whoburnedmore 0.9.2 → 0.9.4

package/dist/index.js

@@ -10,7 +10,7 @@ import { spawn } from "node:child_process";
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { platform as platform3 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join9 } from "node:path";
 import { createInterface } from "node:readline/promises";
 import pc2 from "picocolors";
 
@@ -101,7 +101,10 @@ async function post(path, body) {
     res = await fetch(`${apiBase()}${path}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
+      body: JSON.stringify(body),
+      // Bound the request so a slow/black-holing/hostile server can't hang the CLI
+      // — or the unattended 15-minute background sync — indefinitely.
+      signal: AbortSignal.timeout(3e4)
     });
   } catch {
     throw new Error(
@@ -144,7 +147,8 @@ async function anonRemove(anonKey) {
   const res = await fetch(`${apiBase()}/v1/anon`, {
     method: "DELETE",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ anonKey })
+    body: JSON.stringify({ anonKey }),
+    signal: AbortSignal.timeout(3e4)
   });
   if (res.status !== 200) {
     const b = await res.json().catch(() => ({}));
@@ -167,8 +171,8 @@ import {
   existsSync as existsSync2,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync2,
-  renameSync,
-  rmSync,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
   statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -182,6 +186,8 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  renameSync,
+  rmSync,
   writeFileSync
 } from "node:fs";
 import { homedir } from "node:os";
@@ -211,10 +217,20 @@ function loadConfig(dir = defaultConfigDir()) {
 function saveConfig(dir = defaultConfigDir(), config = {}) {
   mkdirSync(dir, { recursive: true });
   const file = join(dir, "config.json");
-  writeFileSync(file, JSON.stringify(config, null, 2), { mode: 384 });
+  const tmp = join(dir, `config.json.${process.pid}.tmp`);
   try {
-    chmodSync(file, 384);
-  } catch {
+    writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 384 });
+    try {
+      chmodSync(tmp, 384);
+    } catch {
+    }
+    renameSync(tmp, file);
+  } catch (err) {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+    throw err;
   }
 }
 function ensureAnonKey(dir = defaultConfigDir()) {
@@ -250,11 +266,55 @@ var STABLE_NPM_CANDIDATES = [
   "/usr/bin/npm"
 ];
 var LATEST_PACKAGE_SPEC = "whoburnedmore@latest";
+var SYNC_PATH_DIRS = [
+  "/opt/homebrew/bin",
+  "/usr/local/bin",
+  "/usr/bin",
+  "/bin",
+  "/usr/sbin",
+  "/sbin"
+];
+function syncPathEnv(npmPath = resolveNpmPath()) {
+  const dir = dirname(npmPath);
+  const dirs = [];
+  if (dir && dir !== "." && dir !== "/" && dir !== npmPath) dirs.push(dir);
+  for (const d of SYNC_PATH_DIRS) {
+    if (!dirs.includes(d)) dirs.push(d);
+  }
+  return dirs.join(":");
+}
+var FORWARDED_ENV_VARS = [
+  "WHOBURNEDMORE_CONFIG_DIR",
+  // identity: where the anonKey lives
+  "WHOBURNEDMORE_API",
+  // endpoint: where submits go
+  "WHOBURNEDMORE_WEB",
+  // dashboard URL shown to the user
+  "XDG_CONFIG_HOME",
+  // base for the default config dir
+  "CLAUDE_CONFIG_DIR"
+  // a primary usage-collection source
+];
+function syncEnv(opts) {
+  const env = opts?.env ?? process.env;
+  const pairs = [["PATH", syncPathEnv(opts?.npmPath)]];
+  for (const key of FORWARDED_ENV_VARS) {
+    const value = env[key];
+    if (typeof value === "string" && value.length > 0 && !/[\r\n]/.test(value)) {
+      pairs.push([key, value]);
+    }
+  }
+  return pairs;
+}
 function syncLogPath() {
   return join2(defaultConfigDir(), "sync.log");
 }
-function buildLaunchdPlist(commandArgs = syncCommandArgs(), logPath = syncLogPath()) {
+function buildLaunchdPlist(commandArgs = syncCommandArgs(), logPath = syncLogPath(), envPairs = syncEnv({ npmPath: commandArgs[0] })) {
   const programArguments = commandArgs.map((arg) => `    <string>${xmlEscape(arg)}</string>`).join("\n");
+  const envEntries = envPairs.map(
+    ([k, v]) => `    <key>${xmlEscape(k)}</key>
+    <string>${xmlEscape(v)}</string>`
+  ).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -265,6 +325,15 @@ function buildLaunchdPlist(commandArgs = syncCommandArgs(), logPath = syncLogPat
   <array>
 ${programArguments}
   </array>
+  <!-- launchd runs jobs with a minimal PATH (/usr/bin:/bin:/usr/sbin:/sbin)
+       that excludes Homebrew. npm's shebang (and the package bin npm exec
+       spawns) is #!/usr/bin/env node, so node must be on PATH or every tick
+       dies with "env: node: No such file or directory". We also forward the
+       user's identity/endpoint/collection env so background == foreground. -->
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>
   <key>StartInterval</key>
   <integer>${SYNC_INTERVAL_MINUTES * 60}</integer>
   <!-- Run once right after login/reboot so a machine that was off (or asleep)
@@ -398,7 +467,10 @@ function cronSchedule(mins = SYNC_INTERVAL_MINUTES) {
 }
 function expectedLinuxCronLine(opts) {
   const command = syncCommandArgs(opts?.npmPath).map(shellQuote).join(" ");
-  return `${cronSchedule()} ${command} >${shellQuote(opts?.logPath ?? syncLogPath())} 2>&1`;
+  const envPrefix = syncEnv({ npmPath: opts?.npmPath ?? resolveNpmPath() }).map(([k, v]) => `${k}=${shellQuote(v)}`).join(" ");
