@aixle/insights 0.2.0 → 0.2.1

package/dist/risk-scanner.js

@@ -12,6 +12,10 @@ const CATEGORIES = {
         weight: 3,
         patterns: [
             /\b\d{3}-\d{2}-\d{4}\b/g, // SSN
+            /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged for
+               `{3}` inside `(?:…)?`. Every branch is a fixed-length digit run
+               anchored by \b, so the match is bounded and cannot backtrack
+               super-linearly. */
             /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\b/g, // Credit card
         ],
     },
@@ -19,6 +23,9 @@ const CATEGORIES = {
         weight: 1,
         patterns: [
             /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/gi, // Email
+            /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged for
+               `?` nested in `?`. All quantified groups are fixed-length digit or
+               separator classes anchored by \b; matching is bounded. */
             /\b(?:\+?1[-.\s]?)?(?:\([0-9]{3}\)|[0-9]{3})[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}\b/g, // Phone
         ],
     },

package/dist/server.d.ts

@@ -7,8 +7,8 @@ export declare const SYNC_NOW_INPUT_SCHEMA: z.ZodObject<{
         cursor: "cursor";
     }>>>;
 }, z.core.$strict>;
-/** Structured status for `db90_status` — tolerates missing/malformed credentials and state. */
-export declare function buildDb90StatusPayload(): Promise<Record<string, unknown>>;
+/** Structured status for `aixle_insights_status` — tolerates missing/malformed credentials and state. */
+export declare function buildAixleInsightsStatusPayload(): Promise<Record<string, unknown>>;
 /** In-process MCP server instance (stdio not attached). */
-export declare function createDb90McpServer(): McpServer;
+export declare function createAixleInsightsMcpServer(): McpServer;
 export declare function startServer(): Promise<void>;

package/dist/server.js

@@ -27,6 +27,12 @@ export const SYNC_NOW_INPUT_SCHEMA = z
     }
 })
     .strict();
+const AUTHENTICATE_INPUT_SCHEMA = z.object({
+    keycloakUrl: z.string().optional(),
+    clientId: z.string().optional(),
+});
+/** DB90DV-569: `db90_*` names are deprecated aliases kept for one release for existing callers. */
+const DEPRECATED_ALIAS_NOTE = "(Deprecated — use `{name}` instead; kept temporarily for backward compatibility, see DB90DV-569.) ";
 function jsonContent(value) {
     return {
         content: [
@@ -70,22 +76,22 @@ async function getProjectResolutionForSync(creds) {
     if (cachedProjectResolution?.key === cacheKey) {
         return cachedProjectResolution.value;
     }
-    const result = await resolveProjectId(undefined, undefined, creds.host, token, false);
+    const result = await resolveProjectId(undefined, undefined, creds.host, token, false, creds.insecureHttpAllowed === true);
     mcpLog.info("project_attribution_resolved", { project_id: result.projectId, source: result.source }, false);
     if (result.source !== "none") {
         cachedProjectResolution = { key: cacheKey, value: result };
     }
     return result;
 }
-/** Structured status for `db90_status` — tolerates missing/malformed credentials and state. */
-export async function buildDb90StatusPayload() {
+/** Structured status for `aixle_insights_status` — tolerates missing/malformed credentials and state. */
+export async function buildAixleInsightsStatusPayload() {
     const snapshot = await buildHealthSnapshot();
     return healthSnapshotToStatusPayload(snapshot);
 }
 async function executeSync(parsed) {
     const creds = await loadCredentials();
     if (!creds || !credentialsHaveAnyToken(creds)) {
-        mcpLog.warn("credential_validation_failed", { source: "db90_sync_now", reason: "missing_credentials" }, false);
+        mcpLog.warn("credential_validation_failed", { source: "aixle_insights_sync_now", reason: "missing_credentials" }, false);
         return { ok: false, error: "missing_credentials" };
     }
     migrateAllLegacyState(creds);
@@ -104,79 +110,84 @@ async function executeSync(parsed) {
     });
     return { ok: syncResultOk(result), result };
 }
-/** In-process MCP server instance (stdio not attached). */
-export function createDb90McpServer() {
-    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
-    server.registerTool("db90_status", {
-        description: "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.",
-    }, async () => jsonContent(await buildDb90StatusPayload()));
-    server.registerTool("db90_sync_now", {
-        description: "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
-            "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).",
-        inputSchema: SYNC_NOW_INPUT_SCHEMA,
-    }, async (input) => {
-        try {
-            const parsed = SYNC_NOW_INPUT_SCHEMA.parse(input ?? {});
-            return jsonContent(await executeSync(parsed));
-        }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                return jsonContent({
-                    ok: false,
-                    error: "validation_error",
-                    details: err.flatten(),
-                });
-            }
+async function statusHandler() {
+    return jsonContent(await buildAixleInsightsStatusPayload());
+}
+async function syncNowHandler(input) {
+    try {
+        const parsed = SYNC_NOW_INPUT_SCHEMA.parse(input ?? {});
+        return jsonContent(await executeSync(parsed));
+    }
+    catch (err) {
+        if (err instanceof z.ZodError) {
             return jsonContent({
                 ok: false,
-                error: err instanceof Error ? err.message : String(err),
-            });
-        }
-    });
-    server.registerTool("db90_authenticate", {
-        description: "Starts Keycloak device login and returns the visit URL/code for the user. Use aixle-insights init for the full terminal flow that saves credentials.",
-        inputSchema: z.object({
-            keycloakUrl: z.string().optional(),
-            clientId: z.string().optional(),
-        }),
-    }, async (input) => {
-        try {
-            const args = input;
-            const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
-            if (!kc) {
-                return jsonContent({
-                    ok: false,
-                    error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
-                });
-            }
-            const clientId = args.clientId?.trim() || defaultKeycloakClientId();
-            const device = await startDeviceAuthorization({
-                issuer: kc,
-                clientId,
-            });
-            return jsonContent({
-                ok: true,
-                verificationUri: device.verification_uri,
-                verificationUriComplete: device.verification_uri_complete ?? null,
-                userCode: device.user_code,
-                expiresIn: device.expires_in,
-                interval: device.interval ?? 5,
-                issuer: kc,
-                clientId,
-                message: `Visit ${device.verification_uri} and enter code ${device.user_code}`,
+                error: "validation_error",
+                details: err.flatten(),
             });
         }
-        catch (err) {
+        return jsonContent({
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function authenticateHandler(args) {
+    try {
+        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
+        if (!kc) {
             return jsonContent({
                 ok: false,
-                error: err instanceof Error ? err.message : String(err),
+                error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
             });
         }
-    });
+        const clientId = args.clientId?.trim() || defaultKeycloakClientId();
+        const device = await startDeviceAuthorization({
+            issuer: kc,
+            clientId,
+        });
+        return jsonContent({
+            ok: true,
+            verificationUri: device.verification_uri,
+            verificationUriComplete: device.verification_uri_complete ?? null,
+            userCode: device.user_code,
+            expiresIn: device.expires_in,
+            interval: device.interval ?? 5,
+            issuer: kc,
+            clientId,
+            message: `Visit ${device.verification_uri} and enter code ${device.user_code}`,
+        });
+    }
+    catch (err) {
+        return jsonContent({
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/** In-process MCP server instance (stdio not attached). */
+export function createAixleInsightsMcpServer() {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    const statusDescription = "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.";
+    server.registerTool("aixle_insights_status", { description: statusDescription }, statusHandler);
+    server.registerTool("db90_status", { description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_status") + statusDescription }, statusHandler);
+    const syncNowDescription = "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
+        "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).";
+    server.registerTool("aixle_insights_sync_now", { description: syncNowDescription, inputSchema: SYNC_NOW_INPUT_SCHEMA }, syncNowHandler);
+    server.registerTool("db90_sync_now", {
+        description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_sync_now") + syncNowDescription,
+        inputSchema: SYNC_NOW_INPUT_SCHEMA,
+    }, syncNowHandler);
+    const authenticateDescription = "Starts Keycloak device login and returns the visit URL/code for the user. Use aixle-insights init for the full terminal flow that saves credentials.";
+    server.registerTool("aixle_insights_authenticate", { description: authenticateDescription, inputSchema: AUTHENTICATE_INPUT_SCHEMA }, authenticateHandler);
+    server.registerTool("db90_authenticate", {
+        description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_authenticate") + authenticateDescription,
+        inputSchema: AUTHENTICATE_INPUT_SCHEMA,
+    }, authenticateHandler);
     return server;
 }
 export async function startServer() {
-    const server = createDb90McpServer();
+    const server = createAixleInsightsMcpServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
     let intervalId;

package/dist/state.js

@@ -2,6 +2,8 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { createHash, randomBytes } from "node:crypto";
+import { mcpLog } from "./log.js";
+import { describeReadFailure } from "./lib/parse-error.js";
 export function getAppDir() {
     const override = process.env["AIXLE_INSIGHTS_HOME"]?.trim();
     if (override && override.length > 0)
@@ -89,44 +91,50 @@ export function migrateLegacyState(dir, host, token) {
 }
 export function readState(dir, host, token) {
     const filePath = stateFilePath(dir ?? getAppDir(), host, token);
+    let parsed;
     try {
-        const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
-        if (typeof parsed === "object" && parsed !== null) {
-            const p = parsed;
-            if (typeof p.version === "number" &&
-                typeof p.sessions === "object" &&
-                p.sessions !== null) {
-                const lastRecentCommitHashes = Array.isArray(p.lastRecentCommitHashes)
-                    ? p.lastRecentCommitHashes.filter((h) => typeof h === "string")
-                    : undefined;
-                const out = {
-                    version: p.version,
-                    sessions: p.sessions,
-                };
-                if (lastRecentCommitHashes !== undefined) {
-                    out.lastRecentCommitHashes = lastRecentCommitHashes;
-                }
-                if ("mcp_operator" in p) {
-                    const mcp = parseMcpOperator(p.mcp_operator);
-                    if (mcp)
-                        out.mcp_operator = mcp;
-                }
-                if ("rate_limited_until" in p) {
-                    if (typeof p.rate_limited_until === "string") {
-                        out.rate_limited_until = p.rate_limited_until;
-                    }
-                    else if (p.rate_limited_until === null) {
-                        out.rate_limited_until = null;
-                    }
-                }
-                return out;
-            }
+        parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code !== "ENOENT") {
+            // State file exists but is not valid JSON — distinguishes tampering from "never created".
+            // ENOENT stays silent: that is the normal first-run case.
+            mcpLog.warn("state_parse_failed", { path: filePath, ...describeReadFailure(err) }, false);
         }
+        return { version: 1, sessions: {} };
     }
-    catch {
-        // missing or malformed state file — start fresh
+    const p = typeof parsed === "object" && parsed !== null ? parsed : null;
+    if (p === null || typeof p.version !== "number" || typeof p.sessions !== "object" || p.sessions === null) {
+        // Valid JSON, wrong shape. This fallback discards every dedup checkpoint and causes a full
+        // re-send, so it is the most consequential of the four to have been silent. (DB90DV-699)
+        mcpLog.warn("state_parse_failed", { path: filePath, reason: "invalid_shape" }, false);
+        return { version: 1, sessions: {} };
+    }
+    const lastRecentCommitHashes = Array.isArray(p.lastRecentCommitHashes)
+        ? p.lastRecentCommitHashes.filter((h) => typeof h === "string")
+        : undefined;
+    const out = {
+        version: p.version,
+        sessions: p.sessions,
+    };
+    if (lastRecentCommitHashes !== undefined) {
+        out.lastRecentCommitHashes = lastRecentCommitHashes;
+    }
+    if ("mcp_operator" in p) {
+        const mcp = parseMcpOperator(p.mcp_operator);
+        if (mcp)
+            out.mcp_operator = mcp;
+    }
+    if ("rate_limited_until" in p) {
+        if (typeof p.rate_limited_until === "string") {
+            out.rate_limited_until = p.rate_limited_until;
+        }
+        else if (p.rate_limited_until === null) {
+            out.rate_limited_until = null;
+        }
     }
-    return { version: 1, sessions: {} };
+    return out;
 }
 /** Atomic write: write to a temp file then rename over the target. */
 export function writeState(state, dir, host, token) {

package/dist/sync.d.ts

@@ -24,6 +24,8 @@ export interface SyncOptions {
     verbose: boolean;
     projectId: string | null;
     projectIdSource?: ProjectResolution["source"];
+    /** Mirrors StoredCredentials.insecureHttpAllowed — set when `init --insecure` was used for this host. */
+    allowInsecureHttp?: boolean;
     pricing: PricingTable;
     appDir?: string;
     transcriptBaseDirs?: string[];
@@ -65,6 +67,15 @@ export declare function getSyncTelemetry(): {
     lastResult: SyncResult | null;
     recentErrors: string[];
 };
+/**
+ * The repo path for a Cursor payload, normalized and safe to hand to project
+ * resolution. Returns an absolute, `..`-collapsed path or undefined.
+ *
+ * `workspace_folder` comes from the workspace's own `workspace.json` and
+ * `workspace` from a composer `uri.fsPath` or the `state.vscdb` path — all
+ * untrusted. When the preferred field is unusable we fall through to the other
+ * rather than giving up. See DB90DV-547.
+ */
 export declare function cursorRepoPathFromPayload(payload: CursorDb90Payload): string | undefined;
 /**
  * Parallel multi-tool cycle under the global advisory ingest lock (`state.lock`).

package/dist/sync.js

@@ -11,6 +11,7 @@ import { postEvent, postEvents } from "./client.js";
 import { getCostWarning } from "./pricing.js";
 import { acquireSyncLock } from "./lock.js";
 import { getGitRemoteForPath, lookupProjectByRemote, } from "./lib/index.js";
+import { isRepoPathWithinRoot, normalizeRepoPathCandidate, } from "./lib/repo-path-safety.js";
 import { mcpLog } from "./log.js";
 /** Prefix for Claude Code session keys in shared MCP state. */
 export const CLAUDE_STATE_PREFIX = "claude_code:";
@@ -102,9 +103,9 @@ function explicitProjectId(projectId, projectIdSource) {
         ? projectId
         : undefined;
 }
-async function resolveProjectIdForRepoPathCached(repoPath, host, token, verbose, cache) {
-    const normalized = repoPath?.trim();
-    if (!normalized)
+async function resolveProjectIdForRepoPathCached(repoPath, host, token, verbose, cache, allowInsecureHttp = false) {
+    const normalized = normalizeRepoPathCandidate(repoPath);
+    if (normalized === null)
         return null;
     if (cache.has(normalized))
         return cache.get(normalized) ?? null;
@@ -113,25 +114,35 @@ async function resolveProjectIdForRepoPathCached(repoPath, host, token, verbose,
         cache.set(normalized, null);
         return null;
     }
-    const result = await lookupProjectByRemote(canonicalRemote, host, token, verbose);
+    const result = await lookupProjectByRemote(canonicalRemote, host, token, verbose, allowInsecureHttp);
     const projectId = result && typeof result === "object" && "project_id" in result ? result.project_id : null;
     cache.set(normalized, projectId);
     return projectId;
 }
+/**
+ * The repo path for a Cursor payload, normalized and safe to hand to project
+ * resolution. Returns an absolute, `..`-collapsed path or undefined.
+ *
+ * `workspace_folder` comes from the workspace's own `workspace.json` and
+ * `workspace` from a composer `uri.fsPath` or the `state.vscdb` path — all
+ * untrusted. When the preferred field is unusable we fall through to the other
+ * rather than giving up. See DB90DV-547.
+ */
 export function cursorRepoPathFromPayload(payload) {
     const metadata = payload.metadata;
     if (!metadata)
         return undefined;
-    if (typeof metadata.workspace_folder === "string" && metadata.workspace_folder.length > 0) {
-        return metadata.workspace_folder;
-    }
-    if (typeof metadata.workspace === "string" && metadata.workspace.length > 0) {
-        return metadata.workspace;
+    for (const candidate of [metadata.workspace_folder, metadata.workspace]) {
+        if (typeof candidate !== "string")
+            continue;
+        const normalized = normalizeRepoPathCandidate(candidate);
+        if (normalized !== null)
+            return normalized;
     }
     return undefined;
 }
 async function runClaudeSlice(options) {
-    const { token, host, dryRun, verbose, projectId, pricing } = options;
+    const { token, host, dryRun, verbose, projectId, pricing, allowInsecureHttp = false } = options;
     const appDir = options.appDir ?? getAppDir();
     const backoffKey = credentialStateKey(host, token);
     const errors = [];
@@ -194,21 +205,27 @@ async function runClaudeSlice(options) {
             mcpLog.info("sync_noise_skip", { tool: "claude_code", reason: "local_command_noise" }, false);
             continue;
         }
-        // When scopeDir is set, skip turns from other directories.
+        // When scopeDir is set, skip turns from other directories. `turn.cwd` is an
+        // arbitrary string from a transcript JSONL, so a plain prefix match would
+        // accept `<scopeDir>/../../elsewhere` (DB90DV-547).
         if (scopeDir) {
-            const cwd = turn.cwd?.trim();
-            const inScope = cwd && (cwd === scopeDir || cwd.startsWith(scopeDir + "/"));
+            const cwd = normalizeRepoPathCandidate(turn.cwd);
+            const inScope = cwd !== null && isRepoPathWithinRoot(cwd, scopeDir);
             if (!inScope) {
                 totalSkipped++;
                 if (verbose) {
-                    console.log(`[verbose] Skipping Claude turn ${turn.turnId} — cwd=${cwd ?? "(none)"} not under scopeDir=${scopeDir}`);
+                    console.log(`[verbose] Skipping Claude turn ${turn.turnId} — cwd=${turn.cwd ?? "(none)"} not under scopeDir=${scopeDir}`);
                 }
                 continue;
             }
         }
         const sKey = sessionStateKey(turn.turnId);
         const known = state.sessions[sKey];
-        if (known) {
+        // A turn keeps its turnId as Claude appends more tool_use blocks to it, so a
+        // plain "already known → skip" would drop derivatives appended after an earlier
+        // mid-turn sync. Skip only when the content fingerprint is unchanged; otherwise
+        // re-emit so the newly appended tool uses are sent (DB90DV-259).
+        if (known && known.contentHash && known.contentHash === turn.contentHash) {
             totalSkipped++;
             if (verbose) {
                 console.log(`[verbose] Skipping already-synced Claude turn ${turn.turnId}`);
@@ -222,13 +239,16 @@ async function runClaudeSlice(options) {
         // effectively one network call per unique cwd per sync.
         const resolvedProjectId = scopeDir
             ? (projectId ??
-                (await resolveProjectIdForRepoPathCached(turn.cwd, host, token, verbose, projectLookupCache)) ??
+                (await resolveProjectIdForRepoPathCached(turn.cwd, host, token, verbose, projectLookupCache, allowInsecureHttp)) ??
                 undefined)
             : (explicitProject ??
-                (await resolveProjectIdForRepoPathCached(turn.cwd, host, token, verbose, projectLookupCache)) ??
+                (await resolveProjectIdForRepoPathCached(turn.cwd, host, token, verbose, projectLookupCache, allowInsecureHttp)) ??
                 undefined);
-        const payload = mapClaudeTranscriptTurn(turn, { projectId: resolvedProjectId, pricing });
-        if (verbose && payload.cost_usd === null) {
+        const payloads = mapClaudeTranscriptTurn(turn, { projectId: resolvedProjectId, pricing });
+        if (!payloads?.length)
+            continue;
+        const parentPayload = payloads[0];
+        if (verbose && parentPayload?.cost_usd === null) {
             if (!turn.model) {
                 if (turn.tokensIn > 0 || turn.tokensOut > 0) {
                     console.warn(`[warn] Claude turn ${turn.turnId} has usage but no model — cost_usd will be null`);
@@ -241,45 +261,54 @@ async function runClaudeSlice(options) {
             }
         }
         if (dryRun) {
-            console.log(`[dry-run] Would send Claude turn ${turn.turnId}:`);
-            console.log(JSON.stringify(payload, null, 2));
-            totalSent++;
+            for (const payload of payloads) {
+                console.log(`[dry-run] Would send Claude ${payload.event_type} ${payload.metadata.session_id}:`);
+                console.log(JSON.stringify(payload, null, 2));
+            }
+            totalSent += payloads.length;
             continue;
         }
-        if (verbose) {
-            console.log(`[verbose] Sending Claude turn ${turn.turnId} (${turn.tokensIn + turn.tokensOut} tokens)`);
-        }
-        const ok = await postEvent(payload, host, token, {
-            on429: (retryAfter, quotaExceeded) => {
-                const currentBackoff = backoffUntilByCredential.get(backoffKey);
-                const nextBackoff = new Date(Math.max(currentBackoff?.getTime() ?? 0, Date.now() + retryAfter * 1000));
-                backoffUntilByCredential.set(backoffKey, nextBackoff);
-                shouldStopForBackoff = true;
-                const reason = quotaExceeded ? "Monthly quota exceeded" : "Rate limited";
-                mcpLog.warn("sync_rate_limit_pause", {
-                    tool: "claude_code",
-                    retry_until: nextBackoff.toISOString(),
-                    quota_exceeded: quotaExceeded,
-                }, true);
-                console.warn(`[aixle-insights] ${reason}. Pausing until ${nextBackoff.toISOString()}.`);
-                // Persist backoff to state so it survives process restarts
-                state = { ...state, rate_limited_until: nextBackoff.toISOString() };
-                writeState(state, appDir, host, token);
-            },
-        });
-        if (ok) {
-            state = markSessionSent(state, sKey, turn.fileSize);
-            writeState(state, appDir, host, token);
-            totalSent++;
-        }
-        else {
-            totalFailed++;
-            errors.push(`Failed to post Claude turn ${turn.turnId}`);
-            mcpLog.error("sync_ingest_final_failure", { tool: "claude_code", session_id: turn.turnId }, true);
-            if (shouldStopForBackoff) {
+        let allOk = true;
+        for (const payload of payloads) {
+            if (verbose) {
+                console.log(`[verbose] Sending Claude ${payload.event_type} ${payload.metadata.session_id}`);
+            }
+            const ok = await postEvent(payload, host, token, {
+                allowInsecureHttp,
+                on429: (retryAfter, quotaExceeded) => {
+                    const currentBackoff = backoffUntilByCredential.get(backoffKey);
+                    const nextBackoff = new Date(Math.max(currentBackoff?.getTime() ?? 0, Date.now() + retryAfter * 1000));
+                    backoffUntilByCredential.set(backoffKey, nextBackoff);
+                    shouldStopForBackoff = true;
+                    const reason = quotaExceeded ? "Monthly quota exceeded" : "Rate limited";
+                    mcpLog.warn("sync_rate_limit_pause", {
+                        tool: "claude_code",
+                        retry_until: nextBackoff.toISOString(),
+                        quota_exceeded: quotaExceeded,
+                    }, true);
+                    console.warn(`[aixle-insights] ${reason}. Pausing until ${nextBackoff.toISOString()}.`);
+                    // Persist backoff to state so it survives process restarts
+                    state = { ...state, rate_limited_until: nextBackoff.toISOString() };
+                    writeState(state, appDir, host, token);
+                },
+            });
+            if (!ok) {
+                allOk = false;
+                totalFailed++;
+                errors.push(`Failed to post Claude ${payload.event_type} for turn ${turn.turnId}`);
+                mcpLog.error("sync_ingest_final_failure", { tool: "claude_code", session_id: turn.turnId }, true);
                 break;
             }
         }
+        if (allOk) {
+            totalSent += payloads.length;
+            state = markSessionSent(state, sKey, turn.fileSize, turn.contentHash);
+            writeState(state, appDir, host, token);
+        }
+        else if (shouldStopForBackoff) {
+            break;
+        }
+        // Non-backoff failure: continue to next turn (failed turn will retry next sync)
     }
     const result = { sent: totalSent, failed: totalFailed, skipped: totalSkipped };
     const currentBackoff = backoffUntilByCredential.get(backoffKey);
@@ -290,7 +319,7 @@ async function runClaudeSlice(options) {
     return result;
 }
 async function runCursorSlice(params) {
-    const { token, host, dryRun, verbose, projectId, projectIdSource, projectLookupToken, appDir, cursorBaseDir, cursorTranscriptProjectDirs, scopeDir, fullScan = false, cursorPricing = resolveCursorPricing(undefined, appDir), } = params;
+    const { token, host, dryRun, verbose, projectId, projectIdSource, projectLookupToken, allowInsecureHttp = false, appDir, cursorBaseDir, cursorTranscriptProjectDirs, scopeDir, fullScan = false, cursorPricing = resolveCursorPricing(undefined, appDir), } = params;
     const backoffKey = credentialStateKey(host, token);
     // Read state first so we can restore a persisted rate-limit backoff from a prior process.
     const stateBefore = readState(appDir, host, token);
@@ -331,6 +360,7 @@ async function runCursorSlice(params) {
         host,
         token,
         projectLookupToken: lookupToken,
+        allowInsecureHttp,
         verbose,
         cursorBaseDir,
         cursorTranscriptProjectDirs,
@@ -341,11 +371,11 @@ async function runCursorSlice(params) {
             const inScope = [];
             for (const payload of group.payloads) {
                 const ws = cursorRepoPathFromPayload(payload);
-                if (ws && (ws === scopeDir || ws.startsWith(scopeDir + "/"))) {
+                if (ws && isRepoPathWithinRoot(ws, scopeDir)) {
                     // Same fallback as Claude: when the pre-resolved projectId is null, do a
                     // per-payload lookup from the payload's workspace. Cache dedupes by path.
                     const resolved = projectId ??
-                        (await resolveProjectIdForRepoPathCached(ws, host, lookupToken, verbose, projectLookupCache));
+                        (await resolveProjectIdForRepoPathCached(ws, host, lookupToken, verbose, projectLookupCache, allowInsecureHttp));
                     if (resolved)
                         payload.project_id = resolved;
                     else
@@ -365,7 +395,7 @@ async function runCursorSlice(params) {
                 continue;
             for (const payload of group.payloads) {
                 const repoPath = cursorRepoPathFromPayload(payload);
-                const resolvedProjectId = await resolveProjectIdForRepoPathCached(repoPath, host, lookupToken, verbose, projectLookupCache);
+                const resolvedProjectId = await resolveProjectIdForRepoPathCached(repoPath, host, lookupToken, verbose, projectLookupCache, allowInsecureHttp);
                 if (resolvedProjectId)
                     payload.project_id = resolvedProjectId;
                 else
@@ -438,7 +468,7 @@ async function runCursorSlice(params) {
                     totalSkipped++;
                     continue;
                 }
-                const ok = await postEvent(payload, host, token, { on429 });
+                const ok = await postEvent(payload, host, token, { on429, allowInsecureHttp });
                 if (ok) {
                     totalSent++;
                     const turnId = payload.metadata.session_id;
@@ -455,7 +485,7 @@ async function runCursorSlice(params) {
             }
             continue;
         }
-        const batchResult = await postEvents(group.payloads, host, token, { on429 });
+        const batchResult = await postEvents(group.payloads, host, token, { on429, allowInsecureHttp });
         totalSent += batchResult.sent;
         totalFailed += batchResult.failed;
         if (batchResult.failed > 0) {
@@ -501,10 +531,11 @@ async function runCursorSlice(params) {
                 state: stateMut,
                 host,
                 token,
+                allowInsecureHttp,
                 on429,
                 resolveProjectId: explicitProject
                     ? undefined
-                    : (workspace) => resolveProjectIdForRepoPathCached(workspace, host, lookupToken, verbose, projectLookupCache),
+                    : (workspace) => resolveProjectIdForRepoPathCached(workspace, host, lookupToken, verbose, projectLookupCache, allowInsecureHttp),
                 verbose,
             });
             totalSent += hooksResult.sent;
@@ -590,6 +621,7 @@ export async function syncTelemetryTools(options) {
                 dryRun,
                 verbose,
                 projectId,
+                allowInsecureHttp: credentials.insecureHttpAllowed === true,
                 pricing,
                 appDir,
                 transcriptBaseDirs: options.transcriptBaseDirs,
@@ -606,6 +638,7 @@ export async function syncTelemetryTools(options) {
                 projectId,
                 projectIdSource,
                 projectLookupToken,
+                allowInsecureHttp: credentials.insecureHttpAllowed === true,
                 appDir,
                 cursorBaseDir: options.cursorBaseDir,
                 cursorTranscriptProjectDirs: options.cursorTranscriptProjectDirs,