claude-smart 0.2.44 → 0.2.46

package/plugin/vendor/reflexio/reflexio/cli/env_loader.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import importlib.resources
 import logging
+import os
 import re
 import secrets
 import sys
@@ -15,7 +16,7 @@ from pathlib import Path
 
 _logger = logging.getLogger(__name__)
 
-from dotenv import load_dotenv
+from dotenv import dotenv_values, load_dotenv
 
 from .paths import reflexio_home
 
@@ -23,6 +24,21 @@ _USER_ENV_DIR = reflexio_home()
 _USER_ENV_FILE = _USER_ENV_DIR / ".env"
 
 
+def user_env_file() -> Path:
+    """Return the user-level .env path, honoring ``REFLEXIO_ENV_FILE``.
+
+    When ``REFLEXIO_ENV_FILE`` is set (and non-blank) it overrides the default
+    ``~/.reflexio/.env``. This lets a second local backend keep its env separate
+    from the OSS reflexio default that also lives under ``~/.reflexio`` — e.g.
+    claude-smart points this at ``~/.claude-smart/.env`` so an OSS reflexio
+    ``.env`` (with its own ``REFLEXIO_STORAGE`` etc.) can't leak into it. The data
+    directory is independent (see ``LOCAL_STORAGE_PATH``), so both backends can
+    still share ``~/.reflexio/data``.
+    """
+    override = os.environ.get("REFLEXIO_ENV_FILE", "").strip()
+    return Path(override).expanduser() if override else _USER_ENV_FILE
+
+
 # Path to the .env file that load_reflexio_env last resolved — None until
 # load_reflexio_env runs for the first time. Exposed via get_loaded_env_path
 # so the startup banner can show the operator exactly which dotenv was
@@ -33,10 +49,72 @@ _loaded_env_path: Path | None = None
 def get_env_path() -> Path:
     """Return the canonical path to the user-level .env file.
 
-    Returns:
-        Path: ``~/.reflexio/.env``
+    Honors ``REFLEXIO_ENV_FILE`` (see :func:`user_env_file`); defaults to
+    ``~/.reflexio/.env``.
+    """
+    return user_env_file()
+
+
+def block_implicit_dotenv_walkup() -> None:
+    """Neutralize path-less ``dotenv.load_dotenv()`` autoloads (the walk-up).
+
+    Third-party libraries — notably ``litellm`` at import time
+    (``litellm/__init__.py``) — call ``load_dotenv()`` with no arguments. With
+    no path, python-dotenv runs ``find_dotenv()``, which walks **up** the
+    directory tree and loads the first ``.env`` it finds. Run from the
+    ``open_source/reflexio`` submodule inside the enterprise monorepo, that
+    climbs to the enterprise-root ``.env`` (platform-configured) and leaks
+    ``BACKEND_PORT`` / ``DEPLOYMENT_MODE`` / ``REFLEXIO_STORAGE`` into the
+    process — silently overriding the OSS launcher's own ``806*`` defaults.
+
+    Reflexio loads env deliberately via :func:`load_reflexio_env`, scoped to
+    ``./.env`` + ``~/.reflexio/.env`` and never walking up, so a library's
+    implicit autoload is redundant. This installs a shim on
+    ``dotenv.load_dotenv`` that no-ops the path-less form while passing explicit
+    ``load_dotenv(dotenv_path=...)`` / ``stream=...`` calls through unchanged.
+    Reflexio's own loader binds ``load_dotenv`` at import and always passes an
+    explicit path, so it is unaffected regardless.
+
+    Must run before the first ``import litellm`` in the process — the CLI entry
+    point (:func:`reflexio.cli.__main__.main`) calls it first thing. Idempotent.
+    Only the CLI launcher installs this: the spawned server subprocesses bind
+    the parent-resolved ``--port`` and the OSS server never reads
+    ``DEPLOYMENT_MODE``, so the launcher process is the only place the leak
+    changes behavior.
     """
-    return _USER_ENV_FILE
+    import functools
+    from typing import IO
+
+    import dotenv
+
+    original = dotenv.load_dotenv
+    if getattr(original, "__reflexio_walkup_guarded__", False):
+        return
+
+    @functools.wraps(original)
+    def _guarded(
+        dotenv_path: str | os.PathLike[str] | None = None,
+        stream: IO[str] | None = None,
+        verbose: bool = False,
+        override: bool = False,
+        interpolate: bool = True,
+        encoding: str | None = "utf-8",
+    ) -> bool:
+        if dotenv_path is None and stream is None:
+            # Path-less call would walk up past reflexio's controlled search
+            # scope (./.env + ~/.reflexio/.env). Ignore it.
+            return False
+        return original(
+            dotenv_path,
+            stream,
+            verbose=verbose,
+            override=override,
+            interpolate=interpolate,
+            encoding=encoding,
+        )
+
+    _guarded.__reflexio_walkup_guarded__ = True  # type: ignore[attr-defined]
+    dotenv.load_dotenv = _guarded
 
