troxy-cli 1.29.2 → 1.29.4

package/src/tests/proxy-wiring.test.js

@@ -0,0 +1,118 @@
+// Source-inspection tests for glue code that can't be unit-tested directly
+// without heavy mocking (reprovisionKeyConsumers does real execSync/fs
+// calls against installService etc. - same reason init.test.js and
+// tool_detect.test.js's own "wiring" section never call it directly either).
+//
+// Covers two things from the plan's Layer 3 spec:
+//  1. reprovisionKeyConsumers's settings.json-writing gate is widened from
+//     hasClaude alone to (hasClaude || hasDesktop) for the Stop/PreToolUse
+//     hook step - a desktop-only machine used to get zero settings.json
+//     writes at all.
+//  2. bin/troxy.js registers `troxy proxy status/enable/disable`, wired to
+//     src/proxy.js, and is NOT listed in the default help banner (it's
+//     deliberately undocumented per the plan's rollout order - not surfaced
+//     until after real hands-on validation).
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const initSrc = readFileSync(join(__dirname, '..', 'init.js'), 'utf8');
+const binSrc = readFileSync(join(__dirname, '..', '..', 'bin', 'troxy.js'), 'utf8');
+const uninstallSrc = readFileSync(join(__dirname, '..', 'uninstall.js'), 'utf8');
+
+describe('reprovisionKeyConsumers: desktop detection gate', () => {
+  it('computes hasDesktop via hasClaudeDesktop()', () => {
+    assert.match(initSrc, /const hasDesktop = hasClaudeDesktop\(\);/);
+  });
+
+  it('gates patchClaudeCodeHooks on (hasClaude || hasDesktop), not hasClaude alone', () => {
+    const hooksIdx = initSrc.indexOf('patchClaudeCodeHooks(claudeCodeSettingsPath())');
+    assert.ok(hooksIdx !== -1, 'patchClaudeCodeHooks call not found');
+    const preceding = initSrc.slice(Math.max(0, hooksIdx - 200), hooksIdx);
+    assert.match(
+      preceding,
+      /if\s*\(hasClaude\s*\|\|\s*hasDesktop\)\s*\{/,
+      'the Stop/PreToolUse hook step must be gated on hasClaude || hasDesktop',
+    );
+  });
+
+  // Matches the exact `if (<condition>) {` guarding each call, whatever
+  // comments sit in between - robust to the block's own prose being edited,
+  // unlike a fixed-size slice of preceding characters.
+  function _guardCondition(callSnippet) {
+    const callIdx = initSrc.indexOf(callSnippet);
+    assert.ok(callIdx !== -1, `call not found: ${callSnippet}`);
+    const before = initSrc.slice(0, callIdx);
+    const ifMatches = [...before.matchAll(/if\s*\(([^)]*)\)\s*\{/g)];
+    assert.ok(ifMatches.length > 0, `no guarding if() found before: ${callSnippet}`);
+    return ifMatches[ifMatches.length - 1][1].trim();
+  }
+
+  it('keeps patchClaudeCodeConfig (project-scoped MCP registration) gated on hasClaude alone - terminal only', () => {
+    assert.equal(_guardCondition('patchClaudeCodeConfig(claudeCodeConfigPath(), key)'), 'hasClaude');
+  });
+
+  it('calls maybeEnableTroxyInterception (not the old base-URL substitution) gated on hasClaude alone', () => {
+    assert.equal(_guardCondition('await maybeEnableTroxyInterception(proxyOptIn, hasDesktop);'), 'hasClaude');
+  });
+
+  it('no longer calls maybeEnableClaudeCodeProxy from reprovisionKeyConsumers - terminal fully switched to interception', () => {
+    assert.ok(!initSrc.includes('await maybeEnableClaudeCodeProxy'));
+  });
+
+  it('maybeEnableTroxyInterception runs migration before the enable/proxyOptIn decision, so it always fires', () => {
+    const fnStart = initSrc.indexOf('async function maybeEnableTroxyInterception');
+    assert.ok(fnStart !== -1, 'maybeEnableTroxyInterception not found');
