sigrank 0.12.5 → 0.13.0

package/README.md

@@ -67,7 +67,7 @@ sigrank
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.12.5
+⊙ SigRank CLI  v0.13.0
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board

package/cli.mjs

@@ -29,17 +29,25 @@ import { classify } from './cascade.mjs'
 import { ensureIdentity, keystorePath } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
 import { execFile } from 'child_process'
-import { existsSync, readFileSync, writeFileSync } from 'fs'
+import { existsSync, readFileSync } from 'fs'
 import os from 'os'
 import path from 'path'
+import { fileURLToPath } from 'url'
+
+// Resolve local node_modules/.bin for bundled deps (ccusage, tokscale)
+const _pkgRoot = path.dirname(fileURLToPath(import.meta.url))
+const _localBin = path.join(_pkgRoot, 'node_modules', '.bin')
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
 
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
 // defense-in-depth (shell injection prevention). execFile passes args as an
 // array, so no shell parsing occurs — even if platform contained special chars,
 // they'd be treated as literal arguments, not shell commands.
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -460,8 +468,28 @@ async function ccusagePillars(platform = 'claude') {
   }
 }
 
-function tokscalePillars(platform = 'claude') {
-  // Read tokscale_report.json — all-time only (no timestamps in export)
+async function tokscalePillars(platform = 'claude') {
+  // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
+  try {
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
+    const data = JSON.parse(raw)
+    const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
+    const rows = entries.filter(e =>
+      e && e.client === platform &&
+      e.model !== '<synthetic>' && e.model !== 'unknown' &&
+      ((Number(e.input) || 0) > 0 || (Number(e.output) || 0) > 0)
+    )
+    if (rows.length) {
+      const p = rows.reduce((acc, e) => ({
+        input:       acc.input       + (Number(e.input)      || 0),
+        output:      acc.output      + (Number(e.output)     || 0),
+        cacheCreate: acc.cacheCreate + (Number(e.cacheWrite) || 0),
+        cacheRead:   acc.cacheRead   + (Number(e.cacheRead)  || 0),
+      }), { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 })
+      return { all: p }
+    }
+  } catch { /* fall through to file-based read */ }
+  // Fallback: read saved tokscale_report.json — all-time only (no timestamps in export)
   const reportPath = path.join(os.homedir(), 'tokscale_report.json')
   if (!existsSync(reportPath)) return null
   try {
@@ -509,24 +537,34 @@ function appPillars() {
 async function tokenDashPillars() {
   const dbPath = path.join(os.homedir(), '.claude', 'token-dashboard.db')
   if (!existsSync(dbPath)) return null
+  // Read directly with sqlite3 — no python script needed (bundled dep).
+  // Windowed queries using sqlite3's datetime() function.
+  const cf = "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')"
   try {
-    const tmpScript = path.join(os.tmpdir(), 'sigrank_td_query.py')
-    writeFileSync(tmpScript, `
-import sqlite3, json, sys
-from datetime import datetime, timezone, timedelta
-db = sqlite3.connect(sys.argv[1])
-cf = "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')"
-out = {}
-for win, days in [('7d',7),('30d',30),('90d',90)]:
-    since = (datetime.now(timezone.utc) - timedelta(days=days)).isoformat()
-    r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE timestamp>=? AND {cf}",(since,)).fetchone()
-    out[win] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
-r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE {cf}").fetchone()
-out['all'] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
-print(json.dumps(out))
-`)
-    const raw = await execFileAsync('python3', [tmpScript, dbPath], 15000)
-    return JSON.parse(raw.trim())
+    const wins = [
+      ['7d',  "datetime('now','-7 days')"],
+      ['30d', "datetime('now','-30 days')"],
+      ['90d', "datetime('now','-90 days')"],
+    ]
+    const sql = (cutoff) =>
+      `SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE timestamp>=${cutoff} AND ${cf}`
+    const allSql = `SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE ${cf}`
+    const [d7, d30, d90, dAll] = await Promise.all([
+      execFileAsync('sqlite3', [dbPath, sql(wins[0][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, sql(wins[1][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, sql(wins[2][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, allSql], 5000),
+    ])
+    const parse = (raw) => {
+      const [i,o,cw,cr] = raw.trim().split('|').map(Number)
+      return { input: i||0, output: o||0, cacheCreate: cw||0, cacheRead: cr||0 }
+    }
+    return {
+      '7d': parse(d7),
+      '30d': parse(d30),
+      '90d': parse(d90),
+      all: parse(dAll),
+    }
   } catch {
     return null
   }
@@ -577,7 +615,7 @@ async function runCompare({ platform = 'claude' } = {}) {
     ccusagePillars(platform).catch(() => null),
     callTool('tokenpull', { platform }).catch(() => null),
     (platform === 'claude' ? tokenDashPillars() : Promise.resolve(null)).catch(() => null),
-    Promise.resolve(tokscalePillars(platform)),
+    tokscalePillars(platform).catch(() => null),
     Promise.resolve(platform === 'claude' ? appPillars() : null),
   ])
   write(CURSOR_UP(1) + ERASE_LINE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.12.5",
+  "version": "0.13.0",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,9 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@zhangferry-dev/tokendash": "^1.7.5",
+    "ccusage": "^20.0.14",
+    "tokscale": "^4.0.4"
   }
 }

