whoburnedmore 0.8.5 → 0.8.9

package/README.md

@@ -62,7 +62,7 @@ npx whoburnedmore --local
 | `npx whoburnedmore --no-submit` | Print local stats only, send nothing |
 | `npx whoburnedmore login` | Sign in to claim a public handle + join the leaderboard |
 | `npx whoburnedmore logout` | Forget the local token (your data is untouched) |
-| `npx whoburnedmore install-sync` | Keep your dashboard live with a background sync (hourly) |
+| `npx whoburnedmore install-sync` | Keep your dashboard live with a background sync (every 15 min) |
 | `npx whoburnedmore uninstall-sync` | Remove the background sync |
 
 ## Supported tools
@@ -88,10 +88,14 @@ It uses a device flow — a code appears in your terminal, you approve it in the
 Want your dashboard to stay fresh without re-running by hand?
 
 ```bash
-npx whoburnedmore install-sync     # background sync hourly (launchd / cron / scheduled task)
+npx whoburnedmore install-sync     # background sync every 15 min (launchd / cron / scheduled task)
 npx whoburnedmore uninstall-sync   # remove it
 ```
 
+The installed background job runs the latest published `whoburnedmore` package on
+each sync tick, so future CLI fixes are picked up automatically after the next
+15-minute refresh.
+
 ## Links
 
 - 🏆 Leaderboard — **[whoburnedmore.com](https://whoburnedmore.com)**

package/dist/index.js

@@ -16,9 +16,24 @@ import pc2 from "picocolors";
 
 // src/args.ts
 function parseBoard(args) {
-  const eq = args.find((a) => a.startsWith("--board="));
-  if (eq) return eq.slice("--board=".length).trim() || void 0;
-  const i = args.indexOf("--board");
+  return parseValueFlag(args, "--board");
+}
+function parseOrg(args) {
+  return parseValueFlag(args, "--org");
+}
+function parseInstallToken(args) {
+  return parseValueFlag(args, "--token");
+}
+function applyScope(payload, flags) {
+  if (flags.board) payload.board = flags.board;
+  if (flags.org) payload.org = flags.org;
+  return payload;
+}
+function parseValueFlag(args, name) {
+  const prefix = `${name}=`;
+  const eq = args.find((a) => a.startsWith(prefix));
+  if (eq) return eq.slice(prefix.length).trim() || void 0;
+  const i = args.indexOf(name);
   if (i !== -1 && args[i + 1] && !args[i + 1].startsWith("-")) {
     return args[i + 1].trim() || void 0;
   }
@@ -31,7 +46,16 @@ function resolveCommand(args) {
   if (args.includes("--version") || args.includes("-v") || args.includes("version")) {
     return "version";
   }
-  return args.find((a) => !a.startsWith("-")) ?? "run";
+  const valueFlags = /* @__PURE__ */ new Set(["--board", "--org", "--token"]);
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("-")) {
+      if (valueFlags.has(a)) i++;
+      continue;
+    }
+    return a;
+  }
+  return "run";
 }
 
 // src/api.ts
@@ -41,6 +65,20 @@ function apiBase() {
 function webBase() {
   return process.env.WHOBURNEDMORE_WEB ?? "https://whoburnedmore.com";
 }
+function isTrustedWebUrl(url) {
+  let u;
+  let base;
+  try {
+    u = new URL(url);
+    base = new URL(webBase());
+  } catch {
+    return false;
+  }
+  return (u.protocol === "https:" || u.protocol === "http:") && u.protocol === base.protocol && u.host === base.host;
+}
+function isOpenableUrl(url) {
+  return /^(https?|file):\/\//.test(url);
+}
 async function readJson(res) {
   const text = await res.text();
   if (!text) return {};
@@ -80,6 +118,9 @@ async function anonSubmit(anonKey, payload) {
 function claimUrl(dashboardUrl, anonKey) {
   return `${dashboardUrl}#k=${encodeURIComponent(anonKey)}`;
 }
+function boardClaimUrl(boardUrl, slug, anonKey) {
+  return `${boardUrl}#k=${encodeURIComponent(anonKey)}&u=${encodeURIComponent(slug)}`;
+}
 async function anonVisibility(anonKey, listed) {
   const { status, body } = await post(
     "/v1/anon/visibility",
@@ -100,6 +141,15 @@ async function anonRemove(anonKey) {
     throw new Error(b.error ?? `failed (HTTP ${res.status})`);
   }
 }
+async function redeemServerInstall(token, anonKey) {
+  const { status, body } = await post("/v1/server-install/redeem", { token, anonKey });
+  if (status !== 200) {
+    throw new Error(
+      body.error ?? `server install failed (HTTP ${status})`
+    );
+  }
+  return body;
+}
 
