troxy-cli 1.29.45 → 1.29.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.45",
+  "version": "1.29.47",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/daemon.js

@@ -105,7 +105,7 @@ export function startInterceptor({
     routeResolver: (host, method, reqPath) => troxyRouteFor(providers, host, method, reqPath),
     // Fresh from disk on every request, not cached at startup - a
     // `troxy rotate-key` takes effect immediately, no daemon restart needed.
-    getTroxyKey: () => loadConfig()?.apiKey || null,
+    getTroxyKey: () => loadConfig()?.apiKey?.trim() || null,
     getCerts: () => certs,
     log: _log,
   });

package/src/interceptor.js

@@ -104,7 +104,7 @@ export function detectSurface(incomingHeaders) {
 const _SANDBOX_STATE_FRESHNESS_MS = 2 * 60 * 1000;
 const _DEFAULT_SANDBOX_STATE_DIR = path.join(os.homedir(), '.troxy', 'sandbox');
 // Written by the troxy-guard mod when it reroutes a prompt to a cheaper model:
-// { from, to, ts } per session. Forwarded so the proxy can credit the saving to
+// { arm, from?, to?, ts } per session. Forwarded so the proxy can credit the saving to
 // the model the user originally asked for (it only ever sees the rerouted one).
 const _DEFAULT_MOD_ROUTE_DIR = path.join(os.homedir(), '.troxy', 'mod-route');
 const _MOD_ROUTE_MAX_AGE_MS = 30 * 60 * 1000;
@@ -112,12 +112,15 @@ const _MOD_ROUTE_MAX_AGE_MS = 30 * 60 * 1000;
 function _readModRoute(dir, sessionId) {
   try {
     const file = sessionArmPath(dir, sessionId);
-    if (!file) return null;
+    if (!file) return { arm: null, from: null, to: null };
     const n = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (typeof n.from !== 'string' || typeof n.to !== 'string' || !(Date.now() - n.ts < _MOD_ROUTE_MAX_AGE_MS)) return null;
-    return n;
+    // arm is per-session state and never expires; from/to is only valid if fresh.
+    const arm = n.arm === 'treated' || n.arm === 'holdout' ? n.arm : null;
+    const isFresh = Date.now() - n.ts < _MOD_ROUTE_MAX_AGE_MS;
+    const routed = isFresh && typeof n.from === 'string' && typeof n.to === 'string';
+    return { arm, from: routed ? n.from : null, to: routed ? n.to : null };
   } catch {
-    return null;
+    return { arm: null, from: null, to: null };
   }
 }
 
@@ -172,10 +175,12 @@ export function buildTroxyForwardHeaders(incomingHeaders, troxyKey, sandboxState
     : _readFreshSandboxState(sandboxStateDir);
   if (sandboxState) headers['x-troxy-tool-sandbox'] = sandboxState;
   const modRoute = _readModRoute(modRouteDir, incomingHeaders['x-claude-code-session-id']);
-  if (modRoute) {
+  if (modRoute && modRoute.from) {
     headers['x-troxy-mod-routed-from'] = modRoute.from;
     headers['x-troxy-mod-routed-to'] = modRoute.to;
   }
+  // The mod is this session's one router: the proxy must not route it, and logs the arm.
+  if (modRoute && modRoute.arm) headers['x-troxy-mod-arm'] = modRoute.arm;
   headers.authorization = `Bearer ${troxyKey}`;
   return headers;
 }
@@ -279,13 +284,15 @@ function _relayToTroxy(route, req, res, body, troxyKey, connectTimeoutMs, respon
       resolve(result);
     };
 
-    const upstreamReq = _clientForProtocol(route.upstream).request({
-      method: req.method,
-      hostname: url.hostname,
-      port: url.port || (url.protocol === 'http:' ? 80 : 443),
-      path: url.pathname + search,
-      headers: buildTroxyForwardHeaders(req.headers, troxyKey),
-    }, (upstreamRes) => {
+    let upstreamReq;
+    try {
+      upstreamReq = _clientForProtocol(route.upstream).request({
+        method: req.method,
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'http:' ? 80 : 443),
+        path: url.pathname + search,
+        headers: buildTroxyForwardHeaders(req.headers, troxyKey),
+      }, (upstreamRes) => {
       if (settled) return; // already failed open on a timeout; drop this late arrival
       settled = true;
       clearTimeout(connectTimer);
@@ -328,6 +335,11 @@ function _relayToTroxy(route, req, res, body, troxyKey, connectTimeoutMs, respon
 
     upstreamReq.on('error', () => settle(false));
     upstreamReq.end(body);
+    } catch (err) {
+      // Invalid header value (e.g. a trailing newline in the key) throws synchronously: fail open.
+      log('troxy request rejected before sending: %s', err.message);
+      settle(false);
+    }
   });
 }
 

package/src/mods/troxy-guard/hooks/register.js

@@ -91,16 +91,27 @@ function parseScore(text) {
   return Number.isFinite(n) ? Math.min(1, Math.max(0, n)) : null;
 }
 
-function pickModel(score, requested, contextTokens) {
+function pickModel(score, requested, contextTokens, warm) {
   const rq = tierOf(requested);
   if (rq === null) return requested; // unknown family (e.g. a newer tier): leave it alone
+  // No score (scorer failed or echoed the prompt): stay on the warm model at any
+  // size, since a switch would re-write the cache for no reason.
+  if (score === null) {
+    const w = tierOf(warm);
+    return w !== null && RANK[w] <= RANK[rq] ? warm : requested;
+  }
   let tier = rq;
   for (const [limit, name] of BANDS) {
     if (score <= limit) { if (RANK[name] < RANK[rq]) tier = name; break; }
   }
   // The cache is per model: the first prompt on a new model re-writes the whole
-  // conversation, so past the floor a switch costs more than one cheap turn saves.
-  if (tier !== rq && contextTokens > ROUTE_CONTEXT_FLOOR_TOKENS) tier = rq;
+  // conversation, so past the floor stay on the model the cache is warm on
+  // (`warm`, what this session last ran), unless the prompt needs a stronger one.
+  if (contextTokens > ROUTE_CONTEXT_FLOOR_TOKENS) {
+    const w = tierOf(warm);
+    if (w === null || RANK[w] > RANK[rq]) tier = rq;
+    else if (RANK[tier] <= RANK[w]) tier = w;
+  }
   return tier === rq ? requested : MODELS[tier];
 }
 
@@ -198,7 +209,7 @@ function statusText({ version, paused, totals, rateLimits = [], compactOff = fal
     : 'This session: nothing moved to a cheaper model yet');
   const meter = rateLimits.filter(w => WINDOW_LABEL[w.kind]).map(w => `${WINDOW_LABEL[w.kind]} ${Math.round(w.percentUsed)}%`);
   if (meter.length) lines.push(`Plan usage now: ${meter.join(' · ')}`);
-  lines.push(`Prompts with over ${ROUTE_CONTEXT_FLOOR_TOKENS / 1000}k tokens of context stay on your model (switching would rewrite the cache).`);
+  lines.push(`Past ${ROUTE_CONTEXT_FLOOR_TOKENS / 1000}k tokens of context a session stays on the model it is on (switching would rewrite the cache), unless a prompt needs a stronger one.`);
   lines.push(compactOff ? 'Idle compaction is off (/troxy compact on).'
     : `Idle compaction is on: sessions over ${COMPACT_MIN_TOKENS / 1000}k tokens are compacted after ${COMPACT_IDLE_MS / 60000} min idle (/troxy compact off).`);
   lines.push('All sessions: dash.troxy.io');
@@ -302,26 +313,31 @@ async function scorePrompt($, e, next) {
   );
   const score = r.isAnswered ? parseScore(r.text) : null;
   $.ui.log(`troxy scorer: ${r.isAnswered ? JSON.stringify(r.text) : r.reason} -> ${score}`, { to: 'debug' });
-  if (score !== null) {
-    const u = await $.session.usage();
-    decision = { score, tokens: estimateTokens(u.context && u.context.tokens, e.text) };
-  }
+  const u = await $.session.usage();
+  decision = { score, tokens: estimateTokens(u.context && u.context.tokens, e.text) };
   return next(e);
 }
 
