troxy-cli 1.29.3 → 1.29.5

package/src/proxy.js

@@ -0,0 +1,184 @@
+/**
+ * `troxy proxy status/enable/disable` - the explicit, hands-on control
+ * surface for Layer 3 of the Live Model Policy Enforcement plan (local
+ * interceptor set up in interceptor.js/tls-ca.js/daemon.js). Deliberately
+ * NOT wired into `troxy init`'s own interactive flow yet: per the plan's
+ * rollout order, this ships first as an explicit, undocumented opt-in
+ * (`--experimental` on enable) so it can be validated by hand against a
+ * real desktop app before it becomes something an ordinary `troxy init`
+ * run could ever turn on for every user.
+ */
+import net  from 'node:net';
+import os   from 'node:os';
+import path from 'node:path';
+import fs   from 'node:fs';
+import {
+  hasClaudeCode, hasClaudeDesktop, claudeCodeSettingsPath,
+  patchClaudeCodeInterception, unpatchClaudeCodeInterception, interceptionIsConfigured,
+  troxyInterceptorProxyUrl, troxyLocalCaCertPath,
+} from './init.js';
+import { ensureInterceptionCerts, certIsValid, certExpiresWithin } from './tls-ca.js';
+import { enabledProviders, interceptHostsFor } from './providers.js';
+import { INTERCEPTOR_PORT } from './daemon.js';
+
+const TROXY_DIR = path.join(os.homedir(), '.troxy');
+
+// Quick, bounded TCP probe - "is anything listening on 127.0.0.1:<port>",
+// not a real request. Exists to tell the fail-open layer-6 mismatch
+// (settings.json points HTTPS_PROXY at the interceptor, but nothing is
+// actually there - exactly the outage this whole plan's fail-open design
+// was written around) apart from a healthy setup, so status/enable can say
+// so plainly instead of a user discovering it as a mysterious hang.
+export function probePort(port, timeoutMs = 800) {
+  return new Promise(resolve => {
+    const socket = net.connect({ host: '127.0.0.1', port, timeout: timeoutMs });
+    socket.once('connect', () => { socket.destroy(); resolve(true); });
+    socket.once('timeout', () => { socket.destroy(); resolve(false); });
+    socket.once('error', () => resolve(false));
+  });
+}
+
+function _readCert(certPath) {
+  try { return fs.readFileSync(certPath, 'utf8'); } catch { return null; }
+}
+
+export async function runProxyStatus() {
+  console.log('\n  Troxy: Live Model Policy Enforcement (interception)\n');
+
+  const hasClaude = hasClaudeCode();
+  const hasDesktop = hasClaudeDesktop();
+  console.log(`  Terminal Claude Code:   ${hasClaude ? 'detected' : 'not detected'}`);
+  console.log(`  Claude Desktop app:     ${hasDesktop ? 'detected' : 'not detected'}`);
+
+  const settingsPath = claudeCodeSettingsPath();
+  const proxyUrl = troxyInterceptorProxyUrl();
+  const caCertPath = troxyLocalCaCertPath();
+  const configured = interceptionIsConfigured(settingsPath, { proxyUrl, caCertPath });
+  console.log(`\n  Configured in settings.json:  ${configured ? 'yes' : 'no'}`);
+  if (!configured) {
+    console.log('  Run `troxy proxy enable --experimental` to turn this on.\n');
+    return;
+  }
+
+  const bound = await probePort(INTERCEPTOR_PORT);
+  if (!bound) {
+    console.log(`  ⚠  settings.json points at 127.0.0.1:${INTERCEPTOR_PORT}, but nothing is`);
+    console.log('     listening there right now - Claude Code and the desktop app will');
+    console.log('     fail to connect while this is the case.');
+    console.log('     Fix: `troxy restart` (restarts the background daemon), or');
+    console.log('          `troxy proxy disable` to remove the setting until this is resolved.\n');
+    return;
+  }
+  console.log(`  Interceptor listening:        yes  (127.0.0.1:${INTERCEPTOR_PORT})`);
+
+  const caPem = _readCert(caCertPath);
+  if (!caPem) {
+    console.log(`  CA certificate:                ✗ not found at ${caCertPath}\n`);
+    return;
+  }
+  console.log(`  CA certificate:                ${certIsValid(caPem) ? 'valid' : '✗ invalid/expired'}`);
+
+  const leafPath = path.join(TROXY_DIR, 'tls', 'leaf-api.anthropic.com.crt');
+  const leafPem = _readCert(leafPath);
+  if (leafPem) {
+    const leafOk = certIsValid(leafPem);
+    const renewingSoon = leafOk && certExpiresWithin(leafPem, 30);
+    console.log(`  Leaf certificate:               ${leafOk ? 'valid' : '✗ invalid/expired'}${renewingSoon ? ' (renews within 30 days)' : ''}`);
+  }
+  console.log(`  CA cert path:                  ${caCertPath}`);
+  console.log(`  Providers intercepted:         ${interceptHostsFor(enabledProviders()).join(', ') || '(none)'}\n`);
+}
+
+export async function runProxyEnable(flags = {}) {
+  if (flags.help || flags.h) {
+    console.log(`
+  troxy proxy enable --experimental
+
+  Routes the Claude Desktop app's Code tab (and terminal Claude Code)
+  through Troxy's local interceptor, so model policies (e.g. a BLOCK rule
+  on a specific model) are enforced in real time even inside the desktop
+  app - not just terminal \`claude\`.
+
+  How: writes HTTPS_PROXY + NODE_EXTRA_CA_CERTS into
+  ~/.claude/settings.json, pointing at a certificate authority generated
+  ON THIS MACHINE (~/.troxy/tls/). The private key never leaves this
+  machine and is never sent to Troxy. It is locked to api.anthropic.com
+  only, via a nameConstraints extension - it cannot be used to intercept
+  any other site - and it is never installed in your system keychain, only
+  referenced by Claude Code itself.
+
+  \`troxy init\` already offers this for terminal Claude Code automatically.
+  This command is for a desktop-only machine (no terminal \`claude\`), or to
+  reconfigure by hand. --experimental is required as an explicit
+  acknowledgment.
+
+  Remove any time with: troxy proxy disable
+`);
+    process.exit(0);
+  }
+  if (!flags.experimental) {
+    console.error('\n  This is experimental. Run: troxy proxy enable --experimental');
+    console.error('  Run `troxy proxy enable --help` first to see what this does.\n');
+    process.exit(1);
+  }
+
+  console.log("\n  Route Claude's model calls through Troxy so policies are enforced in");
+  console.log("  real time, including the Claude desktop app's Code tab, which ignores");
+  console.log('  the normal ANTHROPIC_BASE_URL setting.\n');
+  console.log('  To do that on the desktop app, Troxy generates a certificate authority');
+  console.log('  ON THIS MACHINE. The private key never leaves this computer and is');
+  console.log('  never sent to Troxy. It is locked to api.anthropic.com only - it cannot');
+  console.log('  be used for any other site - and it is NOT installed in your system');
+  console.log('  keychain, only referenced by Claude Code. Everything except');
+  console.log('  api.anthropic.com passes through untouched and unreadable.\n');
+
+  process.stdout.write('  Generating certificate authority...  ');
+  try {
+    ensureInterceptionCerts(TROXY_DIR, {
+      hostname: os.hostname(),
+      leafDnsNames: interceptHostsFor(enabledProviders()),
+    });
+    console.log('✓');
+  } catch (err) {
+    console.log('✗');
+    console.error(`\n  Could not generate certificates: ${err.message}\n`);
+    process.exit(1);
+  }
+
+  const settingsPath = claudeCodeSettingsPath();
+  process.stdout.write('  Writing ~/.claude/settings.json...   ');
+  try {
+    patchClaudeCodeInterception(settingsPath);
+    console.log('✓');
+  } catch (err) {
+    console.log('✗');
+    console.error(`\n  Could not write settings.json: ${err.message}\n`);
+    process.exit(1);
+  }
+
+  const bound = await probePort(INTERCEPTOR_PORT);
+  if (!bound) {
+    console.log(`\n  ⚠  Nothing is listening on 127.0.0.1:${INTERCEPTOR_PORT} yet - the running`);
+    console.log('     background daemon does not have this feature (it predates this');
+    console.log('     build). Restart it so the interceptor actually binds:');
+    console.log('       troxy restart');
+    console.log('     Until then, Claude Code will fail to connect while this is enabled.\n');
+  } else {
+    console.log(`\n  Interceptor is live on 127.0.0.1:${INTERCEPTOR_PORT}. Restart Claude Code`);
+    console.log('  (and the desktop app, if open) to pick up the new settings.\n');
+  }
+  console.log('  Remove any time with: troxy proxy disable\n');
+}
+
+export function runProxyDisable() {
+  const settingsPath = claudeCodeSettingsPath();
+  process.stdout.write('\n  Removing HTTPS_PROXY / NODE_EXTRA_CA_CERTS from settings.json...  ');
+  try {
+    unpatchClaudeCodeInterception(settingsPath);
+    console.log('✓\n');
+  } catch (err) {
+    console.log('✗');
+    console.error(`\n  ${err.message}\n`);
+    process.exit(1);
+  }
+}

package/src/tests/claude-code-hook.test.js

@@ -17,7 +17,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { patchClaudeCodeConfig, patchClaudeCodeHooks } from '../init.js';
+import { patchClaudeCodeConfig, patchClaudeCodeHooks, unpatchClaudeCodeConfig, unpatchClaudeCodeHooks } from '../init.js';
 
 let dir;
 beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-cc-')); });
@@ -71,6 +71,52 @@ describe('patchClaudeCodeConfig', () => {
   });
 });
 
+// Uninstall symmetry: removes the troxy entry from EVERY project in the
+// file, not just process.cwd() - `troxy init` may have run from several
+// project directories over time, each getting its own entry, and uninstall
+// has no reliable way to know which cwd(s) were ever used.
+describe('unpatchClaudeCodeConfig', () => {
+  const configPath = () => path.join(dir, '.claude.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+
+  it('removes the troxy entry from a single project', () => {
+    patchClaudeCodeConfig(configPath(), 'txy-abc', '/Users/x/proj');
+    unpatchClaudeCodeConfig(configPath());
+    const cfg = read();
+    assert.equal(cfg.projects['/Users/x/proj'].mcpServers.troxy, undefined);
+  });
+
+  it('removes it from every project that has one, in a single pass', () => {
+    patchClaudeCodeConfig(configPath(), 'txy-abc', '/Users/x/proj-a');
+    patchClaudeCodeConfig(configPath(), 'txy-abc', '/Users/x/proj-b');
+    unpatchClaudeCodeConfig(configPath());
+    const cfg = read();
+    assert.equal(cfg.projects['/Users/x/proj-a'].mcpServers.troxy, undefined);
+    assert.equal(cfg.projects['/Users/x/proj-b'].mcpServers.troxy, undefined);
+  });
+
+  it('leaves other tools\' mcpServers entries and unrelated project keys untouched', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      projects: { '/Users/x/proj': { allowedTools: ['Bash'], mcpServers: { someOtherTool: { command: 'x' } } } },
+    }));
+    patchClaudeCodeConfig(configPath(), 'txy-abc', '/Users/x/proj');
+    unpatchClaudeCodeConfig(configPath());
+    const cfg = read();
+    assert.deepEqual(cfg.projects['/Users/x/proj'].allowedTools, ['Bash']);
+    assert.ok(cfg.projects['/Users/x/proj'].mcpServers.someOtherTool);
+  });
+
+  it('does not throw and does not create a file when called against a non-existent config file', () => {
+    assert.doesNotThrow(() => unpatchClaudeCodeConfig(configPath()));
+    assert.equal(fs.existsSync(configPath()), false);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => unpatchClaudeCodeConfig(configPath()));
+  });
+});
+
 describe('patchClaudeCodeHooks', () => {
