@aixle/insights 0.2.1-staging → 0.2.1

package/dist/cursor-payload-contract.d.ts

@@ -1,4 +1,4 @@
-import type { CursorPayload } from "./readers/cursor.js";
+import type { CursorDb90Payload } from "./readers/cursor.js";
 /** Ingest paths for Cursor payloads emitted by telemetry-mcp. */
 export type CursorIngestPath = "daily_tab" | "daily_composer" | "legacy_request" | "recent_commit" | "mcp_transcript" | "cursor_hook";
 export interface PayloadValidationResult {
@@ -6,12 +6,12 @@ export interface PayloadValidationResult {
     errors: string[];
     path: CursorIngestPath | "unknown";
 }
-export declare function inferIngestPath(payload: CursorPayload): CursorIngestPath | "unknown";
-export declare function validateCursorPayload(payload: CursorPayload): PayloadValidationResult;
+export declare function inferIngestPath(payload: CursorDb90Payload): CursorIngestPath | "unknown";
+export declare function validateCursorPayload(payload: CursorDb90Payload): PayloadValidationResult;
 export interface DryRunMatrixRow {
     path: CursorIngestPath | "unknown";
     count: number;
     sample_occurred_at: string | null;
 }
-export declare function summarizeDryRunMatrix(payloads: CursorPayload[]): DryRunMatrixRow[];
-export declare function printCursorDryRunValidationReport(payloads: CursorPayload[]): boolean;
+export declare function summarizeDryRunMatrix(payloads: CursorDb90Payload[]): DryRunMatrixRow[];
+export declare function printCursorDryRunValidationReport(payloads: CursorDb90Payload[]): boolean;

package/dist/health.d.ts

@@ -16,8 +16,6 @@ export interface HealthSnapshot {
     hooks_queue_depth: number;
     /** Best-effort merge of credential-scoped `mcp_operator` (latest `last_sync_at`). */
     persisted: McpOperatorState | null;
-    /** True only when buildHealthSnapshot caught an unexpected error building the snapshot. */
-    snapshot_failed?: boolean;
     /** In-process telemetry (same fields as `getSyncTelemetry`). */
     process: {
         last_sync_at: string | null;

package/dist/health.js

@@ -122,7 +122,6 @@ export async function buildHealthSnapshot() {
             hooks_installed: hooksReport.hooks_json_installed,
             hooks_queue_depth: hooksReport.queue_depth,
             persisted: null,
-            snapshot_failed: true,
             process: {
                 last_sync_at: telemetry.lastSyncAt,
                 last_result: telemetry.lastResult,
@@ -141,18 +140,11 @@ export function healthSnapshotToStatusPayload(snapshot) {
     const lastSyncAt = proc.last_sync_at ?? pers?.last_sync_at ?? null;
     const lastResult = proc.last_result ?? snapshotToResult(pers?.last_result ?? null);
     const errors = mergeErrors(proc.recent_errors, pers?.recent_errors ?? []);
-    const needsInit = !snapshot.authenticated && snapshot.snapshot_failed !== true;
-    const onboardingMessage = needsInit
-        ? "aixle-insights is installed but not connected. Run `aixle-insights init` to start tracking — " +
-            "activity since install is not lost; the first sync after init backfills all of it."
-        : null;
     return {
         authenticated: snapshot.authenticated,
         configured: snapshot.configured,
         host: snapshot.host,
         ingest_tools: snapshot.ingest_tools,
-        needs_init: needsInit,
-        onboarding_message: onboardingMessage,
         last_sync_at: lastSyncAt,
         last_result: lastResult,
         sessions_synced: lastResult?.sent ?? 0,
@@ -199,9 +191,5 @@ export function formatHealthForCli(snapshot) {
     else {
         lines.push("  (none)");
     }
-    if (typeof sta["onboarding_message"] === "string") {
-        lines.push("");
-        lines.push(sta["onboarding_message"]);
-    }
     return lines.join("\n");
 }

