troxy-cli 1.29.23 → 1.29.25

package/src/tests/interceptor.test.js

@@ -13,6 +13,9 @@
 
 import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
 import net from 'node:net';
 import tls from 'node:tls';
 import http from 'node:http';
@@ -105,6 +108,62 @@ describe('buildTroxyForwardHeaders', () => {
     assert.equal(headers.connection, undefined);
     assert.equal(headers['content-length'], undefined);
   });
+
+  it('adds x-troxy-tool-sandbox header when a fresh state file exists', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'treated' }));
+
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'user-agent': 'claude-cli/2.1.236' },
+      'txy-key',
+      dir,
+    );
+
+    assert.equal(headers['x-troxy-tool-sandbox'], 'treated');
+  });
+
+  it('omits x-troxy-tool-sandbox header when no state file exists', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'user-agent': 'claude-cli/2.1.236' },
+      'txy-key',
+      dir,
+    );
+
+    assert.equal('x-troxy-tool-sandbox' in headers, false);
+  });
+
+  it('omits x-troxy-tool-sandbox header when state file is stale (older than 2 minutes)', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    const stateFile = path.join(dir, 'last-state.json');
+    fs.writeFileSync(stateFile, JSON.stringify({ state: 'treated' }));
+
+    const old = new Date(Date.now() - 3 * 60 * 1000);
+    fs.utimesSync(stateFile, old, old);
+
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'user-agent': 'claude-cli/2.1.236' },
+      'txy-key',
+      dir,
+    );
+
+    assert.equal('x-troxy-tool-sandbox' in headers, false);
+  });
+
+  it('does not alter existing x-troxy-surface header behavior when sandbox state is present', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'holdout' }));
+
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'user-agent': 'claude-cli/2.1.236 (external, cli)' },
+      'txy-key',
+      dir,
+    );
+
+    assert.equal(headers['x-troxy-surface'], 'terminal');
+    assert.equal(headers['x-troxy-tool-sandbox'], 'holdout');
+  });
 });
 
 describe('buildRelayHeaders', () => {
@@ -594,3 +653,23 @@ describe('createInterceptor - integration, real sockets', () => {
     assert.equal(result.body, 'tunneled-because-cert-unhealthy');
   });
 });
+
+describe('buildTroxyForwardHeaders session arm', () => {
+  it('tags a request with its own session arm, ignoring another session\'s last-state', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    fs.mkdirSync(path.join(dir, 'sessions'));
+    fs.writeFileSync(path.join(dir, 'sessions', 'sess-aaaa-1111.json'), JSON.stringify({ arm: 'holdout' }));
+    fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'treated' }));
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'x-claude-code-session-id': 'sess-aaaa-1111' }, 'txy-key', dir);
+    assert.equal(headers['x-troxy-tool-sandbox'], 'holdout');
+  });
+
+  it('leaves a session with no arm yet untagged, never borrowing another session\'s last-state', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'treated' }));
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'x-claude-code-session-id': 'sess-new-9999' }, 'txy-key', dir);
+    assert.equal('x-troxy-tool-sandbox' in headers, false);
+  });
+});

package/src/tests/mcp-recall.test.js

@@ -0,0 +1,22 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { put } from '../sandbox/store.js';
+import { handleRecall } from '../mcp-server.js';
+
+test('troxy_recall returns the stored content for a valid handle', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const { handle } = await put('the full raw output', { summary: 'x', tags: [] }, dir);
+  const result = await handleRecall({ handle }, dir);
+  assert.equal(result.isError, false);
+  assert.equal(result.content[0].text, 'the full raw output');
+});
+
+test('troxy_recall returns a clear error for an unknown handle', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const result = await handleRecall({ handle: 'does-not-exist' }, dir);
+  assert.equal(result.isError, true);
+  assert.match(result.content[0].text, /not found/i);
+});

