whoburnedmore 0.9.5 → 0.9.6

package/README.md

@@ -1,6 +1,6 @@
 # whoburnedmore
 
-**who burned more tokens — you or them?** One command reads your local AI coding-agent usage logs, shows your burn, and gives you a **shareable dashboard with no sign-in required**.
+**who burned more tokens — you or them?** One command reads your local AI coding-agent usage logs, adds up your burn, and puts you on the public leaderboard with a **shareable dashboard**.
 
 [![npm version](https://img.shields.io/npm/v/whoburnedmore.svg?color=f97316)](https://www.npmjs.com/package/whoburnedmore)
 [![npm downloads](https://img.shields.io/npm/dm/whoburnedmore.svg?color=f97316)](https://www.npmjs.com/package/whoburnedmore)
@@ -11,7 +11,7 @@
 npx whoburnedmore
 ```
 
-That's the whole thing. No install, no account, no config.
+That's the whole thing. No install, no config. Your **first run signs you in** — the CLI opens a page, you approve a short code, and this machine is bound to your account.
 
 ---
 
@@ -28,13 +28,15 @@ whoburnedmore · https://whoburnedmore.com
   total          2.31B tokens   $2,656.91
   today          92.8M tokens
 
-  You burned 2.31B tokens. Your shareable dashboard:
-  https://whoburnedmore.com/d/5twjwi-jtga4r
+  You burned 2.31B tokens. Your dashboard:
+  https://whoburnedmore.com/u/<your-handle>
 
-  Re-run anytime to update it · `npx whoburnedmore login` to claim a public handle and compete.
+  Re-run anytime to update it. Background sync keeps it fresh every 15 min.
 ```
 
-Your dashboard is **anonymous and unlisted by default** — only people you send the link to can see it. Run the command again anytime to refresh it.
+Once you're signed in, your usage lands on the leaderboard under your handle. Run the command again anytime to refresh — or let the background sync do it for you.
+
+**Want to stay off the board?** Run `npx whoburnedmore private` to hide your dashboard, or `npx whoburnedmore --local` to never upload anything at all.
 
 ## Privacy first
 
@@ -46,7 +48,7 @@ See exactly what would be sent, and send nothing:
 npx whoburnedmore --dry-run
 ```
 
-Or stay completely offline — `--local` builds the same dashboard as a self-contained HTML file on your machine and opens it in your browser, sending nothing anywhere:
+Or stay completely offline — `--local` builds the same dashboard as a self-contained HTML file on your machine and opens it in your browser, sending nothing anywhere and never signing you in:
 
 ```bash
 npx whoburnedmore --local
@@ -56,14 +58,21 @@ npx whoburnedmore --local
 
 | Command | What it does |
 | --- | --- |
-| `npx whoburnedmore` | Show your burn + get a shareable dashboard (no sign-in) |
-| `npx whoburnedmore --local` | Build the dashboard locally and open it (fully offline) |
+| `npx whoburnedmore` | Sign in, submit your burn, land on the leaderboard, open your dashboard |
+| `npx whoburnedmore --board=CODE` | Compare with friends — sign in and join their board |
+| `npx whoburnedmore --org=SLUG` | Submit to your organization's board (companies / hackathons) |
+| `npx whoburnedmore --local` | Build the dashboard locally and open it (fully offline, no sign-in) |
 | `npx whoburnedmore --dry-run` | Print exactly what would be sent, send nothing |
 | `npx whoburnedmore --no-submit` | Print local stats only, send nothing |
-| `npx whoburnedmore login` | Sign in to claim a public handle + join the leaderboard |
-| `npx whoburnedmore logout` | Forget the local token (your data is untouched) |
-| `npx whoburnedmore install-sync` | Keep your dashboard live with a background sync (every 15 min) |
-| `npx whoburnedmore uninstall-sync` | Remove the background sync |
+| `npx whoburnedmore private` | Hide your dashboard from the leaderboard |
+| `npx whoburnedmore public` | Put it back on the leaderboard |
+| `npx whoburnedmore remove` | Delete your dashboard and all its data |
+| `npx whoburnedmore verify` | Delisted? Re-verify your usage to get back on |
+| `npx whoburnedmore link --token=TOKEN` | Bind a server / VM to your account (token from your profile) |
+| `npx whoburnedmore daemon` | Keep syncing in the foreground (containers with no scheduler) |
+| `npx whoburnedmore status` | Check background-sync health (last sync, staleness) |
+| `npx whoburnedmore install-sync` | Turn the 15-minute background sync back on |
+| `npx whoburnedmore uninstall-sync` | Turn the background sync off |
 
 ## Supported tools
 
@@ -73,29 +82,37 @@ Usage is read via [`ccusage`](https://www.npmjs.com/package/ccusage) from any of
 
 Whatever you have logs for is picked up automatically — you don't pass any flags.
 
-## Claim a public handle (optional)
+## Compete with friends and teams
 
-Want on the public leaderboard? Sign in with **GitHub or Google**:
+- **Friends:** join someone's board with `npx whoburnedmore --board=CODE` (the code comes from their board's invite).
+- **Companies / hackathons:** submit to an organization board with `npx whoburnedmore --org=SLUG` (add `--pass=CODE` if the org requires a join code).
 
