modelstat 0.0.22 → 0.0.24

package/dist/cli.mjs

@@ -4339,6 +4339,18 @@ var init_schemas = __esm({
       tool_calls: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).default({}),
       // Files touched, relative to git root. Never absolute — scrubbed by agent.
       files_touched: external_exports.array(external_exports.string().max(512)).max(256).default([]),
+      // Redacted excerpt of the conversation turn (user prompt or
+      // assistant response). The PARSER is responsible for:
+      //   1. Pulling a representative snippet from the turn (≤320 chars).
+      //   2. Running it through @modelstat/core/redact PLUS, when
+      //      available, the on-device Privacy Filter adapter.
+      //   3. Stripping code blocks and file-path noise.
+      // Optional — events without it fall back to metadata-only abstracts
+      // (the historical behaviour). The companion-core pipeline runs
+      // redact() over it again as defence-in-depth before building the
+      // summarize prompt; it never gets stored long-term server-side, only
+      // used to construct the summarize input.
+      content_excerpt: external_exports.string().max(320).optional(),
       // Reference to originating file for reparsing
       source_file: external_exports.string().max(1024).nullable(),
       source_byte_offset: external_exports.number().int().nonnegative().nullable(),
@@ -4354,7 +4366,7 @@ var init_schemas = __esm({
       secrets_found: external_exports.number().int().nonnegative().default(0),
       emails_redacted: external_exports.number().int().nonnegative().default(0),
       paths_redacted_absolute: external_exports.number().int().nonnegative().default(0)
-    });
+    }).catchall(external_exports.number().int().nonnegative());
     TaxonomyHintRooted = external_exports.object({
       root_key: external_exports.string().max(60),
       name: external_exports.string().max(120),
@@ -4651,6 +4663,28 @@ import { createHash } from "crypto";
 import { createReadStream } from "fs";
 import { stat } from "fs/promises";
 import { createInterface } from "readline";
+function extractExcerpt(content) {
+  if (!content) return void 0;
+  let text = "";
+  if (typeof content === "string") {
+    text = content;
+  } else if (Array.isArray(content)) {
+    const parts = [];
+    for (const block of content) {
+      if (block && block.type === "text" && typeof block.text === "string") {
+        parts.push(block.text);
+      }
+    }
+    text = parts.join(" ");
+  }
+  if (!text) return void 0;
+  text = text.replace(/```[\s\S]*?```/g, " ").replace(/`[^`]*`/g, " ");
+  text = text.replace(/\s+/g, " ").trim();
+  if (!text) return void 0;
+  const cleaned = redact(text).text;
+  const truncated = cleaned.slice(0, 320);
+  return truncated.length > 0 ? truncated : void 0;
+}
 async function parseClaudeCodeJsonl(ctx) {
   const events = [];
   let rawLines = 0;
@@ -4701,6 +4735,7 @@ async function parseClaudeCodeJsonl(ctx) {
         continue;
       }
       const slug = guessRepoSlugFromPath(cwd);
+      const excerpt = extractExcerpt(a.message?.content);
       events.push({
         source_event_id: sourceEventId(ctx.deviceId, ctx.sourceFile, offsetAtLineStart),
         ts: a.timestamp,
@@ -4729,6 +4764,7 @@ async function parseClaudeCodeJsonl(ctx) {
         duration_ms: null,
         tool_calls: {},
         files_touched: [],
+        ...excerpt ? { content_excerpt: excerpt } : {},
         source_file: ctx.sourceFile,
         source_byte_offset: offsetAtLineStart,
         // Files in ~/.claude/projects/ come from the Claude Code app
@@ -4743,6 +4779,7 @@ async function parseClaudeCodeJsonl(ctx) {
         skipped += 1;
         continue;
       }
+      const excerpt = extractExcerpt(u.message?.content);
       events.push({
         source_event_id: sourceEventId(ctx.deviceId, ctx.sourceFile, offsetAtLineStart),
         ts: u.timestamp,
@@ -4759,6 +4796,7 @@ async function parseClaudeCodeJsonl(ctx) {
         duration_ms: null,
         tool_calls: {},
         files_touched: [],
+        ...excerpt ? { content_excerpt: excerpt } : {},
         source_file: ctx.sourceFile,
         source_byte_offset: offsetAtLineStart,
         billing: "subscription"
@@ -7487,6 +7525,107 @@ var init_src2 = __esm({
   }
 });
 
+// src/identity.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  writeFileSync,
+  existsSync as existsSync3
+} from "fs";
+import { homedir as homedir2, hostname as osHostname } from "os";
+import { join as join2 } from "path";
+function ensureRoot() {
+  mkdirSync(ROOT, { recursive: true, mode: 448 });
+}
+function writeAtomic(meta) {
+  ensureRoot();
+  const tmp = `${IDENTITY_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(meta, null, 2), { mode: 384 });
