whoburnedmore 0.9.4 → 0.9.6

package/README.md

@@ -1,6 +1,6 @@
 # whoburnedmore
 
-**who burned more tokens — you or them?** One command reads your local AI coding-agent usage logs, shows your burn, and gives you a **shareable dashboard with no sign-in required**.
+**who burned more tokens — you or them?** One command reads your local AI coding-agent usage logs, adds up your burn, and puts you on the public leaderboard with a **shareable dashboard**.
 
 [![npm version](https://img.shields.io/npm/v/whoburnedmore.svg?color=f97316)](https://www.npmjs.com/package/whoburnedmore)
 [![npm downloads](https://img.shields.io/npm/dm/whoburnedmore.svg?color=f97316)](https://www.npmjs.com/package/whoburnedmore)
@@ -11,7 +11,7 @@
 npx whoburnedmore
 ```
 
-That's the whole thing. No install, no account, no config.
+That's the whole thing. No install, no config. Your **first run signs you in** — the CLI opens a page, you approve a short code, and this machine is bound to your account.
 
 ---
 
@@ -28,13 +28,15 @@ whoburnedmore · https://whoburnedmore.com
   total          2.31B tokens   $2,656.91
   today          92.8M tokens
 
-  You burned 2.31B tokens. Your shareable dashboard:
-  https://whoburnedmore.com/d/5twjwi-jtga4r
+  You burned 2.31B tokens. Your dashboard:
+  https://whoburnedmore.com/u/<your-handle>
 
-  Re-run anytime to update it · `npx whoburnedmore login` to claim a public handle and compete.
+  Re-run anytime to update it. Background sync keeps it fresh every 15 min.
 ```
 
-Your dashboard is **anonymous and unlisted by default** — only people you send the link to can see it. Run the command again anytime to refresh it.
+Once you're signed in, your usage lands on the leaderboard under your handle. Run the command again anytime to refresh — or let the background sync do it for you.
+
+**Want to stay off the board?** Run `npx whoburnedmore private` to hide your dashboard, or `npx whoburnedmore --local` to never upload anything at all.
 
 ## Privacy first
 
@@ -46,7 +48,7 @@ See exactly what would be sent, and send nothing:
 npx whoburnedmore --dry-run
 ```
 
-Or stay completely offline — `--local` builds the same dashboard as a self-contained HTML file on your machine and opens it in your browser, sending nothing anywhere:
+Or stay completely offline — `--local` builds the same dashboard as a self-contained HTML file on your machine and opens it in your browser, sending nothing anywhere and never signing you in:
 
 ```bash
 npx whoburnedmore --local
@@ -56,14 +58,21 @@ npx whoburnedmore --local
 
 | Command | What it does |
 | --- | --- |
-| `npx whoburnedmore` | Show your burn + get a shareable dashboard (no sign-in) |
-| `npx whoburnedmore --local` | Build the dashboard locally and open it (fully offline) |
+| `npx whoburnedmore` | Sign in, submit your burn, land on the leaderboard, open your dashboard |
+| `npx whoburnedmore --board=CODE` | Compare with friends — sign in and join their board |
+| `npx whoburnedmore --org=SLUG` | Submit to your organization's board (companies / hackathons) |
+| `npx whoburnedmore --local` | Build the dashboard locally and open it (fully offline, no sign-in) |
 | `npx whoburnedmore --dry-run` | Print exactly what would be sent, send nothing |
 | `npx whoburnedmore --no-submit` | Print local stats only, send nothing |
-| `npx whoburnedmore login` | Sign in to claim a public handle + join the leaderboard |
-| `npx whoburnedmore logout` | Forget the local token (your data is untouched) |
-| `npx whoburnedmore install-sync` | Keep your dashboard live with a background sync (every 15 min) |
-| `npx whoburnedmore uninstall-sync` | Remove the background sync |
+| `npx whoburnedmore private` | Hide your dashboard from the leaderboard |
+| `npx whoburnedmore public` | Put it back on the leaderboard |
+| `npx whoburnedmore remove` | Delete your dashboard and all its data |
+| `npx whoburnedmore verify` | Delisted? Re-verify your usage to get back on |
+| `npx whoburnedmore link --token=TOKEN` | Bind a server / VM to your account (token from your profile) |
+| `npx whoburnedmore daemon` | Keep syncing in the foreground (containers with no scheduler) |
+| `npx whoburnedmore status` | Check background-sync health (last sync, staleness) |
+| `npx whoburnedmore install-sync` | Turn the 15-minute background sync back on |
+| `npx whoburnedmore uninstall-sync` | Turn the background sync off |
 
 ## Supported tools
 
@@ -73,29 +82,37 @@ Usage is read via [`ccusage`](https://www.npmjs.com/package/ccusage) from any of
 
 Whatever you have logs for is picked up automatically — you don't pass any flags.
 
