opt-in only
+// (Gilad, 2026-08-29) - the prompt/flag gating that decides WHETHER to call
+// this lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not
+// tested here; this file covers what actually gets written once it's
+// called, same split as claude-code-hook.test.js does for the hooks patch.
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { patchClaudeCodeProxy, troxyModelProxyBaseUrl } from '../init.js';
+
+let dir;
+beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-cc-proxy-')); });
+afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+
+describe('patchClaudeCodeProxy', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+
+  it('creates the env block with ANTHROPIC_BASE_URL when the file does not exist', () => {
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+  });
+
+  it('sets ENABLE_TOOL_SEARCH so the model-proxy\'s forwarded tool_reference blocks still work', () => {
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ENABLE_TOOL_SEARCH, 'true');
+  });
+
+  it('accepts a custom base URL for testing/overrides instead of hardcoding proxy.troxy.io', () => {
+    patchClaudeCodeProxy(configPath(), 'https://staging.example.com');
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://staging.example.com');
+  });
+
+  it('preserves unrelated existing env keys instead of replacing the whole block', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ env: { SOME_OTHER_VAR: 'keep-me' } }));
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+  });
+
+  it('preserves unrelated top-level keys (e.g. hooks already written by patchClaudeCodeHooks)', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'x' }] }] } }));
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.ok(cfg.hooks.Stop.length === 1, 'existing hooks block was dropped');
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+  });
+
+  it('re-running is idempotent - overwrites rather than duplicating or erroring', () => {
+    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath()));
+  });
+});

package/src/tests/tool_detect.test.js

@@ -373,7 +373,7 @@ describe('wiring: api.js / bin/troxy.js / init.js', () => {
   });
 
   it('runInit calls tool detection after reprovisionKeyConsumers, wrapped so a scan failure never blocks init', () => {
-    const reprovisionIdx = initSrc.indexOf('reprovisionKeyConsumers(key, agentName)');
+    const reprovisionIdx = initSrc.indexOf('reprovisionKeyConsumers(key, agentName, proxyOptIn)');
     const toolIdx = initSrc.indexOf('runToolDetection');
     assert.ok(reprovisionIdx !== -1, 'reprovisionKeyConsumers call not found in init.js');
     assert.ok(toolIdx !== -1, 'runToolDetection not wired into runInit');