claude-smart 0.2.23 → 0.2.25

package/plugin/scripts/ensure-plugin-root.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Maintain ~/.reflexio/plugin-root as a symlink to the active plugin
+# install dir so slash commands can reference one short path regardless
+# of whether the user is on the remote marketplace (reflexioai) or the
+# local-dev marketplace (reflexioai-local).
+#
+# Usage: ensure-plugin-root.sh <target-dir> [--force]
+#   --force  overwrite any existing link (used by setup-local-dev.sh)
+#   default  self-heal only if the link is missing or points at an
+#            invalid target
+set -eu
+
+TARGET="${1:-}"
+FORCE="${2:-}"
+
+if [ -z "$TARGET" ]; then
+    echo "[claude-smart] ensure-plugin-root: usage: $0 <target-dir> [--force]" >&2
+    exit 1
+fi
+
+if [ ! -f "$TARGET/pyproject.toml" ]; then
+    echo "[claude-smart] ensure-plugin-root: $TARGET is not a plugin dir (no pyproject.toml)" >&2
+    exit 1
+fi
+
+LINK="$HOME/.reflexio/plugin-root"
+mkdir -p "$(dirname "$LINK")"
+
+if [ "$FORCE" = "--force" ]; then
+    ln -sfn "$TARGET" "$LINK"
+    echo "[claude-smart] plugin-root → $TARGET (forced)" >&2
+    exit 0
+fi
+
+# Opt-in: when CLAUDE_SMART_PLUGIN_ROOT_FOLLOW_SESSION=1 (set in the
+# environment or in ~/.reflexio/.env), always relink to $TARGET so the
+# symlink tracks the currently loaded plugin. Off by default to preserve
+# a pinned local-dev link across sessions that load the remote plugin.
+FOLLOW="${CLAUDE_SMART_PLUGIN_ROOT_FOLLOW_SESSION:-}"
+if [ -z "$FOLLOW" ] && [ -f "$HOME/.reflexio/.env" ]; then
+    FOLLOW="$(grep -E '^CLAUDE_SMART_PLUGIN_ROOT_FOLLOW_SESSION=' "$HOME/.reflexio/.env" \
+        | tail -n1 | cut -d= -f2-)"
+    # Strip a single pair of surrounding double or single quotes, if present.
+    FOLLOW="${FOLLOW#\"}"; FOLLOW="${FOLLOW%\"}"
+    FOLLOW="${FOLLOW#\'}"; FOLLOW="${FOLLOW%\'}"
+fi
+if [ "$FOLLOW" = "1" ]; then
+    ln -sfn "$TARGET" "$LINK"
+    echo "[claude-smart] plugin-root → $TARGET (follow-session)" >&2
+    exit 0
+fi
+
+# Cache-tracking: if the link currently resolves to a path under the
+# managed plugin cache (~/.claude/plugins/cache/), always retarget it to
+# $TARGET. Plugin updates leave old version directories behind, so a
+# valid pyproject.toml at the stale target is not proof the link is
+# fresh. Links pointing outside the cache (e.g., a user's local-dev
+# checkout) are left alone here and handled by the self-heal below.
+if [ -L "$LINK" ]; then
+    # Literal target string, not realpath: we compare against what was written by ln -s.
+    CURRENT="$(readlink "$LINK" 2>/dev/null || true)"
+    case "$CURRENT" in
+        "$HOME/.claude/plugins/cache/"*)
+            CURRENT_NORM="${CURRENT%/}"
+            TARGET_NORM="${TARGET%/}"
+            if [ "$CURRENT_NORM" != "$TARGET_NORM" ]; then
+                ln -sfn "$TARGET" "$LINK"
+                echo "[claude-smart] plugin-root → $TARGET (cache-tracking, was $CURRENT)" >&2
+            fi
+            exit 0
+            ;;
+    esac
+fi
+
+# Self-heal path: only rewrite the link if it's missing or its target is
+# gone/invalid. This preserves a valid local-dev symlink set earlier by
+# setup-local-dev.sh, so SessionStart hooks on the local install don't
+# clobber the user's repo-pointing link.
