@plexor-dev/claude-code-plugin 0.1.0-beta.31 → 0.1.0-beta.32

package/commands/plexor-enabled.js

@@ -14,6 +14,9 @@
 const fs = require('fs');
 const path = require('path');
 
+// Import centralized constants with HOME directory validation
+const { PLEXOR_DIR, CONFIG_PATH } = require('../lib/constants');
+
 // Import settings manager with error handling for missing lib
 let settingsManager, PLEXOR_STAGING_URL, PLEXOR_PROD_URL;
 try {
@@ -30,9 +33,6 @@ try {
   throw err;
 }
 
-const CONFIG_PATH = path.join(process.env.HOME, '.plexor', 'config.json');
-const PLEXOR_DIR = path.join(process.env.HOME, '.plexor');
-
 function loadConfig() {
   try {
     if (!fs.existsSync(CONFIG_PATH)) {

package/commands/plexor-login.js

@@ -13,6 +13,9 @@ const path = require('path');
 const https = require('https');
 const http = require('http');
 
+// Import centralized constants with HOME directory validation
+const { PLEXOR_DIR, CONFIG_PATH, DEFAULT_API_URL } = require('../lib/constants');
+
 // Import settings manager with error handling for missing lib
 let settingsManager;
 try {
@@ -26,11 +29,6 @@ try {
   throw err;
 }
 
-const CONFIG_PATH = path.join(process.env.HOME, '.plexor', 'config.json');
-const PLEXOR_DIR = path.join(process.env.HOME, '.plexor');
-// PRODUCTION PACKAGE - uses production API
-const DEFAULT_API_URL = 'https://api.plexor.dev';
-
 function loadConfig() {
   try {
     if (!fs.existsSync(CONFIG_PATH)) {
@@ -121,9 +119,62 @@ function validateApiKey(apiUrl, apiKey) {
   });
 }
 
+/**
+ * Read API key from stdin (for piped input)
+ * @returns {Promise<string>} The API key read from stdin
+ */
+function readFromStdin() {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    const timeout = setTimeout(() => {
+      reject(new Error('Timeout reading from stdin'));
+    }, 5000);
+
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on('end', () => {
+      clearTimeout(timeout);
+      resolve(data.trim());
+    });
+    process.stdin.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+    });
+    process.stdin.resume();
+  });
+}
+
 async function main() {
   const args = process.argv.slice(2);
-  let apiKey = args[0];
+  let apiKey = null;
+  let keySource = null;
+
+  // SECURITY FIX: Check for API key in order of preference
+  // 1. Environment variable (most secure for scripts/CI)
+  // 2. Stdin pipe (secure for interactive use)
+  // 3. Command line argument (warns about security risk)
+
+  // Check environment variable first (most secure)
+  if (process.env.PLEXOR_API_KEY) {
+    apiKey = process.env.PLEXOR_API_KEY;
+    keySource = 'environment';
+  }
+  // Check if stdin has data (piped input)
+  else if (!process.stdin.isTTY && args.length === 0) {
+    try {
+      apiKey = await readFromStdin();
+      keySource = 'stdin';
+    } catch {
+      // Stdin read failed, continue to check args
+    }
+  }
+  // Check command line argument (least secure - shows in ps)
+  else if (args[0]) {
+    apiKey = args[0];
+    keySource = 'argument';
+  }
 
   // Check for existing login
   const config = loadConfig();
@@ -135,14 +186,14 @@ async function main() {
     console.log(`├─────────────────────────────────────────────┤`);
     console.log(`│  API Key: ${(existingKey.substring(0, 8) + '...').padEnd(33)}│`);
     console.log(`│  To re-login, provide a new key:            │`);
-    console.log(`│    /plexor-login <api-key>                  │`);
+    console.log(`│    echo $PLEXOR_API_KEY | /plexor-login     │`);
     console.log(`│  To logout:                                 │`);
     console.log(`│    /plexor-logout                           │`);
     console.log(`└─────────────────────────────────────────────┘`);
     return;
   }
 