package/tokenpull.mjs

@@ -18,20 +18,30 @@
 import { readdir, readFile, lstat } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
 import { execFile } from 'node:child_process'
-import { join } from 'node:path'
+import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
+import { fileURLToPath } from 'node:url'
 import { ADAPTERS } from './adapters.mjs'
 
 const DAY_MS = 86_400_000
 
+// Resolve the package root for finding bundled binaries (ccusage, tokscale, etc.)
+const _pkgRoot = join(dirname(fileURLToPath(import.meta.url)))
+const _localBin = join(_pkgRoot, 'node_modules', '.bin')
+// Prepend local node_modules/.bin to PATH so bundled deps are found even when
+// not globally installed (e.g., npx sigrank, local dev).
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
+
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync in the
 // fresh verifier readers. execSync blocks the entire Node event loop (no key handling,
 // no screen repaint for up to 90s during the tokendash scan). execFile is async: the
 // event loop keeps running, so the TUI stays responsive while external commands run.
 // Returns stdout as a string. Rejects on error or timeout (caller catches → null).
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// (ccusage, tokscale) are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -354,13 +364,9 @@ async function _freshCcusage(platform = 'claude') {
 async function _freshTokendash(platform = 'claude') {
   if (platform !== 'claude') return null
   const dbPath = join(homedir(), '.claude', 'token-dashboard.db')
-  const scanCli = join(homedir(), 'Desktop', 'token-dashboard', 'cli.py')
-  // Step 1 — refresh the db (best-effort; failures must not abort the read).
-  if (existsSync(scanCli)) {
-    try { await execFileAsync('python3', [scanCli, 'scan'], 90000) }
-    catch { /* continue: read whatever the db currently has */ }
-  }
-  // Step 2 — read the (now-refreshed) db. all-time only; the db doesn't expose windowing here.
+  // Read the token-dashboard DB directly with sqlite3 (no external python scan
+  // needed — the DB is created by the tokendash dashboard, now bundled as a dep).
+  // all-time only; the db doesn't expose windowing here.
   if (!existsSync(dbPath)) return null
   try {
     const raw = await execFileAsync('sqlite3', [dbPath,
@@ -372,8 +378,9 @@ async function _freshTokendash(platform = 'claude') {
   } catch { return null }
 }
 
-// tokscale: run `bunx tokscale@latest models --json` and sum the per-(client,model) rows for
-// the requested platform. The JSON shape (verified live) is:
+// tokscale: run `tokscale models --json` (bundled as npm dep — no bunx needed)
+// and sum the per-(client,model) rows for the requested platform. The JSON shape
+// (verified live) is:
 //   { entries: [ { client, model, input, output, cacheRead, cacheWrite, ... }, ... ], ... }
 // `client` maps directly to our platform name. Synthetic/unknown model rows are dropped (they
 // carry no real usage). all-time only — tokscale's models view is not windowed. If no row
@@ -383,7 +390,7 @@ async function _freshTokendash(platform = 'claude') {
 // Now uses execFile (async) so the TUI stays responsive.
 async function _freshTokscale(platform = 'claude') {
   try {
-    const raw = await execFileAsync('bunx', ['tokscale@latest', 'models', '--json'], 60000)
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
     const data = JSON.parse(raw)
     const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
     const rows = entries.filter((e) =>

package/tools.mjs

@@ -19,14 +19,22 @@ import { execFile } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// Resolve local node_modules/.bin for bundled deps (ccusage, tokscale)
+const _pkgRoot = path.dirname(fileURLToPath(import.meta.url))
+const _localBin = path.join(_pkgRoot, 'node_modules', '.bin')
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
 
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
 // defense-in-depth (shell injection prevention + non-blocking). The platform param
 // is enum-validated at the MCP schema level, but execFile also prevents shell
 // interpolation attacks by passing args as an array (no shell parsing).
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -82,7 +90,24 @@ async function _tokenDashPillars() {
   } catch { return null }
 }
 
-function _tokscalePillars(platform = 'claude') {
+async function _tokscalePillars(platform = 'claude') {
+  // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
+  try {
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
+    const data = JSON.parse(raw)
+    const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
+    const rows = entries.filter(e =>
+      e && e.client === platform && e.model !== '<synthetic>' && e.model !== 'unknown' && ((Number(e.input) || 0) > 0 || (Number(e.output) || 0) > 0)
+    )
+    if (rows.length) {
+      const acc = rows.reduce((a,e) => ({
+        input: a.input+(Number(e.input)||0), output: a.output+(Number(e.output)||0),
+        cacheCreate: a.cacheCreate+(Number(e.cacheWrite)||0), cacheRead: a.cacheRead+(Number(e.cacheRead)||0),
+      }), { input:0, output:0, cacheCreate:0, cacheRead:0 })
+      return { all: acc }
+    }
+  } catch { /* fall through to file-based read */ }
+  // Fallback: read saved tokscale_report.json if it exists
   const p = path.join(os.homedir(), 'tokscale_report.json')
   if (!existsSync(p)) return null
   try {
@@ -595,7 +620,7 @@ export async function callTool(name, args, opts = {}) {
       pullByPlatform(platform, opts).catch(() => null),
       _ccusagePillars(platform).catch(() => null),
       (platform === 'claude' ? _tokenDashPillars() : Promise.resolve(null)).catch(() => null),
-      Promise.resolve(_tokscalePillars(platform)),
+      _tokscalePillars(platform).catch(() => null),
     ])
 
     // Build tokenpull window lookup