troxy-cli 1.29.4 → 1.29.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.4",
+  "version": "1.29.6",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/command-compaction.js

@@ -0,0 +1,108 @@
+// Token Optimization plan, Step 4 (real scope, not the artifact's original
+// one): rewrite a small, explicit set of known-verbose Bash commands into
+// their own natively-concise equivalent, via PreToolUse's `updatedInput`
+// field - BEFORE the command runs, since that's the only rewrite point
+// Claude Code's real hook contract offers. There is no PostToolUse field
+// that replaces a tool's actual output (confirmed against Claude Code's
+// hooks reference, 2026-09-13) - a hook can only add supplementary
+// `additionalContext` alongside the original output, or block the call
+// entirely and feed Claude a reason instead of a result. So "compact the
+// output after it runs" is not buildable here at all; this only ever
+// rewrites the INPUT of a command whose own concise flag produces
+// equivalent information in less text.
+//
+// Deliberately small and conservative, not exhaustive: every rule here is
+// a pure reformat (git status --porcelain carries the same file-state
+// information as the verbose default, just machine-shaped) or a noise
+// reduction of genuinely redundant detail (pytest's -q drops per-test
+// PASSED lines, not failure detail) - never a rule that could cause an
+// agent to act on less information than it would have had. A rule that
+// trades size for real information loss (git log --oneline drops full
+// commit messages and authorship) does NOT belong here even though it
+// would shrink output - see docs/superpowers/specs for the fuller set of
+// commands considered and explicitly excluded for that reason.
+//
+// Pure and synchronous on purpose: called from pretooluse-hook.js's hot
+// path, which must fail open fast (see that file's own docstring) - no
+// network calls, no I/O, nothing that can hang or throw asynchronously.
+
+// Each rule: `test(command)` returns true if this rule applies; `rewrite`
+// returns the new command string. Order matters - first match wins.
+const _RULES = [
+  {
+    name: 'git-status-porcelain',
+    // Bare `git status`, optionally with a pathspec, but not already
+    // carrying its own format flag - regex, not a shell parser, so
+    // deliberately narrow: only matches when `git status` is the whole
+    // command (optionally followed by plain word/path arguments), never
+    // inside a compound command (&&, ;, |) where naive rewriting could
+    // easily target the wrong part of the line. Missing a rewrite
+    // opportunity is harmless; rewriting the wrong thing is not.
+    test(command) {
+      return /^git\s+status(\s+[^&;|]*)?$/.test(command.trim())
+        && !/(--porcelain|--short|-s\b|--long)/.test(command);
+    },
+    rewrite(command) {
+      return `${command.trim()} --porcelain=v1`;
+    },
+  },
+  {
+    name: 'pytest-quiet',
+    // Bare `pytest`/`python -m pytest`, not already carrying its own
+    // verbosity flag. -q drops the per-test PASSED noise; failure output
+    // (the only detail an agent actually needs to act on) is unaffected.
+    test(command) {
+      return /^(python[3]?\s+-m\s+)?pytest(\s+[^&;|]*)?$/.test(command.trim())
+        && !/(-q\b|--quiet|-v\b|--verbose|-vv)/.test(command);
+    },
+    rewrite(command) {
+      return `${command.trim()} -q`;
+    },
+  },
+];
+
+/**
+ * Returns a rewritten command string if a rule applies, or null if none do
+ * (including on any internal error - never throws, this is a pure
+ * best-effort optimization, not a correctness requirement).
+ */
+export function compactBashCommand(command) {
+  if (typeof command !== 'string' || !command.trim()) return null;
+  try {
+    for (const rule of _RULES) {
+      if (rule.test(command)) {
+        // No "is the rewrite shorter" check here on purpose: the command
+        // STRING itself is expected to grow (`--porcelain=v1` adds
+        // characters to the input), what shrinks is the tool's future
+        // OUTPUT once it runs - the size that actually matters, and the
+        // one thing this synchronous, pre-execution hook can never
+        // observe. The real "never worse than raw" guarantee here is that
+        // every rule is a hand-picked, known-safe flag on a real command
+        // (see the module docstring) - not something to (mis)approximate
+        // by comparing command lengths, which was tried and removed after
+        // review: it measured an unrelated quantity and would have passed
+        // or failed by accident, never by relevance.
+        return rule.rewrite(command) || null;
+      }
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+/**
+ * Entry point for the PreToolUse hook: given the hook's own tool_name and
+ * tool_input, returns an `updatedInput` object to merge into
+ * hookSpecificOutput, or null if no rewrite applies. Only handles Bash for
+ * now - Read/Edit/Write's own large-output problem needs offset/limit
+ * changes that risk silently truncating content the agent actually needs
+ * (worse than raw, not just no-better), so those are deliberately not
+ * covered here; see the module docstring's file-reads note.
+ */
+export function updatedInputFor(toolName, toolInput) {
+  if (toolName !== 'Bash') return null;
+  const command = toolInput?.command;
+  const rewritten = compactBashCommand(command);
+  return rewritten ? { command: rewritten } : null;
+}

