hacklab 0.22.3 → 26.921.1

package/README.md

@@ -1,453 +1,46 @@
-# hacklab
+# Hacklab CLI
 
-The terminal-native way to join [Hacklab](https://hacklab.so) — a social network
-for AI-native hackers. Sign in to Hacklab, scan your local AI token usage, share
-a card.
+A Bun CLI for updating your Hacklab bio and social links with your coding agent.
 
-## Install
-
-Install, then run setup:
-
-```bash
-curl -fsSL https://hacklab.so/install | sh
-hacklab setup
-```
-
-The script checks for Node 20+ and installs the CLI globally — that's all it
-does. After it, `hacklab` is a real command on your PATH, and `hacklab setup` is
-the guided first run: it scans this machine's AI usage, signs you in to Hacklab,
-uploads your usage, and starts the background sync. If you already have Node 20
-or newer (including a version manager), you can skip the script:
-
-```bash
-npm i -g hacklab@latest
-hacklab setup
-```
-
-`login`, `scan`, and `sync` all still exist as standalone commands for re-running
-one piece on its own.
-
-### Windows
-
-On native Windows (PowerShell), use the `.ps1` installer instead — it checks
-for Node 20+ and installs the CLI globally, then points you at `hacklab setup`:
-
-```powershell
-irm https://hacklab.so/install.ps1 | iex
-```
-
-The CLI reads your agents' usage from your Windows home (`%USERPROFILE%\.claude`,
-`.codex`, `.grok`, and Cursor's native tracking DB), and `hacklab daemon` registers the
-background sync as two Task Scheduler tasks. If you run Claude Code or Codex
-**inside WSL**, install there instead with the `curl … | sh` command above, run
-from your WSL shell.
-
-The installer also enables local PowerShell scripts for your user
-(`Set-ExecutionPolicy -Scope CurrentUser RemoteSigned`) so the `hacklab` command
-runs. If you install manually instead (`npm i -g hacklab@latest`) and PowerShell
-says *"running scripts is disabled on this system"*, run that one line yourself,
-or call `hacklab.cmd …` (which no execution policy blocks).
-
-The `curl | sh` installer itself only installs — it never touches your session.
-
-The CLI prints a one-line nudge when a newer version is published (checked at
-most once a day); update with `npm i -g hacklab@latest`.
-
-## Scan
-
-```
-login → scan this machine → upload → receipt → share on X → daemon on
-```
-
-`hacklab scan` requires `hacklab login`. It reads local AI token usage from
-Claude Code, Codex, Cursor, OpenClaw, Hermes, OpenCode, Grok Build, GitHub Copilot,
-and Antigravity, uploads it to your profile, and prints a text usage receipt
-without displaying a card or image in the terminal. Then it asks whether to
-share a card on X, using the live account's rank, belt, and streak.
-A successful scan summons the daemon so the card stays current; `hacklab scan
---no-daemon` skips the schedule, and `hacklab daemon off` tears it down.
-Skip the whole command if this computer isn't yours — it would upload that
-machine's usage to your profile. Cursor users with no API key are offered one
-(local Cursor data is only an estimate).
-
-## Commands
-
-- `hacklab setup` — the guided first run: scan, sign-in, one question
-  about syncing your prompt activity, upload, background sync on. Safe to
-  re-run; it checks your saved session with the server first, skips whatever is
-  already done, and stops early once everything is. If that session has expired
-  or been revoked it signs you in again instead of reporting you as set up; if
-  the server can't be reached it says so and carries on with what's on disk.
-- `hacklab scan` — scan this machine, upload to your profile, share the card.
-  Requires login. Summons the daemon afterwards (`--no-daemon` to skip).
-- `hacklab sync` — re-scan local AI usage and sync it to your profile.
-- `hacklab daemon` — summon the daemon: two OS-native background jobs (launchd on
-  macOS, systemd user timers on Linux, Task Scheduler tasks on Windows) so your
-  tokens, rank, and streak stay current without you running anything. A **tick
-  every minute** reads only what your tools appended since the last run — no
-  network call at all on a minute where nothing happened — and a **full sync once
-  a day** re-scans everything and repairs whatever the tick missed. With prompt
-  sync on (see below), the same minutely read also pushes your prompt activity.