+if [ -f "$LINK/pyproject.toml" ]; then
+    exit 0
+fi
+
+ln -sfn "$TARGET" "$LINK"
+echo "[claude-smart] plugin-root → $TARGET" >&2

package/plugin/scripts/hook_entry.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Dispatch a Claude Code or Codex hook event to the claude_smart Python package.
+# CLAUDE_PLUGIN_ROOT points at the plugin dir (dev: <repo>/plugin;
+# installed: ~/.claude/plugins/cache/reflexioai/claude-smart/<version>),
+# which is also the Python project root with pyproject.toml + uv.lock.
+# We invoke via `uv run --project` so the pinned env from uv.lock is used.
+#
+# If the Setup hook recorded an install failure at
+# ~/.claude-smart/install-failed, short-circuit with a user-visible
+# message instead of trying to run uv and failing silently.
+set -eu
+
+HOST="claude-code"
+EVENT="${1:-}"
+case "$EVENT" in
+  claude-code|codex)
+    HOST="$EVENT"
+    EVENT="${2:-}"
+    ;;
+esac
+if [ -z "$EVENT" ]; then
+  echo '{"continue":true,"suppressOutput":true}'
+  exit 0
+fi
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=_lib.sh
+. "$HERE/_lib.sh"
+# Pick up uv from the user's login-shell PATH (covers ~/.local/bin populated
+# by the astral.sh installer) so a fresh install works before the user
+# restarts their terminal. Matches the pattern used by smart-install.sh.
+claude_smart_source_login_path
+# Explicit fallback for the astral.sh installer's default paths, in case
+# the user's login-shell rc hasn't yet been re-sourced to pick them up.
+claude_smart_prepend_astral_bins
+
+PLUGIN_ROOT="$(cd "$HERE/.." && pwd)"
+
+FAILURE_MARKER="$HOME/.claude-smart/install-failed"
+if [ -f "$FAILURE_MARKER" ]; then
+  if [ "$EVENT" = "session-start" ] && command -v python3 >/dev/null 2>&1; then
+    python3 - "$FAILURE_MARKER" <<'PY'
+import json, pathlib, sys
+msg = pathlib.Path(sys.argv[1]).read_text().strip() or "unknown error"
+print(json.dumps({
+    "hookSpecificOutput": {
+        "hookEventName": "SessionStart",
+        "additionalContext": (
+            f"> **claude-smart is not installed correctly:** {msg}\n"
+            "> Re-run the plugin's Setup (restart your coding assistant) "
+            "or fix the underlying issue and delete "
+            "`~/.claude-smart/install-failed` to retry."
+        ),
+    }
+}))
+PY
+  else
+    echo '{"continue":true,"suppressOutput":true}'
+  fi
+  exit 0
+fi
+
+if ! command -v uv >/dev/null 2>&1; then
+  # uv missing post-install → don't crash the session, just no-op.
+  echo '{"continue":true,"suppressOutput":true}'
+  exit 0
+fi
+
+# Stdin is the hook payload JSON — stream it through to the Python CLI.
+exec uv run --project "$PLUGIN_ROOT" --quiet python -m claude_smart.hook "$HOST" "$EVENT"

package/plugin/scripts/smart-install.sh

@@ -0,0 +1,411 @@
+#!/usr/bin/env bash
+# Run once on plugin install. Pulls the reflexio submodule, syncs the
+# Python env, and flips on the claude-code LiteLLM provider in reflexio's
+# .env so extraction works with no external API key.
+#
+# On failure, writes the reason to ~/.claude-smart/install-failed so
+# hook_entry.sh can short-circuit and surface a user-visible message
+# instead of silently no-op'ing every session.
+set -eu
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=_lib.sh
+. "$HERE/_lib.sh"
+claude_smart_source_login_path
+claude_smart_prepend_astral_bins
+claude_smart_prepend_node_bins
+
+PLUGIN_ROOT="$(cd "$HERE/.." && pwd)"
+REPO_ROOT="$(cd "$HERE/../.." && pwd)"
+
+MARKER_DIR="$HOME/.claude-smart"
+FAILURE_MARKER="$MARKER_DIR/install-failed"
+mkdir -p "$MARKER_DIR"
+rm -f "$FAILURE_MARKER"
+
+write_failure() {
+  local reason
+  reason="$1"
+  printf '%s\n' "$reason" > "$FAILURE_MARKER"
+  echo "[claude-smart] install failed: $reason" >&2
+  echo '{"continue":true,"suppressOutput":true}'
+  exit 0
+}
+
+install_private_node() {
+  local NODE_MIN_MAJOR NODE_MIN_MINOR NODE_LTS_MAJOR
+  local node_os archive_ext reason node_arch node_platform base_url node_root
+  local tmp_dir shasums_path archive_name ext_re install_dir archive_path
+  local expected_hash actual_hash archive_win dest_win candidate_path next_link
+
+  NODE_MIN_MAJOR=20
+  NODE_MIN_MINOR=9
+  NODE_LTS_MAJOR="${CLAUDE_SMART_NODE_LTS_MAJOR:-22}"
+
+  if claude_smart_node_satisfies "$NODE_MIN_MAJOR" "$NODE_MIN_MINOR" \
+    && claude_smart_npm_available; then
+    claude_smart_clear_dashboard_unavailable
+    return 0
+  fi
+
+  case "$(uname -s 2>/dev/null)" in
+    Darwin*) node_os="darwin"; archive_ext="tar.gz" ;;
+    Linux*) node_os="linux"; archive_ext="tar.gz" ;;
+    MINGW*|MSYS*|CYGWIN*)
+      node_os="win"
+      archive_ext="zip"
+      if ! command -v powershell >/dev/null 2>&1; then
+        reason="PowerShell is not on PATH, so claude-smart could not extract private Node.js on Windows."
+        echo "[claude-smart] WARNING: $reason" >&2
+        claude_smart_write_dashboard_unavailable "$reason"
+        return 1
+      fi
+      ;;
+    *)
+      reason="unsupported OS for private Node.js install: $(uname -s 2>/dev/null || echo unknown)"
+      echo "[claude-smart] WARNING: $reason" >&2
+      claude_smart_write_dashboard_unavailable "$reason"
+      return 1
+      ;;
+  esac
+
+  case "$(uname -m 2>/dev/null)" in
+    x86_64|amd64) node_arch="x64" ;;
+    arm64|aarch64) node_arch="arm64" ;;
+    *)
+      reason="unsupported CPU for private Node.js install: $(uname -m 2>/dev/null || echo unknown)"
+      echo "[claude-smart] WARNING: $reason" >&2
+      claude_smart_write_dashboard_unavailable "$reason"
+      return 1
+      ;;
+  esac
+
+  node_platform="$node_os-$node_arch"
+  base_url="${CLAUDE_SMART_NODE_BASE_URL:-https://nodejs.org/dist/latest-v${NODE_LTS_MAJOR}.x}"
+  echo "[claude-smart] Node.js >=20.9 with npm not found — installing private Node.js from nodejs.org..." >&2
+  node_root="$HOME/.claude-smart/node"
+  mkdir -p "$node_root"
+  tmp_dir=$(mktemp -d "$node_root/tmp.XXXXXX") || {
+    reason="could not create temporary directory under $node_root"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  }
+  shasums_path="$tmp_dir/SHASUMS256.txt"
+
+  if ! claude_smart_download "$base_url/SHASUMS256.txt" "$shasums_path"; then
+    rm -rf "$tmp_dir"