 
 def get_loaded_env_path() -> Path | None:
@@ -87,10 +165,43 @@ def set_env_var(env_path: Path, key: str, value: str) -> None:
     env_path.chmod(0o600)
 
 
-_ENV_SEARCH_PATHS = [
-    Path(".env"),  # 1. Current directory (local dev / project-level)
-    _USER_ENV_FILE,  # 2. User home default (~/.reflexio/.env)
-]
+def _env_search_paths() -> list[Path]:
+    """OSS .env search order, resolved at call time so ``REFLEXIO_ENV_FILE`` is honored."""
+    return [
+        Path(".env"),  # 1. Current directory (local dev / project-level)
+        user_env_file(),  # 2. User-level file (REFLEXIO_ENV_FILE override, else ~/.reflexio/.env)
+    ]
+
+
+def _load_dotenv_pruned(path: Path, *, override: bool = False) -> None:
+    """Load a .env file, treating blank assignments (``KEY=``) as unset.
+
+    python-dotenv exports a blank ``KEY=`` line as ``os.environ["KEY"] = ""``
+    rather than leaving the key unset. That empty string silently defeats every
+    ``os.getenv("KEY", default)`` fallback — the root cause of the HF_HOME
+    cache-in-repo-root bug, and of any ``int()``/``float()`` parse that crashes
+    on ``""``. This wrapper normalizes "set to blank" to "unset" so callers that
+    rely on a default behave correctly.
+
+    After loading, it drops any key the FILE assigned a blank/whitespace value,
+    but only when the resulting environment value is still blank — so a real
+    process-env value (task definition, shell ``export``) or an earlier-loaded
+    file value is never removed.
+
+    Args:
+        path: Path to the .env file to load.
+        override: Forwarded to ``load_dotenv``. When False (default) the existing
+            process environment wins over the file's values.
+    """
+    file_vals = dotenv_values(path)
+    load_dotenv(dotenv_path=path, override=override)
+    for key, value in file_vals.items():
+        if (
+            value is not None
+            and not value.strip()
+            and not os.environ.get(key, "").strip()
+        ):
+            os.environ.pop(key, None)
 
 
 def load_reflexio_env(
@@ -116,9 +227,9 @@ def load_reflexio_env(
         Path to the loaded .env file, or None if no .env was found/created.
     """
     global _loaded_env_path
-    for env_path in _ENV_SEARCH_PATHS:
+    for env_path in _env_search_paths():
         if env_path.exists():
-            load_dotenv(dotenv_path=env_path)
+            _load_dotenv_pruned(env_path)
             resolved = env_path.resolve()
             _logger.debug("Loaded env from: %s", resolved)
             _loaded_env_path = resolved
@@ -133,6 +244,165 @@ def load_reflexio_env(
     return created
 