package/dist/hooks/cursor-hooks-mapper.d.ts

@@ -1,5 +1,5 @@
 import type { HookLogEvent } from "./hooks-config.js";
-import type { CursorPayload } from "../readers/cursor.js";
+import type { CursorDb90Payload } from "../readers/cursor.js";
 export { HookLogEvent };
 /** State key prefix for hook event dedup in state.sessions. */
 export declare const CURSOR_HOOK_STATE_PREFIX: "cursor:hook:";
@@ -16,7 +16,7 @@ export declare function shouldIngestHookEvent(event: HookLogEvent, verbose?: boo
 /** Warn-only version gate — Cursor builds can have unusual version strings. */
 export declare function warnOnCursorVersion(event: HookLogEvent, verbose: boolean): void;
 /**
- * Map a validated hook event to the CursorPayload contract.
+ * Map a validated hook event to the CursorDb90Payload contract.
  * Call shouldIngestHookEvent() before this — it does not re-validate.
  */
-export declare function mapHookEventToPayload(event: HookLogEvent, projectId?: string | null): CursorPayload;
+export declare function mapHookEventToPayload(event: HookLogEvent, projectId?: string | null): CursorDb90Payload;

package/dist/hooks/cursor-hooks-mapper.js

@@ -47,7 +47,7 @@ export function warnOnCursorVersion(event, verbose) {
     }
 }
 /**
- * Map a validated hook event to the CursorPayload contract.
+ * Map a validated hook event to the CursorDb90Payload contract.
  * Call shouldIngestHookEvent() before this — it does not re-validate.
  */
 export function mapHookEventToPayload(event, projectId) {

package/dist/hooks/cursor-hooks-reader.js

@@ -6,9 +6,16 @@ import { markSessionSent } from "../state.js";
 import { postEvent } from "../client.js";
 import { mcpLog } from "../log.js";
 import { shouldIngestHookEvent, mapHookEventToPayload, hookDedupeKey, warnOnCursorVersion, CURSOR_HOOK_STATE_PREFIX, } from "./cursor-hooks-mapper.js";
+import { isRepoPathWithinRoot, normalizeRepoPathCandidate } from "../lib/repo-path-safety.js";
 export { CURSOR_HOOK_STATE_PREFIX };
+/**
+ * `workspace` is `workspace_roots[0]` from the on-disk hooks queue — an
+ * arbitrary JSON string. A plain prefix match would accept
+ * `<scopeDir>/../../elsewhere` (DB90DV-547).
+ */
 function isUnderScopeDir(workspace, scopeDir) {
-    return workspace === scopeDir || workspace.startsWith(scopeDir + "/");
+    const normalized = normalizeRepoPathCandidate(workspace);
+    return normalized !== null && isRepoPathWithinRoot(normalized, scopeDir);
 }
 /**
  * The forwarder redacts the home directory to "~" in workspace_roots for

package/dist/install/index.d.ts

@@ -1,10 +1,8 @@
 import { type InstallClaudeUserMcpOptions, type InstallResult } from "./claude.js";
-import { type InstallCursorUserMcpOptions, type UninstallResult } from "./cursor.js";
-export type SupportedEditor = "claude" | "cursor";
-export type { InstallClaudeUserMcpOptions, InstallCursorUserMcpOptions, InstallResult, UninstallResult, };
+export type SupportedEditor = "claude";
+export type { InstallClaudeUserMcpOptions, InstallResult };
 /**
- * Editor dispatch for MCP install hooks.
+ * Editor dispatch for MCP install hooks. Only Claude Code is supported in this story.
  */
-export declare function installEditorMcp(editor: SupportedEditor, options?: InstallClaudeUserMcpOptions & InstallCursorUserMcpOptions): InstallResult;
+export declare function installEditorMcp(editor: SupportedEditor, options?: InstallClaudeUserMcpOptions): InstallResult;
 export { installClaudeUserMcp, defaultClaudeUserConfigPath, desiredAixleInsightsEntry, aixleInsightsEntryMatchesDesired, } from "./claude.js";
-export { installCursorUserMcp, uninstallCursorUserMcp, defaultCursorUserConfigPath, } from "./cursor.js";

