troxy-cli 1.4.20 → 1.4.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.4.20",
+  "version": "1.4.22",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/config.js

@@ -14,6 +14,12 @@ export function loadConfig() {
 }
 
 export function saveConfig(data) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2));
+  // Owner-only permissions on dir + file — matches what AWS CLI does with
+  // ~/.aws/credentials. Stops other users on the same machine from reading
+  // the API key. mkdirSync's `mode` is only honoured for newly-created dirs,
+  // so we chmod afterwards too to also fix existing pre-secured installs.
+  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(CONFIG_DIR, 0o700); } catch {}
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(CONFIG_FILE, 0o600); } catch {}
 }

package/src/policies.js

@@ -13,7 +13,7 @@ function _scope(p) {
 const HELP = {
   list:         `  troxy policies list\n\n  Lists all policies in your account with their action, scope, status, and conditions.\n`,
   describe:     `  troxy policies describe --name <policy-name>\n\n  Shows full details for a single policy.\n\n  Options:\n    --name   Name of the policy (use single quotes for names with special chars)\n`,
-  create:       `  troxy policies create --name <name> --action <action> [options]\n\n  Creates a new policy. Login required.\n\n  Required:\n    --name     Policy name\n    --action   ALLOW, BLOCK, NOTIFY, or ESCALATE\n\n  Optional conditions:\n    --field      Field to match: amount, merchant_name, merchant_category,\n                 merchant_country, currency, agent_name, hour, day_of_week\n    --operator   eq, neq, gt, gte, lt, lte, contains, between\n    --value      Comparison value (e.g. 500, amazon, Monday)\n    --value2     Upper bound for 'between' operator\n\n  Priority:\n    --priority <n>   Explicit priority number (default: auto, max+10)\n                     Lower number = higher priority (evaluated first).\n\n  Scope:\n    --mcp <name>   Scope policy to a specific MCP only (default: all MCPs)\n                   Run 'troxy mcps list' to see MCP names.\n\n  Examples:\n    troxy policies create --name "Block large" --action BLOCK --field amount --operator gte --value 500\n    troxy policies create --name "Block Amazon" --action BLOCK --field merchant_name --operator contains --value amazon\n    troxy policies create --name "Cap spend" --action BLOCK --mcp "My Laptop" --field amount --operator gte --value 200\n    troxy policies create --name "Allow Wiki" --action ALLOW --priority 5 --field merchant_name --operator contains --value Wiki\n`,
+  create:       `  troxy policies create --name <name> --action <action> [options]\n\n  Creates a new policy. Login required.\n\n  Required:\n    --name     Policy name\n    --action   ALLOW, BLOCK, NOTIFY, or ESCALATE\n\n  Optional conditions:\n    --field      Field to match: amount, merchant_name, tx_per_day\n    --operator   eq, neq, gt, gte, lt, lte, contains, starts_with, not_contains, between\n    --value      Comparison value (e.g. 500, amazon)\n    --value2     Upper bound for 'between' operator\n\n  Priority:\n    --priority <n>   Explicit priority number (default: auto, max+10)\n                     Lower number = higher priority (evaluated first).\n\n  Scope:\n    --mcp <name>   Scope policy to a specific MCP only (default: all MCPs)\n                   Run 'troxy mcps list' to see MCP names.\n\n  Examples:\n    troxy policies create --name "Block large" --action BLOCK --field amount --operator gte --value 500\n    troxy policies create --name "Block Amazon" --action BLOCK --field merchant_name --operator contains --value amazon\n    troxy policies create --name "Cap volume" --action BLOCK --field tx_per_day --operator gt --value 20\n    troxy policies create --name "Allow Wiki" --action ALLOW --priority 5 --field merchant_name --operator contains --value Wiki\n`,
   'set-priority': `  troxy policies set-priority --name <policy-name> --priority <n>\n\n  Changes the priority of a policy. Lower number = higher priority (evaluated first).\n\n  Options:\n    --name       Name of the policy\n    --priority   New priority number (e.g. 10, 20, 50)\n\n  Example:\n    troxy policies set-priority --name "Block Wiki" --priority 5\n`,
   enable:       `  troxy policies enable --name <policy-name>\n\n  Enables a disabled policy.\n\n  Options:\n    --name   Name of the policy to enable\n`,
   disable:      `  troxy policies disable --name <policy-name>\n\n  Disables a policy without deleting it.\n\n  Options:\n    --name   Name of the policy to disable\n`,
@@ -89,12 +89,28 @@ export async function runPolicies([sub, ...args], flags) {
         console.error('  --action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n');
         process.exit(1);
       }
+      const VALID_FIELDS = ['amount', 'merchant_name', 'tx_per_day'];
+      const FIELD_OPERATORS = {
+        amount:        ['lt', 'lte', 'gt', 'gte', 'eq', 'between'],
+        merchant_name: ['eq', 'neq', 'contains', 'not_contains', 'starts_with'],
+        tx_per_day:    ['lt', 'lte', 'gt', 'gte'],
+      };
       const conditions = [];
       if (flags.field) {
+        if (!VALID_FIELDS.includes(flags.field)) {
+          console.error(`  --field must be one of: ${VALID_FIELDS.join(', ')}\n`); process.exit(1);
+        }
         if (!flags.operator) { console.error('  --operator is required with --field\n'); process.exit(1); }
-        const cond = { field: flags.field, operator: flags.operator };
-        if (flags.value)  cond.value  = flags.value;
-        if (flags.value2) cond.value2 = flags.value2;
+        const validOps = FIELD_OPERATORS[flags.field];
+        if (!validOps.includes(flags.operator)) {
+          console.error(`  --operator for ${flags.field} must be one of: ${validOps.join(', ')}\n`); process.exit(1);
+        }
+        if (flags.value == null) { console.error('  --value is required with --field\n'); process.exit(1); }
+        if (flags.operator === 'between' && flags.value2 == null) {
+          console.error('  --value2 is required with --operator between\n'); process.exit(1);
+        }
+        const cond = { field: flags.field, operator: flags.operator, value: flags.value };
+        if (flags.value2 != null) cond.value2 = flags.value2;
         conditions.push(cond);
       }