+  const redirect = `>${shellQuote(opts?.logPath ?? syncLogPath())} 2>&1`;
+  const commandField = `${envPrefix} ${command} ${redirect}`.replaceAll("%", "\\%");
+  return `${cronSchedule()} ${commandField}`;
 }
 var SYSTEMD_UNIT = "whoburnedmore-sync";
 function systemdUserDir() {
@@ -412,15 +484,17 @@ function systemdTimerPath() {
   return join2(systemdUserDir(), `${SYSTEMD_UNIT}.timer`);
 }
 function systemdQuote(value) {
-  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+  return `"${value.replaceAll("\\", "\\\\").replaceAll("%", "%%").replaceAll('"', '\\"')}"`;
 }
-function buildSystemdService(commandArgs = syncCommandArgs()) {
+function buildSystemdService(commandArgs = syncCommandArgs(), envPairs = syncEnv({ npmPath: commandArgs[0] })) {
   const execStart = commandArgs.map(systemdQuote).join(" ");
+  const envLines = envPairs.map(([k, v]) => `Environment=${systemdQuote(`${k}=${v}`)}`).join("\n");
   return `[Unit]
 Description=whoburnedmore background token-usage sync
 
 [Service]
 Type=oneshot
+${envLines}
 ExecStart=${execStart}
 `;
 }
@@ -478,8 +552,8 @@ function tryInstallSystemd() {
     { stdio: "ignore" }
   );
   if (res.status !== 0) {
-    rmSync(systemdServicePath(), { force: true });
-    rmSync(systemdTimerPath(), { force: true });
+    rmSync2(systemdServicePath(), { force: true });
+    rmSync2(systemdTimerPath(), { force: true });
     return null;
   }
   return `systemd user timer installed, syncing every ${syncIntervalLabel()} (run \`loginctl enable-linger\` to keep syncing while logged out)`;
@@ -490,7 +564,7 @@ function uninstallAutoSync() {
     const plistPath = launchAgentPath();
     if (existsSync2(plistPath)) {
       spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore" });
-      rmSync(plistPath, { force: true });
+      rmSync2(plistPath, { force: true });
     }
     return "launchd agent removed";
   }
@@ -508,8 +582,8 @@ function uninstallAutoSync() {
         ["--user", "disable", "--now", `${SYSTEMD_UNIT}.timer`],
         { stdio: "ignore" }
       );
-      rmSync(systemdServicePath(), { force: true });
-      rmSync(systemdTimerPath(), { force: true });
+      rmSync2(systemdServicePath(), { force: true });
+      rmSync2(systemdTimerPath(), { force: true });
       spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
       removed = true;
     }
@@ -585,7 +659,7 @@ function rotateLogIfLarge(path = syncLogPath(), capBytes = 256 * 1024) {
   try {
     if (!existsSync2(path)) return false;
     if (statSync(path).size <= capBytes) return false;
-    renameSync(path, `${path}.1`);
+    renameSync2(path, `${path}.1`);
     return true;
   } catch {
     return false;
@@ -673,46 +747,23 @@ async function daemonLoop(deps) {
 // src/collect.ts
 import { execFile } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname3, join as join8 } from "node:path";
 import { promisify } from "node:util";
 
 // src/attribution.ts
 import { readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename, join as join3 } from "node:path";
-
-// src/pricing.ts
-var TABLE = [
-  { match: /opus/i, price: { in: 15, out: 75, cacheWrite: 18.75, cacheRead: 1.5 } },
-  { match: /sonnet/i, price: { in: 3, out: 15, cacheWrite: 3.75, cacheRead: 0.3 } },
-  { match: /haiku/i, price: { in: 0.8, out: 4, cacheWrite: 1, cacheRead: 0.08 } },
-  { match: /fable/i, price: { in: 15, out: 75, cacheWrite: 18.75, cacheRead: 1.5 } },
-  { match: /gpt-4o|gpt-4\.1/i, price: { in: 2.5, out: 10, cacheWrite: 2.5, cacheRead: 1.25 } },
-  { match: /gpt-5|o3|o4|codex/i, price: { in: 1.25, out: 10, cacheWrite: 1.25, cacheRead: 0.125 } },
-  { match: /gemini.*flash/i, price: { in: 0.15, out: 0.6, cacheWrite: 0.15, cacheRead: 0.0375 } },
-  { match: /gemini/i, price: { in: 1.25, out: 5, cacheWrite: 1.25, cacheRead: 0.31 } }
-];
-function estimateCostUSD(model, t) {
-  const row = TABLE.find((r) => r.match.test(model));
-  if (!row) return 0;
-  const p = row.price;
-  const usd = (t.inputTokens * p.in + t.outputTokens * p.out + t.cacheCreationTokens * p.cacheWrite + t.cacheReadTokens * p.cacheRead) / 1e6;
-  return usd > 0 ? usd : 0;
-}
-
-// src/attribution.ts
+import { join as join3 } from "node:path";
 var CLAUDE_PROJECTS = join3(homedir3(), ".claude", "projects");
 var CODEX_SESSIONS = join3(homedir3(), ".codex", "sessions");
 var MAX_FILES = 5e3;
 var MAX_FILE_BYTES = 64 * 1024 * 1024;
 var TIME_BUDGET_MS = 12e3;
 var MAX_STATS = 300;
-var MAX_PROJECTS = 500;
 function createAccumulator() {
   return {
     tools: /* @__PURE__ */ new Map(),
     skills: /* @__PURE__ */ new Map(),
-    projects: /* @__PURE__ */ new Map(),
     agent: {
       messageCount: 0,
       subagentMessages: 0,
@@ -720,7 +771,6 @@ function createAccumulator() {
       totalTokens: 0,
       userMessageCount: 0
     },
-    titles: /* @__PURE__ */ new Map(),
     sessionMessages: /* @__PURE__ */ new Map()
   };
 }
@@ -761,9 +811,6 @@ function processRecord(rec, acc, ctx) {
     sk.tokens += recTokens;
     acc.skills.set(s, sk);
   }
-  if (r.type === "ai-title" && typeof r.aiTitle === "string" && r.aiTitle && typeof r.sessionId === "string" && r.sessionId) {
-    acc.titles.set(r.sessionId, r.aiTitle.slice(0, 200));
