troxy-cli 1.8.5 → 1.8.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/api.js

@@ -72,6 +72,7 @@ export const api = {
   // Evaluate + confirm (agent API key)
   evaluate: (body, apiKey) => request('POST', '/evaluate', { apiKey, body }),
   evaluateEmail: (body, apiKey) => request('POST', '/evaluate/email', { apiKey, body }),
+  selfRevoke: (apiKey) => request('POST', '/mcp/self-revoke', { apiKey }),
   confirmPayment: (auditId, body, apiKey) => request('POST', `/payments/${auditId}/confirm`, { apiKey, body }),
   waitApprovalStatus: (token) => request('GET', `/approvals/${encodeURIComponent(token)}/wait`),
 

package/src/uninstall.js

@@ -4,6 +4,7 @@ import path         from 'path';
 import { execSync } from 'child_process';
 import readline     from 'readline';
 import { loadConfig } from './config.js';
+import { api }        from './api.js';
 
 const MCP_CLIENTS = [
   {
@@ -107,12 +108,21 @@ export async function runUninstall() {
     console.log('none found');
   }
 
-  // 3. Warn about API key (requires login to revoke — user must do it from dashboard)
+  // 3. Revoke the API key. /mcp/self-revoke only lets a key revoke the exact
+  // token it authenticates as — it can't touch or list any other token — so
+  // this doesn't need a login/JWT, the key on disk is enough.
   const cfg = loadConfig();
   if (cfg?.apiKey) {
     const prefix = cfg.apiKey.slice(0, 12) + '...';
-    console.log(`\n  ⚠  API key ${prefix} was NOT revoked automatically.`);
-    console.log('     Go to dash.troxy.io → Settings → API Keys to revoke it.\n');
+    process.stdout.write(`  Revoking API key ${prefix}...  `);
+    try {
+      await api.selfRevoke(cfg.apiKey);
+      console.log('✓');
+    } catch (err) {
+      console.log('✗');
+      console.log(`     Couldn't revoke automatically (${err.message}).`);
+      console.log('     Go to dash.troxy.io → Settings → API Keys to revoke it.\n');
+    }
   }
 
   // 4. Delete ~/.troxy config