
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@code-insights/cli
Advanced tools
Analyze AI coding sessions from the terminal. Parses session history from Claude Code, Cursor, Codex CLI, Copilot CLI, and VS Code Copilot Chat — stores everything in a local SQLite database — and serves a built-in browser dashboard with cross-session pattern detection.
Local-first. No accounts. No cloud. No data leaves your machine.
npm install -g @code-insights/cli
Verify:
code-insights --version
# Try instantly (no install needed)
npx @code-insights/cli
# Or after installing globally:
code-insights # sync sessions + open dashboard
The dashboard opens at http://localhost:7890 and shows your sessions, analytics, and LLM-powered insights.
code-insights stats # terminal analytics (no dashboard needed)
code-insights stats today # today's sessions
code-insights dashboard # start dashboard server (auto-syncs first)
code-insights dashboard --no-sync # start dashboard without syncing
code-insights sync # sync sessions only
code-insights init # customize settings (optional)
| Tool | Data Location |
|---|---|
| Claude Code | ~/.claude/projects/**/*.jsonl |
| Cursor | Workspace storage SQLite (macOS, Linux, Windows) |
| Codex CLI | ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl |
| Copilot CLI | ~/.copilot/session-state/{id}/events.jsonl |
| VS Code Copilot Chat | Platform-specific Copilot Chat storage |
Sessions from all tools are discovered automatically during sync.
code-insights dashboard
Opens the built-in React dashboard at http://localhost:7890. The dashboard provides:
code-insights dashboard --port 8080 # Custom port
code-insights dashboard --no-open # Start server without opening browser
# Sync sessions and open dashboard — no setup required
code-insights
# Customize settings (optional) — prompts for Claude dir, excluded projects, etc.
code-insights init
# Show current configuration
code-insights config
# Configure LLM provider for session analysis (interactive)
code-insights config llm
# Configure LLM provider with flags (non-interactive)
code-insights config llm --provider anthropic --model claude-sonnet-4-20250514 --api-key sk-ant-...
# Show current LLM configuration
code-insights config llm --show
# Set a config value (e.g., disable telemetry)
code-insights config set telemetry false
# Sync new and modified sessions (incremental)
code-insights sync
# Force re-sync all sessions
code-insights sync --force
# Preview what would be synced (no changes made)
code-insights sync --dry-run
# Sync only from a specific tool
code-insights sync --source cursor
code-insights sync --source claude-code
code-insights sync --source codex-cli
code-insights sync --source copilot-cli
# Sync only sessions from a specific project
code-insights sync --project "my-project"
# Quiet mode (useful for hooks)
code-insights sync -q
# Show diagnostic warnings from providers
code-insights sync --verbose
# Regenerate titles for all sessions
code-insights sync --regenerate-titles
# Soft-delete sessions (preview + confirm)
code-insights sync prune
# Overview: sessions, cost, activity (last 7 days)
code-insights stats
# Cost breakdown by project and model
code-insights stats cost
# Per-project detail cards
code-insights stats projects
# Today's sessions with time, cost, and model details
code-insights stats today
# Model usage distribution and cost chart
code-insights stats models
# Cross-session patterns summary
code-insights stats patterns
Shared flags for all stats subcommands:
| Flag | Description |
|---|---|
--period 7d|30d|90d|all | Time range (default: 7d) |
--project <name> | Scope to a specific project (fuzzy matching) |
--source <tool> | Filter by source tool |
--no-sync | Skip auto-sync before displaying stats |
Cross-session pattern detection and synthesis. Requires an LLM provider to be configured.
# Generate weekly cross-session synthesis (current week)
code-insights reflect
# Reflect on a specific ISO week
code-insights reflect --week 2026-W11
# Scope to a specific project
code-insights reflect --project "my-project"
# Backfill facets for sessions that were synced before Reflect existed
code-insights reflect backfill
# Backfill prompt quality analysis
code-insights reflect backfill --prompt-quality
The Reflect feature analyzes your sessions to surface:
# Show sync statistics (sessions, projects, last sync)
code-insights status
# Open the local dashboard in your browser
code-insights open
code-insights open --project # Open filtered to the current project
# Delete all local data and reset sync state
code-insights reset --confirm
# Install a Claude Code hook — auto-syncs when sessions end
code-insights install-hook
# Remove the hook
code-insights uninstall-hook
Anonymous usage telemetry is opt-out. No PII is collected.
code-insights telemetry status # Check current status
code-insights telemetry disable # Disable telemetry
code-insights telemetry enable # Re-enable telemetry
Alternatively, set the environment variable:
CODE_INSIGHTS_TELEMETRY_DISABLED=1 code-insights sync
Session analysis (summaries, decisions, learnings, facets) and Reflect synthesis require an LLM provider. Configure it via CLI or the dashboard Settings page.
code-insights config llm
Supported providers:
| Provider | Models | Requires API Key |
|---|---|---|
| Anthropic | claude-opus-4-6, claude-sonnet-4-6, etc. | Yes |
| OpenAI | gpt-4o, gpt-4o-mini, etc. | Yes |
| Google Gemini | gemini-2.0-flash, gemini-2.0-pro, etc. | Yes |
| Ollama | llama3.2, qwen2.5-coder, etc. | No (local) |
API keys are stored in ~/.code-insights/config.json (mode 0o600, readable only by you).
This is a pnpm workspace monorepo with three packages: cli, dashboard, and server.
# Clone
git clone https://github.com/melagiri/code-insights.git
cd code-insights
# Install all dependencies
pnpm install
# Build all packages
pnpm build
# Link CLI for local testing
cd cli && npm link
code-insights --version
# Watch mode (CLI only)
cd cli && pnpm dev
code-insights/
├── cli/ # This package — Node.js CLI, SQLite, providers
├── dashboard/ # Vite + React SPA
└── server/ # Hono API server (serves dashboard + REST API)
See CONTRIBUTING.md for code style, PR guidelines, and how to add a new source tool provider.
~/.code-insights/data.db (SQLite) on your machineMIT — see LICENSE for details.
FAQs
Turn your AI coding sessions into knowledge
The npm package @code-insights/cli receives a total of 198 weekly downloads. As such, @code-insights/cli popularity was classified as not popular.
We found that @code-insights/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.