-## Claim a public handle (optional)
+## Compete with friends and teams
 
-Want on the public leaderboard? Sign in with **GitHub or Google**:
+- **Friends:** join someone's board with `npx whoburnedmore --board=CODE` (the code comes from their board's invite).
+- **Companies / hackathons:** submit to an organization board with `npx whoburnedmore --org=SLUG` (add `--pass=CODE` if the org requires a join code).
 
-```bash
-npx whoburnedmore login
-```
-
-It uses a device flow — a code appears in your terminal, you approve it in the browser, and you're done. Your submissions then link to your handle at `whoburnedmore.com/u/<handle>`. You can delete your account and every row of data anytime from your profile.
+Your submissions link to your handle at `whoburnedmore.com/u/<handle>`. You can delete your account and every row of data anytime from your profile.
 
 ## Keep it live
 
-Want your dashboard to stay fresh without re-running by hand?
+Background sync is on by default after your first run, so your dashboard stays fresh without re-running by hand. To manage it:
 
 ```bash
-npx whoburnedmore install-sync     # background sync every 15 min (launchd / cron / scheduled task)
-npx whoburnedmore uninstall-sync   # remove it
+npx whoburnedmore status           # last sync + staleness
+npx whoburnedmore uninstall-sync   # turn the background sync off
+npx whoburnedmore install-sync     # turn it back on (launchd / cron / scheduled task)
 ```
 
 The installed background job runs the latest published `whoburnedmore` package on
 each sync tick, so future CLI fixes are picked up automatically after the next
 15-minute refresh.
 
+## Servers & VMs
+
+Generate a one-time `link` command from your profile on whoburnedmore.com and run it inside the machine to bind it to your account:
+
+```bash
+npx whoburnedmore link --token=TOKEN
+```
+
+On a persistent VM, background sync uses cron or a systemd user timer automatically. In a container or any host without a scheduler, run `npx whoburnedmore daemon` under your process manager instead. Set `WHOBURNEDMORE_CONFIG_DIR` to a persistent path so the machine identity survives restarts.
+
 ## Links
 
