troxy-cli 1.29.2 → 1.29.4

package/src/init.js

@@ -5,6 +5,10 @@ import readline       from 'readline';
 import { execSync, execFileSync } from 'child_process';
 import { saveConfig } from './config.js';
 import { evaluatePayment, api } from './api.js';
+import { INTERCEPTOR_PORT } from './daemon.js';
+import { ensureInterceptionCerts } from './tls-ca.js';
+import { enabledProviders, interceptHostsFor } from './providers.js';
+import { probePort } from './proxy.js';
 
 // Re-point every consumer of the API key (MCP client configs, the background service /
 // systemd env file / launchd plist, OpenClaw) at `key`. Shared by runInit and rotate-key
@@ -87,6 +91,15 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
         console.log(`    • OpenClaw  ✗  (${err.message})`);
       }
     }
+    // Claude Desktop's Code tab runs the same Claude Code engine under the
+    // hood and reads the same global ~/.claude/settings.json - it just has
+    // no CLI on PATH for hasClaudeCode()'s probe to find, and (unlike
+    // terminal `claude`) no project-scoped ~/.claude.json entry to patch.
+    // Before this fix, a desktop-only machine (no terminal `claude` on PATH
+    // at all) got ZERO settings.json writes: not even the pre-existing
+    // Stop/PreToolUse hook capture, let alone anything interception-related.
+    // See the plan doc's Layer 3 section ("the detection gap to fix").
+    const hasDesktop = hasClaudeDesktop();
     if (hasClaude) {
       try {
         patchClaudeCodeConfig(claudeCodeConfigPath(), key);
@@ -94,13 +107,28 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
       } catch (err) {
         console.log(`    • Claude Code  ✗  (${err.message})`);
       }
+    }
+    if (hasClaude || hasDesktop) {
       try {
         patchClaudeCodeHooks(claudeCodeSettingsPath());
         console.log(`    • Claude Code usage capture (all projects)  ✓`);
       } catch (err) {
         console.log(`    • Claude Code usage capture  ✗  (${err.message})`);
       }
-      await maybeEnableClaudeCodeProxy(proxyOptIn, key);
+    }
+    if (hasClaude) {
+      // Terminal used to get base-URL substitution (maybeEnableClaudeCodeProxy)
+      // here - found live 2026-09-07 that it silently bills the org's own
+      // pay-as-you-go API key for every terminal call, since substituting
+      // ANTHROPIC_AUTH_TOKEN with a Troxy token means no real Anthropic
+      // credential ever reaches model-proxy. This now reuses the same
+      // interception mechanism already live for Desktop (see
+      // patchClaudeCodeInterception below) instead: terminal keeps its own
+      // real login, Troxy watches the traffic on its way to Anthropic.
+      // Desktop-only machines are unaffected by this call (hasDesktop is
+      // not part of the gate here) - they still use the existing manual
+      // `troxy proxy enable --experimental` path.
+      await maybeEnableTroxyInterception(proxyOptIn, hasDesktop);
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -320,6 +348,28 @@ export async function runInit({ key, name, proxy } = {}) {
   console.log('\n  For more information, visit https://docs.troxy.io\n');
 }
 
+// Found live 2026-09-08: `which troxy` failing silently fell back to a
+// guessed path, `/usr/local/bin/troxy`, that may not exist on this machine
+// at all. Nothing downstream ever checked - the plist/unit file got written
+// and loaded pointing at a binary that isn't there, and installService still
+// returned normally, so init printed "Background service installed ✓" for a
+// service that could never actually start. The specific incident that
+// surfaced this was a dev-only setup (this repo living under a TCC-
+// protected folder, see troxy-hq/CLAUDE.md) - but `which troxy` reliably
+// fails for real end users too, every time someone runs `npx troxy-cli
+// init` (README's own documented install path): npx never puts the binary
+// on PATH, so this is the common case for that install method, not an edge
+// case. The error message below leads with the fix that actually applies to
+// them.
+export function verifyTroxyBinExists(troxy) {
+  if (!fs.existsSync(troxy)) {
+    throw new Error(
+      `resolved troxy binary not found at ${troxy} - run "npm install -g troxy-cli" ` +
+      '(or "npm link" from a local checkout) so "which troxy" resolves correctly, then re-run init',
+    );
+  }
+}
+
 function installService(apiKey, agentName) {
   const platform = process.platform;
   let troxy;
@@ -328,8 +378,12 @@ function installService(apiKey, agentName) {
   } catch {
     troxy = '/usr/local/bin/troxy';
   }
+  verifyTroxyBinExists(troxy);
 