package/src/interceptor.js

@@ -73,6 +73,21 @@ export function parseConnectTarget(url) {
 // meaningless (or wrong) to forward on either outbound leg.
 const _HOP_BY_HOP_HEADERS = new Set(['host', 'connection', 'content-length', 'transfer-encoding']);
 
+/** 'desktop' | 'terminal' | null. Verified live 2026-09-11 against two real
+ * captured user-agents from this same machine: terminal sends
+ * "claude-cli/2.1.236 (external, cli)", desktop sends "claude-cli/2.1.260
+ * (external, claude-desktop, agent-sdk/0.3.260)" - the literal substring
+ * "claude-desktop" is the one stable, explicit signal found; everything
+ * else in the string (version numbers) will drift across releases. null
+ * (never a guess) when the client sends no recognizable claude-cli
+ * user-agent at all - some other tool on this port, or a future format
+ * change this hasn't been updated for. */
+export function detectSurface(incomingHeaders) {
+  const ua = incomingHeaders['user-agent'] || '';
+  if (!/^claude-cli\//.test(ua)) return null;
+  return ua.includes('claude-desktop') ? 'desktop' : 'terminal';
+}
+
 /** Headers for the leg going to Troxy: the client's own Authorization (an
  * Anthropic API key or OAuth token) is never sent to Troxy as-is - it
  * rides the side channel app.py already knows how to consume
@@ -87,6 +102,8 @@ export function buildTroxyForwardHeaders(incomingHeaders, troxyKey) {
   if (incomingHeaders.authorization) {
     headers['x-troxy-upstream-authorization'] = incomingHeaders.authorization;
   }
+  const surface = detectSurface(incomingHeaders);
+  if (surface) headers['x-troxy-surface'] = surface;
   headers.authorization = `Bearer ${troxyKey}`;
   return headers;
 }

package/src/pretooluse-hook.js

@@ -1,6 +1,7 @@
 import { loadConfig } from './config.js';
 import { api } from './api.js';
 import { usageForCurrentTurn } from './hook-report.js';
+import { updatedInputFor } from './command-compaction.js';
 
 // Claude Code PreToolUse hook entry point: `troxy pretooluse-hook` (wired in
 // bin/troxy.js, registered by patchClaudeCodeHooks in init.js). Fires before
@@ -56,7 +57,29 @@ export function buildDenyPayload(reason) {
   };
 }
 
