@aixle/insights 0.2.5-staging → 0.2.7-staging

package/README.md

@@ -102,7 +102,27 @@ After `init` succeeds:
 
 ## Multi-org
 
-If your account has several organization memberships, `init` mints ingest tokens for the **oldest** membership unless you scope to a different org:
+If your account belongs to a **single** organization, `init` binds that org automatically — no flag, zero friction.
+
+If your account belongs to **more than one** organization, `init` needs to know which org to bind. It resolves the target in this order:
+
+1. `--organization-id <uuid>` flag (or `DB90_ORGANIZATION_ID` env var), or
+2. your **Default Organization** preference from the web app.
+
+If neither is set, `init` **does not** guess. It prints the organizations you belong to and exits non-zero without saving credentials:
+
+```
+Multiple organizations found — choose one to bind this install:
+  - Acme Corp (b1e2...  ) — owner
+  - Contoso (c3d4...  ) — member
+Then either:
+  1. Re-run init with --organization-id <uuid> (completes device login again), or
+  2. Set a Default Organization in web Preferences, then re-run init.
+```
+
+Because credentials are only persisted on success, re-running `init` means completing the Keycloak device login again.
+
+To scope explicitly:
 
 ```bash
 npx -y @aixle/insights init \
@@ -111,7 +131,11 @@ npx -y @aixle/insights init \
   --organization-id <uuid>
 ```
 
-You can also set `DB90_ORGANIZATION_ID=<uuid>` in your shell environment, or pin it via `mcpServers.aixle-insights.env` in `~/.claude.json`. The CLI flag overrides the env var when both are set.
+You can also set `AIXLE_INSIGHTS_ORGANIZATION_ID=<uuid>` (or the deprecated `DB90_ORGANIZATION_ID`) in your shell environment, or pin it via `mcpServers.aixle-insights.env` in `~/.claude.json`. The CLI flag overrides the env var when both are set.
+
+Once `init` succeeds it reports the bound org (`Credentials saved (organization <uuid>).`), and `aixle-insights health` (or the `aixle_insights_status` MCP tool) shows the bound `organization_id`.
+
+> **Preferences caveat — this is non-obvious.** The web app's "current org" (the one you appear to be viewing) is normally the **last-used** org, remembered in your browser's `localStorage`. That is **not** the same as your **Default Organization** preference, which is what `init` reads. A multi-org user who has switched orgs in the UI but never explicitly set **Default Organization** in web Preferences has no server-side preference for `init` to use — so `init` will hit the org-selection error above until you either set the Default Organization preference or pass `--organization-id`.
 
 ## First run and backfill
 
@@ -129,7 +153,7 @@ If the MCP has been installed but never connected, `aixle-insights health` (or t
 | `aixle-insights run --once` | Perform one multi-tool sync, exit. Useful for cron / manual flushes. |
 | `aixle-insights run --once --full` | Backfill: ignore Cursor watermarks and commit-hash dedupe. |
 | `aixle-insights init` | Keycloak device login + persist credentials + merge `~/.claude.json` entry. |
-| `aixle-insights init --host <url>` | Use a DB90 API origin for token exchange. Remote hosts must use HTTPS; `http://localhost` and loopback addresses are allowed for local development. |
+| `aixle-insights init --host <url>` | Use an Aixle Insights API origin for token exchange. Remote hosts must use HTTPS; `http://localhost` and loopback addresses are allowed for local development. |
 | `aixle-insights init --insecure --host http://...` | Allow a remote plaintext HTTP host for a trusted non-production test endpoint. Prints a warning because tokens and telemetry can be exposed. |
 | `aixle-insights init --hooks --tool-name cursor` | Also install the Cursor-side hook forwarder (opt-in; requires Cursor restart). |
 | `aixle-insights uninstall-hooks` | Remove the hook forwarder + restore `~/.cursor/hooks.json` backup. |
@@ -140,15 +164,15 @@ If the MCP has been installed but never connected, `aixle-insights health` (or t
 
 | Variable | Purpose |
 |---|---|
-| `DB90_API_URL` | API origin for ingestion + MCP exchange (defaults to `http://localhost:3000`; `init --host` overrides). |
-| `KEYCLOAK_ISSUER` / `DB90_KEYCLOAK_ISSUER` | Realm issuer URLs (preferred on servers + CI). |
-| `DB90_KEYCLOAK_CLIENT_ID` | Defaults to `db90-web`; must allow device authorization in Keycloak. |
-| `DB90_ORGANIZATION_ID` | Optional UUID scoping `init` to that org membership (header `X-Organization-ID`). |
+| `AIXLE_INSIGHTS_API_URL` (deprecated: `DB90_API_URL`) | API origin for ingestion + MCP exchange (defaults to `http://localhost:3000`; `init --host` overrides). |
+| `KEYCLOAK_ISSUER` / `AIXLE_INSIGHTS_KEYCLOAK_ISSUER` (deprecated: `DB90_KEYCLOAK_ISSUER`) | Realm issuer URLs (`KEYCLOAK_ISSUER` is preferred on servers + CI). |
+| `AIXLE_INSIGHTS_KEYCLOAK_CLIENT_ID` (deprecated: `DB90_KEYCLOAK_CLIENT_ID`) | Defaults to `db90-web`; must allow device authorization in Keycloak. |
+| `AIXLE_INSIGHTS_ORGANIZATION_ID` (deprecated: `DB90_ORGANIZATION_ID`) | Optional UUID scoping `init` to that org membership (header `X-Organization-ID`). |
 | `AIXLE_INSIGHTS_HOME` | Override the local state directory (defaults to `~/.aixle-insights/`). |
 
 Remote API and ingest hosts must use `https://`. Plaintext `http://` is local-dev-only for `localhost`, `127.0.0.0/8`, and `[::1]`; those loopback URLs work without warnings. A remote `http://` host is rejected during `init` unless you pass `--insecure`, which should only be used for trusted non-production test endpoints and will print a warning because ingest tokens and telemetry can cross the network unencrypted.
 
-Note: the `DB90_*` variables above are retained as compatibility names for the deployment-side Keycloak realm/client identifiers. Future versions may rename them with a deprecation window.
+Note: the `DB90_*` variables above are deprecated aliases for the `AIXLE_INSIGHTS_*` names (branding rename, DB90DV-624). Both are honored indefinitely — the `AIXLE_INSIGHTS_*` name wins when both are set — but using a `DB90_*` name prints a one-line deprecation warning to stderr. There is no removal date yet; this table will be updated when one is set.
 
 Optional `~/.aixle-insights/config.json` accepts Cursor line-cost overrides (per-model rates):
 
@@ -217,7 +241,7 @@ reason. File contents, keychain payloads, and tokens are never logged.
 ## State + credentials
 
 - **App home directory**: `~/.aixle-insights/` (override with `AIXLE_INSIGHTS_HOME`).
-- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
+- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR`, or the deprecated `DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
 - **State files**: `state-<hostname>-<token-hash>.json` per credential, plus `state.lock` advisory lock, `mcp.log` rotating diagnostic log, optional `hooks-queue.ndjson`.
 
 ### Credential storage by OS
@@ -232,7 +256,7 @@ The secure store is the platform's native keychain, accessed via `keytar` (servi
 
 Notes:
 
-- **Windows**: don't set `DB90_MCP_DISABLE_KEYTAR` — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
+- **Windows**: don't set `AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR` (or the deprecated `DB90_MCP_DISABLE_KEYTAR`) — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
 - **Linux**: when no Secret Service is running (common in headless/CI/container contexts), the tool degrades to the `chmod 0600` fallback file **by design** — this is the one environment where the file path is routinely exercised, and POSIX permissions protect it there.
 - A stale `credentials.json` sitting alongside a populated keychain entry is logged as drift (`credentials_file_shadowed_by_keychain` in `mcp.log`) and ignored in favour of the keychain.
 
@@ -280,9 +304,9 @@ Three properties are worth relying on:
 
 | Symptom | Most likely cause | Fix |
 |---|---|---|
-| `Error: DB90 API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
-| `Blocked event send — DB90 ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
-| `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For DB90 staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
+| `Error: Aixle Insights API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
+| `Blocked event send — Aixle Insights ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
+| `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For Aixle Insights staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
 | `Failed to post event: HTTP 401 Unauthorized` repeated for every turn | Your saved ingest token has been rotated, revoked, or invalidated by a server redeploy. The ingest token is distinct from the Keycloak access token that `health` reports as `authenticated: true`. | Reset the keychain entry and re-run `init`: `security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"` then `rm -f ~/.aixle-insights/credentials.json` then `aixle-insights init --host ... --keycloak-url ...`. State files are **not** deleted, so already-sent sessions stay deduped. |
 | `health` shows `authenticated: true` but `last_result` is `sent: 0, failed: N` cycle after cycle | Same as the 401 row above. `authenticated` only proves the OIDC token was acquired, not that the ingest token still validates server-side. | Re-init as above. |
 | `last_result` reports `sent: N` but the Events UI shows nothing | The Temporal worker is not running. The ingest endpoint returns HTTP 202 (queued) regardless of worker state. | `make worker` (or check `docker ps` for `db90-worker`). See [LOCAL-DEV.md](./LOCAL-DEV.md) §1. |

