hacklab 0.22.3 → 26.921.2

package/README.md

@@ -1,453 +1,77 @@
-# hacklab
+# Hacklab CLI
 
-The terminal-native way to join [Hacklab](https://hacklab.so) — a social network
-for AI-native hackers. Sign in to Hacklab, scan your local AI token usage, share
-a card.
+A CLI for updating your Hacklab bio and social links with your coding agent.
 
-## Install
+Requires Node.js 22 or newer. Bun 1.4.2 or newer is also supported.
 
-Install, then run setup:
-
-```bash
-curl -fsSL https://hacklab.so/install | sh
-hacklab setup
+```sh
+npm install --global hacklab@beta
+hacklab --help
 ```
 
-The script checks for Node 20+ and installs the CLI globally — that's all it
-does. After it, `hacklab` is a real command on your PATH, and `hacklab setup` is
-the guided first run: it scans this machine's AI usage, signs you in to Hacklab,
-uploads your usage, and starts the background sync. If you already have Node 20
-or newer (including a version manager), you can skip the script:
-
-```bash
-npm i -g hacklab@latest
-hacklab setup
-```
+For Bun, use `bun install --global hacklab@beta` and `bunx --bun hacklab@beta --help`.
 
-`login`, `scan`, and `sync` all still exist as standalone commands for re-running
-one piece on its own.
+Copy the agent instructions from the signed-in onboarding dialog. They contain no credentials. When you upload, the CLI opens a browser page to sign in with GitHub and authorize the CLI through Better Auth. Check that the code matches your terminal before approving.
 
-### Windows
+## Preview a profile
 
-On native Windows (PowerShell), use the `.ps1` installer instead — it checks
-for Node 20+ and installs the CLI globally, then points you at `hacklab setup`:
+Create a local JSON file containing a one-line `bio` (at most 160 characters) and a `socials` object. Supported social keys are `github`, `linkedin`, `x`, `instagram`, `youtube`, `huggingface`, `producthunt`, and `goodreads`. Use full HTTPS profile URLs. Omitted links remain unchanged; `null` removes a link.
 
-```powershell
-irm https://hacklab.so/install.ps1 | iex
+```sh
+hacklab onboard --file /path/to/profile.json
 ```
 
-The CLI reads your agents' usage from your Windows home (`%USERPROFILE%\.claude`,
-`.codex`, `.grok`, and Cursor's native tracking DB), and `hacklab daemon` registers the
-background sync as two Task Scheduler tasks. If you run Claude Code or Codex
-**inside WSL**, install there instead with the `curl … | sh` command above, run
-from your WSL shell.
-
-The installer also enables local PowerShell scripts for your user
-(`Set-ExecutionPolicy -Scope CurrentUser RemoteSigned`) so the `hacklab` command
-runs. If you install manually instead (`npm i -g hacklab@latest`) and PowerShell
-says *"running scripts is disabled on this system"*, run that one line yourself,
-or call `hacklab.cmd …` (which no execution policy blocks).
-
-The `curl | sh` installer itself only installs — it never touches your session.
+This validates and previews locally without making a network request.
 
-The CLI prints a one-line nudge when a newer version is published (checked at
-most once a day); update with `npm i -g hacklab@latest`.
+## Upload after approval
 
-## Scan
+Review the exact bio and links first. Agents must ask the user for approval before using `--confirm-upload`.
 