+    const fnBody = initSrc.slice(fnStart, fnStart + 1000);
+    const migrateIdx = fnBody.indexOf('migrateBaseUrlProxyToInterception(');
+    const optInIdx = fnBody.indexOf('proxyOptIn === true');
+    assert.ok(migrateIdx !== -1, 'migrateBaseUrlProxyToInterception call not found in function body');
+    assert.ok(optInIdx !== -1, 'proxyOptIn check not found in function body');
+    assert.ok(migrateIdx < optInIdx, 'migration must run unconditionally, before the enable/proxyOptIn decision');
+  });
+});
+
+describe('bin/troxy.js: proxy subcommand wiring', () => {
+  it("registers case 'proxy' importing from src/proxy.js", () => {
+    assert.ok(binSrc.includes("case 'proxy'"));
+    assert.ok(binSrc.includes("'../src/proxy.js'"));
+  });
+
+  it('dispatches status/enable/disable to the matching proxy.js export', () => {
+    const proxyBlock = binSrc.slice(binSrc.indexOf("case 'proxy'"), binSrc.indexOf("case 'proxy'") + 800);
+    assert.match(proxyBlock, /runProxyEnable/);
+    assert.match(proxyBlock, /runProxyDisable/);
+    assert.match(proxyBlock, /runProxyStatus/);
+  });
+
+  it('is NOT listed in the default help banner - deliberately undocumented until rollout step 5', () => {
+    const helpBannerStart = binSrc.indexOf("Troxy: a secure control layer for AI agents");
+    const helpBanner = binSrc.slice(helpBannerStart);
+    assert.ok(!helpBanner.includes('troxy proxy '), 'troxy proxy must not appear in the printed help banner yet');
+  });
+});
+
+describe('uninstall.js: settings.json symmetry (fail-open layer 6)', () => {
+  it('calls all four unpatch functions', () => {
+    for (const fn of ['unpatchClaudeCodeConfig', 'unpatchClaudeCodeHooks', 'unpatchClaudeCodeProxy', 'unpatchClaudeCodeInterception']) {
+      assert.ok(uninstallSrc.includes(`${fn}(`), `${fn} is not called from uninstall.js`);
+    }
+  });
+
+  it('reverts settings.json BEFORE deleting ~/.troxy, not after', () => {
+    const revertIdx = uninstallSrc.indexOf('unpatchClaudeCodeConfig(');
+    const deleteIdx = uninstallSrc.indexOf("path.join(os.homedir(), '.troxy')");
+    assert.ok(revertIdx !== -1 && deleteIdx !== -1);
+    assert.ok(revertIdx < deleteIdx, 'settings.json must be reverted before ~/.troxy is deleted - this is the exact fail-open gap the plan requires closed');
+  });
+
+  it('wraps the revert step in try/catch so a broken config file never blocks the rest of uninstall', () => {
+    const revertIdx = uninstallSrc.indexOf('unpatchClaudeCodeConfig(');
+    const surrounding = uninstallSrc.slice(Math.max(0, revertIdx - 200), revertIdx + 400);
+    assert.match(surrounding, /try\s*\{[\s\S]*unpatchClaudeCodeConfig[\s\S]*\}\s*catch/);
+  });
+});

package/src/tests/tls-ca.test.js

@@ -0,0 +1,222 @@
+// Layer 2 of the Live Model Policy Enforcement plan: the certificate
+// authority that lets the local interceptor terminate TLS for
+// api.anthropic.com only. This is the single most security-sensitive file
+// in the whole feature - a cert that impersonates Anthropic's API is
+// powerful, so the nameConstraints extension (permitted;DNS:api.anthropic.com,
+// critical) is the concrete, cryptographic answer to "this must never
+// become a general MITM tool," not just a comment saying so. node-forge has
+// no built-in friendly encoding for nameConstraints (verified directly
+// against its source - only keyUsage/basicConstraints/extKeyUsage/
+// subjectAltName/etc. are natively supported), so it's hand-built from raw
+// ASN.1 here - exactly the kind of thing that's easy to get subtly wrong in
+// a way that LOOKS right until a real client actually tries to validate it.
