troxy-cli 1.29.19 → 1.29.21

package/bin/troxy.js

@@ -484,22 +484,16 @@ switch (command) {
     process.stdout.write(`  DB:   ${health.db}\n`);
     process.stdout.write(`  Env:  ${health.env}\n`);
 
-    // Account info from login session
-    const session = loadSession();
-    if (session?.jwt) {
-      try {
-        const data = await api.agentStatus(session.jwt);
-        const { account } = data;
-        console.log(`
-  Account
-    Active policies:  ${account.active_policies}
-    MCPs total:       ${account.total_mcps}  (${account.connected_mcps} connected)
-    Requests 24h:     ${account.requests_24h}
-    Default action:   ${account.default_action}
-`);
-      } catch { console.log(); }
+    const { proxyState } = await import('../src/proxy.js');
+    const { INTERCEPTOR_PORT } = await import('../src/daemon.js');
+    const proxy = await proxyState();
+    console.log();
+    if (proxy === 'on') {
+      console.log(`  Proxy:    ✓ on  (Claude traffic routed through Troxy, 127.0.0.1:${INTERCEPTOR_PORT})`);
+    } else if (proxy === 'down') {
+      console.log(`  Proxy:    ⚠  configured, but nothing is listening on 127.0.0.1:${INTERCEPTOR_PORT}. Run: troxy restart`);
     } else {
-      console.log('\n  Not logged in. Run: troxy login\n');
+      console.log('  Proxy:    off  (turn on: troxy proxy enable --experimental)');
     }
 
     // MCP connection info from local config (set by troxy init)
@@ -519,7 +513,24 @@ switch (command) {
       } catch {
         process.stdout.write('\n');
       }
-      console.log();
+    }
+
+    // Login only unlocks account commands; protection runs off the key + proxy above.
+    const session = loadSession();
+    if (session?.jwt) {
+      try {
+        const data = await api.agentStatus(session.jwt);
+        const { account } = data;
+        console.log(`
+  Account
+    Active policies:  ${account.active_policies}
+    MCPs total:       ${account.total_mcps}  (${account.connected_mcps} connected)
+    Requests 24h:     ${account.requests_24h}
+    Default action:   ${account.default_action}
+`);
+      } catch { console.log(); }
+    } else {
+      console.log('  Account:  not signed in. Run `troxy login` to manage policies and view activity from the CLI.\n');
     }
 
     // Version check

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.19",
+  "version": "1.29.21",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/init.js

@@ -115,10 +115,12 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null,
         const entry = JSON.stringify({ command: 'npx', args: ['troxy-cli', 'mcp'], env: { TROXY_API_KEY: key } });
         // execFileSync passes args directly to the process (no shell), so the
         // key can't break out of a quoted string and inject shell commands.
-        execFileSync('openclaw', ['mcp', 'set', 'troxy', entry], { stdio: 'ignore' });
+        execFileSync('openclaw', ['mcp', 'set', 'troxy', entry], { stdio: ['ignore', 'ignore', 'pipe'] });
         console.log(`    • OpenClaw  ✓`);
       } catch (err) {
-        console.log(`    • OpenClaw  ✗  (${err.message})`);
+        // err.message embeds the full argv, key included: never print it.
+        const reason = err.stderr?.toString().trim().split('\n').pop() || `exit code ${err.status}`;
+        console.log(`    • OpenClaw  ✗  (${reason.replaceAll(key, key.substring(0, 12) + '...')})`);
       }
     }
     // Claude Desktop's Code tab runs the same Claude Code engine under the

package/src/proxy.js

@@ -40,6 +40,12 @@ export function probePort(port, timeoutMs = 800) {
   });
 }
 
+// 'on' | 'down' (settings point at the interceptor but nothing is listening) | 'off'
+export async function proxyState() {
+  if (!interceptionIsConfigured(claudeCodeSettingsPath())) return 'off';
+  return (await probePort(INTERCEPTOR_PORT)) ? 'on' : 'down';
+}
+
 function _readCert(certPath) {
   try { return fs.readFileSync(certPath, 'utf8'); } catch { return null; }
 }