+```sh
+hacklab onboard --file /path/to/profile.json --confirm-upload
 ```
-login → scan this machine → upload → receipt → share on X → daemon on
-```
-
-`hacklab scan` requires `hacklab login`. It reads local AI token usage from
-Claude Code, Codex, Cursor, OpenClaw, Hermes, OpenCode, Grok Build, GitHub Copilot,
-and Antigravity, uploads it to your profile, and prints a text usage receipt
-without displaying a card or image in the terminal. Then it asks whether to
-share a card on X, using the live account's rank, belt, and streak.
-A successful scan summons the daemon so the card stays current; `hacklab scan
---no-daemon` skips the schedule, and `hacklab daemon off` tears it down.
-Skip the whole command if this computer isn't yours — it would upload that
-machine's usage to your profile. Cursor users with no API key are offered one
-(local Cursor data is only an estimate).
-
-## Commands
-
-- `hacklab setup` — the guided first run: scan, sign-in, one question
-  about syncing your prompt activity, upload, background sync on. Safe to
-  re-run; it checks your saved session with the server first, skips whatever is
-  already done, and stops early once everything is. If that session has expired
-  or been revoked it signs you in again instead of reporting you as set up; if
-  the server can't be reached it says so and carries on with what's on disk.
-- `hacklab scan` — scan this machine, upload to your profile, share the card.
-  Requires login. Summons the daemon afterwards (`--no-daemon` to skip).
-- `hacklab sync` — re-scan local AI usage and sync it to your profile.
-- `hacklab daemon` — summon the daemon: two OS-native background jobs (launchd on
-  macOS, systemd user timers on Linux, Task Scheduler tasks on Windows) so your
-  tokens, rank, and streak stay current without you running anything. A **tick
-  every minute** reads only what your tools appended since the last run — no
-  network call at all on a minute where nothing happened — and a **full sync once
-  a day** re-scans everything and repairs whatever the tick missed. With prompt
-  sync on (see below), the same minutely read also pushes your prompt activity.
-  No daemon, no streak. Re-running it is idempotent; `hacklab daemon off` tears both down, and
-  `hacklab logout` removes them too. On a platform we can't schedule (BSD, a
-  locked-down box) it prints the commands to schedule yourself instead of
-  pretending it worked. `hacklab sync --install-daily` still forwards here.
-- `hacklab whoami` — show who you're logged in as.
-- `hacklab drop "message"` — post a drop to your feed (`-u <url>` to attach a
-  link). Human output prints its profile URL; `--json` returns a stable envelope
-  (`schemaVersion`, `id`, `path`, full `url`).
-- `hacklab chat` — open the live channel (typing posts; this is the default, so
-  bare `hacklab chat` and `hacklab chat live` are the same). Other subcommands:
-  `tail`, `post`, `history`, `dms`, `dm <handle>`, `flag`. Author handles are
-  coloured by belt rank. Add `--json` to any non-interactive subcommand for
-  machine-readable output an agent can drive.
-- `hacklab login` — sign in to Hacklab (creates an account if you don't have one).
-- `hacklab logout` — clear your saved session on this machine.
-- `hacklab config <key> <value>` — set config (`cursor-api-key`, `cursor-email`,
-  `prompt-sync`).
-  Bare `hacklab config` prints the effective values and where each came from.
-- `hacklab project` — agent help for publishing a project to your profile.
-  `project add --title "…" [--repo <git url>] [--url <live url>] [--desc "…"]`
-  posts it (`--json` for agents); one of `--repo`/`--url` is required. `--repo`
-  takes any git host; a github.com `--url` with no `--repo` is treated as the
-  repo. A github repo is probed for visibility so a private one stays hidden on
-  the web; `--private`/`--public` override that. Re-run with the same title to
-  update. `project list` shows yours, `project view <slug>` prints one full
-  page, and `project edit <slug> [--title/--desc/--repo/--url/--private/--public]`
-  changes fields — editing a GitHub-synced project ends that sync, so it needs
-  `--yes`. `project delete <slug>` removes one; it confirms first, and `--yes`
-  is required when there's no terminal to ask (scripts, agents, `--json`).
-- `hacklab essay` — agent help for posting an essay. `essay post --title "…"
-  --content <md>` publishes it (`--file <path.md>`, or a bare `<path.md>`, for
-  a file on disk; `--json` for agents). `essay update <id>` replaces the body at
-  the same URL. `essay list` shows yours — `essay list <handle>` a hacker's,
-  `essay list org <slug>` an org's, `--page N` for more. `essay view <id>` reads
-  one essay. `essay delete <id>` removes one of yours; like `project delete` it
-  confirms first and needs `--yes` when nothing can ask.
-- `hacklab org` — hub for company management. If you already own a company, pick
-  a field, type the new value, and it saves as you go. If you don't own one yet,
-  it offers to claim or create. Subcommands: `hacklab org claim` (take ownership
-  of a YC-seeded company you're a member of, or whose domain matches your login
