@aixle/insights 0.2.6-staging → 0.2.8-staging

package/README.md

@@ -13,7 +13,7 @@ Two channels are published. Pick one deliberately — they are **not** interchan
 | | Production | Staging (QA) |
 |---|---|---|
 | Install | `npm i -g @aixle/insights` | `npm i -g @aixle/insights@staging` |
-| Version looks like | `0.2.0` | `0.2.1-staging` |
+| Version looks like | `0.2.1` | `0.2.6-staging` |
 | Points at | the production API | the staging API |
 | Who should use it | **everyone** | QA validating unreleased work |
 | Stability | released, supported | may change or break without notice |
@@ -28,7 +28,7 @@ npx -y @aixle/insights init \
 
 # Or global install:
 npm i -g @aixle/insights
-aixle-insights --version    # e.g. 0.2.0  (no suffix)
+npm ls -g @aixle/insights   # e.g. @aixle/insights@0.2.1  (no suffix)
 ```
 
 ### Staging — QA only
@@ -44,7 +44,7 @@ npx -y @aixle/insights@staging init \
 
 # Or global install:
 npm i -g @aixle/insights@staging
-aixle-insights --version    # e.g. 0.2.1-staging  (note the suffix)
+npm ls -g @aixle/insights   # e.g. @aixle/insights@0.2.6-staging  (note the suffix)
 ```
 
 Point a staging build at the **staging** API host. Sending staging telemetry to production
@@ -53,14 +53,14 @@ pollutes production analytics.
 ### Which one do I have?
 
 ```bash
-aixle-insights --version                 # a -staging suffix means a QA build
+npm ls -g @aixle/insights                # a -staging suffix means a QA build
 npm view @aixle/insights dist-tags       # what each channel currently resolves to
 ```
 
 Expected output — `latest` and `staging` move independently:
 
 ```
-{ latest: '0.2.0', staging: '0.2.1-staging' }
+{ latest: '0.2.1', staging: '0.2.6-staging' }
 ```
 
 ### Switching back to production
@@ -73,8 +73,8 @@ Then re-run `init` against the production host, since credentials and the MCP en
 per-host.
 
 > **Why `npm install` never surprises you with a staging build:** `-staging` versions are semver
-> prereleases, and no ordinary version range resolves to a prerelease. `*`, `^0.2.0`, `~0.2.0`
-> and `>=0.1.0` all select `0.2.0` even when `0.2.1-staging` exists. Staging builds are
+> prereleases, and no ordinary version range resolves to a prerelease. `*`, `^0.2.1`, `~0.2.1`
+> and `>=0.1.0` all select `0.2.1` even when `0.2.6-staging` exists. Staging builds are
 > reachable only by exact version or the `staging` dist-tag.
 
 Maintainers: see [`../RELEASING.md`](../RELEASING.md) for how each channel is cut.
@@ -131,12 +131,51 @@ npx -y @aixle/insights init \
   --organization-id <uuid>
 ```
 
-You can also set `DB90_ORGANIZATION_ID=<uuid>` in your shell environment, or pin it via `mcpServers.aixle-insights.env` in `~/.claude.json`. The CLI flag overrides the env var when both are set.
+You can also set `AIXLE_INSIGHTS_ORGANIZATION_ID=<uuid>` (or the deprecated `DB90_ORGANIZATION_ID`) in your shell environment, or pin it via `mcpServers.aixle-insights.env` in `~/.claude.json`. The CLI flag overrides the env var when both are set.
 
 Once `init` succeeds it reports the bound org (`Credentials saved (organization <uuid>).`), and `aixle-insights health` (or the `aixle_insights_status` MCP tool) shows the bound `organization_id`.
 
 > **Preferences caveat — this is non-obvious.** The web app's "current org" (the one you appear to be viewing) is normally the **last-used** org, remembered in your browser's `localStorage`. That is **not** the same as your **Default Organization** preference, which is what `init` reads. A multi-org user who has switched orgs in the UI but never explicitly set **Default Organization** in web Preferences has no server-side preference for `init` to use — so `init` will hit the org-selection error above until you either set the Default Organization preference or pass `--organization-id`.
 
+## Cursor hooks (optional)
+
+**Claude Code needs nothing beyond `init`** — the MCP transcript reader already captures model, token counts (including cache tokens), prompt and assistant text, risk scan, and tool uses.
+
+Cursor is different: its local store does not reliably record *which model* answered a turn, so events can land with `model: "unknown"`. Two things address it — the automatic `state.vscdb` fallback (DB90DV-540), and this opt-in hook forwarder for per-turn attribution captured as it happens:
+
+```bash
+npx -y @aixle/insights init --hooks --tool-name cursor --host <host> --keycloak-url <realm>
+
+aixle-insights verify-hooks     # JSON: installed? queue depth?
+aixle-insights uninstall-hooks  # remove, restoring the ~/.cursor/hooks.json backup
+```
+
+**Restart Cursor afterwards** — hooks are read at launch. The forwarder appends redacted payloads to `~/.aixle-insights/hooks-queue.ndjson`, which the next sync drains, so events arrive on the normal cycle rather than instantly.
+
+> Editor-level hooks (`~/.claude/settings.json` `PostToolUse` / `Stop`) are a **fallback for environments that cannot run an MCP server**, not an upgrade. They carry no model, token, or cost data, so the MCP path is strictly better wherever it is available.
+
+## Ingest tokens and rotation
+
+`init` mints an ingest token per tool — distinct from your Keycloak login — and stores it in the **OS keychain** (service `aixle-insights`), falling back to `~/.aixle-insights/credentials.json` at mode 0600 where no keychain is available. Tokens are `aixle_<64 hex>` and the server retains only a SHA-256 hash, so a token cannot be recovered after `init`; losing it means re-running `init`.
+
+You never need to paste a token for the MCP path — `init` obtains its own.
+
+> **Rotation policy: TBD.** There is no self-service rotation command and no documented expiry or cadence. Placeholders until an owner defines them:
+>
+> | | Placeholder |
+> |---|---|
+> | Token lifetime | _undefined — tokens do not self-expire today_ |
+> | Rotation cadence | _TBD_ |
+> | Who can revoke | _TBD — no CLI path; server-side only_ |
+
+**If a token is revoked, rotated server-side, or invalidated by a redeploy**, every sync fails with `HTTP 401` while `health` still reports `authenticated: true` — that flag only covers the OIDC login. Clear the stored credential and re-run `init`; state files are preserved, so already-sent sessions stay deduped:
+
+```bash
+security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"  # macOS
+rm -f ~/.aixle-insights/credentials.json
+# then re-run init
+```
+
 ## First run and backfill
 
 Before you run `init`, the MCP server is a deliberate no-op: it does not read, buffer, or send anything, and it does not create any state files. Nothing is lost during this window — Claude Code's transcripts and Cursor's local telemetry stores are unaffected by whether `@aixle/insights` is watching them.
@@ -145,6 +184,49 @@ The moment `init` succeeds, this package's per-credential state starts from empt
 
 If the MCP has been installed but never connected, `aixle-insights health` (or the `status` MCP tool) reports `needs_init: true` with a human-readable `onboarding_message` explaining exactly this — install-but-uninitialized is not a state you need to worry about losing data in.
 
+Once `init` succeeds it reports the bound org (`Credentials saved (organization <uuid>).`), and `aixle-insights health` (or the `aixle_insights_status` MCP tool) shows the bound `organization_id`.
+
+> **Preferences caveat — this is non-obvious.** The web app's "current org" (the one you appear to be viewing) is normally the **last-used** org, remembered in your browser's `localStorage`. That is **not** the same as your **Default Organization** preference, which is what `init` reads. A multi-org user who has switched orgs in the UI but never explicitly set **Default Organization** in web Preferences has no server-side preference for `init` to use — so `init` will hit the org-selection error above until you either set the Default Organization preference or pass `--organization-id`.
+
+## Cursor hooks (optional)
+
+**Claude Code needs nothing beyond `init`** — the MCP transcript reader already captures model, token counts (including cache tokens), prompt and assistant text, risk scan, and tool uses.
+
+Cursor is different: its local store does not reliably record *which model* answered a turn, so events can land with `model: "unknown"`. Two things address it — the automatic `state.vscdb` fallback (DB90DV-540), and this opt-in hook forwarder for per-turn attribution captured as it happens:
+
+```bash
+npx -y @aixle/insights init --hooks --tool-name cursor --host <host> --keycloak-url <realm>
+
+aixle-insights verify-hooks     # JSON: installed? queue depth?
+aixle-insights uninstall-hooks  # remove, restoring the ~/.cursor/hooks.json backup
+```
+
+**Restart Cursor afterwards** — hooks are read at launch. The forwarder appends redacted payloads to `~/.aixle-insights/hooks-queue.ndjson`, which the next sync drains, so events arrive on the normal cycle rather than instantly.
+
+> Editor-level hooks (`~/.claude/settings.json` `PostToolUse` / `Stop`) are a **fallback for environments that cannot run an MCP server**, not an upgrade. They carry no model, token, or cost data, so the MCP path is strictly better wherever it is available.
+
+## Ingest tokens and rotation
+
+`init` mints an ingest token per tool — distinct from your Keycloak login — and stores it in the **OS keychain** (service `aixle-insights`), falling back to `~/.aixle-insights/credentials.json` at mode 0600 where no keychain is available. Tokens are `aixle_<64 hex>` and the server retains only a SHA-256 hash, so a token cannot be recovered after `init`; losing it means re-running `init`.
+
+You never need to paste a token for the MCP path — `init` obtains its own.
+
+> **Rotation policy: TBD.** There is no self-service rotation command and no documented expiry or cadence. Placeholders until an owner defines them:
+>
+> | | Placeholder |
+> |---|---|
+> | Token lifetime | _undefined — tokens do not self-expire today_ |
+> | Rotation cadence | _TBD_ |
+> | Who can revoke | _TBD — no CLI path; server-side only_ |
+
+**If a token is revoked, rotated server-side, or invalidated by a redeploy**, every sync fails with `HTTP 401` while `health` still reports `authenticated: true` — that flag only covers the OIDC login. Clear the stored credential and re-run `init`; state files are preserved, so already-sent sessions stay deduped:
+
+```bash
+security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"  # macOS
+rm -f ~/.aixle-insights/credentials.json
+# then re-run init
+```
+
 ## Commands
 
 | Command | What it does |
@@ -153,10 +235,13 @@ If the MCP has been installed but never connected, `aixle-insights health` (or t
 | `aixle-insights run --once` | Perform one multi-tool sync, exit. Useful for cron / manual flushes. |
 | `aixle-insights run --once --full` | Backfill: ignore Cursor watermarks and commit-hash dedupe. |
 | `aixle-insights init` | Keycloak device login + persist credentials + merge `~/.claude.json` entry. |
-| `aixle-insights init --host <url>` | Use a DB90 API origin for token exchange. Remote hosts must use HTTPS; `http://localhost` and loopback addresses are allowed for local development. |
+| `aixle-insights init --host <url>` | Use an Aixle Insights API origin for token exchange. Remote hosts must use HTTPS; `http://localhost` and loopback addresses are allowed for local development. |
 | `aixle-insights init --insecure --host http://...` | Allow a remote plaintext HTTP host for a trusted non-production test endpoint. Prints a warning because tokens and telemetry can be exposed. |
 | `aixle-insights init --hooks --tool-name cursor` | Also install the Cursor-side hook forwarder (opt-in; requires Cursor restart). |
+| `aixle-insights init --force` | Re-run `init` even when credentials already exist — re-mints ingest tokens and re-writes the MCP entry. Use after changing host, org, or realm. |
+| `aixle-insights init --tool-name <tool>` | Scope `init` to a single connector. **Omit it** so one login covers both Claude Code and Cursor. |
 | `aixle-insights uninstall-hooks` | Remove the hook forwarder + restore `~/.cursor/hooks.json` backup. |
+| `aixle-insights uninstall-cursor-mcp` | Remove (or restore from backup) only the aixle-insights entry in `~/.cursor/mcp.json`, leaving sibling MCP servers untouched. |
 | `aixle-insights verify-hooks` | Print hooks install status + queue depth as JSON. |
 | `aixle-insights health` | Multi-line diagnostic (credentials, sync, log path, state files). |
 
@@ -164,15 +249,20 @@ If the MCP has been installed but never connected, `aixle-insights health` (or t
 
 | Variable | Purpose |
 |---|---|
-| `DB90_API_URL` | API origin for ingestion + MCP exchange (defaults to `http://localhost:3000`; `init --host` overrides). |
-| `KEYCLOAK_ISSUER` / `DB90_KEYCLOAK_ISSUER` | Realm issuer URLs (preferred on servers + CI). |
-| `DB90_KEYCLOAK_CLIENT_ID` | Defaults to `db90-web`; must allow device authorization in Keycloak. |
-| `DB90_ORGANIZATION_ID` | Optional UUID scoping `init` to that org membership (header `X-Organization-ID`). |
+| `AIXLE_INSIGHTS_API_URL` (deprecated: `DB90_API_URL`) | API origin for ingestion + MCP exchange (defaults to `http://localhost:3000`; `init --host` overrides). |
+| `KEYCLOAK_ISSUER` / `AIXLE_INSIGHTS_KEYCLOAK_ISSUER` (deprecated: `DB90_KEYCLOAK_ISSUER`) | Realm issuer URLs (`KEYCLOAK_ISSUER` is preferred on servers + CI). |
+| `KEYCLOAK_CLIENT_ID` / `AIXLE_INSIGHTS_KEYCLOAK_CLIENT_ID` (deprecated: `DB90_KEYCLOAK_CLIENT_ID`) | Defaults to `aixle-insights-web`; must allow device authorization in Keycloak. |
+| `AIXLE_INSIGHTS_ORGANIZATION_ID` (deprecated: `DB90_ORGANIZATION_ID`) | Optional UUID scoping `init` to that org membership (header `X-Organization-ID`). |
 | `AIXLE_INSIGHTS_HOME` | Override the local state directory (defaults to `~/.aixle-insights/`). |
+| `AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR` (deprecated: `DB90_MCP_DISABLE_KEYTAR`) | Set to skip the OS keychain entirely and use the `credentials.json` fallback. Useful on headless Linux/CI/Docker where Secret Service is absent. |
+| `AIXLE_INSIGHTS_MCP_USE_LOCAL_KEYCLOAK_DEFAULT` (deprecated: `DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT`) | Default the Keycloak issuer to the local stack (`http://localhost:8080/realms/db90`) so `--keycloak-url` can be omitted during local development. |
+| `AIXLE_INSIGHTS_CLAUDE_USER_CONFIG_PATH` (deprecated: `DB90_CLAUDE_USER_CONFIG_PATH`) | Override the path to `~/.claude.json` that `init` merges the MCP entry into. Primarily a test seam; also lets you target a non-default Claude Code profile. |
+
+Also read, but not intended as user-facing configuration: `APPDATA` and `XDG_CONFIG_HOME` (platform config-directory discovery) and `NODE_ENV`.
 
 Remote API and ingest hosts must use `https://`. Plaintext `http://` is local-dev-only for `localhost`, `127.0.0.0/8`, and `[::1]`; those loopback URLs work without warnings. A remote `http://` host is rejected during `init` unless you pass `--insecure`, which should only be used for trusted non-production test endpoints and will print a warning because ingest tokens and telemetry can cross the network unencrypted.
 
-Note: the `DB90_*` variables above are retained as compatibility names for the deployment-side Keycloak realm/client identifiers. Future versions may rename them with a deprecation window.
+Note: the `DB90_*` variables above are deprecated aliases for the `AIXLE_INSIGHTS_*` names (branding rename, DB90DV-624). Both are honored indefinitely — the `AIXLE_INSIGHTS_*` name wins when both are set — but using a `DB90_*` name prints a one-line deprecation warning to stderr. There is no removal date yet; this table will be updated when one is set.
 
 Optional `~/.aixle-insights/config.json` accepts Cursor line-cost overrides (per-model rates):
 
@@ -186,11 +276,81 @@ Optional `~/.aixle-insights/config.json` accepts Cursor line-cost overrides (per
 }
 ```
 
-The file is optional — an absent `config.json` is the normal case and is silent. A file that is
-present but unusable is ignored entirely (every override falls back to its default) and a
-`config_parse_failed` line is written to `mcp.log`. That covers malformed JSON and valid JSON that
-isn't an object, including a **top-level array** — a common mistake when writing per-model rates.
-Nothing is printed to the terminal, so check the log if an override appears to have no effect.
+### Configuration reference
+
+`~/.aixle-insights/config.json` is optional — `init` does not create it. Every key is optional too.
+
+| Key | Type | Purpose |
+|---|---|---|
+| `host` | string | Ingest API origin. Same value as `--host`. |
+| `token` | string | Ingest token. Rarely needed — `init` stores tokens in the keychain instead, and this is the plaintext alternative. |
+| `project_id` | string | Pin every event to one project instead of resolving from the git remote. |
+| `cursor.line_costs.<model>` | `{ input_per_line, output_per_line }` | Per-model cost rates for Cursor line-based accounting. |
+
+**Precedence:** CLI flag → environment variable → `config.json`. A flag always wins; the config file is the fallback of last resort. An absent `config.json` is the normal case and is silent. A file that is present but unusable — malformed JSON, or valid JSON that isn't an object, including a **top-level array** (a common mistake when writing per-model rates) — is ignored entirely: every override falls back to its default, and a `config_parse_failed` line is written to `mcp.log` rather than a crash. Nothing is printed to the terminal, so check the log if an override appears to have no effect.
+
+Worked example — pin a project and override Cursor rates for two models:
+
+```json
+{
+  "host": "https://staging.insights.aixle.com",
+  "project_id": "3f6c1e28-9b4a-4c7f-8d21-5ac0e7b91f04",
+  "cursor": {
+    "line_costs": {
+      "claude-sonnet-4-5": { "input_per_line": 0.0002, "output_per_line": 0.0008 },
+      "gpt-4o":            { "input_per_line": 0.0001, "output_per_line": 0.0004 }
+    }
+  }
+}
+```
+
+## Clean slate — full uninstall / reset
+
+Use this when a breaking change lands, when switching between the production and staging channels, or when you want to prove a problem is not stale local state. Steps are ordered least to most destructive; stop wherever your problem clears.
+
+**1. Remove editor integration**
+
+```bash
+aixle-insights uninstall-hooks        # Cursor hook forwarder + restore ~/.cursor/hooks.json backup
+aixle-insights uninstall-cursor-mcp   # remove only our entry from ~/.cursor/mcp.json
+```
+
+Then delete the `mcpServers.aixle-insights` entry from `~/.claude.json` by hand — `init` writes it and there is no command to remove it.
+
+**2. Clear credentials** — forces a fresh `init` and re-mints ingest tokens:
+
+```bash
+security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"  # macOS
+rm -f ~/.aixle-insights/credentials.json
+```
+
+**3. Reset sync state** — ⚠️ **this is the destructive one.** State files hold the watermarks and dedupe checkpoints. Deleting them makes the next sync treat all local history as new, so you get a **full re-backfill**. Ingest upserts by `metadata.session_id`, so you should get updates rather than duplicates, but volume will spike:
+
+```bash
+rm -f ~/.aixle-insights/state-*.json
+rm -f ~/.aixle-insights/state.lock          # only if no `aixle-insights run` is alive — check with: pgrep -fa aixle-insights
+rm -f ~/.aixle-insights/hooks-queue.ndjson  # discards hook events not yet drained
+```
+
+**4. Nuclear** — remove everything the package created locally:
+
+```bash
+rm -rf ~/.aixle-insights/    # credentials, state, logs, hook queue
+npm uninstall -g @aixle/insights
+```
+
+Nothing here touches your Claude Code transcripts or Cursor's own store — those belong to the editors and are only ever read. Events already delivered to the server are unaffected; this is purely local state.
+
+| Artifact | Created by | Removed in step |
+|---|---|---|
+| `~/.aixle-insights/credentials.json` / keychain entry | `init` | 2 |
+| `~/.aixle-insights/state-<host>-<hash>.json` | first sync | 3 |
+| `~/.aixle-insights/state.lock` | `run` | 3 |
+| `~/.aixle-insights/hooks-queue.ndjson` | hook forwarder | 3 |
+| `~/.aixle-insights/mcp.log`, `mcp.log.1` | any run | 4 |
+| `~/.cursor/hooks.json` entry | `init --hooks` | 1 |
+| `~/.cursor/mcp.json` entry | `init` | 1 |
+| `mcpServers.aixle-insights` in `~/.claude.json` | `init` | 1 (manual) |
 
