modelstat 0.0.48 → 0.0.49

package/dist/cli.mjs

@@ -44914,6 +44914,116 @@ var init_api = __esm({
   }
 });
 
+// src/machine-key.ts
+import { spawnSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4, platform as platform2 } from "os";
+import { join as join4 } from "path";
+function macosPlatformUuid() {
+  try {
+    const r = spawnSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      encoding: "utf8",
+      timeout: 4e3
+    });
+    if (r.status !== 0 || !r.stdout) return null;
+    const m = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(r.stdout);
+    return m?.[1]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function linuxMachineId() {
+  for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    try {
+      const v = readFileSync3(p, "utf8").trim();
+      if (v) return v;
+    } catch {
+    }
+  }
+  return null;
+}
+function windowsMachineGuid() {
+  try {
+    const r = spawnSync(
+      "reg",
+      ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+      { encoding: "utf8", timeout: 4e3 }
+    );
+    if (r.status !== 0 || !r.stdout) return null;
+    const m = /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]+)/.exec(r.stdout);
+    return m?.[1]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function fallbackKey() {
+  try {
+    if (existsSync6(FALLBACK_KEY_FILE)) {
+      const v = readFileSync3(FALLBACK_KEY_FILE, "utf8").trim();
+      if (v) return v;
+    }
+  } catch {
+  }
+  const fresh = createHash3("sha256").update(`${MACHINE_KEY_SALT}:fallback:${Date.now()}:${Math.random()}`).digest("hex");
+  try {
+    mkdirSync2(ROOT2, { recursive: true, mode: 448 });
+    writeFileSync3(FALLBACK_KEY_FILE, fresh, { mode: 384 });
+    chmodSync2(FALLBACK_KEY_FILE, 384);
+  } catch {
+  }
+  return fresh;
+}
+function resolveRaw() {
+  const p = platform2();
+  if (p === "darwin") {
+    const v = macosPlatformUuid();
+    if (v) return { raw: v, source: "macos-ioplatform" };
+  } else if (p === "win32") {
+    const v = windowsMachineGuid();
+    if (v) return { raw: v, source: "windows-guid" };
+  } else {
+    const v = linuxMachineId();
+    if (v) return { raw: v, source: "linux-machine-id" };
+  }
+  return { raw: fallbackKey(), source: "fallback-file" };
+}
+function machineKey() {
+  if (cachedKey) return cachedKey;
+  const { raw, source } = resolveRaw();
+  cachedSource = source;
+  cachedKey = createHash3("sha256").update(`${MACHINE_KEY_SALT}:${raw}`).digest("hex");
+  return cachedKey;
+}
+function machineKeySource() {
+  if (!cachedSource) machineKey();
+  return cachedSource;
+}
+function deviceUuidFromMachineKey(key = machineKey()) {
+  const nsHex = DEVICE_UUID_NAMESPACE.replace(/-/g, "");
+  const nsBytes = Buffer.from(nsHex, "hex");
+  const hash = createHash3("sha1").update(nsBytes).update(key).digest();
+  const b = Buffer.from(hash.subarray(0, 16));
+  b[6] = b[6] & 15 | 80;
+  b[8] = b[8] & 63 | 128;
+  const h = b.toString("hex");
+  return [h.slice(0, 8), h.slice(8, 12), h.slice(12, 16), h.slice(16, 20), h.slice(20, 32)].join(
+    "-"
+  );
+}
+var MACHINE_KEY_SALT, DEVICE_UUID_NAMESPACE, ROOT2, FALLBACK_KEY_FILE, cachedKey, cachedSource;
+var init_machine_key = __esm({
+  "src/machine-key.ts"() {
+    "use strict";
+    MACHINE_KEY_SALT = "modelstat.device.machine-key.v1";
+    DEVICE_UUID_NAMESPACE = "6f1d2c9a-8b3e-4a7f-9c2d-0e5a1b6c7d8e";
+    ROOT2 = join4(homedir4(), ".modelstat");
+    FALLBACK_KEY_FILE = join4(ROOT2, "machine-key");
+    cachedKey = null;
+    cachedSource = null;
+  }
+});
+
 // ../../packages/companion-core/src/contracts/index.ts
 var init_contracts = __esm({
   "../../packages/companion-core/src/contracts/index.ts"() {
@@ -45696,14 +45806,14 @@ var init_ollama = __esm({
 
 // ../../packages/companion-core/src/node/llama.ts
 import { mkdir } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join4 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname5, join as join5 } from "path";
 function defaultLlamaConfig() {
   const env2 = globalThis.process?.env ?? {};
-  const modelsDir = env2.MODELSTAT_MODELS_DIR ?? join4(homedir4(), ".modelstat", "models");
+  const modelsDir = env2.MODELSTAT_MODELS_DIR ?? join5(homedir5(), ".modelstat", "models");
   const modelUrl = env2.MODELSTAT_LLAMA_MODEL_URL ?? DEFAULT_LLAMA_MODEL_URL;
-  const modelPath = env2.MODELSTAT_LLAMA_MODEL_PATH ?? join4(modelsDir, basenameFromUrl(modelUrl));
+  const modelPath = env2.MODELSTAT_LLAMA_MODEL_PATH ?? join5(modelsDir, basenameFromUrl(modelUrl));
   return {
     modelPath,
     modelUrl,
@@ -45724,7 +45834,7 @@ function basenameFromUrl(url) {
   return parts[parts.length - 1] || "model.gguf";
 }
 async function ensureLlamaModel(cfg = defaultLlamaConfig()) {