 
+def resolve_mode(cli_mode: str | None = None) -> str | None:
+    """Resolve the active deployment mode for mode-aware env loading.
+
+    Selection precedence:
+        1. Explicit ``--mode`` flag (``cli_mode``)
+        2. ``DEPLOYMENT_MODE`` environment variable
+        3. None (caller falls back to the plain ``.env`` loader)
+
+    The resolved mode is spliced into ``.env.<mode>`` file paths, so it is
+    validated against a safe slug pattern: an empty/whitespace value resolves to
+    None (fall back to the plain loader), and anything containing path
+    characters (``/``, ``..``) or other non-slug characters raises ValueError
+    rather than redirecting reads/writes/chmods outside ``~/.reflexio/``.
+
+    Args:
+        cli_mode: Mode passed explicitly via a CLI flag, if any.
+
+    Returns:
+        The normalized (stripped, lowercased) mode string, or None when no
+        mode is selected.
+
+    Raises:
+        ValueError: If the selected mode is not a safe slug.
+    """
+    raw_mode = cli_mode if cli_mode is not None else os.environ.get("DEPLOYMENT_MODE")
+    if raw_mode is None:
+        return None
+    mode = raw_mode.strip().lower()
+    if not mode:
+        return None
+    if not re.fullmatch(r"[a-z0-9][a-z0-9_-]*", mode):
+        raise ValueError(f"Invalid deployment mode: {raw_mode!r}")
+    return mode
+
+
+def load_reflexio_env_for_mode(
+    *,
+    cli_mode: str | None = None,
+    package_data_module: str = "reflexio.data",
+    auto_generate_keys: list[str] | None = None,
+) -> Path | None:
+    """Load ``.env.<mode>`` presets plus optional home secrets, mode-aware.
+
+    Loads the committed ``.env.<mode>`` presets (from CWD or the user home dir)
+    together with the optional gitignored ``~/.reflexio/.env.<mode>`` secrets
+    file. Both are loaded with ``override=False`` so the process environment
+    (task-def / shell ``export``) always wins, and home secrets take precedence
+    over committed presets for any disjoint keys.
+
+    When no mode is resolved, this falls back to :func:`load_reflexio_env`.
+
+    Args:
+        cli_mode: Mode passed explicitly via a CLI flag, if any.
+        package_data_module: Module containing the bundled ``.env.<mode>``
+            template (for ``importlib.resources``).
+        auto_generate_keys: Env var names to auto-generate as hex tokens
+            (e.g., ``["JWT_SECRET_KEY"]``) when missing. Generated secrets are
+            written ONLY to the gitignored ``~/.reflexio/.env.<mode>`` home
+            file — never the committed ``./.env.<mode>`` presets. Load-only
+            callers (the uvicorn / migration entrypoints) pass ``None``.
+
+    Returns:
+        Path to the loaded mode env file, or None if nothing was found/created.
+    """
+    global _loaded_env_path
+    mode = resolve_mode(cli_mode)
+    if mode is None:
+        return load_reflexio_env(
+            package_data_module=package_data_module,
+            auto_generate_keys=auto_generate_keys,
+        )
+
+    # Optional gitignored home secrets, loaded first so committed presets and
+    # process env both still win where they define the same keys.
+    home_secrets = _USER_ENV_DIR / f".env.{mode}"
+    if home_secrets.exists():
+        _load_dotenv_pruned(home_secrets, override=False)
+
+    loaded: Path | None = None
+    for env_path in (Path(f".env.{mode}"), home_secrets):
+        if env_path.exists():
+            _load_dotenv_pruned(env_path, override=False)