-  email) and `hacklab org create` (register a brand-new company from the CLI).
-- `hacklab org access` — manage who controls a company, and at what level.
-  Several people can be on one company's access list, at one of two roles:
-  **admin**, who can do everything (edit the profile, change this list, post
-  jobs), and **recruiter**, who can only reach `hacklab org jobs`. Bare `org
-  access` (or `org access list`) shows everyone and their role; `org access
-  grant <handle> [--role admin|recruiter]` adds someone (defaulting to admin —
-  re-granting an existing person changes their role); `org access revoke
-  <handle>` removes them — including yourself, though the last remaining
-  **admin** can't be removed or demoted. Only admins change the list; a
-  recruiter can stand down but nothing else. Use `--org <slug>` when you're on
-  more than one, and `--json` on any of them for agents.
-- `hacklab org jobs` — your company's Job Shop listings. Bare `org jobs` (or
-  `org jobs list`) shows every listing you've posted and its status; `org jobs
-  view <id>` reads one; `org jobs post` creates one, interactively or from
-  flags (`--role`, `--description`, `--apply-url`, `--contact`, plus optional
-  `--company`, `--company-url`, `--salary`, `--work-style`, `--min-belt`);
-  `org jobs close <id>` takes a live one down early. A listing costs
-  **$1,000**, so `post` can't finish in the terminal — it creates the listing
-  and hands back a Stripe checkout link to open. Once that's paid we review it
-  before it goes live, and it runs for 30 days. Admins and recruiters both
-  reach all of this; `--json` on any subcommand for agents.
-- `hacklab jobs` — browse the Job Shop. Bare `hacklab jobs` (or `jobs list`,
-  with `--limit 1-100`) lists what's hiring; `jobs view <id>` reads one listing
-  in full with its apply link. Read-only — posting is `hacklab org jobs post`.
-  `hacklab jo` resolves to `jobs`.
-- `hacklab profile` — view and edit your own profile. Bare `profile` (or
-  `profile view`) shows it; `profile edit` is an org-style autosave editor;
-  `profile set <field> <value>` writes one field (`--clear` unsets, handles like
-  `x mattbratos` become full links); `profile set https://x.com/mattbratos`
-  picks the field from the host (x, youtube, instagram, goodreads); `profile
-  set readme --file profile.md` writes a long Markdown README without shell
-  quoting; `profile apply profile.yaml` writes many fields in one shot. Fields:
-  `name`, `bio`, `readme`, `website`, `blog`, `x`, `youtube`, `instagram`,
-  `goodreads`, `rss`, `open-to-work`.
-  Add `--json` to `view`/`set`/`apply` for machine-readable output.
-- `hacklab hacker <username> --json` — read the rich agent profile including
-  links, counts, skills, recent projects, essays, and drops.
-- `hacklab hackathon` — RSVP, team up, and submit for a hacklab hackathon. Each
-  event has a challenge mode — `open` (build anything, no theme or tracks),
-  `theme` (one subject everyone builds to), or `tracks` (teams each pick one
-  of several) — and the organizer may keep the theme/track list hidden from
-  participants until the hackathon starts.
-  `hackathon list [--past]` shows upcoming (or past) events; `hackathon view
-  <slug>` shows one event's phase, highlights its next deadline (RSVP
-  closes / teams lock / tracks lock / submissions due), and shows the
-  challenge — the theme/tracks if revealed, or a note that it's announced
-  when the hackathon starts; `hackathon rsvp <slug> [--token <t>]` RSVPs (an
-  invite link from the organizer also works if you're not on the invite
-  list); `hackathon invite <slug> --file <path>` or `--emails
-  a@b.com,c@d.com` sends invites and lists every rejected line; `hackathon
-  team create <slug> --name "X" [--summary S] [--max N] [--closed]` starts a
-  team, `team join <slug> <teamSlug>` requests to join one, `team
-  accept|reject <slug> <teamSlug> <handle>` decides a request, and `team list
-  <slug>` lists teams; `hackathon track <slug> <teamSlug> <trackSlug>` sets a
-  team's track (refused once the challenge is locked, or if this hackathon
-  has no tracks); `hackathon tracks <slug>` prints the theme or track list on
-  its own, honouring the same reveal rule; `hackathon submit <slug>
-  <teamSlug> --title T --description D [--repo/--video/--site/--track]`
-  submits a project; `hackathon export <slug> [--format csv|json] [--out
-  <path>]` downloads the participant list (this contains personal data —
-  handle exported files carefully). Every subcommand takes `--json` for
-  agents.
-- `hacklab --version` / `hacklab --help`.
-
-## Cursor usage
 
-Cursor is the one tool whose local data can't give exact numbers. Without a key
-the scanner estimates from Cursor's commit-tracking database (AI lines written
-× 30, all attributed to today, so no real daily history). With a key it reads
-exact per-event token counts and real dates from Cursor's API.
+Confirmed onboarding first syncs usage, then saves the profile, sharing one browser authorization. Approval must cover both the profile and the usage report. Preview mode does neither. If syncing fails, onboarding stops before saving the profile.
 
-Supply a key three ways, highest priority first:
+## Sync usage
 