   if (platform === 'linux') {
+    // No StandardOutPath/StandardErrorPath equivalent needed here (unlike the
+    // darwin branch below) - systemd captures a service's stdout/stderr into
+    // the journal automatically; `journalctl -u troxy-mcp` is the log.
     // The API key lives in a separate root-owned, 600-permission file loaded via
     // EnvironmentFile= — unit files under /etc/systemd/system are world-readable
     // (mode 644), so putting the key directly in `Environment=` there would leak
@@ -362,6 +416,19 @@ WantedBy=multi-user.target
     execSync('sudo systemctl restart troxy-mcp');
 
   } else if (platform === 'darwin') {
+    // Found live 2026-09-08: with no StandardOutPath/StandardErrorPath, a
+    // daemon that fails to start under launchd (e.g. the TCC-protected-folder
+    // EPERM bug documented in troxy-hq/CLAUDE.md) fails completely silently -
+    // no log anywhere says why. These two keys are launchd's only mechanism
+    // for capturing a job's stdout/stderr (there is no journald equivalent on
+    // macOS); the log directory is created below, before the plist is loaded,
+    // since launchd creates the log *file* on first output but not a missing
+    // parent directory.
+    const troxyDir = path.join(os.homedir(), '.troxy');
+    const stdoutLogPath = path.join(troxyDir, 'daemon-out.log');
+    const stderrLogPath = path.join(troxyDir, 'daemon-err.log');
+    fs.mkdirSync(troxyDir, { recursive: true });
+
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -382,6 +449,10 @@ WantedBy=multi-user.target
     <key>PATH</key>
     <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
   </dict>
+  <key>StandardOutPath</key>
+  <string>${stdoutLogPath}</string>
+  <key>StandardErrorPath</key>
+  <string>${stderrLogPath}</string>
   <key>RunAtLoad</key>
   <true/>
   <key>KeepAlive</key>
@@ -466,10 +537,27 @@ function patchContinueConfig(configPath, apiKey) {
 // asking the agent to also report chat-only turns would double-count against
 // the hook's real capture of the same turns. Tool-use self-report is left
 // alone; the hook does not replace that, only chat-only reporting.
-function claudeCodeConfigPath() {
+export function claudeCodeConfigPath() {
   return path.join(os.homedir(), '.claude.json');
 }
 
+// checklist item: uninstall symmetry. Removes the troxy mcpServers entry
+// from EVERY project in ~/.claude.json, not just process.cwd() - a machine
+// may have run `troxy init` from several project directories over time,
+// each getting its own entry (patchClaudeCodeConfig is keyed by cwd), and
+// uninstall has no reliable way to know which cwd(s) were used, so it
+// simply scans every project this file knows about.
+export function unpatchClaudeCodeConfig(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (config.projects) {
+    for (const proj of Object.values(config.projects)) {
+      if (proj?.mcpServers?.troxy) delete proj.mcpServers.troxy;
+    }
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
 // configPath and cwd are explicit params, same shape as patchMcpConfig /
 // patchZedConfig above, so this can be pointed at a temp file and a fake
 // project directory in tests rather than always touching the real
@@ -496,7 +584,7 @@ export function patchClaudeCodeConfig(configPath, apiKey, cwd = process.cwd()) {
 // and replacing it in place, rather than blind-pushing - a second `troxy
 // init` must not duplicate the entry, and any of the user's OWN unrelated
 // Stop hooks in the same file must survive untouched.
-function claudeCodeSettingsPath() {
+export function claudeCodeSettingsPath() {
   return path.join(os.homedir(), '.claude', 'settings.json');
 }
 
@@ -523,6 +611,17 @@ export function troxyPreToolUseCommand() {
   return `${_resolveTroxyBin()} pretooluse-hook`;
 }
 