+  renameSync(tmp, IDENTITY_FILE);
+  try {
+    chmodSync(IDENTITY_FILE, 384);
+  } catch {
+  }
+}
+function identityPath() {
+  return IDENTITY_FILE;
+}
+function hasIdentityFile() {
+  return existsSync3(IDENTITY_FILE);
+}
+function parseFile() {
+  try {
+    const raw = readFileSync2(IDENTITY_FILE, "utf8");
+    const obj = JSON.parse(raw);
+    if (!obj.deviceUuid || !obj.deviceId || !obj.bearerToken) {
+      return null;
+    }
+    return {
+      deviceUuid: obj.deviceUuid,
+      deviceId: obj.deviceId,
+      bearerToken: obj.bearerToken,
+      claimCode: obj.claimCode ?? null,
+      claimUrl: obj.claimUrl ?? null,
+      hostname: obj.hostname ?? osHostname(),
+      createdAt: obj.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      userEmail: obj.userEmail ?? null,
+      defaultOrgId: obj.defaultOrgId ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+function loadIdentity(migrateFromConf2) {
+  const fromFile = parseFile();
+  if (fromFile) return fromFile;
+  if (!migrateFromConf2) return null;
+  const legacy = migrateFromConf2();
+  if (!legacy) return null;
+  if (!legacy.deviceUuid || !legacy.deviceId || !legacy.bearerToken) {
+    return null;
+  }
+  const migrated = {
+    deviceUuid: legacy.deviceUuid,
+    deviceId: legacy.deviceId,
+    bearerToken: legacy.bearerToken,
+    claimCode: legacy.claimCode ?? null,
+    claimUrl: legacy.claimUrl ?? null,
+    hostname: osHostname(),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    userEmail: legacy.userEmail ?? null,
+    defaultOrgId: legacy.defaultOrgId ?? null
+  };
+  writeAtomic(migrated);
+  return migrated;
+}
+function saveIdentity(meta) {
+  writeAtomic(meta);
+}
+function backupIdentity() {
+  if (!existsSync3(IDENTITY_FILE)) return null;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dest = `${IDENTITY_FILE}.bak-${stamp}`;
+  renameSync(IDENTITY_FILE, dest);
+  return dest;
+}
+function updateIdentity(patch) {
+  const current = parseFile();
+  if (!current) return null;
+  const merged = { ...current, ...patch };
+  writeAtomic(merged);
+  return merged;
+}
+var ROOT, IDENTITY_FILE;
+var init_identity = __esm({
+  "src/identity.ts"() {
+    "use strict";
+    ROOT = join2(homedir2(), ".modelstat");
+    IDENTITY_FILE = join2(ROOT, "identity.json");
+  }
+});
+
 // ../../node_modules/.pnpm/undici@7.25.0/node_modules/undici/lib/core/symbols.js
 var require_symbols = __commonJS({
   "../../node_modules/.pnpm/undici@7.25.0/node_modules/undici/lib/core/symbols.js"(exports, module) {
@@ -33061,15 +33200,15 @@ function envPaths(name, { suffix = "nodejs" } = {}) {
   }
   return linux(name);
 }
-var homedir2, tmpdir, env, macos, windows, linux;
+var homedir3, tmpdir, env, macos, windows, linux;
 var init_env_paths = __esm({
   "../../node_modules/.pnpm/env-paths@3.0.0/node_modules/env-paths/index.js"() {
     "use strict";
-    homedir2 = os.homedir();
+    homedir3 = os.homedir();
     tmpdir = os.tmpdir();
     ({ env } = process2);
     macos = (name) => {
-      const library = path.join(homedir2, "Library");
+      const library = path.join(homedir3, "Library");
       return {
         data: path.join(library, "Application Support", name),
         config: path.join(library, "Preferences", name),
@@ -33079,8 +33218,8 @@ var init_env_paths = __esm({
       };
     };
     windows = (name) => {
-      const appData = env.APPDATA || path.join(homedir2, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path.join(homedir2, "AppData", "Local");
+      const appData = env.APPDATA || path.join(homedir3, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path.join(homedir3, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
         data: path.join(localAppData, name, "Data"),
@@ -33091,13 +33230,13 @@ var init_env_paths = __esm({
       };
     };
     linux = (name) => {
-      const username = path.basename(homedir2);
+      const username = path.basename(homedir3);
       return {
-        data: path.join(env.XDG_DATA_HOME || path.join(homedir2, ".local", "share"), name),
-        config: path.join(env.XDG_CONFIG_HOME || path.join(homedir2, ".config"), name),
-        cache: path.join(env.XDG_CACHE_HOME || path.join(homedir2, ".cache"), name),
+        data: path.join(env.XDG_DATA_HOME || path.join(homedir3, ".local", "share"), name),
+        config: path.join(env.XDG_CONFIG_HOME || path.join(homedir3, ".config"), name),
+        cache: path.join(env.XDG_CACHE_HOME || path.join(homedir3, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path.join(env.XDG_STATE_HOME || path.join(homedir2, ".local", "state"), name),
+        log: path.join(env.XDG_STATE_HOME || path.join(homedir3, ".local", "state"), name),
         temp: path.join(tmpdir, username, name)
       };
     };
@@ -33538,9 +33677,9 @@ import { once } from "events";
 import { createWriteStream } from "fs";
 import path3 from "path";
 import { Readable } from "stream";
-function writeFileSync(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
+function writeFileSync2(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
   if (isString(options))
-    return writeFileSync(filePath, data, { encoding: options });
+    return writeFileSync2(filePath, data, { encoding: options });
   const timeout = options.timeout ?? DEFAULT_TIMEOUT_SYNC;
   const retryOptions = { timeout };
   let tempDisposer = null;
@@ -43663,7 +43802,7 @@ var init_source = __esm({
           fs2.writeFileSync(this.path, data, { mode: this.#options.configFileMode });
         } else {
           try {
-            writeFileSync(this.path, data, { mode: this.#options.configFileMode });
+            writeFileSync2(this.path, data, { mode: this.#options.configFileMode });
           } catch (error) {
             if (error?.code === "EXDEV") {
               fs2.writeFileSync(this.path, data, { mode: this.#options.configFileMode });
@@ -43765,20 +43904,52 @@ var init_source = __esm({
 });
 
 // src/config.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
-var import_dotenv, here, DEFAULT_API_URL, LEGACY_LOCALHOST_API, store, state;
+function migrateFromConf() {
+  const bearer = store.get("bearerToken");
+  const deviceUuid = store.get("deviceUuid");
+  const deviceId = store.get("deviceId");
+  if (!bearer || !deviceUuid || !deviceId) return null;
+  return {
+    bearerToken: bearer,
+    deviceId,
+    deviceUuid,
+    claimCode: store.get("claimCode"),
+    claimUrl: store.get("claimUrl"),
+    userEmail: store.get("userEmail"),
+    defaultOrgId: store.get("defaultOrgId")
+  };
+}
+function clearConfIdentity() {
+  store.set("bearerToken", null);
+  store.set("deviceId", null);
+  store.set("deviceUuid", null);
+  store.set("claimCode", null);
+  store.set("claimUrl", null);
+}
+function writeThrough(patch) {
+  if (!cachedIdentity) {
+    throw new Error(
+      "config: no identity yet \u2014 call state.saveFreshIdentity() first"
+    );
+  }
+  cachedIdentity = { ...cachedIdentity, ...patch };
+  updateIdentity(patch);
+}
+var import_dotenv, here, DEFAULT_API_URL, LEGACY_LOCALHOST_API, store, cachedIdentity, state;
 var init_config2 = __esm({
   "src/config.ts"() {
     "use strict";
     import_dotenv = __toESM(require_main(), 1);
     init_source();
+    init_identity();
     here = dirname2(fileURLToPath(import.meta.url));
     for (let d = here, i = 0; i < 8; i++, d = resolve3(d, "..")) {
       const candidate = resolve3(d, ".env");
-      if (existsSync3(candidate)) {
+      if (existsSync4(candidate)) {
         (0, import_dotenv.config)({ path: candidate });
         break;
       }
@@ -43804,6 +43975,14 @@ var init_config2 = __esm({
         cursor: {}
       }
     });
+    cachedIdentity = (() => {
+      const had = store.get("bearerToken") !== null;
+      const id = loadIdentity(migrateFromConf);
+      if (id && had && !store.path.includes("fallback")) {
+        clearConfIdentity();
+      }
+      return id;
+    })();
     state = {
       /** Resolution order: env var → stored value (if user ran `setApiUrl`
        * or paired pre-0.0.8) → production default. The legacy localhost
@@ -43817,42 +43996,66 @@ var init_config2 = __esm({
       setApiUrl(v) {
         store.set("apiUrl", v);
       },
+      // ── Identity: backed by ~/.modelstat/identity.json ─────────────
+      /** Seed a fresh identity after a successful self-register. Writes
+       * the file atomically; use `state.backupAndReset()` first if
+       * overwriting an existing identity. */
+      saveFreshIdentity(meta) {
+        const id = {
+          deviceUuid: meta.deviceUuid,
+          deviceId: meta.deviceId,
+          bearerToken: meta.bearerToken,
+          claimCode: meta.claimCode,
+          claimUrl: meta.claimUrl,
+          hostname: hostname(),
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          userEmail: null,
+          defaultOrgId: null
+        };
+        saveIdentity(id);
+        cachedIdentity = id;
+      },
+      get identity() {
+        return cachedIdentity;
+      },
       get bearer() {
-        return store.get("bearerToken");
+        return cachedIdentity?.bearerToken ?? null;
       },
       setBearer(v) {
-        store.set("bearerToken", v);
+        if (v === null) {
+          cachedIdentity = null;
+          return;
+        }
+        writeThrough({ bearerToken: v });
       },
       get deviceId() {
-        return store.get("deviceId");
-      },
-      setDeviceId(v) {
-        store.set("deviceId", v);
-      },
-      get userEmail() {
-        return store.get("userEmail");
-      },
-      setUserEmail(v) {