-  if (existsSync6(cfg.modelPath)) return cfg.modelPath;
+  if (existsSync7(cfg.modelPath)) return cfg.modelPath;
   await mkdir(dirname5(cfg.modelPath), { recursive: true });
   const res = await fetch(cfg.modelUrl);
   if (!res.ok || !res.body) {
@@ -46237,8 +46347,8 @@ var init_pipeline2 = __esm({
 
 // src/scan.ts
 import { readdir, stat as stat2 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 function withNonNullTokens(e) {
   return e.tokens ? e : { ...e, tokens: { ...ZERO_TOKENS } };
 }
@@ -46247,16 +46357,16 @@ async function scanAll(cb = {}) {
   if (!deviceId) throw new Error("agent not enrolled \u2014 run `register` first");
   const jobs = [];
   try {
-    const base = join5(homedir5(), ".claude/projects");
+    const base = join6(homedir6(), ".claude/projects");
     const projects = await readdir(base).catch(() => []);
     for (const p of projects) {
-      const dir = join5(base, p);
+      const dir = join6(base, p);
       const ds = await stat2(dir).catch(() => null);
       if (!ds?.isDirectory()) continue;
       const files = await readdir(dir);
       for (const f of files) {
         if (!f.endsWith(".jsonl")) continue;
-        const full = join5(dir, f);
+        const full = join6(dir, f);
         jobs.push({
           path: full,
           parse: async (sink2) => {
@@ -46270,17 +46380,17 @@ async function scanAll(cb = {}) {
     console.warn("claude scan skipped:", e.message);
   }
   try {
-    const base = join5(homedir5(), ".codex/sessions");
+    const base = join6(homedir6(), ".codex/sessions");
     const years = await readdir(base).catch(() => []);
     for (const y of years) {
-      const months = await readdir(join5(base, y)).catch(() => []);
+      const months = await readdir(join6(base, y)).catch(() => []);
       for (const m of months) {
-        const days = await readdir(join5(base, y, m)).catch(() => []);
+        const days = await readdir(join6(base, y, m)).catch(() => []);
         for (const d of days) {
-          const files = await readdir(join5(base, y, m, d)).catch(() => []);
+          const files = await readdir(join6(base, y, m, d)).catch(() => []);
           for (const f of files) {
             if (!f.startsWith("rollout-") || !f.endsWith(".jsonl")) continue;
-            const full = join5(base, y, m, d, f);
+            const full = join6(base, y, m, d, f);
             jobs.push({
               path: full,
               parse: async (sink2) => {
@@ -46397,7 +46507,7 @@ var init_scan = __esm({
     init_api();
     init_config2();
     init_pipeline2();
-    AGENT_VERSION = true ? "agent-0.0.48" : "agent-dev";
+    AGENT_VERSION = true ? "agent-0.0.49" : "agent-dev";
     BATCH_MAX_EVENTS = 2e3;
     BATCH_MAX_TOOL_CALLS = 2e4;
     BATCH_BUFFER_HARD_CAP = BATCH_MAX_EVENTS * 2;
@@ -46414,17 +46524,17 @@ var init_scan = __esm({
 // src/lock.ts
 import {
   closeSync,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync4,
   openSync,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4,
+  writeFileSync as writeFileSync5,
   writeSync
 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
   try {
@@ -46438,7 +46548,7 @@ function isProcessAlive(pid) {
 }
 function readDaemonLock(lockFile = LOCK_FILE) {
   try {
-    const raw = readFileSync4(lockFile, "utf8");
+    const raw = readFileSync5(lockFile, "utf8");
     const obj = JSON.parse(raw);
     if (typeof obj.pid !== "number") return null;
     return {
@@ -46452,7 +46562,7 @@ function readDaemonLock(lockFile = LOCK_FILE) {
   }
 }
 function writeLockAtomic(meta) {
-  mkdirSync3(LOCK_DIR, { recursive: true });
+  mkdirSync4(LOCK_DIR, { recursive: true });
   const tmp = `${LOCK_FILE}.${meta.pid}.${Date.now()}.tmp`;
   const fd = openSync(tmp, "wx");
   try {
@@ -46544,8 +46654,8 @@ var LOCK_DIR, LOCK_FILE, LOCK_RECHECK_MS;
 var init_lock = __esm({
   "src/lock.ts"() {
     "use strict";
-    LOCK_DIR = join7(homedir7(), ".modelstat");
-    LOCK_FILE = join7(LOCK_DIR, "daemon.lock");
+    LOCK_DIR = join8(homedir8(), ".modelstat");
+    LOCK_FILE = join8(LOCK_DIR, "daemon.lock");
     LOCK_RECHECK_MS = 5e3;
   }
 });
@@ -48342,7 +48452,7 @@ __export(daemon_exports, {
   setQueue: () => setQueue,
   setStat: () => setStat
 });
-import { existsSync as existsSync9, statSync as statSync2 } from "fs";
+import { existsSync as existsSync10, statSync as statSync2 } from "fs";
 function setPhase(phase, message) {
   status.phase = phase;
   status.message = message ?? null;
@@ -48384,7 +48494,8 @@ function snapshotBody() {
     queue_size: status.queueSize,
     stats: status.stats,
     last_event_at: status.lastEventAt,
-    agent_version: AGENT_VERSION2
+    agent_version: AGENT_VERSION2,
+    machine_id: machineKey()
   };
 }
 function scheduleLocalFlush() {
