troxy-cli 1.29.65 → 1.30.0

package/LICENSE

@@ -0,0 +1,17 @@
+Copyright (c) 2026 Troxy. All rights reserved.
+
+This software is proprietary. You may install and run it only to use the
+Troxy service under your Troxy account, and only while your account is active.
+
+You may not copy, modify, distribute, sublicense, sell, or create derivative
+works from this software or any part of it, or use it to build a competing
+product or service, without prior written permission from Troxy.
+
+Versions published before this notice were released under the MIT License;
+that license continues to apply to those versions only.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL TROXY BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY ARISING FROM THE SOFTWARE OR ITS USE.
+
+Contact: support@troxy.io

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.65",
+  "version": "1.30.0",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {
@@ -44,5 +44,5 @@
     "payments",
     "secrets"
   ],
-  "license": "MIT"
+  "license": "SEE LICENSE IN LICENSE"
 }

package/src/init.js

@@ -3,7 +3,7 @@ import os             from 'os';
 import path           from 'path';
 import readline       from 'readline';
 import { execSync, execFileSync } from 'child_process';
-import { saveConfig } from './config.js';
+import { loadConfig, saveConfig } from './config.js';
 import { evaluatePayment, api } from './api.js';
 import { INTERCEPTOR_PORT } from './daemon.js';
 import { ensureInterceptionCerts } from './tls-ca.js';
@@ -201,18 +201,7 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null,
       }
     }
     if (hasClaude) {
-      // Terminal used to get base-URL substitution (maybeEnableClaudeCodeProxy)
-      // here - found live 2026-09-07 that it silently bills the org's own
-      // pay-as-you-go API key for every terminal call, since substituting
-      // ANTHROPIC_AUTH_TOKEN with a Troxy token means no real Anthropic
-      // credential ever reaches model-proxy. This now reuses the same
-      // interception mechanism already live for Desktop (see
-      // patchClaudeCodeInterception below) instead: terminal keeps its own
-      // real login, Troxy watches the traffic on its way to Anthropic.
-      // Desktop-only machines are unaffected by this call (hasDesktop is
-      // not part of the gate here) - they still use the existing manual
-      // `troxy proxy enable --experimental` path.
-      await maybeEnableTroxyInterception(proxyOptIn, hasDesktop);
+      await useDirectAnthropic();
     }
     console.log('\n  Restart your MCP client to activate Troxy.');
   }
@@ -589,8 +578,8 @@ export async function runInit({ key, name, proxy, concise } = {}) {
     // MOD installation is optional - init succeeds even if it fails
   }
 
-  console.log('\n  Your payments are now protected.');
-  console.log('  Dashboard → https://dash.troxy.io');
+  console.log('\n  Troxy is on. Restart Claude Code, then work as usual.');
+  console.log('  Your savings → https://dash.troxy.io (Usage and Savings)');
   console.log('\n  For more information, visit https://docs.troxy.io\n');
 }
 
@@ -1036,67 +1025,22 @@ export function migrateBaseUrlProxyToInterception(configPath) {
   return true;
 }
 
