getprismo 0.1.50 → 0.1.52

package/docs/privacy-telemetry.md

@@ -15,6 +15,8 @@ This page lists **exactly** what the connector sends after you connect, field by
 
 ## What session sync sends (`prismo sync`, and the connector on an interval)
 
+The background connector captures recent agent sessions from **every repo** on this machine (each attributed to its own repo), so all your agent activity is visible in one place — not just the repo the connector was started in. A one-off `prismo sync` covers only the current repo unless you pass `--all-repos`. Either way, only the numbers and labels below are sent; never code or prompts.
+
 Per machine:
 
 | field | example | note |

package/docs/validation-week.md

@@ -8,3 +8,8 @@ Paper cuts, observations, and metric notes from the measurement window. Fix bugs
 - 2026-06-12: follow-up dogfood found backend-summary.md could churn backups because generated .prismo context files influenced load-bearing text-reference counts. Excluded .prismo generated context from the reference corpus and added a regression test; repeated optimize on the SaaS repo now produces 0 new .bak files after the one-time old-report replacement.
 - 2026-06-12: connector dogfood found scoped `optimize frontend` and unscoped `optimize` could alternate optimize-report.md's Generated Files list and create metadata-only backups. Changed optimize-report metadata-only changes to update without backups and added a scoped/unscoped regression test.
 - 2026-06-12: connector dogfood found legitimate generated-context changes still left timestamped `.prismo/*.bak` files, which made the repo look dirty during validation. Changed `prismo optimize` context files to update in place because they are reproducible generated artifacts; user-authored files still keep backups.
+- 2026-06-14: THREE real bugs found via dogfooding, all fixed + shipped (v0.1.47-0.1.51):
+  1. Digest counted auto-detect health scans as interventions (186 fake vs 3 real).
+  2. Verification baseline poisoned by Cursor's blind 0-signals -> now compares like-for-like across tools.
+  3. CRITICAL: Claude Code telemetry silently dropped when repo path has a space/dot ("Code Projects") -> path encoding now matches Claude's. Was hiding the strongest signal for any user with a spaced path.
+- 2026-06-14: KNOWN BUG (not yet fixed): `prismo protect` reinstalls/repoints the single connector even when one is already running for another repo, silently hijacking which repo syncs. Connector is single-repo; working across multiple repos means only the watched one syncs to the dashboard. Post-freeze: make protect not move a running connector, and consider syncing all recent repos.

package/lib/prismo-dev/agent.js

@@ -752,7 +752,10 @@ module.exports = function createAgent(deps) {
     let syncResult = null;
     if (options.syncTelemetry) {
       try {
-        const result = await runSync(rootDir, { limit: options.syncLimit || 20 });
+        // The connector is the always-on capturer: observe every repo's agent
+        // activity, not just the one it was started in (each session is
+        // attributed to its own repo). Opt out with allRepos: false.
+        const result = await runSync(rootDir, { limit: options.syncLimit || 20, allRepos: options.allRepos !== false });
         syncResult = {
           synced: Boolean(result.synced),
           sessions: Number(result.aggregate?.sessions || 0),

package/lib/prismo-dev/cli.js

@@ -417,6 +417,7 @@ function createCli(deps) {
         preview: rest.includes("--preview"),
         limit: parsePositiveInt(limitIndex >= 0 ? rest[limitIndex + 1] : null, 20),
         tool: toolIndex >= 0 ? rest[toolIndex + 1] : "all",
+        allRepos: rest.includes("--all-repos"),
         endpoint: apiUrlIndex >= 0 ? `${String(rest[apiUrlIndex + 1] || "").replace(/\/$/, "")}/v1/dev/sessions/sync` : null,
       };
       if (rest.includes("--watch")) {
@@ -859,8 +860,15 @@ function createCli(deps) {
       const config = loadConfig();
       if (config?.token) {
         const connector = runConnectorStatus();
-        if (connector.running) {
-          steps.push({ step: "connector", ok: true, detail: "Background connector already running." });
+        if (connector.installed) {
+          // The connector already runs and now observes every repo's agent
+          // activity (all-repos sync), so do NOT repoint it to this repo —
+          // that would hijack which repo the dashboard treats as primary.
+          const watchedRoot = connector.state && connector.state.root;
+          const watched = watchedRoot && path.resolve(watchedRoot) !== path.resolve(target)
+            ? ` (watching ${path.basename(watchedRoot)}; it captures this repo too)`
+            : "";
+          steps.push({ step: "connector", ok: true, detail: `Background connector already installed${watched}.` });
         } else {
           runConnectorInstall(target, { mode: "autopilot" });
           steps.push({ step: "connector", ok: true, detail: "Background connector installed and started in autopilot." });

package/lib/prismo-dev/cloud-sync.js

@@ -86,7 +86,18 @@ module.exports = function createCloudSync(deps) {
     }
   }
 
-  function repoIdentity(root) {
+  function sameResolvedPath(a, b) {
+    if (!a || !b) return false;
+    try {
+      const ra = fs.existsSync(a) ? fs.realpathSync(a) : path.resolve(a);
+      const rb = fs.existsSync(b) ? fs.realpathSync(b) : path.resolve(b);
+      return ra === rb;
+    } catch {
+      return path.resolve(a) === path.resolve(b);
+    }
+  }
+
+  function repoIdentity(root, idOptions = {}) {
     const resolved = path.resolve(root || process.cwd());
     const remote = runGit(resolved, ["config", "--get", "remote.origin.url"]);
     const branch = runGit(resolved, ["branch", "--show-current"]);
@@ -96,7 +107,9 @@ module.exports = function createCloudSync(deps) {
       remote: redactRemote(remote),
       branch: branch || null,
       commit: commit || null,
-      pr: detectPullRequest(resolved),
+      // PR detection shells out to `gh` per repo; skip it for secondary repos
+      // in all-repos sync so a 60s poll doesn't fan out gh calls everywhere.
+      pr: idOptions.detectPr === false ? null : detectPullRequest(resolved),
     };
   }
 
@@ -176,11 +189,13 @@ module.exports = function createCloudSync(deps) {
 
   function buildSyncPayload(rootDir = process.cwd(), options = {}) {
     const root = path.resolve(rootDir);
+    const allRepos = Boolean(options.allRepos);
     const repo = repoIdentity(root);
     const usage = getUsageSummary({
       cwd: root,
       tool: options.tool || "all",
       limit: options.limit || 20,
+      allRepos,
     });
     let scan = null;
     try {
@@ -188,7 +203,28 @@ module.exports = function createCloudSync(deps) {
     } catch {
       scan = null;
     }
-    const sessions = (usage.sessions || []).map((session) => sanitizeSession(session, repo));
+
+    // In all-repos mode each session is attributed to its own repo, derived
+    // from the session's recorded cwd (git lookups cached per directory), so
+    // the dashboard groups activity by the repo it actually happened in.
+    const repoCache = new Map();
+    function repoForSession(session) {
+      if (!allRepos) return repo;
+      const sessionCwd = session && session.cwd ? path.resolve(session.cwd) : null;
+      if (!sessionCwd) return repo;
+      if (sameResolvedPath(sessionCwd, root)) return repo;
+      if (repoCache.has(sessionCwd)) return repoCache.get(sessionCwd);
+      let id;
+      try {
+        id = repoIdentity(sessionCwd, { detectPr: false });
+      } catch {
+        id = repo;
+      }
+      repoCache.set(sessionCwd, id);
+      return id;
+    }
+
+    const sessions = (usage.sessions || []).map((session) => sanitizeSession(session, repoForSession(session)));
     const aggregate = sessions.reduce((acc, session) => {
       acc.sessions += 1;
       acc.displayTokens += session.tokens.display;
@@ -347,6 +383,7 @@ module.exports = function createCloudSync(deps) {
     const payload = buildSyncPayload(rootDir, {
       limit: options.limit || config?.sync?.defaultLimit || 20,
       tool: options.tool || "all",
+      allRepos: Boolean(options.allRepos),
     });
     if (options.dryRun || options.preview) {
       return {

package/lib/prismo-dev/help.js

@@ -15,7 +15,7 @@ Usage:
   prismo connect [--json] [--token TOKEN] [--api-url URL] [--org ORG] [--user USER] [--device NAME]
   prismo connector [status|install|start|stop|uninstall] [--json] [--interval N] [--sync-interval N] [--mode observe|suggest|autopilot] [path]
   prismo bridge [--json] [path]
-  prismo sync [--json] [--dry-run] [--watch] [--interval N] [--limit N] [--tool all|codex|claude|cursor] [path]
+  prismo sync [--json] [--dry-run] [--watch] [--all-repos] [--interval N] [--limit N] [--tool all|codex|claude|cursor] [path]
   prismo status [--json]
   prismo digest [--json] [--days N]
   prismo disconnect [--json]
@@ -485,7 +485,7 @@ Output:
 Usage:
   prismo connect [--json] [--token TOKEN] [--api-url URL] [--org ORG] [--user USER] [--device NAME]
   prismo connector [status|install|start|stop|uninstall] [--json] [--interval N] [--sync-interval N] [--mode observe|suggest|autopilot] [path]
-  prismo sync [--json] [--dry-run] [--watch] [--interval N] [--limit N] [--tool all|codex|claude|cursor] [path]
+  prismo sync [--json] [--dry-run] [--watch] [--all-repos] [--interval N] [--limit N] [--tool all|codex|claude|cursor] [path]
   prismo status [--json]
   prismo disconnect [--json]
 
@@ -556,7 +556,7 @@ Privacy:
   sync: `PrismoDev Sync
 
 Usage:
-  prismo sync [--json] [--dry-run] [--watch] [--interval N] [--limit N] [--tool all|codex|claude|cursor] [path]
+  prismo sync [--json] [--dry-run] [--watch] [--all-repos] [--interval N] [--limit N] [--tool all|codex|claude|cursor] [path]
 
 Examples:
   prismo sync --dry-run

package/lib/prismo-dev/usage-sessions.js

@@ -228,9 +228,18 @@ function getClaudeSessionFiles(cwd = process.cwd()) {
   }
   const files = [];
   for (const candidate of Array.from(new Set(candidates))) {
-    const safeProject = candidate.replace(/[\/\\:]/g, "-").replace(/^-/, "-");
-    const projectDir = path.join(claudeHome, "projects", safeProject);
-    files.push(...listFilesRecursive(projectDir, (file) => file.endsWith(".jsonl"), 200));
+    // Claude Code names a project folder by replacing every path separator,
+    // whitespace, and dot in the cwd with "-" (e.g. "/Users/me/Code Projects/app"
+    // -> "-Users-me-Code-Projects-app"). Matching only "/\:" missed any path
+    // containing a space or dot, silently dropping all Claude Code telemetry.
+    const encodings = new Set([
+      candidate.replace(/[\/\\:.\s]/g, "-"),
+      candidate.replace(/[\/\\:]/g, "-"), // legacy fallback for older folders
+    ]);
+    for (const safeProject of encodings) {
+      const projectDir = path.join(claudeHome, "projects", safeProject);
+      files.push(...listFilesRecursive(projectDir, (file) => file.endsWith(".jsonl"), 200));
+    }
   }
   return Array.from(new Set(files));
 }
@@ -248,24 +257,53 @@ function sameResolvedPath(a, b) {
     return false;
   }
 }
+function safeMtimeMs(filePath) {
+  try {
+    return fs.statSync(filePath).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+
 function getUsageSummary(options = {}) {
   const tool = options.tool || "all";
   const limit = options.limit || 5;
   const cwd = options.cwd || process.cwd();
+  // allRepos: capture the most recent sessions across every repo on this
+  // machine (each retains its own cwd for per-repo attribution), so a single
+  // always-on connector observes all of the user's agent activity rather than
+  // only the one repo it was started in. Cursor is skipped here because it
+  // exposes no per-session signal and cannot be attributed per repo.
+  const allRepos = Boolean(options.allRepos);
   const sessions = [];
   if (tool === "all" || tool === "codex") {
-    for (const file of getCodexSessionFiles().slice(0, Math.max(limit * 8, 20))) {
-      const session = analyzeSessionFile(file, "codex");
-      if (!session.cwd || sameResolvedPath(session.cwd, cwd)) sessions.push(session);
-      if (sessions.filter((item) => item.tool === "codex").length >= limit) break;
+    if (allRepos) {
+      const recent = getCodexSessionFiles()
+        .map((file) => ({ file, m: safeMtimeMs(file) }))
+        .sort((a, b) => b.m - a.m)
+        .slice(0, Math.max(limit, 30));
+      for (const { file } of recent) sessions.push(analyzeSessionFile(file, "codex"));
+    } else {
+      for (const file of getCodexSessionFiles().slice(0, Math.max(limit * 8, 20))) {
+        const session = analyzeSessionFile(file, "codex");
+        if (!session.cwd || sameResolvedPath(session.cwd, cwd)) sessions.push(session);
+        if (sessions.filter((item) => item.tool === "codex").length >= limit) break;
+      }
     }
   }
   if (tool === "all" || tool === "claude") {
-    for (const file of getClaudeSessionFiles(cwd).slice(0, limit)) {
+    const claudeFiles = allRepos
+      ? getAllClaudeSessionFiles()
+          .map((file) => ({ file, m: safeMtimeMs(file) }))
+          .sort((a, b) => b.m - a.m)
+          .slice(0, Math.max(limit, 30))
+          .map((x) => x.file)
+      : getClaudeSessionFiles(cwd).slice(0, limit);
+    for (const file of claudeFiles) {
       sessions.push(analyzeSessionFile(file, "claude-code"));
     }
   }
-  if (tool === "all" || tool === "cursor") {
+  if (!allRepos && (tool === "all" || tool === "cursor")) {
     try {
       const cursorData = analyzeCursorSessions({ limit, cwd });
       if (cursorData.sessions.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getprismo",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "Local AI coding workflow scanner for Codex, Claude Code, Cursor, and token-waste diagnostics.",
   "license": "MIT",
   "homepage": "https://github.com/shanirsh/prismodev#readme",