package/dist/install/index.js

@@ -1,16 +1,11 @@
 import { installClaudeUserMcp, } from "./claude.js";
-import { installCursorUserMcp, } from "./cursor.js";
 /**
- * Editor dispatch for MCP install hooks.
+ * Editor dispatch for MCP install hooks. Only Claude Code is supported in this story.
  */
 export function installEditorMcp(editor, options = {}) {
     if (editor === "claude") {
         return installClaudeUserMcp(options);
     }
-    if (editor === "cursor") {
-        return installCursorUserMcp(options);
-    }
     return { kind: "error", message: `Unsupported editor for MCP install: ${String(editor)}` };
 }
 export { installClaudeUserMcp, defaultClaudeUserConfigPath, desiredAixleInsightsEntry, aixleInsightsEntryMatchesDesired, } from "./claude.js";
-export { installCursorUserMcp, uninstallCursorUserMcp, defaultCursorUserConfigPath, } from "./cursor.js";

package/dist/lib/config.d.ts

@@ -12,8 +12,8 @@ export interface BaseConfig {
  * Load a connector's `config.json` from disk. Returns `{}` on missing or
  * malformed files — callers fall back to env vars / CLI flags / defaults.
  *
- * @param configDir Directory containing `config.json`, typically the
- *                  connector's `APP_DIR` (`~/.db90-claude` / `~/.db90-cursor`).
+ * @param configDir Directory containing `config.json`, typically the app home directory
+ *                  (`~/.aixle-insights`, or `AIXLE_INSIGHTS_HOME` when set).
  * @param parsePricing Optional callback that extracts a connector-specific
  *                     pricing shape from the raw parsed JSON. Returns
  *                     `undefined` when the pricing block is missing or invalid.

package/dist/lib/config.js

@@ -1,12 +1,13 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { mcpLog } from "../log.js";
+import { describeReadFailure } from "./parse-error.js";
 /**
  * Load a connector's `config.json` from disk. Returns `{}` on missing or
  * malformed files — callers fall back to env vars / CLI flags / defaults.
  *
- * @param configDir Directory containing `config.json`, typically the
- *                  connector's `APP_DIR` (`~/.db90-claude` / `~/.db90-cursor`).
+ * @param configDir Directory containing `config.json`, typically the app home directory
+ *                  (`~/.aixle-insights`, or `AIXLE_INSIGHTS_HOME` when set).
  * @param parsePricing Optional callback that extracts a connector-specific
  *                     pricing shape from the raw parsed JSON. Returns
  *                     `undefined` when the pricing block is missing or invalid.
@@ -16,29 +17,36 @@ import { mcpLog } from "../log.js";
  */
 export function loadBaseConfig(configDir, parsePricing) {
     const configPath = join(configDir, "config.json");
+    let parsed;
     try {
-        const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
-        if (typeof parsed === "object" && parsed !== null) {
-            const obj = parsed;
-            const result = {
-                token: typeof obj.token === "string" ? obj.token : undefined,
-                host: typeof obj.host === "string" ? obj.host : undefined,
-                project_id: typeof obj.project_id === "string" ? obj.project_id : undefined,
-            };
-            if (parsePricing) {
-                const pricing = parsePricing(obj);
-                if (pricing !== undefined)
-                    result.pricing = pricing;
-            }
-            return result;
-        }
+        parsed = JSON.parse(readFileSync(configPath, "utf-8"));
     }
     catch (err) {
         const code = err?.code;
         if (code !== "ENOENT") {
-            // Config file exists but failed to parse — distinguishes tampering from "never created".
-            mcpLog.warn("config_parse_failed", { path: configPath, error: err instanceof Error ? err.message : String(err) }, false);
+            // Config file exists but is not valid JSON — distinguishes tampering from "never created".
+            // ENOENT stays silent: this file is optional and most users never create it.
+            mcpLog.warn("config_parse_failed", { path: configPath, ...describeReadFailure(err) }, false);
         }
+        return {};
+    }
+    // Valid JSON, but not a config object. Arrays are rejected explicitly because
+    // `typeof [] === "object"` would otherwise let them reach the happy path and be handed
+    // to `parsePricing`. Previously every non-object fell through silently. (DB90DV-699)
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        mcpLog.warn("config_parse_failed", { path: configPath, reason: "invalid_shape" }, false);
+        return {};
+    }
+    const obj = parsed;
+    const result = {
+        token: typeof obj.token === "string" ? obj.token : undefined,
+        host: typeof obj.host === "string" ? obj.host : undefined,
+        project_id: typeof obj.project_id === "string" ? obj.project_id : undefined,
+    };
+    if (parsePricing) {
+        const pricing = parsePricing(obj);
+        if (pricing !== undefined)
+            result.pricing = pricing;
     }
-    return {};
+    return result;
 }

package/dist/lib/parse-error.d.ts

@@ -0,0 +1,21 @@
+export type ReadFailureReason = "invalid_json" | "unreadable";
+/**
+ * Classifies a caught error from `JSON.parse(readFileSync(...))` (or a parsed keychain
+ * payload) into a log-safe reason + error string.
+ *
+ * V8's `JSON.parse` throws a `SyntaxError` whose `.message` can embed a prefix (or, for a
+ * short enough input, the entirety) of the unparsed content — e.g.
+ * `JSON.parse("example_local_fixture_1234567890")` produces
+ * `Unexpected token 'e', "example_lo"... is not valid JSON`. Logging that message would
+ * leak exactly the secret content the parse-failure events exist to describe without
+ * exposing (see `credentials_parse_failed` / `credentials_keytar_parse_failed` /
+ * `config_parse_failed` / `state_parse_failed`). So for a `SyntaxError` this reports only
+ * the error name, never `.message`.
+ *
+ * Any other error (fs I/O — `EACCES`, `EISDIR`, etc.) is reported as `unreadable` using its
+ * errno `code`, which never contains file content and is more actionable than a bare name.
+ */
+export declare function describeReadFailure(err: unknown): {
+    reason: ReadFailureReason;
+    error: string;
+};

package/dist/lib/parse-error.js

@@ -0,0 +1,25 @@
+/**
+ * Classifies a caught error from `JSON.parse(readFileSync(...))` (or a parsed keychain
+ * payload) into a log-safe reason + error string.
+ *
+ * V8's `JSON.parse` throws a `SyntaxError` whose `.message` can embed a prefix (or, for a
+ * short enough input, the entirety) of the unparsed content — e.g.
+ * `JSON.parse("example_local_fixture_1234567890")` produces
+ * `Unexpected token 'e', "example_lo"... is not valid JSON`. Logging that message would
+ * leak exactly the secret content the parse-failure events exist to describe without
+ * exposing (see `credentials_parse_failed` / `credentials_keytar_parse_failed` /
+ * `config_parse_failed` / `state_parse_failed`). So for a `SyntaxError` this reports only
+ * the error name, never `.message`.
+ *
+ * Any other error (fs I/O — `EACCES`, `EISDIR`, etc.) is reported as `unreadable` using its
+ * errno `code`, which never contains file content and is more actionable than a bare name.
+ */
+export function describeReadFailure(err) {
+    if (err instanceof SyntaxError) {
+        return { reason: "invalid_json", error: "SyntaxError" };
+    }
+    const code = err?.code;
+    if (code)
+        return { reason: "unreadable", error: code };
+    return { reason: "unreadable", error: err instanceof Error ? err.name : "unknown_error" };
+}