-```bash
-npx whoburnedmore login
-```
-
-It uses a device flow — a code appears in your terminal, you approve it in the browser, and you're done. Your submissions then link to your handle at `whoburnedmore.com/u/<handle>`. You can delete your account and every row of data anytime from your profile.
+Your submissions link to your handle at `whoburnedmore.com/u/<handle>`. You can delete your account and every row of data anytime from your profile.
 
 ## Keep it live
 
-Want your dashboard to stay fresh without re-running by hand?
+Background sync is on by default after your first run, so your dashboard stays fresh without re-running by hand. To manage it:
 
 ```bash
-npx whoburnedmore install-sync     # background sync every 15 min (launchd / cron / scheduled task)
-npx whoburnedmore uninstall-sync   # remove it
+npx whoburnedmore status           # last sync + staleness
+npx whoburnedmore uninstall-sync   # turn the background sync off
+npx whoburnedmore install-sync     # turn it back on (launchd / cron / scheduled task)
 ```
 
 The installed background job runs the latest published `whoburnedmore` package on
 each sync tick, so future CLI fixes are picked up automatically after the next
 15-minute refresh.
 
+## Servers & VMs
+
+Generate a one-time `link` command from your profile on whoburnedmore.com and run it inside the machine to bind it to your account:
+
+```bash
+npx whoburnedmore link --token=TOKEN
+```
+
+On a persistent VM, background sync uses cron or a systemd user timer automatically. In a container or any host without a scheduler, run `npx whoburnedmore daemon` under your process manager instead. Set `WHOBURNEDMORE_CONFIG_DIR` to a persistent path so the machine identity survives restarts.
+
 ## Links
 
 - 🏆 Leaderboard — **[whoburnedmore.com](https://whoburnedmore.com)**

package/dist/index.js

@@ -127,8 +127,10 @@ async function verifyUsage(token, payload) {
   }
   return body;
 }
+var ANON_RETIRED_MESSAGE = "Anonymous mode has been retired. Run `npx whoburnedmore` and sign in, or `npx whoburnedmore link --token=\u2026` for a server/CI, to put your usage on the leaderboard.";
 async function anonSubmit(anonKey, payload) {
   const { status, body } = await post("/v1/anon/submit", { ...payload, anonKey });
+  if (status === 410) throw new Error(ANON_RETIRED_MESSAGE);
   if (status !== 200) {
     const err = body;
     const details = err.details?.length ? `
@@ -179,19 +181,12 @@ async function submit(token, payload) {
 function claimUrl(dashboardUrl, anonKey) {
   return `${dashboardUrl}#k=${encodeURIComponent(anonKey)}`;
 }
-function boardClaimUrl(boardUrl, slug, anonKey) {
-  return `${boardUrl}#k=${encodeURIComponent(anonKey)}&u=${encodeURIComponent(slug)}`;
-}
-function resolveOpenTarget(result, anonKey) {
-  const baseUrl = result.orgBoardUrl ?? result.boardUrl ?? result.dashboardUrl;
-  const target = result.orgBoardUrl ? boardClaimUrl(result.orgBoardUrl, result.slug, anonKey) : result.boardUrl ? boardClaimUrl(result.boardUrl, result.slug, anonKey) : claimUrl(result.dashboardUrl, anonKey);
-  return { baseUrl, target };
-}
 async function anonVisibility(anonKey, listed) {
   const { status, body } = await post(
     "/v1/anon/visibility",
     { anonKey, listed }
   );
+  if (status === 410) throw new Error(ANON_RETIRED_MESSAGE);
   if (status !== 200) {
     throw new Error(body.error ?? `failed (HTTP ${status})`);
   }
@@ -203,6 +198,7 @@ async function anonRemove(anonKey) {
     body: JSON.stringify({ anonKey }),
     signal: AbortSignal.timeout(3e4)
   });
+  if (res.status === 410) throw new Error(ANON_RETIRED_MESSAGE);
   if (res.status !== 200) {
     const b = await res.json().catch(() => ({}));
     throw new Error(b.error ?? `failed (HTTP ${res.status})`);
@@ -299,10 +295,6 @@ function recordSync(dir = defaultConfigDir(), when = Date.now()) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, lastSyncAt: when });
 }
-function recordLaunchNotificationDelivered(dir = defaultConfigDir(), when = Date.now()) {
-  const config = loadConfig(dir) ?? {};
-  saveConfig(dir, { ...config, launchNotificationDeliveredAt: when });
-}
 function saveAuth(dir = defaultConfigDir(), auth = { cliToken: "" }) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, cliToken: auth.cliToken, handle: auth.handle });
@@ -730,41 +722,6 @@ function rotateLogIfLarge(path = syncLogPath(), capBytes = 256 * 1024) {
     return false;
   }
 }
-function notifyLaunchLive(opts) {
-  const os = opts?.platform ?? platform();
-  const run2 = opts?.spawn ?? ((cmd, args) => spawnSync(cmd, args, { stdio: "ignore" }));
-  const title = "whoburnedmore is live";
-  const message = "Your dashboard is ready. Go to whoburnedmore.com";
-  if (os === "darwin") {
-    return run2("osascript", [
-      "-e",
-      `display notification "${message}" with title "${title}"`
-    ]).status === 0;
-  }
-  if (os === "linux") {
-    return run2("notify-send", [title, message]).status === 0;
-  }
-  if (os === "win32") {
-    const psQuote = (value) => `'${value.replaceAll("'", "''")}'`;
-    const script = [
-      "Add-Type -AssemblyName System.Windows.Forms",
-      "$n = New-Object System.Windows.Forms.NotifyIcon",
-      "$n.Icon = [System.Drawing.SystemIcons]::Application",
-      `$n.BalloonTipTitle = ${psQuote(title)}`,
-      `$n.BalloonTipText = ${psQuote(message)}`,
-      "$n.Visible = $true",
-      "$n.ShowBalloonTip(10000)",
-      "Start-Sleep -Seconds 2",
-      "$n.Dispose()"
-    ].join("; ");
-    return run2("powershell", [
-      "-NoProfile",
-      "-Command",
-      script
-    ]).status === 0;
-  }
-  return false;
-}
 function autoSyncLoaded() {
   if (platform() === "darwin") {
     const res = spawnSync("launchctl", ["list"], { encoding: "utf8" });
@@ -6493,22 +6450,6 @@ function formatUSD(n) {
 function sanitizeServerText(s) {
   return s.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
 }
-function submitNextStepLines(result) {
-  if (result.boardUrl) {
-    const code = result.boardCode ?? result.boardUrl.split("/").filter(Boolean).pop() ?? "";
-    return [
-      `  \u{1F91D} You're on the board: ${sanitizeServerText(result.boardUrl)}`,
-      "  \u2192 Open it to see who burned more.",
-      `  \u2192 Get a friend on it \u2014 have them run: npx whoburnedmore --board=${sanitizeServerText(code)}`,
-      "  \u2192 Sign in on the page and add your X to claim your spot and own your rank."
-    ];
-  }
-  return [
-    `  Your dashboard: ${sanitizeServerText(result.dashboardUrl)}`,
-    "  \u2192 Sign in and add your X on the page to get on the leaderboard and claim your rank.",
-    "  Private until you do. Manage anytime: `npx whoburnedmore private` \xB7 `public` \xB7 `remove`."
-  ];
-}
 function signedInNextStepLines(result) {
   if (result.orgBoardUrl) {
     return [
@@ -6910,8 +6851,6 @@ async function run(flags) {
   const canSignIn = !flags.quiet && Boolean(process.stdout.isTTY);
   if (cfg?.cliToken) {
     await submitSignedIn(cfg.cliToken, payload, flags, canSignIn);
-  } else if (cfg?.anonKey) {
-    await submitWithDeviceKey(cfg.anonKey, payload, flags);
   } else if (canSignIn) {
     const auth = await ensureSignedIn();
     if (!auth) return;
@@ -7031,44 +6970,6 @@ async function submitSignedIn(token, payload, flags, interactive) {
   }
   afterSubmitChores(flags);
 }
-async function submitWithDeviceKey(anonKey, payload, flags) {
-  const result = await anonSubmit(anonKey, payload);
-  try {
-    recordSync();
-  } catch {
-  }
-  try {
-    const config = loadConfig();
-    if (result.launch?.live && !config?.launchNotificationDeliveredAt) {
-      if (notifyLaunchLive()) {
-        recordLaunchNotificationDelivered();
-      }
-    }
-  } catch {
-  }
-  const { baseUrl, target } = resolveOpenTarget(result, anonKey);
-  const trusted = isTrustedWebUrl(baseUrl);
-  if (!flags.quiet) {
-    console.log(
-      pc2.green("  \u2713 Synced securely.") + pc2.dim(" Only your daily totals left this machine \u2014 never your prompts, code, or file names.")
-    );
-    if (trusted) {
-      console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
-      openBrowser(target);
-    } else {
-      console.log(
-        pc2.dim("  The server returned an unexpected dashboard address, so it was NOT auto-opened. Open it yourself only if you trust it:")
-      );
-      console.log(`  ${sanitizeServerText(baseUrl)}`);
-    }
-    for (const line of submitNextStepLines(result)) {
-      if (line.includes("\u2192")) console.log(pc2.bold(line));
-      else if (line.startsWith("  Private until you do")) console.log(pc2.dim(line));
-      else console.log(line);
-    }
-  }
-  afterSubmitChores(flags);
-}
 function afterSubmitChores(flags) {
   if (flags.quiet) return;
   try {
@@ -7086,6 +6987,9 @@ async function linkServerInstall(token) {
   }
   const anonKey = ensureAnonKey();
   const linked = await redeemServerInstall(token, anonKey);
+  if (linked.cliToken) {
+    saveAuth(void 0, { cliToken: linked.cliToken, handle: linked.handle });
+  }
   const handle = sanitizeServerText(linked.handle);
   console.log(
     linked.alreadyLinked ? `  This machine is already linked to @${handle}.` : `  Linked this machine to @${handle}.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {