troxy-cli 1.29.52 → 1.29.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.52",
+  "version": "1.29.54",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/daemon.js

@@ -23,7 +23,7 @@ import { api } from './api.js';
 import { createInterceptor } from './interceptor.js';
 import { enabledProviders, interceptHostsFor, troxyRouteFor } from './providers.js';
 import { ensureInterceptionCerts } from './tls-ca.js';
-import { migrateBaseUrlProxyToInterception, claudeCodeSettingsPath } from './init.js';
+import { migrateBaseUrlProxyToInterception, claudeCodeSettingsPath, refreshTroxyGuardMod } from './init.js';
 
 const INTERVAL_MS = 60_000;
 
@@ -139,6 +139,8 @@ export async function runDaemon() {
   process.on('unhandledRejection', (err) => {
     process.stderr.write(`[troxy-daemon] unhandled rejection (continuing): ${err?.stack || err}\n`);
   });
+  // A CLI upgrade (npm or troxy update) then a daemon restart brings the mod up to date.
+  refreshTroxyGuardMod().catch((err) => process.stderr.write(`[troxy-daemon] mod refresh failed: ${err.message}\n`));
 
   const cfg = loadConfig();
   if (!cfg?.apiKey) {

package/src/init.js

@@ -38,6 +38,18 @@ export async function installTroxyGuardMod(home = os.homedir(), detectFn = detec
   return true;
 }
 
+// Only `troxy init` used to install the mod, so a CLI upgrade left the old mod running.
+// Re-copy it when the installed one is stamped with a different CLI version; a machine
+// without the mod (never ran init, or uninstalled) is left alone.
+export async function refreshTroxyGuardMod(home = os.homedir(), detectFn = detectInstalledClaudeCodeVersion) {
+  const manifest = path.join(home, '.claude', 'skills', 'troxy-guard', '.claude-plugin', 'plugin.json');
+  let installed;
+  try { installed = JSON.parse(fs.readFileSync(manifest, 'utf8')).version; } catch { return false; }
+  const { version } = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
+  if (installed === version) return false;
+  return installTroxyGuardMod(home, detectFn);
+}
+
 export function uninstallTroxyGuardMod(home = os.homedir()) {
   fs.rmSync(path.join(home, '.claude', 'skills', 'troxy-guard'), { recursive: true, force: true });
 }
@@ -113,6 +125,7 @@ export async function refreshHostedInstructions(key) {
 
 export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null, conciseOptIn = null) {
   const platform = process.platform;
+  try { if (await refreshTroxyGuardMod()) console.log('    • Troxy model routing updated  ✓'); } catch {}
   const { detected, hasOpenClaw, hasClaude, none } = detectMcpClients();
 
   if (none) {

package/src/interceptor.js

@@ -118,9 +118,9 @@ function _readModRoute(dir, sessionId) {
     const arm = n.arm === 'treated' || n.arm === 'holdout' ? n.arm : null;
     const isFresh = Date.now() - n.ts < _MOD_ROUTE_MAX_AGE_MS;
     const routed = isFresh && typeof n.from === 'string' && typeof n.to === 'string';
-    return { arm, from: routed ? n.from : null, to: routed ? n.to : null, compact: isFresh && n.compact === true };
+    return { arm, from: routed ? n.from : null, to: routed ? n.to : null, compact: isFresh && n.compact === true, cold: isFresh && typeof n.cold === 'boolean' ? n.cold : null };
   } catch {
-    return { arm: null, from: null, to: null, compact: false };
+    return { arm: null, from: null, to: null, compact: false, cold: null };
   }
 }
 
@@ -183,6 +183,8 @@ export function buildTroxyForwardHeaders(incomingHeaders, troxyKey, sandboxState
   if (modRoute && modRoute.arm) headers['x-troxy-mod-arm'] = modRoute.arm;
   // The mod's idle compaction is in flight: this is its summary request.
   if (modRoute && modRoute.compact) headers['x-troxy-mod-compact'] = '1';
+  // Tagged: whether this request hit the cold or warm path (for measurement).
+  if (modRoute && typeof modRoute.cold === 'boolean') headers['x-troxy-switch'] = modRoute.cold ? 'cold' : 'warm';
   headers.authorization = `Bearer ${troxyKey}`;
   return headers;
 }

package/src/mods/troxy-guard/hooks/register.js

@@ -453,9 +453,10 @@ async function* routeStep($, e, next) {
   const h = held.get(sid) || { decision: null, prompts: 0 };
   const newPrompt = Boolean(decision) && decision !== h.decision;
   if (newPrompt) h.decision = decision;
+  const isCold = !ls || now - ls.at >= WARM_MS || coldNext.has(sid);
   const model = (await $.store.get('paused')) ? want : stepModel({
     arm, requested: want, switched,
-    cold: !ls || now - ls.at >= WARM_MS || coldNext.has(sid),
+    cold: isCold,
     score: decision ? decision.score : null, warm: ls && ls.model,
     newPrompt, heldPrompts: h.prompts, tokens: decision ? decision.tokens : Infinity,
   });
@@ -470,7 +471,8 @@ async function* routeStep($, e, next) {
   const key = `${sid}:${arm}:${want}>${model}`;
   if (file && lastNote !== key) {
     lastNote = key;
-    await $.fs.write(file, JSON.stringify(model === want ? { arm, ts: now } : { arm, from: want, to: model, ts: now }));
+    const route = model === want ? { arm, cold: isCold, ts: now } : { arm, from: want, to: model, cold: isCold, ts: now };
+    await $.fs.write(file, JSON.stringify(route));
   }
   try { await rememberAsked($, sid, want, model); } catch {} // a missed write only loses this on resume
   if (model !== want && turn) turn.ratio = PRICE[tierOf(want)] / PRICE[tierOf(model)];

package/src/tests/init-mods.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import os from 'node:os';
 import path from 'node:path';
 import fs from 'node:fs';
-import { installTroxyGuardMod, uninstallTroxyGuardMod } from '../init.js';
+import { installTroxyGuardMod, uninstallTroxyGuardMod, refreshTroxyGuardMod } from '../init.js';
 
 test('installTroxyGuardMod: copies the mod when the version supports it', async () => {
   const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-mod-home-'));
@@ -77,3 +77,20 @@ test('uninstallTroxyGuardMod: a no-op (not a throw) when nothing was installed',
     fs.rmSync(tmpHome, { recursive: true, force: true });
   }
 });
+
+test('refreshTroxyGuardMod: re-copies a stale mod, leaves a current or missing one alone', async () => {
+  const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-mod-home-'));
+  const cc = async () => ({ major: 2, minor: 1, patch: 289 });
+  const manifest = path.join(tmpHome, '.claude', 'skills', 'troxy-guard', '.claude-plugin', 'plugin.json');
+  try {
+    assert.equal(await refreshTroxyGuardMod(tmpHome, cc), false); // never installed: stays off
+    assert.equal(fs.existsSync(manifest), false);
+    await installTroxyGuardMod(tmpHome, cc);
+    assert.equal(await refreshTroxyGuardMod(tmpHome, cc), false); // already current
+    fs.writeFileSync(manifest, JSON.stringify({ name: 'troxy-guard', version: '0.0.1' }));
+    assert.equal(await refreshTroxyGuardMod(tmpHome, cc), true);  // stale: re-copied and re-stamped
+    assert.notEqual(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, '0.0.1');
+  } finally {
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+  }
+});