claude-smart 0.2.31 → 0.2.33

package/README.md

@@ -13,7 +13,7 @@
     <img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License">
   </a>
   <a href="plugin/pyproject.toml">
-    <img src="https://img.shields.io/badge/version-0.2.31-green.svg" alt="Version">
+    <img src="https://img.shields.io/badge/version-0.2.33-green.svg" alt="Version">
   </a>
   <a href="plugin/pyproject.toml">
     <img src="https://img.shields.io/badge/python-%3E%3D3.12-brightgreen.svg" alt="Python">
@@ -120,7 +120,7 @@ To uninstall:
 npx claude-smart uninstall --host codex
 ```
 
-Restart Codex after uninstalling. Learned data under `~/.reflexio/` and `~/.claude-smart/` is preserved and shared with Claude Code, so you can switch between hosts without losing skills or preferences.
+Restart Codex after uninstalling. The uninstaller stops local claude-smart services and removes plugin/cache/config state; learned data under `~/.reflexio/` and `~/.claude-smart/` is preserved and shared with Claude Code, so you can switch between hosts without losing skills or preferences.
 
 Developing the plugin itself? See [DEVELOPER.md](./DEVELOPER.md#developing-locally) for what the installer does, manual toggles via `/plugins`, and clone-based development.
 

package/bin/claude-smart.js

@@ -11,10 +11,11 @@
  */
 "use strict";
 
-const { execSync, spawn } = require("child_process");
+const { execSync, spawn, spawnSync } = require("child_process");
 const crypto = require("crypto");
 const {
   appendFileSync,
+  chmodSync,
   cpSync,
   existsSync,
   lstatSync,
@@ -37,6 +38,8 @@ const CODEX_MARKETPLACE_NAME = "reflexioai";
 const CODEX_MARKETPLACE_DISPLAY_NAME = "ReflexioAI";
 const CODEX_PLUGIN_ID = `claude-smart@${CODEX_MARKETPLACE_NAME}`;
 const REFLEXIO_ENV_PATH = join(homedir(), ".reflexio", ".env");
+const MANAGED_REFLEXIO_URL = "https://www.reflexio.ai/";
+const REFLEXIO_USER_ID_ENV = "REFLEXIO_USER_ID";
 const REFLEXIO_DIR = join(homedir(), ".reflexio");
 const CLAUDE_SMART_STATE_DIR = join(homedir(), ".claude-smart");
 const CODEX_CONFIG_PATH = join(homedir(), ".codex", "config.toml");
@@ -48,7 +51,7 @@ const CODEX_MARKETPLACE_DIR = join(
   "marketplaces",
   CODEX_MARKETPLACE_NAME,
 );
-const CODEX_MARKETPLACE_PLUGIN_PATH = join("plugins", "claude-smart");
+const CODEX_MARKETPLACE_PLUGIN_PATH = "plugin";
 const CODEX_PLUGIN_CACHE_DIR = join(
   homedir(),
   ".codex",
@@ -57,6 +60,14 @@ const CODEX_PLUGIN_CACHE_DIR = join(
   CODEX_MARKETPLACE_NAME,
   "claude-smart",
 );
+const LOCAL_DATA_NOTICE = [
+  "Local data was kept so reinstalling claude-smart can reuse your learned rules, sessions, logs, and local Reflexio data.",
+  "Kept folders:",
+  "  ~/.claude-smart",
+  "  ~/.reflexio",
+  "Delete them only if you want a full reset or need to remove local claude-smart data from this machine:",
+  "  rm -rf ~/.claude-smart ~/.reflexio",
+];
 const CODEX_REQUIRED_FILES = [
   ".agents/plugins/marketplace.json",
   "plugin/.codex-plugin/plugin.json",
@@ -68,6 +79,7 @@ const CODEX_REQUIRED_FILES = [
   "plugin/scripts/_codex_env.sh",
 ];
 const CODEX_CLI_TIMEOUT_MS = 30_000;
+const PLUGIN_SERVICE_TIMEOUT_MS = 15_000;
 const COPYTREE_IGNORE_NAMES = new Set([
   "__pycache__",
   ".venv",
@@ -197,9 +209,103 @@ function seedReflexioEnv() {
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
   const body = missing.map((f) => `${f}=1`).join("\n") + "\n";
   appendFileSync(REFLEXIO_ENV_PATH, prefix + body);