-  }
   const content = r.message?.content;
   if (!Array.isArray(content)) return;
   const isAssistant = r.type === "assistant" || r.message?.role === "assistant";
@@ -800,25 +847,6 @@ function processRecord(rec, acc, ctx) {
         (acc.sessionMessages.get(r.sessionId) ?? 0) + 1
       );
     }
-    if (typeof r.cwd === "string" && r.cwd && tokens > 0) {
-      const name = basename(r.cwd).slice(0, 128) || "unknown";
-      const model = typeof r.message?.model === "string" ? r.message.model : "unknown";
-      const u = r.message?.usage;
-      const num3 = (v) => {
-        const x = Math.round(Number(v));
-        return Number.isFinite(x) && x > 0 ? x : 0;
-      };
-      const cost = estimateCostUSD(model, {
-        inputTokens: num3(u?.input_tokens),
-        outputTokens: num3(u?.output_tokens),
-        cacheCreationTokens: num3(u?.cache_creation_input_tokens),
-        cacheReadTokens: num3(u?.cache_read_input_tokens)
-      });
-      const p = acc.projects.get(name) ?? { tokens: 0, costUSD: 0 };
-      p.tokens += tokens;
-      p.costUSD += cost;
-      acc.projects.set(name, p);
-    }
   } else if (isUser) {
     for (const block of content) {
       if (block && typeof block === "object" && block.type === "tool_result" && block.is_error === true) {
@@ -844,20 +872,11 @@ function toToolStats(map) {
     return base;
   });
 }
-function toProjectStats(map) {
-  return [...map.entries()].map(([name, v]) => ({
-    name,
-    tokens: v.tokens,
-    costUSD: Number(v.costUSD.toFixed(6))
-  })).filter((p) => p.tokens > 0).sort((a, b) => b.tokens - a.tokens).slice(0, MAX_PROJECTS);
-}
 function accumulatorToResult(acc) {
   return {
     tools: toToolStats(acc.tools),
     skills: toSkillStats(acc.skills),
-    projects: toProjectStats(acc.projects),
     agent: { ...acc.agent },
-    titles: acc.titles,
     sessionMessages: acc.sessionMessages,
     complete: true
   };
@@ -867,7 +886,7 @@ function numTok(v) {
   return Number.isFinite(x) && x > 0 ? x : 0;
 }
 function createCodexContext() {
-  return { cwd: "", model: "unknown", pending: [] };
+  return { pending: [] };
 }
 function processCodexRecord(rec, acc, ctx) {
   if (!rec || typeof rec !== "object") return;
@@ -875,11 +894,7 @@ function processCodexRecord(rec, acc, ctx) {
   if (!r.payload || typeof r.payload !== "object") return;
   const pl = r.payload;
   const ptype = pl.type;
-  if (r.type === "session_meta" || r.type === "turn_context") {
-    if (typeof pl.cwd === "string" && pl.cwd) ctx.cwd = pl.cwd;
-    if (typeof pl.model === "string" && pl.model) ctx.model = pl.model;
-    return;
-  }
+  if (r.type === "session_meta" || r.type === "turn_context") return;
   if (ptype === "function_call" || ptype === "custom_tool_call" || ptype === "local_shell_call") {
     const raw = typeof pl.name === "string" ? pl.name : ptype === "local_shell_call" ? "local_shell" : "";
     const name = raw.slice(0, 128);
@@ -905,19 +920,6 @@ function processCodexRecord(rec, acc, ctx) {
     }
     acc.agent.messageCount += 1;
     acc.agent.totalTokens += tokens;
-    if (ctx.cwd) {
-      const name = basename(ctx.cwd).slice(0, 128) || "unknown";
-      const cost = estimateCostUSD(ctx.model, {
-        inputTokens,
-        outputTokens,
-        cacheCreationTokens: 0,
-        cacheReadTokens
-      });
-      const proj = acc.projects.get(name) ?? { tokens: 0, costUSD: 0 };
-      proj.tokens += tokens;
-      proj.costUSD += cost;
-      acc.projects.set(name, proj);
-    }
     const per = ctx.pending.length > 0 ? Math.floor(tokens / ctx.pending.length) : 0;
     for (const tu of ctx.pending) {
       const t = acc.tools.get(tu.name);
@@ -1272,6 +1274,361 @@ async function collectCursor() {
   return { entries: [], blocks: [], found: false };
 }
 
+// src/native/claude.ts
+import { readdir, readFile } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { join as join6 } from "node:path";
+
+// src/pricing.ts
+var TABLE = [
+  { match: /opus/i, price: { in: 15, out: 75, cacheWrite: 18.75, cacheRead: 1.5 } },
+  { match: /sonnet/i, price: { in: 3, out: 15, cacheWrite: 3.75, cacheRead: 0.3 } },
+  { match: /haiku/i, price: { in: 0.8, out: 4, cacheWrite: 1, cacheRead: 0.08 } },
+  { match: /fable/i, price: { in: 15, out: 75, cacheWrite: 18.75, cacheRead: 1.5 } },
+  { match: /gpt-4o|gpt-4\.1/i, price: { in: 2.5, out: 10, cacheWrite: 2.5, cacheRead: 1.25 } },
+  { match: /gpt-5|o3|o4|codex/i, price: { in: 1.25, out: 10, cacheWrite: 1.25, cacheRead: 0.125 } },
+  { match: /gemini.*flash/i, price: { in: 0.15, out: 0.6, cacheWrite: 0.15, cacheRead: 0.0375 } },
+  { match: /gemini/i, price: { in: 1.25, out: 5, cacheWrite: 1.25, cacheRead: 0.31 } }
+];
+function estimateCostUSD(model, t) {
+  const row = TABLE.find((r) => r.match.test(model));
+  if (!row) return 0;
+  const p = row.price;
+  const usd = (t.inputTokens * p.in + t.outputTokens * p.out + t.cacheCreationTokens * p.cacheWrite + t.cacheReadTokens * p.cacheRead) / 1e6;
+  return usd > 0 ? usd : 0;
+}
+
+// src/native/claude.ts
+function num3(n) {
+  const v = Math.round(Number(n));
+  return Number.isFinite(v) && v > 0 ? v : 0;
+}
+function reqTokens(r) {
+  return r.inputTokens + r.outputTokens + r.cacheCreationTokens + r.cacheReadTokens;
