@aixle/insights 0.1.1 → 0.2.1-staging

package/dist/cli.js

@@ -11,17 +11,19 @@ import { DEFAULT_PRICING, mergePricing } from "./pricing.js";
 import { resolveCursorPricing } from "./cursor-config.js";
 import { buildHealthSnapshot, formatHealthForCli } from "./health.js";
 import { installClaudeUserMcp } from "./install/claude.js";
+import { installCursorUserMcp, uninstallCursorUserMcp } from "./install/cursor.js";
 import { installHooksConfig, uninstallHooksConfig, verifyHooksConfig, FORWARDER_FILENAME } from "./hooks/hooks-config.js";
+import { evaluateTransportSecurity } from "./lib/transport-security.js";
 import { join } from "node:path";
 import { fileURLToPath as nodeFileURLToPath } from "node:url";
 import { mcpLog } from "./log.js";
 const GLOBAL_FLAGS = new Set(["--help", "-h", "--once", "--full"]);
 const INIT_VALUE_FLAGS = new Set(["--host", "--keycloak-url", "--tool-name", "--organization-id"]);
-const INIT_BOOLEAN_FLAGS = new Set(["--force", "--hooks"]);
+const INIT_BOOLEAN_FLAGS = new Set(["--force", "--hooks", "--insecure"]);
 /** Matches DB90 Rails `McpController` UUID check for `X-Organization-ID` (RFC 4122 variant). */
-export const DB90_ORGANIZATION_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-export function isValidDb90OrganizationUuid(value) {
-    return DB90_ORGANIZATION_UUID_PATTERN.test(value.trim());
+export const ORGANIZATION_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function isValidOrganizationUuid(value) {
+    return ORGANIZATION_UUID_PATTERN.test(value.trim());
 }
 function takeFlagValue(argv, name) {
     const eqForm = argv.find((a) => a.startsWith(`${name}=`));
@@ -112,7 +114,8 @@ export function parseArgs(argv) {
         const organizationId = takeFlagValue(args, "--organization-id");
         const force = args.includes("--force");
         const hooks = args.includes("--hooks");
-        return { command: "init", help, once: false, host, keycloakUrl, toolName, organizationId, force, hooks };
+        const insecure = args.includes("--insecure");
+        return { command: "init", help, once: false, host, keycloakUrl, toolName, organizationId, force, hooks, insecure };
     }
     const nonInitBad = args.filter((a) => {
         if (!a.startsWith("--") && a !== "-h")
@@ -145,7 +148,7 @@ export function parseArgs(argv) {
     if (raw === "serve") {
         return { command: "run", help, once, full: full || undefined };
     }
-    if (raw === "uninstall-hooks" || raw === "verify-hooks") {
+    if (raw === "uninstall-hooks" || raw === "verify-hooks" || raw === "uninstall-cursor-mcp") {
         return { command: raw, help: false, once: false };
     }
     return { command: "help", help: true, once: false };
@@ -158,11 +161,12 @@ Usage:
   aixle-insights [command] [options]
 
 Commands:
-  run              Start the MCP stdio server (default — used by Claude Code).
-  init             Keycloak device login once, then persist DB90 ingest credentials (keychain or file).
-  health           Multi-line diagnostic (credentials, sync, log path, state files).
-  uninstall-hooks  Remove DB90 from ~/.cursor/hooks.json and restore backup (if any).
-  verify-hooks     Print hooks install status and queue depth as JSON.
+  run                   Start the MCP stdio server (default — used by Claude Code).
+  init                  Keycloak device login once, then persist DB90 ingest credentials (keychain or file).
+  health                Multi-line diagnostic (credentials, sync, log path, state files).
+  uninstall-hooks       Remove DB90 from ~/.cursor/hooks.json and restore backup (if any).
+  verify-hooks          Print hooks install status and queue depth as JSON.
+  uninstall-cursor-mcp  Remove aixle-insights from ~/.cursor/mcp.json and restore backup (if any).
 
 Options:
   --once      With 'run': perform a multi-tool sync then exit (no MCP server).
@@ -174,9 +178,11 @@ init options:
   --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER)
   --tool-name <name>       Optional: mint only \`claude_code\`, only \`cursor\`, or omit to mint BOTH.
   --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env DB90_ORGANIZATION_ID).
-  --force                  Replace an existing user "aixle-insights" MCP entry in ~/.claude.json if it differs.
+  --force                  Re-run the device flow even if valid credentials already exist, and
+                           replace an existing user "aixle-insights" MCP entry in ~/.claude.json if it differs.
   --hooks                  (opt-in) Install Cursor hook forwarder for per-turn model attribution.
                            Requires Cursor restart. Run 'aixle-insights uninstall-hooks' to remove.
+  --insecure               Allow remote http:// hosts for trusted non-production test endpoints only.
 
 Multi-org:
   Set \`DB90_ORGANIZATION_ID\` to a UUID, or pass \`--organization-id\` on \`init\`, so ingest tokens are minted for that membership instead of the default (oldest) org.
@@ -188,7 +194,7 @@ Credentials:
 Note: Omitting --tool-name provisions separate ingest tokens for Claude Code + Cursor behind a single Keycloak login.
 `);
 }
-function defaultDb90Host() {
+function defaultApiHost() {
     const v = process.env["DB90_API_URL"]?.trim();
     if (v)
         return v.replace(/\/$/, "");
@@ -208,16 +214,24 @@ export async function runInit(cliArgs, deps) {
         defaultKeycloakIssuer,
         getAppDir,
         installClaudeUserMcp,
+        installCursorUserMcp,
         log: console.log,
         error: console.error,
         ...deps,
     };
-    const db90Host = (cliArgs.host ?? defaultDb90Host()).replace(/\/$/, "");
-    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer()).trim();
-    if (!kcIssuer) {
-        runtime.error("Error: Keycloak issuer is not configured. Pass --keycloak-url or set KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER.");
+    const apiHost = (cliArgs.host ?? defaultApiHost()).replace(/\/$/, "");
+    const transportSecurity = evaluateTransportSecurity(apiHost, {
+        allowInsecureHttp: cliArgs.insecure === true,
+        label: "DB90 API host",
+    });
+    if (!transportSecurity.ok) {
+        runtime.error(`Error: ${transportSecurity.error}`);
         return 1;
     }
+    if (transportSecurity.warning) {
+        runtime.error(`Warning: ${transportSecurity.warning}`);
+    }
+    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer()).trim();
     if (cliArgs.toolName !== undefined && !["claude_code", "cursor"].includes(cliArgs.toolName)) {
         runtime.error("Error: --tool-name must be one of: claude_code, cursor.");
         return 1;
@@ -230,12 +244,12 @@ export async function runInit(cliArgs, deps) {
     const fromFlag = cliArgs.organizationId?.trim();
     const fromEnv = process.env["DB90_ORGANIZATION_ID"]?.trim();
     const exchangeOrganizationId = fromFlag || fromEnv;
-    if (exchangeOrganizationId && !isValidDb90OrganizationUuid(exchangeOrganizationId)) {
+    if (exchangeOrganizationId && !isValidOrganizationUuid(exchangeOrganizationId)) {
         runtime.error("Error: --organization-id / DB90_ORGANIZATION_ID must be a valid UUID (RFC 4122, version 1–5, variant per DB90 API).");
         return 1;
     }
     const result = await runtime.loginAndPersistCredentials({
-        db90Host,
+        apiHost,
         keycloakIssuer: kcIssuer,
         tools: provisionTools.length > 1 ? provisionTools : undefined,
         toolName: provisionTools.length === 1
@@ -246,6 +260,11 @@ export async function runInit(cliArgs, deps) {
         deviceLabel: "aixle-insights CLI init",
         appDir: runtime.getAppDir(),
         exchangeOrganizationId: exchangeOrganizationId || undefined,
+        allowInsecureHttp: cliArgs.insecure === true,
+        force: cliArgs.force === true,
+        onSecurityWarning: (message) => {
+            runtime.error(`Warning: ${message}`);
+        },
         onVisitInstructions: (uri, code) => {
             runtime.log(`Visit ${uri} and enter code ${code}`);
         },
@@ -254,7 +273,12 @@ export async function runInit(cliArgs, deps) {
         runtime.error(`Auth failed: ${result.error}`);
         return 1;
     }
-    runtime.log(`Credentials saved (organization ${result.organizationId}).`);
+    if ("alreadyAuthenticated" in result) {
+        runtime.log(`Already authenticated (organization ${result.organizationId ?? "unknown"}). Pass --force to re-authenticate.`);
+    }
+    else {
+        runtime.log(`Credentials saved (organization ${result.organizationId}).`);
+    }
     if (cliArgs.hooks) {
         const appDir = runtime.getAppDir();
         const thisFile = nodeFileURLToPath(import.meta.url);
@@ -300,6 +324,28 @@ export async function runInit(cliArgs, deps) {
     else {
         runtime.log("Skipped Claude Code MCP auto-install (--tool-name cursor only).");
     }
+    const shouldInstallCursor = provisionTools.includes("cursor");
+    if (shouldInstallCursor) {
+        const cursorInstallResult = runtime.installCursorUserMcp({ force: cliArgs.force === true });
+        switch (cursorInstallResult.kind) {
+            case "already-configured":
+                runtime.log("Cursor MCP: aixle-insights server is already configured for your user.");
+                break;
+            case "installed":
+                runtime.log("Cursor MCP: added aixle-insights server to ~/.cursor/mcp.json.");
+                break;
+            case "requires-force":
+                runtime.error(cursorInstallResult.detail);
+                return 1;
+            case "error":
+                runtime.error(`Cursor MCP install failed: ${cursorInstallResult.message}`);
+                return 1;
+        }
+        runtime.log("Restart Cursor to activate the aixle-insights MCP server.");
+    }
+    else {
+        runtime.log("Skipped Cursor MCP auto-install (--tool-name claude_code only).");
+    }
     return 0;
 }
 export async function runOnce(deps, options) {
@@ -316,6 +362,8 @@ export async function runOnce(deps, options) {
     };
     const creds = await runtime.loadCredentials();
     if (!creds || !credentialsHaveAnyToken(creds)) {
+        // File-only: runOnce prints a user-facing error below, so mirroring this
+        // structured warn would just duplicate the message on stderr.
         mcpLog.warn("credential_validation_failed", { source: "cli_once", reason: "missing_credentials" }, false);
         runtime.error("Error: no Aixle Insights credentials. Run `aixle-insights init` first (dual-tool auth is the default).");
         return 1;
@@ -330,7 +378,7 @@ export async function runOnce(deps, options) {
     let projectId = null;
     let projectIdSource = "none";
     if (lookupToken) {
-        const resolution = await runtime.resolveProjectId(undefined, undefined, creds.host, lookupToken, false);
+        const resolution = await runtime.resolveProjectId(undefined, undefined, creds.host, lookupToken, false, creds.insecureHttpAllowed === true);
         projectId = resolution.projectId;
         projectIdSource = resolution.source;
         mcpLog.info("project_attribution_resolved", { project_id: resolution.projectId, source: resolution.source }, false);
@@ -390,6 +438,24 @@ async function main() {
             }
             return;
         }
+        case "uninstall-cursor-mcp": {
+            const result = uninstallCursorUserMcp();
+            switch (result.kind) {
+                case "restored":
+                    console.log(`Cursor MCP entry removed; ~/.cursor/mcp.json restored from ${result.backupPath}.`);
+                    break;
+                case "removed":
+                    console.log("Cursor MCP entry removed from ~/.cursor/mcp.json.");
+                    break;
+                case "noop":
+                    console.log("No aixle-insights entry found in ~/.cursor/mcp.json — nothing to uninstall.");
+                    break;
+                case "error":
+                    console.error(`Cursor MCP uninstall failed: ${result.message}`);
+                    process.exit(1);
+            }
+            return;
+        }
         case "verify-hooks": {
             const report = verifyHooksConfig(getAppDir());
             console.log(JSON.stringify(report, null, 2));