+  chmodSync(REFLEXIO_ENV_PATH, 0o600);
   return missing;
 }
 
+function escapeEnvValue(value) {
+  return String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+
+function parseEnvLine(line) {
+  let trimmed = String(line || "").trim();
+  if (!trimmed || trimmed.startsWith("#")) return null;
+  if (trimmed.startsWith("export ")) trimmed = trimmed.slice("export ".length).trimStart();
+  const eq = trimmed.indexOf("=");
+  if (eq < 0) return null;
+  const key = trimmed.slice(0, eq).trim();
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) return null;
+  return { key };
+}
+
+function setReflexioEnvVars(values) {
+  mkdirSync(dirname(REFLEXIO_ENV_PATH), { recursive: true });
+  const existing = existsSync(REFLEXIO_ENV_PATH)
+    ? readFileSync(REFLEXIO_ENV_PATH, "utf8")
+    : "";
+  const lines = existing ? existing.split(/\r?\n/) : [];
+  const seen = new Set();
+  const out = [];
+  for (const line of lines) {
+    const parsed = parseEnvLine(line);
+    if (parsed && Object.prototype.hasOwnProperty.call(values, parsed.key)) {
+      out.push(`${parsed.key}="${escapeEnvValue(values[parsed.key])}"`);
+      seen.add(parsed.key);
+    } else {
+      out.push(line);
+    }
+  }
+  const added = [];
+  for (const [key, value] of Object.entries(values)) {
+    if (seen.has(key)) continue;
+    out.push(`${key}="${escapeEnvValue(value)}"`);
+    added.push(key);
+  }
+  const content = out.join("\n").replace(/\n*$/, "\n");
+  writeFileSync(REFLEXIO_ENV_PATH, content);
+  chmodSync(REFLEXIO_ENV_PATH, 0o600);
+  return added;
+}
+
+function readReflexioEnvValue(key) {
+  const existing = existsSync(REFLEXIO_ENV_PATH)
+    ? readFileSync(REFLEXIO_ENV_PATH, "utf8")
+    : "";
+  for (const line of existing.split(/\r?\n/)) {
+    const parsed = parseEnvLine(line);
+    if (!parsed || parsed.key !== key) continue;
+    let value = line.slice(line.indexOf("=") + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    return value;
+  }
+  return "";
+}
+
+function maskSecret(value) {
+  if (!value) return "";
+  if (value.length <= 8) return "*".repeat(value.length);
+  const prefix = value.slice(0, 8).includes("-") ? value.slice(0, 5) : value.slice(0, 4);
+  return `${prefix}****${value.slice(-4)}`;
+}
+
+function configureReflexioSetup(args) {
+  const apiKey = parseOptionalArg(args, "--api-key").trim();
+  if (apiKey) {
+    const reflexioUrl = parseOptionalArg(args, "--reflexio-url") || MANAGED_REFLEXIO_URL;
+    const userId = readReflexioEnvValue(REFLEXIO_USER_ID_ENV) || crypto.randomUUID();
+    const added = setReflexioEnvVars({
+      REFLEXIO_URL: reflexioUrl,
+      REFLEXIO_API_KEY: apiKey,
+      [REFLEXIO_USER_ID_ENV]: userId,
+    });
+    const changed = added.length > 0 ? added.join(", ") : "managed Reflexio settings";
+    process.stdout.write(
+      `Configured ${REFLEXIO_ENV_PATH} for managed Reflexio (${changed}; API key ${maskSecret(apiKey)}).\n`,
+    );
+    return;
+  }
+
+  const added = seedReflexioEnv();
+  if (added.length > 0) {
+    process.stdout.write(`Seeded ${REFLEXIO_ENV_PATH} with ${added.join(", ")}.\n`);
+  }
+}
+
 function findClaudeCodePluginRoot() {
   const cacheRoot = join(homedir(), ".claude", "plugins", "cache", CODEX_MARKETPLACE_NAME, "claude-smart");
   const candidates = [];
@@ -218,6 +324,8 @@ function findClaudeCodePluginRoot() {
     // Fall through to marketplace/package fallbacks.
