@aixle/insights 0.2.0 → 0.2.1

package/README.md

@@ -13,7 +13,7 @@ Two channels are published. Pick one deliberately — they are **not** interchan
 | | Production | Staging (QA) |
 |---|---|---|
 | Install | `npm i -g @aixle/insights` | `npm i -g @aixle/insights@staging` |
-| Version looks like | `0.2.0` | `0.2.1-staging` |
+| Version looks like | `0.2.1` | `0.2.6-staging` |
 | Points at | the production API | the staging API |
 | Who should use it | **everyone** | QA validating unreleased work |
 | Stability | released, supported | may change or break without notice |
@@ -28,7 +28,7 @@ npx -y @aixle/insights init \
 
 # Or global install:
 npm i -g @aixle/insights
-aixle-insights --version    # e.g. 0.2.0  (no suffix)
+aixle-insights --version    # e.g. 0.2.1  (no suffix)
 ```
 
 ### Staging — QA only
@@ -44,7 +44,7 @@ npx -y @aixle/insights@staging init \
 
 # Or global install:
 npm i -g @aixle/insights@staging
-aixle-insights --version    # e.g. 0.2.1-staging  (note the suffix)
+aixle-insights --version    # e.g. 0.2.6-staging  (note the suffix)
 ```
 
 Point a staging build at the **staging** API host. Sending staging telemetry to production
@@ -60,7 +60,7 @@ npm view @aixle/insights dist-tags       # what each channel currently resolves
 Expected output — `latest` and `staging` move independently:
 
 ```
-{ latest: '0.2.0', staging: '0.2.1-staging' }
+{ latest: '0.2.1', staging: '0.2.6-staging' }
 ```
 
 ### Switching back to production
@@ -73,8 +73,8 @@ Then re-run `init` against the production host, since credentials and the MCP en
 per-host.
 
 > **Why `npm install` never surprises you with a staging build:** `-staging` versions are semver
-> prereleases, and no ordinary version range resolves to a prerelease. `*`, `^0.2.0`, `~0.2.0`
-> and `>=0.1.0` all select `0.2.0` even when `0.2.1-staging` exists. Staging builds are
+> prereleases, and no ordinary version range resolves to a prerelease. `*`, `^0.2.1`, `~0.2.1`
+> and `>=0.1.0` all select `0.2.1` even when `0.2.6-staging` exists. Staging builds are
 > reachable only by exact version or the `staging` dist-tag.
 
 Maintainers: see [`../RELEASING.md`](../RELEASING.md) for how each channel is cut.
@@ -98,7 +98,7 @@ After `init` succeeds:
 
 1. **Restart Claude Code** — it discovers the new MCP server on the next launch.
 2. Open Claude Code; confirm `/mcp` lists **aixle-insights**.
-3. During a Claude session invoke the **`db90_status`** MCP tool (or `aixle-insights health` from the shell) to see connectivity + last sync metadata.
+3. During a Claude session invoke the **`aixle_insights_status`** MCP tool (or `aixle-insights health` from the shell) to see connectivity + last sync metadata.
 
 ## Multi-org
 
@@ -154,29 +154,54 @@ Optional `~/.aixle-insights/config.json` accepts Cursor line-cost overrides (per
 }
 ```
 
+The file is optional — an absent `config.json` is the normal case and is silent. A file that is
+present but unusable is ignored entirely (every override falls back to its default) and a
+`config_parse_failed` line is written to `mcp.log`. That covers malformed JSON and valid JSON that
+isn't an object, including a **top-level array** — a common mistake when writing per-model rates.
+Nothing is printed to the terminal, so check the log if an override appears to have no effect.
+
 ## Security
 
 `@aixle/insights` enforces HTTPS for any remote host. Plaintext `http://` is allowed only for loopback (`localhost`, `127.0.0.0/8`, `[::1]`) so that local-dev flows against `make up` continue to work without friction.
 
-### Two gates
+### Three gates
 
 | Gate | Where it fires | What it checks |
 |---|---|---|
 | CLI `--host` gate | `runInit()` at the top of `aixle-insights init`, before any network call to Keycloak | The `--host` value the user typed |
 | Post-exchange `ingestHost` gate | `auth/flow.ts`, immediately after the OIDC-for-ingest-token exchange returns, before persisting credentials to the keychain | The `ingestHost` returned by the server, in case it differs from `--host` |
+| Runtime send/lookup gate | `lib/client.ts`'s `postEvent` and `lib/project-resolver.ts`'s `lookupProjectByRemote`, immediately before every ingest POST and project-attribution GET | The `host` loaded from stored credentials, on **every** sync cycle — not just at `init` |
+
+All three gates use the same pure utility, `evaluateTransportSecurity()` in `src/lib/transport-security.ts`. The first two rejecting aborts `init` with exit code 1 and a single-line error naming the offending host. The third rejecting drops that send/lookup (logged via `console.error`, no retry) without aborting the whole sync cycle — a single tampered credential shouldn't crash background sync, it should just refuse to leak the token.
 
-Both gates use the same pure utility, `evaluateTransportSecurity()` in `src/lib/transport-security.ts`. Either gate rejecting aborts `init` with exit code 1 and a single-line error naming the offending host.
+The runtime gate exists because `init`'s two gates only run once, at login time. If `~/.aixle-insights/credentials.json` is edited afterward (by hand, by malware, or by disk corruption) to point at a plaintext `http://` remote, nothing previously re-checked the scheme before every subsequent sync sent the bearer token — DB90DV-539 closed that gap.
 
-### `--insecure` (init-only)
+### `--insecure` (init-only, consent persists to runtime)
 
-`aixle-insights init --insecure --host http://<remote>` downgrades both gates from "reject" to "warn + continue." It is intended only for trusted non-production test endpoints (e.g. a self-hosted staging on a private network without a TLS cert).
+`aixle-insights init --insecure --host http://<remote>` downgrades the first two gates from "reject" to "warn + continue." It is intended only for trusted non-production test endpoints (e.g. a self-hosted staging on a private network without a TLS cert).
 
-`--insecure` is rejected on the `run` subcommand by design — the long-running MCP server should never run insecurely. `run --insecure` routes to the help screen, the same as any unknown flag.
+`--insecure` is rejected on the `run` subcommand by design — the long-running MCP server should never run insecurely, and since `run` is normally spawned non-interactively (by Claude Code, via `~/.claude.json`), there is no ergonomic way to pass a flag to it per-cycle anyway. Instead, when `init --insecure` is used, that consent is recorded as `insecureHttpAllowed: true` on the stored credential (`StoredCredentials.insecureHttpAllowed` in `auth/credentials.ts`) and every later `run` reads it back — so a legitimately-approved trusted HTTP endpoint keeps syncing normally. A `credentials.json` that has an `http://` remote host **without** this flag set (e.g. because someone hand-edited the file after the fact, bypassing `init` entirely) is rejected by the runtime gate on every send.
 
 ### What is NOT gated
 
 The Keycloak issuer URL (`--keycloak-url` / `KEYCLOAK_ISSUER`) is **not** TLS-gated by this package. Same threat model, different ticket — tracked separately. For now, use HTTPS for any remote Keycloak issuer; the OIDC device-flow library will fail the request if the cert is invalid, but it will not refuse to attempt plaintext.
 
+### Local store integrity
+
+Transport security covers data in flight. The other half of the threat model is what the package
+reads back off the local machine: credentials (keychain or file), `config.json`, and state files are
+all attacker-writable if the account is compromised, so none of them is trusted on read.
+
+Each is validated every time it is loaded. A payload that fails to parse, or that parses but does
+not match the expected shape, is **rejected** and the caller falls back to its documented default —
+no credentials, no config overrides, fresh state. Every rejection is recorded in `mcp.log`, so a
+corrupted or tampered store is distinguishable from one that was never created; before this, both
+were silent and looked identical to a fresh install. See
+[Diagnostics](#diagnostics) for the event names.
+
+Log fields carry only the file path (or the keychain service name) and a short machine-readable
+reason. File contents, keychain payloads, and tokens are never logged.
+
 ## Cursor hook forwarder (opt-in)
 
 `aixle-insights init --hooks --tool-name cursor` installs a Node script as a Cursor hook (`~/.cursor/hooks.json`). The script appends redacted hook payloads to `~/.aixle-insights/hooks-queue.ndjson`; the background sync drains the queue on its next cycle and POSTs the events with accurate per-turn model attribution. Requires a Cursor restart after install. To remove, run `aixle-insights uninstall-hooks` and restart Cursor again.
@@ -184,9 +209,25 @@ The Keycloak issuer URL (`--keycloak-url` / `KEYCLOAK_ISSUER`) is **not** TLS-ga
 ## State + credentials
 
 - **App home directory**: `~/.aixle-insights/` (override with `AIXLE_INSIGHTS_HOME`).
-- **Credentials**: OS keychain via `keytar` when available (service: `aixle-insights`); fallback file `~/.aixle-insights/credentials.json` with mode 0600 on POSIX.
+- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
 - **State files**: `state-<hostname>-<token-hash>.json` per credential, plus `state.lock` advisory lock, `mcp.log` rotating diagnostic log, optional `hooks-queue.ndjson`.
 
+### Credential storage by OS
+
+The secure store is the platform's native keychain, accessed via `keytar` (service `aixle-insights`):
+
+| OS | Secure store | Availability | Fallback file protection |
+| --- | --- | --- | --- |
+| **macOS** | Keychain | reliably present | `credentials.json` written `chmod 0600` |
+| **Windows** | Credential Manager | reliably present | `credentials.json` best-effort locked via `icacls` (Node `chmod` cannot set NTFS ACLs) |
+| **Linux** | Secret Service (libsecret / GNOME Keyring / KWallet) | **often absent** on headless servers, minimal Docker images, and CI — no D-Bus secret service | `credentials.json` written `chmod 0600` |
+
+Notes:
+
+- **Windows**: don't set `DB90_MCP_DISABLE_KEYTAR` — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
+- **Linux**: when no Secret Service is running (common in headless/CI/container contexts), the tool degrades to the `chmod 0600` fallback file **by design** — this is the one environment where the file path is routinely exercised, and POSIX permissions protect it there.
+- A stale `credentials.json` sitting alongside a populated keychain entry is logged as drift (`credentials_file_shadowed_by_keychain` in `mcp.log`) and ignored in favour of the keychain.
+
 The internal state-file shape is implementation-detail; don't depend on it from outside this package.
 
 ## Diagnostics
@@ -196,18 +237,51 @@ aixle-insights health        # connectivity + last sync metadata
 aixle-insights verify-hooks  # JSON: hooks installed + queue depth
 ```
 
-`mcp.log` (rotates at 5 MiB to `mcp.log.1`) under the app home directory captures operational events. Inside Claude Code, the **`db90_status`** MCP tool returns the same diagnostic structure as `aixle-insights health`.
+`mcp.log` (rotates at 5 MiB to `mcp.log.1`) under the app home directory captures operational events. Inside Claude Code, the **`aixle_insights_status`** MCP tool returns the same diagnostic structure as `aixle-insights health`.
+
+### Local-store integrity events
+
+These four are the only signal that a local store was present but unusable — `health` and
+`aixle_insights_status` do **not** report them, so `mcp.log` is the sole surface:
+
+| Event | Fires when |
+|---|---|
+| `credentials_parse_failed` | `credentials.json` exists but was rejected |
+| `credentials_keytar_parse_failed` | the OS keychain entry exists but was rejected |
+| `config_parse_failed` | `config.json` exists but was rejected |
+| `state_parse_failed` | a state file exists but was rejected |
+
+Each carries a `reason` distinguishing the two failure modes:
+
+- `invalid_json` — the payload did not parse at all.
+- `invalid_shape` — it parsed, but validation rejected it: credentials with no usable token, a
+  `config.json` that is a JSON array, a state file missing `version` / `sessions`, and so on.
+
+Three properties are worth relying on:
+
+- An **absent** file never warns. That is the everyday case (most users never create a
+  `config.json`, and every machine starts with no state file), so a warning always means something
+  is actually there and wrong.
+- A **missing or disabled OS keychain** never warns either — falling back to the file is expected
+  on headless Linux, CI, and containers, not an error.
+- All four are written to the log **only**, never mirrored to stderr, because stray output on the
+  stdio transport corrupts the MCP protocol. Emitting a warning never changes the fallback the
+  caller returns.
 
 ## Troubleshooting
 
 | Symptom | Most likely cause | Fix |
 |---|---|---|
 | `Error: DB90 API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
+| `Blocked event send — DB90 ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
 | `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For DB90 staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
 | `Failed to post event: HTTP 401 Unauthorized` repeated for every turn | Your saved ingest token has been rotated, revoked, or invalidated by a server redeploy. The ingest token is distinct from the Keycloak access token that `health` reports as `authenticated: true`. | Reset the keychain entry and re-run `init`: `security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"` then `rm -f ~/.aixle-insights/credentials.json` then `aixle-insights init --host ... --keycloak-url ...`. State files are **not** deleted, so already-sent sessions stay deduped. |
 | `health` shows `authenticated: true` but `last_result` is `sent: 0, failed: N` cycle after cycle | Same as the 401 row above. `authenticated` only proves the OIDC token was acquired, not that the ingest token still validates server-side. | Re-init as above. |
 | `last_result` reports `sent: N` but the Events UI shows nothing | The Temporal worker is not running. The ingest endpoint returns HTTP 202 (queued) regardless of worker state. | `make worker` (or check `docker ps` for `db90-worker`). See [LOCAL-DEV.md](./LOCAL-DEV.md) §1. |
 | `sync_lock_skip {reason: "advisory_lock_held"}` in the log | Another sync cycle is still holding `~/.aixle-insights/state.lock`. | Wait for it to finish; only delete the lock file (`rm -f ~/.aixle-insights/state.lock`) after confirming no `aixle-insights run` process is alive (`pgrep -fa aixle-insights`). |
+| `health` reports `authenticated: false` right after a successful `init`, and `credentials_parse_failed` or `credentials_keytar_parse_failed` is in the log | The credential store exists but was rejected, so it is treated as absent. The `reason` field says whether it failed to parse (`invalid_json`) or parsed into the wrong shape (`invalid_shape`). | Re-run `init`. If you hand-edited `credentials.json` for local testing, remember the keychain is read **first** — see [State + credentials](#state--credentials). |
+| A `config.json` override has no effect, and `config_parse_failed` is in the log | The file is malformed, or is valid JSON that is not an object — a top-level array is the usual mistake. | Fix it to match the shape under [Environment](#environment); until it parses, every override is ignored. |
+| Sync re-sends history that was already delivered, and `state_parse_failed` is in the log | A state file was present but rejected, so sync fell back to fresh state and lost its dedup checkpoints. | This is recovery, not a loop — the next successful cycle writes valid state. Ingest upserts by session, so duplicates are absorbed. Worth investigating what wrote the bad file. |
 | `aixle-insights --help` doesn't list `--insecure` | You're running an older published version of the package, not the local source. | `which aixle-insights` shows the path. To run local source: `cd packages/tools/aixle-insights && npm run build && npm link`. To return to the published version: `npm unlink -g @aixle/insights && npm install -g @aixle/insights@latest`. |
 | Not sure whether `aixle-insights` is a `npm link` or a real install | Real installs are regular files; `npm link` is a symlink chain into the repo. | `readlink "$(which aixle-insights)"` shows the link target if any. A linked install will trace back to a path under your monorepo checkout. |
 
@@ -246,7 +320,9 @@ After the script reports success: **quit and reopen Claude Code / Cursor** so ea
 
 ## Requirements
 
-- Node.js ≥ 20.
+- Node.js >= 20.19.0 — matches `engines.node` in `package.json`, and
+  `src/test/supply-chain-contract.test.ts` fails if the two drift apart. Older
+  20.x patch releases are not supported.
 - macOS / Linux / Windows. On Windows, the package writes a `cmd /c npx …` wrapper in `~/.claude.json` so Claude Code can spawn the MCP server reliably.
 - `better-sqlite3` is a native module. After a Node upgrade, if SQLite reads start failing, rebuild it from the tools workspace:
 

package/dist/auth/credentials.d.ts

@@ -5,6 +5,12 @@ export interface StoredCredentials {
     host: string;
     organizationId?: string;
     accounts: Partial<Record<TelemetryToolId, string>>;
+    /**
+     * Set only when the user explicitly passed `init --insecure` for this host.
+     * There is no `run --insecure` flag (by design — see README § Security), so
+     * runtime sync honors this persisted consent instead of re-prompting.
+     */
+    insecureHttpAllowed?: boolean;
 }
 export declare const KEYTAR_SERVICE = "aixle-insights";
 /** Returns true when at least one tool has a non-empty token. */
@@ -12,7 +18,7 @@ export declare function credentialsHaveAnyToken(creds: StoredCredentials): boole
 export declare function pickProjectLookupToken(creds: StoredCredentials): string | null;
 /** Read credentials from disk only (tests / fallback). */
 export declare function loadCredentialsFromFileOnly(appDir?: string): StoredCredentials | null;
-/** Prefer OS keychain when keytar works; otherwise read `credentials.json`. */
+/** Prefer the OS keychain when keytar works; fall back to `credentials.json`. */
 export declare function loadCredentials(appDir?: string): Promise<StoredCredentials | null>;
 /**
  * Persist multi-tool ingest tokens for one host namespace.

package/dist/auth/credentials.js

@@ -1,6 +1,10 @@
+import { execFileSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { userInfo } from "node:os";
 import { join } from "node:path";
 import { getAppDir } from "../state.js";
+import { mcpLog } from "../log.js";
+import { describeReadFailure } from "../lib/parse-error.js";
 export const KEYTAR_SERVICE = "aixle-insights";
 const KEYTAR_ACCOUNT = "aixle-insights-ingest-credential";
 function credentialsPath(appDir) {
@@ -45,6 +49,7 @@ function normalizeLoadedCredentials(raw) {
             host,
             accounts: out,
             organizationId: typeof org === "string" ? org : undefined,
+            ...(o.insecureHttpAllowed === true ? { insecureHttpAllowed: true } : {}),
         };
     }
     const token = o.token;
@@ -58,28 +63,54 @@ export function loadCredentialsFromFileOnly(appDir = getAppDir()) {
     const filePath = credentialsPath(appDir);
     if (!existsSync(filePath))
         return null;
+    let raw;
     try {
-        const raw = JSON.parse(readFileSync(filePath, "utf-8"));
-        return normalizeLoadedCredentials(raw);
+        raw = JSON.parse(readFileSync(filePath, "utf-8"));
     }
-    catch {
+    catch (err) {
+        // File exists (checked above) but is not readable/valid JSON — distinguishes tampering from "never created".
+        mcpLog.warn("credentials_parse_failed", { path: filePath, ...describeReadFailure(err) }, false);
         return null;
     }
+    const normalized = normalizeLoadedCredentials(raw);
+    if (normalized === null) {
+        // Valid JSON, but not a credential shape we accept. `normalizeLoadedCredentials` signals
+        // rejection by returning null and never throws, so this cannot surface in the catch
+        // above — without this branch a plausible-looking replacement file stays silent. (DB90DV-699)
+        mcpLog.warn("credentials_parse_failed", { path: filePath, reason: "invalid_shape" }, false);
+    }
+    return normalized;
 }
 async function tryKeytarGet() {
     if (keytarDisabled())
         return null;
+    let raw;
     try {
         const keytar = await import("keytar");
-        const raw = await keytar.default.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
-        if (!raw)
-            return null;
-        const parsed = JSON.parse(raw);
-        return normalizeLoadedCredentials(parsed);
+        raw = await keytar.default.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     }
     catch {
+        // Keytar unavailable (native module missing/unbuilt, no Secret Service, etc.) — silent fallback to file, same as tryKeytarSet.
+        return null;
+    }
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        // Keychain entry exists (checked above) but is not valid JSON — distinguishes tampering from "no entry".
+        mcpLog.warn("credentials_keytar_parse_failed", { keytarService: KEYTAR_SERVICE, ...describeReadFailure(err) }, false);
         return null;
     }
+    const normalized = normalizeLoadedCredentials(parsed);
+    if (normalized === null) {
+        // Same shape-rejection hole as the file path above. Fields stay service-only — never the
+        // keychain payload. (DB90DV-699)
+        mcpLog.warn("credentials_keytar_parse_failed", { keytarService: KEYTAR_SERVICE, reason: "invalid_shape" }, false);
+    }
+    return normalized;
 }
 async function tryKeytarSet(payload) {
     if (keytarDisabled())
@@ -100,8 +131,32 @@ async function tryKeytarDelete() {
         const keytar = await import("keytar");
         await keytar.default.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     }
+    catch (err) {
+        // Non-fatal, but a stale keychain entry can mislead later loads — record it.
+        mcpLog.warn("keytar_delete_failed", { keytarService: KEYTAR_SERVICE, error: err instanceof Error ? err.message : String(err) }, false);
+    }
+}
+/**
+ * Best-effort NTFS ACL lock-down for the fallback credentials file on Windows.
+ *
+ * Node's file `mode` / `chmodSync` only toggle the read-only bit on Windows — they do NOT
+ * map to NTFS ACLs — so the POSIX `0o600` we set on other platforms has no real effect there.
+ * We shell out to the built-in `icacls` to drop inherited ACEs and grant only the current user
+ * full control. Mirrors the POSIX `chmod` best-effort: any failure is swallowed (the user-profile
+ * directory already blocks cross-user reads, and Windows Credential Manager — the preferred store
+ * via keytar — makes this fallback file rare in the first place).
+ */
+function restrictWindowsAclBestEffort(filePath) {
+    try {
+        const user = userInfo().username;
+        if (!user)
+            return;
+        execFileSync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:F`], {
+            stdio: "ignore",
+        });
+    }
     catch {
-        // ignore
+        // best-effort, non-fatal — same posture as the POSIX chmod
     }
 }
 function writeFileCredential(appDir, creds) {
@@ -112,12 +167,16 @@ function writeFileCredential(appDir, creds) {
         host: creds.host,
         organizationId: creds.organizationId,
         accounts: { ...creds.accounts },
+        ...(creds.insecureHttpAllowed ? { insecureHttpAllowed: true } : {}),
     };
     writeFileSync(filePath, `${JSON.stringify(body, null, 2)}\n`, {
         encoding: "utf-8",
         mode: 0o600,
     });
-    if (process.platform !== "win32") {
+    if (process.platform === "win32") {
+        restrictWindowsAclBestEffort(filePath);
+    }
+    else {
         try {
             chmodSync(filePath, 0o600);
         }
@@ -132,19 +191,27 @@ function removeFileCredential(appDir) {
         try {
             unlinkSync(filePath);
         }
-        catch {
-            // ignore
+        catch (err) {
+            // A stale plaintext credentials.json left behind here is exactly the drift loadCredentials warns about.
+            mcpLog.warn("credentials_file_remove_failed", { path: filePath, error: err instanceof Error ? err.message : String(err) }, false);
         }
     }
 }
-/** Prefer OS keychain when keytar works; otherwise read `credentials.json`. */
+/** Prefer the OS keychain when keytar works; fall back to `credentials.json`. */
 export async function loadCredentials(appDir = getAppDir()) {
+    const fromKeytar = await tryKeytarGet();
+    if (fromKeytar) {
+        // Keychain is the source of truth; a lingering file is stale and silently shadowed it before this fix.
+        // Warn-only (log file, no stderr mirror): drift is recorded without spamming the background sync loop,
+        // and the next saveStoredCredentials removes the file. We do not mutate disk on a read.
+        if (existsSync(credentialsPath(appDir))) {
+            mcpLog.warn("credentials_file_shadowed_by_keychain", { path: credentialsPath(appDir), keytarService: KEYTAR_SERVICE }, false);
+        }
+        return fromKeytar;
+    }
     const fromFile = loadCredentialsFromFileOnly(appDir);
     if (fromFile)
         return fromFile;
-    const fromKeytar = await tryKeytarGet();
-    if (fromKeytar)
-        return fromKeytar;
     return null;
 }
 /**
@@ -154,7 +221,13 @@ export async function saveStoredCredentials(creds, appDir = getAppDir()) {
     if (!credentialsHaveAnyToken(creds)) {
         throw new Error("saveStoredCredentials requires at least one account token");
     }
-    const payload = JSON.stringify({ version: 2, ...creds, accounts: { ...creds.accounts } });
+    const payload = JSON.stringify({
+        version: 2,
+        host: creds.host,
+        organizationId: creds.organizationId,
+        accounts: { ...creds.accounts },
+        ...(creds.insecureHttpAllowed ? { insecureHttpAllowed: true } : {}),
+    });
     const keytarOk = await tryKeytarSet(payload);
     if (keytarOk) {
         removeFileCredential(appDir);

package/dist/auth/flow.js

@@ -61,6 +61,7 @@ export async function loginAndPersistCredentials(opts) {
             host: exchanged.ingestHost,
             organizationId: exchanged.organizationId,
             accounts: existing?.host === exchanged.ingestHost ? { ...existing.accounts } : {},
+            ...(opts.allowInsecureHttp === true ? { insecureHttpAllowed: true } : {}),
         };
         for (const tid of ["claude_code", "cursor"]) {
             const acc = exchanged.accounts[tid];

package/dist/cli.js

@@ -348,7 +348,7 @@ export async function runOnce(deps, options) {
     let projectId = null;
     let projectIdSource = "none";
     if (lookupToken) {
-        const resolution = await runtime.resolveProjectId(undefined, undefined, creds.host, lookupToken, false);
+        const resolution = await runtime.resolveProjectId(undefined, undefined, creds.host, lookupToken, false, creds.insecureHttpAllowed === true);
         projectId = resolution.projectId;
         projectIdSource = resolution.source;
         mcpLog.info("project_attribution_resolved", { project_id: resolution.projectId, source: resolution.source }, false);

package/dist/collect-cursor-payloads.d.ts

@@ -14,6 +14,7 @@ export interface PrepareCursorSliceGroupsOptions {
     host?: string;
     token?: string;
     projectLookupToken?: string | null;
+    allowInsecureHttp?: boolean;
     verbose?: boolean;
     cursorBaseDir?: string;
     cursorTranscriptProjectDirs?: string[];

package/dist/collect-cursor-payloads.js

@@ -6,7 +6,7 @@ import { readEvents as readCursorEvents, readDailyStatsWithDedupe, readRecentCom
  * Read local Cursor stores, apply watermarks/dedupe, and group payloads for sync posting.
  */
 export async function prepareCursorSliceGroups(options) {
-    const { stateBefore, fullScan = false, projectId = null, projectIdSource, host, token, projectLookupToken, verbose = false, cursorBaseDir, cursorTranscriptProjectDirs, cursorPricing = DEFAULT_CURSOR_PRICING, } = options;
+    const { stateBefore, fullScan = false, projectId = null, projectIdSource, host, token, projectLookupToken, allowInsecureHttp, verbose = false, cursorBaseDir, cursorTranscriptProjectDirs, cursorPricing = DEFAULT_CURSOR_PRICING, } = options;
     const useCommitHashDedup = !fullScan;
     const eventsSince = fullScan
         ? null
@@ -22,7 +22,9 @@ export async function prepareCursorSliceGroups(options) {
         console.log("[verbose][cursor] Full scan — ignoring saved watermarks and commit hash dedupe");
     }
     const baseDir = cursorBaseDir;
-    const activeModel = readCursorActiveModel(baseDir) ?? undefined;
+    const activeModelResolution = readCursorActiveModel(baseDir);
+    const activeModel = activeModelResolution.model ?? undefined;
+    const modelResolution = activeModelResolution.source;
     const transcriptTurns = await readCursorTranscriptSessions(baseDir, cursorTranscriptProjectDirs, verbose);
     const rawEvents = readCursorEvents(eventsSince, baseDir, verbose);
     const { raw: dailyStatsRaw, deduped: dailyStats } = readDailyStatsWithDedupe(dailyStatsSince, baseDir, verbose);
@@ -41,7 +43,7 @@ export async function prepareCursorSliceGroups(options) {
             return known.contentHash !== turn.contentHash;
         return known.fileSize !== turn.fileSize;
     })
-        .map((turn) => mapCursorTranscriptTurn(turn, projectIdOpt, cursorPricing, activeModel))
+        .map((turn) => mapCursorTranscriptTurn(turn, projectIdOpt, cursorPricing, activeModel, modelResolution))
         .sort((a, b) => a.occurred_at.localeCompare(b.occurred_at));
     const skippedTranscriptCount = transcriptTurns.length - transcriptPayloads.length;
     const transcriptModeEnabled = transcriptTurnsById.size > 0;
@@ -49,7 +51,7 @@ export async function prepareCursorSliceGroups(options) {
         .map(({ row, workspacePath }) => mapCursorEvent(row, workspacePath, projectIdOpt, cursorPricing))
         .filter((e) => e !== null);
     const allMappedFromStats = dailyStats
-        .flatMap((entry) => mapDailyStats(entry, projectIdOpt, cursorPricing, activeModel));
+        .flatMap((entry) => mapDailyStats(entry, projectIdOpt, cursorPricing, activeModel, modelResolution));
     // When transcripts are present they cover the same chat activity — suppress the daily aggregates
     // to prevent double-counting. Logged at info level in sync.ts via counts.suppressedComposer.
     const mappedFromEvents = allMappedFromEvents.filter((payload) => !transcriptModeEnabled || payload.event_type !== "chat");
@@ -59,7 +61,7 @@ export async function prepareCursorSliceGroups(options) {
             allMappedFromStats.filter((p) => p.event_type === "chat").length
         : 0;
     let mappedFromCommits = recentCommitSnapshots
-        .map((snapshot) => mapRecentCommit(snapshot, projectIdOpt, cursorPricing, activeModel))
+        .map((snapshot) => mapRecentCommit(snapshot, projectIdOpt, cursorPricing, activeModel, modelResolution))
         .filter((payload) => payload !== null)
         .sort((a, b) => a.occurred_at.localeCompare(b.occurred_at));
     if (useCommitHashDedup) {
@@ -72,6 +74,7 @@ export async function prepareCursorSliceGroups(options) {
                 projectIdSource,
                 host,
                 token: lookupToken,
+                allowInsecureHttp,
                 verbose,
             });
         }

package/dist/cursor-payload-contract.js

@@ -19,6 +19,7 @@ const METADATA_BASE_KEYS = new Set([
     "cost_model",
     "scannable",
     "risk_level",
+    "model_resolution",
 ]);
 const METADATA_COMMIT_KEYS = new Set([
     ...METADATA_BASE_KEYS,
@@ -42,6 +43,7 @@ const METADATA_TRANSCRIPT_KEYS = new Set([
     "composer_name",
     "prompt_text",
     "assistant_text",
+    "model_resolution",
 ]);
 const METADATA_HOOK_KEYS = new Set([
     "cursor_session_id",
@@ -136,6 +138,10 @@ export function validateCursorPayload(payload) {
         if (typeof meta.workspace !== "string" || meta.workspace.length === 0) {
             errors.push("metadata.workspace must be a non-empty string");
         }
+        if (meta.model_resolution !== undefined &&
+            !["settings_json", "state_vscdb", "unresolved"].includes(meta.model_resolution)) {
+            errors.push('metadata.model_resolution must be "settings_json", "state_vscdb", or "unresolved" when present');
+        }
         if (path !== "mcp_transcript" && path !== "cursor_hook") {
             if (meta.workspace_scope !== "global" && meta.workspace_scope !== "workspace") {
                 errors.push('metadata.workspace_scope must be "global" or "workspace"');

package/dist/cursor-settings.d.ts

@@ -1,6 +1,11 @@
+export type CursorModelResolutionSource = "settings_json" | "state_vscdb" | "unresolved";
+export interface CursorActiveModelResolution {
+    model: string | null;
+    source: CursorModelResolutionSource;
+}
 /**
- * Best-effort: read active model name from Cursor's settings.json.
- * Returns null on any error (file absent, unreadable, no matching key).
- * Never throws.
+ * Resolves Cursor's active model, chaining settings.json (pre-1.6 location) then
+ * state.vscdb (1.6+ location). Reports which source supplied the model, or "unresolved"
+ * when neither has it, so downstream payload metadata can record where the tool looked.
  */
-export declare function readCursorActiveModel(baseDir?: string): string | null;
+export declare function readCursorActiveModel(baseDir?: string): CursorActiveModelResolution;

package/dist/cursor-settings.js

@@ -1,22 +1,15 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { cursorUserDir } from "./readers/cursor.js";
-// Keys are tried in specificity order — Cursor-namespaced keys first, then
-// generic fallbacks. "model" is last to avoid capturing unrelated workspace
-// settings that happen to have a "model" key.
+import { openCursorSqliteReadonly } from "./readers/cursor-sqlite.js";
 const SETTINGS_MODEL_KEYS = [
     "cursor.aiModel",
     "aiModel",
     "cursor.general.preferredModel",
     "model",
 ];
-/**
- * Best-effort: read active model name from Cursor's settings.json.
- * Returns null on any error (file absent, unreadable, no matching key).
- * Never throws.
- */
-export function readCursorActiveModel(baseDir) {
-    const settingsPath = join(baseDir ?? cursorUserDir(), "settings.json");
+function readModelFromSettingsJson(dir) {
+    const settingsPath = join(dir, "settings.json");
     try {
         if (!existsSync(settingsPath))
             return null;
@@ -36,3 +29,80 @@ export function readCursorActiveModel(baseDir) {
         return null;
     }
 }
+function safeParseJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function isNonEmptyString(v) {
+    return typeof v === "string" && v.trim().length > 0;
+}
+/**
+ * Reads the active model from Cursor's global state.vscdb (Cursor 1.6+), where settings.json
+ * no longer carries it. The model lives in the cursorDiskKV table (verified against a real
+ * Cursor install, 2026-07-10 — NOT ItemTable.aiSettings/featureModelConfigs, which don't exist
+ * on current Cursor versions), one row per conversation keyed composerData:<composerId>. The
+ * table is UNIQUE ON CONFLICT REPLACE, so every update to a composer re-inserts it with a fresh
+ * (higher) rowid — ORDER BY rowid DESC LIMIT 1 gives the most recently touched composer without
+ * needing to parse and rank every row's timestamp. Opens the DB only via openCursorSqliteReadonly
+ * (read-only, root-contained) — never a raw new Database() call.
+ */
+function readCursorActiveModelFromStateDb(baseDir) {
+    const dbPath = join(baseDir, "globalStorage", "state.vscdb");
+    const opened = openCursorSqliteReadonly(dbPath, { rootDir: baseDir });
+    if (!opened.ok)
+        return null;
+    const { db } = opened;
+    try {
+        const hasTable = db
+            .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='cursorDiskKV'")
+            .get();
+        if (!hasTable)
+            return null;
+        const row = db
+            .prepare("SELECT value FROM cursorDiskKV WHERE key LIKE 'composerData:%' ORDER BY rowid DESC LIMIT 1")
+            .get();
+        if (!row)
+            return null;
+        const parsed = safeParseJson(row.value);
+        if (typeof parsed !== "object" || parsed === null)
+            return null;
+        const modelConfig = parsed.modelConfig;
+        if (typeof modelConfig !== "object" || modelConfig === null)
+            return null;
+        const mc = modelConfig;
+        if (isNonEmptyString(mc.modelName))
+            return mc.modelName.trim();
+        const selectedModels = mc.selectedModels;
+        if (Array.isArray(selectedModels) && selectedModels.length > 0) {
+            const first = selectedModels[0];
+            if (isNonEmptyString(first?.modelId))
+                return first.modelId.trim();
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * Resolves Cursor's active model, chaining settings.json (pre-1.6 location) then
+ * state.vscdb (1.6+ location). Reports which source supplied the model, or "unresolved"
+ * when neither has it, so downstream payload metadata can record where the tool looked.
+ */
+export function readCursorActiveModel(baseDir) {
+    const dir = baseDir ?? cursorUserDir();
+    const fromSettings = readModelFromSettingsJson(dir);
+    if (fromSettings)
+        return { model: fromSettings, source: "settings_json" };
+    const fromStateDb = readCursorActiveModelFromStateDb(dir);
+    if (fromStateDb)
+        return { model: fromStateDb, source: "state_vscdb" };
+    return { model: null, source: "unresolved" };
+}