-  No daemon, no streak. Re-running it is idempotent; `hacklab daemon off` tears both down, and
-  `hacklab logout` removes them too. On a platform we can't schedule (BSD, a
-  locked-down box) it prints the commands to schedule yourself instead of
-  pretending it worked. `hacklab sync --install-daily` still forwards here.
-- `hacklab whoami` — show who you're logged in as.
-- `hacklab drop "message"` — post a drop to your feed (`-u <url>` to attach a
-  link). Human output prints its profile URL; `--json` returns a stable envelope
-  (`schemaVersion`, `id`, `path`, full `url`).
-- `hacklab chat` — open the live channel (typing posts; this is the default, so
-  bare `hacklab chat` and `hacklab chat live` are the same). Other subcommands:
-  `tail`, `post`, `history`, `dms`, `dm <handle>`, `flag`. Author handles are
-  coloured by belt rank. Add `--json` to any non-interactive subcommand for
-  machine-readable output an agent can drive.
-- `hacklab login` — sign in to Hacklab (creates an account if you don't have one).
-- `hacklab logout` — clear your saved session on this machine.
-- `hacklab config <key> <value>` — set config (`cursor-api-key`, `cursor-email`,
-  `prompt-sync`).
-  Bare `hacklab config` prints the effective values and where each came from.
-- `hacklab project` — agent help for publishing a project to your profile.
-  `project add --title "…" [--repo <git url>] [--url <live url>] [--desc "…"]`
-  posts it (`--json` for agents); one of `--repo`/`--url` is required. `--repo`
-  takes any git host; a github.com `--url` with no `--repo` is treated as the
-  repo. A github repo is probed for visibility so a private one stays hidden on
-  the web; `--private`/`--public` override that. Re-run with the same title to
-  update. `project list` shows yours, `project view <slug>` prints one full
-  page, and `project edit <slug> [--title/--desc/--repo/--url/--private/--public]`
-  changes fields — editing a GitHub-synced project ends that sync, so it needs
-  `--yes`. `project delete <slug>` removes one; it confirms first, and `--yes`
-  is required when there's no terminal to ask (scripts, agents, `--json`).
-- `hacklab essay` — agent help for posting an essay. `essay post --title "…"
-  --content <md>` publishes it (`--file <path.md>`, or a bare `<path.md>`, for
-  a file on disk; `--json` for agents). `essay update <id>` replaces the body at
-  the same URL. `essay list` shows yours — `essay list <handle>` a hacker's,
-  `essay list org <slug>` an org's, `--page N` for more. `essay view <id>` reads
-  one essay. `essay delete <id>` removes one of yours; like `project delete` it
-  confirms first and needs `--yes` when nothing can ask.
-- `hacklab org` — hub for company management. If you already own a company, pick
-  a field, type the new value, and it saves as you go. If you don't own one yet,
-  it offers to claim or create. Subcommands: `hacklab org claim` (take ownership
-  of a YC-seeded company you're a member of, or whose domain matches your login
-  email) and `hacklab org create` (register a brand-new company from the CLI).
-- `hacklab org access` — manage who controls a company, and at what level.
-  Several people can be on one company's access list, at one of two roles:
-  **admin**, who can do everything (edit the profile, change this list, post
-  jobs), and **recruiter**, who can only reach `hacklab org jobs`. Bare `org
-  access` (or `org access list`) shows everyone and their role; `org access
-  grant <handle> [--role admin|recruiter]` adds someone (defaulting to admin —
-  re-granting an existing person changes their role); `org access revoke
-  <handle>` removes them — including yourself, though the last remaining
-  **admin** can't be removed or demoted. Only admins change the list; a
-  recruiter can stand down but nothing else. Use `--org <slug>` when you're on
-  more than one, and `--json` on any of them for agents.
-- `hacklab org jobs` — your company's Job Shop listings. Bare `org jobs` (or
-  `org jobs list`) shows every listing you've posted and its status; `org jobs
-  view <id>` reads one; `org jobs post` creates one, interactively or from
-  flags (`--role`, `--description`, `--apply-url`, `--contact`, plus optional
-  `--company`, `--company-url`, `--salary`, `--work-style`, `--min-belt`);
-  `org jobs close <id>` takes a live one down early. A listing costs
-  **$1,000**, so `post` can't finish in the terminal — it creates the listing
-  and hands back a Stripe checkout link to open. Once that's paid we review it
-  before it goes live, and it runs for 30 days. Admins and recruiters both
-  reach all of this; `--json` on any subcommand for agents.
