troxy-cli 1.4.3 → 1.4.5

package/bin/troxy.js

@@ -143,7 +143,9 @@ switch (command) {
 
   // ── Simulate a payment evaluation ────────────────────────────
   case 'pay': {
-    const apiKey   = requireKey(flags);
+    requireJwt();
+    const apiKey   = loadConfig()?.apiKey || process.env.TROXY_API_KEY;
+    if (!apiKey) { console.error('  No API key. Run: troxy init --key txy-...\n'); process.exit(1); }
     const merchant = flags.merchant;
     const amount   = parseFloat(flags.amount);
     const card     = flags.card || 'Work';
@@ -286,30 +288,37 @@ switch (command) {
   MCP setup (once per machine):  troxy init --key <api-key>
   Login for CLI commands (12h):  troxy login
 
-  MCP Setup
+  Setup (one time, API key required)
     troxy init --key <api-key>     Connect this machine as an MCP + save key
-    troxy rotate-key               Create new MCP key + save it
-    troxy rotate-key --revoke-old  Same + revoke the old key immediately
     troxy uninstall                Remove Troxy from this machine
-    troxy status                   API health + account overview
-    troxy pause                    Pause this MCP (blocks all payments until resumed)
-    troxy resume                   Resume this MCP after a pause
+    troxy status                   API health + MCP status (no login needed)
+
+  Everything else requires: troxy login
+
+  MCP
+    troxy pause                    Pause this MCP (blocks all payments)
+    troxy resume                   Resume this MCP
+    troxy mcps list                All MCPs in your account
+    troxy mcps rename --name "x"   Rename this machine's MCP
 
-  Inspect  (requires: troxy login)
+  Keys
+    troxy rotate-key               Create new MCP key + save it locally
+    troxy rotate-key --revoke-old  Same + revoke the old key immediately
+
+  Policies
     troxy policies list
     troxy policies describe --name "Block Amazon"
-    troxy mcps list
-    troxy mcps rename --name "new-name"
-    troxy activity [--limit 50] [--mine]
-    troxy insights [--period 7]
-
-  Manage  (requires: troxy login)
     troxy policies create --name "X" --action BLOCK --field amount --operator gte --value 500
+    troxy policies create --name "X" --action BLOCK --mcp "My Laptop"   (scoped to one MCP)
     troxy policies enable  --name "X"
     troxy policies disable --name "X"
     troxy policies delete  --name "X"
 
-  Simulate  (requires MCP key — run troxy init first)
+  Activity & insights
+    troxy activity [--limit 50] [--mine]
+    troxy insights [--period 7]
+
+  Simulate
     troxy pay --merchant "Amazon" --amount 50 --card "Work"
     troxy pay --merchant "Google" --amount 300 --card "Work" --category software
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/api.js

@@ -58,11 +58,18 @@ export const api = {
   // MCP heartbeat (agent API key)
   mcpHeartbeat: (apiKey, agentName) => request('POST', '/mcp/heartbeat', { apiKey, body: agentName ? { agent_name: agentName } : undefined }),
 
-  // MCP status / rename / pause / resume (agent API key)
-  mcpStatus:  (apiKey)       => request('GET',   '/mcp/status', { apiKey }),
-  mcpRename:  (apiKey, name) => request('PATCH', '/mcp/name',   { apiKey, body: { name } }),
-  mcpPause:  (apiKey) => request('POST', '/mcp/pause',  { apiKey }),
-  mcpResume: (apiKey) => request('POST', '/mcp/resume', { apiKey }),
+  // MCP status (agent API key — no login needed)
+  mcpStatus:  (apiKey) => request('GET', '/mcp/status', { apiKey }),
+
+  // MCP pause / resume / rename via JWT (requires troxy login)
+  pauseToken:  (jwt, id)       => request('POST',  `/tokens/${id}/pause`,  { jwt }),
+  resumeToken: (jwt, id)       => request('POST',  `/tokens/${id}/resume`, { jwt }),
+  renameToken: (jwt, id, name) => request('PATCH', `/tokens/${id}/name`,   { jwt, body: { name } }),
+
+  // MCP daemon endpoints (agent API key — used by MCP server only)
+  mcpPause:  (apiKey) => request('POST',  '/mcp/pause',  { apiKey }),
+  mcpResume: (apiKey) => request('POST',  '/mcp/resume', { apiKey }),
+  mcpRename: (apiKey, name) => request('PATCH', '/mcp/name', { apiKey, body: { name } }),
 
   // Agent read-only API (JWT session auth — run: troxy login)
   agentStatus:   (jwt)              => request('GET', '/agent/status',   { jwt }),

package/src/mcps.js

@@ -28,18 +28,16 @@ export async function runMcps([sub], flags) {
 
     case 'rename': {
       const name = flags.name;
-      if (!name) {
-        console.error('\n  Usage: troxy mcps rename --name "new-name"\n');
-        process.exit(1);
-      }
+      if (!name) { console.error('\n  Usage: troxy mcps rename --name "new-name"\n'); process.exit(1); }
+      const jwt = requireJwt();
       const config = loadConfig();
-      const apiKey = process.env.TROXY_API_KEY || config?.apiKey;
-      if (!apiKey) {
-        console.error('\n  No API key found. Run: troxy init --key txy-...\n');
-        process.exit(1);
-      }
+      const prefix = (config?.apiKey || '').substring(0, 11);
+      if (!prefix) { console.error('\n  No API key found. Run: troxy init --key txy-...\n'); process.exit(1); }
       process.stdout.write(`\n  Renaming MCP to "${name}"... `);
-      await api.mcpRename(apiKey, name);
+      const { tokens = [] } = await api.listTokens(jwt);
+      const tok = tokens.find(t => t.prefix === prefix);
+      if (!tok) { console.error('\nCould not find this machine\'s MCP. Run: troxy init --key txy-...\n'); process.exit(1); }
+      await api.renameToken(jwt, tok.id, name);
       saveConfig({ ...config, agentName: name });
       console.log('✓');
       console.log('  Dashboard and future heartbeats will use the new name.\n');

package/src/pause.js

@@ -1,25 +1,33 @@
 import { loadConfig } from './config.js';
+import { requireJwt } from './auth.js';
 import { api } from './api.js';
 
+async function _localTokenId(jwt, config) {
+  const prefix = (config?.apiKey || '').substring(0, 11);
+  if (!prefix) throw new Error('No API key found. Run: troxy init --key txy-...');
+  const { tokens = [] } = await api.listTokens(jwt);
+  const tok = tokens.find(t => t.prefix === prefix);
+  if (!tok) throw new Error('This machine\'s MCP key was not found in your account. Run: troxy init --key txy-...');
+  return tok.id;
+}
+
 export async function runPause() {
+  const jwt = requireJwt();
   const config = loadConfig();
-  const apiKey = process.env.TROXY_API_KEY || config?.apiKey;
-  if (!apiKey) {
-    console.error('No API key found. Run: npx troxy init --key txy-...');
-    process.exit(1);
-  }
-  await api.mcpPause(apiKey);
-  console.log('⏸  MCP paused. All payment evaluations will be blocked.');
-  console.log('   Run "troxy resume" to resume.');
+  process.stdout.write('\n  Pausing MCP... ');
+  const id = await _localTokenId(jwt, config);
+  await api.pauseToken(jwt, id);
+  console.log('✓');
+  console.log('  ⏸  All payment evaluations are now blocked.');
+  console.log('  Run "troxy resume" to resume.\n');
 }
 
 export async function runResume() {
+  const jwt = requireJwt();
   const config = loadConfig();
-  const apiKey = process.env.TROXY_API_KEY || config?.apiKey;
-  if (!apiKey) {
-    console.error('No API key found. Run: npx troxy init --key txy-...');
-    process.exit(1);
-  }
-  await api.mcpResume(apiKey);
-  console.log('▶  MCP resumed. Payment evaluations are active again.');
+  process.stdout.write('\n  Resuming MCP... ');
+  const id = await _localTokenId(jwt, config);
+  await api.resumeToken(jwt, id);
+  console.log('✓');
+  console.log('  ▶  Payment evaluations are active again.\n');
 }

package/src/policies.js

@@ -82,8 +82,30 @@ export async function runPolicies([sub, ...args], flags) {
         if (flags.value2) cond.value2 = flags.value2;
         conditions.push(cond);
       }
-      const policy = await api.createPolicy(jwt, { name, action, conditions, enabled: true });
-      console.log(`\n  Policy "${policy.name}" created ✓  (priority: ${policy.priority})\n`);
+
+      // --mcp <name>: scope policy to a specific MCP instead of all
+      let isGlobal = true;
+      let mcpIds = [];
+      if (flags.mcp) {
+        const { tokens = [] } = await api.listTokens(jwt);
+        const needle = flags.mcp.toLowerCase();
+        const match = tokens.find(t =>
+          (t.name  && t.name.toLowerCase()  === needle) ||
+          (t.agent_name && t.agent_name.toLowerCase() === needle) ||
+          (t.prefix && t.prefix.toLowerCase().startsWith(needle))
+        );
+        if (!match) {
+          console.error(`\n  MCP "${flags.mcp}" not found. Run: troxy mcps list\n`);
+          process.exit(1);
+        }
+        isGlobal = false;
+        mcpIds   = [match.id];
+        console.log(`\n  Scoping to MCP: ${match.name || match.agent_name || match.prefix}`);
+      }
+
+      const policy = await api.createPolicy(jwt, { name, action, conditions, enabled: true, global: isGlobal, mcp_ids: mcpIds });
+      const scope  = isGlobal ? 'all MCPs' : (policy.mcps?.[0]?.name || flags.mcp);
+      console.log(`\n  Policy "${policy.name}" created ✓  (priority: ${policy.priority}, scope: ${scope})\n`);
       break;
     }