-function allow() {
+// Same reasoning as buildDenyPayload above: exported and pure so the exact
+// contract shape is testable without triggering allow()'s process.exit.
+export function buildUpdatedInputPayload(updatedInput) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      updatedInput,
+    },
+  };
+}
+
+// updatedInput: Token Optimization Step 4 - a command-rewrite from
+// command-compaction.js, independent of and unrelated to the policy
+// decision below (see that module's own docstring). Emitted alongside a
+// plain allow (no permissionDecision at all - `undefined`/absent means
+// "the normal permission flow applies", same as today's exit-0-with-
+// nothing-printed behavior when there's no rewrite either), never mixed
+// with a deny: a call about to be blocked doesn't need its command
+// rewritten first.
+function allow(updatedInput) {
+  if (updatedInput) {
+    process.stdout.write(JSON.stringify(buildUpdatedInputPayload(updatedInput)));
+  }
   process.exit(0);
 }
 
@@ -75,8 +98,16 @@ export async function runPreToolUseHook() {
       return allow(); // can't parse our own input - never block on that
     }
 
+    // Independent of everything below: a pure, local, synchronous command
+    // rewrite (Token Optimization Step 4) that applies (or doesn't)
+    // regardless of whether the policy check below even runs - it needs no
+    // API key, no transcript, no network call, so it's computed once, up
+    // front, and threaded through every allow() below rather than gated
+    // behind the same fail-open checks the policy path needs.
+    const rewrite = updatedInputFor(payload?.tool_name, payload?.tool_input);
+
     const transcriptPath = payload?.transcript_path;
-    if (!transcriptPath) return allow();
+    if (!transcriptPath) return allow(rewrite);
 
     // transcript_path can lag the current turn by a beat (Claude Code's own
     // docs note this), so this may occasionally read the previous turn's
@@ -85,11 +116,11 @@ export async function runPreToolUseHook() {
     // not a wrong-direction failure (never wrongly denies because of it),
     // just an occasional miss, consistent with fail-open throughout this file.
     const usage = usageForCurrentTurn(transcriptPath);
-    if (!usage || !usage.model) return allow(); // nothing to gate against yet
+    if (!usage || !usage.model) return allow(rewrite); // nothing to gate against yet
 
     const config = loadConfig();
     const apiKey = process.env.TROXY_API_KEY || config?.apiKey;
-    if (!apiKey) return allow();
+    if (!apiKey) return allow(rewrite);
 
     const body = { model: usage.model, task: payload.tool_name || '' };
     // Real effort straight off the transcript entry (see hook-report.js's
@@ -120,7 +151,7 @@ export async function runPreToolUseHook() {
     // nowhere here to pause and wait on an approval), so it fails open
     // rather than hanging Claude Code - same reasoning as every other
     // "never block on our own uncertainty" branch in this file.
-    return allow();
+    return allow(rewrite);
   } catch {
     // Network error, timeout, malformed response - never block the user's
     // session over our own failure.