-  // If no key provided, prompt for it
+  // If no key provided, show secure usage options
   if (!apiKey) {
     console.log(`┌─────────────────────────────────────────────┐`);
     console.log(`│  Plexor Login                               │`);
@@ -150,11 +201,25 @@ async function main() {
     console.log(`│  Get your API key at:                       │`);
     console.log(`│  https://plexor.dev/dashboard/api-keys      │`);
     console.log(`├─────────────────────────────────────────────┤`);
-    console.log(`│  Usage: /plexor-login <api-key>             │`);
+    console.log(`│  Secure usage (recommended):                │`);
+    console.log(`│    echo "plx_..." | /plexor-login           │`);
+    console.log(`│    PLEXOR_API_KEY=plx_... /plexor-login     │`);
+    console.log(`├─────────────────────────────────────────────┤`);
+    console.log(`│  Direct usage (visible in ps):              │`);
+    console.log(`│    /plexor-login <api-key>                  │`);
     console.log(`└─────────────────────────────────────────────┘`);
     return;
   }
 
+  // Warn if API key was passed as command line argument
+  if (keySource === 'argument') {
+    console.log(`⚠ Security note: API key passed as argument is visible in`);
+    console.log(`  process list (ps aux). For better security, use:`);
+    console.log(`    echo "plx_..." | /plexor-login`);
+    console.log(`    PLEXOR_API_KEY=plx_... /plexor-login`);
+    console.log('');
+  }
+
   // Validate key format
   if (!apiKey.startsWith('plx_') || apiKey.length < 20) {
     console.error(`Error: Invalid API key format`);

package/commands/plexor-logout.js

@@ -8,10 +8,22 @@
 const fs = require('fs');
 const path = require('path');
 
-const PLEXOR_DIR = path.join(process.env.HOME, '.plexor');
-const CONFIG_PATH = path.join(PLEXOR_DIR, 'config.json');
-const SESSION_PATH = path.join(PLEXOR_DIR, 'session.json');
-const CACHE_PATH = path.join(PLEXOR_DIR, 'cache.json');
+// Import centralized constants with HOME directory validation
+const { PLEXOR_DIR, CONFIG_PATH, SESSION_PATH, CACHE_PATH } = require('../lib/constants');
+
+// Import settings manager for Claude Code routing cleanup
+let settingsManager;
+try {
+  const lib = require('../lib/settings-manager');
+  settingsManager = lib.settingsManager;
+} catch (err) {
+  if (err.code === 'MODULE_NOT_FOUND') {
+    console.error('Error: Plexor plugin files are missing or corrupted.');
+    console.error('       Please reinstall: npm install @plexor-dev/claude-code-plugin');
+    process.exit(1);
+  }
+  throw err;
+}
 
 function loadConfig() {
   try {
@@ -96,6 +108,11 @@ function main() {
     process.exit(1);
   }
 
+  // CRITICAL FIX: Disable Claude Code routing in ~/.claude/settings.json
+  // This removes ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN so Claude Code
+  // no longer tries to route through Plexor with removed credentials
+  const routingDisabled = settingsManager.disablePlexorRouting();
+
   // Clear session
   deleteFile(SESSION_PATH);
 
@@ -109,12 +126,13 @@ function main() {
   console.log(`│  ✓ Logged Out                               │`);
   console.log(`├─────────────────────────────────────────────┤`);
   console.log(`│  ✓ API key removed                          │`);
-  console.log(`│  ✓ Plexor proxy disabled                    │`);
+  console.log(`│  ${routingDisabled ? '✓' : '○'} Claude Code routing disabled             │`);
   console.log(`│  ✓ Session cleared                          │`);
   if (clearCache) {
     console.log(`│  ${cacheCleared ? '✓' : '○'} Cache cleared                            │`);
   }
   console.log(`├─────────────────────────────────────────────┤`);
+  console.log(`│  Claude Code now connects directly.         │`);
   console.log(`│  Run /plexor-login to re-authenticate.      │`);
   if (!clearCache) {
     console.log(`│  Use --clear-cache to also clear cache.     │`);

package/commands/plexor-status.js

@@ -9,10 +9,9 @@ const fs = require('fs');
 const path = require('path');
 const https = require('https');
 
-const CONFIG_PATH = path.join(process.env.HOME, '.plexor', 'config.json');
-const SESSION_PATH = path.join(process.env.HOME, '.plexor', 'session.json');
-const CLAUDE_SETTINGS_PATH = path.join(process.env.HOME, '.claude', 'settings.json');
-const SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
+// Import centralized constants with HOME directory validation
+const { HOME_DIR, CONFIG_PATH, SESSION_PATH, SESSION_TIMEOUT_MS } = require('../lib/constants');
+const CLAUDE_SETTINGS_PATH = path.join(HOME_DIR, '.claude', 'settings.json');
 
 /**
  * Check if Claude Code is actually routing through Plexor

package/lib/constants.js

@@ -4,7 +4,23 @@
 
 const path = require('path');
 
-const PLEXOR_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '', '.plexor');
+/**
+ * Get the user's home directory with proper validation
+ * @returns {string} Home directory path
+ * @throws {Error} If HOME is not set or empty
+ */
+function getHomeDir() {
+  const home = process.env.HOME || process.env.USERPROFILE;
+  if (!home || home.trim() === '') {
+    console.error('Error: HOME environment variable is not set.');
+    console.error('       Please set HOME to your user directory before running Plexor commands.');
+    process.exit(1);
+  }
+  return home;
+}
+
+const HOME_DIR = getHomeDir();
+const PLEXOR_DIR = path.join(HOME_DIR, '.plexor');
 const CONFIG_PATH = path.join(PLEXOR_DIR, 'config.json');
 const SESSION_PATH = path.join(PLEXOR_DIR, 'session.json');
 const CACHE_PATH = path.join(PLEXOR_DIR, 'cache.json');
@@ -15,6 +31,8 @@ const DEFAULT_API_URL = 'https://api.plexor.dev';
 const DEFAULT_TIMEOUT = 5000;
 
 module.exports = {
+  getHomeDir,
+  HOME_DIR,
   PLEXOR_DIR,
   CONFIG_PATH,
   SESSION_PATH,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plexor-dev/claude-code-plugin",
-  "version": "0.1.0-beta.31",
+  "version": "0.1.0-beta.32",
   "description": "LLM cost optimization plugin for Claude Code - Save up to 90% on AI costs",
   "main": "lib/constants.js",
   "bin": {

package/scripts/uninstall.js

@@ -11,11 +11,32 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
+// Import settings manager for Claude Code routing cleanup
+let settingsManager;
+try {
+  const lib = require('../lib/settings-manager');
+  settingsManager = lib.settingsManager;
+} catch (err) {
+  // If settings manager can't be loaded during uninstall, continue anyway
+  settingsManager = null;
+}
+
 const COMMANDS_SOURCE = path.join(__dirname, '..', 'commands');
 const CLAUDE_COMMANDS_DIR = path.join(os.homedir(), '.claude', 'commands');
 
 function main() {
   try {
+    // CRITICAL: Disable Claude Code routing before removing commands
+    // This ensures users don't get stuck with Plexor routing after uninstall
+    let routingDisabled = false;
+    if (settingsManager) {
+      try {
+        routingDisabled = settingsManager.disablePlexorRouting();
+      } catch (e) {
+        // Continue with uninstall even if routing cleanup fails
+      }
+    }
+
     // Get list of our command files
     const files = fs.readdirSync(COMMANDS_SOURCE)
       .filter(f => f.endsWith('.md'));
@@ -39,12 +60,21 @@ function main() {
       }
     }
 
-    if (removed.length > 0) {
+    if (removed.length > 0 || routingDisabled) {
       console.log('');
       console.log('  Plexor plugin uninstalled');
       console.log('');
-      console.log('  Removed commands:');
-      removed.forEach(cmd => console.log(`    /${cmd}`));
+
+      if (routingDisabled) {
+        console.log('  ✓ Claude Code routing disabled');
+        console.log('    (Claude Code now connects directly to Anthropic)');
+        console.log('');
+      }
+
+      if (removed.length > 0) {
+        console.log('  Removed commands:');
+        removed.forEach(cmd => console.log(`    /${cmd}`));
+      }
 
       if (restored.length > 0) {
         console.log('');