mostcracked 1.0.0

package/README.md

@@ -0,0 +1,46 @@
+# mostcracked
+
+The global **coding-agent leaderboard** — [mostcracked.com](https://mostcracked.com).
+
+Sign in with GitHub, and every prompt you send and every file your agent edits
+scores you a point. Works with Claude Code and Codex. Live on the web dashboard
+and right in your terminal statusline.
+
+It counts **prompts** and **file edits** via your agent's own hooks. It sends
+**counts and metadata only, never your code**.
+
+```
+🥇  jay      prompts 128   edits 94   score 222
+🥈  ada      prompts 111   edits 80   score 191
+🥉  linus    prompts  76   edits 60   score 136
+```
+
+## Get on the board
+
+```bash
+npx mostcracked login
+```
+
+Sign in with GitHub (device flow: enter a one-time code at
+`github.com/login/device`, or reuse your `gh` CLI session), restart your agent,
+and your prompts and edits start counting. Check your rank anytime with
+`npx mostcracked status` or at [mostcracked.com](https://mostcracked.com).
+
+New machine? Just `npx mostcracked login` again. GitHub is your identity, so
+there's nothing else to recover.
+
+**No fresh start at the bottom:** on sign-in it offers to backfill your last 7
+days from your local agent history — per-day **counts only, never your code**,
+one shot per account.
+
+**Stays fresh by itself:** the installed hook quietly picks up new versions of
+these scripts. You never run `update` by hand.
+
+To stop: `npx mostcracked leave`.
+
+## Privacy
+
+- Identity is real GitHub auth (`read:user` scope — public profile only). It
+  can't touch your code, repos, or orgs.
+- Only event counts leave your machine. No prompts, no diffs, no file
+  contents. Ever.

package/bin/ccrank.mjs

@@ -0,0 +1,555 @@
+#!/usr/bin/env node
+// ccrank CLI — sign in with GitHub, create/join rooms, and (un)install the
+// Claude Code hooks. Zero dependencies, no build step.
+//
+// USER-PRIMARY model: your GitHub account is the identity; all your prompts
+// and edits form ONE global stream. Rooms are just groupings you're a member of.
+//
+// Identity is REAL GitHub auth: we get a GitHub access token (from the gh CLI
+// if you're signed in, else GitHub's device flow) and the server verifies it
+// with api.github.com before minting a session. No username squatting possible.
+
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync, existsSync } from "node:fs";
+import { scanHistory } from "../lib/backfill.mjs";
+import { recordApplied } from "../lib/update-check.mjs";
+import { execSync, spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(HERE, "..");
+const CC_DIR = join(homedir(), ".ccrank");                 // our config + hook scripts live here
+const CFG = join(CC_DIR, "config.json");
+const CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
+const CODEX_HOOKS = join(homedir(), ".codex", "hooks.json"); // Codex reads lifecycle hooks here
+
+// Default server. Overridable with --server <url> or CCRANK_SERVER env.
+const DEFAULT_SERVER = process.env.CCRANK_SERVER || "https://mostcracked.com";
+
+// GitHub OAuth app client id for the device flow (public by design, not a
+// secret — it only identifies the "ccrank" OAuth app). Overridable for forks.
+const GH_CLIENT_ID = process.env.CCRANK_GH_CLIENT_ID || "Ov23lipQUJVMvnQ2gTh2";
+
+// ---- tiny arg parsing ----------------------------------------------------
+const [cmd, ...rest] = process.argv.slice(2);
+const flags = {};
+const pos = [];
+for (let i = 0; i < rest.length; i++) {
+  if (rest[i].startsWith("--")) flags[rest[i].slice(2)] = rest[++i];
+  else pos.push(rest[i]);
+}
+const server = (flags.server || DEFAULT_SERVER).replace(/\/$/, "");
+
+// Which coding agent(s) to wire: 'claude' (default), 'codex', or 'both'.
+// Scores merge across agents; this only decides which config files we touch.
+// An explicit --agent wins; otherwise reuse whatever was installed before (so
+// `ccrank update` on a codex/both setup doesn't silently drop back to claude).
+const AGENT = ["claude", "codex", "both"].includes(flags.agent)
+  ? flags.agent
+  : (loadConfig()?.agent || "claude");
+const wantClaude = AGENT === "claude" || AGENT === "both";
+const wantCodex = AGENT === "codex" || AGENT === "both";
+const agentLabel = AGENT === "codex" ? "Codex" : AGENT === "both" ? "Claude Code and Codex" : "Claude Code";
+function restartMsg() {
+  return c.dim(`  Restart ${agentLabel} (or open a new session) to activate.\n`);
+}
+
+const c = { dim: (s) => `\x1b[2m${s}\x1b[0m`, y: (s) => `\x1b[33m${s}\x1b[0m`,
+            g: (s) => `\x1b[32m${s}\x1b[0m`, b: (s) => `\x1b[1m${s}\x1b[0m` };
+
+async function api(path, method = "GET", body) {
+  const res = await fetch(server + path, {
+    method,
+    headers: body ? { "content-type": "application/json" } : {},
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`);
+  return data;
+}
+
+function loadConfig() { try { return JSON.parse(readFileSync(CFG, "utf8")); } catch { return null; } }
+function saveConfig(cfg) { mkdirSync(CC_DIR, { recursive: true }); writeFileSync(CFG, JSON.stringify(cfg, null, 2)); }
+
+// Personalized board URL: ?me=<github_id> lets the dashboard highlight the
+// viewer's own row. The id is PUBLIC (it's in every leaderboard row) and only
+// drives a cosmetic highlight — never put tokens or secrets in URLs.
+function withMe(url, cfg) {
+  if (!cfg?.githubId) return url;
+  return url + (url.includes("?") ? "&" : "?") + "me=" + cfg.githubId;
+}
+
+// Best-effort "open in browser" — silent on failure (SSH/headless/CI), the
+// printed link always covers those cases.
+function openBrowser(url) {
+  try {
+    const [bin, args] = process.platform === "darwin" ? ["open", [url]]
+      : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
+      : ["xdg-open", [url]];
+    const child = spawn(bin, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch { return false; }
+}
+
+// ---- GitHub auth ---------------------------------------------------------
+
+// Shortcut: you're signed into the gh CLI — its token identifies you without
+// the browser step. We OFFER it; device flow remains the canonical path.
+function ghCliToken() {
+  try {
+    const out = execSync("gh auth token", { stdio: ["ignore", "pipe", "ignore"], timeout: 4000 })
+      .toString().trim();
+    return /^(gho|ghp|ghu|github_pat)_[A-Za-z0-9_]+$/.test(out) ? out : null;
+  } catch { return null; }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// One y/n question on the terminal; non-interactive runs take the default.