package/src/tests/command-compaction.test.js

@@ -0,0 +1,106 @@
+// Pure logic only - no hook plumbing here, see pretooluse-hook.test.js for
+// how updatedInputFor's result actually reaches Claude Code's own
+// hookSpecificOutput contract.
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { compactBashCommand, updatedInputFor } from '../command-compaction.js';
+
+describe('compactBashCommand - git status', () => {
+  it('rewrites bare `git status` to porcelain form', () => {
+    assert.equal(compactBashCommand('git status'), 'git status --porcelain=v1');
+  });
+
+  it('rewrites `git status` with a pathspec', () => {
+    assert.equal(compactBashCommand('git status src/'), 'git status src/ --porcelain=v1');
+  });
+
+  it('does not double-rewrite a command already using --porcelain', () => {
+    assert.equal(compactBashCommand('git status --porcelain'), null);
+  });
+
+  it('does not rewrite a command already using -s/--short', () => {
+    assert.equal(compactBashCommand('git status -s'), null);
+    assert.equal(compactBashCommand('git status --short'), null);
+  });
+
+  it('does not touch git status inside a compound command', () => {
+    // Deliberately conservative - see the module docstring on why a
+    // missed rewrite is fine but a wrong one isn't.
+    assert.equal(compactBashCommand('git status && git log'), null);
+    assert.equal(compactBashCommand('git status; echo done'), null);
+    assert.equal(compactBashCommand('git status | cat'), null);
+  });
+
+  it('does not touch an unrelated command containing the word status', () => {
+    assert.equal(compactBashCommand('echo "git status is useful"'), null);
+  });
+});
+
+describe('compactBashCommand - pytest', () => {
+  it('rewrites bare `pytest` to add -q', () => {
+    assert.equal(compactBashCommand('pytest'), 'pytest -q');
+  });
+
+  it('rewrites `pytest` with a path argument', () => {
+    assert.equal(compactBashCommand('pytest tests/'), 'pytest tests/ -q');
+  });
+
+  it('rewrites `python -m pytest`', () => {
+    assert.equal(compactBashCommand('python -m pytest'), 'python -m pytest -q');
+    assert.equal(compactBashCommand('python3 -m pytest'), 'python3 -m pytest -q');
+  });
+
+  it('does not double-rewrite a command already carrying a verbosity flag', () => {
+    assert.equal(compactBashCommand('pytest -q'), null);
+    assert.equal(compactBashCommand('pytest -v'), null);
+    assert.equal(compactBashCommand('pytest --verbose'), null);
+    assert.equal(compactBashCommand('pytest --quiet'), null);
+  });
+});
+
+describe('compactBashCommand - unmatched input', () => {
+  it('returns null for a command with no matching rule', () => {
+    assert.equal(compactBashCommand('ls -la'), null);
+    assert.equal(compactBashCommand('git diff'), null);
+    assert.equal(compactBashCommand('git log'), null);
+  });
+
+  it('never throws on malformed input', () => {
+    assert.doesNotThrow(() => compactBashCommand(null));
+    assert.doesNotThrow(() => compactBashCommand(undefined));
+    assert.doesNotThrow(() => compactBashCommand(42));
+    assert.doesNotThrow(() => compactBashCommand(''));
+    assert.doesNotThrow(() => compactBashCommand('   '));
+  });
+
+  it('returns null, not a throw, for non-string input', () => {
+    assert.equal(compactBashCommand(null), null);
+    assert.equal(compactBashCommand(undefined), null);
+    assert.equal(compactBashCommand(42), null);
+  });
+});
+
+describe('updatedInputFor', () => {
+  it('returns an updatedInput object for a rewritable Bash command', () => {
+    assert.deepEqual(updatedInputFor('Bash', { command: 'git status' }), {
+      command: 'git status --porcelain=v1',
+    });
+  });
+
+  it('returns null for a non-Bash tool', () => {
+    assert.equal(updatedInputFor('Read', { file_path: '/tmp/x' }), null);
+    assert.equal(updatedInputFor('Edit', { command: 'git status' }), null);
+  });
+
+  it('returns null for a Bash command with no matching rule', () => {
+    assert.equal(updatedInputFor('Bash', { command: 'ls -la' }), null);
+  });
+
+  it('never throws on a malformed tool_input', () => {
+    assert.doesNotThrow(() => updatedInputFor('Bash', null));
+    assert.doesNotThrow(() => updatedInputFor('Bash', {}));
+    assert.doesNotThrow(() => updatedInputFor(null, null));
+  });
+});

package/src/tests/interceptor.test.js

@@ -21,6 +21,7 @@ import { format } from 'node:util';
 
 import {
   parseConnectTarget,
+  detectSurface,
   buildTroxyForwardHeaders,
   buildRelayHeaders,
   createInterceptor,
@@ -41,7 +42,43 @@ describe('parseConnectTarget', () => {
   });
 });
 
