troxy-cli 1.29.15 → 1.29.16

package/bin/troxy.js

@@ -704,6 +704,13 @@ switch (command) {
     troxy status                   API health + MCP status (no login needed)
     troxy update                   Update to the latest version
 
+  Proxy (experimental - routes Claude's own model calls through Troxy for
+  real-time policy enforcement and cost optimization, separate from the MCP
+  connection above)
+    troxy proxy status             Show whether it's on, and cert/interceptor health
+    troxy proxy enable --experimental   Turn it on (installs a local CA cert)
+    troxy proxy disable            Turn it off - removes the settings.json patch
+
   Everything else requires: troxy login
 
   MCP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.15",
+  "version": "1.29.16",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {
@@ -14,9 +14,17 @@
     "test": "node --test src/tests/*.test.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.10.2",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "node-forge": "^1.4.0"
   },
+  "overrides": {
+    "fast-uri": "^3.1.6",
+    "ip-address": "^10.3.1",
+    "hono": "^4.13.8",
+    "qs": "^6.16.0",
+    "body-parser": "^2.3.0",
+    "@hono/node-server": "^1.19.17"
+  },
   "engines": {
     "node": ">=18"
   },

package/src/action-classification.js

@@ -0,0 +1,195 @@
+// Turns a Bash tool_input about to run into the same {action_verb, resource,
+// item_count} shape the evaluate_action MCP tool asks agents to self-report
+// (see mcp-server.js's evaluate_action inputSchema) - so the PreToolUse hook
+// can ask on the agent's behalf instead of trusting it to call the tool
+// first. That trust was the exact gap evaluate_model already proved doesn't
+// hold (see pretooluse-hook.js's own docstring): a real session ran a
+// destructive command directly and never checked in.
+//
+// Regex over shell segments, not a real shell parser - same tradeoff
+// command-compaction.js makes, but the opposite risk direction. There, a
+// wrong match rewrites the user's actual command, so the rules are narrow
+// and a miss is harmless. Here, a match only ever ADDS one evaluate_action
+// round-trip inside the hook's existing fail-open budget - the backend
+// still makes the real ALLOW/BLOCK call, so a false match costs latency,
+// nothing worse. A MISS, on the other hand, silently falls back to the
+// pre-existing advisory MCP path (unchanged, not made worse). So unlike
+// command-compaction.js, it's fine - correct, even - for these rules to
+// err a little broad rather than a little narrow.
+//
+// Deliberately not exhaustive: this covers the highest-confidence,
+// highest-blast-radius shapes (recursive/plain deletes, force-pushes,
+// branch deletes, infra destroys, DB drops/truncates) rather than trying to
+// pattern-match every verb evaluate_action's schema lists (share, upload,
+// export, revoke are too shape-varied to recognize reliably from a raw
+// command string without a much higher false-positive rate). Extend this
+// list as real gaps show up, not preemptively.
+//
+// item_count is only ever a real count (e.g. the number of path arguments
+// to `rm`) or the tool's own documented default of 1 - never a guess at
+// how many rows/records/files a command will actually touch, since this
+// module does no I/O (no listing directories, no querying the resource) by
+// design: it runs synchronously, inline, on every single tool call.
+//
+// reversible is never set here, only ever omitted. evaluate_action's own
+// contract treats an undeclared reversibility as irreversible so a guess
+// can't wave something through - a heuristic classifier has even less
+// business claiming reversibility than the agent itself does, so it never
+// tries.
+
+function segments(command) {
+  // Split on top-level &&, ||, |, ;, and newlines - but not inside a single
+  // or double-quoted string, so `echo "rm -rf /" && ls` doesn't let the
+  // quoted text leak a false match into its own segment. Doesn't handle
+  // nested $(...) or backticks; a command hidden inside one of those is a
+  // known miss, not a wrong-direction failure (see module docstring).
+  const parts = [];
+  let current = '';
+  let quote = null;
+  for (const ch of command) {
+    if (quote) {
+      current += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n') {
+      parts.push(current);
+      current = '';
+      continue;
+    }
+    current += ch;
+  }
+  parts.push(current);
+  return parts.map((s) => s.trim()).filter(Boolean);
+}
+
+// Non-flag tokens after a leading command name - `rm -rf a.txt b.txt` -> ['a.txt', 'b.txt'].
+function pathArgs(segment, afterWords) {
+  const words = segment.split(/\s+/).slice(afterWords);
+  return words.filter((w) => w && !w.startsWith('-'));
+}
+
+function summarizeResource(paths, fallback) {
+  if (!paths.length) return fallback;
+  const shown = paths.slice(0, 3).join(', ');
+  return paths.length > 3 ? `${shown} (+${paths.length - 3} more)` : shown;
+}
+
+const DB_CLI = /^(psql|mysql|mariadb|sqlite3|mongosh?|redis-cli)\b/i;
+
+// Each rule: test a single shell segment, return {action_verb, resource,
+// item_count} or null. First match wins - one flagged segment in a compound
+// command is enough to trigger a check, see module docstring.
+const RULES = [
+  // rm: any invocation with at least one non-flag argument. Not narrowed to
+  // -rf on purpose - `rm one-file.txt` is still a real, irreversible delete.
+  (segment) => {
+    if (!/^rm\s+\S/.test(segment)) return null;
+    const paths = pathArgs(segment, 1);
+    return {
+      action_verb: 'delete',
+      resource: summarizeResource(paths, 'file(s) via rm'),
+      item_count: paths.length || 1,
+    };
+  },
+
+  // git push --force / -f / --force-with-lease
+  (segment) => {
+    if (!/^git\s+push\b/.test(segment)) return null;
+    if (!/(\s--force(-with-lease)?\b|\s-f\b)/.test(segment)) return null;
+    const paths = pathArgs(segment, 2).filter((w) => !w.startsWith('--'));
+    return {
+      action_verb: 'force_push',
+      resource: summarizeResource(paths, 'the remote branch'),
+      item_count: 1,
+    };
+  },
+
+  // git branch -D, or git push <remote> --delete <branch> / :<branch>
+  (segment) => {
+    if (/^git\s+branch\b.*\s-D\b/.test(segment)) {
+      const paths = pathArgs(segment, 2).filter((w) => !w.startsWith('-'));
+      return { action_verb: 'delete', resource: summarizeResource(paths, 'a branch'), item_count: 1 };
+    }
+    if (/^git\s+push\b/.test(segment) && (/\s--delete\b/.test(segment) || /\s\S*:\S+/.test(segment))) {
+      // `git push origin :branch` (empty source = delete) and
+      // `git push origin local:branch` both use the same refspec shape;
+      // either way the part after the colon is the remote branch being
+      // touched, which is what matters here regardless of which it deletes.
+      const target = segment.match(/--delete\s+(\S+)/)?.[1] || segment.match(/\s\S*:(\S+)/)?.[1];
+      return { action_verb: 'delete', resource: target || 'a remote branch', item_count: 1 };
+    }
+    return null;
+  },
+
+  // terraform destroy
+  (segment) => {
+    if (!/^terraform\s+destroy\b/.test(segment)) return null;
+    const target = segment.match(/-target[= ]("[^"]+"|\S+)/)?.[1];
+    return { action_verb: 'destroy', resource: target || 'infrastructure (terraform)', item_count: 1 };
+  },
+
+  // kubectl delete
+  (segment) => {
+    if (!/^kubectl\s+delete\b/.test(segment)) return null;
+    const paths = pathArgs(segment, 2);
+    return { action_verb: 'delete', resource: summarizeResource(paths, 'a cluster resource'), item_count: paths.length || 1 };
+  },
+
+  // docker rm / rmi / volume rm / system prune
+  (segment) => {
+    if (!/^docker\s+(rm|rmi)\b/.test(segment) && !/^docker\s+volume\s+rm\b/.test(segment) && !/^docker\s+system\s+prune\b/.test(segment)) {
+      return null;
+    }
+    const paths = pathArgs(segment, segment.startsWith('docker volume') ? 3 : 2);
+    return { action_verb: 'delete', resource: summarizeResource(paths, 'docker resource(s)'), item_count: paths.length || 1 };
+  },
+
+  // aws s3 rm
+  (segment) => {
+    if (!/^aws\s+s3\s+rm\b/.test(segment)) return null;
+    const paths = pathArgs(segment, 3);
+    return { action_verb: 'delete', resource: summarizeResource(paths, 'an s3 path'), item_count: 1 };
+  },
+
+  // DB DROP TABLE/DATABASE/SCHEMA - only when the segment is actually
+  // invoking a known DB CLI, to avoid matching the words inside unrelated
+  // text (a commit message, a comment, an echoed string).
+  (segment) => {
+    if (!DB_CLI.test(segment)) return null;
+    if (/\bdrop\s+(table|database|schema)\b/i.test(segment)) {
+      const resource = segment.match(/\bdrop\s+(?:table|database|schema)\s+([^\s"')]+)/i)?.[1];
+      return { action_verb: 'drop', resource: resource || 'a database object', item_count: 1 };
+    }
+    if (/\btruncate\s+table\b/i.test(segment)) {
+      const resource = segment.match(/\btruncate\s+table\s+([^\s"')]+)/i)?.[1];
+      return { action_verb: 'truncate', resource: resource || 'a table', item_count: 1 };
+    }
+    return null;
+  },
+];
+
+// Returns {action_verb, resource, item_count} for the first recognized
+// destructive shape found anywhere in the command, or null. Only Bash is
+// handled for now - Write/Edit overwriting an existing file is a much
+// noisier signal (nearly every edit would match) and usually git-recoverable,
+// so it's deliberately left to the advisory evaluate_action path rather than
+// flagged here.
+export function actionFor(toolName, toolInput) {
+  if (toolName !== 'Bash') return null;
+  const command = toolInput?.command;
+  if (!command || typeof command !== 'string') return null;
+
+  for (const segment of segments(command)) {
+    for (const rule of RULES) {
+      const match = rule(segment);
+      if (match) return match;
+    }
+  }
+  return null;
+}