package/dist/auth/credentials.js

@@ -5,13 +5,18 @@ import { join } from "node:path";
 import { getAppDir } from "../state.js";
 import { mcpLog } from "../log.js";
 import { describeReadFailure } from "../lib/parse-error.js";
+import { readBooleanEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 export const KEYTAR_SERVICE = "aixle-insights";
 const KEYTAR_ACCOUNT = "aixle-insights-ingest-credential";
 function credentialsPath(appDir) {
     return join(appDir, "credentials.json");
 }
 function keytarDisabled() {
-    return ["1", "true", "yes"].includes(process.env["DB90_MCP_DISABLE_KEYTAR"]?.toLowerCase() ?? "");
+    return readBooleanEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR",
+        deprecated: "DB90_MCP_DISABLE_KEYTAR",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
 }
 /** Returns true when at least one tool has a non-empty token. */
 export function credentialsHaveAnyToken(creds) {

package/dist/auth/exchange.d.ts

@@ -1,3 +1,12 @@
+export interface OrgOption {
+    id: string;
+    name: string;
+    role: string;
+}
+export declare class OrganizationSelectionRequiredError extends Error {
+    readonly organizations: OrgOption[];
+    constructor(message: string, organizations: OrgOption[]);
+}
 export interface ExchangeAccount {
     ingestToken: string;
 }

package/dist/auth/exchange.js

@@ -1,3 +1,11 @@
+export class OrganizationSelectionRequiredError extends Error {
+    organizations;
+    constructor(message, organizations) {
+        super(message);
+        this.name = "OrganizationSelectionRequiredError";
+        this.organizations = organizations;
+    }
+}
 export async function exchangeIngestToken(params) {
     const fetchFn = params.fetchImpl ?? fetch;
     const requestedTools = params.tools?.length ? [...params.tools] : params.toolName ? [params.toolName] : [];
@@ -35,21 +43,36 @@ export async function exchangeIngestToken(params) {
         json = JSON.parse(text);
     }
     catch {
-        throw new Error(`DB90 exchange: invalid JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
+        throw new Error(`Aixle Insights exchange: invalid JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
     }
     if (!res.ok) {
-        throw new Error(`DB90 exchange failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
+        const errBody = json;
+        if (errBody["error"] === "organization_selection_required") {
+            const rawOrgs = Array.isArray(errBody["organizations"]) ? errBody["organizations"] : [];
+            // Defensive: skip null/non-object elements so a malformed server body cannot crash init.
+            const orgs = rawOrgs
+                .filter((o) => typeof o === "object" && o !== null && !Array.isArray(o))
+                .filter((o) => typeof o["id"] === "string" && typeof o["name"] === "string")
+                .map((o) => ({
+                id: o["id"],
+                name: o["name"],
+                role: String(o["role"] ?? ""),
+            }));
+            const msg = typeof errBody["message"] === "string" ? errBody["message"] : "Organization selection required.";
+            throw new OrganizationSelectionRequiredError(msg, orgs);
+        }
+        throw new Error(`Aixle Insights exchange failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
     }
     const root = json;
     const data = root["data"];
     if (typeof data !== "object" || data === null) {
-        throw new Error("DB90 exchange: missing data object");
+        throw new Error("Aixle Insights exchange: missing data object");
     }
     const d = data;
     const ingestHost = d["ingestHost"];
     const organizationId = d["organizationId"];
     if (typeof ingestHost !== "string" || typeof organizationId !== "string") {
-        throw new Error("DB90 exchange: missing ingestHost or organizationId in data");
+        throw new Error("Aixle Insights exchange: missing ingestHost or organizationId in data");
     }
     const ingestTokenRaw = d["ingestToken"];
     const accountsRaw = d["accounts"];
@@ -73,7 +96,7 @@ export async function exchangeIngestToken(params) {
     }
     if (Object.keys(accounts).length === 0) {
         if (!ingestToken) {
-            throw new Error("DB90 exchange: no ingestToken / accounts returned in data");
+            throw new Error("Aixle Insights exchange: no ingestToken / accounts returned in data");
         }
         const fallbackTool = requestedTools.length === 1 ? requestedTools[0] : d["toolName"];
         const tid = fallbackTool === "cursor" ? "cursor" : "claude_code";
@@ -81,7 +104,7 @@ export async function exchangeIngestToken(params) {
     }
     const missingTools = requestedTools.filter((tool) => !accounts[tool]?.ingestToken);
     if (missingTools.length > 0) {
-        throw new Error(`DB90 exchange: missing requested account(s): ${missingTools.join(", ")}`);
+        throw new Error(`Aixle Insights exchange: missing requested account(s): ${missingTools.join(", ")}`);
     }
     return { ingestHost, organizationId, ingestToken, accounts };
 }

package/dist/auth/flow.d.ts

@@ -1,3 +1,4 @@
+import { type OrgOption } from "./exchange.js";
 import { defaultKeycloakClientId, defaultKeycloakIssuer } from "./keycloak.js";
 import type { TelemetryToolId } from "./credentials.js";
 export interface LoginAndPersistOptions {
@@ -29,5 +30,7 @@ export declare function loginAndPersistCredentials(opts: LoginAndPersistOptions)
 } | {
     ok: false;
     error: string;
+    code?: "organization_selection_required";
+    organizations?: OrgOption[];
 }>;
 export { defaultKeycloakIssuer, defaultKeycloakClientId };

package/dist/auth/flow.js

@@ -1,4 +1,4 @@
-import { exchangeIngestToken } from "./exchange.js";
+import { exchangeIngestToken, OrganizationSelectionRequiredError } from "./exchange.js";
 import { defaultKeycloakClientId, defaultKeycloakIssuer, obtainKeycloakAccessTokenViaDeviceFlow } from "./keycloak.js";
 import { loadCredentials, saveStoredCredentials } from "./credentials.js";
 import { getAppDir } from "../state.js";
@@ -69,7 +69,7 @@ export async function loginAndPersistCredentials(opts) {
         }
         const ingestHostSecurity = evaluateTransportSecurity(exchanged.ingestHost, {
             allowInsecureHttp: opts.allowInsecureHttp === true,
-            label: "DB90 ingest host",
+            label: "Aixle Insights ingest host",
         });
         if (!ingestHostSecurity.ok) {
             return { ok: false, error: ingestHostSecurity.error };
@@ -78,10 +78,11 @@ export async function loginAndPersistCredentials(opts) {
             opts.onSecurityWarning?.(ingestHostSecurity.warning);
         }
         const existing = await loadCredentials(appDir);
+        const sameOrg = existing?.host === exchanged.ingestHost && existing.organizationId === exchanged.organizationId;
         const stored = {
             host: exchanged.ingestHost,
             organizationId: exchanged.organizationId,
-            accounts: existing?.host === exchanged.ingestHost ? { ...existing.accounts } : {},
+            accounts: sameOrg ? { ...existing.accounts } : {},
             ...(opts.allowInsecureHttp === true ? { insecureHttpAllowed: true } : {}),
         };
         for (const tid of ["claude_code", "cursor"]) {
@@ -92,6 +93,14 @@ export async function loginAndPersistCredentials(opts) {
         await saveStoredCredentials(stored, appDir);
     }
     catch (e) {
+        if (e instanceof OrganizationSelectionRequiredError) {
+            return {
+                ok: false,
+                code: "organization_selection_required",
+                organizations: e.organizations,
+                error: e.message,
+            };
+        }
         return { ok: false, error: e instanceof Error ? e.message : String(e) };
     }
     return { ok: true, organizationId: exchanged.organizationId };

package/dist/auth/keycloak.js

@@ -3,6 +3,7 @@
  */
 import { createHash, randomBytes } from "node:crypto";
 import { isLoopbackHost } from "../lib/transport-security.js";
+import { readEnvWithDeprecatedAlias, readBooleanEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 function normalizeIssuer(issuer) {
     return issuer.replace(/\/$/, "");
 }
@@ -156,11 +157,18 @@ export async function obtainKeycloakAccessTokenViaDeviceFlow(params) {
     });
 }
 export function defaultKeycloakIssuer(ingestHost) {
-    const fromEnv = process.env["DB90_KEYCLOAK_ISSUER"]?.trim() ||
-        process.env["KEYCLOAK_ISSUER"]?.trim();
+    const fromEnv = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_KEYCLOAK_ISSUER",
+        deprecated: "DB90_KEYCLOAK_ISSUER",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    }) || process.env["KEYCLOAK_ISSUER"]?.trim();
     if (fromEnv)
         return fromEnv.replace(/\/$/, "");
-    const useLocalDefault = ["1", "true", "yes"].includes(process.env["DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT"]?.toLowerCase() ?? "");
+    const useLocalDefault = readBooleanEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_MCP_USE_LOCAL_KEYCLOAK_DEFAULT",
+        deprecated: "DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (useLocalDefault || process.env["NODE_ENV"] === "development") {
         if (ingestHost) {
             let hostname;
@@ -185,5 +193,9 @@ export function defaultKeycloakIssuer(ingestHost) {
     return "";
 }
 export function defaultKeycloakClientId() {
-    return process.env["DB90_KEYCLOAK_CLIENT_ID"]?.trim() || "db90-web";
+    return (readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_KEYCLOAK_CLIENT_ID",
+        deprecated: "DB90_KEYCLOAK_CLIENT_ID",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    }) || "db90-web");
 }

package/dist/cli.js

@@ -14,6 +14,7 @@ import { installClaudeUserMcp } from "./install/claude.js";
 import { installCursorUserMcp, uninstallCursorUserMcp } from "./install/cursor.js";
 import { installHooksConfig, uninstallHooksConfig, verifyHooksConfig, FORWARDER_FILENAME } from "./hooks/hooks-config.js";
 import { evaluateTransportSecurity } from "./lib/transport-security.js";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "./lib/env.js";
 import { join } from "node:path";
 import { fileURLToPath as nodeFileURLToPath } from "node:url";
 import { mcpLog } from "./log.js";
@@ -162,9 +163,9 @@ Usage:
 
 Commands:
   run                   Start the MCP stdio server (default — used by Claude Code).
-  init                  Keycloak device login once, then persist DB90 ingest credentials (keychain or file).
+  init                  Keycloak device login once, then persist Aixle Insights ingest credentials (keychain or file).
   health                Multi-line diagnostic (credentials, sync, log path, state files).
-  uninstall-hooks       Remove DB90 from ~/.cursor/hooks.json and restore backup (if any).
+  uninstall-hooks       Remove Aixle Insights from ~/.cursor/hooks.json and restore backup (if any).
   verify-hooks          Print hooks install status and queue depth as JSON.
   uninstall-cursor-mcp  Remove aixle-insights from ~/.cursor/mcp.json and restore backup (if any).
 
@@ -174,10 +175,10 @@ Options:
   --help, -h  Show this help message.
 
 init options:
-  --host <url>             DB90 API base URL (default: env DB90_API_URL or http://localhost:3000)
-  --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER)
+  --host <url>             Aixle Insights API base URL (default: env AIXLE_INSIGHTS_API_URL, or deprecated DB90_API_URL, or http://localhost:3000)
+  --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER, or AIXLE_INSIGHTS_KEYCLOAK_ISSUER / deprecated DB90_KEYCLOAK_ISSUER)
   --tool-name <name>       Optional: mint only \`claude_code\`, only \`cursor\`, or omit to mint BOTH.
-  --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env DB90_ORGANIZATION_ID).
+  --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env AIXLE_INSIGHTS_ORGANIZATION_ID / deprecated DB90_ORGANIZATION_ID).
   --force                  Re-run the device flow even if valid credentials already exist, and
                            replace an existing user "aixle-insights" MCP entry in ~/.claude.json if it differs.
   --hooks                  (opt-in) Install Cursor hook forwarder for per-turn model attribution.
@@ -185,7 +186,7 @@ init options:
   --insecure               Allow remote http:// hosts for trusted non-production test endpoints only.
 
 Multi-org:
-  Set \`DB90_ORGANIZATION_ID\` to a UUID, or pass \`--organization-id\` on \`init\`, so ingest tokens are minted for that membership instead of the default (oldest) org.
+  Set \`AIXLE_INSIGHTS_ORGANIZATION_ID\` (or deprecated \`DB90_ORGANIZATION_ID\`) to a UUID, or pass \`--organization-id\` on \`init\`, so ingest tokens are minted for that membership instead of the default (oldest) org.
 
 Credentials:
   Stored in the OS keychain via keytar when available; otherwise
@@ -195,7 +196,11 @@ Note: Omitting --tool-name provisions separate ingest tokens for Claude Code + C
 `);
 }
 function defaultApiHost() {
-    const v = process.env["DB90_API_URL"]?.trim();
+    const v = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_API_URL",
+        deprecated: "DB90_API_URL",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (v)
         return v.replace(/\/$/, "");
     return "http://localhost:3000";
@@ -222,7 +227,7 @@ export async function runInit(cliArgs, deps) {
     const apiHost = (cliArgs.host ?? defaultApiHost()).replace(/\/$/, "");
     const transportSecurity = evaluateTransportSecurity(apiHost, {
         allowInsecureHttp: cliArgs.insecure === true,
-        label: "DB90 API host",
+        label: "Aixle Insights API host",
     });
     if (!transportSecurity.ok) {
         runtime.error(`Error: ${transportSecurity.error}`);
@@ -231,7 +236,11 @@ export async function runInit(cliArgs, deps) {
     if (transportSecurity.warning) {
         runtime.error(`Warning: ${transportSecurity.warning}`);
     }
-    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer()).trim();
+    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer(apiHost)).trim();
+    if (!kcIssuer) {
+        runtime.error("Error: Keycloak issuer is not configured. Pass --keycloak-url or set KEYCLOAK_ISSUER / AIXLE_INSIGHTS_KEYCLOAK_ISSUER (or deprecated DB90_KEYCLOAK_ISSUER).");
+        return 1;
+    }
     if (cliArgs.toolName !== undefined && !["claude_code", "cursor"].includes(cliArgs.toolName)) {
         runtime.error("Error: --tool-name must be one of: claude_code, cursor.");
         return 1;
@@ -242,10 +251,14 @@ export async function runInit(cliArgs, deps) {
             ? ["claude_code"]
             : ["claude_code", "cursor"];
     const fromFlag = cliArgs.organizationId?.trim();
-    const fromEnv = process.env["DB90_ORGANIZATION_ID"]?.trim();
+    const fromEnv = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_ORGANIZATION_ID",
+        deprecated: "DB90_ORGANIZATION_ID",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     const exchangeOrganizationId = fromFlag || fromEnv;
     if (exchangeOrganizationId && !isValidOrganizationUuid(exchangeOrganizationId)) {
-        runtime.error("Error: --organization-id / DB90_ORGANIZATION_ID must be a valid UUID (RFC 4122, version 1–5, variant per DB90 API).");
+        runtime.error("Error: --organization-id / AIXLE_INSIGHTS_ORGANIZATION_ID (or deprecated DB90_ORGANIZATION_ID) must be a valid UUID (RFC 4122, version 1–5, variant per Aixle Insights API).");
         return 1;
     }
     const result = await runtime.loginAndPersistCredentials({
@@ -270,6 +283,19 @@ export async function runInit(cliArgs, deps) {
         },
     });
     if (!result.ok) {
+        if (result.code === "organization_selection_required") {
+            runtime.error(result.error);
+            if (result.organizations?.length) {
+                runtime.error("Multiple organizations found — choose one to bind this install:");
+                for (const o of result.organizations) {
+                    runtime.error(`  - ${o.name} (${o.id})${o.role ? ` — ${o.role}` : ""}`);
+                }
+            }
+            runtime.error("Then either:");
+            runtime.error("  1. Re-run init with --organization-id <uuid> (completes device login again), or");
+            runtime.error("  2. Set a Default Organization in web Preferences, then re-run init.");
+            return 1;
+        }
         runtime.error(`Auth failed: ${result.error}`);
         return 1;
     }
@@ -437,7 +463,7 @@ async function main() {
                 console.log(backupPath ? `Hooks uninstalled; hooks.json restored from ${backupPath}.` : "Hooks uninstalled; hooks.json removed.");
             }
             else {
-                console.log("No DB90 hooks entry found in ~/.cursor/hooks.json — nothing to uninstall.");
+                console.log("No Aixle Insights hooks entry found in ~/.cursor/hooks.json — nothing to uninstall.");
             }
             return;
         }

package/dist/health.d.ts

@@ -5,6 +5,7 @@ export interface HealthSnapshot {
     authenticated: boolean;
     configured: boolean;
     host: string | null;
+    organization_id: string | null;
     ingest_tools: TelemetryToolId[];
     app_dir: string;
     log_path: string;

package/dist/health.js

@@ -70,6 +70,7 @@ export async function buildHealthSnapshot() {
                 authenticated: false,
                 configured: false,
                 host: null,
+                organization_id: null,
                 ingest_tools: [],
                 app_dir: appDir,
                 log_path: logPath,
@@ -94,6 +95,7 @@ export async function buildHealthSnapshot() {
             authenticated: true,
             configured: true,
             host: creds.host,
+            organization_id: creds.organizationId ?? null,
             ingest_tools,
             app_dir: appDir,
             log_path: logPath,
@@ -114,6 +116,7 @@ export async function buildHealthSnapshot() {
             authenticated: false,
             configured: false,
             host: null,
+            organization_id: null,
             ingest_tools: [],
             app_dir: appDir,
             log_path: logPath,
@@ -150,6 +153,7 @@ export function healthSnapshotToStatusPayload(snapshot) {
         authenticated: snapshot.authenticated,
         configured: snapshot.configured,
         host: snapshot.host,
+        organization_id: snapshot.organization_id,
         ingest_tools: snapshot.ingest_tools,
         needs_init: needsInit,
         onboarding_message: onboardingMessage,
@@ -172,6 +176,7 @@ export function formatHealthForCli(snapshot) {
     lines.push(`authenticated: ${snapshot.authenticated}`);
     lines.push(`configured: ${snapshot.configured}`);
     lines.push(`host: ${snapshot.host ?? "(none)"}`);
+    lines.push(`organization_id: ${snapshot.organization_id ?? "(none)"}`);
     lines.push(`ingest_tools: ${snapshot.ingest_tools.length ? snapshot.ingest_tools.join(", ") : "(none)"}`);
     lines.push(`state_file_paths:`);
     if (snapshot.state_file_paths.length === 0) {

package/dist/install/claude.js

@@ -2,8 +2,13 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { randomBytes } from "node:crypto";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 export function defaultClaudeUserConfigPath() {
-    const override = process.env["DB90_CLAUDE_USER_CONFIG_PATH"]?.trim();
+    const override = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_CLAUDE_USER_CONFIG_PATH",
+        deprecated: "DB90_CLAUDE_USER_CONFIG_PATH",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (override)
         return override;
     return join(homedir(), ".claude.json");

package/dist/lib/client.js

@@ -13,7 +13,7 @@ import { evaluateTransportSecurity } from "./transport-security.js";
 export async function postEvent(payload, host, token, options = {}) {
     const transportSecurity = evaluateTransportSecurity(host, {
         allowInsecureHttp: options.allowInsecureHttp === true,
-        label: "DB90 ingest host",
+        label: "Aixle Insights ingest host",
     });
     if (!transportSecurity.ok) {
         // Deliberately does NOT call options.onNetworkError/onHttpError: the retry

package/dist/lib/env.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `DB90_*` env vars are deprecated aliases for the `AIXLE_INSIGHTS_*` names (branding rename,
+ * DB90DV-624). Both are honored indefinitely until a removal date is announced; the deprecated
+ * name only wins when the current name is unset, so setting both is safe.
+ */
+export interface EnvAliasOptions {
+    /** Preferred, currently-documented env var name. */
+    current: string;
+    /** Deprecated env var name, still honored as a fallback. */
+    deprecated: string;
+    onDeprecatedUse?: (deprecatedName: string, currentName: string) => void;
+}
+export declare function readEnvWithDeprecatedAlias(options: EnvAliasOptions): string | undefined;
+export declare function readBooleanEnvWithDeprecatedAlias(options: EnvAliasOptions): boolean;
+export declare function warnDeprecatedEnvVar(deprecatedName: string, currentName: string, log?: (message: string) => void): void;

package/dist/lib/env.js

@@ -0,0 +1,18 @@
+export function readEnvWithDeprecatedAlias(options) {
+    const currentValue = process.env[options.current]?.trim();
+    if (currentValue)
+        return currentValue;
+    const deprecatedValue = process.env[options.deprecated]?.trim();
+    if (deprecatedValue) {
+        options.onDeprecatedUse?.(options.deprecated, options.current);
+        return deprecatedValue;
+    }
+    return undefined;
+}
+export function readBooleanEnvWithDeprecatedAlias(options) {
+    const value = readEnvWithDeprecatedAlias(options);
+    return ["1", "true", "yes"].includes(value?.toLowerCase() ?? "");
+}
+export function warnDeprecatedEnvVar(deprecatedName, currentName, log = console.error) {
+    log(`Warning: ${deprecatedName} is deprecated; use ${currentName} instead.`);
+}

package/dist/lib/project-resolver.js

@@ -216,7 +216,7 @@ export async function enrichCommitProjectAttribution(payloads, options) {
 export async function lookupProjectByRemote(gitRemote, host, token, verbose, allowInsecureHttp = false) {
     const transportSecurity = evaluateTransportSecurity(host, {
         allowInsecureHttp,
-        label: "DB90 project-lookup host",
+        label: "Aixle Insights project-lookup host",
     });
     if (!transportSecurity.ok) {
         console.error(`Blocked project lookup — ${transportSecurity.error}`);

package/dist/readers/claude.d.ts

@@ -60,6 +60,13 @@ export interface ClaudeTranscriptTurn {
     navToolCalls: number;
     totalToolCalls: number;
     messageIds: string[];
+    /**
+     * Fingerprint of the turn's content (prompt + assistant text + tool-use set).
+     * A turn keeps the same turnId as Claude appends more tool_use blocks to it,
+     * so sync compares this hash to detect appended derivatives and re-emit them
+     * instead of skipping the turn forever on its unchanged id (DB90DV-259).
+     */
+    contentHash: string;
 }
 /** Payload shape for the parent chat turn (carries full token cost). */
 export interface ClaudePayload extends IngestPayload {

package/dist/readers/claude.js

@@ -1,4 +1,5 @@
 import { createReadStream, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { finished } from "node:stream/promises";
 import { createInterface } from "node:readline";
 import { join } from "node:path";
@@ -206,9 +207,29 @@ function newTurn(sessionId, turnIndex, filePath, fileSize, occurredAt, promptId)
         navToolCalls: 0,
         totalToolCalls: 0,
         messageIds: [],
+        contentHash: "",
         persisted: false,
     };
 }
+/**
+ * Stable fingerprint of a turn's emittable content. Includes the tool-use set
+ * (id + name + summary) so appending a tool_use to an already-synced turn
+ * changes the hash and triggers a re-emit (DB90DV-259).
+ */
+function computeTurnContentHash(turn) {
+    const toolFingerprint = turn.toolUses
+        .map((t) => `${t.id}:${t.eventType}:${t.summary}`)
+        .join("
");
+    const material = [
+        turn.model ?? "",
+        turn.tokensIn,
+        turn.tokensOut,
+        turn.promptText,
+        turn.assistantText,
+        toolFingerprint,
+    ].join("");
+    return createHash("sha256").update(material).digest("hex").slice(0, 32);
+}
 function appendText(existing, addition) {
     if (!addition.trim())
         return existing;
@@ -391,7 +412,10 @@ export async function parseTranscriptFile(filePath, verbose = false) {
         return turns;
     }
     flushCurrentTurn();
-    return finalizedTurns.map(({ persisted: _persisted, ...turn }) => turn);
+    return finalizedTurns.map(({ persisted: _persisted, ...turn }) => ({
+        ...turn,
+        contentHash: computeTurnContentHash(turn),
+    }));
 }
 /** Converts a Claude transcript turn to parent chat and derivative tool-use payloads. */
 export function mapTranscriptTurn(turn, options) {

package/dist/readers/cursor.js

@@ -717,6 +717,12 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
             if (texts.length === 0)
                 continue;
             if (entry.role === "user") {
+                // Normalize/filter before noting the time: a whitespace- or wrapper-only line
+                // must not set currentTurnOccurredAt (nor start a new turn) with nothing to append,
+                // otherwise the next real message inherits this stale timestamp.
+                const fragments = texts.map(stripUserQueryWrapper).filter((text) => text.length > 0);
+                if (fragments.length === 0)
+                    continue;
                 if (currentPromptParts.length > 0 || currentAssistantParts.length > 0) {
                     finalizeTurn();
                     currentPromptParts = [];

package/dist/server.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { getGitRemote, resolveProjectId } from "./lib/index.js";
 import { loadCredentials, credentialsHaveAnyToken, pickProjectLookupToken } from "./credentials.js";
 import { defaultKeycloakClientId, defaultKeycloakIssuer, startDeviceAuthorization } from "./auth/keycloak.js";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "./lib/env.js";
 import { migrateLegacyState, getAppDir } from "./state.js";
 import { syncTelemetryTools } from "./sync.js";
 import { DEFAULT_PRICING, mergePricing } from "./pricing.js";
@@ -143,13 +144,23 @@ async function syncNowHandler(input) {
         });
     }
 }
+function defaultIngestHost() {
+    const v = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_API_URL",
+        deprecated: "DB90_API_URL",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
+    if (v)
+        return v.replace(/\/$/, "");
+    return "http://localhost:3000";
+}
 async function authenticateHandler(args) {
     try {
-        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
+        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer(defaultIngestHost())).trim();
         if (!kc) {
             return jsonContent({
                 ok: false,
-                error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
+                error: "keycloakUrl or KEYCLOAK_ISSUER / AIXLE_INSIGHTS_KEYCLOAK_ISSUER (or deprecated DB90_KEYCLOAK_ISSUER) is required",
             });
         }
         const clientId = args.clientId?.trim() || defaultKeycloakClientId();
@@ -182,7 +193,7 @@ export function createAixleInsightsMcpServer() {
     const statusDescription = "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.";
     server.registerTool("aixle_insights_status", { description: statusDescription }, statusHandler);
     server.registerTool("db90_status", { description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_status") + statusDescription }, statusHandler);
-    const syncNowDescription = "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
+    const syncNowDescription = "Runs one Aixle Insights ingest sync cycle for enabled tools immediately (matches background cadence). " +
         "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).";
     server.registerTool("aixle_insights_sync_now", { description: syncNowDescription, inputSchema: SYNC_NOW_INPUT_SCHEMA }, syncNowHandler);
     server.registerTool("db90_sync_now", {

package/dist/sync.js

@@ -225,7 +225,11 @@ async function runClaudeSlice(options) {
         }
         const sKey = sessionStateKey(turn.turnId);
         const known = state.sessions[sKey];
-        if (known) {
+        // A turn keeps its turnId as Claude appends more tool_use blocks to it, so a
+        // plain "already known → skip" would drop derivatives appended after an earlier
+        // mid-turn sync. Skip only when the content fingerprint is unchanged; otherwise
+        // re-emit so the newly appended tool uses are sent (DB90DV-259).
+        if (known && known.contentHash && known.contentHash === turn.contentHash) {
             totalSkipped++;
             if (verbose) {
                 console.log(`[verbose] Skipping already-synced Claude turn ${turn.turnId}`);
@@ -282,6 +286,7 @@ async function runClaudeSlice(options) {
                 console.log(`[verbose] Sending Claude ${payload.event_type} ${payload.metadata.session_id}`);
             }
             const ok = await postEvent(payload, host, token, {
+                allowInsecureHttp,
                 on429: (retryAfter, quotaExceeded) => {
                     const currentBackoff = backoffUntilByCredential.get(backoffKey);
                     const nextBackoff = new Date(Math.max(currentBackoff?.getTime() ?? 0, Date.now() + retryAfter * 1000));
@@ -309,7 +314,7 @@ async function runClaudeSlice(options) {
         }
         if (allOk) {
             totalSent += payloads.length;
-            state = markSessionSent(state, sKey, turn.fileSize);
+            state = markSessionSent(state, sKey, turn.fileSize, turn.contentHash);
             writeState(state, appDir, host, token);
         }
         else if (shouldStopForBackoff) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aixle/insights",
-  "version": "0.2.5-staging",
+  "version": "0.2.7-staging",
   "description": "stdio MCP server for AI coding-assistant telemetry — Claude transcript sync + Cursor SQLite ingest.",
   "type": "module",
   "bin": {
@@ -66,6 +66,6 @@
     "eslint-plugin-security": "^4.0.1",
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.0"
+    "vitest": "4.1.9"
   }
 }