whoburnedmore 0.8.7 → 0.9.1

package/README.md

@@ -62,7 +62,7 @@ npx whoburnedmore --local
 | `npx whoburnedmore --no-submit` | Print local stats only, send nothing |
 | `npx whoburnedmore login` | Sign in to claim a public handle + join the leaderboard |
 | `npx whoburnedmore logout` | Forget the local token (your data is untouched) |
-| `npx whoburnedmore install-sync` | Keep your dashboard live with a background sync (hourly) |
+| `npx whoburnedmore install-sync` | Keep your dashboard live with a background sync (every 15 min) |
 | `npx whoburnedmore uninstall-sync` | Remove the background sync |
 
 ## Supported tools
@@ -88,10 +88,14 @@ It uses a device flow — a code appears in your terminal, you approve it in the
 Want your dashboard to stay fresh without re-running by hand?
 
 ```bash
-npx whoburnedmore install-sync     # background sync hourly (launchd / cron / scheduled task)
+npx whoburnedmore install-sync     # background sync every 15 min (launchd / cron / scheduled task)
 npx whoburnedmore uninstall-sync   # remove it
 ```
 
+The installed background job runs the latest published `whoburnedmore` package on
+each sync tick, so future CLI fixes are picked up automatically after the next
+15-minute refresh.
+
 ## Links
 
 - 🏆 Leaderboard — **[whoburnedmore.com](https://whoburnedmore.com)**

package/dist/index.js

@@ -16,9 +16,29 @@ import pc2 from "picocolors";
 
 // src/args.ts
 function parseBoard(args) {
-  const eq = args.find((a) => a.startsWith("--board="));
-  if (eq) return eq.slice("--board=".length).trim() || void 0;
-  const i = args.indexOf("--board");
+  return parseValueFlag(args, "--board");
+}
+function parseOrg(args) {
+  return parseValueFlag(args, "--org");
+}
+function parsePass(args) {
+  return parseValueFlag(args, "--pass") ?? parseValueFlag(args, "--code");
+}
+function parseInstallToken(args) {
+  return parseValueFlag(args, "--token");
+}
+function applyScope(payload, flags) {
+  if (flags.board) payload.board = flags.board;
+  if (flags.org) payload.org = flags.org;
+  if (flags.org && flags.orgCode)
+    payload.orgCode = flags.orgCode;
+  return payload;
+}
+function parseValueFlag(args, name) {
+  const prefix = `${name}=`;
+  const eq = args.find((a) => a.startsWith(prefix));
+  if (eq) return eq.slice(prefix.length).trim() || void 0;
+  const i = args.indexOf(name);
   if (i !== -1 && args[i + 1] && !args[i + 1].startsWith("-")) {
     return args[i + 1].trim() || void 0;
   }
@@ -31,7 +51,16 @@ function resolveCommand(args) {
   if (args.includes("--version") || args.includes("-v") || args.includes("version")) {
     return "version";
   }
-  return args.find((a) => !a.startsWith("-")) ?? "run";
+  const valueFlags = /* @__PURE__ */ new Set(["--board", "--org", "--token", "--pass", "--code"]);
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("-")) {
+      if (valueFlags.has(a)) i++;
+      continue;
+    }
+    return a;
+  }
+  return "run";
 }
 
 // src/api.ts
@@ -41,6 +70,20 @@ function apiBase() {
 function webBase() {
   return process.env.WHOBURNEDMORE_WEB ?? "https://whoburnedmore.com";
 }
+function isTrustedWebUrl(url) {
+  let u;
+  let base;
+  try {
+    u = new URL(url);
+    base = new URL(webBase());
+  } catch {
+    return false;
+  }
+  return (u.protocol === "https:" || u.protocol === "http:") && u.protocol === base.protocol && u.host === base.host;
+}
+function isOpenableUrl(url) {
+  return /^(https?|file):\/\//.test(url);
+}
 async function readJson(res) {
   const text = await res.text();
   if (!text) return {};
@@ -83,6 +126,11 @@ function claimUrl(dashboardUrl, anonKey) {
 function boardClaimUrl(boardUrl, slug, anonKey) {
   return `${boardUrl}#k=${encodeURIComponent(anonKey)}&u=${encodeURIComponent(slug)}`;
 }
+function resolveOpenTarget(result, anonKey) {
+  const baseUrl = result.orgBoardUrl ?? result.boardUrl ?? result.dashboardUrl;
+  const target = result.orgBoardUrl ? boardClaimUrl(result.orgBoardUrl, result.slug, anonKey) : result.boardUrl ? boardClaimUrl(result.boardUrl, result.slug, anonKey) : claimUrl(result.dashboardUrl, anonKey);
+  return { baseUrl, target };
+}
 async function anonVisibility(anonKey, listed) {
   const { status, body } = await post(
     "/v1/anon/visibility",
@@ -103,6 +151,15 @@ async function anonRemove(anonKey) {
     throw new Error(b.error ?? `failed (HTTP ${res.status})`);
   }
 }
+async function redeemServerInstall(token, anonKey) {
+  const { status, body } = await post("/v1/server-install/redeem", { token, anonKey });
+  if (status !== 200) {
+    throw new Error(
+      body.error ?? `server install failed (HTTP ${status})`
+    );
+  }
+  return body;
+}
 
 // src/autosync.ts
 import { spawnSync } from "node:child_process";
@@ -116,8 +173,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
-import { join as join2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname, join as join2, win32 } from "node:path";
 