package/src/tests/model-checkpoint.test.js

@@ -242,10 +242,11 @@ test('no new tool was introduced for the chat path', () => {
   const toolsSeg = src.slice(src.indexOf('tools: ['), src.indexOf('server.setRequestHandler(CallToolRequestSchema'));
   const toolNames = [...toolsSeg.matchAll(/name: '([a-z_]+)'/g)].map(m => m[1]);
   const unique = new Set(toolNames);
-  // 9, not this test's original 8: evaluate_secrets was added afterward
-  // (2026-08-15, mcp-checkpoints.test.js) to close a real gap, not to give
-  // chat its own tool - the assertion this test cares about is still that no
-  // *tenth*, chat-specific tool exists.
-  assert.strictEqual(unique.size, 9, 'a tool was added or removed for this change');
+  // 10, not this test's original 8: evaluate_secrets was added afterward
+  // (2026-08-15, mcp-checkpoints.test.js) to close a real gap, and
+  // troxy_recall was added later still (tool-output-sandbox) to fetch back
+  // sandboxed output - neither gives chat its own tool. The assertion this
+  // test cares about is still that no *eleventh*, chat-specific tool exists.
+  assert.strictEqual(unique.size, 10, 'a tool was added or removed for this change');
   assert.ok(unique.has('evaluate_model') && unique.has('report_model_usage'));
 });

