troxy-cli 1.8.3 → 1.8.4

package/bin/troxy.js

@@ -8,7 +8,6 @@ import { loadConfig } from '../src/config.js';
 import { runPolicies }                 from '../src/policies.js';
 import { runMcps }                     from '../src/mcps.js';
 import { runActivity }                 from '../src/activity.js';
-import { runCards }                    from '../src/cards.js';
 import { runSettings }                 from '../src/settings.js';
 import { runChatBudget }               from '../src/chat-budget.js';
 import { runApprovals }                from '../src/approvals.js';
@@ -107,13 +106,15 @@ switch (command) {
     troxy rotate-key
     troxy rotate-key --name "My Agent Key"
 
-  After rotating: run troxy restart to apply the new key.
+  Automatically re-points MCP clients and the background service at the new key.
 `);
       process.exit(0);
     }
     const jwt = requireJwt();
     const { loadConfig, saveConfig } = await import('../src/config.js');
-    const oldKey    = loadConfig()?.apiKey;
+    const { reprovisionKeyConsumers } = await import('../src/init.js');
+    const existing  = loadConfig() || {};
+    const oldKey    = existing.apiKey;
     const oldPrefix = oldKey ? oldKey.substring(0, 11) : null;
     const name = flags.name || null; // keep existing name if not specified
 
@@ -123,11 +124,18 @@ switch (command) {
     const newPrefix = result.prefix;
     console.log('✓');
 
-    saveConfig({ apiKey: newKey });
+    // Merge, don't overwrite — saveConfig({apiKey}) alone used to drop agentName/notify.
+    saveConfig({ ...existing, apiKey: newKey });
     console.log('  Saved to ~/.troxy/config.json ✓');
 
+    // Re-point every real consumer (MCP client configs, the background service) at the new
+    // key BEFORE revoking the old one — otherwise every consumer, which holds the key via
+    // ENV rather than config.json, keeps presenting the now-revoked key and payment control
+    // goes down until the user thinks to re-run init. (H6)
+    await reprovisionKeyConsumers(newKey, existing.agentName || 'my-agent');
+
     if (oldPrefix) {
-      process.stdout.write(`  Revoking old key ${oldPrefix}... `);
+      process.stdout.write(`\n  Revoking old key ${oldPrefix}... `);
       const { tokens = [] } = await api.listTokens(jwt);
       const old = tokens.find(t => t.prefix === oldPrefix);
       if (old) { await api.revokeToken(jwt, old.id); console.log('✓'); }
@@ -142,8 +150,7 @@ switch (command) {
   New key (shown once, save it now):
     ${newKey}
 
-  ~/.troxy/config.json updated ✓
-  Run troxy restart to apply the new key.
+  ~/.troxy/config.json and all connected MCP clients / the background service updated ✓
 `);
     break;
   }
@@ -187,11 +194,10 @@ switch (command) {
     --amount <n>        Payment amount in USD
 
   Optional:
-    --card <alias>      Card alias (default: "Work")
     --category <cat>    Merchant category (e.g. travel, software, food)
     --no-confirm        Don't auto-confirm, leaves the row PENDING
     --fail              Confirm as a failed charge instead of success
-                        (simulates a declined card)
+                        (simulates a declined charge)
 
