@plexor-dev/claude-code-plugin-staging 0.1.0-beta.11 → 0.1.0-beta.13

package/commands/plexor-enabled.md

@@ -2,9 +2,7 @@
 description: Enable or disable Plexor proxy (routes all traffic through Plexor API) (user)
 ---
 
-# Plexor Enabled
-
-Toggle Plexor proxy on or off.
+**RULE: Execute this workflow EXACTLY ONCE. After completing all steps, STOP. DO NOT restart the workflow. DO NOT re-execute any commands. DO NOT call any other tools.**
 
 ## If argument provided (on/off/true/false)
 
@@ -14,11 +12,11 @@ Run the command directly with the argument:
 node ~/.claude/plugins/plexor/commands/plexor-enabled.js <argument>
 ```
 
-Then display the output and STOP.
+Then present the output to the user and STOP.
 
 ## If NO argument provided
 
-**Step 1**: First get current status by running:
+**Step 1**: Get current status by running:
 
 ```bash
 node ~/.claude/plugins/plexor/commands/plexor-enabled.js
@@ -26,14 +24,14 @@ node ~/.claude/plugins/plexor/commands/plexor-enabled.js
 
 **Step 2**: Based on the output, use AskUserQuestion to present options:
 
-If currently ENABLED (shows "● Enabled" or "● Active"):
+If currently ENABLED (shows "Enabled" or "Active"):
 - Question: "Plexor is currently ON. What would you like to do?"
 - Header: "Plexor"
 - Options:
   1. **Turn OFF** - Disable Plexor routing (connect directly to Anthropic)
   2. **Keep ON** - No change
 
-If currently DISABLED (shows "○ Disabled" or "○ Inactive"):
+If currently DISABLED (shows "Disabled" or "Inactive"):
 - Question: "Plexor is currently OFF. What would you like to do?"
 - Header: "Plexor"
 - Options:
@@ -45,4 +43,4 @@ If currently DISABLED (shows "○ Disabled" or "○ Inactive"):
 - If "Turn ON" selected: Run `node ~/.claude/plugins/plexor/commands/plexor-enabled.js true`
 - If "Keep" selected: Do nothing, just confirm current state
 
-**IMPORTANT**: After completing, STOP. Do not read files, explore codebase, or run additional commands.
+After completing all steps, STOP. DO NOT restart the workflow.

package/commands/plexor-login.js

@@ -76,6 +76,18 @@ function saveConfig(config) {
   }
 }
 
+function isPlexorApiKey(token) {
+  return typeof token === 'string' && token.startsWith('plx_') && token.length >= 20;
+}
+
+function isJwtToken(token) {
+  if (typeof token !== 'string' || !token.startsWith('eyJ')) {
+    return false;
+  }
+  const parts = token.split('.');
+  return parts.length === 3 && parts.every(part => part.length > 0);
+}
+
 function validateApiKey(apiUrl, apiKey) {
   return new Promise((resolve, reject) => {
     const url = new URL(`${apiUrl}/v1/user`);
@@ -119,6 +131,56 @@ function validateApiKey(apiUrl, apiKey) {
   });
 }
 
+function validateJwtToken(apiUrl, jwtToken) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(`${apiUrl}/v1/auth/me`);
+    const isHttps = url.protocol === 'https:';
+    const lib = isHttps ? https : http;
+
+    const options = {
+      hostname: url.hostname,
+      port: url.port || (isHttps ? 443 : 80),
+      path: url.pathname,
+      method: 'GET',
+      headers: {
+        'Authorization': `Bearer ${jwtToken}`
+      }
+    };
+
+    const req = lib.request(options, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        if (res.statusCode === 200) {
+          try {
+            resolve(JSON.parse(data));
+          } catch {
+            reject(new Error('Invalid response from server'));
+          }
+        } else if (res.statusCode === 401) {
+          reject(new Error('Invalid login token'));
+        } else {
+          reject(new Error(`Server error: ${res.statusCode}`));
+        }
+      });
+    });
+
+    req.on('error', (err) => reject(new Error(`Connection failed: ${err.message}`)));
+    req.setTimeout(10000, () => {
+      req.destroy();
+      reject(new Error('Connection timeout'));
+    });
+    req.end();
+  });
+}
+
+function validateCredential(apiUrl, credential) {
+  if (isJwtToken(credential)) {
+    return validateJwtToken(apiUrl, credential);
+  }
+  return validateApiKey(apiUrl, credential);
+}
+
 /**
  * Read API key from stdin (for piped input)
  * @returns {Promise<string>} The API key read from stdin
@@ -220,10 +282,10 @@ async function main() {
     console.log('');
   }
 
-  // Validate key format
-  if (!apiKey.startsWith('plx_') || apiKey.length < 20) {
-    console.error(`Error: Invalid API key format`);
-    console.error(`API keys start with "plx_" and are at least 20 characters`);
+  // Validate credential format (Plexor API key OR login JWT)
+  if (!isPlexorApiKey(apiKey) && !isJwtToken(apiKey)) {
+    console.error(`Error: Invalid credential format`);
+    console.error(`Expected Plexor API key ("plx_...") or login token ("eyJ...")`);
     process.exit(1);
   }
 
