sigrank 0.0.176 → 0.0.177

package/README.md

@@ -147,7 +147,7 @@ smithery tool call sigrank rank_paste '{"text": "1000000 500000 50000 800000"}'
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.0.176
+⊙ SigRank CLI  v0.0.177
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board

package/cli.mjs

@@ -236,7 +236,10 @@ async function fetchBoard(window = "30d") {
   const res = await fetch(
     `${DEFAULT_API_BASE}/api/v1/leaderboard?window=${window}&metric=yield_`,
     {
-      headers: { accept: "application/json" },
+      headers: {
+        accept: "application/json",
+        "user-agent": `node/${process.version} sigrank-mcp/cli`,
+      },
     },
   );
   if (!res.ok) throw new Error(`Board API → HTTP ${res.status}`);
@@ -1472,6 +1475,7 @@ async function runSigRank() {
                       headers: {
                         "content-type": "application/json",
                         accept: "application/json",
+                        "user-agent": `node/${process.version} sigrank-mcp/cli`,
                       },
                       body: JSON.stringify({
                         codename,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.0.176",
+  "version": "0.0.177",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",

package/submit.mjs

@@ -11,9 +11,22 @@
 
 import { snapshotHash, signPayload } from "./sign.mjs";
 import { preflight } from "./preflight.mjs";
+import { readFileSync } from "node:fs";
 
 const WINDOW_TYPE = { "7d": "7d", "30d": "30d", "90d": "90d", all: "all_time" };
 const WINDOW_SPAN_DAYS = { "7d": 7, "30d": 30, "90d": 90, all_time: 3650 };
+
+/** Resolve this package's version for the User-Agent stamp (best-effort). */
+function _pkgVersion() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(new URL("./package.json", import.meta.url), "utf-8"),
+    );
+    return pkg.version;
+  } catch {
+    return "unknown";
+  }
+}
 const PLATFORM_ENUM = new Set([
   "claude",
   "chatgpt",
@@ -181,8 +194,13 @@ export async function submitSignedWindow(
     ((url, init = {}) => {
       const ctrl = new AbortController();
       const timer = setTimeout(() => ctrl.abort(), 15_000);
+      const headers = {
+        "user-agent": `node/${process.version} sigrank-mcp/${_pkgVersion()}`,
+        ...(init.headers || {}),
+      };
       return fetch(url, {
         ...init,
+        headers,
         signal: init.signal || ctrl.signal,
       }).finally(() => clearTimeout(timer));
     });

package/tools.mjs

@@ -26,7 +26,7 @@ import { ALL_PLATFORMS } from "./adapters.mjs";
 import { ensureIdentity, recordEnrollment } from "./keystore.mjs";
 import { submitSignedWindow } from "./submit.mjs";
 import { createHash } from "node:crypto";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -256,6 +256,56 @@ export const DEFAULT_FETCH_TIMEOUT =
  *  past this is malformed or abusive — reject cleanly before parsing/POSTing (E2 hardening). */
 const MAX_INPUT = 1_000_000;
 
+/** Resolve this package's version for the User-Agent stamp (best-effort). */
+function agentVersionStamp() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(new URL("./package.json", import.meta.url), "utf-8"),
+    );
+    return pkg.version;
+  } catch {
+    return "unknown";
+  }
+}
+
+/**
+ * curl-based fetch fallback for when Node's fetch is blocked by Vercel's bot
+ * protection (TLS fingerprinting). Returns a Response-like object with .ok,
+ * .status, .json(), .text(). Uses execFileSync for synchronous curl execution.
+ */
+function curlFetch(url, init = {}, timeoutMs = 10_000) {
+  const args = ["-s", "-S", "-w", "\n__HTTP_STATUS__%{http_code}", "--max-time", String(Math.ceil(timeoutMs / 1000))];
+  if (init.method) args.push("-X", init.method);
+  const headers = init.headers || {};
+  for (const [k, v] of Object.entries(headers)) {
+    args.push("-H", `${k}: ${v}`);
+  }
+  if (init.body) {
+    args.push("-d", init.body);
+  }
+  args.push(url);
+  let stdout;
+  try {
+    stdout = execFileSync("curl", args, {
+      encoding: "utf-8",
+      maxBuffer: 10 * 1024 * 1024,
+      timeout: timeoutMs + 2000,
+    });
+  } catch (e) {
+    throw new Error(`curl transport failed: ${e.message}`);
+  }
+  // Parse the status code from the trailer
+  const statusMatch = stdout.match(/__HTTP_STATUS__(\d+)$/);
+  const status = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+  const bodyText = statusMatch ? stdout.slice(0, statusMatch.index) : stdout;
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => { try { return JSON.parse(bodyText); } catch { return {}; } },
+    text: async () => bodyText,
+  };
+}
+
 // ── Smithery quality: output schemas + annotations ──────────────────────────
 // MCP tool annotations hint to clients about side-effects, read-only status, etc.
 const ANNOTATIONS = {
@@ -1357,13 +1407,45 @@ export async function callTool(name, args, opts = {}) {
   const rawFetch = opts.fetchImpl || fetch;
 
   // Wrap every fetch with an AbortController timeout so a hung network call never
-  // blocks the MCP client indefinitely.
-  const doFetch = (url, init = {}) => {
+  // blocks the MCP client indefinitely. Vercel's bot protection (security
+  // checkpoint) blocks Node's fetch via TLS fingerprinting — no UA fix helps.
+  // When fetch gets a 403 Vercel challenge, fall back to curl (which passes).
+  const doFetch = async (url, init = {}) => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), timeoutMs);
-    return rawFetch(url, { ...init, signal: ac.signal }).finally(() =>
-      clearTimeout(timer),
-    );
+    const headers = {
+      "user-agent": `node/${process.version} sigrank-mcp/${agentVersionStamp()}`,
+      ...(init.headers || {}),
+    };
+    try {
+      const res = await rawFetch(url, { ...init, headers, signal: ac.signal });
+      // Detect Vercel security checkpoint (403 + HTML body, not JSON)
+      if (res.status === 403) {
+        const text = await res.text();
+        if (text.includes("Vercel Security Checkpoint") || text.includes("x-vercel-challenge")) {
+          // Fall back to curl transport
+          return curlFetch(url, init, timeoutMs);
+        }
+        // Real 403 from the API — return a mock response object
+        return {
+          ok: false,
+          status: 403,
+          json: async () => { try { return JSON.parse(text); } catch { return {}; } },
+          text: async () => text,
+        };
+      }
+      return res;
+    } catch (e) {
+      if (e.name === "AbortError") throw e;
+      // Network error — try curl as fallback
+      try {
+        return await curlFetch(url, init, timeoutMs);
+      } catch {
+        throw e;
+      }
+    } finally {
+      clearTimeout(timer);
+    }
   };
 
   const fetchJson = async (path) => {