sigrank 0.12.3 → 0.12.5

package/README.md

@@ -67,7 +67,7 @@ sigrank
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.12.1
+⊙ SigRank CLI  v0.12.5
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board

package/cli.mjs

@@ -28,11 +28,24 @@ import { callTool, DEFAULT_API_BASE } from './tools.mjs'
 import { classify } from './cascade.mjs'
 import { ensureIdentity, keystorePath } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
-import { execSync } from 'child_process'
+import { execFile } from 'child_process'
 import { existsSync, readFileSync, writeFileSync } from 'fs'
 import os from 'os'
 import path from 'path'
 
+// ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
+// defense-in-depth (shell injection prevention). execFile passes args as an
+// array, so no shell parsing occurs — even if platform contained special chars,
+// they'd be treated as literal arguments, not shell commands.
+function execFileAsync(cmd, args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+      if (err) reject(err)
+      else resolve(stdout.toString())
+    })
+  })
+}
+
 // ── ANSI helpers (no chalk dep) ────────────────────────────────────────────
 const ESC = '\x1b['
 const c = {
@@ -407,11 +420,10 @@ async function runMe({ platform = 'claude', compare = false } = {}) {
 // identical to _freshCcusage and could be consolidated in a future pass if compare
 // switches to live data — but that's a behavior change, not a refactor.
 
-function ccusagePillars(platform = 'claude') {
+async function ccusagePillars(platform = 'claude') {
   // ccusage <platform> daily --json → sum by window
   try {
-    const cmd = platform === 'claude' ? 'ccusage claude daily --json' : `ccusage ${platform} daily --json`
-    const raw = execSync(cmd, { timeout: 15000, stdio: ['ignore', 'pipe', 'ignore'] }).toString()
+    const raw = await execFileAsync('ccusage', [platform, 'daily', '--json'], 15000)
     const data = JSON.parse(raw)
     const rows = data.daily ?? data // ccusage may return {daily:[...]} or [...]
 
@@ -494,7 +506,7 @@ function appPillars() {
   }
 }
 
-function tokenDashPillars() {
+async function tokenDashPillars() {
   const dbPath = path.join(os.homedir(), '.claude', 'token-dashboard.db')
   if (!existsSync(dbPath)) return null
   try {
@@ -513,9 +525,8 @@ r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m
 out['all'] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
 print(json.dumps(out))
 `)
-    const raw = execSync(`python3 "${tmpScript}" "${dbPath}"`,
-      { timeout: 15000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim()
-    return JSON.parse(raw)
+    const raw = await execFileAsync('python3', [tmpScript, dbPath], 15000)
+    return JSON.parse(raw.trim())
   } catch {
     return null
   }
@@ -560,12 +571,12 @@ function cascadeFromPillars(p) {
 async function runCompare({ platform = 'claude' } = {}) {
   write(HIDE_CURSOR)
 
-  // Pull all five sources in parallel
+  // Pull all five sources in parallel (verifiers now async via execFile)
   writeln(`  ${dim('reading all 5 sources…')}`)
   const [ccPillars, tpData, tdPillars, tsPillars, apPillars] = await Promise.all([
-    Promise.resolve(ccusagePillars(platform)),
+    ccusagePillars(platform).catch(() => null),
     callTool('tokenpull', { platform }).catch(() => null),
-    Promise.resolve(platform === 'claude' ? tokenDashPillars() : null),
+    (platform === 'claude' ? tokenDashPillars() : Promise.resolve(null)).catch(() => null),
     Promise.resolve(tokscalePillars(platform)),
     Promise.resolve(platform === 'claude' ? appPillars() : null),
   ])
@@ -1154,8 +1165,8 @@ async function runSigRank() {
         if (k === 'q' || key === '\u0003') { // q or ctrl+c
           resolve()
         } else if (k === 'b') {
-          const { execSync: es } = await import('child_process')
-          try { es('open https://signalaf.com', { stdio: 'ignore' }) } catch { }
+          // ASYNC FIX (2026-06-27): execFile instead of dynamic execSync import
+          execFile('open', ['https://signalaf.com'], { stdio: 'ignore' }, () => {})
           resolve()
         } else if (k === 's') {
           const id = ensureIdentity()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.12.3",
+  "version": "0.12.5",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "type": "module",
   "license": "MIT",

package/tokenpull.mjs

@@ -17,7 +17,7 @@
 
 import { readdir, readFile, lstat } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
-import { execSync, execFile } from 'node:child_process'
+import { execFile } from 'node:child_process'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
 import { ADAPTERS } from './adapters.mjs'

package/tools.mjs

@@ -15,11 +15,24 @@ import { ALL_PLATFORMS } from './adapters.mjs'
 import { ensureIdentity, recordEnrollment } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
 import { createHash } from 'node:crypto'
-import { execSync } from 'node:child_process'
+import { execFile } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 
+// ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
+// defense-in-depth (shell injection prevention + non-blocking). The platform param
+// is enum-validated at the MCP schema level, but execFile also prevents shell
+// interpolation attacks by passing args as an array (no shell parsing).
+function execFileAsync(cmd, args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+      if (err) reject(err)
+      else resolve(stdout.toString())
+    })
+  })
+}
+
 // ── Verifier readers (sync, on-device, token-only) ────────────────────────────
 // These mirror the implementations in cli.mjs / tui.mjs without the circular import.
 //
@@ -29,9 +42,9 @@ import path from 'node:path'
 // (bunx tokscale, scan+read tokendash) for the TUI/CLI dashboard. Different data sources =
 // different behavior; do NOT merge without understanding the trade-off.
 
