troxy-cli 1.29.13 → 1.29.15

package/bin/troxy.js

@@ -12,7 +12,7 @@ import { runSettings }                 from '../src/settings.js';
 import { runApprovals }                from '../src/approvals.js';
 import { runAccount }                  from '../src/account.js';
 import { runSecrets }                  from '../src/secrets.js';
-import { api }                         from '../src/api.js';
+import { api, checkLatestVersion }     from '../src/api.js';
 import { table }                       from '../src/print.js';
 import { printSimHelp, runSend, runSignin, runAction, runModelCall, runScan } from '../src/simulate.js';
 
@@ -70,8 +70,7 @@ switch (command) {
     const { version } = createRequire(import.meta.url)('../package.json');
     process.stdout.write(version);
     try {
-      const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) });
-      const { version: latest } = await res.json();
+      const latest = await checkLatestVersion();
       if (version !== latest) {
         process.stdout.write(`  ⚠  ${latest} available, run: troxy update`);
       }
@@ -495,8 +494,7 @@ switch (command) {
       const { createRequire } = await import('module');
       const require = createRequire(import.meta.url);
       const { version: current } = require('../package.json');
-      const res  = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(3000) });
-      const { version: latest } = await res.json();
+      const latest = await checkLatestVersion();
       if (current !== latest) {
         console.log(`  ⚠  New version available: ${latest} (you have ${current})`);
         console.log(`     Run: troxy update\n`);
@@ -560,8 +558,7 @@ switch (command) {
     process.stdout.write('\n  Checking for updates... ');
     let latest;
     try {
-      const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', { signal: AbortSignal.timeout(5000) });
-      ({ version: latest } = await res.json());
+      latest = await checkLatestVersion(5000);
     } catch {
       console.log('✗');
       console.error('\n  Could not reach npm registry. Check your connection.\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.13",
+  "version": "1.29.15",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/api.js

@@ -18,6 +18,18 @@ export const CLI_VERSION = (() => {
   }
 })();
 
+// Fetches the latest published version from the npm registry. Throws on
+// any failure (network error, timeout, bad response) — callers that just
+// want to print an upgrade nudge should swallow the error; `troxy update`
+// needs to tell the difference and reports it to the user.
+export async function checkLatestVersion(timeoutMs = 3000) {
+  const res = await fetch('https://registry.npmjs.org/troxy-cli/latest', {
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  const { version } = await res.json();
+  return version;
+}
+
 async function request(method, path, { apiKey, jwt, body } = {}) {
   const headers = { 'Content-Type': 'application/json' };
   if (apiKey) headers['X-Troxy-Key'] = apiKey;

package/src/daemon.js

@@ -23,6 +23,7 @@ import { api } from './api.js';
 import { createInterceptor } from './interceptor.js';
 import { enabledProviders, interceptHostsFor, troxyRouteFor } from './providers.js';
 import { ensureInterceptionCerts } from './tls-ca.js';
+import { migrateBaseUrlProxyToInterception, claudeCodeSettingsPath } from './init.js';
 
 const INTERVAL_MS = 60_000;
 
@@ -55,9 +56,28 @@ function _log(fmt, ...args) {
  * without touching whatever the real machine running the test has there.
  * `port` defaults to INTERCEPTOR_PORT, injectable so a test doesn't
  * collide with a real daemon that might already be running on this
- * machine.
+ * machine. `configPath` defaults to the real ~/.claude/settings.json,
+ * injectable for the same reason.
+ *
+ * Also self-heals a machine still stuck on the old ANTHROPIC_BASE_URL
+ * substitution (retired 2026-09-08, see migrateBaseUrlProxyToInterception's
+ * own docstring in init.js): that migration previously only ran inside
+ * `troxy init`, so a machine that set it up before the retirement and never
+ * re-ran init keeps routing terminal traffic straight to model-proxy via
+ * Claude Code's own HTTP client - a path this codebase never touches at
+ * all, so it can never carry the x-troxy-surface header buildTroxyForwardHeaders
+ * (interceptor.js) sets. Confirmed live: 30 days of real traffic with zero
+ * surface='terminal' rows, all landing as unattributed NULL instead. Running
+ * the same migration here too means every daemon (re)start heals it, not
+ * just an interactive `init` the user may never re-run.
  */
-export function startInterceptor({ troxyDir = path.join(os.homedir(), '.troxy'), port = INTERCEPTOR_PORT } = {}) {
+export function startInterceptor({
+  troxyDir = path.join(os.homedir(), '.troxy'),
+  port = INTERCEPTOR_PORT,
+  configPath = claudeCodeSettingsPath(),
+} = {}) {
+  migrateBaseUrlProxyToInterception(configPath);
+
   const providers = enabledProviders();
   const interceptHosts = interceptHostsFor(providers);
   if (interceptHosts.length === 0) return null;

package/src/providers.js

@@ -6,15 +6,11 @@
  * route here - passes through as a blind byte tunnel, never parsed, never
  * visible to this codebase at all.
  *
- * Phase 1 (see the plan doc) is Anthropic only. openai_codex/cursor are
- * declared here, disabled, purely so Phase 2/3 is a data change to this
- * file later, not a rewrite of the interceptor or the CA logic - the
- * provider's real divergence (Codex signs with CODEX_CA_CERTIFICATE, not
- * NODE_EXTRA_CA_CERTS, since it's Rust-based) is already captured as a
- * field, not hardcoded control flow, even though it isn't wired to
- * anything yet. Do not flip `enabled` on either without first doing that
- * phase's own hands-on verification - see the plan's Phase 2/3 section for
- * exactly what's still unverified about each.
+ * Phase 1 (see the plan doc) is Anthropic only. Codex/Cursor support was
+ * speculatively declared here, disabled, ahead of Phase 2/3 - deleted per
+ * YAGNI (ponytail audit): re-add when that phase actually ships, with its
+ * own hands-on verification of each provider's real divergence (e.g. Codex
+ * signs with CODEX_CA_CERTIFICATE, not NODE_EXTRA_CA_CERTS).
  */
 
 export const PROVIDERS = [
@@ -28,28 +24,6 @@ export const PROVIDERS = [
     ],
     envKeys: { proxy: 'HTTPS_PROXY', ca: 'NODE_EXTRA_CA_CERTS' },
   },
-  {
-    id: 'openai_codex',
-    name: 'Codex CLI',
-    enabled: false, // Phase 2 - not wired up. See plan doc: no official network-config
-                     // doc exists for Codex, and whether its TLS stack enforces
-                     // nameConstraints the way OpenSSL does is unverified.
-    interceptHosts: ['api.openai.com'],
-    troxyRoutes: [],
-    envKeys: { proxy: 'HTTPS_PROXY', ca: 'CODEX_CA_CERTIFICATE' },
-  },
-  {
-    id: 'cursor',
-    name: 'Cursor',
-    enabled: false, // Phase 3 - not wired up, shape genuinely unknown. See plan doc:
-                     // Cursor routes ALL traffic through its own backend even with
-                     // BYOK, so this would need to intercept api2.cursor.sh (Cursor
-                     // itself), not a model provider - a materially different,
-                     // unverified scope. Needs its own hands-on test before design.
-    interceptHosts: [],
-    troxyRoutes: [],
-    envKeys: {},
-  },
 ];
 
 export function enabledProviders() {

package/src/proxy.js

@@ -172,6 +172,13 @@ export async function runProxyEnable(flags = {}) {
 
 export function runProxyDisable() {
   const settingsPath = claudeCodeSettingsPath();
+
+  // Same restart hazard as uninstall.js's own fix: a Claude Code process
+  // already running has these two env vars loaded in memory, independent of
+  // what settings.json says from this point on. Check BEFORE unpatching so
+  // this reflects the state the running process actually launched with.
+  const wasIntercepting = interceptionIsConfigured(settingsPath);
+
   process.stdout.write('\n  Removing HTTPS_PROXY / NODE_EXTRA_CA_CERTS from settings.json...  ');
   try {
     unpatchClaudeCodeInterception(settingsPath);
@@ -181,4 +188,14 @@ export function runProxyDisable() {
     console.error(`\n  ${err.message}\n`);
     process.exit(1);
   }
+
+  if (wasIntercepting) {
+    console.log('  ⚠  Restart Claude Code / Claude Desktop now for this to take effect -');
+    console.log('     the running process still has the old proxy settings loaded in');
+    console.log('     memory and will keep routing through Troxy until you do.\n');
+  }
+
+  console.log('  The CLI, background daemon, certificate, and your API key are all still');
+  console.log('  in place - this only stops routing calls through Troxy. Turn it back on');
+  console.log('  any time with: troxy proxy enable --experimental\n');
 }

package/src/simulate.js

@@ -219,25 +219,27 @@ export function _scanBody(flags) {
   };
 }
 
-export async function runSend(flags) {
-  const apiKey = _requireApiKey();
-  _report(await api.evaluateEmail(_sendBody(flags), apiKey));
-}
-
-export async function runSignin(flags) {
-  const apiKey = _requireApiKey();
-  _report(await api.evaluateLogin(_signinBody(flags), apiKey));
-}
+// send/signin/action/model-call all just build a body, POST it, and print
+// the standard report - a lookup table drives them instead of four copies
+// of the same two lines. runScan below is NOT in this table: it has real
+// extra behavior (printing detections) so it stays its own function.
+const SIMULATORS = {
+  send:         [api.evaluateEmail,  _sendBody],
+  signin:       [api.evaluateLogin,  _signinBody],
+  action:       [api.evaluateAction, _actionBody],
+  'model-call': [api.evaluateModel,  _modelCallBody],
+};
 
-export async function runAction(flags) {
+async function _runSimulator(kind, flags) {
+  const [evaluate, buildBody] = SIMULATORS[kind];
   const apiKey = _requireApiKey();
-  _report(await api.evaluateAction(_actionBody(flags), apiKey));
+  _report(await evaluate(buildBody(flags), apiKey));
 }
 
-export async function runModelCall(flags) {
-  const apiKey = _requireApiKey();
-  _report(await api.evaluateModel(_modelCallBody(flags), apiKey));
-}
+export const runSend      = (flags) => _runSimulator('send', flags);
+export const runSignin    = (flags) => _runSimulator('signin', flags);
+export const runAction    = (flags) => _runSimulator('action', flags);
+export const runModelCall = (flags) => _runSimulator('model-call', flags);
 
 export async function runScan(flags) {
   const apiKey = _requireApiKey();

package/src/tests/daemon.test.js

@@ -82,4 +82,33 @@ describe('startInterceptor', () => {
     const err = await new Promise((resolve) => { server.on('error', resolve); });
     assert.equal(err.code, 'EADDRINUSE');
   });
+
+  it('self-heals a machine still on the old ANTHROPIC_BASE_URL substitution on every start, ' +
+     'not just an interactive `troxy init` the user may never re-run', async () => {
+    const configPath = path.join(dir, 'settings.json');
+    fs.writeFileSync(configPath, JSON.stringify({
+      env: { ANTHROPIC_BASE_URL: 'https://proxy.troxy.io', ANTHROPIC_AUTH_TOKEN: 'txy-abc', ENABLE_TOOL_SEARCH: 'true' },
+    }));
+
+    const server = startInterceptor({ troxyDir: dir, port: 0, configPath });
+    servers.push(server);
+    await new Promise((resolve, reject) => { server.on('listening', resolve); server.on('error', reject); });
+
+    const settings = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    assert.equal(settings.env.ANTHROPIC_BASE_URL, undefined);
+    assert.equal(settings.env.ANTHROPIC_AUTH_TOKEN, undefined);
+    assert.equal(settings.env.ENABLE_TOOL_SEARCH, undefined);
+  });
+
+  it('leaves a settings.json with no Troxy-owned base-URL keys untouched', async () => {
+    const configPath = path.join(dir, 'settings.json');
+    fs.writeFileSync(configPath, JSON.stringify({ env: { SOME_OTHER_VAR: '1' } }));
+
+    const server = startInterceptor({ troxyDir: dir, port: 0, configPath });
+    servers.push(server);
+    await new Promise((resolve, reject) => { server.on('listening', resolve); server.on('error', reject); });
+
+    const settings = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    assert.equal(settings.env.SOME_OTHER_VAR, '1');
+  });
 });

package/src/tests/providers.test.js

@@ -1,11 +1,7 @@
 // The single source of truth for which hosts the local interceptor ever
 // terminates TLS for, and where an intercepted request gets re-addressed
-// to. Only 'anthropic' is enabled in Phase 1 - openai_codex/cursor are
-// declared but disabled, so Phase 2/3 becomes a data change later, not a
-// rewrite (see the plan doc). The critical property this file's tests
-// guard: a disabled provider must NEVER contribute to the live intercept
-// allowlist - that's the guardrail against a Phase-2 stub silently
-// widening what gets MITM'd before it's actually ready.
+// to. Only 'anthropic' is declared/enabled in Phase 1 (see the plan doc;
+// Codex/Cursor entries were deleted per YAGNI until that phase ships).
 
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
@@ -18,13 +14,6 @@ describe('PROVIDERS', () => {
     assert.equal(anthropic.enabled, true);
     assert.deepEqual(anthropic.interceptHosts, ['api.anthropic.com']);
   });
-
-  it('codex and cursor are declared but NOT enabled - Phase 1 is Anthropic only', () => {
-    const codex = PROVIDERS.find(p => p.id === 'openai_codex');
-    const cursor = PROVIDERS.find(p => p.id === 'cursor');
-    assert.equal(codex.enabled, false);
-    assert.equal(cursor.enabled, false);
-  });
 });
 
 describe('enabledProviders', () => {
@@ -32,8 +21,6 @@ describe('enabledProviders', () => {
     const providers = enabledProviders();
     assert.ok(providers.every(p => p.enabled === true));
     assert.ok(providers.some(p => p.id === 'anthropic'));
-    assert.ok(!providers.some(p => p.id === 'openai_codex'));
-    assert.ok(!providers.some(p => p.id === 'cursor'));
   });
 });
 
@@ -42,12 +29,6 @@ describe('interceptHostsFor', () => {
     assert.deepEqual(interceptHostsFor(enabledProviders()), ['api.anthropic.com']);
   });
 
-  it('a disabled provider passed in explicitly contributes nothing - ' +
-     'enabling it later must be a deliberate PROVIDERS edit, not automatic', () => {
-    const cursor = PROVIDERS.find(p => p.id === 'cursor');
-    assert.deepEqual(interceptHostsFor([cursor]), []);
-  });
-
   it('empty input yields an empty allowlist, not an error', () => {
     assert.deepEqual(interceptHostsFor([]), []);
   });

package/src/tests/proxy-wiring.test.js

@@ -116,3 +116,25 @@ describe('uninstall.js: settings.json symmetry (fail-open layer 6)', () => {
     assert.match(surrounding, /try\s*\{[\s\S]*unpatchClaudeCodeConfig[\s\S]*\}\s*catch/);
   });
 });
+
+describe('proxy.js: runProxyDisable restart warning (same hazard as uninstall.js)', () => {
+  const proxySrc = readFileSync(join(__dirname, '..', 'proxy.js'), 'utf8');
+
+  it('checks interceptionIsConfigured BEFORE unpatching, not after', () => {
+    const checkIdx = proxySrc.indexOf('interceptionIsConfigured(settingsPath)');
+    const unpatchIdx = proxySrc.indexOf('unpatchClaudeCodeInterception(settingsPath)');
+    assert.ok(checkIdx !== -1 && unpatchIdx !== -1);
+    assert.ok(checkIdx < unpatchIdx, 'must read whether interception was configured before unpatching removes the evidence');
+  });
+
+  it('warns to restart Claude Code only when it was actually intercepting', () => {
+    const warnIdx = proxySrc.indexOf('now for this to take effect');
+    assert.ok(warnIdx !== -1, 'restart warning text not found');
+    const guardIdx = proxySrc.lastIndexOf('if (wasIntercepting)', warnIdx);
+    assert.ok(guardIdx !== -1 && guardIdx < warnIdx, 'restart warning must be gated behind an if (wasIntercepting) check');
+  });
+
+  it('reassures the user that disable leaves the CLI, daemon, cert and API key untouched', () => {
+    assert.match(proxySrc, /CLI, background daemon, certificate, and your API key are all still/);
+  });
+});

package/src/tool_detect.js

@@ -92,9 +92,7 @@ export async function reportToolPlans(apiKey, detected) {
 
 // The full flow, shared by `troxy init` (a quiet inventory step) and
 // `troxy tools` (an explicit re-scan). No prompting - detection is a fact,
-// not a question - so `interactive` no longer changes behavior; kept as a
-// parameter so callers don't need to change, in case a future non-detection
-// step needs the distinction.
+// not a question.
 export async function runToolDetection(apiKey) {
   const detected = detectAiTools();
   if (detected.every(d => !d.installed)) return;