+async function askYesNo(question, def = true) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return def;
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const a = (await rl.question(`  ${question} ${def ? "[Y/n]" : "[y/N]"} `)).trim().toLowerCase();
+    return a === "" ? def : a === "y" || a === "yes";
+  } finally { rl.close(); }
+}
+
+// Copy text to the OS clipboard, best-effort and silent on failure.
+function toClipboard(text) {
+  try {
+    const [bin, args] = process.platform === "darwin" ? ["pbcopy", []]
+      : process.platform === "win32" ? ["clip", []]
+      : ["xclip", ["-selection", "clipboard"]];
+    const child = spawn(bin, args, { stdio: ["pipe", "ignore", "ignore"] });
+    child.on("error", () => {});
+    child.stdin.on("error", () => {});
+    child.stdin.write(text); child.stdin.end();
+    return true;
+  } catch { return false; }
+}
+
+// GitHub device flow. The CLI does ALL the legwork itself — opens the GitHub
+// page in the browser AND puts the code in the clipboard — so the user just
+// pastes and clicks. The printed code is the fallback for SSH/headless.
+// scope read:user: public profile only; can't touch code, repos, or orgs.
+async function deviceFlowToken() {
+  const start = await (await fetch("https://github.com/login/device/code", {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ client_id: GH_CLIENT_ID, scope: "read:user" }),
+  })).json();
+  if (!start?.device_code) { fail("Could not start GitHub sign-in. Try again."); return null; }
+
+  const uri = start.verification_uri || "https://github.com/login/device";
+  const copied = toClipboard(start.user_code);
+  const opened = openBrowser(uri);
+  // Native notification so the code reaches the user even if this output is
+  // buried (e.g. an agent ran us in the background and forgot to relay it).
+  if (process.platform === "darwin") {
+    try {
+      const note = `Code ${start.user_code} ${copied ? "copied, just paste it" : ""} on the GitHub page`;
+      spawn("osascript", ["-e",
+        `display notification ${JSON.stringify(note)} with title "ccrank" subtitle "GitHub sign-in"`],
+        { detached: true, stdio: "ignore" }).unref();
+    } catch { /* cosmetic */ }
+  }
+  console.log(`\n  Sign in with GitHub to prove who you are.`);
+  if (opened) console.log(`  ${c.g("✓")} GitHub just opened in your browser.${copied ? ` The code's in your clipboard, so just paste it.` : ""}`);
+  console.log(`\n    Code:  ${c.y(start.user_code)}${copied ? c.dim("  (copied to clipboard)") : ""}`);
+  console.log(`    Page:  ${c.b(uri)}${opened ? c.dim("  (already open)") : ""}`);
+  console.log(c.dim(`\n  Tip: GitHub's green Authorize button wakes up after a second or two.`));
+  console.log(c.dim(`  Waiting for you to authorize (Ctrl-C to abort)…`));
+
+  let interval = (start.interval || 5) * 1000;
+  const deadline = Date.now() + Math.min((start.expires_in || 900) * 1000, 10 * 60 * 1000);
+  while (Date.now() < deadline) {
+    await sleep(interval);
+    const res = await (await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        client_id: GH_CLIENT_ID,
+        device_code: start.device_code,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    })).json().catch(() => ({}));
+    if (res.access_token) return res.access_token;
+    if (res.error === "authorization_pending") continue;
+    if (res.error === "slow_down") { interval += 5000; continue; }
+    if (res.error === "access_denied") { fail("GitHub sign-in was denied."); return null; }
+    if (res.error === "expired_token") break;
+  }
+  fail("GitHub sign-in timed out. Run the command again.");
+  return null;
+}
+
+// Ensure we have a GitHub-verified session: reuse the saved one, else sign in.
+// Returns the config object (NOT yet saved), or null on failure.
+async function ensureUser({ force = false } = {}) {
+  const prev = loadConfig();
+  if (!force && prev?.token && prev?.login) return { ...prev, server: prev.server || server };
+
+  let ghToken = null;
+  const cliToken = ghCliToken();
+  if (cliToken && (await askYesNo("You're signed into the gh CLI. Sign in to ccrank with it (skips the browser step)?"))) {
+    ghToken = cliToken;
+  }
+  if (!ghToken) ghToken = await deviceFlowToken();
+  if (!ghToken) return null;
+  try {
+    const res = await api("/api/login", "POST", { ghToken });
+    return {
+      server, token: res.token, githubId: res.githubId || null,
+      login: res.login, avatar: res.avatar || null,
+      reclaimed: !!res.reclaimed,
+      roomCode: prev?.roomCode || null, roomName: prev?.roomName || null,
+      wrappedStatusLine: prev?.wrappedStatusLine || null,
+    };
+  } catch (e) {
+    if (e.message === "github_rejected") {
+      fail(`GitHub didn't accept that sign-in. Try again (or "gh auth login" first if you use the gh CLI).`);
+      return null;
+    }
+    throw e;
+  }
+}
+
+// ---- install plumbing ----------------------------------------------------
+
+// Copy hook.mjs + statusline.mjs into ~/.ccrank so Claude Code can run them.
+function installScripts() {
+  mkdirSync(CC_DIR, { recursive: true });
+  for (const f of ["hook.mjs", "statusline.mjs", "update-check.mjs"])
+    copyFileSync(join(PKG_ROOT, "lib", f), join(CC_DIR, f));
+}
+
+// Record which version is now installed so the auto-update check doesn't
+// spawn a pointless update. `update --applied-version <v>` knows exactly (the
+// auto-updater pins the version it ran; legacy pre-npm updaters pass
+// --applied-sha); every other path asks the server, best-effort — worst case
+// is one redundant background update tomorrow.
+async function recordVersion() {
+  if (flags["applied-version"]) { recordApplied(flags["applied-version"]); return; }
+  if (flags["applied-sha"]) { recordApplied(flags["applied-sha"]); return; }
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 2500);
+  try {
+    const res = await fetch(server + "/api/client-version", { signal: ctrl.signal });
+    const v = (await res.json())?.version;
+    if (v) recordApplied(v);
+  } catch { /* cosmetic */ } finally { clearTimeout(timer); }
+}
+
+// Remove any ccrank hook entries from a settings/hooks object, in place. Run
+// before re-adding so upgrades never leave a stale command behind (e.g. the
+// old source-less `hook.mjs prompt` alongside the new `hook.mjs prompt claude`,
+// which would double-count).
