troxy-cli 1.29.24 → 1.29.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.24",
+  "version": "1.29.25",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/interceptor.js

@@ -33,6 +33,7 @@ import https from 'node:https';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { sessionArmPath } from './sandbox/posttooluse-hook.js';
 
 // Found live 2026-09-08, first real terminal validation of this whole
 // mechanism: a real `claude` process opens a burst of ~15 concurrent
@@ -119,6 +120,21 @@ function _readFreshSandboxState(sandboxStateDir) {
   }
 }
 
+// The session's A/B arm written by the PostToolUse hook, keyed by the
+// X-Claude-Code-Session-Id header Claude Code sends on every API request.
+// A session property, so no freshness window. null when the header is
+// missing/invalid or the session hasn't run a tool yet.
+function _readSessionArm(sandboxStateDir, sessionId) {
+  try {
+    const file = sessionArmPath(sandboxStateDir, sessionId);
+    if (!file) return null;
+    const arm = JSON.parse(fs.readFileSync(file, 'utf8')).arm;
+    return arm === 'treated' || arm === 'holdout' ? arm : null;
+  } catch {
+    return null;
+  }
+}
+
 export function buildTroxyForwardHeaders(incomingHeaders, troxyKey, sandboxStateDir = _DEFAULT_SANDBOX_STATE_DIR) {
   const headers = {};
   for (const [k, v] of Object.entries(incomingHeaders)) {
@@ -130,7 +146,13 @@ export function buildTroxyForwardHeaders(incomingHeaders, troxyKey, sandboxState
   }
   const surface = detectSurface(incomingHeaders);
   if (surface) headers['x-troxy-surface'] = surface;
-  const sandboxState = _readFreshSandboxState(sandboxStateDir);
+  // With a session header, only that session's own arm counts (a session
+  // with no tool call yet stays untagged rather than borrowing another
+  // session's state). Legacy shared last-state only when there's no header.
+  const sessionFile = sessionArmPath(sandboxStateDir, incomingHeaders['x-claude-code-session-id']);
+  const sandboxState = sessionFile
+    ? _readSessionArm(sandboxStateDir, incomingHeaders['x-claude-code-session-id'])
+    : _readFreshSandboxState(sandboxStateDir);
   if (sandboxState) headers['x-troxy-tool-sandbox'] = sandboxState;
   headers.authorization = `Bearer ${troxyKey}`;
   return headers;

package/src/sandbox/posttooluse-hook.js

@@ -6,6 +6,38 @@ import { put, storeDir as defaultStoreDir } from './store.js';
 
 const STDIN_TIMEOUT_MS = 2000;
 
+// Per-session A/B arm. The measurement compares whole sessions, so the
+// holdout draw happens once per Claude Code session_id, not per tool call:
+// a per-call draw leaves both arms with near-identical context (every
+// "holdout" request still carries earlier compressed outputs), which
+// measures ~0 whatever the real effect is. The interceptor reads this same
+// file by the X-Claude-Code-Session-Id request header to tag each request
+// with its own session's arm.
+// ponytail: one tiny file per session, never pruned; add cleanup if ~/.troxy/sandbox/sessions gets large.
+const SESSION_ID_RE = /^[A-Za-z0-9-]{8,128}$/;
+
+export function sessionArmPath(dir, sessionId) {
+  if (typeof sessionId !== 'string' || !SESSION_ID_RE.test(sessionId)) return null;
+  return path.join(dir, 'sessions', `${sessionId}.json`);
+}
+
+function sessionArm(dir, sessionId, holdoutFraction, randomFn) {
+  const file = sessionArmPath(dir, sessionId);
+  if (!file) return null;
+  try {
+    const arm = JSON.parse(fs.readFileSync(file, 'utf8')).arm;
+    if (arm === 'treated' || arm === 'holdout') return arm;
+  } catch { /* first tool call of this session, or unreadable: draw below */ }
+  const arm = randomFn() < holdoutFraction ? 'holdout' : 'treated';
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ arm }));
+  } catch {
+    return null; // can't persist the arm, so fall back to the per-call path
+  }
+  return arm;
+}
+
 function writeState(dir, state) {
   try {
     fs.mkdirSync(dir, { recursive: true });
@@ -59,17 +91,23 @@ export async function buildHookResponse(toolUseBlock, {
   storeDir = defaultStoreDir(),
 } = {}) {
   const toolResponse = toolUseBlock?.tool_response;
+  const arm = sessionArm(storeDir, toolUseBlock?.session_id, holdoutFraction, randomFn);
+  if (arm === 'holdout') {
+    writeState(storeDir, 'holdout');
+    return undefined;
+  }
   const output = extractText(toolResponse);
   if (output === null || !shouldSandbox(output)) {
     writeState(storeDir, 'skipped');
     return undefined;
   }
 