+// Shared by patchClaudeCodeHooks and unpatchClaudeCodeHooks, so "what counts
+// as a Troxy-owned hook entry" has exactly one definition.
+function _isTroxyStopEntry(matcherEntry) {
+  return Array.isArray(matcherEntry?.hooks) &&
+    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('hook-report'));
+}
+function _isTroxyPreToolUseEntry(matcherEntry) {
+  return Array.isArray(matcherEntry?.hooks) &&
+    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('pretooluse-hook'));
+}
+
 export function patchClaudeCodeHooks(
   configPath,
   stopCommand = troxyHookCommand(),
@@ -533,11 +632,8 @@ export function patchClaudeCodeHooks(
   if (!config.hooks) config.hooks = {};
 
   if (!Array.isArray(config.hooks.Stop)) config.hooks.Stop = [];
-  const isTroxyStopEntry = (matcherEntry) =>
-    Array.isArray(matcherEntry?.hooks) &&
-    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('hook-report'));
   const stopEntry = { hooks: [{ type: 'command', command: stopCommand }] };
-  const stopIdx = config.hooks.Stop.findIndex(isTroxyStopEntry);
+  const stopIdx = config.hooks.Stop.findIndex(_isTroxyStopEntry);
   if (stopIdx >= 0) config.hooks.Stop[stopIdx] = stopEntry;
   else config.hooks.Stop.push(stopEntry);
 
@@ -549,11 +645,8 @@ export function patchClaudeCodeHooks(
   // Claude Code cancels the hook and lets the tool proceed once this
   // elapses (its documented behavior for a timed-out PreToolUse hook).
   if (!Array.isArray(config.hooks.PreToolUse)) config.hooks.PreToolUse = [];
-  const isTroxyPreToolUseEntry = (matcherEntry) =>
-    Array.isArray(matcherEntry?.hooks) &&
-    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('pretooluse-hook'));
   const preToolUseEntry = { matcher: '*', hooks: [{ type: 'command', command: preToolUseCommand, timeout: 5 }] };
-  const preIdx = config.hooks.PreToolUse.findIndex(isTroxyPreToolUseEntry);
+  const preIdx = config.hooks.PreToolUse.findIndex(_isTroxyPreToolUseEntry);
   if (preIdx >= 0) config.hooks.PreToolUse[preIdx] = preToolUseEntry;
   else config.hooks.PreToolUse.push(preToolUseEntry);
 
@@ -561,6 +654,21 @@ export function patchClaudeCodeHooks(
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
 }
 
+// Uninstall symmetry (fail-open layer 6 in the plan doc): removes exactly
+// the Troxy-owned Stop/PreToolUse entries, leaving any of the user's own
+// unrelated hooks in the same file untouched.
+export function unpatchClaudeCodeHooks(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (Array.isArray(config.hooks?.Stop)) {
+    config.hooks.Stop = config.hooks.Stop.filter(e => !_isTroxyStopEntry(e));
+  }
+  if (Array.isArray(config.hooks?.PreToolUse)) {
+    config.hooks.PreToolUse = config.hooks.PreToolUse.filter(e => !_isTroxyPreToolUseEntry(e));
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
 // checklist #17 ("one-command proxy setup") - routes Claude Code's model
 // calls through Troxy's model-proxy instead of straight to Anthropic, so
 // evaluate_model's advisory model-swap suggestions become real, enforced
@@ -606,30 +714,91 @@ export function patchClaudeCodeProxy(configPath, troxyKey, baseUrl = troxyModelP
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
 }
 
-// Opt-in only (Gilad, 2026-08-29): the Remote Control tradeoff is real and
-// user-visible, so this must be a deliberate yes, never a default-on
-// behavior change slipped into an ordinary init run.
-//   proxyOptIn === true  -> --proxy was passed explicitly, enable without asking
-//   proxyOptIn === null  -> not passed; ask interactively if there's a TTY,
-//                           otherwise skip (a scripted/CI init must never hang
-//                           on a prompt, and silence must never mean yes)
-async function maybeEnableClaudeCodeProxy(proxyOptIn, key) {
+// Uninstall symmetry (fail-open layer 6): removes exactly the three keys
+// patchClaudeCodeProxy writes, leaving any other env keys (the user's own,
+// or the interception keys below) untouched.
+export function unpatchClaudeCodeProxy(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (config.env) {
+    delete config.env.ANTHROPIC_BASE_URL;
+    delete config.env.ANTHROPIC_AUTH_TOKEN;
+    delete config.env.ENABLE_TOOL_SEARCH;
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// Auto-migration for the terminal-interception-passthrough fix
+// (2026-09-08): a machine that already ran `troxy init --proxy` has
+// ANTHROPIC_AUTH_TOKEN set to a Troxy token instead of a real Anthropic
+// credential, which is why model-proxy had to fall back to the org's own
+// pay-as-you-go API key to pay for terminal calls at all - confirmed live
+// 2026-09-07, a single terminal message visibly moved the org's Console
+// API balance instead of the user's Claude subscription usage. Called
+// unconditionally by maybeEnableTroxyInterception (below), regardless of
+// whether the user then opts into interception - leaving these keys in
+// place is strictly worse than falling back to no Troxy visibility for
+// terminal at all.
+export function migrateBaseUrlProxyToInterception(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return false; }
+  const env = config.env || {};
+  const isTroxyOwned =
+    env.ANTHROPIC_BASE_URL === troxyModelProxyBaseUrl() ||
+    String(env.ANTHROPIC_AUTH_TOKEN || '').startsWith('txy-');
+  if (!isTroxyOwned) return false;
+  unpatchClaudeCodeProxy(configPath);
+  return true;
+}
+
+// Terminal's counterpart to the desktop app's already-shipped
+// interception path. See the call site above for why terminal moved off
+// base-URL substitution. Same proxyOptIn semantics as the retired
+// maybeEnableClaudeCodeProxy: true = enable without asking, null + TTY =
+// ask interactively, otherwise skip (a scripted/CI init must never hang
+// on a prompt).
+async function maybeEnableTroxyInterception(proxyOptIn, hasDesktop, configPath = claudeCodeSettingsPath()) {
+  // Unconditional, regardless of what's decided below: a machine still on
+  // the old base-URL substitution keys is actively mischarging the org's
+  // API balance right now, and leaving that in place is strictly worse
+  // than falling back to no Troxy visibility for terminal at all.
+  const migrated = migrateBaseUrlProxyToInterception(configPath);
+  if (migrated) {
+    console.log('    • Removed the old Troxy proxy setup for terminal (was billing your org\'s API key instead of your subscription)');
+  }
+
+  if (interceptionIsConfigured(configPath)) return; // already set up correctly, nothing to ask
+
   let enable = proxyOptIn === true;
   if (proxyOptIn === null && process.stdin.isTTY) {
     console.log("\n  Route Claude Code's model calls through Troxy for automatic cost");
-    console.log('  optimization? Troxy can swap in a cheaper model when it finds an');
-    console.log('  opportunity, not just suggest one.');
-    console.log("  Trade-off: while this is on, Claude Code's Remote Control feature is");
-    console.log('  disabled (Anthropic disables it whenever the API base URL points');
-    console.log('  anywhere other than api.anthropic.com). Model policies (e.g. a BLOCK');
-    console.log('  rule on a specific model) ARE enforced on this path.');
+    console.log('  optimization? Your normal Claude login (subscription or API key) still');
+    console.log('  pays - Troxy never substitutes its own credential. Troxy does see your');
+    console.log('  real credential in transit, forwarded upstream to actually make the');
+    console.log('  call to Anthropic on your behalf.');
+    console.log('  How: Troxy generates a certificate authority ON THIS MACHINE');
+    console.log('  (~/.troxy/tls/). The private key never leaves this computer and is');
+    console.log('  never sent to Troxy. It is locked to api.anthropic.com only and is');
+    console.log('  NOT installed in your system keychain, only referenced by Claude Code.');
+    if (hasDesktop) {
+      console.log('  This also covers the Claude desktop app\'s Code tab (same setting).');
+    }
+    console.log('  Remove any time with: troxy proxy disable');
     const answer = await prompt('  Enable? (y/N): ');