 // src/autosync.ts
 import { spawnSync } from "node:child_process";
@@ -113,8 +163,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { join as join2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname, join as join2, win32 } from "node:path";
 
 // src/config.ts
 import { randomBytes } from "node:crypto";
@@ -128,6 +177,8 @@ import {
 import { homedir } from "node:os";
 import { join } from "node:path";
 function defaultConfigDir() {
+  const override = process.env.WHOBURNEDMORE_CONFIG_DIR?.trim();
+  if (override) return override;
   return join(homedir(), ".config", "whoburnedmore");
 }
 function loadConfig(dir = defaultConfigDir()) {
@@ -139,6 +190,9 @@ function loadConfig(dir = defaultConfigDir()) {
     if (typeof parsed.anonKey === "string") config.anonKey = parsed.anonKey;
     if (typeof parsed.lastSyncAt === "number" && Number.isFinite(parsed.lastSyncAt))
       config.lastSyncAt = parsed.lastSyncAt;
+    if (typeof parsed.launchNotificationDeliveredAt === "number" && Number.isFinite(parsed.launchNotificationDeliveredAt)) {
+      config.launchNotificationDeliveredAt = parsed.launchNotificationDeliveredAt;
+    }
     return Object.keys(config).length > 0 ? config : null;
   } catch {
     return null;
@@ -164,19 +218,33 @@ function recordSync(dir = defaultConfigDir(), when = Date.now()) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, lastSyncAt: when });
 }
+function recordLaunchNotificationDelivered(dir = defaultConfigDir(), when = Date.now()) {
+  const config = loadConfig(dir) ?? {};
+  saveConfig(dir, { ...config, launchNotificationDeliveredAt: when });
+}
 
