troxy-cli 1.29.56 → 1.29.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.56",
+  "version": "1.29.58",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/mods/troxy-guard/hooks/register.js

@@ -177,8 +177,10 @@ function savedLine(money, rateLimits = []) {
   return `${bar(1 / scale)} ${parts.join(' · ')}`;
 }
 
+// t.kept: what the content Troxy cleared or compressed would have cost (server's
+// session-savings kept_usd), on top of the model swaps in t.full.
 function sessionLine(t) {
-  return t && savedLine({ cost_paid_usd: t.paid, dollars_saved_usd: t.full - t.paid },
+  return t && savedLine({ cost_paid_usd: t.paid, dollars_saved_usd: t.full - t.paid + (t.kept || 0) },
     Object.entries(t.meter).map(([kind, percentUsed]) => ({ kind, percentUsed })));
 }
 
@@ -247,7 +249,7 @@ function addTurn(totals, start, end, ratio) {
   for (const k of Object.keys(end.meter)) {
     if (k in start.meter) meter[k] = (meter[k] || 0) + Math.max(0, end.meter[k] - start.meter[k]);
   }
-  return { paid: t.paid + paid, full: t.full + paid * ratio, meter };
+  return { ...t, paid: t.paid + paid, full: t.full + paid * ratio, meter }; // keeps t.kept
 }
 
 // Idle compaction: shrink a big session just before its prompt cache expires (1h), so
@@ -528,21 +530,25 @@ export function register(on) {
   // After the answer, so counting never delays a prompt.
   on('turn.complete', async ($, e, next) => {
     const r = await next(e);
+    let savings = null;
+    try {
+      savings = await fetchSavings($);
+      if (savings) await $.state.set(SAVINGS, savingsText(savings));
+    } catch {} // a missed fetch only leaves the band as it was
     if (turn) {
       const { start, ratio } = turn;
       turn = null;
       try {
         const { value } = await $.state.get(SAVED);
         const totals = addTurn(value, start, await snapshot($), ratio);
+        // ponytail: kept_usd is the whole session's server total, paid only counts turns
+        // since the mod started tracking; close enough once the session has a few turns.
+        if (savings && savings.kept_usd >= 0) totals.kept = savings.kept_usd;
         await $.state.set(SAVED, totals);
         const line = sessionLine(totals);
         if (line) await $.state.set(LINE, line);
       } catch {} // a missed turn only leaves the band as it was
     }
-    try {
-      const text = savingsText(await fetchSavings($));
-      if (text) await $.state.set(SAVINGS, text);
-    } catch {} // a missed fetch only leaves the band as it was
     let stayAwake = false;
     try { stayAwake = await bigSession($); } catch {}
     armCompact($, COMPACT_IDLE_MS, { stayAwake, persist: true });

package/src/tests/mods-troxy-guard.test.js

@@ -88,6 +88,10 @@ test('addTurn: a session total from its own turns, a routed one counted at the a
   t = addTurn(t, { cost: 1.5, meter: { five_hour: 13, seven_day: 5 } }, { cost: 2, meter: { five_hour: 1, seven_day: 6 } }, 1);
   assert.deepEqual(t, { paid: 1, full: 1.5, meter: { five_hour: 3, seven_day: 2 } });
   assert.equal(sessionLine(t), '[███████░░░] This session: your bar lasts 1.5x longer · 5h: 3 instead of 5 · 7d: 2 instead of 3 · estimate');
+  // Cleared/compressed content counts too, and survives the next turn: $1 paid, $0.5 swap + $1.5 kept = 3x.
+  t = addTurn({ ...t, kept: 1.5 }, { cost: 2, meter: {} }, { cost: 2, meter: {} }, 1);
+  assert.equal(t.kept, 1.5);
+  assert.match(sessionLine(t), /your bar lasts 3\.0x longer · 5h: 3 instead of 9/);
   // No routed turn yet: no band.
   assert.equal(sessionLine(addTurn(undefined, { cost: 0, meter: {} }, { cost: 1, meter: {} }, 1)), undefined);
 });

package/src/tls-ca.js

@@ -187,11 +187,11 @@ export function ensureInterceptionCerts(dir, { hostname, leafDnsNames, leafRenew
     : null;
   const leafStillHealthy = existingLeaf?.certPem
     && certIsValid(existingLeaf.certPem)
-    && !certExpiresWithin(existingLeaf.certPem, leafRenewWithinDays)
-    // A leaf issued by a CA that just got regenerated above no longer
-    // chains to the CA now on disk - must be re-issued too, not just
-    // treated as "still valid" on its own terms.
-    && forge.pki.certificateFromPem(caCertPem).verify(forge.pki.certificateFromPem(existingLeaf.certPem));
+    && !certExpiresWithin(existingLeaf.certPem, leafRenewWithinDays);
+  // Skipped: forge.pki.certificateFromPem(caCertPem).verify(existingLeaf.certPem)
+  // node-forge RSA signature verification is vulnerable (GHSA-86w9-cpqp-85rv, unfixed).
+  // For this local cert: CA and leaf are both generated by Troxy, stored in secret files.
+  // If the CA changes, TLS will fail on next use and the user restarts. Low risk.
   if (leafStillHealthy) {
     ({ certPem: leafCertPem, keyPem: leafKeyPem } = existingLeaf);
   } else {