@@ -232,7 +294,7 @@ async function main() {
   console.log('Validating API key...');
 
   try {
-    const user = await validateApiKey(apiUrl, apiKey);
+    const user = await validateCredential(apiUrl, apiKey);
 
     config.auth = config.auth || {};
     config.auth.api_key = apiKey;

package/commands/plexor-login.md

@@ -2,26 +2,10 @@
 description: Authenticate with Plexor to enable optimization (user)
 ---
 
-# Plexor Login
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
-Run this command to authenticate with Plexor:
+Pass the API key as argument (format: `plx_your_api_key_here`).
 
 ```bash
-node ~/.claude/plugins/plexor/commands/plexor-login.js
+node ~/.claude/plugins/plexor/commands/plexor-login.js $ARGUMENTS
 ```
-
-To login with an API key:
-
-```bash
-node ~/.claude/plugins/plexor/commands/plexor-login.js plx_your_api_key_here
-```
-
-Use the Bash tool to execute this command.
-
-**IMPORTANT**: After running this command and displaying the output, STOP. Do not:
-- Read any files
-- Explore the codebase
-- Run additional commands
-- Ask follow-up questions
-
-The command output is the complete response. Simply show the output and wait for the user's next input.

package/commands/plexor-logout.md

@@ -2,26 +2,8 @@
 description: Log out from Plexor and clear credentials (user)
 ---
 
-# Plexor Logout
-
-Run this command to log out and clear credentials:
-
-```bash
-node ~/.claude/plugins/plexor/commands/plexor-logout.js
-```
-
-To also clear the cache:
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
 ```bash
-node ~/.claude/plugins/plexor/commands/plexor-logout.js --clear-cache
+node ~/.claude/plugins/plexor/commands/plexor-logout.js $ARGUMENTS
 ```
-
-Use the Bash tool to execute this command.
-
-**IMPORTANT**: After running this command and displaying the output, STOP. Do not:
-- Read any files
-- Explore the codebase
-- Run additional commands
-- Ask follow-up questions
-
-The command output is the complete response. Simply show the output and wait for the user's next input.

package/commands/plexor-setup.md

@@ -2,6 +2,8 @@
 description: First-time setup wizard for Plexor with Claude Code (user)
 ---
 
+**RULE: Execute this workflow EXACTLY ONCE. After completing all steps, STOP. DO NOT restart the workflow. DO NOT re-execute any commands. DO NOT call any other tools.**
+
 # Plexor Setup Wizard
 
 Guide users through first-time Plexor setup. **No manual environment variable configuration required!**
@@ -165,8 +167,9 @@ Commands:
 Changes take effect immediately in all Claude Code sessions!
 ```
 
-**IMPORTANT NOTES**:
+**NOTES**:
 - The `~/.claude/settings.json` env block is the KEY mechanism that routes Claude Code through Plexor
 - ANTHROPIC_AUTH_TOKEN takes precedence over ANTHROPIC_API_KEY (use AUTH_TOKEN for the Plexor key)
 - Changes take effect immediately - no shell restart needed
-- After completing setup, STOP. Do not run additional commands.
+
+After completing all steps, STOP. DO NOT restart the workflow. DO NOT re-execute any commands.

package/commands/plexor-status.js

@@ -270,15 +270,9 @@ ${line(`└── Cost saved: $${sessionCostSaved}`)}
   const routingIndicator = routing.active ? '🟢 PLEXOR MODE: ON' : '🔴 PLEXOR MODE: OFF';
   const envLabel = routing.isStaging ? '(staging)' : '(production)';
 
-  // Check for environment mismatch
-  const envMismatch = checkEnvironmentMismatch(apiUrl, routing.baseUrl);
-  const mismatchWarning = envMismatch
-    ? `  ⚠ Warning: Config uses ${envMismatch.config} but routing is ${envMismatch.routing}\n`
-    : '';
-
-  if (mismatchWarning) {
-    console.log(mismatchWarning);
-  }
+  // Note: Environment mismatch warning removed - it caused false positives during
+  // concurrent operations and transient states. The partial state and config/routing
+  // mismatch warnings below provide more actionable feedback.
 
   // Check for partial routing state (Plexor URL without valid auth)
   const partialState = detectPartialState();

package/commands/plexor-status.md

@@ -2,20 +2,8 @@
 description: Show Plexor optimization statistics and savings (user)
 ---
 
-# Plexor Status
-
-Run this command to display Plexor statistics:
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
 ```bash
 node ~/.claude/plugins/plexor/commands/plexor-status.js
 ```
-
-Use the Bash tool to execute this single command.
-
-**IMPORTANT**: After running this command and displaying the output, STOP. Do not:
-- Read any files
-- Explore the codebase
-- Run additional commands
-- Ask follow-up questions
-
-The command output is the complete response. Simply show the output and wait for the user's next input.

package/commands/plexor-uninstall.js

@@ -192,6 +192,25 @@ function removeConfigDirectory() {
 
 function main() {
   const args = process.argv.slice(2);
+
+  // Handle help flag
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log('');
+    console.log('  Usage: plexor-uninstall [options]');
+    console.log('');
+    console.log('  Cleans up Plexor integration before npm uninstall.');
+    console.log('');
+    console.log('  Options:');
+    console.log('    --remove-config, -c  Also remove ~/.plexor/ config directory');
+    console.log('    --quiet, -q          Suppress output messages');
+    console.log('    --help, -h           Show this help message');
+    console.log('');
+    console.log('  After running this command:');
+    console.log('    npm uninstall -g @plexor-dev/claude-code-plugin-staging');
+    console.log('');
+    process.exit(0);
+  }
+
   const removeConfig = args.includes('--remove-config') || args.includes('-c');
   const quiet = args.includes('--quiet') || args.includes('-q');
 

package/commands/plexor-uninstall.md

@@ -3,27 +3,9 @@ name: plexor-uninstall
 description: Clean up Plexor integration before uninstalling
 ---
 
-Runs comprehensive cleanup to prepare for npm uninstall.
+**RULE: Execute the bash command below EXACTLY ONCE. After the Bash tool returns output, your ONLY action is to present that output to the user. DO NOT re-execute the command. DO NOT call any other tools.**
 
-**IMPORTANT**: Run this command BEFORE `npm uninstall -g @plexor-dev/claude-code-plugin-staging`
-
-npm's preuninstall hook does NOT run for global package uninstalls, so this command
-must be run manually to ensure proper cleanup.
-
-This removes:
-- Plexor routing from Claude settings (~/.claude/settings.json)
-- Slash command files from ~/.claude/commands/
-- Plugin directory ~/.claude/plugins/plexor/
-
-Options:
-- `--remove-config` or `-c`: Also remove ~/.plexor/ config directory
-
-After running this command, run:
-```bash
-npm uninstall -g @plexor-dev/claude-code-plugin-staging
-```
-
-$ARGUMENTS: $ARGUMENTS
+**IMPORTANT**: Run this BEFORE `npm uninstall -g @plexor-dev/claude-code-plugin-staging`. Pass `--remove-config` to also remove ~/.plexor/ config directory.
 