+}
+function localDate(iso) {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return null;
+  const d = new Date(t);
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}-${m}-${day}`;
+}
+var syntheticCounter = 0;
+function parseClaudeLine(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  let obj;
+  try {
+    obj = JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+  const message = obj.message;
+  if (!message || typeof message !== "object") return null;
+  const usage = message.usage;
+  if (!usage || typeof usage !== "object") return null;
+  if (message.role !== void 0 && message.role !== "assistant") return null;
+  const date = localDate(String(obj.timestamp ?? ""));
+  if (!date) return null;
+  const messageId = typeof message.id === "string" ? message.id : "";
+  const requestId = typeof obj.requestId === "string" ? obj.requestId : "";
+  const hasRealId = messageId !== "" || requestId !== "";
+  const key = hasRealId ? `${messageId}|${requestId}` : `synthetic|${date}|${syntheticCounter += 1}`;
+  return {
+    key,
+    hasRealId,
+    date,
+    model: typeof message.model === "string" ? message.model : "unknown",
+    inputTokens: num3(usage.input_tokens),
+    outputTokens: num3(usage.output_tokens),
+    cacheCreationTokens: num3(usage.cache_creation_input_tokens),
+    cacheReadTokens: num3(usage.cache_read_input_tokens)
+  };
+}
+function accumulateClaudeLines(acc, lines) {
+  for (const line of lines) {
+    const r = parseClaudeLine(line);
+    if (!r) continue;
+    const prev = acc.get(r.key);
+    if (!prev || reqTokens(r) > reqTokens(prev)) acc.set(r.key, r);
+  }
+}
+function finalizeClaudeEntries(acc) {
+  const byDayModel = /* @__PURE__ */ new Map();
+  for (const r of acc.values()) {
+    const k = `${r.date}|${r.model}`;
+    let b = byDayModel.get(k);
+    if (!b) {
+      b = {
+        date: r.date,
+        model: r.model,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheCreationTokens: 0,
+        cacheReadTokens: 0,
+        requestCount: 0
+      };
+      byDayModel.set(k, b);
+    }
+    b.inputTokens += r.inputTokens;
+    b.outputTokens += r.outputTokens;
+    b.cacheCreationTokens += r.cacheCreationTokens;
+    b.cacheReadTokens += r.cacheReadTokens;
+    if (r.hasRealId) b.requestCount += 1;
+  }
+  const entries = [];
+  for (const b of byDayModel.values()) {
+    const tokens = b.inputTokens + b.outputTokens + b.cacheCreationTokens + b.cacheReadTokens;
+    if (tokens === 0) continue;
+    entries.push({
+      date: b.date,
+      tool: "claude",
+      model: b.model,
+      inputTokens: b.inputTokens,
+      outputTokens: b.outputTokens,
+      cacheCreationTokens: b.cacheCreationTokens,
+      cacheReadTokens: b.cacheReadTokens,
+      costUSD: estimateCostUSD(b.model, b),
+      origin: "cli",
+      verified: false,
+      requestCount: b.requestCount
+    });
+  }
+  return entries;
+}
+function resolveClaudeConfigRoots(env = process.env) {
+  const override = env.CLAUDE_CONFIG_DIR;
+  return override ? override.split(",").map((s) => s.trim()).filter(Boolean) : [join6(homedir5(), ".claude"), join6(homedir5(), ".config", "claude")];
+}
+function resolveClaudeProjectDirs(env = process.env) {
+  return resolveClaudeConfigRoots(env).map((r) => join6(r, "projects"));
+}
+async function listJsonl(dir) {
+  let dirents;
+  try {
+    dirents = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const d of dirents) {
+    const full = join6(dir, d.name);
+    if (d.isDirectory()) {
+      out.push(...await listJsonl(full));
+    } else if (d.isFile() && d.name.endsWith(".jsonl")) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+var NATIVE_READ_BUDGET_MS = 2e4;
+function* splitLines(content) {
+  let start = 0;
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") {
+      yield content.slice(start, i);
+      start = i + 1;
+    }
+  }
+  if (start < content.length) yield content.slice(start);
+}
+async function collectClaudeNative(env = process.env, opts = {}) {
+  const dirs = resolveClaudeProjectDirs(env);
+  const files = [];
+  for (const dir of dirs) files.push(...await listJsonl(dir));
+  if (files.length === 0) return { entries: [], found: false, filesScanned: 0 };
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.budgetMs ?? NATIVE_READ_BUDGET_MS);
+  const acc = /* @__PURE__ */ new Map();
+  let scanned = 0;
+  for (const f of files) {
+    if (now() > deadline) {
+      return { entries: [], found: false, filesScanned: scanned, timedOut: true };
+    }
+    let content;
+    try {
+      content = await readFile(f, "utf8");
+    } catch {
+      continue;
+    }
+    accumulateClaudeLines(acc, splitLines(content));
+    scanned += 1;
+  }
+  return { entries: finalizeClaudeEntries(acc), found: true, filesScanned: scanned };
+}
+
+// src/native/codex.ts
+import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
+import { join as join7 } from "node:path";
+function num4(n) {
+  const v = Math.round(Number(n));
+  return Number.isFinite(v) && v > 0 ? v : 0;
+}
+function localDate2(iso) {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return null;
+  const d = new Date(t);
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}-${m}-${day}`;
