sigrank 0.12.5 → 0.13.1

package/README.md

@@ -1,16 +1,6 @@
 <div align="center">
 
-```
- ███████ ██  ██████  ██████   █████  ███    ██ ██   ██
- ██      ██ ██       ██   ██ ██   ██ ████   ██ ██  ██
- ███████ ██ ██   ███ ██████  ███████ ██ ██  ██ █████
-      ██ ██ ██    ██ ██   ██ ██   ██ ██  ██ ██ ██  ██
- ███████ ██  ██████  ██   ██ ██   ██ ██   ████ ██   ██
-```
-
-◈ ─────────────────────────────────────────── ◈
-
-# SigRank MCP
+<p><img src="./.github/assets/og-card.png" alt="SigRank — the new standard in AI evaluation &amp; benchmarks" width="800"></p>
 
 **The yield cascade + live leaderboard as MCP tools any agent can call.**
 
@@ -25,21 +15,35 @@ For all builders, burners and 10xers.
 
 </div>
 
----
+| The board | Your operator profile |
+|:---:|:---:|
+| [![SigRank leaderboard](./.github/assets/board.png)](https://signalaf.com/board/all) | [![SigRank operator profile](./.github/assets/profile.png)](https://signalaf.com) |
+| Every operator ranked by **Υ Yield** — the architecture of the cascade, not raw spend | Cascade layer, class, and fingerprint — derived from four token counts |
 
-Token-only. No auth. No transcript content. Privacy-preserving by design.
+> **Run [`sigrank enroll`](#sign-in--submit) then [`sigrank submit`](#sign-in--submit) to get ranked and claim your public profile at [signalaf.com](https://signalaf.com).**
 
-Dual-mode package: **interactive CLI dashboard** for operators, **MCP stdio server** for AI clients.
+---
+
+## Quickstart — 3 steps to the board
 
 ```bash
+# 1. Install (pulls ccusage + tokscale + tokendash automatically — no separate installs)
 npm install -g sigrank
-sigrank          # launches the full tabbed TUI (TTY detected automatically)
+
+# 2. Sign in (paste a connect code from signalaf.com → Settings → New key)
+sigrank enroll
+
+# 3. Submit your cascade to the board
+sigrank submit
 ```
 
-Or one-shot without installing:
+That's it. The agent reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — only the four token counts leave your machine.
+
+Or just explore without signing in:
 
 ```bash
-npx sigrank board --once
+sigrank          # launches the full tabbed TUI (dashboard, compare, board, watch)
+npx sigrank board --once    # print the live leaderboard once
 ```
 
 ## Install from GitHub
@@ -67,7 +71,7 @@ sigrank
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.12.5
+⊙ SigRank CLI  v0.13.0
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board
@@ -202,9 +206,9 @@ The dashboard pulls from multiple sources and shows them side-by-side for verifi
 | Source | What | Platform |
 |---|---|---|
 | `tokenpull` | On-device JSONL scanner (canon source) | claude, codex, amp, … |
-| `ccusage` | `ccusage <platform> daily --json` CLI | claude, codex |
-| `token-dashboard` | `~/.claude/token-dashboard.db` SQLite | claude only |
-| `tokscale` | `~/tokscale_report.json` export | claude, codex |
+| `ccusage` | `ccusage <platform> daily --json` CLI (bundled) | claude, codex |
+| `token-dashboard` | `~/.claude/token-dashboard.db` SQLite (bundled) | claude only |
+| `tokscale` | `tokscale models --json` CLI (bundled, falls back to `~/tokscale_report.json`) | claude, codex |
 