package/dist/collect-cursor-payloads.d.ts

@@ -1,10 +1,10 @@
 import type { ProjectResolution } from "./lib/index.js";
 import type { State } from "./state.js";
-import { type CursorDb90Payload, type CursorTranscriptTurn, type PricingConfig } from "./readers/cursor.js";
+import { type CursorPayload, type CursorTranscriptTurn, type PricingConfig } from "./readers/cursor.js";
 export interface CursorSliceGroup {
     key: string;
     label: string;
-    payloads: CursorDb90Payload[];
+    payloads: CursorPayload[];
 }
 export interface PrepareCursorSliceGroupsOptions {
     stateBefore: State;
@@ -14,6 +14,7 @@ export interface PrepareCursorSliceGroupsOptions {
     host?: string;
     token?: string;
     projectLookupToken?: string | null;
+    allowInsecureHttp?: boolean;
     verbose?: boolean;
     cursorBaseDir?: string;
     cursorTranscriptProjectDirs?: string[];
@@ -46,7 +47,7 @@ export interface CollectLocalCursorPayloadsOptions {
     stateBefore?: State;
 }
 export interface CollectedCursorPayloads {
-    payloads: CursorDb90Payload[];
+    payloads: CursorPayload[];
     counts: PreparedCursorSliceGroups["counts"];
 }
 /**

package/dist/collect-cursor-payloads.js

@@ -6,7 +6,7 @@ import { readEvents as readCursorEvents, readDailyStatsWithDedupe, readRecentCom
  * Read local Cursor stores, apply watermarks/dedupe, and group payloads for sync posting.
  */
 export async function prepareCursorSliceGroups(options) {
-    const { stateBefore, fullScan = false, projectId = null, projectIdSource, host, token, projectLookupToken, verbose = false, cursorBaseDir, cursorTranscriptProjectDirs, cursorPricing = DEFAULT_CURSOR_PRICING, } = options;
+    const { stateBefore, fullScan = false, projectId = null, projectIdSource, host, token, projectLookupToken, allowInsecureHttp, verbose = false, cursorBaseDir, cursorTranscriptProjectDirs, cursorPricing = DEFAULT_CURSOR_PRICING, } = options;
     const useCommitHashDedup = !fullScan;
     const eventsSince = fullScan
         ? null
@@ -22,7 +22,9 @@ export async function prepareCursorSliceGroups(options) {
         console.log("[verbose][cursor] Full scan — ignoring saved watermarks and commit hash dedupe");
     }
     const baseDir = cursorBaseDir;
-    const activeModel = readCursorActiveModel(baseDir) ?? undefined;
+    const activeModelResolution = readCursorActiveModel(baseDir);
+    const activeModel = activeModelResolution.model ?? undefined;
+    const modelResolution = activeModelResolution.source;
     const transcriptTurns = await readCursorTranscriptSessions(baseDir, cursorTranscriptProjectDirs, verbose);
     const rawEvents = readCursorEvents(eventsSince, baseDir, verbose);
     const { raw: dailyStatsRaw, deduped: dailyStats } = readDailyStatsWithDedupe(dailyStatsSince, baseDir, verbose);
@@ -41,7 +43,7 @@ export async function prepareCursorSliceGroups(options) {
             return known.contentHash !== turn.contentHash;
         return known.fileSize !== turn.fileSize;
     })
-        .map((turn) => mapCursorTranscriptTurn(turn, projectIdOpt, cursorPricing, activeModel))
+        .map((turn) => mapCursorTranscriptTurn(turn, projectIdOpt, cursorPricing, activeModel, modelResolution))
         .sort((a, b) => a.occurred_at.localeCompare(b.occurred_at));
     const skippedTranscriptCount = transcriptTurns.length - transcriptPayloads.length;
     const transcriptModeEnabled = transcriptTurnsById.size > 0;
@@ -49,7 +51,7 @@ export async function prepareCursorSliceGroups(options) {
         .map(({ row, workspacePath }) => mapCursorEvent(row, workspacePath, projectIdOpt, cursorPricing))
         .filter((e) => e !== null);
     const allMappedFromStats = dailyStats
-        .flatMap((entry) => mapDailyStats(entry, projectIdOpt, cursorPricing, activeModel));
+        .flatMap((entry) => mapDailyStats(entry, projectIdOpt, cursorPricing, activeModel, modelResolution));
     // When transcripts are present they cover the same chat activity — suppress the daily aggregates
     // to prevent double-counting. Logged at info level in sync.ts via counts.suppressedComposer.
     const mappedFromEvents = allMappedFromEvents.filter((payload) => !transcriptModeEnabled || payload.event_type !== "chat");
@@ -59,7 +61,7 @@ export async function prepareCursorSliceGroups(options) {
             allMappedFromStats.filter((p) => p.event_type === "chat").length
         : 0;
     let mappedFromCommits = recentCommitSnapshots
-        .map((snapshot) => mapRecentCommit(snapshot, projectIdOpt, cursorPricing, activeModel))
+        .map((snapshot) => mapRecentCommit(snapshot, projectIdOpt, cursorPricing, activeModel, modelResolution))
         .filter((payload) => payload !== null)
         .sort((a, b) => a.occurred_at.localeCompare(b.occurred_at));
     if (useCommitHashDedup) {
@@ -72,6 +74,7 @@ export async function prepareCursorSliceGroups(options) {
                 projectIdSource,
                 host,
                 token: lookupToken,
+                allowInsecureHttp,
                 verbose,
             });
         }