+    reason="could not download Node.js checksums from $base_url/SHASUMS256.txt"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  ext_re=$(printf '%s' "$archive_ext" | sed 's/\./\\./g')
+  archive_name=$(
+    awk -v platform="$node_platform" -v ext="$ext_re" \
+          '$2 ~ ("^node-v[0-9][^ ]*-" platform "\\." ext "$") { print $2; exit }' \
+      "$shasums_path"
+  ) || archive_name=""
+  if [ -z "$archive_name" ]; then
+    rm -rf "$tmp_dir"
+    reason="could not resolve Node.js archive for $node_platform from $base_url"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  install_dir="$node_root/${archive_name%.$archive_ext}"
+  archive_path="$tmp_dir/$archive_name"
+  expected_hash=$(awk -v name="$archive_name" '$2 == name { print $1; exit }' "$shasums_path")
+  if [ -z "$expected_hash" ]; then
+    rm -rf "$tmp_dir"
+    reason="Node.js checksums did not include $archive_name"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  if ! claude_smart_download "$base_url/$archive_name" "$archive_path"; then
+    rm -rf "$tmp_dir"
+    reason="Node.js download failed from $base_url/$archive_name"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  actual_hash=$(claude_smart_sha256_file "$archive_path" || true)
+  if [ -z "$actual_hash" ] || [ "$actual_hash" != "$expected_hash" ]; then
+    rm -rf "$tmp_dir"
+    reason="Node.js checksum verification failed for $archive_name"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  rm -rf "$install_dir" "$node_root/current.next"
+  if [ "$archive_ext" = "zip" ]; then
+    archive_win="$archive_path"
+    dest_win="$node_root"
+    if command -v cygpath >/dev/null 2>&1; then
+      archive_win=$(cygpath -w "$archive_path")
+      dest_win=$(cygpath -w "$node_root")
+    fi
+    if ! ARCHIVE_PATH="$archive_win" DEST_DIR="$dest_win" powershell -NoProfile -ExecutionPolicy Bypass -Command \
+      '$ProgressPreference="SilentlyContinue"; Expand-Archive -LiteralPath $env:ARCHIVE_PATH -DestinationPath $env:DEST_DIR -Force' >&2; then
+      rm -rf "$tmp_dir" "$install_dir"
+      reason="Node.js archive extraction failed for $archive_name"
+      echo "[claude-smart] WARNING: $reason" >&2
+      claude_smart_write_dashboard_unavailable "$reason"
+      return 1
+    fi
+  elif ! tar -xzf "$archive_path" -C "$node_root"; then
+    rm -rf "$tmp_dir" "$install_dir"
+    reason="Node.js archive extraction failed for $archive_name"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  if [ ! -d "$install_dir" ]; then
+    rm -rf "$tmp_dir"
+    reason="Node.js archive extracted without expected directory $install_dir"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  if [ -x "$install_dir/bin/node" ]; then
+    candidate_path="$install_dir/bin:$PATH"
+  elif [ -x "$install_dir/node.exe" ] || [ -x "$install_dir/node" ]; then
+    candidate_path="$install_dir:$PATH"
+  else
+    rm -rf "$tmp_dir"
+    reason="Node.js archive extracted without a node executable"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  if claude_smart_node_satisfies "$NODE_MIN_MAJOR" "$NODE_MIN_MINOR" \
+    && claude_smart_npm_available; then
+    : # existing PATH unexpectedly became suitable; keep going
+  elif PATH="$candidate_path" claude_smart_node_satisfies "$NODE_MIN_MAJOR" "$NODE_MIN_MINOR" \
+    && PATH="$candidate_path" claude_smart_npm_available; then
+    : # candidate install is suitable
+  else
+    rm -rf "$tmp_dir"
+    reason="private Node.js install completed but node/npm are still not usable"
+    echo "[claude-smart] WARNING: $reason" >&2
+    claude_smart_write_dashboard_unavailable "$reason"
+    return 1
+  fi
+
+  next_link="$node_root/current.next.$$"
+  if ln -s "$install_dir" "$next_link" 2>/dev/null; then
+    if mv -Tf "$next_link" "$node_root/current" 2>/dev/null; then
+      :
+    elif mv -hf "$next_link" "$node_root/current" 2>/dev/null; then
+      :
+    else
+      rm -rf "$node_root/current"
+      mv "$next_link" "$node_root/current"
+    fi
+  else
+    rm -rf "$next_link" "$node_root/current"
+    mv "$install_dir" "$node_root/current"
+  fi
+
+  rm -rf "$tmp_dir"
+  claude_smart_prepend_node_bins
+  if claude_smart_node_satisfies "$NODE_MIN_MAJOR" "$NODE_MIN_MINOR" \
+    && claude_smart_npm_available; then
+    claude_smart_clear_dashboard_unavailable
+    echo "[claude-smart] installed private $(node -v) at $node_root/current" >&2
+    return 0
+  fi
+
+  reason="private Node.js install completed but current node/npm are still not usable"
+  echo "[claude-smart] WARNING: $reason" >&2
+  claude_smart_write_dashboard_unavailable "$reason"
+  return 1
+}
+
+if [ "${CLAUDE_SMART_INSTALL_PRIVATE_NODE_ONLY:-}" = "1" ]; then
+  install_private_node
+  exit $?
+fi
+
+# Dev-mode only: when running from a git checkout, pull the reflexio
+# submodule so tests/benchmarks can use its sources. In install mode the
+# plugin lives under ~/.claude/plugins/cache and reflexio-ai resolves
+# from PyPI instead. The guard checks for both `.git` and `.gitmodules`
+# at REPO_ROOT to distinguish a dev checkout from a marketplace cache
+# (where REPO_ROOT has neither).
+if [ -d "$REPO_ROOT/.git" ] && [ -f "$REPO_ROOT/.gitmodules" ]; then
+  echo "[claude-smart] initializing reflexio submodule..." >&2
+  if ! (cd "$REPO_ROOT" && git submodule update --init --recursive reflexio) >&2; then
+    echo "[claude-smart] WARNING: git submodule update failed; continuing with PyPI reflexio-ai" >&2
+  fi
+fi
+
+if ! command -v uv >/dev/null 2>&1; then
+  echo "[claude-smart] uv not found — installing from astral.sh..." >&2
+  # The astral.sh bash installer downloads a zip and unzips it. On
+  # Windows-flavoured bash (Git Bash / MSYS) the bundled `unzip` corrupts
+  # the Windows uv binary (bad CRC on the inflated uv.exe), leaving the
+  # install half-finished. Use the official PowerShell installer
+  # (install.ps1) on Windows, which writes uv.exe to ~/.local/bin
+  # natively — same destination the bash installer targets on POSIX, so
+  # claude_smart_prepend_astral_bins picks it up uniformly afterwards.