+// The last test in this file does a genuine TLS handshake, not just DER
+// inspection, specifically to catch that class of mistake.
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import tls from 'node:tls';
+import net from 'node:net';
+import forge from 'node-forge';
+
+import {
+  generateCA,
+  generateLeaf,
+  certIsValid,
+  certExpiresWithin,
+  ensureInterceptionCerts,
+} from '../tls-ca.js';
+
+let dir;
+beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-tls-ca-')); });
+afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+
+describe('generateCA', () => {
+  it('is a CA certificate with pathlen:0', () => {
+    const { certPem } = generateCA('test-host');
+    const cert = forge.pki.certificateFromPem(certPem);
+    const bc = cert.getExtension('basicConstraints');
+    assert.equal(bc.cA, true);
+    assert.equal(bc.pathLenConstraint, 0);
+    assert.equal(bc.critical, true);
+  });
+
+  it('has keyCertSign + cRLSign key usage, critical', () => {
+    const { certPem } = generateCA('test-host');
+    const cert = forge.pki.certificateFromPem(certPem);
+    const ku = cert.getExtension('keyUsage');
+    assert.equal(ku.keyCertSign, true);
+    assert.equal(ku.cRLSign, true);
+    assert.equal(ku.critical, true);
+  });
+
+  it('has a nameConstraints extension, critical, restricted to api.anthropic.com', () => {
+    const { certPem } = generateCA('test-host');
+    const cert = forge.pki.certificateFromPem(certPem);
+    const nc = cert.getExtension({ id: '2.5.29.30' });
+    assert.ok(nc, 'nameConstraints extension is missing entirely');
+    assert.equal(nc.critical, true, 'nameConstraints must be critical - a non-critical ' +
+      'constraint a client does not understand is required to be IGNORED per RFC 5280, ' +
+      'which would silently defeat the whole scoping guarantee');
+  });
+
+  it('CN identifies this as a Troxy-issued interception CA, with the hostname, for cert-viewer clarity', () => {
+    const { certPem } = generateCA('my-macbook');
+    const cert = forge.pki.certificateFromPem(certPem);
+    const cn = cert.subject.getField('CN').value;
+    assert.match(cn, /Troxy/);
+    assert.match(cn, /my-macbook/);
+  });
+
+  it('is not expired and does not expire within the next year (long validity, not a leaf)', () => {
+    const { certPem } = generateCA('test-host');
+    assert.equal(certIsValid(certPem), true);
+    assert.equal(certExpiresWithin(certPem, 365), false);
+  });
+});
+
+describe('generateLeaf', () => {
+  it('chains to the issuing CA (verifiable, not just self-consistent)', () => {
+    const ca = generateCA('test-host');
+    const leaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com']);
+    const caCert = forge.pki.certificateFromPem(ca.certPem);
+    const leafCert = forge.pki.certificateFromPem(leaf.certPem);
+    assert.equal(caCert.verify(leafCert), true);
+  });
+
+  it('has serverAuth extended key usage', () => {
+    const ca = generateCA('test-host');
+    const leaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com']);
+    const cert = forge.pki.certificateFromPem(leaf.certPem);
+    const eku = cert.getExtension('extKeyUsage');
+    assert.equal(eku.serverAuth, true);
+  });
+
+  it('carries the requested hostname as a subjectAltName dNSName', () => {
+    const ca = generateCA('test-host');
+    const leaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com']);
+    const cert = forge.pki.certificateFromPem(leaf.certPem);
+    const san = cert.getExtension('subjectAltName');
+    const names = san.altNames.map(n => n.value);