 ```sh
-hacklab --cursor-api-key <key> sync    # flag: one run
-CURSOR_API_KEY=<key> hacklab sync      # env var: one shell / CI
-hacklab config cursor-api-key <key>    # config file: persists
+hacklab sync
 ```
 
-`--cursor-email <email>` / `CURSOR_EMAIL` / `hacklab config cursor-email` set the
-account email, which resolves independently of the key. **If your key is a team
-key, set the email.** Cursor's usage endpoint returns every team member's events
-otherwise, and all of it would land on your profile as your own.
+The CLI includes pinned `ccusage@20.0.24` and runs `ccusage session --json`. No separate ccusage installation is needed. Its stdout is posted unchanged to `/api/token-usage`. This report includes agent/session identifiers, tokens, costs, model breakdowns, and metadata, which can include project paths. Source code and transcript contents are not uploaded.
 
-If a key is set but Cursor rejects it, the scan says so and falls back to the
-local estimate — it won't quietly hand you an estimate you think is exact.
+The API accepts the exact `{ session, totals }` envelope. `token_usage` stores each session with the upstream camelCase field names and nested JSON unchanged; only the authenticated `user_id` is added by the server. Totals are validated but not stored because they can be derived from the session rows. Repeated syncs replace counts for the same user, agent, and period rather than adding them. Missing sessions are retained, so syncing another machine does not delete earlier uploads. Reports are limited to 20 MB. The first upload uses browser authorization. Later commands reuse the saved session, checking that it is still valid; expired or revoked sessions open the browser again. Credentials are stored per Hacklab origin in `~/.config/hacklab/credentials/`, with owner-only directory and file permissions on Unix. Run `hacklab logout` to forget local authorization for the current Hacklab server.
 
-## Prompt sync
-
-`sync` can also track *how* you prompt, not just how many tokens you burned.
-With it on, the same minutely tick that pushes your token counts also pushes
-prompt metadata — so your profile shows your coding sessions, how many you run
-at once, and your prompt counts, kept current rather than once a day. Every
-full sync carries whatever is still outstanding too, so a machine with no
-daemon gets its prompt activity up by running `hacklab sync` by hand. The daily
-full sync also adds a histogram of your prompt lengths — every bar an exact
-word count, and everything past the end of the axis as a list of length/count
-pairs instead, so a tail of unusually long prompts keeps its real lengths
-rather than piling into a final catch-all bar — and a prompt count per project.
-Sources are local Claude Code transcripts (`~/.claude/projects`), GitHub Copilot
-transcripts, and readable Antigravity CLI/IDE logs.
-
-**Only what you actually typed counts.** A transcript records far more than
-your prompts, and a lot of it is stored in the same shape: a background
-subagent's report, the body of a skill that got invoked, the echo of a slash
-command and its output, the marker left when you hit escape, bash-mode
-commands, hook output, and the context Claude Code injects into a turn. Left
-in, those were 39% of the "prompts" and 65% of the words on a typical machine —
-one `/browse` looked like a 7,268-word prompt. The scan drops any entry the
-harness flagged as its own, plus anything that *starts* with one of those
-markers. Starts with, not contains: a real prompt that quotes
-`<command-name>` while asking about it is still your prompt, and still counts.
-
-For Antigravity, an explicit-user-input entry counts only when it contains a
-nonempty `<USER_REQUEST>` body. That body is preserved verbatim, including blank
-lines; surrounding metadata, model-setting changes, and artifact-comment prose
-are excluded from both word counts and the `full`-tier sample. Empty request
-bodies, including artifact approvals, do not count as prompts. `created_at` is
-the preferred timestamp, with a valid `timestamp` as fallback. If neither is
-valid, the prompt stays undated — no timestamp is inferred.
-
-Nothing conversation-derived leaves your machine until you say so. The first
-interactive `sync` asks and remembers the answer for the disclosed sources.
-Adding IDE chats requires fresh consent from anyone whose previous answer
-covered only Claude Code; an earlier `none` remains a refusal. Until you answer
-again, unattended sync uploads tokens only. There are three tiers:
-
-| Tier    | What leaves your machine |
-| ------- | ------------------------ |
-| `none`  | token counts only — nothing prompt-related |
-| `stats` | + prompt counts, word counts, timestamps and session ids, synced continuously, plus the length histogram and per-project counts. Your prompt text never leaves the machine |
-| `full`  | + a rolling sample of your most recent prompts (≤20k chars) sent with the daily sync, used only to estimate a technical-level score and then discarded server-side. Never stored |
-
-Project counts currently come from Claude Code and are matched by git `origin`
-remote, so a project count only lands on a project you've already added to
-hacklab. Missing remotes skip **project attribution**, not the aggregate prompt
-statistics or the separately consented text sample.
-
-Answer up front, without the prompt — the agent-friendly path:
-
-```sh
-hacklab sync --share-prompt-sync         # metadata only
-hacklab sync --share-prompt-sync=full    # metadata + prompt sample
-hacklab sync --no-share-prompt-sync      # refuse
-```
-
-Change or revoke it any time:
+## Log in
 
 ```sh
-hacklab config prompt-sync none    # stop syncing; nothing further is uploaded
-hacklab config                     # show the current tier
+hacklab login
 ```
 
-The unattended daily sync and the minutely tick never ask. A machine that has
-never answered uploads token counts only.
-
-## IDE and agent-chat coverage
+Authorizes the CLI and saves the session without collecting or uploading usage. An existing valid session is reused. To check the authorization dialog again, run `hacklab logout` followed by `hacklab login`.
 
-**Copilot and Antigravity are token harnesses**, like Claude Code and Codex.
-They contribute to total tokens, daily usage, model breakdowns, rank, and arena.
-A Claude model used through Copilot counts under Copilot, not Claude Code.
-Model totals are another view of the same tokens, never an extra addition.
-No tokens are estimated from prompts, quota, subscription spend, or context size.
+## Log out
 
-| Source | Token usage | Consented prompts |
-| ------ | ----------- | ----------------- |
-| GitHub Copilot CLI | Persisted `session.shutdown.modelMetrics` in `${COPILOT_HOME:-~/.copilot}/session-state/<session-id>/events.jsonl`; available after shutdown. Supported local trace exports can supply completed calls before the next shutdown. | User messages in the same events file; synthetic user events excluded. |
-| GitHub Copilot in VS Code Stable / Insiders | Native Copilot `chat` spans in `User/globalStorage/github.copilot-chat/agent-traces.db` (including user profiles) or configured local OTel JSONL exports. Telemetry must already be enabled; ordinary chat transcripts do not contain usage. | Agent JSONL in `User/workspaceStorage/<workspace>/github.copilot-chat/transcripts/`; only the Copilot producer and user messages count. |
-| Antigravity CLI / GUI | `~/.gemini/{antigravity-cli,antigravity,antigravity-ide}/conversations/<UUID>.db`, where the supported SQLite `steps.metadata` usage schema exists. | Readable `brain/<UUID>/.system_generated/logs/transcript_full.jsonl` or `transcript.jsonl` under those roots, when present in the explicit-user-input format. Full transcript preferred; copies not counted together. |
-| Android Studio's built-in Gemini | Not supported: no reliable local, attributable usage schema was established. API/account dashboards can include other clients and cannot safely be counted as Studio usage. | Not supported. Saved Prompt Library entries are templates, not chat activity. |
-
-### Accounting and deduplication
-
-- Copilot shutdown counters are cumulative across resumed sessions. Count the
-  first snapshot and then only positive growth, dated to each shutdown.
-  `inputTokens` includes cache reads/writes; `outputTokens` includes reasoning.
-  Never add nested `agentMetrics` to the same root totals.
-- Copilot trace exports count only completed `chat` calls with an identifiable
-  native Copilot owning agent. Root `invoke_agent` totals, metrics, and duplicate
-  log events are not extra usage. File/SQLite copies share trace/span IDs and are
-  deduplicated. Calls already covered by a session/model shutdown are suppressed;
-  later resumed calls remain until the next shutdown covers them.
-- Claude/Codex agent delegates are excluded from Copilot telemetry so their native
-  scanners own that usage. This is about the **agent**, not the model: BYOK Claude
-  calls under a native Copilot agent still count as Copilot.
-- Antigravity counts uncached input + cached input + total output. Thinking and
-  visible-answer fields are output subsets, not additions. Response IDs identify
-  duplicate generations; conversation UUID + step index is the fallback when no
-  response ID exists. Numeric model enums remain `antigravity-model-<id>` rather
-  than being assigned an unverified model name.
-
-### Local telemetry and coverage limits
-
-Hacklab never enables telemetry or overwrites harness settings. For VS Code,
-`github.copilot.chat.otel.dbSpanExporter.enabled` enables the local trace DB;
-alternatively use the documented OTel file exporter with an absolute
-`github.copilot.chat.otel.outfile`. The scanner reads that setting from default
-user/profile JSONC files, `${COPILOT_HOME:-~/.copilot}/otel/**/*.jsonl`, and
-`COPILOT_OTEL_FILE_EXPORTER_PATH` when supplied to Hacklab. Prompt/response content
-capture is **not needed**. Broken exporter records containing only `{}` cannot
-provide usage; prefer the local trace DB on affected VS Code versions.
-JSONL parsing supports the direct ReadableSpan form emitted by VS Code. The
-standalone CLI's exact exporter serialization is not a documented stable
-contract; unrecognized record forms are ignored, not interpreted as estimates.
-
-VS Code roots are `%APPDATA%/Code[ - Insiders]` on Windows,
-`~/Library/Application Support/Code[ - Insiders]` on macOS, and
-`${XDG_CONFIG_HOME:-~/.config}/Code[ - Insiders]` on Linux. Custom user-data roots,
-remote hosts, other Copilot IDEs, and generic chat exports are not swept.
-Trace calls wait for an identifiable completed owning-agent span. Unknown
-schemas/owners are not guessed. The read-only SQLite reader observes the main
-database; recent WAL-only writes become visible after the harness checkpoints.
-Antigravity's DB schema is reverse-engineered, not a vendor stability guarantee;
-opaque `.pb` histories and unsupported transcript formats remain unreadable.
-
-Only retained history is available. VS Code prompt transcripts normally retain
-20 sessions per workspace plus active sessions; trace DB retention is also
-bounded. Missing prompt timestamps allow a histogram and `full`-tier sample,
-but **never** dated activity. Token records need their own real timestamp.
-The minutely tick fingerprints snapshot sources and replaces changed aggregates,
-not adds the whole snapshot again. Full syncs rebuild the same sources. Prompt
-sharing remains separately consented; incremental state contains no prompt text.
-
-Storage evidence:
-[Copilot usage schema](https://github.com/github/copilot-sdk/blob/main/nodejs/src/generated/session-events.ts),
-[shutdown/cache semantics](https://ccusage.com/guide/copilot/),
-[VS Code telemetry](https://code.visualstudio.com/docs/agents/guides/monitoring-agents),
-[VS Code trace DB](https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/platform/otel/node/sqlite/otelSqliteStore.ts),
-[VS Code transcript writer](https://github.com/microsoft/vscode/blob/main/extensions/copilot/src/extension/chat/vscode-node/sessionTranscriptService.ts),
-[Antigravity DB metadata](https://github.com/Eneasf/antigravity-token-dashboard/blob/main/docs/TELEMETRY_SPEC.md),
-[CLI/GUI schema audit](https://github.com/mjacobs/agy-reader/blob/main/COMPATIBILITY.md),
-[readable Antigravity exporter](https://github.com/mehdawimohamed/antigravity-conversation-exporter/blob/main/export_chat.py),
-[Android Studio API-key usage](https://developer.android.com/studio/gemini/add-api-key).
-
-## Choosing a backend
-
-Every command resolves which backend to talk to by the same precedence:
-
-1. **`--env <name>`** on the command line (highest);
-2. **`HACKLAB_APP_URL`** set in the environment;
-3. **the backend you logged into** (saved in the session file);
-4. **production** (`https://hacklab.so`) by default.
-
-```bash
-hacklab login --env development    # http://localhost:3000
-hacklab drop "hi" --env dev        # the override applies to every command, not just login
-```
-
-`--env` accepts the named backends `production` and `development` (any
-unambiguous abbreviation — `prod`, `dev` — plus the aliases `local`/`localhost`
-for development). Under the hood it just sets `HACKLAB_APP_URL` for that run, so
-an explicit `--env` overrides an inherited `HACKLAB_APP_URL`. To target any other
-backend, set `HACKLAB_APP_URL` to its base URL directly:
-
-```bash
-HACKLAB_APP_URL=https://your-backend.example.com hacklab login
+```sh
+hacklab logout
+hacklab sync
 ```
 
-Note that **sessions are per-backend**: your token is only valid on the backend
-you logged into. Overriding `--env` (or `HACKLAB_APP_URL`) to a backend you
-haven't authenticated against will 401 until you `hacklab login` there.
-`hacklab whoami` shows the effective backend and warns when it differs from where
-you logged in.
-
-## Environment
-
-- `HACKLAB_APP_URL` — explicit app base URL (read from the real environment; the
-  CLI does not load any `.env` file). A command-line `--env` sets this for the
-  run, so `--env` wins over an inherited value. See **Choosing a backend** for
-  the full precedence.
-- `HACKLAB_SESSION_PATH` — custom path for the session file
-  (default `~/.hacklab/session.json`).
-- `HACKLAB_DEV` — set to `1` to mark this as a developer run. `hacklab whoami`
-  then always prints the backend host, including production (which it otherwise
-  leaves out as noise). `0`, `false`, empty and unset are off.
-- `HACKLAB_NO_UPDATE_CHECK` — set to any value to disable the once-a-day
-  "newer version available" nudge. The check is already skipped for piped /
-  scripted / `--json` runs; this turns it off for interactive runs too.
-- `POSTHOG_API_KEY` / `POSTHOG_HOST` — override the built-in (public) analytics
-  project/host. Set `HACKLAB_NO_TELEMETRY` (or the cross-tool `DO_NOT_TRACK`) to
-  disable anonymous usage analytics entirely.
-
-## Signing in
-
-`hacklab login` uses a **device flow**, everywhere (desktop or headless): it
-prints a short code and a URL like `https://hacklab.so/cli/login?code=857F-61CE`.
-Open that on any device with a browser; the code is prefilled. Approve the login —
-you sign in to Hacklab there with GitHub
-or Google, and if you don't have an account yet you create one on the spot. The
-terminal picks up the session as soon as you approve. No local server, no port
-forwarding, no localhost/app URL.
+Logout clears the saved CLI credential for the current Hacklab server, even when offline. The next sync opens the authorization dialog on the Arena again. Your browser stays signed in. Other Hacklab servers' credentials are preserved; this command does not revoke the server session.
 