 **Codex input is estimated** — Codex logs don't expose true input tokens directly. The formula:
 ```

package/banner.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="800" height="200" viewBox="0 0 800 200">
+  <rect width="800" height="200" rx="12" fill="#0a0805"/>
+  <rect x="0" y="0" width="800" height="3" rx="12" fill="#c4923a"/>
+  <text x="60" y="110" font-family="Georgia, serif" font-size="56" font-weight="700" fill="#e8b955">§ SigRank</text>
+  <text x="60" y="150" font-family="Helvetica, Arial, sans-serif" font-size="18" fill="#a89a7a">The AI operator leaderboard</text>
+  <text x="60" y="178" font-family="Helvetica, Arial, sans-serif" font-size="14" fill="#6b6354">signalaf.com</text>
+</svg>

package/cli.mjs

@@ -29,17 +29,25 @@ import { classify } from './cascade.mjs'
 import { ensureIdentity, keystorePath } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
 import { execFile } from 'child_process'
-import { existsSync, readFileSync, writeFileSync } from 'fs'
+import { existsSync, readFileSync } from 'fs'
 import os from 'os'
 import path from 'path'
+import { fileURLToPath } from 'url'
+
+// Resolve local node_modules/.bin for bundled deps (ccusage, tokscale)
+const _pkgRoot = path.dirname(fileURLToPath(import.meta.url))
+const _localBin = path.join(_pkgRoot, 'node_modules', '.bin')
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
 
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
 // defense-in-depth (shell injection prevention). execFile passes args as an
 // array, so no shell parsing occurs — even if platform contained special chars,
 // they'd be treated as literal arguments, not shell commands.
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -460,8 +468,28 @@ async function ccusagePillars(platform = 'claude') {
   }
 }
 
-function tokscalePillars(platform = 'claude') {
-  // Read tokscale_report.json — all-time only (no timestamps in export)
+async function tokscalePillars(platform = 'claude') {
+  // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
+  try {
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
+    const data = JSON.parse(raw)
+    const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
+    const rows = entries.filter(e =>
+      e && e.client === platform &&
+      e.model !== '<synthetic>' && e.model !== 'unknown' &&
+      ((Number(e.input) || 0) > 0 || (Number(e.output) || 0) > 0)
+    )
+    if (rows.length) {
+      const p = rows.reduce((acc, e) => ({
+        input:       acc.input       + (Number(e.input)      || 0),
+        output:      acc.output      + (Number(e.output)     || 0),
+        cacheCreate: acc.cacheCreate + (Number(e.cacheWrite) || 0),
+        cacheRead:   acc.cacheRead   + (Number(e.cacheRead)  || 0),
+      }), { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 })
+      return { all: p }
+    }
+  } catch { /* fall through to file-based read */ }
+  // Fallback: read saved tokscale_report.json — all-time only (no timestamps in export)
   const reportPath = path.join(os.homedir(), 'tokscale_report.json')
   if (!existsSync(reportPath)) return null
   try {
@@ -509,24 +537,34 @@ function appPillars() {
 async function tokenDashPillars() {
   const dbPath = path.join(os.homedir(), '.claude', 'token-dashboard.db')
   if (!existsSync(dbPath)) return null
+  // Read directly with sqlite3 — no python script needed (bundled dep).
+  // Windowed queries using sqlite3's datetime() function.
+  const cf = "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')"
   try {
-    const tmpScript = path.join(os.tmpdir(), 'sigrank_td_query.py')
-    writeFileSync(tmpScript, `
-import sqlite3, json, sys
-from datetime import datetime, timezone, timedelta
-db = sqlite3.connect(sys.argv[1])
-cf = "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')"
-out = {}
-for win, days in [('7d',7),('30d',30),('90d',90)]:
-    since = (datetime.now(timezone.utc) - timedelta(days=days)).isoformat()
-    r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE timestamp>=? AND {cf}",(since,)).fetchone()
-    out[win] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
-r = db.execute(f"SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE {cf}").fetchone()
-out['all'] = {'input':r[0] or 0,'output':r[1] or 0,'cacheCreate':r[2] or 0,'cacheRead':r[3] or 0}