-  if (randomFn() < sandboxFraction && randomFn() < holdoutFraction) {
+  // No session arm (hook input without session_id): legacy per-call draw.
+  if (!arm && randomFn() < sandboxFraction && randomFn() < holdoutFraction) {
     writeState(storeDir, 'holdout');
     return undefined;
   }
-  if (randomFn() >= sandboxFraction) {
+  if (!arm && randomFn() >= sandboxFraction) {
     writeState(storeDir, 'skipped');
     return undefined;
   }

package/src/tests/interceptor.test.js

@@ -653,3 +653,23 @@ describe('createInterceptor - integration, real sockets', () => {
     assert.equal(result.body, 'tunneled-because-cert-unhealthy');
   });
 });
+
+describe('buildTroxyForwardHeaders session arm', () => {
+  it('tags a request with its own session arm, ignoring another session\'s last-state', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    fs.mkdirSync(path.join(dir, 'sessions'));
+    fs.writeFileSync(path.join(dir, 'sessions', 'sess-aaaa-1111.json'), JSON.stringify({ arm: 'holdout' }));
+    fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'treated' }));
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'x-claude-code-session-id': 'sess-aaaa-1111' }, 'txy-key', dir);
+    assert.equal(headers['x-troxy-tool-sandbox'], 'holdout');
+  });
+
+  it('leaves a session with no arm yet untagged, never borrowing another session\'s last-state', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-sandbox-'));
+    fs.writeFileSync(path.join(dir, 'last-state.json'), JSON.stringify({ state: 'treated' }));
+    const headers = buildTroxyForwardHeaders(
+      { host: 'api.anthropic.com', 'x-claude-code-session-id': 'sess-new-9999' }, 'txy-key', dir);
+    assert.equal('x-troxy-tool-sandbox' in headers, false);
+  });
+});

package/src/tests/posttooluse-hook.test.js

@@ -197,3 +197,29 @@ test('bin/troxy.js posttooluse-hook dispatch: real CLI subprocess does not throw
     fs.rmSync(tmpHome, { recursive: true, force: true });
   }
 });
+
+test('session arm is drawn once per session_id and sticks across tool calls', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-arm-'));
+  const big = { tool_response: { stdout: 'x'.repeat(5000) }, session_id: 'sess-aaaa-1111' };
+  // First call draws holdout (random 0 < 0.2).
+  const r1 = await buildHookResponse(big, { holdoutFraction: 0.2, randomFn: () => 0, storeDir: dir });
+  assert.equal(r1, undefined);
+  // Later draws would say treated, but the session stays holdout.
+  const r2 = await buildHookResponse(big, { holdoutFraction: 0.2, randomFn: () => 0.99, storeDir: dir });
+  assert.equal(r2, undefined);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(dir, 'sessions', 'sess-aaaa-1111.json'), 'utf8')).arm, 'holdout');
+
+  // A treated session compresses every big output, no per-call holdout draw.
+  const t = { ...big, session_id: 'sess-bbbb-2222' };
+  const t1 = await buildHookResponse(t, { holdoutFraction: 0.2, randomFn: () => 0.99, storeDir: dir });
+  assert.ok(t1?.hookSpecificOutput);
+  const t2 = await buildHookResponse(t, { holdoutFraction: 0.2, randomFn: () => 0, storeDir: dir });
+  assert.ok(t2?.hookSpecificOutput, 'treated session must not fall into a per-call holdout');
+});
+
+test('session_id with path characters is ignored (no file outside the store)', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-arm-'));
+  await buildHookResponse({ tool_response: { stdout: 'small' }, session_id: '../../etc/x' },
+    { holdoutFraction: 0.2, randomFn: () => 0, storeDir: dir });
+  assert.equal(fs.existsSync(path.join(dir, 'sessions')), false);
+});