whoburnedmore 0.9.4 → 0.9.5

package/dist/index.js

@@ -7,6 +7,7 @@ var __export = (target, all) => {
 
 // src/index.ts
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { platform as platform3 } from "node:os";
@@ -95,12 +96,14 @@ async function readJson(res) {
     };
   }
 }
-async function post(path, body) {
+async function post(path, body, token) {
+  const headers = { "Content-Type": "application/json" };
+  if (token) headers.Authorization = `Bearer ${token}`;
   let res;
   try {
     res = await fetch(`${apiBase()}${path}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers,
       body: JSON.stringify(body),
       // Bound the request so a slow/black-holing/hostile server can't hang the CLI
       // — or the unattended 15-minute background sync — indefinitely.
@@ -113,6 +116,17 @@ async function post(path, body) {
   }
   return { status: res.status, body: await readJson(res) };
 }
+async function verifyUsage(token, payload) {
+  const { status, body } = await post("/v1/verify", payload, token);
+  if (status === 401) throw new UnauthorizedError();
+  if (status !== 200) {
+    const err = body;
+    const details = err.details?.length ? `
+  - ${err.details.join("\n  - ")}` : "";
+    throw new Error(`${err.error ?? "verification failed"}${details}`);
+  }
+  return body;
+}
 async function anonSubmit(anonKey, payload) {
   const { status, body } = await post("/v1/anon/submit", { ...payload, anonKey });
   if (status !== 200) {
@@ -123,6 +137,45 @@ async function anonSubmit(anonKey, payload) {
   }
   return body;
 }
+var UnauthorizedError = class extends Error {
+  constructor(message = "your sign-in has expired") {
+    super(message);
+    this.name = "UnauthorizedError";
+  }
+};
+async function deviceStart() {
+  const { status, body } = await post(
+    "/v1/auth/device",
+    {}
+  );
+  if (status !== 200) {
+    throw new Error(
+      body.error ?? `sign-in failed (HTTP ${status})`
+    );
+  }
+  return body;
+}
+async function devicePoll(deviceCode) {
+  const { status, body } = await post(
+    "/v1/auth/device/token",
+    { deviceCode }
+  );
+  if (status !== 200) {
+    throw new Error(`sign-in failed (HTTP ${status})`);
+  }
+  return body;
+}
+async function submit(token, payload) {
+  const { status, body } = await post("/v1/submit", payload, token);
+  if (status === 401) throw new UnauthorizedError();
+  if (status !== 200) {
+    const err = body;
+    const details = err.details?.length ? `
+  - ${err.details.join("\n  - ")}` : "";
+    throw new Error(`${err.error ?? `submit failed (HTTP ${status})`}${details}`);
+  }
+  return body;
+}
 function claimUrl(dashboardUrl, anonKey) {
   return `${dashboardUrl}#k=${encodeURIComponent(anonKey)}`;
 }
@@ -204,6 +257,8 @@ function loadConfig(dir = defaultConfigDir()) {
     const parsed = JSON.parse(readFileSync(file, "utf8"));
     const config = {};
     if (typeof parsed.anonKey === "string") config.anonKey = parsed.anonKey;
+    if (typeof parsed.cliToken === "string") config.cliToken = parsed.cliToken;
+    if (typeof parsed.handle === "string") config.handle = parsed.handle;
     if (typeof parsed.lastSyncAt === "number" && Number.isFinite(parsed.lastSyncAt))
       config.lastSyncAt = parsed.lastSyncAt;
     if (typeof parsed.launchNotificationDeliveredAt === "number" && Number.isFinite(parsed.launchNotificationDeliveredAt)) {
@@ -248,6 +303,16 @@ function recordLaunchNotificationDelivered(dir = defaultConfigDir(), when = Date
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, launchNotificationDeliveredAt: when });
 }
+function saveAuth(dir = defaultConfigDir(), auth = { cliToken: "" }) {
+  const config = loadConfig(dir) ?? {};
+  saveConfig(dir, { ...config, cliToken: auth.cliToken, handle: auth.handle });
+}
+function clearAuth(dir = defaultConfigDir()) {
