modelstat 0.0.48 → 0.0.50

package/dist/cli.mjs

@@ -78,11 +78,11 @@ var init_git = __esm({
 });
 
 // ../../packages/core/src/enums.ts
-var TOOLS, PROVIDERS, IDENTITY_OWNER_SCOPES, INSTALL_METHODS, OS_FAMILIES, EVENT_KINDS, TOOL_CALL_STATUSES, COMPANION_PHASES, CLASSIFICATION_CONFIDENCE;
+var AGENTS, PROVIDERS, IDENTITY_OWNER_SCOPES, INSTALL_METHODS, OS_FAMILIES, EVENT_KINDS, TOOL_CALL_STATUSES, COMPANION_PHASES, CLASSIFICATION_CONFIDENCE;
 var init_enums = __esm({
   "../../packages/core/src/enums.ts"() {
     "use strict";
-    TOOLS = [
+    AGENTS = [
       "claude_code",
       "claude_desktop",
       "codex_cli",
@@ -105,12 +105,13 @@ var init_enums = __esm({
       "crush",
       "kimi",
       "openclaw",
+      "hermes",
       "ollama",
       "raw_sdk_anthropic",
       "raw_sdk_openai",
       "raw_sdk_google",
       // Web chat UIs (Chrome-extension companion). Categorically distinct
-      // from *_cli / *_desktop tools — same provider, different surface.
+      // from *_cli / *_desktop agents — same provider, different surface.
       "chatgpt_web",
       "claude_web",
       "gemini_web",
@@ -4339,11 +4340,11 @@ var init_schemas = __esm({
       ts: external_exports.string().datetime({ offset: true }),
       kind: external_exports.enum(EVENT_KINDS),
       // Attribution
-      tool: external_exports.enum(TOOLS),
+      agent: external_exports.enum(AGENTS),
       provider: external_exports.enum(PROVIDERS),
       model: external_exports.string().max(120).nullable(),
       session_id: external_exports.string().max(120),
-      // tool-local session id (UUID in most cases)
+      // agent-local session id (UUID in most cases)
       turn_index: external_exports.number().int().nonnegative().nullable(),
       parent_event_id: external_exports.string().nullable(),
       // for subagent turns
@@ -4372,7 +4373,7 @@ var init_schemas = __esm({
       // Reference to originating file for reparsing
       source_file: external_exports.string().max(1024).nullable(),
       source_byte_offset: external_exports.number().int().nonnegative().nullable(),
-      // Billing mode. Tools with a flat-fee subscription tier (Claude
+      // Billing mode. Agents with a flat-fee subscription tier (Claude
       // Code, Cursor Pro, GitHub Copilot, etc) emit events tagged
       // `billing: "subscription"` — the server short-circuits cost to $0
       // for those, since token-level pricing doesn't apply once the user
@@ -4397,7 +4398,7 @@ var init_schemas = __esm({
       /** sha256-based deterministic id — see @modelstat/core/ids.ts segmentId(). */
       segment_id: external_exports.string().max(64),
       session_id: external_exports.string().max(120),
-      tool: external_exports.enum(TOOLS),
+      agent: external_exports.enum(AGENTS),
       started_at: external_exports.string().datetime({ offset: true }),
       ended_at: external_exports.string().datetime({ offset: true }),
       /** Pre-redacted abstract, ≤ 512 chars. Never contains PII. */
@@ -4421,15 +4422,15 @@ var init_schemas = __esm({
        * deterministic `tc_<djb2-base36>` of `${source_event_id}|${call_index}`
        * when the source line carries no id. */
       external_call_id: external_exports.string().max(120),
-      /** Tool-local session id — same id space as RawEvent.session_id. */
+      /** Agent-local session id — same id space as RawEvent.session_id. */
       session_id: external_exports.string().max(120),
       /** The RawEvent that contained the tool_use (dedupe/replay anchor). */
       source_event_id: external_exports.string(),
       /** Segment containing source_event_id — filled by the companion at
        * batch-build time when known, else null. */
       segment_id: external_exports.string().max(64).nullable().default(null),
-      /** The agent that made the call (TOOLS enum — "tool" in legacy naming). */
-      agent: external_exports.enum(TOOLS),
+      /** The agent that made the call (AGENTS enum). */
+      agent: external_exports.enum(AGENTS),
       /** `builtin` or `mcp:<server>`. */
       server: external_exports.string().max(120),
       /** Bare tool name (`Bash`, `create_pr`) — normalised vendor identifier. */
@@ -4463,7 +4464,7 @@ var init_schemas = __esm({
       batch_id: external_exports.string(),
       // ULID
       device_id: external_exports.string(),
-      agent_version: external_exports.string().max(40),
+      companion_version: external_exports.string().max(40),
       events: external_exports.array(RawEvent).max(1e4),
       segments: external_exports.array(Segment).max(2e3).default([]),
       /** Per-call tool invocations (additive — old agents omit it, old
@@ -4496,7 +4497,7 @@ var init_schemas = __esm({
       queue_size: external_exports.number().int().nonnegative().default(0),
       stats: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
       last_event_at: external_exports.string().datetime({ offset: true }).nullable(),
-      agent_version: external_exports.string().max(40)
+      companion_version: external_exports.string().max(40)
     });
     DeviceEnrollment = external_exports.object({
       machine_id: external_exports.string(),
@@ -4505,7 +4506,7 @@ var init_schemas = __esm({
       os_family: external_exports.enum(OS_FAMILIES),
       os_version: external_exports.string().max(60),
       arch: external_exports.enum(["x86_64", "arm64", "other"]),
-      agent_version: external_exports.string().max(40)
+      companion_version: external_exports.string().max(40)
     });
     DeviceSelfRegister = external_exports.object({
       /** Agent-generated UUIDv7 — must pass shape + recent-timestamp checks. */
@@ -4521,8 +4522,8 @@ var init_schemas = __esm({
         os_family: external_exports.enum(OS_FAMILIES).optional(),
         os_version: external_exports.string().max(60).optional(),
         arch: external_exports.enum(["x86_64", "arm64", "other"]).optional(),
-        agent: external_exports.string().max(80).optional(),
-        agent_version: external_exports.string().max(40).optional()
+        companion: external_exports.string().max(80).optional(),
+        companion_version: external_exports.string().max(40).optional()
         // Allow extra fields for forward-compat without breaking old agents.
