@aixle/insights 0.1.1 → 0.2.1-staging

package/dist/health.d.ts

@@ -16,6 +16,8 @@ export interface HealthSnapshot {
     hooks_queue_depth: number;
     /** Best-effort merge of credential-scoped `mcp_operator` (latest `last_sync_at`). */
     persisted: McpOperatorState | null;
+    /** True only when buildHealthSnapshot caught an unexpected error building the snapshot. */
+    snapshot_failed?: boolean;
     /** In-process telemetry (same fields as `getSyncTelemetry`). */
     process: {
         last_sync_at: string | null;
@@ -26,6 +28,6 @@ export interface HealthSnapshot {
 /** Pick the freshest persisted operator block by `last_sync_at` lexicographic (ISO-safe). */
 export declare function mergePersistedOperators(snapshots: McpOperatorState[]): McpOperatorState | null;
 export declare function buildHealthSnapshot(): Promise<HealthSnapshot>;
-/** MCP `db90_status` JSON — single source shared with CLI health. */
+/** MCP `aixle_insights_status` JSON — single source shared with CLI health. */
 export declare function healthSnapshotToStatusPayload(snapshot: HealthSnapshot): Record<string, unknown>;
 export declare function formatHealthForCli(snapshot: HealthSnapshot): string;

package/dist/health.js

@@ -122,6 +122,7 @@ export async function buildHealthSnapshot() {
             hooks_installed: hooksReport.hooks_json_installed,
             hooks_queue_depth: hooksReport.queue_depth,
             persisted: null,
+            snapshot_failed: true,
             process: {
                 last_sync_at: telemetry.lastSyncAt,
                 last_result: telemetry.lastResult,
@@ -133,18 +134,25 @@ export async function buildHealthSnapshot() {
         };
     }
 }
-/** MCP `db90_status` JSON — single source shared with CLI health. */
+/** MCP `aixle_insights_status` JSON — single source shared with CLI health. */
 export function healthSnapshotToStatusPayload(snapshot) {
     const proc = snapshot.process;
     const pers = snapshot.persisted;
     const lastSyncAt = proc.last_sync_at ?? pers?.last_sync_at ?? null;
     const lastResult = proc.last_result ?? snapshotToResult(pers?.last_result ?? null);
     const errors = mergeErrors(proc.recent_errors, pers?.recent_errors ?? []);
+    const needsInit = !snapshot.authenticated && snapshot.snapshot_failed !== true;
+    const onboardingMessage = needsInit
+        ? "aixle-insights is installed but not connected. Run `aixle-insights init` to start tracking — " +
+            "activity since install is not lost; the first sync after init backfills all of it."
+        : null;
     return {
         authenticated: snapshot.authenticated,
         configured: snapshot.configured,
         host: snapshot.host,
         ingest_tools: snapshot.ingest_tools,
+        needs_init: needsInit,
+        onboarding_message: onboardingMessage,
         last_sync_at: lastSyncAt,
         last_result: lastResult,
         sessions_synced: lastResult?.sent ?? 0,
@@ -191,5 +199,9 @@ export function formatHealthForCli(snapshot) {
     else {
         lines.push("  (none)");
     }
+    if (typeof sta["onboarding_message"] === "string") {
+        lines.push("");
+        lines.push(sta["onboarding_message"]);
+    }
     return lines.join("\n");
 }