+function purgeHooks(s) {
+  for (const ev of Object.keys(s.hooks || {})) {
+    s.hooks[ev] = (s.hooks[ev] || []).filter((g) => !JSON.stringify(g).includes("hook.mjs"));
+    if (!s.hooks[ev].length) delete s.hooks[ev];
+  }
+}
+
+// Build the two hook entries for a given agent's hook object. `source` is baked
+// into the command so the same hook.mjs reports the right agent. `editMatcher`
+// differs per agent (Codex edits are apply_patch).
+function addHooks(s, source, editMatcher) {
+  s.hooks ||= {};
+  const hookCmd = (arg) => `node "${join(CC_DIR, "hook.mjs")}" ${arg} ${source}`;
+  const push = (event, matcher, arg) => {
+    s.hooks[event] ||= [];
+    const entry = { hooks: [{ type: "command", command: hookCmd(arg) }] };
+    if (matcher) entry.matcher = matcher;
+    s.hooks[event].push(entry);
+  };
+  push("UserPromptSubmit", null, "prompt");
+  push("PostToolUse", editMatcher, "edit");
+}
+
+// Merge our hooks (and statusline) into ~/.claude/settings.json, non-destructively.
+function wireClaude() {
+  let s = {};
+  if (existsSync(CLAUDE_SETTINGS)) {
+    try { s = JSON.parse(readFileSync(CLAUDE_SETTINGS, "utf8")); }
+    catch { throw new Error(`Could not parse ${CLAUDE_SETTINGS}. Fix or move it, then re-run.`); }
+  } else {
+    mkdirSync(dirname(CLAUDE_SETTINGS), { recursive: true });
+  }
+  purgeHooks(s);
+  addHooks(s, "claude", "Edit|Write|MultiEdit");
+
+  // Statusline: preserve any existing one by wrapping it.
+  const ourStatus = `node "${join(CC_DIR, "statusline.mjs")}"`;
+  let wrapped = null;
+  const existing = s.statusLine;
+  if (existing && existing.command && !existing.command.includes("statusline.mjs")) {
+    wrapped = existing.command; // first install: capture the user's real statusline
+  } else if (existing && existing.command) {
+    // Re-run: our statusline is already installed. Don't treat it as the
+    // user's original — keep whatever original we captured the first time.
+    wrapped = loadConfig()?.wrappedStatusLine || null;
+  }
+  s.statusLine = { type: "command", command: ourStatus };
+  return { settings: s, wrapped };
+}
+
+// Merge our hooks into ~/.codex/hooks.json (same schema as Claude's, JSON so no
+// TOML editing). Codex edits go through apply_patch. No statusline concept.
+function wireCodex() {
+  let s = {};
+  if (existsSync(CODEX_HOOKS)) {
+    try { s = JSON.parse(readFileSync(CODEX_HOOKS, "utf8")); }
+    catch { throw new Error(`Could not parse ${CODEX_HOOKS}. Fix or move it, then re-run.`); }
+  } else {
+    mkdirSync(dirname(CODEX_HOOKS), { recursive: true });
+  }
+  purgeHooks(s);
+  addHooks(s, "codex", "apply_patch|Edit|Write");
+  return s;
+}
+
+async function finishInstall(cfg) {
+  installScripts();
+  let wrapped = cfg.wrappedStatusLine ?? null;
+  if (wantClaude) {
+    const res = wireClaude();
+    wrapped = res.wrapped ?? wrapped;
+    mkdirSync(dirname(CLAUDE_SETTINGS), { recursive: true });
+    writeFileSync(CLAUDE_SETTINGS, JSON.stringify(res.settings, null, 2));
+  }
+  if (wantCodex) {
+    const cs = wireCodex();
+    mkdirSync(dirname(CODEX_HOOKS), { recursive: true });
+    writeFileSync(CODEX_HOOKS, JSON.stringify(cs, null, 2));
+  }
+  saveConfig({ ...cfg, agent: AGENT, wrappedStatusLine: wrapped });
+  await recordVersion(); // stamp what's installed for the daily auto-update check
+  return wrapped;
+}
+
+// ---- backfill --------------------------------------------------------------
+// One-time import of the last 7 days of local Claude Code history, so a brand
+// new user doesn't debut at the bottom of the board. The scan happens HERE and
+// sends per-day counts only — never your code. Server rules keep it honest:
+// once per GitHub account ever, only days with zero tracked events (so it can
+// never double-count), and the normal daily caps still apply.
+async function offerBackfill(cfg, { explicit = false } = {}) {
+  let scan;
+  try { scan = await scanHistory(7); } catch { return; }
+  if (!scan.days.length) {
+    if (explicit) console.log(`  No Claude Code history found for the last 7 days — nothing to backfill.`);
+    return;
+  }
+  console.log(`\n  Found ${c.b(scan.prompts)} prompts and ${c.b(scan.edits)} file edits in your local`);
+  console.log(`  coding-agent history from the last 7 days (before today). Backfilling`);
+  console.log(`  sends those per-day counts only — ${c.b("never your code")}.`);
+  if (!(await askYesNo("Backfill them onto the board? (one shot per account)"))) {
+    console.log(c.dim(`  Skipped. Changed your mind? "ccrank backfill" — still one shot.`));
+    return;
+  }
+  try {
+    const res = await api("/api/backfill", "POST", { token: cfg.token, days: scan.days });
+    if (res.prompts + res.edits > 0) {
+      console.log(`  ${c.g("✓")} Backfilled ${c.b(res.prompts)} prompts + ${c.b(res.edits)} edits across ${res.days} day${res.days === 1 ? "" : "s"}. No fresh start for you.`);
+    } else {
+      console.log(c.dim(`  Nothing credited — those days already have live-tracked events.`));
+    }
+  } catch (e) {
+    if (e.message === "already_backfilled") {
+      console.log(c.dim(`  This account already used its one backfill — skipping.`));
+    } else {
+      console.log(c.dim(`  Backfill didn't go through (${e.message}). Retry later: ccrank backfill`));
+    }
+  }
+}
+
+async function backfillCmd() {
+  const cfg = loadConfig();
+  if (!cfg?.token) return fail(`Not signed in yet. Run "ccrank login" first.`);
+  await offerBackfill(cfg, { explicit: true });
+}
+
+// ---- commands ------------------------------------------------------------
+
+// Sign in with GitHub and get on the GLOBAL board — no room needed. Also the
+// "new machine" path: GitHub itself is the recovery, so just log in again.
+async function login() {
+  const cfg = await ensureUser({ force: true });
+  if (!cfg) return;
+  const wrapped = await finishInstall(cfg);
+  console.log(`\n  ${c.g("✓")} Signed in as ${c.y(cfg.login)} ${c.dim("(verified by GitHub)")}`);
+  console.log(`  You're on the global board. Every prompt you send and every file`);
+  console.log(`  Claude edits scores you a point. Only counts leave your machine, ${c.b("never your code")}.`);
+  // Send them straight to their board — room if they have one, else global.