       }).catchall(external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).default({})
     });
@@ -4553,7 +4554,7 @@ var init_schemas = __esm({
       recommended_for: external_exports.string().max(160).optional()
     });
     DetectedInstallation = external_exports.object({
-      tool: external_exports.enum(TOOLS),
+      agent: external_exports.enum(AGENTS),
       install_method: external_exports.enum(INSTALL_METHODS),
       binary_path: external_exports.string().nullable(),
       data_dir: external_exports.string().nullable(),
@@ -5143,7 +5144,7 @@ async function parseClaudeCodeJsonl(ctx) {
         source_event_id: eventId,
         ts: a.timestamp,
         kind: "assistant_message",
-        tool: "claude_code",
+        agent: "claude_code",
         provider: "anthropic",
         model: a.message?.model ?? null,
         session_id: sessionId,
@@ -5206,7 +5207,7 @@ async function parseClaudeCodeJsonl(ctx) {
         source_event_id: eventId,
         ts: u.timestamp,
         kind: "user_message",
-        tool: "claude_code",
+        agent: "claude_code",
         provider: "anthropic",
         model: lastModel,
         session_id: sessionId,
@@ -5531,7 +5532,7 @@ async function parseCodexRollout(ctx) {
           source_event_id: sourceEventId(ctx.deviceId, ctx.sourceFile, offsetAtLineStart),
           ts,
           kind: "assistant_message",
-          tool: "codex_cli",
+          agent: "codex_cli",
           provider: "openai",
           model,
           session_id: sessionId,
@@ -5571,7 +5572,7 @@ async function parseCodexRollout(ctx) {
           source_event_id: sourceEventId(ctx.deviceId, ctx.sourceFile, offsetAtLineStart),
           ts,
           kind: "user_message",
-          tool: "codex_cli",
+          agent: "codex_cli",
           provider: "openai",
           model,
           session_id: sessionId,
@@ -7805,11 +7806,11 @@ async function discover(options = {}) {
       const v = process.env[env2];
       if (v) candidates.add(v);
     }
-    for (const extra of options.extraDataDirs?.[spec.tool] ?? []) candidates.add(expandPath(extra));
+    for (const extra of options.extraDataDirs?.[spec.agent] ?? []) candidates.add(expandPath(extra));
     for (const p of candidates) {
       if (existsSync3(p) && statSync(p).isDirectory()) {
         installations.push({
-          tool: spec.tool,
+          agent: spec.agent,
           install_method: "manual",
           binary_path: null,
           data_dir: p,
@@ -7828,7 +7829,7 @@ async function discover(options = {}) {
           if (existsSync3(p)) {
             const version = await safeVersionProbe(p);
             installations.push({
-              tool: spec.tool,
+              agent: spec.agent,
               install_method: classifyInstallMethod(p, os2),
               binary_path: p,
               data_dir: null,
@@ -7848,7 +7849,7 @@ async function discover(options = {}) {
           const hit = apps.find((a) => a.bundleId === bid);
           if (hit) {
             installations.push({
-              tool: spec.tool,
+              agent: spec.agent,
               install_method: "app_bundle",
               binary_path: hit.path,
               data_dir: null,
@@ -8076,7 +8077,7 @@ async function probeIdentities(os2) {
 function dedupeInstalls(list) {
   const seen = /* @__PURE__ */ new Map();
   for (const i of list) {
-    const k = `${i.tool}|${i.binary_path ?? ""}|${i.data_dir ?? ""}`;
+    const k = `${i.agent}|${i.binary_path ?? ""}|${i.data_dir ?? ""}`;
     const prev = seen.get(k);
     if (!prev) {
       seen.set(k, i);
@@ -8103,7 +8104,7 @@ var init_discovery = __esm({
     H = (p) => p.startsWith("~") ? p.replace("~", homedir()) : p;
     SOURCES = [
       {
-        tool: "claude_code",
+        agent: "claude_code",
         dataDirs: {
           macos: ["~/.claude"],
           linux: ["$XDG_CONFIG_HOME/claude", "~/.claude", "~/.config/claude"]
@@ -8115,7 +8116,7 @@ var init_discovery = __esm({
         ]
       },
       {
-        tool: "codex_cli",
+        agent: "codex_cli",
         dataDirs: {
           macos: ["~/.codex"],
           linux: ["$XDG_CONFIG_HOME/codex", "~/.codex"]
@@ -8125,7 +8126,7 @@ var init_discovery = __esm({
         fileSignatures: [{ filenameGlob: "sessions/**/rollout-*.jsonl" }]
       },
       {
-        tool: "claude_desktop",
+        agent: "claude_desktop",
         dataDirs: {
           macos: ["~/Library/Application Support/Claude"],
           linux: ["~/.config/Claude"]
@@ -8133,7 +8134,7 @@ var init_discovery = __esm({
         bundleIds: ["com.anthropic.claudeforbrowser", "com.anthropic.claudeelectron"]
       },
       {
-        tool: "cursor",
+        agent: "cursor",
         dataDirs: {
           macos: ["~/Library/Application Support/Cursor"],
           linux: ["~/.config/Cursor"]
@@ -8141,7 +8142,7 @@ var init_discovery = __esm({
         bundleIds: ["co.anysphere.cursor", "com.todesktop.230313mzl4w4u92"]
       },
       {
-        tool: "windsurf",
+        agent: "windsurf",
         dataDirs: {
           macos: ["~/Library/Application Support/Windsurf"],
           linux: ["~/.config/Windsurf"]
@@ -8149,7 +8150,7 @@ var init_discovery = __esm({
         bundleIds: ["com.codeium.windsurf"]
       },
       {
-        tool: "zed",
+        agent: "zed",
         dataDirs: {
           macos: ["~/Library/Application Support/Zed", "~/.config/zed"],
           linux: ["~/.config/zed"]
@@ -8158,7 +8159,7 @@ var init_discovery = __esm({
         bundleIds: ["dev.zed.Zed"]
       },
       {
-        tool: "gemini_cli",
+        agent: "gemini_cli",
         dataDirs: {
           macos: ["~/.gemini"],
           linux: ["~/.gemini"]
@@ -8166,18 +8167,18 @@ var init_discovery = __esm({
         binaries: ["gemini"]
       },
       {
-        tool: "aider",
+        agent: "aider",
         dataDirs: { macos: ["~/.aider"], linux: ["~/.aider"] },
         binaries: ["aider"]
       },
       {
-        tool: "ollama",
+        agent: "ollama",
         dataDirs: { macos: ["~/.ollama"], linux: ["~/.ollama"] },
         binaries: ["ollama"],
         bundleIds: ["com.electron.ollama"]
       },
       {
-        tool: "openclaw",
+        agent: "openclaw",
         dataDirs: { macos: ["~/.openclaw", "~/.claw"], linux: ["~/.openclaw", "~/.claw"] },
         binaries: ["openclaw", "claw", "clawdbot", "moltbot"]
       }
@@ -44914,6 +44915,116 @@ var init_api = __esm({
   }
 });
 
+// src/machine-key.ts
+import { spawnSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4, platform as platform2 } from "os";
+import { join as join4 } from "path";
+function macosPlatformUuid() {
+  try {
+    const r = spawnSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      encoding: "utf8",
+      timeout: 4e3
+    });
+    if (r.status !== 0 || !r.stdout) return null;
+    const m = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(r.stdout);
+    return m?.[1]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function linuxMachineId() {
+  for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    try {
+      const v = readFileSync3(p, "utf8").trim();
+      if (v) return v;
+    } catch {
+    }
+  }
+  return null;
+}
+function windowsMachineGuid() {
+  try {
+    const r = spawnSync(
+      "reg",
+      ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+      { encoding: "utf8", timeout: 4e3 }
+    );
+    if (r.status !== 0 || !r.stdout) return null;
+    const m = /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]+)/.exec(r.stdout);
+    return m?.[1]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function fallbackKey() {
+  try {
+    if (existsSync6(FALLBACK_KEY_FILE)) {
+      const v = readFileSync3(FALLBACK_KEY_FILE, "utf8").trim();
+      if (v) return v;
+    }
+  } catch {
+  }
+  const fresh = createHash3("sha256").update(`${MACHINE_KEY_SALT}:fallback:${Date.now()}:${Math.random()}`).digest("hex");
+  try {
+    mkdirSync2(ROOT2, { recursive: true, mode: 448 });
+    writeFileSync3(FALLBACK_KEY_FILE, fresh, { mode: 384 });
+    chmodSync2(FALLBACK_KEY_FILE, 384);
+  } catch {
+  }
+  return fresh;
+}
+function resolveRaw() {
+  const p = platform2();
+  if (p === "darwin") {
+    const v = macosPlatformUuid();
+    if (v) return { raw: v, source: "macos-ioplatform" };
+  } else if (p === "win32") {
+    const v = windowsMachineGuid();
+    if (v) return { raw: v, source: "windows-guid" };
+  } else {
+    const v = linuxMachineId();
+    if (v) return { raw: v, source: "linux-machine-id" };
+  }
+  return { raw: fallbackKey(), source: "fallback-file" };
+}
+function machineKey() {
+  if (cachedKey) return cachedKey;
+  const { raw, source } = resolveRaw();
+  cachedSource = source;
+  cachedKey = createHash3("sha256").update(`${MACHINE_KEY_SALT}:${raw}`).digest("hex");
+  return cachedKey;
+}
+function machineKeySource() {
+  if (!cachedSource) machineKey();
+  return cachedSource;
+}
+function deviceUuidFromMachineKey(key = machineKey()) {
+  const nsHex = DEVICE_UUID_NAMESPACE.replace(/-/g, "");
+  const nsBytes = Buffer.from(nsHex, "hex");
+  const hash = createHash3("sha1").update(nsBytes).update(key).digest();
+  const b = Buffer.from(hash.subarray(0, 16));
+  b[6] = b[6] & 15 | 80;
+  b[8] = b[8] & 63 | 128;
+  const h = b.toString("hex");
+  return [h.slice(0, 8), h.slice(8, 12), h.slice(12, 16), h.slice(16, 20), h.slice(20, 32)].join(
+    "-"
+  );
+}
+var MACHINE_KEY_SALT, DEVICE_UUID_NAMESPACE, ROOT2, FALLBACK_KEY_FILE, cachedKey, cachedSource;
+var init_machine_key = __esm({
+  "src/machine-key.ts"() {
+    "use strict";
+    MACHINE_KEY_SALT = "modelstat.device.machine-key.v1";
+    DEVICE_UUID_NAMESPACE = "6f1d2c9a-8b3e-4a7f-9c2d-0e5a1b6c7d8e";
+    ROOT2 = join4(homedir4(), ".modelstat");
+    FALLBACK_KEY_FILE = join4(ROOT2, "machine-key");
+    cachedKey = null;
+    cachedSource = null;
+  }
+});
+
 // ../../packages/companion-core/src/contracts/index.ts
 var init_contracts = __esm({
   "../../packages/companion-core/src/contracts/index.ts"() {
@@ -45099,7 +45210,7 @@ async function buildSessionTitles(segments, entitle) {
       const project = first.tags.find((t) => t.root_key === "projects")?.name;
       const facts = [
         project ? `repo ${project}` : null,
-        `${sorted.length} part${sorted.length === 1 ? "" : "s"} on ${first.tool}`
+        `${sorted.length} part${sorted.length === 1 ? "" : "s"} on ${first.agent}`
       ].filter(Boolean).join("; ");
       try {
         title = sanitiseTitle(await entitle({ abstracts: sampleAbstracts(abstracts), facts }));
@@ -45254,14 +45365,14 @@ async function summariseSlice(sessionId, slice, adapters2) {
   const promptFacts = [
     first.git?.remote_slug ? `repo ${first.git.remote_slug}` : null,
     first.git?.branch ? `branch ${first.git.branch}` : null,
-    `${slice.length} turns on ${first.tool}`,
+    `${slice.length} turns on ${first.agent}`,
     first.files_touched?.length ? `files touched: ${first.files_touched.slice(0, 5).join(", ")}` : null,
     Object.keys(first.tool_calls ?? {}).length ? `tool calls: ${Object.keys(first.tool_calls).slice(0, 5).join(", ")}` : null
   ].filter(Boolean).join("; ");
   const excerpts = sampleAndRedactExcerpts(slice);
   if (excerpts.length === 0) {
     throw new Error(
-      `parser produced 0 content excerpts for session ${sessionId} (${slice.length} turns) \u2014 the summariser would only see metadata and produce "${slice.length} turns on ${first.tool}". Check the parser for ${first.tool} (likely extractExcerpt stripped everything as code or the session is pure tool_use).`
+      `parser produced 0 content excerpts for session ${sessionId} (${slice.length} turns) \u2014 the summariser would only see metadata and produce "${slice.length} turns on ${first.agent}". Check the parser for ${first.agent} (likely extractExcerpt stripped everything as code or the session is pure tool_use).`
     );
   }
   const excerptBlock = excerpts.map((e, i) => `  [turn ${i + 1}] "${e.replace(/\s+/g, " ").trim()}"`).join("\n");
@@ -45304,7 +45415,7 @@ Write the SHORTEST keyword-dense paragraph (1-3 sentences, \u2264${ABSTRACT_OUTP
     }
   }
   const tags = [
-    { root_key: "tools", name: first.tool, confidence: 1 },
+    { root_key: "agents", name: first.agent, confidence: 1 },
     { root_key: "providers", name: first.provider, confidence: 1 }
   ];
   if (first.model) tags.push({ root_key: "models", name: first.model, confidence: 1 });
@@ -45355,7 +45466,7 @@ Write the SHORTEST keyword-dense paragraph (1-3 sentences, \u2264${ABSTRACT_OUTP
   return {
     segment_id: id,
     session_id: sessionId,
-    tool: first.tool,
+    agent: first.agent,
     started_at: first.ts,
     ended_at: last.ts,
     // Slice to the user-visible cap (ABSTRACT_OUTPUT_MAX_CHARS, default
@@ -45399,7 +45510,7 @@ function sampleAndRedactExcerpts(slice) {
   return out;
 }
 function turnSurface(e) {
-  const parts = [e.kind, e.tool];
+  const parts = [e.kind, e.agent];
   if (e.model) parts.push(e.model);
   const toolCalls = Object.keys(e.tool_calls ?? {});
   if (toolCalls.length) parts.push(`tools:${toolCalls.join(",")}`);
@@ -45484,7 +45595,7 @@ var init_file_queue_store = __esm({
         try {
           const raw = await fs3.readFile(this.filePath, "utf8");
           const parsed = JSON.parse(raw);
-          if (parsed.version === 1 && parsed.items) {
+          if (parsed.version === 2 && parsed.items) {
             const now = Date.now();
             for (const [k, v] of Object.entries(parsed.items)) {
               if (v.synced && now - v.last_event_ts_ms > SENT_TTL_MS) continue;
@@ -45496,7 +45607,7 @@ var init_file_queue_store = __esm({
             try {
               const bak = await fs3.readFile(`${this.filePath}.bak`, "utf8");
               const parsed = JSON.parse(bak);
-              if (parsed.version === 1 && parsed.items) {
+              if (parsed.version === 2 && parsed.items) {
                 for (const [k, v] of Object.entries(parsed.items)) {
                   this.items.set(k, v);
                 }
@@ -45515,7 +45626,7 @@ var init_file_queue_store = __esm({
         const run = async () => {
           await prior?.catch(() => void 0);
           const snap = {
-            version: 1,
+            version: 2,
             items: Object.fromEntries(this.items.entries())
           };
           const tmp = `${this.filePath}.tmp`;
@@ -45696,14 +45807,14 @@ var init_ollama = __esm({
 
 // ../../packages/companion-core/src/node/llama.ts
 import { mkdir } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join4 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname5, join as join5 } from "path";
 function defaultLlamaConfig() {
   const env2 = globalThis.process?.env ?? {};
-  const modelsDir = env2.MODELSTAT_MODELS_DIR ?? join4(homedir4(), ".modelstat", "models");
+  const modelsDir = env2.MODELSTAT_MODELS_DIR ?? join5(homedir5(), ".modelstat", "models");
   const modelUrl = env2.MODELSTAT_LLAMA_MODEL_URL ?? DEFAULT_LLAMA_MODEL_URL;
-  const modelPath = env2.MODELSTAT_LLAMA_MODEL_PATH ?? join4(modelsDir, basenameFromUrl(modelUrl));
+  const modelPath = env2.MODELSTAT_LLAMA_MODEL_PATH ?? join5(modelsDir, basenameFromUrl(modelUrl));
   return {
     modelPath,
     modelUrl,
@@ -45724,7 +45835,7 @@ function basenameFromUrl(url) {
   return parts[parts.length - 1] || "model.gguf";
 }
 async function ensureLlamaModel(cfg = defaultLlamaConfig()) {
-  if (existsSync6(cfg.modelPath)) return cfg.modelPath;
+  if (existsSync7(cfg.modelPath)) return cfg.modelPath;
   await mkdir(dirname5(cfg.modelPath), { recursive: true });
   const res = await fetch(cfg.modelUrl);
   if (!res.ok || !res.body) {
@@ -46237,8 +46348,8 @@ var init_pipeline2 = __esm({
 
 // src/scan.ts
 import { readdir, stat as stat2 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 function withNonNullTokens(e) {
   return e.tokens ? e : { ...e, tokens: { ...ZERO_TOKENS } };
 }
@@ -46247,16 +46358,16 @@ async function scanAll(cb = {}) {
   if (!deviceId) throw new Error("agent not enrolled \u2014 run `register` first");
   const jobs = [];
   try {
-    const base = join5(homedir5(), ".claude/projects");
+    const base = join6(homedir6(), ".claude/projects");
     const projects = await readdir(base).catch(() => []);
     for (const p of projects) {
-      const dir = join5(base, p);
+      const dir = join6(base, p);
       const ds = await stat2(dir).catch(() => null);
       if (!ds?.isDirectory()) continue;
       const files = await readdir(dir);
       for (const f of files) {
         if (!f.endsWith(".jsonl")) continue;
-        const full = join5(dir, f);
+        const full = join6(dir, f);
         jobs.push({
           path: full,
           parse: async (sink2) => {
@@ -46270,17 +46381,17 @@ async function scanAll(cb = {}) {
     console.warn("claude scan skipped:", e.message);
   }
   try {
-    const base = join5(homedir5(), ".codex/sessions");
+    const base = join6(homedir6(), ".codex/sessions");
     const years = await readdir(base).catch(() => []);
     for (const y of years) {
-      const months = await readdir(join5(base, y)).catch(() => []);
+      const months = await readdir(join6(base, y)).catch(() => []);
       for (const m of months) {
-        const days = await readdir(join5(base, y, m)).catch(() => []);
+        const days = await readdir(join6(base, y, m)).catch(() => []);
         for (const d of days) {
-          const files = await readdir(join5(base, y, m, d)).catch(() => []);
+          const files = await readdir(join6(base, y, m, d)).catch(() => []);
           for (const f of files) {
             if (!f.startsWith("rollout-") || !f.endsWith(".jsonl")) continue;
-            const full = join5(base, y, m, d, f);
+            const full = join6(base, y, m, d, f);
             jobs.push({
               path: full,
               parse: async (sink2) => {
@@ -46332,7 +46443,7 @@ async function scanAll(cb = {}) {
     const batch = {
       batch_id: batchId(),
       device_id: deviceId,
-      agent_version: AGENT_VERSION,
+      companion_version: AGENT_VERSION,
       events,
       segments,
       tool_calls: attachSegmentIdsByMap(toolCallBuffer, callSegmentByEvent),
@@ -46397,7 +46508,7 @@ var init_scan = __esm({
     init_api();
     init_config2();
     init_pipeline2();
-    AGENT_VERSION = true ? "agent-0.0.48" : "agent-dev";
+    AGENT_VERSION = true ? "agent-0.0.50" : "agent-dev";
     BATCH_MAX_EVENTS = 2e3;
     BATCH_MAX_TOOL_CALLS = 2e4;
     BATCH_BUFFER_HARD_CAP = BATCH_MAX_EVENTS * 2;
@@ -46414,17 +46525,17 @@ var init_scan = __esm({
 // src/lock.ts
 import {
   closeSync,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync4,
   openSync,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4,
+  writeFileSync as writeFileSync5,
   writeSync
 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
   try {
@@ -46438,13 +46549,13 @@ function isProcessAlive(pid) {
 }
 function readDaemonLock(lockFile = LOCK_FILE) {
   try {
-    const raw = readFileSync4(lockFile, "utf8");
+    const raw = readFileSync5(lockFile, "utf8");
     const obj = JSON.parse(raw);
     if (typeof obj.pid !== "number") return null;
     return {
       pid: obj.pid,
       startedAt: obj.startedAt ?? "unknown",
-      agentVersion: obj.agentVersion ?? "unknown",
+      companionVersion: obj.companionVersion ?? "unknown",
       apiUrl: obj.apiUrl ?? "unknown"
     };
   } catch {
@@ -46452,7 +46563,7 @@ function readDaemonLock(lockFile = LOCK_FILE) {
   }
 }
 function writeLockAtomic(meta) {
-  mkdirSync3(LOCK_DIR, { recursive: true });
+  mkdirSync4(LOCK_DIR, { recursive: true });
   const tmp = `${LOCK_FILE}.${meta.pid}.${Date.now()}.tmp`;
   const fd = openSync(tmp, "wx");
   try {
@@ -46486,7 +46597,7 @@ function acquireDaemonLock(opts) {
   const meta = {
     pid: process.pid,
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    agentVersion: opts.agentVersion,
+    companionVersion: opts.companionVersion,
     apiUrl: opts.apiUrl
   };
   writeLockAtomic(meta);
@@ -46544,8 +46655,8 @@ var LOCK_DIR, LOCK_FILE, LOCK_RECHECK_MS;
 var init_lock = __esm({
   "src/lock.ts"() {
     "use strict";
-    LOCK_DIR = join7(homedir7(), ".modelstat");
-    LOCK_FILE = join7(LOCK_DIR, "daemon.lock");
+    LOCK_DIR = join8(homedir8(), ".modelstat");
+    LOCK_FILE = join8(LOCK_DIR, "daemon.lock");
     LOCK_RECHECK_MS = 5e3;
   }
 });
@@ -48342,7 +48453,7 @@ __export(daemon_exports, {
   setQueue: () => setQueue,
   setStat: () => setStat
 });
-import { existsSync as existsSync9, statSync as statSync2 } from "fs";
+import { existsSync as existsSync10, statSync as statSync2 } from "fs";
 function setPhase(phase, message) {
   status.phase = phase;
   status.message = message ?? null;
@@ -48384,7 +48495,8 @@ function snapshotBody() {
     queue_size: status.queueSize,
     stats: status.stats,
     last_event_at: status.lastEventAt,
-    agent_version: AGENT_VERSION2
+    companion_version: AGENT_VERSION2,
+    machine_id: machineKey()
   };
 }
 function scheduleLocalFlush() {
@@ -48421,12 +48533,12 @@ async function sendHeartbeat() {
   writeLocalStatus(body).catch(() => void 0);
 }
 async function rotateRunawayLogs() {
-  const { homedir: homedir10 } = await import("os");
-  const { join: join12 } = await import("path");
+  const { homedir: homedir11 } = await import("os");
+  const { join: join13 } = await import("path");
   const { open: open2, stat: stat6, truncate, writeFile } = await import("fs/promises");
-  const dir = join12(homedir10(), ".modelstat", "logs");
+  const dir = join13(homedir11(), ".modelstat", "logs");
   for (const name of ["out.log", "err.log"]) {
-    const p = join12(dir, name);
+    const p = join13(dir, name);
     try {
       const st = await stat6(p);
       if (st.size <= LOG_MAX_BYTES) continue;
@@ -48448,16 +48560,16 @@ async function rotateRunawayLogs() {
   }
 }
 async function writeLocalStatus(snapshot) {
-  const { homedir: homedir10 } = await import("os");
-  const { join: join12 } = await import("path");
+  const { homedir: homedir11 } = await import("os");
+  const { join: join13 } = await import("path");
   const { writeFile, mkdir: mkdir2, rename } = await import("fs/promises");
   if (!lastStatusPath) {
-    const dir = join12(homedir10(), ".modelstat");
+    const dir = join13(homedir11(), ".modelstat");
     try {
       await mkdir2(dir, { recursive: true });
     } catch {
     }
-    lastStatusPath = join12(dir, "last-status.json");
+    lastStatusPath = join13(dir, "last-status.json");
   }
   const tmp = `${lastStatusPath}.tmp`;
   try {
@@ -48499,10 +48611,7 @@ async function runScanCycle(reason) {
         if (p.segment === 0) {
           setPhase("processing", `Analyzing${sess}`);
         } else {
-          setPhase(
-            "processing",
-            `Summarising segment ${p.segment}/${p.segmentTotal}${sess}`
-          );
+          setPhase("processing", `Summarising segment ${p.segment}/${p.segmentTotal}${sess}`);
         }
       },
       onUpload({ segments }) {
@@ -48537,7 +48646,7 @@ async function runDaemon(opts = {}) {
     throw new Error("not enrolled \u2014 run `npx modelstat@latest` first");
   }
   const lock = acquireDaemonLock({
-    agentVersion: AGENT_VERSION2,
+    companionVersion: AGENT_VERSION2,
     apiUrl: state.apiUrl,
     force: opts.force === true,
     // If a racing daemon out-renamed us for the lock (see lock.ts
@@ -48555,14 +48664,10 @@ async function runDaemon(opts = {}) {
     console.log(
       `modelstat daemon is already running \u2014 PID ${lock.owner.pid}, started ${formatAge(
         lock.ageSec
-      )} ago, agent ${lock.owner.agentVersion}.`
-    );
-    console.log(
-      "  \u2192 to stop it:          kill " + lock.owner.pid
-    );
-    console.log(
-      "  \u2192 to force-replace it: modelstat start --force"
+      )} ago, agent ${lock.owner.companionVersion}.`
     );
+    console.log("  \u2192 to stop it:          kill " + lock.owner.pid);
+    console.log("  \u2192 to force-replace it: modelstat start --force");
     return;
   }
   setPhase("starting", "Booting");
@@ -48590,21 +48695,19 @@ async function runDaemon(opts = {}) {
   await runDiscovery();
   await requestScan("startup");
   const chokidar = (await Promise.resolve().then(() => (init_esm2(), esm_exports))).default;
-  const { homedir: homedir10, platform: platform5 } = await import("os");
-  const { join: join12 } = await import("path");
-  const home2 = homedir10();
+  const { homedir: homedir11, platform: platform6 } = await import("os");
+  const { join: join13 } = await import("path");
+  const home2 = homedir11();
   const dirs = [
-    join12(home2, ".claude/projects"),
-    join12(home2, ".codex/sessions"),
-    join12(home2, ".cursor/ai-tracking"),
-    join12(home2, ".gemini"),
-    ...platform5() === "darwin" ? [
-      join12(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join12(home2, "Library/Application Support/Claude")
-    ] : [
-      join12(home2, ".config/Cursor/User/workspaceStorage")
-    ]
-  ].filter((p) => existsSync9(p) && statSync2(p).isDirectory());
+    join13(home2, ".claude/projects"),
+    join13(home2, ".codex/sessions"),
+    join13(home2, ".cursor/ai-tracking"),
+    join13(home2, ".gemini"),
+    ...platform6() === "darwin" ? [
+      join13(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join13(home2, "Library/Application Support/Claude")
+    ] : [join13(home2, ".config/Cursor/User/workspaceStorage")]
+  ].filter((p) => existsSync10(p) && statSync2(p).isDirectory());
   setPhase("watching", `Watching ${dirs.length} directories`);
   const watcher = chokidar.watch(dirs, {
     persistent: true,
@@ -48629,10 +48732,7 @@ async function runDaemon(opts = {}) {
   });
   const backstop = setInterval(() => void requestScan("interval"), SCAN_INTERVAL_MS);
   backstop.unref();
-  const discoveryTimer = setInterval(
-    () => void runDiscovery(),
-    DISCOVERY_INTERVAL_MS
-  );
+  const discoveryTimer = setInterval(() => void runDiscovery(), DISCOVERY_INTERVAL_MS);
   discoveryTimer.unref();
   const shutdown = async () => {
     setPhase("offline", "Shutting down");
@@ -48649,15 +48749,16 @@ var import_undici2, AGENT_VERSION2, HEARTBEAT_INTERVAL_MS, SCAN_INTERVAL_MS, DIS
 var init_daemon = __esm({
   "src/daemon.ts"() {
     "use strict";
-    import_undici2 = __toESM(require_undici(), 1);
     init_logger();
     init_src2();
+    import_undici2 = __toESM(require_undici(), 1);
     init_api();
     init_config2();
     init_lock();
+    init_machine_key();
     init_scan();
     init_single_flight();
-    AGENT_VERSION2 = true ? "agent-0.0.48" : "agent-dev";
+    AGENT_VERSION2 = true ? "agent-0.0.50" : "agent-dev";
     HEARTBEAT_INTERVAL_MS = 1e4;
     SCAN_INTERVAL_MS = 5 * 60 * 1e3;
     DISCOVERY_INTERVAL_MS = 6e4;
@@ -48685,37 +48786,37 @@ var watch_exports = {};
 __export(watch_exports, {
   watchForever: () => watchForever
 });
-import { existsSync as existsSync10 } from "fs";
-import { homedir as homedir9, platform as platform3 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { homedir as homedir10, platform as platform4 } from "os";
+import { join as join12 } from "path";
 function resolveWatchDirs() {
-  const home2 = homedir9();
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join11(home2, ".config");
-  const xdgData = process.env.XDG_DATA_HOME ?? join11(home2, ".local/share");
+  const home2 = homedir10();
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join12(home2, ".config");
+  const xdgData = process.env.XDG_DATA_HOME ?? join12(home2, ".local/share");
   const candidates = [
     // universal (default HOME-rooted CLI data dirs)
-    join11(home2, ".claude/projects"),
-    join11(home2, ".codex/sessions"),
-    join11(home2, ".cursor/ai-tracking"),
-    join11(home2, ".gemini"),
-    join11(home2, ".aider"),
+    join12(home2, ".claude/projects"),
+    join12(home2, ".codex/sessions"),
+    join12(home2, ".cursor/ai-tracking"),
+    join12(home2, ".gemini"),
+    join12(home2, ".aider"),
     // XDG / Linux
-    join11(xdgConfig, "claude/projects"),
-    join11(xdgConfig, "codex/sessions"),
-    join11(xdgConfig, "Cursor/User/workspaceStorage"),
-    join11(xdgConfig, "Code/User/workspaceStorage"),
-    join11(xdgConfig, "Code - Insiders/User/workspaceStorage"),
-    join11(xdgData, "claude/projects"),
+    join12(xdgConfig, "claude/projects"),
+    join12(xdgConfig, "codex/sessions"),
+    join12(xdgConfig, "Cursor/User/workspaceStorage"),
+    join12(xdgConfig, "Code/User/workspaceStorage"),
+    join12(xdgConfig, "Code - Insiders/User/workspaceStorage"),
+    join12(xdgData, "claude/projects"),
     // macOS
-    ...platform3() === "darwin" ? [
-      join11(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join11(home2, "Library/Application Support/Claude"),
-      join11(home2, "Library/Application Support/Code/User/workspaceStorage"),
-      join11(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
-      join11(home2, "Library/Application Support/Zed")
+    ...platform4() === "darwin" ? [
+      join12(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join12(home2, "Library/Application Support/Claude"),
+      join12(home2, "Library/Application Support/Code/User/workspaceStorage"),
+      join12(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
+      join12(home2, "Library/Application Support/Zed")
     ] : []
   ];
-  return Array.from(new Set(candidates)).filter((p) => existsSync10(p));
+  return Array.from(new Set(candidates)).filter((p) => existsSync11(p));
 }
 async function safeScan(reason) {
   if (scanning) {
@@ -48780,53 +48881,53 @@ init_src2();
 init_api();
 init_config2();
 init_identity();
+init_machine_key();
 init_scan();
 import { spawn } from "child_process";
-import { randomBytes } from "crypto";
-import { arch as cpuArch, hostname as hostname2, platform as platform4, release } from "os";
+import { arch as cpuArch, hostname as hostname2, platform as platform5, release } from "os";
 import { createInterface as createInterface3 } from "readline";
 
 // src/service.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
   realpathSync,
   unlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir6, platform as platform2, userInfo } from "os";
-import { dirname as dirname6, join as join6 } from "path";
+import { homedir as homedir7, platform as platform3, userInfo } from "os";
+import { dirname as dirname6, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var SERVICE_LABEL = "ai.modelstat.agent";
 var SYSTEMD_UNIT = "modelstat";
 function home() {
-  return homedir6();
+  return homedir7();
 }
 function stateDir() {
-  return join6(home(), ".modelstat");
+  return join7(home(), ".modelstat");
 }
 function binDir() {
-  return join6(stateDir(), "bin");
+  return join7(stateDir(), "bin");
 }
 function logDir() {
-  return join6(stateDir(), "logs");
+  return join7(stateDir(), "logs");
 }
 function installedCliPath() {
-  return join6(binDir(), "modelstat.mjs");
+  return join7(binDir(), "modelstat.mjs");
 }
 function runningCliPath() {
   return fileURLToPath2(import.meta.url).replace(/service\.(mjs|js|ts)$/, "cli.mjs");
 }
 function installBundle() {
-  mkdirSync2(binDir(), { recursive: true });
-  mkdirSync2(logDir(), { recursive: true });
+  mkdirSync3(binDir(), { recursive: true });
+  mkdirSync3(logDir(), { recursive: true });
   const src = runningCliPath();
   const dest = installedCliPath();
-  if (!existsSync7(src)) {
+  if (!existsSync8(src)) {
     throw new Error(
       `Can't find the CLI bundle to install from (${src}). Are you running a local dev build?`
     );
@@ -48844,9 +48945,9 @@ function sourceLlamaVersion(sourceCli) {
     const req = createRequire(sourceCli);
     let d = dirname6(realpathSync(req.resolve("node-llama-cpp")));
     for (let i = 0; i < 10; i++) {
-      const pj = join6(d, "package.json");
-      if (existsSync7(pj)) {
-        const p = JSON.parse(readFileSync3(pj, "utf8"));
+      const pj = join7(d, "package.json");
+      if (existsSync8(pj)) {
+        const p = JSON.parse(readFileSync4(pj, "utf8"));
         if (p.name === "node-llama-cpp" && p.version) return p.version;
       }
       const up = dirname6(d);
@@ -48862,19 +48963,19 @@ function installNativeRuntime(sourceCli) {
   const dest = binDir();
   try {
     const have = JSON.parse(
-      readFileSync3(
-        join6(dest, "node_modules", "node-llama-cpp", "package.json"),
+      readFileSync4(
+        join7(dest, "node_modules", "node-llama-cpp", "package.json"),
         "utf8"
       )
     );
     if (have.version === version) return [`node-llama-cpp@${version} (cached)`];
   } catch {
   }
-  mkdirSync2(dest, { recursive: true });
+  mkdirSync3(dest, { recursive: true });
   const childEnv = { ...process.env };
   delete childEnv.npm_config_global;
   delete childEnv.npm_config_prefix;
-  const r = spawnSync(
+  const r = spawnSync2(
     "npm",
     [
       "install",
@@ -48904,21 +49005,21 @@ function nodeBinary() {
   return process.execPath;
 }
 function plistPath() {
-  return join6(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join7(home(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function locateTrayExecutable() {
   const candidates = [
-    join6(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
+    join7(home(), "Applications", "ModelstatTray.app", "Contents", "MacOS", "modelstat-tray"),
     "/Applications/ModelstatTray.app/Contents/MacOS/modelstat-tray"
   ];
   for (const p of candidates) {
-    if (existsSync7(p)) return p;
+    if (existsSync8(p)) return p;
   }
   return null;
 }
 function writePlist(cliPath) {
   const p = plistPath();
-  mkdirSync2(dirname6(p), { recursive: true });
+  mkdirSync3(dirname6(p), { recursive: true });
   const tray = locateTrayExecutable();
   const programArgs = tray ? `    <string>${tray}</string>` : [
     `    <string>${nodeBinary()}</string>`,
@@ -48938,8 +49039,8 @@ ${programArgs}
   <key>KeepAlive</key>
   <dict><key>SuccessfulExit</key><false/></dict>
   <key>ThrottleInterval</key><integer>30</integer>
-  <key>StandardOutPath</key><string>${join6(logDir(), "out.log")}</string>
-  <key>StandardErrorPath</key><string>${join6(logDir(), "err.log")}</string>
+  <key>StandardOutPath</key><string>${join7(logDir(), "out.log")}</string>
+  <key>StandardErrorPath</key><string>${join7(logDir(), "err.log")}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key><string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin</string>
@@ -48953,11 +49054,11 @@ ${programArgs}
 </dict>
 </plist>
 `;
-  writeFileSync3(p, plist, { mode: 420 });
+  writeFileSync4(p, plist, { mode: 420 });
   return p;
 }
 function launchctl(args) {
-  const r = spawnSync("launchctl", args, { encoding: "utf8" });
+  const r = spawnSync2("launchctl", args, { encoding: "utf8" });
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "" };
 }
 function macInstall() {
@@ -48984,7 +49085,7 @@ function macUninstall() {
   const target = `gui/${uid}/${SERVICE_LABEL}`;
   launchctl(["bootout", target]);
   const plist = plistPath();
-  if (existsSync7(plist)) {
+  if (existsSync8(plist)) {
     try {
       unlinkSync(plist);
     } catch {
@@ -48997,12 +49098,12 @@ function macStatus() {
   return { running: r.ok, hint: r.ok ? "launchd managed" : "not installed" };
 }
 function systemdUnitPath() {
-  const xdg = process.env.XDG_CONFIG_HOME ?? join6(home(), ".config");
-  return join6(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
+  const xdg = process.env.XDG_CONFIG_HOME ?? join7(home(), ".config");
+  return join7(xdg, "systemd", "user", `${SYSTEMD_UNIT}.service`);
 }
 function writeSystemdUnit(cliPath) {
   const unitPath = systemdUnitPath();
-  mkdirSync2(dirname6(unitPath), { recursive: true });
+  mkdirSync3(dirname6(unitPath), { recursive: true });
   const unit = `[Unit]