+  const config = loadConfig(dir);
+  if (!config?.cliToken && !config?.handle) return;
+  const { cliToken: _t, handle: _h, ...rest } = config;
+  saveConfig(dir, rest);
+}
 
 // src/autosync.ts
 var SYNC_INTERVAL_MINUTES = 15;
@@ -1332,6 +1397,8 @@ function parseClaudeLine(raw) {
   if (message.role !== void 0 && message.role !== "assistant") return null;
   const date = localDate(String(obj.timestamp ?? ""));
   if (!date) return null;
+  const tsParsed = Date.parse(String(obj.timestamp ?? ""));
+  const ts = Number.isFinite(tsParsed) ? tsParsed : 0;
   const messageId = typeof message.id === "string" ? message.id : "";
   const requestId = typeof obj.requestId === "string" ? obj.requestId : "";
   const hasRealId = messageId !== "" || requestId !== "";
@@ -1340,6 +1407,7 @@ function parseClaudeLine(raw) {
     key,
     hasRealId,
     date,
+    ts,
     model: typeof message.model === "string" ? message.model : "unknown",
     inputTokens: num3(usage.input_tokens),
     outputTokens: num3(usage.output_tokens),
@@ -1458,6 +1526,28 @@ async function collectClaudeNative(env = process.env, opts = {}) {
   }
   return { entries: finalizeClaudeEntries(acc), found: true, filesScanned: scanned };
 }
+async function collectClaudeRequests(env = process.env, opts = {}) {
+  const dirs = resolveClaudeProjectDirs(env);
+  const files = [];
+  for (const dir of dirs) files.push(...await listJsonl(dir));
+  if (files.length === 0) return { requests: [], found: false };
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.budgetMs ?? NATIVE_READ_BUDGET_MS);
+  const acc = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (now() > deadline) {
+      return { requests: [...acc.values()], found: true, timedOut: true };
+    }
+    let content;
+    try {
+      content = await readFile(f, "utf8");
+    } catch {
+      continue;
+    }
+    accumulateClaudeLines(acc, splitLines(content));
+  }
+  return { requests: [...acc.values()], found: true };
+}
 
 // src/native/codex.ts
 import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
@@ -1491,9 +1581,8 @@ function readTokenFields(payload) {
 }
 function parseCodexRollout(lines) {
   let model = "unknown";
-  let lastDate = null;
-  let last = null;
-  let turnCount = 0;
+  const perDay = /* @__PURE__ */ new Map();
+  let lastSeenDate = null;
   for (const raw of lines) {
     const trimmed = raw.trim();
     if (!trimmed) continue;
@@ -1512,49 +1601,68 @@ function parseCodexRollout(lines) {
     if (payload.type === "token_count") {
       const fields = readTokenFields(payload);
       if (!fields) continue;
-      last = fields;
-      turnCount += 1;
-      const d = localDate2(String(obj.timestamp ?? ""));
-      if (d) lastDate = d;
+      const parsed = localDate2(String(obj.timestamp ?? ""));
+      const day = parsed ?? lastSeenDate;
+      if (!day) continue;
+      lastSeenDate = day;
+      const e = perDay.get(day);
+      if (e) {
+        e.cum = fields;
+        e.turns += 1;
+      } else {
+        perDay.set(day, { cum: fields, turns: 1 });
+      }
     }
   }
-  if (!last || !lastDate) return null;
-  const cacheReadTokens = last.cached;
-  const inputTokens = Math.max(0, last.input - last.cached);
-  const outputTokens = last.output + last.reasoning;
-  if (inputTokens + outputTokens + cacheReadTokens === 0) return null;
-  return {
-    date: lastDate,
-    model,
-    inputTokens,
-    outputTokens,
-    cacheCreationTokens: 0,
-    cacheReadTokens,
-    turnCount
-  };
+  if (perDay.size === 0) return [];
+  const dates = [...perDay.keys()].sort();
+  const out = [];
+  let prev = { input: 0, cached: 0, output: 0, reasoning: 0 };
+  for (const date of dates) {
+    const { cum, turns } = perDay.get(date);
+    const dInput = Math.max(0, cum.input - prev.input);
+    const dCached = Math.max(0, cum.cached - prev.cached);
+    const dOutput = Math.max(0, cum.output - prev.output);
+    const dReasoning = Math.max(0, cum.reasoning - prev.reasoning);
+    prev = cum;
+    const cacheReadTokens = dCached;
+    const inputTokens = Math.max(0, dInput - dCached);
+    const outputTokens = dOutput + dReasoning;
+    if (inputTokens + outputTokens + cacheReadTokens === 0) continue;
+    out.push({
+      date,
+      model,
+      inputTokens,
+      outputTokens,
+      cacheCreationTokens: 0,
+      cacheReadTokens,
+      turnCount: turns
+    });
+  }
+  return out;
 }
 function accumulateCodexSession(acc, lines) {
-  const s = parseCodexRollout(lines);
-  if (!s) return;
-  const k = `${s.date}|${s.model}`;
-  let b = acc.get(k);
-  if (!b) {
-    b = {
-      date: s.date,
-      model: s.model,
-      inputTokens: 0,
-      outputTokens: 0,
-      cacheCreationTokens: 0,
-      cacheReadTokens: 0,
-      requestCount: 0
-    };
-    acc.set(k, b);
+  for (const s of parseCodexRollout(lines)) {
+    const k = `${s.date}|${s.model}`;
+    let b = acc.get(k);
+    if (!b) {
+      b = {
+        date: s.date,
+        model: s.model,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheCreationTokens: 0,
+        cacheReadTokens: 0,
+        requestCount: 0
+      };
+      acc.set(k, b);
+    }
+    b.inputTokens += s.inputTokens;
+    b.outputTokens += s.outputTokens;
+    b.cacheCreationTokens += s.cacheCreationTokens;
+    b.cacheReadTokens += s.cacheReadTokens;
+    b.requestCount += s.turnCount;
   }
-  b.inputTokens += s.inputTokens;
-  b.outputTokens += s.outputTokens;
-  b.cacheCreationTokens += s.cacheCreationTokens;
-  b.cacheReadTokens += s.cacheReadTokens;
-  b.requestCount += s.turnCount;
 }
 function finalizeCodexEntries(acc) {
   const entries = [];
@@ -6241,6 +6349,32 @@ var AnonSubmitPayload = SubmitPayload.extend({
   /** Client-generated secret (hex). The server stores only its hash. */
   anonKey: external_exports.string().min(16).max(128)
 });
+var VerifyRequestRecord = external_exports.object({
+  /** Local calendar date (YYYY-MM-DD) this request is bucketed under. */
+  date: DateString,
+  /** Epoch milliseconds of the request's final (max-token) transcript line. */
+  ts: external_exports.number().int().nonnegative(),
+  tool: external_exports.string().min(1).max(64),
+  model: external_exports.string().min(1).max(128),
+  inputTokens: tokenCount,
+  outputTokens: tokenCount,
+  cacheCreationTokens: tokenCount,
+  cacheReadTokens: tokenCount,
+  /** sha256(msgId|reqId), truncated — preserves uniqueness without revealing the id. */
+  reqHash: external_exports.string().min(1).max(64)
+});
+var VerifyPayload = external_exports.object({
+  cliVersion: external_exports.string().min(1).max(32),
+  /** The per-request skeleton (bounded/sampled — see `truncated`). */
+  requests: external_exports.array(VerifyRequestRecord).min(1).max(1e5),
+  /**
+   * True when the local corpus exceeded the client upload cap and was sampled to
+   * the most recent N requests. The server treats a truncated upload conservatively
+   * (it never AUTO-passes a truncated one — it can still auto-FAIL on a physical
+   * impossibility, or route to a human).
+   */
+  truncated: external_exports.boolean().optional()
+});
 function entryTotalTokens(e) {
   return e.inputTokens + e.outputTokens + e.cacheCreationTokens + e.cacheReadTokens;
 }
@@ -6375,6 +6509,26 @@ function submitNextStepLines(result) {
     "  Private until you do. Manage anytime: `npx whoburnedmore private` \xB7 `public` \xB7 `remove`."
   ];
 }
+function signedInNextStepLines(result) {
+  if (result.orgBoardUrl) {
+    return [
+      `  \u{1F3E2} You're on your team board: ${sanitizeServerText(result.orgBoardUrl)}`,
+      "  \u2192 Open it to see who burned more."