package/dist/cursor-checkpoints.d.ts

@@ -1,5 +1,5 @@
 import type { State } from "./state.js";
-import type { CursorDb90Payload } from "./readers/cursor.js";
+import type { CursorPayload } from "./readers/cursor.js";
 /** Cursor SQLite watermark checkpoints — never collide with Claude `claude_code:*` session keys. */
 export declare const CURSOR_WATERMARK_KEY: "cursor:watermark";
 export declare const CURSOR_EVENTS_WATERMARK_KEY: "cursor:events_watermark";
@@ -9,4 +9,4 @@ export declare const CURSOR_TRANSCRIPT_TURN_PREFIX: "cursor:transcript_turn:";
 export declare function cursorTranscriptTurnStateKey(turnId: string): string;
 export declare function cursorWatermarkDate(state: Pick<State, "sessions">, ...keys: string[]): Date | null;
 /** Skip recent-commit payloads whose hash was already successfully POSTed. */
-export declare function filterRecentCommitsByHashDedup(payloads: CursorDb90Payload[], lastRecentCommitHashes?: string[]): CursorDb90Payload[];
+export declare function filterRecentCommitsByHashDedup(payloads: CursorPayload[], lastRecentCommitHashes?: string[]): CursorPayload[];

package/dist/cursor-payload-contract.d.ts

@@ -1,4 +1,4 @@
-import type { CursorDb90Payload } from "./readers/cursor.js";
+import type { CursorPayload } from "./readers/cursor.js";
 /** Ingest paths for Cursor payloads emitted by telemetry-mcp. */
 export type CursorIngestPath = "daily_tab" | "daily_composer" | "legacy_request" | "recent_commit" | "mcp_transcript" | "cursor_hook";
 export interface PayloadValidationResult {
@@ -6,12 +6,12 @@ export interface PayloadValidationResult {
     errors: string[];
     path: CursorIngestPath | "unknown";
 }
-export declare function inferIngestPath(payload: CursorDb90Payload): CursorIngestPath | "unknown";
-export declare function validateCursorPayload(payload: CursorDb90Payload): PayloadValidationResult;
+export declare function inferIngestPath(payload: CursorPayload): CursorIngestPath | "unknown";
+export declare function validateCursorPayload(payload: CursorPayload): PayloadValidationResult;
 export interface DryRunMatrixRow {
     path: CursorIngestPath | "unknown";
     count: number;
     sample_occurred_at: string | null;
 }
-export declare function summarizeDryRunMatrix(payloads: CursorDb90Payload[]): DryRunMatrixRow[];
-export declare function printCursorDryRunValidationReport(payloads: CursorDb90Payload[]): boolean;
+export declare function summarizeDryRunMatrix(payloads: CursorPayload[]): DryRunMatrixRow[];
+export declare function printCursorDryRunValidationReport(payloads: CursorPayload[]): boolean;

package/dist/cursor-payload-contract.js

@@ -11,6 +11,7 @@ const TOP_LEVEL_KEYS = new Set([
     "metadata",
 ]);
 const METADATA_BASE_KEYS = new Set([
+    "session_id",
     "cursor_session_id",
     "workspace",
     "workspace_scope",
@@ -18,6 +19,7 @@ const METADATA_BASE_KEYS = new Set([
     "cost_model",
     "scannable",
     "risk_level",
+    "model_resolution",
 ]);
 const METADATA_COMMIT_KEYS = new Set([
     ...METADATA_BASE_KEYS,
@@ -41,6 +43,7 @@ const METADATA_TRANSCRIPT_KEYS = new Set([
     "composer_name",
     "prompt_text",
     "assistant_text",
+    "model_resolution",
 ]);
 const METADATA_HOOK_KEYS = new Set([
     "cursor_session_id",
@@ -135,6 +138,10 @@ export function validateCursorPayload(payload) {
         if (typeof meta.workspace !== "string" || meta.workspace.length === 0) {
             errors.push("metadata.workspace must be a non-empty string");
         }
+        if (meta.model_resolution !== undefined &&
+            !["settings_json", "state_vscdb", "unresolved"].includes(meta.model_resolution)) {
+            errors.push('metadata.model_resolution must be "settings_json", "state_vscdb", or "unresolved" when present');
+        }
         if (path !== "mcp_transcript" && path !== "cursor_hook") {
             if (meta.workspace_scope !== "global" && meta.workspace_scope !== "workspace") {
                 errors.push('metadata.workspace_scope must be "global" or "workspace"');

package/dist/cursor-settings.d.ts

@@ -1,6 +1,11 @@
+export type CursorModelResolutionSource = "settings_json" | "state_vscdb" | "unresolved";
+export interface CursorActiveModelResolution {
+    model: string | null;
+    source: CursorModelResolutionSource;
+}
 /**
- * Best-effort: read active model name from Cursor's settings.json.
- * Returns null on any error (file absent, unreadable, no matching key).
- * Never throws.
+ * Resolves Cursor's active model, chaining settings.json (pre-1.6 location) then
+ * state.vscdb (1.6+ location). Reports which source supplied the model, or "unresolved"
+ * when neither has it, so downstream payload metadata can record where the tool looked.
  */
-export declare function readCursorActiveModel(baseDir?: string): string | null;
+export declare function readCursorActiveModel(baseDir?: string): CursorActiveModelResolution;

package/dist/cursor-settings.js

@@ -1,22 +1,15 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { cursorUserDir } from "./readers/cursor.js";
-// Keys are tried in specificity order — Cursor-namespaced keys first, then
-// generic fallbacks. "model" is last to avoid capturing unrelated workspace
-// settings that happen to have a "model" key.
+import { openCursorSqliteReadonly } from "./readers/cursor-sqlite.js";
 const SETTINGS_MODEL_KEYS = [
     "cursor.aiModel",
     "aiModel",
     "cursor.general.preferredModel",
     "model",
 ];
-/**
- * Best-effort: read active model name from Cursor's settings.json.
- * Returns null on any error (file absent, unreadable, no matching key).
- * Never throws.
- */
-export function readCursorActiveModel(baseDir) {
-    const settingsPath = join(baseDir ?? cursorUserDir(), "settings.json");
+function readModelFromSettingsJson(dir) {
+    const settingsPath = join(dir, "settings.json");
     try {
         if (!existsSync(settingsPath))
             return null;
@@ -36,3 +29,80 @@ export function readCursorActiveModel(baseDir) {
         return null;
     }
 }
+function safeParseJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function isNonEmptyString(v) {
+    return typeof v === "string" && v.trim().length > 0;
+}
+/**
+ * Reads the active model from Cursor's global state.vscdb (Cursor 1.6+), where settings.json
+ * no longer carries it. The model lives in the cursorDiskKV table (verified against a real
+ * Cursor install, 2026-07-10 — NOT ItemTable.aiSettings/featureModelConfigs, which don't exist
+ * on current Cursor versions), one row per conversation keyed composerData:<composerId>. The
+ * table is UNIQUE ON CONFLICT REPLACE, so every update to a composer re-inserts it with a fresh
+ * (higher) rowid — ORDER BY rowid DESC LIMIT 1 gives the most recently touched composer without
+ * needing to parse and rank every row's timestamp. Opens the DB only via openCursorSqliteReadonly
+ * (read-only, root-contained) — never a raw new Database() call.
+ */
+function readCursorActiveModelFromStateDb(baseDir) {
+    const dbPath = join(baseDir, "globalStorage", "state.vscdb");
+    const opened = openCursorSqliteReadonly(dbPath, { rootDir: baseDir });
+    if (!opened.ok)
+        return null;
+    const { db } = opened;
+    try {
+        const hasTable = db
+            .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='cursorDiskKV'")
+            .get();
+        if (!hasTable)
+            return null;
+        const row = db
+            .prepare("SELECT value FROM cursorDiskKV WHERE key LIKE 'composerData:%' ORDER BY rowid DESC LIMIT 1")
+            .get();
+        if (!row)
+            return null;
+        const parsed = safeParseJson(row.value);
+        if (typeof parsed !== "object" || parsed === null)
+            return null;
+        const modelConfig = parsed.modelConfig;
+        if (typeof modelConfig !== "object" || modelConfig === null)
+            return null;
+        const mc = modelConfig;
+        if (isNonEmptyString(mc.modelName))
+            return mc.modelName.trim();
+        const selectedModels = mc.selectedModels;
+        if (Array.isArray(selectedModels) && selectedModels.length > 0) {
+            const first = selectedModels[0];
+            if (isNonEmptyString(first?.modelId))
+                return first.modelId.trim();
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * Resolves Cursor's active model, chaining settings.json (pre-1.6 location) then
+ * state.vscdb (1.6+ location). Reports which source supplied the model, or "unresolved"
+ * when neither has it, so downstream payload metadata can record where the tool looked.
+ */
+export function readCursorActiveModel(baseDir) {
+    const dir = baseDir ?? cursorUserDir();
+    const fromSettings = readModelFromSettingsJson(dir);
+    if (fromSettings)
+        return { model: fromSettings, source: "settings_json" };
+    const fromStateDb = readCursorActiveModelFromStateDb(dir);
+    if (fromStateDb)
+        return { model: fromStateDb, source: "state_vscdb" };
+    return { model: null, source: "unresolved" };
+}

