troxy-cli 1.8.9 → 1.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.8.9",
+  "version": "1.10.0",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/api.js

@@ -73,6 +73,7 @@ export const api = {
   evaluate: (body, apiKey) => request('POST', '/evaluate', { apiKey, body }),
   evaluateEmail: (body, apiKey) => request('POST', '/evaluate/email', { apiKey, body }),
   evaluateLogin: (body, apiKey) => request('POST', '/evaluate/login', { apiKey, body }),
+  evaluateAction: (body, apiKey) => request('POST', '/evaluate/action', { apiKey, body }),
   selfRevoke: (apiKey) => request('POST', '/mcp/self-revoke', { apiKey }),
   confirmPayment: (auditId, body, apiKey) => request('POST', `/payments/${auditId}/confirm`, { apiKey, body }),
   waitApprovalStatus: (token) => request('GET', `/approvals/${encodeURIComponent(token)}/wait`),

package/src/mcp-server.js

@@ -9,6 +9,7 @@ import { evaluatePayment, api } from './api.js';
 const confirmPayment = (auditId, body, apiKey) => api.confirmPayment(auditId, body, apiKey);
 const evaluateEmail   = (body, apiKey) => api.evaluateEmail(body, apiKey);
 const evaluateLogin   = (body, apiKey) => api.evaluateLogin(body, apiKey);
+const evaluateAction  = (body, apiKey) => api.evaluateAction(body, apiKey);
 
 export async function runMcp() {
   const config    = loadConfig();
@@ -41,7 +42,8 @@ export async function runMcp() {
         'If the decision is NOTIFY, proceed but the user will be notified. ' +
         'When calling evaluate_payment, use the merchant\'s domain name as merchant_name when available (e.g. "amazon.com", "indigobloom.co.il"); this ensures consistent matching against policies. ' +
         'After every ALLOW or NOTIFY decision, attempt the payment, then call confirm_payment with the audit_id and the outcome (success/failed/cancelled). Always include a reason when the charge fails. ' +
-        'You MUST also call the evaluate_email tool before sending any email on the user\'s behalf. Always include the full plaintext "body" argument, exactly as you intend to send it — Troxy policies inspect the body for secrets and confidential content, and cannot do so if it is omitted, summarized, or truncated. Never send an email without first receiving an ALLOW or NOTIFY decision. If BLOCK, do not send it. If ESCALATE, call wait_for_payment_approval with the returned approval_token (same wait mechanism payments use), then call evaluate_email again with the approval_token once approved. ' +
+        'You MUST also call the evaluate_email tool before sending any email on the user\'s behalf. Always include the full plaintext "body" argument, exactly as you intend to send it — Troxy policies inspect the body for secrets and confidential content, and cannot do so if it is omitted, summarized, or truncated. When the email goes to more than one person (a reply-all, a group, a bulk send), also pass every To/Cc/Bcc address in "recipients" so mass-email policies can apply. Never send an email without first receiving an ALLOW or NOTIFY decision. If BLOCK, do not send it. If ESCALATE, call wait_for_payment_approval with the returned approval_token (same wait mechanism payments use), then call evaluate_email again with the approval_token once approved. ' +
+        'You MUST also call the evaluate_action tool before any destructive or hard-to-undo action on the user\'s behalf: deleting files or records, dropping or truncating a table, force-pushing or deleting a branch, destroying infrastructure, revoking access, or overwriting data. Give the verb, what it affects, how many items, and whether it can be undone. Never carry the action out without first receiving an ALLOW or NOTIFY decision. ' +
         'You MUST also call the evaluate_login tool before logging into or signing up for any website on the user\'s behalf, giving the site\'s domain and whether it is a login or a signup. Never submit login credentials or a signup form without first receiving an ALLOW or NOTIFY decision. If BLOCK, do not proceed. If ESCALATE, call wait_for_payment_approval with the returned approval_token, then call evaluate_login again with the approval_token once approved.',
     },
     { capabilities: { tools: {} } },
@@ -148,7 +150,16 @@ export async function runMcp() {
           properties: {
             recipient: {
               type: 'string',
-              description: 'Email address of the recipient',
+              description: 'Email address of the primary recipient',
+            },
+            recipients: {
+              type: 'array',
+              items: { type: 'string' },
+              description:
+                'EVERY address the email will reach — all To, Cc, and Bcc recipients, ' +
+                'including the primary one. Send this whenever there is more than one ' +
+                'recipient (a reply-all, a group, a bulk send), so Troxy policies about ' +
+                'mass email can apply. Omit only for a genuine one-to-one email.',
             },
             subject: {
               type: 'string',
@@ -172,6 +183,49 @@ export async function runMcp() {
           },
         },
       },
+      {
+        name: 'evaluate_action',
+        description:
+          'Evaluate whether a destructive or hard-to-undo action should be allowed, blocked, or ' +
+          'escalated based on your Troxy policies. Call this BEFORE deleting, overwriting, dropping, ' +
+          'truncating, force-pushing, destroying, or revoking anything on the user\'s behalf.',
+        inputSchema: {
+          type: 'object',
+          required: ['action_verb'],
+          properties: {
+            action_verb: {
+              type: 'string',
+              description:
+                'What you are about to do, one lowercase word: delete, overwrite, drop, truncate, ' +
+                'force_push, destroy, revoke, deploy, share, upload, or export.',
+            },
+            resource: {
+              type: 'string',
+              description:
+                'What it affects — a path, table, bucket, repo or branch, e.g. "/var/data", ' +
+                '"users", "refs/heads/main". Policies can narrow a rule to a specific target.',
+            },
+            item_count: {
+              type: 'number',
+              description:
+                'How many things the action affects (files, rows, records). Send the real number ' +
+                'whenever you know it — bulk-action policies depend on it. Defaults to 1.',
+            },
+            reversible: {
+              type: 'boolean',
+              description:
+                'True only if this can be straightforwardly undone (e.g. a soft delete, a revert). ' +
+                'If you are unsure, omit it or send false: an undeclared action is treated as ' +
+                'irreversible so it is not waved through by mistake.',
+            },
+            agent: { type: 'string', description: 'Name of the agent (optional)' },
+            approval_token: {
+              type: 'string',
+              description: 'Approval token from a previous ESCALATE response. Include this to proceed after the user has approved.',
+            },
+          },
+        },
+      },
       {
         name: 'evaluate_login',
         description:
@@ -299,7 +353,7 @@ export async function runMcp() {
           emailText = `✗ Email blocked.${reason ? ` ${reason}` : ''} Do not send it. (audit: ${audit_id})`;
           break;
         case 'ESCALATE':
-          emailText = `⏳ Email requires human approval; a request has been sent to the account owner.\n\nApproval token: ${approval_token}\n\nNow call wait_for_payment_approval(approval_token="${approval_token}") to automatically detect approval, then call evaluate_email again with the same recipient/subject/body PLUS this approval_token. Do not send until it returns approved.`;
+          emailText = `⏳ Email requires human approval; a request has been sent to the account owner.\n\nApproval token: ${approval_token}\n\nNow call wait_for_payment_approval(approval_token="${approval_token}") to automatically detect approval, then call evaluate_email again with the same recipient/recipients/subject/body PLUS this approval_token. Do not send until it returns approved.`;
           break;
         default:
           emailText = JSON.stringify(result);
@@ -310,6 +364,37 @@ export async function runMcp() {
       };
     }
 