   }
   candidates.sort((a, b) => {
+    const versionCompare = compareSemverLikePathNames(b, a);
+    if (versionCompare !== 0) return versionCompare;
     try {
       return statSync(b).mtimeMs - statSync(a).mtimeMs;
     } catch {
@@ -239,6 +347,27 @@ function findClaudeCodePluginRoot() {
   return null;
 }
 
+function semverLikePathName(path) {
+  const base = String(path).split(/[\\/]/).pop() || "";
+  const match = base.match(/^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/);
+  if (!match) return null;
+  return match.slice(1).map((part) => Number.parseInt(part, 10));
+}
+
+function compareSemverLikePathNames(a, b) {
+  const av = semverLikePathName(a);
+  const bv = semverLikePathName(b);
+  if (av && bv) {
+    for (let i = 0; i < 3; i += 1) {
+      if (av[i] !== bv[i]) return av[i] - bv[i];
+    }
+    return 0;
+  }
+  if (av) return 1;
+  if (bv) return -1;
+  return 0;
+}
+
 function forcePluginRoot(pluginRoot) {
   mkdirSync(REFLEXIO_DIR, { recursive: true });
   const link = join(REFLEXIO_DIR, "plugin-root");
@@ -342,6 +471,45 @@ function runChecked(command, args, options = {}) {
   });
 }
 
+function runPluginService(pluginRoot, scriptName, subcommand) {
+  const script = join(pluginRoot, "scripts", scriptName);
+  if (!existsSync(script)) return false;
+  const bash = resolveCommand(isWindows() ? ["bash.exe", "bash"] : ["bash"]);
+  if (!bash) return false;
+  const result = spawnSync(bash, [script, subcommand], {
+    cwd: pluginRoot,
+    env: runtimeEnv(),
+    stdio: "ignore",
+    windowsHide: true,
+    timeout: PLUGIN_SERVICE_TIMEOUT_MS,
+    killSignal: "SIGTERM",
+  });
+  if (result.error || result.signal) {
+    const reason = result.error && result.error.code === "ETIMEDOUT"
+      ? `timed out after ${PLUGIN_SERVICE_TIMEOUT_MS / 1000}s`
+      : result.error
+        ? result.error.message
+        : `terminated by ${result.signal}`;
+    process.stderr.write(
+      `warning: ${scriptName} ${subcommand} ${reason}; continuing.\n`,
+    );
+    return false;
+  }
+  return result.status === 0;
+}
+
+function refreshDashboardService(pluginRoot) {
+  // dashboard-service.sh is marker-gated: stop only reaps a listener that
+  // identifies as claude-smart, so foreign apps on 3001 are left alone.
+  runPluginService(pluginRoot, "dashboard-service.sh", "stop");
+  return runPluginService(pluginRoot, "dashboard-service.sh", "start");
+}
+
+function stopClaudeSmartServices(pluginRoot) {
+  runPluginService(pluginRoot, "dashboard-service.sh", "stop");
+  runPluginService(pluginRoot, "backend-service.sh", "stop");
+}
+
 function downloadFile(url, dest) {
   return new Promise((resolve, reject) => {
     const request = https.get(url, (response) => {
@@ -676,6 +844,7 @@ function printHelp() {
       "  npx claude-smart install                       Install the plugin into Claude Code",
       "  npx claude-smart install --host codex          Register the plugin marketplace for Codex",
       "  npx claude-smart install --source <owner/repo> Override the marketplace source",
+      "  npx claude-smart install --api-key <key>        Use managed Reflexio service",
       "  npx claude-smart uninstall --host codex        Remove the Codex marketplace registration",
       "  npx claude-smart --help                        Show this help",
       "",
@@ -684,6 +853,7 @@ function printHelp() {
       `  2. claude plugin install ${PLUGIN_SPEC}`,
       "  3. Appends CLAUDE_SMART_USE_LOCAL_CLI=1 and CLAUDE_SMART_USE_LOCAL_EMBEDDING=1",
       "     to ~/.reflexio/.env (idempotent).",
+      "     Passing --api-key writes REFLEXIO_URL, REFLEXIO_API_KEY, and REFLEXIO_USER_ID instead.",
       "",
       "Codex install:",
       `  1. Copies the bundled marketplace to ${CODEX_MARKETPLACE_DIR}`,
@@ -696,6 +866,7 @@ function printHelp() {
       "",
       "Update:",
       "  npx claude-smart update                        Update to the latest version",
+      "  npx claude-smart update --api-key <key>        Update and configure managed Reflexio",
       "",
       "Uninstall:",
       "  npx claude-smart uninstall                     Remove the plugin from Claude Code",
@@ -715,6 +886,17 @@ function parseSource(args) {
   return value;
 }
 
+function parseOptionalArg(args, flag) {
+  const idx = args.indexOf(flag);
+  if (idx === -1) return "";
+  const value = args[idx + 1];
+  if (!value) {
+    process.stderr.write(`error: ${flag} requires a value\n`);
+    process.exit(1);
+  }
+  return value;
+}
+
 function parseHost(args) {
   const idx = args.indexOf("--host");
   if (idx === -1) return "claude-code";
@@ -791,6 +973,21 @@ function copyCodexMarketplace() {
   return CODEX_MARKETPLACE_DIR;
 }
 
+function codexMarketplacePluginRoot(marketplaceRoot) {
+  const manifestPath = join(marketplaceRoot, ".agents", "plugins", "marketplace.json");
+  const fallback = join(marketplaceRoot, CODEX_MARKETPLACE_PLUGIN_PATH);
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const entry = (manifest.plugins || []).find((plugin) => plugin.name === "claude-smart");
+    const rawPath = entry && entry.source && entry.source.path;
+    if (typeof rawPath !== "string" || !rawPath) return fallback;
+    const relPath = rawPath.replace(/^\.\//, "");
+    return join(marketplaceRoot, relPath);
+  } catch {
+    return fallback;
+  }
+}
+
 function removeTomlSections(path, { exact, prefixes = [] }) {
   if (!existsSync(path)) return true;
   const text = readFileSync(path, "utf8");
@@ -1095,7 +1292,7 @@ function installCodexPluginCache(pluginRoot) {
   return cacheDir;
 }
 
-async function runUpdate() {
+async function runUpdate(args) {
   if (!hasClaudeCli()) {
     process.stderr.write(
       "error: 'claude' CLI not found on PATH. " +
@@ -1113,6 +1310,7 @@ async function runUpdate() {
   }
 
   process.stdout.write("\nclaude-smart updated. Restart Claude Code to apply.\n");
+  if (args.includes("--api-key")) configureReflexioSetup(args);
 }
 
 async function runUninstall(args) {
@@ -1138,12 +1336,13 @@ async function runUninstall(args) {
     );
     process.exit(code);
   }
+  stopClaudeSmartServices(join(PACKAGE_ROOT, "plugin"));
 
   process.stdout.write(
     [
       "",
       "claude-smart uninstalled. Restart Claude Code to apply.",
-      "Local data in ~/.reflexio/ and ~/.claude-smart/ was left in place — remove manually if desired.",
+      ...LOCAL_DATA_NOTICE,
       "",
     ].join("\n"),
   );
@@ -1151,7 +1350,7 @@ async function runUninstall(args) {
 
 async function runInstall(args) {
   if (parseHost(args) === "codex") {
-    await runInstallCodex();
+    await runInstallCodex(args);
     return;
   }
 
@@ -1164,6 +1363,8 @@ async function runInstall(args) {
   }
 
   const source = parseSource(args);
+  configureReflexioSetup(args);
+
   const steps = [
     { args: ["plugin", "marketplace", "add", source], label: "Adding marketplace…" },
     { args: ["plugin", "install", PLUGIN_SPEC], label: "Installing claude-smart…" },
@@ -1179,15 +1380,12 @@ async function runInstall(args) {
     }
   }
 
-  const added = seedReflexioEnv();
-  if (added.length > 0) {
-    process.stdout.write(
-      `Seeded ${REFLEXIO_ENV_PATH} with ${added.join(", ")}.\n`,
-    );
-  }
   try {
     const pluginRoot = await bootstrapClaudeCodeInstall();
     process.stdout.write(`Prepared claude-smart runtime at ${pluginRoot}.\n`);
+    if (refreshDashboardService(pluginRoot)) {
+      process.stdout.write("Refreshed claude-smart dashboard service.\n");
+    }
   } catch (err) {
     process.stderr.write(
       `error: claude-smart installed, but dependency bootstrap failed: ${err && err.message ? err.message : err}\n`,
@@ -1209,11 +1407,12 @@ async function runInstall(args) {
   );
 }
 
-async function runInstallCodex() {
+async function runInstallCodex(args) {
   if (!hasCli("codex")) {
     process.stderr.write("error: 'codex' CLI not found on PATH. Install Codex first.\n");
     process.exit(1);
   }
+  configureReflexioSetup(args);
 
   const marketplaceRoot = copyCodexMarketplace();
   process.stdout.write(`Prepared Codex marketplace at ${marketplaceRoot}.\n`);
@@ -1254,9 +1453,12 @@ async function runInstallCodex() {
   let trustedHookCount = 0;
   let trustError = null;
   try {
-    cacheDir = installCodexPluginCache(join(marketplaceRoot, CODEX_MARKETPLACE_PLUGIN_PATH));
+    cacheDir = installCodexPluginCache(codexMarketplacePluginRoot(marketplaceRoot));
     process.stdout.write(`Installed Codex plugin cache at ${cacheDir}.\n`);
     await bootstrapPluginRuntime(cacheDir);
+    if (refreshDashboardService(cacheDir)) {
+      process.stdout.write("Refreshed claude-smart dashboard service.\n");
+    }
   } catch (err) {
     process.stderr.write(
       `error: automatic Codex plugin install failed: ${err && err.message ? err.message : err}\n`,
@@ -1289,11 +1491,6 @@ async function runInstallCodex() {
     process.stdout.write(`Trusted and enabled ${trustedHookCount} claude-smart Codex hooks.\n`);
   }
 
-  const added = seedReflexioEnv();
-  if (added.length > 0) {
-    process.stdout.write(`Seeded ${REFLEXIO_ENV_PATH} with ${added.join(", ")}.\n`);
-  }
-
   process.stdout.write(
     [
       "",
@@ -1306,6 +1503,7 @@ async function runInstallCodex() {
 }
 
 async function runUninstallCodex() {
+  stopClaudeSmartServices(join(PACKAGE_ROOT, "plugin"));
   if (!hasCli("codex")) {
     process.stdout.write("Codex CLI not found; skipping marketplace removal.\n");
     cleanupCodexInstallState();
@@ -1324,7 +1522,8 @@ async function runUninstallCodex() {
     [
       "",
       "claude-smart Codex plugin and marketplace state removed. Restart Codex to apply.",
-      "Codex's global hook feature flags and local data under ~/.reflexio/ and ~/.claude-smart/ were left in place.",
+      "Codex's global hook feature flags were left in place.",
+      ...LOCAL_DATA_NOTICE,
       "",
     ].join("\n"),
   );
@@ -1345,7 +1544,7 @@ async function main() {
   }
 
   if (cmd === "update") {
-    await runUpdate();
+    await runUpdate(args.slice(1));
     return;
   }
 
@@ -1370,8 +1569,11 @@ if (require.main === module) {
 module.exports = {
   assertSupportedRuntimePlatform,
   bootstrapPluginRuntime,
+  codexMarketplacePluginRoot,
+  copyCodexMarketplace,
   ensurePrivateNode,
   ensureUv,
+  configureReflexioSetup,
   patchCodexHooksForNode,
   platformSupportError,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-smart",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Self-improving Claude Code plugin — learns from corrections via reflexio",
   "keywords": [
     "claude",

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-smart",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Self-improving Claude Code plugin — learns from corrections across sessions via reflexio",
   "author": {
     "name": "Yi Lu"

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-smart",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Self-improving coding assistant plugin — learns from corrections across sessions via reflexio",
   "author": {
     "name": "Yi Lu"

package/plugin/dashboard/app/api/config/route.ts

@@ -1,16 +1,25 @@
 import { NextResponse } from "next/server";
 import { readConfig, writeConfig } from "@/lib/config-file";
+import type { ClaudeSmartConfig } from "@/lib/types";
 
 export const dynamic = "force-dynamic";
 
+function publicConfig(config: ClaudeSmartConfig): ClaudeSmartConfig {
+  return {
+    ...config,
+    REFLEXIO_API_KEY: "",
+    REFLEXIO_API_KEY_SET: Boolean(config.REFLEXIO_API_KEY),
+  };
+}
+
 export async function GET() {
   const config = await readConfig();
-  return NextResponse.json(config);
+  return NextResponse.json(publicConfig(config));
 }
 
 export async function PUT(req: Request) {
   const body = await req.json();
   await writeConfig(body);
   const config = await readConfig();
-  return NextResponse.json(config);
+  return NextResponse.json(publicConfig(config));
