1. Open sheets.google.com and make a new blank sheet. Name it (e.g. "Sample Class 1 Points").
2. In that sheet's menu: Extensions → Apps Script.
3. At the top-left, click Untitled project and rename it (e.g. "Sample Class 1 Points") so the permission screen later looks familiar, not anonymous.
4. Delete any code in the editor and paste in Code 1 below.
5. Click the gear (Project Settings) on the left and tick "Show appsscript.json manifest file in editor."
6. Back in the editor (<> Editor), open the file named appsscript.json, delete what's there, and paste in Code 2. This limits the app to this one sheet only.
7. Click Deploy → New deployment. Type: Web app. Set Execute as: Me and Who has access: Anyone. Click Deploy.
8. Google will warn the app "isn't verified" — that's normal for your own script. Click Advanced → Go to … (unsafe) → Allow. (It runs as you, on your sheet only.)
9. Copy the Web app URL it gives you (ends in /exec), paste it in the box above, and click Save link.

Tip: to test by hand, pick testSetup in the function dropdown and click Run — that authorizes the script and drops one test row in your Log. Don't click Run on doPost; it only works from a real web request and will show a "postData" error otherwise.

Already set up? Two steps, not one:

1. Re-copy this updated Code 1 and paste it over your existing Code.gs (replacing it entirely), then save (Ctrl/Cmd+S).
2. Redeploy it — pasting new code alone does not update your live sync link. In Apps Script: Deploy → Manage deployments, click the ✏️ pencil icon next to your existing deployment, set Version to New version, then click Deploy. (Do not click "New deployment" — that would give you a different link and break your existing sync URL in this app.)

function doGet(e) {
  if (e && e.parameter && e.parameter.action === "roster") {
    var ss = SpreadsheetApp.getActiveSpreadsheet();
    var sh = ss.getSheetByName("Roster");
    if (!sh) {
      var all = ss.getSheets();
      for (var i = 0; i < all.length; i++) {
        var nm = all[i].getName().toLowerCase().replace(/\s+/g, "");
        if (nm === "roster" || nm === "roaster" || nm === "classlist" ||
            nm === "classes" || nm === "students" || nm === "kids") { sh = all[i]; break; }
      }
    }
    var out = [];
    if (sh && sh.getLastRow() > 1) {
      var rows = sh.getRange(2, 1, sh.getLastRow() - 1, 3).getValues();
      rows.forEach(function (r) {
        var name = (r[0] || "").toString().trim();
        var cls = (r[1] || "").toString().trim();
        var photo = (r[2] || "").toString().trim();
        if (name) out.push({ name: name, cls: cls, photo: photo });
      });
    }
    return ContentService.createTextOutput(JSON.stringify(out))
      .setMimeType(ContentService.MimeType.JSON);
  }
  return ContentService.createTextOutput("Points sync is live.");
}

// Log columns are: Time, Student, Bunk/Group, Activity, Points, New total, ID, Undo Of.
// The ID column is how duplicate scans get caught — if the app sends the same
// scan twice (a flaky connection, a manual resync), the second one is skipped.
function logHasId(log, id) {
  if (!id) return false;
  var last = log.getLastRow();
  if (last < 2) return false;
  var ids = log.getRange(2, 7, last - 1, 1).getValues();
  for (var i = 0; i < ids.length; i++) { if (ids[i][0] === id) return true; }
  return false;
}

// Sort helper for rebuildLeaderBoard — "First Last" becomes "Last, First"
// so ties on points sort alphabetically by last name, same as the app.
function lastFirstKey(name) {
  var parts = (name || "").toString().trim().split(/\s+/);
  if (parts.length < 2) return name || "";
  return parts[parts.length - 1] + ", " + parts.slice(0, -1).join(" ");
}

// Recomputes a "Leader Board" tab straight from the Log, so standings are
// always current without anyone having to click "Send standings now."
function rebuildLeaderBoard() {
  var ss = SpreadsheetApp.getActiveSpreadsheet();
  var log = ss.getSheetByName("Log");
  if (!log || log.getLastRow() < 2) return;
  var rows = log.getRange(2, 1, log.getLastRow() - 1, 6).getValues();
  var totals = {};
  rows.forEach(function (r) {
    var name = r[1];
    if (!name) return;
    totals[name] = { group: r[2], total: r[5] }; // last row per student wins — rows are in time order
  });
  var list = Object.keys(totals).map(function (name) {
    return { name: name, group: totals[name].group, total: totals[name].total };
  });
  list.sort(function (a, b) { return b.total - a.total || lastFirstKey(a.name).localeCompare(lastFirstKey(b.name)); });
  var lb = ss.getSheetByName("Leader Board") || ss.insertSheet("Leader Board");
  lb.clear();
  lb.appendRow(["Rank", "Student", "Bunk/Group", "Points"]);
  list.forEach(function (it, i) { lb.appendRow([i + 1, it.name, it.group, it.total]); });
  lb.setFrozenRows(1);
}

function doPost(e) {
  if (!e || !e.postData) {
    return ContentService.createTextOutput(
      "No data received. This runs from the Points app. To test by hand, run testSetup() instead."
    );
  }

  var ss = SpreadsheetApp.getActiveSpreadsheet();
  var body = JSON.parse(e.postData.contents);

  if (body.type === "scan" || body.type === "correction") {
    var log = ss.getSheetByName("Log") || ss.insertSheet("Log");
    if (log.getLastRow() === 0) {
      log.appendRow(["Time", "Student", "Bunk/Group", "Activity", "Points", "New total", "ID", "Undo Of"]);
    }
    if (!logHasId(log, body.id)) {
      log.appendRow([new Date(body.ts), body.name, body.group, body.label, body.delta, body.total, body.id || "", body.undoOf || ""]);
      rebuildLeaderBoard();
    }
  }

  if (body.type === "standings") {
    var st = ss.getSheetByName("Standings") || ss.insertSheet("Standings");
    st.clear();
    st.appendRow(["Rank", "Student", "Bunk/Group", "Points"]);
    (body.rows || []).forEach(function (r) { st.appendRow(r); });
  }

  if (body.type === "pasuk") {
    var pl = ss.getSheetByName("Pesukim Log") || ss.insertSheet("Pesukim Log");
    if (pl.getLastRow() === 0) {
      pl.appendRow(["Time", "Student", "Bunk/Group", "Pasuk"]);
    }
    pl.appendRow([new Date(body.ts), body.name, body.group, body.ref + ":" + body.pasuk]);
  }

  if (body.type === "pasukgrid") {
    var pc = ss.getSheetByName("Pesukim Chart") || ss.insertSheet("Pesukim Chart");
    pc.clear();
    var header = ["Student", "Bunk/Group"];
    for (var v = body.from; v <= body.to; v++) { header.push(body.ref + ":" + v); }
    header.push("Done");
    pc.appendRow(header);
    (body.rows || []).forEach(function (r) { pc.appendRow(r); });
  }

  if (body.type === "totals") {
    var st = ss.getSheetByName("Student Totals") || ss.insertSheet("Student Totals");
    st.clear();
    st.appendRow(["Updated", new Date()]);
    st.appendRow(body.header || []);
    (body.rows || []).forEach(function (r) { st.appendRow(r); });
    st.setFrozenRows(2);
  }

  if (body.type === "attendance") {
    var att = ss.getSheetByName("Attendance Log") || ss.insertSheet("Attendance Log");
    if (att.getLastRow() === 0) {
      att.appendRow(["Time", "Date", "Student", "Bunk/Group", "Status"]);
    }
    att.appendRow([new Date(body.ts), body.date, body.name, body.group, body.status]);
  }

  if (body.type === "tracker") {
    var trk = ss.getSheetByName("Tracker Log") || ss.insertSheet("Tracker Log");
    if (trk.getLastRow() === 0) {
      trk.appendRow(["Time", "Student", "Bunk/Group", "Activity"]);
    }
    trk.appendRow([new Date(body.ts), body.name, body.group, body.activity]);
  }

  if (body.type === "hw") {
    var hwl = ss.getSheetByName("Homework Log") || ss.insertSheet("Homework Log");
    if (hwl.getLastRow() === 0) {
      hwl.appendRow(["Time", "Date", "Student", "Bunk/Group", "Checked"]);
    }
    hwl.appendRow([new Date(body.ts), body.date, body.name, body.group, body.checked ? "Yes" : "No"]);
  }

  return ContentService.createTextOutput("ok");
}

// Run THIS one by hand (pick it in the function dropdown, click Run) to
// authorize the script and confirm it works. It writes one test row you
// can delete afterward. Do not click Run on doPost — it needs a web request.
function testSetup() {
  var ss = SpreadsheetApp.getActiveSpreadsheet();
  var log = ss.getSheetByName("Log") || ss.insertSheet("Log");
  if (log.getLastRow() === 0) {
    log.appendRow(["Time", "Student", "Bunk/Group", "Activity", "Points", "New total", "ID", "Undo Of"]);
  }
  log.appendRow([new Date(), "Test student", "Gimel 1", "Setup test", 0, 0, "test-" + Date.now(), ""]);
  rebuildLeaderBoard();
}

// Run THIS once to create the "Roster" tab with Name / Class headers and a
// few example rows. Then fill it in with your kids and their classes, and
// tap "Import roster from sheet" on the Students tab in the app.
function setupRoster() {
  var ss = SpreadsheetApp.getActiveSpreadsheet();
  var sh = ss.getSheetByName("Roster") || ss.insertSheet("Roster");
  if (sh.getLastRow() === 0) {
    sh.appendRow(["Name", "Class"]);
    sh.appendRow(["Yaakov Cohen", "Math 5A"]);
    sh.appendRow(["Dovid Levi", "Math 5A"]);
    sh.appendRow(["Moshe Stern", "Math 6B"]);
  }
}

{
  "timeZone": "America/New_York",
  "dependencies": {},
  "exceptionLogging": "STACKDRIVER",
  "runtimeVersion": "V8",
  "oauthScopes": [
    "https://www.googleapis.com/auth/spreadsheets.currentonly"
  ]
}

With Code 2 in place, the permission screen will say it only wants the spreadsheet "this application is installed in" — meaning your points sheet, nothing else in your Drive.

If you ever change the code, you must re-deploy for it to take effect: Deploy → Manage deployments → ✏️ Edit → Version: New version → Deploy. The URL stays the same.

Already set up from before? The Pesukim chart needs the newest Code 1 above. Re-paste it, then re-deploy: Deploy → Manage deployments → ✏️ Edit → Version: New version → Deploy. Your link stays the same.

Updating from an older setup: the newest Code 1 adds an ID and Undo Of column at the end of the Log tab (used to stop the same scan being recorded twice) and a new Leader Board tab that recalculates itself from the Log automatically. Existing rows in Log are untouched; new columns just start filling in going forward. Re-paste and re-deploy as above.

Heads up: the page sends data without waiting for a reply, so a wrong link won't show an error here. After saving, do one scan and check that a row appears in your sheet's Log tab — if it does, you're set.