+  // The ?me= link is always printed too (SSH/headless can't pop a browser).
+  await offerBackfill(cfg);
+  const boardUrl = withMe(cfg.roomCode ? cfg.server + "/r/" + cfg.roomCode : cfg.server + "/", cfg);
+  const opened = openBrowser(boardUrl);
+  console.log(`\n  Your board${opened ? " (opening in your browser)" : ""}:`);
+  console.log(`  ${c.y(boardUrl)}`);
+  if (!cfg.roomCode) console.log(`\n  Want a private room for your crew? ${c.dim("ccrank create --name \"Room\"  ·  ccrank join <CODE>")}`);
+  if (wrapped) console.log(c.dim(`  (kept your existing statusline; rank is appended to it)`));
+  console.log(restartMsg());
+}
+
+async function create() {
+  const name = flags.name || pos[0] || "My room";
+  const cfg = await ensureUser();
+  if (!cfg) return;
+  let created;
+  try {
+    created = await api("/api/rooms", "POST", { token: cfg.token, name });
+  } catch (e) {
+    if (e.message === "room_name_taken") {
+      console.error(`\n  A room named ${c.y(name)} already exists. Room names must be unique.`);
+      console.error(`  Pick a different name and try again.\n`);
+      process.exitCode = 1;
+      return;
+    }
+    throw e;
+  }
+  const { code } = created;
+  // Creating auto-joins you, so wire everything up right away.
+  const wrapped = await finishInstall({ ...cfg, roomCode: code, roomName: name });
+
+  console.log(`\n  ${c.g("✓")} Signed in as ${c.y(cfg.login)} ${c.dim("(verified by GitHub)")}`);
+  console.log(`  ${c.g("✓")} Room created: ${c.b(name)}. You're in it.`);
+  await offerBackfill(cfg);
+  // Auto-open the room page: shows the board AND teaches this browser the
+  // room code so the site's sidebar can link it from now on.
+  const roomUrl = withMe(cfg.server + "/r/" + code, cfg);
+  const opened = openBrowser(roomUrl);
+  console.log(`  Code:      ${c.y(code)}`);
+  console.log(`  Dashboard${opened ? " (opening)" : ""}: ${c.dim(roomUrl)}`);
+  console.log(`\n  Invite friends. Each of them runs:`);
+  console.log(`    ${c.b(`npx mostcracked join ${code}`)}\n`);
+  if (wrapped) console.log(c.dim(`  (kept your existing statusline; rank is appended to it)`));
+  console.log(restartMsg());
+}
+
+async function joinRoom() {
+  const code = (pos[0] || flags.code || "").toUpperCase();
+  if (!code) return fail("Usage: ccrank join <ROOM_CODE>");
+
+  const cfg = await ensureUser();
+  if (!cfg) return;
+  let res;
+  try {
+    res = await api(`/api/rooms/${code}/join`, "POST", { token: cfg.token });
+  } catch (e) {
+    if (e.message === "invalid token") {
+      // Saved session no longer valid (server reset / signed in elsewhere) —
+      // wipe it; GitHub is the recovery, so signing in again fixes everything.
+      saveConfig({ ...cfg, token: null, login: null });
+      return fail(`Your saved session expired. Run "ccrank login" (or this command again) to sign back in with GitHub.`);
+    }
+    if (e.message === "room not found") return fail(`No room answers to ${code}. Double-check the code.`);
+    throw e;
+  }
+
+  const wrapped = await finishInstall({ ...cfg, roomCode: res.roomCode, roomName: res.roomName });
+
+  console.log(`\n  ${c.g("✓")} Signed in as ${c.y(cfg.login)} ${c.dim("(verified by GitHub)")}`);
+  console.log(`  ${c.g("✓")} Joined ${c.b(res.roomName)}`);
+  await offerBackfill(cfg);
+  const who = res.owner ? `${c.b(res.owner)} invited you to` : `You're in`;
+  console.log(`  ${who} a private room on the global ccrank board.`);
+  console.log(`  Every prompt you send and every file Claude edits scores you a point.`);
+  console.log(`  One global score that follows you into every room. Only counts leave`);
+  console.log(`  your machine, ${c.b("never your code")}.`);
+  // Auto-open the room page: shows the board AND teaches this browser the
+  // room code so the site's sidebar can link it from now on.
+  const roomUrl = withMe(cfg.server + "/r/" + code, cfg);
+  const opened = openBrowser(roomUrl);
+  console.log(`\n  Room board${opened ? " (opening)" : ""}:  ${c.y(roomUrl)}`);
+  console.log(`  Global board:    ${c.dim(withMe(cfg.server + "/", cfg))}`);
+  console.log(`  What is ccrank?  ${c.dim("https://mostcracked.com")}`);
+  if (wrapped) console.log(c.dim(`  (kept your existing statusline; rank is appended to it)`));
+  console.log(restartMsg());
+}
+
+// Pull the latest hook/statusline scripts — no re-auth, same user, counts untouched.
+async function update() {
+  const cfg = loadConfig();
+  if (!cfg?.token) return fail("Not signed in yet. Run: ccrank join <CODE>");
+  await finishInstall(cfg);
+  console.log(`\n  ${c.g("✓")} Updated to the latest ccrank scripts.`);
+  // Existing users get their shot at the one-time backfill here — update is
+  // the path they already run, and the server rules make it safe (only days
+  // with zero tracked events can credit, so it can never double-count).
+  await offerBackfill(cfg);
+  console.log(restartMsg());
+}
+
+async function status() {
+  const cfg = loadConfig();
+  if (!cfg?.token) return console.log("Not signed in yet. Run: ccrank join <CODE>");
+  try {
+    const me = await api(`/api/me?token=${encodeURIComponent(cfg.token)}`);
+    console.log(`\n  ${c.y(me.login)} ${c.dim("·")} global rank ${c.b("#" + me.rank + "/" + me.total)}, score ${c.g(me.score)}`);
+    for (const r of me.rooms || []) {
+      console.log(`  ${c.dim("room")} ${c.b(r.name)} ${c.dim("· " + cfg.server + "/r/" + r.code)}`);
+    }
+    console.log(`  ${c.dim(cfg.server + "/")}\n`);
+  } catch (e) { fail(e.message); }
+}
+
+function leave() {
+  // Remove our hooks from BOTH agents + restore any wrapped statusline. Leaves
+  // config in place. Idempotent — safe to run whatever was installed.
+  const cfg = loadConfig();
+  if (existsSync(CLAUDE_SETTINGS)) {
+    const s = JSON.parse(readFileSync(CLAUDE_SETTINGS, "utf8"));
+    purgeHooks(s);
+    if (s.statusLine?.command?.includes("statusline.mjs")) {
+      if (cfg?.wrappedStatusLine) s.statusLine = { type: "command", command: cfg.wrappedStatusLine };
+      else delete s.statusLine;
+    }
+    writeFileSync(CLAUDE_SETTINGS, JSON.stringify(s, null, 2));
+  }
+  if (existsSync(CODEX_HOOKS)) {
+    const s = JSON.parse(readFileSync(CODEX_HOOKS, "utf8"));
+    purgeHooks(s);
+    writeFileSync(CODEX_HOOKS, JSON.stringify(s, null, 2));
+  }
+  console.log(`  ${c.g("✓")} Removed ccrank hooks. Restart your agent to finish.`);
+}
+
+function fail(msg) { console.error(`  ${msg}`); process.exitCode = 1; }
+
+function help() {
+  console.log(`
+  ${c.b("ccrank")} is the global leaderboard for Claude Code and Codex. Every
+  prompt and edit scores a point. Sign in with GitHub and you're on the board
+  with every ccrank user. Rooms are optional private groups viewing the same
+  scores. Use both agents? Your scores merge into one; the board marks Codex.
+
+  ${c.y("ccrank login")}                   sign in with GitHub, get on the global board
+  ${c.y("ccrank join")} <CODE>              join a private room (logs you in if needed)
+  ${c.y("ccrank create")} --name "Room"    create a room, auto-joins you (logs in if needed)
+  ${c.y("ccrank update")}                  pull the latest scripts (no re-auth)
+  ${c.y("ccrank backfill")}                one-time import of your last 7 days of local
+                                 Claude Code history (counts only, never code)
+  ${c.y("ccrank status")}                  show your global rank + rooms
+  ${c.y("ccrank leave")}                   remove the hooks (both agents)
+
+  Sign-in is GitHub device flow: you enter a one-time code at
+  github.com/login/device (or reuse your gh CLI session if it's signed in).
+  Scope read:user, public profile only. New machine? Just "ccrank login" again.
+
+  Options:
+    --agent <which>   which agent to wire: claude (default), codex, or both.
+                      Claude hooks -> ~/.claude/settings.json; Codex hooks ->
+                      ~/.codex/hooks.json.
+    --server <url>    point at a different ccrank server (or set CCRANK_SERVER)
+`);
+}
+
+const table = { login, create, join: joinRoom, update, status, leave, backfill: backfillCmd, help };
+Promise.resolve((table[cmd] || help)()).catch((e) => fail(e.message));

package/lib/backfill.mjs

@@ -0,0 +1,158 @@
+// ccrank backfill — one-time import of the last 7 days of LOCAL Claude Code
+// history, so a brand-new user doesn't debut at the bottom of the board.
+// Reads the transcripts Claude Code itself writes (~/.claude/projects/**/*.jsonl)
+// and counts prompts + edits the same way the live hook would have. Only
+// per-day COUNTS are produced — message content never leaves this module.
+//
+// Today (UTC) is excluded: the live hooks already count it, and the server
+// additionally refuses any day the user has tracked events on.
+
+import { readdirSync, statSync, createReadStream } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit"]);
+
+// Same line-counting rules as lib/hook.mjs editValue() — a number only.
+function editLines(name, inp) {
+  let text = "";
+  if (name === "Write") text = inp?.content || "";
+  else if (name === "Edit") text = inp?.new_string || "";
+  else if (name === "MultiEdit") text = (inp?.edits || []).map((e) => e?.new_string || "").join("\n");
+  const lines = String(text).split("\n").filter((l) => l.trim().length).length;
+  return Math.max(1, lines);
+}
+
+// A transcript "user" entry that the UserPromptSubmit hook would have fired
+// for: a real typed prompt — not tool results, not meta/compact bookkeeping,
+// not a subagent's inner conversation.
+function isRealPrompt(e) {
+  if (e.type !== "user" || e.isMeta || e.isSidechain || e.isCompactSummary) return false;
+  if (e.userType && e.userType !== "external") return false;
+  const content = e.message?.content;
+  if (typeof content === "string") {
+    return content.trim().length > 0 && !content.startsWith("<local-command-stdout>");
+  }
+  if (Array.isArray(content)) {
+    if (content.some((b) => b?.type === "tool_result")) return false;
+    return content.some((b) => b?.type === "text" && String(b.text || "").trim().length);
+  }
+  return false;
+}
+
+function* jsonlFiles(dir) {
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  for (const ent of entries) {
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) yield* jsonlFiles(p);
+    else if (ent.name.endsWith(".jsonl")) yield p;
+  }
+}
+
+function scanFile(path, start, end, byDay) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: createReadStream(path), crlfDelay: Infinity });
+    rl.on("line", (line) => {
+      let e;
+      try { e = JSON.parse(line); } catch { return; }
+      const ts = Date.parse(e?.timestamp || "");
+      if (!Number.isFinite(ts) || ts < start || ts >= end) return;
+      const day = new Date(ts).toISOString().slice(0, 10);
+      let d = byDay.get(day);
+      if (!d) { d = { day, prompts: 0, edits: 0, lines: 0 }; byDay.set(day, d); }
+      if (isRealPrompt(e)) { d.prompts++; return; }
+      // Edits: PostToolUse fires inside subagents too, so no isSidechain filter.
+      if (e?.type === "assistant" && Array.isArray(e.message?.content)) {
+        for (const b of e.message.content) {
+          if (b?.type === "tool_use" && EDIT_TOOLS.has(b.name)) {
+            d.edits++;
+            d.lines += editLines(b.name, b.input || {});
+          }
+        }
+      }
+    });
+    rl.on("close", resolve);
+    rl.on("error", resolve);
+  });
+}
+
+// ---- Codex (best-effort) ---------------------------------------------------
+// Codex CLI writes rollout files (~/.codex/sessions/**/*.jsonl). The format is
+// Codex-internal and less stable than Claude's, so this parser is deliberately
+// conservative: shapes it doesn't recognize count 0, never garbage. Prompts =
+// durable response_item user messages with real typed text (Codex wraps its
+// injected user_instructions / environment_context in <tags>, so a leading
+// '<' is filtered out). Edits = apply_patch calls, lines = added '+' lines.
+function codexPromptOrEdit(e, d) {
+  const p = e?.payload;
+  if (e?.type !== "response_item" || !p) return;
+  if (p.type === "message" && p.role === "user") {
+    const texts = Array.isArray(p.content)
+      ? p.content.filter((b) => b?.type === "input_text").map((b) => String(b.text || ""))
+      : [];
+    const t = texts.join("").trim();
+    if (t.length && !t.startsWith("<")) d.prompts++;
+    return;
+  }
+  let patch = null;
+  if (p.type === "function_call") {
+    const name = String(p.name || "");
+    const args = String(p.arguments || "");
+    if (name === "apply_patch" || (name === "shell" && args.includes("apply_patch"))) patch = args;
+  } else if (p.type === "custom_tool_call" && String(p.name || "") === "apply_patch") {
+    patch = String(p.input || "");
+  }
+  if (patch != null) {
+    const added = patch.split("\n")
+      .filter((l) => l.startsWith("+") && !l.startsWith("+++") && l.slice(1).trim().length).length;
+    d.edits++;
+    d.lines += Math.max(1, added);
+  }
+}
+
+function scanCodexFile(path, start, end, byDay) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: createReadStream(path), crlfDelay: Infinity });
+    rl.on("line", (line) => {
+      let e;
+      try { e = JSON.parse(line); } catch { return; }
+      const ts = Date.parse(e?.timestamp || "");
+      if (!Number.isFinite(ts) || ts < start || ts >= end) return;
+      const day = new Date(ts).toISOString().slice(0, 10);
+      let d = byDay.get(day);
+      if (!d) { d = { day, prompts: 0, edits: 0, lines: 0 }; byDay.set(day, d); }
+      codexPromptOrEdit(e, d);
+    });
+    rl.on("close", resolve);
+    rl.on("error", resolve);
+  });
+}
+
+async function scanRoot(root, start, end, byDay, scanOne) {
+  for (const file of jsonlFiles(root)) {
+    // A file last touched before the window started can't hold in-window entries.
+    try { if (statSync(file).mtimeMs < start) continue; } catch { continue; }
+    await scanOne(file, start, end, byDay);
+  }
+}
+
+// Scan the last `daysBack` full UTC days (today excluded) of BOTH agents'
+// local history — history is history, whatever agent it came from. Returns
+// { days: [{day, prompts, edits, lines}], prompts, edits, lines } — sorted by
+// day, zero-activity days omitted.
+export async function scanHistory(daysBack = 7) {
+  const end = Date.parse(new Date().toISOString().slice(0, 10) + "T00:00:00Z"); // start of today UTC
+  const start = end - daysBack * 86400000;
+
+  const byDay = new Map();
+  await scanRoot(join(homedir(), ".claude", "projects"), start, end, byDay, scanFile);
+  await scanRoot(join(homedir(), ".codex", "sessions"), start, end, byDay, scanCodexFile);
+
+  const days = [...byDay.values()]
+    .filter((d) => d.prompts + d.edits > 0)
+    .sort((a, b) => (a.day < b.day ? -1 : 1));
+  const sum = (k) => days.reduce((s, d) => s + d[k], 0);
+  return { days, prompts: sum("prompts"), edits: sum("edits"), lines: sum("lines") };
+}

package/lib/hook.mjs

@@ -0,0 +1,79 @@
+// ccrank hook — runs on Claude Code or Codex UserPromptSubmit / PostToolUse.
+// Sends ONLY counts + metadata to the server. Never sends code content.
+// Must stay silent on stdout (UserPromptSubmit stdout is injected into context).
+//
+// argv[2] = kind ('prompt' | 'edit'); argv[3] = source ('claude' | 'codex').
+// The installer bakes the source in per agent, so one hook file serves both.
+
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { maybeAutoUpdate } from "./update-check.mjs";
+
+const kind = process.argv[2] === "edit" ? "edit" : "prompt";
+const source = process.argv[3] === "codex" ? "codex" : "claude";
+
+function config() {
+  try { return JSON.parse(readFileSync(join(homedir(), ".ccrank", "config.json"), "utf8")); }
+  catch { return null; }
+}
+
+function readStdin() {
+  try { return readFileSync(0, "utf8"); } catch { return ""; }
+}
+
+// Count lines touched by an edit — a number only, no content ever leaves the
+// machine. Claude Code tools carry the new text directly; Codex's apply_patch
+// carries a unified-diff-ish patch, so we count its added ('+') lines.
+function editValue(payload) {
+  try {
+    const t = payload.tool_name || "";
+    const inp = payload.tool_input || {};
+    // Codex applies edits as a patch (apply_patch). Count added lines.
+    if (t === "apply_patch" || (source === "codex" && !inp.content && !inp.new_string)) {
+      const patch = String(inp.input || inp.patch || inp.content || inp.changes || "");
+      const added = patch.split("\n").filter(
+        (l) => l.startsWith("+") && !l.startsWith("+++") && l.slice(1).trim().length).length;
+      if (added) return added;
+      // Not a recognizable patch — fall back to non-empty line count.
+      const any = patch.split("\n").filter((l) => l.trim().length).length;
+      return Math.max(1, any);
+    }
+    let text = "";
+    if (t === "Write") text = inp.content || "";
+    else if (t === "Edit") text = inp.new_string || "";
+    else if (t === "MultiEdit") text = (inp.edits || []).map((e) => e.new_string || "").join("\n");
+    const lines = text.split("\n").filter((l) => l.trim().length).length;
+    return Math.max(1, lines);
+  } catch { return 1; }
+}
+
+async function main() {
+  const cfg = config();
+  if (!cfg?.token || !cfg?.server) return; // not set up; do nothing
+
+  let payload = {};
+  try { payload = JSON.parse(readStdin() || "{}"); } catch {}
+
+  const value = kind === "edit" ? editValue(payload) : 1;
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 1500);
+  try {
+    await fetch(cfg.server.replace(/\/$/, "") + "/api/events", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token: cfg.token, kind, value, source }),
+      signal: ctrl.signal,
+    });
+  } catch {
+    /* offline / slow — never block Claude Code */
+  } finally {
+    clearTimeout(timer);
+  }
+  // Daily no-op except when a new client version exists (see update-check.mjs).
+  // Covers Codex-only users, who have no statusline. Stays silent on stdout.
+  await maybeAutoUpdate(cfg.server);
+}
+
+main().finally(() => process.exit(0));

package/lib/statusline.mjs

@@ -0,0 +1,195 @@
+// ccrank statusline — prints your live GLOBAL rank, e.g.  CC-Rank #2/14 · leaderboard ↗
+// The "leaderboard" text links to the GLOBAL board only — never room URLs or
+// personal params; this line lives on screen through screenshares.
+// If you already had a statusline, it runs that first and appends this,
+// so nothing you had is lost.
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { maybeAutoUpdate } from "./update-check.mjs";
+
+const CC = join(homedir(), ".ccrank");
+const CACHE = join(CC, "cache.json");
+// Last successful render of the wrapped (user's original) statusline. We reuse
+// it if the wrapped command times out or fails on a given tick, so a slow start
+// never blanks out someone else's statusline — we must not make their line
+// flicker in and out just because ours runs it. See wrapped() below.
+const WRAP_CACHE = join(CC, "wrapped.json");
+// How long a wrapped statusline is spawned to run before we give up on it and
+// fall back to WRAP_CACHE. Node-based statuslines (ccstatusline, ccusage, …)
+// cold-start anywhere from ~0.3s to ~1.7s, so this must comfortably clear that.
+const WRAP_TIMEOUT_MS = 3000;
+// Don't reuse a wrapped render older than this — better a missing line than a
+// wildly stale model/cost readout if their statusline was removed or broke.
+const WRAP_MAX_AGE_MS = 5 * 60 * 1000;
+// Only hit the network every CACHE_TTL_MS; serve cache in between. This is the
+// single biggest lever on server/D1 usage — the statusline re-renders far more
+// often than this, so without it we'd query the DB on every keystroke-ish tick.
+const CACHE_TTL_MS = 15 * 1000;
+// If the data we're showing is older than this (e.g. we're offline and serving
+// old cache), flag it so nobody trusts a stale rank as live.
+const STALE_AFTER_MS = 5 * 60 * 1000;
+
+function config() {
+  try { return JSON.parse(readFileSync(join(CC, "config.json"), "utf8")); }
+  catch { return null; }
+}
+function readStdin() { try { return readFileSync(0, "utf8"); } catch { return ""; } }
+function readCache() { try { return JSON.parse(readFileSync(CACHE, "utf8")); } catch { return null; } }
+function writeCache(obj) { try { writeFileSync(CACHE, JSON.stringify({ ...obj, _ts: Date.now() })); } catch {} }
+function readWrapCache() { try { return JSON.parse(readFileSync(WRAP_CACHE, "utf8")); } catch { return null; } }
+function writeWrapCache(out) { try { writeFileSync(WRAP_CACHE, JSON.stringify({ out, _ts: Date.now() })); } catch {} }
+
+// Run the user's previous statusline command, feeding it the same stdin.
+// Resolves to its stdout on a clean exit, or "" if it times out / fails to
+// spawn. On timeout we discard any partial output — a half-written line from a
+// killed process is unreliable; the caller falls back to the last good render.
+function runWrapped(cmd, input) {
+  return new Promise((resolve) => {
+    if (!cmd) return resolve("");
+    let out = "";
+    const child = spawn(cmd, { shell: true });
+    const kill = setTimeout(() => { try { child.kill(); } catch {} resolve(""); }, WRAP_TIMEOUT_MS);
+    child.stdout.on("data", (d) => (out += d));
+    child.on("close", () => { clearTimeout(kill); resolve(out.trim()); });
+    child.on("error", () => { clearTimeout(kill); resolve(""); });
+    // A fast-exiting child may close stdin before we finish writing — swallow EPIPE.
+    child.stdin.on("error", () => {});
+    try { child.stdin.write(input); child.stdin.end(); } catch {}
+  });
+}
+
+// Run the wrapped statusline, but never blank it out on a slow/failed tick:
+// cache each good render and reuse the last fresh one when this run comes back
+// empty. Keeps the user's original statusline rock-steady alongside ours.
+async function wrapped(cmd, input) {
+  if (!cmd) return "";
+  const out = await runWrapped(cmd, input);
+  if (out) { writeWrapCache(out); return out; }
+  const c = readWrapCache();
+  if (c && c.out && Date.now() - (c._ts || 0) < WRAP_MAX_AGE_MS) return c.out;
+  return "";
+}
+
+// Wrap text in an OSC 8 terminal hyperlink. Terminals that support it (iTerm2,
+// WezTerm, Kitty, recent VS Code / GNOME Terminal) make it click / ⌘-click to
+// open; ones that don't just show the plain text.
+function link(url, text) {
+  return `\x1b]8;;${url}\x07${text}\x1b]8;;\x07`;
+}
+
+// Rank colors: #1 gold, #2 silver, #3 bronze, everyone else bright cyan.
+function rankColor(rank) {
+  if (rank === 1) return "\x1b[1;38;5;220m";
+  if (rank === 2) return "\x1b[1;38;5;252m";
+  if (rank === 3) return "\x1b[1;38;5;208m";
+  return "\x1b[1;96m";
+}
+
+async function rankSegment(cfg) {
+  const base = cfg.server.replace(/\/$/, "");
+  // ALWAYS the global board. Never the room URL: room codes are join
+  // credentials, and the statusline sits on screen through every screenshare
+  // and recording — printing /r/CODE here would leak room access to anyone
+  // watching. (Same reason there's no ?me= — nothing personal in this line.)
+  // Your rooms are one click away in the site's sidebar once you're there.
+  const boardUrl = base + "/";
+  const view = `\x1b[94;4m${link(boardUrl, "leaderboard ↗")}\x1b[0m`;
+  const label = "\x1b[1;35mCC-Rank\x1b[0m";
+  // One line only. We used to print the raw URL underneath for terminals that
+  // don't support OSC-8 links, but it sits directly above the prompt and people
+  // kept mis-clicking it into a browser. The "leaderboard ↗" link stays.
+  // A dim "· Nm old" suffix when the shown data is older than STALE_AFTER_MS.
+  const age = (ts) => {
+    const ms = Date.now() - (ts || 0);
+    if (ms < STALE_AFTER_MS) return "";
+    const m = Math.round(ms / 60000);
+    return m < 60 ? ` \x1b[2m· ${m}m old\x1b[0m` : ` \x1b[2m· ${Math.round(m / 60)}h old\x1b[0m`;
+  };
+  const fmtRank = (me, ts) => `${label} ${rankColor(me.rank)}#${me.rank}/${me.total}\x1b[0m \x1b[2m·\x1b[0m ${view}${age(ts)}`;
+  const deleted = () => `\x1b[1;38;5;203msigned out\x1b[0m \x1b[2m·\x1b[0m \x1b[94;4m${link(base, "re-join ccrank ↗")}\x1b[0m`;
+  const fromCache = (c) =>
+    c?.deleted ? deleted() : c?.rank ? fmtRank(c, c._ts) : null;
+
+  // Serve a fresh-enough cache without any network call.
+  const cached = readCache();
+  if (cached && cached.roomCode === cfg.roomCode && cached._ts &&
+      Date.now() - cached._ts < CACHE_TTL_MS) {
+    const line = fromCache(cached);
+    if (line) return line;
+  }
+
+  // Cache stale/missing — refresh from the server (bounded by a timeout).