+}
+function readTokenFields(payload) {
+  const info = payload.info;
+  const src = info?.total_token_usage ?? payload;
+  const input = src.input_tokens;
+  const output = src.output_tokens;
+  if (input === void 0 && output === void 0) return null;
+  return {
+    input: num4(input),
+    cached: num4(src.cached_input_tokens),
+    output: num4(output),
+    reasoning: num4(src.reasoning_output_tokens)
+  };
+}
+function parseCodexRollout(lines) {
+  let model = "unknown";
+  let lastDate = null;
+  let last = null;
+  let turnCount = 0;
+  for (const raw of lines) {
+    const trimmed = raw.trim();
+    if (!trimmed) continue;
+    let obj;
+    try {
+      obj = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const payload = obj.payload;
+    if (!payload || typeof payload !== "object") continue;
+    const kind = obj.type;
+    if (kind === "session_meta" || kind === "turn_context") {
+      if (typeof payload.model === "string" && payload.model) model = payload.model;
+    }
+    if (payload.type === "token_count") {
+      const fields = readTokenFields(payload);
+      if (!fields) continue;
+      last = fields;
+      turnCount += 1;
+      const d = localDate2(String(obj.timestamp ?? ""));
+      if (d) lastDate = d;
+    }
+  }
+  if (!last || !lastDate) return null;
+  const cacheReadTokens = last.cached;
+  const inputTokens = Math.max(0, last.input - last.cached);
+  const outputTokens = last.output + last.reasoning;
+  if (inputTokens + outputTokens + cacheReadTokens === 0) return null;
+  return {
+    date: lastDate,
+    model,
+    inputTokens,
+    outputTokens,
+    cacheCreationTokens: 0,
+    cacheReadTokens,
+    turnCount
+  };
+}
+function accumulateCodexSession(acc, lines) {
+  const s = parseCodexRollout(lines);
+  if (!s) return;
+  const k = `${s.date}|${s.model}`;
+  let b = acc.get(k);
+  if (!b) {
+    b = {
+      date: s.date,
+      model: s.model,
+      inputTokens: 0,
+      outputTokens: 0,
+      cacheCreationTokens: 0,
+      cacheReadTokens: 0,
+      requestCount: 0
+    };
+    acc.set(k, b);
+  }
+  b.inputTokens += s.inputTokens;
+  b.outputTokens += s.outputTokens;
+  b.cacheCreationTokens += s.cacheCreationTokens;
+  b.cacheReadTokens += s.cacheReadTokens;
+  b.requestCount += s.turnCount;
+}
+function finalizeCodexEntries(acc) {
+  const entries = [];
+  for (const b of acc.values()) {
+    entries.push({
+      date: b.date,
+      tool: "codex",
+      model: b.model,
+      inputTokens: b.inputTokens,
+      outputTokens: b.outputTokens,
+      cacheCreationTokens: b.cacheCreationTokens,
+      cacheReadTokens: b.cacheReadTokens,
+      costUSD: estimateCostUSD(b.model, b),
+      origin: "cli",
+      verified: false,
+      requestCount: b.requestCount
+    });
+  }
+  return entries;
+}
+function resolveCodexSessionsDir(env = process.env) {
+  const home = env.CODEX_HOME && env.CODEX_HOME.trim() ? env.CODEX_HOME.trim() : join7(homedir6(), ".codex");
+  return join7(home, "sessions");
+}
+async function listJsonl2(dir) {
+  let dirents;
+  try {
+    dirents = await readdir2(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const d of dirents) {
+    const full = join7(dir, d.name);
+    if (d.isDirectory()) out.push(...await listJsonl2(full));
+    else if (d.isFile() && d.name.endsWith(".jsonl")) out.push(full);
+  }
+  return out;
+}
+function* splitLines2(content) {
+  let start = 0;
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") {
+      yield content.slice(start, i);
+      start = i + 1;
+    }
+  }
+  if (start < content.length) yield content.slice(start);
+}
+var NATIVE_READ_BUDGET_MS2 = 2e4;
+async function collectCodexNative(env = process.env, opts = {}) {
+  const dir = resolveCodexSessionsDir(env);
+  const files = await listJsonl2(dir);
+  if (files.length === 0) return { entries: [], found: false, filesScanned: 0 };
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.budgetMs ?? NATIVE_READ_BUDGET_MS2);
+  const acc = /* @__PURE__ */ new Map();
+  let scanned = 0;
+  for (const f of files) {
+    if (now() > deadline) {
+      return { entries: [], found: false, filesScanned: scanned, timedOut: true };
+    }
+    let content;
+    try {
+      content = await readFile2(f, "utf8");
+    } catch {
+      continue;
+    }
+    accumulateCodexSession(acc, splitLines2(content));
+    scanned += 1;
+  }
+  return { entries: finalizeCodexEntries(acc), found: true, filesScanned: scanned };
+}
+
 // src/collect.ts
 var execFileAsync = promisify(execFile);
 var SOURCES = [
@@ -1340,9 +1697,12 @@ function mapCcusageDaily(tool, json) {
         };
       });
     } else {
+      const modelsUsed = Array.isArray(day.modelsUsed) ? day.modelsUsed.filter(
+        (m) => typeof m === "string" && m.length > 0
+      ) : [];
       candidates = [
         {
-          model: "unknown",
+          model: modelsUsed.length === 1 ? modelsUsed[0] : "unknown",
           inputTokens: norm(day.inputTokens),
           outputTokens: norm(day.outputTokens),
           cacheCreationTokens: norm(day.cacheCreationTokens),
@@ -1409,7 +1769,7 @@ function resolveCcusageBin() {
   const pkgPath = require3.resolve("ccusage/package.json");
   const pkg = require3("ccusage/package.json");
   const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.ccusage ?? "ccusage";
-  const binPath = join6(dirname3(pkgPath), rel);
+  const binPath = join8(dirname3(pkgPath), rel);
   if (/\.(c|m)?js$/.test(binPath)) {
     return { cmd: process.execPath, prefixArgs: [binPath] };
   }
@@ -1430,6 +1790,9 @@ function dedupeDaily(entries) {
     prev.cacheReadTokens += e.cacheReadTokens;
     prev.costUSD = Number((prev.costUSD + e.costUSD).toFixed(6));
     prev.verified = prev.verified && e.verified;
+    if (e.requestCount !== void 0 || prev.requestCount !== void 0) {
+      prev.requestCount = (prev.requestCount ?? 0) + (e.requestCount ?? 0);
+    }
   }
   return [...byKey.values()];
 }
@@ -1462,7 +1825,18 @@ function dedupeBlocks(blocks) {
   }
   return [...byStart.values()];
 }
-async function runCcusageOnce(cmd, args) {
+function selectSourceEntries(source, ccusageEntries, native) {
+  if (source === "claude" && native.claude.found && native.claude.entries.length > 0)
+    return native.claude.entries;
+  if (source === "codex" && native.codex.found && native.codex.entries.length > 0)
+    return native.codex.entries;
+  return ccusageEntries;
+}
+function ccusageClaudeEnv(env = process.env) {
+  if (env.CLAUDE_CONFIG_DIR && env.CLAUDE_CONFIG_DIR.trim()) return env;
+  return { ...env, CLAUDE_CONFIG_DIR: resolveClaudeConfigRoots(env).join(",") };
+}
+async function runCcusageOnce(cmd, args, env) {
   try {
     const { stdout } = await execFileAsync(cmd, args, {
       encoding: "utf8",
@@ -1470,7 +1844,8 @@ async function runCcusageOnce(cmd, args) {
       // A single source shouldn't be able to hang the whole run. 25s is plenty
       // for a healthy local read; a hung source gets killed and (if transient)
       // retried once below rather than stalling everything for minutes.
-      timeout: 25e3
+      timeout: 25e3,
+      ...env ? { env } : {}
     });
     if (!stdout) return { json: null, transient: false };
     try {
@@ -1484,18 +1859,29 @@ async function runCcusageOnce(cmd, args) {
     return { json: null, transient };
   }
 }
-async function runCcusage(cmd, args) {
-  const first = await runCcusageOnce(cmd, args);
+async function runCcusage(cmd, args, env) {
+  const first = await runCcusageOnce(cmd, args, env);
   if (first.json !== null || !first.transient) return first.json;
-  return (await runCcusageOnce(cmd, args)).json;
+  return (await runCcusageOnce(cmd, args, env)).json;
 }
 var COLLECT_STAGES = SOURCES.length + 4;
 async function collectAll(onProgress) {
   const { cmd, prefixArgs } = resolveCcusageBin();
   let done = 0;
   const tick = () => onProgress?.(++done, COLLECT_STAGES, "");
+  const nativeClaudeTask = collectClaudeNative().catch(
+    () => ({ entries: [], found: false, filesScanned: 0 })
+  );
+  const nativeCodexTask = collectCodexNative().catch(
+    () => ({ entries: [], found: false, filesScanned: 0 })
+  );
   const sourceTasks = SOURCES.map(async (source) => {
-    const json = await runCcusage(cmd, [...prefixArgs, source, "daily", "--json", "--offline"]);
+    const env = source === "claude" ? ccusageClaudeEnv() : void 0;
+    const json = await runCcusage(
+      cmd,
+      [...prefixArgs, source, "daily", "--json", "--offline"],
+      env
+    );
     tick();
     return { source, mapped: json ? mapCcusageDaily(source, json) : [] };
   });
@@ -1519,18 +1905,22 @@ async function collectAll(onProgress) {
     tick();
     return a;
   });
-  const [sourceResults, sessions, blocks, cursor, attribution] = await Promise.all([
+  const [sourceResults, sessions, blocks, cursor, attribution, nativeClaude, nativeCodex] = await Promise.all([
     Promise.all(sourceTasks),
     sessionTask,
     blockTask,
     cursorTask,
-    attributionTask
+    attributionTask,
+    nativeClaudeTask,
+    nativeCodexTask
   ]);
+  const native = { claude: nativeClaude, codex: nativeCodex };
   const entries = [];
   const toolsFound = [];
   for (const { source, mapped } of sourceResults) {
-    if (mapped.length > 0) {
-      entries.push(...mapped);
+    const chosen = selectSourceEntries(source, mapped, native);
+    if (chosen.length > 0) {
+      entries.push(...chosen);
       toolsFound.push(source);
     }
   }
@@ -1539,14 +1929,12 @@ async function collectAll(onProgress) {
     blocks.push(...cursor.blocks);
     toolsFound.push("cursor");
   }
-  const { tools, skills, projects, agent, titles, sessionMessages, complete } = attribution;
+  const { tools, skills, agent, sessionMessages, complete } = attribution;
   onProgress?.(COLLECT_STAGES, COLLECT_STAGES, "");
   const dedupedSessions = dedupeSessions(sessions).map((s) => {
-    const title = titles.get(s.sessionId);
     const messageCount = sessionMessages.get(s.sessionId);
     return {
       ...s,
-      ...title ? { title } : {},
       ...messageCount ? { messageCount } : {}
     };
   });
@@ -1555,14 +1943,13 @@ async function collectAll(onProgress) {
     // schema: entries ≤ 20000, sessions/blocks ≤ 10000), keeping the
     // highest-token rows. Without this, a power user with >10000 distinct sessions
     // would have their ENTIRE submit rejected with a 400 instead of a capped one.