+    assert.deepEqual(names, ['api.anthropic.com']);
+  });
+
+  it('defaults to a 90-day validity window', () => {
+    const ca = generateCA('test-host');
+    const leaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com']);
+    assert.equal(certExpiresWithin(leaf.certPem, 91), true);
+    assert.equal(certExpiresWithin(leaf.certPem, 1), false);
+  });
+});
+
+describe('ensureInterceptionCerts', () => {
+  const opts = () => ({ hostname: 'test-host', leafDnsNames: ['api.anthropic.com'] });
+
+  it('generates and writes CA + leaf files on first run', () => {
+    const result = ensureInterceptionCerts(dir, opts());
+    assert.ok(fs.existsSync(result.caCertPath));
+    assert.ok(fs.existsSync(result.caKeyPath));
+    assert.ok(fs.existsSync(result.leafCertPath));
+    assert.ok(fs.existsSync(result.leafKeyPath));
+  });
+
+  it('directory is 0700 and every file is 0600 - same convention as ~/.troxy/config.json', () => {
+    const result = ensureInterceptionCerts(dir, opts());
+    const dirMode = fs.statSync(path.dirname(result.caCertPath)).mode & 0o777;
+    assert.equal(dirMode, 0o700);
+    for (const p of [result.caCertPath, result.caKeyPath, result.leafCertPath, result.leafKeyPath]) {
+      assert.equal(fs.statSync(p).mode & 0o777, 0o600, `${p} is not 0600`);
+    }
+  });
+
+  it('re-running when everything is still healthy is idempotent - same CA, not regenerated', () => {
+    const first = ensureInterceptionCerts(dir, opts());
+    const second = ensureInterceptionCerts(dir, opts());
+    assert.equal(second.caCertPem, first.caCertPem);
+    assert.equal(second.leafCertPem, first.leafCertPem);
+  });
+
+  it('regenerates the CA when the existing one is corrupt, rather than throwing', () => {
+    fs.mkdirSync(path.join(dir, 'tls'), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(dir, 'tls', 'troxy-local-ca.crt'), 'not a real cert', { mode: 0o600 });
+    assert.doesNotThrow(() => ensureInterceptionCerts(dir, opts()));
+    const result = ensureInterceptionCerts(dir, opts());
+    assert.equal(certIsValid(result.caCertPem), true);
+  });
+
+  it('re-issues an expiring leaf without touching the CA', () => {
+    const first = ensureInterceptionCerts(dir, opts());
+    // Force the leaf to look imminently-expiring by writing one that's
+    // already past the renewal window, signed by the SAME CA on disk.
+    const ca = { certPem: first.caCertPem, keyPem: fs.readFileSync(first.caKeyPath, 'utf8') };
+    const staleLeaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com'], { days: 1 });
+    fs.writeFileSync(first.leafCertPath, staleLeaf.certPem, { mode: 0o600 });
+    fs.writeFileSync(first.leafKeyPath, staleLeaf.keyPem, { mode: 0o600 });
+
+    const renewed = ensureInterceptionCerts(dir, opts());
+    assert.equal(renewed.caCertPem, first.caCertPem, 'CA must not be touched by a leaf renewal');
+    assert.notEqual(renewed.leafCertPem, staleLeaf.certPem, 'leaf was not actually renewed');
+    assert.equal(certExpiresWithin(renewed.leafCertPem, 30), false);
+  });
+});
+
+describe('name-constraint enforcement - a real TLS handshake, not just DER inspection', () => {
+  // This is the test that actually proves "can't become a general MITM
+  // tool" rather than asserting it. A client that trusts this CA must
+  // accept a leaf for api.anthropic.com and MUST REJECT a leaf for any
+  // other host, enforced by the TLS stack itself via the CA's
+  // nameConstraints extension - not by any code in this project choosing
+  // to behave correctly.