+            _loaded_env_path = env_path.resolve()
+            _logger.debug("Loaded mode env from: %s (mode=%s)", _loaded_env_path, mode)
+            loaded = env_path
+            break
+
+    if loaded is None:
+        loaded = _create_default_env_for_mode(mode, package_data_module)
+
+    # Auto-generate any missing secret keys into the gitignored home file ONLY,
+    # never the committed ./.env.<mode> presets file.
+    if auto_generate_keys:
+        _USER_ENV_DIR.mkdir(parents=True, exist_ok=True)
+        _backfill_missing_keys(home_secrets, auto_generate_keys)
+
+    return loaded
+
+
+def _create_default_env_for_mode(mode: str, package_data_module: str) -> Path | None:
+    """Create ``~/.reflexio/.env.<mode>`` from the bundled mode template.
+
+    Args:
+        mode: The resolved deployment mode (e.g. ``"platform"``).
+        package_data_module: Module path for finding the ``.env.<mode>``
+            template.
+
+    Returns:
+        Path to the newly created mode env file, or None if no template found.
+    """
+    global _loaded_env_path
+    content = _find_mode_template(mode, package_data_module)
+    if content is None:
+        return None
+    _USER_ENV_DIR.mkdir(parents=True, exist_ok=True)
+    target = _USER_ENV_DIR / f".env.{mode}"
+    target.write_text(content)
+    target.chmod(0o600)
+    _load_dotenv_pruned(target, override=False)
+    _loaded_env_path = target.resolve()
+    return target
+
+
+def _find_mode_template(mode: str, package_data_module: str) -> str | None:
+    """Find ``.env.<mode>`` template content from CWD or package data.
+
+    Args:
+        mode: The resolved deployment mode (e.g. ``"platform"``).
+        package_data_module: Dotted module path for importlib.resources lookup.
+
+    Returns:
+        The template content as a string, or None if not found anywhere.
+    """
+    # 1. Current directory (local dev checkout)
+    local = Path(f".env.{mode}")
+    if local.exists():
+        return local.read_text()
+
+    # 2. Package data (installed package)
+    try:
+        ref = importlib.resources.files(package_data_module).joinpath(f".env.{mode}")
+        return ref.read_text(encoding="utf-8")
+    except (ModuleNotFoundError, FileNotFoundError):
+        pass
+
+    # 3. Editable install: .env.<mode> lives at project root, two levels up.
+    try:
+        import reflexio as _pkg
+
+        project_root = Path(_pkg.__file__).resolve().parent.parent
+        candidate = project_root / f".env.{mode}"
+        if candidate.is_file():
+            return candidate.read_text()
+    except Exception:  # noqa: BLE001, S110
+        pass
+
+    return None
+
+
 def ensure_user_env_for_setup(
     *,
     package_data_module: str = "reflexio.data",
@@ -161,7 +431,7 @@ def ensure_user_env_for_setup(
     """
     global _loaded_env_path
     if _USER_ENV_FILE.exists():
-        load_dotenv(dotenv_path=_USER_ENV_FILE)
+        _load_dotenv_pruned(_USER_ENV_FILE)
         resolved = _USER_ENV_FILE.resolve()
         _logger.debug("Loaded user env from: %s", resolved)
         _loaded_env_path = resolved
@@ -184,8 +454,6 @@ def _backfill_missing_keys(env_path: Path, keys: list[str]) -> None:
         env_path: Path to the existing .env file.
         keys: Env var names to check/generate.
     """
-    import os
-
     generated: list[str] = []
     for key in keys:
         if os.environ.get(key):
@@ -256,10 +524,12 @@ def _create_default_env(
         sys.stdout.flush()
         return None
 
-    created_dir = not _USER_ENV_DIR.exists()
-    _USER_ENV_DIR.mkdir(parents=True, exist_ok=True)
+    target = user_env_file()  # honors REFLEXIO_ENV_FILE (e.g. ~/.claude-smart/.env)
+    target_dir = target.parent
+    created_dir = not target_dir.exists()
+    target_dir.mkdir(parents=True, exist_ok=True)
     if created_dir:
-        sys.stdout.write(f"Created directory: {_USER_ENV_DIR}\n")
+        sys.stdout.write(f"Created directory: {target_dir}\n")
 
     # Auto-generate secret keys
     for key in auto_generate_keys:
@@ -272,13 +542,13 @@ def _create_default_env(
             flags=re.MULTILINE,
         )
 
-    _USER_ENV_FILE.write_text(content)
-    _USER_ENV_FILE.chmod(0o600)
-    load_dotenv(dotenv_path=_USER_ENV_FILE)
+    target.write_text(content)
+    target.chmod(0o600)
+    _load_dotenv_pruned(target)
 
-    sys.stdout.write(f"Created env file: {_USER_ENV_FILE}\n")
+    sys.stdout.write(f"Created env file: {target}\n")
     if auto_generate_keys:
         sys.stdout.write(f"  Auto-generated: {', '.join(auto_generate_keys)}\n")
-    sys.stdout.write(f"  Edit {_USER_ENV_FILE} to add your API keys.\n\n")
+    sys.stdout.write(f"  Edit {target} to add your API keys.\n\n")
     sys.stdout.flush()
-    return _USER_ENV_FILE
+    return target

package/plugin/vendor/reflexio/reflexio/cli/log_format.py

@@ -187,15 +187,31 @@ def print_startup_banner(
     ports: dict[str, int],
     *,
     supabase_port: int | None = 54321,
+    supabase_status: str = "ready",
+    failures: list[str] | None = None,
     log_file: str = DEV_LOG_FILE,
     config_paths: dict[str, str] | None = None,
 ) -> None:
     """Print a consolidated startup summary banner with service URLs.
 
+    Services that were *requested* but failed to reach a ready state are
+    rendered with a red "not ready" status (instead of being silently
+    omitted), so operators can tell at a glance that startup did not
+    fully succeed.
+
     Args:
-        ports: Mapping of service name to port number.
-        supabase_port: Supabase port, or None if not running.
-        log_file: Path to the log file.
+        ports: Mapping of service name to port number for services that
+            were started (backend/frontend/docs).
+        supabase_port: Supabase port to display, or None to omit the
+            Supabase line entirely (e.g. when --no-supabase was passed).
+        supabase_status: ``"ready"`` (green) or anything else (rendered
+            as red "not ready"). Only consulted when ``supabase_port``
+            is not None.
+        failures: Optional list of human-readable failure summary
+            lines. Rendered as a red "Failures" section above the logs
+            so the cause is visible without scrolling back through the
+            scrollback.
+        log_file: Path to the dev-server log file.
         config_paths: Optional mapping of config-label → path string (e.g.
             ``{"env": "~/.reflexio/.env", "config": "~/.reflexio/configs/config_default.json"}``).
             Renders as a "Config" section above the "Logs" line so operators
@@ -219,7 +235,11 @@ def print_startup_banner(
     if supabase_port is not None:
         url = f"http://localhost:{supabase_port}"
         label = colorize("  Supabase   ", "36")
-        status = colorize("ready", "32")
+        status = (
+            colorize("ready", "32")
+            if supabase_status == "ready"
+            else colorize("not ready", "31", bold=True)
+        )
         lines.append(f"{label}{url:<26}{status}")
 
     home = str(Path.home())
@@ -234,6 +254,11 @@ def print_startup_banner(
         for label, path in config_paths.items():
             lines.append(f"  {label:<11}{_collapse_home(str(path))}")
 
+    if failures:
+        lines.append(f"{'-' * width}")
+        lines.append(colorize("  Failures", "31", bold=True))
+        lines.extend(colorize(f"  - {msg}", "31") for msg in failures)
+
     lines.append(f"{'-' * width}")
     # Logs section — surface both the general dev log and the LLM I/O log.
     # LLM_IO_LOG_FILE is the one operators hit first when debugging prompt /

package/plugin/vendor/reflexio/reflexio/cli/run_services.py

@@ -27,6 +27,13 @@ _PACKAGE_DIR = Path(reflexio.__file__).resolve().parent
 _EDITABLE_REPO_ROOT = _PACKAGE_DIR.parent
 DOCS_DIR = _EDITABLE_REPO_ROOT / "docs"
 
+# Default local ports for the OSS launcher. OSS occupies the 806* range so it
+# never collides with claude-smart / openclaw-smart (807*), enterprise self-host
+# (808*), or enterprise platform (809*). Embedding sits in the *9 slot to mirror
+# the enterprise convention (8089 self-host, 8099 platform). Override per service
+# with the matching CLI flag or {BACKEND,DOCS,EMBEDDING}_PORT env var.
+DEFAULT_OSS_PORTS: dict[str, int] = {"backend": 8061, "docs": 8062, "embedding": 8069}
+
 
 def add_arguments(parser: argparse.ArgumentParser) -> None:
     """Add run-services arguments to the parser.
@@ -39,19 +46,19 @@ def add_arguments(parser: argparse.ArgumentParser) -> None:
         "--backend-port",
         type=int,
         default=None,
-        help="Backend port (default: 8081, env: BACKEND_PORT)",
+        help="Backend port (default: 8061, env: BACKEND_PORT)",
     )
     parser.add_argument(
         "--docs-port",
         type=int,
         default=None,
-        help="Docs port (default: 8082, env: DOCS_PORT)",
+        help="Docs port (default: 8062, env: DOCS_PORT)",
     )
     parser.add_argument(
         "--embedding-port",
         type=int,
         default=None,
-        help="Embedding service port (default: 8072, env: EMBEDDING_PORT)",
+        help="Embedding service port (default: 8069, env: EMBEDDING_PORT)",
     )
     parser.add_argument(
         "--only",
@@ -252,7 +259,11 @@ def build_nextjs_service(
     )
 
 
-def build_embedding_service(ports: dict[str, int]) -> ServiceConfig:
+def build_embedding_service(
+    ports: dict[str, int],
+    *,
+    app_module: str = "reflexio.server.llm.embedding_service:app",
+) -> ServiceConfig:
     """Build the local embedding daemon service configuration."""
     return ServiceConfig(
         name="embedding",
@@ -260,7 +271,7 @@ def build_embedding_service(ports: dict[str, int]) -> ServiceConfig:
             sys.executable,
             "-m",
             "uvicorn",
-            "reflexio.server.llm.embedding_service:app",
+            app_module,
             "--host",
             "127.0.0.1",
             "--port",
@@ -319,9 +330,7 @@ def execute(args: argparse.Namespace) -> None:
     ts = time.strftime("%Y-%m-%d %H:%M:%S %Z")
     print(f"\n{bar}\n=== NEW REFLEXIO SERVER START — {ts} ===\n{bar}\n")
 
-    ports = resolve_ports(
-        args, defaults={"backend": 8081, "docs": 8082, "embedding": 8072}
-    )
+    ports = resolve_ports(args, defaults=DEFAULT_OSS_PORTS)
     os.environ["API_BACKEND_URL"] = os.environ.get(
         "API_BACKEND_URL", f"http://localhost:{ports['backend']}"
     )

package/plugin/vendor/reflexio/reflexio/cli/stop_services.py

@@ -4,9 +4,12 @@ from __future__ import annotations
 
 import argparse
 
-from dotenv import load_dotenv
-
-from reflexio.cli.run_services import parse_only_flag, resolve_ports
+from reflexio.cli.env_loader import load_reflexio_env
+from reflexio.cli.run_services import (
+    DEFAULT_OSS_PORTS,
+    parse_only_flag,
+    resolve_ports,
+)
 from reflexio.cli.utils import stop_services
 
 
@@ -16,19 +19,19 @@ def add_arguments(parser: argparse.ArgumentParser) -> None:
         "--backend-port",
         type=int,
         default=None,
-        help="Backend port (default: 8081, env: BACKEND_PORT)",
+        help="Backend port (default: 8061, env: BACKEND_PORT)",
     )
     parser.add_argument(
         "--docs-port",
         type=int,
         default=None,
-        help="Docs port (default: 8082, env: DOCS_PORT)",
+        help="Docs port (default: 8062, env: DOCS_PORT)",
     )
     parser.add_argument(
         "--embedding-port",
         type=int,
         default=None,
-        help="Embedding service port (default: 8072, env: EMBEDDING_PORT)",
+        help="Embedding service port (default: 8069, env: EMBEDDING_PORT)",
     )
     parser.add_argument(
         "--only",
@@ -79,11 +82,11 @@ def build_stop_targets(
 
 def execute(args: argparse.Namespace) -> None:
     """Execute the stop-services command."""
-    load_dotenv()
+    # Use reflexio's scoped loader (./.env + ~/.reflexio/.env), not a bare
+    # ``dotenv.load_dotenv()`` which walks up to a parent ``.env``.
+    load_reflexio_env()
 
-    ports = resolve_ports(
-        args, defaults={"backend": 8081, "docs": 8082, "embedding": 8072}
-    )
+    ports = resolve_ports(args, defaults=DEFAULT_OSS_PORTS)
     only = parse_only_flag(args.only, {"backend", "docs", "embedding"})
     port_map, process_patterns = build_stop_targets(only, ports)