-    // tools/skills/projects are already bounded upstream (attribution caps).
+    // tools/skills are already bounded upstream (attribution caps).
     entries: capByTokens(dedupeDaily(entries), 2e4, entryTokens),
     sessions: capByTokens(dedupedSessions, 1e4, entryTokens),
     blocks: capByTokens(dedupeBlocks(blocks), 1e4, (b) => b.totalTokens),
     toolsFound,
     tools,
     skills,
-    projects,
     agent,
     attributionComplete: complete
   };
@@ -5747,7 +6134,18 @@ var DailyUsageEntry = external_exports.object({
   /** Where this entry came from. Defaults to the local CLI for back-compat. */
   origin: UsageOrigin.default("cli"),
   /** True when the numbers come from a provider's authoritative usage API. */
-  verified: external_exports.boolean().default(false)
+  verified: external_exports.boolean().default(false),
+  /**
+   * Structural fingerprint: the number of DISTINCT provider requests
+   * (unique message-id + request-id pairs) that summed into this entry. A real
+   * heavy day is the product of thousands of distinct API requests; a hand-typed
+   * fabrication has none. The server uses this as an anti-fraud signal — a
+   * billion-token day backed by ~zero real requests is the forgery signature.
+   * Optional + back-compat: older CLIs and the ccusage fallback path (which
+   * cannot see request ids) omit it, and an omitted fingerprint is never
+   * penalized.
+   */
+  requestCount: external_exports.number().int().nonnegative().optional()
 });
 var Timestamp = external_exports.string().min(1).max(40);
 var SessionEntry = external_exports.object({
@@ -5760,8 +6158,6 @@ var SessionEntry = external_exports.object({
   cacheReadTokens: tokenCount,
   costUSD: external_exports.number().nonnegative(),
   lastActivity: Timestamp,
-  /** Human-readable AI-generated session title (from transcripts). Optional. */
-  title: external_exports.string().max(200).optional(),
   /** Number of assistant messages in this session (from transcripts). Optional. */
   messageCount: external_exports.number().int().nonnegative().optional()
 });
@@ -5778,11 +6174,6 @@ var ToolStat = external_exports.object({
   /** Tokens burned on turns that used this tool (turn tokens split across its tool calls). Optional. */
   tokens: external_exports.number().int().nonnegative().optional()
 });
-var ProjectStat = external_exports.object({
-  name: external_exports.string().min(1).max(128),
-  tokens: external_exports.number().int().nonnegative(),
-  costUSD: external_exports.number().nonnegative()
-});
 var AgentStat = external_exports.object({
   /** Total assistant messages across transcripts. */
   messageCount: external_exports.number().int().nonnegative(),
@@ -5816,15 +6207,13 @@ var SubmitPayload = external_exports.object({
   tools: external_exports.array(ToolStat).max(300).optional(),
   /** Optional skill-usage frequencies parsed from local transcripts. */
   skills: external_exports.array(SkillStat).max(300).optional(),
-  /** Optional per-project usage totals parsed from local transcripts. */
-  projects: external_exports.array(ProjectStat).max(500).optional(),
   /** Optional subagent-vs-main rollup parsed from local transcripts. */
   agent: AgentStat.optional(),
   /**
    * Set when the transcript scan completed within its time budget, i.e. the
-   * tool/skill/project/agent rollups are a FULL snapshot. The server refreshes
-   * the dashboard breakdowns unconditionally for a full snapshot; for a partial
-   * one (flag absent/false) it keeps its no-shrink guard. Back-compat: omittable.
+   * tool/skill/agent rollups are a FULL snapshot. The server refreshes the
+   * dashboard breakdowns unconditionally for a full snapshot; for a partial one
+   * (flag absent/false) it keeps its no-shrink guard. Back-compat: omittable.
    */
   attributionComplete: external_exports.boolean().optional(),
   /** Optional friends-board code (from `--board=<code>`): auto-join this board on submit. */
@@ -5837,7 +6226,16 @@ var SubmitPayload = external_exports.object({
    * never needs it, and a wrong/missing code only skips the org attach (the
    * personal submit still succeeds).
    */
-  orgCode: external_exports.string().min(1).max(64).optional()
+  orgCode: external_exports.string().min(1).max(64).optional(),
+  /**
+   * The submitter's local UTC offset in minutes EAST of UTC (IST = +330,
+   * US-Pacific DST = -420; i.e. `-new Date().getTimezoneOffset()`). ccusage dates
+   * usage in this local zone, so the server uses the offset to compute each
+   * member's daily/weekly leaderboard window in THEIR calendar day rather than a
+   * UTC one. Back-compat: omittable — older CLIs don't send it and the board falls
+   * back to its default offset. Range clamps to real zones (UTC-14..+14).
+   */
+  tzOffsetMinutes: external_exports.number().int().min(-840).max(840).optional()
 });
 var AnonSubmitPayload = SubmitPayload.extend({
   /** Client-generated secret (hex). The server stores only its hash. */
@@ -5923,7 +6321,16 @@ var OrgProvisionInput = external_exports.object({
   ownerEmail: external_exports.string().email().max(254).optional(),
   description: external_exports.string().max(2e3).optional(),
   boardVisibility: OrgBoardVisibility.optional(),
-  window: OrgWindow.optional()
+  window: OrgWindow.optional(),
+  /** Brand accent applied to the org homepage theming. */
+  accentColor: HexColor.optional(),
+  /**
+   * Create the org UNOWNED and mint a one-time owner-claim ("admin sign-in")
+   * token in the same call. The first person to open the link + sign in becomes
+   * the owner; the token is then consumed. When set, an owner email/handle is
+   * NOT required — the link is how the first admin is assigned.