 // src/config.ts
 import { randomBytes } from "node:crypto";
@@ -131,6 +187,8 @@ import {
 import { homedir } from "node:os";
 import { join } from "node:path";
 function defaultConfigDir() {
+  const override = process.env.WHOBURNEDMORE_CONFIG_DIR?.trim();
+  if (override) return override;
   return join(homedir(), ".config", "whoburnedmore");
 }
 function loadConfig(dir = defaultConfigDir()) {
@@ -142,6 +200,9 @@ function loadConfig(dir = defaultConfigDir()) {
     if (typeof parsed.anonKey === "string") config.anonKey = parsed.anonKey;
     if (typeof parsed.lastSyncAt === "number" && Number.isFinite(parsed.lastSyncAt))
       config.lastSyncAt = parsed.lastSyncAt;
+    if (typeof parsed.launchNotificationDeliveredAt === "number" && Number.isFinite(parsed.launchNotificationDeliveredAt)) {
+      config.launchNotificationDeliveredAt = parsed.launchNotificationDeliveredAt;
+    }
     return Object.keys(config).length > 0 ? config : null;
   } catch {
     return null;
@@ -167,19 +228,33 @@ function recordSync(dir = defaultConfigDir(), when = Date.now()) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, lastSyncAt: when });
 }
+function recordLaunchNotificationDelivered(dir = defaultConfigDir(), when = Date.now()) {
+  const config = loadConfig(dir) ?? {};
+  saveConfig(dir, { ...config, launchNotificationDeliveredAt: when });
+}
 
