troxy-cli 1.29.3 → 1.29.4

package/bin/troxy.js

@@ -115,6 +115,19 @@ switch (command) {
     await runUninstall();
     break;
 
+  // ── Live Model Policy Enforcement interception (Layer 3, experimental) ─
+  // Not yet part of `troxy init` or the default help banner below - see
+  // proxy.js's own top-of-file note and the plan doc's rollout order for
+  // why this is deliberately opt-in-only and manually run for now.
+  case 'proxy': {
+    const { runProxyStatus, runProxyEnable, runProxyDisable } = await import('../src/proxy.js');
+    if (sub === 'enable') { await runProxyEnable(flags); break; }
+    if (sub === 'disable') { runProxyDisable(); break; }
+    if (sub === 'status' || !sub) { await runProxyStatus(); break; }
+    console.error(`  Unknown: troxy proxy ${sub}. Try: status, enable, disable\n`);
+    process.exit(1);
+  }
+
   // ── Auth ──────────────────────────────────────────────────────
   case 'login':
     await runLogin(flags);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.3",
+  "version": "1.29.4",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {
@@ -14,7 +14,8 @@
     "test": "node --test src/tests/*.test.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.10.2"
+    "@modelcontextprotocol/sdk": "^1.10.2",
+    "node-forge": "^1.4.0"
   },
   "engines": {
     "node": ">=18"

package/src/daemon.js

@@ -1,16 +1,125 @@
 /**
- * Troxy heartbeat daemon.
+ * Troxy background daemon.
  * Runs as a background service (systemd / launchd). Sends a heartbeat to the
  * Troxy API every 60 seconds so the dashboard shows this agent as connected.
- * Does NOT start an MCP stdio server — that only makes sense when an MCP client
- * (Claude Desktop, Cursor, etc.) is present.
+ * Does NOT start an MCP stdio server - that only makes sense when an MCP
+ * client (Claude Desktop, Cursor, etc.) is present.
+ *
+ * As of Layer 2 of the Live Model Policy Enforcement plan, also hosts the
+ * local interceptor (interceptor.js) - the TLS-terminating proxy that lets
+ * the Claude Desktop app's Code tab route through Troxy the same way
+ * terminal `claude` already does via ANTHROPIC_BASE_URL. This lives here,
+ * not as a separate process, specifically so it inherits the supervision
+ * this daemon already has (launchd KeepAlive / systemd Restart=always) -
+ * see the plan doc's architecture section for why a fully local, always-
+ * supervised interceptor is the only design that can actually fail open
+ * when Troxy's own service has downtime.
  */
+import os from 'node:os';
+import path from 'node:path';
+import { format } from 'node:util';
 import { loadConfig } from './config.js';
 import { api } from './api.js';
+import { createInterceptor } from './interceptor.js';
+import { enabledProviders, interceptHostsFor, troxyRouteFor } from './providers.js';
+import { ensureInterceptionCerts } from './tls-ca.js';
 
 const INTERVAL_MS = 60_000;
 
+// Fixed, not dynamically chosen - so settings.json's HTTPS_PROXY value
+// stays valid across daemon restarts instead of needing to be rewritten
+// every time. If this port is ever unavailable, the interceptor simply
+// does not start (see startInterceptor's listen 'error' handler) rather
+// than silently picking a different one and leaving settings.json wrong.
+export const INTERCEPTOR_PORT = 48173;
+
+// Re-checked once a day, not on a timer that matters much - ensureInterceptionCerts
+// is idempotent when the existing CA/leaf are still healthy, so this is a
+// cheap no-op almost every time it fires; it only does real work on the
+// leaf's ~30-day renewal window or if something on disk got corrupted.
+const CERT_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+function _log(fmt, ...args) {
+  process.stderr.write(`[troxy-interceptor] ${format(fmt, ...args)}\n`);
+}
+
+/**
+ * Starts the local interceptor, if any provider is enabled (Phase 1: just
+ * 'anthropic'). Never throws - a failure here (bad cert generation, the
+ * port already being held by something else) is logged and the daemon
+ * keeps running its heartbeat regardless; interception is additive, never
+ * a requirement for the rest of what this daemon does.
+ *
+ * `troxyDir` defaults to the real ~/.troxy but is injectable, matching
+ * ensureInterceptionCerts's own pattern - lets a test exercise this
+ * without touching whatever the real machine running the test has there.
+ * `port` defaults to INTERCEPTOR_PORT, injectable so a test doesn't
+ * collide with a real daemon that might already be running on this
+ * machine.
+ */
+export function startInterceptor({ troxyDir = path.join(os.homedir(), '.troxy'), port = INTERCEPTOR_PORT } = {}) {
+  const providers = enabledProviders();
+  const interceptHosts = interceptHostsFor(providers);
+  if (interceptHosts.length === 0) return null;
+
+  let certs = null;
+
+  function refreshCerts() {
+    try {
+      const result = ensureInterceptionCerts(troxyDir, {
+        hostname: os.hostname(),
+        leafDnsNames: interceptHosts,
+      });
+      certs = { leafCertPem: result.leafCertPem, leafKeyPem: result.leafKeyPem };
+    } catch (err) {
+      _log('failed to generate interception certificates, tunneling only until this resolves: %s', err.message);
+      certs = null;
+    }
+  }
+  refreshCerts();
+  const refreshTimer = setInterval(refreshCerts, CERT_REFRESH_INTERVAL_MS);
+  refreshTimer.unref(); // must not keep the process alive on its own
+
+  const interceptor = createInterceptor({
+    interceptHosts,
+    routeResolver: (host, method, reqPath) => troxyRouteFor(providers, host, method, reqPath),
+    // Fresh from disk on every request, not cached at startup - a
+    // `troxy rotate-key` takes effect immediately, no daemon restart needed.
+    getTroxyKey: () => loadConfig()?.apiKey || null,
+    getCerts: () => certs,
+    log: _log,
+  });
+
+  interceptor.on('error', (err) => {
+    if (err.code === 'EADDRINUSE') {
+      _log('port %d is already in use by something else - interception is disabled this run. ' +
+           'Run `troxy proxy status` to check, or `troxy proxy disable` if this persists.', port);
+    } else {
+      _log('server error (interception disabled this run): %s', err.message);
+    }
+  });
+
+  interceptor.listen(port, '127.0.0.1', () => {
+    _log('listening on 127.0.0.1:%d for %s', port, interceptHosts.join(', '));
+  });
+
+  return interceptor;
+}
+
 export async function runDaemon() {
+  // Installed first, before anything else in this process can throw - a
+  // bug anywhere here (the heartbeat, cert generation, a single bad TLS
+  // handshake) must never take the whole daemon down. The interceptor's
+  // listener dying silently is exactly what broke Claude Code outright
+  // during this feature's own manual testing - log and keep running,
+  // never exit.
+  process.on('uncaughtException', (err) => {
+    process.stderr.write(`[troxy-daemon] uncaught exception (continuing): ${err.stack || err.message}\n`);
+  });
+  process.on('unhandledRejection', (err) => {
+    process.stderr.write(`[troxy-daemon] unhandled rejection (continuing): ${err?.stack || err}\n`);
+  });
+
   const cfg = loadConfig();
   if (!cfg?.apiKey) {
     process.stderr.write('[troxy-daemon] No API key found. Run troxy init first.\n');
@@ -19,6 +128,10 @@ export async function runDaemon() {
 
   const { apiKey, agentName } = cfg;
 
+  // Bound before the first heartbeat - a network hiccup reaching the Troxy
+  // API on startup must never leave the interceptor's port unbound.
+  startInterceptor();
+
   // `force` pushes the config name as the authoritative display name. We only
   // do this on the FIRST beat after (re)start, so a `troxy restart` overrides
   // the dashboard, while regular beats never clobber a dashboard rename.

package/src/init.js

@@ -5,6 +5,10 @@ import readline       from 'readline';
 import { execSync, execFileSync } from 'child_process';
 import { saveConfig } from './config.js';
 import { evaluatePayment, api } from './api.js';
+import { INTERCEPTOR_PORT } from './daemon.js';
+import { ensureInterceptionCerts } from './tls-ca.js';
+import { enabledProviders, interceptHostsFor } from './providers.js';
+import { probePort } from './proxy.js';
 
