ai-lens 0.8.110 → 0.8.112

package/.commithash

@@ -1 +1 @@
-a16390a
+1411e25

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 History of changes to the `ai-lens` CLI package on npm. New entries go on top. Format: `## X.Y.Z — YYYY-MM-DD`, followed by user-facing bullets.
 
+## 0.8.112 — 2026-06-23
+- feat: re-running `init --yes` no longer changes your MCP registration. On an already-set-up install it's left exactly as-is — if MCP is registered it stays (same scope), if it isn't it's left off — instead of being removed-and-re-added at user scope (which could migrate its scope, force it on, or drop it if the re-add failed). Fresh installs still register MCP; use `init --mcp-only` to deliberately (re)register.
+
+## 0.8.111 — 2026-06-23
+- fix(status): case-fold project-filter-mismatch buckets on Windows
+- fix(client): tolerate Cursor Windows mojibake paths in project_filter
+- fix(status): project hooks "absent" and benign capture drops are info, not errors
+
 ## 0.8.110 — 2026-06-23
 - feat: `init` now sends a status report to the server right after it finishes, so the server has your current config (including which `projects` are tracked) and confirmation that hooks fire — no need to run `ai-lens status` by hand. The diagnostic runs quietly: just one summary line on screen.
 

package/README.md

@@ -222,6 +222,12 @@ When MCP is enabled during `npx ai-lens init`, these tools become available insi
 | `get_chain_analysis` | AI-generated chain analysis: tasks, problems, tool errors, unanswered questions |
 | `request_analysis` | Manually trigger analysis for a specific session chain |
 | `get_token_usage` | Token usage statistics grouped by model (input/output/cache tokens) |
+| `get_cost` | Dual-track cost breakdown (billed / estimated / subscription, do not sum) + by-model for a period; scope company/team/developer/bot |
+| `get_cost_ranking` | Ranked cost by team or by people for a period |
+| `get_cost_attribution` | Attribution health of factual Cursor spend — unattributed money and the people behind it |
+| `get_cost_trend` | Company dual-track cost time-series over the last N buckets |
+| `get_analysis_spend` | AI-Lens's own LLM (analysis pipeline) spend — daily series, total, delta, by source |
+| `manage_subscription_fee` | Manage the manual per-developer × tool monthly seat fee (the subscription lane) |
 | `knowhow_search` | Search the team knowledge base built from session analyses |
 | `knowhow_update` | Add or update a knowledge base entry |
 | `export_developer_tips` | Export personalized tips as a Markdown document |

package/cli/init.js

@@ -66,6 +66,24 @@ export function importMode(flags = {}) {
   return 'prompt';                         // interactive: ask
 }
 
+// How the FULL init flow should handle the MCP registration. Returns:
+//   'skip'     — never touch MCP (today's --no-mcp behavior; existing reg left intact)
+//   'preserve' — existing install under --yes: leave MCP exactly as-is (no add/remove/migrate)
+//   'setup'    — fresh install under --yes, or interactive: register (onboarding / prompt)
+//
+// On an EXISTING install under --yes, MCP is ALWAYS preserved — neither --project-hooks
+// nor --mcp-scope re-registers it. This stops `setupMcpServers` (which removes at all
+// scopes then re-adds at one) from migrating an existing local/project registration to
+// `user`, force-adding MCP for someone who never had it, or leaving MCP removed-but-not-
+// re-added when the `claude mcp add` fails. The only explicit (re)register path is the
+// separate `--mcp-only` branch, which never reaches this gate.
+// "Existing install" = a prior auth token in config (read before this run authenticates).
+export function mcpSetupAction({ noMcp, auto, hasToken } = {}) {
+  if (noMcp) return 'skip';
+  if (auto && hasToken) return 'preserve';
+  return 'setup';
+}
+
 function getJson(url) {
   return new Promise((resolve, reject) => {
     const parsed = new URL(url);
@@ -1305,14 +1323,23 @@ export default async function init() {
   // --project-hooks installs hooks at project scope, so mirror that for the MCP:
   // default the scope to local and target the project .cursor/mcp.json (an explicit
   // --mcp-scope still wins; setupMcpServers maps scope → Cursor target).
-  if (!flags.noMcp) {
+  const mcpAction = mcpSetupAction({
+    noMcp: flags.noMcp,
+    auto,
+    hasToken: Boolean(currentConfig.authToken),
+  });
+  if (mcpAction === 'setup') {
     await setupMcpServers(serverUrl, {
       auto,
       mcpScope: flags.mcpScope,
       forcedScope: (flags.projectHooks && !flags.mcpScope) ? 'local' : null,
       projectRoot: flags.projectHooks ? resolve(process.cwd()) : null,
     });
+  } else if (mcpAction === 'preserve') {
+    // Existing install under --yes: leave the current MCP registration untouched.
+    info('  MCP: сохранён как есть (для (пере)регистрации — npx -y ai-lens init --mcp-only)');
   }
+  // 'skip' (--no-mcp) → do nothing; an existing registration is left intact.
 
   // Quick verification
   heading('Verification');

package/cli/status.js

@@ -9,6 +9,8 @@ import { TLS_TRUST_CODES, tlsCodeOf, tlsVerdictSummary, issuerName } from '../cl
 
 import { getVersionInfo, readLensConfig, detectInstalledTools, getCursorToolConfig, getClaudeCodeToolConfig, getCodexToolConfig, analyzeToolHooks, checkHooksDisabled, verifyCodexHookTrust, CAPTURE_PATH, TOOL_CONFIGS, isClaudeProjectDirCommand, analyzeClaudeLocalOverlay, extractProjectDirRelPath, globalClaudeHooksActive, CONHOST_HEADLESS_PREFIX_RE } from './hooks.js';
 import { DATA_DIR, PENDING_DIR, SENDING_DIR, SESSION_PATHS_DIR, LOG_PATH, CAPTURE_LOG_PATH, LAST_STATUS_REPORT_PATH, getGitIdentity, getMonitoredProjects } from '../client/config.js';
+import { recoverMojibake } from '../client/mojibake-fix.js';
+import { isProjectMonitored } from '../client/capture.js';
 import { isLockStale } from '../client/sender.js';
 import { initLogger, info, success, warn, error, heading, blank, detail, setScreenQuiet } from './logger.js';
 import { scanNestedProjects, summarizeNestedProjects } from './scan.js';
@@ -610,7 +612,7 @@ function checkConfig() {
   };
 }
 
-function checkHooks(tool) {
+export function checkHooks(tool) {
   const analysis = analyzeToolHooks(tool);
   const statusMap = {
     fresh: { ok: null, label: 'no config file' },
@@ -633,6 +635,21 @@ function checkHooks(tool) {
     }
   } catch { /* file doesn't exist or isn't valid */ }
 
+  // Project-scope hooks are opt-in (init --project-hooks). A project config that
+  // simply carries no AI Lens hooks ("absent") is informational, NOT a failure —
+  // it's the default for almost every repo with a committed .claude/.cursor config,
+  // and capture is handled by the global hooks. A genuine no-capture state (nothing
+  // installed in any scope) is still surfaced by the "Hook mode: none" check and the
+  // global tool lines, so this never hides a real problem.
+  const isProjectScope = tool.dirPath && dirname(tool.dirPath) !== homedir();
+  if (analysis.status === 'absent' && isProjectScope) {
+    return {
+      ok: null,
+      summary: 'no project hooks (opt-in)',
+      detail: `${detail}\n\nNo AI Lens hooks in this project's config — informational only. Project hooks are opt-in (npx -y ai-lens init --project-hooks); capture runs via the global hooks when installed.`,
+    };
+  }
+
   // Check if hooks are globally disabled (e.g. disableAllHooks in settings.local.json)
   const disabled = checkHooksDisabled(tool);
   if (disabled.length > 0) {
@@ -852,14 +869,14 @@ function checkSenderLog() {
   };
 }
 
-function checkCaptureLog() {
-  if (!existsSync(CAPTURE_LOG_PATH)) {
+export function checkCaptureLog(logPath = CAPTURE_LOG_PATH) {
+  if (!existsSync(logPath)) {
     return { ok: true, summary: 'no drops logged', detail: 'Capture log does not exist (no events dropped)' };
   }
 
   let lines;
   try {
-    lines = readFileSync(CAPTURE_LOG_PATH, 'utf-8').split(/\r?\n/).filter(Boolean);
+    lines = readFileSync(logPath, 'utf-8').split(/\r?\n/).filter(Boolean);
   } catch (err) {
     return { ok: false, summary: `error reading log: ${err.message}`, detail: `Error: ${err.message}` };
   }
@@ -869,10 +886,19 @@ function checkCaptureLog() {
   // code distribution per category so it reaches the server via client_reports
   // — the count alone can't tell EMFILE from EACCES from ENOENT. The raw
   // error.message strings stay local (may contain paths); only the code travels.
+  // Severity of capture-log entries:
+  //  - `reason` entries are expected gate DROPS (project_filter / no_email /
+  //    duplicate / …) — never a problem, they reflect your own config.
+  //  - `msg` entries are capture-side errors. Split them: SOFT transient read
+  //    errors (transcript-offset-*: a re-read/offset race, not a broken setup)
+  //    surface as informational; HARD errors (queue/spawn/capture failures) mean
+  //    capture is actually failing and stay a hard ✗.
+  const SOFT_ERROR_MSGS = new Set(['transcript-offset-error', 'transcript-offset-commit-failed']);
   const counts = {};
   const codesByCategory = {};
   let lastTs = null;
-  let hasErrors = false;
+  let hasHardError = false;
+  let hasSoftError = false;
   for (const line of lines) {
     try {
       const entry = JSON.parse(line);
@@ -883,7 +909,10 @@ function checkCaptureLog() {
         codesByCategory[category][entry.code] = (codesByCategory[category][entry.code] || 0) + 1;
       }
       lastTs = entry.ts;
-      if (entry.msg) hasErrors = true;
+      if (entry.msg) {
+        if (SOFT_ERROR_MSGS.has(entry.msg)) hasSoftError = true;
+        else hasHardError = true;
+      }
     } catch { /* non-JSON line */ }
   }
 
@@ -906,13 +935,79 @@ function checkCaptureLog() {
   const codeBlock = codeLines.length ? `\n\nError codes by category:\n${codeLines.join('\n')}` : '';
   const last10 = lines.slice(-10);
 
+  // Hard error → ✗; only soft/transient errors → informational '-'; pure drops → ✓.
   return {
-    ok: !hasErrors,
+    ok: hasHardError ? false : (hasSoftError ? null : true),
     summary,
-    detail: `Log: ${CAPTURE_LOG_PATH}\nTotal: ${total}${codeBlock}\n\nLast 10 entries:\n${last10.join('\n')}`,
+    detail: `Log: ${logPath}\nTotal: ${total}${codeBlock}\n\nLast 10 entries:\n${last10.join('\n')}`,
   };
 }
 
+// Render a captured (Cursor URI-style, forward-slash) path as a native path for
+// the fix hint — `/c:/a/b` → `C:\a\b` on Windows; unchanged elsewhere.
+function toDisplayPath(p) {
+  if (process.platform !== 'win32' || typeof p !== 'string') return p;
+  let n = p.replace(/^\/([a-zA-Z]:)/, '$1').replace(/\//g, '\\');
+  return n.replace(/^([a-z]):/, (_m, d) => d.toUpperCase() + ':');
+}
+
+// Surface project_filter drops where the user's ACTUAL working project isn't in
+// the `projects` filter — real events silently dropped. The plain "Capture drops"
+// counter hides this. Recovers Cursor 3.2.x+ Windows mojibake paths before the
+// coverage check so they aren't flagged once the capture-side fix matches them.
+// Guards against false positives: only entries logged under the CURRENT live
+// filter (drops the status self-test's own synthetic drops + stale-config
+// entries), excludes the self-test session/paths, and needs a meaningful count.
+const PROJECT_FILTER_MISMATCH_MIN = 5;
+export function checkProjectFilterMismatch(logPath = CAPTURE_LOG_PATH, monitored = getMonitoredProjects()) {
+  if (!monitored) return { ok: true, summary: 'no filter configured (capturing all)', detail: 'projects filter is unset — nothing to mismatch.' };
+  if (!existsSync(logPath)) return { ok: true, summary: 'no drops logged', detail: 'Capture log does not exist.' };
+
+  let lines;
+  try { lines = readFileSync(logPath, 'utf-8').split(/\r?\n/).filter(Boolean); }
+  catch (err) { return { ok: true, summary: 'log unreadable', detail: `Error: ${err.message}` }; }
+
+  const liveSig = JSON.stringify([...monitored].sort());
+  const byPath = new Map(); // case-normalized key -> { display, count }
+  for (const line of lines) {
+    let e;
+    try { e = JSON.parse(line); } catch { continue; }
+    if (e.reason !== 'project_filter' || typeof e.project_path !== 'string' || !e.project_path) continue;
+    // Skip the status self-test's own synthetic drops.
+    if (typeof e.session_id === 'string' && e.session_id.startsWith('status-check-')) continue;
+    if (e.project_path.includes('.ai-lens-status-check')) continue;
+    // Only entries logged under the CURRENT filter — drops stale-config and the
+    // self-test's `AI_LENS_PROJECTS=…status-check-nonexistent` runs.
+    const sig = Array.isArray(e.monitored) ? JSON.stringify([...e.monitored].sort()) : null;
+    if (sig !== liveSig) continue;
+    // If the live filter already covers it (raw OR mojibake-recovered), the
+    // capture-side fix will keep it — not a mismatch.
+    if (isProjectMonitored(e.project_path, [], monitored)) continue;
+    const display = toDisplayPath(recoverMojibake(e.project_path));
+    // Key case-insensitively on Windows so the same project logged with
+    // differing case doesn't split across buckets and dodge the threshold.
+    const key = process.platform === 'win32' ? display.toLowerCase() : display;
+    const cur = byPath.get(key);
+    if (cur) cur.count++;
+    else byPath.set(key, { display, count: 1 });
+  }
+
+  const offenders = [...byPath.values()].filter(o => o.count >= PROJECT_FILTER_MISMATCH_MIN).sort((a, b) => b.count - a.count);
+  if (offenders.length === 0) return { ok: true, summary: 'filter matches captured paths', detail: 'No project_filter drops outside the configured filter.' };
+
+  const { display: topPath, count: topCount } = offenders[0];
+  const filterStr = monitored.join(', ');
+  const detail =
+    `⚠️ Фильтр projects не покрывает твой рабочий путь — события отбрасываются (project_filter).\n` +
+    `   Рабочий путь: ${topPath}\n` +
+    `   В фильтре:    ${filterStr}\n` +
+    `   Почини: org-разработчику — /sync + /setup; иначе добавь путь в фильтр:\n` +
+    `   npx -y ai-lens@latest init --yes --projects "${topPath}"\n` +
+    `   (если этот проект исключён намеренно — игнорируй)` +
+    (offenders.length > 1 ? `\n   Ещё путей вне фильтра: ${offenders.length - 1}` : '');
+  return { ok: null, summary: `⚠ ${topCount} событий отброшено — рабочий путь не в фильтре projects`, detail };
+}
+
 function checkRealActivity() {
   try {
     if (!existsSync(SESSION_PATHS_DIR)) {
@@ -1624,6 +1719,7 @@ export default async function status({ report = false, quiet = false } = {}) {
 
   // 10. Capture drops
   printLine('Capture drops', checkCaptureLog());
+  printLine('Project filter', checkProjectFilterMismatch());
 
   // 11. Real activity
   const realActivityResult = checkRealActivity();

package/client/capture.js

@@ -41,6 +41,16 @@ try {
   redactObject = mod.redactObject ?? ((o) => o);
 } catch { /* redact.js not installed yet — skip redaction, server will handle it */ }
 
+// Soft import — mojibake-fix.js may not exist on older client installs.
+// recoverMojibake repairs Cursor 3.2.x+ Windows mojibake (CP1251/CP1252 double
+// UTF-8) for the project_filter MATCH decision only; the raw payload is never
+// mutated (the server stays the canonical recoverer on ingest).
+let recoverMojibake = (s) => s;
+try {
+  const mod = await import('./mojibake-fix.js');
+  recoverMojibake = mod.recoverMojibake ?? ((s) => s);
+} catch { /* mojibake-fix.js not installed yet — skip recovery, server recovers on ingest */ }
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
 /**
@@ -964,7 +974,7 @@ const CURSOR_TYPE_MAP = {
 // to forward slashes before comparing. On Windows the filesystem is
 // case-insensitive, so we also lowercase both sides to prevent mismatches
 // when realpathSync returns a different case than the configured path.
-function pathContains(parent, child) {
+export function pathContains(parent, child) {
   if (!parent || !child || typeof parent !== 'string' || typeof child !== 'string') return false;
   const norm = s => {
     let n = s.replace(/\\/g, '/').replace(/\/$/, '');
@@ -977,6 +987,36 @@ function pathContains(parent, child) {
   return c === p || c.startsWith(p + '/');
 }
 
+// Decide whether an event's project is covered by the monitored filter.
+// Tolerates the mojibake `project_path` Cursor 3.2.x+ emits on Windows
+// (CP1251/CP1252 double-UTF-8): each candidate is matched BOTH as-is and via
+// recoverMojibake(). The recovered form is used ONLY here for the match — the
+// raw payload is shipped unchanged and the server recovers it on ingest.
+// Returns true (= keep) when no filter is configured or no project_path is
+// present, preserving the prior gate's "can't filter → pass through" behavior.
+export function isProjectMonitored(projectPath, workspaceRoots, monitored) {
+  if (!monitored) return true;
+  if (!projectPath) return true;
+  const candidates = [];
+  const add = (v) => {
+    if (typeof v !== 'string' || !v) return;
+    candidates.push(v);
+    const fixed = recoverMojibake(v);
+    if (fixed !== v) candidates.push(fixed);
+  };
+  let resolved = projectPath;
+  try { resolved = realpathSync(projectPath); } catch {}
+  add(resolved);
+  add(projectPath); // raw (realpathSync fails on a mojibake path, so keep the original too)
+  for (const r of (Array.isArray(workspaceRoots) ? workspaceRoots : [])) {
+    let rr = r;
+    try { rr = realpathSync(r); } catch {}
+    add(rr);
+    add(r);
+  }
+  return candidates.some(c => monitored.some(p => pathContains(p, c)));
+}
+
 function pickWorkspaceRoot(roots) {
   if (!Array.isArray(roots) || roots.length === 0) return null;
   const valid = roots.filter(r => typeof r === 'string' && r.length > 0);
@@ -987,7 +1027,8 @@ function pickWorkspaceRoot(roots) {
     const match = valid.find(root => {
       let resolved = root;
       try { resolved = realpathSync(root); } catch {}
-      return monitored.some(p => pathContains(p, resolved));
+      // Match raw OR mojibake-recovered (Cursor Windows non-ASCII paths).
+      return monitored.some(p => pathContains(p, resolved) || pathContains(p, recoverMojibake(resolved)));
     });
     if (match) return match;
   }
@@ -1527,16 +1568,12 @@ async function main() {
   // If the primary is filtered out, drop the entire batch (the per-call events
   // share the same project_path).
   const monitored = getMonitoredProjects();
-  let projectPath = primary.project_path;
-  try { projectPath = realpathSync(projectPath); } catch {}
-  if (monitored && projectPath && !monitored.some(p => pathContains(p, projectPath))) {
-    // Fallback: for Cursor multi-root workspaces, check if any raw workspace_roots entry matches
-    const roots = Array.isArray(event.workspace_roots) ? event.workspace_roots : [];
-    const resolvedRoots = roots.map(r => { try { return realpathSync(r); } catch { return r; } });
-    if (!resolvedRoots.some(root => monitored.some(p => pathContains(p, root)))) {
-      logDrop('project_filter', { type: primary.type, source: primary.source, session_id: primary.session_id, project_path: primary.project_path, monitored });
-      process.exit(0);
-    }
+  // isProjectMonitored matches the primary project_path AND any Cursor
+  // workspace_roots, each as-is and mojibake-recovered (Cursor 3.2.x+ Windows
+  // CP1251/CP1252 paths). It returns true when no filter / no project_path.
+  if (!isProjectMonitored(primary.project_path, event.workspace_roots, monitored)) {
+    logDrop('project_filter', { type: primary.type, source: primary.source, session_id: primary.session_id, project_path: primary.project_path, monitored });
+    process.exit(0);
   }
 
   // Resolve identity: git first, then fall back to event payload (e.g. Cursor's user_email)

package/client/mojibake-fix.js

@@ -0,0 +1,192 @@
+/**
+ * Mojibake recovery for "double UTF-8" corruption from Cursor 3.2.x+ on Windows.
+ *
+ * CLIENT copy. This is a verbatim port of `server/utils/mojibake-fix.js` so the
+ * client-side project_filter can recover a mojibake `project_path` for the MATCH
+ * DECISION ONLY (the raw payload is shipped unchanged — the server stays the
+ * canonical recoverer on ingest). The client bundle (~/.ai-lens/client/) cannot
+ * import from server/, and the server image is esbuild-bundled without client/,
+ * so the two copies are kept identical by a parity test
+ * (test/client/mojibake-fix-parity.test.js) rather than a shared import.
+ *
+ * Two patterns observed in production:
+ *   - Pattern B (CP1252 -> UTF-8): UTF-8 bytes (D0 95 = "Е") read as
+ *     Windows-1252 ("Е") and re-encoded as UTF-8. English/Western
+ *     Windows locales.
+ *   - Pattern A (CP1251 -> UTF-8): same, but read as Windows-1251
+ *     (D0 9A = "К" -> "Рљ"). Russian Windows locales.
+ *
+ * Recovery: encode each char back to its codepage byte, then strict-decode as
+ * UTF-8. Conservative -- only accepts the recovered string if it contains
+ * strictly more "plain" Cyrillic (a-z A-Z e E in Cyrillic) than the input.
+ */
+
+// CP1251 byte -> Unicode code point. -1 = undefined byte.
+const CP1251_FROM_BYTE = (() => {
+  const t = new Array(256);
+  for (let i = 0; i < 0x80; i++) t[i] = i;
+  const upper = [
+    0x0402, 0x0403, 0x201A, 0x0453, 0x201E, 0x2026, 0x2020, 0x2021,
+    0x20AC, 0x2030, 0x0409, 0x2039, 0x040A, 0x040C, 0x040B, 0x040F,
+    0x0452, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014,
+    -1,     0x2122, 0x0459, 0x203A, 0x045A, 0x045C, 0x045B, 0x045F,
+    0x00A0, 0x040E, 0x045E, 0x0408, 0x00A4, 0x0490, 0x00A6, 0x00A7,
+    0x0401, 0x00A9, 0x0404, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x0407,
+    0x00B0, 0x00B1, 0x0406, 0x0456, 0x0491, 0x00B5, 0x00B6, 0x00B7,
+    0x0451, 0x2116, 0x0454, 0x00BB, 0x0458, 0x0405, 0x0455, 0x0457,
+  ];
+  for (let i = 0; i < upper.length; i++) t[0x80 + i] = upper[i];
+  for (let i = 0; i < 64; i++) t[0xC0 + i] = 0x0410 + i;
+  return t;
+})();
+
+// CP1252 byte -> Unicode. 0x80-0x9F have a few unused slots; rest is identity.
+const CP1252_FROM_BYTE = (() => {
+  const t = new Array(256);
+  for (let i = 0; i < 256; i++) t[i] = i;
+  const upper = [
+    0x20AC, -1,     0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021,
+    0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, -1,     0x017D, -1,
+    -1,     0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014,
+    0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, -1,     0x017E, 0x0178,
+  ];
+  for (let i = 0; i < upper.length; i++) if (upper[i] !== -1) t[0x80 + i] = upper[i];
+  return t;
+})();
+
+// Reverse maps: Unicode code point -> byte.
+function buildReverse(forward) {
+  const m = new Map();
+  for (let b = 0; b < 256; b++) if (forward[b] !== -1) m.set(forward[b], b);
+  return m;
+}
+const CP1251_TO_BYTE = buildReverse(CP1251_FROM_BYTE);
+const CP1252_TO_BYTE = buildReverse(CP1252_FROM_BYTE);
+
+function encodeWith(str, reverseMap) {
+  const bytes = Buffer.alloc(str.length);
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    const b = reverseMap.get(code);
+    if (b === undefined) return null;
+    bytes[i] = b;
+  }
+  return bytes;
+}
+
+// Lossy variant: substitutes 0x3F ('?') for unmappable chars. Used by the
+// loose-decode fallback when strict encode fails because Cursor inserted
+// a stray non-codepage char (e.g., '–' EM-DASH from autocorrect).
+function encodeWithLossy(str, reverseMap) {
+  const bytes = Buffer.alloc(str.length);
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    const b = reverseMap.get(code);
+    bytes[i] = b !== undefined ? b : 0x3F;
+  }
+  return bytes;
+}
+
+function strictUtf8Decode(buf) {
+  try {
+    return new TextDecoder('utf-8', { fatal: true }).decode(buf);
+  } catch {
+    return null;
+  }
+}
+
+function looseUtf8Decode(buf) {
+  // Non-fatal: invalid byte sequences become U+FFFD replacement chars.
+  return new TextDecoder('utf-8').decode(buf);
+}
+
+function countReplacements(str) {
+  let n = 0;
+  for (let i = 0; i < str.length; i++) if (str.charCodeAt(i) === 0xFFFD) n++;
+  return n;
+}
+
+const PLAIN_CYRILLIC_RE = /[А-яЁё]/g;
+// Mojibeka marker chars that real Russian/English text never contains:
+//   - Latin1 supplement (À-ÿ) — Pattern B leaves these littered throughout.
+//   - Non-Russian Cyrillic supplement (Ѐ-Џ, ѐ-џ, Ґ-ӿ) — Pattern A's signature.
+const NOISE_RE = /[À-ÿЀ-Џѐ-џҐ-ӿ]/g;
+function countMatches(re, str) {
+  const m = str.match(re);
+  return m ? m.length : 0;
+}
+
+// Marker A: any latin1-supplement letter (À-ÿ) -- these almost never
+//   appear in our event data outside of Pattern-B mojibeka.
+// Marker B: standard Russian Cyrillic (А-яЁё) immediately
+//   followed by a non-Russian Cyrillic supplement (Ѐ-Џѐ-џҐ-ӿ).
+//   Plain Russian text never produces such adjacency, but Pattern-A mojibeka
+//   does (e.g., "Рљ" = mojibeka of "К").
+const MOJIBAKE_HINT_RE = /[À-ÿ]|[А-яЁё][Ѐ-Џѐ-џҐ-ӿ]/;
+
+/**
+ * Detect double-UTF-8 mojibeka (CP1252 or CP1251 flavour) and recover the
+ * original Cyrillic text. Returns the input unchanged if no improvement.
+ */
+export function recoverMojibake(str) {
+  if (typeof str !== 'string' || str.length < 2) return str;
+  if (!MOJIBAKE_HINT_RE.test(str)) return str;
+
+  const baseNoise = countMatches(NOISE_RE, str);
+  if (baseNoise === 0) return str;
+
+  for (const reverseMap of [CP1252_TO_BYTE, CP1251_TO_BYTE]) {
+    const bytes = encodeWith(str, reverseMap);
+    if (!bytes) continue;
+    const decoded = strictUtf8Decode(bytes);
+    if (decoded == null) continue;
+    // Accept if the round-trip strictly drops noise marker chars AND yields
+    // some real Russian content. Pure-mojibeka strings collapse 50/50
+    // markers→letters; partially mojibeked strings still see a strict drop.
+    const newNoise = countMatches(NOISE_RE, decoded);
+    const newCyrillic = countMatches(PLAIN_CYRILLIC_RE, decoded);
+    if (newNoise < baseNoise && newCyrillic > 0) return decoded;
+  }
+
+  // Loose-decode fallback. Triggers only when strict failed AND the input
+  // is densely mojibeked (>=5 marker chars). Cursor 3.2.x on Windows can
+  // drop the second byte of a 2-byte UTF-8 sequence (e.g., capslock + space
+  // shortcut), leaving "Р " instead of "Ри" — strict UTF-8 rejects, but
+  // non-fatal decode recovers the rest with a U+FFFD where the byte was lost.
+  // Tight thresholds keep clean Cyrillic, Ukrainian, and partially-corrupted
+  // text untouched: they all fail the >=10-cyrillic / <=5%-replacements
+  // / <=10%-residual-noise gate.
+  if (baseNoise >= 5) {
+    for (const reverseMap of [CP1252_TO_BYTE, CP1251_TO_BYTE]) {
+      const bytes = encodeWithLossy(str, reverseMap);
+      const decoded = looseUtf8Decode(bytes);
+      const newNoise = countMatches(NOISE_RE, decoded);
+      const newCyrillic = countMatches(PLAIN_CYRILLIC_RE, decoded);
+      const replacements = countReplacements(decoded);
+      if (newCyrillic >= 10
+          && newNoise <= baseNoise * 0.1
+          && replacements * 20 <= newCyrillic) {
+        return decoded;
+      }
+    }
+  }
+
+  return str;
+}
+
+/**
+ * Recursively walk an object and recover mojibeka in every leaf string.
+ * Mirrors `redactObject` (server/utils/redact.js): depth-guarded, returns a
+ * new object/array; primitives and non-objects pass through.
+ */
+export function walkAndFix(value, depth = 0) {
+  if (typeof value === 'string') return recoverMojibake(value);
+  if (depth >= 100) return value;
+  if (Array.isArray(value)) return value.map(v => walkAndFix(v, depth + 1));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = walkAndFix(v, depth + 1);
+    return out;
+  }
+  return value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-lens",
-  "version": "0.8.110",
+  "version": "0.8.112",
   "type": "module",
   "description": "Centralized session analytics for AI coding tools",
   "bin": {