   const configPath = () => path.join(dir, 'settings.json');
   const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
@@ -178,3 +224,52 @@ describe('patchClaudeCodeHooks: PreToolUse gate', () => {
     assert.equal(cfg.hooks.Stop[0].hooks[0].command, 'troxy hook-report');
   });
 });
+
+// Uninstall symmetry: removes exactly the Troxy-owned Stop/PreToolUse
+// entries (identified the same way patchClaudeCodeHooks itself finds them
+// to update in place - by command containing 'hook-report'/'pretooluse-hook'),
+// leaving any of the user's own unrelated hooks in the same file untouched.
+describe('unpatchClaudeCodeHooks', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+
+  it('removes the Troxy Stop and PreToolUse entries', () => {
+    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
+    unpatchClaudeCodeHooks(configPath());
+    const cfg = read();
+    assert.equal(cfg.hooks.Stop.length, 0);
+    assert.equal(cfg.hooks.PreToolUse.length, 0);
+  });
+
+  it("preserves the user's own unrelated Stop and PreToolUse hooks in the same file", () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      hooks: {
+        Stop: [{ hooks: [{ type: 'command', command: 'my-own-script.sh' }] }],
+        PreToolUse: [{ matcher: 'Write', hooks: [{ type: 'command', command: 'validate.sh' }] }],
+      },
+    }));
+    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
+    unpatchClaudeCodeHooks(configPath());
+    const cfg = read();
+    assert.equal(cfg.hooks.Stop.length, 1);
+    assert.equal(cfg.hooks.Stop[0].hooks[0].command, 'my-own-script.sh');
+    assert.equal(cfg.hooks.PreToolUse.length, 1);
+    assert.equal(cfg.hooks.PreToolUse[0].hooks[0].command, 'validate.sh');
+  });
+
+  it('does not throw and does not create a file when called against a non-existent settings file', () => {
+    assert.doesNotThrow(() => unpatchClaudeCodeHooks(configPath()));
+    assert.equal(fs.existsSync(configPath()), false);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => unpatchClaudeCodeHooks(configPath()));
+  });
+
+  it('is idempotent - calling twice is safe', () => {
+    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
+    unpatchClaudeCodeHooks(configPath());
+    assert.doesNotThrow(() => unpatchClaudeCodeHooks(configPath()));
+  });
+});

package/src/tests/claude-code-proxy.test.js

@@ -14,7 +14,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { patchClaudeCodeProxy, troxyModelProxyBaseUrl } from '../init.js';
+import { patchClaudeCodeProxy, unpatchClaudeCodeProxy, troxyModelProxyBaseUrl, migrateBaseUrlProxyToInterception } from '../init.js';
 
