troxy-cli 1.29.2 → 1.29.4

package/README.md

@@ -94,6 +94,12 @@ prediction, and the dashboard marks that agent's figures as unverified.
 - Paste the code into the terminal
 - Stores the JWT locally for 12 hours
 
+Without a real terminal attached (a script, CI, an agent's own shell), the
+masked prompt is skipped in favor of a plain line read from stdin - it never
+crashes for lack of a TTY. There's no flag to pass the code directly: the
+code the browser shows is only valid against this run's own session, so it
+has to come back through this same process, e.g. `troxy login < code.txt`.
+
 ## Stack
 
 - Node.js 18+ (ESM)

package/bin/troxy.js

@@ -115,6 +115,19 @@ switch (command) {
     await runUninstall();
     break;
 
+  // ── Live Model Policy Enforcement interception (Layer 3, experimental) ─
+  // Not yet part of `troxy init` or the default help banner below - see
+  // proxy.js's own top-of-file note and the plan doc's rollout order for
+  // why this is deliberately opt-in-only and manually run for now.
+  case 'proxy': {
+    const { runProxyStatus, runProxyEnable, runProxyDisable } = await import('../src/proxy.js');
+    if (sub === 'enable') { await runProxyEnable(flags); break; }
+    if (sub === 'disable') { runProxyDisable(); break; }
+    if (sub === 'status' || !sub) { await runProxyStatus(); break; }
+    console.error(`  Unknown: troxy proxy ${sub}. Try: status, enable, disable\n`);
+    process.exit(1);
+  }
+
   // ── Auth ──────────────────────────────────────────────────────
   case 'login':
     await runLogin(flags);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.2",
+  "version": "1.29.4",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {
@@ -14,7 +14,8 @@
     "test": "node --test src/tests/*.test.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.10.2"
+    "@modelcontextprotocol/sdk": "^1.10.2",
+    "node-forge": "^1.4.0"
   },
   "engines": {
     "node": ">=18"

package/src/auth.js

@@ -95,6 +95,44 @@ function _openBrowser(url) {
   }
 }
 
+// Which strategy resolves the login code, given whether stdin is a TTY.
+// Exported so this decision is unit-testable without a real terminal: the
+// raw-mode branch itself needs a real TTY and can't be, but which branch
+// gets picked is exactly the logic that used to crash with no TTY at all
+// (setRawMode is not a function on a pipe/non-interactive stdin - found live
+// by another Claude instance running in a non-interactive shell). No --code
+// flag: the code the browser shows is minted for, and only valid against,
+// this specific run's own session_id (auth.py's handle_cli_authorize binds
+// cli_code to session_id server-side, 5-minute TTL) - a flag read before a
+// fresh cliStart() would always redeem a stale session and 401.
+export function _codeInputStrategy(isTTY) {
+  return isTTY ? 'raw-tty' : 'line-read';
+}
+
+// A plain, non-masked line read for the no-TTY fallback - deliberately not
+// init.js's shared prompt(), which leaves its Promise permanently unresolved
+// if the input stream closes (EOF) before an answer, a real Node readline
+// quirk: init.js's own callers are all isTTY-guarded already, so a live human
+// terminal never hits it, but a no-TTY `troxy login` (a pipe with nothing
+// written to it, or none at all) hits EOF immediately and is exactly this
+// fallback's whole reason to exist - it must resolve either way, so the
+// existing "No code entered" handling below still runs instead of the
+// process just going quiet with no explanation and exit code 0.
+function _readCodeLine(question) {
+  return new Promise(resolve => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    let answered = false;
+    rl.question(question, ans => {
+      answered = true;
+      rl.close();
+      resolve(ans.trim());
+    });
+    rl.on('close', () => {
+      if (!answered) resolve('');
+    });
+  });
+}
+
 /** Device-code login flow — opens browser, user copies code back to CLI. */
 export async function runLogin() {
   // 1. Start a CLI auth session
@@ -118,41 +156,51 @@ export async function runLogin() {
     _openBrowser(session.url);
   }
 