 ## Security
 
@@ -241,7 +401,7 @@ reason. File contents, keychain payloads, and tokens are never logged.
 ## State + credentials
 
 - **App home directory**: `~/.aixle-insights/` (override with `AIXLE_INSIGHTS_HOME`).
-- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
+- **Credentials**: the OS keychain is the source of truth. On read, the keychain is consulted **first**; the file is only a fallback when the keychain is unavailable, empty, or explicitly disabled (`AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR`, or the deprecated `DB90_MCP_DISABLE_KEYTAR`). On write, credentials go to the keychain and the file is removed when the keychain write succeeds.
 - **State files**: `state-<hostname>-<token-hash>.json` per credential, plus `state.lock` advisory lock, `mcp.log` rotating diagnostic log, optional `hooks-queue.ndjson`.
 
 ### Credential storage by OS
@@ -256,7 +416,7 @@ The secure store is the platform's native keychain, accessed via `keytar` (servi
 
 Notes:
 
-- **Windows**: don't set `DB90_MCP_DISABLE_KEYTAR` — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
+- **Windows**: don't set `AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR` (or the deprecated `DB90_MCP_DISABLE_KEYTAR`) — Credential Manager is reliably present, and the plaintext fallback file cannot be locked down as tightly as the keychain. The `icacls` hardening is best-effort defense-in-depth.
 - **Linux**: when no Secret Service is running (common in headless/CI/container contexts), the tool degrades to the `chmod 0600` fallback file **by design** — this is the one environment where the file path is routinely exercised, and POSIX permissions protect it there.
 - A stale `credentials.json` sitting alongside a populated keychain entry is logged as drift (`credentials_file_shadowed_by_keychain` in `mcp.log`) and ignored in favour of the keychain.
 
@@ -304,9 +464,9 @@ Three properties are worth relying on:
 
 | Symptom | Most likely cause | Fix |
 |---|---|---|
-| `Error: DB90 API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
-| `Blocked event send — DB90 ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
-| `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For DB90 staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
+| `Error: Aixle Insights API host <name> uses remote plaintext HTTP.` | You passed `--host http://<remote>` without `--insecure`. | Use `https://...`, or add `--insecure` if you know the endpoint is trusted and non-production. |
+| `Blocked event send — Aixle Insights ingest host <name> uses remote plaintext HTTP.` (or `Blocked project lookup — ...`) in `mcp.log` / console during `run` | `credentials.json` (or the keychain entry) has an `http://` remote `host` without a recorded `--insecure` consent — most likely because it was edited outside of `init`. | Re-run `aixle-insights init --host https://... ` (or `init --insecure --host http://...` if the endpoint is genuinely trusted non-prod) to re-establish credentials with an explicit, recorded decision. |
+| `Auth failed: fetch failed` during `init` | The `--keycloak-url` host doesn't resolve (NXDOMAIN), is behind a VPN, or the TLS cert is bad. | Verify with `curl -sS https://<host>/realms/<realm>/.well-known/openid-configuration`. For Aixle Insights staging, the canonical Keycloak URL is embedded in the SPA — `curl https://<APP_HOST> \| grep keycloakUrl` extracts the current value. |
 | `Failed to post event: HTTP 401 Unauthorized` repeated for every turn | Your saved ingest token has been rotated, revoked, or invalidated by a server redeploy. The ingest token is distinct from the Keycloak access token that `health` reports as `authenticated: true`. | Reset the keychain entry and re-run `init`: `security delete-generic-password -s "aixle-insights" -a "aixle-insights-ingest-credential"` then `rm -f ~/.aixle-insights/credentials.json` then `aixle-insights init --host ... --keycloak-url ...`. State files are **not** deleted, so already-sent sessions stay deduped. |
 | `health` shows `authenticated: true` but `last_result` is `sent: 0, failed: N` cycle after cycle | Same as the 401 row above. `authenticated` only proves the OIDC token was acquired, not that the ingest token still validates server-side. | Re-init as above. |
 | `last_result` reports `sent: N` but the Events UI shows nothing | The Temporal worker is not running. The ingest endpoint returns HTTP 202 (queued) regardless of worker state. | `make worker` (or check `docker ps` for `db90-worker`). See [LOCAL-DEV.md](./LOCAL-DEV.md) §1. |
@@ -362,6 +522,10 @@ cd packages/tools
 npm rebuild better-sqlite3
 ```
 
+## Changelog
+
+See [CHANGELOG.md](https://github.com/dualboot-partners/db90-rails/blob/develop/packages/tools/aixle-insights/CHANGELOG.md) — npm's registry page doesn't render this file directly, so it's linked here instead of duplicated.
+
 ## License
 
 MIT.

package/dist/auth/credentials.js

@@ -5,13 +5,18 @@ import { join } from "node:path";
 import { getAppDir } from "../state.js";
 import { mcpLog } from "../log.js";
 import { describeReadFailure } from "../lib/parse-error.js";
+import { readBooleanEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 export const KEYTAR_SERVICE = "aixle-insights";
 const KEYTAR_ACCOUNT = "aixle-insights-ingest-credential";
 function credentialsPath(appDir) {
     return join(appDir, "credentials.json");
 }
 function keytarDisabled() {
-    return ["1", "true", "yes"].includes(process.env["DB90_MCP_DISABLE_KEYTAR"]?.toLowerCase() ?? "");
+    return readBooleanEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_MCP_DISABLE_KEYTAR",
+        deprecated: "DB90_MCP_DISABLE_KEYTAR",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
 }
 /** Returns true when at least one tool has a non-empty token. */
 export function credentialsHaveAnyToken(creds) {

package/dist/auth/exchange.js

@@ -43,7 +43,7 @@ export async function exchangeIngestToken(params) {
         json = JSON.parse(text);
     }
     catch {
-        throw new Error(`DB90 exchange: invalid JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
+        throw new Error(`Aixle Insights exchange: invalid JSON (HTTP ${res.status}): ${text.slice(0, 200)}`);
     }
     if (!res.ok) {
         const errBody = json;
@@ -61,18 +61,18 @@ export async function exchangeIngestToken(params) {
             const msg = typeof errBody["message"] === "string" ? errBody["message"] : "Organization selection required.";
             throw new OrganizationSelectionRequiredError(msg, orgs);
         }
-        throw new Error(`DB90 exchange failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
+        throw new Error(`Aixle Insights exchange failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
     }
     const root = json;
     const data = root["data"];
     if (typeof data !== "object" || data === null) {
-        throw new Error("DB90 exchange: missing data object");
+        throw new Error("Aixle Insights exchange: missing data object");
     }
     const d = data;
     const ingestHost = d["ingestHost"];
     const organizationId = d["organizationId"];
     if (typeof ingestHost !== "string" || typeof organizationId !== "string") {
-        throw new Error("DB90 exchange: missing ingestHost or organizationId in data");
+        throw new Error("Aixle Insights exchange: missing ingestHost or organizationId in data");
     }
     const ingestTokenRaw = d["ingestToken"];
     const accountsRaw = d["accounts"];
@@ -96,7 +96,7 @@ export async function exchangeIngestToken(params) {
     }
     if (Object.keys(accounts).length === 0) {
         if (!ingestToken) {
-            throw new Error("DB90 exchange: no ingestToken / accounts returned in data");
+            throw new Error("Aixle Insights exchange: no ingestToken / accounts returned in data");
         }
         const fallbackTool = requestedTools.length === 1 ? requestedTools[0] : d["toolName"];
         const tid = fallbackTool === "cursor" ? "cursor" : "claude_code";
@@ -104,7 +104,7 @@ export async function exchangeIngestToken(params) {
     }
     const missingTools = requestedTools.filter((tool) => !accounts[tool]?.ingestToken);
     if (missingTools.length > 0) {
-        throw new Error(`DB90 exchange: missing requested account(s): ${missingTools.join(", ")}`);
+        throw new Error(`Aixle Insights exchange: missing requested account(s): ${missingTools.join(", ")}`);
     }
     return { ingestHost, organizationId, ingestToken, accounts };
 }

package/dist/auth/flow.js

@@ -69,7 +69,7 @@ export async function loginAndPersistCredentials(opts) {
         }
         const ingestHostSecurity = evaluateTransportSecurity(exchanged.ingestHost, {
             allowInsecureHttp: opts.allowInsecureHttp === true,
-            label: "DB90 ingest host",
+            label: "Aixle Insights ingest host",
         });
         if (!ingestHostSecurity.ok) {
             return { ok: false, error: ingestHostSecurity.error };

package/dist/auth/keycloak.js

@@ -3,6 +3,7 @@
  */
 import { createHash, randomBytes } from "node:crypto";
 import { isLoopbackHost } from "../lib/transport-security.js";
+import { readEnvWithDeprecatedAlias, readBooleanEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 function normalizeIssuer(issuer) {
     return issuer.replace(/\/$/, "");
 }
@@ -156,11 +157,18 @@ export async function obtainKeycloakAccessTokenViaDeviceFlow(params) {
     });
 }
 export function defaultKeycloakIssuer(ingestHost) {
-    const fromEnv = process.env["DB90_KEYCLOAK_ISSUER"]?.trim() ||
-        process.env["KEYCLOAK_ISSUER"]?.trim();
+    const fromEnv = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_KEYCLOAK_ISSUER",
+        deprecated: "DB90_KEYCLOAK_ISSUER",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    }) || process.env["KEYCLOAK_ISSUER"]?.trim();
     if (fromEnv)
         return fromEnv.replace(/\/$/, "");
-    const useLocalDefault = ["1", "true", "yes"].includes(process.env["DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT"]?.toLowerCase() ?? "");
+    const useLocalDefault = readBooleanEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_MCP_USE_LOCAL_KEYCLOAK_DEFAULT",
+        deprecated: "DB90_MCP_USE_LOCAL_KEYCLOAK_DEFAULT",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (useLocalDefault || process.env["NODE_ENV"] === "development") {
         if (ingestHost) {
             let hostname;
@@ -185,5 +193,11 @@ export function defaultKeycloakIssuer(ingestHost) {
     return "";
 }
 export function defaultKeycloakClientId() {
-    return process.env["DB90_KEYCLOAK_CLIENT_ID"]?.trim() || "db90-web";
+    return (process.env["KEYCLOAK_CLIENT_ID"]?.trim() ||
+        readEnvWithDeprecatedAlias({
+            current: "AIXLE_INSIGHTS_KEYCLOAK_CLIENT_ID",
+            deprecated: "DB90_KEYCLOAK_CLIENT_ID",
+            onDeprecatedUse: warnDeprecatedEnvVar,
+        }) ||
+        "aixle-insights-web");
 }

package/dist/cli.js

@@ -14,6 +14,7 @@ import { installClaudeUserMcp } from "./install/claude.js";
 import { installCursorUserMcp, uninstallCursorUserMcp } from "./install/cursor.js";
 import { installHooksConfig, uninstallHooksConfig, verifyHooksConfig, FORWARDER_FILENAME } from "./hooks/hooks-config.js";
 import { evaluateTransportSecurity } from "./lib/transport-security.js";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "./lib/env.js";
 import { join } from "node:path";
 import { fileURLToPath as nodeFileURLToPath } from "node:url";
 import { mcpLog } from "./log.js";
@@ -162,9 +163,9 @@ Usage:
 
 Commands:
   run                   Start the MCP stdio server (default — used by Claude Code).
-  init                  Keycloak device login once, then persist DB90 ingest credentials (keychain or file).
+  init                  Keycloak device login once, then persist Aixle Insights ingest credentials (keychain or file).
   health                Multi-line diagnostic (credentials, sync, log path, state files).
-  uninstall-hooks       Remove DB90 from ~/.cursor/hooks.json and restore backup (if any).
+  uninstall-hooks       Remove Aixle Insights from ~/.cursor/hooks.json and restore backup (if any).
   verify-hooks          Print hooks install status and queue depth as JSON.
   uninstall-cursor-mcp  Remove aixle-insights from ~/.cursor/mcp.json and restore backup (if any).
 
@@ -174,10 +175,10 @@ Options:
   --help, -h  Show this help message.
 
 init options:
-  --host <url>             DB90 API base URL (default: env DB90_API_URL or http://localhost:3000)
-  --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER)
+  --host <url>             Aixle Insights API base URL (default: env AIXLE_INSIGHTS_API_URL, or deprecated DB90_API_URL, or http://localhost:3000)
+  --keycloak-url <issuer>  Keycloak realm issuer (default: env KEYCLOAK_ISSUER, or AIXLE_INSIGHTS_KEYCLOAK_ISSUER / deprecated DB90_KEYCLOAK_ISSUER)
   --tool-name <name>       Optional: mint only \`claude_code\`, only \`cursor\`, or omit to mint BOTH.
-  --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env DB90_ORGANIZATION_ID).
+  --organization-id <uuid> Optional: scope MCP token exchange to this org (overrides env AIXLE_INSIGHTS_ORGANIZATION_ID / deprecated DB90_ORGANIZATION_ID).
   --force                  Re-run the device flow even if valid credentials already exist, and
                            replace an existing user "aixle-insights" MCP entry in ~/.claude.json if it differs.
   --hooks                  (opt-in) Install Cursor hook forwarder for per-turn model attribution.
@@ -185,9 +186,7 @@ init options:
   --insecure               Allow remote http:// hosts for trusted non-production test endpoints only.
 
 Multi-org:
-  If you belong to more than one org, pass \`--organization-id <uuid>\` (or set \`DB90_ORGANIZATION_ID\`),
-  or set a Default Organization in web Preferences. Without either, \`init\` lists your orgs and exits.
-  Single-org users need no flag. Run \`aixle-insights health\` to see the bound organization_id.
+  Set \`AIXLE_INSIGHTS_ORGANIZATION_ID\` (or deprecated \`DB90_ORGANIZATION_ID\`) to a UUID, or pass \`--organization-id\` on \`init\`, so ingest tokens are minted for that membership instead of the default (oldest) org.
 
 Credentials:
   Stored in the OS keychain via keytar when available; otherwise
@@ -197,7 +196,11 @@ Note: Omitting --tool-name provisions separate ingest tokens for Claude Code + C
 `);
 }
 function defaultApiHost() {
-    const v = process.env["DB90_API_URL"]?.trim();
+    const v = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_API_URL",
+        deprecated: "DB90_API_URL",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (v)
         return v.replace(/\/$/, "");
     return "http://localhost:3000";
@@ -224,7 +227,7 @@ export async function runInit(cliArgs, deps) {
     const apiHost = (cliArgs.host ?? defaultApiHost()).replace(/\/$/, "");
     const transportSecurity = evaluateTransportSecurity(apiHost, {
         allowInsecureHttp: cliArgs.insecure === true,
-        label: "DB90 API host",
+        label: "Aixle Insights API host",
     });
     if (!transportSecurity.ok) {
         runtime.error(`Error: ${transportSecurity.error}`);
@@ -233,7 +236,11 @@ export async function runInit(cliArgs, deps) {
     if (transportSecurity.warning) {
         runtime.error(`Warning: ${transportSecurity.warning}`);
     }
-    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer()).trim();
+    const kcIssuer = (cliArgs.keycloakUrl ?? runtime.defaultKeycloakIssuer(apiHost)).trim();
+    if (!kcIssuer) {
+        runtime.error("Error: Keycloak issuer is not configured. Pass --keycloak-url or set KEYCLOAK_ISSUER / AIXLE_INSIGHTS_KEYCLOAK_ISSUER.");
+        return 1;
+    }
     if (cliArgs.toolName !== undefined && !["claude_code", "cursor"].includes(cliArgs.toolName)) {
         runtime.error("Error: --tool-name must be one of: claude_code, cursor.");
         return 1;
@@ -244,10 +251,14 @@ export async function runInit(cliArgs, deps) {
             ? ["claude_code"]
             : ["claude_code", "cursor"];
     const fromFlag = cliArgs.organizationId?.trim();
-    const fromEnv = process.env["DB90_ORGANIZATION_ID"]?.trim();
+    const fromEnv = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_ORGANIZATION_ID",
+        deprecated: "DB90_ORGANIZATION_ID",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     const exchangeOrganizationId = fromFlag || fromEnv;
     if (exchangeOrganizationId && !isValidOrganizationUuid(exchangeOrganizationId)) {
-        runtime.error("Error: --organization-id / DB90_ORGANIZATION_ID must be a valid UUID (RFC 4122, version 1–5, variant per DB90 API).");
+        runtime.error("Error: --organization-id / AIXLE_INSIGHTS_ORGANIZATION_ID must be a valid UUID (RFC 4122, version 1–5, variant per Aixle Insights API).");
         return 1;
     }
     const result = await runtime.loginAndPersistCredentials({
@@ -452,7 +463,7 @@ async function main() {
                 console.log(backupPath ? `Hooks uninstalled; hooks.json restored from ${backupPath}.` : "Hooks uninstalled; hooks.json removed.");
             }
             else {
-                console.log("No DB90 hooks entry found in ~/.cursor/hooks.json — nothing to uninstall.");
+                console.log("No Aixle Insights hooks entry found in ~/.cursor/hooks.json — nothing to uninstall.");
             }
             return;
         }

package/dist/install/claude.js

@@ -2,8 +2,13 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { randomBytes } from "node:crypto";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "../lib/env.js";
 export function defaultClaudeUserConfigPath() {
-    const override = process.env["DB90_CLAUDE_USER_CONFIG_PATH"]?.trim();
+    const override = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_CLAUDE_USER_CONFIG_PATH",
+        deprecated: "DB90_CLAUDE_USER_CONFIG_PATH",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
     if (override)
         return override;
     return join(homedir(), ".claude.json");

package/dist/lib/client.js

@@ -13,7 +13,7 @@ import { evaluateTransportSecurity } from "./transport-security.js";
 export async function postEvent(payload, host, token, options = {}) {
     const transportSecurity = evaluateTransportSecurity(host, {
         allowInsecureHttp: options.allowInsecureHttp === true,
-        label: "DB90 ingest host",
+        label: "Aixle Insights ingest host",
     });
     if (!transportSecurity.ok) {
         // Deliberately does NOT call options.onNetworkError/onHttpError: the retry

package/dist/lib/env.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `DB90_*` env vars are deprecated aliases for the `AIXLE_INSIGHTS_*` names (branding rename,
+ * DB90DV-624). Both are honored indefinitely until a removal date is announced; the deprecated
+ * name only wins when the current name is unset, so setting both is safe.
+ */
+export interface EnvAliasOptions {
+    /** Preferred, currently-documented env var name. */
+    current: string;
+    /** Deprecated env var name, still honored as a fallback. */
+    deprecated: string;
+    onDeprecatedUse?: (deprecatedName: string, currentName: string) => void;
+}
+export declare function readEnvWithDeprecatedAlias(options: EnvAliasOptions): string | undefined;
+export declare function readBooleanEnvWithDeprecatedAlias(options: EnvAliasOptions): boolean;
+export declare function warnDeprecatedEnvVar(deprecatedName: string, currentName: string, log?: (message: string) => void): void;

package/dist/lib/env.js

@@ -0,0 +1,18 @@
+export function readEnvWithDeprecatedAlias(options) {
+    const currentValue = process.env[options.current]?.trim();
+    if (currentValue)
+        return currentValue;
+    const deprecatedValue = process.env[options.deprecated]?.trim();
+    if (deprecatedValue) {
+        options.onDeprecatedUse?.(options.deprecated, options.current);
+        return deprecatedValue;
+    }
+    return undefined;
+}
+export function readBooleanEnvWithDeprecatedAlias(options) {
+    const value = readEnvWithDeprecatedAlias(options);
+    return ["1", "true", "yes"].includes(value?.toLowerCase() ?? "");
+}
+export function warnDeprecatedEnvVar(deprecatedName, currentName, log = console.error) {
+    log(`Warning: ${deprecatedName} is deprecated; use ${currentName} instead.`);
+}

package/dist/lib/project-resolver.d.ts

@@ -33,7 +33,7 @@ export declare function canonicalizeGitRemote(remote: string, verbose: boolean):
  */
 export declare function repoNameToGitRemoteCandidates(repoName: string): string[];
 export declare function lookupProjectByRepoName(repoName: string, host: string, token: string, verbose: boolean, allowInsecureHttp?: boolean): Promise<LookupResult | "not-found" | null>;
-/** Payload shape shared by db90-cursor and telemetry-mcp commit mappers. */
+/** Payload shape shared by the Cursor and Claude commit mappers. */
 export interface CommitAttributionPayload {
     event_type?: string;
     project_id?: string;

package/dist/lib/project-resolver.js

@@ -216,7 +216,7 @@ export async function enrichCommitProjectAttribution(payloads, options) {
 export async function lookupProjectByRemote(gitRemote, host, token, verbose, allowInsecureHttp = false) {
     const transportSecurity = evaluateTransportSecurity(host, {
         allowInsecureHttp,
-        label: "DB90 project-lookup host",
+        label: "Aixle Insights project-lookup host",
     });
     if (!transportSecurity.ok) {
         console.error(`Blocked project lookup — ${transportSecurity.error}`);

package/dist/readers/claude.d.ts

@@ -60,6 +60,13 @@ export interface ClaudeTranscriptTurn {
     navToolCalls: number;
     totalToolCalls: number;
     messageIds: string[];
+    /**
+     * Fingerprint of the turn's content (prompt + assistant text + tool-use set).
+     * A turn keeps the same turnId as Claude appends more tool_use blocks to it,
+     * so sync compares this hash to detect appended derivatives and re-emit them
+     * instead of skipping the turn forever on its unchanged id (DB90DV-259).
+     */
+    contentHash: string;
 }
 /** Payload shape for the parent chat turn (carries full token cost). */
 export interface ClaudePayload extends IngestPayload {

package/dist/readers/claude.js

@@ -1,4 +1,5 @@
 import { createReadStream, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { finished } from "node:stream/promises";
 import { createInterface } from "node:readline";
 import { join } from "node:path";
@@ -206,9 +207,29 @@ function newTurn(sessionId, turnIndex, filePath, fileSize, occurredAt, promptId)
         navToolCalls: 0,
         totalToolCalls: 0,
         messageIds: [],
+        contentHash: "",
         persisted: false,
     };
 }
+/**
+ * Stable fingerprint of a turn's emittable content. Includes the tool-use set
+ * (id + name + summary) so appending a tool_use to an already-synced turn
+ * changes the hash and triggers a re-emit (DB90DV-259).
+ */
+function computeTurnContentHash(turn) {
+    const toolFingerprint = turn.toolUses
+        .map((t) => `${t.id}:${t.eventType}:${t.summary}`)
+        .join("
");
+    const material = [
+        turn.model ?? "",
+        turn.tokensIn,
+        turn.tokensOut,
+        turn.promptText,
+        turn.assistantText,
+        toolFingerprint,
+    ].join("");
+    return createHash("sha256").update(material).digest("hex").slice(0, 32);
+}
 function appendText(existing, addition) {
     if (!addition.trim())
         return existing;
@@ -391,7 +412,10 @@ export async function parseTranscriptFile(filePath, verbose = false) {
         return turns;
     }
     flushCurrentTurn();
-    return finalizedTurns.map(({ persisted: _persisted, ...turn }) => turn);
+    return finalizedTurns.map(({ persisted: _persisted, ...turn }) => ({
+        ...turn,
+        contentHash: computeTurnContentHash(turn),
+    }));
 }
 /** Converts a Claude transcript turn to parent chat and derivative tool-use payloads. */
 export function mapTranscriptTurn(turn, options) {

package/dist/readers/cursor.js

@@ -717,6 +717,12 @@ export async function parseCursorTranscriptFile(filePath, composerHeaders, verbo
             if (texts.length === 0)
                 continue;
             if (entry.role === "user") {
+                // Normalize/filter before noting the time: a whitespace- or wrapper-only line
+                // must not set currentTurnOccurredAt (nor start a new turn) with nothing to append,
+                // otherwise the next real message inherits this stale timestamp.
+                const fragments = texts.map(stripUserQueryWrapper).filter((text) => text.length > 0);
+                if (fragments.length === 0)
+                    continue;
                 if (currentPromptParts.length > 0 || currentAssistantParts.length > 0) {
                     finalizeTurn();
                     currentPromptParts = [];

package/dist/server.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { getGitRemote, resolveProjectId } from "./lib/index.js";
 import { loadCredentials, credentialsHaveAnyToken, pickProjectLookupToken } from "./credentials.js";
 import { defaultKeycloakClientId, defaultKeycloakIssuer, startDeviceAuthorization } from "./auth/keycloak.js";
+import { readEnvWithDeprecatedAlias, warnDeprecatedEnvVar } from "./lib/env.js";
 import { migrateLegacyState, getAppDir } from "./state.js";
 import { syncTelemetryTools } from "./sync.js";
 import { DEFAULT_PRICING, mergePricing } from "./pricing.js";
@@ -143,13 +144,23 @@ async function syncNowHandler(input) {
         });
     }
 }
+function defaultIngestHost() {
+    const v = readEnvWithDeprecatedAlias({
+        current: "AIXLE_INSIGHTS_API_URL",
+        deprecated: "DB90_API_URL",
+        onDeprecatedUse: warnDeprecatedEnvVar,
+    });
+    if (v)
+        return v.replace(/\/$/, "");
+    return "http://localhost:3000";
+}
 async function authenticateHandler(args) {
     try {
-        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
+        const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer(defaultIngestHost())).trim();
         if (!kc) {
             return jsonContent({
                 ok: false,
-                error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
+                error: "keycloakUrl or KEYCLOAK_ISSUER / AIXLE_INSIGHTS_KEYCLOAK_ISSUER is required",
             });
         }
         const clientId = args.clientId?.trim() || defaultKeycloakClientId();
@@ -182,7 +193,7 @@ export function createAixleInsightsMcpServer() {
     const statusDescription = "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.";
     server.registerTool("aixle_insights_status", { description: statusDescription }, statusHandler);
     server.registerTool("db90_status", { description: DEPRECATED_ALIAS_NOTE.replace("{name}", "aixle_insights_status") + statusDescription }, statusHandler);
-    const syncNowDescription = "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
+    const syncNowDescription = "Runs one Aixle Insights ingest sync cycle for enabled tools immediately (matches background cadence). " +
         "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).";
     server.registerTool("aixle_insights_sync_now", { description: syncNowDescription, inputSchema: SYNC_NOW_INPUT_SCHEMA }, syncNowHandler);
     server.registerTool("db90_sync_now", {

package/dist/sync.js

@@ -225,7 +225,11 @@ async function runClaudeSlice(options) {
         }
         const sKey = sessionStateKey(turn.turnId);
         const known = state.sessions[sKey];
-        if (known) {
+        // A turn keeps its turnId as Claude appends more tool_use blocks to it, so a
+        // plain "already known → skip" would drop derivatives appended after an earlier
+        // mid-turn sync. Skip only when the content fingerprint is unchanged; otherwise
+        // re-emit so the newly appended tool uses are sent (DB90DV-259).
+        if (known && known.contentHash && known.contentHash === turn.contentHash) {
             totalSkipped++;
             if (verbose) {
                 console.log(`[verbose] Skipping already-synced Claude turn ${turn.turnId}`);
@@ -282,6 +286,7 @@ async function runClaudeSlice(options) {
                 console.log(`[verbose] Sending Claude ${payload.event_type} ${payload.metadata.session_id}`);
             }
             const ok = await postEvent(payload, host, token, {
+                allowInsecureHttp,
                 on429: (retryAfter, quotaExceeded) => {
                     const currentBackoff = backoffUntilByCredential.get(backoffKey);
                     const nextBackoff = new Date(Math.max(currentBackoff?.getTime() ?? 0, Date.now() + retryAfter * 1000));
@@ -309,7 +314,7 @@ async function runClaudeSlice(options) {
         }
         if (allOk) {
             totalSent += payloads.length;
-            state = markSessionSent(state, sKey, turn.fileSize);
+            state = markSessionSent(state, sKey, turn.fileSize, turn.contentHash);
             writeState(state, appDir, host, token);
         }
         else if (shouldStopForBackoff) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aixle/insights",
-  "version": "0.2.6-staging",
+  "version": "0.2.8-staging",
   "description": "stdio MCP server for AI coding-assistant telemetry — Claude transcript sync + Cursor SQLite ingest.",
   "type": "module",
   "bin": {
@@ -46,6 +46,7 @@
     "lint": "eslint . --max-warnings 0",
     "verify:cursor-dry-run": "tsx scripts/verify-cursor-dry-run.ts",
     "audit:local-stores": "tsx scripts/audit-local-stores.ts",
+    "nightly:resolve": "tsx scripts/nightly-release-resolve.ts",
     "dev": "tsx src/cli.ts",
     "prepublishOnly": "npm run build"
   },
@@ -66,6 +67,6 @@
     "eslint-plugin-security": "^4.0.1",
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.0"
+    "vitest": "4.1.9"
   }
 }