 - 🏆 Leaderboard — **[whoburnedmore.com](https://whoburnedmore.com)**

package/dist/index.js

@@ -7,6 +7,7 @@ var __export = (target, all) => {
 
 // src/index.ts
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 import { platform as platform3 } from "node:os";
@@ -95,12 +96,14 @@ async function readJson(res) {
     };
   }
 }
-async function post(path, body) {
+async function post(path, body, token) {
+  const headers = { "Content-Type": "application/json" };
+  if (token) headers.Authorization = `Bearer ${token}`;
   let res;
   try {
     res = await fetch(`${apiBase()}${path}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers,
       body: JSON.stringify(body),
       // Bound the request so a slow/black-holing/hostile server can't hang the CLI
       // — or the unattended 15-minute background sync — indefinitely.
@@ -113,8 +116,21 @@ async function post(path, body) {
   }
   return { status: res.status, body: await readJson(res) };
 }
+async function verifyUsage(token, payload) {
+  const { status, body } = await post("/v1/verify", payload, token);
+  if (status === 401) throw new UnauthorizedError();
+  if (status !== 200) {
+    const err = body;
+    const details = err.details?.length ? `
+  - ${err.details.join("\n  - ")}` : "";
+    throw new Error(`${err.error ?? "verification failed"}${details}`);
+  }
+  return body;
+}
+var ANON_RETIRED_MESSAGE = "Anonymous mode has been retired. Run `npx whoburnedmore` and sign in, or `npx whoburnedmore link --token=\u2026` for a server/CI, to put your usage on the leaderboard.";
 async function anonSubmit(anonKey, payload) {
   const { status, body } = await post("/v1/anon/submit", { ...payload, anonKey });
+  if (status === 410) throw new Error(ANON_RETIRED_MESSAGE);
   if (status !== 200) {
     const err = body;
     const details = err.details?.length ? `
@@ -123,22 +139,54 @@ async function anonSubmit(anonKey, payload) {
   }
   return body;
 }
-function claimUrl(dashboardUrl, anonKey) {
-  return `${dashboardUrl}#k=${encodeURIComponent(anonKey)}`;
+var UnauthorizedError = class extends Error {
+  constructor(message = "your sign-in has expired") {
+    super(message);
+    this.name = "UnauthorizedError";
+  }
+};
+async function deviceStart() {
+  const { status, body } = await post(
+    "/v1/auth/device",
+    {}
+  );
+  if (status !== 200) {
+    throw new Error(
+      body.error ?? `sign-in failed (HTTP ${status})`
+    );
+  }
+  return body;
 }
-function boardClaimUrl(boardUrl, slug, anonKey) {
-  return `${boardUrl}#k=${encodeURIComponent(anonKey)}&u=${encodeURIComponent(slug)}`;
+async function devicePoll(deviceCode) {
+  const { status, body } = await post(
+    "/v1/auth/device/token",
+    { deviceCode }
+  );
+  if (status !== 200) {
+    throw new Error(`sign-in failed (HTTP ${status})`);
+  }
+  return body;
 }
-function resolveOpenTarget(result, anonKey) {
-  const baseUrl = result.orgBoardUrl ?? result.boardUrl ?? result.dashboardUrl;
-  const target = result.orgBoardUrl ? boardClaimUrl(result.orgBoardUrl, result.slug, anonKey) : result.boardUrl ? boardClaimUrl(result.boardUrl, result.slug, anonKey) : claimUrl(result.dashboardUrl, anonKey);
-  return { baseUrl, target };
+async function submit(token, payload) {
+  const { status, body } = await post("/v1/submit", payload, token);
+  if (status === 401) throw new UnauthorizedError();
+  if (status !== 200) {
+    const err = body;
+    const details = err.details?.length ? `
+  - ${err.details.join("\n  - ")}` : "";
+    throw new Error(`${err.error ?? `submit failed (HTTP ${status})`}${details}`);
+  }
+  return body;
+}
+function claimUrl(dashboardUrl, anonKey) {
+  return `${dashboardUrl}#k=${encodeURIComponent(anonKey)}`;
 }
 async function anonVisibility(anonKey, listed) {
   const { status, body } = await post(
     "/v1/anon/visibility",
     { anonKey, listed }
   );
+  if (status === 410) throw new Error(ANON_RETIRED_MESSAGE);
   if (status !== 200) {
     throw new Error(body.error ?? `failed (HTTP ${status})`);
   }
@@ -150,6 +198,7 @@ async function anonRemove(anonKey) {
     body: JSON.stringify({ anonKey }),
     signal: AbortSignal.timeout(3e4)
   });
+  if (res.status === 410) throw new Error(ANON_RETIRED_MESSAGE);
   if (res.status !== 200) {
     const b = await res.json().catch(() => ({}));
     throw new Error(b.error ?? `failed (HTTP ${res.status})`);
@@ -204,6 +253,8 @@ function loadConfig(dir = defaultConfigDir()) {
     const parsed = JSON.parse(readFileSync(file, "utf8"));
     const config = {};
     if (typeof parsed.anonKey === "string") config.anonKey = parsed.anonKey;
+    if (typeof parsed.cliToken === "string") config.cliToken = parsed.cliToken;
+    if (typeof parsed.handle === "string") config.handle = parsed.handle;
     if (typeof parsed.lastSyncAt === "number" && Number.isFinite(parsed.lastSyncAt))
       config.lastSyncAt = parsed.lastSyncAt;
     if (typeof parsed.launchNotificationDeliveredAt === "number" && Number.isFinite(parsed.launchNotificationDeliveredAt)) {
@@ -244,9 +295,15 @@ function recordSync(dir = defaultConfigDir(), when = Date.now()) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, lastSyncAt: when });
 }
-function recordLaunchNotificationDelivered(dir = defaultConfigDir(), when = Date.now()) {
+function saveAuth(dir = defaultConfigDir(), auth = { cliToken: "" }) {
   const config = loadConfig(dir) ?? {};
-  saveConfig(dir, { ...config, launchNotificationDeliveredAt: when });
+  saveConfig(dir, { ...config, cliToken: auth.cliToken, handle: auth.handle });
+}
+function clearAuth(dir = defaultConfigDir()) {
+  const config = loadConfig(dir);
+  if (!config?.cliToken && !config?.handle) return;
+  const { cliToken: _t, handle: _h, ...rest } = config;
+  saveConfig(dir, rest);
 }
 