@@ -48421,12 +48532,12 @@ async function sendHeartbeat() {
   writeLocalStatus(body).catch(() => void 0);
 }
 async function rotateRunawayLogs() {
-  const { homedir: homedir10 } = await import("os");
-  const { join: join12 } = await import("path");
+  const { homedir: homedir11 } = await import("os");
+  const { join: join13 } = await import("path");
   const { open: open2, stat: stat6, truncate, writeFile } = await import("fs/promises");
-  const dir = join12(homedir10(), ".modelstat", "logs");
+  const dir = join13(homedir11(), ".modelstat", "logs");
   for (const name of ["out.log", "err.log"]) {
-    const p = join12(dir, name);
+    const p = join13(dir, name);
     try {
       const st = await stat6(p);
       if (st.size <= LOG_MAX_BYTES) continue;
@@ -48448,16 +48559,16 @@ async function rotateRunawayLogs() {
   }
 }
 async function writeLocalStatus(snapshot) {
-  const { homedir: homedir10 } = await import("os");
-  const { join: join12 } = await import("path");
+  const { homedir: homedir11 } = await import("os");
+  const { join: join13 } = await import("path");
   const { writeFile, mkdir: mkdir2, rename } = await import("fs/promises");
   if (!lastStatusPath) {
-    const dir = join12(homedir10(), ".modelstat");
+    const dir = join13(homedir11(), ".modelstat");
     try {
       await mkdir2(dir, { recursive: true });
     } catch {
     }
-    lastStatusPath = join12(dir, "last-status.json");
+    lastStatusPath = join13(dir, "last-status.json");
   }
   const tmp = `${lastStatusPath}.tmp`;
   try {
@@ -48499,10 +48610,7 @@ async function runScanCycle(reason) {
         if (p.segment === 0) {
           setPhase("processing", `Analyzing${sess}`);
         } else {
-          setPhase(
-            "processing",
-            `Summarising segment ${p.segment}/${p.segmentTotal}${sess}`
-          );
+          setPhase("processing", `Summarising segment ${p.segment}/${p.segmentTotal}${sess}`);
         }
       },
       onUpload({ segments }) {
@@ -48557,12 +48665,8 @@ async function runDaemon(opts = {}) {
         lock.ageSec
       )} ago, agent ${lock.owner.agentVersion}.`
     );
-    console.log(
-      "  \u2192 to stop it:          kill " + lock.owner.pid
-    );
-    console.log(
-      "  \u2192 to force-replace it: modelstat start --force"
-    );
+    console.log("  \u2192 to stop it:          kill " + lock.owner.pid);
+    console.log("  \u2192 to force-replace it: modelstat start --force");
     return;
   }
   setPhase("starting", "Booting");
@@ -48590,21 +48694,19 @@ async function runDaemon(opts = {}) {
   await runDiscovery();
   await requestScan("startup");
   const chokidar = (await Promise.resolve().then(() => (init_esm2(), esm_exports))).default;
-  const { homedir: homedir10, platform: platform5 } = await import("os");
-  const { join: join12 } = await import("path");
-  const home2 = homedir10();
+  const { homedir: homedir11, platform: platform6 } = await import("os");
+  const { join: join13 } = await import("path");
+  const home2 = homedir11();
   const dirs = [
-    join12(home2, ".claude/projects"),
-    join12(home2, ".codex/sessions"),
-    join12(home2, ".cursor/ai-tracking"),
-    join12(home2, ".gemini"),
-    ...platform5() === "darwin" ? [
-      join12(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join12(home2, "Library/Application Support/Claude")
-    ] : [
-      join12(home2, ".config/Cursor/User/workspaceStorage")
-    ]
-  ].filter((p) => existsSync9(p) && statSync2(p).isDirectory());
+    join13(home2, ".claude/projects"),
+    join13(home2, ".codex/sessions"),
+    join13(home2, ".cursor/ai-tracking"),
+    join13(home2, ".gemini"),
+    ...platform6() === "darwin" ? [
+      join13(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join13(home2, "Library/Application Support/Claude")
+    ] : [join13(home2, ".config/Cursor/User/workspaceStorage")]
+  ].filter((p) => existsSync10(p) && statSync2(p).isDirectory());
   setPhase("watching", `Watching ${dirs.length} directories`);
   const watcher = chokidar.watch(dirs, {
     persistent: true,
@@ -48629,10 +48731,7 @@ async function runDaemon(opts = {}) {
   });
   const backstop = setInterval(() => void requestScan("interval"), SCAN_INTERVAL_MS);
   backstop.unref();
-  const discoveryTimer = setInterval(
-    () => void runDiscovery(),
-    DISCOVERY_INTERVAL_MS
-  );
+  const discoveryTimer = setInterval(() => void runDiscovery(), DISCOVERY_INTERVAL_MS);
   discoveryTimer.unref();
   const shutdown = async () => {
     setPhase("offline", "Shutting down");
@@ -48649,15 +48748,16 @@ var import_undici2, AGENT_VERSION2, HEARTBEAT_INTERVAL_MS, SCAN_INTERVAL_MS, DIS
 var init_daemon = __esm({
   "src/daemon.ts"() {
     "use strict";
-    import_undici2 = __toESM(require_undici(), 1);
     init_logger();
     init_src2();
+    import_undici2 = __toESM(require_undici(), 1);
     init_api();
     init_config2();
     init_lock();
+    init_machine_key();
     init_scan();
     init_single_flight();
-    AGENT_VERSION2 = true ? "agent-0.0.48" : "agent-dev";
+    AGENT_VERSION2 = true ? "agent-0.0.49" : "agent-dev";
     HEARTBEAT_INTERVAL_MS = 1e4;
     SCAN_INTERVAL_MS = 5 * 60 * 1e3;
     DISCOVERY_INTERVAL_MS = 6e4;
@@ -48685,37 +48785,37 @@ var watch_exports = {};
 __export(watch_exports, {
   watchForever: () => watchForever
 });
-import { existsSync as existsSync10 } from "fs";
-import { homedir as homedir9, platform as platform3 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { homedir as homedir10, platform as platform4 } from "os";
+import { join as join12 } from "path";
 function resolveWatchDirs() {
-  const home2 = homedir9();
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join11(home2, ".config");
-  const xdgData = process.env.XDG_DATA_HOME ?? join11(home2, ".local/share");
+  const home2 = homedir10();
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join12(home2, ".config");
+  const xdgData = process.env.XDG_DATA_HOME ?? join12(home2, ".local/share");
   const candidates = [
     // universal (default HOME-rooted CLI data dirs)
-    join11(home2, ".claude/projects"),
-    join11(home2, ".codex/sessions"),
-    join11(home2, ".cursor/ai-tracking"),
-    join11(home2, ".gemini"),
-    join11(home2, ".aider"),
+    join12(home2, ".claude/projects"),
+    join12(home2, ".codex/sessions"),
+    join12(home2, ".cursor/ai-tracking"),
+    join12(home2, ".gemini"),
+    join12(home2, ".aider"),
     // XDG / Linux
-    join11(xdgConfig, "claude/projects"),
-    join11(xdgConfig, "codex/sessions"),
-    join11(xdgConfig, "Cursor/User/workspaceStorage"),
-    join11(xdgConfig, "Code/User/workspaceStorage"),
-    join11(xdgConfig, "Code - Insiders/User/workspaceStorage"),
-    join11(xdgData, "claude/projects"),
+    join12(xdgConfig, "claude/projects"),
+    join12(xdgConfig, "codex/sessions"),
+    join12(xdgConfig, "Cursor/User/workspaceStorage"),
+    join12(xdgConfig, "Code/User/workspaceStorage"),
+    join12(xdgConfig, "Code - Insiders/User/workspaceStorage"),
+    join12(xdgData, "claude/projects"),
     // macOS
-    ...platform3() === "darwin" ? [
-      join11(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join11(home2, "Library/Application Support/Claude"),
-      join11(home2, "Library/Application Support/Code/User/workspaceStorage"),
-      join11(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
-      join11(home2, "Library/Application Support/Zed")
+    ...platform4() === "darwin" ? [
+      join12(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join12(home2, "Library/Application Support/Claude"),
+      join12(home2, "Library/Application Support/Code/User/workspaceStorage"),
+      join12(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
+      join12(home2, "Library/Application Support/Zed")
     ] : []
   ];
-  return Array.from(new Set(candidates)).filter((p) => existsSync10(p));
+  return Array.from(new Set(candidates)).filter((p) => existsSync11(p));
 }
 async function safeScan(reason) {
   if (scanning) {
@@ -48780,53 +48880,53 @@ init_src2();
 init_api();
 init_config2();
 init_identity();
+init_machine_key();
 init_scan();
 import { spawn } from "child_process";
-import { randomBytes } from "crypto";
-import { arch as cpuArch, hostname as hostname2, platform as platform4, release } from "os";
+import { arch as cpuArch, hostname as hostname2, platform as platform5, release } from "os";
 import { createInterface as createInterface3 } from "readline";
 
 // src/service.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
   realpathSync,
   unlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir6, platform as platform2, userInfo } from "os";
-import { dirname as dirname6, join as join6 } from "path";
+import { homedir as homedir7, platform as platform3, userInfo } from "os";
+import { dirname as dirname6, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var SERVICE_LABEL = "ai.modelstat.agent";
 var SYSTEMD_UNIT = "modelstat";
 function home() {
-  return homedir6();
+  return homedir7();
 }
 function stateDir() {
-  return join6(home(), ".modelstat");
+  return join7(home(), ".modelstat");
 }
 function binDir() {
-  return join6(stateDir(), "bin");
+  return join7(stateDir(), "bin");
 }
 function logDir() {
-  return join6(stateDir(), "logs");
+  return join7(stateDir(), "logs");
 }
 function installedCliPath() {
-  return join6(binDir(), "modelstat.mjs");
+  return join7(binDir(), "modelstat.mjs");
 }
 function runningCliPath() {
   return fileURLToPath2(import.meta.url).replace(/service\.(mjs|js|ts)$/, "cli.mjs");
 }
 function installBundle() {
-  mkdirSync2(binDir(), { recursive: true });
-  mkdirSync2(logDir(), { recursive: true });
+  mkdirSync3(binDir(), { recursive: true });
+  mkdirSync3(logDir(), { recursive: true });
   const src = runningCliPath();
   const dest = installedCliPath();
-  if (!existsSync7(src)) {
+  if (!existsSync8(src)) {
     throw new Error(
       `Can't find the CLI bundle to install from (${src}). Are you running a local dev build?`
     );
@@ -48844,9 +48944,9 @@ function sourceLlamaVersion(sourceCli) {
     const req = createRequire(sourceCli);
     let d = dirname6(realpathSync(req.resolve("node-llama-cpp")));
     for (let i = 0; i < 10; i++) {
-      const pj = join6(d, "package.json");
-      if (existsSync7(pj)) {
-        const p = JSON.parse(readFileSync3(pj, "utf8"));
+      const pj = join7(d, "package.json");
+      if (existsSync8(pj)) {
+        const p = JSON.parse(readFileSync4(pj, "utf8"));
         if (p.name === "node-llama-cpp" && p.version) return p.version;
       }
       const up = dirname6(d);
@@ -48862,19 +48962,19 @@ function installNativeRuntime(sourceCli) {
   const dest = binDir();
   try {
     const have = JSON.parse(
-      readFileSync3(
-        join6(dest, "node_modules", "node-llama-cpp", "package.json"),
+      readFileSync4(
+        join7(dest, "node_modules", "node-llama-cpp", "package.json"),
         "utf8"
       )
     );
     if (have.version === version) return [`node-llama-cpp@${version} (cached)`];
   } catch {
   }
-  mkdirSync2(dest, { recursive: true });
+  mkdirSync3(dest, { recursive: true });
   const childEnv = { ...process.env };
   delete childEnv.npm_config_global;
   delete childEnv.npm_config_prefix;
-  const r = spawnSync(
+  const r = spawnSync2(
     "npm",
     [
       "install",
@@ -48904,21 +49004,21 @@ function nodeBinary() {
   return process.execPath;
 }
 function plistPath() {
-  return join6(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join7(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function locateTrayExecutable() {
   const candidates = [
-    join6(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
+    join7(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
     "/Applications/ModelstatTray.app/Contents/MacOS/modelstat-tray"
   ];
   for (const p of candidates) {
-    if (existsSync7(p)) return p;
+    if (existsSync8(p)) return p;
   }
   return null;
 }
 function writePlist(cliPath) {
   const p = plistPath();
-  mkdirSync2(dirname6(p), { recursive: true });
+  mkdirSync3(dirname6(p), { recursive: true });
   const tray = locateTrayExecutable();
   const programArgs = tray ? `    <string>${tray}</string>` : [
     `    <string>${nodeBinary()}</string>`,
@@ -48938,8 +49038,8 @@ ${programArgs}
   <key>KeepAlive</key>
   <dict><key>SuccessfulExit</key><false/></dict>
   <key>ThrottleInterval</key><integer>30</integer>
-  <key>StandardOutPath</key><string>${join6(logDir(), "out.log")}</string>
-  <key>StandardErrorPath</key><string>${join6(logDir(), "err.log")}</string>
+  <key>StandardOutPath</key><string>${join7(logDir(), "out.log")}</string>
+  <key>StandardErrorPath</key><string>${join7(logDir(), "err.log")}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key><string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin</string>
@@ -48953,11 +49053,11 @@ ${programArgs}
 </dict>
 </plist>
 `;
-  writeFileSync3(p, plist, { mode: 420 });
+  writeFileSync4(p, plist, { mode: 420 });
   return p;
 }
 function launchctl(args) {
-  const r = spawnSync("launchctl", args, { encoding: "utf8" });
+  const r = spawnSync2("launchctl", args, { encoding: "utf8" });
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "" };
 }
 function macInstall() {
@@ -48984,7 +49084,7 @@ function macUninstall() {
   const target = `gui/${uid}/${SERVICE_LABEL}`;
   launchctl(["bootout", target]);
   const plist = plistPath();
-  if (existsSync7(plist)) {
+  if (existsSync8(plist)) {
     try {
       unlinkSync(plist);
     } catch {
@@ -48997,12 +49097,12 @@ function macStatus() {
   return { running: r.ok, hint: r.ok ? "launchd managed" : "not installed" };
 }
 function systemdUnitPath() {
-  const xdg = process.env.XDG_CONFIG_HOME ?? join6(home(), ".config");
-  return join6(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
+  const xdg = process.env.XDG_CONFIG_HOME ?? join7(home(), ".config");
+  return join7(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
 }
 function writeSystemdUnit(cliPath) {
   const unitPath = systemdUnitPath();
-  mkdirSync2(dirname6(unitPath), { recursive: true });
+  mkdirSync3(dirname6(unitPath), { recursive: true });
   const unit = `[Unit]
 Description=modelstat agent
 Documentation=https://modelstat.ai
@@ -49021,17 +49121,17 @@ RestartSec=10
 # Don't restart-storm if the service is persistently unreachable.
 StartLimitIntervalSec=300
 StartLimitBurst=10
-StandardOutput=append:${join6(logDir(), "out.log")}
-StandardError=append:${join6(logDir(), "err.log")}
+StandardOutput=append:${join7(logDir(), "out.log")}
+StandardError=append:${join7(logDir(), "err.log")}
 
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync3(unitPath, unit, { mode: 420 });
+  writeFileSync4(unitPath, unit, { mode: 420 });
   return unitPath;
 }
 function systemctl(args) {
-  const r = spawnSync("systemctl", ["--user", ...args], { encoding: "utf8" });
+  const r = spawnSync2("systemctl", ["--user", ...args], { encoding: "utf8" });
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "" };
 }
 function linuxInstall() {
@@ -49047,7 +49147,7 @@ function linuxInstall() {
 function linuxUninstall() {
   systemctl(["disable", "--now", `${SYSTEMD_UNIT}.service`]);
   const unit = systemdUnitPath();
-  if (existsSync7(unit)) {
+  if (existsSync8(unit)) {
     try {
       unlinkSync(unit);
     } catch {
@@ -49061,7 +49161,7 @@ function linuxStatus() {
   return { running: active, hint: active ? "systemd managed" : "not running" };
 }
 function installService() {
-  const p = platform2();
+  const p = platform3();
   if (p === "darwin") {
     macInstall();
     return { path: plistPath(), logs: logDir() };
@@ -49075,13 +49175,13 @@ function installService() {
   );
 }
 function uninstallService() {
-  const p = platform2();
+  const p = platform3();
   if (p === "darwin") return macUninstall();
   if (p === "linux") return linuxUninstall();
   throw new Error(`Service uninstall isn't supported on ${p}.`);
 }
 function serviceStatus() {
-  const p = platform2();
+  const p = platform3();
   if (p === "darwin") return macStatus();
   if (p === "linux") return linuxStatus();
   return { running: false, hint: `unsupported platform (${p})` };
@@ -49090,60 +49190,60 @@ function logsDir() {
   return logDir();
 }
 function installTrayApp(sourceAppPath) {
-  if (platform2() !== "darwin") return null;
-  if (!existsSync7(sourceAppPath)) return null;
-  const dest = join6(home(), "Applications", "ModelstatTray.app");
-  mkdirSync2(dirname6(dest), { recursive: true });
-  spawnSync("rm", ["-rf", dest]);
-  const r = spawnSync("cp", ["-R", sourceAppPath, dest], { encoding: "utf8" });
+  if (platform3() !== "darwin") return null;
+  if (!existsSync8(sourceAppPath)) return null;
+  const dest = join7(home(), "Applications", "ModelstatTray.app");
+  mkdirSync3(dirname6(dest), { recursive: true });
+  spawnSync2("rm", ["-rf", dest]);
+  const r = spawnSync2("cp", ["-R", sourceAppPath, dest], { encoding: "utf8" });
   if (r.status !== 0) {
     throw new Error(`cp ModelstatTray.app failed: ${r.stderr?.trim() || `exit ${r.status}`}`);
   }
   return { installedAt: dest };
 }
 function bundledTrayAppPath() {
-  if (platform2() !== "darwin") return null;
+  if (platform3() !== "darwin") return null;
   const here2 = dirname6(fileURLToPath2(import.meta.url));
   const candidates = [
     // Pre-built .app — CI with codesigning drops one here.