   Examples:
     troxy pay --merchant "Amazon" --amount 50
@@ -205,14 +211,13 @@ switch (command) {
     if (!apiKey) { console.error('  No API key. Run: troxy init --key txy-...\n'); process.exit(1); }
     const merchant = flags.merchant;
     const amount   = parseFloat(flags.amount);
-    const card     = flags.card || 'Work';
     const category = flags.category;
     const noConfirm = !!flags['no-confirm'];
     const failCharge = !!flags.fail;
     if (!merchant)    { console.error('  --merchant is required\n'); process.exit(1); }
     if (isNaN(amount)){ console.error('  --amount is required\n');   process.exit(1); }
     const agentName = loadConfig()?.agentName || 'troxy-cli';
-    const body = { card_alias: card, merchant_name: merchant, amount, agent: agentName };
+    const body = { merchant_name: merchant, amount, agent: agentName, source: 'troxy-cli' };
     if (category) body.merchant_category = category;
     const result = await api.evaluate(body, apiKey);
     const ICON = { ALLOW: '✓', BLOCK: '✗', ESCALATE: '⏳', NOTIFY: '~' };
@@ -232,7 +237,7 @@ switch (command) {
         await api.confirmPayment(result.audit_id, {
           status,
           provider: 'troxy-cli',
-          ...(failCharge ? { reason: 'simulated card decline (--fail)' } : {}),
+          ...(failCharge ? { reason: 'simulated declined charge (--fail)' } : {}),
         }, apiKey);
         console.log(`  confirmed: charge ${status}`);
       } catch (e) {
@@ -256,10 +261,6 @@ switch (command) {
     await runActivity(flags);
     break;
 
-  case 'cards':
-    await runCards(positional, flags);
-    break;
-
   case 'settings':
     await runSettings(positional, flags);
     break;
@@ -328,10 +329,9 @@ switch (command) {
     if (!sub || sub === 'policies') { await runPolicies(['list'], flags); break; }
     if (sub === 'mcps')             { await runMcps(['list'], flags);     break; }
     if (sub === 'activity')         { await runActivity(flags);           break; }
-    if (sub === 'cards')            { await runCards(['list'], flags);    break; }
     if (sub === 'approvals')        { await runApprovals(['list'], flags); break; }
     if (sub === 'secrets')          { await runSecrets(['list'], flags);  break; }
-    console.error(`  Unknown resource: ${sub}. Try: policies, mcps, activity, cards, approvals, secrets\n`);
+    console.error(`  Unknown resource: ${sub}. Try: policies, mcps, activity, approvals, secrets\n`);
     process.exit(1);
 
   // ── Status ────────────────────────────────────────────────────
@@ -543,12 +543,6 @@ switch (command) {
     troxy policies resume --name "X"
     troxy policies delete --name "X"
 
-  Cards
-    troxy cards list
-    troxy cards create --name "Work" --last4 1234 --budget 2000
-    troxy cards update --name "Work" --budget 3000
-    troxy cards delete --name "Work"
-
   Approvals (ESCALATE holds)
     troxy approvals list
     troxy approvals approve --id <id>
@@ -574,8 +568,8 @@ switch (command) {
     troxy insights [--period 7]
 
   Simulate
-    troxy pay --merchant "Amazon" --amount 50 --card "Work"
-    troxy pay --merchant "Google" --amount 300 --card "Work" --category software
+    troxy pay --merchant "Amazon" --amount 50
+    troxy pay --merchant "Google" --amount 300 --category software
 `);
     process.exit(command ? 1 : 0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/account.js

@@ -8,7 +8,7 @@ function prompt(question) {
 }
 
 const HELP = {
-  delete:     `  troxy account delete\n\n  PERMANENTLY deletes your Troxy account: all activity, policies, cards,\n  API keys, and the account itself. This cannot be undone. You'll be asked\n  to type your account email to confirm.\n`,
+  delete:     `  troxy account delete\n\n  PERMANENTLY deletes your Troxy account: all activity, policies,\n  API keys, and the account itself. This cannot be undone. You'll be asked\n  to type your account email to confirm.\n`,
   'clear-data': `  troxy account clear-data\n\n  Deletes all activity, policies, and pending approvals. Keeps your account\n  and API keys intact, so your MCP connections keep working.\n`,
 };
 