package/dist/cursor-store-audit.d.ts

@@ -39,8 +39,8 @@ export interface CursorStoreAuditReport {
     daily_stats_version_note: string;
 }
 export declare function redactCursorPath(p: string): string;
-export declare function auditStateVscdbFile(dbPath: string): StateVscdbAuditEntry;
-export declare function auditLegacyCursorDbFile(dbPath: string): LegacyDbAuditEntry;
+export declare function auditStateVscdbFile(dbPath: string, rootDir?: string): StateVscdbAuditEntry;
+export declare function auditLegacyCursorDbFile(dbPath: string, rootDir?: string): LegacyDbAuditEntry;
 /**
  * CUR-V07 — inventory local Cursor stores (state.vscdb vs legacy cursor.db).
  * Does not read disk outside Cursor's User directory unless `baseDir` is passed (tests).

package/dist/cursor-store-audit.js

@@ -1,9 +1,9 @@
 import { existsSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import Database from "better-sqlite3";
 import { discoverDailyStatsVersionsInDb, mergeDailyStatsVersionDiscoveries, } from "./daily-stats-versions.js";
 import { cursorUserDir, findCursorDbs, findStateVscDbs, isGlobalStateDbPath, probeCursorGlobalStateDb, } from "./readers/cursor.js";
+import { openCursorSqliteReadonly, resolveCursorSqlitePath } from "./readers/cursor-sqlite.js";
 const LEGACY_TABLE = "CursorRequestFeedback";
 const STATE_TABLE = "ItemTable";
 const RECENT_COMMIT_KEY = "aiCodeTracking.recentCommit";
@@ -16,7 +16,7 @@ function tableExists(db, tableName) {
         .get(tableName);
     return row !== undefined;
 }
-export function auditStateVscdbFile(dbPath) {
+export function auditStateVscdbFile(dbPath, rootDir) {
     const entry = {
         db_path_redacted: redactCursorPath(dbPath),
         exists: existsSync(dbPath),
@@ -27,7 +27,10 @@ export function auditStateVscdbFile(dbPath) {
         return entry;
     let db = null;
     try {
-        db = new Database(dbPath, { readonly: true });
+        const opened = openCursorSqliteReadonly(dbPath, { rootDir });
+        if (!opened.ok)
+            return entry;
+        db = opened.db;
         const ds = db
             .prepare(`SELECT count(*) AS c FROM ${STATE_TABLE} WHERE key LIKE 'aiCodeTracking.dailyStats%'`)
             .get();
@@ -45,18 +48,25 @@ export function auditStateVscdbFile(dbPath) {
     }
     return entry;
 }
-export function auditLegacyCursorDbFile(dbPath) {
+export function auditLegacyCursorDbFile(dbPath, rootDir) {
     const entry = {
         db_path_redacted: redactCursorPath(dbPath),
-        file_bytes: existsSync(dbPath) ? statSync(dbPath).size : 0,
+        file_bytes: 0,
         has_feedback_table: false,
         feedback_row_count: 0,
     };
     if (!existsSync(dbPath))
         return entry;
+    const resolved = resolveCursorSqlitePath(dbPath, { rootDir });
+    if (!resolved.ok)
+        return entry;
+    entry.file_bytes = statSync(resolved.path).size;
     let db = null;
     try {
-        db = new Database(dbPath, { readonly: true });
+        const opened = openCursorSqliteReadonly(resolved.path, { rootDir });
+        if (!opened.ok)
+            return entry;
+        db = opened.db;
         if (!tableExists(db, LEGACY_TABLE))
             return entry;
         entry.has_feedback_table = true;
@@ -105,19 +115,20 @@ function pathCIngestNote(verdict, legacyCount, totalRows) {
  * Does not read disk outside Cursor's User directory unless `baseDir` is passed (tests).
  */
 export function auditCursorLocalStores(baseDir) {
-    const sqlite_probe_ok = probeCursorGlobalStateDb(false);
+    const rootDir = baseDir ?? cursorUserDir();
+    const sqlite_probe_ok = probeCursorGlobalStateDb(false, baseDir);
     const statePaths = findStateVscDbs(baseDir);
     const globalPath = statePaths.find((p) => isGlobalStateDbPath(p)) ??
         join(baseDir ?? cursorUserDir(), "globalStorage", "state.vscdb");
-    const global = auditStateVscdbFile(globalPath);
+    const global = auditStateVscdbFile(globalPath, rootDir);
     const workspacePaths = statePaths.filter((p) => !isGlobalStateDbPath(p));
-    const workspaceAudits = workspacePaths.map(auditStateVscdbFile);
+    const workspaceAudits = workspacePaths.map((p) => auditStateVscdbFile(p, rootDir));
     const versionDiscoveries = statePaths
         .filter((p) => existsSync(p))
-        .map(discoverDailyStatsVersionsInDb);
+        .map((p) => discoverDailyStatsVersionsInDb(p, { rootDir }));
     const daily_stats_versions = mergeDailyStatsVersionDiscoveries(versionDiscoveries);
     const legacyPaths = findCursorDbs(baseDir);
-    const legacyEntries = legacyPaths.map(auditLegacyCursorDbFile);
+    const legacyEntries = legacyPaths.map((p) => auditLegacyCursorDbFile(p, rootDir));
     const withFeedbackTable = legacyEntries.filter((e) => e.has_feedback_table).length;
     const totalFeedbackRows = legacyEntries.reduce((sum, e) => sum + e.feedback_row_count, 0);
     let path_c_verdict;

package/dist/daily-stats-versions.d.ts

@@ -26,6 +26,8 @@ export declare function isVersionNewerThanV1_5(version: string): boolean;
 /**
  * Read all `aiCodeTracking.dailyStats%` keys from one `state.vscdb` file.
  */
-export declare function discoverDailyStatsVersionsInDb(dbPath: string): DailyStatsVersionDiscovery;
+export declare function discoverDailyStatsVersionsInDb(dbPath: string, options?: {
+    rootDir?: string;
+}): DailyStatsVersionDiscovery;
 /** Merge discoveries from global + workspace `state.vscdb` files (dedupe sample keys only). */
 export declare function mergeDailyStatsVersionDiscoveries(discoveries: DailyStatsVersionDiscovery[]): DailyStatsVersionDiscovery;

package/dist/daily-stats-versions.js

@@ -1,8 +1,4 @@
-/**
- * CUR-V11 — discover `aiCodeTracking.dailyStats` version prefixes on disk.
- * Keys look like: aiCodeTracking.dailyStats.v1.5.2026-05-20
- */
-import Database from "better-sqlite3";
+import { openCursorSqliteReadonly } from "./readers/cursor-sqlite.js";
 const STATE_TABLE = "ItemTable";
 const DAILY_STATS_LIKE = "aiCodeTracking.dailyStats%";
 /** Full key shape for a dated dailyStats row. */
@@ -70,12 +66,15 @@ function mergeBuckets(target, discovery) {
 /**
  * Read all `aiCodeTracking.dailyStats%` keys from one `state.vscdb` file.
  */
-export function discoverDailyStatsVersionsInDb(dbPath) {
+export function discoverDailyStatsVersionsInDb(dbPath, options = {}) {
     const byVersion = new Map();
     const unmatched = [];
     let db = null;
     try {
-        db = new Database(dbPath, { readonly: true });
+        const opened = openCursorSqliteReadonly(dbPath, { rootDir: options.rootDir });
+        if (!opened.ok)
+            return emptyDiscovery();
+        db = opened.db;
         const table = db
             .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?")
             .get(STATE_TABLE);