@aixle/insights 0.2.0 → 0.2.2-staging

package/dist/readers/cursor.js

@@ -74,7 +74,10 @@ export function probeCursorGlobalStateDb(verbose = false, baseDir) {
 export function findCursorDbs(baseDir) {
     const dir = join(baseDir ?? cursorUserDir(), "workspaceStorage");
     try {
-        return glob.sync(join(dir, "**", "cursor.db"));
+        // Pattern stays forward-slash and the directory goes through `cwd`. Building
+        // it with `join` emitted `\` on Windows, and glob treats `\` as an escape
+        // character on every platform, so this silently matched nothing there.
+        return glob.sync("**/cursor.db", { cwd: dir, absolute: true });
     }
     catch {
         return [];
@@ -244,7 +247,14 @@ export function findStateVscDbs(baseDir) {
     const results = [];
     results.push(join(userDir, "globalStorage", "state.vscdb"));
     try {
-        results.push(...glob.sync(join(userDir, "workspaceStorage", "**", "state.vscdb")));
+        // Forward-slash pattern + `cwd`, as above. This one mattered most: the
+        // globalStorage path is pushed unconditionally, so on Windows the function
+        // still returned a result while silently dropping every per-workspace
+        // state.vscdb — partial data loss that looked like working software.
+        results.push(...glob.sync("workspaceStorage/**/state.vscdb", {
+            cwd: userDir,
+            absolute: true,
+        }));
     }
     catch {
         /* ignore */
@@ -447,6 +457,62 @@ function toIsoFromMs(value) {
     const date = new Date(value);
     return Number.isNaN(date.getTime()) ? null : date.toISOString();
 }
+/** Coerce epoch ms/seconds, numeric strings, or ISO-8601 into an ISO timestamp. */
+function coerceTranscriptTimestamp(value) {
+    if (value == null)
+        return null;
+    if (typeof value === "number")
+        return toIsoFromMs(value);
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    const fromEpoch = toIsoString(trimmed);
+    if (fromEpoch)
+        return fromEpoch;
+    const ms = Date.parse(trimmed);
+    if (Number.isNaN(ms))
+        return null;
+    return new Date(ms).toISOString();
+}
+/** Prefer explicit per-line / per-message times when Cursor includes them. */
+function extractLineOccurredAt(entry) {
+    const candidates = [
+        entry.timestamp,
+        entry.createdAt,
+        entry.unixMs,
+        entry.message?.timestamp,
+        entry.message?.createdAt,
+    ];
+    for (const candidate of candidates) {
+        const iso = coerceTranscriptTimestamp(candidate);
+        if (iso)
+            return iso;
+    }
+    return null;
+}
+/**
+ * Spread turns across [start, end] when the JSONL has no per-message times.
+ * Prevents first-sync backfill from collapsing every turn onto lastUpdatedAt/mtime
+ * (DB90DV-605 weekly chart spike).
+ */
+function interpolateTurnOccurredAt(startIso, endIso, index, total, fallbackIso) {
+    if (total <= 0)
+        return fallbackIso;
+    // Single turn: prefer session end (lastUpdatedAt) — matches prior composer-header behavior.
+    if (total === 1)
+        return endIso ?? startIso ?? fallbackIso;
+    const startMs = startIso ? Date.parse(startIso) : NaN;
+    const endMs = endIso ? Date.parse(endIso) : NaN;
+    if (Number.isNaN(startMs) || Number.isNaN(endMs)) {
+        return startIso ?? endIso ?? fallbackIso;
+    }
+    if (endMs <= startMs)
+        return startIso ?? fallbackIso;
+    const ms = startMs + ((endMs - startMs) * index) / (total - 1);
+    return new Date(ms).toISOString();
+}
 function readComposerHeaders(baseDir) {
     const userDir = baseDir ?? cursorUserDir();
     const dbPath = join(userDir, "globalStorage", "state.vscdb");
@@ -491,6 +557,7 @@ function readComposerHeaders(baseDir) {
                 composerId,
                 name: typeof composer.name === "string" ? composer.name : null,
                 workspacePath: typeof uri?.fsPath === "string" ? uri.fsPath : null,
+                createdAt: toIsoFromMs(composer.createdAt),
                 lastUpdatedAt: toIsoFromMs(composer.lastUpdatedAt),
             });
         }
@@ -563,11 +630,15 @@ function workspaceFromTranscriptFile(filePath) {
 const MAX_TRANSCRIPT_BYTES = 50 * 1024 * 1024; // 50 MB
 export async function parseCursorTranscriptFile(filePath, composerHeaders, verbose = false) {
     let fileSize = 0;
-    let occurredAt = new Date().toISOString();
+    let fileMtimeIso = new Date().toISOString();
+    let fileBirthIso = null;
     try {
         const stat = statSync(filePath);
         fileSize = stat.size;
-        occurredAt = stat.mtime.toISOString();
+        fileMtimeIso = stat.mtime.toISOString();
+        if (stat.birthtime && !Number.isNaN(stat.birthtime.getTime()) && stat.birthtime.getTime() > 0) {
+            fileBirthIso = stat.birthtime.toISOString();
+        }
     }
     catch {
         return [];
@@ -580,15 +651,25 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
     }
     const sessionId = basename(filePath, ".jsonl");
     const header = composerHeaders.get(sessionId);
-    if (header?.lastUpdatedAt)
-        occurredAt = header.lastUpdatedAt;
-    const turns = [];
+    const sessionFallback = header?.lastUpdatedAt ?? fileMtimeIso;
+    const sessionStart = header?.createdAt ?? fileBirthIso ?? sessionFallback;
+    const sessionEnd = header?.lastUpdatedAt ?? fileMtimeIso;
+    const drafts = [];
     let currentPromptParts = [];
     let currentAssistantParts = [];
+    let currentTurnOccurredAt = null;
     let turnIndex = 0;
     const hasher = createHash("sha256");
     const stream = createReadStream(filePath, { encoding: "utf-8" });
     const rl = createInterface({ input: stream, crlfDelay: Infinity });
+    const noteLineTime = (entry) => {
+        const lineAt = extractLineOccurredAt(entry);
+        if (!lineAt)
+            return;
+        // Prefer the first timestamp in the turn (usually the user message).
+        if (!currentTurnOccurredAt)
+            currentTurnOccurredAt = lineAt;
+    };
     const finalizeTurn = () => {
         const promptText = currentPromptParts.join("\n\n").trim();
         const assistantText = currentAssistantParts.join("\n\n").trim();
@@ -596,14 +677,14 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
             return;
         const risk = scanText(promptText);
         turnIndex += 1;
-        turns.push({
+        drafts.push({
             turnId: `${sessionId}:${turnIndex}`,
             sessionId,
             filePath,
             fileSize,
             workspacePath: header?.workspacePath ?? workspaceFromTranscriptFile(filePath),
             composerName: header?.name ?? null,
-            occurredAt,
+            turnOccurredAt: currentTurnOccurredAt,
             promptText,
             assistantText,
             tokensIn: estimateTokens(promptText),
@@ -612,6 +693,7 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
             riskScore: risk.risk_score,
             riskCategories: risk.risk_categories,
         });
+        currentTurnOccurredAt = null;
     };
     let lineNumber = 0;
     try {
@@ -640,9 +722,11 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
                     currentPromptParts = [];
                     currentAssistantParts = [];
                 }
+                noteLineTime(entry);
                 currentPromptParts.push(...texts.map(stripUserQueryWrapper).filter((text) => text.length > 0));
             }
             else if (entry.role === "assistant") {
+                noteLineTime(entry);
                 currentAssistantParts.push(...texts.map((text) => text.trim()).filter((text) => text.length > 0));
             }
         }
@@ -659,9 +743,16 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
     }
     finalizeTurn();
     const contentHash = hasher.digest("hex").slice(0, 32);
-    for (const t of turns)
-        t.contentHash = contentHash;
-    return turns;
+    const total = drafts.length;
+    return drafts.map((draft, index) => {
+        const { turnOccurredAt, ...rest } = draft;
+        return {
+            ...rest,
+            contentHash,
+            occurredAt: turnOccurredAt ??
+                interpolateTurnOccurredAt(sessionStart, sessionEnd, index, total, sessionFallback),
+        };
+    });
 }
 export async function readCursorTranscriptSessions(cursorUserBaseDir, transcriptProjectDirs, verbose = false) {
     const composerHeaders = readComposerHeaders(cursorUserBaseDir);
@@ -730,7 +821,7 @@ function dailyStatsSessionId(date, eventType, modelKey) {
     return `cursor:daily_stats:${date}:${suffix}`;
 }
 function buildPayload(opts) {
-    const { eventType, tokensIn, tokensOut, costUsd, occurredAt, dbPath, date, model = "unknown", modelKey, projectId, costModel = LINE_COST_MODEL, } = opts;
+    const { eventType, tokensIn, tokensOut, costUsd, occurredAt, dbPath, date, model = "unknown", modelResolution, modelKey, projectId, costModel = LINE_COST_MODEL, } = opts;
     const payload = {
         tool_name: "cursor",
         event_type: eventType,
@@ -746,13 +837,14 @@ function buildPayload(opts) {
             cost_model: costModel,
             scannable: false,
             risk_level: "none",
+            ...(modelResolution !== undefined ? { model_resolution: modelResolution } : {}),
         },
     };
     if (projectId)
         payload.project_id = projectId;
     return payload;
 }
-export function mapDailyStats(entry, projectId, pricing = DEFAULT_CURSOR_PRICING, model) {
+export function mapDailyStats(entry, projectId, pricing = DEFAULT_CURSOR_PRICING, model, modelResolution) {
     const { date, value, dbPath } = entry;
     const occurredAt = `${date}T00:00:00.000Z`;
     const results = [];
@@ -773,6 +865,7 @@ export function mapDailyStats(entry, projectId, pricing = DEFAULT_CURSOR_PRICING
             dbPath,
             date,
             model,
+            modelResolution,
             projectId,
         }));
     }
@@ -781,11 +874,12 @@ export function mapDailyStats(entry, projectId, pricing = DEFAULT_CURSOR_PRICING
             eventType: "chat",
             tokensIn: composerSuggested,
             tokensOut: composerAccepted,
-            costUsd: computeLineCost("chat", composerAccepted, pricing),
+            costUsd: computeLineCost("chat", composerSuggested, pricing),
             occurredAt,
             dbPath,
             date,
             model,
+            modelResolution,
             projectId,
         }));
     }
@@ -820,7 +914,7 @@ export function mapDailyStats(entry, projectId, pricing = DEFAULT_CURSOR_PRICING
  * Cursor only keeps one recent commit row (overwritten on each new commit).
  * Line-cost math still follows the chat-style line proxy (`computeLineCost("chat", …)`); only `event_type` differs.
  */
-export function mapRecentCommit(entry, projectId, pricing = DEFAULT_CURSOR_PRICING, model) {
+export function mapRecentCommit(entry, projectId, pricing = DEFAULT_CURSOR_PRICING, model, modelResolution) {
     const { value: obj, dbPath } = entry;
     const occurredAt = toIsoString(obj.timestamp);
     if (!occurredAt)
@@ -866,6 +960,7 @@ export function mapRecentCommit(entry, projectId, pricing = DEFAULT_CURSOR_PRICI
                     : undefined,
             scannable: false,
             risk_level: "none",
+            ...(modelResolution !== undefined ? { model_resolution: modelResolution } : {}),
         },
     };
     if (projectId)
@@ -902,7 +997,7 @@ export function mapEvent(row, workspacePath, projectId, pricing = DEFAULT_CURSOR
         payload.project_id = projectId;
     return payload;
 }
-export function mapTranscriptTurn(turn, projectId, pricing = DEFAULT_CURSOR_PRICING, model) {
+export function mapTranscriptTurn(turn, projectId, pricing = DEFAULT_CURSOR_PRICING, model, modelResolution) {
     const payload = {
         tool_name: "cursor",
         event_type: "chat",
@@ -924,6 +1019,7 @@ export function mapTranscriptTurn(turn, projectId, pricing = DEFAULT_CURSOR_PRIC
             composer_name: turn.composerName ?? undefined,
             prompt_text: turn.promptText || undefined,
             assistant_text: turn.assistantText || undefined,
+            ...(modelResolution !== undefined ? { model_resolution: modelResolution } : {}),
         },
     };
     if (projectId)

package/dist/risk-scanner.js

@@ -12,6 +12,10 @@ const CATEGORIES = {
         weight: 3,
         patterns: [
             /\b\d{3}-\d{2}-\d{4}\b/g, // SSN
+            /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged for
+               `{3}` inside `(?:…)?`. Every branch is a fixed-length digit run
+               anchored by \b, so the match is bounded and cannot backtrack
+               super-linearly. */
             /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\b/g, // Credit card
         ],
     },
@@ -19,6 +23,9 @@ const CATEGORIES = {
         weight: 1,
         patterns: [
             /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/gi, // Email
+            /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged for
+               `?` nested in `?`. All quantified groups are fixed-length digit or
+               separator classes anchored by \b; matching is bounded. */
             /\b(?:\+?1[-.\s]?)?(?:\([0-9]{3}\)|[0-9]{3})[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}\b/g, // Phone
         ],
     },

package/dist/server.d.ts

@@ -7,8 +7,25 @@ export declare const SYNC_NOW_INPUT_SCHEMA: z.ZodObject<{
         cursor: "cursor";
     }>>>;
 }, z.core.$strict>;
-/** Structured status for `db90_status` — tolerates missing/malformed credentials and state. */
-export declare function buildDb90StatusPayload(): Promise<Record<string, unknown>>;
+/**
+ * Whether a `credential_validation_failed` warning should mirror to stderr.
+ * Mirrors for one-shot/startup sources so an installed-but-uninitialized MCP is
+ * visible, but NOT for the recurring background `"interval"` tick — that fires
+ * every SYNC_INTERVAL_MS for the whole process lifetime and would spam the logs.
+ * The event is always written to mcp.log regardless of this return value.
+ */
+export declare function shouldMirrorMissingCredentials(source: string): boolean;
+/** Structured status for `aixle_insights_status` — tolerates missing/malformed credentials and state. */
+export declare function buildAixleInsightsStatusPayload(): Promise<Record<string, unknown>>;
 /** In-process MCP server instance (stdio not attached). */
-export declare function createDb90McpServer(): McpServer;
+export declare function createAixleInsightsMcpServer(): McpServer;
+/**
+ * Subscribes `shutdown` to the given stream's "end" and "close" events.
+ * Closing stdin is how the OS signals a stdio-transport MCP server that its
+ * parent process is gone — this fires even when the parent can't deliver a
+ * signal (e.g. it was itself SIGKILL'd, or the OS reparented this process
+ * without ever sending one). Exported standalone so it's testable with a
+ * plain EventEmitter instead of the real process.stdin.
+ */
+export declare function wireParentExitShutdown(stdin: Pick<NodeJS.ReadStream, "on">, shutdown: () => void): void;
 export declare function startServer(): Promise<void>;

package/dist/server.js

@@ -27,6 +27,12 @@ export const SYNC_NOW_INPUT_SCHEMA = z
     }
 })
     .strict();
+const AUTHENTICATE_INPUT_SCHEMA = z.object({
+    keycloakUrl: z.string().optional(),
+    clientId: z.string().optional(),
+});
+/** DB90DV-569: `db90_*` names are deprecated aliases kept for one release for existing callers. */
+const DEPRECATED_ALIAS_NOTE = "(Deprecated — use `{name}` instead; kept temporarily for backward compatibility, see DB90DV-569.) ";
 function jsonContent(value) {
     return {
         content: [
@@ -56,6 +62,16 @@ function migrateAllLegacyState(creds) {
 function syncResultOk(result) {
     return !result.locked && result.failed === 0;
 }
+/**
+ * Whether a `credential_validation_failed` warning should mirror to stderr.
+ * Mirrors for one-shot/startup sources so an installed-but-uninitialized MCP is
+ * visible, but NOT for the recurring background `"interval"` tick — that fires
+ * every SYNC_INTERVAL_MS for the whole process lifetime and would spam the logs.
+ * The event is always written to mcp.log regardless of this return value.
+ */
+export function shouldMirrorMissingCredentials(source) {
+    return source !== "interval";
+}
 // Process-lifetime cache keyed on the inputs that drive resolveProjectId: host,
 // lookup token, and the current repo's git remote. Re-resolve when any of them
 // changes (re-auth, repo cwd change). `source: "none"` is never cached so a
@@ -70,22 +86,22 @@ async function getProjectResolutionForSync(creds) {
     if (cachedProjectResolution?.key === cacheKey) {
         return cachedProjectResolution.value;
     }
-    const result = await resolveProjectId(undefined, undefined, creds.host, token, false);
+    const result = await resolveProjectId(undefined, undefined, creds.host, token, false, creds.insecureHttpAllowed === true);
     mcpLog.info("project_attribution_resolved", { project_id: result.projectId, source: result.source }, false);
     if (result.source !== "none") {
         cachedProjectResolution = { key: cacheKey, value: result };
     }
     return result;
 }
-/** Structured status for `db90_status` — tolerates missing/malformed credentials and state. */
-export async function buildDb90StatusPayload() {
+/** Structured status for `aixle_insights_status` — tolerates missing/malformed credentials and state. */
+export async function buildAixleInsightsStatusPayload() {
     const snapshot = await buildHealthSnapshot();
     return healthSnapshotToStatusPayload(snapshot);
 }
 async function executeSync(parsed) {
     const creds = await loadCredentials();
     if (!creds || !credentialsHaveAnyToken(creds)) {
-        mcpLog.warn("credential_validation_failed", { source: "db90_sync_now", reason: "missing_credentials" }, false);
+        mcpLog.warn("credential_validation_failed", { source: "aixle_insights_sync_now", reason: "missing_credentials" }, shouldMirrorMissingCredentials("aixle_insights_sync_now"));
         return { ok: false, error: "missing_credentials" };
     }
     migrateAllLegacyState(creds);
@@ -104,79 +120,96 @@ async function executeSync(parsed) {
     });
     return { ok: syncResultOk(result), result };
 }
-/** In-process MCP server instance (stdio not attached). */
-export function createDb90McpServer() {
-    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
-    server.registerTool("db90_status", {
-        description: "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.",
-    }, async () => jsonContent(await buildDb90StatusPayload()));
-    server.registerTool("db90_sync_now", {
-        description: "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
-            "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).",
-        inputSchema: SYNC_NOW_INPUT_SCHEMA,
-    }, async (input) => {
-        try {
-            const parsed = SYNC_NOW_INPUT_SCHEMA.parse(input ?? {});
-            return jsonContent(await executeSync(parsed));
-        }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                return jsonContent({
-                    ok: false,
-                    error: "validation_error",
-                    details: err.flatten(),
-                });
-            }
+async function statusHandler() {
+    return jsonContent(await buildAixleInsightsStatusPayload());
+}
+async function syncNowHandler(input) {
+    try {
+        const parsed = SYNC_NOW_INPUT_SCHEMA.parse(input ?? {});
+        return jsonContent(await executeSync(parsed));
+    }
+    catch (err) {
+        if (err instanceof z.ZodError) {
             return jsonContent({
                 ok: false,
-                error: err instanceof Error ? err.message : String(err),
-            });
-        }
-    });
-    server.registerTool("db90_authenticate", {
-        description: "Starts Keycloak device login and returns the visit URL/code for the user. Use aixle-insights init for the full terminal flow that saves credentials.",
-        inputSchema: z.object({
-            keycloakUrl: z.string().optional(),
-            clientId: z.string().optional(),
-        }),
-    }, async (input) => {
-        try {
-            const args = input;
-            const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
-            if (!kc) {
-                return jsonContent({
-                    ok: false,
-                    error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
-                });
-            }
-            const clientId = args.clientId?.trim() || defaultKeycloakClientId();
-            const device = await startDeviceAuthorization({
-                issuer: kc,
-                clientId,
-            });
-            return jsonContent({
-                ok: true,
-                verificationUri: device.verification_uri,
-                verificationUriComplete: device.verification_uri_complete ?? null,
-                userCode: device.user_code,
-                expiresIn: device.expires_in,
-                interval: device.interval ?? 5,
-                issuer: kc,
-                clientId,
-                message: `Visit ${device.verification_uri} and enter code ${device.user_code}`,
+                error: "validation_error",
+                details: err.flatten(),
             });
         }
-        catch (err) {
+        return jsonContent({
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function authenticateHandler(args) {
+    try {
+        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
+        if (!kc) {
             return jsonContent({
                 ok: false,
-                error: err instanceof Error ? err.message : String(err),
+                error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
             });
         }
-    });
+        const clientId = args.clientId?.trim() || defaultKeycloakClientId();
+        const device = await startDeviceAuthorization({
+            issuer: kc,
+            clientId,
+        });
+        return jsonContent({
+            ok: true,
+            verificationUri: device.verification_uri,
+            verificationUriComplete: device.verification_uri_complete ?? null,
+            userCode: device.user_code,
+            expiresIn: device.expires_in,
+            interval: device.interval ?? 5,
+            issuer: kc,
+            clientId,
+            message: `Visit ${device.verification_uri} and enter code ${device.user_code}`,
+        });
+    }
+    catch (err) {
+        return jsonContent({
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/** In-process MCP server instance (stdio not attached). */
+export function createAixleInsightsMcpServer() {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    const statusDescription = "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.";
+    server.registerTool("aixle_insights_status", { description: statusDescription }, statusHandler);
+    server.registerTool("db90_status", { description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_status") + statusDescription }, statusHandler);
+    const syncNowDescription = "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
+        "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).";
+    server.registerTool("aixle_insights_sync_now", { description: syncNowDescription, inputSchema: SYNC_NOW_INPUT_SCHEMA }, syncNowHandler);
+    server.registerTool("db90_sync_now", {
+        description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_sync_now") + syncNowDescription,
+        inputSchema: SYNC_NOW_INPUT_SCHEMA,
+    }, syncNowHandler);
+    const authenticateDescription = "Starts Keycloak device login and returns the visit URL/code for the user. Use aixle-insights init for the full terminal flow that saves credentials.";
+    server.registerTool("aixle_insights_authenticate", { description: authenticateDescription, inputSchema: AUTHENTICATE_INPUT_SCHEMA }, authenticateHandler);
+    server.registerTool("db90_authenticate", {
+        description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_authenticate") + authenticateDescription,
+        inputSchema: AUTHENTICATE_INPUT_SCHEMA,
+    }, authenticateHandler);
     return server;
 }
+/**
+ * Subscribes `shutdown` to the given stream's "end" and "close" events.
+ * Closing stdin is how the OS signals a stdio-transport MCP server that its
+ * parent process is gone — this fires even when the parent can't deliver a
+ * signal (e.g. it was itself SIGKILL'd, or the OS reparented this process
+ * without ever sending one). Exported standalone so it's testable with a
+ * plain EventEmitter instead of the real process.stdin.
+ */
+export function wireParentExitShutdown(stdin, shutdown) {
+    stdin.on("end", shutdown);
+    stdin.on("close", shutdown);
+}
 export async function startServer() {
-    const server = createDb90McpServer();
+    const server = createAixleInsightsMcpServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
     let intervalId;
@@ -195,12 +228,13 @@ export async function startServer() {
     };
     process.on("SIGINT", onSignal);
     process.on("SIGTERM", onSignal);
+    wireParentExitShutdown(process.stdin, onSignal);
     const runBackground = async (source) => {
         if (shuttingDown)
             return;
         const creds = await loadCredentials();
         if (!creds || !credentialsHaveAnyToken(creds)) {
-            mcpLog.warn("credential_validation_failed", { source, reason: "missing_credentials" }, false);
+            mcpLog.warn("credential_validation_failed", { source, reason: "missing_credentials" }, shouldMirrorMissingCredentials(source));
             return;
         }
         try {

package/dist/state.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { createHash, randomBytes } from "node:crypto";
+import { mcpLog } from "./log.js";
 export function getAppDir() {
     const override = process.env["AIXLE_INSIGHTS_HOME"]?.trim();
     if (override && override.length > 0)
@@ -123,8 +124,12 @@ export function readState(dir, host, token) {
             }
         }
     }
-    catch {
-        // missing or malformed state file — start fresh
+    catch (err) {
+        const code = err?.code;
+        if (code !== "ENOENT") {
+            // State file exists but failed to parse — distinguishes tampering from "never created".
+            mcpLog.warn("state_parse_failed", { path: filePath, error: err instanceof Error ? err.message : String(err) }, false);
+        }
     }
     return { version: 1, sessions: {} };
 }

package/dist/sync.d.ts

@@ -2,7 +2,7 @@ import type { TelemetryToolId, StoredCredentials } from "./auth/credentials.js";
 import { type PricingTable } from "./pricing.js";
 import type { PricingConfig } from "./readers/cursor.js";
 import { type ProjectResolution } from "./lib/index.js";
-import type { CursorDb90Payload } from "./readers/cursor.js";
+import type { CursorPayload } from "./readers/cursor.js";
 /** Prefix for Claude Code session keys in shared MCP state. */
 export declare const CLAUDE_STATE_PREFIX: "claude_code:";
 export { CURSOR_WATERMARK_KEY, CURSOR_EVENTS_WATERMARK_KEY, CURSOR_DAILY_STATS_WATERMARK_KEY, CURSOR_RECENT_COMMIT_WATERMARK_KEY, CURSOR_TRANSCRIPT_TURN_PREFIX, cursorTranscriptTurnStateKey, filterRecentCommitsByHashDedup, } from "./cursor-checkpoints.js";
@@ -24,6 +24,8 @@ export interface SyncOptions {
     verbose: boolean;
     projectId: string | null;
     projectIdSource?: ProjectResolution["source"];
+    /** Mirrors StoredCredentials.insecureHttpAllowed — set when `init --insecure` was used for this host. */
+    allowInsecureHttp?: boolean;
     pricing: PricingTable;
     appDir?: string;
     transcriptBaseDirs?: string[];
@@ -65,7 +67,16 @@ export declare function getSyncTelemetry(): {
     lastResult: SyncResult | null;
     recentErrors: string[];
 };
-export declare function cursorRepoPathFromPayload(payload: CursorDb90Payload): string | undefined;
+/**
+ * The repo path for a Cursor payload, normalized and safe to hand to project
+ * resolution. Returns an absolute, `..`-collapsed path or undefined.
+ *
+ * `workspace_folder` comes from the workspace's own `workspace.json` and
+ * `workspace` from a composer `uri.fsPath` or the `state.vscdb` path — all
+ * untrusted. When the preferred field is unusable we fall through to the other
+ * rather than giving up. See DB90DV-547.
+ */
+export declare function cursorRepoPathFromPayload(payload: CursorPayload): string | undefined;
 /**
  * Parallel multi-tool cycle under the global advisory ingest lock (`state.lock`).
  */