+  if claude_smart_is_windows; then
+    if ! command -v powershell >/dev/null 2>&1; then
+      write_failure "uv install needs PowerShell on Windows but powershell is not on PATH — install uv manually from https://docs.astral.sh/uv/"
+    fi
+    if ! powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://astral.sh/uv/install.ps1 | iex" >&2; then
+      write_failure "uv install via PowerShell failed — install manually from https://docs.astral.sh/uv/"
+    fi
+  else
+    UV_INSTALLER="$MARKER_DIR/uv-install.sh"
+    if ! claude_smart_download https://astral.sh/uv/install.sh "$UV_INSTALLER"; then
+      write_failure "uv installer download failed — install manually from https://docs.astral.sh/uv/"
+    fi
+    if ! sh "$UV_INSTALLER" >&2; then
+      write_failure "uv install failed — install manually from https://docs.astral.sh/uv/"
+    fi
+  fi
+  claude_smart_prepend_astral_bins
+  if ! command -v uv >/dev/null 2>&1; then
+    UV_FOUND=""
+    for candidate in "$HOME/.local/bin/uv" "$HOME/.local/bin/uv.exe" "$HOME/.cargo/bin/uv" "$HOME/bin/uv"; do
+      if [ -x "$candidate" ]; then
+        UV_FOUND="$candidate"
+        break
+      fi
+    done
+    if [ -n "$UV_FOUND" ]; then
+      write_failure "uv installed at $UV_FOUND — add its parent directory to PATH in your shell rc"
+    else
+      write_failure "uv install reported success but binary not found — install manually from https://docs.astral.sh/uv/"
+    fi
+  fi
+fi
+
+cd "$PLUGIN_ROOT"
+echo "[claude-smart] running uv sync..." >&2
+if ! uv sync --locked --python 3.12 --quiet >&2; then
+  write_failure "uv sync failed in $PLUGIN_ROOT — run 'uv sync --locked --python 3.12' there to diagnose"
+fi
+
+# Reflexio's CLI reads ~/.reflexio/.env (see reflexio/cli/env_loader.py);
+# append our two opt-in flags there so `reflexio services start` picks
+# them up regardless of which directory the user runs it from.
+REFLEXIO_ENV="$HOME/.reflexio/.env"
+mkdir -p "$(dirname "$REFLEXIO_ENV")"
+touch "$REFLEXIO_ENV"
+if ! grep -q '^CLAUDE_SMART_USE_LOCAL_CLI=' "$REFLEXIO_ENV"; then
+  printf '\n# Route reflexio generation through the local Claude Code CLI\nCLAUDE_SMART_USE_LOCAL_CLI=1\n' >> "$REFLEXIO_ENV"
+  echo "[claude-smart] appended CLAUDE_SMART_USE_LOCAL_CLI=1 to $REFLEXIO_ENV" >&2
+fi
+if ! grep -q '^CLAUDE_SMART_USE_LOCAL_EMBEDDING=' "$REFLEXIO_ENV"; then
+  printf '# Use the in-process ONNX embedder (chromadb) — no API key for semantic search\nCLAUDE_SMART_USE_LOCAL_EMBEDDING=1\n' >> "$REFLEXIO_ENV"
+  echo "[claude-smart] appended CLAUDE_SMART_USE_LOCAL_EMBEDDING=1 to $REFLEXIO_ENV" >&2
+fi
+
+# Migrate stale REFLEXIO_URL from reflexio's library default (8081) to the
+# plugin backend port (8071). Matches the quoted and unquoted forms but
+# requires paired quotes, so malformed or deliberately different values
+# (e.g. a remote reflexio URL) are preserved.
+if grep -qE '^REFLEXIO_URL=("http://localhost:8081/?"|http://localhost:8081/?)$' "$REFLEXIO_ENV"; then
+  sed -i.bak -E \
+    -e 's|^REFLEXIO_URL="http://localhost:8081(/?)"$|REFLEXIO_URL="http://localhost:8071\1"|' \
+    -e 's|^REFLEXIO_URL=http://localhost:8081(/?)$|REFLEXIO_URL=http://localhost:8071\1|' \
+    "$REFLEXIO_ENV"
+  echo "[claude-smart] migrated REFLEXIO_URL 8081 → 8071 in $REFLEXIO_ENV (backup at $REFLEXIO_ENV.bak)" >&2
+fi
+
+if ! command -v claude >/dev/null 2>&1; then
+  echo "[claude-smart] WARNING: 'claude' CLI not on PATH — reflexio extractors will have no LLM until it's installed" >&2
+fi
+
+# Allowlist cs-cite globally so Claude's citation Bash calls don't pop a
+# permission prompt mid-turn. Idempotent: no-ops when the entry is already
+# present. Uses Python to preserve the rest of settings.json intact.
+# Resolves python via claude_smart_resolve_python so we don't fire the
+# Windows App Execution Alias stub (which exits non-zero with "Python
+# was not found" when no real interpreter is installed).