 // The model the session last asked for, per session, so a /model switch is seen.
 const lastAsked = new Map();
+// The model each session last ran on and when: its cache is warm for about an hour.
+const lastSent = new Map();
+const WARM_MS = 55 * 60 * 1000;
 
 async function* routeStep($, e, next) {
   // Main loop only: a subagent keeps whatever model it was given.
-  if (!decision || e.agentId) return yield* next(e);
+  if (e.agentId) return yield* next(e);
+  const sid = await $.session.id();
+  const now = await $.clock.now();
   // The user picked a different model since the last turn: their choice wins
   // for this turn (the proxy does the same, route_reason 'user_switch').
-  const sid = await $.session.id();
   const prev = lastAsked.get(sid);
   lastAsked.set(sid, e.model);
-  if (prev && prev !== e.model) { decision = null; return yield* next(e); }
-  const model = pickModel(decision.score, e.model, decision.tokens);
+  if (prev && prev !== e.model) decision = null;
+  if (!decision) { lastSent.set(sid, { model: e.model, at: now }); return yield* next(e); }
+  const ls = lastSent.get(sid);
+  const model = pickModel(decision.score, e.model, decision.tokens, ls && now - ls.at < WARM_MS ? ls.model : null);
+  lastSent.set(sid, { model, at: now });
   if (model !== e.model) {
     const file = modRouteFile($.plugin.root, sid);
     const key = `${sid}:${e.model}>${model}`;

package/src/tests/interceptor.test.js

@@ -149,6 +149,20 @@ describe('buildTroxyForwardHeaders', () => {
       note(dir, { from: 'a', to: 'b', ts: Date.now() });
       assert.equal(build(dir, '../etc/passwd')['x-troxy-mod-routed-from'], undefined);
     });
+
+    it('tags the arm on every call, with or without a reroute', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-modroute-'));
+      note(dir, { arm: 'holdout', ts: Date.now() });
+      let h = build(dir);
+      assert.equal(h['x-troxy-mod-arm'], 'holdout');
+      assert.equal(h['x-troxy-mod-routed-from'], undefined);
+      note(dir, { arm: 'treated', from: 'claude-opus-5-5', to: 'claude-haiku-4-5-20251001', ts: Date.now() });
+      h = build(dir);
+      assert.equal(h['x-troxy-mod-arm'], 'treated');
+      assert.equal(h['x-troxy-mod-routed-to'], 'claude-haiku-4-5-20251001');
+      note(dir, { arm: 'bogus', ts: Date.now() });
+      assert.equal(build(dir)['x-troxy-mod-arm'], undefined);
+    });
   });
 
   it('omits x-troxy-tool-sandbox header when no state file exists', () => {
@@ -702,3 +716,58 @@ describe('buildTroxyForwardHeaders session arm', () => {
     assert.equal('x-troxy-tool-sandbox' in headers, false);
   });
 });
+
+describe('interceptor fails open on invalid header values', () => {
+  const openServers = [];
+  after(async () => {
+    openServers.forEach(s => s.close());
+  });
+
+  it('handles API key with trailing newline gracefully without crashing', async () => {
+    // Simulates daemon.js config loading a key with a trailing newline,
+    // before the trim fix. The interceptor must fail open, not crash.
+    const targetServer = net.createServer((socket) => {
+      socket.write('HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK');
+      socket.end();
+    });
+    await new Promise(r => targetServer.listen(0, '127.0.0.1', r));
+    openServers.push(targetServer);
+    const targetPort = targetServer.address().port;
+
+    const interceptor = createInterceptor({
+      interceptHosts: ['api.anthropic.com'],
+      routeResolver: (host, method, reqPath) => {
+        if (host === 'api.anthropic.com') {
+          return { method, path: '/v1/messages', upstream: `http://127.0.0.1:${targetPort}` };
+        }
+        return null;
+      },
+      // Return a key with trailing newline - simulates the bug before daemon.js trim
+      getTroxyKey: () => 'txy-test-key\n',
+      getCerts: () => null, // No TLS for this test, it goes straight to HTTP upstream
+      log: () => {},
+    });
+    await new Promise(r => interceptor.listen(0, '127.0.0.1', r));
+    openServers.push(interceptor);
+
+    // Make a request through the proxy to the anthropic host
+    // The invalid header should cause a catch in _relayToTroxy, which should
+    // settle(false) to fail open, not crash the server.
+    const response = await new Promise((resolve, reject) => {
+      const req = net.createConnection(
+        { host: '127.0.0.1', port: interceptor.address().port },
+        () => {
+          req.write('GET / HTTP/1.1\r\nHost: api.anthropic.com\r\nConnection: close\r\n\r\n');
+        }
+      );
+      let body = '';
+      req.on('data', (chunk) => { body += chunk.toString(); });
+      req.on('end', () => resolve(body));
+      req.on('error', reject);
+    });
+
+    // Verify we got a response (either direct relay or error response),
+    // and the server didn't crash
+    assert.ok(response.length > 0, 'should get a response, not crash');
+  });
+});