-    join6(here2, "..", "vendor", "ModelstatTray.app"),
+    join7(here2, "..", "vendor", "ModelstatTray.app"),
     // Local dev layout: apps/agent-dev/src/service.ts → ../../tray-mac/build/ModelstatTray.app
-    join6(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
+    join7(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
   ];
   for (const c of candidates) {
-    if (existsSync7(c)) return c;
+    if (existsSync8(c)) return c;
   }
   const sourceDirs = [
-    join6(here2, "..", "vendor", "tray-mac"),
-    join6(here2, "..", "..", "tray-mac")
+    join7(here2, "..", "vendor", "tray-mac"),
+    join7(here2, "..", "..", "tray-mac")
   ];
   for (const src of sourceDirs) {
-    const build = join6(src, "build-app.sh");
-    if (!existsSync7(build)) continue;
+    const build = join7(src, "build-app.sh");
+    if (!existsSync8(build)) continue;
     if (!hasSwift()) return null;
-    const r = spawnSync("bash", [build], { cwd: src, encoding: "utf8" });
+    const r = spawnSync2("bash", [build], { cwd: src, encoding: "utf8" });
     if (r.status === 0) {
-      const app = join6(src, "build", "ModelstatTray.app");
-      if (existsSync7(app)) return app;
+      const app = join7(src, "build", "ModelstatTray.app");
+      if (existsSync8(app)) return app;
     }
   }
   return null;
 }
 function hasSwift() {
-  const r = spawnSync("swift", ["--version"], { encoding: "utf8" });
+  const r = spawnSync2("swift", ["--version"], { encoding: "utf8" });
   return r.status === 0;
 }
 function trayStatus() {
-  if (platform2() !== "darwin") return { installed: false, path: null };
+  if (platform3() !== "darwin") return { installed: false, path: null };
   const exe = locateTrayExecutable();
   return exe ? { installed: true, path: exe.replace(/\/Contents\/MacOS\/modelstat-tray$/, "") } : { installed: false, path: null };
 }
 
 // src/supervise.ts
 init_lock();
-import { readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
 var STATUS_FRESH_MS = 12e4;
 var BOOT_GRACE_MS = 9e4;
 function decideSupervision(input) {
@@ -49160,13 +49260,13 @@ function decideSupervision(input) {
 function daemonHealth(opts = {}) {
   const now = opts.now ?? Date.now();
   const pidAlive = opts.pidAlive ?? isProcessAlive;
-  const statusPath = opts.statusPath ?? join8(homedir8(), ".modelstat", "last-status.json");
+  const statusPath = opts.statusPath ?? join9(homedir9(), ".modelstat", "last-status.json");
   const lock = opts.lockPath === void 0 ? readDaemonLock() : readDaemonLock(opts.lockPath);
   const ownerAlive = lock !== null && pidAlive(lock.pid);
   const lockAgeMs = lock ? ageMs(lock.startedAt, now) : null;
   let statusAgeMs = null;
   try {
-    const raw = readFileSync5(statusPath, "utf8");
+    const raw = readFileSync6(statusPath, "utf8");
     const writtenAt = JSON.parse(raw).written_at;
     statusAgeMs = writtenAt ? ageMs(writtenAt, now) : null;
   } catch {
@@ -49208,7 +49308,7 @@ async function confirmPrompt(question, defaultYes) {
   }
 }
 function tryOpenBrowser(url) {
-  const p = platform4();
+  const p = platform5();
   const cmd = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
   const args = p === "win32" ? ["/c", "start", "", url] : [url];
   try {
@@ -49222,9 +49322,9 @@ function tryOpenBrowser(url) {
     return false;
   }
 }
-var AGENT_VERSION3 = true ? "agent-0.0.48" : "agent-dev";
+var AGENT_VERSION3 = true ? "agent-0.0.49" : "agent-dev";
 function osFamily() {
-  const p = platform4();
+  const p = platform5();
   if (p === "darwin") return "macos";
   if (p === "linux") return "linux";
   return "other";
@@ -49235,35 +49335,33 @@ function osArch() {
   if (a === "arm64") return "arm64";
   return "other";
 }
-function generateUuidV7() {
-  const ms = Date.now();
-  const tsHex = ms.toString(16).padStart(12, "0");
-  const rand = randomBytes(10);
-  rand[0] = rand[0] & 15 | 112;
-  rand[2] = rand[2] & 63 | 128;
-  const hex = tsHex + rand.toString("hex");
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20, 32)
-  ].join("-");
+function intendedDeviceUuid() {
+  const salt = process.env.MODELSTAT_DEVICE_SALT?.trim();
+  const key = salt ? `${machineKey()}:${salt}` : machineKey();
+  return deviceUuidFromMachineKey(key);
 }
 async function cmdSelfRegister() {
-  const deviceUuid = state.deviceUuid ?? generateUuidV7();
-  const fresh = !state.deviceUuid;
+  const deviceUuid = state.deviceUuid ?? intendedDeviceUuid();
+  const derived = !state.deviceUuid;
+  const mid = machineKey();
   const fingerprint = {
     hostname: hostname2(),
     os_family: osFamily(),
     os_version: release(),
     arch: osArch(),
     agent: "modelstat-agent-dev",
-    agent_version: AGENT_VERSION3
+    agent_version: AGENT_VERSION3,
+    // Stable, install-method-independent machine key. The server
+    // dedupes self-register on this so the same physical machine can
+    // never become two device rows, even if the UUID somehow differs
+    // (legacy random UUID → deterministic UUID transition).
+    machine_id: mid
   };
-  if (fresh) {
-    process.stdout.write(`  \x1B[2mgenerated UUIDv7 ${deviceUuid.slice(0, 8)}\u2026\x1B[0m
-`);
+  if (derived) {
+    process.stdout.write(
+      `  \x1B[2mdevice id derived from machine key (${machineKeySource()}): ${deviceUuid.slice(0, 8)}\u2026\x1B[0m
+`
+    );
   }
   process.stdout.write(`  \x1B[2m\u2192 POST ${state.apiUrl}/v1/devices/self-register\x1B[0m
 `);
@@ -49343,7 +49441,7 @@ async function cmdConnect(opts) {
     await cmdSelfRegister();
   };
   if (opts.fresh && hasIdentityFile()) {
-    step("`--fresh` passed \u2014 minting a new device identity");
+    step("`--fresh` passed \u2014 re-registering this device");
     await wipeAndSelfRegister("forced fresh start");
   } else if (!state.deviceUuid || !state.bearer || !state.deviceId) {
     step("Registering this device with modelstat.ai");
@@ -49388,7 +49486,7 @@ async function cmdConnect(opts) {
     claim_url: claimUrl,
     agent_url: agentUrl
   });
-  if (platform4() === "darwin") {
+  if (platform5() === "darwin") {
     step("Installing menu-bar tray (macOS)");
     try {
       const src = bundledTrayAppPath();
@@ -49432,7 +49530,7 @@ async function cmdConnect(opts) {
       logs: svc.logs,
       summariser_ready: modelReady
     });
-    ok(`${platform4() === "darwin" ? "launchd" : "systemd --user"}: ${svc.path}`);
+    ok(`${platform5() === "darwin" ? "launchd" : "systemd --user"}: ${svc.path}`);
   } catch (e) {
     emitEvent(opts, "service_install_failed", { error: e.message });
     warn(`couldn't install service: ${e.message}`);
@@ -49475,7 +49573,7 @@ async function cmdConnect(opts) {
         `    detected: \x1B[32m${discovered.installations} installs \xB7 ${discovered.identities} accounts\x1B[0m`
       );
     }
-    if (platform4() === "darwin") {
+    if (platform5() === "darwin") {
       console.log(
         `    tray    : \x1B[${tray.installed ? "32" : "2"}m${tray.installed ? "menu-bar icon ready" : "not installed"}\x1B[0m`
       );
@@ -49606,10 +49704,10 @@ function fmtTokens(v) {
 }
 async function readLocalStatus() {
   try {
-    const { homedir: homedir10 } = await import("os");
-    const { join: join12 } = await import("path");
+    const { homedir: homedir11 } = await import("os");
+    const { join: join13 } = await import("path");
     const { readFile } = await import("fs/promises");
-    const p = join12(homedir10(), ".modelstat", "last-status.json");
+    const p = join13(homedir11(), ".modelstat", "last-status.json");
     const txt = await readFile(p, "utf8");
     return JSON.parse(txt);
   } catch {
@@ -49729,11 +49827,17 @@ async function cmdJobs(args) {
   }
 }
 function cmdPaths(args) {
+  const intended = intendedDeviceUuid();
   const data = {
     state: state.storePath,
+    identity: identityPath(),
     logs: logsDir(),
     api: state.apiUrl,
-    paired: !!state.bearer && !!state.deviceId
+    paired: !!state.bearer && !!state.deviceId,
+    device_id: state.deviceId ?? "(none)",
+    device_uuid: state.deviceUuid ?? "(none)",
+    intended_uuid: intended,
+    machine_key_source: machineKeySource()
   };
   if (args.includes("--json")) {
     process.stdout.write(`${JSON.stringify(data)}
@@ -49840,10 +49944,18 @@ async function main() {
       console.log();
       console.log("Diagnostics:");
       console.log("  npx modelstat@latest status         \u2014 show pairing + service state");
-      console.log("  npx modelstat@latest stats          \u2014 live device summary: sessions \xB7 tokens \xB7 cost (--json)");
-      console.log("  npx modelstat@latest jobs           \u2014 pipeline queue + recent processing ledger (--json)");
-      console.log("  npx modelstat@latest paths          \u2014 print state file + log dir + api URL (--json)");
-      console.log("  npx modelstat@latest token          \u2014 print the device token for hosted MCP / API access (--json)");
+      console.log(
+        "  npx modelstat@latest stats          \u2014 live device summary: sessions \xB7 tokens \xB7 cost (--json)"
+      );
+      console.log(
+        "  npx modelstat@latest jobs           \u2014 pipeline queue + recent processing ledger (--json)"
+      );
+      console.log(
+        "  npx modelstat@latest paths          \u2014 print state file + log dir + api URL (--json)"
+      );
+      console.log(
+        "  npx modelstat@latest token          \u2014 print the device token for hosted MCP / API access (--json)"
+      );
       console.log();
       console.log("Dev / one-shots:");
       console.log("  npx modelstat@latest scan           \u2014 one-shot parse + upload of local JSONL");