@aixle/insights 0.2.6-staging → 0.2.7-staging

package/README.md

@@ -131,7 +131,7 @@ npx -y @aixle/insights init \
   --organization-id <uuid>
 ```
 
-You can also set `DB90_ORGANIZATION_ID=<uuid>` in your shell environment, or pin it via `mcpServers.aixle-insights.env` in `~/.claude.json`. The CLI flag overrides the env var when both are set.
+You can also set `AIXLE_INSIGHTS_ORGANIZATION_ID=<uuid>` (or the deprecated `DB90_ORGANIZATION_ID`) in your shell environment, or pin it via `mcpServers.aixle-insights.env` in `~/.claude.json`. The CLI flag overrides the env var when both are set.
 
 Once `init` succeeds it reports the bound org (`Credentials saved (organization <uuid>).`), and `aixle-insights health` (or the `aixle_insights_status` MCP tool) shows the bound `organization_id`.
 
@@ -153,7 +153,7 @@ If the MCP has been installed but never connected, `aixle-insights health` (or t
 | `aixle-insights run --once` | Perform one multi-tool sync, exit. Useful for cron / manual flushes. |
 | `aixle-insights run --once --full` | Backfill: ignore Cursor watermarks and commit-hash dedupe. |
 | `aixle-insights init` | Keycloak device login + persist credentials + merge `~/.claude.json` entry. |
-| `aixle-insights init --host <url>` | Use a DB90 API origin for token exchange. Remote hosts must use HTTPS; `http://localhost` and loopback addresses are allowed for local development. |
+| `aixle-insights init --host <url>` | Use an Aixle Insights API origin for token exchange. Remote hosts must use HTTPS; `http://localhost` and loopback addresses are allowed for local development. |
 | `aixle-insights init --insecure --host http://...` | Allow a remote plaintext HTTP host for a trusted non-production test endpoint. Prints a warning because tokens and telemetry can be exposed. |
 | `aixle-insights init --hooks --tool-name cursor` | Also install the Cursor-side hook forwarder (opt-in; requires Cursor restart). |
 | `aixle-insights uninstall-hooks` | Remove the hook forwarder + restore `~/.cursor/hooks.json` backup. |
@@ -164,15 +164,15 @@ If the MCP has been installed but never connected, `aixle-insights health` (or t
 
 | Variable | Purpose |
 |---|---|
-| `DB90_API_URL` | API origin for ingestion + MCP exchange (defaults to `http://localhost:3000`; `init --host` overrides). |
-| `KEYCLOAK_ISSUER` / `DB90_KEYCLOAK_ISSUER` | Realm issuer URLs (preferred on servers + CI). |
-| `DB90_KEYCLOAK_CLIENT_ID` | Defaults to `db90-web`; must allow device authorization in Keycloak. |
-| `DB90_ORGANIZATION_ID` | Optional UUID scoping `init` to that org membership (header `X-Organization-ID`). |
+| `AIXLE_INSIGHTS_API_URL` (deprecated: `DB90_API_URL`) | API origin for ingestion + MCP exchange (defaults to `http://localhost:3000`; `init --host` overrides). |
+| `KEYCLOAK_ISSUER` / `AIXLE_INSIGHTS_KEYCLOAK_ISSUER` (deprecated: `DB90_KEYCLOAK_ISSUER`) | Realm issuer URLs (`KEYCLOAK_ISSUER` is preferred on servers + CI). |
+| `AIXLE_INSIGHTS_KEYCLOAK_CLIENT_ID` (deprecated: `DB90_KEYCLOAK_CLIENT_ID`) | Defaults to `db90-web`; must allow device authorization in Keycloak. |
+| `AIXLE_INSIGHTS_ORGANIZATION_ID` (deprecated: `DB90_ORGANIZATION_ID`) | Optional UUID scoping `init` to that org membership (header `X-Organization-ID`). |
 | `AIXLE_INSIGHTS_HOME` | Override the local state directory (defaults to `~/.aixle-insights/`). |
 
 Remote API and ingest hosts must use `https://`. Plaintext `http://` is local-dev-only for `localhost`, `127.0.0.0/8`, and `[::1]`; those loopback URLs work without warnings. A remote `http://` host is rejected during `init` unless you pass `--insecure`, which should only be used for trusted non-production test endpoints and will print a warning because ingest tokens and telemetry can cross the network unencrypted.
 
-Note: the `DB90_*` variables above are retained as compatibility names for the deployment-side Keycloak realm/client identifiers. Future versions may rename them with a deprecation window.
+Note: the `DB90_*` variables above are deprecated aliases for the `AIXLE_INSIGHTS_*` names (branding rename, DB90DV-624). Both are honored indefinitely — the `AIXLE_INSIGHTS_*` name wins when both are set — but using a `DB90_*` name prints a one-line deprecation warning to stderr. There is no removal date yet; this table will be updated when one is set.
 
 Optional `~/.aixle-insights/config.json` accepts Cursor line-cost overrides (per-model rates):
 
@@ -241,7 +241,7 @@ reason. File contents, keychain payloads, and tokens are never logged.
 ## State + credentials
 
 - **App home directory**: `~/.aixle-insights/` (override with `AIXLE_INSIGHTS_HOME`).
-- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
+- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR`, or the deprecated `DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
 - **State files**: `state-<hostname>-<token-hash>.json` per credential, plus `state.lock` advisory lock, `mcp.log` rotating diagnostic log, optional `hooks-queue.ndjson`.
 
 ### Credential storage by OS
@@ -256,7 +256,7 @@ The secure store is the platform's native keychain, accessed via `keytar` (servi
 
 Notes:
 
-- **Windows**: don't set `DB90_MCP_DISABLE_KEYTAR` — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
+- **Windows**: don't set `AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR` (or the deprecated `DB90_MCP_DISABLE_KEYTAR`) — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
 - **Linux**: when no Secret Service is running (common in headless/CI/container contexts), the tool degrades to the `chmod 0600` fallback file **by design** — this is the one environment where the file path is routinely exercised, and POSIX permissions protect it there.
 - A stale `credentials.json` sitting alongside a populated keychain entry is logged as drift (`credentials_file_shadowed_by_keychain` in `mcp.log`) and ignored in favour of the keychain.
 
@@ -304,9 +304,9 @@ Three properties are worth relying on:
 
 | Symptom | Most likely cause | Fix |
 |---|---|---|
-| `Error: DB90 API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
-| `Blocked event send — DB90 ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
-| `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For DB90 staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
+| `Error: Aixle Insights API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
+| `Blocked event send — Aixle Insights ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
+| `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For Aixle Insights staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
 | `Failed to post event: HTTP 401 Unauthorized` repeated for every turn | Your saved ingest token has been rotated, revoked, or invalidated by a server redeploy. The ingest token is distinct from the Keycloak access token that `health` reports as `authenticated: true`. | Reset the keychain entry and re-run `init`: `security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"` then `rm -f ~/.aixle-insights/credentials.json` then `aixle-insights init --host ... --keycloak-url ...`. State files are **not** deleted, so already-sent sessions stay deduped. |
 | `health` shows `authenticated: true` but `last_result` is `sent: 0, failed: N` cycle after cycle | Same as the 401 row above. `authenticated` only proves the OIDC token was acquired, not that the ingest token still validates server-side. | Re-init as above. |
 | `last_result` reports `sent: N` but the Events UI shows nothing | The Temporal worker is not running. The ingest endpoint returns HTTP 202 (queued) regardless of worker state. | `make worker` (or check `docker ps` for `db90-worker`). See [LOCAL-DEV.md](./LOCAL-DEV.md) §1. |

package/dist/auth/credentials.js

@@ -5,13 +5,18 @@ import { join } from "node:path";
 import { getAppDir } from "../state.js";
 import { mcpLog } from "../log.js";
 import { describeReadFailure } from "../lib/parse-error.js";
+import { readBooleanEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 export const KEYTAR_SERVICE = "aixle-insights";
 const KEYTAR_ACCOUNT = "aixle-insights-ingest-credential";
 function credentialsPath(appDir) {
     return join(appDir, "credentials.json");
 }
 function keytarDisabled() {
-    return ["1", "true", "yes"].includes(process.env["DB90_MCP_DISABLE_KEYTAR"]?.toLowerCase() ?? "");
+    return readBooleanEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR",
+        deprecated: "DB90_MCP_DISABLE_KEYTAR",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
 }
 /** Returns true when at least one tool has a non-empty token. */
 export function credentialsHaveAnyToken(creds) {

package/dist/auth/exchange.js

@@ -43,7 +43,7 @@ export async function exchangeIngestToken(params) {
         json = JSON.parse(text);
     }
     catch {
-        throw new Error(`DB90 exchange: invalid JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
+        throw new Error(`Aixle Insights exchange: invalid JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
     }
     if (!res.ok) {
         const errBody = json;
