bidserver

A local server that watches online auctions, reminds you before lots close, and snipes only the lots you arm. HiBid is the first site. It has no public API, so bidserver sends trimmed copies of the web app's own GraphQL queries, polling a lot every 30 minutes when the close is over six hours out and every 3 seconds in the last two minutes. Reminders come as Web Push, built on node:crypto, and a calendar feed holds every close time. TypeScript run directly on Node 24, with no runtime packages.

The shot

Each armed lot gets timers set off its close: check the HiBid sign-in at five minutes, open the connection and measure the round trip at 30 seconds, re-read the lot at 20, touch the connection again 2.5 seconds before firing, then send the max at close minus the lead minus half the round trip. Every fresh reading re-plans them, so an extension just moves the shot. The close time comes from the lot's own countdown pinned to the middle of the request, because HiBid's close field carries no time zone. HiBid's login needs a captcha, so bidserver never logs in and never sees a password: a snippet run in a signed-in tab copies the session cookies, and the server refreshes them the way HiBid's app does.

Bidders

On watched lots it reads the public bid history whenever the bid count rises and summarizes each masked handle: sniper, early claimer, mid-auction or mixed, how high it tends to go, and when its first bids come in. Only a handle's first bid on a lot counts, because HiBid raises a preset max on the bidder's behalf and those later rows are nobody acting. Timing comes from bidserver's own polls, since HiBid's bid times have only minutes. A handle is not a person, two bidders can share one, and nothing tries to unmask them.

Stated honestly

• A bid is binding, and HiBid's terms may not allow automated bidding. bidserver bids once, only on a lot you armed, and only up to your max.
• Soft close blunts sniping: most lots extend a minute or two after a late bid.
• The Mac has to stay awake. Within 12 hours of an armed close it holds a caffeinate assertion, and a closed lid on battery still sleeps.
• It binds to loopback and refuses to listen anywhere else without a token. Not deployed.
• Bidder tracking sits on an unmerged branch and hasn't yet run against a live watched lot; its tests use a fake site.