troxy-cli 1.29.0 → 1.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.0",
+  "version": "1.29.1",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/init.js

@@ -100,7 +100,7 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
       } catch (err) {
         console.log(`    • Claude Code usage capture  ✗  (${err.message})`);
       }
-      await maybeEnableClaudeCodeProxy(proxyOptIn);
+      await maybeEnableClaudeCodeProxy(proxyOptIn, key);
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -583,12 +583,24 @@ export function troxyModelProxyBaseUrl() {
 //   2. Remote Control is disabled while the base URL points elsewhere
 //      (Claude Code v2.1.196+) - nothing to configure around this one, it's
 //      just true while the proxy is active, hence the up-front warning.
-export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUrl()) {
+export function patchClaudeCodeProxy(configPath, troxyKey, baseUrl = troxyModelProxyBaseUrl()) {
   let config = {};
   try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
   if (!config.env) config.env = {};
   config.env.ANTHROPIC_BASE_URL = baseUrl;
   config.env.ENABLE_TOOL_SEARCH = 'true';
+  // Found live 2026-09-04: without this, Claude Code still authenticates to
+  // whatever base_url it's pointed at using its own Anthropic credential (an
+  // API key sent as x-api-key, or a Claude.ai OAuth session token sent as
+  // Authorization) - neither is a Troxy key, so the model-proxy's
+  // authenticate_api_key(troxy_key) check (reads the Authorization header)
+  // rejected every real request as "invalid or revoked Troxy API key",
+  // silently making the whole proxy path a no-op regardless of base URL.
+  // ANTHROPIC_AUTH_TOKEN is the one Claude Code env var that maps directly
+  // onto Authorization: Bearer <value> (same docs page as above) - setting
+  // it to the Troxy key is what the model-proxy actually needs to identify
+  // the caller.
+  if (troxyKey) config.env.ANTHROPIC_AUTH_TOKEN = troxyKey;
 
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
@@ -601,7 +613,7 @@ export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUr
 //   proxyOptIn === null  -> not passed; ask interactively if there's a TTY,
 //                           otherwise skip (a scripted/CI init must never hang
 //                           on a prompt, and silence must never mean yes)
-async function maybeEnableClaudeCodeProxy(proxyOptIn) {
+async function maybeEnableClaudeCodeProxy(proxyOptIn, key) {
   let enable = proxyOptIn === true;
   if (proxyOptIn === null && process.stdin.isTTY) {
     console.log("\n  Route Claude Code's model calls through Troxy for automatic cost");
@@ -609,15 +621,14 @@ async function maybeEnableClaudeCodeProxy(proxyOptIn) {
     console.log('  opportunity, not just suggest one.');
     console.log("  Trade-off: while this is on, Claude Code's Remote Control feature is");
     console.log('  disabled (Anthropic disables it whenever the API base URL points');
-    console.log('  anywhere other than api.anthropic.com). Also, model policies (e.g. a');
-    console.log('  BLOCK rule on a specific model) are not enforced on this path yet -');
-    console.log('  only the cost-saving model swap is live.');
+    console.log('  anywhere other than api.anthropic.com). Model policies (e.g. a BLOCK');
+    console.log('  rule on a specific model) ARE enforced on this path.');
     const answer = await prompt('  Enable? (y/N): ');
     enable = /^y(es)?$/i.test(answer);
   }
   if (!enable) return;
   try {
-    patchClaudeCodeProxy(claudeCodeSettingsPath());
+    patchClaudeCodeProxy(claudeCodeSettingsPath(), key);
     console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
   } catch (err) {
     console.log(`    • Claude Code model proxy  ✗  (${err.message})`);

package/src/tests/claude-code-proxy.test.js

@@ -1,11 +1,12 @@
 // Checklist #17 ("one-command proxy setup"): patchClaudeCodeProxy writes
-// ANTHROPIC_BASE_URL + ENABLE_TOOL_SEARCH into Claude Code's global
-// settings.json `env` block, so its own model calls route through
-// proxy.troxy.io instead of straight to Anthropic. This is opt-in only
-// (Gilad, 2026-08-29) - the prompt/flag gating that decides WHETHER to call
-// this lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not
-// tested here; this file covers what actually gets written once it's
-// called, same split as claude-code-hook.test.js does for the hooks patch.
+// ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN + ENABLE_TOOL_SEARCH into Claude
+// Code's global settings.json `env` block, so its own model calls route
+// through proxy.troxy.io instead of straight to Anthropic, AND authenticate
+// as this Troxy user once they get there. This is opt-in only (Gilad,
+// 2026-08-29) - the prompt/flag gating that decides WHETHER to call this
+// lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not tested
+// here; this file covers what actually gets written once it's called, same
+// split as claude-code-hook.test.js does for the hooks patch.
 
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
@@ -22,28 +23,45 @@ afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
 describe('patchClaudeCodeProxy', () => {
   const configPath = () => path.join(dir, 'settings.json');
   const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const KEY = 'txy-test-key-123';
 
   it('creates the env block with ANTHROPIC_BASE_URL when the file does not exist', () => {
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
   });
 
   it('sets ENABLE_TOOL_SEARCH so the model-proxy\'s forwarded tool_reference blocks still work', () => {
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ENABLE_TOOL_SEARCH, 'true');
   });
 
+  it('sets ANTHROPIC_AUTH_TOKEN to the Troxy key - found live 2026-09-04: without this, ' +
+     'Claude Code sends its own Anthropic credential as Authorization, and the model-proxy ' +
+     'rejects every real request as an invalid Troxy key, making the whole proxy path a no-op',
+  () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
+  });
+
+  it('does not write ANTHROPIC_AUTH_TOKEN at all when no key is given, rather than writing "undefined"', () => {
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, undefined);
+  });
+
   it('accepts a custom base URL for testing/overrides instead of hardcoding proxy.troxy.io', () => {
-    patchClaudeCodeProxy(configPath(), 'https://staging.example.com');
+    patchClaudeCodeProxy(configPath(), KEY, 'https://staging.example.com');
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://staging.example.com');
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
   });
 
   it('preserves unrelated existing env keys instead of replacing the whole block', () => {
     fs.writeFileSync(configPath(), JSON.stringify({ env: { SOME_OTHER_VAR: 'keep-me' } }));
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
@@ -51,21 +69,22 @@ describe('patchClaudeCodeProxy', () => {
 
   it('preserves unrelated top-level keys (e.g. hooks already written by patchClaudeCodeHooks)', () => {
     fs.writeFileSync(configPath(), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'x' }] }] } }));
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.ok(cfg.hooks.Stop.length === 1, 'existing hooks block was dropped');
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
   });
 
   it('re-running is idempotent - overwrites rather than duplicating or erroring', () => {
-    patchClaudeCodeProxy(configPath());
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
   });
 
   it('does not throw when the existing file is corrupted JSON', () => {
     fs.writeFileSync(configPath(), '{ not json');
-    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath()));
+    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath(), KEY));
   });
 });