 // src/autosync.ts
-var SYNC_INTERVAL_HOURS = 1;
+var SYNC_INTERVAL_MINUTES = 15;
+function syncIntervalLabel(mins = SYNC_INTERVAL_MINUTES) {
+  return mins % 60 === 0 ? `${mins / 60}h` : `${mins}m`;
+}
 var LABEL = "com.whoburnedmore.sync";
 var STABLE_NODE_CANDIDATES = [
   "/opt/homebrew/bin/node",
   "/usr/local/bin/node",
   "/usr/bin/node"
 ];
+var STABLE_NPM_CANDIDATES = [
+  "/opt/homebrew/bin/npm",
+  "/usr/local/bin/npm",
+  "/usr/bin/npm"
+];
+var LATEST_PACKAGE_SPEC = "whoburnedmore@latest";
 function syncLogPath() {
   return join2(defaultConfigDir(), "sync.log");
 }
-function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
+function buildLaunchdPlist(commandArgs = syncCommandArgs(), logPath = syncLogPath()) {
+  const programArguments = commandArgs.map((arg) => `    <string>${xmlEscape(arg)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -185,12 +253,10 @@ function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
   <string>${LABEL}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${nodePath}</string>
-    <string>${scriptPath}</string>
-    <string>sync</string>
+${programArguments}
   </array>
   <key>StartInterval</key>
-  <integer>${SYNC_INTERVAL_HOURS * 3600}</integer>
+  <integer>${SYNC_INTERVAL_MINUTES * 60}</integer>
   <!-- Run once right after login/reboot so a machine that was off (or asleep)
        through a scheduled tick catches up immediately, then keeps to the
        interval. Submits are idempotent server-side, so an extra run is safe. -->
@@ -200,9 +266,9 @@ function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
   <key>ProcessType</key>
   <string>Background</string>
   <key>StandardOutPath</key>
-  <string>${logPath}</string>
+  <string>${xmlEscape(logPath)}</string>
   <key>StandardErrorPath</key>
-  <string>${logPath}</string>
+  <string>${xmlEscape(logPath)}</string>
 </dict>
 </plist>
 `;
@@ -210,9 +276,6 @@ function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
 function launchAgentPath() {
   return join2(homedir2(), "Library", "LaunchAgents", `${LABEL}.plist`);
 }
-function cliScriptPath() {
-  return fileURLToPath(new URL("./index.js", import.meta.url));
-}
 function isUsableNode(p) {
   if (!existsSync2(p)) return false;
   const res = spawnSync(p, ["-v"], { encoding: "utf8" });
@@ -229,8 +292,51 @@ function resolveNodePath(opts) {
   }
   return execPath;
 }
+function isUsableNpm(p) {
+  if (!existsSync2(p)) return false;
+  const res = spawnSync(p, ["--version"], { encoding: "utf8" });
+  return res.status === 0;
+}
+function resolveNpmPath(opts) {
+  const candidates = opts?.candidates ?? STABLE_NPM_CANDIDATES;
+  const check = opts?.check ?? isUsableNpm;
+  const execPath = opts?.execPath ?? process.execPath;
+  const os = opts?.platform ?? platform();
+  for (const c of candidates) {
+    if (check(c)) return c;
+  }
+  const sibling = os === "win32" ? win32.join(win32.dirname(execPath), "npm.cmd") : join2(dirname(execPath), "npm");
+  if (check(sibling)) return sibling;
+  return os === "win32" ? "npm.cmd" : "npm";
+}
+function syncCommandArgs(npmPath = resolveNpmPath()) {
+  return [
+    npmPath,
+    "exec",
+    "--yes",
+    "--ignore-scripts",
+    "--package",
+    LATEST_PACKAGE_SPEC,
+    "--",
+    "whoburnedmore",
+    "sync"
+  ];
+}
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll(">", "&gt;");
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function windowsQuote(value) {
+  const escaped = value.replace(/(\\*)"/g, '$1$1\\"').replace(/\\+$/g, (slashes) => `${slashes}${slashes}`);
+  return `"${escaped}"`;
+}
+function windowsCommandLine(args) {
+  return args.map(windowsQuote).join(" ");
+}
 function expectedDarwinPlist() {
-  return buildLaunchdPlist(resolveNodePath(), cliScriptPath());
+  return buildLaunchdPlist(syncCommandArgs());
 }
 function plistDrift(installed, expected) {
