troxy-cli 1.29.0 → 1.29.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.0",
+  "version": "1.29.2",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/hook-report.js

@@ -42,6 +42,11 @@ export function extractUsage(entry) {
     // dollar math server-side from the model id; this file only sums what
     // the transcript says was used.
     tokens: inputTokens + outputTokens + cacheCreation + cacheRead,
+    // Reply-only portion of the total above - sent alongside actual_tokens,
+    // never in place of it (server still bills off the combined total; this
+    // is purely so the activity log can show "X tokens (Y reply)" instead
+    // of one opaque combined number - Gilad, 2026-09-04).
+    outputTokens,
     // Lives on the transcript ENTRY itself, not inside message.usage -
     // confirmed live 2026-09-03 against a real session file (values seen:
     // 'high', 'max'). Whatever string Claude Code actually used, passed
@@ -128,7 +133,11 @@ export function usageForCurrentTurn(transcriptPath) {
   if (seen.size === 0) return null;
 
   let totalTokens = 0;
-  for (const u of seen.values()) totalTokens += u.tokens;
+  let totalOutputTokens = 0;
+  for (const u of seen.values()) {
+    totalTokens += u.tokens;
+    totalOutputTokens += u.outputTokens || 0;
+  }
 
   // turn_key: dedups a hook that fires twice for the same turn (a retry,
   // a Claude Code internal replay) against a repeat POST for the same
@@ -151,8 +160,8 @@ export function usageForCurrentTurn(transcriptPath) {
   const contentExcerpt = replyText ? replyText.slice(0, MAX_EXCERPT_LEN) : null;
 
   return {
-    tokens: totalTokens, model: lastModel, effort: lastEffort, toolUseBlocksSoFar,
-    turnKey, contentExcerpt,
+    tokens: totalTokens, outputTokens: totalOutputTokens, model: lastModel,
+    effort: lastEffort, toolUseBlocksSoFar, turnKey, contentExcerpt,
   };
 }
 
@@ -202,6 +211,10 @@ export async function runHookReport() {
     const turnKey = sessionId ? `${sessionId}:${usage.turnKey}` : null;
 
     const body = { model: usage.model, actual_tokens: usage.tokens, turn_key: turnKey };
+    // Additive only - the backend already treats a missing/invalid value as
+    // "no breakdown available" and falls back to the plain total, so it's
+    // safe to just omit this rather than validate it client-side too.
+    if (usage.outputTokens > 0) body.actual_output_tokens = usage.outputTokens;
     // content_excerpt is optional and additive - the backend classifies it
     // if present, samples/rate-limits on its own, and silently skips when
     // it isn't. Sending it is not required for the usage report itself to

package/src/init.js

@@ -100,7 +100,7 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
       } catch (err) {
         console.log(`    • Claude Code usage capture  ✗  (${err.message})`);
       }
-      await maybeEnableClaudeCodeProxy(proxyOptIn);
+      await maybeEnableClaudeCodeProxy(proxyOptIn, key);
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -583,12 +583,24 @@ export function troxyModelProxyBaseUrl() {
 //   2. Remote Control is disabled while the base URL points elsewhere
 //      (Claude Code v2.1.196+) - nothing to configure around this one, it's
 //      just true while the proxy is active, hence the up-front warning.
-export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUrl()) {
+export function patchClaudeCodeProxy(configPath, troxyKey, baseUrl = troxyModelProxyBaseUrl()) {
   let config = {};
   try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
   if (!config.env) config.env = {};
   config.env.ANTHROPIC_BASE_URL = baseUrl;
   config.env.ENABLE_TOOL_SEARCH = 'true';
+  // Found live 2026-09-04: without this, Claude Code still authenticates to
+  // whatever base_url it's pointed at using its own Anthropic credential (an
+  // API key sent as x-api-key, or a Claude.ai OAuth session token sent as
+  // Authorization) - neither is a Troxy key, so the model-proxy's
+  // authenticate_api_key(troxy_key) check (reads the Authorization header)
+  // rejected every real request as "invalid or revoked Troxy API key",
+  // silently making the whole proxy path a no-op regardless of base URL.
+  // ANTHROPIC_AUTH_TOKEN is the one Claude Code env var that maps directly
+  // onto Authorization: Bearer <value> (same docs page as above) - setting
+  // it to the Troxy key is what the model-proxy actually needs to identify
+  // the caller.
+  if (troxyKey) config.env.ANTHROPIC_AUTH_TOKEN = troxyKey;
 