+    if (toolName === 'evaluate_action') {
+      if (agentName && !args.agent) args.agent = agentName;
+      let result;
+      try {
+        result = await evaluateAction(args, apiKey);
+      } catch (err) {
+        return { content: [{ type: 'text', text: `Troxy error: ${err.message}` }], isError: true };
+      }
+      if (result.error) {
+        return { content: [{ type: 'text', text: `Troxy error: ${result.error}` }], isError: true };
+      }
+      const { decision, reason, audit_id, approval_token } = result;
+      const what = `${args.action_verb}${args.resource ? ` on ${args.resource}` : ''}`;
+      let actionText;
+      switch (decision) {
+        case 'ALLOW':
+        case 'NOTIFY':
+          actionText = `✓ Approved: ${what}.${reason ? ` ${reason}` : ''} You may proceed. (audit: ${audit_id})`;
+          break;
+        case 'BLOCK':
+          actionText = `✗ Blocked: ${what}.${reason ? ` ${reason}` : ''} Do not proceed. (audit: ${audit_id})`;
+          break;
+        case 'ESCALATE':
+          actionText = `⏳ ${what} requires human approval; a request has been sent to the account owner.\n\nApproval token: ${approval_token}\n\nNow call wait_for_payment_approval(approval_token="${approval_token}") to automatically detect approval, then call evaluate_action again with the same arguments PLUS this approval_token. Do not proceed until it returns approved.`;
+          break;
+        default:
+          actionText = JSON.stringify(result);
+      }
+      return { content: [{ type: 'text', text: actionText }], isError: decision === 'BLOCK' };
+    }
+
     if (toolName === 'evaluate_login') {
       if (agentName && !args.agent) args.agent = agentName;
       let result;