package/src/tests/posttooluse-hook.test.js

@@ -0,0 +1,225 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import { buildHookResponse } from '../sandbox/posttooluse-hook.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const troxyBin = path.join(__dirname, '..', '..', 'bin', 'troxy.js');
+
+function readState(dir) {
+  return JSON.parse(fs.readFileSync(path.join(dir, 'last-state.json'), 'utf8'));
+}
+
+// Real tool_response shapes, confirmed 2026-10-05 against this machine's own
+// ~/.claude/projects/*/*.jsonl transcripts - a prior version of this file
+// used an invented `{ tool_response: { output } }` shape that no real tool
+// result ever has, which is why 9 clean task reviews never caught that the
+// hook was a complete no-op in production. Bash is real tool_response's most
+// common shape by a wide margin (~20k of ~33k sampled real results).
+function bashResult(stdout) {
+  return { interrupted: false, isImage: false, noOutputExpected: false, stderr: '', stdout };
+}
+
+test('small Bash output passes through unmodified, no store write', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const response = await buildHookResponse(
+    { tool_response: bashResult('short') },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0, storeDir: dir });
+  assert.equal(response, undefined); // undefined = Claude Code keeps the real output
+});
+
+test('small output writes skipped state', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  await buildHookResponse(
+    { tool_response: bashResult('short') },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0, storeDir: dir });
+  assert.equal(readState(dir).state, 'skipped');
+});
+
+test('large Bash stdout gets replaced with a summary containing the real handle, other fields untouched', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'x'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: bashResult(big) },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  assert.equal(response.hookSpecificOutput.hookEventName, 'PostToolUse');
+  const updated = response.hookSpecificOutput.updatedToolOutput;
+  // Must be the full real tool_response shape, not a bare string - Claude
+  // Code validates updatedToolOutput against the tool's own output schema
+  // and silently reverts to the original output (plus a visible hook-error
+  // message) if the shape doesn't match.
+  assert.equal(typeof updated, 'object');
+  assert.equal(updated.stderr, ''); // untouched sibling field survives
+  assert.equal(updated.interrupted, false);
+  assert.ok(updated.stdout.length < big.length);
+  const index = JSON.parse(fs.readFileSync(path.join(dir, 'index.json'), 'utf8'));
+  const handle = index[0].handle;
+  assert.ok(handle, 'expected a handle to have been written to the store index');
+  assert.ok(updated.stdout.includes(handle),
+    'updatedToolOutput.stdout must embed the real recall handle, not just the word troxy_recall');
+});
+
+test('large Read file content gets replaced with a summary, nested under file.content', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'y'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: { type: 'text', file: { filePath: '/tmp/big.txt', content: big } } },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  const updated = response.hookSpecificOutput.updatedToolOutput;
+  assert.equal(updated.file.filePath, '/tmp/big.txt'); // untouched sibling field survives
+  assert.ok(updated.file.content.length < big.length);
+});
+
+test('large Write/create content gets replaced with a summary on the content field', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'z'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: { type: 'create', filePath: '/tmp/new.txt', content: big } },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  const updated = response.hookSpecificOutput.updatedToolOutput;
+  assert.equal(updated.filePath, '/tmp/new.txt');
+  assert.ok(updated.content.length < big.length);
+});
+
+test('a bare-string tool_response (MCP tools) is sandboxed and rebuilt as a plain string', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'w'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: big },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  assert.equal(typeof response.hookSpecificOutput.updatedToolOutput, 'string');
+  assert.ok(response.hookSpecificOutput.updatedToolOutput.length < big.length);
+});
+
+test('an unrecognized tool_response shape (e.g. Grep matches) is left untouched, not guessed at', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  // Grep's real shape - no stdout/content/file.content field this hook
+  // knows how to extract or rebuild safely, so it must pass through rather
+  // than risk a schema mismatch on a shape nobody verified.
+  const response = await buildHookResponse(
+    { tool_response: { matches: Array(500).fill('/some/long/path/to/a/file.js'), query: 'x' } },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  assert.equal(response, undefined);
+  assert.equal(readState(dir).state, 'skipped');
+});
+
+test('successful compression writes treated state', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'x'.repeat(3000);
+  await buildHookResponse(
+    { tool_response: bashResult(big) },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  assert.equal(readState(dir).state, 'treated');
+});
+
+test('excluded by sandboxFraction draw returns undefined and writes skipped state', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'x'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: bashResult(big) },
+    { sandboxFraction: 0, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  assert.equal(response, undefined);
+  assert.equal(readState(dir).state, 'skipped');
+});
+
+test('holdout draw skips compression even for large output, and records holdout state', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const big = 'x'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: bashResult(big) },
+    { sandboxFraction: 1, holdoutFraction: 1, randomFn: () => 0, storeDir: dir });
+  assert.equal(response, undefined);
+  assert.equal(readState(dir).state, 'holdout');
+});
+
+test('a thrown error during compression fails open to the real output', async () => {
+  const dir = '/nonexistent/path/that/cannot/be/created/\0bad';
+  const big = 'x'.repeat(3000);
+  const response = await buildHookResponse(
+    { tool_response: bashResult(big) },
+    { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+  assert.equal(response, undefined); // store write failed, fails open
+});
+
+test('a put() failure does not leave a stale treated state behind', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  // Seed a prior 'treated' state, then make the store directory unwritable so
+  // put() throws - the failure must overwrite this with 'skipped', not leave
+  // the stale 'treated' value looking like this turn succeeded.
+  fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'treated' }));
+  fs.chmodSync(dir, 0o500); // read+execute only, no write
+  const big = 'x'.repeat(3000);
+  try {
+    const response = await buildHookResponse(
+      { tool_response: bashResult(big) },
+      { sandboxFraction: 1, holdoutFraction: 0, randomFn: () => 0.5, storeDir: dir });
+    assert.equal(response, undefined);
+  } finally {
+    fs.chmodSync(dir, 0o700); // restore so the test runner can clean up the tmpdir
+  }
+  const state = readState(dir);
+  assert.notEqual(state.state, 'treated');
+  assert.equal(state.state, 'skipped');
+});
+
+test('bin/troxy.js posttooluse-hook dispatch: real CLI subprocess does not throw and produces sensible stdout', () => {
+  // Regression test for Finding 2: bin/troxy.js dynamically imports
+  // runPostToolUseHook and awaits it. Before the fix that export did not
+  // exist (only an unexported main()), so this threw
+  // "TypeError: runPostToolUseHook is not a function", was caught by
+  // bin/troxy.js's top-level try/catch, and exited 1 on every real hook
+  // invocation. Spawning the real CLI is the only way to catch that -
+  // calling buildHookResponse directly (as the tests above do) never
+  // touches bin/troxy.js's import at all.
+  const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-home-'));
+  try {
+    // Small output: deterministically below the sandboxing threshold regardless
+    // of the holdout coin flip, so this assertion can't flake. The point isn't
+    // exercising buildHookResponse's branches (covered above) - it's proving
+    // bin/troxy.js's dynamic import of runPostToolUseHook actually resolves
+    // and runs to completion through the real CLI entrypoint.
+    const stdout = execFileSync(
+      process.execPath,
+      [troxyBin, 'posttooluse-hook'],
+      {
+        input: JSON.stringify({ tool_response: bashResult('short') }),
+        env: { ...process.env, HOME: tmpHome },
+        encoding: 'utf8',
+      }
+    );
+    // Fail-open/skip path: no replacement needed, so no stdout is written.
+    assert.equal(stdout, '');
+  } finally {
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+  }
+});
+
+test('session arm is drawn once per session_id and sticks across tool calls', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-arm-'));
+  const big = { tool_response: { stdout: 'x'.repeat(5000) }, session_id: 'sess-aaaa-1111' };
+  // First call draws holdout (random 0 < 0.2).
+  const r1 = await buildHookResponse(big, { holdoutFraction: 0.2, randomFn: () => 0, storeDir: dir });
+  assert.equal(r1, undefined);
+  // Later draws would say treated, but the session stays holdout.
+  const r2 = await buildHookResponse(big, { holdoutFraction: 0.2, randomFn: () => 0.99, storeDir: dir });
+  assert.equal(r2, undefined);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(dir, 'sessions', 'sess-aaaa-1111.json'), 'utf8')).arm, 'holdout');
+
+  // A treated session compresses every big output, no per-call holdout draw.
+  const t = { ...big, session_id: 'sess-bbbb-2222' };
+  const t1 = await buildHookResponse(t, { holdoutFraction: 0.2, randomFn: () => 0.99, storeDir: dir });
+  assert.ok(t1?.hookSpecificOutput);
+  const t2 = await buildHookResponse(t, { holdoutFraction: 0.2, randomFn: () => 0, storeDir: dir });
+  assert.ok(t2?.hookSpecificOutput, 'treated session must not fall into a per-call holdout');
+});
+
+test('session_id with path characters is ignored (no file outside the store)', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-arm-'));
+  await buildHookResponse({ tool_response: { stdout: 'small' }, session_id: '../../etc/x' },
+    { holdoutFraction: 0.2, randomFn: () => 0, storeDir: dir });
+  assert.equal(fs.existsSync(path.join(dir, 'sessions')), false);
+});

package/src/tests/proxy-wiring.test.js

@@ -32,13 +32,13 @@ describe('reprovisionKeyConsumers: desktop detection gate', () => {
   });
 
   it('gates patchClaudeCodeHooks on (hasClaude || hasDesktop), not hasClaude alone', () => {
-    const hooksIdx = initSrc.indexOf('patchClaudeCodeHooks(claudeCodeSettingsPath())');
-    assert.ok(hooksIdx !== -1, 'patchClaudeCodeHooks call not found');
+    const hooksIdx = initSrc.indexOf('_patchClaudeCodeHooksFile(claudeCodeSettingsPath()');
+    assert.ok(hooksIdx !== -1, 'patchClaudeCodeHooks hook call not found');
     const preceding = initSrc.slice(Math.max(0, hooksIdx - 200), hooksIdx);
     assert.match(
       preceding,
       /if\s*\(hasClaude\s*\|\|\s*hasDesktop\)\s*\{/,
-      'the Stop/PreToolUse hook step must be gated on hasClaude || hasDesktop',
+      'the Stop/PreToolUse/PostToolUse hook step must be gated on hasClaude || hasDesktop',
     );
   });
 
@@ -100,9 +100,11 @@ describe('bin/troxy.js: proxy subcommand wiring', () => {
 
 describe('uninstall.js: settings.json symmetry (fail-open layer 6)', () => {
   it('calls all four unpatch functions', () => {
-    for (const fn of ['unpatchClaudeCodeConfig', 'unpatchClaudeCodeHooks', 'unpatchClaudeCodeProxy', 'unpatchClaudeCodeInterception']) {
+    for (const fn of ['unpatchClaudeCodeConfig', 'unpatchClaudeCodeProxy', 'unpatchClaudeCodeInterception']) {
       assert.ok(uninstallSrc.includes(`${fn}(`), `${fn} is not called from uninstall.js`);
     }
+    // unpatchClaudeCodeHooks is called via its file-based wrapper _unpatchClaudeCodeHooksFile
+    assert.ok(uninstallSrc.includes('_unpatchClaudeCodeHooksFile('), '_unpatchClaudeCodeHooksFile is not called from uninstall.js');
   });
 