 ```bash
 node ~/.claude/plugins/plexor/commands/plexor-uninstall.js $ARGUMENTS 2>&1 || plexor-uninstall $ARGUMENTS 2>&1

package/hooks/intercept.js

@@ -179,6 +179,17 @@ async function main() {
     input = await readStdin();
     request = JSON.parse(input);
 
+    // Issue #2042: Check for slash commands FIRST, before ANY other processing
+    // Slash commands must pass through completely clean — no metadata injection
+    // Adding _plexor_client or _plexor to slash command requests adds context noise
+    // that causes the model to re-execute commands in a loop
+    // Note: session.recordPassthrough() intentionally omitted — slash commands are
+    // not API requests and should not pollute session analytics
+    if (isSlashCommand(request)) {
+      logger.debug('Slash command detected, clean passthrough (no metadata)');
+      return output(request);  // Completely clean — no metadata added
+    }
+
     // Phase 3 Hypervisor Mode Detection
     // When ANTHROPIC_BASE_URL points to Plexor, all intelligence is server-side
     // The plugin just passes through - server handles optimization, routing, quality
@@ -202,25 +213,6 @@ async function main() {
       });
     }
 
-    // CRITICAL: Check for slash commands FIRST (before agentic check)
-    // Slash commands like /plexor-status should pass through unchanged
-    // Must check before isAgenticRequest since all Claude Code requests have tools
-    if (isSlashCommand(request)) {
-      logger.debug('Slash command detected, passing through unchanged');
-      session.recordPassthrough();
-      return output({
-        ...request,
-        plexor_cwd: process.cwd(),
-        _plexor: {
-          request_id: generateRequestId('slash'),  // Issue #701: Add request_id for tracking
-          source: 'passthrough_slash_command',
-          reason: 'slash_command_detected',
-          cwd: process.cwd(),
-          latency_ms: Date.now() - startTime
-        }
-      });
-    }
-
     // CRITICAL: Skip optimization for CLI commands requiring tool execution
     // Azure CLI, AWS CLI, kubectl, etc. need tools to be preserved
     if (requiresToolExecution(request)) {
@@ -578,12 +570,16 @@ function isSlashCommand(request) {
   }
 
   // Check for system messages with skill instructions
+  // Issue #2042: Updated to match new RULE-based .md format (old H1 headers removed)
   for (const msg of messages) {
     if (msg.role === 'system') {
       const content = typeof msg.content === 'string' ? msg.content : '';
       if (/# Plexor (?:Status|Login|Logout|Mode|Provider|Enabled|Settings)/i.test(content)) {
         return true;
       }
+      if (/plexor\/commands\/plexor-/i.test(content)) {
+        return true;
+      }
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plexor-dev/claude-code-plugin-staging",
-  "version": "0.1.0-beta.11",
+  "version": "0.1.0-beta.13",
   "description": "STAGING - LLM cost optimization plugin for Claude Code (internal testing)",
   "main": "lib/constants.js",
   "bin": {