 // src/autosync.ts
-var SYNC_INTERVAL_HOURS = 1;
+var SYNC_INTERVAL_MINUTES = 15;
+function syncIntervalLabel(mins = SYNC_INTERVAL_MINUTES) {
+  return mins % 60 === 0 ? `${mins / 60}h` : `${mins}m`;
+}
 var LABEL = "com.whoburnedmore.sync";
 var STABLE_NODE_CANDIDATES = [
   "/opt/homebrew/bin/node",
   "/usr/local/bin/node",
   "/usr/bin/node"
 ];
+var STABLE_NPM_CANDIDATES = [
+  "/opt/homebrew/bin/npm",
+  "/usr/local/bin/npm",
+  "/usr/bin/npm"
+];
+var LATEST_PACKAGE_SPEC = "whoburnedmore@latest";
 function syncLogPath() {
   return join2(defaultConfigDir(), "sync.log");
 }
-function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
+function buildLaunchdPlist(commandArgs = syncCommandArgs(), logPath = syncLogPath()) {
+  const programArguments = commandArgs.map((arg) => `    <string>${xmlEscape(arg)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -188,12 +263,10 @@ function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
   <string>${LABEL}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${nodePath}</string>
-    <string>${scriptPath}</string>
-    <string>sync</string>
+${programArguments}
   </array>
   <key>StartInterval</key>
-  <integer>${SYNC_INTERVAL_HOURS * 3600}</integer>
+  <integer>${SYNC_INTERVAL_MINUTES * 60}</integer>
   <!-- Run once right after login/reboot so a machine that was off (or asleep)
        through a scheduled tick catches up immediately, then keeps to the
        interval. Submits are idempotent server-side, so an extra run is safe. -->
@@ -203,9 +276,9 @@ function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
   <key>ProcessType</key>
   <string>Background</string>
   <key>StandardOutPath</key>
-  <string>${logPath}</string>
+  <string>${xmlEscape(logPath)}</string>
   <key>StandardErrorPath</key>
-  <string>${logPath}</string>
+  <string>${xmlEscape(logPath)}</string>
 </dict>
 </plist>
 `;
@@ -213,9 +286,6 @@ function buildLaunchdPlist(nodePath, scriptPath, logPath = syncLogPath()) {
 function launchAgentPath() {
   return join2(homedir2(), "Library", "LaunchAgents", `${LABEL}.plist`);
 }
-function cliScriptPath() {
-  return fileURLToPath(new URL("./index.js", import.meta.url));
-}
 function isUsableNode(p) {
   if (!existsSync2(p)) return false;
   const res = spawnSync(p, ["-v"], { encoding: "utf8" });
@@ -232,8 +302,51 @@ function resolveNodePath(opts) {
   }
   return execPath;
 }
+function isUsableNpm(p) {
+  if (!existsSync2(p)) return false;
+  const res = spawnSync(p, ["--version"], { encoding: "utf8" });
+  return res.status === 0;
+}
+function resolveNpmPath(opts) {
+  const candidates = opts?.candidates ?? STABLE_NPM_CANDIDATES;
+  const check = opts?.check ?? isUsableNpm;
+  const execPath = opts?.execPath ?? process.execPath;
+  const os = opts?.platform ?? platform();
+  for (const c of candidates) {
+    if (check(c)) return c;
+  }
+  const sibling = os === "win32" ? win32.join(win32.dirname(execPath), "npm.cmd") : join2(dirname(execPath), "npm");
+  if (check(sibling)) return sibling;
+  return os === "win32" ? "npm.cmd" : "npm";
+}
+function syncCommandArgs(npmPath = resolveNpmPath()) {
+  return [
+    npmPath,
+    "exec",
+    "--yes",
+    "--ignore-scripts",
+    "--package",
+    LATEST_PACKAGE_SPEC,
+    "--",
+    "whoburnedmore",
+    "sync"
+  ];
+}
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll(">", "&gt;");
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function windowsQuote(value) {
+  const escaped = value.replace(/(\\*)"/g, '$1$1\\"').replace(/\\+$/g, (slashes) => `${slashes}${slashes}`);
+  return `"${escaped}"`;
+}
+function windowsCommandLine(args) {
+  return args.map(windowsQuote).join(" ");
+}
 function expectedDarwinPlist() {
-  return buildLaunchdPlist(resolveNodePath(), cliScriptPath());
+  return buildLaunchdPlist(syncCommandArgs());
 }
 function plistDrift(installed, expected) {
   if (installed === null) return "absent";
@@ -251,40 +364,125 @@ function installAutoSync() {
     writeFileSync2(plistPath, expectedDarwinPlist());
     spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore" });
     spawnSync("launchctl", ["load", plistPath], { stdio: "ignore" });
-    return `launchd agent installed (${plistPath}), syncing every ${SYNC_INTERVAL_HOURS}h`;
+    return `launchd agent installed (${plistPath}), syncing every ${syncIntervalLabel()}`;
   }
   if (os === "linux") {
-    const line = expectedLinuxCronLine();
-    const current = spawnSync("crontab", ["-l"], { encoding: "utf8" });
-    const existing = current.status === 0 ? current.stdout : "";
-    const kept = existing.split("\n").filter((l) => !l.includes("whoburnedmore")).join("\n");
-    const next = `${kept.trimEnd()}
-${line}
-`.replace(/^\n+/, "");
-    const res = spawnSync("crontab", ["-"], { input: next });
-    if (res.status !== 0) throw new Error("could not install crontab entry");
-    return `cron entry installed, syncing every ${SYNC_INTERVAL_HOURS}h`;
+    const viaCron = tryInstallCron();
+    if (viaCron) return viaCron;
+    const viaSystemd = tryInstallSystemd();
+    if (viaSystemd) return viaSystemd;
+    throw new Error(
+      "could not install background sync: no usable crontab or systemd user timer. Run `whoburnedmore daemon` under your process manager (systemd service, Docker CMD, pm2 or nohup) to keep syncing."
+    );
   }
   if (os === "win32") {
     const res = spawnSync("schtasks", [
       "/Create",
       "/F",
       "/SC",
-      "HOURLY",
+      "MINUTE",
       "/MO",
-      String(SYNC_INTERVAL_HOURS),
+      String(SYNC_INTERVAL_MINUTES),
       "/TN",
       "whoburnedmore-sync",
       "/TR",
-      `"${resolveNodePath()}" "${cliScriptPath()}" sync`
+      windowsCommandLine(syncCommandArgs())
     ]);
     if (res.status !== 0) throw new Error("could not create scheduled task");
-    return `scheduled task installed, syncing every ${SYNC_INTERVAL_HOURS}h`;
+    return `scheduled task installed, syncing every ${syncIntervalLabel()}`;
   }
   throw new Error(`auto-sync is not supported on ${os}`);
 }
-function expectedLinuxCronLine() {
-  return `0 */${SYNC_INTERVAL_HOURS} * * * "${resolveNodePath()}" "${cliScriptPath()}" sync >"${syncLogPath()}" 2>&1`;
+function cronSchedule(mins = SYNC_INTERVAL_MINUTES) {
+  return mins % 60 === 0 ? `0 */${mins / 60} * * *` : `*/${mins} * * * *`;
+}
+function expectedLinuxCronLine(opts) {
+  const command = syncCommandArgs(opts?.npmPath).map(shellQuote).join(" ");
+  return `${cronSchedule()} ${command} >${shellQuote(opts?.logPath ?? syncLogPath())} 2>&1`;
+}
+var SYSTEMD_UNIT = "whoburnedmore-sync";
+function systemdUserDir() {
+  const base = process.env.XDG_CONFIG_HOME?.trim() || join2(homedir2(), ".config");
+  return join2(base, "systemd", "user");
+}
+function systemdServicePath() {
+  return join2(systemdUserDir(), `${SYSTEMD_UNIT}.service`);
+}
+function systemdTimerPath() {
+  return join2(systemdUserDir(), `${SYSTEMD_UNIT}.timer`);
+}
+function systemdQuote(value) {
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function buildSystemdService(commandArgs = syncCommandArgs()) {