 let dir;
 beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-cc-proxy-')); });
@@ -88,3 +88,122 @@ describe('patchClaudeCodeProxy', () => {
     assert.doesNotThrow(() => patchClaudeCodeProxy(configPath(), KEY));
   });
 });
+
+// Uninstall symmetry (fail-open layer 6 of the Live Model Policy Enforcement
+// plan): before this existed, `troxy uninstall` deleted ~/.troxy but never
+// touched these three keys, so a machine that had them set kept routing
+// through a proxy that no longer existed.
+describe('unpatchClaudeCodeProxy', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const KEY = 'txy-test-key-123';
+
+  it('removes exactly the three keys patchClaudeCodeProxy writes', () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    unpatchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, undefined);
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, undefined);
+    assert.equal(cfg.env.ENABLE_TOOL_SEARCH, undefined);
+  });
+
+  it('leaves unrelated env keys (e.g. the interception keys) and top-level keys untouched', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      env: { HTTPS_PROXY: 'http://127.0.0.1:48173', SOME_OTHER_VAR: 'keep-me' },
+      hooks: { Stop: [{ hooks: [{ command: 'x' }] }] },
+    }));
+    patchClaudeCodeProxy(configPath(), KEY);
+    unpatchClaudeCodeProxy(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.HTTPS_PROXY, 'http://127.0.0.1:48173');
+    assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
+    assert.equal(cfg.hooks.Stop.length, 1);
+  });
+
+  it('does not throw and does not create a file when called against a non-existent settings file', () => {
+    assert.doesNotThrow(() => unpatchClaudeCodeProxy(configPath()));
+    assert.equal(fs.existsSync(configPath()), false);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => unpatchClaudeCodeProxy(configPath()));
+  });
+
+  it('is idempotent - calling twice is safe', () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    unpatchClaudeCodeProxy(configPath());
+    assert.doesNotThrow(() => unpatchClaudeCodeProxy(configPath()));
+  });
+});
+
+// New for the terminal-interception-passthrough plan (2026-09-08): a
+// machine that already ran `troxy init --proxy` has the old base-URL
+// substitution keys set, which is the live billing bug (terminal calls
+// silently charged to the org's own API key instead of the user's
+// subscription). This is the auto-migration step that removes them the
+// next time init/rotate-key/update runs, regardless of whether the user
+// then opts into interception.
+describe('migrateBaseUrlProxyToInterception', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const KEY = 'txy-test-key-123';
+
+  it('returns false and does nothing when the file does not exist', () => {
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), false);
+    assert.equal(fs.existsSync(configPath()), false);
+  });
+
+  it('returns false and does nothing when neither old key is set', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ env: { SOME_OTHER_VAR: 'keep-me' } }));
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), false);
+    assert.equal(read().env.SOME_OTHER_VAR, 'keep-me');
+  });
+
+  it('returns true and removes all three base-URL-proxy keys when ANTHROPIC_BASE_URL is set', () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), true);
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, undefined);
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, undefined);
+    assert.equal(cfg.env.ENABLE_TOOL_SEARCH, undefined);
+  });
+
+  it('returns true when only ANTHROPIC_AUTH_TOKEN is set (partial/manually-edited state)', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ env: { ANTHROPIC_AUTH_TOKEN: 'txy-abc' } }));
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), true);
+    assert.equal(read().env.ANTHROPIC_AUTH_TOKEN, undefined);
+  });
+
+  it('does not touch a non-Troxy ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN (e.g. a user\'s own LiteLLM/Bedrock gateway)', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      env: { ANTHROPIC_BASE_URL: 'https://litellm.internal/v1', ANTHROPIC_AUTH_TOKEN: 'sk-my-own-key' },
+    }));
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), false);
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://litellm.internal/v1');
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, 'sk-my-own-key');
+  });
+
+  it('preserves unrelated env keys (e.g. interception keys already set) and top-level keys', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      env: { ANTHROPIC_BASE_URL: 'https://proxy.troxy.io', HTTPS_PROXY: 'http://127.0.0.1:48173' },
+      hooks: { Stop: [{ hooks: [{ command: 'x' }] }] },
+    }));
+    migrateBaseUrlProxyToInterception(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.HTTPS_PROXY, 'http://127.0.0.1:48173');
+    assert.equal(cfg.hooks.Stop.length, 1);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => migrateBaseUrlProxyToInterception(configPath()));
+  });
+
+  it('is idempotent - calling twice is safe and returns false the second time', () => {
+    patchClaudeCodeProxy(configPath(), KEY);
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), true);
+    assert.equal(migrateBaseUrlProxyToInterception(configPath()), false);
+  });
+});