-  // 3. Prompt for the code shown in the browser (masked like a password,
-  //    one bullet per char so the terminal doesn't look frozen)
-  const code = await new Promise(resolve => {
-    const rl = readline.createInterface({ input: process.stdin, output: null });
-    process.stdout.write('  Paste the code from your browser: ');
-    let buf = '';
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding('utf8');
-    const onData = chunk => {
-      for (const ch of chunk) {
-        if (ch === '\r' || ch === '\n') {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener('data', onData);
-          rl.close();
-          process.stdout.write('\n');
-          resolve(buf.trim());
-          return;
-        } else if (ch === '\u0003') { // Ctrl-C
-          process.stdout.write('\n');
-          process.exit(0);
-        } else if (ch === '\u007f' || ch === '\b') { // backspace
-          if (buf.length > 0) {
-            buf = buf.slice(0, -1);
-            process.stdout.write('\b \b');
+  // 3. Resolve the code shown in the browser. A real TTY gets the masked
+  //    raw-mode prompt (one bullet per char so the terminal doesn't look
+  //    frozen); anything else (a script, CI, an agent's own shell) falls
+  //    back to a plain line read (_readCodeLine below) - process.stdin.
+  //    setRawMode is not a function at all without a real TTY, so it must
+  //    never run unguarded (it used to, and crashed uncaught).
+  const strategy = _codeInputStrategy(process.stdin.isTTY);
+  let code;
+  if (strategy === 'line-read') {
+    code = await _readCodeLine('  Paste the code from your browser: ');
+  } else {
+    code = await new Promise(resolve => {
+      const rl = readline.createInterface({ input: process.stdin, output: null });
+      process.stdout.write('  Paste the code from your browser: ');
+      let buf = '';
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.setEncoding('utf8');
+      const onData = chunk => {
+        for (const ch of chunk) {
+          if (ch === '\r' || ch === '\n') {
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stdin.removeListener('data', onData);
+            rl.close();
+            process.stdout.write('\n');
+            resolve(buf.trim());
+            return;
+          } else if (ch === '\u0003') { // Ctrl-C
+            process.stdout.write('\n');
+            process.exit(0);
+          } else if (ch === '\u007f' || ch === '\b') { // backspace
+            if (buf.length > 0) {
+              buf = buf.slice(0, -1);
+              process.stdout.write('\b \b');
+            }
+          } else if (ch >= ' ') {
+            buf += ch;
+            process.stdout.write('•');
           }
-        } else if (ch >= ' ') {
-          buf += ch;
-          process.stdout.write('•');
         }
-      }
-    };
-    process.stdin.on('data', onData);
-  });
+      };
+      process.stdin.on('data', onData);
+    });
+  }
 
   if (!code) {
     console.error('\n  No code entered. Run troxy login to try again.\n');

package/src/daemon.js

@@ -1,16 +1,125 @@
 /**
- * Troxy heartbeat daemon.
+ * Troxy background daemon.
  * Runs as a background service (systemd / launchd). Sends a heartbeat to the
  * Troxy API every 60 seconds so the dashboard shows this agent as connected.
- * Does NOT start an MCP stdio server — that only makes sense when an MCP client
- * (Claude Desktop, Cursor, etc.) is present.
+ * Does NOT start an MCP stdio server - that only makes sense when an MCP
+ * client (Claude Desktop, Cursor, etc.) is present.
+ *
+ * As of Layer 2 of the Live Model Policy Enforcement plan, also hosts the
+ * local interceptor (interceptor.js) - the TLS-terminating proxy that lets
+ * the Claude Desktop app's Code tab route through Troxy the same way
+ * terminal `claude` already does via ANTHROPIC_BASE_URL. This lives here,
+ * not as a separate process, specifically so it inherits the supervision
+ * this daemon already has (launchd KeepAlive / systemd Restart=always) -
+ * see the plan doc's architecture section for why a fully local, always-
+ * supervised interceptor is the only design that can actually fail open
+ * when Troxy's own service has downtime.
  */
+import os from 'node:os';
+import path from 'node:path';
+import { format } from 'node:util';
 import { loadConfig } from './config.js';
 import { api } from './api.js';
+import { createInterceptor } from './interceptor.js';
+import { enabledProviders, interceptHostsFor, troxyRouteFor } from './providers.js';
+import { ensureInterceptionCerts } from './tls-ca.js';
 
 const INTERVAL_MS = 60_000;
 