+  const execStart = commandArgs.map(systemdQuote).join(" ");
+  return `[Unit]
+Description=whoburnedmore background token-usage sync
+
+[Service]
+Type=oneshot
+ExecStart=${execStart}
+`;
+}
+function buildSystemdTimer(mins = SYNC_INTERVAL_MINUTES) {
+  return `[Unit]
+Description=whoburnedmore background token-usage sync timer
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=${mins}min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+`;
+}
+function binaryExists(cmd, probeArgs = ["--version"]) {
+  const res = spawnSync(cmd, probeArgs, { stdio: "ignore" });
+  return !res.error;
+}
+function linuxSyncMechanism() {
+  const cron = spawnSync("crontab", ["-l"], { encoding: "utf8" });
+  if (!cron.error && cron.status === 0 && cron.stdout.includes("whoburnedmore")) {
+    return "cron";
+  }
+  if (existsSync2(systemdTimerPath())) return "systemd";
+  return "none";
+}
+function tryInstallCron() {
+  if (!binaryExists("crontab", ["-l"])) return null;
+  const line = expectedLinuxCronLine();
+  const current = spawnSync("crontab", ["-l"], { encoding: "utf8" });
+  const existing = current.status === 0 ? current.stdout : "";
+  const kept = existing.split("\n").filter((l) => !l.includes("whoburnedmore")).join("\n");
+  const next = `${kept.trimEnd()}
+${line}
+`.replace(/^\n+/, "");
+  const res = spawnSync("crontab", ["-"], { input: next });
+  if (res.status !== 0) return null;
+  return `cron entry installed, syncing every ${syncIntervalLabel()}`;
+}
+function tryInstallSystemd() {
+  if (!binaryExists("systemctl", ["--user", "--version"])) return null;
+  try {
+    mkdirSync2(systemdUserDir(), { recursive: true });
+    writeFileSync2(systemdServicePath(), buildSystemdService());
+    writeFileSync2(systemdTimerPath(), buildSystemdTimer());
+  } catch {
+    return null;
+  }
+  spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+  const res = spawnSync(
+    "systemctl",
+    ["--user", "enable", "--now", `${SYSTEMD_UNIT}.timer`],
+    { stdio: "ignore" }
+  );
+  if (res.status !== 0) {
+    rmSync(systemdServicePath(), { force: true });
+    rmSync(systemdTimerPath(), { force: true });
+    return null;
+  }
+  return `systemd user timer installed, syncing every ${syncIntervalLabel()} (run \`loginctl enable-linger\` to keep syncing while logged out)`;
 }
 function uninstallAutoSync() {
   const os = platform();
@@ -297,12 +495,25 @@ function uninstallAutoSync() {
     return "launchd agent removed";
   }
   if (os === "linux") {
+    let removed = false;
     const current = spawnSync("crontab", ["-l"], { encoding: "utf8" });
-    if (current.status === 0 && current.stdout.includes("whoburnedmore")) {
+    if (!current.error && current.status === 0 && current.stdout.includes("whoburnedmore")) {
       const next = current.stdout.split("\n").filter((l) => !l.includes("whoburnedmore")).join("\n");
       spawnSync("crontab", ["-"], { input: next });
+      removed = true;
     }
-    return "cron entry removed";
+    if (existsSync2(systemdTimerPath())) {
+      spawnSync(
+        "systemctl",
+        ["--user", "disable", "--now", `${SYSTEMD_UNIT}.timer`],
+        { stdio: "ignore" }
+      );
+      rmSync(systemdServicePath(), { force: true });
+      rmSync(systemdTimerPath(), { force: true });
+      spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+      removed = true;
+    }
+    return removed ? "background sync removed" : "nothing to remove";
   }
   if (os === "win32") {
     spawnSync("schtasks", ["/Delete", "/F", "/TN", "whoburnedmore-sync"]);
@@ -313,8 +524,7 @@ function uninstallAutoSync() {
 function autoSyncInstalled() {
   if (platform() === "darwin") return existsSync2(launchAgentPath());
   if (platform() === "linux") {
-    const current = spawnSync("crontab", ["-l"], { encoding: "utf8" });
-    return current.status === 0 && current.stdout.includes("whoburnedmore");
+    return linuxSyncMechanism() !== "none";
   }
   if (platform() === "win32") {
     const res = spawnSync("schtasks", ["/Query", "/TN", "whoburnedmore-sync"], {
@@ -324,22 +534,40 @@ function autoSyncInstalled() {
   }
   return false;
 }
+function readInstalledSystemd() {
+  try {
+    return `${readFileSync2(systemdServicePath(), "utf8")}
+${readFileSync2(systemdTimerPath(), "utf8")}`;
+  } catch {
+    return null;
+  }
+}
+function expectedSystemd() {
+  return `${buildSystemdService()}
+${buildSystemdTimer()}`;
+}
 function readInstalledAgent() {
   if (platform() === "darwin") {
     const p = launchAgentPath();
     return existsSync2(p) ? readFileSync2(p, "utf8") : null;
   }
   if (platform() === "linux") {
-    const current = spawnSync("crontab", ["-l"], { encoding: "utf8" });
-    if (current.status !== 0) return null;
-    const line = current.stdout.split("\n").find((l) => l.includes("whoburnedmore"));
-    return line ?? null;
+    const mech = linuxSyncMechanism();
+    if (mech === "cron") {
+      const current = spawnSync("crontab", ["-l"], { encoding: "utf8" });
+      if (current.error || current.status !== 0) return null;
+      return current.stdout.split("\n").find((l) => l.includes("whoburnedmore")) ?? null;
+    }
+    if (mech === "systemd") return readInstalledSystemd();
+    return null;
   }
   return null;
 }
 function expectedAgent() {
   if (platform() === "darwin") return expectedDarwinPlist();
-  if (platform() === "linux") return expectedLinuxCronLine();
+  if (platform() === "linux") {
+    return linuxSyncMechanism() === "systemd" ? expectedSystemd() : expectedLinuxCronLine();
+  }
   return null;
 }
 function autoSyncDrift() {
@@ -363,6 +591,41 @@ function rotateLogIfLarge(path = syncLogPath(), capBytes = 256 * 1024) {
     return false;
   }
 }
+function notifyLaunchLive(opts) {
+  const os = opts?.platform ?? platform();
+  const run2 = opts?.spawn ?? ((cmd, args) => spawnSync(cmd, args, { stdio: "ignore" }));
+  const title = "whoburnedmore is live";
+  const message = "Your dashboard is ready. Go to whoburnedmore.com";
+  if (os === "darwin") {
+    return run2("osascript", [
+      "-e",
+      `display notification "${message}" with title "${title}"`
+    ]).status === 0;
+  }
+  if (os === "linux") {
+    return run2("notify-send", [title, message]).status === 0;
+  }
+  if (os === "win32") {
+    const psQuote = (value) => `'${value.replaceAll("'", "''")}'`;
+    const script = [
+      "Add-Type -AssemblyName System.Windows.Forms",
+      "$n = New-Object System.Windows.Forms.NotifyIcon",
+      "$n.Icon = [System.Drawing.SystemIcons]::Application",
+      `$n.BalloonTipTitle = ${psQuote(title)}`,
+      `$n.BalloonTipText = ${psQuote(message)}`,
+      "$n.Visible = $true",
+      "$n.ShowBalloonTip(10000)",
+      "Start-Sleep -Seconds 2",
+      "$n.Dispose()"
+    ].join("; ");
+    return run2("powershell", [
+      "-NoProfile",
+      "-Command",
+      script
+    ]).status === 0;
+  }
+  return false;
+}
 function autoSyncLoaded() {
   if (platform() === "darwin") {
     const res = spawnSync("launchctl", ["list"], { encoding: "utf8" });
@@ -389,10 +652,28 @@ function printBanner() {
   console.log();
 }
 
+// src/daemon.ts
+async function daemonLoop(deps) {
+  let cycles = 0;
+  while (!deps.isStopped()) {
+    cycles++;
+    try {
+      await deps.runOnce();
+      deps.log("synced");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      deps.log(`sync failed: ${message} \u2014 retrying next cycle`);
+    }
+    if (deps.isStopped()) break;
+    await deps.wait(deps.intervalMs);
+  }
+  return cycles;
+}
+
 // src/collect.ts
 import { execFile } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { dirname as dirname3, join as join6 } from "node:path";
 import { promisify } from "node:util";
 
 // src/attribution.ts
@@ -751,7 +1032,7 @@ import { join as join5 } from "node:path";
 // src/tokscale.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire } from "node:module";
-import { dirname, join as join4 } from "node:path";
+import { dirname as dirname2, join as join4 } from "node:path";
 var LOOKBACK_DAYS = 30;
 function num(n) {
   const v = Math.round(Number(n));
@@ -795,7 +1076,7 @@ function resolveTokscaleBin() {
     const pkg = require3("tokscale/package.json");
     const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.tokscale ?? "";
     if (!rel) return null;
-    const binPath = join4(dirname(pkgPath), rel);
+    const binPath = join4(dirname2(pkgPath), rel);
     if (/\.(c|m)?js$/.test(binPath)) {
       return { cmd: process.execPath, prefixArgs: [binPath] };
     }
@@ -1128,7 +1409,7 @@ function resolveCcusageBin() {
   const pkgPath = require3.resolve("ccusage/package.json");
   const pkg = require3("ccusage/package.json");
   const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.ccusage ?? "ccusage";
-  const binPath = join6(dirname2(pkgPath), rel);
+  const binPath = join6(dirname3(pkgPath), rel);
   if (/\.(c|m)?js$/.test(binPath)) {
     return { cmd: process.execPath, prefixArgs: [binPath] };
   }
@@ -1152,6 +1433,13 @@ function dedupeDaily(entries) {
   }
   return [...byKey.values()];
 }
+function entryTokens(e) {
+  return e.inputTokens + e.outputTokens + e.cacheCreationTokens + e.cacheReadTokens;
+}
+function capByTokens(rows, max, tokens) {
+  if (rows.length <= max) return rows;
+  return [...rows].sort((a, b) => tokens(b) - tokens(a)).slice(0, max);
+}
 function dedupeSessions(sessions) {
   const byId = /* @__PURE__ */ new Map();
   const total = (s) => s.inputTokens + s.outputTokens + s.cacheCreationTokens + s.cacheReadTokens;
@@ -1263,9 +1551,14 @@ async function collectAll(onProgress) {
     };
   });
   return {
-    entries: dedupeDaily(entries),
-    sessions: dedupedSessions,
-    blocks: dedupeBlocks(blocks),
+    // Cap each array to the server's accepted maximum (the shared SubmitPayload
+    // schema: entries ≤ 20000, sessions/blocks ≤ 10000), keeping the
+    // highest-token rows. Without this, a power user with >10000 distinct sessions
+    // would have their ENTIRE submit rejected with a 400 instead of a capped one.
+    // tools/skills/projects are already bounded upstream (attribution caps).
+    entries: capByTokens(dedupeDaily(entries), 2e4, entryTokens),
+    sessions: capByTokens(dedupedSessions, 1e4, entryTokens),
+    blocks: capByTokens(dedupeBlocks(blocks), 1e4, (b) => b.totalTokens),
     toolsFound,
     tools,
     skills,
@@ -1296,8 +1589,8 @@ function buildStatusReport(s) {
       "    \u21B3 config is out of date \u2014 it will self-repair on your next run"
     );
   }
-  lines.push(`  \u2022 Interval: every ${s.intervalHours}h`);
-  const staleAfterMs = s.intervalHours * 2 * 3600 * 1e3;
+  lines.push(`  \u2022 Interval: every ${syncIntervalLabel(s.intervalMinutes)}`);
+  const staleAfterMs = s.intervalMinutes * 2 * 60 * 1e3;
   if (s.lastSyncAt === null) {
     lines.push("  \u2022 Last sync: never recorded");
     lines.push("  \u26A0 STALE: no successful sync recorded yet \u2014 run `npx whoburnedmore`");
@@ -1306,7 +1599,7 @@ function buildStatusReport(s) {
     lines.push(`  \u2022 Last sync: ${ago(age)}`);
     if (age > staleAfterMs) {
       lines.push(
-        `  \u26A0 STALE: last sync was over ${s.intervalHours * 2}h ago \u2014 your dashboard may be behind. Run \`npx whoburnedmore\`.`
+        `  \u26A0 STALE: last sync was over ${syncIntervalLabel(s.intervalMinutes * 2)} ago \u2014 your dashboard may be behind. Run \`npx whoburnedmore\`.`
       );
     } else {
       lines.push("  \u2713 Fresh \u2014 your dashboard is up to date.");
@@ -1328,7 +1621,7 @@ function agentStatusReport(now = Date.now()) {
     installed: autoSyncInstalled(),
     loaded: autoSyncLoaded(),
     drift: autoSyncDrift(),
-    intervalHours: SYNC_INTERVAL_HOURS,
+    intervalMinutes: SYNC_INTERVAL_MINUTES,
     lastSyncAt: typeof cfg?.lastSyncAt === "number" ? cfg.lastSyncAt : null,
     now,
     nodePath,
@@ -5378,6 +5671,48 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../shared/dist/tenant.js
+var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
+  "www",
+  "api",
+  "app",
+  "admin",
+  "mail",
+  "email",
+  "cdn",
+  "static",
+  "assets",
+  "blog",
+  "docs",
+  "status",
+  "help",
+  "support",
+  "ingest",
+  "vercel",
+  "preview",
+  "staging",
+  "dev",
+  "test"
+]);
+
+// ../shared/dist/launch-gate.js
+var LaunchAccessMode = external_exports.enum(["full", "invited", "waitlisted"]);
+var LaunchStatusResponse = external_exports.object({
+  mode: LaunchAccessMode,
+  launchAt: external_exports.string().datetime(),
+  now: external_exports.string().datetime(),
+  remainingSeconds: external_exports.number().int().nonnegative(),
+  live: external_exports.boolean()
+});
+var LaunchRedeemRequest = external_exports.object({
+  code: external_exports.string().trim().min(2).max(64)
+});
+var LaunchRedeemResponse = external_exports.object({
+  ok: external_exports.literal(true),
+  mode: LaunchAccessMode,
+  expiresAt: external_exports.string().datetime().nullable()
+});
+
 // ../shared/dist/index.js
 var DateString = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be YYYY-MM-DD");
 var tokenCount = external_exports.number().int().nonnegative();
@@ -5493,7 +5828,16 @@ var SubmitPayload = external_exports.object({
    */
   attributionComplete: external_exports.boolean().optional(),
   /** Optional friends-board code (from `--board=<code>`): auto-join this board on submit. */
-  board: external_exports.string().min(1).max(32).optional()
+  board: external_exports.string().min(1).max(32).optional(),
+  /** Optional organization slug (from `--org=<slug>`): auto-join this org on submit. */
+  org: external_exports.string().min(2).max(32).optional(),
+  /**
+   * Optional org join password (from `--pass=<code>` / `--code=<code>`): required
+   * to attach a CLI run to an `org`. Back-compat: omittable — a run with no org
+   * never needs it, and a wrong/missing code only skips the org attach (the
+   * personal submit still succeeds).
+   */
+  orgCode: external_exports.string().min(1).max(64).optional()
 });
 var AnonSubmitPayload = SubmitPayload.extend({
   /** Client-generated secret (hex). The server stores only its hash. */
@@ -5504,6 +5848,96 @@ function entryTotalTokens(e) {
 }
 var LeaderboardPeriod = external_exports.enum(["today", "7d", "30d", "all"]);
 var LeaderboardMetric = external_exports.enum(["tokens", "cost"]);
+var OrgType = external_exports.enum(["company", "hackathon", "hackerhouse"]);
+var MemberRole = external_exports.enum(["owner", "admin", "member"]);
+var OrgBoardVisibility = external_exports.enum(["public", "members"]);
+var HexColor = external_exports.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/, "must be a hex color like #f97316");
+var RESERVED_SLUGS = /* @__PURE__ */ new Set([
+  ...RESERVED_SUBDOMAINS,
+  "o",
+  "d",
+  "u",
+  "boards",
+  "board",
+  "claim",
+  "signin",
+  "signout",
+  "login",
+  "logout",
+  "dashboard",
+  "install",
+  "for-teams",
+  "teams",
+  "about",
+  "contact",
+  "trust",
+  "cli",
+  "feedback",
+  "guides",
+  "guide",
+  "join",
+  "leaderboard",
+  "settings",
+  "account",
+  "me",
+  "new",
+  "robots",
+  "sitemap"
+]);
+var SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
+function isValidSlug(slug) {
+  return typeof slug === "string" && slug.length >= 2 && slug.length <= 32 && SLUG_RE.test(slug) && // Reject consecutive hyphens — the regex above permits "a--b", which makes
+  // for confusing subdomains and is never a deliberate slug.
+  !slug.includes("--") && !RESERVED_SLUGS.has(slug);
+}
+var OrgSlug = external_exports.string().min(2).max(32).refine(isValidSlug, "invalid or reserved slug");
+var OrgWindow = external_exports.object({
+  startDate: DateString.nullable().optional(),
+  endDate: DateString.nullable().optional()
+}).refine((w) => !(w.startDate && w.endDate) || w.endDate >= w.startDate, { message: "endDate must be on or after startDate", path: ["endDate"] });
+var OrgJoinPolicy = external_exports.object({
+  allowCodeJoin: external_exports.boolean().default(true),
+  allowDomainJoin: external_exports.boolean().default(false),
+  /** Verified email domains that auto-join, e.g. ["acme.com"]. */
+  emailDomains: external_exports.array(external_exports.string().min(3).max(253).toLowerCase()).max(20).default([])
+});
+var OrgApplicationInput = external_exports.object({
+  type: OrgType,
+  orgName: external_exports.string().min(1).max(120),
+  desiredSlug: external_exports.string().min(2).max(32).optional(),
+  contactName: external_exports.string().min(1).max(120),
+  contactEmail: external_exports.string().email().max(254),
+  website: external_exports.string().url().max(300).optional(),
+  /** Rough headcount / attendee estimate, free text. */
+  size: external_exports.string().max(60).optional(),
+  message: external_exports.string().max(2e3).optional()
+});
+var OrgProvisionInput = external_exports.object({
+  /** When provisioning straight from an application. */
+  applicationId: external_exports.string().min(1).max(64).optional(),
+  slug: OrgSlug,
+  name: external_exports.string().min(1).max(120),
+  type: OrgType,
+  /** Handle (or email) of the user who becomes Owner. */
+  ownerHandle: external_exports.string().min(1).max(120).optional(),
+  ownerEmail: external_exports.string().email().max(254).optional(),
+  description: external_exports.string().max(2e3).optional(),
+  boardVisibility: OrgBoardVisibility.optional(),
+  window: OrgWindow.optional()
+});
+var OrgSettingsInput = external_exports.object({
+  name: external_exports.string().min(1).max(120).optional(),
+  description: external_exports.string().max(2e3).nullable().optional(),
+  accentColor: HexColor.optional(),
+  logoUrl: external_exports.string().url().max(500).nullable().optional(),
+  boardVisibility: OrgBoardVisibility.optional(),
+  window: OrgWindow.optional(),
+  joinPolicy: OrgJoinPolicy.partial().optional()
+});
+var OrgJoinInput = external_exports.object({
+  /** Required only when joining via a code; domain/admin joins omit it. */
+  code: external_exports.string().min(1).max(64).optional()
+});
 
 // src/output.ts
 function formatTokens(n) {
@@ -5815,6 +6249,7 @@ function startProgress() {
   };
 }
 function openBrowser(url) {
+  if (!isOpenableUrl(url)) return;
   const os = platform3();
   const [cmd, args] = os === "darwin" ? ["open", [url]] : os === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
@@ -5880,7 +6315,7 @@ async function run(flags) {
   if (agent.messageCount > 0) payload.agent = agent;
   if (attributionComplete && (tools.length > 0 || skills.length > 0 || projects.length > 0))
     payload.attributionComplete = true;
-  if (flags.board) payload.board = flags.board;
+  applyScope(payload, flags);
   if (flags.dryRun) {
     console.log(pc2.dim("\n  --dry-run: this exact payload would be sent, nothing else:\n"));
     console.log(JSON.stringify(payload, null, 2));
@@ -5909,13 +6344,30 @@ async function run(flags) {
     recordSync();
   } catch {
   }
-  const target = result.boardUrl ? boardClaimUrl(result.boardUrl, result.slug, anonKey) : claimUrl(result.dashboardUrl, anonKey);
+  try {
+    const config = loadConfig();
+    if (result.launch?.live && !config?.launchNotificationDeliveredAt) {
+      if (notifyLaunchLive()) {
+        recordLaunchNotificationDelivered();
+      }
+    }
+  } catch {
+  }
+  const { baseUrl, target } = resolveOpenTarget(result, anonKey);
+  const trusted = isTrustedWebUrl(baseUrl);
   if (!flags.quiet) {
     console.log(
       pc2.green("  \u2713 Synced securely.") + pc2.dim(" Only your daily totals left this machine \u2014 never your prompts, code, or file names.")
     );
-    console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
-    openBrowser(target);
+    if (trusted) {
+      console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
+      openBrowser(target);
+    } else {
+      console.log(
+        pc2.dim("  The server returned an unexpected dashboard address, so it was NOT auto-opened. Open it yourself only if you trust it:")
+      );
+      console.log(`  ${baseUrl}`);
+    }
   }
   const lines = submitNextStepLines(result);
   for (const line of lines) {
@@ -5933,10 +6385,89 @@ async function run(flags) {
   if (!flags.quiet) {
     console.log();
     console.log(
-      autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every hour (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
+      autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every 15 min (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
     );
   }
 }
+async function linkServerInstall(token) {
+  if (!token) {
+    throw new Error("missing install token \u2014 use `npx whoburnedmore link --token=<token>`");
+  }
+  const anonKey = ensureAnonKey();
+  const linked = await redeemServerInstall(token, anonKey);
+  console.log(
+    linked.alreadyLinked ? `  This machine is already linked to @${linked.handle}.` : `  Linked this machine to @${linked.handle}.`
+  );
+  if (linked.mergedDays > 0) {
+    console.log(pc2.dim(`  Merged ${linked.mergedDays} existing usage day${linked.mergedDays === 1 ? "" : "s"} from this machine.`));
+  }
+  await run({
+    dryRun: false,
+    noSubmit: false,
+    local: false,
+    quiet: true
+  });
+  try {
+    const action = reconcileAutoSync();
+    if (action === "installed") {
+      console.log(pc2.dim("  Background sync installed; this machine will refresh every 15 min."));
+    } else if (action === "reinstalled") {
+      console.log(pc2.dim("  Background sync repaired; this machine will refresh every 15 min."));
+    } else {
+      console.log(pc2.dim("  Background sync is already configured."));
+    }
+  } catch {
+    console.log(pc2.dim("  Linked, but background sync could not be installed automatically. Run `npx whoburnedmore install-sync` to retry."));
+  }
+  console.log(`  Profile: ${linked.profileUrl}`);
+}
+function waitOrAbort(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function runDaemon() {
+  ensureAnonKey();
+  const controller = new AbortController();
+  const onSignal = () => controller.abort();
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  console.log(pc2.bold("  whoburnedmore daemon"));
+  console.log(
+    pc2.dim(
+      `  Syncing in the foreground every ${syncIntervalLabel()} \u2014 run this under systemd, a Docker CMD, pm2 or nohup to keep a server on the leaderboard. Ctrl-C to stop.`
+    )
+  );
+  if (!process.env.WHOBURNEDMORE_CONFIG_DIR) {
+    console.log(
+      pc2.dim(
+        "  Tip: set WHOBURNEDMORE_CONFIG_DIR to a persistent path so this machine's identity survives container/VM restarts."
+      )
+    );
+  }
+  console.log();
+  const cycles = await daemonLoop({
+    intervalMs: SYNC_INTERVAL_MINUTES * 6e4,
+    isStopped: () => controller.signal.aborted,
+    log: (line) => console.log(`  ${pc2.dim((/* @__PURE__ */ new Date()).toISOString())}  ${line}`),
+    wait: (ms) => waitOrAbort(ms, controller.signal),
+    runOnce: async () => {
+      rotateLogIfLarge();
+      await run({ dryRun: false, noSubmit: false, local: false, quiet: true });
+    }
+  });
+  console.log();
+  console.log(pc2.dim(`  Daemon stopped after ${cycles} sync cycle${cycles === 1 ? "" : "s"}.`));
+}
 async function main() {
   const major = Number(process.versions.node.split(".")[0]);
   if (major < 20) {
@@ -5945,13 +6476,16 @@ async function main() {
     return;
   }
   const args = process.argv.slice(2);
-  const command = resolveCommand(args);
+  const baseCommand = resolveCommand(args);
+  const command = args.includes("--watch") && (baseCommand === "run" || baseCommand === "sync") ? "daemon" : baseCommand;
   const flags = {
     dryRun: args.includes("--dry-run"),
     noSubmit: args.includes("--no-submit"),
     local: args.includes("--local"),
     quiet: command === "sync",
-    board: parseBoard(args)
+    board: parseBoard(args),
+    org: parseOrg(args),
+    orgCode: parsePass(args)
   };
   switch (command) {
     case "run":
@@ -5963,6 +6497,12 @@ async function main() {
       await run({ ...flags, noSubmit: false, dryRun: false, local: false });
       break;
     }
+    case "link":
+      await linkServerInstall(parseInstallToken(args));
+      break;
+    case "daemon":
+      await runDaemon();
+      break;
     case "status":
     case "doctor": {
       for (const line of agentStatusReport()) console.log(line);
@@ -6016,9 +6556,12 @@ function printHelp() {
   ${pc2.bold("usage")}
     npx whoburnedmore              burn + land on the public leaderboard, open your dashboard
     npx whoburnedmore --board=CODE compare with friends \u2014 join their board (no sign-in)
+    npx whoburnedmore --org=SLUG   submit to your organization's board (companies/hackathons)
     npx whoburnedmore --local      build the dashboard on your machine and open it (offline)
     npx whoburnedmore --dry-run    print exactly what would be sent, send nothing
     npx whoburnedmore --no-submit  collect locally, send nothing (no dashboard)
+    npx whoburnedmore link --token=TOKEN  link this server/VM to your signed-in account
+    npx whoburnedmore daemon       keep syncing in the foreground (VMs/containers with no cron)
     npx whoburnedmore private      hide your dashboard from the leaderboard
     npx whoburnedmore public       put it back on the leaderboard
     npx whoburnedmore remove       delete your dashboard and its data
@@ -6027,12 +6570,20 @@ function printHelp() {
     npx whoburnedmore install-sync     turn it back on after uninstalling
 
