troxy-cli 1.28.0 → 1.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.28.0",
+  "version": "1.29.1",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/hook-report.js

@@ -102,6 +102,15 @@ export function usageForCurrentTurn(transcriptPath) {
   const seen = new Map(); // messageId -> {model, tokens, effort}
   let lastModel = null;
   let lastEffort = null;
+  // How many tool_use content blocks this turn has produced so far -
+  // Claude Code writes one JSONL line per content block (see the big
+  // comment above), so this is a real count, not a guess, of tool calls
+  // already made this turn, before whichever one just triggered this hook.
+  // Only the block's `type` tag is read here, a category label
+  // ("tool_use"/"thinking"/"text"), never its actual name or arguments -
+  // same narrow-purpose exception extractReplyText already sets for
+  // touching `content` at all, still never touching real conversation data.
+  let toolUseBlocksSoFar = 0;
   for (const entry of turnLines) {
     const usage = extractUsage(entry);
     if (!usage || !usage.messageId) continue;
@@ -110,6 +119,10 @@ export function usageForCurrentTurn(transcriptPath) {
       lastModel = lastModel || usage.model;
       lastEffort = lastEffort || usage.effort;
     }
+    const content = entry?.type === 'assistant' ? entry.message?.content : null;
+    if (Array.isArray(content) && content.some(b => b?.type === 'tool_use')) {
+      toolUseBlocksSoFar++;
+    }
   }
 
   if (seen.size === 0) return null;
@@ -137,7 +150,10 @@ export function usageForCurrentTurn(transcriptPath) {
   }
   const contentExcerpt = replyText ? replyText.slice(0, MAX_EXCERPT_LEN) : null;
 
-  return { tokens: totalTokens, model: lastModel, effort: lastEffort, turnKey, contentExcerpt };
+  return {
+    tokens: totalTokens, model: lastModel, effort: lastEffort, toolUseBlocksSoFar,
+    turnKey, contentExcerpt,
+  };
 }
 
 function withTimeout(promise, ms) {

package/src/init.js

@@ -100,7 +100,7 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
       } catch (err) {
         console.log(`    • Claude Code usage capture  ✗  (${err.message})`);
       }
-      await maybeEnableClaudeCodeProxy(proxyOptIn);
+      await maybeEnableClaudeCodeProxy(proxyOptIn, key);
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -583,12 +583,24 @@ export function troxyModelProxyBaseUrl() {
 //   2. Remote Control is disabled while the base URL points elsewhere
 //      (Claude Code v2.1.196+) - nothing to configure around this one, it's
 //      just true while the proxy is active, hence the up-front warning.
-export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUrl()) {
+export function patchClaudeCodeProxy(configPath, troxyKey, baseUrl = troxyModelProxyBaseUrl()) {
   let config = {};
   try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
   if (!config.env) config.env = {};
   config.env.ANTHROPIC_BASE_URL = baseUrl;
   config.env.ENABLE_TOOL_SEARCH = 'true';
+  // Found live 2026-09-04: without this, Claude Code still authenticates to
+  // whatever base_url it's pointed at using its own Anthropic credential (an
+  // API key sent as x-api-key, or a Claude.ai OAuth session token sent as
+  // Authorization) - neither is a Troxy key, so the model-proxy's
+  // authenticate_api_key(troxy_key) check (reads the Authorization header)
+  // rejected every real request as "invalid or revoked Troxy API key",
+  // silently making the whole proxy path a no-op regardless of base URL.
+  // ANTHROPIC_AUTH_TOKEN is the one Claude Code env var that maps directly
+  // onto Authorization: Bearer <value> (same docs page as above) - setting
+  // it to the Troxy key is what the model-proxy actually needs to identify
+  // the caller.
+  if (troxyKey) config.env.ANTHROPIC_AUTH_TOKEN = troxyKey;
 
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
@@ -601,7 +613,7 @@ export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUr
 //   proxyOptIn === null  -> not passed; ask interactively if there's a TTY,
 //                           otherwise skip (a scripted/CI init must never hang
 //                           on a prompt, and silence must never mean yes)
-async function maybeEnableClaudeCodeProxy(proxyOptIn) {
+async function maybeEnableClaudeCodeProxy(proxyOptIn, key) {
   let enable = proxyOptIn === true;
   if (proxyOptIn === null && process.stdin.isTTY) {
     console.log("\n  Route Claude Code's model calls through Troxy for automatic cost");
@@ -609,15 +621,14 @@ async function maybeEnableClaudeCodeProxy(proxyOptIn) {
     console.log('  opportunity, not just suggest one.');
     console.log("  Trade-off: while this is on, Claude Code's Remote Control feature is");
     console.log('  disabled (Anthropic disables it whenever the API base URL points');
-    console.log('  anywhere other than api.anthropic.com). Also, model policies (e.g. a');
-    console.log('  BLOCK rule on a specific model) are not enforced on this path yet -');
-    console.log('  only the cost-saving model swap is live.');
+    console.log('  anywhere other than api.anthropic.com). Model policies (e.g. a BLOCK');
+    console.log('  rule on a specific model) ARE enforced on this path.');
     const answer = await prompt('  Enable? (y/N): ');
     enable = /^y(es)?$/i.test(answer);
   }
   if (!enable) return;
   try {
-    patchClaudeCodeProxy(claudeCodeSettingsPath());
+    patchClaudeCodeProxy(claudeCodeSettingsPath(), key);
     console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
   } catch (err) {
     console.log(`    • Claude Code model proxy  ✗  (${err.message})`);

package/src/pretooluse-hook.js

@@ -97,6 +97,15 @@ export async function runPreToolUseHook() {
     // guessed low/medium/high. Omitted when the transcript doesn't carry one
     // (an older Claude Code build, or a turn before any assistant reply yet).
     if (usage.effort) body.effort = usage.effort;
+    // How many tools this turn has used so far (from the transcript), plus
+    // the one about to run that triggered this hook. An undercount by
+    // nature - a PreToolUse hook cannot know how many MORE tool calls this
+    // turn will end up making - but a real, current-as-of-right-now number,
+    // not a guess, and the effort-suggestion feature only needs to tell a
+    // turn's first tool call apart from its fifth, not know the eventual
+    // total. Without this, effort was accepted but never actually
+    // classified as "simple", so no suggestion could ever fire from here.
+    body.estimated_tool_count = usage.toolUseBlocksSoFar + 1;
 
     const result = await withTimeout(
       api.evaluateModel(body, apiKey),

package/src/tests/claude-code-proxy.test.js

@@ -1,11 +1,12 @@
 // Checklist #17 ("one-command proxy setup"): patchClaudeCodeProxy writes
-// ANTHROPIC_BASE_URL + ENABLE_TOOL_SEARCH into Claude Code's global
-// settings.json `env` block, so its own model calls route through
-// proxy.troxy.io instead of straight to Anthropic. This is opt-in only
-// (Gilad, 2026-08-29) - the prompt/flag gating that decides WHETHER to call
-// this lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not
-// tested here; this file covers what actually gets written once it's
-// called, same split as claude-code-hook.test.js does for the hooks patch.
+// ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN + ENABLE_TOOL_SEARCH into Claude
+// Code's global settings.json `env` block, so its own model calls route
+// through proxy.troxy.io instead of straight to Anthropic, AND authenticate
+// as this Troxy user once they get there. This is opt-in only (Gilad,
+// 2026-08-29) - the prompt/flag gating that decides WHETHER to call this
+// lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not tested
+// here; this file covers what actually gets written once it's called, same
+// split as claude-code-hook.test.js does for the hooks patch.
 
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
@@ -22,28 +23,45 @@ afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
 describe('patchClaudeCodeProxy', () => {
   const configPath = () => path.join(dir, 'settings.json');
   const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const KEY = 'txy-test-key-123';
 
   it('creates the env block with ANTHROPIC_BASE_URL when the file does not exist', () => {
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
   });
 
   it('sets ENABLE_TOOL_SEARCH so the model-proxy\'s forwarded tool_reference blocks still work', () => {
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ENABLE_TOOL_SEARCH, 'true');
   });
 
+  it('sets ANTHROPIC_AUTH_TOKEN to the Troxy key - found live 2026-09-04: without this, ' +
+     'Claude Code sends its own Anthropic credential as Authorization, and the model-proxy ' +
+     'rejects every real request as an invalid Troxy key, making the whole proxy path a no-op',
+  () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
+  });
+
+  it('does not write ANTHROPIC_AUTH_TOKEN at all when no key is given, rather than writing "undefined"', () => {
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, undefined);
+  });
+
   it('accepts a custom base URL for testing/overrides instead of hardcoding proxy.troxy.io', () => {
-    patchClaudeCodeProxy(configPath(), 'https://staging.example.com');
+    patchClaudeCodeProxy(configPath(), KEY, 'https://staging.example.com');
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://staging.example.com');
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
   });
 
   it('preserves unrelated existing env keys instead of replacing the whole block', () => {
     fs.writeFileSync(configPath(), JSON.stringify({ env: { SOME_OTHER_VAR: 'keep-me' } }));
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
@@ -51,21 +69,22 @@ describe('patchClaudeCodeProxy', () => {
 
   it('preserves unrelated top-level keys (e.g. hooks already written by patchClaudeCodeHooks)', () => {
     fs.writeFileSync(configPath(), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'x' }] }] } }));
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.ok(cfg.hooks.Stop.length === 1, 'existing hooks block was dropped');
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
   });
 
   it('re-running is idempotent - overwrites rather than duplicating or erroring', () => {
-    patchClaudeCodeProxy(configPath());
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
   });
 
   it('does not throw when the existing file is corrupted JSON', () => {
     fs.writeFileSync(configPath(), '{ not json');
-    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath()));
+    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath(), KEY));
   });
 });

package/src/tests/hook-report.test.js

@@ -40,6 +40,10 @@ function assistantLineWithText(messageId, usage, text, model = 'claude-sonnet-5'
   return { type: 'assistant', message: { id: messageId, model, usage, content: [{ type: 'text', text }] } };
 }
 
+function assistantToolUseLine(messageId, usage, toolName = 'Bash', model = 'claude-sonnet-5') {
+  return { type: 'assistant', message: { id: messageId, model, usage, content: [{ type: 'tool_use', name: toolName }] } };
+}
+
 const USAGE_A = { input_tokens: 2, output_tokens: 1176, cache_creation_input_tokens: 4134, cache_read_input_tokens: 244103 };
 
 describe('extractUsage', () => {
@@ -142,6 +146,29 @@ describe('usageForCurrentTurn', () => {
     assert.equal(result.effort, null);
   });
 
+  it('counts tool_use content blocks in the current turn, not text/thinking ones', () => {
+    writeLines([
+      { type: 'user', message: { content: [{ type: 'text', text: 'hi' }] } },
+      // Same real shape: one JSONL line per content block, all three lines
+      // share message.id 'msg_1' and repeat the same usage object.
+      { type: 'assistant', message: { id: 'msg_1', model: 'claude-sonnet-5', usage: { input_tokens: 1, output_tokens: 1 }, content: [{ type: 'thinking', thinking: 'planning' }] } },
+      assistantToolUseLine('msg_1', { input_tokens: 1, output_tokens: 1 }, 'Read'),
+      assistantToolUseLine('msg_2', { input_tokens: 1, output_tokens: 1 }, 'Bash'),
+      assistantLineWithText('msg_3', { input_tokens: 1, output_tokens: 1 }, 'done'),
+    ]);
+    const result = usageForCurrentTurn(transcriptPath());
+    assert.equal(result.toolUseBlocksSoFar, 2);
+  });
+
+  it('toolUseBlocksSoFar is 0 for a turn with no tool use yet', () => {
+    writeLines([
+      { type: 'user', message: { content: [{ type: 'text', text: 'hi' }] } },
+      assistantLineWithText('msg_1', { input_tokens: 1, output_tokens: 1 }, 'just chatting'),
+    ]);
+    const result = usageForCurrentTurn(transcriptPath());
+    assert.equal(result.toolUseBlocksSoFar, 0);
+  });
+
   it('returns a stable turn_key for the same set of message ids, order-independent', () => {
     writeLines([
       { type: 'user', message: { content: [] } },