@@ -61,18 +61,18 @@ export async function exchangeIngestToken(params) {
             const msg = typeof errBody["message"] === "string" ? errBody["message"] : "Organization selection required.";
             throw new OrganizationSelectionRequiredError(msg, orgs);
         }
-        throw new Error(`DB90 exchange failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
+        throw new Error(`Aixle Insights exchange failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
     }
     const root = json;
     const data = root["data"];
     if (typeof data !== "object" || data === null) {
-        throw new Error("DB90 exchange: missing data object");
+        throw new Error("Aixle Insights exchange: missing data object");
     }
     const d = data;
     const ingestHost = d["ingestHost"];
     const organizationId = d["organizationId"];
     if (typeof ingestHost !== "string" || typeof organizationId !== "string") {
-        throw new Error("DB90 exchange: missing ingestHost or organizationId in data");
+        throw new Error("Aixle Insights exchange: missing ingestHost or organizationId in data");
     }
     const ingestTokenRaw = d["ingestToken"];
     const accountsRaw = d["accounts"];
@@ -96,7 +96,7 @@ export async function exchangeIngestToken(params) {
     }
     if (Object.keys(accounts).length === 0) {
         if (!ingestToken) {
-            throw new Error("DB90 exchange: no ingestToken / accounts returned in data");
+            throw new Error("Aixle Insights exchange: no ingestToken / accounts returned in data");
         }
         const fallbackTool = requestedTools.length === 1 ? requestedTools[0] : d["toolName"];
         const tid = fallbackTool === "cursor" ? "cursor" : "claude_code";
@@ -104,7 +104,7 @@ export async function exchangeIngestToken(params) {
     }
     const missingTools = requestedTools.filter((tool) => !accounts[tool]?.ingestToken);
     if (missingTools.length > 0) {
-        throw new Error(`DB90 exchange: missing requested account(s): ${missingTools.join(", ")}`);
+        throw new Error(`Aixle Insights exchange: missing requested account(s): ${missingTools.join(", ")}`);
     }
     return { ingestHost, organizationId, ingestToken, accounts };
 }

package/dist/auth/flow.js

@@ -69,7 +69,7 @@ export async function loginAndPersistCredentials(opts) {
         }
         const ingestHostSecurity = evaluateTransportSecurity(exchanged.ingestHost, {
             allowInsecureHttp: opts.allowInsecureHttp === true,
-            label: "DB90 ingest host",
+            label: "Aixle Insights ingest host",
         });
         if (!ingestHostSecurity.ok) {
             return { ok: false, error: ingestHostSecurity.error };

package/dist/auth/keycloak.js

@@ -3,6 +3,7 @@
  */
 import { createHash, randomBytes } from "node:crypto";
 import { isLoopbackHost } from "../lib/transport-security.js";
+import { readEnvWithDeprecatedAlias, readBooleanEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 function normalizeIssuer(issuer) {
     return issuer.replace(/\/$/, "");
 }
@@ -156,11 +157,18 @@ export async function obtainKeycloakAccessTokenViaDeviceFlow(params) {
     });
 }
 export function defaultKeycloakIssuer(ingestHost) {
-    const fromEnv = process.env["DB90_KEYCLOAK_ISSUER"]?.trim() ||
-        process.env["KEYCLOAK_ISSUER"]?.trim();
+    const fromEnv = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_KEYCLOAK_ISSUER",
+        deprecated: "DB90_KEYCLOAK_ISSUER",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    }) || process.env["KEYCLOAK_ISSUER"]?.trim();
     if (fromEnv)
         return fromEnv.replace(/\/$/, "");
-    const useLocalDefault = ["1", "true", "yes"].includes(process.env["DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT"]?.toLowerCase() ?? "");
+    const useLocalDefault = readBooleanEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_MCP_USE_LOCAL_KEYCLOAK_DEFAULT",
+        deprecated: "DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (useLocalDefault || process.env["NODE_ENV"] === "development") {
         if (ingestHost) {
             let hostname;
@@ -185,5 +193,9 @@ export function defaultKeycloakIssuer(ingestHost) {
     return "";
 }
 export function defaultKeycloakClientId() {
-    return process.env["DB90_KEYCLOAK_CLIENT_ID"]?.trim() || "db90-web";
+    return (readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_KEYCLOAK_CLIENT_ID",
+        deprecated: "DB90_KEYCLOAK_CLIENT_ID",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    }) || "db90-web");
 }

package/dist/cli.js

@@ -14,6 +14,7 @@ import { installClaudeUserMcp } from "./install/claude.js";
 import { installCursorUserMcp, uninstallCursorUserMcp } from "./install/cursor.js";
 import { installHooksConfig, uninstallHooksConfig, verifyHooksConfig, FORWARDER_FILENAME } from "./hooks/hooks-config.js";
 import { evaluateTransportSecurity } from "./lib/transport-security.js";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "./lib/env.js";
 import { join } from "node:path";
 import { fileURLToPath as nodeFileURLToPath } from "node:url";
 import { mcpLog } from "./log.js";
@@ -162,9 +163,9 @@ Usage:
 
 Commands:
   run                   Start the MCP stdio server (default — used by Claude Code).
-  init                  Keycloak device login once, then persist DB90 ingest credentials (keychain or file).
+  init                  Keycloak device login once, then persist Aixle Insights ingest credentials (keychain or file).
   health                Multi-line diagnostic (credentials, sync, log path, state files).
-  uninstall-hooks       Remove DB90 from ~/.cursor/hooks.json and restore backup (if any).
+  uninstall-hooks       Remove Aixle Insights from ~/.cursor/hooks.json and restore backup (if any).
   verify-hooks          Print hooks install status and queue depth as JSON.
   uninstall-cursor-mcp  Remove aixle-insights from ~/.cursor/mcp.json and restore backup (if any).
 
@@ -174,10 +175,10 @@ Options:
   --help, -h  Show this help message.
 
 init options:
-  --host <url>             DB90 API base URL (default: env DB90_API_URL or http://localhost:3000)
-  --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER)
+  --host <url>             Aixle Insights API base URL (default: env AIXLE_INSIGHTS_API_URL, or deprecated DB90_API_URL, or http://localhost:3000)
+  --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER, or AIXLE_INSIGHTS_KEYCLOAK_ISSUER / deprecated DB90_KEYCLOAK_ISSUER)
   --tool-name <name>       Optional: mint only \`claude_code\`, only \`cursor\`, or omit to mint BOTH.
-  --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env DB90_ORGANIZATION_ID).
+  --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env AIXLE_INSIGHTS_ORGANIZATION_ID / deprecated DB90_ORGANIZATION_ID).
   --force                  Re-run the device flow even if valid credentials already exist, and
                            replace an existing user "aixle-insights" MCP entry in ~/.claude.json if it differs.
   --hooks                  (opt-in) Install Cursor hook forwarder for per-turn model attribution.
@@ -185,9 +186,7 @@ init options:
   --insecure               Allow remote http:// hosts for trusted non-production test endpoints only.
 
 Multi-org:
-  If you belong to more than one org, pass \`--organization-id <uuid>\` (or set \`DB90_ORGANIZATION_ID\`),
-  or set a Default Organization in web Preferences. Without either, \`init\` lists your orgs and exits.
-  Single-org users need no flag. Run \`aixle-insights health\` to see the bound organization_id.
+  Set \`AIXLE_INSIGHTS_ORGANIZATION_ID\` (or deprecated \`DB90_ORGANIZATION_ID\`) to a UUID, or pass \`--organization-id\` on \`init\`, so ingest tokens are minted for that membership instead of the default (oldest) org.
 
 Credentials:
   Stored in the OS keychain via keytar when available; otherwise
@@ -197,7 +196,11 @@ Note: Omitting --tool-name provisions separate ingest tokens for Claude Code + C
 `);
 }
 function defaultApiHost() {
-    const v = process.env["DB90_API_URL"]?.trim();
+    const v = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_API_URL",
+        deprecated: "DB90_API_URL",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (v)
         return v.replace(/\/$/, "");
     return "http://localhost:3000";
@@ -224,7 +227,7 @@ export async function runInit(cliArgs, deps) {
     const apiHost = (cliArgs.host ?? defaultApiHost()).replace(/\/$/, "");
     const transportSecurity = evaluateTransportSecurity(apiHost, {
         allowInsecureHttp: cliArgs.insecure === true,
-        label: "DB90 API host",
+        label: "Aixle Insights API host",
     });
     if (!transportSecurity.ok) {
         runtime.error(`Error: ${transportSecurity.error}`);
@@ -233,7 +236,11 @@ export async function runInit(cliArgs, deps) {
     if (transportSecurity.warning) {
         runtime.error(`Warning: ${transportSecurity.warning}`);
     }
-    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer()).trim();
+    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer(apiHost)).trim();
+    if (!kcIssuer) {
+        runtime.error("Error: Keycloak issuer is not configured. Pass --keycloak-url or set KEYCLOAK_ISSUER / AIXLE_INSIGHTS_KEYCLOAK_ISSUER (or deprecated DB90_KEYCLOAK_ISSUER).");
+        return 1;
+    }
     if (cliArgs.toolName !== undefined && !["claude_code", "cursor"].includes(cliArgs.toolName)) {
         runtime.error("Error: --tool-name must be one of: claude_code, cursor.");
         return 1;
@@ -244,10 +251,14 @@ export async function runInit(cliArgs, deps) {
             ? ["claude_code"]
             : ["claude_code", "cursor"];
     const fromFlag = cliArgs.organizationId?.trim();
-    const fromEnv = process.env["DB90_ORGANIZATION_ID"]?.trim();
+    const fromEnv = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_ORGANIZATION_ID",
+        deprecated: "DB90_ORGANIZATION_ID",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     const exchangeOrganizationId = fromFlag || fromEnv;
     if (exchangeOrganizationId && !isValidOrganizationUuid(exchangeOrganizationId)) {
-        runtime.error("Error: --organization-id / DB90_ORGANIZATION_ID must be a valid UUID (RFC 4122, version 1–5, variant per DB90 API).");
+        runtime.error("Error: --organization-id / AIXLE_INSIGHTS_ORGANIZATION_ID (or deprecated DB90_ORGANIZATION_ID) must be a valid UUID (RFC 4122, version 1–5, variant per Aixle Insights API).");
         return 1;
     }
     const result = await runtime.loginAndPersistCredentials({
@@ -452,7 +463,7 @@ async function main() {
                 console.log(backupPath ? `Hooks uninstalled; hooks.json restored from ${backupPath}.` : "Hooks uninstalled; hooks.json removed.");
             }
             else {
-                console.log("No DB90 hooks entry found in ~/.cursor/hooks.json — nothing to uninstall.");
+                console.log("No Aixle Insights hooks entry found in ~/.cursor/hooks.json — nothing to uninstall.");
             }
             return;
         }

package/dist/install/claude.js

@@ -2,8 +2,13 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { randomBytes } from "node:crypto";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 export function defaultClaudeUserConfigPath() {
-    const override = process.env["DB90_CLAUDE_USER_CONFIG_PATH"]?.trim();
+    const override = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_CLAUDE_USER_CONFIG_PATH",
+        deprecated: "DB90_CLAUDE_USER_CONFIG_PATH",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (override)
         return override;
     return join(homedir(), ".claude.json");

package/dist/lib/client.js

@@ -13,7 +13,7 @@ import { evaluateTransportSecurity } from "./transport-security.js";
 export async function postEvent(payload, host, token, options = {}) {
     const transportSecurity = evaluateTransportSecurity(host, {
         allowInsecureHttp: options.allowInsecureHttp === true,
-        label: "DB90 ingest host",
+        label: "Aixle Insights ingest host",
     });
     if (!transportSecurity.ok) {
         // Deliberately does NOT call options.onNetworkError/onHttpError: the retry

package/dist/lib/env.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `DB90_*` env vars are deprecated aliases for the `AIXLE_INSIGHTS_*` names (branding rename,
+ * DB90DV-624). Both are honored indefinitely until a removal date is announced; the deprecated
+ * name only wins when the current name is unset, so setting both is safe.