+   */
+  issueClaimLink: external_exports.boolean().optional()
 });
 var OrgSettingsInput = external_exports.object({
   name: external_exports.string().min(1).max(120).optional(),
@@ -5949,18 +6356,21 @@ function formatTokens(n) {
 function formatUSD(n) {
   return `$${n.toLocaleString("en-US", { maximumFractionDigits: 2 })}`;
 }
+function sanitizeServerText(s) {
+  return s.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
 function submitNextStepLines(result) {
   if (result.boardUrl) {
     const code = result.boardCode ?? result.boardUrl.split("/").filter(Boolean).pop() ?? "";
     return [
-      `  \u{1F91D} You're on the board: ${result.boardUrl}`,
+      `  \u{1F91D} You're on the board: ${sanitizeServerText(result.boardUrl)}`,
       "  \u2192 Open it to see who burned more.",
-      `  \u2192 Get a friend on it \u2014 have them run: npx whoburnedmore --board=${code}`,
+      `  \u2192 Get a friend on it \u2014 have them run: npx whoburnedmore --board=${sanitizeServerText(code)}`,
       "  \u2192 Sign in on the page and add your X to claim your spot and own your rank."
     ];
   }
   return [
-    `  Your dashboard: ${result.dashboardUrl}`,
+    `  Your dashboard: ${sanitizeServerText(result.dashboardUrl)}`,
     "  \u2192 Sign in and add your X on the page to get on the leaderboard and claim your rank.",
     "  Private until you do. Manage anytime: `npx whoburnedmore private` \xB7 `public` \xB7 `remove`."
   ];
@@ -5968,7 +6378,7 @@ function submitNextStepLines(result) {
 
 // src/local-dashboard.ts
 function esc(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function renderDashboardHtml(entries, generatedAt = /* @__PURE__ */ new Date(), connect) {
   const today = generatedAt.toISOString().slice(0, 10);
@@ -6181,8 +6591,12 @@ async function publishLocal(payload, deps) {
   }
   const key = deps.ensureAnonKey();
   const res = await deps.anonSubmit(key, payload);
-  deps.log(`  Published \u2014 you're on the board: ${res.dashboardUrl}`);
-  deps.openBrowser(claimUrl(res.dashboardUrl, key));
+  deps.log(`  Published \u2014 you're on the board: ${sanitizeServerText(res.dashboardUrl)}`);
+  if (isTrustedWebUrl(res.dashboardUrl)) {
+    deps.openBrowser(claimUrl(res.dashboardUrl, key));
+  } else {
+    deps.log("  (The server returned an unexpected address, so it was not auto-opened.)");
+  }
   deps.log(
     "  Sign in there to claim it, or `npx whoburnedmore private` to hide it again."
   );
@@ -6264,7 +6678,7 @@ async function confirm(question) {
 function showLocalDashboard(payload) {
   const dir = defaultConfigDir();
   mkdirSync3(dir, { recursive: true });
-  const file = join7(dir, "dashboard.html");
+  const file = join9(dir, "dashboard.html");
   writeFileSync3(
     file,
     renderDashboardHtml(payload.entries, /* @__PURE__ */ new Date(), {
@@ -6299,7 +6713,7 @@ async function run(flags) {
   } finally {
     progress.stop();
   }
-  const { entries, sessions, blocks, tools, skills, projects, agent, attributionComplete } = collected;
+  const { entries, sessions, blocks, tools, skills, agent, attributionComplete } = collected;
   if (entries.length === 0) {
     console.log();
     console.log("  Nothing to burn yet \u2014 no local usage found from any coding agent.");
@@ -6307,13 +6721,13 @@ async function run(flags) {
     return;
   }
   const payload = { cliVersion: VERSION, entries };
+  payload.tzOffsetMinutes = -(/* @__PURE__ */ new Date()).getTimezoneOffset();
   if (sessions.length > 0) payload.sessions = sessions;
   if (blocks.length > 0) payload.blocks = blocks;
   if (tools.length > 0) payload.tools = tools;
   if (skills.length > 0) payload.skills = skills;
-  if (projects.length > 0) payload.projects = projects;
   if (agent.messageCount > 0) payload.agent = agent;
-  if (attributionComplete && (tools.length > 0 || skills.length > 0 || projects.length > 0))
+  if (attributionComplete && (tools.length > 0 || skills.length > 0))
     payload.attributionComplete = true;
   applyScope(payload, flags);
   if (flags.dryRun) {
@@ -6366,7 +6780,7 @@ async function run(flags) {
       console.log(
         pc2.dim("  The server returned an unexpected dashboard address, so it was NOT auto-opened. Open it yourself only if you trust it:")
       );
-      console.log(`  ${baseUrl}`);
+      console.log(`  ${sanitizeServerText(baseUrl)}`);
     }
   }
   const lines = submitNextStepLines(result);
@@ -6395,8 +6809,9 @@ async function linkServerInstall(token) {
   }
   const anonKey = ensureAnonKey();
   const linked = await redeemServerInstall(token, anonKey);
+  const handle = sanitizeServerText(linked.handle);
   console.log(
-    linked.alreadyLinked ? `  This machine is already linked to @${linked.handle}.` : `  Linked this machine to @${linked.handle}.`
+    linked.alreadyLinked ? `  This machine is already linked to @${handle}.` : `  Linked this machine to @${handle}.`
   );
   if (linked.mergedDays > 0) {
     console.log(pc2.dim(`  Merged ${linked.mergedDays} existing usage day${linked.mergedDays === 1 ? "" : "s"} from this machine.`));
@@ -6419,7 +6834,7 @@ async function linkServerInstall(token) {
   } catch {
     console.log(pc2.dim("  Linked, but background sync could not be installed automatically. Run `npx whoburnedmore install-sync` to retry."));
   }
-  console.log(`  Profile: ${linked.profileUrl}`);
+  console.log(`  Profile: ${sanitizeServerText(linked.profileUrl)}`);
 }
 function waitOrAbort(ms, signal) {
   if (signal.aborted) return Promise.resolve();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {