feat: sync integrity check + anti-cheat caps on leaderboard

Client: sends version + SHA-256 integrity fingerprint with sync
Server: caps totals (200k msgs, 50k hours), week (20k msgs), logs version/integrity
Prevents inflated stats from modified clients or sub-agent counting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: vakovalskii

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codedash-app",
-  "version": "6.15.9",
+  "version": "6.15.10",
   "description": "Dashboard + CLI for Claude Code, Codex & OpenCode sessions. View, search, resume, convert, handoff between agents.",
   "bin": {
     "codedash": "./bin/cli.js"

src/server.js

@@ -880,12 +880,23 @@ async function syncLeaderboard() {
 
   const stats = getLeaderboardStats();
   const anon = stats.anon || {};
+  // Build integrity fingerprint: SHA-256(version + data.js header)
+  const pkg = require('../package.json');
+  let integrity = '';
+  try {
+    const dataJsPath = require('path').join(__dirname, 'data.js');
+    const header = require('fs').readFileSync(dataJsPath, 'utf8').slice(0, 200);
+    integrity = require('crypto').createHash('sha256').update(pkg.version + header).digest('hex').slice(0, 16);
+  } catch {}
+
   const payload = {
     username: profile.username,
     avatar: profile.avatar,
     name: profile.name,
     deviceId: anon.id || require('crypto').randomUUID(),
     token: profile.token, // for server-side GitHub verification
+    version: pkg.version,
+    integrity: integrity,
     stats: {
       today: { ...stats.today, hours: Math.min(stats.today.hours || 0, 24) },
       week: stats.daily ? stats.daily.slice(0, 7).reduce((acc, d) => ({ messages: acc.messages + d.messages, hours: acc.hours + d.hours, cost: acc.cost + d.cost }), { messages: 0, hours: 0, cost: 0 }) : { messages: 0, hours: 0, cost: 0 },