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 2500);
+  try {
+    const res = await fetch(base + "/api/me?token=" + encodeURIComponent(cfg.token), { signal: ctrl.signal });
+    const me = await res.json();
+    if (me && me.rank) {
+      writeCache({ ...me, roomCode: cfg.roomCode });
+      return fmtRank(me, Date.now()); // just fetched — no age suffix
+    }
+    // Server answered but doesn't know us — room/player was deleted.
+    if (res.status === 401 || res.status === 404) {
+      writeCache({ deleted: true, roomCode: cfg.roomCode });
+      return deleted();
+    }
+  } catch {
+    // Offline / slow — fall back to whatever we last cached, even if stale.
+    const line = fromCache(cached);
+    if (line) return line;
+  } finally {
+    clearTimeout(timer);
+  }
+  // No rank yet (or offline with no cache) — still offer the link.
+  return view;
+}
+
+// ---- usage reporting -------------------------------------------------------
+// Claude Code hands the statusline `cost.total_cost_usd` — CUMULATIVE for the
+// session. Post it (with the session id) so the board can show tokens/$;
+// the server keeps MAX per session, so re-posts can never double-count.
+// Throttle: only when this session's cost grew ≥ $0.05 since our last post
+// (state in usage.json — separate file so rank cache writes never clobber it).
+const USAGE_FILE = join(CC, "usage.json");
+async function reportUsage(cfg, input) {
+  try {
+    const p = JSON.parse(input || "{}");
+    const sid = String(p.session_id || "");
+    const usd = Math.round(Number(p.cost && p.cost.total_cost_usd) * 100) / 100;
+    if (!/^[A-Za-z0-9._-]{8,64}$/.test(sid) || !(usd > 0)) return;
+    let last = null;
+    try { last = JSON.parse(readFileSync(USAGE_FILE, "utf8")); } catch {}
+    if (last && last.sid === sid && usd < (last.usd || 0) + 0.05) return;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 1500);
+    try {
+      const res = await fetch(cfg.server.replace(/\/$/, "") + "/api/usage", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: cfg.token, session_id: sid, cost_usd: usd }),
+        signal: ctrl.signal,
+      });
+      if (res.ok) writeFileSync(USAGE_FILE, JSON.stringify({ sid, usd }));
+    } catch { /* offline — retry naturally on a later tick */ }
+    finally { clearTimeout(timer); }
+  } catch { /* never let usage reporting break the statusline */ }
+}
+
+async function main() {
+  const input = readStdin();
+  const cfg = config();
+  const prev = await wrapped(cfg?.wrappedStatusLine, input);
+  const [seg] = await Promise.all([
+    cfg?.token ? rankSegment(cfg) : "",
+    cfg?.token ? reportUsage(cfg, input) : null,
+    // Daily no-op except when a new client version exists — then it spawns a
+    // detached background self-update (see update-check.mjs). Bounded at 1.5s.
+    cfg?.server ? maybeAutoUpdate(cfg.server) : null,
+  ]);
+  process.stdout.write([prev, seg].filter(Boolean).join("  "));
+}
+
+main().finally(() => process.exit(0));

package/lib/update-check.mjs

@@ -0,0 +1,71 @@
+// ccrank auto-update — the "never lift a finger" pipe. Once a day, whichever
+// of the hook / statusline ticks first asks the server which version of the
+// client is current; if it isn't the one recorded as applied, it spawns
+// `npx -y mostcracked@<version> update` detached in the background. That
+// re-runs the installer: fresh scripts into ~/.ccrank, hooks rewired, and the
+// one-time backfill offered — all with zero user action.
+//
+// Security shape (the old curl-style self-updater was removed on purpose in
+// the hardening pass; this is its replacement): the package name is
+// HARD-PINNED here, so the server only ever names WHICH version of OUR npm
+// package to run — it can never point users at other code. Install goes
+// through the npm registry, same trust as the original `npx mostcracked`
+// install.
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+
+const STATE = join(homedir(), ".ccrank", "update.json");
+const PKG = "mostcracked"; // pinned — never comes from the server
+// Every ~3h. Cheap: the check is one 1.5s-bounded GET, and /api/client-version
+// is cached an hour server-side, so this is ~8 tiny requests per user per day.
+// Actual update spawns stay gated on version !== appliedVersion — they're
+// bounded by how often we publish, not by how often we check.
+const CHECK_EVERY_MS = 3 * 60 * 60 * 1000;
+
+const SEMVER = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+
+function state() {
+  try { return JSON.parse(readFileSync(STATE, "utf8")); } catch { return {}; }
+}
+function save(patch) {
+  try { writeFileSync(STATE, JSON.stringify({ ...state(), ...patch })); } catch {}
+}
+
+// Record which version is installed. Written by `ccrank update
+// --applied-version` (exact) and best-effort after any install, so a fresh
+// install at the latest version doesn't trigger a pointless update spawn the
+// next day. Also still accepts the legacy 40-hex sha the pre-npm auto-updater
+// passes via `update --applied-sha` — harmless, keeps the transition quiet.
+export function recordApplied(v) {
+  const s = String(v);
+  if (SEMVER.test(s)) save({ appliedVersion: s, appliedAt: Date.now() });
+  else if (/^[0-9a-f]{7,40}$/.test(s)) save({ appliedSha: s, appliedAt: Date.now() });
+}
+
+export async function maybeAutoUpdate(server) {
+  const st = state();
+  const now = Date.now();
+  if (!server || now - (st.checkedAt || 0) < CHECK_EVERY_MS) return;
+  // Slam the door BEFORE the network call so concurrent hook/statusline ticks
+  // (or several open sessions) can't double-run the check.
+  save({ checkedAt: now });
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 1500);
+  try {
+    const res = await fetch(String(server).replace(/\/$/, "") + "/api/client-version", { signal: ctrl.signal });
+    const v = String((await res.json())?.version || "");
+    if (!SEMVER.test(v) || v === st.appliedVersion) return;
+    const child = spawn(
+      process.platform === "win32" ? "npx.cmd" : "npx",
+      ["-y", `${PKG}@${v}`, "update", "--applied-version", v],
+      { detached: true, stdio: "ignore", shell: process.platform === "win32" });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    /* offline / slow — the next daily window retries */
+  } finally { clearTimeout(timer); }
+}

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "mostcracked",
+  "version": "1.0.0",
+  "description": "The global Claude Code leaderboard — every prompt and every edit scores a point, live at mostcracked.com.",
+  "type": "module",
+  "bin": {
+    "ccrank": "bin/ccrank.mjs",
+    "mostcracked": "bin/ccrank.mjs"
+  },
+  "files": [
+    "bin",
+    "lib"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT"
+}