-print(json.dumps(out))
-`)
-    const raw = await execFileAsync('python3', [tmpScript, dbPath], 15000)
-    return JSON.parse(raw.trim())
+    const wins = [
+      ['7d',  "datetime('now','-7 days')"],
+      ['30d', "datetime('now','-30 days')"],
+      ['90d', "datetime('now','-90 days')"],
+    ]
+    const sql = (cutoff) =>
+      `SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE timestamp>=${cutoff} AND ${cf}`
+    const allSql = `SELECT SUM(input_tokens),SUM(output_tokens),SUM(cache_create_5m_tokens+cache_create_1h_tokens),SUM(cache_read_tokens) FROM messages WHERE ${cf}`
+    const [d7, d30, d90, dAll] = await Promise.all([
+      execFileAsync('sqlite3', [dbPath, sql(wins[0][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, sql(wins[1][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, sql(wins[2][1])], 5000),
+      execFileAsync('sqlite3', [dbPath, allSql], 5000),
+    ])
+    const parse = (raw) => {
+      const [i,o,cw,cr] = raw.trim().split('|').map(Number)
+      return { input: i||0, output: o||0, cacheCreate: cw||0, cacheRead: cr||0 }
+    }
+    return {
+      '7d': parse(d7),
+      '30d': parse(d30),
+      '90d': parse(d90),
+      all: parse(dAll),
+    }
   } catch {
     return null
   }
@@ -577,7 +615,7 @@ async function runCompare({ platform = 'claude' } = {}) {
     ccusagePillars(platform).catch(() => null),
     callTool('tokenpull', { platform }).catch(() => null),
     (platform === 'claude' ? tokenDashPillars() : Promise.resolve(null)).catch(() => null),
-    Promise.resolve(tokscalePillars(platform)),
+    tokscalePillars(platform).catch(() => null),
     Promise.resolve(platform === 'claude' ? appPillars() : null),
   ])
   write(CURSOR_UP(1) + ERASE_LINE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.12.5",
+  "version": "0.13.1",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "type": "module",
   "license": "MIT",
@@ -37,10 +37,31 @@
     "keystore.mjs",
     "submit.mjs",
     "connect.mjs",
+    "banner.svg",
     "README.md",
     "LICENSE"
   ],
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "ai-agents",
+    "claude",
+    "anthropic",
+    "llm",
+    "token-telemetry",
+    "token-usage",
+    "leaderboard",
+    "cli",
+    "tui",
+    "yield-cascade",
+    "sigrank",
+    "agent-tools",
+    "on-device"
+  ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@zhangferry-dev/tokendash": "^1.7.5",
+    "ccusage": "^20.0.14",
+    "tokscale": "^4.0.4"
   }
 }

package/tokenpull.mjs

@@ -18,20 +18,30 @@
 import { readdir, readFile, lstat } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
 import { execFile } from 'node:child_process'
-import { join } from 'node:path'
+import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
+import { fileURLToPath } from 'node:url'
 import { ADAPTERS } from './adapters.mjs'
 
 const DAY_MS = 86_400_000
 
+// Resolve the package root for finding bundled binaries (ccusage, tokscale, etc.)
+const _pkgRoot = join(dirname(fileURLToPath(import.meta.url)))
+const _localBin = join(_pkgRoot, 'node_modules', '.bin')
+// Prepend local node_modules/.bin to PATH so bundled deps are found even when
+// not globally installed (e.g., npx sigrank, local dev).
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
+
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync in the
 // fresh verifier readers. execSync blocks the entire Node event loop (no key handling,
 // no screen repaint for up to 90s during the tokendash scan). execFile is async: the
 // event loop keeps running, so the TUI stays responsive while external commands run.
 // Returns stdout as a string. Rejects on error or timeout (caller catches → null).
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// (ccusage, tokscale) are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -354,13 +364,9 @@ async function _freshCcusage(platform = 'claude') {
 async function _freshTokendash(platform = 'claude') {
   if (platform !== 'claude') return null
   const dbPath = join(homedir(), '.claude', 'token-dashboard.db')
-  const scanCli = join(homedir(), 'Desktop', 'token-dashboard', 'cli.py')
-  // Step 1 — refresh the db (best-effort; failures must not abort the read).
-  if (existsSync(scanCli)) {
-    try { await execFileAsync('python3', [scanCli, 'scan'], 90000) }
-    catch { /* continue: read whatever the db currently has */ }
-  }
-  // Step 2 — read the (now-refreshed) db. all-time only; the db doesn't expose windowing here.
+  // Read the token-dashboard DB directly with sqlite3 (no external python scan
+  // needed — the DB is created by the tokendash dashboard, now bundled as a dep).
+  // all-time only; the db doesn't expose windowing here.
   if (!existsSync(dbPath)) return null
   try {
     const raw = await execFileAsync('sqlite3', [dbPath,
@@ -372,8 +378,9 @@ async function _freshTokendash(platform = 'claude') {
   } catch { return null }
 }
 
-// tokscale: run `bunx tokscale@latest models --json` and sum the per-(client,model) rows for
-// the requested platform. The JSON shape (verified live) is:
+// tokscale: run `tokscale models --json` (bundled as npm dep — no bunx needed)
+// and sum the per-(client,model) rows for the requested platform. The JSON shape
+// (verified live) is:
 //   { entries: [ { client, model, input, output, cacheRead, cacheWrite, ... }, ... ], ... }
 // `client` maps directly to our platform name. Synthetic/unknown model rows are dropped (they
 // carry no real usage). all-time only — tokscale's models view is not windowed. If no row
@@ -383,7 +390,7 @@ async function _freshTokendash(platform = 'claude') {
 // Now uses execFile (async) so the TUI stays responsive.
 async function _freshTokscale(platform = 'claude') {
   try {
-    const raw = await execFileAsync('bunx', ['tokscale@latest', 'models', '--json'], 60000)
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
     const data = JSON.parse(raw)
     const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
     const rows = entries.filter((e) =>

package/tools.mjs

@@ -19,14 +19,22 @@ import { execFile } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// Resolve local node_modules/.bin for bundled deps (ccusage, tokscale)
+const _pkgRoot = path.dirname(fileURLToPath(import.meta.url))
+const _localBin = path.join(_pkgRoot, 'node_modules', '.bin')
+const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
 
 // ASYNC FIX (2026-06-27): execFile wrapped in a Promise — replaces execSync for
 // defense-in-depth (shell injection prevention + non-blocking). The platform param
 // is enum-validated at the MCP schema level, but execFile also prevents shell
 // interpolation attacks by passing args as an array (no shell parsing).
+// BIN FIX (2026-06-27): PATH includes local node_modules/.bin so bundled deps
+// are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -82,7 +90,24 @@ async function _tokenDashPillars() {
   } catch { return null }
 }
 
-function _tokscalePillars(platform = 'claude') {
+async function _tokscalePillars(platform = 'claude') {
+  // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
+  try {
+    const raw = await execFileAsync('tokscale', ['models', '--json'], 60000)
+    const data = JSON.parse(raw)
+    const entries = Array.isArray(data?.entries) ? data.entries : (Array.isArray(data) ? data : [])
+    const rows = entries.filter(e =>
+      e && e.client === platform && e.model !== '<synthetic>' && e.model !== 'unknown' && ((Number(e.input) || 0) > 0 || (Number(e.output) || 0) > 0)
+    )
+    if (rows.length) {
+      const acc = rows.reduce((a,e) => ({
+        input: a.input+(Number(e.input)||0), output: a.output+(Number(e.output)||0),
+        cacheCreate: a.cacheCreate+(Number(e.cacheWrite)||0), cacheRead: a.cacheRead+(Number(e.cacheRead)||0),
+      }), { input:0, output:0, cacheCreate:0, cacheRead:0 })
+      return { all: acc }
+    }
+  } catch { /* fall through to file-based read */ }
+  // Fallback: read saved tokscale_report.json if it exists
   const p = path.join(os.homedir(), 'tokscale_report.json')
   if (!existsSync(p)) return null
   try {
@@ -595,7 +620,7 @@ export async function callTool(name, args, opts = {}) {
       pullByPlatform(platform, opts).catch(() => null),
       _ccusagePillars(platform).catch(() => null),
       (platform === 'claude' ? _tokenDashPillars() : Promise.resolve(null)).catch(() => null),
-      Promise.resolve(_tokscalePillars(platform)),
+      _tokscalePillars(platform).catch(() => null),
     ])
 
     // Build tokenpull window lookup