package/dist/hooks/cursor-hooks-mapper.d.ts

@@ -1,5 +1,5 @@
 import type { HookLogEvent } from "./hooks-config.js";
-import type { CursorDb90Payload } from "../readers/cursor.js";
+import type { CursorPayload } from "../readers/cursor.js";
 export { HookLogEvent };
 /** State key prefix for hook event dedup in state.sessions. */
 export declare const CURSOR_HOOK_STATE_PREFIX: "cursor:hook:";
@@ -16,7 +16,7 @@ export declare function shouldIngestHookEvent(event: HookLogEvent, verbose?: boo
 /** Warn-only version gate — Cursor builds can have unusual version strings. */
 export declare function warnOnCursorVersion(event: HookLogEvent, verbose: boolean): void;
 /**
- * Map a validated hook event to the CursorDb90Payload contract.
+ * Map a validated hook event to the CursorPayload contract.
  * Call shouldIngestHookEvent() before this — it does not re-validate.
  */
-export declare function mapHookEventToPayload(event: HookLogEvent, projectId?: string | null): CursorDb90Payload;
+export declare function mapHookEventToPayload(event: HookLogEvent, projectId?: string | null): CursorPayload;

package/dist/hooks/cursor-hooks-mapper.js

@@ -47,7 +47,7 @@ export function warnOnCursorVersion(event, verbose) {
     }
 }
 /**
- * Map a validated hook event to the CursorDb90Payload contract.
+ * Map a validated hook event to the CursorPayload contract.
  * Call shouldIngestHookEvent() before this — it does not re-validate.
  */
 export function mapHookEventToPayload(event, projectId) {

package/dist/hooks/cursor-hooks-reader.d.ts

@@ -8,6 +8,8 @@ export interface ProcessHooksQueueParams {
     state: State;
     host: string;
     token: string;
+    /** Mirrors StoredCredentials.insecureHttpAllowed — set when `init --insecure` was used for this host. */
+    allowInsecureHttp?: boolean;
     /** Called when a 429 is received. */
     on429: (retryAfter: number, quotaExceeded: boolean) => void;
     /** If true, skip events already in state.sessions. */

package/dist/hooks/cursor-hooks-reader.js

@@ -47,7 +47,7 @@ function rewriteQueueKeepingLines(queuePath, allLines, keepIndices) {
  * Partial failure: lines that succeeded are removed; lines that failed stay.
  */
 export async function processHooksQueue(params) {
-    const { queuePath, scopeDir, host, token, on429, skipSeen = true, resolveProjectId, verbose = false, } = params;
+    const { queuePath, scopeDir, host, token, allowInsecureHttp = false, on429, skipSeen = true, resolveProjectId, verbose = false, } = params;
     if (!existsSync(queuePath)) {
         return { sent: 0, failed: 0, skipped: 0, state: params.state };
     }
@@ -97,7 +97,7 @@ export async function processHooksQueue(params) {
             projectId = await resolveProjectId(workspace);
         }
         const payload = mapHookEventToPayload(event, projectId);
-        const ok = await postEvent(payload, host, token, { on429 });
+        const ok = await postEvent(payload, host, token, { on429, allowInsecureHttp });
         if (ok) {
             totalSent++;
             stateMut = markSessionSent(stateMut, dedupeKey, 0);

package/dist/install/cursor.d.ts

@@ -0,0 +1,34 @@
+import { type InstallResult } from "./claude.js";
+export interface InstallCursorUserMcpOptions {
+    /** Tests: full path to the Cursor MCP config file (default ~/.cursor/mcp.json). */
+    cursorConfigPath?: string;
+    force?: boolean;
+}
+export type UninstallResult = {
+    kind: "restored";
+    backupPath: string;
+} | {
+    kind: "removed";
+} | {
+    kind: "noop";
+} | {
+    kind: "error";
+    message: string;
+};
+export declare function defaultCursorUserConfigPath(): string;
+/**
+ * Merges top-level `mcpServers.aixle-insights` into ~/.cursor/mcp.json (or overridden path).
+ * Preserves all other keys and MCP server entries. Backs up the existing file
+ * (once) before the first write, and removes legacy "db90"/"insights" keys so
+ * Cursor does not spawn duplicate aixle-insights servers.
+ */
+export declare function installCursorUserMcp(options?: InstallCursorUserMcpOptions): InstallResult;
+/**
+ * Removes the aixle-insights entry from ~/.cursor/mcp.json without disturbing any
+ * other server entry — including ones the user or Cursor added after install.
+ * Works on the CURRENT file (never a full-file revert to the backup). If a
+ * pre-install backup exists, the user's ORIGINAL aixle-insights entry (if any)
+ * is restored from it; otherwise our key is simply removed. The backup file is
+ * cleaned up either way.
+ */
+export declare function uninstallCursorUserMcp(options?: InstallCursorUserMcpOptions): UninstallResult;

package/dist/install/cursor.js

@@ -0,0 +1,193 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, copyFileSync, unlinkSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { randomBytes } from "node:crypto";
+import { desiredAixleInsightsEntry, aixleInsightsEntryMatchesDesired } from "./claude.js";
+export function defaultCursorUserConfigPath() {
+    return join(homedir(), ".cursor", "mcp.json");
+}
+/**
+ * Legacy keys to clean up on install: "db90" (pre-rebrand) and "insights" (an
+ * earlier local-dev-only convention documented in scripts/reset-local-env.mjs,
+ * never the production installer's key — see DB90DV-560 orientation.md).
+ */
+const LEGACY_MCP_KEYS = ["db90", "insights"];
+const AIXLE_INSIGHTS_MCP_KEY = "aixle-insights";
+const BACKUP_SUFFIX = ".aixle-insights-backup";
+function readRootObject(path) {
+    if (!existsSync(path)) {
+        return {};
+    }
+    try {
+        const raw = readFileSync(path, "utf-8");
+        if (!raw.trim()) {
+            return {};
+        }
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return {
+                kind: "error",
+                message: `${path}: top-level JSON value must be an object.`,
+            };
+        }
+        return parsed;
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { kind: "error", message: `Cannot read ${path}: ${msg}` };
+    }
+}
+function atomicWriteJson(path, data) {
+    try {
+        const dir = dirname(path);
+        mkdirSync(dir, { recursive: true });
+        const serialized = `${JSON.stringify(data, null, 2)}\n`;
+        const tmpPath = join(dir, `.aixle-insights-cursor-json-${randomBytes(8).toString("hex")}.tmp`);
+        writeFileSync(tmpPath, serialized, "utf-8");
+        renameSync(tmpPath, path);
+        return { kind: "installed" };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { kind: "error", message: `Failed to write ${path}: ${msg}` };
+    }
+}
+/** Copy the current file to a backup path, unless a backup already exists (never clobber the user's original). */
+function backupIfNeeded(path) {
+    if (!existsSync(path))
+        return;
+    const backupPath = path + BACKUP_SUFFIX;
+    if (existsSync(backupPath))
+        return;
+    copyFileSync(path, backupPath);
+}
+/**
+ * Merges top-level `mcpServers.aixle-insights` into ~/.cursor/mcp.json (or overridden path).
+ * Preserves all other keys and MCP server entries. Backs up the existing file
+ * (once) before the first write, and removes legacy "db90"/"insights" keys so
+ * Cursor does not spawn duplicate aixle-insights servers.
+ */
+export function installCursorUserMcp(options = {}) {
+    const path = options.cursorConfigPath ?? defaultCursorUserConfigPath();
+    const force = options.force === true;
+    const desired = desiredAixleInsightsEntry();
+    const rootRead = readRootObject(path);
+    if ("kind" in rootRead && typeof rootRead.kind === "string" && rootRead.kind === "error") {
+        return rootRead;
+    }
+    const root = {
+        ...rootRead,
+    };
+    const rawServers = root["mcpServers"];
+    let mcpServers;
+    if (rawServers === undefined) {
+        mcpServers = {};
+    }
+    else if (typeof rawServers === "object" &&
+        rawServers !== null &&
+        !Array.isArray(rawServers)) {
+        mcpServers = { ...rawServers };
+    }
+    else {
+        return {
+            kind: "error",
+            message: `Invalid Cursor MCP config at ${path}: "mcpServers" must be an object when present.`,
+        };
+    }
+    const existing = mcpServers[AIXLE_INSIGHTS_MCP_KEY];
+    const hasLegacyKey = LEGACY_MCP_KEYS.some((k) => mcpServers[k] !== undefined);
+    if (existing !== undefined && aixleInsightsEntryMatchesDesired(existing, desired)) {
+        if (!hasLegacyKey) {
+            return { kind: "already-configured" };
+        }
+        backupIfNeeded(path);
+        for (const key of LEGACY_MCP_KEYS)
+            delete mcpServers[key];
+        root["mcpServers"] = mcpServers;
+        return atomicWriteJson(path, root);
+    }
+    if (existing !== undefined && !force) {
+        return {
+            kind: "requires-force",
+            detail: 'A different "aixle-insights" MCP server entry already exists in ~/.cursor/mcp.json. Re-run with `init --force` to replace only that entry.',
+        };
+    }
+    backupIfNeeded(path);
+    for (const key of LEGACY_MCP_KEYS)
+        delete mcpServers[key];
+    mcpServers[AIXLE_INSIGHTS_MCP_KEY] = { command: desired.command, args: desired.args };
+    root["mcpServers"] = mcpServers;
+    return atomicWriteJson(path, root);
+}
+/**
+ * Removes the aixle-insights entry from ~/.cursor/mcp.json without disturbing any
+ * other server entry — including ones the user or Cursor added after install.
+ * Works on the CURRENT file (never a full-file revert to the backup). If a
+ * pre-install backup exists, the user's ORIGINAL aixle-insights entry (if any)
+ * is restored from it; otherwise our key is simply removed. The backup file is
+ * cleaned up either way.
+ */
+export function uninstallCursorUserMcp(options = {}) {
+    const path = options.cursorConfigPath ?? defaultCursorUserConfigPath();
+    const backupPath = path + BACKUP_SUFFIX;
+    const hasBackup = existsSync(backupPath);
+    const cleanupBackup = () => {
+        if (hasBackup) {
+            try {
+                unlinkSync(backupPath);
+            }
+            catch {
+                /* non-fatal */
+            }
+        }
+    };
+    if (!existsSync(path)) {
+        cleanupBackup();
+        return { kind: "noop" };
+    }
+    const rootRead = readRootObject(path);
+    if ("kind" in rootRead && typeof rootRead.kind === "string" && rootRead.kind === "error") {
+        return rootRead;
+    }
+    const root = { ...rootRead };
+    const rawServers = root["mcpServers"];
+    if (typeof rawServers !== "object" || rawServers === null || Array.isArray(rawServers)) {
+        cleanupBackup();
+        return { kind: "noop" };
+    }
+    const mcpServers = { ...rawServers };
+    // If a backup exists, recover the user's ORIGINAL aixle-insights entry (if they
+    // had one we overwrote) rather than just deleting ours — but only that one key,
+    // leaving every current sibling entry intact.
+    let restoredPrior = false;
+    if (hasBackup) {
+        const backupRead = readRootObject(backupPath);
+        const backupIsObject = !("kind" in backupRead &&
+            typeof backupRead.kind === "string" &&
+            backupRead.kind === "error");
+        if (backupIsObject) {
+            const backupServers = backupRead["mcpServers"];
+            if (typeof backupServers === "object" && backupServers !== null && !Array.isArray(backupServers)) {
+                const priorEntry = backupServers[AIXLE_INSIGHTS_MCP_KEY];
+                if (priorEntry !== undefined) {
+                    mcpServers[AIXLE_INSIGHTS_MCP_KEY] = priorEntry;
+                    restoredPrior = true;
+                }
+            }
+        }
+    }
+    if (!restoredPrior) {
+        if (mcpServers[AIXLE_INSIGHTS_MCP_KEY] === undefined) {
+            cleanupBackup();
+            return { kind: "noop" };
+        }
+        delete mcpServers[AIXLE_INSIGHTS_MCP_KEY];
+    }
+    root["mcpServers"] = mcpServers;
+    const writeResult = atomicWriteJson(path, root);
+    if (writeResult.kind === "error") {
+        return writeResult;
+    }
+    cleanupBackup();
+    return restoredPrior ? { kind: "restored", backupPath } : { kind: "removed" };
+}

package/dist/install/index.d.ts

@@ -1,8 +1,10 @@
 import { type InstallClaudeUserMcpOptions, type InstallResult } from "./claude.js";
-export type SupportedEditor = "claude";
-export type { InstallClaudeUserMcpOptions, InstallResult };
+import { type InstallCursorUserMcpOptions, type UninstallResult } from "./cursor.js";
+export type SupportedEditor = "claude" | "cursor";
+export type { InstallClaudeUserMcpOptions, InstallCursorUserMcpOptions, InstallResult, UninstallResult, };
 /**
- * Editor dispatch for MCP install hooks. Only Claude Code is supported in this story.
+ * Editor dispatch for MCP install hooks.
  */
-export declare function installEditorMcp(editor: SupportedEditor, options?: InstallClaudeUserMcpOptions): InstallResult;
+export declare function installEditorMcp(editor: SupportedEditor, options?: InstallClaudeUserMcpOptions & InstallCursorUserMcpOptions): InstallResult;
 export { installClaudeUserMcp, defaultClaudeUserConfigPath, desiredAixleInsightsEntry, aixleInsightsEntryMatchesDesired, } from "./claude.js";
+export { installCursorUserMcp, uninstallCursorUserMcp, defaultCursorUserConfigPath, } from "./cursor.js";

package/dist/install/index.js

@@ -1,11 +1,16 @@
 import { installClaudeUserMcp, } from "./claude.js";
+import { installCursorUserMcp, } from "./cursor.js";
 /**
- * Editor dispatch for MCP install hooks. Only Claude Code is supported in this story.
+ * Editor dispatch for MCP install hooks.
  */
 export function installEditorMcp(editor, options = {}) {
     if (editor === "claude") {
         return installClaudeUserMcp(options);
     }
+    if (editor === "cursor") {
+        return installCursorUserMcp(options);
+    }
     return { kind: "error", message: `Unsupported editor for MCP install: ${String(editor)}` };
 }
 export { installClaudeUserMcp, defaultClaudeUserConfigPath, desiredAixleInsightsEntry, aixleInsightsEntryMatchesDesired, } from "./claude.js";
+export { installCursorUserMcp, uninstallCursorUserMcp, defaultCursorUserConfigPath, } from "./cursor.js";

package/dist/lib/client.d.ts

@@ -8,6 +8,13 @@ export interface IngestPayload {
     [key: string]: unknown;
 }
 export interface PostEventOptions {
+    /**
+     * Skip the HTTPS-or-loopback gate for this host. Only ever set this to
+     * `true` when the caller has independently confirmed the user explicitly
+     * consented via `init --insecure` for this exact credential (see
+     * `StoredCredentials.insecureHttpAllowed`). Defaults to `false`.
+     */
+    allowInsecureHttp?: boolean;
     /** Override default console.error on non-ok HTTP response. */
     onHttpError?: (status: number, statusText: string, body: string) => void;
     /** Override default console.error on network-level failure. */