+CLAUDE_SETTINGS="$HOME/.claude/settings.json"
+mkdir -p "$(dirname "$CLAUDE_SETTINGS")"
+PY_BIN=$(claude_smart_resolve_python || true)
+if [ -z "$PY_BIN" ]; then
+  echo "[claude-smart] WARNING: no working python interpreter found; skipping cs-cite allowlist" >&2
+elif "$PY_BIN" - "$CLAUDE_SETTINGS" <<'PY' >&2
+import json
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+entry = "Bash(cs-cite:*)"
+data: dict = {}
+if path.is_file():
+    try:
+        data = json.loads(path.read_text() or "{}")
+    except json.JSONDecodeError:
+        print(
+            f"[claude-smart] WARNING: {path} is not valid JSON; skipping cs-cite allowlist",
+            file=sys.stderr,
+        )
+        sys.exit(2)
+def _warn_and_exit(reason: str) -> None:
+    print(
+        f"[claude-smart] WARNING: {path} {reason}; skipping cs-cite allowlist",
+        file=sys.stderr,
+    )
+    sys.exit(2)
+
+if not isinstance(data, dict):
+    _warn_and_exit("top-level is not a JSON object")
+permissions = data.setdefault("permissions", {})
+if not isinstance(permissions, dict):
+    _warn_and_exit("'permissions' is not a JSON object")
+allow = permissions.setdefault("allow", [])
+if not isinstance(allow, list):
+    _warn_and_exit("'permissions.allow' is not a JSON array")
+if entry in allow:
+    sys.exit(1)  # already present — convey via exit code so shell can skip the log
+allow.append(entry)
+path.write_text(json.dumps(data, indent=2) + "\n")
+sys.exit(0)
+PY
+then
+  echo "[claude-smart] added Bash(cs-cite:*) to $CLAUDE_SETTINGS permissions.allow" >&2
+fi
+
+# Spawn the dashboard build detached so install returns immediately and
+# Claude Code's install-hook timeout never kills a half-finished
+# `next build` (which would force the user into a manual /claude-smart:restart
+# recovery). dashboard-service.sh will also re-spawn this on SessionStart
+# if .next is still missing, and dashboard-open.sh detects the build-pid
+# file to surface a "still building" message instead of a generic error.
+DASHBOARD_DIR="$PLUGIN_ROOT/dashboard"
+if [ -d "$DASHBOARD_DIR" ]; then
+  install_private_node || true
+fi
+if [ -d "$DASHBOARD_DIR" ] && claude_smart_npm_available; then
+  echo "[claude-smart] starting dashboard build in background (~1-2 min on first install)" >&2
+  claude_smart_spawn_detached bash "$HERE/dashboard-build.sh" >/dev/null 2>&1
+elif [ -d "$DASHBOARD_DIR" ]; then
+  reason="npm is not on PATH after private Node.js bootstrap"
+  echo "[claude-smart] WARNING: $reason" >&2
+  [ -f "$(claude_smart_dashboard_unavailable_marker)" ] || claude_smart_write_dashboard_unavailable "$reason"
+fi
+
+# Point ~/.reflexio/plugin-root at this install so slash commands can
+# reference one stable short path regardless of which marketplace
+# (reflexioai or reflexioai-local) loaded us.
+if ! bash "$HERE/ensure-plugin-root.sh" "$PLUGIN_ROOT"; then
+  echo "[claude-smart] WARNING: failed to set ~/.reflexio/plugin-root symlink — slash commands may not resolve" >&2
+fi
+
+echo "[claude-smart] install complete. Backend and dashboard auto-start on session start." >&2
+echo '{"continue":true,"suppressOutput":true}'

package/plugin/src/claude_smart/__init__.py

@@ -0,0 +1,3 @@
+"""claude-smart — self-improving Claude Code plugin via reflexio."""
+
+__version__ = "0.1.0"