+describe('detectSurface', () => {
+  // Real user-agents captured live 2026-09-11 from this same machine's own
+  // terminal and desktop-app traffic through this interceptor.
+  it('recognizes a real desktop-app user-agent', () => {
+    assert.equal(
+      detectSurface({ 'user-agent': 'claude-cli/2.1.260 (external, claude-desktop, agent-sdk/0.3.260)' }),
+      'desktop',
+    );
+  });
+
+  it('recognizes a real terminal user-agent', () => {
+    assert.equal(detectSurface({ 'user-agent': 'claude-cli/2.1.236 (external, cli)' }), 'terminal');
+  });
+
+  it('returns null when there is no user-agent at all', () => {
+    assert.equal(detectSurface({}), null);
+  });
+
+  it('returns null for a user-agent that is not claude-cli - never a guess', () => {
+    assert.equal(detectSurface({ 'user-agent': 'curl/8.4.0' }), null);
+  });
+});
+
 describe('buildTroxyForwardHeaders', () => {
+  it('sets x-troxy-surface from a recognized user-agent', () => {
+    const headers = buildTroxyForwardHeaders(
+      { 'user-agent': 'claude-cli/2.1.260 (external, claude-desktop, agent-sdk/0.3.260)' },
+      'txy-key',
+    );
+    assert.equal(headers['x-troxy-surface'], 'desktop');
+  });
+
+  it('omits x-troxy-surface entirely when the surface cannot be determined', () => {
+    const headers = buildTroxyForwardHeaders({ 'user-agent': 'curl/8.4.0' }, 'txy-key');
+    assert.equal(headers['x-troxy-surface'], undefined);
+  });
+
   it('translates the client\'s own Authorization into X-Troxy-Upstream-Authorization, ' +
      'and sets Authorization to the Troxy key instead', () => {
     const headers = buildTroxyForwardHeaders(

package/src/tests/pretooluse-hook.test.js

@@ -14,7 +14,8 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
-import { buildDenyPayload } from '../pretooluse-hook.js';
+import { buildDenyPayload, buildUpdatedInputPayload } from '../pretooluse-hook.js';
+import { updatedInputFor } from '../command-compaction.js';
 
 describe('buildDenyPayload', () => {
   it('matches the exact PreToolUse hookSpecificOutput contract', () => {
@@ -40,3 +41,41 @@ describe('buildDenyPayload', () => {
     );
   });
 });
+
+// Token Optimization Step 4: the command-rewrite path is independent of the
+// policy-check path above (see pretooluse-hook.js's own comment on why
+// updatedInput is computed once, up front, and threaded through every
+// allow() branch) - these tests cover just the contract shape
+// buildUpdatedInputPayload produces, same "pure and testable without
+// process.exit" reasoning as buildDenyPayload's own tests above.
+describe('buildUpdatedInputPayload', () => {
+  it('matches the exact PreToolUse hookSpecificOutput contract for updatedInput', () => {
+    const payload = buildUpdatedInputPayload({ command: 'git status --porcelain=v1' });
+    assert.deepEqual(payload, {
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        updatedInput: { command: 'git status --porcelain=v1' },
+      },
+    });
+  });
+
+  it('carries no permissionDecision field - a plain allow, not a decision', () => {
+    const payload = buildUpdatedInputPayload({ command: 'pytest -q' });
+    assert.equal(payload.hookSpecificOutput.permissionDecision, undefined);
+  });
+
+  it('is valid JSON when stringified', () => {
+    assert.doesNotThrow(() => JSON.stringify(buildUpdatedInputPayload({ command: 'git status --porcelain=v1' })));
+  });
+});
+
+describe('updatedInputFor wired to real hook payload shapes', () => {
+  it('produces a rewrite for a real Bash tool_use payload shape', () => {
+    const rewrite = updatedInputFor('Bash', { command: 'git status', description: 'Check status' });
+    assert.deepEqual(rewrite, { command: 'git status --porcelain=v1' });
+  });
+
+  it('produces nothing for a tool this hook does not rewrite', () => {
+    assert.equal(updatedInputFor('Read', { file_path: '/tmp/x.py' }), null);
+  });
+});