package/src/tests/mods-troxy-guard.test.js

@@ -98,7 +98,7 @@ test('statusText: version, routing, this session, plan usage, where the account
     'Troxy 1.29.42 · routing is on\n'
     + 'This session: your bar lasts 4.0x longer · $0.09 saved of $0.12 at list price · estimate\n'
     + 'Plan usage now: 5h 23% · 7d 77%\n'
-    + 'Prompts with over 50k tokens of context stay on your model (switching would rewrite the cache).\n'
+    + 'Past 50k tokens of context a session stays on the model it is on (switching would rewrite the cache), unless a prompt needs a stronger one.\n'
     + 'Idle compaction is on: sessions over 100k tokens are compacted after 55 min idle (/troxy compact off).\n'
     + 'All sessions: dash.troxy.io\n'
     + 'Type /troxy off to pause routing.');
@@ -147,10 +147,11 @@ test('fetchSavings: sends the saved key and the session id; null without a key o
 // (score 0.1) and the context is small, so the mod would route down to haiku.
 function routingApi() {
   const kv = new Map();
+  const sid = 'sess-' + Math.random().toString(36).slice(2, 10);
   return {
     state: { get: async (k) => ({ value: kv.get(k.key) }), set: async (k, v) => kv.set(k.key, v) },
     store: { get: async () => undefined },
-    session: { id: async () => 'sess-switch-test', usage: async () => ({ context: { tokens: 1000 }, rateLimits: [] }) },
+    session: { id: async () => sid, usage: async () => ({ context: { tokens: 1000 }, rateLimits: [] }) },
     plugin: { root: '/tmp/not-installed' },
     model: { complete: async () => ({ isAnswered: true, text: '0.1' }) },
     ui: { log: () => {} },
@@ -175,3 +176,28 @@ test('routeStep: a /model switch is honored for that turn, then routing resumes'
   assert.equal(await runTurn($, sonnet), sonnet); // user picked sonnet: kept
   assert.equal(await runTurn($, sonnet), haiku);  // same choice again: routing resumes
 });
+
+test('pickModel: past the floor, stay on the warm model unless the prompt needs a stronger one', () => {
+  const { pickModel, MODELS } = _internal;
+  const big = 80000;
+  assert.equal(pickModel(0.1, MODELS.opus, big, MODELS.haiku), MODELS.haiku); // easy: stay warm on haiku
+  assert.equal(pickModel(0.5, MODELS.opus, big, MODELS.haiku), MODELS.sonnet); // needs sonnet: step up
+  assert.equal(pickModel(0.1, MODELS.opus, big, MODELS.opus), MODELS.opus);   // warm on opus: no switch down
+  assert.equal(pickModel(0.1, MODELS.opus, big, null), MODELS.opus);          // cold or unknown: as before
+  assert.equal(pickModel(0.1, MODELS.opus, 1000, MODELS.opus), MODELS.haiku); // under the floor: route freely
+});
+
+test('routeStep: the session that crossed 50k on haiku stays on haiku (no cache rewrite)', async () => {
+  const $ = routingApi();
+  const { opus, haiku } = _internal.MODELS;
+  assert.equal(await runTurn($, opus), haiku);
+  $.session.usage = async () => ({ context: { tokens: 60000 }, rateLimits: [] });
+  assert.equal(await runTurn($, opus), haiku);
+});
+
+test('pickModel: no score never causes a switch away from the warm model past the floor', () => {
+  const { pickModel, MODELS } = _internal;
+  assert.equal(pickModel(null, MODELS.opus, 80000, MODELS.haiku), MODELS.haiku);
+  assert.equal(pickModel(null, MODELS.opus, 1000, MODELS.haiku), MODELS.haiku); // small context too
+  assert.equal(pickModel(null, MODELS.opus, 1000, null), MODELS.opus);           // nothing warm: as asked
+});