   if (installed === null) return "absent";
@@ -248,7 +354,7 @@ function installAutoSync() {
     writeFileSync2(plistPath, expectedDarwinPlist());
     spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore" });
     spawnSync("launchctl", ["load", plistPath], { stdio: "ignore" });
-    return `launchd agent installed (${plistPath}), syncing every ${SYNC_INTERVAL_HOURS}h`;
+    return `launchd agent installed (${plistPath}), syncing every ${syncIntervalLabel()}`;
   }
   if (os === "linux") {
     const line = expectedLinuxCronLine();
@@ -260,28 +366,32 @@ ${line}
 `.replace(/^\n+/, "");
     const res = spawnSync("crontab", ["-"], { input: next });
     if (res.status !== 0) throw new Error("could not install crontab entry");
-    return `cron entry installed, syncing every ${SYNC_INTERVAL_HOURS}h`;
+    return `cron entry installed, syncing every ${syncIntervalLabel()}`;
   }
   if (os === "win32") {
     const res = spawnSync("schtasks", [
       "/Create",
       "/F",
       "/SC",
-      "HOURLY",
+      "MINUTE",
       "/MO",
-      String(SYNC_INTERVAL_HOURS),
+      String(SYNC_INTERVAL_MINUTES),
       "/TN",
       "whoburnedmore-sync",
       "/TR",
-      `"${resolveNodePath()}" "${cliScriptPath()}" sync`
+      windowsCommandLine(syncCommandArgs())
     ]);
     if (res.status !== 0) throw new Error("could not create scheduled task");
-    return `scheduled task installed, syncing every ${SYNC_INTERVAL_HOURS}h`;
+    return `scheduled task installed, syncing every ${syncIntervalLabel()}`;
   }
   throw new Error(`auto-sync is not supported on ${os}`);
 }
-function expectedLinuxCronLine() {
-  return `0 */${SYNC_INTERVAL_HOURS} * * * "${resolveNodePath()}" "${cliScriptPath()}" sync >"${syncLogPath()}" 2>&1`;
+function cronSchedule(mins = SYNC_INTERVAL_MINUTES) {
+  return mins % 60 === 0 ? `0 */${mins / 60} * * *` : `*/${mins} * * * *`;
+}
+function expectedLinuxCronLine(opts) {
+  const command = syncCommandArgs(opts?.npmPath).map(shellQuote).join(" ");
+  return `${cronSchedule()} ${command} >${shellQuote(opts?.logPath ?? syncLogPath())} 2>&1`;
 }
 function uninstallAutoSync() {
   const os = platform();
@@ -360,6 +470,41 @@ function rotateLogIfLarge(path = syncLogPath(), capBytes = 256 * 1024) {
     return false;
   }
 }
+function notifyLaunchLive(opts) {
+  const os = opts?.platform ?? platform();
+  const run2 = opts?.spawn ?? ((cmd, args) => spawnSync(cmd, args, { stdio: "ignore" }));
+  const title = "whoburnedmore is live";
+  const message = "Your dashboard is ready. Go to whoburnedmore.com";
+  if (os === "darwin") {
+    return run2("osascript", [
+      "-e",
+      `display notification "${message}" with title "${title}"`
+    ]).status === 0;
+  }
+  if (os === "linux") {
+    return run2("notify-send", [title, message]).status === 0;
+  }
+  if (os === "win32") {
+    const psQuote = (value) => `'${value.replaceAll("'", "''")}'`;
+    const script = [
+      "Add-Type -AssemblyName System.Windows.Forms",
+      "$n = New-Object System.Windows.Forms.NotifyIcon",
+      "$n.Icon = [System.Drawing.SystemIcons]::Application",
+      `$n.BalloonTipTitle = ${psQuote(title)}`,
+      `$n.BalloonTipText = ${psQuote(message)}`,
+      "$n.Visible = $true",
+      "$n.ShowBalloonTip(10000)",
+      "Start-Sleep -Seconds 2",
+      "$n.Dispose()"
+    ].join("; ");
+    return run2("powershell", [
+      "-NoProfile",
+      "-Command",
+      script
+    ]).status === 0;
+  }
+  return false;
+}
 function autoSyncLoaded() {
   if (platform() === "darwin") {
     const res = spawnSync("launchctl", ["list"], { encoding: "utf8" });
@@ -389,7 +534,7 @@ function printBanner() {
 // src/collect.ts
 import { execFile } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { dirname as dirname3, join as join6 } from "node:path";
 import { promisify } from "node:util";
 
