troxy-cli 1.29.46 → 1.29.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.46",
+  "version": "1.29.47",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/daemon.js

@@ -105,7 +105,7 @@ export function startInterceptor({
     routeResolver: (host, method, reqPath) => troxyRouteFor(providers, host, method, reqPath),
     // Fresh from disk on every request, not cached at startup - a
     // `troxy rotate-key` takes effect immediately, no daemon restart needed.
-    getTroxyKey: () => loadConfig()?.apiKey || null,
+    getTroxyKey: () => loadConfig()?.apiKey?.trim() || null,
     getCerts: () => certs,
     log: _log,
   });

package/src/interceptor.js

@@ -104,7 +104,7 @@ export function detectSurface(incomingHeaders) {
 const _SANDBOX_STATE_FRESHNESS_MS = 2 * 60 * 1000;
 const _DEFAULT_SANDBOX_STATE_DIR = path.join(os.homedir(), '.troxy', 'sandbox');
 // Written by the troxy-guard mod when it reroutes a prompt to a cheaper model:
-// { from, to, ts } per session. Forwarded so the proxy can credit the saving to
+// { arm, from?, to?, ts } per session. Forwarded so the proxy can credit the saving to
 // the model the user originally asked for (it only ever sees the rerouted one).
 const _DEFAULT_MOD_ROUTE_DIR = path.join(os.homedir(), '.troxy', 'mod-route');
 const _MOD_ROUTE_MAX_AGE_MS = 30 * 60 * 1000;
@@ -112,12 +112,15 @@ const _MOD_ROUTE_MAX_AGE_MS = 30 * 60 * 1000;
 function _readModRoute(dir, sessionId) {
   try {
     const file = sessionArmPath(dir, sessionId);
-    if (!file) return null;
+    if (!file) return { arm: null, from: null, to: null };
     const n = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (typeof n.from !== 'string' || typeof n.to !== 'string' || !(Date.now() - n.ts < _MOD_ROUTE_MAX_AGE_MS)) return null;
-    return n;
+    // arm is per-session state and never expires; from/to is only valid if fresh.
+    const arm = n.arm === 'treated' || n.arm === 'holdout' ? n.arm : null;
+    const isFresh = Date.now() - n.ts < _MOD_ROUTE_MAX_AGE_MS;
+    const routed = isFresh && typeof n.from === 'string' && typeof n.to === 'string';
+    return { arm, from: routed ? n.from : null, to: routed ? n.to : null };
   } catch {
-    return null;
+    return { arm: null, from: null, to: null };
   }
 }
 
@@ -172,10 +175,12 @@ export function buildTroxyForwardHeaders(incomingHeaders, troxyKey, sandboxState
     : _readFreshSandboxState(sandboxStateDir);
   if (sandboxState) headers['x-troxy-tool-sandbox'] = sandboxState;
   const modRoute = _readModRoute(modRouteDir, incomingHeaders['x-claude-code-session-id']);
-  if (modRoute) {
+  if (modRoute && modRoute.from) {
     headers['x-troxy-mod-routed-from'] = modRoute.from;
     headers['x-troxy-mod-routed-to'] = modRoute.to;
   }
+  // The mod is this session's one router: the proxy must not route it, and logs the arm.
+  if (modRoute && modRoute.arm) headers['x-troxy-mod-arm'] = modRoute.arm;
   headers.authorization = `Bearer ${troxyKey}`;
   return headers;
 }
@@ -279,13 +284,15 @@ function _relayToTroxy(route, req, res, body, troxyKey, connectTimeoutMs, respon
       resolve(result);
     };
 