package/dist/lib/project-resolver.js

@@ -1,4 +1,6 @@
 import { execFileSync } from "node:child_process";
+import { isSafeSshHost } from "./spawn-arg-safety.js";
+import { safeGitRepoPath } from "./repo-path-safety.js";
 import { evaluateTransportSecurity } from "./transport-security.js";
 /** Coerce empty string to undefined so "" is treated as "not set" */
 function coerce(val) {
@@ -48,8 +50,19 @@ export function getGitRemote(verbose) {
     }
 }
 export function getGitRemoteForPath(repoPath, verbose) {
+    // The spawn boundary. `repoPath` is untrusted (Cursor workspace.json, a
+    // composer uri.fsPath, a hook workspace_root, or a Claude transcript cwd), so
+    // it must resolve to a real directory before git reads its .git/config.
+    // Supersedes the isSafeSpawnPathArg check from DB90DV-546, which this
+    // subsumes. See DB90DV-547.
+    const safePath = safeGitRepoPath(repoPath);
+    if (safePath === null) {
+        if (verbose)
+            console.log(`[verbose] Refusing git for unsafe repo path: ${repoPath}`);
+        return null;
+    }
     try {
-        const out = execFileSync("git", ["-C", repoPath, "remote", "get-url", "origin"], {
+        const out = execFileSync("git", ["-C", safePath, "remote", "get-url", "origin"], {
             encoding: "utf-8",
             stdio: ["ignore", "pipe", "pipe"],
             timeout: 5000,
@@ -75,12 +88,21 @@ export function canonicalizeGitRemote(remote, verbose) {
     if (!trimmed)
         return remote;
     const scp = trimmed.match(/^([\w.-]+)@([^:/]+):(.+)$/);
+    /* eslint-disable-next-line security/detect-unsafe-regex -- Flagged only
+       because safe-regex counts `?` as a repetition. Every group is separated by
+       a literal delimiter (`@`, `:`, `/`) that its neighbours exclude, so there
+       is no backtracking ambiguity. Input is a git remote URL, bounded length. */
     const sshUrl = trimmed.match(/^ssh:\/\/(?:([\w.-]+)@)?([^:/]+)(?::\d+)?\/(.+)$/i);
     const host = scp?.[2] ?? sshUrl?.[2];
-    if (!host)
+    // An unvalidated host would be parsed by ssh as an option (DB90DV-546); an
+    // unvalidated `resolved` would be spliced back into the remote and sent to
+    // the lookup endpoint. Both fail open — the remote is returned unchanged.
+    if (!host || !isSafeSshHost(host))
         return trimmed;
     const resolved = resolveSshHostName(host, verbose);
-    if (!resolved || resolved.toLowerCase() === host.toLowerCase())
+    if (!resolved || !isSafeSshHost(resolved))
+        return trimmed;
+    if (resolved.toLowerCase() === host.toLowerCase())
         return trimmed;
     if (verbose)
         console.log(`[verbose] Resolved SSH host alias ${host} -> ${resolved}`);
@@ -90,6 +112,13 @@ export function canonicalizeGitRemote(remote, verbose) {
     return `ssh://${user}${resolved}/${sshUrl[3]}`;
 }
 function resolveSshHostName(host, verbose) {
+    // Defense in depth: the only caller already checks, but this function is the
+    // spawn boundary and must not depend on callers getting it right.
+    if (!isSafeSshHost(host)) {
+        if (verbose)
+            console.log(`[verbose] Refusing ssh -G for option-shaped host: ${host}`);
+        return null;
+    }
     try {
         const out = execFileSync("ssh", ["-G", host], {
             encoding: "utf-8",
@@ -129,6 +158,11 @@ export function repoNameToGitRemoteCandidates(repoName) {
     if (trimmed.includes("://") || trimmed.includes("@")) {
         return [trimmed];
     }
+    /* eslint-disable-next-line security/detect-unsafe-regex -- Star height 2
+       (`+` inside `(…)*`), but the inner group is prefixed by `/`, which is not
+       in [\w.-]. There is no ambiguous overlap, so matching stays linear. The
+       input is a short `owner/repo` slug that already failed the "://" and "@"
+       checks above. */
     if (/^[\w.-]+\/[\w.-]+(\/[\w.-]+)*$/.test(trimmed)) {
         return [`https://github.com/${trimmed}`, `git@github.com:${trimmed}.git`];
     }

package/dist/lib/repo-path-safety.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Normalize an untrusted repo-path candidate. Pure — never touches the
+ * filesystem, so it is safe to call on every payload in a sync.
+ *
+ * Returns an absolute, `..`-collapsed path, or null when the value cannot be a
+ * legitimate workspace path. Rejecting relative values is deliberate: `git -C`
+ * would resolve a relative path against *this* process's cwd, which has nothing
+ * to do with where the value came from. It also rejects Cursor's literal
+ * `"unknown"` placeholder for global hook events.
+ */
+export declare function normalizeRepoPathCandidate(value: string | undefined | null): string | null;
+/**
+ * True when `candidate` is `root` itself or lives beneath it.
+ *
+ * Compares with a trailing `sep` so `/repos/project-evil` is not treated as
+ * inside `/repos/project`, and resolves symlinks so a link inside the root
+ * cannot point out of it.
+ *
+ * When either side does not exist, `realpathSync` throws and the normalized
+ * paths are compared instead. That loses nothing — a path that does not exist
+ * cannot be a symlink, and `resolve()` has already collapsed `..` — and it keeps
+ * containment usable for scope filtering, which legitimately runs against
+ * payload paths naming directories this machine no longer has.
+ */
+export declare function isRepoPathWithinRoot(candidate: string, root: string): boolean;
+/**
+ * The last check before `git -C <path>` runs. Requires the value to resolve to a
+ * real directory: a missing path, a dangling symlink, or a regular file is not a
+ * workspace. (Cursor's `metadata.workspace` is often the `state.vscdb` file
+ * itself, which git would only error on anyway.)
+ *
+ * Returns the canonical real path so `git` runs against exactly what was
+ * checked, narrowing the window between the check and the spawn.
+ */
+export declare function safeGitRepoPath(value: string | undefined | null): string | null;

package/dist/lib/repo-path-safety.js

@@ -0,0 +1,102 @@
+import { realpathSync, statSync } from "node:fs";
+import { isAbsolute, resolve, sep } from "node:path";
+import { isSafeSpawnPathArg } from "./spawn-arg-safety.js";
+/**
+ * Containment for untrusted filesystem paths that end up in `git -C <path>`.
+ *
+ * Every repo path this package resolves is untrusted text: Cursor's
+ * `workspace.json` `folder`, a composer's `workspaceIdentifier.uri.fsPath`, a
+ * hook's `workspace_roots[0]`, or a Claude transcript's `cwd`. None is validated
+ * by its producer — `fileUriToPath` (`readers/cursor.ts:189`) even passes a
+ * non-`file://` value straight through.
+ *
+ * `execFileSync` stops shell injection, but not `git -C ../../../elsewhere`: git
+ * would read that directory's `.git/config` and this package would ship the
+ * remote it found to the DB90 API. See DB90DV-547.
+ *
+ * Semantics are ported from `validatedRealPathWithinRoot`
+ * (`readers/cursor-sqlite.ts:23`), which already guards the Cursor SQLite
+ * reader the same way.
+ */
+function realPathOrNull(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalize an untrusted repo-path candidate. Pure — never touches the
+ * filesystem, so it is safe to call on every payload in a sync.
+ *
+ * Returns an absolute, `..`-collapsed path, or null when the value cannot be a
+ * legitimate workspace path. Rejecting relative values is deliberate: `git -C`
+ * would resolve a relative path against *this* process's cwd, which has nothing
+ * to do with where the value came from. It also rejects Cursor's literal
+ * `"unknown"` placeholder for global hook events.
+ */
+export function normalizeRepoPathCandidate(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    // Rejects empty, NUL-containing, and option-shaped values (DB90DV-546).
+    if (!isSafeSpawnPathArg(trimmed))
+        return null;
+    if (!isAbsolute(trimmed))
+        return null;
+    return resolve(trimmed);
+}
+/**
+ * True when `candidate` is `root` itself or lives beneath it.
+ *
+ * Compares with a trailing `sep` so `/repos/project-evil` is not treated as
+ * inside `/repos/project`, and resolves symlinks so a link inside the root
+ * cannot point out of it.
+ *
+ * When either side does not exist, `realpathSync` throws and the normalized
+ * paths are compared instead. That loses nothing — a path that does not exist
+ * cannot be a symlink, and `resolve()` has already collapsed `..` — and it keeps
+ * containment usable for scope filtering, which legitimately runs against
+ * payload paths naming directories this machine no longer has.
+ */
+export function isRepoPathWithinRoot(candidate, root) {
+    const normalizedCandidate = resolve(candidate);
+    const normalizedRoot = resolve(root);
+    const realCandidate = realPathOrNull(normalizedCandidate);
+    const realRoot = realPathOrNull(normalizedRoot);
+    // Compare like with like: mixing a realpath against a normalized path would
+    // false-negative on macOS, where /var is a symlink to /private/var.
+    const bothResolve = realCandidate !== null && realRoot !== null;
+    const left = bothResolve ? realCandidate : normalizedCandidate;
+    const right = bothResolve ? realRoot : normalizedRoot;
+    if (left === right)
+        return true;
+    const rootWithSep = right.endsWith(sep) ? right : `${right}${sep}`;
+    return left.startsWith(rootWithSep);
+}
+/**
+ * The last check before `git -C <path>` runs. Requires the value to resolve to a
+ * real directory: a missing path, a dangling symlink, or a regular file is not a
+ * workspace. (Cursor's `metadata.workspace` is often the `state.vscdb` file
+ * itself, which git would only error on anyway.)
+ *
+ * Returns the canonical real path so `git` runs against exactly what was
+ * checked, narrowing the window between the check and the spawn.
+ */
+export function safeGitRepoPath(value) {
+    const normalized = normalizeRepoPathCandidate(value);
+    if (normalized === null)
+        return null;
+    const real = realPathOrNull(normalized);
+    if (real === null)
+        return null;
+    try {
+        if (!statSync(real).isDirectory())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return real;
+}

package/dist/lib/spawn-arg-safety.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Guards for untrusted values that end up in the argv of a spawned process.
+ *
+ * `execFileSync` prevents *shell* injection but not *argv-option* injection: a
+ * value beginning with `-` is parsed by the child as a command-line option. Git
+ * remotes and workspace paths are untrusted text — they come from a repo the
+ * developer cloned, from Cursor's `workspace.json`, or from a Claude transcript
+ * — so every value derived from them must be checked before it reaches `git`
+ * or `ssh`. See DB90DV-546.
+ */
+/**
+ * True when `host` is safe to pass as an argv element to `ssh`. Accepts real
+ * hostnames, IPv4 literals, and `~/.ssh/config` host aliases.
+ */
+export declare function isSafeSshHost(host: string): boolean;
+/**
+ * True when `value` is safe to pass as a filesystem-path argv element (e.g.
+ * after `git -C`). Deliberately permissive about path *content* — real
+ * workspace paths contain spaces, dashes and drive letters. It only rejects
+ * what makes the child misread the value as an option, plus embedded NUL.
+ *
+ * This is an argv guard, not a containment check: verifying the path points
+ * somewhere legitimate is DB90DV-547.
+ */
+export declare function isSafeSpawnPathArg(value: string): boolean;

package/dist/lib/spawn-arg-safety.js

@@ -0,0 +1,49 @@
+/**
+ * Guards for untrusted values that end up in the argv of a spawned process.
+ *
+ * `execFileSync` prevents *shell* injection but not *argv-option* injection: a
+ * value beginning with `-` is parsed by the child as a command-line option. Git
+ * remotes and workspace paths are untrusted text — they come from a repo the
+ * developer cloned, from Cursor's `workspace.json`, or from a Claude transcript
+ * — so every value derived from them must be checked before it reaches `git`
+ * or `ssh`. See DB90DV-546.
+ */
+/** Longest legal DNS name (253) with headroom for an ssh_config alias. */
+const MAX_HOST_LENGTH = 255;
+/**
+ * Dot-separated labels of alphanumerics, `-` and `_`. A label may not start or
+ * end with `-`, which is what blocks option injection (`-oProxyCommand=…`).
+ * Whitespace, `=`, quotes, backslashes, newlines and NUL are all excluded.
+ * Underscores are allowed because `~/.ssh/config` aliases commonly use them.
+ * IPv6 literals are not covered — the SCP/`ssh://` host capture in
+ * `project-resolver.ts` cannot produce one, since it excludes `:`.
+ */
+const HOST_LABEL = "[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?";
+const HOST_PATTERN = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*$`);
+/**
+ * True when `host` is safe to pass as an argv element to `ssh`. Accepts real
+ * hostnames, IPv4 literals, and `~/.ssh/config` host aliases.
+ */
+export function isSafeSshHost(host) {
+    if (host.length === 0 || host.length > MAX_HOST_LENGTH)
+        return false;
+    return HOST_PATTERN.test(host);
+}
+/**
+ * True when `value` is safe to pass as a filesystem-path argv element (e.g.
+ * after `git -C`). Deliberately permissive about path *content* — real
+ * workspace paths contain spaces, dashes and drive letters. It only rejects
+ * what makes the child misread the value as an option, plus embedded NUL.
+ *
+ * This is an argv guard, not a containment check: verifying the path points
+ * somewhere legitimate is DB90DV-547.
+ */
+export function isSafeSpawnPathArg(value) {
+    if (value.length === 0)
+        return false;
+    if (value.startsWith("-"))
+        return false;
+    if (value.includes("\0"))
+        return false;
+    return true;
+}

package/dist/lib/transport-security.d.ts

@@ -9,5 +9,4 @@ export interface TransportSecurityOptions {
     allowInsecureHttp: boolean;
     label: string;
 }
-export declare function isLoopbackHost(hostname: string): boolean;
 export declare function evaluateTransportSecurity(rawUrl: string, options: TransportSecurityOptions): TransportSecurityResult;

package/dist/lib/transport-security.js

@@ -8,7 +8,7 @@ function isIpv4Loopback(hostname) {
         octet <= 255 &&
         String(octet) === parts[index]) && octets[0] === 127;
 }
-export function isLoopbackHost(hostname) {
+function isLoopbackHost(hostname) {
     const normalized = hostname.toLowerCase();
     return normalized === "localhost" ||
         normalized === "::1" ||

package/dist/readers/claude.d.ts

@@ -59,7 +59,13 @@ export interface ClaudeTranscriptTurn {
     toolUses: ClaudeCollectedToolUse[];
     navToolCalls: number;
     totalToolCalls: number;
-    messageIds: string[];
+    /**
+     * Fingerprint of the turn's content (prompt + assistant text + tool-use set).
+     * A turn keeps the same turnId as Claude appends more tool_use blocks to it,
+     * so sync compares this hash to detect appended derivatives and re-emit them
+     * instead of skipping the turn forever on its unchanged id (DB90DV-259).
+     */
+    contentHash: string;
 }
 /** Payload shape for the parent chat turn (carries full token cost). */
 export interface ClaudePayload extends IngestPayload {
@@ -90,7 +96,6 @@ export interface ClaudePayload extends IngestPayload {
         cost_model: "token_count";
         nav_tool_calls: number;
         total_tool_calls: number;
-        message_ids?: string[];
     };
 }
 /** Payload shape for derivative tool-use children (cost_usd: 0, no tokens). */