+    ];
+  }
+  if (result.boardUrl) {
+    const code = result.boardUrl.split("/").filter(Boolean).pop() ?? "";
+    return [
+      `  \u{1F91D} You're on the board: ${sanitizeServerText(result.boardUrl)}`,
+      "  \u2192 Open it to see who burned more.",
+      `  \u2192 Get a friend on it \u2014 have them run: npx whoburnedmore --board=${sanitizeServerText(code)}`
+    ];
+  }
+  return [
+    `  Your dashboard: ${sanitizeServerText(result.profileUrl)}`,
+    "  \u2192 Open it to see your rank and share your profile."
+  ];
+}
 
 // src/local-dashboard.ts
 function esc(s) {
@@ -6752,7 +6906,132 @@ async function run(flags) {
     console.log(pc2.dim("  --no-submit: skipped the dashboard."));
     return;
   }
-  const anonKey = ensureAnonKey();
+  const cfg = loadConfig();
+  const canSignIn = !flags.quiet && Boolean(process.stdout.isTTY);
+  if (cfg?.cliToken) {
+    await submitSignedIn(cfg.cliToken, payload, flags, canSignIn);
+  } else if (cfg?.anonKey) {
+    await submitWithDeviceKey(cfg.anonKey, payload, flags);
+  } else if (canSignIn) {
+    const auth = await ensureSignedIn();
+    if (!auth) return;
+    await submitSignedIn(auth.token, payload, flags, canSignIn);
+  } else if (!flags.quiet) {
+    console.log(pc2.yellow("  Sign in to put your usage on the leaderboard."));
+    console.log(
+      pc2.dim(
+        "  Run `npx whoburnedmore` in an interactive terminal to sign in, or `npx whoburnedmore link --token=\u2026` (from your signed-in profile) for servers/CI."
+      )
+    );
+  } else {
+    return;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function ensureSignedIn() {
+  const cfg = loadConfig();
+  if (cfg?.cliToken) return { token: cfg.cliToken, handle: cfg.handle ?? "" };
+  let dev;
+  try {
+    dev = await deviceStart();
+  } catch (err) {
+    console.log(pc2.yellow(`  Couldn't start sign-in: ${err.message}`));
+    return null;
+  }
+  console.log();
+  console.log(pc2.bold("  Sign in to whoburnedmore to put your usage on the board."));
+  console.log(`  1. Opening ${pc2.cyan(sanitizeServerText(dev.verifyUrl))} \u2014 or go there yourself.`);
+  console.log(`  2. Approve this code: ${pc2.bold(sanitizeServerText(dev.userCode))}`);
+  if (isTrustedWebUrl(dev.verifyUrl)) openBrowser(dev.verifyUrl);
+  console.log(pc2.dim("  Waiting for you to approve in the browser\u2026"));
+  const deadline = Date.now() + dev.expiresInSeconds * 1e3;
+  const intervalMs = Math.max(1, dev.pollIntervalSeconds) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    let res;
+    try {
+      res = await devicePoll(dev.deviceCode);
+    } catch {
+      continue;
+    }
+    if (res.status === "ok") {
+      saveAuth(void 0, { cliToken: res.token, handle: res.handle });
+      console.log(pc2.green(`  \u2713 Signed in as @${sanitizeServerText(res.handle)}.`));
+      return { token: res.token, handle: res.handle };
+    }
+    if (res.status === "expired") break;
+  }
+  console.log(
+    pc2.yellow("  Sign-in timed out. Run `npx whoburnedmore` again to retry.")
+  );
+  return null;
+}
+async function submitSignedIn(token, payload, flags, interactive) {
+  let result;
+  try {
+    result = await submit(token, payload);
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      clearAuth();
+      if (!interactive) return;
+      const auth = await ensureSignedIn();
+      if (!auth) return;
+      result = await submit(auth.token, payload);
+    } else {
+      throw err;
+    }
+  }
+  try {
+    recordSync();
+  } catch {
+  }
+  const baseUrl = result.orgBoardUrl ?? result.boardUrl ?? result.profileUrl;
+  if (!flags.quiet) {
+    console.log(
+      pc2.green("  \u2713 Synced securely.") + pc2.dim(" Only your daily totals left this machine \u2014 never your prompts, code, or file names.")
+    );
+    if (result.suppressed) {
+      console.log();
+      console.log(
+        pc2.yellow(
+          "  \u26A0 You're currently OFF the leaderboard \u2014 we couldn't verify these numbers."
+        )
+      );
+      console.log(
+        pc2.dim(
+          "  Verify your usage to get back on \u2014 this sends a detailed per-request breakdown (timestamps + token counts, never your prompts or code)."
+        )
+      );
+      if (process.stdin.isTTY && await confirm("  Verify now?")) {
+        await runVerify();
+        afterSubmitChores(flags);
+        return;
+      }
+      console.log(
+        pc2.dim(
+          "  Run `npx whoburnedmore verify` anytime, or appeal at whoburnedmore.com/appeal."
+        )
+      );
+    }
+    if (isTrustedWebUrl(baseUrl)) {
+      console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
+      openBrowser(baseUrl);
+    } else {
+      console.log(
+        pc2.dim("  The server returned an unexpected dashboard address, so it was NOT auto-opened. Open it yourself only if you trust it:")
+      );
+      console.log(`  ${sanitizeServerText(baseUrl)}`);
+    }
+    for (const line of signedInNextStepLines(result)) {
+      if (line.includes("\u2192")) console.log(pc2.bold(line));
+      else console.log(line);
+    }
+  }
+  afterSubmitChores(flags);
+}
+async function submitWithDeviceKey(anonKey, payload, flags) {
   const result = await anonSubmit(anonKey, payload);
   try {
     recordSync();
@@ -6782,26 +7061,24 @@ async function run(flags) {
       );
       console.log(`  ${sanitizeServerText(baseUrl)}`);
     }
-  }
-  const lines = submitNextStepLines(result);
-  for (const line of lines) {
-    if (line.includes("\u2192")) console.log(pc2.bold(line));
-    else if (line.startsWith("  Private until you do")) {
-      if (!flags.quiet) console.log(pc2.dim(line));
-    } else console.log(line);
-  }
-  if (!flags.quiet) {
-    try {
-      reconcileAutoSync();
-    } catch {
+    for (const line of submitNextStepLines(result)) {
+      if (line.includes("\u2192")) console.log(pc2.bold(line));
+      else if (line.startsWith("  Private until you do")) console.log(pc2.dim(line));
+      else console.log(line);
     }
   }
-  if (!flags.quiet) {
-    console.log();
-    console.log(
-      autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every 15 min (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
-    );
+  afterSubmitChores(flags);
+}
+function afterSubmitChores(flags) {
+  if (flags.quiet) return;
+  try {
+    reconcileAutoSync();
+  } catch {
   }
+  console.log();
+  console.log(
+    autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every 15 min (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
+  );
 }
 async function linkServerInstall(token) {
   if (!token) {
@@ -6883,6 +7160,102 @@ async function runDaemon() {
   console.log();
   console.log(pc2.dim(`  Daemon stopped after ${cycles} sync cycle${cycles === 1 ? "" : "s"}.`));
 }
+async function runVerify() {
+  printBanner();
+  console.log();
+  console.log(pc2.bold("  Verify your usage to get back on the leaderboard."));
+  console.log(
+    pc2.dim(
+      "  This sends a DETAILED per-request breakdown \u2014 timestamps and token counts, still never your prompts, code, or file names \u2014 so we can confirm your usage is real. It's deleted after review."
+    )
+  );
+  const cfg = loadConfig();
+  let token = cfg?.cliToken;
+  if (!token) {
+    if (!process.stdout.isTTY) {
+      console.log(
+        pc2.yellow(
+          "  Sign in first \u2014 run `npx whoburnedmore verify` in an interactive terminal."
+        )
+      );
+      return;
+    }
+    const auth = await ensureSignedIn();
+    if (!auth) return;
+    token = auth.token;
+  }
+  if (process.stdin.isTTY) {
+    const ok = await confirm("\n  Send this breakdown to verify your usage?");
+    if (!ok) {
+      console.log(pc2.dim("  Cancelled \u2014 nothing was sent."));
+      return;
+    }
+  }
+  console.log(pc2.dim("  Reading your local Claude Code logs\u2026"));
+  const { requests, found } = await collectClaudeRequests();
+  if (!found || requests.length === 0) {
+    console.log(
+      pc2.yellow("  No local Claude Code logs found on this machine to verify.")
+    );
+    console.log(
+      pc2.dim(
+        "  Run this on the machine where you actually use Claude Code, or file a written appeal at whoburnedmore.com/appeal."
