ai-lens 0.8.100 → 0.8.103

package/.commithash

@@ -1 +1 @@
-3ebf574
+0aee413

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 History of changes to the `ai-lens` CLI package on npm. New entries go on top. Format: `## X.Y.Z — YYYY-MM-DD`, followed by user-facing bullets.
 
+## 0.8.103 — 2026-06-18
+- fix: `ai-lens status` no longer falsely reports the client as "outdated" on repo-path installs (where hooks run capture.js straight from a checkout that auto-updates on `git pull`). It now reads the client version from the repo the hooks actually run, instead of an unused leftover copy in `~/.ai-lens/client/` — which could be months stale and made the check show ✗ + "run init" even though the live client was current. The stale copy is now noted as ignored. Copy-mode installs are unchanged.
+
+## 0.8.102 — 2026-06-17
+- fix: the per-machine `settings.local.json` overlay for committed Claude Code hooks now also writes the absolute launcher form on Windows (matching the main install path), so a repo whose tracked `settings.json` carries `$CLAUDE_PROJECT_DIR` hooks captures correctly on Windows without manual fix-up. `ai-lens status`/`init` now flag any leftover `$CLAUDE_PROJECT_DIR`/`%CLAUDE_PROJECT_DIR%` Claude hook on Windows as outdated so it migrates to the absolute form.
+- fix: the Windows windowless hook launcher (`ai-lens-hook.ps1`) now sends the event payload to node as raw UTF-8 bytes (Cyrillic prompts and accented paths are no longer mangled by PowerShell's default codepage) and fails open — on any internal error it exits cleanly and writes nothing to stdout, so a launcher hiccup can never break a Cursor hook or disrupt the session.
+
+## 0.8.101 — 2026-06-17
+- fix: Claude Code hooks on Windows now use an absolute path to capture.js instead of `$CLAUDE_PROJECT_DIR`, which Claude Code does not expand on Windows (the v0.8.100 form failed to find the launcher and, when Cursor also ran the hook, produced a visible error). Capture is restored. Existing installs migrate on the next `ai-lens init` / `/setup`. macOS/Linux keep `$CLAUDE_PROJECT_DIR` (expanded there). Note: a brief console window can still flash on Claude Code hooks on Windows — that's an upstream Claude Code behaviour (it launches the hook shell without hiding the window) and can't be fixed from the hook side
+
 ## 0.8.100 — 2026-06-17
 - fix: Claude Code hooks on Windows now actually capture. The previous windowless wrapper (`conhost.exe --headless`) hid the console window but silently swallowed the hook's stdin, so the event payload never reached AI Lens and nothing was recorded. Claude Code now uses the same windowless launcher as Cursor (`ai-lens-hook.ps1`), which both suppresses the window and delivers the payload. Existing installs migrate on the next `ai-lens init` / `/setup`. macOS/Linux unchanged. (The launcher was renamed from `cursor-ai-lens-hook.ps1` since it now serves both tools.)
 

