sigrank 0.12.4 → 0.13.0

package/README.md

@@ -67,7 +67,7 @@ sigrank
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.12.3
+⊙ SigRank CLI  v0.13.0
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board

package/cli.mjs

@@ -28,10 +28,31 @@ import { callTool, DEFAULT_API_BASE } from './tools.mjs'
 import { classify } from './cascade.mjs'
 import { ensureIdentity, keystorePath } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
-import { execSync } from 'child_process'
-import { existsSync, readFileSync, writeFileSync } from 'fs'
+import { execFile } from 'child_process'
+import { existsSync, readFileSync } from 'fs'
 import os from 'os'
 import path from 'path'
+import { fileURLToPath } from 'url'
+
+// Resolve local node_modules/.bin for bundled deps (ccusage, tokscale)
+const _pkgRoot = path.dirname(fileURLToPath(import.meta.url))
+const _localBin = path.join(_pkgRoot, 'node_modules', '.bin')
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
+
+// ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
+// defense-in-depth (shell injection prevention). execFile passes args as an
+// array, so no shell parsing occurs — even if platform contained special chars,
+// they'd be treated as literal arguments, not shell commands.
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// are found even when sigrank isn't globally installed.
+function execFileAsync(cmd, args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
+      if (err) reject(err)
+      else resolve(stdout.toString())
+    })
+  })
+}
 
 // ── ANSI helpers (no chalk dep) ────────────────────────────────────────────
 const ESC = '\x1b['
@@ -407,11 +428,10 @@ async function runMe({ platform = 'claude', compare = false } = {}) {
 // identical to _freshCcusage and could be consolidated in a future pass if compare
 // switches to live data — but that's a behavior change, not a refactor.
 
-function ccusagePillars(platform = 'claude') {
+async function ccusagePillars(platform = 'claude') {
   // ccusage <platform> daily --json → sum by window
   try {
-    const cmd = platform === 'claude' ? 'ccusage claude daily --json' : `ccusage ${platform} daily --json`
-    const raw = execSync(cmd, { timeout: 15000, stdio: ['ignore', 'pipe', 'ignore'] }).toString()
+    const raw = await execFileAsync('ccusage', [platform, 'daily', '--json'], 15000)
     const data = JSON.parse(raw)
     const rows = data.daily ?? data // ccusage may return {daily:[...]} or [...]
 
@@ -448,8 +468,28 @@ function ccusagePillars(platform = 'claude') {
   }
 }
 
-function tokscalePillars(platform = 'claude') {
-  // Read tokscale_report.json — all-time only (no timestamps in export)
+async function tokscalePillars(platform = 'claude') {
+  // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
+  try {
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
+    const data = JSON.parse(raw)
+    const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
+    const rows = entries.filter(e =>
+      e && e.client === platform &&
+      e.model !== '<synthetic>' && e.model !== 'unknown' &&
+      ((Number(e.input) || 0) > 0 || (Number(e.output) || 0) > 0)
+    )
+    if (rows.length) {
+      const p = rows.reduce((acc, e) => ({
+        input:       acc.input       + (Number(e.input)      || 0),
+        output:      acc.output      + (Number(e.output)     || 0),
+        cacheCreate: acc.cacheCreate + (Number(e.cacheWrite) || 0),
+        cacheRead:   acc.cacheRead   + (Number(e.cacheRead)  || 0),
+      }), { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 })
+      return { all: p }
+    }
+  } catch { /* fall through to file-based read */ }
+  // Fallback: read saved tokscale_report.json — all-time only (no timestamps in export)
   const reportPath = path.join(os.homedir(), 'tokscale_report.json')
   if (!existsSync(reportPath)) return null
   try {
@@ -494,28 +534,37 @@ function appPillars() {
   }
 }
 
-function tokenDashPillars() {
+async function tokenDashPillars() {
   const dbPath = path.join(os.homedir(), '.claude', 'token-dashboard.db')
   if (!existsSync(dbPath)) return null
+  // Read directly with sqlite3 — no python script needed (bundled dep).
+  // Windowed queries using sqlite3's datetime() function.
+  const cf = "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')"
   try {
-    const tmpScript = path.join(os.tmpdir(), 'sigrank_td_query.py')
-    writeFileSync(tmpScript, `
-import sqlite3, json, sys
-from datetime import datetime, timezone, timedelta
-db = sqlite3.connect(sys.argv[1])
-cf = "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')"
-out = {}
-for win, days in [('7d',7),('30d',30),('90d',90)]:
-    since = (datetime.now(timezone.utc) - timedelta(days=days)).isoformat()
-    r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE timestamp>=? AND {cf}",(since,)).fetchone()
-    out[win] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
-r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE {cf}").fetchone()
-out['all'] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
-print(json.dumps(out))
-`)
-    const raw = execSync(`python3 "${tmpScript}" "${dbPath}"`,
-      { timeout: 15000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim()
-    return JSON.parse(raw)
+    const wins = [
+      ['7d',  "datetime('now','-7 days')"],
+      ['30d', "datetime('now','-30 days')"],
+      ['90d', "datetime('now','-90 days')"],
+    ]
+    const sql = (cutoff) =>
+      `SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE timestamp>=${cutoff} AND ${cf}`
+    const allSql = `SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE ${cf}`
+    const [d7, d30, d90, dAll] = await Promise.all([
+      execFileAsync('sqlite3', [dbPath, sql(wins[0][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, sql(wins[1][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, sql(wins[2][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, allSql], 5000),
+    ])
+    const parse = (raw) => {
+      const [i,o,cw,cr] = raw.trim().split('|').map(Number)
+      return { input: i||0, output: o||0, cacheCreate: cw||0, cacheRead: cr||0 }
+    }
+    return {
+      '7d': parse(d7),
+      '30d': parse(d30),
+      '90d': parse(d90),
+      all: parse(dAll),
+    }
   } catch {
     return null
   }
@@ -560,13 +609,13 @@ function cascadeFromPillars(p) {
 async function runCompare({ platform = 'claude' } = {}) {
   write(HIDE_CURSOR)
 
-  // Pull all five sources in parallel
+  // Pull all five sources in parallel (verifiers now async via execFile)
   writeln(`  ${dim('reading all 5 sources…')}`)
   const [ccPillars, tpData, tdPillars, tsPillars, apPillars] = await Promise.all([
-    Promise.resolve(ccusagePillars(platform)),
+    ccusagePillars(platform).catch(() => null),
     callTool('tokenpull', { platform }).catch(() => null),
-    Promise.resolve(platform === 'claude' ? tokenDashPillars() : null),
-    Promise.resolve(tokscalePillars(platform)),
+    (platform === 'claude' ? tokenDashPillars() : Promise.resolve(null)).catch(() => null),
+    tokscalePillars(platform).catch(() => null),
     Promise.resolve(platform === 'claude' ? appPillars() : null),
   ])
   write(CURSOR_UP(1) + ERASE_LINE)
@@ -1154,8 +1203,8 @@ async function runSigRank() {
         if (k === 'q' || key === '\u0003') { // q or ctrl+c
           resolve()
         } else if (k === 'b') {
-          const { execSync: es } = await import('child_process')
-          try { es('open https://signalaf.com', { stdio: 'ignore' }) } catch { }
+          // ASYNC FIX (2026-06-27): execFile instead of dynamic execSync import
+          execFile('open', ['https://signalaf.com'], { stdio: 'ignore' }, () => {})
           resolve()
         } else if (k === 's') {
           const id = ensureIdentity()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.12.4",
+  "version": "0.13.0",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,9 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@zhangferry-dev/tokendash": "^1.7.5",
+    "ccusage": "^20.0.14",
+    "tokscale": "^4.0.4"
   }
 }

package/tokenpull.mjs

@@ -17,21 +17,31 @@
 
 import { readdir, readFile, lstat } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
-import { execSync, execFile } from 'node:child_process'
-import { join } from 'node:path'
+import { execFile } from 'node:child_process'
+import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
+import { fileURLToPath } from 'node:url'
 import { ADAPTERS } from './adapters.mjs'
 