   it('reverts settings.json BEFORE deleting ~/.troxy, not after', () => {

package/src/tests/sandbox-compress.test.js

@@ -0,0 +1,85 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { shouldSandbox, summarize } from '../sandbox/compress.js';
+
+test('shouldSandbox is false for small output', () => {
+  assert.equal(shouldSandbox('short output'), false);
+});
+
+test('shouldSandbox is true for output over 2000 chars', () => {
+  assert.equal(shouldSandbox('x'.repeat(2001)), true);
+});
+
+test('summarize keeps failing test lines verbatim', () => {
+  const output = Array.from({ length: 200 }, (_, i) => `test_${i} PASSED`).join('\n')
+    + '\ntest_login FAILED: AssertionError: expected 200, got 403'
+    + '\n' + Array.from({ length: 200 }, (_, i) => `test_${i + 200} PASSED`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /test_login FAILED: AssertionError: expected 200, got 403/);
+});
+
+test('summarize falls back to head+tail with a byte count for generic output', () => {
+  const output = Array.from({ length: 500 }, (_, i) => `line ${i}`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /line 0/);
+  assert.match(summary, /line 499/);
+  assert.match(summary, /use troxy_recall/);
+});
+
+test('summarize keeps a fused Python exception verbatim', () => {
+  const output = Array.from({ length: 200 }, (_, i) => `line ${i}`).join('\n')
+    + "\nValueError: invalid literal for int() with base 10: 'abc'"
+    + '\n' + Array.from({ length: 200 }, (_, i) => `line ${i + 200}`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /ValueError: invalid literal for int\(\) with base 10: 'abc'/);
+});
+
+test('summarize keeps Python traceback frame lines verbatim', () => {
+  const output = Array.from({ length: 200 }, (_, i) => `line ${i}`).join('\n')
+    + '\nTraceback (most recent call last):'
+    + '\n  File "/app/main.py", line 42, in <module>'
+    + '\nKeyError: \'missing_key\''
+    + '\n' + Array.from({ length: 200 }, (_, i) => `line ${i + 200}`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /File "\/app\/main\.py", line 42, in <module>/);
+  assert.match(summary, /KeyError: 'missing_key'/);
+});
+
+test('summarize keeps a jest-style failure verbatim', () => {
+  const output = Array.from({ length: 200 }, (_, i) => `line ${i}`).join('\n')
+    + '\nFAIL src/foo.test.js'
+    + '\n  ✕ adds two numbers (3 ms)'
+    + '\n' + Array.from({ length: 200 }, (_, i) => `line ${i + 200}`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /FAIL src\/foo\.test\.js/);
+  assert.match(summary, /✕ adds two numbers/);
+});
+
+test('summarize keeps a go-style failure verbatim', () => {
+  const output = Array.from({ length: 200 }, (_, i) => `line ${i}`).join('\n')
+    + '\n--- FAIL: TestForgottenIndex (0.00s)'
+    + '\n' + Array.from({ length: 200 }, (_, i) => `line ${i + 200}`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /--- FAIL: TestForgottenIndex \(0\.00s\)/);
+});
+
+test('summarize keeps a rust panic verbatim', () => {
+  const output = Array.from({ length: 200 }, (_, i) => `line ${i}`).join('\n')
+    + "\nthread 'main' panicked at 'index out of bounds', src/main.rs:5:4"
+    + '\n' + Array.from({ length: 200 }, (_, i) => `line ${i + 200}`).join('\n');
+  const summary = summarize(output);
+  assert.match(summary, /thread 'main' panicked at 'index out of bounds', src\/main\.rs:5:4/);
+});
+
+test('summarize falls back to character truncation for a single giant line', () => {
+  const output = 'x'.repeat(5000);
+  const summary = summarize(output);
+  assert.ok(summary.length < output.length, 'summary should be smaller than the original blob');
+  assert.match(summary, /use troxy_recall/);
+});
+
+test('summarize notes truncation when more than 20 signal lines match', () => {
+  const matching = Array.from({ length: 25 }, (_, i) => `Error: failure ${i}`).join('\n');
+  const summary = summarize(matching);
+  assert.match(summary, /showing 20 of 25 matching lines/);
+});