package/dist/lib/client.js

@@ -1,3 +1,4 @@
+import { evaluateTransportSecurity } from "./transport-security.js";
 /**
  * POST a single event payload to the db90 ingest endpoint.
  *
@@ -10,6 +11,22 @@
  * Never throws — callers can rely on Promise.allSettled-style aggregation.
  */
 export async function postEvent(payload, host, token, options = {}) {
+    const transportSecurity = evaluateTransportSecurity(host, {
+        allowInsecureHttp: options.allowInsecureHttp === true,
+        label: "DB90 ingest host",
+    });
+    if (!transportSecurity.ok) {
+        // Deliberately does NOT call options.onNetworkError/onHttpError: the retry
+        // wrapper in src/client.ts treats those as transient and retries with
+        // backoff. A scheme rejection is permanent — retrying wastes ~21s per
+        // event for nothing. Bare console.error mirrors this file's existing
+        // unrecoverable-failure logging style.
+        console.error(`Blocked event send — ${transportSecurity.error}`);
+        return false;
+    }
+    if (transportSecurity.warning) {
+        console.error(`Warning: ${transportSecurity.warning}`);
+    }
     const url = `${host.replace(/\/$/, "")}/api/v1/ingest/events`;
     const headers = {
         "Content-Type": "application/json",

package/dist/lib/config.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { mcpLog } from "../log.js";
 /**
  * Load a connector's `config.json` from disk. Returns `{}` on missing or
  * malformed files — callers fall back to env vars / CLI flags / defaults.
@@ -32,8 +33,12 @@ export function loadBaseConfig(configDir, parsePricing) {
             return result;
         }
     }
-    catch {
-        // missing or invalid config — fall through
+    catch (err) {
+        const code = err?.code;
+        if (code !== "ENOENT") {
+            // Config file exists but failed to parse — distinguishes tampering from "never created".
+            mcpLog.warn("config_parse_failed", { path: configPath, error: err instanceof Error ? err.message : String(err) }, false);
+        }
     }
     return {};
 }

package/dist/lib/project-resolver.d.ts

@@ -6,8 +6,8 @@ export interface LookupResult {
     project_id: string;
     name: string;
 }
-export declare function resolveProjectId(flagValue: string | undefined, configValue: string | undefined, host: string, token: string, verbose: boolean): Promise<ProjectResolution>;
-export declare function resolveProjectIdForRepoPath(repoPath: string, host: string, token: string, verbose: boolean): Promise<ProjectResolution>;
+export declare function resolveProjectId(flagValue: string | undefined, configValue: string | undefined, host: string, token: string, verbose: boolean, allowInsecureHttp?: boolean): Promise<ProjectResolution>;
+export declare function resolveProjectIdForRepoPath(repoPath: string, host: string, token: string, verbose: boolean, allowInsecureHttp?: boolean): Promise<ProjectResolution>;
 export declare function getGitRemote(verbose: boolean): string | null;
 export declare function getGitRemoteForPath(repoPath: string, verbose: boolean): string | null;
 /**
@@ -24,7 +24,7 @@ export declare function canonicalizeGitRemote(remote: string, verbose: boolean):
  * git remote. Expand to remotes the API lookup understands (`Project.normalize_git_remote`).
  */
 export declare function repoNameToGitRemoteCandidates(repoName: string): string[];
-export declare function lookupProjectByRepoName(repoName: string, host: string, token: string, verbose: boolean): Promise<LookupResult | "not-found" | null>;
+export declare function lookupProjectByRepoName(repoName: string, host: string, token: string, verbose: boolean, allowInsecureHttp?: boolean): Promise<LookupResult | "not-found" | null>;
 /** Payload shape shared by db90-cursor and telemetry-mcp commit mappers. */
 export interface CommitAttributionPayload {
     event_type?: string;
@@ -44,5 +44,6 @@ export declare function enrichCommitProjectAttribution(payloads: CommitAttributi
     host: string;
     token: string;
     verbose?: boolean;
+    allowInsecureHttp?: boolean;
 }): Promise<void>;
-export declare function lookupProjectByRemote(gitRemote: string, host: string, token: string, verbose: boolean): Promise<LookupResult | "not-found" | null>;
+export declare function lookupProjectByRemote(gitRemote: string, host: string, token: string, verbose: boolean, allowInsecureHttp?: boolean): Promise<LookupResult | "not-found" | null>;

package/dist/lib/project-resolver.js

@@ -1,9 +1,10 @@
 import { execFileSync } from "node:child_process";
+import { evaluateTransportSecurity } from "./transport-security.js";
 /** Coerce empty string to undefined so "" is treated as "not set" */
 function coerce(val) {
     return val === "" ? undefined : val;
 }
-export async function resolveProjectId(flagValue, configValue, host, token, verbose) {
+export async function resolveProjectId(flagValue, configValue, host, token, verbose, allowInsecureHttp = false) {
     const flag = coerce(flagValue);
     const config = coerce(configValue);
     if (flag !== undefined)
@@ -13,18 +14,18 @@ export async function resolveProjectId(flagValue, configValue, host, token, verb
     const gitRemote = getGitRemote(verbose);
     if (gitRemote === null)
         return { projectId: null, source: "none" };
-    const result = await lookupProjectByRemote(gitRemote, host, token, verbose);
+    const result = await lookupProjectByRemote(gitRemote, host, token, verbose, allowInsecureHttp);
     if (result === "not-found")
         return { projectId: null, source: "auto-detect-not-found" };
     if (result !== null)
         return { projectId: result.project_id, source: "auto-detect" };
     return { projectId: null, source: "none" };
 }
-export async function resolveProjectIdForRepoPath(repoPath, host, token, verbose) {
+export async function resolveProjectIdForRepoPath(repoPath, host, token, verbose, allowInsecureHttp = false) {
     const gitRemote = getGitRemoteForPath(repoPath, verbose);
     if (gitRemote === null)
         return { projectId: null, source: "none" };
-    const result = await lookupProjectByRemote(gitRemote, host, token, verbose);
+    const result = await lookupProjectByRemote(gitRemote, host, token, verbose, allowInsecureHttp);
     if (result === "not-found")
         return { projectId: null, source: "auto-detect-not-found" };
     if (result !== null)
@@ -133,7 +134,7 @@ export function repoNameToGitRemoteCandidates(repoName) {
     }
     return [];
 }
-export async function lookupProjectByRepoName(repoName, host, token, verbose) {
+export async function lookupProjectByRepoName(repoName, host, token, verbose, allowInsecureHttp = false) {
     const candidates = repoNameToGitRemoteCandidates(repoName);
     if (candidates.length === 0) {
         if (verbose)
@@ -141,7 +142,7 @@ export async function lookupProjectByRepoName(repoName, host, token, verbose) {
         return "not-found";
     }
     for (const candidate of candidates) {
-        const result = await lookupProjectByRemote(candidate, host, token, verbose);
+        const result = await lookupProjectByRemote(candidate, host, token, verbose, allowInsecureHttp);
         if (result === "not-found")
             continue;
         return result;
@@ -164,7 +165,7 @@ export async function enrichCommitProjectAttribution(payloads, options) {
         const repoName = payload.metadata?.repo_name;
         if (!repoName)
             continue;
-        const result = await lookupProjectByRepoName(repoName, options.host, options.token, options.verbose ?? false);
+        const result = await lookupProjectByRepoName(repoName, options.host, options.token, options.verbose ?? false, options.allowInsecureHttp === true);
         if (result && typeof result === "object" && "project_id" in result) {
             payload.project_id = result.project_id;
             if (options.verbose) {
@@ -173,7 +174,18 @@ export async function enrichCommitProjectAttribution(payloads, options) {
         }
     }
 }
-export async function lookupProjectByRemote(gitRemote, host, token, verbose) {
+export async function lookupProjectByRemote(gitRemote, host, token, verbose, allowInsecureHttp = false) {
+    const transportSecurity = evaluateTransportSecurity(host, {
+        allowInsecureHttp,
+        label: "DB90 project-lookup host",
+    });
+    if (!transportSecurity.ok) {
+        console.error(`Blocked project lookup — ${transportSecurity.error}`);
+        return null;
+    }
+    if (transportSecurity.warning) {
+        console.error(`Warning: ${transportSecurity.warning}`);
+    }
     const url = `${host.replace(/\/$/, "")}/api/v1/projects/lookup?git_remote=${encodeURIComponent(gitRemote)}`;
     try {
         const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });

package/dist/lib/transport-security.d.ts

@@ -0,0 +1,13 @@
+export type TransportSecurityResult = {
+    ok: true;
+    warning?: string;
+} | {
+    ok: false;
+    error: string;
+};
+export interface TransportSecurityOptions {
+    allowInsecureHttp: boolean;
+    label: string;
+}
+export declare function isLoopbackHost(hostname: string): boolean;
+export declare function evaluateTransportSecurity(rawUrl: string, options: TransportSecurityOptions): TransportSecurityResult;

package/dist/lib/transport-security.js

@@ -0,0 +1,47 @@
+function isIpv4Loopback(hostname) {
+    const parts = hostname.split(".");
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map((part) => Number(part));
+    return octets.every((octet, index) => Number.isInteger(octet) &&
+        octet >= 0 &&
+        octet <= 255 &&
+        String(octet) === parts[index]) && octets[0] === 127;
+}
+export function isLoopbackHost(hostname) {
+    const normalized = hostname.toLowerCase();
+    return normalized === "localhost" ||
+        normalized === "::1" ||
+        normalized === "[::1]" ||
+        isIpv4Loopback(normalized);
+}
+function plaintextMessage(label, host, action) {
+    const prefix = `${label} ${host} uses remote plaintext HTTP`;
+    const guidance = "Plaintext HTTP can expose ingest tokens and telemetry. Use HTTPS for remote hosts";
+    if (action === "warn") {
+        return `${prefix}. ${guidance}; --insecure should only be used for trusted non-production test endpoints.`;
+    }
+    return `${prefix}. ${guidance}, or pass --insecure only for a trusted non-production test endpoint.`;
+}
+export function evaluateTransportSecurity(rawUrl, options) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return { ok: false, error: `${options.label} must be a valid URL.` };
+    }
+    if (parsed.protocol === "https:") {
+        return { ok: true };
+    }
+    if (parsed.protocol !== "http:") {
+        return { ok: false, error: `${options.label} must use HTTPS, or HTTP for localhost/loopback local development.` };
+    }
+    if (isLoopbackHost(parsed.hostname)) {
+        return { ok: true };
+    }
+    if (options.allowInsecureHttp) {
+        return { ok: true, warning: plaintextMessage(options.label, parsed.host, "warn") };
+    }
+    return { ok: false, error: plaintextMessage(options.label, parsed.host, "reject") };
+}

package/dist/pricing.d.ts

@@ -2,7 +2,7 @@
  * Model pricing table and cost calculation for @aixle/insights.
  *
  * Default rates source: https://platform.claude.com/docs/en/about-claude/pricing
- * Rates last verified: 2026-05-04
+ * Rates last verified: 2026-06-17
  */
 export interface ModelPricing {
     input_per_mtok: number;
@@ -32,6 +32,14 @@ export declare const DEFAULT_PRICING: PricingTable;
  * - Returns a new table object so mutations never affect DEFAULT_PRICING.
  */
 export declare function mergePricing(base: PricingTable, overrides: PricingTable): PricingTable;
+/**
+ * Strips a trailing -YYYYMMDD date suffix to produce the bare model key used
+ * in the pricing table. Returns the original ID when:
+ *  - it has no date suffix, OR
+ *  - the bare form is not in the table (i.e. the dated form IS the canonical key,
+ *    like legacy "claude-3-5-sonnet-20241022").
+ */
+export declare function normalizeModelId(model: string, pricing: PricingTable): string;
 export declare function calculateCost(model: string | null, baseInputTokens: number, outputTokens: number, cacheWriteTokens: number, cacheReadTokens: number, pricing: PricingTable): number | null;
 /**
  * Returns a human-readable warning string explaining why cost could not be