claude-smart 0.2.35 → 0.2.37

package/README.md

@@ -13,7 +13,7 @@
     <img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License">
   </a>
   <a href="plugin/pyproject.toml">
-    <img src="https://img.shields.io/badge/version-0.2.35-green.svg" alt="Version">
+    <img src="https://img.shields.io/badge/version-0.2.37-green.svg" alt="Version">
   </a>
   <a href="plugin/pyproject.toml">
     <img src="https://img.shields.io/badge/python-%3E%3D3.12-brightgreen.svg" alt="Python">

package/bin/claude-smart.js

@@ -5,7 +5,9 @@
  * plugin. For Codex it copies the bundled local marketplace, registers it,
  * and enables plugin hooks. Both paths seed ~/.reflexio/.env with the two
  * local-provider flags so reflexio can route generation through local tools
- * with no API key.
+ * with no API key. Managed/read-only/global setup is handled by
+ * `npx claude-smart setup`, which writes ~/.reflexio/.env before running this
+ * installer.
  *
  * Keep this file dependency-free — it runs via `npx` with no install step.
  */
@@ -14,8 +16,6 @@
 const { execSync, spawn, spawnSync } = require("child_process");
 const crypto = require("crypto");
 const {
-  appendFileSync,
-  chmodSync,
   cpSync,
   existsSync,
   lstatSync,
@@ -39,8 +39,9 @@ const CODEX_MARKETPLACE_DISPLAY_NAME = "ReflexioAI";
 const CODEX_PLUGIN_ID = `claude-smart@${CODEX_MARKETPLACE_NAME}`;
 const REFLEXIO_ENV_PATH = join(homedir(), ".reflexio", ".env");
 const MANAGED_REFLEXIO_URL = "https://www.reflexio.ai/";
-const REFLEXIO_USER_ID_ENV = "REFLEXIO_USER_ID";
 const MANAGED_SETUP_ENV = "CLAUDE_SMART_MANAGED_SETUP";
+const CLAUDE_SMART_READ_ONLY_ENV = "CLAUDE_SMART_READ_ONLY";
+const REFLEXIO_USER_ID_ENV = "REFLEXIO_USER_ID";
 const REFLEXIO_DIR = join(homedir(), ".reflexio");
 const CLAUDE_SMART_STATE_DIR = join(homedir(), ".claude-smart");
 const CODEX_CONFIG_PATH = join(homedir(), ".codex", "config.toml");
@@ -196,28 +197,6 @@ function runCodex(args) {
   });
 }
 