package/src/tests/daemon.test.js

@@ -0,0 +1,85 @@
+// daemon.js's startInterceptor() is thin orchestration over already-tested
+// pieces (createInterceptor, ensureInterceptionCerts, providers.js) - these
+// tests cover the wiring itself (it actually binds, it actually generates
+// certs on first run, a second call is idempotent), not the underlying
+// TLS/CA/routing behavior, which interceptor.test.js and tls-ca.test.js
+// already cover thoroughly.
+//
+// Port 0 (OS-assigned) is used everywhere except the EADDRINUSE test,
+// deliberately - node:test runs `it()` blocks within a file concurrently
+// by default, and a separate "probe a free port, close it, then bind that
+// same number" pattern across multiple concurrent tests races: two tests'
+// probes can receive the SAME OS-assigned ephemeral port in the gap before
+// either has actually bound it (confirmed live - this reproduced on every
+// run before switching to port 0). Binding directly with port 0 makes
+// "find a free port" and "bind it" one atomic step, which is the only way
+// to avoid that race entirely.
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import net from 'node:net';
+
+import { startInterceptor } from '../daemon.js';
+
+let dir;
+let servers = [];
+beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-daemon-')); servers = []; });
+afterEach(() => {
+  for (const s of servers) { try { s.close(); } catch {} }
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe('startInterceptor', () => {
+  it('starts and actually binds - Phase 1 always has at least the anthropic provider enabled', async () => {
+    const server = startInterceptor({ troxyDir: dir, port: 0 });
+    servers.push(server);
+    assert.ok(server, 'expected a server instance, got null');
+    await new Promise((resolve, reject) => {
+      server.on('listening', resolve);
+      server.on('error', reject);
+    });
+    assert.equal(server.listening, true);
+  });
+
+  it('generates the CA + leaf certificate files under the given troxyDir on first run', async () => {
+    const server = startInterceptor({ troxyDir: dir, port: 0 });
+    servers.push(server);
+    await new Promise((resolve, reject) => { server.on('listening', resolve); server.on('error', reject); });
+
+    assert.ok(fs.existsSync(path.join(dir, 'tls', 'troxy-local-ca.crt')));
+    assert.ok(fs.existsSync(path.join(dir, 'tls', 'leaf-api.anthropic.com.crt')));
+  });
+
+  it('a second call reuses the same CA rather than regenerating it', async () => {
+    const server1 = startInterceptor({ troxyDir: dir, port: 0 });
+    servers.push(server1);
+    await new Promise((resolve, reject) => { server1.on('listening', resolve); server1.on('error', reject); });
+    const firstCa = fs.readFileSync(path.join(dir, 'tls', 'troxy-local-ca.crt'), 'utf8');
+
+    const server2 = startInterceptor({ troxyDir: dir, port: 0 });
+    servers.push(server2);
+    await new Promise((resolve, reject) => { server2.on('listening', resolve); server2.on('error', reject); });
+    const secondCa = fs.readFileSync(path.join(dir, 'tls', 'troxy-local-ca.crt'), 'utf8');
+
+    assert.equal(secondCa, firstCa);
+  });
+
+  it('emits a clean EADDRINUSE error instead of crashing when the port is already taken', async () => {
+    // This one genuinely needs a specific, known port to collide on, so it
+    // can't use port 0 - occupies it directly with a plain server first,
+    // reading back the OS-assigned port from THAT bind (also atomic, no
+    // separate probe-then-close step).
+    const occupied = net.createServer();
+    servers.push(occupied);
+    await new Promise(r => occupied.listen(0, '127.0.0.1', r));
+    const port = occupied.address().port;
+
+    const server = startInterceptor({ troxyDir: dir, port });
+    servers.push(server);
+    const err = await new Promise((resolve) => { server.on('error', resolve); });
+    assert.equal(err.code, 'EADDRINUSE');
+  });
+});

package/src/tests/init-detection.test.js

@@ -0,0 +1,95 @@
+// hasClaudeDesktop() - Layer 3 of the Live Model Policy Enforcement plan.
+// Same technique tool_detect.js already uses for Cursor/Windsurf/etc: check
+// the app's own install directory, never a config file troxy itself might
+// have created (~/.claude.json and ~/.claude/settings.json are both created
+// lazily by troxy - their mere existence proves nothing about whether
+// Desktop is actually installed).
+//
+// Unlike tool_detect.js's `home` (cached at module load, forcing a
+// "set HOME before first import" trick), hasClaudeDesktop() reads
+// os.homedir() fresh on every call - so these tests just set process.env.HOME
+// per test, no import-order dance required.
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { hasClaudeDesktop } from '../init.js';
+
+let dir;
+let originalHome, originalLocalAppData, originalAppData;
+
+beforeEach(() => {
+  dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-desktop-detect-'));
+  originalHome = process.env.HOME;
+  originalLocalAppData = process.env.LOCALAPPDATA;
+  originalAppData = process.env.APPDATA;
+  process.env.HOME = dir;
+  delete process.env.LOCALAPPDATA;
+  delete process.env.APPDATA;
+});
+
+afterEach(() => {
+  process.env.HOME = originalHome;
+  if (originalLocalAppData === undefined) delete process.env.LOCALAPPDATA;
+  else process.env.LOCALAPPDATA = originalLocalAppData;
+  if (originalAppData === undefined) delete process.env.APPDATA;
+  else process.env.APPDATA = originalAppData;
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe('hasClaudeDesktop', () => {
+  it('reports false against a clean home dir with no app installed', () => {
+    assert.equal(hasClaudeDesktop(), false);
+  });
+
+  it('does NOT treat a troxy-created ~/.claude.json or ~/.claude/settings.json as evidence Desktop is installed', () => {
+    fs.writeFileSync(path.join(dir, '.claude.json'), '{}');
+    fs.mkdirSync(path.join(dir, '.claude'), { recursive: true });
+    fs.writeFileSync(path.join(dir, '.claude', 'settings.json'), '{}');
+    assert.equal(
+      hasClaudeDesktop(),
+      false,
+      'config files troxy itself creates must never look like Desktop being installed',
+    );
+  });
+
+  it("detects Desktop from ~/Library/Application Support/Claude (macOS)", () => {
+    fs.mkdirSync(path.join(dir, 'Library/Application Support/Claude'), { recursive: true });
+    assert.equal(hasClaudeDesktop(), true);
+  });
+
+  it("detects Desktop from ~/Applications/Claude.app (per-user Applications folder)", () => {
+    fs.mkdirSync(path.join(dir, 'Applications/Claude.app'), { recursive: true });
+    assert.equal(hasClaudeDesktop(), true);
+  });
+
+  it('detects Desktop from ~/.config/Claude (Linux)', () => {
+    fs.mkdirSync(path.join(dir, '.config/Claude'), { recursive: true });
+    assert.equal(hasClaudeDesktop(), true);
+  });
+
+  it('detects Desktop from %APPDATA%/Claude when APPDATA is set (Windows)', () => {
+    const appData = path.join(dir, 'AppData/Roaming');
+    fs.mkdirSync(path.join(appData, 'Claude'), { recursive: true });
+    process.env.APPDATA = appData;
+    assert.equal(hasClaudeDesktop(), true);
+  });
+
+  it('detects Desktop from %LOCALAPPDATA%/AnthropicClaude when LOCALAPPDATA is set (Windows)', () => {
+    const localAppData = path.join(dir, 'AppData/Local');
+    fs.mkdirSync(path.join(localAppData, 'AnthropicClaude'), { recursive: true });
+    process.env.LOCALAPPDATA = localAppData;
+    assert.equal(hasClaudeDesktop(), true);
+  });
+
+  it('never throws when a candidate path is unreadable/permission-denied rather than merely absent', () => {
+    // fs.existsSync itself never throws for a normal missing path, but the
+    // implementation wraps every check in try/catch specifically so a
+    // stranger failure mode (e.g. a permission-denied parent dir) degrades
+    // to "not detected" rather than crashing troxy init.
+    assert.doesNotThrow(() => hasClaudeDesktop());
+  });
+});