package/src/api.js

@@ -68,13 +68,18 @@ export const api = {
   // use, so a condition that previews as firing is trusted, not guessed.
   previewPolicy: (jwt, b)    => request('POST',   '/dashboard/policies/preview', { jwt, body: b }),
 
-  // Org (admin can write, any active member can read - see orgs.py's
-  // is_org_admin vs is_org_member split). org_id comes from currentOrg().
-  currentOrg:      (jwt)             => request('GET',    '/orgs/current',              { jwt }),
-  listOrgPolicies: (jwt, orgId)      => request('GET',    `/orgs/${orgId}/policies`,     { jwt }),
-  createOrgPolicy: (jwt, orgId, b)   => request('POST',   `/orgs/${orgId}/policies`,     { jwt, body: b }),
-  updateOrgPolicy: (jwt, orgId, id, b) => request('PATCH', `/orgs/${orgId}/policies/${id}`, { jwt, body: b }),
-  deleteOrgPolicy: (jwt, orgId, id)  => request('DELETE', `/orgs/${orgId}/policies/${id}`, { jwt }),
+  // Org-scoped policies (admin can write, any active member can read - see
+  // workspaces.py's is_workspace_admin vs is_workspace_member split).
+  // "Org" here is the policy scope tier (org-wide vs space-scoped), not the
+  // tenant - kept as-is to match the backend's policies.scope column and
+  // the dashboard's --org flag naming. workspaceId comes from
+  // currentWorkspace() and is the tenant's id, passed in to build these
+  // org-scoped-policy URLs.
+  currentWorkspace: (jwt)                  => request('GET',    '/workspaces/current',              { jwt }),
+  listOrgPolicies: (jwt, workspaceId)      => request('GET',    `/workspaces/${workspaceId}/policies`,     { jwt }),
+  createOrgPolicy: (jwt, workspaceId, b)   => request('POST',   `/workspaces/${workspaceId}/policies`,     { jwt, body: b }),
+  updateOrgPolicy: (jwt, workspaceId, id, b) => request('PATCH', `/workspaces/${workspaceId}/policies/${id}`, { jwt, body: b }),
+  deleteOrgPolicy: (jwt, workspaceId, id)  => request('DELETE', `/workspaces/${workspaceId}/policies/${id}`, { jwt }),
 