-    const upstreamReq = _clientForProtocol(route.upstream).request({
-      method: req.method,
-      hostname: url.hostname,
-      port: url.port || (url.protocol === 'http:' ? 80 : 443),
-      path: url.pathname + search,
-      headers: buildTroxyForwardHeaders(req.headers, troxyKey),
-    }, (upstreamRes) => {
+    let upstreamReq;
+    try {
+      upstreamReq = _clientForProtocol(route.upstream).request({
+        method: req.method,
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'http:' ? 80 : 443),
+        path: url.pathname + search,
+        headers: buildTroxyForwardHeaders(req.headers, troxyKey),
+      }, (upstreamRes) => {
       if (settled) return; // already failed open on a timeout; drop this late arrival
       settled = true;
       clearTimeout(connectTimer);
@@ -328,6 +335,11 @@ function _relayToTroxy(route, req, res, body, troxyKey, connectTimeoutMs, respon
 
     upstreamReq.on('error', () => settle(false));
     upstreamReq.end(body);
+    } catch (err) {
+      // Invalid header value (e.g. a trailing newline in the key) throws synchronously: fail open.
+      log('troxy request rejected before sending: %s', err.message);
+      settle(false);
+    }
   });
 }
 

package/src/tests/interceptor.test.js

@@ -149,6 +149,20 @@ describe('buildTroxyForwardHeaders', () => {
       note(dir, { from: 'a', to: 'b', ts: Date.now() });
       assert.equal(build(dir, '../etc/passwd')['x-troxy-mod-routed-from'], undefined);
     });
+
+    it('tags the arm on every call, with or without a reroute', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-modroute-'));
+      note(dir, { arm: 'holdout', ts: Date.now() });
+      let h = build(dir);
+      assert.equal(h['x-troxy-mod-arm'], 'holdout');
+      assert.equal(h['x-troxy-mod-routed-from'], undefined);
+      note(dir, { arm: 'treated', from: 'claude-opus-5-5', to: 'claude-haiku-4-5-20251001', ts: Date.now() });
+      h = build(dir);
+      assert.equal(h['x-troxy-mod-arm'], 'treated');
+      assert.equal(h['x-troxy-mod-routed-to'], 'claude-haiku-4-5-20251001');
+      note(dir, { arm: 'bogus', ts: Date.now() });
+      assert.equal(build(dir)['x-troxy-mod-arm'], undefined);
+    });
   });
 
   it('omits x-troxy-tool-sandbox header when no state file exists', () => {
@@ -702,3 +716,58 @@ describe('buildTroxyForwardHeaders session arm', () => {
     assert.equal('x-troxy-tool-sandbox' in headers, false);
   });
 });
+
+describe('interceptor fails open on invalid header values', () => {
+  const openServers = [];
+  after(async () => {
+    openServers.forEach(s => s.close());
+  });
+
+  it('handles API key with trailing newline gracefully without crashing', async () => {
+    // Simulates daemon.js config loading a key with a trailing newline,
+    // before the trim fix. The interceptor must fail open, not crash.
+    const targetServer = net.createServer((socket) => {
+      socket.write('HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK');
+      socket.end();
+    });
+    await new Promise(r => targetServer.listen(0, '127.0.0.1', r));
+    openServers.push(targetServer);
+    const targetPort = targetServer.address().port;
+
+    const interceptor = createInterceptor({
+      interceptHosts: ['api.anthropic.com'],
+      routeResolver: (host, method, reqPath) => {
+        if (host === 'api.anthropic.com') {
+          return { method, path: '/v1/messages', upstream: `http://127.0.0.1:${targetPort}` };
+        }
+        return null;
+      },
+      // Return a key with trailing newline - simulates the bug before daemon.js trim
+      getTroxyKey: () => 'txy-test-key\n',
+      getCerts: () => null, // No TLS for this test, it goes straight to HTTP upstream
+      log: () => {},
+    });
+    await new Promise(r => interceptor.listen(0, '127.0.0.1', r));
+    openServers.push(interceptor);
+
+    // Make a request through the proxy to the anthropic host
+    // The invalid header should cause a catch in _relayToTroxy, which should
+    // settle(false) to fail open, not crash the server.
+    const response = await new Promise((resolve, reject) => {
+      const req = net.createConnection(
+        { host: '127.0.0.1', port: interceptor.address().port },
+        () => {
+          req.write('GET / HTTP/1.1\r\nHost: api.anthropic.com\r\nConnection: close\r\n\r\n');
+        }
+      );
+      let body = '';
+      req.on('data', (chunk) => { body += chunk.toString(); });
+      req.on('end', () => resolve(body));
+      req.on('error', reject);
+    });
+
+    // Verify we got a response (either direct relay or error response),
+    // and the server didn't crash
+    assert.ok(response.length > 0, 'should get a response, not crash');
+  });
+});