+// Fixed, not dynamically chosen - so settings.json's HTTPS_PROXY value
+// stays valid across daemon restarts instead of needing to be rewritten
+// every time. If this port is ever unavailable, the interceptor simply
+// does not start (see startInterceptor's listen 'error' handler) rather
+// than silently picking a different one and leaving settings.json wrong.
+export const INTERCEPTOR_PORT = 48173;
+
+// Re-checked once a day, not on a timer that matters much - ensureInterceptionCerts
+// is idempotent when the existing CA/leaf are still healthy, so this is a
+// cheap no-op almost every time it fires; it only does real work on the
+// leaf's ~30-day renewal window or if something on disk got corrupted.
+const CERT_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+function _log(fmt, ...args) {
+  process.stderr.write(`[troxy-interceptor] ${format(fmt, ...args)}\n`);
+}
+
+/**
+ * Starts the local interceptor, if any provider is enabled (Phase 1: just
+ * 'anthropic'). Never throws - a failure here (bad cert generation, the
+ * port already being held by something else) is logged and the daemon
+ * keeps running its heartbeat regardless; interception is additive, never
+ * a requirement for the rest of what this daemon does.
+ *
+ * `troxyDir` defaults to the real ~/.troxy but is injectable, matching
+ * ensureInterceptionCerts's own pattern - lets a test exercise this
+ * without touching whatever the real machine running the test has there.
+ * `port` defaults to INTERCEPTOR_PORT, injectable so a test doesn't
+ * collide with a real daemon that might already be running on this
+ * machine.
+ */
+export function startInterceptor({ troxyDir = path.join(os.homedir(), '.troxy'), port = INTERCEPTOR_PORT } = {}) {
+  const providers = enabledProviders();
+  const interceptHosts = interceptHostsFor(providers);
+  if (interceptHosts.length === 0) return null;
+
+  let certs = null;
+
+  function refreshCerts() {
+    try {
+      const result = ensureInterceptionCerts(troxyDir, {
+        hostname: os.hostname(),
+        leafDnsNames: interceptHosts,
+      });
+      certs = { leafCertPem: result.leafCertPem, leafKeyPem: result.leafKeyPem };
+    } catch (err) {
+      _log('failed to generate interception certificates, tunneling only until this resolves: %s', err.message);
+      certs = null;
+    }
+  }
+  refreshCerts();
+  const refreshTimer = setInterval(refreshCerts, CERT_REFRESH_INTERVAL_MS);
+  refreshTimer.unref(); // must not keep the process alive on its own
+
+  const interceptor = createInterceptor({
+    interceptHosts,
+    routeResolver: (host, method, reqPath) => troxyRouteFor(providers, host, method, reqPath),
+    // Fresh from disk on every request, not cached at startup - a
+    // `troxy rotate-key` takes effect immediately, no daemon restart needed.
+    getTroxyKey: () => loadConfig()?.apiKey || null,
+    getCerts: () => certs,
+    log: _log,
+  });
+
+  interceptor.on('error', (err) => {
+    if (err.code === 'EADDRINUSE') {
+      _log('port %d is already in use by something else - interception is disabled this run. ' +
+           'Run `troxy proxy status` to check, or `troxy proxy disable` if this persists.', port);
+    } else {
+      _log('server error (interception disabled this run): %s', err.message);
+    }
+  });
+
+  interceptor.listen(port, '127.0.0.1', () => {
+    _log('listening on 127.0.0.1:%d for %s', port, interceptHosts.join(', '));
+  });
+
+  return interceptor;
+}
+
 export async function runDaemon() {
+  // Installed first, before anything else in this process can throw - a
+  // bug anywhere here (the heartbeat, cert generation, a single bad TLS
+  // handshake) must never take the whole daemon down. The interceptor's
+  // listener dying silently is exactly what broke Claude Code outright
+  // during this feature's own manual testing - log and keep running,
+  // never exit.
+  process.on('uncaughtException', (err) => {
+    process.stderr.write(`[troxy-daemon] uncaught exception (continuing): ${err.stack || err.message}\n`);
+  });
+  process.on('unhandledRejection', (err) => {
+    process.stderr.write(`[troxy-daemon] unhandled rejection (continuing): ${err?.stack || err}\n`);
+  });
+
   const cfg = loadConfig();
   if (!cfg?.apiKey) {
     process.stderr.write('[troxy-daemon] No API key found. Run troxy init first.\n');
@@ -19,6 +128,10 @@ export async function runDaemon() {
 
   const { apiKey, agentName } = cfg;
 
+  // Bound before the first heartbeat - a network hiccup reaching the Troxy
+  // API on startup must never leave the interceptor's port unbound.
+  startInterceptor();
+
   // `force` pushes the config name as the authoritative display name. We only
   // do this on the FIRST beat after (re)start, so a `troxy restart` overrides
   // the dashboard, while regular beats never clobber a dashboard rename.