+ */
+export interface EnvAliasOptions {
+    /** Preferred, currently-documented env var name. */
+    current: string;
+    /** Deprecated env var name, still honored as a fallback. */
+    deprecated: string;
+    onDeprecatedUse?: (deprecatedName: string, currentName: string) => void;
+}
+export declare function readEnvWithDeprecatedAlias(options: EnvAliasOptions): string | undefined;
+export declare function readBooleanEnvWithDeprecatedAlias(options: EnvAliasOptions): boolean;
+export declare function warnDeprecatedEnvVar(deprecatedName: string, currentName: string, log?: (message: string) => void): void;

package/dist/lib/env.js

@@ -0,0 +1,18 @@
+export function readEnvWithDeprecatedAlias(options) {
+    const currentValue = process.env[options.current]?.trim();
+    if (currentValue)
+        return currentValue;
+    const deprecatedValue = process.env[options.deprecated]?.trim();
+    if (deprecatedValue) {
+        options.onDeprecatedUse?.(options.deprecated, options.current);
+        return deprecatedValue;
+    }
+    return undefined;
+}
+export function readBooleanEnvWithDeprecatedAlias(options) {
+    const value = readEnvWithDeprecatedAlias(options);
+    return ["1", "true", "yes"].includes(value?.toLowerCase() ?? "");
+}
+export function warnDeprecatedEnvVar(deprecatedName, currentName, log = console.error) {
+    log(`Warning: ${deprecatedName} is deprecated; use ${currentName} instead.`);
+}

package/dist/lib/project-resolver.js

@@ -216,7 +216,7 @@ export async function enrichCommitProjectAttribution(payloads, options) {
 export async function lookupProjectByRemote(gitRemote, host, token, verbose, allowInsecureHttp = false) {
     const transportSecurity = evaluateTransportSecurity(host, {
         allowInsecureHttp,
-        label: "DB90 project-lookup host",
+        label: "Aixle Insights project-lookup host",
     });
     if (!transportSecurity.ok) {
         console.error(`Blocked project lookup — ${transportSecurity.error}`);

package/dist/readers/claude.d.ts

@@ -60,6 +60,13 @@ export interface ClaudeTranscriptTurn {
     navToolCalls: number;
     totalToolCalls: number;
     messageIds: string[];
+    /**
+     * Fingerprint of the turn's content (prompt + assistant text + tool-use set).
+     * A turn keeps the same turnId as Claude appends more tool_use blocks to it,
+     * so sync compares this hash to detect appended derivatives and re-emit them
+     * instead of skipping the turn forever on its unchanged id (DB90DV-259).
+     */
+    contentHash: string;
 }
 /** Payload shape for the parent chat turn (carries full token cost). */
 export interface ClaudePayload extends IngestPayload {

package/dist/readers/claude.js

@@ -1,4 +1,5 @@
 import { createReadStream, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { finished } from "node:stream/promises";
 import { createInterface } from "node:readline";
 import { join } from "node:path";
@@ -206,9 +207,29 @@ function newTurn(sessionId, turnIndex, filePath, fileSize, occurredAt, promptId)
         navToolCalls: 0,
         totalToolCalls: 0,
         messageIds: [],
+        contentHash: "",
         persisted: false,
     };
 }
+/**
+ * Stable fingerprint of a turn's emittable content. Includes the tool-use set
+ * (id + name + summary) so appending a tool_use to an already-synced turn
+ * changes the hash and triggers a re-emit (DB90DV-259).
+ */
+function computeTurnContentHash(turn) {
+    const toolFingerprint = turn.toolUses
+        .map((t) => `${t.id}:${t.eventType}:${t.summary}`)
+        .join("
");
+    const material = [
+        turn.model ?? "",
+        turn.tokensIn,
+        turn.tokensOut,
+        turn.promptText,
+        turn.assistantText,
+        toolFingerprint,
+    ].join("");
+    return createHash("sha256").update(material).digest("hex").slice(0, 32);
+}
 function appendText(existing, addition) {
     if (!addition.trim())
         return existing;
@@ -391,7 +412,10 @@ export async function parseTranscriptFile(filePath, verbose = false) {
         return turns;
     }
     flushCurrentTurn();
-    return finalizedTurns.map(({ persisted: _persisted, ...turn }) => turn);
+    return finalizedTurns.map(({ persisted: _persisted, ...turn }) => ({
+        ...turn,
+        contentHash: computeTurnContentHash(turn),
+    }));
 }
 /** Converts a Claude transcript turn to parent chat and derivative tool-use payloads. */
 export function mapTranscriptTurn(turn, options) {

package/dist/readers/cursor.js

@@ -717,6 +717,12 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
             if (texts.length === 0)
                 continue;
             if (entry.role === "user") {
+                // Normalize/filter before noting the time: a whitespace- or wrapper-only line
+                // must not set currentTurnOccurredAt (nor start a new turn) with nothing to append,
+                // otherwise the next real message inherits this stale timestamp.
+                const fragments = texts.map(stripUserQueryWrapper).filter((text) => text.length > 0);
+                if (fragments.length === 0)
+                    continue;
                 if (currentPromptParts.length > 0 || currentAssistantParts.length > 0) {
                     finalizeTurn();
                     currentPromptParts = [];

package/dist/server.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { getGitRemote, resolveProjectId } from "./lib/index.js";
 import { loadCredentials, credentialsHaveAnyToken, pickProjectLookupToken } from "./credentials.js";
 import { defaultKeycloakClientId, defaultKeycloakIssuer, startDeviceAuthorization } from "./auth/keycloak.js";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "./lib/env.js";
 import { migrateLegacyState, getAppDir } from "./state.js";
 import { syncTelemetryTools } from "./sync.js";
 import { DEFAULT_PRICING, mergePricing } from "./pricing.js";
@@ -143,13 +144,23 @@ async function syncNowHandler(input) {
         });
     }
 }
+function defaultIngestHost() {
+    const v = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_API_URL",
+        deprecated: "DB90_API_URL",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
+    if (v)
+        return v.replace(/\/$/, "");
+    return "http://localhost:3000";
+}
 async function authenticateHandler(args) {
     try {
-        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
+        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer(defaultIngestHost())).trim();
         if (!kc) {
             return jsonContent({
                 ok: false,
-                error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
+                error: "keycloakUrl or KEYCLOAK_ISSUER / AIXLE_INSIGHTS_KEYCLOAK_ISSUER (or deprecated DB90_KEYCLOAK_ISSUER) is required",
             });
         }
         const clientId = args.clientId?.trim() || defaultKeycloakClientId();
@@ -182,7 +193,7 @@ export function createAixleInsightsMcpServer() {
     const statusDescription = "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.";
     server.registerTool("aixle_insights_status", { description: statusDescription }, statusHandler);
     server.registerTool("db90_status", { description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_status") + statusDescription }, statusHandler);
-    const syncNowDescription = "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
+    const syncNowDescription = "Runs one Aixle Insights ingest sync cycle for enabled tools immediately (matches background cadence). " +
         "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).";
     server.registerTool("aixle_insights_sync_now", { description: syncNowDescription, inputSchema: SYNC_NOW_INPUT_SCHEMA }, syncNowHandler);
     server.registerTool("db90_sync_now", {

package/dist/sync.js

@@ -225,7 +225,11 @@ async function runClaudeSlice(options) {
         }
         const sKey = sessionStateKey(turn.turnId);
         const known = state.sessions[sKey];
-        if (known) {
+        // A turn keeps its turnId as Claude appends more tool_use blocks to it, so a
+        // plain "already known → skip" would drop derivatives appended after an earlier
+        // mid-turn sync. Skip only when the content fingerprint is unchanged; otherwise
+        // re-emit so the newly appended tool uses are sent (DB90DV-259).
+        if (known && known.contentHash && known.contentHash === turn.contentHash) {
             totalSkipped++;
             if (verbose) {
                 console.log(`[verbose] Skipping already-synced Claude turn ${turn.turnId}`);
@@ -282,6 +286,7 @@ async function runClaudeSlice(options) {
                 console.log(`[verbose] Sending Claude ${payload.event_type} ${payload.metadata.session_id}`);
             }
             const ok = await postEvent(payload, host, token, {
+                allowInsecureHttp,
                 on429: (retryAfter, quotaExceeded) => {
                     const currentBackoff = backoffUntilByCredential.get(backoffKey);
                     const nextBackoff = new Date(Math.max(currentBackoff?.getTime() ?? 0, Date.now() + retryAfter * 1000));
@@ -309,7 +314,7 @@ async function runClaudeSlice(options) {
         }
         if (allOk) {
             totalSent += payloads.length;
-            state = markSessionSent(state, sKey, turn.fileSize);
+            state = markSessionSent(state, sKey, turn.fileSize, turn.contentHash);
             writeState(state, appDir, host, token);
         }
         else if (shouldStopForBackoff) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aixle/insights",
-  "version": "0.2.6-staging",
+  "version": "0.2.7-staging",
   "description": "stdio MCP server for AI coding-assistant telemetry — Claude transcript sync + Cursor SQLite ingest.",
   "type": "module",
   "bin": {
@@ -66,6 +66,6 @@
     "eslint-plugin-security": "^4.0.1",
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.0"
+    "vitest": "4.1.9"
   }
 }