 }

package/plugin/dashboard/app/api/health/route.ts

@@ -1,10 +1,49 @@
-export const dynamic = "force-static";
+import { readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+export const dynamic = "force-dynamic";
+
+function realpathOrSelf(value: string): string {
+  try {
+    return realpathSync(value);
+  } catch {
+    return value;
+  }
+}
+
+function pluginVersion(pluginRoot: string): string {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(path.join(pluginRoot, ".codex-plugin", "plugin.json"), "utf8"),
+    );
+    return typeof manifest.version === "string" && manifest.version
+      ? manifest.version
+      : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
 
 export function GET() {
-  return new Response(JSON.stringify({ service: "claude-smart-dashboard" }), {
-    headers: {
-      "content-type": "application/json",
-      "x-claude-smart-dashboard": "1",
+  const dashboardDir = realpathOrSelf(process.cwd());
+  const pluginRoot = realpathOrSelf(path.dirname(dashboardDir));
+  const version = pluginVersion(pluginRoot);
+
+  return new Response(
+    JSON.stringify({
+      service: "claude-smart-dashboard",
+      pluginRoot,
+      dashboardDir,
+      version,
+    }),
+    {
+      headers: {
+        "content-type": "application/json",
+        "x-claude-smart-dashboard": "1",
+        "x-claude-smart-plugin-root": pluginRoot,
+        "x-claude-smart-dashboard-dir": dashboardDir,
+        "x-claude-smart-version": version,
+      },
     },
-  });
+  );
 }

package/plugin/dashboard/app/api/reflexio/[...path]/route.ts

@@ -1,16 +1,21 @@
 import { NextResponse } from "next/server";
 import { originOnly } from "@/lib/reflexio-url";
+import { readConfig } from "@/lib/config-file";
 
 export const dynamic = "force-dynamic";
 
 const DEFAULT_URL = "http://localhost:8071";
 
-function reflexioBase(req: Request): string {
-  const header = req.headers.get("x-reflexio-url");
-  const fromHeader = header ? originOnly(header) : null;
-  if (fromHeader) return fromHeader;
+async function reflexioConfig(): Promise<{ base: string; apiKey: string }> {
+  const config = await readConfig();
+  const apiKey = config.REFLEXIO_API_KEY || process.env.REFLEXIO_API_KEY || "";
   const fromEnv = originOnly(process.env.REFLEXIO_URL ?? "");
-  return fromEnv ?? DEFAULT_URL;
+  const fromConfig = originOnly(config.REFLEXIO_URL ?? "");
+  const configuredBase = fromEnv ?? fromConfig;
+  return {
+    base: configuredBase ?? DEFAULT_URL,
+    apiKey: configuredBase ? apiKey : "",
+  };
 }
 
 async function proxy(
@@ -20,12 +25,15 @@ async function proxy(
   const { path } = await context.params;
   const targetPath = path.join("/");
   const url = new URL(req.url);
-  const target = `${reflexioBase(req)}/${targetPath}${url.search}`;
+  const { base, apiKey } = await reflexioConfig();
+  const target = `${base}/${targetPath}${url.search}`;
 
   const headers = new Headers(req.headers);
   headers.delete("host");
-  headers.delete("x-reflexio-url");
   headers.delete("connection");
+  headers.delete("authorization");
+  headers.set("user-agent", "claude-smart");
+  if (apiKey) headers.set("authorization", `Bearer ${apiKey}`);
 
   const init: RequestInit = {
     method: req.method,

package/plugin/dashboard/app/api/rules/applied/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+import { listAppliedRules } from "@/lib/session-reader";
+
+export const dynamic = "force-dynamic";
+
+const MAX_DAYS_BACK = 365;
+const MAX_LIMIT = 500;
+
+function positiveInt(value: string | null, fallback: number): number {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const daysBack = Math.min(
+    positiveInt(url.searchParams.get("daysBack"), 30),
+    MAX_DAYS_BACK,
+  );
+  const limit = Math.min(
+    positiveInt(url.searchParams.get("limit"), 20),
+    MAX_LIMIT,
+  );
+  const stats = await listAppliedRules({ daysBack, limit });
+  return NextResponse.json({ success: true, stats });
+}