-        store.set("userEmail", v);
+        return cachedIdentity?.deviceId ?? null;
       },
       get deviceUuid() {
-        return store.get("deviceUuid");
-      },
-      setDeviceUuid(v) {
-        store.set("deviceUuid", v);
+        return cachedIdentity?.deviceUuid ?? null;
       },
       get claimCode() {
-        return store.get("claimCode");
+        return cachedIdentity?.claimCode ?? null;
       },
       setClaimCode(v) {
-        store.set("claimCode", v);
+        if (!cachedIdentity) return;
+        writeThrough({ claimCode: v });
       },
       get claimUrl() {
-        return store.get("claimUrl");
+        return cachedIdentity?.claimUrl ?? null;
       },
       setClaimUrl(v) {
-        store.set("claimUrl", v);
+        if (!cachedIdentity) return;
+        writeThrough({ claimUrl: v });
       },
+      get userEmail() {
+        return cachedIdentity?.userEmail ?? null;
+      },
+      setUserEmail(v) {
+        if (!cachedIdentity) return;
+        writeThrough({ userEmail: v });
+      },
+      // ── Runtime state: stays in conf ───────────────────────────────
       getCursor(path5) {
         return store.get("cursor")[path5];
       },
@@ -44032,9 +44235,9 @@ var OLLAMA_CHAT_MODEL, OLLAMA_EMBED_MODEL, SUMMARISER_SYSTEM_PROMPT, SUMMARISER_
 var init_prompts = __esm({
   "../../packages/companion-core/src/pipeline/prompts.ts"() {
     "use strict";
-    OLLAMA_CHAT_MODEL = "qwen3:0.6b";
+    OLLAMA_CHAT_MODEL = "qwen3.5:0.8b";
     OLLAMA_EMBED_MODEL = "bge-small-en-v1.5";
-    SUMMARISER_SYSTEM_PROMPT = "You summarise an AI coding session in ONE sentence, \u2264 240 characters. Focus on what the human was trying to accomplish. No quotes, no PII, no code literals, no file paths. Reply with only the sentence.";
+    SUMMARISER_SYSTEM_PROMPT = "You summarise an AI coding session in ONE sentence, \u2264 240 characters. If the user message includes sampled conversation excerpts, base your summary on what the developer was actually working on (the substance \u2014 what was being built, debugged, refactored, or designed). If only metadata is given, paraphrase the metadata. Never quote the excerpts verbatim. No PII, no code literals, no file paths, no API keys. Reply with only the sentence.";
     SUMMARISER_MAX_TOKENS = 120;
     SUMMARISER_TEMPERATURE = 0.2;
     QWEN_CHARS_PER_TOKEN = 3.3;
@@ -44145,7 +44348,14 @@ async function summariseSlice(sessionId, slice, adapters2) {
     first.files_touched?.length ? `files touched: ${first.files_touched.slice(0, 5).join(", ")}` : null,
     Object.keys(first.tool_calls ?? {}).length ? `tool calls: ${Object.keys(first.tool_calls).slice(0, 5).join(", ")}` : null
   ].filter(Boolean).join("; ");
-  const prompt = `Session context: ${promptFacts || "generic coding session"}.
+  const excerpts = sampleAndRedactExcerpts(slice);
+  const excerptBlock = excerpts.length ? excerpts.map((e, i) => `  [turn ${i + 1}] "${e.replace(/\s+/g, " ").trim()}"`).join("\n") : "";
+  const prompt = excerptBlock ? `Session context: ${promptFacts || "generic coding session"}.
+
+Sampled excerpts from the conversation (already redacted of PII and secrets):
+${excerptBlock}
+
+Write ONE sentence (\u2264240 chars) describing what the human was working on. Focus on the substance \u2014 what was being built, debugged, or designed. No quotes, no PII, no code literals, no file paths.` : `Session context: ${promptFacts || "generic coding session"}.
 Write one sentence describing what the human was doing.`;
   let rawAbstract;
   try {
@@ -44153,7 +44363,20 @@ Write one sentence describing what the human was doing.`;
   } catch {
     rawAbstract = promptFacts || `${first.tool} session with ${slice.length} turns`;
   }
-  const redacted = redact(rawAbstract);
+  const regexPass = redact(rawAbstract);
+  let abstractText = regexPass.text;
+  const counts = { ...regexPass.counts };
+  if (adapters2.redact) {
+    try {
+      const modelPass = await adapters2.redact(regexPass.text);
+      abstractText = modelPass.text;
+      for (const [k, v] of Object.entries(modelPass.counts)) {
+        if (k.startsWith("pf_")) counts[k] = v;
+      }
+    } catch {
+    }
+  }
+  const redacted = { text: abstractText, counts };
   const tags = [
     { root_key: "tools", name: first.tool, confidence: 1 },
     { root_key: "providers", name: first.provider, confidence: 1 }
@@ -44194,11 +44417,39 @@ Write one sentence describing what the human was doing.`;
     abstract: redacted.text.slice(0, ABSTRACT_MAX_CHARS),
     tokens,
     tags,
+    // counts is `Record<string, number>` after the optional model
+    // merge; the schema's RedactionReport requires the three regex
+    // counters (always populated from regexPass.counts) plus a
+    // number-valued catchall for pf_*.
     redaction: redacted.counts,
     source_event_ids: sourceEventIds,
     abstract_embedding: segmentEmbedding && segmentEmbedding.length === 384 ? segmentEmbedding : void 0
   };
 }
+function sampleAndRedactExcerpts(slice) {
+  const withContent = [];
+  for (let i = 0; i < slice.length; i++) {
+    const c = slice[i]?.content_excerpt;
+    if (c && c.trim().length > 0) withContent.push({ idx: i, text: c });
+  }
+  if (withContent.length === 0) return [];
+  const picks = [0];
+  if (withContent.length > 1) picks.push(withContent.length - 1);
+  for (const frac of [0.25, 0.5, 0.75]) {
+    const idx = Math.floor(withContent.length * frac);
+    if (!picks.includes(idx)) picks.push(idx);
+    if (picks.length >= 5) break;
+  }
+  picks.sort((a, b) => a - b);
+  const out = [];
+  for (const i of picks) {
+    const raw = withContent[i]?.text;
+    if (!raw) continue;
+    const redacted = redact(raw).text;
+    out.push(redacted.slice(0, 200));
+  }
+  return out;
+}
 function turnSurface(e) {
   const parts = [e.kind, e.tool];
   if (e.model) parts.push(e.model);
@@ -44402,23 +44653,23 @@ var init_pipeline2 = __esm({
 
 // src/scan.ts
 import { readdir, stat as stat2 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join2 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join3 } from "path";
 async function scanAll(cb = {}) {
   const deviceId = state.deviceId;
   if (!deviceId) throw new Error("agent not enrolled \u2014 run `register` first");
   const jobs = [];
   try {
-    const base = join2(homedir3(), ".claude/projects");
+    const base = join3(homedir4(), ".claude/projects");
     const projects = await readdir(base).catch(() => []);
     for (const p of projects) {
-      const dir = join2(base, p);
+      const dir = join3(base, p);
       const ds = await stat2(dir).catch(() => null);
       if (!ds?.isDirectory()) continue;
       const files = await readdir(dir);
       for (const f of files) {
         if (!f.endsWith(".jsonl")) continue;
-        const full = join2(dir, f);
+        const full = join3(dir, f);
         jobs.push({
           path: full,
           parse: async () => {
@@ -44432,17 +44683,17 @@ async function scanAll(cb = {}) {
     console.warn("claude scan skipped:", e.message);
   }
   try {
-    const base = join2(homedir3(), ".codex/sessions");
+    const base = join3(homedir4(), ".codex/sessions");
     const years = await readdir(base).catch(() => []);
     for (const y of years) {
-      const months = await readdir(join2(base, y)).catch(() => []);
+      const months = await readdir(join3(base, y)).catch(() => []);
       for (const m of months) {
-        const days = await readdir(join2(base, y, m)).catch(() => []);
+        const days = await readdir(join3(base, y, m)).catch(() => []);
         for (const d of days) {
-          const files = await readdir(join2(base, y, m, d)).catch(() => []);
+          const files = await readdir(join3(base, y, m, d)).catch(() => []);
           for (const f of files) {
             if (!f.startsWith("rollout-") || !f.endsWith(".jsonl")) continue;
-            const full = join2(base, y, m, d, f);
+            const full = join3(base, y, m, d, f);
             jobs.push({
               path: full,
               parse: async () => {
@@ -44516,7 +44767,7 @@ var init_scan = __esm({
     init_pipeline2();
     init_config2();
     init_api();
-    AGENT_VERSION = "agent-dev-0.0.22";
+    AGENT_VERSION = "agent-dev-0.0.23";
     BATCH_MAX_EVENTS = 2e3;
   }
 });
@@ -44524,17 +44775,17 @@ var init_scan = __esm({
 // src/lock.ts
 import {
   closeSync,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync3,
   openSync,
-  readFileSync as readFileSync2,
-  renameSync,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync3,
+  writeFileSync as writeFileSync4,
   writeSync
 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join5 } from "path";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
   try {
@@ -44548,7 +44799,7 @@ function isProcessAlive(pid) {
 }
 function readLock() {
   try {
-    const raw = readFileSync2(LOCK_FILE, "utf8");
+    const raw = readFileSync3(LOCK_FILE, "utf8");
     const obj = JSON.parse(raw);
     if (typeof obj.pid !== "number") return null;
     return {
@@ -44562,7 +44813,7 @@ function readLock() {
   }
 }
 function writeLockAtomic(meta) {
-  mkdirSync2(LOCK_DIR, { recursive: true });
+  mkdirSync3(LOCK_DIR, { recursive: true });
   const tmp = `${LOCK_FILE}.${meta.pid}.${Date.now()}.tmp`;
   const fd = openSync(tmp, "wx");
   try {
@@ -44570,7 +44821,7 @@ function writeLockAtomic(meta) {
   } finally {
     closeSync(fd);
   }
-  renameSync(tmp, LOCK_FILE);
+  renameSync2(tmp, LOCK_FILE);
 }
 function removeLockIfOwned(ownerPid) {
   const lock = readLock();
@@ -44635,8 +44886,8 @@ var LOCK_DIR, LOCK_FILE;
 var init_lock = __esm({
   "src/lock.ts"() {
     "use strict";
-    LOCK_DIR = join4(homedir5(), ".modelstat");
-    LOCK_FILE = join4(LOCK_DIR, "daemon.lock");
+    LOCK_DIR = join5(homedir6(), ".modelstat");
+    LOCK_FILE = join5(LOCK_DIR, "daemon.lock");
   }
 });
 
@@ -46366,7 +46617,7 @@ __export(daemon_exports, {
   setProgress: () => setProgress,
   setQueue: () => setQueue
 });
-import { existsSync as existsSync6, statSync as statSync2 } from "fs";
+import { existsSync as existsSync7, statSync as statSync2 } from "fs";
 function setPhase(phase, message) {
   status.phase = phase;
   status.message = message ?? null;
@@ -46488,21 +46739,21 @@ async function runDaemon(opts = {}) {
   await runDiscovery();
   await runScanCycle("startup");
   const chokidar = (await Promise.resolve().then(() => (init_esm2(), esm_exports))).default;
-  const { homedir: homedir7, platform: platform5 } = await import("os");
-  const { join: join8 } = await import("path");
-  const home2 = homedir7();
+  const { homedir: homedir8, platform: platform5 } = await import("os");
+  const { join: join9 } = await import("path");
+  const home2 = homedir8();
   const dirs = [
-    join8(home2, ".claude/projects"),
-    join8(home2, ".codex/sessions"),
-    join8(home2, ".cursor/ai-tracking"),
-    join8(home2, ".gemini"),
+    join9(home2, ".claude/projects"),
+    join9(home2, ".codex/sessions"),
+    join9(home2, ".cursor/ai-tracking"),
+    join9(home2, ".gemini"),
     ...platform5() === "darwin" ? [
-      join8(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join8(home2, "Library/Application Support/Claude")
+      join9(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join9(home2, "Library/Application Support/Claude")
     ] : [
-      join8(home2, ".config/Cursor/User/workspaceStorage")
+      join9(home2, ".config/Cursor/User/workspaceStorage")
     ]
-  ].filter((p) => existsSync6(p) && statSync2(p).isDirectory());
+  ].filter((p) => existsSync7(p) && statSync2(p).isDirectory());
   setPhase("watching", `Watching ${dirs.length} directories`);
   const watcher = chokidar.watch(dirs, {
     persistent: true,
@@ -46549,7 +46800,7 @@ var init_daemon = __esm({
     init_config2();
     init_lock();
     init_scan();
-    AGENT_VERSION2 = "agent-dev-0.0.22";
+    AGENT_VERSION2 = "agent-dev-0.0.23";
     HEARTBEAT_INTERVAL_MS = 1e4;
     SCAN_INTERVAL_MS = 5 * 60 * 1e3;
     status = {
@@ -46569,37 +46820,37 @@ var watch_exports = {};
 __export(watch_exports, {
   watchForever: () => watchForever
 });
-import { existsSync as existsSync7 } from "fs";
-import { homedir as homedir6, platform as platform3 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { homedir as homedir7, platform as platform3 } from "os";
+import { join as join8 } from "path";
 function resolveWatchDirs() {
-  const home2 = homedir6();
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join7(home2, ".config");
-  const xdgData = process.env.XDG_DATA_HOME ?? join7(home2, ".local/share");
+  const home2 = homedir7();
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join8(home2, ".config");
+  const xdgData = process.env.XDG_DATA_HOME ?? join8(home2, ".local/share");
   const candidates = [
     // universal (default HOME-rooted CLI data dirs)
-    join7(home2, ".claude/projects"),
-    join7(home2, ".codex/sessions"),
-    join7(home2, ".cursor/ai-tracking"),
-    join7(home2, ".gemini"),
-    join7(home2, ".aider"),
+    join8(home2, ".claude/projects"),
+    join8(home2, ".codex/sessions"),
+    join8(home2, ".cursor/ai-tracking"),
+    join8(home2, ".gemini"),
+    join8(home2, ".aider"),
     // XDG / Linux
-    join7(xdgConfig, "claude/projects"),
-    join7(xdgConfig, "codex/sessions"),
-    join7(xdgConfig, "Cursor/User/workspaceStorage"),
-    join7(xdgConfig, "Code/User/workspaceStorage"),
-    join7(xdgConfig, "Code - Insiders/User/workspaceStorage"),
-    join7(xdgData, "claude/projects"),
+    join8(xdgConfig, "claude/projects"),
+    join8(xdgConfig, "codex/sessions"),
+    join8(xdgConfig, "Cursor/User/workspaceStorage"),
+    join8(xdgConfig, "Code/User/workspaceStorage"),
+    join8(xdgConfig, "Code - Insiders/User/workspaceStorage"),
+    join8(xdgData, "claude/projects"),
     // macOS
     ...platform3() === "darwin" ? [
-      join7(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join7(home2, "Library/Application Support/Claude"),
-      join7(home2, "Library/Application Support/Code/User/workspaceStorage"),
-      join7(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
-      join7(home2, "Library/Application Support/Zed")
+      join8(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join8(home2, "Library/Application Support/Claude"),
+      join8(home2, "Library/Application Support/Code/User/workspaceStorage"),
+      join8(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
+      join8(home2, "Library/Application Support/Zed")
     ] : []
   ];
-  return Array.from(new Set(candidates)).filter((p) => existsSync7(p));
+  return Array.from(new Set(candidates)).filter((p) => existsSync8(p));
 }
 async function safeScan(reason) {
   if (scanning) {
@@ -46659,51 +46910,53 @@ var init_watch = __esm({
 
 // src/cli.ts
 init_src2();
+init_identity();
 init_api();
 init_config2();
 init_scan();
 import { spawn } from "child_process";
 import { randomBytes } from "crypto";
 import { platform as platform4, release, arch as cpuArch, hostname as hostname2 } from "os";
+import { createInterface as createInterface3 } from "readline";
 
 // src/service.ts
 import { spawnSync } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync4,
-  mkdirSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync2,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir4, platform as platform2, userInfo } from "os";
-import { dirname as dirname4, join as join3 } from "path";
+import { homedir as homedir5, platform as platform2, userInfo } from "os";
+import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var SERVICE_LABEL = "ai.modelstat.agent";
 var SYSTEMD_UNIT = "modelstat";
 function home() {
-  return homedir4();
+  return homedir5();
 }
 function stateDir() {
-  return join3(home(), ".modelstat");
+  return join4(home(), ".modelstat");
 }
 function binDir() {
-  return join3(stateDir(), "bin");
+  return join4(stateDir(), "bin");
 }
 function logDir() {
-  return join3(stateDir(), "logs");
+  return join4(stateDir(), "logs");
 }
 function installedCliPath() {
-  return join3(binDir(), "modelstat.mjs");
+  return join4(binDir(), "modelstat.mjs");
 }
 function runningCliPath() {
   return fileURLToPath2(import.meta.url).replace(/service\.(mjs|js|ts)$/, "cli.mjs");
 }
 function installBundle() {
-  mkdirSync(binDir(), { recursive: true });
-  mkdirSync(logDir(), { recursive: true });
+  mkdirSync2(binDir(), { recursive: true });
+  mkdirSync2(logDir(), { recursive: true });
   const src = runningCliPath();
   const dest = installedCliPath();
-  if (!existsSync4(src)) {
+  if (!existsSync5(src)) {
     throw new Error(
       `Can't find the CLI bundle to install from (${src}). Are you running a local dev build?`
     );
@@ -46715,21 +46968,21 @@ function nodeBinary() {
   return process.execPath;
 }
 function plistPath() {
-  return join3(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join4(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function locateTrayExecutable() {
   const candidates = [
-    join3(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
+    join4(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
     "/Applications/ModelstatTray.app/Contents/MacOS/modelstat-tray"
   ];
   for (const p of candidates) {
-    if (existsSync4(p)) return p;
+    if (existsSync5(p)) return p;
   }
   return null;
 }
 function writePlist(cliPath) {
   const p = plistPath();
-  mkdirSync(dirname4(p), { recursive: true });
+  mkdirSync2(dirname4(p), { recursive: true });
   const tray = locateTrayExecutable();
   const programArgs = tray ? `    <string>${tray}</string>` : [
     `    <string>${nodeBinary()}</string>`,
@@ -46749,8 +47002,8 @@ ${programArgs}
   <key>KeepAlive</key>
   <dict><key>SuccessfulExit</key><false/></dict>
   <key>ThrottleInterval</key><integer>30</integer>
-  <key>StandardOutPath</key><string>${join3(logDir(), "out.log")}</string>
-  <key>StandardErrorPath</key><string>${join3(logDir(), "err.log")}</string>
+  <key>StandardOutPath</key><string>${join4(logDir(), "out.log")}</string>
+  <key>StandardErrorPath</key><string>${join4(logDir(), "err.log")}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key><string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin</string>
@@ -46759,7 +47012,7 @@ ${programArgs}
 </dict>
 </plist>
 `;
-  writeFileSync2(p, plist, { mode: 420 });
+  writeFileSync3(p, plist, { mode: 420 });
   return p;
 }
 function launchctl(args) {
@@ -46790,7 +47043,7 @@ function macUninstall() {
   const target = `gui/${uid}/${SERVICE_LABEL}`;
   launchctl(["bootout", target]);
   const plist = plistPath();
-  if (existsSync4(plist)) {
+  if (existsSync5(plist)) {
     try {
       unlinkSync(plist);
     } catch {
@@ -46803,12 +47056,12 @@ function macStatus() {
   return { running: r.ok, hint: r.ok ? "launchd managed" : "not installed" };
 }
 function systemdUnitPath() {
-  const xdg = process.env.XDG_CONFIG_HOME ?? join3(home(), ".config");
-  return join3(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
+  const xdg = process.env.XDG_CONFIG_HOME ?? join4(home(), ".config");
+  return join4(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
 }
 function writeSystemdUnit(cliPath) {
   const unitPath = systemdUnitPath();
-  mkdirSync(dirname4(unitPath), { recursive: true });
+  mkdirSync2(dirname4(unitPath), { recursive: true });
   const unit = `[Unit]
 Description=modelstat agent
 Documentation=https://modelstat.ai
@@ -46823,13 +47076,13 @@ RestartSec=10
 # Don't restart-storm if the service is persistently unreachable.
 StartLimitIntervalSec=300
 StartLimitBurst=10
-StandardOutput=append:${join3(logDir(), "out.log")}
-StandardError=append:${join3(logDir(), "err.log")}
+StandardOutput=append:${join4(logDir(), "out.log")}
+StandardError=append:${join4(logDir(), "err.log")}
 
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync2(unitPath, unit, { mode: 420 });
+  writeFileSync3(unitPath, unit, { mode: 420 });
   return unitPath;
 }
 function systemctl(args) {
@@ -46849,7 +47102,7 @@ function linuxInstall() {
 function linuxUninstall() {
   systemctl(["disable", "--now", `${SYSTEMD_UNIT}.service`]);
   const unit = systemdUnitPath();
-  if (existsSync4(unit)) {
+  if (existsSync5(unit)) {
     try {
       unlinkSync(unit);
     } catch {
@@ -46893,9 +47146,9 @@ function logsDir() {
 }
 function installTrayApp(sourceAppPath) {
   if (platform2() !== "darwin") return null;
-  if (!existsSync4(sourceAppPath)) return null;
-  const dest = join3(home(), "Applications", "ModelstatTray.app");
-  mkdirSync(dirname4(dest), { recursive: true });
+  if (!existsSync5(sourceAppPath)) return null;
+  const dest = join4(home(), "Applications", "ModelstatTray.app");
+  mkdirSync2(dirname4(dest), { recursive: true });
   spawnSync("rm", ["-rf", dest]);
   const r = spawnSync("cp", ["-R", sourceAppPath, dest], { encoding: "utf8" });
   if (r.status !== 0) {
@@ -46908,25 +47161,25 @@ function bundledTrayAppPath() {
   const here2 = dirname4(fileURLToPath2(import.meta.url));
   const candidates = [
     // Pre-built .app — CI with codesigning drops one here.
-    join3(here2, "..", "vendor", "ModelstatTray.app"),
+    join4(here2, "..", "vendor", "ModelstatTray.app"),
     // Local dev layout: apps/agent-dev/src/service.ts → ../../tray-mac/build/ModelstatTray.app
-    join3(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
+    join4(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
   ];
   for (const c of candidates) {
-    if (existsSync4(c)) return c;
+    if (existsSync5(c)) return c;
   }
   const sourceDirs = [
-    join3(here2, "..", "vendor", "tray-mac"),
-    join3(here2, "..", "..", "tray-mac")
+    join4(here2, "..", "vendor", "tray-mac"),
+    join4(here2, "..", "..", "tray-mac")
   ];
   for (const src of sourceDirs) {
-    const build = join3(src, "build-app.sh");
-    if (!existsSync4(build)) continue;
+    const build = join4(src, "build-app.sh");
+    if (!existsSync5(build)) continue;
     if (!hasSwift()) return null;
     const r = spawnSync("bash", [build], { cwd: src, encoding: "utf8" });
     if (r.status === 0) {
-      const app = join3(src, "build", "ModelstatTray.app");
-      if (existsSync4(app)) return app;
+      const app = join4(src, "build", "ModelstatTray.app");
+      if (existsSync5(app)) return app;
     }
   }
   return null;
@@ -46942,6 +47195,20 @@ function trayStatus() {
 }
 
 // src/cli.ts
+async function confirmPrompt(question, defaultYes) {
+  if (process.stdin.isTTY !== true) return defaultYes;
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  try {
+    const raw = await new Promise((resolve6) => rl.question(question, resolve6));
+    const ans = raw.trim().toLowerCase();
+    if (ans === "") return defaultYes;
+    if (ans === "y" || ans === "yes") return true;
+    if (ans === "n" || ans === "no") return false;
+    return defaultYes;
+  } finally {
+    rl.close();
+  }
+}
 function tryOpenBrowser(url) {
   const p = platform4();
   const cmd = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
@@ -47008,11 +47275,13 @@ async function cmdSelfRegister() {
     device_uuid: deviceUuid,
     fingerprint
   });
-  state.setDeviceUuid(res.device_uuid);
-  state.setDeviceId(res.device_id);
-  state.setBearer(res.device_secret);
-  state.setClaimCode(res.claim_code);
-  state.setClaimUrl(res.claim_url);
+  state.saveFreshIdentity({
+    deviceUuid: res.device_uuid,
+    deviceId: res.device_id,
+    bearerToken: res.device_secret,
+    claimCode: res.claim_code,
+    claimUrl: res.claim_url
+  });
   process.stdout.write(`  \x1B[32m\u2713\x1B[0m registered  device_id=${res.device_id}
 `);
   process.stdout.write(`  \x1B[32m\u2713\x1B[0m secret      ${res.secret_prefix}\u2026  (hashed on server, never re-sent)
@@ -47072,19 +47341,21 @@ async function cmdConnect(opts) {
   };
   const wipeAndSelfRegister = async (reason) => {
     warn(`${reason} \u2014 re-registering this device`);
+    const bak = backupIdentity();
+    if (bak) warn(`old identity moved to ${bak}`);
     state.setBearer(null);
-    state.setDeviceId(null);
-    state.setDeviceUuid(null);
-    state.setClaimCode(null);
-    state.setClaimUrl(null);
     await cmdSelfRegister();
   };
-  if (!state.deviceUuid || !state.bearer || !state.deviceId) {
+  if (opts.fresh && hasIdentityFile()) {
+    step("`--fresh` passed \u2014 minting a new device identity");
+    await wipeAndSelfRegister("forced fresh start");
+  } else if (!state.deviceUuid || !state.bearer || !state.deviceId) {
     step("Registering this device with modelstat.ai");
     await cmdSelfRegister();
   } else {
     step("Re-using existing device identity");
     ok(`device ${state.deviceId}`);
+    ok(`identity file ${identityPath()}`);
     try {
       const me = await fetchDeviceMe(state.bearer);
       if (me.claim_code && me.claim_code !== state.claimCode) {
@@ -47096,6 +47367,15 @@ async function cmdConnect(opts) {
       }
     } catch (e) {
       if (e instanceof DeviceMeUnauthorized) {
+        const interactive = !opts.yes && process.stdin.isTTY === true;
+        if (interactive) {
+          const prompt = "cached credentials no longer accepted by the server. Re-register this device? [Y/n] ";
+          const answer = await confirmPrompt(prompt, true);
+          if (!answer) {
+            warn("keeping existing identity; connect aborted");
+            return;
+          }
+        }
         await wipeAndSelfRegister("cached credentials no longer valid");
       } else {
         warn(`couldn't refresh device state: ${e.message}`);
@@ -47375,7 +47655,9 @@ function cmdPaths(args) {
 function parseConnectOpts(argv) {
   return {
     json: argv.includes("--json"),
-    noBrowser: argv.includes("--no-browser")
+    noBrowser: argv.includes("--no-browser"),
+    fresh: argv.includes("--fresh"),
+    yes: argv.includes("--yes") || argv.includes("-y")
   };
 }
 async function main() {