+  function listenWithCert(certPem, keyPem) {
+    return new Promise((resolve) => {
+      const server = tls.createServer({ cert: certPem, key: keyPem }, (socket) => {
+        socket.end();
+      });
+      server.listen(0, '127.0.0.1', () => resolve(server));
+    });
+  }
+
+  function attemptHandshake(port, caCertPem, servername) {
+    return new Promise((resolve) => {
+      const socket = tls.connect(
+        { host: '127.0.0.1', port, servername, ca: [caCertPem], rejectUnauthorized: true },
+        () => { socket.end(); resolve({ ok: true }); },
+      );
+      socket.on('error', (err) => resolve({ ok: false, error: err }));
+    });
+  }
+
+  it('a leaf for api.anthropic.com, signed by this CA, is trusted', async () => {
+    const ca = generateCA('test-host');
+    const leaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com']);
+    const server = await listenWithCert(leaf.certPem, leaf.keyPem);
+    try {
+      const result = await attemptHandshake(server.address().port, ca.certPem, 'api.anthropic.com');
+      assert.equal(result.ok, true, `expected the handshake to succeed, got: ${result.error}`);
+    } finally {
+      server.close();
+    }
+  });
+
+  it('a leaf for github.com, signed by the SAME CA, is REJECTED by name constraints - ' +
+     'a leaked CA key still cannot impersonate any other host', async () => {
+    const ca = generateCA('test-host');
+    // Sign a leaf for an out-of-scope host directly with generateLeaf,
+    // simulating what an attacker with the CA key (but not this codebase's
+    // cooperation) could attempt.
+    const rogueLeaf = generateLeaf(ca.certPem, ca.keyPem, ['github.com']);
+    const server = await listenWithCert(rogueLeaf.certPem, rogueLeaf.keyPem);
+    try {
+      const result = await attemptHandshake(server.address().port, ca.certPem, 'github.com');
+      assert.equal(result.ok, false,
+        'a client trusting this CA accepted a certificate for github.com - the ' +
+        'nameConstraints extension is not actually being enforced, which defeats ' +
+        'this entire feature\'s core security guarantee');
+    } finally {
+      server.close();
+    }
+  });
+});

package/src/tls-ca.js

@@ -0,0 +1,208 @@
+/**
+ * The certificate authority for the local interceptor (Layer 2 of the Live
+ * Model Policy Enforcement plan). Generated once per install, entirely on
+ * this machine - the private key never leaves it and is never sent to
+ * Troxy. Scoped to intercept exactly one thing, cryptographically: a
+ * nameConstraints extension (permitted;DNS:api.anthropic.com, critical)
+ * means even a leaked CA key cannot sign a certificate any client trusting
+ * this CA would accept for any host other than api.anthropic.com. See
+ * tls-ca.test.js's last two tests - a real TLS handshake, not just DER
+ * inspection - for the proof.
+ *
+ * node-forge has no built-in friendly encoding for nameConstraints (only
+ * keyUsage/basicConstraints/extKeyUsage/subjectAltName/etc. are natively
+ * supported - verified directly against its source before writing this),
+ * so it's hand-built from raw ASN.1 per RFC 5280 in _nameConstraintsValue.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import forge from 'node-forge';
+
+const CA_VALIDITY_DAYS = 730;       // ~2 years
+const LEAF_VALIDITY_DAYS = 90;
+const LEAF_RENEW_WITHIN_DAYS = 30;  // re-issue once fewer than this many days remain
+const KEY_BITS = 2048;
+
+function _daysFromNow(days) {
+  const d = new Date();
+  d.setDate(d.getDate() + days);
+  return d;
+}
+
+function _randomSerial() {
+  // Positive, non-zero, RFC 5280-compliant serial - a leading 00 byte
+  // avoids the value being misread as negative (DER INTEGERs are
+  // two's-complement) when the high bit of the first random byte is set.