 // Re-point every consumer of the API key (MCP client configs, the background service /
 // systemd env file / launchd plist, OpenClaw) at `key`. Shared by runInit and rotate-key
@@ -87,6 +91,15 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
         console.log(`    • OpenClaw  ✗  (${err.message})`);
       }
     }
+    // Claude Desktop's Code tab runs the same Claude Code engine under the
+    // hood and reads the same global ~/.claude/settings.json - it just has
+    // no CLI on PATH for hasClaudeCode()'s probe to find, and (unlike
+    // terminal `claude`) no project-scoped ~/.claude.json entry to patch.
+    // Before this fix, a desktop-only machine (no terminal `claude` on PATH
+    // at all) got ZERO settings.json writes: not even the pre-existing
+    // Stop/PreToolUse hook capture, let alone anything interception-related.
+    // See the plan doc's Layer 3 section ("the detection gap to fix").
+    const hasDesktop = hasClaudeDesktop();
     if (hasClaude) {
       try {
         patchClaudeCodeConfig(claudeCodeConfigPath(), key);
@@ -94,13 +107,28 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
       } catch (err) {
         console.log(`    • Claude Code  ✗  (${err.message})`);
       }
+    }
+    if (hasClaude || hasDesktop) {
       try {
         patchClaudeCodeHooks(claudeCodeSettingsPath());
         console.log(`    • Claude Code usage capture (all projects)  ✓`);
       } catch (err) {
         console.log(`    • Claude Code usage capture  ✗  (${err.message})`);
       }
-      await maybeEnableClaudeCodeProxy(proxyOptIn, key);
+    }
+    if (hasClaude) {
+      // Terminal used to get base-URL substitution (maybeEnableClaudeCodeProxy)
+      // here - found live 2026-09-07 that it silently bills the org's own
+      // pay-as-you-go API key for every terminal call, since substituting
+      // ANTHROPIC_AUTH_TOKEN with a Troxy token means no real Anthropic
+      // credential ever reaches model-proxy. This now reuses the same
+      // interception mechanism already live for Desktop (see
+      // patchClaudeCodeInterception below) instead: terminal keeps its own
+      // real login, Troxy watches the traffic on its way to Anthropic.
+      // Desktop-only machines are unaffected by this call (hasDesktop is
+      // not part of the gate here) - they still use the existing manual
+      // `troxy proxy enable --experimental` path.
+      await maybeEnableTroxyInterception(proxyOptIn, hasDesktop);
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -320,6 +348,28 @@ export async function runInit({ key, name, proxy } = {}) {
   console.log('\n  For more information, visit https://docs.troxy.io\n');
 }
 
+// Found live 2026-09-08: `which troxy` failing silently fell back to a
+// guessed path, `/usr/local/bin/troxy`, that may not exist on this machine
+// at all. Nothing downstream ever checked - the plist/unit file got written
+// and loaded pointing at a binary that isn't there, and installService still
+// returned normally, so init printed "Background service installed ✓" for a
+// service that could never actually start. The specific incident that
+// surfaced this was a dev-only setup (this repo living under a TCC-
+// protected folder, see troxy-hq/CLAUDE.md) - but `which troxy` reliably
+// fails for real end users too, every time someone runs `npx troxy-cli
+// init` (README's own documented install path): npx never puts the binary
+// on PATH, so this is the common case for that install method, not an edge
+// case. The error message below leads with the fix that actually applies to
+// them.
+export function verifyTroxyBinExists(troxy) {
+  if (!fs.existsSync(troxy)) {
+    throw new Error(
+      `resolved troxy binary not found at ${troxy} - run "npm install -g troxy-cli" ` +
+      '(or "npm link" from a local checkout) so "which troxy" resolves correctly, then re-run init',
+    );
+  }
+}
+
 function installService(apiKey, agentName) {
   const platform = process.platform;
   let troxy;
@@ -328,8 +378,12 @@ function installService(apiKey, agentName) {
   } catch {
     troxy = '/usr/local/bin/troxy';
   }
+  verifyTroxyBinExists(troxy);
 
   if (platform === 'linux') {
+    // No StandardOutPath/StandardErrorPath equivalent needed here (unlike the
+    // darwin branch below) - systemd captures a service's stdout/stderr into
+    // the journal automatically; `journalctl -u troxy-mcp` is the log.
     // The API key lives in a separate root-owned, 600-permission file loaded via
     // EnvironmentFile= — unit files under /etc/systemd/system are world-readable
     // (mode 644), so putting the key directly in `Environment=` there would leak
@@ -362,6 +416,19 @@ WantedBy=multi-user.target
     execSync('sudo systemctl restart troxy-mcp');
 
   } else if (platform === 'darwin') {
+    // Found live 2026-09-08: with no StandardOutPath/StandardErrorPath, a
+    // daemon that fails to start under launchd (e.g. the TCC-protected-folder
+    // EPERM bug documented in troxy-hq/CLAUDE.md) fails completely silently -
+    // no log anywhere says why. These two keys are launchd's only mechanism
+    // for capturing a job's stdout/stderr (there is no journald equivalent on
+    // macOS); the log directory is created below, before the plist is loaded,
+    // since launchd creates the log *file* on first output but not a missing
+    // parent directory.
+    const troxyDir = path.join(os.homedir(), '.troxy');
+    const stdoutLogPath = path.join(troxyDir, 'daemon-out.log');
+    const stderrLogPath = path.join(troxyDir, 'daemon-err.log');
+    fs.mkdirSync(troxyDir, { recursive: true });
+
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -382,6 +449,10 @@ WantedBy=multi-user.target
     <key>PATH</key>
     <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
   </dict>
+  <key>StandardOutPath</key>
+  <string>${stdoutLogPath}</string>
+  <key>StandardErrorPath</key>
+  <string>${stderrLogPath}</string>
   <key>RunAtLoad</key>
   <true/>
   <key>KeepAlive</key>
@@ -466,10 +537,27 @@ function patchContinueConfig(configPath, apiKey) {
 // asking the agent to also report chat-only turns would double-count against
 // the hook's real capture of the same turns. Tool-use self-report is left
 // alone; the hook does not replace that, only chat-only reporting.
-function claudeCodeConfigPath() {
+export function claudeCodeConfigPath() {
   return path.join(os.homedir(), '.claude.json');
 }
 
+// checklist item: uninstall symmetry. Removes the troxy mcpServers entry
+// from EVERY project in ~/.claude.json, not just process.cwd() - a machine
+// may have run `troxy init` from several project directories over time,
+// each getting its own entry (patchClaudeCodeConfig is keyed by cwd), and
+// uninstall has no reliable way to know which cwd(s) were used, so it
+// simply scans every project this file knows about.
+export function unpatchClaudeCodeConfig(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (config.projects) {
+    for (const proj of Object.values(config.projects)) {
+      if (proj?.mcpServers?.troxy) delete proj.mcpServers.troxy;
+    }
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
 // configPath and cwd are explicit params, same shape as patchMcpConfig /
 // patchZedConfig above, so this can be pointed at a temp file and a fake
 // project directory in tests rather than always touching the real
@@ -496,7 +584,7 @@ export function patchClaudeCodeConfig(configPath, apiKey, cwd = process.cwd()) {
 // and replacing it in place, rather than blind-pushing - a second `troxy
 // init` must not duplicate the entry, and any of the user's OWN unrelated
 // Stop hooks in the same file must survive untouched.
-function claudeCodeSettingsPath() {
+export function claudeCodeSettingsPath() {
   return path.join(os.homedir(), '.claude', 'settings.json');
 }
 
@@ -523,6 +611,17 @@ export function troxyPreToolUseCommand() {
   return `${_resolveTroxyBin()} pretooluse-hook`;
 }
 
+// Shared by patchClaudeCodeHooks and unpatchClaudeCodeHooks, so "what counts
+// as a Troxy-owned hook entry" has exactly one definition.
+function _isTroxyStopEntry(matcherEntry) {
+  return Array.isArray(matcherEntry?.hooks) &&
+    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('hook-report'));
+}
+function _isTroxyPreToolUseEntry(matcherEntry) {
+  return Array.isArray(matcherEntry?.hooks) &&
+    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('pretooluse-hook'));
+}
+
 export function patchClaudeCodeHooks(
   configPath,
   stopCommand = troxyHookCommand(),
@@ -533,11 +632,8 @@ export function patchClaudeCodeHooks(
   if (!config.hooks) config.hooks = {};
 
   if (!Array.isArray(config.hooks.Stop)) config.hooks.Stop = [];
-  const isTroxyStopEntry = (matcherEntry) =>
-    Array.isArray(matcherEntry?.hooks) &&
-    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('hook-report'));
   const stopEntry = { hooks: [{ type: 'command', command: stopCommand }] };
-  const stopIdx = config.hooks.Stop.findIndex(isTroxyStopEntry);
+  const stopIdx = config.hooks.Stop.findIndex(_isTroxyStopEntry);
   if (stopIdx >= 0) config.hooks.Stop[stopIdx] = stopEntry;
   else config.hooks.Stop.push(stopEntry);
 
@@ -549,11 +645,8 @@ export function patchClaudeCodeHooks(
   // Claude Code cancels the hook and lets the tool proceed once this
   // elapses (its documented behavior for a timed-out PreToolUse hook).
   if (!Array.isArray(config.hooks.PreToolUse)) config.hooks.PreToolUse = [];
-  const isTroxyPreToolUseEntry = (matcherEntry) =>
-    Array.isArray(matcherEntry?.hooks) &&
-    matcherEntry.hooks.some(h => typeof h?.command === 'string' && h.command.includes('pretooluse-hook'));
   const preToolUseEntry = { matcher: '*', hooks: [{ type: 'command', command: preToolUseCommand, timeout: 5 }] };
-  const preIdx = config.hooks.PreToolUse.findIndex(isTroxyPreToolUseEntry);
+  const preIdx = config.hooks.PreToolUse.findIndex(_isTroxyPreToolUseEntry);
   if (preIdx >= 0) config.hooks.PreToolUse[preIdx] = preToolUseEntry;
   else config.hooks.PreToolUse.push(preToolUseEntry);
 
@@ -561,6 +654,21 @@ export function patchClaudeCodeHooks(
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
 }
 
+// Uninstall symmetry (fail-open layer 6 in the plan doc): removes exactly
+// the Troxy-owned Stop/PreToolUse entries, leaving any of the user's own
+// unrelated hooks in the same file untouched.
+export function unpatchClaudeCodeHooks(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (Array.isArray(config.hooks?.Stop)) {
+    config.hooks.Stop = config.hooks.Stop.filter(e => !_isTroxyStopEntry(e));
+  }
+  if (Array.isArray(config.hooks?.PreToolUse)) {
+    config.hooks.PreToolUse = config.hooks.PreToolUse.filter(e => !_isTroxyPreToolUseEntry(e));
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
 // checklist #17 ("one-command proxy setup") - routes Claude Code's model
 // calls through Troxy's model-proxy instead of straight to Anthropic, so
 // evaluate_model's advisory model-swap suggestions become real, enforced
@@ -606,30 +714,91 @@ export function patchClaudeCodeProxy(configPath, troxyKey, baseUrl = troxyModelP
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
 }
 
-// Opt-in only (Gilad, 2026-08-29): the Remote Control tradeoff is real and
-// user-visible, so this must be a deliberate yes, never a default-on
-// behavior change slipped into an ordinary init run.
-//   proxyOptIn === true  -> --proxy was passed explicitly, enable without asking
-//   proxyOptIn === null  -> not passed; ask interactively if there's a TTY,
-//                           otherwise skip (a scripted/CI init must never hang
-//                           on a prompt, and silence must never mean yes)
-async function maybeEnableClaudeCodeProxy(proxyOptIn, key) {
+// Uninstall symmetry (fail-open layer 6): removes exactly the three keys
+// patchClaudeCodeProxy writes, leaving any other env keys (the user's own,
+// or the interception keys below) untouched.
+export function unpatchClaudeCodeProxy(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (config.env) {
+    delete config.env.ANTHROPIC_BASE_URL;
+    delete config.env.ANTHROPIC_AUTH_TOKEN;
+    delete config.env.ENABLE_TOOL_SEARCH;
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// Auto-migration for the terminal-interception-passthrough fix
+// (2026-09-08): a machine that already ran `troxy init --proxy` has
+// ANTHROPIC_AUTH_TOKEN set to a Troxy token instead of a real Anthropic
+// credential, which is why model-proxy had to fall back to the org's own
+// pay-as-you-go API key to pay for terminal calls at all - confirmed live
+// 2026-09-07, a single terminal message visibly moved the org's Console
+// API balance instead of the user's Claude subscription usage. Called
+// unconditionally by maybeEnableTroxyInterception (below), regardless of
+// whether the user then opts into interception - leaving these keys in
+// place is strictly worse than falling back to no Troxy visibility for
+// terminal at all.
+export function migrateBaseUrlProxyToInterception(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return false; }
+  const env = config.env || {};
+  const isTroxyOwned =
+    env.ANTHROPIC_BASE_URL === troxyModelProxyBaseUrl() ||
+    String(env.ANTHROPIC_AUTH_TOKEN || '').startsWith('txy-');
+  if (!isTroxyOwned) return false;
+  unpatchClaudeCodeProxy(configPath);
+  return true;
+}
+
+// Terminal's counterpart to the desktop app's already-shipped
+// interception path. See the call site above for why terminal moved off
+// base-URL substitution. Same proxyOptIn semantics as the retired
+// maybeEnableClaudeCodeProxy: true = enable without asking, null + TTY =
+// ask interactively, otherwise skip (a scripted/CI init must never hang
+// on a prompt).
+async function maybeEnableTroxyInterception(proxyOptIn, hasDesktop, configPath = claudeCodeSettingsPath()) {
+  // Unconditional, regardless of what's decided below: a machine still on
+  // the old base-URL substitution keys is actively mischarging the org's
+  // API balance right now, and leaving that in place is strictly worse
+  // than falling back to no Troxy visibility for terminal at all.
+  const migrated = migrateBaseUrlProxyToInterception(configPath);
+  if (migrated) {
+    console.log('    • Removed the old Troxy proxy setup for terminal (was billing your org\'s API key instead of your subscription)');
+  }
+
+  if (interceptionIsConfigured(configPath)) return; // already set up correctly, nothing to ask
+
   let enable = proxyOptIn === true;
   if (proxyOptIn === null && process.stdin.isTTY) {
     console.log("\n  Route Claude Code's model calls through Troxy for automatic cost");
-    console.log('  optimization? Troxy can swap in a cheaper model when it finds an');
-    console.log('  opportunity, not just suggest one.');
-    console.log("  Trade-off: while this is on, Claude Code's Remote Control feature is");
-    console.log('  disabled (Anthropic disables it whenever the API base URL points');
-    console.log('  anywhere other than api.anthropic.com). Model policies (e.g. a BLOCK');
-    console.log('  rule on a specific model) ARE enforced on this path.');
+    console.log('  optimization? Your normal Claude login (subscription or API key) still');
+    console.log('  pays - Troxy never substitutes its own credential. Troxy does see your');
+    console.log('  real credential in transit, forwarded upstream to actually make the');
+    console.log('  call to Anthropic on your behalf.');
+    console.log('  How: Troxy generates a certificate authority ON THIS MACHINE');
+    console.log('  (~/.troxy/tls/). The private key never leaves this computer and is');
+    console.log('  never sent to Troxy. It is locked to api.anthropic.com only and is');
+    console.log('  NOT installed in your system keychain, only referenced by Claude Code.');
+    if (hasDesktop) {
+      console.log('  This also covers the Claude desktop app\'s Code tab (same setting).');
+    }
+    console.log('  Remove any time with: troxy proxy disable');
     const answer = await prompt('  Enable? (y/N): ');
     enable = /^y(es)?$/i.test(answer);
   }
   if (!enable) return;
+
   try {
-    patchClaudeCodeProxy(claudeCodeSettingsPath(), key);
+    const troxyDir = path.join(os.homedir(), '.troxy');
+    ensureInterceptionCerts(troxyDir, { hostname: os.hostname(), leafDnsNames: interceptHostsFor(enabledProviders()) });
+    patchClaudeCodeInterception(configPath);
     console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
+    const bound = await probePort(INTERCEPTOR_PORT);
+    if (!bound) {
+      console.log(`    ⚠  Nothing is listening on 127.0.0.1:${INTERCEPTOR_PORT} yet - restart the`);
+      console.log('       background service (`troxy restart`) so Claude Code can connect.');
+    }
   } catch (err) {
     console.log(`    • Claude Code model proxy  ✗  (${err.message})`);
   }
@@ -648,3 +817,86 @@ export function hasClaudeCode() {
     return false;
   }
 }
+
+// Claude Desktop's Code tab has no "claude --version" to probe (it isn't a
+// CLI on PATH) and no marker *file* whose mere existence is reliable
+// (~/.claude.json / ~/.claude/settings.json are created lazily by troxy
+// itself, so their existence proves nothing about whether Desktop is
+// installed - the exact hazard tool_detect.js already documents and avoids
+// for Cursor by checking the app's own per-user data directory instead of a
+// system-wide /Applications path). Same technique here, and for the same
+// reason tool_detect.js never checks a fixed /Applications/<App>.app path
+// either: only per-user, HOME-relative locations, so this stays correct
+// under a real $HOME override in tests instead of depending on whatever
+// happens to be installed system-wide on the machine running them.
+export function hasClaudeDesktop() {
+  const home = os.homedir();
+  const paths = [
+    path.join(home, 'Applications/Claude.app'),
+    path.join(home, 'Library/Application Support/Claude'),                                    // macOS
+    path.join(process.env.LOCALAPPDATA || path.join(home, 'AppData/Local'), 'AnthropicClaude'), // Windows
+    path.join(process.env.APPDATA || path.join(home, 'AppData/Roaming'), 'Claude'),
+    path.join(home, '.config/Claude'),                                                          // Linux
+  ];
+  return paths.some(p => { try { return fs.existsSync(p); } catch { return false; } });
+}
+
+// The port the local interceptor listens on (daemon.js's startInterceptor) -
+// re-exported here as a URL so callers never hardcode 127.0.0.1 or the
+// scheme themselves.
+export function troxyInterceptorProxyUrl(port = INTERCEPTOR_PORT) {
+  return `http://127.0.0.1:${port}`;
+}
+
+export function troxyLocalCaCertPath(troxyDir = path.join(os.homedir(), '.troxy')) {
+  return path.join(troxyDir, 'tls', 'troxy-local-ca.crt');
+}
+
+// Layer 3 of the Live Model Policy Enforcement plan: routes the desktop
+// app's Code tab (which hard-overrides ANTHROPIC_BASE_URL, so the base-URL
+// substitution above never reaches it) through the local interceptor
+// instead. Terminal `claude` honors these two the same way Desktop does.
+// Do NOT also leave the base-URL substitution keys set for the same
+// surface - if `ANTHROPIC_BASE_URL` points straight at proxy.troxy.io,
+// Claude Code never touches api.anthropic.com at all, so this
+// interceptor's allowlist never sees that traffic; base-URL substitution
+// silently wins. See `migrateBaseUrlProxyToInterception` for how
+// terminal's own provisioning avoids this.
+export function patchClaudeCodeInterception(
+  configPath,
+  { proxyUrl = troxyInterceptorProxyUrl(), caCertPath = troxyLocalCaCertPath() } = {},
+) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
+  if (!config.env) config.env = {};
+  config.env.HTTPS_PROXY = proxyUrl;
+  config.env.NODE_EXTRA_CA_CERTS = caCertPath;
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// `troxy proxy disable`'s one-line recovery, and part of uninstall symmetry
+// (fail-open layer 6) - removes exactly these two keys, leaving the
+// base-URL proxy keys (if also set) and any of the user's own env untouched.
+export function unpatchClaudeCodeInterception(configPath) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return; }
+  if (config.env) {
+    delete config.env.HTTPS_PROXY;
+    delete config.env.NODE_EXTRA_CA_CERTS;
+  }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+}
+
+// Used by `troxy proxy status`/`enable` to avoid re-prompting or rewriting
+// settings that are already correct (the same class of bug the pre-existing
+// maybeEnableClaudeCodeProxy has - re-prompts on every rotate-key/update
+// because it never checks this).
+export function interceptionIsConfigured(
+  configPath,
+  { proxyUrl = troxyInterceptorProxyUrl(), caCertPath = troxyLocalCaCertPath() } = {},
+) {
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { return false; }
+  return config.env?.HTTPS_PROXY === proxyUrl && config.env?.NODE_EXTRA_CA_CERTS === caCertPath;
+}