   // Activity + insights
   activity:   (jwt, limit) => request('GET', `/dashboard/activity?limit=${limit || 20}`, { jwt }),

package/src/policies.js

@@ -30,7 +30,7 @@ function _promptYN(question) {
 }
 
 const HELP = {
-  list: `  troxy policies list [--org]\n\n  Lists every org and space policy currently in force for you. --org narrows this to just your organization's policies (any member can read them, admin-authored).\n`,
+  list: `  troxy policies list [--org]\n\n  Lists every org and space policy currently in force for you. --org narrows this to just your workspace's policies (any member can read them, admin-authored).\n`,
   describe: `  troxy policies describe --name <policy-name> [--org]\n\n  Shows full details for a single policy.\n\n  Options:\n    --name   Name of the policy (use single quotes for names with special chars)\n    --org    Look up an org policy specifically, instead of the combined org+space view\n`,
   create: `  troxy policies create --name <name> --action <action> --domain <domain> [options]\n  troxy policies create --name <name> --action <action> --template "<template label>"\n  troxy policies create --describe "<plain English>"\n\n  Creates a new policy. Login required. Policy creation is admin-only and\n  always org-wide - pass --org (admin access required). Personal-scope and\n  per-MCP policies no longer exist; space-scoped creation isn't available\n  from the CLI yet, use the dashboard for that.\n\n  Checkpoints (--domain), one per Troxy checkpoint - what the policy is about:\n    payment       paying, buying, sending money            (/evaluate)\n    comms         messages on any channel (email, Slack...) (/evaluate/email)\n    access        logging in or signing up on a site        (/evaluate/login)\n    destructive   deletes, exports, permission/access changes, other consequential actions (/evaluate/action)\n    model         the agent's own model, tokens, cost       (/evaluate/model)\n    secrets       content scanned for secrets before it leaves (/evaluate/secrets)\n\n  Run 'troxy policies fields --domain <domain>' to see the exact fields and\n  operators each checkpoint supports - the same table the server checks\n  against, so nothing here can drift from what actually fires.\n\n  From a template (fastest, matches the dashboard's own template library):\n    --template "<label>"   Exact template label - run 'troxy policies templates' to list them\n    --value / --value2     Override the template's default threshold (only when it has exactly one condition)\n    --action                Override the template's default action\n\n  Manual, single condition:\n    --domain     Required whenever --field is given, unless --field is one of\n                 the original payment fields (amount, merchant_name, tx_per_day),\n                 which still default to --domain payment for old scripts.\n    --field      Field to match - see 'troxy policies fields --domain <domain>'\n    --operator   eq, neq, gt, gte, lt, lte, contains, starts_with, not_contains, between\n    --value      Comparison value\n    --value2     Upper bound for 'between'\n\n  Manual, multiple conditions:\n    --and "field=X,operator=Y,value=Z"   Repeatable. ANDs onto the single --field condition (if any).\n    --or  "field=X,operator=Y,value=Z"   Repeatable. Each becomes its own alternative branch (any\n                                         --and conditions apply to every branch); all branches share --action.\n\n  Raw (full expressiveness, for scripting):\n    --json '<JSON>'   {\"conditions\": [...], \"or_conditions\": [...]} exactly as the API expects.\n                       Cannot be combined with --field/--and/--or/--template.\n\n  AI builder (org AI key, admin required; --domain payment or comms only - the other four\n  checkpoints aren't covered by this endpoint yet, use --template or a manual condition):\n    --describe "<text>"   Describe the policy in plain English and Troxy AI drafts it for you to confirm.\n    --domain              payment (default) or comms - which allowlist the AI drafts against.\n\n  Priority:\n    --priority <n>   Explicit priority number (default: auto, max+10). Lower = evaluated first.\n\n  Org (required; applies to every member):\n    --org   Admin access required. Every policy created from the CLI is org-wide.\n\n  Examples:\n    troxy policies create --name "Block a secret going public" --template "Block a secret going somewhere public" --org\n    troxy policies create --name "Cap over 100" --action BLOCK --domain payment --field amount --operator gt --value 100 --org\n    troxy policies create --name "Signups" --action ESCALATE --domain access --field login_action --operator eq --value signup --org\n    troxy policies create --name "Big exports" --action BLOCK --domain destructive --field action_verb --operator eq --value export --and "field=resource,operator=contains,value=customer" --org\n    troxy policies create --name "Personal domains" --action BLOCK --domain comms --or "field=recipient_domain,operator=contains,value=gmail.com" --or "field=recipient_domain,operator=contains,value=yahoo.com" --org\n    troxy policies create --name "Lock down secrets" --action BLOCK --domain secrets --field has_api_key --operator eq --value true --org\n`,
   fields: `  troxy policies fields [--domain <domain>]\n\n  Lists the fields, operators and allowed values each checkpoint actually supports -\n  the same table the server validates against, so this can never offer something\n  that saves and then never fires. Omit --domain to see all six.\n`,
@@ -60,10 +60,10 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
     switch (sub || 'list') {
       case 'list': {
         if (flags.org) {
-          const org = await _resolveOrgContext(jwt, false);
-          const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
-          if (!policies.length) { console.log(`\n  No org policies yet in ${org.name}.\n`); return; }
-          console.log(`\n  Organization: ${org.name}`);
+          const workspace = await _resolveOrgContext(jwt, false);
+          const { policies = [] } = await api.listOrgPolicies(jwt, workspace.id);
+          if (!policies.length) { console.log(`\n  No org policies yet in ${workspace.name}.\n`); return; }
+          console.log(`\n  Organization: ${workspace.name}`);
           table(
             ['#', 'Name', 'Domain', 'Action', 'Status', 'Conditions'],
             policies.map(p => [p.priority, p.name, p.domain, _displayAction(p), p.enabled ? 'active' : 'paused', _condSummary(p)]),
@@ -93,17 +93,17 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
         const name = flags.name;
         if (!name) { console.error('  --name is required  (tip: use single quotes for names with special chars)\n'); process.exit(1); }
         if (flags.org) {
-          const org = await _resolveOrgContext(jwt, false);
-          const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+          const workspace = await _resolveOrgContext(jwt, false);
+          const { policies = [] } = await api.listOrgPolicies(jwt, workspace.id);
           const p = policies.find(x => x.name.toLowerCase() === name.toLowerCase());
-          if (!p) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
+          if (!p) { console.error(`  Org policy "${name}" not found in ${workspace.name}\n`); process.exit(1); }
           console.log(`
   Name:          ${p.name}
   Domain:        ${p.domain}
   Action:        ${_displayAction(p)}
   Priority:      ${p.priority}
   Status:        ${p.enabled ? 'active' : 'paused'}
-  Scope:         org-wide (${org.name})
+  Scope:         org-wide (${workspace.name})
   Conditions:    ${_condDetail(p)}
   Created:       ${new Date(p.created_at).toLocaleDateString()}
 `);
@@ -162,7 +162,7 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
       // Personal-scope and per-MCP policy creation were eliminated (product
       // decision, 2026-08-20): POST /dashboard/policies no longer exists on
       // the server at all (falls through to a bare 404), so every policy the
-      // CLI creates now has to go through /orgs/:id/policies instead. --org
+      // CLI creates now has to go through /workspaces/:id/policies instead. --org
       // is required up front, before touching --describe/--template/manual
       // condition parsing, so a user who forgets it gets this clear message
       // instead of the server's generic "not found".
@@ -184,7 +184,7 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
           console.error(`\n  --describe only supports --domain payment or comms (the AI builder does not cover the other checkpoints yet - try --template or build the condition manually instead).\n`);
           process.exit(1);
         }
-        const org = await _resolveOrgContext(jwt, true);
+        const workspace = await _resolveOrgContext(jwt, true);
         process.stdout.write('\n  Asking Troxy AI to build this policy... ');
         const draft = await api.aiPolicy(jwt, { text: flags.describe, is_email: describeDomain === 'comms' });
         if (draft.error) { console.log('✗'); console.error(`\n  ${draft.error}\n`); process.exit(1); }
@@ -199,8 +199,8 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
         const name = draft.name, action = draft.action, domain = describeDomain,
               conditions = draft.conditions || [], or_conditions = draft.or_conditions || [];
         const body = { name, action, domain, conditions, or_conditions };
-        const policy = await api.createOrgPolicy(jwt, org.id, body);
-        console.log(`\n  Org policy "${policy.name}" created ✓  (priority: ${policy.priority}, applies to every member of ${org.name})\n`);
+        const policy = await api.createOrgPolicy(jwt, workspace.id, body);
+        console.log(`\n  Org policy "${policy.name}" created ✓  (priority: ${policy.priority}, applies to every member of ${workspace.name})\n`);
         break;
       }
 
@@ -209,13 +209,13 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
 
       const { domain, action, conditions, or_conditions } = _buildConditionsFromFlags(flags, multiFlags, { requireAction: true });
 
-      const org = await _resolveOrgContext(jwt, true);
+      const workspace = await _resolveOrgContext(jwt, true);
       const priority = flags.priority != null ? parseInt(flags.priority, 10) : undefined;
       if (flags.priority != null && isNaN(priority)) { console.error('  --priority must be a number\n'); process.exit(1); }
       const body = { name, action, domain, conditions, or_conditions, enabled: true };
       if (priority != null) body.priority = priority;
-      const policy = await api.createOrgPolicy(jwt, org.id, body);
-      console.log(`\n  Org policy "${policy.name}" created ✓  (priority: ${policy.priority}, checkpoint: ${domain}, applies to every member of ${org.name})\n`);
+      const policy = await api.createOrgPolicy(jwt, workspace.id, body);
+      console.log(`\n  Org policy "${policy.name}" created ✓  (priority: ${policy.priority}, checkpoint: ${domain}, applies to every member of ${workspace.name})\n`);
       break;
     }
 
@@ -223,11 +223,11 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
       const name = flags.name;
       if (!name) { console.error('  --name is required\n'); process.exit(1); }
       if (flags.org) {
-        const org = await _resolveOrgContext(jwt, true);
-        const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+        const workspace = await _resolveOrgContext(jwt, true);
+        const { policies = [] } = await api.listOrgPolicies(jwt, workspace.id);
         const policy = policies.find(p => p.name === name);
-        if (!policy) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
-        await api.deleteOrgPolicy(jwt, org.id, policy.id);
+        if (!policy) { console.error(`  Org policy "${name}" not found in ${workspace.name}\n`); process.exit(1); }
+        await api.deleteOrgPolicy(jwt, workspace.id, policy.id);
         console.log(`\n  Org policy "${name}" deleted ✓\n`);
         break;
       }
@@ -251,11 +251,11 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
       const name = flags.name;
       if (!name) { console.error('  --name is required\n'); process.exit(1); }
       if (flags.org) {
-        const org = await _resolveOrgContext(jwt, true);
-        const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+        const workspace = await _resolveOrgContext(jwt, true);
+        const { policies = [] } = await api.listOrgPolicies(jwt, workspace.id);
         const policy = policies.find(p => p.name === name);
-        if (!policy) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
-        await api.updateOrgPolicy(jwt, org.id, policy.id, { enabled: sub === 'resume' });
+        if (!policy) { console.error(`  Org policy "${name}" not found in ${workspace.name}\n`); process.exit(1); }
+        await api.updateOrgPolicy(jwt, workspace.id, policy.id, { enabled: sub === 'resume' });
         console.log(`\n  Org policy "${name}" ${sub}d ✓\n`);
         break;
       }
@@ -283,11 +283,11 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
       const priority = parseInt(flags.priority, 10);
       if (isNaN(priority)) { console.error('  --priority must be a number\n'); process.exit(1); }
       if (flags.org) {
-        const org = await _resolveOrgContext(jwt, true);
-        const { policies = [] } = await api.listOrgPolicies(jwt, org.id);
+        const workspace = await _resolveOrgContext(jwt, true);
+        const { policies = [] } = await api.listOrgPolicies(jwt, workspace.id);
         const policy = policies.find(p => p.name === name);
-        if (!policy) { console.error(`  Org policy "${name}" not found in ${org.name}\n`); process.exit(1); }
-        await api.updateOrgPolicy(jwt, org.id, policy.id, { priority });
+        if (!policy) { console.error(`  Org policy "${name}" not found in ${workspace.name}\n`); process.exit(1); }
+        await api.updateOrgPolicy(jwt, workspace.id, policy.id, { priority });
         console.log(`\n  Org policy "${name}" priority set to ${priority} ✓\n`);
         break;
       }
@@ -319,16 +319,16 @@ export async function runPolicies([sub, ...args], flags, multiFlags = {}) {
 // ── Org context ──────────────────────────────────────────────────────────
 
 async function _resolveOrgContext(jwt, needAdmin) {
-  const { org } = await api.currentOrg(jwt);
-  if (!org) {
-    console.error('\n  --org was passed, but you are not in an organization.\n');
+  const { workspace } = await api.currentWorkspace(jwt);
+  if (!workspace) {
+    console.error('\n  --org was passed, but you are not in a workspace.\n');
     process.exit(1);
   }
-  if (needAdmin && org.role !== 'admin') {
-    console.error(`\n  Org policies require admin access. You are a '${org.role}' in ${org.name}.\n`);
+  if (needAdmin && workspace.role !== 'admin') {
+    console.error(`\n  Org policies require admin access. You are a '${workspace.role}' in ${workspace.name}.\n`);
     process.exit(1);
   }
-  return org;
+  return workspace;
 }
 
 // ── Condition building, shared by create and test ──────────────────────────

package/src/pretooluse-hook.js

@@ -2,6 +2,7 @@ import { loadConfig } from './config.js';
 import { api } from './api.js';
 import { usageForCurrentTurn } from './hook-report.js';
 import { updatedInputFor } from './command-compaction.js';
+import { actionFor } from './action-classification.js';
 
 // Claude Code PreToolUse hook entry point: `troxy pretooluse-hook` (wired in
 // bin/troxy.js, registered by patchClaudeCodeHooks in init.js). Fires before
@@ -11,13 +12,18 @@ import { updatedInputFor } from './command-compaction.js';
 // bearing here: a bug that hangs or wrongly denies would degrade every tool
 // call in every project, not just Token Optimization data.
 //
-// Why this exists: a model-domain policy was previously only enforceable if
-// the connected agent voluntarily called the evaluate_model MCP tool before
-// acting on its own - proven live to not happen (a real Claude Code session
-// just used its own Bash tool directly, never checked in, even on a fresh
-// session with a valid key). PreToolUse is the host's own gate, not the
-// agent's discretion, so it's the first mechanism that actually enforces a
-// model policy instead of hoping the agent asks first.
+// Why this exists: a policy was previously only enforceable if the connected
+// agent voluntarily called the matching evaluate_* MCP tool before acting on
+// its own - proven live to not happen for model policy (a real Claude Code
+// session just used its own Bash tool directly, never checked in, even on a
+// fresh session with a valid key). PreToolUse is the host's own gate, not the
+// agent's discretion, so it's the mechanism that actually enforces a policy
+// instead of hoping the agent asks first. It now covers two independent
+// domains this way: model policy (evaluate_model, since the beginning of
+// this file) and destructive/hard-to-undo Bash commands (evaluate_action,
+// via action-classification.js's heuristic match). Payment, login, and
+// secrets policies still only have the advisory MCP path - the same gap
+// this file exists to close, not yet closed for those three.
 //
 // Everything in this file must fail open. A broken or slow check must never
 // block a tool call that a real policy would have allowed anyway - see the
@@ -106,51 +112,94 @@ export async function runPreToolUseHook() {
     // behind the same fail-open checks the policy path needs.
     const rewrite = updatedInputFor(payload?.tool_name, payload?.tool_input);
 
-    const transcriptPath = payload?.transcript_path;
-    if (!transcriptPath) return allow(rewrite);
+    // Also independent, also pure/local/synchronous: does this specific
+    // tool call look like a destructive or hard-to-undo action? See
+    // action-classification.js for exactly what this does and doesn't
+    // recognize, and why. Unlike the model check below, this needs no
+    // transcript at all - an `rm -rf` is worth gating whether or not a
+    // model policy even applies to this turn.
+    const actionMatch = actionFor(payload?.tool_name, payload?.tool_input);
 
+    const transcriptPath = payload?.transcript_path;
     // transcript_path can lag the current turn by a beat (Claude Code's own
     // docs note this), so this may occasionally read the previous turn's
     // model instead of one just switched to mid-conversation. Worst case:
     // one tool call briefly evaluated against the wrong (but recent) model -
     // not a wrong-direction failure (never wrongly denies because of it),
     // just an occasional miss, consistent with fail-open throughout this file.
-    const usage = usageForCurrentTurn(transcriptPath);
-    if (!usage || !usage.model) return allow(rewrite); // nothing to gate against yet
+    const usage = transcriptPath ? usageForCurrentTurn(transcriptPath) : null;
+
+    if (!usage?.model && !actionMatch) return allow(rewrite); // nothing to gate against
 
     const config = loadConfig();
     const apiKey = process.env.TROXY_API_KEY || config?.apiKey;
     if (!apiKey) return allow(rewrite);
 
-    const body = { model: usage.model, task: payload.tool_name || '' };
-    // Real effort straight off the transcript entry (see hook-report.js's
-    // extractUsage) - whatever Claude Code actually used, not coerced into a
-    // guessed low/medium/high. Omitted when the transcript doesn't carry one
-    // (an older Claude Code build, or a turn before any assistant reply yet).
-    if (usage.effort) body.effort = usage.effort;
-    // How many tools this turn has used so far (from the transcript), plus
-    // the one about to run that triggered this hook. An undercount by
-    // nature - a PreToolUse hook cannot know how many MORE tool calls this
-    // turn will end up making - but a real, current-as-of-right-now number,
-    // not a guess, and the effort-suggestion feature only needs to tell a
-    // turn's first tool call apart from its fifth, not know the eventual
-    // total. Without this, effort was accepted but never actually
-    // classified as "simple", so no suggestion could ever fire from here.
-    body.estimated_tool_count = usage.toolUseBlocksSoFar + 1;
-
-    const result = await withTimeout(
-      api.evaluateModel(body, apiKey),
-      GATE_TIMEOUT_MS,
-    );
-
-    if (result?.decision === 'BLOCK') {
-      return deny(`Troxy: blocked by policy - ${result.reason || `the model "${usage.model}" is not allowed.`}`);
+    // Both checks below run concurrently, sharing one GATE_TIMEOUT_MS
+    // budget each - not one after the other. A tool call that happens to
+    // trip both (a destructive command on a turn that also needs a model
+    // check) must not cost double the latency of a call that only trips
+    // one; Claude Code's own hook timeout is a single fixed budget for the
+    // whole process, not per-check.
+    const checks = [];
+
+    if (usage?.model) {
+      const body = { model: usage.model, task: payload.tool_name || '' };
+      // Real effort straight off the transcript entry (see hook-report.js's
+      // extractUsage) - whatever Claude Code actually used, not coerced into
+      // a guessed low/medium/high. Omitted when the transcript doesn't carry
+      // one (an older Claude Code build, or a turn before any assistant
+      // reply yet).
+      if (usage.effort) body.effort = usage.effort;
+      // How many tools this turn has used so far (from the transcript), plus
+      // the one about to run that triggered this hook. An undercount by
+      // nature - a PreToolUse hook cannot know how many MORE tool calls this
+      // turn will end up making - but a real, current-as-of-right-now number,
+      // not a guess, and the effort-suggestion feature only needs to tell a
+      // turn's first tool call apart from its fifth, not know the eventual
+      // total. Without this, effort was accepted but never actually
+      // classified as "simple", so no suggestion could ever fire from here.
+      body.estimated_tool_count = usage.toolUseBlocksSoFar + 1;
+
+      checks.push(
+        withTimeout(api.evaluateModel(body, apiKey), GATE_TIMEOUT_MS)
+          .then((result) => ({
+            decision: result?.decision,
+            reason: `Troxy: blocked by policy - ${result?.reason || `the model "${usage.model}" is not allowed.`}`,
+          }))
+          .catch(() => null), // this check's own failure must never suppress the other check's result
+      );
     }
-    // ALLOW, ESCALATE, or anything unexpected: don't block. ESCALATE has no
-    // synchronous human-in-the-loop path from inside a hook (there is
-    // nowhere here to pause and wait on an approval), so it fails open
-    // rather than hanging Claude Code - same reasoning as every other
-    // "never block on our own uncertainty" branch in this file.
+
+    if (actionMatch) {
+      const body = { ...actionMatch };
+      // Same agent-identity convention evaluate_action's MCP tool handler
+      // uses (mcp-server.js), so the dashboard can tell a hook-enforced
+      // check apart from a voluntary self-reported one without a separate
+      // field - both are just "this agent called evaluate_action".
+      const agentName = process.env.TROXY_AGENT_NAME || config?.agentName;
+      if (agentName) body.agent = agentName;
+
+      checks.push(
+        withTimeout(api.evaluateAction(body, apiKey), GATE_TIMEOUT_MS)
+          .then((result) => ({
+            decision: result?.decision,
+            reason: `Troxy: blocked by policy - ${result?.reason || `this ${actionMatch.action_verb} is not allowed.`}`,
+          }))
+          .catch(() => null),
+      );
+    }
+
+    const settled = await Promise.all(checks);
+    const blocked = settled.find((entry) => entry?.decision === 'BLOCK');
+    if (blocked) return deny(blocked.reason);
+
+    // ALLOW, ESCALATE, a timeout/network error on either check, or anything
+    // unexpected: don't block. ESCALATE has no synchronous human-in-the-loop
+    // path from inside a hook (there is nowhere here to pause and wait on an
+    // approval), so both checks fail open rather than hanging Claude Code -
+    // same reasoning as every other "never block on our own uncertainty"
+    // branch in this file.
     return allow(rewrite);
   } catch {
     // Network error, timeout, malformed response - never block the user's

package/src/proxy.js

@@ -1,12 +1,14 @@
 /**
  * `troxy proxy status/enable/disable` - the explicit, hands-on control
  * surface for Layer 3 of the Live Model Policy Enforcement plan (local
- * interceptor set up in interceptor.js/tls-ca.js/daemon.js). Deliberately
- * NOT wired into `troxy init`'s own interactive flow yet: per the plan's
- * rollout order, this ships first as an explicit, undocumented opt-in
- * (`--experimental` on enable) so it can be validated by hand against a
- * real desktop app before it becomes something an ordinary `troxy init`
- * run could ever turn on for every user.
+ * interceptor set up in interceptor.js/tls-ca.js/daemon.js). `troxy init`
+ * (see init.js's own prompt around patchClaudeCodeInterception) already
+ * asks every new user this question directly and enables it the same way -
+ * this command is the secondary surface for turning it back on/off later
+ * without rerunning init, or checking cert/interceptor health. Listed in
+ * `troxy --help` for exactly that reason (2026-09-21): asked for by a real
+ * user who'd already had it enabled via init and could not find how to
+ * check or turn it off again.
  */
 import net  from 'node:net';
 import os   from 'node:os';

package/src/tests/action-classification.test.js

@@ -0,0 +1,152 @@
+// Pure logic only - no hook plumbing here, see pretooluse-hook.test.js for
+// how a match actually reaches the evaluate_action call.
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { actionFor } from '../action-classification.js';
+
+function bash(command) {
+  return actionFor('Bash', { command });
+}
+
+describe('actionFor - non-Bash / no match', () => {
+  it('ignores non-Bash tools entirely', () => {
+    assert.equal(actionFor('Write', { file_path: '/tmp/x', content: 'rm -rf /' }), null);
+    assert.equal(actionFor('Edit', { command: 'rm -rf /' }), null);
+  });
+
+  it('ignores a missing or non-string command', () => {
+    assert.equal(actionFor('Bash', {}), null);
+    assert.equal(actionFor('Bash', { command: 123 }), null);
+  });
+
+  it('does not match ordinary, non-destructive commands', () => {
+    assert.equal(bash('ls -la'), null);
+    assert.equal(bash('git status'), null);
+    assert.equal(bash('npm test'), null);
+    assert.equal(bash('echo "rm -rf my-code, wish me luck"'), null);
+  });
+});
+
+describe('actionFor - rm', () => {
+  it('matches a single-file rm and counts one item', () => {
+    const result = bash('rm notes.txt');
+    assert.equal(result.action_verb, 'delete');
+    assert.equal(result.item_count, 1);
+    assert.match(result.resource, /notes\.txt/);
+  });
+
+  it('matches recursive/force rm and counts the real number of paths', () => {
+    const result = bash('rm -rf build/ dist/ .cache/');
+    assert.equal(result.action_verb, 'delete');
+    assert.equal(result.item_count, 3);
+  });
+
+  it('summarizes more than three paths with a remainder count', () => {
+    const result = bash('rm a.txt b.txt c.txt d.txt e.txt');
+    assert.equal(result.item_count, 5);
+    assert.match(result.resource, /\+2 more/);
+  });
+
+  it('does not match `rm` as a substring of another command name', () => {
+    assert.equal(bash('npm run rm-tmp'), null);
+  });
+
+  it('lets the docker-specific rule handle `docker rm`, not the generic rm rule', () => {
+    // Still ends up as a match (via the docker rule below) - just confirms
+    // the two rules don't double-fire or fight over the same segment.
+    assert.equal(bash('docker rm my-container').action_verb, 'delete');
+  });
+
+  it('does not fire on a bare `rm` with no arguments', () => {
+    assert.equal(bash('rm'), null);
+  });
+});
+
+describe('actionFor - git force push / branch delete', () => {
+  it('matches --force and -f push, but not a plain push', () => {
+    assert.equal(bash('git push origin main'), null);
+    assert.equal(bash('git push --force origin main').action_verb, 'force_push');
+    assert.equal(bash('git push -f origin main').action_verb, 'force_push');
+    assert.equal(bash('git push --force-with-lease origin main').action_verb, 'force_push');
+  });
+
+  it('matches git branch -D', () => {
+    const result = bash('git branch -D old-feature');
+    assert.equal(result.action_verb, 'delete');
+    assert.match(result.resource, /old-feature/);
+  });
+
+  it('does not match the safer git branch -d', () => {
+    assert.equal(bash('git branch -d merged-feature'), null);
+  });
+
+  it('matches remote branch delete via --delete and via the :branch refspec', () => {
+    assert.equal(bash('git push origin --delete old-feature').action_verb, 'delete');
+    assert.equal(bash('git push origin :old-feature').action_verb, 'delete');
+  });
+});
+
+describe('actionFor - terraform / kubectl / docker / aws', () => {
+  it('matches terraform destroy and pulls a -target when present', () => {
+    assert.equal(bash('terraform destroy').action_verb, 'destroy');
+    const result = bash('terraform destroy -target=aws_instance.web -auto-approve');
+    assert.equal(result.resource, 'aws_instance.web');
+  });
+
+  it('matches kubectl delete', () => {
+    assert.equal(bash('kubectl delete deployment my-app').action_verb, 'delete');
+  });
+
+  it('matches docker rm/rmi/volume rm/system prune', () => {
+    assert.equal(bash('docker rm my-container').action_verb, 'delete');
+    assert.equal(bash('docker rmi my-image').action_verb, 'delete');
+    assert.equal(bash('docker volume rm my-volume').action_verb, 'delete');
+    assert.equal(bash('docker system prune -af').action_verb, 'delete');
+  });
+
+  it('does not match unrelated docker subcommands', () => {
+    assert.equal(bash('docker run my-image'), null);
+    assert.equal(bash('docker ps'), null);
+  });
+
+  it('matches aws s3 rm', () => {
+    assert.equal(bash('aws s3 rm s3://my-bucket/path --recursive').action_verb, 'delete');
+  });
+});
+
+describe('actionFor - SQL drop/truncate, gated on a known DB CLI', () => {
+  it('matches DROP TABLE/DATABASE via a recognized DB client', () => {
+    assert.equal(bash('psql mydb -c "DROP TABLE users"').action_verb, 'drop');
+    assert.equal(bash('mysql -e "drop database staging"').action_verb, 'drop');
+  });
+
+  it('matches TRUNCATE TABLE via a recognized DB client', () => {
+    const result = bash('psql mydb -c "TRUNCATE TABLE events"');
+    assert.equal(result.action_verb, 'truncate');
+    assert.equal(result.resource, 'events');
+  });
+
+  it('does not match DROP/TRUNCATE text outside of a known DB CLI invocation', () => {
+    // e.g. a commit message or comment mentioning the words - not an actual
+    // destructive command, and there is no DB client in this segment.
+    assert.equal(bash('git commit -m "drop table support from README"'), null);
+    assert.equal(bash('echo "remember to truncate table later"'), null);
+  });
+});
+
+describe('actionFor - compound commands', () => {
+  it('finds a destructive segment anywhere in a && chain', () => {
+    assert.equal(bash('cd /tmp && rm -rf scratch/').action_verb, 'delete');
+  });
+
+  it('does not let a quoted string leak a match into an unrelated segment', () => {
+    assert.equal(bash('echo "rm -rf /" && ls'), null);
+  });
+
+  it('reports never sets reversible - undeclared is treated as irreversible by policy', () => {
+    const result = bash('rm notes.txt');
+    assert.equal('reversible' in result, false);
+  });
+});

package/src/tests/policies-org.test.js

@@ -1,12 +1,13 @@
 // Org policy support end to end: api.js has the routes, policies.js checks
 // --org in every subcommand that has both a personal and an org meaning, and
 // a write subcommand requires admin while list/describe only require
-// membership - matching orgs.py's is_org_admin vs is_org_member split.
+// membership - matching workspaces.py's is_workspace_admin vs
+// is_workspace_member split.
 //
 // Source-inspection style, like rotate-key.test.js: driving the real
-// subcommands would need a live JWT and a real org, which this test suite
-// doesn't have. What it can check without either is that the wiring exists
-// and that a write path can't skip the admin check.
+// subcommands would need a live JWT and a real workspace, which this test
+// suite doesn't have. What it can check without either is that the wiring
+// exists and that a write path can't skip the admin check.
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { readFileSync } from 'node:fs';
@@ -18,15 +19,15 @@ const apiSrc = readFileSync(join(__dirname, '..', 'api.js'), 'utf8');
 const polSrc = readFileSync(join(__dirname, '..', 'policies.js'), 'utf8');
 
 test('the org policy routes are wired in the api client', () => {
-  for (const path of ["'/orgs/current'", '`/orgs/${orgId}/policies`', '`/orgs/${orgId}/policies/${id}`']) {
+  for (const path of ["'/workspaces/current'", '`/workspaces/${workspaceId}/policies`', '`/workspaces/${workspaceId}/policies/${id}`']) {
     assert.ok(apiSrc.includes(path), `${path} not wired in api.js`);
   }
 });
 
 test('every write subcommand resolves org context with admin required', () => {
   // Each of these blocks should call _resolveOrgContext(jwt, true) when
-  // flags.org is set, mirroring orgs.py's is_org_admin gate on every
-  // POST/PATCH/DELETE to /orgs/:id/policies*.
+  // flags.org is set, mirroring workspaces.py's is_workspace_admin gate on
+  // every POST/PATCH/DELETE to /workspaces/:id/policies*.
   const writeSubcommands = ["case 'delete'", "case 'pause'", "case 'set-priority'"];
   for (const marker of writeSubcommands) {
     const start = polSrc.indexOf(marker);
@@ -44,9 +45,9 @@ test('create requires admin for --org but read subcommands do not', () => {
   const createChunk = polSrc.slice(createStart, createStart + 4000);
   assert.ok(/_resolveOrgContext\(jwt,\s*true\)/.test(createChunk), 'create --org must require admin');
 
-  // list/describe are read-only - orgs.py's handle_list_org_policies allows
-  // any active member, not just admins. Passing `false` here is what makes
-  // that distinction actually reach the CLI instead of over-restricting reads.
+  // list/describe are read-only - workspaces.py's handle_list_workspace_policies
+  // allows any active member, not just admins. Passing `false` here is what
+  // makes that distinction actually reach the CLI instead of over-restricting reads.
   const listStart = polSrc.indexOf("case 'list':");
   const listChunk = polSrc.slice(listStart, listStart + 800);
   assert.ok(/_resolveOrgContext\(jwt,\s*false\)/.test(listChunk), 'list --org should not require admin (read access is for any member)');
@@ -55,6 +56,6 @@ test('create requires admin for --org but read subcommands do not', () => {
 test('org policy creation sends the domain, unlike the old payment-only path', () => {
   const createStart = polSrc.indexOf("case 'create'");
   const chunk = polSrc.slice(createStart, polSrc.indexOf('createOrgPolicy', createStart) + 50);
-  assert.ok(/createOrgPolicy\(jwt,\s*org\.id,\s*body\)/.test(chunk));
+  assert.ok(/createOrgPolicy\(jwt,\s*workspace\.id,\s*body\)/.test(chunk));
   assert.ok(/body\s*=\s*\{\s*name,\s*action,\s*domain,\s*conditions,\s*or_conditions/.test(chunk), 'org policy body must include domain - without it every org policy defaults to payment');
 });

package/src/tests/proxy-wiring.test.js

@@ -9,9 +9,11 @@
 //     hook step - a desktop-only machine used to get zero settings.json
 //     writes at all.
 //  2. bin/troxy.js registers `troxy proxy status/enable/disable`, wired to
-//     src/proxy.js, and is NOT listed in the default help banner (it's
-//     deliberately undocumented per the plan's rollout order - not surfaced
-//     until after real hands-on validation).
+//     src/proxy.js, and IS listed in the default help banner - init.js
+//     already asks every new user this question directly (see its own
+//     patchClaudeCodeInterception prompt), so by the time a user goes
+//     looking for `troxy proxy`, it's not an unvalidated feature they'd be
+//     opting into early, it's one they already have on and need to find.
 
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
@@ -89,10 +91,10 @@ describe('bin/troxy.js: proxy subcommand wiring', () => {
     assert.match(proxyBlock, /runProxyStatus/);
   });
 
-  it('is NOT listed in the default help banner - deliberately undocumented until rollout step 5', () => {
+  it('is listed in the default help banner - init already enables it for real users', () => {
     const helpBannerStart = binSrc.indexOf("Troxy: a secure control layer for AI agents");
     const helpBanner = binSrc.slice(helpBannerStart);
-    assert.ok(!helpBanner.includes('troxy proxy '), 'troxy proxy must not appear in the printed help banner yet');
+    assert.ok(helpBanner.includes('troxy proxy '), 'troxy proxy should appear in the printed help banner');
   });
 });