+  let hex = forge.util.bytesToHex(forge.random.getBytesSync(16));
+  if (parseInt(hex[0], 16) >= 8) hex = '00' + hex;
+  return hex;
+}
+
+// NameConstraints ::= SEQUENCE { permittedSubtrees [0] GeneralSubtrees OPTIONAL, ... }
+// GeneralSubtrees ::= SEQUENCE OF GeneralSubtree
+// GeneralSubtree ::= SEQUENCE { base GeneralName, ... }
+// GeneralName ::= CHOICE { ..., dNSName [2] IA5String, ... }        (RFC 5280 s4.2.1.10)
+function _nameConstraintsValue(permittedDnsNames) {
+  const asn1 = forge.asn1;
+  const generalSubtrees = permittedDnsNames.map(name => {
+    const dnsGeneralName = asn1.create(asn1.Class.CONTEXT_SPECIFIC, 2, false, name);
+    return asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [dnsGeneralName]);
+  });
+  const permittedSubtrees = asn1.create(
+    asn1.Class.CONTEXT_SPECIFIC, 0, true, generalSubtrees,
+  );
+  const nameConstraints = asn1.create(
+    asn1.Class.UNIVERSAL, asn1.Type.SEQUENCE, true, [permittedSubtrees],
+  );
+  return asn1.toDer(nameConstraints).getBytes();
+}
+
+/**
+ * Generates a new, self-signed CA restricted to `permittedDnsNames` (only
+ * api.anthropic.com is ever passed today - see providers.js). `hostname`
+ * is cosmetic only (goes in the CN, for a real human looking at this in a
+ * certificate viewer), not a security boundary.
+ */
+export function generateCA(hostname, permittedDnsNames = ['api.anthropic.com']) {
+  const keys = forge.pki.rsa.generateKeyPair(KEY_BITS);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = _randomSerial();
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = _daysFromNow(CA_VALIDITY_DAYS);
+
+  const subject = [{ name: 'commonName', value: `Troxy Local Interception CA (${hostname})` },
+                    { name: 'organizationName', value: 'Troxy (local, unaffiliated with Anthropic)' }];
+  cert.setSubject(subject);
+  cert.setIssuer(subject);
+
+  cert.setExtensions([
+    { name: 'basicConstraints', cA: true, critical: true, pathLenConstraint: 0 },
+    { name: 'keyUsage', critical: true, keyCertSign: true, cRLSign: true },
+    { id: '2.5.29.30', critical: true, value: _nameConstraintsValue(permittedDnsNames) },
+  ]);
+
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+
+  return {
+    certPem: forge.pki.certificateToPem(cert),
+    keyPem: forge.pki.privateKeyToPem(keys.privateKey),
+  };
+}
+
+/**
+ * Signs a leaf certificate for `dnsNames` using the given CA. Only ever
+ * called (in production) with dnsNames matching the CA's own
+ * nameConstraints - a mismatched call would still produce a cert, but no
+ * client trusting the CA would ever accept it (see tls-ca.test.js's
+ * name-constraint enforcement tests). `days` defaults to the short,
+ * frequently-renewed leaf lifetime, not the CA's.
+ */
+export function generateLeaf(caCertPem, caKeyPem, dnsNames, { days = LEAF_VALIDITY_DAYS } = {}) {
+  const caCert = forge.pki.certificateFromPem(caCertPem);
+  const caKey = forge.pki.privateKeyFromPem(caKeyPem);
+  const keys = forge.pki.rsa.generateKeyPair(KEY_BITS);
+
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = _randomSerial();
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = _daysFromNow(days);
+  cert.setSubject([{ name: 'commonName', value: dnsNames[0] }]);
+  cert.setIssuer(caCert.subject.attributes);
+
+  cert.setExtensions([
+    { name: 'basicConstraints', cA: false, critical: true },
+    { name: 'keyUsage', critical: true, digitalSignature: true, keyEncipherment: true },
+    { name: 'extKeyUsage', serverAuth: true },
+    { name: 'subjectAltName', altNames: dnsNames.map(value => ({ type: 2, value })) },
+  ]);
+
+  cert.sign(caKey, forge.md.sha256.create());
+
+  return {
+    certPem: forge.pki.certificateToPem(cert),
+    keyPem: forge.pki.privateKeyToPem(keys.privateKey),
+  };
+}
+
+export function certIsValid(certPem) {
+  try {
+    const cert = forge.pki.certificateFromPem(certPem);
+    const now = new Date();
+    return now >= cert.validity.notBefore && now <= cert.validity.notAfter;
+  } catch {
+    return false;
+  }
+}
+
+export function certExpiresWithin(certPem, days) {
+  try {
+    const cert = forge.pki.certificateFromPem(certPem);
+    return cert.validity.notAfter <= _daysFromNow(days);
+  } catch {
+    return true; // unparseable = treat as already-expired, err toward renewing
+  }
+}
+
+function _writeSecret(filePath, contents) {
+  fs.writeFileSync(filePath, contents, { mode: 0o600 });
+  try { fs.chmodSync(filePath, 0o600); } catch {} // mode is ignored if the file already existed
+}
+
+/**
+ * Ensures a healthy CA + leaf pair exists on disk under `dir` (normally
+ * ~/.troxy), generating or renewing whatever is missing/unhealthy.