package/cli/hooks.js

@@ -316,16 +316,13 @@ export function captureCommand(opts = {}) {
   // binary or /home/<user> path. Windows Claude Code shells via cmd.exe (%VAR%);
   // POSIX shells use $VAR.
   if (projectDirRelPath != null) {
+    // POSIX/macOS only: bare node + $CLAUDE_PROJECT_DIR (the shell expands $VAR; the
+    // path stays machine-agnostic for committed hooks + cwd-robust). On WINDOWS this
+    // form must NOT be used — Claude Code's hook spawn (Git Bash / PowerShell) does NOT
+    // expand $CLAUDE_PROJECT_DIR nor %CLAUDE_PROJECT_DIR% (verified live: both reached
+    // the shell literally and the path failed). Callers therefore route Windows Claude
+    // hooks to the absolute getClaudeCodeHookDefsWithPath form instead of this one.
     const rel = projectDirRelPath.replace(/\\/g, '/').replace(/^\.?\/+/, '');
-    if (winLauncher) {
-      // Windowless form via the launcher. Uses $CLAUDE_PROJECT_DIR — Claude Code
-      // substitutes that variable itself before exec on every OS. The launcher ships
-      // next to capture.js, so it resolves under the same $CLAUDE_PROJECT_DIR path.
-      // node stays bare (committed/machine-agnostic form) — the launcher's
-      // ProcessStartInfo resolves it via PATH (Claude Code requires node on PATH).
-      const launcherRel = rel.replace(/[^/]*$/, 'ai-lens-hook.ps1');
-      return `powershell -NoProfile -ExecutionPolicy Bypass -File "$CLAUDE_PROJECT_DIR/${launcherRel}" node "$CLAUDE_PROJECT_DIR/${rel}"`;
-    }
     const dir = isWin ? '%CLAUDE_PROJECT_DIR%' : '$CLAUDE_PROJECT_DIR';
     return `node "${dir}/${rel}"`;
   }
@@ -926,14 +923,17 @@ function isAcceptableHookCommand(cmd) {
 export function isWrongPlatformProjectDirCommand(cmd, platform = process.platform) {
   if (!isClaudeProjectDirCommand(cmd)) return false;
   const n = (cmd || '').replace(/\\/g, '/');
-  // The Windows windowless launcher form (powershell … -File "$CLAUDE_PROJECT_DIR/…
-  // ai-lens-hook.ps1" …) and the older conhost.exe --headless form are unambiguously
-  // Windows commands. Both deliberately use $CLAUDE_PROJECT_DIR — Claude Code substitutes
-  // that itself before exec, so it expands on Windows. They are correct on win32 and
-  // wrong (won't run) anywhere else; the %VAR%/$VAR rule below doesn't apply to them.
-  if (/ai-lens-hook\.ps1/i.test(n) || isConhostHeadlessCommand(n)) return platform !== 'win32';
-  const correctVar = platform === 'win32' ? '%CLAUDE_PROJECT_DIR%' : '$CLAUDE_PROJECT_DIR';
-  return !n.includes(correctVar);
+  // The legacy conhost.exe --headless form is unambiguously a Windows command and uses
+  // $CLAUDE_PROJECT_DIR: correct on win32, wrong elsewhere. (Migration off conhost is
+  // driven separately by the wrapper-kind check in isCurrentAiLensHook.)
+  if (isConhostHeadlessCommand(n)) return platform !== 'win32';
+  // On Windows, NEITHER $CLAUDE_PROJECT_DIR nor %CLAUDE_PROJECT_DIR% actually expands in
+  // Claude Code's hook spawn (verified live) — so ANY variable-bearing form is wrong on
+  // win32 and must migrate to the absolute path form (incl. a stale $VAR-launcher or a
+  // %VAR% overlay). On POSIX the shell expands $CLAUDE_PROJECT_DIR, so $VAR is the only
+  // correct form there.
+  if (platform === 'win32') return true;
+  return !n.includes('$CLAUDE_PROJECT_DIR');
 }
 
 // Leading `conhost.exe --headless ` windowless wrapper, with the trailing space so a
@@ -1036,13 +1036,27 @@ export function analyzeClaudeLocalOverlay(tool, opts = {}) {
   if (!rel) return { applicable: false, reason: 'could not extract capture.js path from hook command' };
 
   const localPath = claudeLocalSettingsPath(tool);
+  // Committed-file → per-machine overlay mirror. On Windows $CLAUDE_PROJECT_DIR/%VAR% does
+  // NOT expand in Claude Code's hook spawn, so the overlay (like init's main path) writes
+  // the absolute windowless-launcher form — rel resolved against the project root, node
+  // resolved on this machine. POSIX keeps the $CLAUDE_PROJECT_DIR form (the shell expands it).
+  const overlayCtx = { ...(opts.ctx ?? {}), platform };
+  let overlayHookDefs;
+  if (platform === 'win32') {
+    const projectRoot = dirname(dirname(tool.configPath));
+    const absCapture = join(projectRoot, rel).replace(/\\/g, '/');
+    const nodeResolution = overlayCtx.nodeResolution ?? findStableNodePath({ platform });
+    overlayHookDefs = getClaudeCodeHookDefsWithPath(absCapture, { ...overlayCtx, nodeResolution });
+  } else {
+    overlayHookDefs = getClaudeCodeHookDefsWithProjectDir(rel, overlayCtx);
+  }
   const localTool = {
     ...tool,
     name: `${tool.name} (settings.local.json overlay)`,
     configPath: localPath,
     // Never backup/rename a user's settings.local.json wholesale on parse errors.
     sharedConfig: true,
-    hookDefs: getClaudeCodeHookDefsWithProjectDir(rel, { ...(opts.ctx ?? {}), platform }),
+    hookDefs: overlayHookDefs,
   };
   const overlayAnalysis = analyzeToolHooks(localTool, { platform, allowPlatformRewrite: true });
   return {

package/cli/init.js

@@ -182,9 +182,13 @@ function makeNestedClaudeTool(projectDir, capturePathInHooks, ctx = null) {
     // cwd. Absolute/tilde paths keep the legacy <node> <capture.js> form.
     const rel = capturePathInHooks.replace(/\\/g, '/');
     const isRelative = !rel.startsWith('/') && !rel.startsWith('~') && !/^[a-zA-Z]:\//.test(rel);
-    tool.hookDefs = (isRelative && /(?:^|\/)ai-lens\//.test(rel))
+    // $CLAUDE_PROJECT_DIR is expanded by the shell on POSIX but NOT on Windows (Claude's
+    // hook spawn takes it literally) — so on Windows resolve rel to an absolute path
+    // against the nested project root instead of using the projectDir form.
+    const useProjectDir = isRelative && /(?:^|\/)ai-lens\//.test(rel) && ctx?.platform !== 'win32';
+    tool.hookDefs = useProjectDir
       ? getClaudeCodeHookDefsWithProjectDir(rel, ctx)
-      : getClaudeCodeHookDefsWithPath(capturePathInHooks, ctx);
+      : getClaudeCodeHookDefsWithPath(isRelative ? join(projectDir, rel).replace(/\\/g, '/') : capturePathInHooks, ctx);
   }
   return tool;
 }
@@ -513,9 +517,13 @@ export default async function init() {
       : repoPathAbs.replace(/\\/g, '/');
     for (const tool of tools) {
       if (tool.name.startsWith('Claude Code')) {
-        tool.hookDefs = claudeProjectDirRel
+        // On Windows, Claude Code's hook spawn does NOT expand $CLAUDE_PROJECT_DIR (Git
+        // Bash / PowerShell take it literally), so the projectDir form can't resolve —
+        // use the resolved absolute repo path instead (per-machine, so absolute is fine).
+        // POSIX/macOS keep $CLAUDE_PROJECT_DIR (cwd-robust + the shell expands it).
+        tool.hookDefs = (claudeProjectDirRel && ctx?.platform !== 'win32')
           ? getClaudeCodeHookDefsWithProjectDir(claudeProjectDirRel, ctx)
-          : getClaudeCodeHookDefsWithPath(pathInHooks, ctx);
+          : getClaudeCodeHookDefsWithPath(claudeProjectDirRel ? repoPathAbs.replace(/\\/g, '/') : pathInHooks, ctx);
       }
       else if (tool.name.startsWith('Cursor')) tool.hookDefs = getCursorHookDefsWithPath(pathInHooks, ctx);
       else if (tool.name.startsWith('Codex')) tool.hookDefs = getCodexHookDefsWithPath(codexPathInHooks, ctx);

package/cli/status.js

@@ -103,10 +103,12 @@ function expandTilde(pathStr) {
 }
 
 /**
- * Detect install mode from the capture.js path in hook commands.
- * Returns { ok, summary, detail } for the status output.
+ * Resolve the capture.js / launcher path(s) the hooks actually run, tagging each
+ * with its install mode. Shared by detectInstallMode and checkClientFiles so both
+ * reason about the SAME path the hooks execute (not an unrelated copy).
+ * Returns [{ tool, raw, resolved, mode: 'copy' | 'repo-path' }].
  */
-function detectInstallMode(tools) {
+export function resolveHookClientPaths(tools) {
   // Normalise both sides to forward slashes before comparing — captureCommand
   // always emits forward-slash paths into the hook command, but join() on
   // Windows returns backslashes, so a raw startsWith() check would miss every
@@ -116,24 +118,40 @@ function detectInstallMode(tools) {
   for (const tool of tools) {
     const cmd = extractHookCommand(tool);
     if (!cmd) continue;
-    // Match either a launcher (run.sh / run.cmd) or a legacy capture.js path. The launcher
-    // always lives in the install dir, so it's by definition copy-mode.
-    const m = cmd.match(/["']([^"']*(?:capture\.js|run\.(?:sh|cmd)))["']|(\S*(?:capture\.js|run\.(?:sh|cmd)))/);
-    if (m) paths.push({ tool: tool.name, raw: m[1] || m[2], resolved: expandTilde(m[1] || m[2]).replace(/\\/g, '/') });
+    // Match either a launcher (run.sh / run.cmd / ai-lens-hook.ps1) or a capture.js path.
+    // A launcher always lives in the install dir, so it's by definition copy-mode.
+    const m = cmd.match(/["']([^"']*(?:capture\.js|run\.(?:sh|cmd)|ai-lens-hook\.ps1))["']|(\S*(?:capture\.js|run\.(?:sh|cmd)|ai-lens-hook\.ps1))/);
+    if (!m) continue;
+    const raw = m[1] || m[2];
+    const resolved = expandTilde(raw).replace(/\\/g, '/');
+    paths.push({ tool: tool.name, raw, resolved, mode: resolved.startsWith(copyDir) ? 'copy' : 'repo-path' });
+  }
+  return paths;
+}
+
+/** Read the `version` field from a package.json, or null if unreadable. */
+function readPackageVersion(pkgJsonPath) {
+  try {
+    const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'));
+    return pkg.version || null;
+  } catch {
+    return null;
   }
+}
+
+/**
+ * Detect install mode from the capture.js path in hook commands.
+ * Returns { ok, summary, detail } for the status output.
+ */
+function detectInstallMode(tools) {
+  const paths = resolveHookClientPaths(tools);
   if (paths.length === 0) {
     return { ok: null, summary: 'unknown', detail: 'No hook commands found — cannot determine install mode' };
   }
-  const modes = paths.map(p => {
-    if (p.resolved.startsWith(copyDir)) return 'copy';
-    return 'repo-path';
-  });
+  const modes = paths.map(p => p.mode);
   const unique = [...new Set(modes)];
   const mode = unique.length === 1 ? unique[0] : 'mixed';
-  const detail = paths.map(p => {
-    const m = p.resolved.startsWith(copyDir) ? 'copy' : 'repo-path';
-    return `  ${p.tool}: ${m} (${p.raw})`;
-  }).join('\n');
+  const detail = paths.map(p => `  ${p.tool}: ${p.mode} (${p.raw})`).join('\n');
 
   if (mode === 'copy') {
     return { ok: true, summary: 'copy (~/.ai-lens/client/)', detail: `Client files copied to ~/.ai-lens/client/\nUpdate: npx -y ai-lens init --yes\n${detail}` };
@@ -492,7 +510,37 @@ function checkGitIdentity() {
   return { ok: false, summary: 'not configured', detail: 'Git identity not configured (git config user.email)' };
 }
 
-function checkClientFiles() {
+export function checkClientFiles(tools = []) {
+  // In repo-path mode the hooks run capture.js straight from the repo, so the
+  // ~/.ai-lens/client/ copy (if any) is an UNUSED leftover from a prior copy-mode
+  // install. Reading that copy's version.json there would falsely flag the client
+  // "outdated" while the live client (the repo) is current — so check the version
+  // of the path the hooks actually execute.
+  const repoHook = resolveHookClientPaths(tools).find(p => p.mode === 'repo-path');
+  if (repoHook) {
+    // package.json sits one level up from the client/ dir the hook points into.
+    const pkgPath = repoHook.resolved.replace(/\/client\/[^/]+$/i, '/package.json');
+    const repoVersion = readPackageVersion(pkgPath);
+    const copyExists = existsSync(join(homedir(), '.ai-lens', 'client', 'capture.js'));
+    let detail = `Hooks run the client from the repo (repo-path mode) — auto-updates on git pull:\n  ${repoHook.raw}`;
+    detail += repoVersion
+      ? `\n  Repo client version: ${repoVersion}`
+      : `\n  Repo client version: unknown (no package.json at ${pkgPath})`;
+    if (copyExists) {
+      detail += `\n  Note: ~/.ai-lens/client/ exists but is UNUSED in repo-path mode (stale leftover from an old copy-install; safe to ignore).`;
+    }
+    // Healthy as long as the hook-source version is readable. Don't compare against
+    // the CLI: `ai-lens status` may run from a global npx CLI while the hooks point
+    // at a checkout — that mismatch is expected, not an error. A stale repo checkout
+    // surfaces via git (and the version line above), not as a false ✗ here.
+    return {
+      ok: repoVersion != null,
+      summary: repoVersion ? `repo-path (v${repoVersion})` : 'repo-path (version unknown)',
+      detail,
+    };
+  }
+
+  // Copy-mode (or no hooks resolved): the ~/.ai-lens/client/ copy IS the live client.
   const dir = join(homedir(), '.ai-lens', 'client');
   const files = ['capture.js', 'sender.js', 'config.js'];
   const results = files.map(f => ({ name: f, exists: existsSync(join(dir, f)) }));
@@ -1427,16 +1475,19 @@ export default async function status({ report = false } = {}) {
   // 3. Git identity
   printLine('Git identity', checkGitIdentity());
 
+  // Resolve the tools (incl. project hooks) up front — checkClientFiles needs them
+  // to read the version of the path the hooks actually run (repo-path vs copy).
+  const installedTools = detectInstalledTools();
+  const toolsWithProject = getToolsForCaptureTest();
+
   // 4. Client files
-  printLine('Client files', checkClientFiles());
+  printLine('Client files', checkClientFiles(toolsWithProject));
 
   // 5. Config
   const configResult = checkConfig();
   printLine('Config', configResult);
 
   // 6. Hooks: global + project (Cursor then Claude Code; within each: global then project)
-  const installedTools = detectInstalledTools();
-  const toolsWithProject = getToolsForCaptureTest();
   const isGlobalTool = (tool) => TOOL_CONFIGS.includes(tool);
   const toolLabel = (tool) => (isGlobalTool(tool) ? `${tool.name} (global)` : tool.name);
   const hooksOrder = (a, b) => {

package/client/ai-lens-hook.ps1

@@ -8,7 +8,8 @@
 #     never reaches capture.js (it reads empty stdin and drops the event).
 # This launcher instead starts node via ProcessStartInfo with CreateNoWindow=$true (no
 # window) and RedirectStandardInput (real stdin forwarded) — so capture works AND there's
-# no flash, and nothing extra is written to stdout.
+# no flash. It is fail-open: on ANY error it exits 0 and writes NOTHING to stdout (Cursor
+# parses a hook's stdout as JSON — leaking an error there would break the hook).
 #
 # Payload source differs by caller, so read BOTH:
 #   - Cursor pipes it through the PowerShell pipeline → $input.
@@ -18,22 +19,32 @@
 # Args: $args[0] = node path, $args[1] = capture.js path.
 
 $ErrorActionPreference = 'Stop'
-$node = $args[0]
-$capture = $args[1]
+try {
+  $node = $args[0]
+  $capture = $args[1]
 
-$payload = @($input) -join "`n"
-if ([string]::IsNullOrEmpty($payload)) {
-  $payload = [Console]::In.ReadToEnd()
-}
+  $payload = @($input) -join "`n"
+  if ([string]::IsNullOrEmpty($payload)) {
+    $payload = [Console]::In.ReadToEnd()
+  }
 
-$psi = New-Object System.Diagnostics.ProcessStartInfo
-$psi.FileName = $node
-$psi.Arguments = '"' + $capture + '"'
-$psi.UseShellExecute = $false
-$psi.CreateNoWindow = $true
-$psi.RedirectStandardInput = $true
+  $psi = New-Object System.Diagnostics.ProcessStartInfo
+  $psi.FileName = $node
+  $psi.Arguments = '"' + $capture + '"'
+  $psi.UseShellExecute = $false
+  $psi.CreateNoWindow = $true
+  $psi.RedirectStandardInput = $true
 
-$proc = [System.Diagnostics.Process]::Start($psi)
-$proc.StandardInput.Write($payload)
-$proc.StandardInput.Close()
-$proc.WaitForExit()
+  $proc = [System.Diagnostics.Process]::Start($psi)
+  # Write the payload as raw UTF-8 bytes to node's stdin (capture.js reads UTF-8). Going
+  # through BaseStream avoids the StreamWriter's default codepage on Windows PowerShell
+  # 5.1 mangling non-ASCII content (e.g. Cyrillic prompts, accented paths).
+  $bytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
+  $proc.StandardInput.BaseStream.Write($bytes, 0, $bytes.Length)
+  $proc.StandardInput.BaseStream.Flush()
+  $proc.StandardInput.Close()
+  $proc.WaitForExit()
+} catch {
+  # Fail-open: never disrupt the session, never emit non-JSON to the hook's stdout.
+  exit 0
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-lens",
-  "version": "0.8.100",
+  "version": "0.8.103",
   "type": "module",
   "description": "Centralized session analytics for AI coding tools",
   "bin": {