     enable = /^y(es)?$/i.test(answer);
   }
   if (!enable) return;
+
   try {
-    patchClaudeCodeProxy(claudeCodeSettingsPath(), key);
+    const troxyDir = path.join(os.homedir(), '.troxy');
+    ensureInterceptionCerts(troxyDir, { hostname: os.hostname(), leafDnsNames: interceptHostsFor(enabledProviders()) });
+    patchClaudeCodeInterception(configPath);
     console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
+    const bound = await probePort(INTERCEPTOR_PORT);
+    if (!bound) {
+      console.log(`    ⚠  Nothing is listening on 127.0.0.1:${INTERCEPTOR_PORT} yet - restart the`);
+      console.log('       background service (`troxy restart`) so Claude Code can connect.');
+    }
   } catch (err) {
     console.log(`    • Claude Code model proxy  ✗  (${err.message})`);
   }
@@ -648,3 +817,86 @@ export function hasClaudeCode() {
     return false;
   }
 }
+
+// Claude Desktop's Code tab has no "claude --version" to probe (it isn't a
+// CLI on PATH) and no marker *file* whose mere existence is reliable
+// (~/.claude.json / ~/.claude/settings.json are created lazily by troxy
+// itself, so their existence proves nothing about whether Desktop is
+// installed - the exact hazard tool_detect.js already documents and avoids
+// for Cursor by checking the app's own per-user data directory instead of a
+// system-wide /Applications path). Same technique here, and for the same
+// reason tool_detect.js never checks a fixed /Applications/<App>.app path
+// either: only per-user, HOME-relative locations, so this stays correct
+// under a real $HOME override in tests instead of depending on whatever
+// happens to be installed system-wide on the machine running them.
+export function hasClaudeDesktop() {
+  const home = os.homedir();
+  const paths = [
+    path.join(home, 'Applications/Claude.app'),
+    path.join(home, 'Library/Application Support/Claude'),                                    // macOS
+    path.join(process.env.LOCALAPPDATA || path.join(home, 'AppData/Local'), 'AnthropicClaude'), // Windows
+    path.join(process.env.APPDATA || path.join(home, 'AppData/Roaming'), 'Claude'),
+    path.join(home, '.config/Claude'),                                                          // Linux
+  ];
+  return paths.some(p => { try { return fs.existsSync(p); } catch { return false; } });
+}
+
+// The port the local interceptor listens on (daemon.js's startInterceptor) -
+// re-exported here as a URL so callers never hardcode 127.0.0.1 or the
+// scheme themselves.
+export function troxyInterceptorProxyUrl(port = INTERCEPTOR_PORT) {
+  return `http://127.0.0.1:${port}`;
+}
+
+export function troxyLocalCaCertPath(troxyDir = path.join(os.homedir(), '.troxy')) {
+  return path.join(troxyDir, 'tls', 'troxy-local-ca.crt');
+}
+
+// Layer 3 of the Live Model Policy Enforcement plan: routes the desktop
+// app's Code tab (which hard-overrides ANTHROPIC_BASE_URL, so the base-URL
+// substitution above never reaches it) through the local interceptor
+// instead. Terminal `claude` honors these two the same way Desktop does.
+// Do NOT also leave the base-URL substitution keys set for the same
+// surface - if `ANTHROPIC_BASE_URL` points straight at proxy.troxy.io,
+// Claude Code never touches api.anthropic.com at all, so this
+// interceptor's allowlist never sees that traffic; base-URL substitution
+// silently wins. See `migrateBaseUrlProxyToInterception` for how
+// terminal's own provisioning avoids this.
+export function patchClaudeCodeInterception(
+  configPath,
+  { proxyUrl = troxyInterceptorProxyUrl(), caCertPath = troxyLocalCaCertPath() } = {},
+) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
+  if (!config.env) config.env = {};
+  config.env.HTTPS_PROXY = proxyUrl;
+  config.env.NODE_EXTRA_CA_CERTS = caCertPath;
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// `troxy proxy disable`'s one-line recovery, and part of uninstall symmetry
+// (fail-open layer 6) - removes exactly these two keys, leaving the
+// base-URL proxy keys (if also set) and any of the user's own env untouched.
+export function unpatchClaudeCodeInterception(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (config.env) {
+    delete config.env.HTTPS_PROXY;
+    delete config.env.NODE_EXTRA_CA_CERTS;
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// Used by `troxy proxy status`/`enable` to avoid re-prompting or rewriting
+// settings that are already correct (the same class of bug the pre-existing
+// maybeEnableClaudeCodeProxy has - re-prompts on every rotate-key/update
+// because it never checks this).
+export function interceptionIsConfigured(
+  configPath,
+  { proxyUrl = troxyInterceptorProxyUrl(), caCertPath = troxyLocalCaCertPath() } = {},
+) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return false; }
+  return config.env?.HTTPS_PROXY === proxyUrl && config.env?.NODE_EXTRA_CA_CERTS === caCertPath;
+}