 // src/autosync.ts
@@ -665,41 +722,6 @@ function rotateLogIfLarge(path = syncLogPath(), capBytes = 256 * 1024) {
     return false;
   }
 }
-function notifyLaunchLive(opts) {
-  const os = opts?.platform ?? platform();
-  const run2 = opts?.spawn ?? ((cmd, args) => spawnSync(cmd, args, { stdio: "ignore" }));
-  const title = "whoburnedmore is live";
-  const message = "Your dashboard is ready. Go to whoburnedmore.com";
-  if (os === "darwin") {
-    return run2("osascript", [
-      "-e",
-      `display notification "${message}" with title "${title}"`
-    ]).status === 0;
-  }
-  if (os === "linux") {
-    return run2("notify-send", [title, message]).status === 0;
-  }
-  if (os === "win32") {
-    const psQuote = (value) => `'${value.replaceAll("'", "''")}'`;
-    const script = [
-      "Add-Type -AssemblyName System.Windows.Forms",
-      "$n = New-Object System.Windows.Forms.NotifyIcon",
-      "$n.Icon = [System.Drawing.SystemIcons]::Application",
-      `$n.BalloonTipTitle = ${psQuote(title)}`,
-      `$n.BalloonTipText = ${psQuote(message)}`,
-      "$n.Visible = $true",
-      "$n.ShowBalloonTip(10000)",
-      "Start-Sleep -Seconds 2",
-      "$n.Dispose()"
-    ].join("; ");
-    return run2("powershell", [
-      "-NoProfile",
-      "-Command",
-      script
-    ]).status === 0;
-  }
-  return false;
-}
 function autoSyncLoaded() {
   if (platform() === "darwin") {
     const res = spawnSync("launchctl", ["list"], { encoding: "utf8" });
@@ -1332,6 +1354,8 @@ function parseClaudeLine(raw) {
   if (message.role !== void 0 && message.role !== "assistant") return null;
   const date = localDate(String(obj.timestamp ?? ""));
   if (!date) return null;
+  const tsParsed = Date.parse(String(obj.timestamp ?? ""));
+  const ts = Number.isFinite(tsParsed) ? tsParsed : 0;
   const messageId = typeof message.id === "string" ? message.id : "";
   const requestId = typeof obj.requestId === "string" ? obj.requestId : "";
   const hasRealId = messageId !== "" || requestId !== "";
@@ -1340,6 +1364,7 @@ function parseClaudeLine(raw) {
     key,
     hasRealId,
     date,
+    ts,
     model: typeof message.model === "string" ? message.model : "unknown",
     inputTokens: num3(usage.input_tokens),
     outputTokens: num3(usage.output_tokens),
@@ -1458,6 +1483,28 @@ async function collectClaudeNative(env = process.env, opts = {}) {
   }
   return { entries: finalizeClaudeEntries(acc), found: true, filesScanned: scanned };
 }
+async function collectClaudeRequests(env = process.env, opts = {}) {
+  const dirs = resolveClaudeProjectDirs(env);
+  const files = [];
+  for (const dir of dirs) files.push(...await listJsonl(dir));
+  if (files.length === 0) return { requests: [], found: false };
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.budgetMs ?? NATIVE_READ_BUDGET_MS);
+  const acc = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (now() > deadline) {
+      return { requests: [...acc.values()], found: true, timedOut: true };
+    }
+    let content;
+    try {
+      content = await readFile(f, "utf8");
+    } catch {
+      continue;
+    }
+    accumulateClaudeLines(acc, splitLines(content));
+  }
+  return { requests: [...acc.values()], found: true };
+}
 
 // src/native/codex.ts
 import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
@@ -1491,9 +1538,8 @@ function readTokenFields(payload) {
 }
 function parseCodexRollout(lines) {
   let model = "unknown";
-  let lastDate = null;
-  let last = null;
-  let turnCount = 0;
+  const perDay = /* @__PURE__ */ new Map();
+  let lastSeenDate = null;
   for (const raw of lines) {
     const trimmed = raw.trim();
     if (!trimmed) continue;
@@ -1512,49 +1558,68 @@ function parseCodexRollout(lines) {
     if (payload.type === "token_count") {
       const fields = readTokenFields(payload);
       if (!fields) continue;
-      last = fields;
-      turnCount += 1;
-      const d = localDate2(String(obj.timestamp ?? ""));
-      if (d) lastDate = d;
+      const parsed = localDate2(String(obj.timestamp ?? ""));
+      const day = parsed ?? lastSeenDate;
+      if (!day) continue;
+      lastSeenDate = day;
+      const e = perDay.get(day);
+      if (e) {
+        e.cum = fields;
+        e.turns += 1;
+      } else {
+        perDay.set(day, { cum: fields, turns: 1 });
+      }
     }
   }
-  if (!last || !lastDate) return null;
-  const cacheReadTokens = last.cached;
-  const inputTokens = Math.max(0, last.input - last.cached);
-  const outputTokens = last.output + last.reasoning;
-  if (inputTokens + outputTokens + cacheReadTokens === 0) return null;
-  return {
-    date: lastDate,
-    model,
-    inputTokens,
-    outputTokens,
-    cacheCreationTokens: 0,
-    cacheReadTokens,
-    turnCount
-  };
+  if (perDay.size === 0) return [];
+  const dates = [...perDay.keys()].sort();
+  const out = [];
+  let prev = { input: 0, cached: 0, output: 0, reasoning: 0 };
+  for (const date of dates) {
+    const { cum, turns } = perDay.get(date);
+    const dInput = Math.max(0, cum.input - prev.input);
+    const dCached = Math.max(0, cum.cached - prev.cached);
+    const dOutput = Math.max(0, cum.output - prev.output);
+    const dReasoning = Math.max(0, cum.reasoning - prev.reasoning);
+    prev = cum;
+    const cacheReadTokens = dCached;
+    const inputTokens = Math.max(0, dInput - dCached);
+    const outputTokens = dOutput + dReasoning;
+    if (inputTokens + outputTokens + cacheReadTokens === 0) continue;
+    out.push({
+      date,
+      model,
+      inputTokens,
+      outputTokens,
+      cacheCreationTokens: 0,
+      cacheReadTokens,
+      turnCount: turns
+    });
+  }
+  return out;
 }
 function accumulateCodexSession(acc, lines) {
-  const s = parseCodexRollout(lines);
-  if (!s) return;
-  const k = `${s.date}|${s.model}`;
-  let b = acc.get(k);
-  if (!b) {
-    b = {
-      date: s.date,
-      model: s.model,
-      inputTokens: 0,
-      outputTokens: 0,
-      cacheCreationTokens: 0,
-      cacheReadTokens: 0,
-      requestCount: 0
-    };
-    acc.set(k, b);
+  for (const s of parseCodexRollout(lines)) {
+    const k = `${s.date}|${s.model}`;
+    let b = acc.get(k);
+    if (!b) {
+      b = {
+        date: s.date,
+        model: s.model,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheCreationTokens: 0,
+        cacheReadTokens: 0,
+        requestCount: 0
+      };
+      acc.set(k, b);
+    }
+    b.inputTokens += s.inputTokens;
+    b.outputTokens += s.outputTokens;
+    b.cacheCreationTokens += s.cacheCreationTokens;
+    b.cacheReadTokens += s.cacheReadTokens;
+    b.requestCount += s.turnCount;
   }
-  b.inputTokens += s.inputTokens;
-  b.outputTokens += s.outputTokens;
-  b.cacheCreationTokens += s.cacheCreationTokens;
-  b.cacheReadTokens += s.cacheReadTokens;
-  b.requestCount += s.turnCount;
 }
 function finalizeCodexEntries(acc) {
   const entries = [];
@@ -6241,6 +6306,32 @@ var AnonSubmitPayload = SubmitPayload.extend({
   /** Client-generated secret (hex). The server stores only its hash. */
   anonKey: external_exports.string().min(16).max(128)
 });
+var VerifyRequestRecord = external_exports.object({
+  /** Local calendar date (YYYY-MM-DD) this request is bucketed under. */
+  date: DateString,
+  /** Epoch milliseconds of the request's final (max-token) transcript line. */
+  ts: external_exports.number().int().nonnegative(),
+  tool: external_exports.string().min(1).max(64),
+  model: external_exports.string().min(1).max(128),
+  inputTokens: tokenCount,
+  outputTokens: tokenCount,
+  cacheCreationTokens: tokenCount,
+  cacheReadTokens: tokenCount,
+  /** sha256(msgId|reqId), truncated — preserves uniqueness without revealing the id. */
+  reqHash: external_exports.string().min(1).max(64)
+});
+var VerifyPayload = external_exports.object({
+  cliVersion: external_exports.string().min(1).max(32),
+  /** The per-request skeleton (bounded/sampled — see `truncated`). */
+  requests: external_exports.array(VerifyRequestRecord).min(1).max(1e5),
+  /**
+   * True when the local corpus exceeded the client upload cap and was sampled to
+   * the most recent N requests. The server treats a truncated upload conservatively
+   * (it never AUTO-passes a truncated one — it can still auto-FAIL on a physical
+   * impossibility, or route to a human).
+   */
+  truncated: external_exports.boolean().optional()
+});
 function entryTotalTokens(e) {
   return e.inputTokens + e.outputTokens + e.cacheCreationTokens + e.cacheReadTokens;
 }
@@ -6359,20 +6450,24 @@ function formatUSD(n) {
 function sanitizeServerText(s) {
   return s.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
 }
-function submitNextStepLines(result) {
+function signedInNextStepLines(result) {
+  if (result.orgBoardUrl) {
+    return [
+      `  \u{1F3E2} You're on your team board: ${sanitizeServerText(result.orgBoardUrl)}`,
+      "  \u2192 Open it to see who burned more."
+    ];
+  }
   if (result.boardUrl) {
-    const code = result.boardCode ?? result.boardUrl.split("/").filter(Boolean).pop() ?? "";
+    const code = result.boardUrl.split("/").filter(Boolean).pop() ?? "";
     return [
       `  \u{1F91D} You're on the board: ${sanitizeServerText(result.boardUrl)}`,
       "  \u2192 Open it to see who burned more.",
-      `  \u2192 Get a friend on it \u2014 have them run: npx whoburnedmore --board=${sanitizeServerText(code)}`,
-      "  \u2192 Sign in on the page and add your X to claim your spot and own your rank."
+      `  \u2192 Get a friend on it \u2014 have them run: npx whoburnedmore --board=${sanitizeServerText(code)}`
     ];
   }
   return [
-    `  Your dashboard: ${sanitizeServerText(result.dashboardUrl)}`,
-    "  \u2192 Sign in and add your X on the page to get on the leaderboard and claim your rank.",
-    "  Private until you do. Manage anytime: `npx whoburnedmore private` \xB7 `public` \xB7 `remove`."
+    `  Your dashboard: ${sanitizeServerText(result.profileUrl)}`,
+    "  \u2192 Open it to see your rank and share your profile."
   ];
 }
 
@@ -6752,56 +6847,139 @@ async function run(flags) {
     console.log(pc2.dim("  --no-submit: skipped the dashboard."));
     return;
   }
-  const anonKey = ensureAnonKey();
-  const result = await anonSubmit(anonKey, payload);
+  const cfg = loadConfig();
+  const canSignIn = !flags.quiet && Boolean(process.stdout.isTTY);
+  if (cfg?.cliToken) {
+    await submitSignedIn(cfg.cliToken, payload, flags, canSignIn);
+  } else if (canSignIn) {
+    const auth = await ensureSignedIn();
+    if (!auth) return;
+    await submitSignedIn(auth.token, payload, flags, canSignIn);
+  } else if (!flags.quiet) {
+    console.log(pc2.yellow("  Sign in to put your usage on the leaderboard."));
+    console.log(
+      pc2.dim(
+        "  Run `npx whoburnedmore` in an interactive terminal to sign in, or `npx whoburnedmore link --token=\u2026` (from your signed-in profile) for servers/CI."
+      )
+    );
+  } else {
+    return;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function ensureSignedIn() {
+  const cfg = loadConfig();
+  if (cfg?.cliToken) return { token: cfg.cliToken, handle: cfg.handle ?? "" };
+  let dev;
   try {
-    recordSync();
-  } catch {
+    dev = await deviceStart();
+  } catch (err) {
+    console.log(pc2.yellow(`  Couldn't start sign-in: ${err.message}`));
+    return null;
   }
+  console.log();
+  console.log(pc2.bold("  Sign in to whoburnedmore to put your usage on the board."));
+  console.log(`  1. Opening ${pc2.cyan(sanitizeServerText(dev.verifyUrl))} \u2014 or go there yourself.`);
+  console.log(`  2. Approve this code: ${pc2.bold(sanitizeServerText(dev.userCode))}`);
+  if (isTrustedWebUrl(dev.verifyUrl)) openBrowser(dev.verifyUrl);
+  console.log(pc2.dim("  Waiting for you to approve in the browser\u2026"));
+  const deadline = Date.now() + dev.expiresInSeconds * 1e3;
+  const intervalMs = Math.max(1, dev.pollIntervalSeconds) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    let res;
+    try {
+      res = await devicePoll(dev.deviceCode);
+    } catch {
+      continue;
+    }
+    if (res.status === "ok") {
+      saveAuth(void 0, { cliToken: res.token, handle: res.handle });
+      console.log(pc2.green(`  \u2713 Signed in as @${sanitizeServerText(res.handle)}.`));
+      return { token: res.token, handle: res.handle };
+    }
+    if (res.status === "expired") break;
+  }
+  console.log(
+    pc2.yellow("  Sign-in timed out. Run `npx whoburnedmore` again to retry.")
+  );
+  return null;
+}
+async function submitSignedIn(token, payload, flags, interactive) {
+  let result;
   try {
-    const config = loadConfig();
-    if (result.launch?.live && !config?.launchNotificationDeliveredAt) {
-      if (notifyLaunchLive()) {
-        recordLaunchNotificationDelivered();
-      }
+    result = await submit(token, payload);
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      clearAuth();
+      if (!interactive) return;
+      const auth = await ensureSignedIn();
+      if (!auth) return;
+      result = await submit(auth.token, payload);
+    } else {
+      throw err;
     }
+  }
+  try {
+    recordSync();
   } catch {
   }
-  const { baseUrl, target } = resolveOpenTarget(result, anonKey);
-  const trusted = isTrustedWebUrl(baseUrl);
+  const baseUrl = result.orgBoardUrl ?? result.boardUrl ?? result.profileUrl;
   if (!flags.quiet) {
     console.log(
       pc2.green("  \u2713 Synced securely.") + pc2.dim(" Only your daily totals left this machine \u2014 never your prompts, code, or file names.")
     );
-    if (trusted) {
+    if (result.suppressed) {
+      console.log();
+      console.log(
+        pc2.yellow(
+          "  \u26A0 You're currently OFF the leaderboard \u2014 we couldn't verify these numbers."
+        )
+      );
+      console.log(
+        pc2.dim(
+          "  Verify your usage to get back on \u2014 this sends a detailed per-request breakdown (timestamps + token counts, never your prompts or code)."
+        )
+      );
+      if (process.stdin.isTTY && await confirm("  Verify now?")) {
+        await runVerify();
+        afterSubmitChores(flags);
+        return;
+      }
+      console.log(
+        pc2.dim(
+          "  Run `npx whoburnedmore verify` anytime, or appeal at whoburnedmore.com/appeal."
+        )
+      );
+    }
+    if (isTrustedWebUrl(baseUrl)) {
       console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
-      openBrowser(target);
+      openBrowser(baseUrl);
     } else {
       console.log(
         pc2.dim("  The server returned an unexpected dashboard address, so it was NOT auto-opened. Open it yourself only if you trust it:")
       );
       console.log(`  ${sanitizeServerText(baseUrl)}`);
     }
-  }
-  const lines = submitNextStepLines(result);
-  for (const line of lines) {
-    if (line.includes("\u2192")) console.log(pc2.bold(line));
-    else if (line.startsWith("  Private until you do")) {
-      if (!flags.quiet) console.log(pc2.dim(line));
-    } else console.log(line);
-  }
-  if (!flags.quiet) {
-    try {
-      reconcileAutoSync();
-    } catch {
+    for (const line of signedInNextStepLines(result)) {
+      if (line.includes("\u2192")) console.log(pc2.bold(line));
+      else console.log(line);
     }
   }
-  if (!flags.quiet) {
-    console.log();
-    console.log(
-      autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every 15 min (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
-    );
+  afterSubmitChores(flags);
+}
+function afterSubmitChores(flags) {
+  if (flags.quiet) return;
+  try {
+    reconcileAutoSync();
+  } catch {
   }
+  console.log();
+  console.log(
+    autoSyncInstalled() ? pc2.dim("  Background sync is on \u2014 your page updates automatically every 15 min (`npx whoburnedmore uninstall-sync` to stop).") : pc2.dim("  Re-run anytime to update your page.")
+  );
 }
 async function linkServerInstall(token) {
   if (!token) {
@@ -6809,6 +6987,9 @@ async function linkServerInstall(token) {
   }
   const anonKey = ensureAnonKey();
   const linked = await redeemServerInstall(token, anonKey);
+  if (linked.cliToken) {
+    saveAuth(void 0, { cliToken: linked.cliToken, handle: linked.handle });
+  }
   const handle = sanitizeServerText(linked.handle);
   console.log(
     linked.alreadyLinked ? `  This machine is already linked to @${handle}.` : `  Linked this machine to @${handle}.`
@@ -6883,6 +7064,102 @@ async function runDaemon() {
   console.log();
   console.log(pc2.dim(`  Daemon stopped after ${cycles} sync cycle${cycles === 1 ? "" : "s"}.`));
 }
+async function runVerify() {
+  printBanner();
+  console.log();
+  console.log(pc2.bold("  Verify your usage to get back on the leaderboard."));
+  console.log(
+    pc2.dim(
+      "  This sends a DETAILED per-request breakdown \u2014 timestamps and token counts, still never your prompts, code, or file names \u2014 so we can confirm your usage is real. It's deleted after review."
+    )
+  );
+  const cfg = loadConfig();
+  let token = cfg?.cliToken;
+  if (!token) {
+    if (!process.stdout.isTTY) {
+      console.log(
+        pc2.yellow(
+          "  Sign in first \u2014 run `npx whoburnedmore verify` in an interactive terminal."
+        )
+      );
+      return;
+    }
+    const auth = await ensureSignedIn();
+    if (!auth) return;
+    token = auth.token;
+  }
+  if (process.stdin.isTTY) {
+    const ok = await confirm("\n  Send this breakdown to verify your usage?");
+    if (!ok) {
+      console.log(pc2.dim("  Cancelled \u2014 nothing was sent."));
+      return;
+    }
+  }
+  console.log(pc2.dim("  Reading your local Claude Code logs\u2026"));
+  const { requests, found } = await collectClaudeRequests();
+  if (!found || requests.length === 0) {
+    console.log(
+      pc2.yellow("  No local Claude Code logs found on this machine to verify.")
+    );
+    console.log(
+      pc2.dim(
+        "  Run this on the machine where you actually use Claude Code, or file a written appeal at whoburnedmore.com/appeal."
+      )
+    );
+    return;
+  }
+  const CAP = 5e4;
+  const sorted = requests.slice().sort((a, b) => b.ts - a.ts);
+  const truncated = sorted.length > CAP;
+  const capped = truncated ? sorted.slice(0, CAP) : sorted;
+  const records = capped.map((r) => ({
+    date: r.date,
+    ts: r.ts,
+    tool: "claude",
+    model: r.model,
+    inputTokens: r.inputTokens,
+    outputTokens: r.outputTokens,
+    cacheCreationTokens: r.cacheCreationTokens,
+    cacheReadTokens: r.cacheReadTokens,
+    reqHash: createHash("sha256").update(r.key).digest("hex").slice(0, 32)
+  }));
+  console.log(
+    pc2.dim(
+      `  Sending ${records.length} request records for analysis${truncated ? " (most recent, sampled)" : ""}\u2026`
+    )
+  );
+  let result;
+  try {
+    result = await verifyUsage(token, {
+      cliVersion: VERSION,
+      requests: records,
+      ...truncated ? { truncated: true } : {}
+    });
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      clearAuth();
+      console.log(
+        pc2.yellow(
+          "  Your sign-in expired \u2014 run `npx whoburnedmore verify` again to retry."
+        )
+      );
+      return;
+    }
+    throw err;
+  }
+  console.log();
+  const line = `  ${sanitizeServerText(result.message)}`;
+  if (result.relisted) {
+    console.log(pc2.green(`  \u2713${line.slice(1)}`));
+  } else {
+    console.log(result.verdict === "fail" ? pc2.yellow(line) : line);
+    console.log(
+      pc2.dim(
+        "  We'll relist you automatically if it checks out \u2014 re-run `npx whoburnedmore` anytime to check."
+      )
+    );
+  }
+}
 async function main() {
   const major = Number(process.versions.node.split(".")[0]);
   if (major < 20) {
@@ -6918,6 +7195,9 @@ async function main() {
     case "daemon":
       await runDaemon();
       break;
+    case "verify":
+      await runVerify();
+      break;
     case "status":
     case "doctor": {
       for (const line of agentStatusReport()) console.log(line);
@@ -6969,8 +7249,8 @@ function printHelp() {
   ${pc2.bold("whoburnedmore")} \u2014 who burned more tokens, you or them?
 
   ${pc2.bold("usage")}
-    npx whoburnedmore              burn + land on the public leaderboard, open your dashboard
-    npx whoburnedmore --board=CODE compare with friends \u2014 join their board (no sign-in)
+    npx whoburnedmore              sign in, burn + land on the public leaderboard, open your dashboard
+    npx whoburnedmore --board=CODE compare with friends \u2014 sign in and join their board
     npx whoburnedmore --org=SLUG   submit to your organization's board (companies/hackathons)
     npx whoburnedmore --local      build the dashboard on your machine and open it (offline)
     npx whoburnedmore --dry-run    print exactly what would be sent, send nothing
@@ -6980,14 +7260,15 @@ function printHelp() {
     npx whoburnedmore private      hide your dashboard from the leaderboard
     npx whoburnedmore public       put it back on the leaderboard
     npx whoburnedmore remove       delete your dashboard and its data
+    npx whoburnedmore verify       delisted? re-verify your usage to get back on (sends a detailed breakdown)
     npx whoburnedmore status       check background-sync health (last sync, staleness)
     npx whoburnedmore uninstall-sync   turn off the background sync
     npx whoburnedmore install-sync     turn it back on after uninstalling
 
-  Background sync is on by default: after your first run, your page refreshes
-  automatically every 15 min (\`uninstall-sync\` to stop). Your dashboard is public on
-  the leaderboard as an anonymous burner \u2014 sign in on whoburnedmore.com to claim
-  it (handle + X) and own your rank, or run \`private\`/\`remove\` to pull it. Only
+  Your first run signs you in (we open a page, you approve a short code) and binds
+  this machine to your account \u2014 your usage lands on the leaderboard under your
+  handle. Background sync is on by default: your page then refreshes automatically
+  every 15 min (\`uninstall-sync\` to stop); run \`private\`/\`remove\` to pull it. Only
   daily aggregate numbers (date, tool, model, token counts, est. cost) ever leave
   your machine \u2014 never prompts, code, or file names. With --local, nothing leaves
   your machine at all.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {