troxy-cli 1.4.8 → 1.4.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.4.8",
+  "version": "1.4.10",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/api.js

@@ -52,8 +52,9 @@ export const api = {
   createToken:  (jwt, b)  => request('POST',   '/tokens',        { jwt, body: b }),
   revokeToken:  (jwt, id) => request('DELETE', `/tokens/${id}`,  { jwt }),
 
-  // Evaluate (agent API key)
+  // Evaluate + confirm (agent API key)
   evaluate: (body, apiKey) => request('POST', '/evaluate', { apiKey, body }),
+  confirmPayment: (auditId, body, apiKey) => request('POST', `/payments/${auditId}/confirm`, { apiKey, body }),
 
   // MCP heartbeat (agent API key)
   mcpHeartbeat: (apiKey, agentName) => request('POST', '/mcp/heartbeat', { apiKey, body: agentName ? { agent_name: agentName } : undefined }),

package/src/mcp-server.js

@@ -6,6 +6,7 @@ import {
 } from '@modelcontextprotocol/sdk/types.js';
 import { loadConfig }      from './config.js';
 import { evaluatePayment, api } from './api.js';
+const confirmPayment = (auditId, body, apiKey) => api.confirmPayment(auditId, body, apiKey);
 
 export async function runMcp() {
   const config    = loadConfig();
@@ -30,13 +31,49 @@ export async function runMcp() {
         'If the decision is BLOCK, abort the transaction and inform the user. ' +
         'If the decision is ESCALATE, the response includes an approval_token. Wait for the user to approve, then call evaluate_payment again with the same payment details PLUS the approval_token field. The second call will return ALLOW without re-escalating. ' +
         'If the decision is NOTIFY, proceed but the user will be notified. ' +
-        'When calling evaluate_payment, use the merchant\'s domain name as merchant_name when available (e.g. "amazon.com", "indigobloom.co.il") — this ensures consistent matching against policies.',
+        'When calling evaluate_payment, use the merchant\'s domain name as merchant_name when available (e.g. "amazon.com", "indigobloom.co.il") — this ensures consistent matching against policies. ' +
+        'After every ALLOW or NOTIFY decision, attempt the payment, then call confirm_payment with the audit_id and the outcome (success/failed/cancelled). Always include a reason when the charge fails.',
     },
     { capabilities: { tools: {} } },
   );
 
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: [
+      {
+        name: 'confirm_payment',
+        description:
+          'Report the actual outcome of a payment attempt to Troxy. ' +
+          'Call this after every ALLOW or NOTIFY decision, once you know whether the charge succeeded or failed. ' +
+          'This is required for accurate audit logs — without it, approved payments show as unconfirmed.',
+        inputSchema: {
+          type: 'object',
+          required: ['audit_id', 'status'],
+          properties: {
+            audit_id: {
+              type: 'string',
+              description: 'The audit_id returned by evaluate_payment',
+            },
+            status: {
+              type: 'string',
+              enum: ['success', 'failed', 'cancelled'],
+              description: 'Outcome of the charge attempt',
+            },
+            provider: {
+              type: 'string',
+              enum: ['stripe', 'paypal', 'other'],
+              description: 'Payment provider used (optional, defaults to "other")',
+            },
+            provider_transaction_id: {
+              type: 'string',
+              description: 'Provider transaction ID, e.g. Stripe pi_xxx (optional)',
+            },
+            reason: {
+              type: 'string',
+              description: 'Reason for failure or cancellation, e.g. "card declined", "iframe blocked", "timeout" (optional but recommended on failure)',
+            },
+          },
+        },
+      },
       {
         name: 'evaluate_payment',
         description:
@@ -77,11 +114,31 @@ export async function runMcp() {
   }));
 
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    if (request.params.name !== 'evaluate_payment') {
-      throw new Error(`Unknown tool: ${request.params.name}`);
+    const toolName = request.params.name;
+    const args = request.params.arguments ?? {};
+
+    if (toolName === 'confirm_payment') {
+      const { audit_id, status, provider, provider_transaction_id, reason } = args;
+      try {
+        await confirmPayment(audit_id, { status, provider, provider_transaction_id, reason }, apiKey);
+        const detail = provider_transaction_id ? ` Transaction ID: ${provider_transaction_id}.` : '';
+        const why    = reason ? ` Reason: ${reason}.` : '';
+        return {
+          content: [{ type: 'text', text: `✓ Payment outcome recorded: ${status}.${detail}${why} (audit: ${audit_id})` }],
+          isError: false,
+        };
+      } catch (err) {
+        return {
+          content: [{ type: 'text', text: `Troxy confirm_payment error: ${err.message}` }],
+          isError: true,
+        };
+      }
+    }
+
+    if (toolName !== 'evaluate_payment') {
+      throw new Error(`Unknown tool: ${toolName}`);
     }
 
-    const args   = request.params.arguments ?? {};
     if (agentName && !args.agent) args.agent = agentName;
     const result = await evaluatePayment(args, apiKey);
 
@@ -97,16 +154,16 @@ export async function runMcp() {
 
     switch (decision) {
       case 'ALLOW':
-        text = `✓ Payment approved.${policy ? ` Policy matched: "${policy}".` : ''} (audit: ${audit_id})`;
+        text = `✓ Payment approved.${policy ? ` Policy matched: "${policy}".` : ''} (audit: ${audit_id})\n\nAfter the charge attempt completes, call confirm_payment with audit_id "${audit_id}" and status "success", "failed", or "cancelled".`;
         break;
       case 'BLOCK':
         text = `✗ Payment blocked by policy "${policy}". Do not proceed with this payment. (audit: ${audit_id})`;
         break;
       case 'ESCALATE':
-        text = `⏳ Payment requires human approval — a request has been sent to the account owner. Do not proceed until approved.\n\nApproval token: ${approval_token}\n\nOnce the owner approves, call evaluate_payment again with the same payment details and include approval_token: "${approval_token}" to proceed. (audit: ${audit_id})`;
+        text = `⏳ Payment requires human approval — a request has been sent to the account owner. Do not proceed until approved.\n\nApproval token: ${approval_token}\n\nWait for the owner to approve in the Troxy dashboard, then tell me "I approved it" or "continue" so I can proceed. Once you do, I will call evaluate_payment again with the same payment details and approval_token: "${approval_token}". (audit: ${audit_id})`;
         break;
       case 'NOTIFY':
-        text = `✓ Payment approved with notification. Policy matched: "${policy}". (audit: ${audit_id})`;
+        text = `✓ Payment approved with notification. Policy matched: "${policy}". (audit: ${audit_id})\n\nAfter the charge attempt completes, call confirm_payment with audit_id "${audit_id}" and status "success", "failed", or "cancelled".`;
         break;
       default:
         text = JSON.stringify(result);