 const DAY_MS = 86_400_000
 
+// Resolve the package root for finding bundled binaries (ccusage, tokscale, etc.)
+const _pkgRoot = join(dirname(fileURLToPath(import.meta.url)))
+const _localBin = join(_pkgRoot, 'node_modules', '.bin')
+// Prepend local node_modules/.bin to PATH so bundled deps are found even when
+// not globally installed (e.g., npx sigrank, local dev).
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
+
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync in the
 // fresh verifier readers. execSync blocks the entire Node event loop (no key handling,
 // no screen repaint for up to 90s during the tokendash scan). execFile is async: the
 // event loop keeps running, so the TUI stays responsive while external commands run.
 // Returns stdout as a string. Rejects on error or timeout (caller catches → null).
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// (ccusage, tokscale) are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -354,13 +364,9 @@ async function _freshCcusage(platform = 'claude') {
 async function _freshTokendash(platform = 'claude') {
   if (platform !== 'claude') return null
   const dbPath = join(homedir(), '.claude', 'token-dashboard.db')
-  const scanCli = join(homedir(), 'Desktop', 'token-dashboard', 'cli.py')
-  // Step 1 — refresh the db (best-effort; failures must not abort the read).
-  if (existsSync(scanCli)) {
-    try { await execFileAsync('python3', [scanCli, 'scan'], 90000) }
-    catch { /* continue: read whatever the db currently has */ }
-  }
-  // Step 2 — read the (now-refreshed) db. all-time only; the db doesn't expose windowing here.
+  // Read the token-dashboard DB directly with sqlite3 (no external python scan
+  // needed — the DB is created by the tokendash dashboard, now bundled as a dep).
+  // all-time only; the db doesn't expose windowing here.
   if (!existsSync(dbPath)) return null
   try {
     const raw = await execFileAsync('sqlite3', [dbPath,
@@ -372,8 +378,9 @@ async function _freshTokendash(platform = 'claude') {
   } catch { return null }
 }
 
-// tokscale: run `bunx tokscale@latest models --json` and sum the per-(client,model) rows for
-// the requested platform. The JSON shape (verified live) is:
+// tokscale: run `tokscale models --json` (bundled as npm dep — no bunx needed)
+// and sum the per-(client,model) rows for the requested platform. The JSON shape
+// (verified live) is:
 //   { entries: [ { client, model, input, output, cacheRead, cacheWrite, ... }, ... ], ... }
 // `client` maps directly to our platform name. Synthetic/unknown model rows are dropped (they
 // carry no real usage). all-time only — tokscale's models view is not windowed. If no row
@@ -383,7 +390,7 @@ async function _freshTokendash(platform = 'claude') {
 // Now uses execFile (async) so the TUI stays responsive.
 async function _freshTokscale(platform = 'claude') {
   try {
-    const raw = await execFileAsync('bunx', ['tokscale@latest', 'models', '--json'], 60000)
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
     const data = JSON.parse(raw)
     const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
     const rows = entries.filter((e) =>

package/tools.mjs

@@ -15,10 +15,31 @@ import { ALL_PLATFORMS } from './adapters.mjs'
 import { ensureIdentity, recordEnrollment } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
 import { createHash } from 'node:crypto'
-import { execSync } from 'node:child_process'
+import { execFile } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// Resolve local node_modules/.bin for bundled deps (ccusage, tokscale)
+const _pkgRoot = path.dirname(fileURLToPath(import.meta.url))
+const _localBin = path.join(_pkgRoot, 'node_modules', '.bin')
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
+
+// ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
+// defense-in-depth (shell injection prevention + non-blocking). The platform param
+// is enum-validated at the MCP schema level, but execFile also prevents shell
+// interpolation attacks by passing args as an array (no shell parsing).
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// are found even when sigrank isn't globally installed.
+function execFileAsync(cmd, args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
+      if (err) reject(err)
+      else resolve(stdout.toString())
+    })
+  })
+}
 
 // ── Verifier readers (sync, on-device, token-only) ────────────────────────────
 // These mirror the implementations in cli.mjs / tui.mjs without the circular import.
@@ -29,9 +50,9 @@ import path from 'node:path'
 // (bunx tokscale, scan+read tokendash) for the TUI/CLI dashboard. Different data sources =
 // different behavior; do NOT merge without understanding the trade-off.
 
-function _ccusagePillars(platform = 'claude') {
+async function _ccusagePillars(platform = 'claude') {
   try {
-    const raw = execSync(`ccusage ${platform} daily --json`, { timeout: 15000, stdio: ['ignore','pipe','ignore'] }).toString()
+    const raw = await execFileAsync('ccusage', [platform, 'daily', '--json'], 15000)
     const rows = JSON.parse(raw)?.daily ?? JSON.parse(raw)
     const now = Date.now()
     const result = {}
@@ -57,20 +78,36 @@ function _ccusagePillars(platform = 'claude') {
   } catch { return null }
 }
 
-function _tokenDashPillars() {
+async function _tokenDashPillars() {
   const dbPath = path.join(os.homedir(), '.claude', 'token-dashboard.db')
   if (!existsSync(dbPath)) return null
   try {
-    const raw = execSync(
-      `sqlite3 "${dbPath}" "SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens)+SUM(cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages"`,
-      { timeout: 5000, stdio: ['ignore','pipe','ignore'] }
-    ).toString().trim()
-    const [i,o,cw,cr] = raw.split('|').map(Number)
+    const raw = await execFileAsync('sqlite3', [dbPath,
+      'SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens)+SUM(cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages'
+    ], 5000)
+    const [i,o,cw,cr] = raw.trim().split('|').map(Number)
     return { all: { input: i||0, output: o||0, cacheCreate: cw||0, cacheRead: cr||0 } }
   } catch { return null }
 }
 
-function _tokscalePillars(platform = 'claude') {
+async function _tokscalePillars(platform = 'claude') {
+  // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
+  try {
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
+    const data = JSON.parse(raw)
+    const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
+    const rows = entries.filter(e =>
+      e && e.client === platform && e.model !== '<synthetic>' && e.model !== 'unknown' && ((Number(e.input) || 0) > 0 || (Number(e.output) || 0) > 0)
+    )
+    if (rows.length) {
+      const acc = rows.reduce((a,e) => ({
+        input: a.input+(Number(e.input)||0), output: a.output+(Number(e.output)||0),
+        cacheCreate: a.cacheCreate+(Number(e.cacheWrite)||0), cacheRead: a.cacheRead+(Number(e.cacheRead)||0),
+      }), { input:0, output:0, cacheCreate:0, cacheRead:0 })
+      return { all: acc }
+    }
+  } catch { /* fall through to file-based read */ }
+  // Fallback: read saved tokscale_report.json if it exists
   const p = path.join(os.homedir(), 'tokscale_report.json')
   if (!existsSync(p)) return null
   try {
@@ -578,12 +615,12 @@ export async function callTool(name, args, opts = {}) {
     const platform = args?.platform || 'claude'
     const WINS = ['7d', '30d', '90d', 'all']
 
-    // Pull all four sources in parallel (verifiers are sync, wrap in Promise.resolve)
+    // Pull all four sources in parallel (verifiers are now async via execFile)
     const [tpResult, ccPillars, tdPillars, tsPillars] = await Promise.all([
       pullByPlatform(platform, opts).catch(() => null),
-      Promise.resolve(_ccusagePillars(platform)),
-      Promise.resolve(platform === 'claude' ? _tokenDashPillars() : null),
-      Promise.resolve(_tokscalePillars(platform)),
+      _ccusagePillars(platform).catch(() => null),
+      (platform === 'claude' ? _tokenDashPillars() : Promise.resolve(null)).catch(() => null),
+      _tokscalePillars(platform).catch(() => null),
     ])
 
     // Build tokenpull window lookup

package/tui.mjs

@@ -16,7 +16,7 @@ import { callTool, DEFAULT_API_BASE } from './tools.mjs'
 import { freshVerifierPillars } from './tokenpull.mjs'
 import { isSignedIn, isCodeChar } from './connect.mjs'
 import { loadIdentity, clearIdentity } from './keystore.mjs'
-import { execSync } from 'child_process'
+import { execFile } from 'child_process'
 import { existsSync, readFileSync } from 'fs'
 import os from 'os'
 import path from 'path'
@@ -1758,7 +1758,9 @@ export async function runTui({ platform: initPlatform = 'claude', window: win =
           if (watchPlatform && watchPlatform !== 'all') watchCmd += ` --platform ${watchPlatform}`
           if (watchWindow && watchWindow !== 'all-windows') watchCmd += ` --window ${watchWindow}`
           watchCmd += ` --refresh ${watchRefresh}`
-          execSync(`osascript -e 'tell application "Terminal" to do script "${watchCmd}"'`, { stdio: 'ignore' })
+          // ASYNC FIX (2026-06-27): execFile instead of execSync — no shell
+          // interpolation. osascript args passed as array (defense-in-depth).
+          execFile('osascript', ['-e', `tell application "Terminal" to do script "${watchCmd}"`], { stdio: 'ignore' }, () => {})
           const scope = (!watchPlatform || watchPlatform === 'all') && (!watchWindow || watchWindow === 'all-windows')
             ? 'all platforms × all windows' : 'focused'
           status = `watcher launched (${scope}, ${watchRefresh}s) in a new window`