@plexor-dev/claude-code-plugin-localhost 0.1.0-beta.11 → 0.1.0-beta.12

package/commands/plexor-enabled.md

@@ -2,9 +2,7 @@
 description: Enable or disable Plexor proxy (routes all traffic through Plexor API) (user)
 ---
 
-# Plexor Enabled
-
-Toggle Plexor proxy on or off.
+**RULE: Execute this workflow EXACTLY ONCE. After completing all steps, STOP. DO NOT restart the workflow. DO NOT re-execute any commands. DO NOT call any other tools.**
 
 ## If argument provided (on/off/true/false)
 
@@ -14,11 +12,11 @@ Run the command directly with the argument:
 node ~/.claude/plugins/plexor/commands/plexor-enabled.js <argument>
 ```
 
-Then display the output and STOP.
+Then present the output to the user and STOP.
 
 ## If NO argument provided
 
-**Step 1**: First get current status by running:
+**Step 1**: Get current status by running:
 
 ```bash
 node ~/.claude/plugins/plexor/commands/plexor-enabled.js
@@ -26,14 +24,14 @@ node ~/.claude/plugins/plexor/commands/plexor-enabled.js
 
 **Step 2**: Based on the output, use AskUserQuestion to present options:
 
-If currently ENABLED (shows "● Enabled" or "● Active"):
+If currently ENABLED (shows "Enabled" or "Active"):
 - Question: "Plexor is currently ON. What would you like to do?"
 - Header: "Plexor"
 - Options:
   1. **Turn OFF** - Disable Plexor routing (connect directly to Anthropic)
   2. **Keep ON** - No change
 
-If currently DISABLED (shows "○ Disabled" or "○ Inactive"):
+If currently DISABLED (shows "Disabled" or "Inactive"):
 - Question: "Plexor is currently OFF. What would you like to do?"
 - Header: "Plexor"
 - Options:
@@ -45,4 +43,4 @@ If currently DISABLED (shows "○ Disabled" or "○ Inactive"):
 - If "Turn ON" selected: Run `node ~/.claude/plugins/plexor/commands/plexor-enabled.js true`
 - If "Keep" selected: Do nothing, just confirm current state
 
-**IMPORTANT**: After completing, STOP. Do not read files, explore codebase, or run additional commands.
+After completing all steps, STOP. DO NOT restart the workflow.

package/commands/plexor-login.js

@@ -76,6 +76,18 @@ function saveConfig(config) {
   }
 }
 
+function isPlexorApiKey(token) {
+  return typeof token === 'string' && token.startsWith('plx_') && token.length >= 20;
+}
+
+function isJwtToken(token) {
+  if (typeof token !== 'string' || !token.startsWith('eyJ')) {
+    return false;
+  }
+  const parts = token.split('.');
+  return parts.length === 3 && parts.every(part => part.length > 0);
+}
+
 function validateApiKey(apiUrl, apiKey) {
   return new Promise((resolve, reject) => {
     const url = new URL(`${apiUrl}/v1/user`);
@@ -119,6 +131,56 @@ function validateApiKey(apiUrl, apiKey) {
   });
 }
 
+function validateJwtToken(apiUrl, jwtToken) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(`${apiUrl}/v1/auth/me`);
+    const isHttps = url.protocol === 'https:';
+    const lib = isHttps ? https : http;
+
+    const options = {
+      hostname: url.hostname,
+      port: url.port || (isHttps ? 443 : 80),
+      path: url.pathname,
+      method: 'GET',
+      headers: {
+        'Authorization': `Bearer ${jwtToken}`
+      }
+    };
+
+    const req = lib.request(options, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        if (res.statusCode === 200) {
+          try {
+            resolve(JSON.parse(data));
+          } catch {
+            reject(new Error('Invalid response from server'));
+          }
+        } else if (res.statusCode === 401) {
+          reject(new Error('Invalid login token'));
+        } else {
+          reject(new Error(`Server error: ${res.statusCode}`));
+        }
+      });
+    });
+
+    req.on('error', (err) => reject(new Error(`Connection failed: ${err.message}`)));
+    req.setTimeout(10000, () => {
+      req.destroy();
+      reject(new Error('Connection timeout'));
+    });
+    req.end();
+  });
+}
+
+function validateCredential(apiUrl, credential) {
+  if (isJwtToken(credential)) {
+    return validateJwtToken(apiUrl, credential);
+  }
+  return validateApiKey(apiUrl, credential);
+}
+
 /**
  * Read API key from stdin (for piped input)
  * @returns {Promise<string>} The API key read from stdin
@@ -220,10 +282,10 @@ async function main() {
     console.log('');
   }
 
-  // Validate key format
-  if (!apiKey.startsWith('plx_') || apiKey.length < 20) {
-    console.error(`Error: Invalid API key format`);
-    console.error(`API keys start with "plx_" and are at least 20 characters`);
+  // Validate credential format (Plexor API key OR login JWT)
+  if (!isPlexorApiKey(apiKey) && !isJwtToken(apiKey)) {
+    console.error(`Error: Invalid credential format`);
+    console.error(`Expected Plexor API key ("plx_...") or login token ("eyJ...")`);
     process.exit(1);
   }
 
@@ -232,7 +294,7 @@ async function main() {
   console.log('Validating API key...');
 
   try {
-    const user = await validateApiKey(apiUrl, apiKey);
+    const user = await validateCredential(apiUrl, apiKey);
 
     config.auth = config.auth || {};
     config.auth.api_key = apiKey;

package/commands/plexor-login.md

@@ -2,26 +2,10 @@
 description: Authenticate with Plexor to enable optimization (user)
 ---
 
-# Plexor Login
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
-Run this command to authenticate with Plexor:
+Pass the API key as argument (format: `plx_your_api_key_here`).
 
 ```bash
-node ~/.claude/plugins/plexor/commands/plexor-login.js
+node ~/.claude/plugins/plexor/commands/plexor-login.js $ARGUMENTS
 ```
-
-To login with an API key:
-
-```bash
-node ~/.claude/plugins/plexor/commands/plexor-login.js plx_your_api_key_here
-```
-
-Use the Bash tool to execute this command.
-
-**IMPORTANT**: After running this command and displaying the output, STOP. Do not:
-- Read any files
-- Explore the codebase
-- Run additional commands
-- Ask follow-up questions
-
-The command output is the complete response. Simply show the output and wait for the user's next input.

package/commands/plexor-logout.md

@@ -2,26 +2,8 @@
 description: Log out from Plexor and clear credentials (user)
 ---
 
-# Plexor Logout
-
-Run this command to log out and clear credentials:
-
-```bash
-node ~/.claude/plugins/plexor/commands/plexor-logout.js
-```
-
-To also clear the cache:
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
 ```bash
-node ~/.claude/plugins/plexor/commands/plexor-logout.js --clear-cache
+node ~/.claude/plugins/plexor/commands/plexor-logout.js $ARGUMENTS
 ```
-
-Use the Bash tool to execute this command.
-
-**IMPORTANT**: After running this command and displaying the output, STOP. Do not:
-- Read any files
-- Explore the codebase
-- Run additional commands
-- Ask follow-up questions
-
-The command output is the complete response. Simply show the output and wait for the user's next input.

package/commands/plexor-setup.md

@@ -2,6 +2,8 @@
 description: First-time setup wizard for Plexor with Claude Code (user)
 ---
 
+**RULE: Execute this workflow EXACTLY ONCE. After completing all steps, STOP. DO NOT restart the workflow. DO NOT re-execute any commands. DO NOT call any other tools.**
+
 # Plexor Setup Wizard
 
 Guide users through first-time Plexor setup. **No manual environment variable configuration required!**
@@ -165,8 +167,9 @@ Commands:
 Changes take effect immediately in all Claude Code sessions!
 ```
 
-**IMPORTANT NOTES**:
+**NOTES**:
 - The `~/.claude/settings.json` env block is the KEY mechanism that routes Claude Code through Plexor
 - ANTHROPIC_AUTH_TOKEN takes precedence over ANTHROPIC_API_KEY (use AUTH_TOKEN for the Plexor key)
 - Changes take effect immediately - no shell restart needed
-- After completing setup, STOP. Do not run additional commands.
+
+After completing all steps, STOP. DO NOT restart the workflow. DO NOT re-execute any commands.

package/commands/plexor-status.md

@@ -2,20 +2,8 @@
 description: Show Plexor optimization statistics and savings (user)
 ---
 
-# Plexor Status
-
-Run this command to display Plexor statistics:
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
 ```bash
 node ~/.claude/plugins/plexor/commands/plexor-status.js
 ```
-
-Use the Bash tool to execute this single command.
-
-**IMPORTANT**: After running this command and displaying the output, STOP. Do not:
-- Read any files
-- Explore the codebase
-- Run additional commands
-- Ask follow-up questions
-
-The command output is the complete response. Simply show the output and wait for the user's next input.

package/hooks/intercept.js

@@ -179,6 +179,17 @@ async function main() {
     input = await readStdin();
     request = JSON.parse(input);
 
+    // Issue #2042: Check for slash commands FIRST, before ANY other processing
+    // Slash commands must pass through completely clean — no metadata injection
+    // Adding _plexor_client or _plexor to slash command requests adds context noise
+    // that causes the model to re-execute commands in a loop
+    // Note: session.recordPassthrough() intentionally omitted — slash commands are
+    // not API requests and should not pollute session analytics
+    if (isSlashCommand(request)) {
+      logger.debug('Slash command detected, clean passthrough (no metadata)');
+      return output(request);  // Completely clean — no metadata added
+    }
+
     // Phase 3 Hypervisor Mode Detection
     // When ANTHROPIC_BASE_URL points to Plexor, all intelligence is server-side
     // The plugin just passes through - server handles optimization, routing, quality
@@ -202,25 +213,6 @@ async function main() {
       });
     }
 
-    // CRITICAL: Check for slash commands FIRST (before agentic check)
-    // Slash commands like /plexor-status should pass through unchanged
-    // Must check before isAgenticRequest since all Claude Code requests have tools
-    if (isSlashCommand(request)) {
-      logger.debug('Slash command detected, passing through unchanged');
-      session.recordPassthrough();
-      return output({
-        ...request,
-        plexor_cwd: process.cwd(),
-        _plexor: {
-          request_id: generateRequestId('slash'),  // Issue #701: Add request_id for tracking
-          source: 'passthrough_slash_command',
-          reason: 'slash_command_detected',
-          cwd: process.cwd(),
-          latency_ms: Date.now() - startTime
-        }
-      });
-    }
-
     // CRITICAL: Skip optimization for CLI commands requiring tool execution
     // Azure CLI, AWS CLI, kubectl, etc. need tools to be preserved
     if (requiresToolExecution(request)) {
@@ -578,12 +570,16 @@ function isSlashCommand(request) {
   }
 
   // Check for system messages with skill instructions
+  // Issue #2042: Updated to match new RULE-based .md format (old H1 headers removed)
   for (const msg of messages) {
     if (msg.role === 'system') {
       const content = typeof msg.content === 'string' ? msg.content : '';
       if (/# Plexor (?:Status|Login|Logout|Mode|Provider|Enabled|Settings)/i.test(content)) {
         return true;
       }
+      if (/plexor\/commands\/plexor-/i.test(content)) {
+        return true;
+      }
     }
   }
 

package/lib/constants.js

@@ -28,7 +28,7 @@ const CACHE_PATH = path.join(PLEXOR_DIR, 'cache.json');
 const SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
 
 // STAGING PACKAGE - uses staging API
-const DEFAULT_API_URL = 'http://localhost:8000';
+const DEFAULT_API_URL = 'LOCALHOST_TUNNEL_URL';
 const DEFAULT_TIMEOUT = 5000;
 
 module.exports = {

package/lib/server-sync.js

@@ -13,7 +13,7 @@ const http = require('http');
 class ServerSync {
   constructor(options = {}) {
     this.apiKey = options.apiKey;
-    this.baseUrl = options.baseUrl || 'http://localhost:8000';
+    this.baseUrl = options.baseUrl || 'https://api.plexor.dev';
     this.timeout = options.timeout || 5000;
     this.enabled = options.enabled !== false;
     this.lastSyncTime = null;

package/lib/settings-manager.js

@@ -20,8 +20,8 @@ const SETTINGS_PATH = path.join(CLAUDE_DIR, 'settings.json');
 const LOCK_TIMEOUT_MS = 5000; // 5 second lock timeout
 
 // Plexor gateway endpoints
-const PLEXOR_STAGING_URL = 'http://localhost:8000/gateway/anthropic';
-const PLEXOR_PROD_URL = 'http://localhost:8000/gateway/anthropic';
+const PLEXOR_STAGING_URL = 'LOCALHOST_TUNNEL_URL/gateway/anthropic';
+const PLEXOR_PROD_URL = 'https://api.plexor.dev/gateway/anthropic';
 
 class ClaudeSettingsManager {
   constructor() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plexor-dev/claude-code-plugin-localhost",
-  "version": "0.1.0-beta.11",
+  "version": "0.1.0-beta.12",
   "description": "LOCALHOST - LLM cost optimization plugin for Claude Code (local dev testing via tunnel)",
   "main": "lib/constants.js",
   "bin": {

package/scripts/uninstall.js

@@ -60,7 +60,19 @@ function main() {
       }
     }
 
-    if (removed.length > 0 || routingDisabled) {
+    // Remove plugin directory (~/.claude/plugins/plexor/)
+    let pluginDirRemoved = false;
+    try {
+      const pluginDir = path.join(os.homedir(), '.claude', 'plugins', 'plexor');
+      if (fs.existsSync(pluginDir)) {
+        fs.rmSync(pluginDir, { recursive: true, force: true });
+        pluginDirRemoved = true;
+      }
+    } catch (e) {
+      console.warn(`  Warning: Could not remove plugin directory: ${e.message}`);
+    }
+
+    if (removed.length > 0 || routingDisabled || pluginDirRemoved) {
       console.log('');
       console.log('  Plexor plugin uninstalled');
       console.log('');
@@ -76,6 +88,11 @@ function main() {
         removed.forEach(cmd => console.log(`    /${cmd}`));
       }
 
+      if (pluginDirRemoved) {
+        console.log('');
+        console.log('  ✓ Removed plugin directory (~/.claude/plugins/plexor/)');
+      }
+
       if (restored.length > 0) {
         console.log('');
         console.log('  Restored from backup:');