-function _ccusagePillars(platform = 'claude') {
+async function _ccusagePillars(platform = 'claude') {
   try {
-    const raw = execSync(`ccusage ${platform} daily --json`, { timeout: 15000, stdio: ['ignore','pipe','ignore'] }).toString()
+    const raw = await execFileAsync('ccusage', [platform, 'daily', '--json'], 15000)
     const rows = JSON.parse(raw)?.daily ?? JSON.parse(raw)
     const now = Date.now()
     const result = {}
@@ -57,15 +70,14 @@ function _ccusagePillars(platform = 'claude') {
   } catch { return null }
 }
 
-function _tokenDashPillars() {
+async function _tokenDashPillars() {
   const dbPath = path.join(os.homedir(), '.claude', 'token-dashboard.db')
   if (!existsSync(dbPath)) return null
   try {
-    const raw = execSync(
-      `sqlite3 "${dbPath}" "SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens)+SUM(cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages"`,
-      { timeout: 5000, stdio: ['ignore','pipe','ignore'] }
-    ).toString().trim()
-    const [i,o,cw,cr] = raw.split('|').map(Number)
+    const raw = await execFileAsync('sqlite3', [dbPath,
+      'SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens)+SUM(cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages'
+    ], 5000)
+    const [i,o,cw,cr] = raw.trim().split('|').map(Number)
     return { all: { input: i||0, output: o||0, cacheCreate: cw||0, cacheRead: cr||0 } }
   } catch { return null }
 }
@@ -578,11 +590,11 @@ export async function callTool(name, args, opts = {}) {
     const platform = args?.platform || 'claude'
     const WINS = ['7d', '30d', '90d', 'all']
 
-    // Pull all four sources in parallel (verifiers are sync, wrap in Promise.resolve)
+    // Pull all four sources in parallel (verifiers are now async via execFile)
     const [tpResult, ccPillars, tdPillars, tsPillars] = await Promise.all([
       pullByPlatform(platform, opts).catch(() => null),
-      Promise.resolve(_ccusagePillars(platform)),
-      Promise.resolve(platform === 'claude' ? _tokenDashPillars() : null),
+      _ccusagePillars(platform).catch(() => null),
+      (platform === 'claude' ? _tokenDashPillars() : Promise.resolve(null)).catch(() => null),
       Promise.resolve(_tokscalePillars(platform)),
     ])
 

package/tui.mjs

@@ -16,7 +16,7 @@ import { callTool, DEFAULT_API_BASE } from './tools.mjs'
 import { freshVerifierPillars } from './tokenpull.mjs'
 import { isSignedIn, isCodeChar } from './connect.mjs'
 import { loadIdentity, clearIdentity } from './keystore.mjs'
-import { execSync } from 'child_process'
+import { execFile } from 'child_process'
 import { existsSync, readFileSync } from 'fs'
 import os from 'os'
 import path from 'path'
@@ -57,6 +57,7 @@ const green  = (s) => paint(c.green, s)
 const red    = (s) => paint(c.red, s)
 
 const CLEAR      = `${ESC}H${ESC}2J`   // home + erase visible area
+const CLEAR_SB   = `${ESC}3J`          // clear scrollback/saved lines (prevents scroll-up past TUI)
 const ENTER_ALT  = `${ESC}?1049h`       // enter alternate screen buffer
 const EXIT_ALT   = `${ESC}?1049l`       // exit alternate screen buffer (restores original)
 const HIDE       = `${ESC}?25l`
@@ -1334,6 +1335,7 @@ export async function runTui({ platform: initPlatform = 'claude', window: win =
   }
 
   write(ENTER_ALT)  // switch to alternate screen — original terminal state preserved on exit
+  write(CLEAR_SB)   // FIXED-WINDOW (2026-06-27): clear scrollback so nothing is above the TUI
   write(HIDE)
   write(CLEAR)
 
@@ -1756,7 +1758,9 @@ export async function runTui({ platform: initPlatform = 'claude', window: win =
           if (watchPlatform && watchPlatform !== 'all') watchCmd += ` --platform ${watchPlatform}`
           if (watchWindow && watchWindow !== 'all-windows') watchCmd += ` --window ${watchWindow}`
           watchCmd += ` --refresh ${watchRefresh}`
-          execSync(`osascript -e 'tell application "Terminal" to do script "${watchCmd}"'`, { stdio: 'ignore' })
+          // ASYNC FIX (2026-06-27): execFile instead of execSync — no shell
+          // interpolation. osascript args passed as array (defense-in-depth).
+          execFile('osascript', ['-e', `tell application "Terminal" to do script "${watchCmd}"`], { stdio: 'ignore' }, () => {})
           const scope = (!watchPlatform || watchPlatform === 'all') && (!watchWindow || watchWindow === 'all-windows')
             ? 'all platforms × all windows' : 'focused'
           status = `watcher launched (${scope}, ${watchRefresh}s) in a new window`