fix: raise the LiteLLM security floor and refresh dependencies

[yyiilluu]

Summary

• Raise the installed LiteLLM floor to >=1.98.0,<2 and refresh the plugin runtime lockfile.
• Remove the plugin's redundant direct ChromaDB requirement in preparation for the direct ONNX MiniLM runtime.

Changes

• Update installer messages and comments to describe ONNX MiniLM rather than a ChromaDB embedding backend.
• Keep the existing published reflexio-ai>=0.2.28 baseline; do not hide transitive dependencies through overrides.

Test Plan

• Ruff and Pyright passed for the changed Python file.
• node --check bin/claude-smart.js passed.
• bash -n passed for both changed shell scripts.
• Installer and CLI pytest suites: 174 passed (tests/test_install_scripts.py and tests/test_cli_install.py).

Release dependency

The current published Reflexio baseline still brings ChromaDB and python-jose/ecdsa transitively. Complete removal requires publishing the updated OSS package and adopting that release here. This PR does not claim that the standalone installed graph is already free of those dependencies.

Related upstream work: ReflexioAI/reflexio#471

Summary by CodeRabbit

• Chores
  • Updated local embedding configuration descriptions to accurately reference ONNX Runtime.
  • Updated package configuration to use LiteLLM and removed the direct ChromaDB dependency.
  • No runtime behavior changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f073cec6-5d65-42e1-9260-7df71691d750

📥 Commits

Reviewing files that changed from the base of the PR and between 08335bb and ed368b3.

⛔ Files ignored due to path filters (1)

• plugin/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• bin/claude-smart.js
• plugin/pyproject.toml
• plugin/scripts/smart-install.sh
• plugin/src/claude_smart/env_config.py
• scripts/setup-claude-smart.sh

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

The change replaces the direct ChromaDB dependency with litellm>=1.98.0,<2 and updates local embedding comments to identify the in-process ONNX Runtime embedder. Configuration values and runtime behavior remain unchanged.

Changes

Embedding dependency alignment

Layer / File(s)	Summary
Dependency and configuration update plugin/pyproject.toml, bin/claude-smart.js, plugin/scripts/smart-install.sh, plugin/src/claude_smart/env_config.py, scripts/setup-claude-smart.sh	The plugin replaces the direct ChromaDB dependency with a constrained LiteLLM dependency. Local embedding configuration comments now identify ONNX Runtime. Configuration values remain unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to ed368

The PR raises the LiteLLM security floor, refreshes the lockfile, and updates installer messaging without any identified merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: wenchanghan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary changes: raising the LiteLLM minimum version and refreshing dependencies.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/remove-chroma-upgrade-litellm

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}