 Description=modelstat agent
 Documentation=https://modelstat.ai
@@ -49021,17 +49122,17 @@ RestartSec=10
 # Don't restart-storm if the service is persistently unreachable.
 StartLimitIntervalSec=300
 StartLimitBurst=10
-StandardOutput=append:${join6(logDir(), "out.log")}
-StandardError=append:${join6(logDir(), "err.log")}
+StandardOutput=append:${join7(logDir(), "out.log")}
+StandardError=append:${join7(logDir(), "err.log")}
 
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync3(unitPath, unit, { mode: 420 });
+  writeFileSync4(unitPath, unit, { mode: 420 });
   return unitPath;
 }
 function systemctl(args) {
-  const r = spawnSync("systemctl", ["--user", ...args], { encoding: "utf8" });
+  const r = spawnSync2("systemctl", ["--user", ...args], { encoding: "utf8" });
   return { ok: r.status === 0, out: r.stdout ?? "", err: r.stderr ?? "" };
 }
 function linuxInstall() {
@@ -49047,7 +49148,7 @@ function linuxInstall() {
 function linuxUninstall() {
   systemctl(["disable", "--now", `${SYSTEMD_UNIT}.service`]);
   const unit = systemdUnitPath();
-  if (existsSync7(unit)) {
+  if (existsSync8(unit)) {
     try {
       unlinkSync(unit);
     } catch {
@@ -49061,7 +49162,7 @@ function linuxStatus() {
   return { running: active, hint: active ? "systemd managed" : "not running" };
 }
 function installService() {
-  const p = platform2();
+  const p = platform3();
   if (p === "darwin") {
     macInstall();
     return { path: plistPath(), logs: logDir() };
@@ -49075,13 +49176,13 @@ function installService() {
   );
 }
 function uninstallService() {
-  const p = platform2();
+  const p = platform3();
   if (p === "darwin") return macUninstall();
   if (p === "linux") return linuxUninstall();
   throw new Error(`Service uninstall isn't supported on ${p}.`);
 }
 function serviceStatus() {
-  const p = platform2();
+  const p = platform3();
   if (p === "darwin") return macStatus();
   if (p === "linux") return linuxStatus();
   return { running: false, hint: `unsupported platform (${p})` };
@@ -49090,67 +49191,67 @@ function logsDir() {
   return logDir();
 }
 function installTrayApp(sourceAppPath) {
-  if (platform2() !== "darwin") return null;
-  if (!existsSync7(sourceAppPath)) return null;
-  const dest = join6(home(), "Applications", "ModelstatTray.app");
-  mkdirSync2(dirname6(dest), { recursive: true });
-  spawnSync("rm", ["-rf", dest]);
-  const r = spawnSync("cp", ["-R", sourceAppPath, dest], { encoding: "utf8" });
+  if (platform3() !== "darwin") return null;
+  if (!existsSync8(sourceAppPath)) return null;
+  const dest = join7(home(), "Applications", "ModelstatTray.app");
+  mkdirSync3(dirname6(dest), { recursive: true });
+  spawnSync2("rm", ["-rf", dest]);
+  const r = spawnSync2("cp", ["-R", sourceAppPath, dest], { encoding: "utf8" });
   if (r.status !== 0) {
     throw new Error(`cp ModelstatTray.app failed: ${r.stderr?.trim() || `exit ${r.status}`}`);
   }
   return { installedAt: dest };
 }
 function bundledTrayAppPath() {
-  if (platform2() !== "darwin") return null;
+  if (platform3() !== "darwin") return null;
   const here2 = dirname6(fileURLToPath2(import.meta.url));
   const candidates = [
     // Pre-built .app — CI with codesigning drops one here.
-    join6(here2, "..", "vendor", "ModelstatTray.app"),
+    join7(here2, "..", "vendor", "ModelstatTray.app"),
     // Local dev layout: apps/agent-dev/src/service.ts → ../../tray-mac/build/ModelstatTray.app
-    join6(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
+    join7(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
   ];
   for (const c of candidates) {
-    if (existsSync7(c)) return c;
+    if (existsSync8(c)) return c;
   }
   const sourceDirs = [
-    join6(here2, "..", "vendor", "tray-mac"),
-    join6(here2, "..", "..", "tray-mac")
+    join7(here2, "..", "vendor", "tray-mac"),
+    join7(here2, "..", "..", "tray-mac")
   ];
   for (const src of sourceDirs) {
-    const build = join6(src, "build-app.sh");
-    if (!existsSync7(build)) continue;
+    const build = join7(src, "build-app.sh");
+    if (!existsSync8(build)) continue;
     if (!hasSwift()) return null;
-    const r = spawnSync("bash", [build], { cwd: src, encoding: "utf8" });
+    const r = spawnSync2("bash", [build], { cwd: src, encoding: "utf8" });
     if (r.status === 0) {
-      const app = join6(src, "build", "ModelstatTray.app");
-      if (existsSync7(app)) return app;
+      const app = join7(src, "build", "ModelstatTray.app");
+      if (existsSync8(app)) return app;
     }
   }
   return null;
 }
 function hasSwift() {
-  const r = spawnSync("swift", ["--version"], { encoding: "utf8" });
+  const r = spawnSync2("swift", ["--version"], { encoding: "utf8" });
   return r.status === 0;
 }
 function trayStatus() {
-  if (platform2() !== "darwin") return { installed: false, path: null };
+  if (platform3() !== "darwin") return { installed: false, path: null };
   const exe = locateTrayExecutable();
   return exe ? { installed: true, path: exe.replace(/\/Contents\/MacOS\/modelstat-tray$/, "") } : { installed: false, path: null };
 }
 
 // src/supervise.ts
 init_lock();
-import { readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
 var STATUS_FRESH_MS = 12e4;
 var BOOT_GRACE_MS = 9e4;
 function decideSupervision(input) {
   const fresh = input.statusFreshMs ?? STATUS_FRESH_MS;
   const grace = input.bootGraceMs ?? BOOT_GRACE_MS;
   if (!input.lock || !input.ownerAlive) return "spawn";
-  if (input.myAgentVersion && input.lock.agentVersion !== "unknown" && input.lock.agentVersion !== input.myAgentVersion) {
+  if (input.myCompanionVersion && input.lock.companionVersion !== "unknown" && input.lock.companionVersion !== input.myCompanionVersion) {
     return "replace";
   }
   if (input.statusAgeMs !== null && input.statusAgeMs <= fresh) return "adopt";
@@ -49160,13 +49261,13 @@ function decideSupervision(input) {
 function daemonHealth(opts = {}) {
   const now = opts.now ?? Date.now();
   const pidAlive = opts.pidAlive ?? isProcessAlive;
-  const statusPath = opts.statusPath ?? join8(homedir8(), ".modelstat", "last-status.json");
+  const statusPath = opts.statusPath ?? join9(homedir9(), ".modelstat", "last-status.json");
   const lock = opts.lockPath === void 0 ? readDaemonLock() : readDaemonLock(opts.lockPath);
   const ownerAlive = lock !== null && pidAlive(lock.pid);
   const lockAgeMs = lock ? ageMs(lock.startedAt, now) : null;
   let statusAgeMs = null;
   try {
-    const raw = readFileSync5(statusPath, "utf8");
+    const raw = readFileSync6(statusPath, "utf8");
     const writtenAt = JSON.parse(raw).written_at;
     statusAgeMs = writtenAt ? ageMs(writtenAt, now) : null;
   } catch {
@@ -49178,7 +49279,7 @@ function daemonHealth(opts = {}) {
       ownerAlive,
       lockAgeMs,
       statusAgeMs,
-      myAgentVersion: opts.myAgentVersion
+      myCompanionVersion: opts.myCompanionVersion
     }),
     lock,
     ownerAlive,
@@ -49208,7 +49309,7 @@ async function confirmPrompt(question, defaultYes) {
   }
 }
 function tryOpenBrowser(url) {
-  const p = platform4();
+  const p = platform5();
   const cmd = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
   const args = p === "win32" ? ["/c", "start", "", url] : [url];
   try {
@@ -49222,9 +49323,9 @@ function tryOpenBrowser(url) {
     return false;
   }
 }
-var AGENT_VERSION3 = true ? "agent-0.0.48" : "agent-dev";
+var AGENT_VERSION3 = true ? "agent-0.0.50" : "agent-dev";
 function osFamily() {
-  const p = platform4();
+  const p = platform5();
   if (p === "darwin") return "macos";
   if (p === "linux") return "linux";
   return "other";
@@ -49235,35 +49336,33 @@ function osArch() {
   if (a === "arm64") return "arm64";
   return "other";
 }
-function generateUuidV7() {
-  const ms = Date.now();
-  const tsHex = ms.toString(16).padStart(12, "0");
-  const rand = randomBytes(10);
-  rand[0] = rand[0] & 15 | 112;
-  rand[2] = rand[2] & 63 | 128;
-  const hex = tsHex + rand.toString("hex");
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20, 32)
-  ].join("-");
+function intendedDeviceUuid() {
+  const salt = process.env.MODELSTAT_DEVICE_SALT?.trim();
+  const key = salt ? `${machineKey()}:${salt}` : machineKey();
+  return deviceUuidFromMachineKey(key);
 }
 async function cmdSelfRegister() {
-  const deviceUuid = state.deviceUuid ?? generateUuidV7();
-  const fresh = !state.deviceUuid;
+  const deviceUuid = state.deviceUuid ?? intendedDeviceUuid();
+  const derived = !state.deviceUuid;
+  const mid = machineKey();
   const fingerprint = {
     hostname: hostname2(),
     os_family: osFamily(),
     os_version: release(),
     arch: osArch(),
-    agent: "modelstat-agent-dev",
-    agent_version: AGENT_VERSION3
+    companion: "modelstat-agent-dev",
+    companion_version: AGENT_VERSION3,
+    // Stable, install-method-independent machine key. The server
+    // dedupes self-register on this so the same physical machine can
+    // never become two device rows, even if the UUID somehow differs
+    // (legacy random UUID → deterministic UUID transition).
+    machine_id: mid
   };
-  if (fresh) {
-    process.stdout.write(`  \x1B[2mgenerated UUIDv7 ${deviceUuid.slice(0, 8)}\u2026\x1B[0m
-`);
+  if (derived) {
+    process.stdout.write(
+      `  \x1B[2mdevice id derived from machine key (${machineKeySource()}): ${deviceUuid.slice(0, 8)}\u2026\x1B[0m
+`
+    );
   }
   process.stdout.write(`  \x1B[2m\u2192 POST ${state.apiUrl}/v1/devices/self-register\x1B[0m
 `);
@@ -49343,7 +49442,7 @@ async function cmdConnect(opts) {
     await cmdSelfRegister();
   };
   if (opts.fresh && hasIdentityFile()) {
-    step("`--fresh` passed \u2014 minting a new device identity");
+    step("`--fresh` passed \u2014 re-registering this device");
     await wipeAndSelfRegister("forced fresh start");
   } else if (!state.deviceUuid || !state.bearer || !state.deviceId) {
     step("Registering this device with modelstat.ai");
@@ -49388,7 +49487,7 @@ async function cmdConnect(opts) {
     claim_url: claimUrl,
     agent_url: agentUrl
   });
-  if (platform4() === "darwin") {
+  if (platform5() === "darwin") {
     step("Installing menu-bar tray (macOS)");
     try {
       const src = bundledTrayAppPath();
@@ -49432,7 +49531,7 @@ async function cmdConnect(opts) {
       logs: svc.logs,
       summariser_ready: modelReady
     });
-    ok(`${platform4() === "darwin" ? "launchd" : "systemd --user"}: ${svc.path}`);
+    ok(`${platform5() === "darwin" ? "launchd" : "systemd --user"}: ${svc.path}`);
   } catch (e) {
     emitEvent(opts, "service_install_failed", { error: e.message });
     warn(`couldn't install service: ${e.message}`);
@@ -49475,7 +49574,7 @@ async function cmdConnect(opts) {
         `    detected: \x1B[32m${discovered.installations} installs \xB7 ${discovered.identities} accounts\x1B[0m`
       );
     }
-    if (platform4() === "darwin") {
+    if (platform5() === "darwin") {
       console.log(
         `    tray    : \x1B[${tray.installed ? "32" : "2"}m${tray.installed ? "menu-bar icon ready" : "not installed"}\x1B[0m`
       );
@@ -49606,10 +49705,10 @@ function fmtTokens(v) {
 }
 async function readLocalStatus() {
   try {
-    const { homedir: homedir10 } = await import("os");
-    const { join: join12 } = await import("path");
+    const { homedir: homedir11 } = await import("os");
+    const { join: join13 } = await import("path");
     const { readFile } = await import("fs/promises");
-    const p = join12(homedir10(), ".modelstat", "last-status.json");
+    const p = join13(homedir11(), ".modelstat", "last-status.json");
     const txt = await readFile(p, "utf8");
     return JSON.parse(txt);
   } catch {
@@ -49668,9 +49767,9 @@ async function cmdStats(args) {
   }
   console.log(`device:   ${view.device.id}`);
   console.log(`host:     ${view.device.hostname ?? "(unknown)"} (${view.device.os_family ?? "?"})`);
-  console.log(`agent:    ${view.device.agent_version ?? "(unknown)"}`);
+  console.log(`companion: ${view.device.companion_version ?? "(unknown)"}`);
   console.log(
-    `status:   ${view.device.agent_status ?? "(unknown)"}${view.device.last_seen_at ? ` \xB7 last seen ${view.device.last_seen_at}` : ""}`
+    `status:   ${view.device.companion_status ?? "(unknown)"}${view.device.last_seen_at ? ` \xB7 last seen ${view.device.last_seen_at}` : ""}`
   );
   console.log(
     `claim:    ${view.status}${view.status === "unclaimed" ? ` (at ${view.claim_url})` : ""}`
@@ -49729,11 +49828,17 @@ async function cmdJobs(args) {
   }
 }
 function cmdPaths(args) {
+  const intended = intendedDeviceUuid();
   const data = {
     state: state.storePath,
+    identity: identityPath(),
     logs: logsDir(),
     api: state.apiUrl,
-    paired: !!state.bearer && !!state.deviceId
+    paired: !!state.bearer && !!state.deviceId,
+    device_id: state.deviceId ?? "(none)",
+    device_uuid: state.deviceUuid ?? "(none)",
+    intended_uuid: intended,
+    machine_key_source: machineKeySource()
   };
   if (args.includes("--json")) {
     process.stdout.write(`${JSON.stringify(data)}
@@ -49792,7 +49897,7 @@ async function main() {
     }
     case "_daemon-health": {
       try {
-        console.log(JSON.stringify(daemonHealth({ myAgentVersion: AGENT_VERSION3 })));
+        console.log(JSON.stringify(daemonHealth({ myCompanionVersion: AGENT_VERSION3 })));
       } catch (e) {
         console.log(JSON.stringify({ decision: "spawn", error: e.message }));
       }
@@ -49840,10 +49945,18 @@ async function main() {
       console.log();
       console.log("Diagnostics:");
       console.log("  npx modelstat@latest status         \u2014 show pairing + service state");
-      console.log("  npx modelstat@latest stats          \u2014 live device summary: sessions \xB7 tokens \xB7 cost (--json)");
-      console.log("  npx modelstat@latest jobs           \u2014 pipeline queue + recent processing ledger (--json)");
-      console.log("  npx modelstat@latest paths          \u2014 print state file + log dir + api URL (--json)");
-      console.log("  npx modelstat@latest token          \u2014 print the device token for hosted MCP / API access (--json)");
+      console.log(
+        "  npx modelstat@latest stats          \u2014 live device summary: sessions \xB7 tokens \xB7 cost (--json)"
+      );
+      console.log(
+        "  npx modelstat@latest jobs           \u2014 pipeline queue + recent processing ledger (--json)"
+      );
+      console.log(
+        "  npx modelstat@latest paths          \u2014 print state file + log dir + api URL (--json)"
+      );
+      console.log(
+        "  npx modelstat@latest token          \u2014 print the device token for hosted MCP / API access (--json)"
+      );
       console.log();
       console.log("Dev / one-shots:");
       console.log("  npx modelstat@latest scan           \u2014 one-shot parse + upload of local JSONL");