+ * Idempotent when everything is already valid - re-running does not
+ * regenerate the CA (or the leaf, unless it's within its renewal window).
+ * Follows the exact ~/.troxy/ permission convention already established by
+ * config.js/auth.js: 0700 dir (with the required follow-up chmodSync,
+ * since mkdirSync's mode is ignored if the dir already exists), 0600 files.
+ */
+export function ensureInterceptionCerts(dir, { hostname, leafDnsNames, leafRenewWithinDays = LEAF_RENEW_WITHIN_DAYS } = {}) {
+  const tlsDir = path.join(dir, 'tls');
+  fs.mkdirSync(tlsDir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(tlsDir, 0o700); } catch {}
+
+  const caCertPath = path.join(tlsDir, 'troxy-local-ca.crt');
+  const caKeyPath = path.join(tlsDir, 'troxy-local-ca.key');
+  const leafCertPath = path.join(tlsDir, 'leaf-api.anthropic.com.crt');
+  const leafKeyPath = path.join(tlsDir, 'leaf-api.anthropic.com.key');
+
+  let caCertPem, caKeyPem;
+  const existingCa = fs.existsSync(caCertPath) && fs.existsSync(caKeyPath)
+    ? { certPem: _tryRead(caCertPath), keyPem: _tryRead(caKeyPath) }
+    : null;
+  if (existingCa?.certPem && certIsValid(existingCa.certPem)) {
+    ({ certPem: caCertPem, keyPem: caKeyPem } = existingCa);
+  } else {
+    ({ certPem: caCertPem, keyPem: caKeyPem } = generateCA(hostname, leafDnsNames));
+    _writeSecret(caCertPath, caCertPem);
+    _writeSecret(caKeyPath, caKeyPem);
+  }
+
+  let leafCertPem, leafKeyPem;
+  const existingLeaf = fs.existsSync(leafCertPath) && fs.existsSync(leafKeyPath)
+    ? { certPem: _tryRead(leafCertPath), keyPem: _tryRead(leafKeyPath) }
+    : null;
+  const leafStillHealthy = existingLeaf?.certPem
+    && certIsValid(existingLeaf.certPem)
+    && !certExpiresWithin(existingLeaf.certPem, leafRenewWithinDays)
+    // A leaf issued by a CA that just got regenerated above no longer
+    // chains to the CA now on disk - must be re-issued too, not just
+    // treated as "still valid" on its own terms.