-- `hacklab jobs` — browse the Job Shop. Bare `hacklab jobs` (or `jobs list`,
-  with `--limit 1-100`) lists what's hiring; `jobs view <id>` reads one listing
-  in full with its apply link. Read-only — posting is `hacklab org jobs post`.
-  `hacklab jo` resolves to `jobs`.
-- `hacklab profile` — view and edit your own profile. Bare `profile` (or
-  `profile view`) shows it; `profile edit` is an org-style autosave editor;
-  `profile set <field> <value>` writes one field (`--clear` unsets, handles like
-  `x mattbratos` become full links); `profile set https://x.com/mattbratos`
-  picks the field from the host (x, youtube, instagram, goodreads); `profile
-  set readme --file profile.md` writes a long Markdown README without shell
-  quoting; `profile apply profile.yaml` writes many fields in one shot. Fields:
-  `name`, `bio`, `readme`, `website`, `blog`, `x`, `youtube`, `instagram`,
-  `goodreads`, `rss`, `open-to-work`.
-  Add `--json` to `view`/`set`/`apply` for machine-readable output.
-- `hacklab hacker <username> --json` — read the rich agent profile including
-  links, counts, skills, recent projects, essays, and drops.
-- `hacklab hackathon` — RSVP, team up, and submit for a hacklab hackathon. Each
-  event has a challenge mode — `open` (build anything, no theme or tracks),
-  `theme` (one subject everyone builds to), or `tracks` (teams each pick one
-  of several) — and the organizer may keep the theme/track list hidden from
-  participants until the hackathon starts.
-  `hackathon list [--past]` shows upcoming (or past) events; `hackathon view
-  <slug>` shows one event's phase, highlights its next deadline (RSVP
-  closes / teams lock / tracks lock / submissions due), and shows the
-  challenge — the theme/tracks if revealed, or a note that it's announced
-  when the hackathon starts; `hackathon rsvp <slug> [--token <t>]` RSVPs (an
-  invite link from the organizer also works if you're not on the invite
-  list); `hackathon invite <slug> --file <path>` or `--emails
-  a@b.com,c@d.com` sends invites and lists every rejected line; `hackathon
-  team create <slug> --name "X" [--summary S] [--max N] [--closed]` starts a
-  team, `team join <slug> <teamSlug>` requests to join one, `team
-  accept|reject <slug> <teamSlug> <handle>` decides a request, and `team list
-  <slug>` lists teams; `hackathon track <slug> <teamSlug> <trackSlug>` sets a
-  team's track (refused once the challenge is locked, or if this hackathon
-  has no tracks); `hackathon tracks <slug>` prints the theme or track list on
-  its own, honouring the same reveal rule; `hackathon submit <slug>
-  <teamSlug> --title T --description D [--repo/--video/--site/--track]`
-  submits a project; `hackathon export <slug> [--format csv|json] [--out
-  <path>]` downloads the participant list (this contains personal data —
-  handle exported files carefully). Every subcommand takes `--json` for
-  agents.
-- `hacklab --version` / `hacklab --help`.
-
-## Cursor usage
-
-Cursor is the one tool whose local data can't give exact numbers. Without a key
-the scanner estimates from Cursor's commit-tracking database (AI lines written
-× 30, all attributed to today, so no real daily history). With a key it reads
-exact per-event token counts and real dates from Cursor's API.
-
-Supply a key three ways, highest priority first:
+Requires Bun 1.4.2 or newer.
 
 ```sh
-hacklab --cursor-api-key <key> sync    # flag: one run
-CURSOR_API_KEY=<key> hacklab sync      # env var: one shell / CI
-hacklab config cursor-api-key <key>    # config file: persists
+bun add --global hacklab@beta
+hacklab --help
 ```
 
-`--cursor-email <email>` / `CURSOR_EMAIL` / `hacklab config cursor-email` set the
-account email, which resolves independently of the key. **If your key is a team
-key, set the email.** Cursor's usage endpoint returns every team member's events
-otherwise, and all of it would land on your profile as your own.
-
-If a key is set but Cursor rejects it, the scan says so and falls back to the
-local estimate — it won't quietly hand you an estimate you think is exact.
-
-## Prompt sync
-
-`sync` can also track *how* you prompt, not just how many tokens you burned.
-With it on, the same minutely tick that pushes your token counts also pushes
-prompt metadata — so your profile shows your coding sessions, how many you run
-at once, and your prompt counts, kept current rather than once a day. Every
-full sync carries whatever is still outstanding too, so a machine with no
-daemon gets its prompt activity up by running `hacklab sync` by hand. The daily
-full sync also adds a histogram of your prompt lengths — every bar an exact
-word count, and everything past the end of the axis as a list of length/count
-pairs instead, so a tail of unusually long prompts keeps its real lengths
-rather than piling into a final catch-all bar — and a prompt count per project.
-Sources are local Claude Code transcripts (`~/.claude/projects`), GitHub Copilot
-transcripts, and readable Antigravity CLI/IDE logs.
-
-**Only what you actually typed counts.** A transcript records far more than
-your prompts, and a lot of it is stored in the same shape: a background
-subagent's report, the body of a skill that got invoked, the echo of a slash
-command and its output, the marker left when you hit escape, bash-mode
-commands, hook output, and the context Claude Code injects into a turn. Left
-in, those were 39% of the "prompts" and 65% of the words on a typical machine —
-one `/browse` looked like a 7,268-word prompt. The scan drops any entry the
-harness flagged as its own, plus anything that *starts* with one of those
-markers. Starts with, not contains: a real prompt that quotes
-`<command-name>` while asking about it is still your prompt, and still counts.
-
-For Antigravity, an explicit-user-input entry counts only when it contains a
-nonempty `<USER_REQUEST>` body. That body is preserved verbatim, including blank
-lines; surrounding metadata, model-setting changes, and artifact-comment prose
-are excluded from both word counts and the `full`-tier sample. Empty request
-bodies, including artifact approvals, do not count as prompts. `created_at` is
-the preferred timestamp, with a valid `timestamp` as fallback. If neither is
-valid, the prompt stays undated — no timestamp is inferred.
-
-Nothing conversation-derived leaves your machine until you say so. The first
-interactive `sync` asks and remembers the answer for the disclosed sources.
-Adding IDE chats requires fresh consent from anyone whose previous answer
-covered only Claude Code; an earlier `none` remains a refusal. Until you answer
-again, unattended sync uploads tokens only. There are three tiers:
+Sign in at [Hacklab](https://beta.hacklab.so/?onboarding=1) and copy the agent instructions. They include a one-hour credential scoped to your profile. Keep it private and pass it as `HACKLAB_ONBOARDING_TOKEN` in the upload command's environment.
 
-| Tier    | What leaves your machine |
-| ------- | ------------------------ |
-| `none`  | token counts only — nothing prompt-related |
-| `stats` | + prompt counts, word counts, timestamps and session ids, synced continuously, plus the length histogram and per-project counts. Your prompt text never leaves the machine |
-| `full`  | + a rolling sample of your most recent prompts (≤20k chars) sent with the daily sync, used only to estimate a technical-level score and then discarded server-side. Never stored |
+## Preview a profile
 
-Project counts currently come from Claude Code and are matched by git `origin`
-remote, so a project count only lands on a project you've already added to
-hacklab. Missing remotes skip **project attribution**, not the aggregate prompt
-statistics or the separately consented text sample.
-
-Answer up front, without the prompt — the agent-friendly path:
-
-```sh
-hacklab sync --share-prompt-sync         # metadata only
-hacklab sync --share-prompt-sync=full    # metadata + prompt sample
-hacklab sync --no-share-prompt-sync      # refuse
-```
-
-Change or revoke it any time:
+Create a local JSON file containing a one-line `bio` (at most 160 characters) and a `socials` object. Supported social keys are `github`, `linkedin`, `x`, `instagram`, `youtube`, `huggingface`, `producthunt`, and `goodreads`. Use full HTTPS profile URLs. Omitted links remain unchanged; `null` removes a link.
 
 ```sh
-hacklab config prompt-sync none    # stop syncing; nothing further is uploaded
-hacklab config                     # show the current tier
+hacklab onboard --file /path/to/profile.json
 ```
 
-The unattended daily sync and the minutely tick never ask. A machine that has
-never answered uploads token counts only.
-
-## IDE and agent-chat coverage
-
-**Copilot and Antigravity are token harnesses**, like Claude Code and Codex.
-They contribute to total tokens, daily usage, model breakdowns, rank, and arena.
-A Claude model used through Copilot counts under Copilot, not Claude Code.
-Model totals are another view of the same tokens, never an extra addition.
-No tokens are estimated from prompts, quota, subscription spend, or context size.
-
-| Source | Token usage | Consented prompts |
-| ------ | ----------- | ----------------- |
-| GitHub Copilot CLI | Persisted `session.shutdown.modelMetrics` in `${COPILOT_HOME:-~/.copilot}/session-state/<session-id>/events.jsonl`; available after shutdown. Supported local trace exports can supply completed calls before the next shutdown. | User messages in the same events file; synthetic user events excluded. |
-| GitHub Copilot in VS Code Stable / Insiders | Native Copilot `chat` spans in `User/globalStorage/github.copilot-chat/agent-traces.db` (including user profiles) or configured local OTel JSONL exports. Telemetry must already be enabled; ordinary chat transcripts do not contain usage. | Agent JSONL in `User/workspaceStorage/<workspace>/github.copilot-chat/transcripts/`; only the Copilot producer and user messages count. |
-| Antigravity CLI / GUI | `~/.gemini/{antigravity-cli,antigravity,antigravity-ide}/conversations/<UUID>.db`, where the supported SQLite `steps.metadata` usage schema exists. | Readable `brain/<UUID>/.system_generated/logs/transcript_full.jsonl` or `transcript.jsonl` under those roots, when present in the explicit-user-input format. Full transcript preferred; copies not counted together. |
-| Android Studio's built-in Gemini | Not supported: no reliable local, attributable usage schema was established. API/account dashboards can include other clients and cannot safely be counted as Studio usage. | Not supported. Saved Prompt Library entries are templates, not chat activity. |
-
-### Accounting and deduplication
-
-- Copilot shutdown counters are cumulative across resumed sessions. Count the
-  first snapshot and then only positive growth, dated to each shutdown.
-  `inputTokens` includes cache reads/writes; `outputTokens` includes reasoning.
-  Never add nested `agentMetrics` to the same root totals.
-- Copilot trace exports count only completed `chat` calls with an identifiable
-  native Copilot owning agent. Root `invoke_agent` totals, metrics, and duplicate
-  log events are not extra usage. File/SQLite copies share trace/span IDs and are
-  deduplicated. Calls already covered by a session/model shutdown are suppressed;
-  later resumed calls remain until the next shutdown covers them.
-- Claude/Codex agent delegates are excluded from Copilot telemetry so their native
-  scanners own that usage. This is about the **agent**, not the model: BYOK Claude
-  calls under a native Copilot agent still count as Copilot.
-- Antigravity counts uncached input + cached input + total output. Thinking and
-  visible-answer fields are output subsets, not additions. Response IDs identify
-  duplicate generations; conversation UUID + step index is the fallback when no
-  response ID exists. Numeric model enums remain `antigravity-model-<id>` rather
-  than being assigned an unverified model name.
-
-### Local telemetry and coverage limits
-
-Hacklab never enables telemetry or overwrites harness settings. For VS Code,
-`github.copilot.chat.otel.dbSpanExporter.enabled` enables the local trace DB;
-alternatively use the documented OTel file exporter with an absolute
-`github.copilot.chat.otel.outfile`. The scanner reads that setting from default
-user/profile JSONC files, `${COPILOT_HOME:-~/.copilot}/otel/**/*.jsonl`, and
-`COPILOT_OTEL_FILE_EXPORTER_PATH` when supplied to Hacklab. Prompt/response content
-capture is **not needed**. Broken exporter records containing only `{}` cannot
-provide usage; prefer the local trace DB on affected VS Code versions.
-JSONL parsing supports the direct ReadableSpan form emitted by VS Code. The
-standalone CLI's exact exporter serialization is not a documented stable
-contract; unrecognized record forms are ignored, not interpreted as estimates.
-
-VS Code roots are `%APPDATA%/Code[ - Insiders]` on Windows,
-`~/Library/Application Support/Code[ - Insiders]` on macOS, and
-`${XDG_CONFIG_HOME:-~/.config}/Code[ - Insiders]` on Linux. Custom user-data roots,
-remote hosts, other Copilot IDEs, and generic chat exports are not swept.
-Trace calls wait for an identifiable completed owning-agent span. Unknown
-schemas/owners are not guessed. The read-only SQLite reader observes the main
-database; recent WAL-only writes become visible after the harness checkpoints.
-Antigravity's DB schema is reverse-engineered, not a vendor stability guarantee;
-opaque `.pb` histories and unsupported transcript formats remain unreadable.
-
-Only retained history is available. VS Code prompt transcripts normally retain
-20 sessions per workspace plus active sessions; trace DB retention is also
-bounded. Missing prompt timestamps allow a histogram and `full`-tier sample,
-but **never** dated activity. Token records need their own real timestamp.
-The minutely tick fingerprints snapshot sources and replaces changed aggregates,
-not adds the whole snapshot again. Full syncs rebuild the same sources. Prompt
-sharing remains separately consented; incremental state contains no prompt text.
-
-Storage evidence:
-[Copilot usage schema](https://github.com/github/copilot-sdk/blob/main/nodejs/src/generated/session-events.ts),
-[shutdown/cache semantics](https://ccusage.com/guide/copilot/),
-[VS Code telemetry](https://code.visualstudio.com/docs/agents/guides/monitoring-agents),
-[VS Code trace DB](https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/platform/otel/node/sqlite/otelSqliteStore.ts),
-[VS Code transcript writer](https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/extension/chat/vscode-node/sessionTranscriptService.ts),
-[Antigravity DB metadata](https://github.com/Eneasf/antigravity-token-dashboard/blob/main/docs/TELEMETRY_SPEC.md),
-[CLI/GUI schema audit](https://github.com/mjacobs/agy-reader/blob/main/COMPATIBILITY.md),
-[readable Antigravity exporter](https://github.com/mehdawimohamed/antigravity-conversation-exporter/blob/main/export_chat.py),
-[Android Studio API-key usage](https://developer.android.com/studio/gemini/add-api-key).
-
-## Choosing a backend
+This validates and previews locally without making a network request.
 
-Every command resolves which backend to talk to by the same precedence:
+## Upload after approval
 
-1. **`--env <name>`** on the command line (highest);
-2. **`HACKLAB_APP_URL`** set in the environment;
-3. **the backend you logged into** (saved in the session file);
-4. **production** (`https://hacklab.so`) by default.
+Review the exact bio and links first. Agents must ask the user for approval before using `--confirm-upload`.
 
-```bash
-hacklab login --env development    # http://localhost:3000
-hacklab drop "hi" --env dev        # the override applies to every command, not just login
-```
-
-`--env` accepts the named backends `production` and `development` (any
-unambiguous abbreviation — `prod`, `dev` — plus the aliases `local`/`localhost`
-for development). Under the hood it just sets `HACKLAB_APP_URL` for that run, so
-an explicit `--env` overrides an inherited `HACKLAB_APP_URL`. To target any other
-backend, set `HACKLAB_APP_URL` to its base URL directly:
-
-```bash
-HACKLAB_APP_URL=https://your-backend.example.com hacklab login
+```sh
+hacklab onboard --file /path/to/profile.json --confirm-upload
 ```
 
-Note that **sessions are per-backend**: your token is only valid on the backend
-you logged into. Overriding `--env` (or `HACKLAB_APP_URL`) to a backend you
-haven't authenticated against will 401 until you `hacklab login` there.
-`hacklab whoami` shows the effective backend and warns when it differs from where
-you logged in.
-
-## Environment
-
-- `HACKLAB_APP_URL` — explicit app base URL (read from the real environment; the
-  CLI does not load any `.env` file). A command-line `--env` sets this for the
-  run, so `--env` wins over an inherited value. See **Choosing a backend** for
-  the full precedence.
-- `HACKLAB_SESSION_PATH` — custom path for the session file
-  (default `~/.hacklab/session.json`).
-- `HACKLAB_DEV` — set to `1` to mark this as a developer run. `hacklab whoami`
-  then always prints the backend host, including production (which it otherwise
-  leaves out as noise). `0`, `false`, empty and unset are off.
-- `HACKLAB_NO_UPDATE_CHECK` — set to any value to disable the once-a-day
-  "newer version available" nudge. The check is already skipped for piped /
-  scripted / `--json` runs; this turns it off for interactive runs too.
-- `POSTHOG_API_KEY` / `POSTHOG_HOST` — override the built-in (public) analytics
-  project/host. Set `HACKLAB_NO_TELEMETRY` (or the cross-tool `DO_NOT_TRACK`) to
-  disable anonymous usage analytics entirely.
-
-## Signing in
-
-`hacklab login` uses a **device flow**, everywhere (desktop or headless): it
-prints a short code and a URL like `https://hacklab.so/cli/login?code=857F-61CE`.