 // src/attribution.ts
@@ -748,7 +893,7 @@ import { join as join5 } from "node:path";
 // src/tokscale.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire } from "node:module";
-import { dirname, join as join4 } from "node:path";
+import { dirname as dirname2, join as join4 } from "node:path";
 var LOOKBACK_DAYS = 30;
 function num(n) {
   const v = Math.round(Number(n));
@@ -792,7 +937,7 @@ function resolveTokscaleBin() {
     const pkg = require3("tokscale/package.json");
     const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.tokscale ?? "";
     if (!rel) return null;
-    const binPath = join4(dirname(pkgPath), rel);
+    const binPath = join4(dirname2(pkgPath), rel);
     if (/\.(c|m)?js$/.test(binPath)) {
       return { cmd: process.execPath, prefixArgs: [binPath] };
     }
@@ -1125,7 +1270,7 @@ function resolveCcusageBin() {
   const pkgPath = require3.resolve("ccusage/package.json");
   const pkg = require3("ccusage/package.json");
   const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.ccusage ?? "ccusage";
-  const binPath = join6(dirname2(pkgPath), rel);
+  const binPath = join6(dirname3(pkgPath), rel);
   if (/\.(c|m)?js$/.test(binPath)) {
     return { cmd: process.execPath, prefixArgs: [binPath] };
   }
@@ -1149,6 +1294,13 @@ function dedupeDaily(entries) {
   }
   return [...byKey.values()];
 }
+function entryTokens(e) {
+  return e.inputTokens + e.outputTokens + e.cacheCreationTokens + e.cacheReadTokens;
+}
+function capByTokens(rows, max, tokens) {
+  if (rows.length <= max) return rows;
+  return [...rows].sort((a, b) => tokens(b) - tokens(a)).slice(0, max);
+}
 function dedupeSessions(sessions) {
   const byId = /* @__PURE__ */ new Map();
   const total = (s) => s.inputTokens + s.outputTokens + s.cacheCreationTokens + s.cacheReadTokens;
@@ -1260,9 +1412,14 @@ async function collectAll(onProgress) {
     };
   });
   return {
-    entries: dedupeDaily(entries),
-    sessions: dedupedSessions,
-    blocks: dedupeBlocks(blocks),
+    // Cap each array to the server's accepted maximum (the shared SubmitPayload
+    // schema: entries ≤ 20000, sessions/blocks ≤ 10000), keeping the
+    // highest-token rows. Without this, a power user with >10000 distinct sessions
+    // would have their ENTIRE submit rejected with a 400 instead of a capped one.
+    // tools/skills/projects are already bounded upstream (attribution caps).
+    entries: capByTokens(dedupeDaily(entries), 2e4, entryTokens),
+    sessions: capByTokens(dedupedSessions, 1e4, entryTokens),
+    blocks: capByTokens(dedupeBlocks(blocks), 1e4, (b) => b.totalTokens),
     toolsFound,
     tools,
     skills,
@@ -1293,8 +1450,8 @@ function buildStatusReport(s) {
       "    \u21B3 config is out of date \u2014 it will self-repair on your next run"
     );
   }
-  lines.push(`  \u2022 Interval: every ${s.intervalHours}h`);
-  const staleAfterMs = s.intervalHours * 2 * 3600 * 1e3;
+  lines.push(`  \u2022 Interval: every ${syncIntervalLabel(s.intervalMinutes)}`);
+  const staleAfterMs = s.intervalMinutes * 2 * 60 * 1e3;
   if (s.lastSyncAt === null) {
     lines.push("  \u2022 Last sync: never recorded");
     lines.push("  \u26A0 STALE: no successful sync recorded yet \u2014 run `npx whoburnedmore`");
@@ -1303,7 +1460,7 @@ function buildStatusReport(s) {
     lines.push(`  \u2022 Last sync: ${ago(age)}`);
     if (age > staleAfterMs) {
       lines.push(
-        `  \u26A0 STALE: last sync was over ${s.intervalHours * 2}h ago \u2014 your dashboard may be behind. Run \`npx whoburnedmore\`.`
+        `  \u26A0 STALE: last sync was over ${syncIntervalLabel(s.intervalMinutes * 2)} ago \u2014 your dashboard may be behind. Run \`npx whoburnedmore\`.`
       );
     } else {
       lines.push("  \u2713 Fresh \u2014 your dashboard is up to date.");
@@ -1325,7 +1482,7 @@ function agentStatusReport(now = Date.now()) {
     installed: autoSyncInstalled(),
     loaded: autoSyncLoaded(),
     drift: autoSyncDrift(),
-    intervalHours: SYNC_INTERVAL_HOURS,
+    intervalMinutes: SYNC_INTERVAL_MINUTES,
     lastSyncAt: typeof cfg?.lastSyncAt === "number" ? cfg.lastSyncAt : null,
     now,
     nodePath,
@@ -5375,6 +5532,48 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../shared/dist/tenant.js
+var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
+  "www",
+  "api",
+  "app",
+  "admin",
+  "mail",
+  "email",
+  "cdn",
+  "static",
+  "assets",
+  "blog",
+  "docs",
+  "status",
+  "help",
+  "support",
+  "ingest",
+  "vercel",
+  "preview",
+  "staging",
+  "dev",
+  "test"
+]);
+
+// ../shared/dist/launch-gate.js
+var LaunchAccessMode = external_exports.enum(["full", "invited", "waitlisted"]);
+var LaunchStatusResponse = external_exports.object({
+  mode: LaunchAccessMode,
+  launchAt: external_exports.string().datetime(),
+  now: external_exports.string().datetime(),
+  remainingSeconds: external_exports.number().int().nonnegative(),
+  live: external_exports.boolean()
+});
+var LaunchRedeemRequest = external_exports.object({
+  code: external_exports.string().trim().min(2).max(64)
+});
+var LaunchRedeemResponse = external_exports.object({
+  ok: external_exports.literal(true),
+  mode: LaunchAccessMode,
+  expiresAt: external_exports.string().datetime().nullable()
+});
+
 // ../shared/dist/index.js
 var DateString = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be YYYY-MM-DD");
 var tokenCount = external_exports.number().int().nonnegative();
@@ -5490,7 +5689,9 @@ var SubmitPayload = external_exports.object({
    */
   attributionComplete: external_exports.boolean().optional(),
   /** Optional friends-board code (from `--board=<code>`): auto-join this board on submit. */
-  board: external_exports.string().min(1).max(32).optional()
+  board: external_exports.string().min(1).max(32).optional(),
+  /** Optional organization slug (from `--org=<slug>`): auto-join this org on submit. */
+  org: external_exports.string().min(2).max(32).optional()
 });
 var AnonSubmitPayload = SubmitPayload.extend({
   /** Client-generated secret (hex). The server stores only its hash. */
@@ -5501,6 +5702,94 @@ function entryTotalTokens(e) {
 }
 var LeaderboardPeriod = external_exports.enum(["today", "7d", "30d", "all"]);
 var LeaderboardMetric = external_exports.enum(["tokens", "cost"]);
+var OrgType = external_exports.enum(["company", "hackathon", "hackerhouse"]);
+var MemberRole = external_exports.enum(["owner", "admin", "member"]);
+var OrgBoardVisibility = external_exports.enum(["public", "members"]);
+var HexColor = external_exports.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/, "must be a hex color like #f97316");
+var RESERVED_SLUGS = /* @__PURE__ */ new Set([
+  ...RESERVED_SUBDOMAINS,
+  "o",
+  "d",
+  "u",
+  "boards",
+  "board",
+  "claim",
+  "signin",
+  "signout",
+  "login",
+  "logout",
+  "dashboard",
+  "install",
+  "for-teams",
+  "teams",
+  "about",
+  "contact",
+  "trust",
+  "cli",
+  "feedback",
+  "guides",
+  "guide",
+  "join",
+  "leaderboard",
+  "settings",
+  "account",
+  "me",
+  "new",
+  "robots",
+  "sitemap"
+]);
+var SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
+function isValidSlug(slug) {
+  return typeof slug === "string" && slug.length >= 2 && slug.length <= 32 && SLUG_RE.test(slug) && !RESERVED_SLUGS.has(slug);
+}
+var OrgSlug = external_exports.string().min(2).max(32).refine(isValidSlug, "invalid or reserved slug");
+var OrgWindow = external_exports.object({
+  startDate: DateString.nullable().optional(),
+  endDate: DateString.nullable().optional()
+});
+var OrgJoinPolicy = external_exports.object({
+  allowCodeJoin: external_exports.boolean().default(true),
+  allowDomainJoin: external_exports.boolean().default(false),
+  /** Verified email domains that auto-join, e.g. ["acme.com"]. */
+  emailDomains: external_exports.array(external_exports.string().min(3).max(253).toLowerCase()).max(20).default([])
+});
+var OrgApplicationInput = external_exports.object({
+  type: OrgType,
+  orgName: external_exports.string().min(1).max(120),
+  desiredSlug: external_exports.string().min(2).max(32).optional(),
+  contactName: external_exports.string().min(1).max(120),
+  contactEmail: external_exports.string().email().max(254),
+  website: external_exports.string().url().max(300).optional(),
+  /** Rough headcount / attendee estimate, free text. */
+  size: external_exports.string().max(60).optional(),
+  message: external_exports.string().max(2e3).optional()
+});
+var OrgProvisionInput = external_exports.object({
+  /** When provisioning straight from an application. */
+  applicationId: external_exports.string().min(1).max(64).optional(),
+  slug: OrgSlug,
+  name: external_exports.string().min(1).max(120),
+  type: OrgType,
+  /** Handle (or email) of the user who becomes Owner. */
+  ownerHandle: external_exports.string().min(1).max(120).optional(),
+  ownerEmail: external_exports.string().email().max(254).optional(),
+  description: external_exports.string().max(2e3).optional(),
+  boardVisibility: OrgBoardVisibility.optional(),
+  window: OrgWindow.optional()
+});
+var OrgSettingsInput = external_exports.object({
+  name: external_exports.string().min(1).max(120).optional(),
+  description: external_exports.string().max(2e3).nullable().optional(),
+  accentColor: HexColor.optional(),
+  logoUrl: external_exports.string().url().max(500).nullable().optional(),
+  boardVisibility: OrgBoardVisibility.optional(),
+  window: OrgWindow.optional(),
+  joinPolicy: OrgJoinPolicy.partial().optional()
+});
+var OrgJoinInput = external_exports.object({
+  /** Required only when joining via a code; domain/admin joins omit it. */
+  code: external_exports.string().min(1).max(64).optional()
+});
 
 // src/output.ts
 function formatTokens(n) {
@@ -5812,6 +6101,7 @@ function startProgress() {
   };
 }
 function openBrowser(url) {
+  if (!isOpenableUrl(url)) return;
   const os = platform3();
   const [cmd, args] = os === "darwin" ? ["open", [url]] : os === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
@@ -5877,7 +6167,7 @@ async function run(flags) {
   if (agent.messageCount > 0) payload.agent = agent;
   if (attributionComplete && (tools.length > 0 || skills.length > 0 || projects.length > 0))
     payload.attributionComplete = true;
-  if (flags.board) payload.board = flags.board;
+  applyScope(payload, flags);
   if (flags.dryRun) {
     console.log(pc2.dim("\n  --dry-run: this exact payload would be sent, nothing else:\n"));
     console.log(JSON.stringify(payload, null, 2));
@@ -5906,13 +6196,31 @@ async function run(flags) {
     recordSync();
   } catch {
   }
-  const target = result.boardUrl ?? claimUrl(result.dashboardUrl, anonKey);
+  try {
+    const config = loadConfig();
+    if (result.launch?.live && !config?.launchNotificationDeliveredAt) {
+      if (notifyLaunchLive()) {
+        recordLaunchNotificationDelivered();
+      }
+    }
+  } catch {
+  }
+  const baseUrl = result.boardUrl ?? result.dashboardUrl;
+  const target = result.boardUrl ? boardClaimUrl(result.boardUrl, result.slug, anonKey) : claimUrl(result.dashboardUrl, anonKey);
+  const trusted = isTrustedWebUrl(baseUrl);
   if (!flags.quiet) {
     console.log(
       pc2.green("  \u2713 Synced securely.") + pc2.dim(" Only your daily totals left this machine \u2014 never your prompts, code, or file names.")
     );
-    console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
-    openBrowser(target);
+    if (trusted) {
+      console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
+      openBrowser(target);
+    } else {
+      console.log(
+        pc2.dim("  The server returned an unexpected dashboard address, so it was NOT auto-opened. Open it yourself only if you trust it:")
+      );
+      console.log(`  ${baseUrl}`);
+    }
   }
   const lines = submitNextStepLines(result);
   for (const line of lines) {
@@ -5930,10 +6238,42 @@ async function run(flags) {
   if (!flags.quiet) {
     console.log();
     console.log(
-      autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every hour (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
+      autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every 15 min (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
     );
   }
 }
+async function linkServerInstall(token) {
+  if (!token) {
+    throw new Error("missing install token \u2014 use `npx whoburnedmore link --token=<token>`");
+  }
+  const anonKey = ensureAnonKey();
+  const linked = await redeemServerInstall(token, anonKey);
+  console.log(
+    linked.alreadyLinked ? `  This machine is already linked to @${linked.handle}.` : `  Linked this machine to @${linked.handle}.`
+  );
+  if (linked.mergedDays > 0) {
+    console.log(pc2.dim(`  Merged ${linked.mergedDays} existing usage day${linked.mergedDays === 1 ? "" : "s"} from this machine.`));
+  }
+  await run({
+    dryRun: false,
+    noSubmit: false,
+    local: false,
+    quiet: true
+  });
+  try {
+    const action = reconcileAutoSync();
+    if (action === "installed") {
+      console.log(pc2.dim("  Background sync installed; this machine will refresh every 15 min."));
+    } else if (action === "reinstalled") {