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
@@ -601,7 +613,7 @@ export function patchClaudeCodeProxy(configPath, baseUrl = troxyModelProxyBaseUr
 //   proxyOptIn === null  -> not passed; ask interactively if there's a TTY,
 //                           otherwise skip (a scripted/CI init must never hang
 //                           on a prompt, and silence must never mean yes)
-async function maybeEnableClaudeCodeProxy(proxyOptIn) {
+async function maybeEnableClaudeCodeProxy(proxyOptIn, key) {
   let enable = proxyOptIn === true;
   if (proxyOptIn === null && process.stdin.isTTY) {
     console.log("\n  Route Claude Code's model calls through Troxy for automatic cost");
@@ -609,15 +621,14 @@ async function maybeEnableClaudeCodeProxy(proxyOptIn) {
     console.log('  opportunity, not just suggest one.');
     console.log("  Trade-off: while this is on, Claude Code's Remote Control feature is");
     console.log('  disabled (Anthropic disables it whenever the API base URL points');
-    console.log('  anywhere other than api.anthropic.com). Also, model policies (e.g. a');
-    console.log('  BLOCK rule on a specific model) are not enforced on this path yet -');
-    console.log('  only the cost-saving model swap is live.');
+    console.log('  anywhere other than api.anthropic.com). Model policies (e.g. a BLOCK');
+    console.log('  rule on a specific model) ARE enforced on this path.');
     const answer = await prompt('  Enable? (y/N): ');
     enable = /^y(es)?$/i.test(answer);
   }
   if (!enable) return;
   try {
-    patchClaudeCodeProxy(claudeCodeSettingsPath());
+    patchClaudeCodeProxy(claudeCodeSettingsPath(), key);
     console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
   } catch (err) {
     console.log(`    • Claude Code model proxy  ✗  (${err.message})`);

package/src/tests/claude-code-proxy.test.js

@@ -1,11 +1,12 @@
 // Checklist #17 ("one-command proxy setup"): patchClaudeCodeProxy writes
-// ANTHROPIC_BASE_URL + ENABLE_TOOL_SEARCH into Claude Code's global
-// settings.json `env` block, so its own model calls route through
-// proxy.troxy.io instead of straight to Anthropic. This is opt-in only
-// (Gilad, 2026-08-29) - the prompt/flag gating that decides WHETHER to call
-// this lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not
-// tested here; this file covers what actually gets written once it's
-// called, same split as claude-code-hook.test.js does for the hooks patch.
+// ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN + ENABLE_TOOL_SEARCH into Claude
+// Code's global settings.json `env` block, so its own model calls route
+// through proxy.troxy.io instead of straight to Anthropic, AND authenticate
+// as this Troxy user once they get there. This is opt-in only (Gilad,
+// 2026-08-29) - the prompt/flag gating that decides WHETHER to call this
+// lives in reprovisionKeyConsumers/maybeEnableClaudeCodeProxy, not tested
+// here; this file covers what actually gets written once it's called, same
+// split as claude-code-hook.test.js does for the hooks patch.
 
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
@@ -22,28 +23,45 @@ afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
 describe('patchClaudeCodeProxy', () => {
   const configPath = () => path.join(dir, 'settings.json');
   const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const KEY = 'txy-test-key-123';
 
   it('creates the env block with ANTHROPIC_BASE_URL when the file does not exist', () => {
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
   });
 
   it('sets ENABLE_TOOL_SEARCH so the model-proxy\'s forwarded tool_reference blocks still work', () => {
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ENABLE_TOOL_SEARCH, 'true');
   });
 
+  it('sets ANTHROPIC_AUTH_TOKEN to the Troxy key - found live 2026-09-04: without this, ' +
+     'Claude Code sends its own Anthropic credential as Authorization, and the model-proxy ' +
+     'rejects every real request as an invalid Troxy key, making the whole proxy path a no-op',
+  () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
+  });
+
+  it('does not write ANTHROPIC_AUTH_TOKEN at all when no key is given, rather than writing "undefined"', () => {
+    patchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, undefined);
+  });
+
   it('accepts a custom base URL for testing/overrides instead of hardcoding proxy.troxy.io', () => {
-    patchClaudeCodeProxy(configPath(), 'https://staging.example.com');
+    patchClaudeCodeProxy(configPath(), KEY, 'https://staging.example.com');
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://staging.example.com');
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
   });
 
   it('preserves unrelated existing env keys instead of replacing the whole block', () => {
     fs.writeFileSync(configPath(), JSON.stringify({ env: { SOME_OTHER_VAR: 'keep-me' } }));
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
@@ -51,21 +69,22 @@ describe('patchClaudeCodeProxy', () => {
 
   it('preserves unrelated top-level keys (e.g. hooks already written by patchClaudeCodeHooks)', () => {
     fs.writeFileSync(configPath(), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'x' }] }] } }));
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.ok(cfg.hooks.Stop.length === 1, 'existing hooks block was dropped');
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
   });
 
   it('re-running is idempotent - overwrites rather than duplicating or erroring', () => {
-    patchClaudeCodeProxy(configPath());
-    patchClaudeCodeProxy(configPath());
+    patchClaudeCodeProxy(configPath(), KEY);
+    patchClaudeCodeProxy(configPath(), KEY);
     const cfg = read();
     assert.equal(cfg.env.ANTHROPIC_BASE_URL, troxyModelProxyBaseUrl());
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, KEY);
   });
 
   it('does not throw when the existing file is corrupted JSON', () => {
     fs.writeFileSync(configPath(), '{ not json');
-    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath()));
+    assert.doesNotThrow(() => patchClaudeCodeProxy(configPath(), KEY));
   });
 });

package/src/tests/hook-report.test.js

@@ -59,8 +59,9 @@ describe('extractUsage', () => {
       },
     };
     const result = extractUsage(entry);
-    assert.deepEqual(Object.keys(result).sort(), ['effort', 'messageId', 'model', 'tokens']);
+    assert.deepEqual(Object.keys(result).sort(), ['effort', 'messageId', 'model', 'outputTokens', 'tokens']);
     assert.equal(result.effort, 'high');
+    assert.equal(result.outputTokens, 5);
     assert.ok(!JSON.stringify(result).includes('actual conversation'));
   });
 
@@ -108,6 +109,20 @@ describe('usageForCurrentTurn', () => {
     assert.equal(result.tokens, 10 + 20 + 5 + 8);
   });
 
+  it('sums outputTokens (reply-only) alongside tokens, same dedup-by-message-id rule', () => {
+    // Same fixture as the two-real-model-calls test above - outputTokens must
+    // dedup identically (20 + 8, not 20+20+8) since it comes off the same
+    // per-message.id `seen` map as the combined total.
+    writeLines([
+      { type: 'user', message: { content: [{ type: 'text', text: 'hi' }] } },
+      assistantLine('msg_1', { input_tokens: 10, output_tokens: 20 }),
+      assistantLine('msg_1', { input_tokens: 10, output_tokens: 20 }),
+      assistantLine('msg_2', { input_tokens: 5, output_tokens: 8 }),
+    ]);
+    const result = usageForCurrentTurn(transcriptPath());
+    assert.equal(result.outputTokens, 20 + 8, 'reply-only total did not dedup by message.id like tokens does');
+  });
+
   it('only looks back to the last user-authored line, not the whole session', () => {
     writeLines([
       { type: 'user', message: { content: [{ type: 'text', text: 'first turn' }] } },