   Background sync is on by default: after your first run, your page refreshes
-  automatically every hour (\`uninstall-sync\` to stop). Your dashboard is public on
+  automatically every 15 min (\`uninstall-sync\` to stop). Your dashboard is public on
   the leaderboard as an anonymous burner \u2014 sign in on whoburnedmore.com to claim
   it (handle + X) and own your rank, or run \`private\`/\`remove\` to pull it. Only
   daily aggregate numbers (date, tool, model, token counts, est. cost) ever leave
   your machine \u2014 never prompts, code, or file names. With --local, nothing leaves
   your machine at all.
+
+  ${pc2.bold("servers & VMs")}
+    Generate a one-time \`link\` command from your profile on whoburnedmore.com and
+    run it inside the VM to bind that machine to your account. On a persistent VM
+    background sync uses cron or a systemd user timer automatically; in a container
+    or any host without a scheduler, run \`whoburnedmore daemon\` under your process
+    manager instead. Set WHOBURNEDMORE_CONFIG_DIR to a persistent path so the
+    machine identity survives restarts. See docs/SERVER-VM-SETUP.md.
 `);
 }
 main().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.8.7",
+  "version": "0.9.1",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {
@@ -13,7 +13,8 @@
     "build": "rm -rf dist && esbuild src/index.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/index.js --external:ccusage --external:picocolors --external:tokscale",
     "test": "vitest run",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "prepublishOnly": "pnpm run build",
+    "smoke:package": "node scripts/smoke-package.mjs",
+    "prepublishOnly": "pnpm run lint && pnpm run test && pnpm run build && pnpm run smoke:package",
     "release:patch": "npm version patch && npm publish",
     "release:minor": "npm version minor && npm publish",
     "release:major": "npm version major && npm publish"