# StopBurnout

A Windows desktop app that enforces regular, hard-to-skip breaks after a configurable amount of
focused work — so you actually stop, stand up, and recover.

- **Local-only.** No account, no network, no tracking. It only reads *how long ago* your last
  keyboard/mouse input was, never what you typed.
- **Time away counts as recovery.** Stepping away from the keyboard winds the work timer back down.
- **Three protection levels**, from a friendly nudge to no way out:

| Mode | Break | Way out during a break |
|---|---|---|
| Notification | Corner notification, nothing blocks | Just keep working (or don't) |
| **Password-locked** (default) | Mandatory, full screen | Your password |
| **No way out** | Mandatory, full screen | **None.** Not even the password — the break ends when the timer does |

In the two locked modes the password also guards settings changes, which apply immediately.

See [docs/HOW_IT_WORKS.md](docs/HOW_IT_WORKS.md) for the full behavior, including exactly how the
work timer counts.

## Licensing

The app has a **14-day free trial** (anchored to first run, stored locally); the download is
free from [stopburnout.app](https://stopburnout.app). After the trial a lifetime license is
required: without one the work timer pauses (a break already in progress always finishes),
and Settings opens with the License card for activation.

Licensing is two-stage, and one key activates at most **2 machines**:

- The **purchase key** (`SB2-…`) is an ECDSA P-256 signature over the buyer's email, issued by
  the website's checkout backend. It proves the purchase but doesn't license a machine.
- **Activation** is the app's one and only network call (`LicenseActivationClient` →
  `POST stopburnout.app/api/activate`): it sends the email, the key and an anonymous machine
  hash (`WindowsMachineIdProvider`, SHA-256 of Windows' MachineGuid — the GUID never leaves
  the machine). The server counts machine slots per key (max 2, idempotent per machine) and
  returns an **activation token** (`SB2A-…`) — a signature over `email\nmachineId`.
- The token is verified **offline** in `StopBurnout.Core/Security/LicenseValidator.cs` against
  the embedded public key and the current machine id on every read — so after that single
  call the app never phones home, hand-editing the database doesn't unlock anything, and a
  copied database doesn't unlock a different machine.
- The private signing key lives with the website project (`stopburnout.app-webpage`), not here.

## Install / run (release build)

1. Download (or build, see below) `StopBurnout-<version>-win-x64.zip` and extract it anywhere.
2. Run `StopBurnout.App.exe`. No .NET installation is required — the build is self-contained.
3. The first-run wizard walks you through your rhythm and protection level
   (Password-locked is preselected). After setup the app lives in the system tray.

Data is stored in `C:\ProgramData\StopBurnout\stopburnout.db`. To reset everything, quit the app
and delete that file (plus the `-wal`/`-shm` files next to it).

## Build from source

Requirements: .NET 8 SDK on Windows.

```powershell
dotnet build StopBurnout.sln     # build
dotnet test  StopBurnout.sln     # run the test suite
dotnet run --project src\StopBurnout.App    # run the dev build
```

## Package a release

```powershell
.\publish.ps1        # tests + self-contained single-file publish + zip into .\dist
```

## Project layout

| Project | Purpose |
|---|---|
| `StopBurnout.Shared` | Enums, runtime state, IPC contracts shared by all processes |
| `StopBurnout.Core` | Settings, state machine, break engine, unlock/change rules, SQLite storage |
| `StopBurnout.App` | Avalonia UI: tray, dashboard, settings, setup wizard, break overlay |
| `StopBurnout.Platform.Windows` | Windows specifics: input activity, startup registration |
| `tests/*` | Unit + integration tests |