 ## Local development
 
-Requires Node 20+ and [pnpm](https://pnpm.io). From the repo root:
+Building from source requires Bun 1.4.2 or newer; the published package runs with Node.js without Bun.
 
-```bash
-pnpm install
-pnpm dev <command>     # run from source (tsx, no build), e.g. `pnpm dev chat`
-pnpm build             # compile to dist/
-pnpm test              # run the vitest suite
-```
-
-`pnpm dev` is `tsx src/index.ts`, so it defaults to the **production** backend
-like the published package. Point it elsewhere per-command with `--env
-development` (localhost) or `HACKLAB_APP_URL=<url>`. Use a throwaway session to
-avoid touching a real account:
+From the Hacklab repository:
 
-```bash
-HACKLAB_SESSION_PATH=/tmp/hl-test.json pnpm dev login --env development
+```sh
+bun install --frozen-lockfile
+bun run --cwd packages/cli build:dev
+cd packages/cli
+bun link
+hacklab onboard --file /path/to/profile.json
 ```
 
-## Telemetry
-
-The CLI sends anonymous usage analytics to a dedicated, public PostHog project
-(the write-only project key ships in the published package). It is opt-out: set
-`HACKLAB_NO_TELEMETRY=1` or the cross-tool `DO_NOT_TRACK=1` to disable it. See
-`src/posthog.ts`.
-
-## License
-
-[MIT](./LICENSE) © Homebrew Hackers Club inc
+Source runs and `build:dev` always use `http://localhost:3000`. Production builds embed `BETTER_AUTH_URL` from the build environment or `apps/web/.env` / `.env.local`; it must be an HTTPS origin. Set the production URL before running `bun run build` or publishing. No `--url` override is supported. Credentials are saved locally for reuse and are never copied into the prompt. Development and production credentials are stored separately.