+      )
+    );
+    return;
+  }
+  const CAP = 5e4;
+  const sorted = requests.slice().sort((a, b) => b.ts - a.ts);
+  const truncated = sorted.length > CAP;
+  const capped = truncated ? sorted.slice(0, CAP) : sorted;
+  const records = capped.map((r) => ({
+    date: r.date,
+    ts: r.ts,
+    tool: "claude",
+    model: r.model,
+    inputTokens: r.inputTokens,
+    outputTokens: r.outputTokens,
+    cacheCreationTokens: r.cacheCreationTokens,
+    cacheReadTokens: r.cacheReadTokens,
+    reqHash: createHash("sha256").update(r.key).digest("hex").slice(0, 32)
+  }));
+  console.log(
+    pc2.dim(
+      `  Sending ${records.length} request records for analysis${truncated ? " (most recent, sampled)" : ""}\u2026`
+    )
+  );
+  let result;
+  try {
+    result = await verifyUsage(token, {
+      cliVersion: VERSION,
+      requests: records,
+      ...truncated ? { truncated: true } : {}
+    });
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      clearAuth();
+      console.log(
+        pc2.yellow(
+          "  Your sign-in expired \u2014 run `npx whoburnedmore verify` again to retry."
+        )
+      );
+      return;
+    }
+    throw err;
+  }
+  console.log();
+  const line = `  ${sanitizeServerText(result.message)}`;
+  if (result.relisted) {
+    console.log(pc2.green(`  \u2713${line.slice(1)}`));
+  } else {
+    console.log(result.verdict === "fail" ? pc2.yellow(line) : line);
+    console.log(
+      pc2.dim(
+        "  We'll relist you automatically if it checks out \u2014 re-run `npx whoburnedmore` anytime to check."
+      )
+    );
+  }
+}
 async function main() {
   const major = Number(process.versions.node.split(".")[0]);
   if (major < 20) {
@@ -6918,6 +7291,9 @@ async function main() {
     case "daemon":
       await runDaemon();
       break;
+    case "verify":
+      await runVerify();
+      break;
     case "status":
     case "doctor": {
       for (const line of agentStatusReport()) console.log(line);
@@ -6969,8 +7345,8 @@ function printHelp() {
   ${pc2.bold("whoburnedmore")} \u2014 who burned more tokens, you or them?
 
   ${pc2.bold("usage")}
-    npx whoburnedmore              burn + land on the public leaderboard, open your dashboard
-    npx whoburnedmore --board=CODE compare with friends \u2014 join their board (no sign-in)
+    npx whoburnedmore              sign in, burn + land on the public leaderboard, open your dashboard
+    npx whoburnedmore --board=CODE compare with friends \u2014 sign in and join their board
     npx whoburnedmore --org=SLUG   submit to your organization's board (companies/hackathons)
     npx whoburnedmore --local      build the dashboard on your machine and open it (offline)
     npx whoburnedmore --dry-run    print exactly what would be sent, send nothing
@@ -6980,14 +7356,15 @@ function printHelp() {
     npx whoburnedmore private      hide your dashboard from the leaderboard
     npx whoburnedmore public       put it back on the leaderboard
     npx whoburnedmore remove       delete your dashboard and its data
+    npx whoburnedmore verify       delisted? re-verify your usage to get back on (sends a detailed breakdown)
     npx whoburnedmore status       check background-sync health (last sync, staleness)
     npx whoburnedmore uninstall-sync   turn off the background sync
     npx whoburnedmore install-sync     turn it back on after uninstalling
 
-  Background sync is on by default: after your first run, your page refreshes
-  automatically every 15 min (\`uninstall-sync\` to stop). Your dashboard is public on
-  the leaderboard as an anonymous burner \u2014 sign in on whoburnedmore.com to claim
-  it (handle + X) and own your rank, or run \`private\`/\`remove\` to pull it. Only
+  Your first run signs you in (we open a page, you approve a short code) and binds
+  this machine to your account \u2014 your usage lands on the leaderboard under your
+  handle. Background sync is on by default: your page then refreshes automatically
+  every 15 min (\`uninstall-sync\` to stop); run \`private\`/\`remove\` to pull it. Only
   daily aggregate numbers (date, tool, model, token counts, est. cost) ever leave
   your machine \u2014 never prompts, code, or file names. With --local, nothing leaves
   your machine at all.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {