troxy-cli 1.29.7 → 1.29.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.7",
+  "version": "1.29.9",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/init.js

@@ -10,6 +10,7 @@ import { ensureInterceptionCerts } from './tls-ca.js';
 import { enabledProviders, interceptHostsFor } from './providers.js';
 import { probePort } from './proxy.js';
 import { launchdUserDomain } from './launchd.js';
+import { reclaimOwnership } from './sudo-ownership.js';
 
 // Re-point every consumer of the API key (MCP client configs, the background service /
 // systemd env file / launchd plist, OpenClaw) at `key`. Shared by runInit and rotate-key
@@ -142,6 +143,19 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null)
     console.log(`  Background service  ✗  (${err.message})`);
     console.log('  You can start it manually with: troxy daemon &');
   }
+
+  // Sudo safety net, not part of the normal (unprivileged) flow's own
+  // correctness - see sudo-ownership.js's own docstring. A no-op unless
+  // this whole process is running elevated via sudo (e.g. `sudo troxy
+  // update`, the CLI's own suggested remedy for a permission-denied
+  // global npm install), in which case everything reprovisionKeyConsumers
+  // just wrote under ~/.troxy (config, TLS interception certs) and the
+  // LaunchAgent plist would otherwise be left root-owned - unreadable by
+  // the daemon, which always runs as the normal user.
+  reclaimOwnership([
+    path.join(os.homedir(), '.troxy'),
+    path.join(os.homedir(), 'Library/LaunchAgents/ai.troxy.mcp.plist'),
+  ]);
 }
 
 const AGENTS_START = '<!-- troxy:start -->';

package/src/launchd.js

@@ -22,11 +22,21 @@
 // bootstrap into their own domain the same way. Works correctly either
 // way, unlike load/unload.
 //
-// user/<uid>, not gui/<uid>: troxy's daemon needs no GUI/Aqua session, and
-// troxy explicitly targets "your laptop, a server, a VM" (see the CLI's
-// own README) - a server or VM may have no GUI login at all, where
-// gui/<uid> would fail outright. user/<uid> exists as soon as the user is
-// logged in at all, GUI or headless SSH-only alike.
+// gui/<uid>, NOT user/<uid> - corrected 2026-09-12 after shipping user/<uid>
+// first and getting this wrong in practice: a real, normal (non-sudo)
+// `troxy update` run then failed with "Bootstrap failed: 5: Input/output
+// error" bootstrapping into user/501. `man launchctl` confirms why - gui
+// and user are DISCRETE domains with their own separate sets of services
+// (not two names for the same thing), and Apple's own canonical example in
+// that same man page loads a per-user service into gui/<uid>, not
+// user/<uid>. The original reasoning for user/<uid> (a server/VM might
+// have no GUI login) doesn't actually apply here: this whole branch is
+// darwin-only, and a Mac running Troxy for Claude Desktop already requires
+// an active GUI session for Claude Desktop itself to run at all - the
+// "headless Mac" case this was trying to additionally support isn't a
+// real configuration for this specific daemon. Lesson: this got shipped
+// on man-page reading plus reasoning about what SHOULD work, not on
+// checking a real bootstrap call - the second attempt fixed that.
 
 /**
  * The launchd domain-target to bootstrap/bootout ai.troxy.mcp.plist into -
@@ -40,5 +50,5 @@
  */
 export function launchdUserDomain(env = process.env, getuid = () => process.getuid?.()) {
   const uid = env.SUDO_UID || String(getuid() ?? '');
-  return `user/${uid}`;
+  return `gui/${uid}`;
 }

package/src/sudo-ownership.js

@@ -0,0 +1,81 @@
+// Found live 2026-09-12, a broader version of the incident launchd.js fixes
+// (same trigger, different subsystem): `sudo troxy update` - the CLI's own
+// suggested remedy for a permission-denied global npm install (see
+// bin/troxy.js's EACCES handling) - runs the WHOLE process as root. In this
+// user's sudo session $HOME was preserved (not reset to root's own home),
+// so every path resolved correctly to the real user's ~/.troxy - but every
+// file written there (most importantly the TLS interception certs
+// tls-ca.js generates, mode 0600/0700) was still created ROOT-OWNED,
+// because the writing PROCESS's effective UID was 0, regardless of which
+// directory it happened to be writing into.
+//
+// The daemon later runs as the normal user (by design - see
+// installService's own plist, which never sets a UserName key, so launchd
+// runs it as whoever loaded it) and cannot read 0600/0700 files it
+// doesn't own. Real, observed failure: the local TLS-intercepting proxy
+// silently failed to bind at all, and every Anthropic call configured to
+// route through it got a bare connection-refused - completely invisible
+// until someone went looking, because installService's own try/catch
+// only ever sees "the daemon started", never "the daemon can actually do
+// its job". The user's own fix was `sudo chown -R` back to themselves;
+// this reclaims that automatically instead of requiring it after the
+// fact.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * {uid, gid} of the user sudo invoked as - SUDO_UID/SUDO_GID are what sudo
+ * itself sets to the REAL invoking user, never the elevated (0/root) one
+ * process.getuid() reports once elevated. Returns null when this process
+ * isn't running elevated via sudo at all: a normal, unprivileged run (the
+ * overwhelmingly common case, where nothing here needs to do anything),
+ * or root running with no sudo wrapper and thus no real user on record to
+ * hand ownership back to - never guessed at.
+ */
+export function realUserIds(env = process.env, getuid = () => process.getuid?.()) {
+  if (getuid() !== 0) return null;
+  if (!env.SUDO_UID) return null;
+  const uid = Number(env.SUDO_UID);
+  const gid = Number(env.SUDO_GID ?? env.SUDO_UID);
+  if (!Number.isInteger(uid) || !Number.isInteger(gid)) return null;
+  return { uid, gid };
+}
+
+function _chownRecursive(target, uid, gid) {
+  let stat;
+  try {
+    stat = fs.lstatSync(target);
+  } catch {
+    return; // doesn't exist - nothing to reclaim
+  }
+  try { fs.chownSync(target, uid, gid); } catch { /* best-effort, see below */ }
+  if (stat.isDirectory()) {
+    let entries = [];
+    try { entries = fs.readdirSync(target); } catch { return; }
+    for (const entry of entries) _chownRecursive(path.join(target, entry), uid, gid);
+  }
+}
+
+/**
+ * Recursively reclaims ownership of every given path back to the real
+ * user, when (and only when) this process is running elevated via sudo -
+ * a complete no-op otherwise. Never throws: every failure mode here
+ * (a path that doesn't exist, a permission quirk on one file deep in a
+ * tree) is worth trying the next path over, never worth failing the
+ * command that already did its real job. This is purely defensive
+ * cleanup for the sudo case; it is never load-bearing for the normal,
+ * far more common unprivileged run.
+ */
+export function reclaimOwnership(paths, env = process.env, getuid = () => process.getuid?.()) {
+  const real = realUserIds(env, getuid);
+  if (!real) return;
+  for (const p of paths) {
+    try {
+      _chownRecursive(p, real.uid, real.gid);
+    } catch {
+      // Never let reclaiming ownership of one path stop another, or
+      // surface as a failure of whatever real operation just ran.
+    }
+  }
+}

package/src/tests/launchd.test.js

@@ -23,17 +23,17 @@ const uninstallSrc = readFileSync(join(__dirname, '..', 'uninstall.js'), 'utf8')
 describe('launchdUserDomain', () => {
   it('uses SUDO_UID when running under sudo, ignoring the elevated (root) uid', () => {
     const domain = launchdUserDomain({ SUDO_UID: '501' }, () => 0);
-    assert.equal(domain, 'user/501');
+    assert.equal(domain, 'gui/501');
   });
 
   it('falls back to the caller\'s own uid when not running under sudo', () => {
     const domain = launchdUserDomain({}, () => 501);
-    assert.equal(domain, 'user/501');
+    assert.equal(domain, 'gui/501');
   });
 
   it('prefers SUDO_UID even if somehow both are present', () => {
     const domain = launchdUserDomain({ SUDO_UID: '501' }, () => 0);
-    assert.notEqual(domain, 'user/0');
+    assert.notEqual(domain, 'gui/0');
   });
 
   it('never throws when getuid is unavailable (e.g. non-POSIX platform)', () => {

package/src/tests/sudo-ownership.test.js

@@ -0,0 +1,104 @@
+// Found live 2026-09-12: `sudo troxy update` (the CLI's own suggested
+// remedy for a permission-denied global npm install) runs the whole
+// re-provisioning flow as root. Every file it wrote under ~/.troxy - most
+// importantly the TLS interception certs - was created root-owned even
+// though the path correctly resolved to the real user's home. The daemon
+// (always run as the normal user) couldn't read its own 0600/0700 cert
+// files afterward, and the local interceptor silently failed to bind -
+// every Anthropic call routed through it got connection-refused. See
+// sudo-ownership.js's own docstring for the full incident and fix.
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+import { realUserIds, reclaimOwnership } from '../sudo-ownership.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const initSrc = readFileSync(join(__dirname, '..', 'init.js'), 'utf8');
+
+describe('realUserIds', () => {
+  it('returns the real uid/gid when running elevated via sudo', () => {
+    const ids = realUserIds({ SUDO_UID: '501', SUDO_GID: '20' }, () => 0);
+    assert.deepEqual(ids, { uid: 501, gid: 20 });
+  });
+
+  it('falls back to SUDO_UID for the gid when SUDO_GID is absent', () => {
+    const ids = realUserIds({ SUDO_UID: '501' }, () => 0);
+    assert.deepEqual(ids, { uid: 501, gid: 501 });
+  });
+
+  it('returns null when not running as root at all - nothing to reclaim', () => {
+    assert.equal(realUserIds({ SUDO_UID: '501' }, () => 501), null);
+  });
+
+  it('returns null when running as root with no sudo wrapper - no real user on record', () => {
+    assert.equal(realUserIds({}, () => 0), null);
+  });
+
+  it('never throws when getuid is unavailable', () => {
+    assert.doesNotThrow(() => realUserIds({}, () => undefined));
+  });
+});
+
+describe('reclaimOwnership', () => {
+  let dir;
+  beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-reclaim-')); });
+  afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+
+  it('is a complete no-op when not running elevated via sudo', () => {
+    const target = path.join(dir, 'file.txt');
+    fs.writeFileSync(target, 'x');
+    const before = fs.statSync(target);
+    assert.doesNotThrow(() => reclaimOwnership([target], {}, () => before.uid));
+    // Unchanged - never even attempts a chown outside the sudo case.
+    assert.equal(fs.statSync(target).uid, before.uid);
+  });
+
+  it('never throws for a path that does not exist', () => {
+    assert.doesNotThrow(() =>
+      reclaimOwnership([path.join(dir, 'nope')], { SUDO_UID: '501' }, () => 0));
+  });
+
+  it('never throws when chownSync itself would fail (e.g. no real permission in this test env)', () => {
+    // This test process is almost never actually root, so a real chown to
+    // an arbitrary uid will fail - the whole point is that reclaimOwnership
+    // swallows that rather than throwing, matching this file's "best-effort,
+    // never blocks the real operation" contract.
+    const target = path.join(dir, 'file.txt');
+    fs.writeFileSync(target, 'x');
+    assert.doesNotThrow(() =>
+      reclaimOwnership([target], { SUDO_UID: '501', SUDO_GID: '20' }, () => 0));
+  });
+
+  it('walks into a directory when given one, not just its top level', () => {
+    const sub = path.join(dir, 'sub');
+    fs.mkdirSync(sub);
+    fs.writeFileSync(path.join(sub, 'nested.txt'), 'x');
+    // Same "must not throw even though this test isn't really root" shape
+    // as above - the real assertion is that recursion happens at all,
+    // which a thrown error partway through would otherwise mask.
+    assert.doesNotThrow(() =>
+      reclaimOwnership([dir], { SUDO_UID: '501', SUDO_GID: '20' }, () => 0));
+  });
+});
+
+describe('reprovisionKeyConsumers: reclaims ownership after sudo (source inspection)', () => {
+  it('calls reclaimOwnership after installService, covering ~/.troxy and the LaunchAgent plist', () => {
+    const fnStart = initSrc.indexOf('export async function reprovisionKeyConsumers');
+    assert.ok(fnStart !== -1, 'reprovisionKeyConsumers not found');
+    const installIdx = initSrc.indexOf('installService(key, agentName)', fnStart);
+    const reclaimIdx = initSrc.indexOf('reclaimOwnership(', fnStart);
+    assert.ok(installIdx !== -1 && reclaimIdx !== -1);
+    assert.ok(reclaimIdx > installIdx,
+      'ownership must be reclaimed after installService has written the plist, not before');
+    const fnBody = initSrc.slice(fnStart, reclaimIdx + 400);
+    assert.match(fnBody, /\.troxy/);
+    assert.match(fnBody, /LaunchAgents\/ai\.troxy\.mcp\.plist/);
+  });
+});