+    && forge.pki.certificateFromPem(caCertPem).verify(forge.pki.certificateFromPem(existingLeaf.certPem));
+  if (leafStillHealthy) {
+    ({ certPem: leafCertPem, keyPem: leafKeyPem } = existingLeaf);
+  } else {
+    ({ certPem: leafCertPem, keyPem: leafKeyPem } = generateLeaf(caCertPem, caKeyPem, leafDnsNames));
+    _writeSecret(leafCertPath, leafCertPem);
+    _writeSecret(leafKeyPath, leafKeyPem);
+  }
+
+  return { caCertPath, caKeyPath, leafCertPath, leafKeyPath, caCertPem, caKeyPem, leafCertPem, leafKeyPem };
+}
+
+function _tryRead(filePath) {
+  try { return fs.readFileSync(filePath, 'utf8'); } catch { return null; }
+}

package/src/uninstall.js

@@ -5,6 +5,11 @@ import { execSync } from 'child_process';
 import readline     from 'readline';
 import { loadConfig } from './config.js';
 import { api }        from './api.js';
+import {
+  claudeCodeConfigPath, claudeCodeSettingsPath,
+  unpatchClaudeCodeConfig, unpatchClaudeCodeHooks,
+  unpatchClaudeCodeProxy, unpatchClaudeCodeInterception,
+} from './init.js';
 
 const MCP_CLIENTS = [
   {
@@ -111,7 +116,30 @@ export async function runUninstall() {
     console.log('none found');
   }
 
-  // 3. Revoke all OTHER agent keys (cloud agents, other machines) using the
+  // 3. Revert everything written into Claude Code's own config files -
+  // project-scoped MCP registration, the global Stop/PreToolUse hooks, the
+  // base-URL model proxy, and (Layer 3) the local-interceptor env vars.
+  // Fail-open layer 6 of the Live Model Policy Enforcement plan: before this,
+  // uninstall deleted ~/.troxy but left every one of these in place, so a
+  // machine that had `HTTPS_PROXY`/`ANTHROPIC_BASE_URL` pointed at Troxy kept
+  // pointing there after Troxy itself was gone - exactly the "stuck, nothing
+  // is listening" outage this plan's fail-open design exists to prevent.
+  // Each is independently best-effort: a missing/corrupt config file must
+  // never stop the rest of uninstall from proceeding.
+  process.stdout.write('  Reverting Claude Code settings...  ');
+  try {
+    unpatchClaudeCodeConfig(claudeCodeConfigPath());
+    unpatchClaudeCodeHooks(claudeCodeSettingsPath());
+    unpatchClaudeCodeProxy(claudeCodeSettingsPath());
+    unpatchClaudeCodeInterception(claudeCodeSettingsPath());
+    console.log('✓');
+  } catch (err) {
+    console.log('✗');
+    console.log(`     Couldn't fully revert Claude Code settings (${err.message}).`);
+    console.log(`     Check ~/.claude/settings.json and ~/.claude.json by hand.\n`);
+  }
+
+  // 4. Revoke all OTHER agent keys (cloud agents, other machines) using the
   // local API key for auth — no troxy login needed. The key proves identity
   // to the server, and /mcp/revoke-all-others kills every other active token
   // for the same user. We do this BEFORE self-revoke so the key is still valid
@@ -135,7 +163,7 @@ export async function runUninstall() {
       console.log('     Go to dash.troxy.io → API Keys to revoke them manually.\n');
     }
 
-    // 4. Revoke THIS machine's API key (self-revoke). Done after revoke-all-others
+    // 5. Revoke THIS machine's API key (self-revoke). Done after revoke-all-others
     // because self-revoke kills the key we're using to authenticate.
     const prefix = apiKey.slice(0, 12) + '...';
     process.stdout.write(`  Revoking local API key ${prefix}...  `);
@@ -149,7 +177,7 @@ export async function runUninstall() {
     }
   }
 
-  // 5. Delete ~/.troxy config
+  // 6. Delete ~/.troxy config
   process.stdout.write('  Removing config (~/.troxy)...  ');
   const configDir = path.join(os.homedir(), '.troxy');
   if (fs.existsSync(configDir)) {
@@ -159,7 +187,7 @@ export async function runUninstall() {
     console.log('not found');
   }
 
-  // 6. Remove npm package
+  // 7. Remove npm package
   process.stdout.write('  Uninstalling troxy CLI...      ');
   try {
     execSync('npm uninstall -g troxy-cli 2>/dev/null || npm uninstall -g troxy 2>/dev/null', { stdio: 'pipe' });