troxy-cli 1.30.16 → 1.30.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.30.16",
+  "version": "1.30.18",
   "description": "Make your Claude Code usage go further: lighter requests, less usage, less money",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/action-classification.js

@@ -116,12 +116,10 @@ const RULES = [
       const paths = pathArgs(segment, 2).filter((w) => !w.startsWith('-'));
       return { action_verb: 'delete', resource: summarizeResource(paths, 'a branch'), item_count: 1 };
     }
-    if (/^git\s+push\b/.test(segment) && (/\s--delete\b/.test(segment) || /\s\S*:\S+/.test(segment))) {
-      // `git push origin :branch` (empty source = delete) and
-      // `git push origin local:branch` both use the same refspec shape;
-      // either way the part after the colon is the remote branch being
-      // touched, which is what matters here regardless of which it deletes.
-      const target = segment.match(/--delete\s+(\S+)/)?.[1] || segment.match(/\s\S*:(\S+)/)?.[1];
+    if (/^git\s+push\b/.test(segment) && (/\s--delete\b/.test(segment) || /\s:\S+/.test(segment))) {
+      // Only an empty source (`git push origin :branch`) deletes.
+      // `git push origin HEAD:main` is a normal push, not a delete.
+      const target = segment.match(/--delete\s+(\S+)/)?.[1] || segment.match(/\s:(\S+)/)?.[1];
       return { action_verb: 'delete', resource: target || 'a remote branch', item_count: 1 };
     }
     return null;

package/src/init.js

@@ -195,7 +195,7 @@ export async function reprovisionKeyConsumers(key, agentName, proxyOptIn = null,
         const installed = await installTroxyGuardMod();
         console.log(installed
           ? `    • Troxy model routing (terminal + Desktop)  ✓`
-          : `    • Troxy model routing  -  (needs Claude Code 2.1.287+, skipped)`);
+          : `    • Troxy model routing  ✗  NOT installed: needs Claude Code 2.1.287+ (run claude --version). Usage and Savings stays empty until it is.`);
       } catch (err) {
         console.log(`    • Troxy model routing  ✗  (${err.message})`);
       }
@@ -486,6 +486,11 @@ const MCP_CLIENTS = [
 ];
 
 export async function runInit({ key, name, proxy, concise } = {}) {
+  // Under sudo, os.homedir() can be root's, so the mod would land where Claude Code never looks.
+  if (process.env.SUDO_USER) {
+    console.error('\n  Run this without sudo: troxy init --key ...\n  (sudo is only for the install command.)\n');
+    process.exit(1);
+  }
   // undefined (flag never passed) -> null, so reprovisionKeyConsumers can
   // tell "not decided, ask interactively" apart from an explicit --proxy.
   const proxyOptIn = proxy === undefined ? null : Boolean(proxy);

package/src/tests/action-classification.test.js

@@ -86,6 +86,10 @@ describe('actionFor - git force push / branch delete', () => {
     assert.equal(bash('git push origin --delete old-feature').action_verb, 'delete');
     assert.equal(bash('git push origin :old-feature').action_verb, 'delete');
   });
+
+  it('does not treat a normal src:dst push as a delete', () => {
+    assert.equal(bash('git push -q origin HEAD:main'), null);
+  });
 });
 
 describe('actionFor - terraform / kubectl / docker / aws', () => {

package/src/tests/init-mods.test.js

@@ -1,3 +1,5 @@
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import os from 'node:os';
@@ -94,3 +96,10 @@ test('refreshTroxyGuardMod: re-copies a stale mod, leaves a current or missing o
     fs.rmSync(tmpHome, { recursive: true, force: true });
   }
 });
+
+test('init refuses to run under sudo, so the mod is not installed in root\'s home', () => {
+  const r = spawnSync(process.execPath, [fileURLToPath(new URL('../../bin/troxy.js', import.meta.url)), 'init', '--key', 'x'],
+    { env: { ...process.env, SUDO_USER: 'someone' }, encoding: 'utf8' });
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /without sudo/);
+});