@@ -24,7 +24,7 @@ export async function runAccount([sub, ...args], flags) {
     case 'delete': {
       const s = await api.getSettings(jwt);
       console.log(`\n  This PERMANENTLY deletes your Troxy account (${s.email}):`);
-      console.log('  all activity, policies, cards, and API keys. This cannot be undone.\n');
+      console.log('  all activity, policies, and API keys. This cannot be undone.\n');
       const typed = await prompt(`  Type your account email to confirm: `);
       if (typed.trim().toLowerCase() !== s.email.toLowerCase()) {
         console.log('\n  Email did not match. Cancelled.\n');

package/src/api.js

@@ -31,12 +31,6 @@ export const api = {
   cliAuthorize:  (jwt, session_id)     => request('POST', '/auth/cli/authorize',  { jwt, body: { session_id } }),
   cliExchange:   (session_id, code)    => request('POST', '/auth/cli/exchange',   { body: { session_id, code } }),
 
-  // Cards
-  listCards:   (jwt)      => request('GET',    '/cards',    { jwt }),
-  createCard:  (jwt, b)   => request('POST',   '/cards',    { jwt, body: b }),
-  updateCard:  (jwt, id, b) => request('PUT',  `/cards/${id}`, { jwt, body: b }),
-  deleteCard:  (jwt, id)  => request('DELETE', `/cards/${id}`, { jwt }),
-
   // Policies
   listPolicies:  (jwt)       => request('GET',    '/dashboard/policies',        { jwt }),
   createPolicy:  (jwt, b)    => request('POST',   '/dashboard/policies',        { jwt, body: b }),
@@ -97,7 +91,6 @@ export const api = {
   agentStatus:   (jwt, tokenPrefix) => request('GET', `/agent/status${tokenPrefix ? `?token_prefix=${encodeURIComponent(tokenPrefix)}` : ''}`,   { jwt }),
   agentPolicies: (jwt, tokenPrefix) => request('GET', `/agent/policies${tokenPrefix ? `?token_prefix=${encodeURIComponent(tokenPrefix)}` : ''}`,  { jwt }),
   agentMcps:     (jwt, tokenPrefix) => request('GET', `/agent/mcps${tokenPrefix ? `?token_prefix=${encodeURIComponent(tokenPrefix)}` : ''}`,      { jwt }),
-  agentCards:    (jwt)              => request('GET', '/agent/cards',      { jwt }),
   agentActivity: (jwt, limit, mine, tokenPrefix) => request('GET', `/agent/activity?limit=${limit || 20}${mine ? `&mine=true&token_prefix=${encodeURIComponent(tokenPrefix || '')}` : ''}`, { jwt }),
   agentInsights: (jwt, period)      => request('GET', `/agent/insights?period=${period || 30}`, { jwt }),
 };

package/src/approvals.js

@@ -31,13 +31,12 @@ export async function runApprovals([sub, ...args], flags) {
       if (!approvals.length) { console.log('\n  No pending approvals.\n'); return; }
       console.log();
       table(
-        ['ID', 'Merchant', 'Amount', 'Agent', 'Card', 'Expires'],
+        ['ID', 'Merchant', 'Amount', 'Agent', 'Expires'],
         approvals.map(a => [
           a.id.slice(0, 8),
           a.merchant_name,
           `$${Number(a.amount).toFixed(2)} ${a.currency}`,
           a.agent_name,
-          a.card_name,
           new Date(a.expires_at).toLocaleString(),
         ]),
       );

package/src/auth.js

@@ -2,7 +2,7 @@ import fs       from 'fs';
 import os       from 'os';
 import path     from 'path';
 import readline from 'readline';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { api }  from './api.js';
 
 const SESSION_FILE = path.join(os.homedir(), '.troxy', 'session.json');
@@ -16,8 +16,13 @@ export function loadSession() {
 }
 
 export function saveSession(data) {
-  fs.mkdirSync(path.dirname(SESSION_FILE), { recursive: true });
-  fs.writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2));
+  // The session file holds a 12h full-authority JWT — lock it down like the API-key
+  // config (0600), not the default ~0644. writeFileSync's mode is ignored when the file
+  // already exists, so chmod explicitly after writing. (H5)
+  const dir = path.dirname(SESSION_FILE);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(SESSION_FILE, 0o600); } catch {}
 }
 
 export function clearSession() {
@@ -67,15 +72,27 @@ function loadConfig() {
   try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
 }
 
+// The login URL comes from the (unauthenticated) api.cliStart response, so treat it as
+// untrusted. Only https URLs are openable; even so we pass the URL as an argv element via
+// execFile (no shell) below, so metacharacters can never reach a shell. Exported for tests.
+export function isOpenableUrl(url) {
+  return typeof url === 'string' && /^https:\/\//i.test(url);
+}
+
 function _openBrowser(url) {
   const isHeadless = process.platform === 'linux'
     && !process.env.DISPLAY
     && !process.env.WAYLAND_DISPLAY;
   if (isHeadless) return;
-  const cmd = process.platform === 'darwin' ? `open "${url}"`
-            : process.platform === 'win32'  ? `start "" "${url}"`
-            : `xdg-open "${url}"`;
-  exec(cmd, () => {});
+  if (!isOpenableUrl(url)) return;  // (H4)
+  if (process.platform === 'darwin') {
+    execFile('open', [url], () => {});
+  } else if (process.platform === 'win32') {
+    // rundll32 opens a URL with no shell parsing of the argument.
+    execFile('rundll32', ['url.dll,FileProtocolHandler', url], () => {});
+  } else {
+    execFile('xdg-open', [url], () => {});
+  }
 }
 
 /** Device-code login flow — opens browser, user copies code back to CLI. */

package/src/init.js

@@ -6,6 +6,67 @@ import { execSync, execFileSync } from 'child_process';
 import { saveConfig } from './config.js';
 import { evaluatePayment, api } from './api.js';
 
+// Re-point every consumer of the API key (MCP client configs, the background service /
+// systemd env file / launchd plist, OpenClaw) at `key`. Shared by runInit and rotate-key
+// (H6): rotate-key used to write the new key only to config.json and then revoke the old
+// one immediately, so every real consumer — which holds the key via ENV, not config.json —
+// kept presenting the now-revoked key until the user manually re-ran init. Non-interactive
+// (no prompts), so it's safe to call from rotate-key with the existing agent name.
+export async function reprovisionKeyConsumers(key, agentName) {
+  const platform = process.platform;
+  const detected = MCP_CLIENTS.filter(c => {
+    const p = c.path[platform] ?? c.path.linux;
+    return fs.existsSync(p);
+  });
+
+  let hasOpenClaw = false;
+  try {
+    execSync('openclaw --version', { stdio: 'ignore' });
+    hasOpenClaw = true;
+  } catch {}
+
+  if (detected.length === 0 && !hasOpenClaw) {
+    console.log('\n  No MCP clients detected (Claude Desktop, Cursor, Windsurf, OpenClaw).');
+    console.log('  Troxy MCP server config:\n');
+    console.log(JSON.stringify(mcpEntry(key), null, 4));
+    console.log('\n  Add the above to your MCP client\'s config under "mcpServers".\n');
+  } else {
+    console.log('\n  MCP clients found:');
+    for (const client of detected) {
+      const configPath = client.path[platform] ?? client.path.linux;
+      try {
+        if (client.type === 'zed')      patchZedConfig(configPath, key);
+        else if (client.type === 'continue') patchContinueConfig(configPath, key);
+        else                            patchMcpConfig(configPath, key);
+        console.log(`    • ${client.name}  ✓`);
+      } catch (err) {
+        console.log(`    • ${client.name}  ✗  (${err.message})`);
+      }
+    }
+    if (hasOpenClaw) {
+      try {
+        const entry = JSON.stringify({ command: 'npx', args: ['troxy-cli', 'mcp'], env: { TROXY_API_KEY: key } });
+        // execFileSync passes args directly to the process (no shell), so the
+        // key can't break out of a quoted string and inject shell commands.
+        execFileSync('openclaw', ['mcp', 'set', 'troxy', entry], { stdio: 'ignore' });
+        console.log(`    • OpenClaw  ✓`);
+      } catch (err) {
+        console.log(`    • OpenClaw  ✗  (${err.message})`);
+      }
+    }
+    console.log('\n  Restart your MCP client to activate Troxy.');
+  }
+
+  console.log('\n  Setting up background service...');
+  try {
+    installService(key, agentName);
+    console.log('  Background service installed  ✓');
+  } catch (err) {
+    console.log(`  Background service  ✗  (${err.message})`);
+    console.log('  You can start it manually with: troxy daemon &');
+  }
+}
+
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise(resolve => rl.question(question, ans => { rl.close(); resolve(ans.trim()); }));
@@ -69,11 +130,11 @@ export async function runInit({ key } = {}) {
 
   console.log('\n  Troxy: AI payment control\n');
 
-  // Validate the key by hitting /evaluate (404 card = key is valid, TypeError = network failure)
+  // Validate the key by hitting /evaluate (404 = key is valid, TypeError = network failure)
   process.stdout.write('  Validating API key...  ');
   try {
     await evaluatePayment(
-      { agent: 'troxy-init', card_alias_name: '__ping__', amount: 0 },
+      { agent: 'troxy-init', amount: 0 },
       key,
     );
     console.log('✓');
@@ -90,7 +151,7 @@ export async function runInit({ key } = {}) {
       console.error('\n  Error: Invalid or revoked API key.\n');
       process.exit(1);
     }
-    // 404 (card not found) or any other API error = key is valid, API is up
+    // 404 or any other API error = key is valid, API is up
     console.log('✓');
   }
 
@@ -112,61 +173,7 @@ export async function runInit({ key } = {}) {
     // Non-fatal: the daemon's own heartbeat will retry this later.
   }
 
-  // Detect and patch MCP clients
-  const platform = process.platform;
-  const detected = MCP_CLIENTS.filter(c => {
-    const p = c.path[platform] ?? c.path.linux;
-    return fs.existsSync(p);
-  });
-
-  // Detect OpenClaw via CLI
-  let hasOpenClaw = false;
-  try {
-    execSync('openclaw --version', { stdio: 'ignore' });
-    hasOpenClaw = true;
-  } catch {}
-
-  if (detected.length === 0 && !hasOpenClaw) {
-    console.log('\n  No MCP clients detected (Claude Desktop, Cursor, Windsurf, OpenClaw).');
-    console.log('  Troxy MCP server config:\n');
-    console.log(JSON.stringify(mcpEntry(key), null, 4));
-    console.log('\n  Add the above to your MCP client\'s config under "mcpServers".\n');
-  } else {
-    console.log('\n  MCP clients found:');
-    for (const client of detected) {
-      const configPath = client.path[platform] ?? client.path.linux;
-      try {
-        if (client.type === 'zed')      patchZedConfig(configPath, key);
-        else if (client.type === 'continue') patchContinueConfig(configPath, key);
-        else                            patchMcpConfig(configPath, key);
-        console.log(`    • ${client.name}  ✓`);
-      } catch (err) {
-        console.log(`    • ${client.name}  ✗  (${err.message})`);
-      }
-    }
-    if (hasOpenClaw) {
-      try {
-        const entry = JSON.stringify({ command: 'npx', args: ['troxy-cli', 'mcp'], env: { TROXY_API_KEY: key } });
-        // execFileSync passes args directly to the process (no shell), so the
-        // key can't break out of a quoted string and inject shell commands.
-        execFileSync('openclaw', ['mcp', 'set', 'troxy', entry], { stdio: 'ignore' });
-        console.log(`    • OpenClaw  ✓`);
-      } catch (err) {
-        console.log(`    • OpenClaw  ✗  (${err.message})`);
-      }
-    }
-    console.log('\n  Restart your MCP client to activate Troxy.');
-  }
-
-  // Install background service so MCP server survives reboots
-  console.log('\n  Setting up background service...');
-  try {
-    installService(key, agentName);
-    console.log('  Background service installed  ✓');
-  } catch (err) {
-    console.log(`  Background service  ✗  (${err.message})`);
-    console.log('  You can start it manually with: troxy daemon &');
-  }
+  await reprovisionKeyConsumers(key, agentName);
 
   console.log('\n  Your payments are now protected.');
   console.log('  Dashboard → https://dash.troxy.io');

package/src/tests/auth.test.js

@@ -0,0 +1,27 @@
+import { test } from 'node:test';
+import assert from 'node:assert';
+
+import { isOpenableUrl } from '../auth.js';
+
+test('isOpenableUrl accepts plain https and rejects everything else (H4)', () => {
+  assert.equal(isOpenableUrl('https://dash.troxy.io/cli?code=abc'), true);
+
+  // Non-https schemes and non-strings are rejected outright, so a server-controlled
+  // login URL can never be handed to a shell. (Even an https URL is only ever passed as a
+  // single argv element to execFile, never through a shell.)
+  for (const bad of [
+    'http://x',
+    'file:///etc/passwd',
+    'javascript:alert(1)',
+    '$(curl evil.example)',
+    '`id`',
+    '; touch /tmp/pwned',
+    'ftp://x',
+    '',
+    null,
+    undefined,
+    42,
+  ]) {
+    assert.equal(isOpenableUrl(bad), false, `should reject: ${String(bad)}`);
+  }
+});

package/src/cards.js

@@ -1,107 +0,0 @@
-import { api }         from './api.js';
-import { requireJwt }  from './auth.js';
-import { table }       from './print.js';
-
-const HELP = {
-  list:   `  troxy cards list\n\n  Lists all cards (budget/spend aliases) on your account.\n`,
-  create: `  troxy cards create --name <name> --last4 <4 digits> [options]\n\n  Creates a new card alias. Login required.\n\n  Required:\n    --name    Card alias name (e.g. "Work")\n    --last4   Last 4 digits of the card\n\n  Optional:\n    --type              Card type label (default: virtual)\n    --budget <n>        Monthly budget amount\n    --reset-day <n>     Day of month the budget resets (default: 1)\n    --default-action    ALLOW, BLOCK, ESCALATE, or NOTIFY (default: ALLOW)\n    --notes <text>      Free text notes\n\n  Example:\n    troxy cards create --name "Work" --last4 1234 --budget 2000\n`,
-  update: `  troxy cards update --name <name> [options]\n\n  Updates an existing card. Login required.\n\n  Options:\n    --new-name <name>    Rename the card\n    --budget <n>         Set the monthly budget\n    --clear-budget       Remove the monthly budget\n    --reset-day <n>      Day of month the budget resets\n    --status <status>    active or paused\n    --default-action     ALLOW, BLOCK, ESCALATE, or NOTIFY\n    --notes <text>       Free text notes\n\n  Example:\n    troxy cards update --name "Work" --budget 3000\n`,
-  delete: `  troxy cards delete --name <name>\n\n  Permanently deletes a card. Login required.\n`,
-};
-
-export async function runCards([sub, ...args], flags) {
-  if (flags.help || flags.h) {
-    console.log('\n' + (HELP[sub] || `  troxy cards <subcommand> [options]\n\n  Subcommands:\n    list      List all cards\n    create    Create a new card\n    update    Update an existing card\n    delete    Delete a card\n\n  Run 'troxy cards <subcommand> --help' for subcommand help.\n`));
-    process.exit(0);
-  }
-
-  const jwt = requireJwt();
-
-  switch (sub || 'list') {
-    case 'list': {
-      const { cards = [] } = await api.listCards(jwt);
-      if (!cards.length) { console.log('\n  No cards yet.\n'); return; }
-      console.log();
-      table(
-        ['Name', 'Last 4', 'Type', 'Budget', 'Used', 'Reset day', 'Status', 'Default action'],
-        cards.map(c => [
-          c.name,
-          c.last4,
-          c.type,
-          c.budget != null ? `$${Number(c.budget).toFixed(2)}` : '—',
-          c.budget != null ? `$${Number(c.budget_used).toFixed(2)}` : '—',
-          c.reset_day,
-          c.status,
-          c.default_action,
-        ]),
-      );
-      break;
-    }
-
-    case 'create': {
-      const name  = flags.name;
-      const last4 = String(flags.last4 ?? '');
-      if (!name) { console.error('  --name is required\n'); process.exit(1); }
-      if (!/^\d{4}$/.test(last4)) { console.error('  --last4 must be exactly 4 digits\n'); process.exit(1); }
-      const action = flags['default-action'] ? flags['default-action'].toUpperCase() : undefined;
-      if (action && !['ALLOW', 'BLOCK', 'ESCALATE', 'NOTIFY'].includes(action)) {
-        console.error('  --default-action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n'); process.exit(1);
-      }
-      const body = {
-        name, last4,
-        type: flags.type || undefined,
-        budget: flags.budget != null ? parseFloat(flags.budget) : undefined,
-        reset_day: flags['reset-day'] != null ? parseInt(flags['reset-day'], 10) : undefined,
-        default_action: action,
-        notes: flags.notes || undefined,
-      };
-      const card = await api.createCard(jwt, body);
-      console.log(`\n  Card "${card.name}" created ✓  (•••• ${card.last4})\n`);
-      break;
-    }
-
-    case 'update': {
-      const name = flags.name;
-      if (!name) { console.error('  --name is required\n'); process.exit(1); }
-      const { cards = [] } = await api.listCards(jwt);
-      const card = cards.find(c => c.name.toLowerCase() === name.toLowerCase());
-      if (!card) { console.error(`  Card "${name}" not found\n`); process.exit(1); }
-
-      const body = {};
-      if (flags['new-name']) body.name = flags['new-name'];
-      if (flags['clear-budget']) body.budget = null;
-      else if (flags.budget != null) body.budget = parseFloat(flags.budget);
-      if (flags['reset-day'] != null) body.reset_day = parseInt(flags['reset-day'], 10);
-      if (flags.status) body.status = flags.status;
-      if (flags['default-action']) {
-        const action = flags['default-action'].toUpperCase();
-        if (!['ALLOW', 'BLOCK', 'ESCALATE', 'NOTIFY'].includes(action)) {
-          console.error('  --default-action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n'); process.exit(1);
-        }
-        body.default_action = action;
-      }
-      if (flags.notes != null) body.notes = flags.notes;
-      if (Object.keys(body).length === 0) { console.error('  Nothing to update, pass at least one option\n'); process.exit(1); }
-
-      await api.updateCard(jwt, card.id, body);
-      console.log(`\n  Card "${name}" updated ✓\n`);
-      break;
-    }
-
-    case 'delete': {
-      const name = flags.name;
-      if (!name) { console.error('  --name is required\n'); process.exit(1); }
-      const { cards = [] } = await api.listCards(jwt);
-      const card = cards.find(c => c.name.toLowerCase() === name.toLowerCase());
-      if (!card) { console.error(`  Card "${name}" not found\n`); process.exit(1); }
-      await api.deleteCard(jwt, card.id);
-      console.log(`\n  Card "${name}" deleted ✓\n`);
-      break;
-    }
-
-    default:
-      console.error(`  Unknown subcommand: ${sub}`);
-      console.error('  Usage: troxy cards [list|create|update|delete]\n');
-      process.exit(1);
-  }
-}