-Open that on any device with a browser; the code is prefilled. Approve the login —
-you sign in to Hacklab there with GitHub
-or Google, and if you don't have an account yet you create one on the spot. The
-terminal picks up the session as soon as you approve. No local server, no port
-forwarding, no localhost/app URL.
+Only the bio and social links are uploaded. The CLI does not scan projects or upload source code, local paths, session transcripts, or usage statistics.
 
 ## Local development
 
-Requires Node 20+ and [pnpm](https://pnpm.io). From the repo root:
+From the Hacklab repository:
 
-```bash
-pnpm install
-pnpm dev <command>     # run from source (tsx, no build), e.g. `pnpm dev chat`
-pnpm build             # compile to dist/
-pnpm test              # run the vitest suite
-```
-
-`pnpm dev` is `tsx src/index.ts`, so it defaults to the **production** backend
-like the published package. Point it elsewhere per-command with `--env
-development` (localhost) or `HACKLAB_APP_URL=<url>`. Use a throwaway session to
-avoid touching a real account:
-
-```bash
-HACKLAB_SESSION_PATH=/tmp/hl-test.json pnpm dev login --env development
+```sh
+bun install --frozen-lockfile
+bunx turbo run build --filter=hacklab
+cd packages/cli
+bun link
+hacklab onboard --file /path/to/profile.json --url http://localhost:3000
 ```
 
-## Telemetry
-
-The CLI sends anonymous usage analytics to a dedicated, public PostHog project
-(the write-only project key ships in the published package). It is opt-out: set
-`HACKLAB_NO_TELEMETRY=1` or the cross-tool `DO_NOT_TRACK=1` to disable it. See
-`src/posthog.ts`.
-
-## License
-
-[MIT](./LICENSE) © Homebrew Hackers Club inc
+Use instructions and a credential from the local onboarding dialog. Credentials are bound to their issuing origin and cannot be used interchangeably between localhost and production.

package/dist/index.js

@@ -1,24 +1,133 @@
-#!/usr/bin/env node
-// Minimal launcher. It checks the Node version using ONLY built-ins, then
-// dynamically imports the real CLI — so nothing that needs a Node 20+ API is
-// even *linked* until the guard passes. The real entry (cli.ts) pulls in
-// @clack/core, which statically imports `styleText` from node:util (Node 20.12+);
-// on Node 18 that fails to link with a cryptic SyntaxError *before* any code
-// runs, so the version check has to happen here, ahead of that import graph.
-//
-// npm only warns (doesn't block) on an `engines` mismatch, and version-manager
-// users can switch to an old Node after installing — so this runtime guard is
-// the real gate, not package.json.
-const major = Number(process.versions.node.split('.')[0]);
-if (Number.isFinite(major) && major < 20) {
-    console.error(`hacklab requires Node 20 or newer (you have ${process.versions.node}).`);
-    console.error('Using a version manager (nvm/fnm/volta)? Activate Node 20+ in your shell, then: npm install -g hacklab@latest');
-    process.exit(1);
+#!/usr/bin/env bun
+// @bun
+
+// src/index.ts
+import { parseArgs } from "util";
+// package.json
+var version = "26.921.1";
+
+// src/onboard.ts
+function normalizeOrigin(value) {
+  const url = new URL(value);
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.protocol !== "https:" && !(local && url.protocol === "http:"))
+    throw new Error("Use an HTTPS Hacklab origin, or HTTP localhost for development.");
+  return url.origin;
+}
+async function onboard(options) {
+  const origin = normalizeOrigin(options.origin);
+  const file = Bun.file(options.file);
+  if (file.size > 8192)
+    throw new Error("Profile must be smaller than 8 KB.");
+  const profile = await file.json();
+  if (!profile || typeof profile !== "object" || Array.isArray(profile) || Object.keys(profile).some((key) => !["bio", "socials"].includes(key)) || typeof profile.bio !== "string" || !profile.bio.trim() || profile.bio.trim().length > 160 || /[\r\n]/.test(profile.bio) || !profile.socials || typeof profile.socials !== "object" || Array.isArray(profile.socials))
+    throw new Error("Expected a one-line bio (1\u2013160 characters) and a socials object, with no other fields.");
+  const hosts = {
+    github: ["github.com"],
+    linkedin: ["linkedin.com"],
+    x: ["x.com", "twitter.com"],
+    instagram: ["instagram.com"],
+    youtube: ["youtube.com"],
+    huggingface: ["huggingface.co"],
+    producthunt: ["producthunt.com"],
+    goodreads: ["goodreads.com"]
+  };
+  for (const [platform, value] of Object.entries(profile.socials)) {
+    if (!Object.hasOwn(hosts, platform))
+      throw new Error(`Unsupported social platform: ${platform}`);
+    if (value === null)
+      continue;
+    if (typeof value !== "string" || value.length > 500)
+      throw new Error(`Invalid ${platform} profile URL.`);
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname === "/" || !hosts[platform].includes(url.hostname.replace(/^www\./, ""))) {
+      throw new Error(`Use an HTTPS ${platform} profile URL.`);
+    }
+  }
+  const payload = JSON.stringify({ bio: profile.bio.trim(), socials: profile.socials }, null, 2);
+  console.log(`Hacklab profile preview for ${origin}:
+${payload}`);
+  if (!options.confirmUpload) {
+    console.log("Nothing uploaded. Ask the user to approve this exact profile, then run again with --confirm-upload.");
+    return;
+  }
+  const token = Bun.env.HACKLAB_ONBOARDING_TOKEN;
+  if (!token)
+    throw new Error("Set HACKLAB_ONBOARDING_TOKEN from the signed-in onboarding dialog.");
+  let claims;
+  try {
+    claims = JSON.parse(Buffer.from(token.split(".")[0], "base64url").toString());
+  } catch {
+    throw new Error("Invalid onboarding token. Copy fresh agent instructions.");
+  }
+  if (claims.audience !== origin || typeof claims.expiresAt !== "number" || claims.expiresAt <= Date.now()) {
+    throw new Error("Onboarding token is expired or belongs to another Hacklab origin. Copy fresh agent instructions.");
+  }
+  const response = await fetch(`${origin}/api/onboarding`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: payload,
+    redirect: "error",
+    signal: AbortSignal.timeout(30000)
+  });
+  if (!response.ok) {
+    throw new Error(`Hacklab rejected the profile (HTTP ${response.status}). Check the profile and token before retrying.`);
+  }
+  const result = await response.json();
+  if (result.ok !== true)
+    throw new Error("Hacklab did not confirm the update. Check the website before retrying.");
+  console.log("Your Hacklab bio and social links were saved.");
+}
+
+// src/index.ts
+var help = `Hacklab CLI
+
+Usage:
+  hacklab onboard --file <profile.json> [--url <origin>] [--confirm-upload]
+  hacklab --help
+  hacklab --version
+
+Onboarding:
+  --file            Local JSON containing bio and socials
+  --url             Hacklab origin (default: https://beta.hacklab.so)
+  --confirm-upload  Upload only after the user approves the exact profile
+
+Without --confirm-upload, onboard validates and previews locally without uploading.
+Uploads require HACKLAB_ONBOARDING_TOKEN from the signed-in onboarding dialog.
+Bun 1.4.2 or newer is required.`;
+try {
+  const { values, positionals } = parseArgs({
+    args: Bun.argv.slice(2),
+    options: {
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" },
+      file: { type: "string" },
+      url: { type: "string" },
+      "confirm-upload": { type: "boolean" }
+    },
+    allowPositionals: true
+  });
+  if (positionals.length > 1 || positionals[0] && positionals[0] !== "onboard") {
+    throw new Error("Unknown command. Use hacklab onboard or hacklab --help.");
+  }
+  if (values.help) {
+    console.log(help);
+  } else if (values.version) {
+    console.log(version);
+  } else if (positionals[0] === "onboard") {
+    if (!values.file)
+      throw new Error("Pass --file with the local profile JSON to preview or upload.");
+    await onboard({
+      file: values.file,
+      origin: values.url ?? "https://beta.hacklab.so",
+      confirmUpload: values["confirm-upload"] ?? false
+    });
+  } else if (values.file || values.url || values["confirm-upload"]) {
+    throw new Error("Profile options require the onboard command.");
+  } else {
+    console.log(help);
+  }
+} catch (error) {
+  console.error(error instanceof Error ? error.message : "Could not run Hacklab CLI.");
+  process.exitCode = 1;
 }
-// Defer the real CLI (and its Node 20+ import graph) until after the guard.
-import('./cli.js').catch((err) => {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-});
-export {};
-//# sourceMappingURL=index.js.map