troxy-cli 1.26.0 → 1.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.26.0",
+  "version": "1.28.0",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/hook-report.js

@@ -42,6 +42,11 @@ export function extractUsage(entry) {
     // dollar math server-side from the model id; this file only sums what
     // the transcript says was used.
     tokens: inputTokens + outputTokens + cacheCreation + cacheRead,
+    // Lives on the transcript ENTRY itself, not inside message.usage -
+    // confirmed live 2026-09-03 against a real session file (values seen:
+    // 'high', 'max'). Whatever string Claude Code actually used, passed
+    // through as-is; nothing here assumes a fixed low/medium/high vocabulary.
+    effort: entry.effort || null,
   };
 }
 
@@ -94,14 +99,16 @@ export function usageForCurrentTurn(transcriptPath) {
     turnLines.push(entry);
   }
 
-  const seen = new Map(); // messageId -> {model, tokens}
+  const seen = new Map(); // messageId -> {model, tokens, effort}
   let lastModel = null;
+  let lastEffort = null;
   for (const entry of turnLines) {
     const usage = extractUsage(entry);
     if (!usage || !usage.messageId) continue;
     if (!seen.has(usage.messageId)) {
       seen.set(usage.messageId, usage);
       lastModel = lastModel || usage.model;
+      lastEffort = lastEffort || usage.effort;
     }
   }
 
@@ -130,7 +137,7 @@ export function usageForCurrentTurn(transcriptPath) {
   }
   const contentExcerpt = replyText ? replyText.slice(0, MAX_EXCERPT_LEN) : null;
 
-  return { tokens: totalTokens, model: lastModel, turnKey, contentExcerpt };
+  return { tokens: totalTokens, model: lastModel, effort: lastEffort, turnKey, contentExcerpt };
 }
 
 function withTimeout(promise, ms) {

package/src/mcp-server.js

@@ -336,8 +336,7 @@ export async function runMcp() {
             },
             effort: {
               type: 'string',
-              enum: ['low', 'medium', 'high'],
-              description: 'How much work this task warrants. Report it honestly: "high effort on a simple task" is one of the things Troxy flags as waste.',
+              description: 'How much work this task warrants - your own real effort/thinking level for this turn (e.g. low, medium, high, or whatever your model calls it). Report it honestly: "high effort on a simple task" is one of the things Troxy flags as waste.',
             },
             task: {
               type: 'string',
@@ -379,7 +378,6 @@ export async function runMcp() {
             },
             effort: {
               type: 'string',
-              enum: ['low', 'medium', 'high'],
               description: 'The effort level the task actually took, if it differed from what you declared up front (optional).',
             },
           },
@@ -578,7 +576,8 @@ export async function runMcp() {
       if (result.error) {
         return { content: [{ type: 'text', text: `Troxy error: ${result.error}` }], isError: true };
       }
-      const { decision, reason, audit_id, approval_token, suggested_model, suggestion_reason } = result;
+      const { decision, reason, audit_id, approval_token, suggested_model, suggestion_reason,
+              suggested_effort, effort_suggestion_reason } = result;
       const what = `${args.model}${args.effort ? ` at ${args.effort} effort` : ''}`;
       // Every non-blocked branch repeats the audit_id and the instruction to
       // report back. Half the value of this checkpoint is the second call, and
@@ -590,11 +589,16 @@ export async function runMcp() {
       const suggestionText = suggested_model
         ? ` Suggestion: ${suggestion_reason || `${suggested_model} would likely work just as well here.`} If you'd like to use it, call evaluate_model again with model="${suggested_model}" — no obligation, this run is already approved as-is.`
         : '';
+      // Same pattern, same dark-ship gate, sibling advisory - independent of
+      // suggested_model so a call can carry either, both, or neither.
+      const effortSuggestionText = suggested_effort
+        ? ` Suggestion: ${effort_suggestion_reason || `${suggested_effort} effort would likely work just as well here.`} If you'd like to use it, call evaluate_model again with effort="${suggested_effort}" — no obligation, this run is already approved as-is.`
+        : '';
       let modelText;
       switch (decision) {
         case 'ALLOW':
         case 'NOTIFY':
-          modelText = `✓ Approved: ${what}.${reason ? ` ${reason}` : ''} You may run it.${followUp}${suggestionText} (audit: ${audit_id})`;
+          modelText = `✓ Approved: ${what}.${reason ? ` ${reason}` : ''} You may run it.${followUp}${suggestionText}${effortSuggestionText} (audit: ${audit_id})`;
           break;
         case 'BLOCK':
           modelText = `✗ Blocked: ${what}.${reason ? ` ${reason}` : ''} Do not use this model for this task. Choose a cheaper or smaller model and call evaluate_model again with the new model id. (audit: ${audit_id})`;

package/src/pretooluse-hook.js

@@ -91,8 +91,15 @@ export async function runPreToolUseHook() {
     const apiKey = process.env.TROXY_API_KEY || config?.apiKey;
     if (!apiKey) return allow();
 
+    const body = { model: usage.model, task: payload.tool_name || '' };
+    // Real effort straight off the transcript entry (see hook-report.js's
+    // extractUsage) - whatever Claude Code actually used, not coerced into a
+    // guessed low/medium/high. Omitted when the transcript doesn't carry one
+    // (an older Claude Code build, or a turn before any assistant reply yet).
+    if (usage.effort) body.effort = usage.effort;
+
     const result = await withTimeout(
-      api.evaluateModel({ model: usage.model, task: payload.tool_name || '' }, apiKey),
+      api.evaluateModel(body, apiKey),
       GATE_TIMEOUT_MS,
     );
 

package/src/tests/hook-report.test.js

@@ -30,8 +30,10 @@ function writeLines(lines) {
   fs.writeFileSync(transcriptPath(), lines.map(l => JSON.stringify(l)).join('\n') + '\n');
 }
 
-function assistantLine(messageId, usage, model = 'claude-sonnet-5') {
-  return { type: 'assistant', message: { id: messageId, model, usage } };
+function assistantLine(messageId, usage, model = 'claude-sonnet-5', effort = undefined) {
+  const line = { type: 'assistant', message: { id: messageId, model, usage } };
+  if (effort !== undefined) line.effort = effort;
+  return line;
 }
 
 function assistantLineWithText(messageId, usage, text, model = 'claude-sonnet-5') {
@@ -41,9 +43,10 @@ function assistantLineWithText(messageId, usage, text, model = 'claude-sonnet-5'
 const USAGE_A = { input_tokens: 2, output_tokens: 1176, cache_creation_input_tokens: 4134, cache_read_input_tokens: 244103 };
 
 describe('extractUsage', () => {
-  it('only reads usage/model/id fields, never message.content', () => {
+  it('only reads usage/model/id/effort fields, never message.content', () => {
     const entry = {
       type: 'assistant',
+      effort: 'high',
       message: {
         id: 'msg_1',
         model: 'claude-sonnet-5',
@@ -52,10 +55,19 @@ describe('extractUsage', () => {
       },
     };
     const result = extractUsage(entry);
-    assert.deepEqual(Object.keys(result).sort(), ['messageId', 'model', 'tokens']);
+    assert.deepEqual(Object.keys(result).sort(), ['effort', 'messageId', 'model', 'tokens']);
+    assert.equal(result.effort, 'high');
     assert.ok(!JSON.stringify(result).includes('actual conversation'));
   });
 
+  it('effort is null when the entry does not carry one (older Claude Code build)', () => {
+    const entry = {
+      type: 'assistant',
+      message: { id: 'msg_1', model: 'claude-sonnet-5', usage: { input_tokens: 10, output_tokens: 5 } },
+    };
+    assert.equal(extractUsage(entry).effort, null);
+  });
+
   it('returns null for a non-assistant line', () => {
     assert.equal(extractUsage({ type: 'user', message: { usage: { input_tokens: 1 } } }), null);
   });
@@ -112,6 +124,24 @@ describe('usageForCurrentTurn', () => {
     assert.equal(result.model, 'claude-opus-4.5');
   });
 
+  it('returns the effort from the assistant lines in the current turn', () => {
+    writeLines([
+      { type: 'user', message: { content: [{ type: 'text', text: 'hi' }] } },
+      assistantLine('msg_1', { input_tokens: 1, output_tokens: 1 }, 'claude-opus-5', 'max'),
+    ]);
+    const result = usageForCurrentTurn(transcriptPath());
+    assert.equal(result.effort, 'max');
+  });
+
+  it('effort is null, not an error, on a transcript with no effort field (older Claude Code build)', () => {
+    writeLines([
+      { type: 'user', message: { content: [{ type: 'text', text: 'hi' }] } },
+      assistantLine('msg_1', { input_tokens: 1, output_tokens: 1 }),
+    ]);
+    const result = usageForCurrentTurn(transcriptPath());
+    assert.equal(result.effort, null);
+  });
+
   it('returns a stable turn_key for the same set of message ids, order-independent', () => {
     writeLines([
       { type: 'user', message: { content: [] } },