-// Terminal's counterpart to the desktop app's already-shipped
-// interception path. See the call site above for why terminal moved off
-// base-URL substitution. Same proxyOptIn semantics as the retired
-// maybeEnableClaudeCodeProxy: true = enable without asking, null + TTY =
-// ask interactively, otherwise skip (a scripted/CI init must never hang
-// on a prompt).
-async function maybeEnableTroxyInterception(proxyOptIn, hasDesktop, configPath = claudeCodeSettingsPath()) {
-  // Unconditional, regardless of what's decided below: a machine still on
-  // the old base-URL substitution keys is actively mischarging the org's
-  // API balance right now, and leaving that in place is strictly worse
-  // than falling back to no Troxy visibility for terminal at all.
+async function useDirectAnthropic(configPath = claudeCodeSettingsPath()) {
   const migrated = migrateBaseUrlProxyToInterception(configPath);
   if (migrated) {
     console.log('    • Removed the old Troxy proxy setup for terminal (was billing your org\'s API key instead of your subscription)');
   }
-
-  if (interceptionIsConfigured(configPath)) return; // already set up correctly, nothing to ask
-
-  // No auto-started background service on Windows yet (installService throws
-  // there), so pointing Claude Code at 127.0.0.1 would break every call
-  // after a reboot. Policies still work; the engine waits for Windows support.
-  if (process.platform === 'win32') {
-    console.log('\n  The Troxy engine (lighter Claude Code requests) is not available on');
-    console.log('  Windows yet. Policies work. Mac and Linux get the engine today.');
-    return;
-  }
-
-  let enable = proxyOptIn === true;
-  if (proxyOptIn === null && process.stdin.isTTY) {
-    console.log("\n  Turn on the Troxy engine? Claude Code's requests go through Troxy and");
-    console.log('  are made lighter, so your usage goes further. Your normal Claude login');
-    console.log('  (subscription or API key) still');
-    console.log('  pays - Troxy never substitutes its own credential. Troxy does see your');
-    console.log('  real credential in transit, forwarded upstream to actually make the');
-    console.log('  call to Anthropic on your behalf.');
-    console.log('  How: Troxy generates a certificate authority ON THIS MACHINE');
-    console.log('  (~/.troxy/tls/). The private key never leaves this computer and is');
-    console.log('  never sent to Troxy. It is locked to api.anthropic.com only and is');
-    console.log('  NOT installed in your system keychain, only referenced by Claude Code.');
-    if (hasDesktop) {
-      console.log('  This also covers the Claude desktop app\'s Code tab (same setting).');
-    }
-    console.log('  Remove any time with: troxy proxy disable');
-    const answer = await prompt('  Enable? (y/N): ');
-    enable = /^y(es)?$/i.test(answer);
-  }
-  if (!enable) return;
-
-  try {
-    const troxyDir = path.join(os.homedir(), '.troxy');
-    ensureInterceptionCerts(troxyDir, { hostname: os.hostname(), leafDnsNames: interceptHostsFor(enabledProviders()) });
-    patchClaudeCodeInterception(configPath);
-    console.log(`    • Claude Code model proxy (cost optimization)  ✓`);
-    const bound = await probePort(INTERCEPTOR_PORT);
-    if (!bound) {
-      console.log(`    ⚠  Nothing is listening on 127.0.0.1:${INTERCEPTOR_PORT} yet - restart the`);
-      console.log('       background service (`troxy restart`) so Claude Code can connect.');
-    }
-  } catch (err) {
-    console.log(`    • Claude Code model proxy  ✗  (${err.message})`);
+  // A Claude subscription's login token must never leave this machine: Anthropic's
+  // Claude Code terms forbid a third party from intermediating it. So Claude Code
+  // talks to Anthropic directly; the troxy-guard mod does the routing and reports
+  // request metadata (reportUsage) for the dashboard. Older installs sent traffic
+  // through the local interceptor to Troxy's proxy: undo that here, on init and on
+  // every `troxy update`. API-key users can still opt in: `troxy proxy enable`.
+  if (interceptionIsConfigured(configPath)) {
+    unpatchClaudeCodeInterception(configPath);
+    console.log('    • Claude Code now talks to Anthropic directly, your Claude login stays on this machine  ✓');
   }
+  saveConfig({ ...(loadConfig() || {}), reportUsage: true });
 }
 
 // Detects Claude Code the same way the daemon detects OpenClaw: by whether

package/src/interceptor.js

@@ -361,6 +361,14 @@ async function _handleInterceptedRequest(req, res, { routeResolver, getTroxyKey,
   }
 
   const route = routeResolver(targetHost, req.method, req.url);
+  // A Claude subscription login (Authorization header) never goes to Troxy's
+  // proxy: Anthropic's terms forbid a third party from intermediating it. Only
+  // API-key requests (x-api-key) are relayed; everything else goes straight to
+  // Anthropic, and the troxy-guard mod reports its metadata instead.
+  if (route && req.headers.authorization) {
+    _relayToRealHost(targetHost, targetPort, req, res, body, log, lookup, ca);
+    return;
+  }
   if (route) {
     const troxyKey = getTroxyKey();
     if (troxyKey) {

