ai-lens 0.8.98 → 0.8.100

package/.commithash

@@ -1 +1 @@
-5d8b7f1
+3ebf574

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 History of changes to the `ai-lens` CLI package on npm. New entries go on top. Format: `## X.Y.Z — YYYY-MM-DD`, followed by user-facing bullets.
 
+## 0.8.100 — 2026-06-17
+- fix: Claude Code hooks on Windows now actually capture. The previous windowless wrapper (`conhost.exe --headless`) hid the console window but silently swallowed the hook's stdin, so the event payload never reached AI Lens and nothing was recorded. Claude Code now uses the same windowless launcher as Cursor (`ai-lens-hook.ps1`), which both suppresses the window and delivers the payload. Existing installs migrate on the next `ai-lens init` / `/setup`. macOS/Linux unchanged. (The launcher was renamed from `cursor-ai-lens-hook.ps1` since it now serves both tools.)
+
+## 0.8.99 — 2026-06-17
+- fix: Cursor hooks on Windows no longer flash a console window on every event. The flash was `node.exe` (a console app) allocating its own window when Cursor runs the hook; a new windowless launcher (`cursor-ai-lens-hook.ps1`) starts node with no window and forwards the event to it, so capture keeps working with no flash. Existing Cursor installs migrate automatically on the next `ai-lens init` / `/setup`. macOS/Linux and Claude Code are unchanged
+
 ## 0.8.98 — 2026-06-17
 - fix: Cursor hooks on Windows no longer use the `conhost.exe --headless` wrapper — it made Cursor report a "JSON Parse Error" on every hook (conhost emits terminal escape codes that Cursor tries to parse as the hook's output) and broke capture. Cursor returns to the plain working form; machines that briefly got the conhost'd Cursor hook are auto-downgraded on the next `ai-lens init`/`/setup`. Claude Code keeps the windowless wrapper (it tolerates the output). The minor Cursor console flash on Windows is upstream Cursor behaviour
 

package/cli/hooks.js

@@ -295,11 +295,14 @@ export function captureCommand(opts = {}) {
   const clientDir = ctx.clientDir ?? CLIENT_INSTALL_DIR;
   const nodeResolution = ctx.nodeResolution;
   const isWin = platform === 'win32';
-  // Windows-only windowless wrapper (see supportsConhostHeadless). Gated by the
-  // `windowless` opt so it's applied to CLAUDE forms only — Cursor/Codex never set it
-  // (no reported flash + unverified conhost+stdin for those tools; ADR 0003 §3.2).
-  // A build < 1809 falls back to the bare form. Never applied off Windows.
-  const conhost = isWin && windowless && (ctx.conhost ?? supportsConhostHeadless());
+  // Windows windowless launcher (ai-lens-hook.ps1). Gated by the `windowless` opt, so
+  // it applies to CLAUDE forms only here — Cursor builds its own launcher form in
+  // cursorCaptureCommand, Codex never sets windowless. We DON'T use conhost.exe
+  // --headless: it hides the window but breaks capture (swallows node's stdin → the
+  // payload never arrives; and for Cursor it corrupts stdout). The launcher uses
+  // ProcessStartInfo + CreateNoWindow + RedirectStandardInput instead — windowless AND
+  // stdin-preserving — and works on all Windows (no ≥1809 requirement). Never off Windows.
+  const winLauncher = isWin && windowless;
   // shell hint distinguishes cmd.exe (Claude Code) from PowerShell (Cursor) on
   // Windows — the two need different escaping for paths with spaces.
   const isPS = shell === 'powershell';
@@ -314,12 +317,14 @@ export function captureCommand(opts = {}) {
   // POSIX shells use $VAR.
   if (projectDirRelPath != null) {
     const rel = projectDirRelPath.replace(/\\/g, '/').replace(/^\.?\/+/, '');
-    if (conhost) {
-      // Windowless form. conhost is the launched image (no cmd.exe shell), so the
-      // path must use $CLAUDE_PROJECT_DIR — Claude Code substitutes that variable
-      // itself before exec on every OS (the %VAR% form would survive unexpanded
-      // since there's no shell to expand it). Verified on Windows 11 / cc 2.1.177.
-      return `conhost.exe --headless node "$CLAUDE_PROJECT_DIR/${rel}"`;
+    if (winLauncher) {
+      // Windowless form via the launcher. Uses $CLAUDE_PROJECT_DIR — Claude Code
+      // substitutes that variable itself before exec on every OS. The launcher ships
+      // next to capture.js, so it resolves under the same $CLAUDE_PROJECT_DIR path.
+      // node stays bare (committed/machine-agnostic form) — the launcher's
+      // ProcessStartInfo resolves it via PATH (Claude Code requires node on PATH).
+      const launcherRel = rel.replace(/[^/]*$/, 'ai-lens-hook.ps1');
+      return `powershell -NoProfile -ExecutionPolicy Bypass -File "$CLAUDE_PROJECT_DIR/${launcherRel}" node "$CLAUDE_PROJECT_DIR/${rel}"`;
     }
     const dir = isWin ? '%CLAUDE_PROJECT_DIR%' : '$CLAUDE_PROJECT_DIR';
     return `node "${dir}/${rel}"`;
@@ -342,12 +347,15 @@ export function captureCommand(opts = {}) {
     : shellEscape(capturePath, platform);
   const nodeNorm = nodeResolution.path.replace(/\\/g, '/');
 
-  // Windowless (Claude + Windows ≥ 1809): conhost.exe is the launched image and runs
-  // node directly, so it needs neither the cmd.exe `call` nor the PowerShell `&`
-  // wrapper. stdin is forwarded (verified). The node path is always double-quoted on
-  // Windows (it can contain spaces, e.g. C:/Program Files/nodejs/node.exe).
-  if (conhost) {
-    return `conhost.exe --headless "${nodeNorm.replace(/"/g, '""')}" ${pathPart}`;
+  // Windowless (Claude on Windows): run node through the ai-lens-hook.ps1 launcher,
+  // which starts node with CreateNoWindow + forwards stdin (conhost would swallow it).
+  // Claude Code spawns powershell to run the launcher; the payload arrives on the
+  // process's OS stdin, which the launcher reads via [Console]::In. The launcher ships
+  // next to capture.js. node + capture + launcher all double-quoted (may contain spaces).
+  if (winLauncher) {
+    const q = (s) => `"${s.replace(/"/g, '""')}"`;
+    const launcherAbs = capturePath.replace(/[^/]*$/, 'ai-lens-hook.ps1');
+    return `powershell -NoProfile -ExecutionPolicy Bypass -File ${q(launcherAbs)} ${q(nodeNorm)} ${q(capturePath)}`;
   }
   if (isWin && rawPath && nodeNorm.includes(' ')) {
     const quotedNode = `"${nodeNorm.replace(/"/g, '""')}"`;
@@ -369,24 +377,35 @@ export function cursorCaptureCommand(opts = {}) {
   const { useTilde = false, customPath = null } = opts;
   const ctx = opts.ctx ?? resolveDefaultCtx();
   const platform = ctx.platform ?? process.platform;
-  // PowerShell doesn't expand ~ inside double-quoted strings — fall back to absolute.
-  const effectiveUseTilde = platform === 'win32' ? false : useTilde;
-  // Cursor on Windows runs hooks via PowerShell, so use the PS-compatible shell
-  // hint when building the underlying command (avoids the cmd.exe `call` prefix
-  // which PowerShell doesn't understand).
-  const shell = platform === 'win32' ? 'powershell' : null;
-  // NOTE: Cursor deliberately does NOT get the `conhost.exe --headless` windowless
-  // wrapper (unlike Claude Code). conhost runs a ConPTY and emits VT escape sequences
-  // (e.g. ESC[?9001h win32-input-mode) onto the hook's output stream, and Cursor
-  // parses a hook's stdout as JSON → "JSON Parse Error … is not valid JSON", which
-  // breaks the hook. Claude Code tolerates non-JSON hook stdout, so it keeps conhost.
-  // The residual Cursor console flash on Windows is upstream (how Cursor spawns the
-  // hook process) and is the lesser evil vs a broken hook. (ADR 0003 §3.2 deferred
-  // Cursor+conhost as unverified; verified incompatible — reverted here.)
-  const cmd = customPath != null
-    ? captureCommand({ rawPath: true, customPath, ctx, shell })
-    : captureCommand({ useTilde: effectiveUseTilde, ctx, shell });
-  return platform === 'win32' ? `& ${cmd}` : cmd;
+
+  if (platform === 'win32') {
+    // Windows: route node through the windowless launcher ai-lens-hook.ps1.
+    // Cursor spawns hooks via a hidden powershell and pipes the payload through the
+    // PS pipeline ($input); launching node.exe directly there pops a console window
+    // on every event (node is console-subsystem, parent powershell has no console).
+    // conhost.exe --headless hides the window but corrupts Cursor's JSON-parse of hook
+    // stdout with ConPTY VT codes (verified). The launcher starts node with
+    // CreateNoWindow=$true and forwards $input → node stdin: no window, clean stdout.
+    // Form: & "<...>/ai-lens-hook.ps1" "<absNode>" "<capture.js>"
+    const clientDir = (ctx.clientDir ?? CLIENT_INSTALL_DIR).replace(/\\/g, '/');
+    const nodeResolution = ctx.nodeResolution;
+    if (!nodeResolution || !nodeResolution.path) {
+      throw new Error('cursorCaptureCommand: nodeResolution is required');
+    }
+    const node = nodeResolution.path.replace(/\\/g, '/');
+    const capturePath = (customPath ?? `${clientDir}/capture.js`).replace(/\\/g, '/');
+    // The launcher ships next to capture.js (installed client dir, or the repo client
+    // dir for --use-repo-path) — derive its path from capturePath's directory.
+    const launcher = capturePath.replace(/[^/]*$/, 'ai-lens-hook.ps1');
+    const q = (s) => `"${s.replace(/"/g, '""')}"`;
+    return `& ${q(launcher)} ${q(node)} ${q(capturePath)}`;
+  }
+
+  // macOS / Linux: direct node, unchanged. (No console-window concept; conhost/launcher
+  // are Windows-only.)
+  return customPath != null
+    ? captureCommand({ rawPath: true, customPath, ctx })
+    : captureCommand({ useTilde, ctx });
 }
 
 // ---------------------------------------------------------------------------
@@ -401,7 +420,10 @@ export function cursorCaptureCommand(opts = {}) {
  * every hook with ERR_MODULE_NOT_FOUND on a missing sibling import.
  */
 export function listClientFiles(sourceDir = join(__dirname, '..', 'client')) {
-  return readdirSync(sourceDir).filter(f => f.endsWith('.js')).sort();
+  // .js — all client modules (sibling imports must all be present).
+  // .ps1 — the Windows windowless hook launcher (ai-lens-hook.ps1), used by Cursor AND
+  // Claude Code; a missing launcher would break every Windows hook, so ship it too.
+  return readdirSync(sourceDir).filter(f => f.endsWith('.js') || f.endsWith('.ps1')).sort();
 }
 
 /**
@@ -796,6 +818,7 @@ export function _parseHookCommand(cmd) {
     return { kind: 'launcher', path: first, prefix, nodePrefix: null };
   }
 
+
   if (tokens.length >= 2) {
     const second = normalizePath(tokens[1]);
     if (second.endsWith('capture.js')) {
@@ -853,8 +876,17 @@ function normalizePath(p) {
 // still classifies run.* as ai-lens so `remove`/strip cleans up stale launchers.)
 export function isGuiSafeHookCommand(cmd) {
   if (!isAiLensCommand(cmd).isAiLens) return false;
-  // capture.js form: GUI-safe only when the node binary is an absolute path
-  // (e.g. /opt/homebrew/bin/node), not bare `node` or an env shim.
+  // Our Windows windowless launcher (ai-lens-hook.ps1) is GUI-safe by construction — it
+  // starts node with CreateNoWindow. Matched by substring so it covers BOTH invocations:
+  // Cursor `& "<...>/ai-lens-hook.ps1" <node> <capture>` and Claude
+  // `powershell ... -File "<...>/ai-lens-hook.ps1" <node> <capture>` (also the older
+  // cursor-ai-lens-hook.ps1 name). The node arg's existence is validated in status.js.
+  const n = (cmd || '').replace(/\\/g, '/');
+  if (/ai-lens-hook\.ps1/i.test(n)) return true;
+  // Direct capture.js form: GUI-safe only with an ABSOLUTE node path baked in. Bare
+  // `node` / `/usr/bin/env node` are NOT GUI-safe (depend on PATH, which GUI
+  // Cursor/Claude often lack). The old run.sh/run.cmd launcher is NOT recognised here
+  // (ADR 0003) — it stays `outdated` so init migrates it.
   const p = _parseHookCommand(cmd);
   if (p.kind === 'captureJs' && p.nodePrefix) {
     const np = p.nodePrefix;
@@ -894,11 +926,12 @@ function isAcceptableHookCommand(cmd) {
 export function isWrongPlatformProjectDirCommand(cmd, platform = process.platform) {
   if (!isClaudeProjectDirCommand(cmd)) return false;
   const n = (cmd || '').replace(/\\/g, '/');
-  // The conhost windowless form is unambiguously a Windows command (conhost.exe is
-  // Windows-only) and deliberately uses $CLAUDE_PROJECT_DIR — Claude Code substitutes
-  // that itself, so it expands on Windows too. It is therefore correct on win32 and
-  // wrong (won't run) anywhere else; the %VAR% rule below doesn't apply to it.
-  if (isConhostHeadlessCommand(n)) return platform !== 'win32';
+  // The Windows windowless launcher form (powershell … -File "$CLAUDE_PROJECT_DIR/…
+  // ai-lens-hook.ps1" …) and the older conhost.exe --headless form are unambiguously
+  // Windows commands. Both deliberately use $CLAUDE_PROJECT_DIR — Claude Code substitutes
+  // that itself before exec, so it expands on Windows. They are correct on win32 and
+  // wrong (won't run) anywhere else; the %VAR%/$VAR rule below doesn't apply to them.
+  if (/ai-lens-hook\.ps1/i.test(n) || isConhostHeadlessCommand(n)) return platform !== 'win32';
   const correctVar = platform === 'win32' ? '%CLAUDE_PROJECT_DIR%' : '$CLAUDE_PROJECT_DIR';
   return !n.includes(correctVar);
 }
@@ -1093,28 +1126,31 @@ function isCurrentAiLensHook(entry, expected, opts = {}) {
   // $CLAUDE_PROJECT_DIR/%CLAUDE_PROJECT_DIR% hook written for the OTHER OS won't
   // expand on this platform, so flag it outdated to let init rewrite it.
   //
-  // Windowless exception (same allowPlatformRewrite gate): flag a hook outdated when
-  // its stored `conhost.exe --headless` wrapper DISAGREES with the freshly regenerated
-  // `expected` command — in EITHER direction — so init re-syncs it:
-  //   - expected has conhost, stored doesn't → ADD it (Claude on conhost-capable
-  //     Windows that predates the windowless form);
-  //   - expected has NO conhost, stored DOES → REMOVE it (Cursor: conhost is
-  //     incompatible — its ConPTY VT output breaks Cursor's JSON parse of hook stdout
-  //     — so we downgrade machines that got the short-lived conhost'd Cursor form).
-  // We compare ONLY the windowless dimension (not the whole command), so legitimate
-  // path/node/install-mode variation never false-flags. `expected` already bakes in
-  // tool+platform+conhost-support (makeClaudeHookDefs passes windowless:true;
-  // makeCursorHookDefs and makeCodexHookDefs do NOT), so this self-scopes: Codex,
-  // Cursor, macOS, and old Windows produce a non-conhost `expected`, and only Claude
-  // on conhost-capable Windows produces a conhost `expected`. Committed (tracked)
-  // files are exempt via allowPlatformRewrite — they carry one OS-agnostic syntax
-  // and can't bake a Windows-only wrapper; the per-machine overlay provides it.
+  // Windows-wrapper exception (same allowPlatformRewrite gate): flag a hook outdated
+  // when its stored windowless wrapper DISAGREES with the freshly regenerated `expected`
+  // command, so init re-syncs it. We compare ONLY the wrapper kind — `conhost` vs the
+  // `ai-lens-hook.ps1` launcher (keyed on its basename) vs `plain` — never the whole
+  // command, so legitimate path/node/install-mode variation never false-flags.
+  // `expected` bakes in tool+platform: on Windows BOTH Cursor and Claude now use the
+  // launcher (`ps1:ai-lens-hook.ps1`); Codex, macOS → `plain`. So this self-scopes:
+  //   - conhost (old Claude/Cursor) → mismatch → outdated → migrate to the launcher;
+  //   - old `cursor-ai-lens-hook.ps1` → `ps1:cursor-ai-lens-hook.ps1` ≠ `ps1:ai-lens-hook.ps1`
+  //     → outdated → migrate to the renamed launcher;
+  //   - launcher already current → match → current; Codex/macOS plain → current.
+  // Committed (tracked) files are exempt via allowPlatformRewrite.
   const { platform = process.platform, allowPlatformRewrite = false } = opts;
   const expectedCmd = expected?.command ?? expected?.hooks?.[0]?.command ?? '';
-  const expectedWindowless = isConhostHeadlessCommand(expectedCmd);
+  const wrapperKind = (c) => {
+    const s = String(c || '');
+    if (isConhostHeadlessCommand(s)) return 'conhost';
+    const m = s.match(/([\w.-]*ai-lens-hook\.ps1)/i);
+    if (m) return 'ps1:' + m[1].toLowerCase();
+    return 'plain';
+  };
+  const expectedWrapper = wrapperKind(expectedCmd);
   const ok = (cmd) => isAcceptableHookCommand(cmd)
     && !(allowPlatformRewrite && isWrongPlatformProjectDirCommand(cmd, platform))
-    && !(allowPlatformRewrite && expectedWindowless !== isConhostHeadlessCommand(cmd));
+    && !(allowPlatformRewrite && wrapperKind(cmd) !== expectedWrapper);
   // Flat format (Cursor): single command per entry.
   if (entry?.command != null) {
     return ok(entry.command);

package/cli/status.js

@@ -150,8 +150,32 @@ function validateHookCommandPaths(tool) {
 
   const issues = [];
   const launcherMatch = command.match(/["']([^"']*run\.(?:sh|cmd))["']|(\S*run\.(?:sh|cmd))/);
-
-  if (launcherMatch) {
+  // Matches both ai-lens-hook.ps1 and the older cursor-ai-lens-hook.ps1.
+  const ps1Match = command.match(/["']([^"']*ai-lens-hook\.ps1)["']|(\S*ai-lens-hook\.ps1)/);
+  // Paths containing $CLAUDE_PROJECT_DIR / %CLAUDE_PROJECT_DIR% can't be resolved here
+  // (Claude Code substitutes the var at runtime) — skip existence checks for those.
+  const resolvable = (p) => !/CLAUDE_PROJECT_DIR/.test(p);
+
+  if (ps1Match) {
+    // Windows windowless launcher (Cursor: `& "<...>.ps1" <node> <capture>`; Claude:
+    // `powershell ... -File "<...>.ps1" <node> <capture>`). Validate launcher + node arg
+    // + capture.js exist (when their paths are resolvable, i.e. not $CLAUDE_PROJECT_DIR).
+    const ps1Path = expandTilde(ps1Match[1] || ps1Match[2]);
+    if (resolvable(ps1Path) && !existsSync(ps1Path)) issues.push(`AI Lens hook launcher not found at: ${ps1Path}`);
+    const capMatch = command.match(/["']([^"']*capture\.js)["']|(\S*capture\.js)/);
+    if (capMatch) {
+      const capturePath = expandTilde(capMatch[1] || capMatch[2]);
+      if (resolvable(capturePath) && !existsSync(capturePath)) issues.push(`capture.js not found at: ${capturePath}`);
+    }
+    // node = the launcher's first argument (token right after the .ps1 path)
+    const nodeArg = command.match(/ai-lens-hook\.ps1["']?\s+(?:["']([^"']+)["']|(\S+))/);
+    if (nodeArg) {
+      const nodePath = expandTilde(nodeArg[1] || nodeArg[2]);
+      if (nodePath !== 'node' && resolvable(nodePath) && !existsSync(nodePath)) {
+        issues.push(`node not found at: ${nodePath} — re-run \`ai-lens init\` to re-resolve node`);
+      }
+    }
+  } else if (launcherMatch) {
     // Launcher form (0.8.68+): one path, no separate node validation — the node binary
     // baked into the launcher is invoked from inside the script, not the hook command.
     const launcherPath = expandTilde(launcherMatch[1] || launcherMatch[2]);

package/client/ai-lens-hook.ps1

@@ -0,0 +1,39 @@
+# AI Lens — windowless hook launcher (Windows only). Used by BOTH Cursor and Claude Code.
+#
+# Why this exists: a hook spawns node.exe, a console-subsystem binary; launched from a
+# console-less parent it allocates its own console window → a flash on every event. The
+# obvious windowless wrapper, `conhost.exe --headless`, is unusable for hook capture:
+#   - for Cursor it emits ConPTY VT escape codes onto stdout, which Cursor fails to JSON-parse;
+#   - for Claude Code it replaces node's stdin with the pseudoconsole, so the JSON payload
+#     never reaches capture.js (it reads empty stdin and drops the event).
+# This launcher instead starts node via ProcessStartInfo with CreateNoWindow=$true (no
+# window) and RedirectStandardInput (real stdin forwarded) — so capture works AND there's
+# no flash, and nothing extra is written to stdout.
+#
+# Payload source differs by caller, so read BOTH:
+#   - Cursor pipes it through the PowerShell pipeline → $input.
+#   - Claude Code pipes it to the process's OS stdin → [Console]::In.
+# Read $input first; if empty (Claude Code invocation), fall back to [Console]::In.
+#
+# Args: $args[0] = node path, $args[1] = capture.js path.
+
+$ErrorActionPreference = 'Stop'
+$node = $args[0]
+$capture = $args[1]
+
+$payload = @($input) -join "`n"
+if ([string]::IsNullOrEmpty($payload)) {
+  $payload = [Console]::In.ReadToEnd()
+}
+
+$psi = New-Object System.Diagnostics.ProcessStartInfo
+$psi.FileName = $node
+$psi.Arguments = '"' + $capture + '"'
+$psi.UseShellExecute = $false
+$psi.CreateNoWindow = $true
+$psi.RedirectStandardInput = $true
+
+$proc = [System.Diagnostics.Process]::Start($psi)
+$proc.StandardInput.Write($payload)
+$proc.StandardInput.Close()
+$proc.WaitForExit()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-lens",
-  "version": "0.8.98",
+  "version": "0.8.100",
   "type": "module",
   "description": "Centralized session analytics for AI coding tools",
   "bin": {