modelstat 0.0.22 → 0.0.23

package/dist/cli.mjs

@@ -7487,6 +7487,107 @@ var init_src2 = __esm({
   }
 });
 
+// src/identity.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  writeFileSync,
+  existsSync as existsSync3
+} from "fs";
+import { homedir as homedir2, hostname as osHostname } from "os";
+import { join as join2 } from "path";
+function ensureRoot() {
+  mkdirSync(ROOT, { recursive: true, mode: 448 });
+}
+function writeAtomic(meta) {
+  ensureRoot();
+  const tmp = `${IDENTITY_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(meta, null, 2), { mode: 384 });
+  renameSync(tmp, IDENTITY_FILE);
+  try {
+    chmodSync(IDENTITY_FILE, 384);
+  } catch {
+  }
+}
+function identityPath() {
+  return IDENTITY_FILE;
+}
+function hasIdentityFile() {
+  return existsSync3(IDENTITY_FILE);
+}
+function parseFile() {
+  try {
+    const raw = readFileSync2(IDENTITY_FILE, "utf8");
+    const obj = JSON.parse(raw);
+    if (!obj.deviceUuid || !obj.deviceId || !obj.bearerToken) {
+      return null;
+    }
+    return {
+      deviceUuid: obj.deviceUuid,
+      deviceId: obj.deviceId,
+      bearerToken: obj.bearerToken,
+      claimCode: obj.claimCode ?? null,
+      claimUrl: obj.claimUrl ?? null,
+      hostname: obj.hostname ?? osHostname(),
+      createdAt: obj.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      userEmail: obj.userEmail ?? null,
+      defaultOrgId: obj.defaultOrgId ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+function loadIdentity(migrateFromConf2) {
+  const fromFile = parseFile();
+  if (fromFile) return fromFile;
+  if (!migrateFromConf2) return null;
+  const legacy = migrateFromConf2();
+  if (!legacy) return null;
+  if (!legacy.deviceUuid || !legacy.deviceId || !legacy.bearerToken) {
+    return null;
+  }
+  const migrated = {
+    deviceUuid: legacy.deviceUuid,
+    deviceId: legacy.deviceId,
+    bearerToken: legacy.bearerToken,
+    claimCode: legacy.claimCode ?? null,
+    claimUrl: legacy.claimUrl ?? null,
+    hostname: osHostname(),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    userEmail: legacy.userEmail ?? null,
+    defaultOrgId: legacy.defaultOrgId ?? null
+  };
+  writeAtomic(migrated);
+  return migrated;
+}
+function saveIdentity(meta) {
+  writeAtomic(meta);
+}
+function backupIdentity() {
+  if (!existsSync3(IDENTITY_FILE)) return null;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dest = `${IDENTITY_FILE}.bak-${stamp}`;
+  renameSync(IDENTITY_FILE, dest);
+  return dest;
+}
+function updateIdentity(patch) {
+  const current = parseFile();
+  if (!current) return null;
+  const merged = { ...current, ...patch };
+  writeAtomic(merged);
+  return merged;
+}
+var ROOT, IDENTITY_FILE;
+var init_identity = __esm({
+  "src/identity.ts"() {
+    "use strict";
+    ROOT = join2(homedir2(), ".modelstat");
+    IDENTITY_FILE = join2(ROOT, "identity.json");
+  }
+});
+
 // ../../node_modules/.pnpm/undici@7.25.0/node_modules/undici/lib/core/symbols.js
 var require_symbols = __commonJS({
   "../../node_modules/.pnpm/undici@7.25.0/node_modules/undici/lib/core/symbols.js"(exports, module) {
@@ -33061,15 +33162,15 @@ function envPaths(name, { suffix = "nodejs" } = {}) {
   }
   return linux(name);
 }
-var homedir2, tmpdir, env, macos, windows, linux;
+var homedir3, tmpdir, env, macos, windows, linux;
 var init_env_paths = __esm({
   "../../node_modules/.pnpm/env-paths@3.0.0/node_modules/env-paths/index.js"() {
     "use strict";
-    homedir2 = os.homedir();
+    homedir3 = os.homedir();
     tmpdir = os.tmpdir();
     ({ env } = process2);
     macos = (name) => {
-      const library = path.join(homedir2, "Library");
+      const library = path.join(homedir3, "Library");
       return {
         data: path.join(library, "Application Support", name),