package/src/tests/sandbox-store.test.js

@@ -0,0 +1,86 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { spawn } from 'node:child_process';
+import { put, get, search, storeDir } from '../sandbox/store.js';
+
+test('put stores content and get retrieves it by handle', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const { handle } = await put('full raw output here', { summary: 'pytest: 40 passed', tags: ['pytest'] }, dir);
+  const content = await get(handle, dir);
+  assert.equal(content, 'full raw output here');
+});
+
+test('get returns null for an unknown handle', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const content = await get('does-not-exist', dir);
+  assert.equal(content, null);
+});
+
+test('search matches on summary substring, case-insensitive', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  await put('output a', { summary: 'pytest: 40 passed, 2 failed', tags: ['pytest'] }, dir);
+  await put('output b', { summary: 'docker build succeeded', tags: ['docker'] }, dir);
+  const hits = await search('FAILED', dir);
+  assert.equal(hits.length, 1);
+  assert.match(hits[0].summary, /2 failed/);
+});
+
+test('concurrent put calls do not corrupt the index', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  await Promise.all(Array.from({ length: 20 }, (_, i) =>
+    put(`content ${i}`, { summary: `entry ${i}`, tags: [] }, dir)));
+  const hits = await search('entry', dir);
+  assert.equal(hits.length, 5); // search caps at 5
+  const index = JSON.parse(fs.readFileSync(path.join(dir, 'index.json'), 'utf8'));
+  assert.equal(index.length, 20); // all 20 writes landed, none lost
+});
+
+test('concurrent put calls from separate OS processes do not corrupt the index', async () => {
+  // The single-process test above never truly interleaves (no await between
+  // sync fs calls on the uncontended path), and production load is real
+  // separate `node posttooluse-hook.js` processes, not concurrent async calls
+  // in one process. Spawn real child processes to exercise the actual lock.
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const workerDir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-worker-'));
+  const storeUrl = new URL('../sandbox/store.js', import.meta.url).href;
+  const workerPath = path.join(workerDir, 'worker.mjs');
+  const putsPerProcess = 5;
+  const numProcesses = 6;
+  fs.writeFileSync(workerPath, [
+    "import { put } from 'STORE_URL_PLACEHOLDER';",
+    'const [, , dir, prefix, countStr] = process.argv;',
+    'const count = Number(countStr);',
+    'for (let i = 0; i < count; i++) {',
+    "  await put('content ' + prefix + '-' + i, { summary: 'entry ' + prefix + '-' + i, tags: [] }, dir);",
+    '}',
+  ].join('\n').replace('STORE_URL_PLACEHOLDER', storeUrl));
+
+  const runWorker = (prefix) => new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [workerPath, dir, String(prefix), String(putsPerProcess)]);
+    let stderr = '';
+    child.stderr.on('data', (d) => { stderr += d; });
+    child.on('exit', (code) => (code === 0 ? resolve() : reject(new Error(`worker ${prefix} exited ${code}: ${stderr}`))));
+  });
+
+  await Promise.all(Array.from({ length: numProcesses }, (_, i) => runWorker(i)));
+
+  const index = JSON.parse(fs.readFileSync(path.join(dir, 'index.json'), 'utf8'));
+  assert.equal(index.length, numProcesses * putsPerProcess); // every write from every process landed
+  assert.equal(new Set(index.map((e) => e.summary)).size, numProcesses * putsPerProcess); // none lost or overwritten
+});
+
+test('get rejects a path-traversal handle instead of reading outside the store dir', async () => {
+  // handle is agent-controlled (troxy_recall's argument comes from the
+  // model) - a prompt-injected tool call could otherwise pass
+  // "../../../etc/passwd"-style handles and read arbitrary files.
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+  const secretDir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-secret-'));
+  fs.writeFileSync(path.join(secretDir, 'secret.txt'), 'SECRET-CONTENTS');
+  const traversal = path.relative(dir, path.join(secretDir, 'secret')); // "../troxy-secret-xxx/secret"
+  assert.equal(await get(traversal, dir), null);
+  assert.equal(await get('../etc/passwd', dir), null);
+  assert.equal(await get('not-16-hex-chars', dir), null);
+});

package/src/uninstall.js

@@ -7,7 +7,7 @@ import { loadConfig } from './config.js';
 import { api }        from './api.js';
 import {
   claudeCodeConfigPath, claudeCodeSettingsPath,
-  unpatchClaudeCodeConfig, unpatchClaudeCodeHooks,
+  unpatchClaudeCodeConfig, _unpatchClaudeCodeHooksFile,
   unpatchClaudeCodeProxy, unpatchClaudeCodeInterception,
 } from './init.js';
 import { launchdUserDomain } from './launchd.js';
@@ -144,7 +144,7 @@ export async function runUninstall() {
   process.stdout.write('  Reverting Claude Code settings...  ');
   try {
     unpatchClaudeCodeConfig(claudeCodeConfigPath());
-    unpatchClaudeCodeHooks(claudeCodeSettingsPath());
+    _unpatchClaudeCodeHooksFile(claudeCodeSettingsPath());
     unpatchClaudeCodeProxy(claudeCodeSettingsPath());
     unpatchClaudeCodeInterception(claudeCodeSettingsPath());
     console.log('✓');