package/src/mods/troxy-guard/hooks/register.js

@@ -192,25 +192,79 @@ function savingsText(s) {
 
 // This session's savings from the server, or null when there is no key, no session id or
 // the call fails (the band then keeps what it showed).
+// The Troxy key and setup from ~/.troxy/config.json (TROXY_API_KEY wins for the key).
+async function troxyConfig($) {
+  let cfg = {};
+  try {
+    const home = await $.env.get('HOME');
+    if (home) cfg = JSON.parse(await $.fs.read(`${home}/.troxy/config.json`)) || {};
+  } catch {}
+  return { ...cfg, apiKey: (await $.env.get('TROXY_API_KEY')) || cfg.apiKey };
+}
+
+async function troxyFetch($, url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try { return await $.http.fetch(url, { ...init, signal: controller.signal }); }
+  finally { clearTimeout(timer); }
+}
+
 async function fetchSavings($) {
   const sid = await $.session.id();
   if (!/^[A-Za-z0-9-]{8,64}$/.test(String(sid))) return null;
-  let key = await $.env.get('TROXY_API_KEY');
-  if (!key) {
-    const home = await $.env.get('HOME');
-    if (!home) return null;
-    key = JSON.parse(await $.fs.read(`${home}/.troxy/config.json`)).apiKey;
+  const { apiKey } = await troxyConfig($);
+  if (!apiKey) return null;
+  const res = await troxyFetch($, `https://api.troxy.io/mcp/session-savings?session_id=${sid}`, { headers: { 'x-troxy-key': apiKey } });
+  return res.ok ? JSON.parse(res.text) : null;
+}
+
+// Usage reporting. A Claude subscription's login token must never leave the Mac
+// (Anthropic's Claude Code terms), so in that setup Claude Code talks to Anthropic
+// directly and the mod reports each request's metadata instead: model, token counts,
+// usage-bar readings, routing arm. Never prompt or response text. Only when
+// `troxy init` set reportUsage: through the proxy, the proxy already logs each call.
+const REPORT_URL = 'https://api.troxy.io/mcp/usage-report';
+const REPORT_MAX_ROWS = 200; // the endpoint's cap per report
+const REPORT_KEEP_ROWS = 1000; // kept for the next try while Troxy is unreachable
+let pending = [];
+let compacting = false;
+
+function reportRow({ sid, usage, requested, arm, cold, score, compact, rateLimits }) {
+  const rl = {};
+  for (const w of rateLimits || []) {
+    if (!WINDOW_LABEL[w.kind]) continue;
+    const at = typeof w.resetsAt === 'number' ? new Date(w.resetsAt).toISOString() : w.resetsAt;
+    rl[w.kind] = { percent_used: w.percentUsed, resets_at: at };
   }
-  if (!key) return null;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-  try {
-    const res = await $.http.fetch(`https://api.troxy.io/mcp/session-savings?session_id=${sid}`, {
-      headers: { 'x-troxy-key': key }, signal: controller.signal,
+  return {
+    session_id: String(sid), model: usage.model, model_requested: requested || usage.model,
+    arm: arm || null, switch: arm ? (cold ? 'cold' : 'warm') : null, score: score == null ? null : score,
+    compact: Boolean(compact), input_tokens: usage.input_tokens, output_tokens: usage.output_tokens,
+    cache_read_tokens: usage.cache_read_input_tokens, cache_creation_tokens: usage.cache_creation_input_tokens,
+    rate_limits: rl,
+  };
+}
+
+async function noteStep($, result, meta) {
+  const usage = result && result.usage;
+  if (!usage || !usage.model) return;
+  let rateLimits = [];
+  try { rateLimits = (await $.session.usage()).rateLimits; } catch {}
+  pending.push(reportRow({ ...meta, sid: await $.session.id(), usage, compact: compacting, rateLimits }));
+  if (pending.length > REPORT_KEEP_ROWS) pending = pending.slice(-REPORT_KEEP_ROWS);
+}
+
+async function flushReport($) {
+  if (!pending.length) return;
+  const { apiKey, reportUsage } = await troxyConfig($);
+  if (!reportUsage || !apiKey) { pending = []; return; }
+  while (pending.length) {
+    const rows = pending.slice(0, REPORT_MAX_ROWS);
+    const res = await troxyFetch($, REPORT_URL, {
+      method: 'POST', headers: { 'content-type': 'application/json', 'x-troxy-key': apiKey }, body: JSON.stringify({ rows }),
     });
-    return res.ok ? JSON.parse(res.text) : null;
-  } finally {
-    clearTimeout(timer);
+    if (!res.ok && res.status >= 500) return; // kept for the next turn
+    pending = pending.slice(rows.length); // sent, or refused as invalid: never resent
   }
 }
 
@@ -339,8 +393,9 @@ async function idleCompact($, { late = false } = {}) {
   const file = modRouteFile($.plugin.root, await $.session.id());
   if (file) { lastNote = null; await $.fs.write(file, JSON.stringify({ compact: true, ts: await $.clock.now() })); }
   let r;
+  compacting = true;
   try { r = await $.session.compact({ instructions: COMPACT_INSTRUCTIONS }); }
-  finally { if (file) await $.fs.write(file, '{}'); }
+  finally { compacting = false; if (file) await $.fs.write(file, '{}'); }
   if (r.skip) return;
   const k = n => `${Math.round(n / 1000)}k`;
   await $.state.set(COMPACTED, { at: await $.clock.now(), text: r.tokensBefore && r.tokensAfter
@@ -451,11 +506,22 @@ function stepModel({ arm, requested, switched, cold, score, warm }) {
 
 async function* routeStep($, e, next) {
   // Main loop only: a subagent keeps whatever model it was given.
-  if (e.agentId) return yield* next(e);
+  if (e.agentId) {
+    const result = yield* next(e);
+    try { await noteStep($, result, { requested: e.model, arm: await $.store.get(`arm:${await $.session.id()}`), cold: false }); } catch {}
+    return result;
+  }
   const sid = await $.session.id();
   const now = await $.clock.now();
-  let { value: arm } = await $.state.get(ARM);
-  if (!arm) { arm = Math.random() < MOD_HOLDOUT_FRACTION ? 'holdout' : 'treated'; await $.state.set(ARM, arm); }
+  // The arm is kept on disk per session: $.state is per process, so every `claude -p` step,
+  // resume and restart re-rolled the 10% holdout and pinned most sessions to the requested model.
+  let arm = null;
+  try { arm = await $.store.get(`arm:${sid}`); } catch {}
+  if (arm !== 'holdout' && arm !== 'treated') {
+    arm = Math.random() < MOD_HOLDOUT_FRACTION ? 'holdout' : 'treated';
+    try { await $.store.set(`arm:${sid}`, arm); } catch {}
+  }
+  await $.state.set(ARM, arm);
   const prev = lastAsked.get(sid);
   lastAsked.set(sid, e.model);
   const switched = Boolean(prev && prev !== e.model);
@@ -480,7 +546,9 @@ async function* routeStep($, e, next) {
   }
   try { await rememberAsked($, sid, want, model); } catch {} // a missed write only loses this on resume
   if (model !== want && turn) turn.ratio = PRICE[tierOf(want)] / PRICE[tierOf(model)];
-  return yield* next(model === e.model ? e : { ...e, model });
+  const result = yield* next(model === e.model ? e : { ...e, model });
+  try { await noteStep($, result, { requested: want, arm, cold: isCold, score: decision ? decision.score : null }); } catch {} // a missed row only thins the dashboard
+  return result;
 }
 
 export function register(on) {
@@ -529,6 +597,7 @@ export function register(on) {
   // After the answer, so counting never delays a prompt.
   on('turn.complete', async ($, e, next) => {
     const r = await next(e);
+    try { await flushReport($); } catch {} // unsent rows wait for the next turn
     let savings = null;
     try {
       savings = await fetchSavings($);
@@ -554,4 +623,4 @@ export function register(on) {
 }
 
 // Exported for tests only - not part of the mod's runtime contract.
-export const _internal = { askedFor, rememberAsked, asked, armCompact, cancelCompact, toDomainAndFields, guardBash, failClosed, parseScore, asRequest, pickModel, troxyCommand, modRouteFile, estimateTokens, MODELS, savedLine, sessionLine, addTurn, withKept, statusText, compactPlan, savingsText, fetchSavings, scorePrompt, routeStep, stepModel, lastSent };
+export const _internal = { reportRow, noteStep, flushReport, pendingRows: () => pending, troxyConfig, askedFor, rememberAsked, asked, armCompact, cancelCompact, toDomainAndFields, guardBash, failClosed, parseScore, asRequest, pickModel, troxyCommand, modRouteFile, estimateTokens, MODELS, savedLine, sessionLine, addTurn, withKept, statusText, compactPlan, savingsText, fetchSavings, scorePrompt, routeStep, stepModel, lastSent };

package/src/proxy.js

@@ -22,6 +22,7 @@ import {
 import { ensureInterceptionCerts, certIsValid, certExpiresWithin } from './tls-ca.js';
 import { enabledProviders, interceptHostsFor } from './providers.js';
 import { INTERCEPTOR_PORT } from './daemon.js';
+import { loadConfig, saveConfig } from './config.js';
 
 const TROXY_DIR = path.join(os.homedir(), '.troxy');
 
@@ -115,9 +116,10 @@ export async function runProxyEnable(flags = {}) {
   any other site - and it is never installed in your system keychain, only
   referenced by Claude Code itself.
 
-  \`troxy init\` already offers this for terminal Claude Code automatically.
-  This command is for a desktop-only machine (no terminal \`claude\`), or to
-  reconfigure by hand. --experimental is required as an explicit
+  For Claude API keys only. A Claude subscription login (Pro, Max) is never
+  sent to Troxy: Anthropic's terms forbid it, so those requests always go
+  straight to Anthropic, and \`troxy init\` sets that up by default. With a
+  subscription, leave this off. --experimental is required as an explicit
   acknowledgment.
 
   Remove any time with: troxy proxy disable
@@ -157,6 +159,8 @@ export async function runProxyEnable(flags = {}) {
   process.stdout.write('  Writing ~/.claude/settings.json...   ');
   try {
     patchClaudeCodeInterception(settingsPath);
+    // The proxy logs these calls itself; the mod reporting them too would count each twice.
+    saveConfig({ ...(loadConfig() || {}), reportUsage: false });
     console.log('✓');
   } catch (err) {
     console.log('✗');
@@ -190,6 +194,7 @@ export function runProxyDisable() {
   process.stdout.write('\n  Removing HTTPS_PROXY / NODE_EXTRA_CA_CERTS from settings.json...  ');
   try {
     unpatchClaudeCodeInterception(settingsPath);
+    saveConfig({ ...(loadConfig() || {}), reportUsage: true }); // the mod reports again
     console.log('✓\n');
   } catch (err) {
     console.log('✗');

package/src/tests/interceptor.test.js

@@ -383,7 +383,7 @@ describe('createInterceptor - integration, real sockets', () => {
     const result = await httpsOverConnectedSocket(rawSocket, {
       servername: 'api.anthropic.com', ca: [ca.certPem],
       method: 'POST', path: '/v1/messages?beta=true',
-      headers: { authorization: 'Bearer sk-ant-oat01-realtoken', 'content-type': 'application/json' },
+      headers: { 'x-api-key': 'sk-ant-api03-realkey', 'content-type': 'application/json' },
       body: '{"model":"claude-sonnet-5"}',
     });
 
@@ -398,7 +398,7 @@ describe('createInterceptor - integration, real sockets', () => {
       // ran" without checking the dashboard for a decision_source row.
       `expected a "routed ... to troxy" confirmation log line, got: ${JSON.stringify(logLines)}`,
     );
-    assert.equal(troxyRequests[0].headers['x-troxy-upstream-authorization'], 'Bearer sk-ant-oat01-realtoken');
+    assert.equal(troxyRequests[0].headers['x-api-key'], 'sk-ant-api03-realkey');
     assert.equal(troxyRequests[0].body, '{"model":"claude-sonnet-5"}');
   });
 
@@ -440,6 +440,47 @@ describe('createInterceptor - integration, real sockets', () => {
       'the client\'s own credential must reach the real host unmodified');
   });
 
+  it('a Claude subscription login (Authorization) on a routed path never reaches Troxy - ' +
+     'it goes straight to the real host, untouched (Anthropic terms: no third party ' +
+     'may intermediate a subscription token)', async () => {
+    const troxyHits = [];
+    const troxyServer = await startStubHttpServer((req, res) => { troxyHits.push(req.url); res.end('{}'); });
+    openServers.push(troxyServer);
+    const ca = generateCA('test-host');
+    const leaf = generateLeaf(ca.certPem, ca.keyPem, ['api.anthropic.com']);
+
+    const realRequests = [];
+    const realServer = await startStubTlsServer(leaf.certPem, leaf.keyPem, (req, res) => {
+      realRequests.push({ url: req.url, headers: req.headers });
+      res.writeHead(200, {});
+      res.end('real-anthropic-response');
+    });
+    openServers.push(realServer);
+
+    const interceptor = createInterceptor({
+      interceptHosts: ['api.anthropic.com'],
+      routeResolver: () => ({ upstream: `http://127.0.0.1:${troxyServer.address().port}/v1/messages` }),
+      getTroxyKey: () => 'txy-test-key',
+      getCerts: () => ({ leafCertPem: leaf.certPem, leafKeyPem: leaf.keyPem }),
+      lookup: LOOPBACK_LOOKUP,
+      ca: [ca.certPem], // the interceptor's OWN outbound trust for reaching the stub "real host"
+    });
+    await new Promise(r => interceptor.listen(0, '127.0.0.1', r));
+    openServers.push(interceptor);
+
+    const rawSocket = await connectThroughProxy(interceptor.address().port, 'api.anthropic.com', realServer.address().port);
+    const result = await httpsOverConnectedSocket(rawSocket, {
+      servername: 'api.anthropic.com', ca: [ca.certPem],
+      method: 'GET', path: '/api/oauth/account/settings',
+      headers: { authorization: 'Bearer sk-ant-oat01-realtoken' },
+    });
+
+    assert.equal(result.statusCode, 200);
+    assert.equal(result.body, 'real-anthropic-response');
+    assert.equal(realRequests[0].headers.authorization, 'Bearer sk-ant-oat01-realtoken',
+      'the client\'s own credential must reach the real host unmodified');
+    assert.equal(troxyHits.length, 0, 'a subscription login must never be sent to Troxy');
+  });
   it('a host NOT on the intercept allowlist is a blind tunnel - the client\'s TLS ' +
      'terminates at the REAL destination\'s own certificate, never at Troxy\'s', async () => {
     // A completely unrelated CA/cert pair, standing in for a real site the
@@ -512,7 +553,7 @@ describe('createInterceptor - integration, real sockets', () => {
     const result = await httpsOverConnectedSocket(rawSocket, {
       servername: 'api.anthropic.com', ca: [ca.certPem],
       method: 'POST', path: '/v1/messages',
-      headers: { authorization: 'Bearer sk-ant-oat01-realtoken' }, body: '{}',
+      headers: { 'x-api-key': 'sk-ant-api03-realkey' }, body: '{}',
     });
 
     assert.equal(result.statusCode, 200);
@@ -553,7 +594,7 @@ describe('createInterceptor - integration, real sockets', () => {
     const result = await httpsOverConnectedSocket(rawSocket, {
       servername: 'api.anthropic.com', ca: [ca.certPem],
       method: 'POST', path: '/v1/messages',
-      headers: { authorization: 'Bearer sk-ant-oat01-realtoken' }, body: '{}',
+      headers: { 'x-api-key': 'sk-ant-api03-realkey' }, body: '{}',
     });
 
     assert.equal(result.statusCode, 200);
@@ -609,7 +650,7 @@ describe('createInterceptor - integration, real sockets', () => {
         const result = await httpsOverConnectedSocket(rawSocket, {
           servername: 'api.anthropic.com', ca: [ca.certPem],
           method: 'POST', path: '/v1/messages',
-          headers: { authorization: 'Bearer x' }, body: '{}',
+          headers: { 'x-api-key': 'sk-ant-api03-x' }, body: '{}',
         });
         assert.equal(result.statusCode, 200);
       }
@@ -670,7 +711,7 @@ describe('createInterceptor - integration, real sockets', () => {
     const result = await httpsOverConnectedSocket(rawSocket, {
       servername: 'api.anthropic.com', ca: [ca.certPem],
       method: 'POST', path: '/v1/messages',
-      headers: { authorization: 'Bearer sk-ant-oat01-realtoken' }, body: '{}',
+      headers: { 'x-api-key': 'sk-ant-api03-realkey' }, body: '{}',
     });
 
     assert.equal(result.statusCode, 200);

package/src/tests/mods-troxy-guard.test.js

@@ -161,7 +161,7 @@ function routingApi() {
   const sid = 'sess-' + Math.random().toString(36).slice(2, 10);
   return {
     state: { get: async (k) => ({ value: kv.get(k.key) }), set: async (k, v) => kv.set(k.key, v) },
-    store: { get: async () => undefined },
+    store: { get: async (k) => (String(k).startsWith('arm:') ? 'treated' : undefined) },
     session: { id: async () => sid, usage: async () => ({ context: { tokens: 1000 }, rateLimits: [] }) },
     plugin: { root: '/tmp/not-installed' },
     model: { complete: async () => ({ isAnswered: true, text: '0.1' }) },
@@ -196,6 +196,7 @@ test('routeStep: a new process (claude -p step, resume, restart) keeps the warm
     store: { get: async (k) => disk.get(k), set: async (k, v) => disk.set(k, v) },
     clock: { now: async () => now },
     model: { complete: async () => ({ isAnswered: true, text: score }) } };
+  disk.set(`arm:${await $.session.id()}`, 'treated');  // the arm is rolled once per session; pin it
   assert.equal(await runTurn($, M.opus), M.sonnet);  // cold start, easy prompt: sonnet
   lastSent.clear(); score = '0.95';                   // new process, hard prompt
   now += 10 * 60 * 1000;
@@ -204,6 +205,23 @@ test('routeStep: a new process (claude -p step, resume, restart) keeps the warm
   assert.equal(await runTurn($, M.opus), M.opus);    // 55+ min idle: cold, re-picked
 });
 
+test('routeStep: the holdout arm is rolled once per session, not once per process', async () => {
+  const { MODELS: M, lastSent } = _internal;
+  const disk = new Map();
+  const mk = () => { const a = routingApi(); return { ...a,
+    state: { get: async () => ({ value: undefined }), set: async () => {} }, // per-process state starts empty
+    session: { ...a.session, id: async () => 'one-session' },
+    store: { get: async (k) => disk.get(k), set: async (k, v) => disk.set(k, v) } }; };
+  const real = Math.random;
+  try {
+    Math.random = () => 0.5; // would be treated
+    assert.equal(await runTurn(mk(), M.opus), M.sonnet);
+    lastSent.clear();
+    Math.random = () => 0.01; // a re-roll would now be a holdout
+    assert.equal(await runTurn(mk(), M.opus), M.sonnet); // new process: arm read from disk, still treated
+  } finally { Math.random = real; }
+});
+
 test('stepModel: decide only at cold moments, hold in between, holdout never routes', () => {
   const { stepModel, MODELS: M } = _internal;
   const base = { arm: 'treated', requested: M.opus, switched: false, warm: M.haiku };
@@ -328,3 +346,59 @@ test('askedFor: a resumed session that reopens on the routed model is mapped bac
   assert.equal(await askedFor($, 's1', sonnet, true), sonnet); // the user's own /model wins
   assert.equal(await askedFor($, 's2', haiku, false), haiku);  // never routed: Haiku is the pick
 });
+
+test('usage report: each request is queued with model, tokens, bar and arm, then sent at turn end', async () => {
+  const { MODELS: M, routeStep, scorePrompt, flushReport, pendingRows } = _internal;
+  const posts = [];
+  const $ = { ...routingApi(),
+    session: { id: async () => 'report-sess-1', usage: async () => ({ context: { tokens: 1000 },
+      rateLimits: [{ kind: 'five_hour', percentUsed: 42, resetsAt: '2026-10-20T10:00:00Z' }, { kind: 'other', percentUsed: 1 }] }) },
+    env: { get: async (k) => (k === 'HOME' ? '/home/x' : undefined) },
+    fs: { write: async () => {}, read: async () => JSON.stringify({ apiKey: 'txy-test', reportUsage: true }) },
+    http: { fetch: async (url, init) => { posts.push({ url, init }); return { ok: true, status: 200 }; } } };
+  await scorePrompt($, { text: 'reply only ok', origin: { kind: 'composer' } }, async (e) => e);
+  const usage = { model: M.sonnet, input_tokens: 5, output_tokens: 7, cache_read_input_tokens: 900, cache_creation_input_tokens: 30 };
+  const gen = routeStep($, { model: M.opus }, async function* () { return { usage }; });
+  let step; do { step = await gen.next(); } while (!step.done);
+  assert.deepEqual(step.value, { usage });                 // the result is passed on unchanged
+  const row = pendingRows().at(-1);
+  assert.equal(row.model, M.sonnet); assert.equal(row.model_requested, M.opus);
+  assert.equal(row.arm, 'treated'); assert.equal(row.switch, 'cold'); assert.equal(row.cache_read_tokens, 900);
+  assert.deepEqual(row.rate_limits, { five_hour: { percent_used: 42, resets_at: '2026-10-20T10:00:00Z' } });
+  assert.equal(JSON.stringify(row).includes('reply only ok'), false); // never prompt text
+  await flushReport($);
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].url, 'https://api.troxy.io/mcp/usage-report');
+  assert.equal(posts[0].init.headers['x-troxy-key'], 'txy-test');
+  assert.equal(JSON.parse(posts[0].init.body).rows.at(-1).session_id, 'report-sess-1');
+  assert.equal(pendingRows().length, 0);
+});
+
+test('usage report: nothing is sent unless init turned reporting on (the proxy logs those calls)', async () => {
+  const { noteStep, flushReport, pendingRows } = _internal;
+  const posts = [];
+  const $ = { ...routingApi(),
+    env: { get: async () => '/home/x' },
+    fs: { read: async () => JSON.stringify({ apiKey: 'txy-test' }) },
+    http: { fetch: async () => { posts.push(1); return { ok: true }; } } };
+  await noteStep($, { usage: { model: 'claude-sonnet-5-5', input_tokens: 1 } }, { requested: 'claude-sonnet-5-5' });
+  assert.equal(pendingRows().length, 1);
+  await flushReport($);
+  assert.equal(posts.length, 0);
+  assert.equal(pendingRows().length, 0);
+});
+
+test('usage report: a server error keeps the rows for the next turn', async () => {
+  const { noteStep, flushReport, pendingRows } = _internal;
+  let status = 503;
+  const $ = { ...routingApi(),
+    env: { get: async () => '/home/x' },
+    fs: { read: async () => JSON.stringify({ apiKey: 'txy-test', reportUsage: true }) },
+    http: { fetch: async () => ({ ok: status < 400, status }) } };
+  await noteStep($, { usage: { model: 'claude-sonnet-5-5', input_tokens: 1 } }, {});
+  await flushReport($);
+  assert.equal(pendingRows().length, 1);
+  status = 200;
+  await flushReport($);
+  assert.equal(pendingRows().length, 0);
+});

package/src/tests/proxy-wiring.test.js

@@ -58,23 +58,22 @@ describe('reprovisionKeyConsumers: desktop detection gate', () => {
     assert.equal(_guardCondition('patchClaudeCodeConfig(claudeCodeConfigPath(), key)'), 'hasClaude');
   });
 
-  it('calls maybeEnableTroxyInterception (not the old base-URL substitution) gated on hasClaude alone', () => {
-    assert.equal(_guardCondition('await maybeEnableTroxyInterception(proxyOptIn, hasDesktop);'), 'hasClaude');
+  it('calls useDirectAnthropic (Claude Code talks to Anthropic directly) gated on hasClaude alone', () => {
+    assert.equal(_guardCondition('await useDirectAnthropic();'), 'hasClaude');
   });
 
   it('no longer calls maybeEnableClaudeCodeProxy from reprovisionKeyConsumers - terminal fully switched to interception', () => {
     assert.ok(!initSrc.includes('await maybeEnableClaudeCodeProxy'));
   });
 
-  it('maybeEnableTroxyInterception runs migration before the enable/proxyOptIn decision, so it always fires', () => {
-    const fnStart = initSrc.indexOf('async function maybeEnableTroxyInterception');
-    assert.ok(fnStart !== -1, 'maybeEnableTroxyInterception not found');
-    const fnBody = initSrc.slice(fnStart, fnStart + 2000);
-    const migrateIdx = fnBody.indexOf('migrateBaseUrlProxyToInterception(');
-    const optInIdx = fnBody.indexOf('proxyOptIn === true');
-    assert.ok(migrateIdx !== -1, 'migrateBaseUrlProxyToInterception call not found in function body');
-    assert.ok(optInIdx !== -1, 'proxyOptIn check not found in function body');
-    assert.ok(migrateIdx < optInIdx, 'migration must run unconditionally, before the enable/proxyOptIn decision');
+  it('useDirectAnthropic migrates old setups, removes interception and turns mod reporting on - never adds interception', () => {
+    const fnStart = initSrc.indexOf('async function useDirectAnthropic');
+    assert.ok(fnStart !== -1, 'useDirectAnthropic not found');
+    const fnBody = initSrc.slice(fnStart, initSrc.indexOf('\n}\n', fnStart));
+    assert.ok(fnBody.includes('migrateBaseUrlProxyToInterception('));
+    assert.ok(fnBody.includes('unpatchClaudeCodeInterception(configPath)'));
+    assert.ok(fnBody.includes('reportUsage: true'));
+    assert.ok(!/[^n]patchClaudeCodeInterception\(/.test(fnBody), 'must never route Claude Code through the interceptor');
   });
 });