         config: path.join(library, "Preferences", name),
@@ -33079,8 +33180,8 @@ var init_env_paths = __esm({
       };
     };
     windows = (name) => {
-      const appData = env.APPDATA || path.join(homedir2, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path.join(homedir2, "AppData", "Local");
+      const appData = env.APPDATA || path.join(homedir3, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path.join(homedir3, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
         data: path.join(localAppData, name, "Data"),
@@ -33091,13 +33192,13 @@ var init_env_paths = __esm({
       };
     };
     linux = (name) => {
-      const username = path.basename(homedir2);
+      const username = path.basename(homedir3);
       return {
-        data: path.join(env.XDG_DATA_HOME || path.join(homedir2, ".local", "share"), name),
-        config: path.join(env.XDG_CONFIG_HOME || path.join(homedir2, ".config"), name),
-        cache: path.join(env.XDG_CACHE_HOME || path.join(homedir2, ".cache"), name),
+        data: path.join(env.XDG_DATA_HOME || path.join(homedir3, ".local", "share"), name),
+        config: path.join(env.XDG_CONFIG_HOME || path.join(homedir3, ".config"), name),
+        cache: path.join(env.XDG_CACHE_HOME || path.join(homedir3, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path.join(env.XDG_STATE_HOME || path.join(homedir2, ".local", "state"), name),
+        log: path.join(env.XDG_STATE_HOME || path.join(homedir3, ".local", "state"), name),
         temp: path.join(tmpdir, username, name)
       };
     };
@@ -33538,9 +33639,9 @@ import { once } from "events";
 import { createWriteStream } from "fs";
 import path3 from "path";
 import { Readable } from "stream";
-function writeFileSync(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
+function writeFileSync2(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
   if (isString(options))
-    return writeFileSync(filePath, data, { encoding: options });
+    return writeFileSync2(filePath, data, { encoding: options });
   const timeout = options.timeout ?? DEFAULT_TIMEOUT_SYNC;
   const retryOptions = { timeout };
   let tempDisposer = null;
@@ -43663,7 +43764,7 @@ var init_source = __esm({
           fs2.writeFileSync(this.path, data, { mode: this.#options.configFileMode });
         } else {
           try {
-            writeFileSync(this.path, data, { mode: this.#options.configFileMode });
+            writeFileSync2(this.path, data, { mode: this.#options.configFileMode });
           } catch (error) {
             if (error?.code === "EXDEV") {
               fs2.writeFileSync(this.path, data, { mode: this.#options.configFileMode });
@@ -43765,20 +43866,52 @@ var init_source = __esm({
 });
 
 // src/config.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
-var import_dotenv, here, DEFAULT_API_URL, LEGACY_LOCALHOST_API, store, state;
+function migrateFromConf() {
+  const bearer = store.get("bearerToken");
+  const deviceUuid = store.get("deviceUuid");
+  const deviceId = store.get("deviceId");
+  if (!bearer || !deviceUuid || !deviceId) return null;
+  return {
+    bearerToken: bearer,
+    deviceId,
+    deviceUuid,
+    claimCode: store.get("claimCode"),
+    claimUrl: store.get("claimUrl"),
+    userEmail: store.get("userEmail"),
+    defaultOrgId: store.get("defaultOrgId")
+  };
+}
+function clearConfIdentity() {
+  store.set("bearerToken", null);
+  store.set("deviceId", null);
+  store.set("deviceUuid", null);
+  store.set("claimCode", null);
+  store.set("claimUrl", null);
+}
+function writeThrough(patch) {
+  if (!cachedIdentity) {
+    throw new Error(
+      "config: no identity yet \u2014 call state.saveFreshIdentity() first"
+    );
+  }
+  cachedIdentity = { ...cachedIdentity, ...patch };
+  updateIdentity(patch);
+}
+var import_dotenv, here, DEFAULT_API_URL, LEGACY_LOCALHOST_API, store, cachedIdentity, state;
 var init_config2 = __esm({
   "src/config.ts"() {
     "use strict";
     import_dotenv = __toESM(require_main(), 1);
     init_source();
+    init_identity();
     here = dirname2(fileURLToPath(import.meta.url));
     for (let d = here, i = 0; i < 8; i++, d = resolve3(d, "..")) {
       const candidate = resolve3(d, ".env");
-      if (existsSync3(candidate)) {
+      if (existsSync4(candidate)) {
         (0, import_dotenv.config)({ path: candidate });
         break;
       }
@@ -43804,6 +43937,14 @@ var init_config2 = __esm({
         cursor: {}
       }
     });
+    cachedIdentity = (() => {
+      const had = store.get("bearerToken") !== null;
+      const id = loadIdentity(migrateFromConf);
+      if (id && had && !store.path.includes("fallback")) {
+        clearConfIdentity();
+      }
+      return id;
+    })();
     state = {
       /** Resolution order: env var → stored value (if user ran `setApiUrl`
        * or paired pre-0.0.8) → production default. The legacy localhost
@@ -43817,42 +43958,66 @@ var init_config2 = __esm({
       setApiUrl(v) {
         store.set("apiUrl", v);
       },
+      // ── Identity: backed by ~/.modelstat/identity.json ─────────────
+      /** Seed a fresh identity after a successful self-register. Writes
+       * the file atomically; use `state.backupAndReset()` first if
+       * overwriting an existing identity. */
+      saveFreshIdentity(meta) {
+        const id = {
+          deviceUuid: meta.deviceUuid,
+          deviceId: meta.deviceId,
+          bearerToken: meta.bearerToken,
+          claimCode: meta.claimCode,
+          claimUrl: meta.claimUrl,
+          hostname: hostname(),
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          userEmail: null,
+          defaultOrgId: null
+        };
+        saveIdentity(id);
+        cachedIdentity = id;
+      },
+      get identity() {
+        return cachedIdentity;
+      },
       get bearer() {
-        return store.get("bearerToken");
+        return cachedIdentity?.bearerToken ?? null;
       },
       setBearer(v) {
-        store.set("bearerToken", v);
+        if (v === null) {
+          cachedIdentity = null;
+          return;
+        }
+        writeThrough({ bearerToken: v });
       },
       get deviceId() {
-        return store.get("deviceId");
-      },
-      setDeviceId(v) {
-        store.set("deviceId", v);
-      },
-      get userEmail() {
-        return store.get("userEmail");
-      },
-      setUserEmail(v) {
-        store.set("userEmail", v);
+        return cachedIdentity?.deviceId ?? null;
       },
       get deviceUuid() {
-        return store.get("deviceUuid");
-      },
-      setDeviceUuid(v) {
-        store.set("deviceUuid", v);
+        return cachedIdentity?.deviceUuid ?? null;
       },
       get claimCode() {
-        return store.get("claimCode");
+        return cachedIdentity?.claimCode ?? null;
       },
       setClaimCode(v) {
-        store.set("claimCode", v);
+        if (!cachedIdentity) return;
+        writeThrough({ claimCode: v });
       },
       get claimUrl() {
-        return store.get("claimUrl");
+        return cachedIdentity?.claimUrl ?? null;
       },
       setClaimUrl(v) {
-        store.set("claimUrl", v);
+        if (!cachedIdentity) return;
+        writeThrough({ claimUrl: v });
+      },
+      get userEmail() {
+        return cachedIdentity?.userEmail ?? null;
       },
+      setUserEmail(v) {
+        if (!cachedIdentity) return;
+        writeThrough({ userEmail: v });
+      },
+      // ── Runtime state: stays in conf ───────────────────────────────
       getCursor(path5) {
         return store.get("cursor")[path5];
       },
@@ -44402,23 +44567,23 @@ var init_pipeline2 = __esm({
 
 // src/scan.ts
 import { readdir, stat as stat2 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join2 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join3 } from "path";
 async function scanAll(cb = {}) {
   const deviceId = state.deviceId;
   if (!deviceId) throw new Error("agent not enrolled \u2014 run `register` first");
   const jobs = [];
   try {
-    const base = join2(homedir3(), ".claude/projects");
+    const base = join3(homedir4(), ".claude/projects");
     const projects = await readdir(base).catch(() => []);
     for (const p of projects) {
-      const dir = join2(base, p);
+      const dir = join3(base, p);
       const ds = await stat2(dir).catch(() => null);
       if (!ds?.isDirectory()) continue;
       const files = await readdir(dir);
       for (const f of files) {
         if (!f.endsWith(".jsonl")) continue;
-        const full = join2(dir, f);
+        const full = join3(dir, f);
         jobs.push({
           path: full,
           parse: async () => {
@@ -44432,17 +44597,17 @@ async function scanAll(cb = {}) {
     console.warn("claude scan skipped:", e.message);
   }
   try {
-    const base = join2(homedir3(), ".codex/sessions");
+    const base = join3(homedir4(), ".codex/sessions");
     const years = await readdir(base).catch(() => []);
     for (const y of years) {
-      const months = await readdir(join2(base, y)).catch(() => []);
+      const months = await readdir(join3(base, y)).catch(() => []);
       for (const m of months) {
-        const days = await readdir(join2(base, y, m)).catch(() => []);
+        const days = await readdir(join3(base, y, m)).catch(() => []);
         for (const d of days) {
-          const files = await readdir(join2(base, y, m, d)).catch(() => []);
+          const files = await readdir(join3(base, y, m, d)).catch(() => []);
           for (const f of files) {
             if (!f.startsWith("rollout-") || !f.endsWith(".jsonl")) continue;
-            const full = join2(base, y, m, d, f);
+            const full = join3(base, y, m, d, f);
             jobs.push({
               path: full,
               parse: async () => {
@@ -44516,7 +44681,7 @@ var init_scan = __esm({
     init_pipeline2();
     init_config2();
     init_api();
-    AGENT_VERSION = "agent-dev-0.0.22";
+    AGENT_VERSION = "agent-dev-0.0.23";
     BATCH_MAX_EVENTS = 2e3;
   }
 });
@@ -44524,17 +44689,17 @@ var init_scan = __esm({
 // src/lock.ts
 import {
   closeSync,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync3,
   openSync,
-  readFileSync as readFileSync2,
-  renameSync,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync3,
+  writeFileSync as writeFileSync4,
   writeSync
 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join5 } from "path";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
   try {
@@ -44548,7 +44713,7 @@ function isProcessAlive(pid) {
 }
 function readLock() {
   try {
-    const raw = readFileSync2(LOCK_FILE, "utf8");
+    const raw = readFileSync3(LOCK_FILE, "utf8");
     const obj = JSON.parse(raw);
     if (typeof obj.pid !== "number") return null;
     return {
@@ -44562,7 +44727,7 @@ function readLock() {
   }
 }
 function writeLockAtomic(meta) {
-  mkdirSync2(LOCK_DIR, { recursive: true });
+  mkdirSync3(LOCK_DIR, { recursive: true });
   const tmp = `${LOCK_FILE}.${meta.pid}.${Date.now()}.tmp`;
   const fd = openSync(tmp, "wx");
   try {
@@ -44570,7 +44735,7 @@ function writeLockAtomic(meta) {
   } finally {
     closeSync(fd);
   }
-  renameSync(tmp, LOCK_FILE);
+  renameSync2(tmp, LOCK_FILE);
 }
 function removeLockIfOwned(ownerPid) {
   const lock = readLock();
@@ -44635,8 +44800,8 @@ var LOCK_DIR, LOCK_FILE;
 var init_lock = __esm({
   "src/lock.ts"() {
     "use strict";
-    LOCK_DIR = join4(homedir5(), ".modelstat");
-    LOCK_FILE = join4(LOCK_DIR, "daemon.lock");
+    LOCK_DIR = join5(homedir6(), ".modelstat");
+    LOCK_FILE = join5(LOCK_DIR, "daemon.lock");
   }
 });
 
@@ -46366,7 +46531,7 @@ __export(daemon_exports, {
   setProgress: () => setProgress,
   setQueue: () => setQueue
 });
-import { existsSync as existsSync6, statSync as statSync2 } from "fs";
+import { existsSync as existsSync7, statSync as statSync2 } from "fs";
 function setPhase(phase, message) {
   status.phase = phase;
   status.message = message ?? null;
@@ -46488,21 +46653,21 @@ async function runDaemon(opts = {}) {
   await runDiscovery();
   await runScanCycle("startup");
   const chokidar = (await Promise.resolve().then(() => (init_esm2(), esm_exports))).default;
-  const { homedir: homedir7, platform: platform5 } = await import("os");
-  const { join: join8 } = await import("path");
-  const home2 = homedir7();
+  const { homedir: homedir8, platform: platform5 } = await import("os");
+  const { join: join9 } = await import("path");
+  const home2 = homedir8();
   const dirs = [
-    join8(home2, ".claude/projects"),
-    join8(home2, ".codex/sessions"),
-    join8(home2, ".cursor/ai-tracking"),
-    join8(home2, ".gemini"),
+    join9(home2, ".claude/projects"),
+    join9(home2, ".codex/sessions"),
+    join9(home2, ".cursor/ai-tracking"),
+    join9(home2, ".gemini"),
     ...platform5() === "darwin" ? [
-      join8(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join8(home2, "Library/Application Support/Claude")
+      join9(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join9(home2, "Library/Application Support/Claude")
     ] : [
-      join8(home2, ".config/Cursor/User/workspaceStorage")
+      join9(home2, ".config/Cursor/User/workspaceStorage")
     ]
-  ].filter((p) => existsSync6(p) && statSync2(p).isDirectory());
+  ].filter((p) => existsSync7(p) && statSync2(p).isDirectory());
   setPhase("watching", `Watching ${dirs.length} directories`);
   const watcher = chokidar.watch(dirs, {
     persistent: true,
@@ -46549,7 +46714,7 @@ var init_daemon = __esm({
     init_config2();
     init_lock();
     init_scan();
-    AGENT_VERSION2 = "agent-dev-0.0.22";
+    AGENT_VERSION2 = "agent-dev-0.0.23";
     HEARTBEAT_INTERVAL_MS = 1e4;
     SCAN_INTERVAL_MS = 5 * 60 * 1e3;
     status = {
@@ -46569,37 +46734,37 @@ var watch_exports = {};
 __export(watch_exports, {
   watchForever: () => watchForever
 });
-import { existsSync as existsSync7 } from "fs";
-import { homedir as homedir6, platform as platform3 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { homedir as homedir7, platform as platform3 } from "os";
+import { join as join8 } from "path";
 function resolveWatchDirs() {
-  const home2 = homedir6();
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join7(home2, ".config");
-  const xdgData = process.env.XDG_DATA_HOME ?? join7(home2, ".local/share");
+  const home2 = homedir7();
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join8(home2, ".config");
+  const xdgData = process.env.XDG_DATA_HOME ?? join8(home2, ".local/share");
   const candidates = [
     // universal (default HOME-rooted CLI data dirs)
-    join7(home2, ".claude/projects"),
-    join7(home2, ".codex/sessions"),
-    join7(home2, ".cursor/ai-tracking"),
-    join7(home2, ".gemini"),
-    join7(home2, ".aider"),
+    join8(home2, ".claude/projects"),
+    join8(home2, ".codex/sessions"),
+    join8(home2, ".cursor/ai-tracking"),
+    join8(home2, ".gemini"),
+    join8(home2, ".aider"),
     // XDG / Linux
-    join7(xdgConfig, "claude/projects"),
-    join7(xdgConfig, "codex/sessions"),
-    join7(xdgConfig, "Cursor/User/workspaceStorage"),
-    join7(xdgConfig, "Code/User/workspaceStorage"),
-    join7(xdgConfig, "Code - Insiders/User/workspaceStorage"),
-    join7(xdgData, "claude/projects"),
+    join8(xdgConfig, "claude/projects"),
+    join8(xdgConfig, "codex/sessions"),
+    join8(xdgConfig, "Cursor/User/workspaceStorage"),
+    join8(xdgConfig, "Code/User/workspaceStorage"),
+    join8(xdgConfig, "Code - Insiders/User/workspaceStorage"),
+    join8(xdgData, "claude/projects"),
     // macOS
     ...platform3() === "darwin" ? [
-      join7(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join7(home2, "Library/Application Support/Claude"),
-      join7(home2, "Library/Application Support/Code/User/workspaceStorage"),
-      join7(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
-      join7(home2, "Library/Application Support/Zed")
+      join8(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join8(home2, "Library/Application Support/Claude"),
+      join8(home2, "Library/Application Support/Code/User/workspaceStorage"),
+      join8(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
+      join8(home2, "Library/Application Support/Zed")
     ] : []
   ];
-  return Array.from(new Set(candidates)).filter((p) => existsSync7(p));
+  return Array.from(new Set(candidates)).filter((p) => existsSync8(p));
 }
 async function safeScan(reason) {
   if (scanning) {
@@ -46659,51 +46824,53 @@ var init_watch = __esm({
 
 // src/cli.ts
 init_src2();
+init_identity();
 init_api();
 init_config2();
 init_scan();
 import { spawn } from "child_process";
 import { randomBytes } from "crypto";
 import { platform as platform4, release, arch as cpuArch, hostname as hostname2 } from "os";
+import { createInterface as createInterface3 } from "readline";
 
 // src/service.ts
 import { spawnSync } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync4,
-  mkdirSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync2,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir4, platform as platform2, userInfo } from "os";
-import { dirname as dirname4, join as join3 } from "path";
+import { homedir as homedir5, platform as platform2, userInfo } from "os";
+import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var SERVICE_LABEL = "ai.modelstat.agent";
 var SYSTEMD_UNIT = "modelstat";
 function home() {
-  return homedir4();
+  return homedir5();
 }
 function stateDir() {
-  return join3(home(), ".modelstat");
+  return join4(home(), ".modelstat");
 }
 function binDir() {
-  return join3(stateDir(), "bin");
+  return join4(stateDir(), "bin");
 }
 function logDir() {
-  return join3(stateDir(), "logs");
+  return join4(stateDir(), "logs");
 }
 function installedCliPath() {
-  return join3(binDir(), "modelstat.mjs");
+  return join4(binDir(), "modelstat.mjs");
 }
 function runningCliPath() {
   return fileURLToPath2(import.meta.url).replace(/service\.(mjs|js|ts)$/, "cli.mjs");
 }
 function installBundle() {
-  mkdirSync(binDir(), { recursive: true });
-  mkdirSync(logDir(), { recursive: true });
+  mkdirSync2(binDir(), { recursive: true });
+  mkdirSync2(logDir(), { recursive: true });
   const src = runningCliPath();
   const dest = installedCliPath();
-  if (!existsSync4(src)) {
+  if (!existsSync5(src)) {
     throw new Error(
       `Can't find the CLI bundle to install from (${src}). Are you running a local dev build?`
     );
@@ -46715,21 +46882,21 @@ function nodeBinary() {
   return process.execPath;
 }
 function plistPath() {
-  return join3(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join4(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function locateTrayExecutable() {
   const candidates = [
-    join3(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
+    join4(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
     "/Applications/ModelstatTray.app/Contents/MacOS/modelstat-tray"
   ];
   for (const p of candidates) {
-    if (existsSync4(p)) return p;
+    if (existsSync5(p)) return p;
   }
   return null;
 }
 function writePlist(cliPath) {
   const p = plistPath();
-  mkdirSync(dirname4(p), { recursive: true });
+  mkdirSync2(dirname4(p), { recursive: true });
   const tray = locateTrayExecutable();
   const programArgs = tray ? `    <string>${tray}</string>` : [
     `    <string>${nodeBinary()}</string>`,
@@ -46749,8 +46916,8 @@ ${programArgs}
   <key>KeepAlive</key>
   <dict><key>SuccessfulExit</key><false/></dict>
   <key>ThrottleInterval</key><integer>30</integer>
-  <key>StandardOutPath</key><string>${join3(logDir(), "out.log")}</string>
-  <key>StandardErrorPath</key><string>${join3(logDir(), "err.log")}</string>
+  <key>StandardOutPath</key><string>${join4(logDir(), "out.log")}</string>
+  <key>StandardErrorPath</key><string>${join4(logDir(), "err.log")}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key><string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin</string>
@@ -46759,7 +46926,7 @@ ${programArgs}
 </dict>
 </plist>
 `;
-  writeFileSync2(p, plist, { mode: 420 });
+  writeFileSync3(p, plist, { mode: 420 });
   return p;
 }
 function launchctl(args) {
@@ -46790,7 +46957,7 @@ function macUninstall() {
   const target = `gui/${uid}/${SERVICE_LABEL}`;
   launchctl(["bootout", target]);
   const plist = plistPath();
-  if (existsSync4(plist)) {
+  if (existsSync5(plist)) {
     try {
       unlinkSync(plist);
     } catch {
@@ -46803,12 +46970,12 @@ function macStatus() {
   return { running: r.ok, hint: r.ok ? "launchd managed" : "not installed" };
 }
 function systemdUnitPath() {
-  const xdg = process.env.XDG_CONFIG_HOME ?? join3(home(), ".config");
-  return join3(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
+  const xdg = process.env.XDG_CONFIG_HOME ?? join4(home(), ".config");
+  return join4(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
 }
 function writeSystemdUnit(cliPath) {
   const unitPath = systemdUnitPath();
-  mkdirSync(dirname4(unitPath), { recursive: true });
+  mkdirSync2(dirname4(unitPath), { recursive: true });
   const unit = `[Unit]
 Description=modelstat agent
 Documentation=https://modelstat.ai
@@ -46823,13 +46990,13 @@ RestartSec=10
 # Don't restart-storm if the service is persistently unreachable.
 StartLimitIntervalSec=300
 StartLimitBurst=10
-StandardOutput=append:${join3(logDir(), "out.log")}
-StandardError=append:${join3(logDir(), "err.log")}
+StandardOutput=append:${join4(logDir(), "out.log")}
+StandardError=append:${join4(logDir(), "err.log")}
 
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync2(unitPath, unit, { mode: 420 });
+  writeFileSync3(unitPath, unit, { mode: 420 });
   return unitPath;
 }
 function systemctl(args) {
@@ -46849,7 +47016,7 @@ function linuxInstall() {
 function linuxUninstall() {
   systemctl(["disable", "--now", `${SYSTEMD_UNIT}.service`]);
   const unit = systemdUnitPath();
-  if (existsSync4(unit)) {
+  if (existsSync5(unit)) {
     try {
       unlinkSync(unit);
     } catch {
@@ -46893,9 +47060,9 @@ function logsDir() {
 }
 function installTrayApp(sourceAppPath) {
   if (platform2() !== "darwin") return null;
-  if (!existsSync4(sourceAppPath)) return null;
-  const dest = join3(home(), "Applications", "ModelstatTray.app");
-  mkdirSync(dirname4(dest), { recursive: true });
+  if (!existsSync5(sourceAppPath)) return null;
+  const dest = join4(home(), "Applications", "ModelstatTray.app");
+  mkdirSync2(dirname4(dest), { recursive: true });
   spawnSync("rm", ["-rf", dest]);
   const r = spawnSync("cp", ["-R", sourceAppPath, dest], { encoding: "utf8" });
   if (r.status !== 0) {
@@ -46908,25 +47075,25 @@ function bundledTrayAppPath() {
   const here2 = dirname4(fileURLToPath2(import.meta.url));
   const candidates = [
     // Pre-built .app — CI with codesigning drops one here.
-    join3(here2, "..", "vendor", "ModelstatTray.app"),
+    join4(here2, "..", "vendor", "ModelstatTray.app"),
     // Local dev layout: apps/agent-dev/src/service.ts → ../../tray-mac/build/ModelstatTray.app
-    join3(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
+    join4(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
   ];
   for (const c of candidates) {
-    if (existsSync4(c)) return c;
+    if (existsSync5(c)) return c;
   }
   const sourceDirs = [
-    join3(here2, "..", "vendor", "tray-mac"),
-    join3(here2, "..", "..", "tray-mac")
+    join4(here2, "..", "vendor", "tray-mac"),
+    join4(here2, "..", "..", "tray-mac")
   ];
   for (const src of sourceDirs) {
-    const build = join3(src, "build-app.sh");
-    if (!existsSync4(build)) continue;
+    const build = join4(src, "build-app.sh");
+    if (!existsSync5(build)) continue;
     if (!hasSwift()) return null;
     const r = spawnSync("bash", [build], { cwd: src, encoding: "utf8" });
     if (r.status === 0) {
-      const app = join3(src, "build", "ModelstatTray.app");
-      if (existsSync4(app)) return app;
+      const app = join4(src, "build", "ModelstatTray.app");
+      if (existsSync5(app)) return app;
     }
   }
   return null;
@@ -46942,6 +47109,20 @@ function trayStatus() {
 }
 
 // src/cli.ts
+async function confirmPrompt(question, defaultYes) {
+  if (process.stdin.isTTY !== true) return defaultYes;
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  try {
+    const raw = await new Promise((resolve6) => rl.question(question, resolve6));
+    const ans = raw.trim().toLowerCase();
+    if (ans === "") return defaultYes;
+    if (ans === "y" || ans === "yes") return true;
+    if (ans === "n" || ans === "no") return false;
+    return defaultYes;
+  } finally {
+    rl.close();
+  }
+}
 function tryOpenBrowser(url) {
   const p = platform4();
   const cmd = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
@@ -47008,11 +47189,13 @@ async function cmdSelfRegister() {
     device_uuid: deviceUuid,
     fingerprint
   });
-  state.setDeviceUuid(res.device_uuid);
-  state.setDeviceId(res.device_id);
-  state.setBearer(res.device_secret);
-  state.setClaimCode(res.claim_code);
-  state.setClaimUrl(res.claim_url);
+  state.saveFreshIdentity({
+    deviceUuid: res.device_uuid,
+    deviceId: res.device_id,
+    bearerToken: res.device_secret,
+    claimCode: res.claim_code,
+    claimUrl: res.claim_url
+  });
   process.stdout.write(`  \x1B[32m\u2713\x1B[0m registered  device_id=${res.device_id}
 `);
   process.stdout.write(`  \x1B[32m\u2713\x1B[0m secret      ${res.secret_prefix}\u2026  (hashed on server, never re-sent)
@@ -47072,19 +47255,21 @@ async function cmdConnect(opts) {
   };
   const wipeAndSelfRegister = async (reason) => {
     warn(`${reason} \u2014 re-registering this device`);
+    const bak = backupIdentity();
+    if (bak) warn(`old identity moved to ${bak}`);
     state.setBearer(null);
-    state.setDeviceId(null);
-    state.setDeviceUuid(null);
-    state.setClaimCode(null);
-    state.setClaimUrl(null);
     await cmdSelfRegister();
   };
-  if (!state.deviceUuid || !state.bearer || !state.deviceId) {
+  if (opts.fresh && hasIdentityFile()) {
+    step("`--fresh` passed \u2014 minting a new device identity");
+    await wipeAndSelfRegister("forced fresh start");
+  } else if (!state.deviceUuid || !state.bearer || !state.deviceId) {
     step("Registering this device with modelstat.ai");
     await cmdSelfRegister();
   } else {
     step("Re-using existing device identity");
     ok(`device ${state.deviceId}`);
+    ok(`identity file ${identityPath()}`);
     try {
       const me = await fetchDeviceMe(state.bearer);
       if (me.claim_code && me.claim_code !== state.claimCode) {
@@ -47096,6 +47281,15 @@ async function cmdConnect(opts) {
       }
     } catch (e) {
       if (e instanceof DeviceMeUnauthorized) {
+        const interactive = !opts.yes && process.stdin.isTTY === true;
+        if (interactive) {
+          const prompt = "cached credentials no longer accepted by the server. Re-register this device? [Y/n] ";
+          const answer = await confirmPrompt(prompt, true);
+          if (!answer) {
+            warn("keeping existing identity; connect aborted");
+            return;
+          }
+        }
         await wipeAndSelfRegister("cached credentials no longer valid");
       } else {
         warn(`couldn't refresh device state: ${e.message}`);
@@ -47375,7 +47569,9 @@ function cmdPaths(args) {
 function parseConnectOpts(argv) {
   return {
     json: argv.includes("--json"),
-    noBrowser: argv.includes("--no-browser")
+    noBrowser: argv.includes("--no-browser"),
+    fresh: argv.includes("--fresh"),
+    yes: argv.includes("--yes") || argv.includes("-y")
   };
 }
 async function main() {