+      console.log(pc2.dim("  Background sync repaired; this machine will refresh every 15 min."));
+    } else {
+      console.log(pc2.dim("  Background sync is already configured."));
+    }
+  } catch {
+    console.log(pc2.dim("  Linked, but background sync could not be installed automatically. Run `npx whoburnedmore install-sync` to retry."));
+  }
+  console.log(`  Profile: ${linked.profileUrl}`);
+}
 async function main() {
   const major = Number(process.versions.node.split(".")[0]);
   if (major < 20) {
@@ -5948,7 +6288,8 @@ async function main() {
     noSubmit: args.includes("--no-submit"),
     local: args.includes("--local"),
     quiet: command === "sync",
-    board: parseBoard(args)
+    board: parseBoard(args),
+    org: parseOrg(args)
   };
   switch (command) {
     case "run":
@@ -5960,6 +6301,9 @@ async function main() {
       await run({ ...flags, noSubmit: false, dryRun: false, local: false });
       break;
     }
+    case "link":
+      await linkServerInstall(parseInstallToken(args));
+      break;
     case "status":
     case "doctor": {
       for (const line of agentStatusReport()) console.log(line);
@@ -6013,9 +6357,11 @@ function printHelp() {
   ${pc2.bold("usage")}
     npx whoburnedmore              burn + land on the public leaderboard, open your dashboard
     npx whoburnedmore --board=CODE compare with friends \u2014 join their board (no sign-in)
+    npx whoburnedmore --org=SLUG   submit to your organization's board (companies/hackathons)
     npx whoburnedmore --local      build the dashboard on your machine and open it (offline)
     npx whoburnedmore --dry-run    print exactly what would be sent, send nothing
     npx whoburnedmore --no-submit  collect locally, send nothing (no dashboard)
+    npx whoburnedmore link --token=TOKEN  link this server to your signed-in account
     npx whoburnedmore private      hide your dashboard from the leaderboard
     npx whoburnedmore public       put it back on the leaderboard
     npx whoburnedmore remove       delete your dashboard and its data
@@ -6024,7 +6370,7 @@ function printHelp() {
     npx whoburnedmore install-sync     turn it back on after uninstalling
 
   Background sync is on by default: after your first run, your page refreshes
-  automatically every hour (\`uninstall-sync\` to stop). Your dashboard is public on
+  automatically every 15 min (\`uninstall-sync\` to stop). Your dashboard is public on
   the leaderboard as an anonymous burner \u2014 sign in on whoburnedmore.com to claim
   it (handle + X) and own your rank, or run \`private\`/\`remove\` to pull it. Only
   daily aggregate numbers (date, tool, model, token counts, est. cost) ever leave

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.8.5",
+  "version": "0.8.9",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {
@@ -13,7 +13,8 @@
     "build": "rm -rf dist && esbuild src/index.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/index.js --external:ccusage --external:picocolors --external:tokscale",
     "test": "vitest run",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "prepublishOnly": "pnpm run build",
+    "smoke:package": "node scripts/smoke-package.mjs",
+    "prepublishOnly": "pnpm run lint && pnpm run test && pnpm run build && pnpm run smoke:package",
     "release:patch": "npm version patch && npm publish",
     "release:minor": "npm version minor && npm publish",
     "release:major": "npm version major && npm publish"