-function seedReflexioEnv() {
-  mkdirSync(dirname(REFLEXIO_ENV_PATH), { recursive: true });
-  const existing = existsSync(REFLEXIO_ENV_PATH)
-    ? readFileSync(REFLEXIO_ENV_PATH, "utf8")
-    : "";
-  const flags = [
-    "CLAUDE_SMART_USE_LOCAL_CLI",
-    "CLAUDE_SMART_USE_LOCAL_EMBEDDING",
-  ];
-  const missing = flags.filter((f) => !new RegExp(`^${f}=`, "m").test(existing));
-  if (missing.length === 0) return [];
-  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  const body = missing.map((f) => `${f}=1`).join("\n") + "\n";
-  appendFileSync(REFLEXIO_ENV_PATH, prefix + body);
-  chmodSync(REFLEXIO_ENV_PATH, 0o600);
-  return missing;
-}
-
-function escapeEnvValue(value) {
-  return String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-
 function parseEnvLine(line) {
   let trimmed = String(line || "").trim();
   if (!trimmed || trimmed.startsWith("#")) return null;
@@ -226,55 +205,15 @@ function parseEnvLine(line) {
   if (eq < 0) return null;
   const key = trimmed.slice(0, eq).trim();
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) return null;
-  return { key };
-}
-
-function setReflexioEnvVars(values) {
-  mkdirSync(dirname(REFLEXIO_ENV_PATH), { recursive: true });
-  const existing = existsSync(REFLEXIO_ENV_PATH)
-    ? readFileSync(REFLEXIO_ENV_PATH, "utf8")
-    : "";
-  const lines = existing ? existing.split(/\r?\n/) : [];
-  const seen = new Set();
-  const out = [];
-  for (const line of lines) {
-    const parsed = parseEnvLine(line);
-    if (parsed && Object.prototype.hasOwnProperty.call(values, parsed.key)) {
-      out.push(`${parsed.key}="${escapeEnvValue(values[parsed.key])}"`);
-      seen.add(parsed.key);
-    } else {
-      out.push(line);
-    }
-  }
-  const added = [];
-  for (const [key, value] of Object.entries(values)) {
-    if (seen.has(key)) continue;
-    out.push(`${key}="${escapeEnvValue(value)}"`);
-    added.push(key);
-  }
-  const content = out.join("\n").replace(/\n*$/, "\n");
-  writeFileSync(REFLEXIO_ENV_PATH, content);
-  chmodSync(REFLEXIO_ENV_PATH, 0o600);
-  return added;
-}
-
-function readReflexioEnvValue(key) {
-  const existing = existsSync(REFLEXIO_ENV_PATH)
-    ? readFileSync(REFLEXIO_ENV_PATH, "utf8")
-    : "";
-  for (const line of existing.split(/\r?\n/)) {
-    const parsed = parseEnvLine(line);
-    if (!parsed || parsed.key !== key) continue;
-    let value = line.slice(line.indexOf("=") + 1).trim();
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    return value;
+  let value = trimmed.slice(eq + 1).trim();
+  if (
+    value.length >= 2 &&
+    ((value[0] === '"' && value[value.length - 1] === '"') ||
+      (value[0] === "'" && value[value.length - 1] === "'"))
+  ) {
+    value = value.slice(1, -1);
   }
-  return "";
+  return { key, value };
 }
 
 function maskSecret(value) {
@@ -284,31 +223,47 @@ function maskSecret(value) {
   return `${prefix}****${value.slice(-4)}`;
 }
 
-function configureReflexioSetup(args) {
-  const apiKey = parseOptionalArg(args, "--api-key").trim();
+function loadReflexioSetupEnv() {
+  let readOnlyValue = "";
+  let fileApiKey = "";
+  let fileUrl = "";
+  if (existsSync(REFLEXIO_ENV_PATH)) {
+    const text = readFileSync(REFLEXIO_ENV_PATH, "utf8");
+    for (const line of text.split(/\r?\n/)) {
+      const parsed = parseEnvLine(line);
+      if (!parsed) continue;
+      if (parsed.key === "REFLEXIO_API_KEY") {
+        fileApiKey = parsed.value;
+      } else if (parsed.key === "REFLEXIO_URL") {
+        fileUrl = parsed.value;
+      } else if (parsed.key === REFLEXIO_USER_ID_ENV) {
+        process.env[parsed.key] = parsed.value;
+      } else if (parsed.key === CLAUDE_SMART_READ_ONLY_ENV) {
+        readOnlyValue = parsed.value;
+      }
+    }
+  }
+  const apiKey = (fileApiKey || process.env.REFLEXIO_API_KEY || "").trim();
   if (apiKey) {
-    const reflexioUrl = parseOptionalArg(args, "--reflexio-url") || MANAGED_REFLEXIO_URL;
-    const userId = readReflexioEnvValue(REFLEXIO_USER_ID_ENV) || crypto.randomUUID();
-    const added = setReflexioEnvVars({
-      REFLEXIO_URL: reflexioUrl,
-      REFLEXIO_API_KEY: apiKey,
-      [REFLEXIO_USER_ID_ENV]: userId,
-    });
-    const changed = added.length > 0 ? added.join(", ") : "managed Reflexio settings";
-    process.stdout.write(
-      `Configured ${REFLEXIO_ENV_PATH} for managed Reflexio (${changed}; API key ${maskSecret(apiKey)}).\n`,
-    );
-    process.env.REFLEXIO_URL = reflexioUrl;
     process.env.REFLEXIO_API_KEY = apiKey;
-    process.env[REFLEXIO_USER_ID_ENV] = userId;
+    process.env.REFLEXIO_URL = (fileUrl || process.env.REFLEXIO_URL || MANAGED_REFLEXIO_URL).trim();
     process.env[MANAGED_SETUP_ENV] = "1";
-    return;
+    process.stdout.write(
+      `Using managed Reflexio at ${process.env.REFLEXIO_URL} (API key ${maskSecret(apiKey)}).\n`,
+    );
+  } else {
+    delete process.env.REFLEXIO_URL;
+    delete process.env.REFLEXIO_API_KEY;
+    delete process.env[MANAGED_SETUP_ENV];
   }
+  const readOnly = ["1", "true", "yes", "on"].includes(
+    String(readOnlyValue).trim().toLowerCase(),
+  );
+  return { readOnly };
+}
 
-  const added = seedReflexioEnv();
-  if (added.length > 0) {
-    process.stdout.write(`Seeded ${REFLEXIO_ENV_PATH} with ${added.join(", ")}.\n`);
-  }
+function configureReflexioSetup() {
+  return loadReflexioSetupEnv();
 }
 
 function findClaudeCodePluginRoot() {
@@ -752,6 +707,50 @@ function quoteCommandPart(part) {
   return `"${String(part).replace(/"/g, '\\"')}"`;
 }
 
+function commandIsPublishHook(command) {
+  if (typeof command !== "string") return false;
+  return (
+    /hook_entry\.sh\b[\s"']+(?:codex|claude-code)[\s"']+(?:stop|session-end)\b/.test(command) ||
+    /codex-hook\.js"?(?:\s+"?hook"?){1}\s+"?(?:stop|session-end)"?/.test(command)
+  );
+}
+
+function prunePublishHooksForReadOnly(pluginRoot) {
+  for (const hookFile of ["hooks.json", "codex-hooks.json"]) {
+    const hookPath = join(pluginRoot, "hooks", hookFile);
+    if (!existsSync(hookPath)) continue;
+    const parsed = JSON.parse(readFileSync(hookPath, "utf8"));
+    const hooksByEvent = parsed.hooks || {};
+    for (const event of Object.keys(hooksByEvent)) {
+      const blocks = [];
+      for (const block of hooksByEvent[event] || []) {
+        const keptHooks = (block.hooks || []).filter(
+          (hook) => !commandIsPublishHook(hook && hook.command),
+        );
+        if (keptHooks.length > 0) blocks.push({ ...block, hooks: keptHooks });
+      }
+      if (blocks.length > 0) {
+        hooksByEvent[event] = blocks;
+      } else {
+        delete hooksByEvent[event];
+      }
+    }
+    writeFileSync(hookPath, JSON.stringify(parsed, null, 2) + "\n");
+  }
+}
+
+function restorePublishHooksFromSource(pluginRoot) {
+  const sourceHooksDir = join(PACKAGE_ROOT, "plugin", "hooks");
+  const targetHooksDir = join(pluginRoot, "hooks");
+  for (const hookFile of ["hooks.json", "codex-hooks.json"]) {
+    const sourcePath = join(sourceHooksDir, hookFile);
+    const targetPath = join(targetHooksDir, hookFile);
+    if (!existsSync(sourcePath) || !existsSync(targetPath)) continue;
+    if (sourcePath === targetPath) continue;
+    cpSync(sourcePath, targetPath, { force: true });
+  }
+}
+
 function patchCodexHooksForNode(pluginRoot, nodePath) {
   const hookPath = join(pluginRoot, "hooks", "codex-hooks.json");
   const parsed = JSON.parse(readFileSync(hookPath, "utf8"));
@@ -796,11 +795,12 @@ function ensurePluginRoot(pluginRoot) {
   }
 }
 
-async function bootstrapPluginRuntime(pluginRoot) {
+async function bootstrapPluginRuntime(pluginRoot, options = {}) {
   assertSupportedRuntimePlatform();
   process.stdout.write("Preparing claude-smart runtime for hooks...\n");
   const nodeRuntime = await ensurePrivateNode();
   patchCodexHooksForNode(pluginRoot, nodeRuntime.node);
+  if (options.readOnly) prunePublishHooksForReadOnly(pluginRoot);
   ensurePluginRoot(pluginRoot);
   const uv = await ensureUv();
   const env = runtimeEnv([dirname(uv), ...privateNodeBinDirs()]);
@@ -849,16 +849,14 @@ function printHelp() {
       "  npx claude-smart install                       Install the plugin into Claude Code",
       "  npx claude-smart install --host codex          Register the plugin marketplace for Codex",
       "  npx claude-smart install --source <owner/repo> Override the marketplace source",
-      "  npx claude-smart install --api-key <key>        Use managed Reflexio service",
+      "  npx claude-smart setup                         Configure managed/read-only/global setup",
       "  npx claude-smart uninstall --host codex        Remove the Codex marketplace registration",
       "  npx claude-smart --help                        Show this help",
       "",
       "Claude Code install:",
       "  1. claude plugin marketplace add <source>",
       `  2. claude plugin install ${PLUGIN_SPEC}`,
-      "  3. Appends CLAUDE_SMART_USE_LOCAL_CLI=1 and CLAUDE_SMART_USE_LOCAL_EMBEDDING=1",
-      "     to ~/.reflexio/.env (idempotent).",
-      "     Passing --api-key writes REFLEXIO_URL, REFLEXIO_API_KEY, and REFLEXIO_USER_ID instead.",
+      "  3. Reads ~/.reflexio/.env when managed/read-only setup was configured.",
       "",
       "Codex install:",
       `  1. Copies the bundled marketplace to ${CODEX_MARKETPLACE_DIR}`,
@@ -871,7 +869,7 @@ function printHelp() {
       "",
       "Update:",
       "  npx claude-smart update                        Update to the latest version",
-      "  npx claude-smart update --api-key <key>        Update and configure managed Reflexio",
+      "  npx claude-smart setup                         Configure managed/read-only/global setup",
       "",
       "Uninstall:",
       "  npx claude-smart uninstall                     Remove the plugin from Claude Code",
@@ -891,17 +889,6 @@ function parseSource(args) {
   return value;
 }
 
-function parseOptionalArg(args, flag) {
-  const idx = args.indexOf(flag);
-  if (idx === -1) return "";
-  const value = args[idx + 1];
-  if (!value) {
-    process.stderr.write(`error: ${flag} requires a value\n`);
-    process.exit(1);
-  }
-  return value;
-}
-
 function parseHost(args) {
   const idx = args.indexOf("--host");
   if (idx === -1) return "claude-code";
@@ -1298,6 +1285,7 @@ function installCodexPluginCache(pluginRoot) {
 }
 
 async function runUpdate(args) {
+  const setup = configureReflexioSetup();
   if (!hasClaudeCli()) {
     process.stderr.write(
       "error: 'claude' CLI not found on PATH. " +
@@ -1315,7 +1303,14 @@ async function runUpdate(args) {
   }
 
   process.stdout.write("\nclaude-smart updated. Restart Claude Code to apply.\n");
-  if (args.includes("--api-key")) configureReflexioSetup(args);
+  const pluginRoot = findClaudeCodePluginRoot();
+  if (pluginRoot) {
+    restorePublishHooksFromSource(pluginRoot);
+    if (setup.readOnly) {
+      prunePublishHooksForReadOnly(pluginRoot);
+      process.stdout.write("Installed read-only hook manifest; publish interactions hooks are disabled.\n");
+    }
+  }
 }
 
 async function runUninstall(args) {
@@ -1353,6 +1348,21 @@ async function runUninstall(args) {
   );
 }
 
+async function runSetup(args) {
+  const bash = resolveCommand(isWindows() ? ["bash.exe", "bash"] : ["bash"]);
+  if (!bash) {
+    process.stderr.write("error: bash is required to run claude-smart setup.\n");
+    process.exit(1);
+  }
+  const script = join(PACKAGE_ROOT, "scripts", "setup-claude-smart.sh");
+  if (!existsSync(script)) {
+    process.stderr.write(`error: setup script not found at ${script}\n`);
+    process.exit(1);
+  }
+  const code = await runChecked(bash, [script, ...args], { cwd: PACKAGE_ROOT });
+  if (code !== 0) process.exit(code);
+}
+
 async function runInstall(args) {
   if (parseHost(args) === "codex") {
     await runInstallCodex(args);
@@ -1368,7 +1378,8 @@ async function runInstall(args) {
   }
 
   const source = parseSource(args);
-  configureReflexioSetup(args);
+  const setup = configureReflexioSetup();
+  const readOnly = setup.readOnly;
 
   const steps = [
     { args: ["plugin", "marketplace", "add", source], label: "Adding marketplace…" },
@@ -1387,6 +1398,11 @@ async function runInstall(args) {
 
   try {
     const pluginRoot = await bootstrapClaudeCodeInstall();
+    restorePublishHooksFromSource(pluginRoot);
+    if (readOnly) {
+      prunePublishHooksForReadOnly(pluginRoot);
+      process.stdout.write("Installed read-only hook manifest; publish interactions hooks are disabled.\n");
+    }
     process.stdout.write(`Prepared claude-smart runtime at ${pluginRoot}.\n`);
     if (refreshDashboardService(pluginRoot)) {
       process.stdout.write("Refreshed claude-smart dashboard service.\n");
@@ -1417,9 +1433,13 @@ async function runInstallCodex(args) {
     process.stderr.write("error: 'codex' CLI not found on PATH. Install Codex first.\n");
     process.exit(1);
   }
-  configureReflexioSetup(args);
+  const setup = configureReflexioSetup();
+  const readOnly = setup.readOnly;
 
   const marketplaceRoot = copyCodexMarketplace();
+  if (readOnly) {
+    prunePublishHooksForReadOnly(codexMarketplacePluginRoot(marketplaceRoot));
+  }
   process.stdout.write(`Prepared Codex marketplace at ${marketplaceRoot}.\n`);
 
   let code = await runCodex(["plugin", "marketplace", "add", marketplaceRoot]);
@@ -1460,7 +1480,10 @@ async function runInstallCodex(args) {
   try {
     cacheDir = installCodexPluginCache(codexMarketplacePluginRoot(marketplaceRoot));
     process.stdout.write(`Installed Codex plugin cache at ${cacheDir}.\n`);
-    await bootstrapPluginRuntime(cacheDir);
+    await bootstrapPluginRuntime(cacheDir, { readOnly });
+    if (readOnly) {
+      process.stdout.write("Installed read-only hook manifest; publish interactions hooks are disabled.\n");
+    }
     if (refreshDashboardService(cacheDir)) {
       process.stdout.write("Refreshed claude-smart dashboard service.\n");
     }
@@ -1553,6 +1576,11 @@ async function main() {
     return;
   }
 
+  if (cmd === "setup") {
+    await runSetup(args.slice(1));
+    return;
+  }
+
   if (cmd === "uninstall") {
     await runUninstall(args.slice(1));
     return;
@@ -1581,4 +1609,6 @@ module.exports = {
   configureReflexioSetup,
   patchCodexHooksForNode,
   platformSupportError,
+  prunePublishHooksForReadOnly,
+  restorePublishHooksFromSource,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-smart",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "Self-improving Claude Code plugin — learns from corrections via reflexio",
   "keywords": [
     "claude",
@@ -27,6 +27,7 @@
   },
   "files": [
     "bin",
+    "scripts/setup-claude-smart.sh",
     ".agents/plugins/marketplace.json",
     "plugin",
     "!plugin/**/__pycache__",

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-smart",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "Self-improving Claude Code plugin — learns from corrections across sessions via reflexio",
   "author": {
     "name": "Yi Lu"

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-smart",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "Self-improving coding assistant plugin — learns from corrections across sessions via reflexio",
   "author": {
     "name": "Yi Lu"

package/plugin/README.md

@@ -16,6 +16,9 @@ under `~/.claude-smart/` when they are missing. If Node.js is already installed,
 `npx claude-smart install` is equivalent; if uv is already installed,
 `uvx claude-smart install` is equivalent.
 
+Add `--read-only` to either install command to skip hooks that publish
+interactions for learning.
+
 Supported vanilla native targets are Apple Silicon macOS 14+ and Windows x64.
 Intel Mac, macOS 13 or older, and Windows ARM fail early because the local
 embedding/ML dependency stack does not provide a complete native wheel set.

package/plugin/dashboard/app/configure/env/page.tsx

@@ -206,6 +206,21 @@ export default function ConfigureEnvPage() {
                 />
               </div>
 
+              <div className="flex items-start justify-between gap-4">
+                <div className="min-w-0">
+                  <Label htmlFor="read-only-mode">CLAUDE_SMART_READ_ONLY</Label>
+                  <p className="text-xs text-muted-foreground mt-0.5">
+                    Keep session context available but skip publishing
+                    interactions to Reflexio.
+                  </p>
+                </div>
+                <Switch
+                  id="read-only-mode"
+                  checked={!!config.CLAUDE_SMART_READ_ONLY}
+                  onCheckedChange={(v) => update("CLAUDE_SMART_READ_ONLY", v)}
+                />
+              </div>
+
               <div className="space-y-2">
                 <Label>CLAUDE_SMART_CLI_PATH</Label>
                 <Input

package/plugin/dashboard/lib/config-file.ts

@@ -11,9 +11,9 @@ import type { ClaudeSmartConfig } from "./types";
 const KNOWN_KEYS = [
   "REFLEXIO_URL",
   "REFLEXIO_API_KEY",
-  "REFLEXIO_USER_ID",
   "CLAUDE_SMART_USE_LOCAL_CLI",
   "CLAUDE_SMART_USE_LOCAL_EMBEDDING",
+  "CLAUDE_SMART_READ_ONLY",
   "CLAUDE_SMART_CLI_PATH",
   "CLAUDE_SMART_CLI_TIMEOUT",
   "CLAUDE_SMART_STATE_DIR",
@@ -24,6 +24,7 @@ const KNOWN = new Set<string>(KNOWN_KEYS);
 const BOOL_KEYS = new Set([
   "CLAUDE_SMART_USE_LOCAL_CLI",
   "CLAUDE_SMART_USE_LOCAL_EMBEDDING",
+  "CLAUDE_SMART_READ_ONLY",
 ]);
 
 function envPath(): string {
@@ -50,9 +51,9 @@ export async function readConfig(): Promise<ClaudeSmartConfig> {
   const defaults: ClaudeSmartConfig = {
     REFLEXIO_URL: "http://localhost:8071/",
     REFLEXIO_API_KEY: "",
-    REFLEXIO_USER_ID: "",
     CLAUDE_SMART_USE_LOCAL_CLI: false,
     CLAUDE_SMART_USE_LOCAL_EMBEDDING: false,
+    CLAUDE_SMART_READ_ONLY: false,
     CLAUDE_SMART_CLI_PATH: "",
     CLAUDE_SMART_CLI_TIMEOUT: "120",
     CLAUDE_SMART_STATE_DIR: "",

package/plugin/dashboard/lib/types.ts

@@ -114,10 +114,10 @@ export interface SessionDetail {
 export interface ClaudeSmartConfig {
   REFLEXIO_URL: string;
   REFLEXIO_API_KEY: string;
-  REFLEXIO_USER_ID: string;
   REFLEXIO_API_KEY_SET?: boolean;
   CLAUDE_SMART_USE_LOCAL_CLI: boolean;
   CLAUDE_SMART_USE_LOCAL_EMBEDDING: boolean;
+  CLAUDE_SMART_READ_ONLY: boolean;
   CLAUDE_SMART_CLI_PATH: string;
   CLAUDE_SMART_CLI_TIMEOUT: string;
   CLAUDE_SMART_STATE_DIR: string;

package/plugin/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "claude-smart"
-version = "0.2.35"
+version = "0.2.37"
 description = "Self-improving Claude Code plugin — learns from corrections via reflexio"
 readme = "README.md"
 requires-python = ">=3.12"

package/plugin/scripts/_lib.sh

@@ -63,9 +63,9 @@ claude_smart_source_reflexio_env() {
     value="${value#"${value%%[![:space:]]*}"}"
     value="${value%"${value##*[![:space:]]}"}"
     case "$key" in
-      # Reflexio identity: file always wins so a rotated key/url overrides
+      # Managed Reflexio config: file always wins so a rotated key/url overrides
       # whatever a long-lived managed backend or dashboard process inherited.
-      REFLEXIO_URL|REFLEXIO_API_KEY|REFLEXIO_USER_ID)
+      REFLEXIO_URL|REFLEXIO_API_KEY|REFLEXIO_USER_ID|CLAUDE_SMART_READ_ONLY)
         value="$(claude_smart_env_unquote "$value")"
         export "$key=$value"
         ;;
@@ -97,10 +97,10 @@ claude_smart_is_internal_invocation_env() {
   if [ "${CLAUDE_SMART_INTERNAL:-}" = "1" ]; then
     return 0
   fi
-  if [ -n "${CLAUDE_CODE_ENTRYPOINT:-}" ] && [ "${CLAUDE_CODE_ENTRYPOINT:-}" != "cli" ]; then
-    return 0
-  fi
-  return 1
+  case "${CLAUDE_CODE_ENTRYPOINT:-}" in
+    ""|"cli"|"claude-desktop") return 1 ;;
+    *) return 0 ;;
+  esac
 }
 
 claude_smart_emit_continue() {

package/plugin/scripts/codex-hook.js

@@ -184,6 +184,7 @@ function loadReflexioEnv() {
     "REFLEXIO_URL",
     "REFLEXIO_API_KEY",
     "REFLEXIO_USER_ID",
+    "CLAUDE_SMART_READ_ONLY",
   ]);
   const localConfigKeys = new Set([
     "CLAUDE_SMART_USE_LOCAL_CLI",

package/plugin/scripts/smart-install.sh

@@ -105,11 +105,6 @@ install_complete() {
   [ "$(cat "$SUCCESS_MARKER" 2>/dev/null || true)" = "$(install_fingerprint)" ] || return 1
   command -v uv >/dev/null 2>&1 || return 1
   [ -d "$PLUGIN_ROOT/.venv" ] || return 1
-  [ -f "$HOME/.reflexio/.env" ] || return 1
-  if [ -z "${REFLEXIO_API_KEY:-}" ]; then
-    grep -q '^CLAUDE_SMART_USE_LOCAL_CLI=' "$HOME/.reflexio/.env" || return 1
-    grep -q '^CLAUDE_SMART_USE_LOCAL_EMBEDDING=' "$HOME/.reflexio/.env" || return 1
-  fi
   if [ -d "$PLUGIN_ROOT/dashboard" ]; then
     [ -d "$PLUGIN_ROOT/dashboard/.next" ] || [ -f "$MARKER_DIR/dashboard-build.pid" ] || [ -f "$(claude_smart_dashboard_unavailable_marker)" ] || return 1
   fi
@@ -432,8 +427,6 @@ fi
 # append our two opt-in flags there so `reflexio services start` picks
 # them up regardless of which directory the user runs it from.
 REFLEXIO_ENV="$HOME/.reflexio/.env"
-mkdir -p "$(dirname "$REFLEXIO_ENV")"
-touch "$REFLEXIO_ENV"
 claude_smart_env_quote() {
   printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'
 }
@@ -472,42 +465,11 @@ claude_smart_env_upsert() {
   fi
 }
 
-claude_smart_generate_uuid() {
-  if [ -r /proc/sys/kernel/random/uuid ]; then
-    cat /proc/sys/kernel/random/uuid
-  elif command -v python3 >/dev/null 2>&1; then
-    python3 -c 'import uuid; print(uuid.uuid4())'
-  elif command -v python >/dev/null 2>&1; then
-    python -c 'import uuid; print(uuid.uuid4())'
-  else
-    date +%s%N | sed -E 's/^(.{8})(.{4})(.{4})(.{4})(.{12}).*/\1-\2-\3-\4-\5/'
-  fi
-}
-
-if [ "${CLAUDE_SMART_MANAGED_SETUP:-}" = "1" ] && [ -n "${REFLEXIO_API_KEY:-}" ]; then
-  REFLEXIO_URL="${REFLEXIO_URL:-https://www.reflexio.ai/}"
-  REFLEXIO_USER_ID="${REFLEXIO_USER_ID:-$(claude_smart_env_value REFLEXIO_USER_ID || true)}"
-  REFLEXIO_USER_ID="${REFLEXIO_USER_ID:-$(claude_smart_generate_uuid)}"
-  claude_smart_env_upsert REFLEXIO_URL "$REFLEXIO_URL"
-  claude_smart_env_upsert REFLEXIO_API_KEY "$REFLEXIO_API_KEY"
-  claude_smart_env_upsert REFLEXIO_USER_ID "$REFLEXIO_USER_ID"
-  chmod 600 "$REFLEXIO_ENV"
-  echo "[claude-smart] configured managed Reflexio in $REFLEXIO_ENV" >&2
-elif [ -z "${REFLEXIO_API_KEY:-}" ]; then
-  if ! grep -q '^CLAUDE_SMART_USE_LOCAL_CLI=' "$REFLEXIO_ENV"; then
-    printf '\n# Route reflexio generation through the local Claude Code CLI\nCLAUDE_SMART_USE_LOCAL_CLI=1\n' >> "$REFLEXIO_ENV"
-    echo "[claude-smart] appended CLAUDE_SMART_USE_LOCAL_CLI=1 to $REFLEXIO_ENV" >&2
-  fi
-  if ! grep -q '^CLAUDE_SMART_USE_LOCAL_EMBEDDING=' "$REFLEXIO_ENV"; then
-    printf '# Use the in-process ONNX embedder (chromadb) — no API key for semantic search\nCLAUDE_SMART_USE_LOCAL_EMBEDDING=1\n' >> "$REFLEXIO_ENV"
-    echo "[claude-smart] appended CLAUDE_SMART_USE_LOCAL_EMBEDDING=1 to $REFLEXIO_ENV" >&2
-  fi
-fi
 # Migrate stale REFLEXIO_URL from reflexio's library default (8081) to the
 # plugin backend port (8071). Matches the quoted and unquoted forms but
 # requires paired quotes, so malformed or deliberately different values
 # (e.g. a remote reflexio URL) are preserved.
-if grep -qE '^REFLEXIO_URL=("http://localhost:8081/?"|http://localhost:8081/?)$' "$REFLEXIO_ENV"; then
+if [ -f "$REFLEXIO_ENV" ] && grep -qE '^REFLEXIO_URL=("http://localhost:8081/?"|http://localhost:8081/?)$' "$REFLEXIO_ENV"; then
   sed -i.bak -E \
     -e 's|^REFLEXIO_URL="http://localhost:8081(/?)"$|REFLEXIO_URL="http://localhost:8071\1"|' \
     -e 's|^REFLEXIO_URL=http://localhost:8081(/?)$|REFLEXIO_URL=http://localhost:8071\1|' \