sigrank 0.13.1 → 0.14.3

package/README.md

@@ -35,9 +35,12 @@ sigrank enroll
 
 # 3. Submit your cascade to the board
 sigrank submit
+
+# (cautious? see exactly what would be sent — four counts + a signature — sending nothing)
+sigrank submit --dry-run
 ```
 
-That's it. The agent reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — only the four token counts leave your machine.
+That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — only the four token counts leave your machine.
 
 Or just explore without signing in:
 
@@ -71,7 +74,7 @@ sigrank
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.13.0
+⊙ SigRank CLI  v0.14.2
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board
@@ -82,8 +85,6 @@ Commands
   board                    live leaderboard (refreshes every 30s)
   board --window 7d        board for a specific window (7d, 30d, 90d, all)
   board --once             print once and exit
-  me                       single-platform cascade (claude by default)
-  me --platform codex      use a different platform adapter
   compare                  raw pillar audit: tokenpull vs ccusage vs token-dash vs tokscale
   compare --platform codex compare for a specific platform
   tui                      full tabbed TUI: Dashboard / Trends / Compare / Board / Watch / Connect
@@ -107,7 +108,6 @@ Examples
   sigrank board                  # live leaderboard
   sigrank compare                # pillar audit (claude)
   sigrank compare --platform codex
-  sigrank me --platform codex
   sigrank watch --window 7d --refresh 60
   sigrank board --window all --once
 ```
@@ -136,6 +136,7 @@ Six tabs. Keys: `1`-`6` or `←` `→` to switch · `R` refresh · `Q` quit.
 ```bash
 sigrank enroll          # sign in: paste a connect code (get one at signalaf.com → Settings)
 sigrank submit          # publish your verified runs to the board (sign in first)
+sigrank submit --dry-run  # inspect the exact signed payload without sending anything
 ```
 
 Or do it inside the TUI on the **Connect** tab (`6`), then press `[S]` to submit.
@@ -180,7 +181,9 @@ Or if installed globally:
 | `tokenpull_submit(codename, window?)` | `{codename?, window?}` | `tokenpull` → publish to board. Omit codename for preview |
 | `tokenpull_compare(platform?)` | `{platform?}` | All four sources side-by-side: tokenpull + ccusage + token-dash + tokscale. Returns pillars, cascade metrics, and delta % vs tokenpull per window |
 | `rank_windows` | `{platform?, window?}` | Multi-window cascade from local logs |
-| `watch_tokenpull` | `{platform?, interval_s?}` | Streaming cascade snapshots |
+| `watch_tokenpull` | `{platform?, interval_s?}` | One cascade snapshot per call (interval_s advisory) |
+| `submit_verified` | `{window?, platform?, dry_run?}` | THE ranked path: builds + ed25519-signs Schema 1.0 snapshots and POSTs them. `platform:'multi'` sums all active platforms. `dry_run:true` returns the exact payload unsent |
+| `enroll` | `{code, device_label?}` | Bind this device with a connect code from signalaf.com → Settings |
 
 ---
 
@@ -253,7 +256,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 - **Token-only, always.** No message content is ever read, logged, or transmitted — only token counts (`input`, `output`, `cache_creation`, `cache_read`), message IDs, and timestamps.
 - **Local by default.** `tokenpull` reads only `~/.claude/projects` (Claude) or `~/.codex` (Codex) on your device. Numbers stay on your machine unless you explicitly submit with a codename.
 - **Background tooling excluded.** Memory plugins, observers, summarizers (e.g. `claude-mem`, `mem0`, `observer-sessions`) are filtered from both Claude and Codex reads. `subagents/` are kept — they represent real operator work.
-- **No auth required.** All board reads and the submit path are anonymous.
+- **Board reads are anonymous.** No account needed to browse, compare, or watch.
+- **Ranked submissions are signed, not trusted.** `sigrank submit` requires a one-time `enroll` (device-bound ed25519 key — the private key never leaves your machine). Verify what's sent with `sigrank submit --dry-run`: the payload is four token counts, ratios, and a signature.
 
 ---
 
@@ -291,7 +295,7 @@ Tests verify (29 assertions):
 | File | Responsibility |
 |---|---|
 | `index.mjs` | Entry point — TTY detection, routes to CLI or MCP server |
-| `cli.mjs` | CLI commands: board, me, compare, watch, enroll, submit, help |
+| `cli.mjs` | CLI commands: board, compare, watch, enroll, submit, help |
 | `tui.mjs` | Full tabbed TUI: Dashboard / Trends / Compare / Board / Watch / Connect |
 | `cascade.mjs` | Pure cascade math (Υ, SNR, leverage, velocity, 10xDEV, class) |
 | `tokenpull.mjs` | On-device log scanner — Claude, Codex, multi-platform |

package/adapters.mjs

@@ -35,10 +35,10 @@
 import { readdir, readFile } from 'node:fs/promises'
 import { join, extname } from 'node:path'
 import { homedir } from 'node:os'
-import { exec as execCb } from 'node:child_process'
+import { execFile as execFileCb } from 'node:child_process'
 import { promisify } from 'node:util'
 
-const exec = promisify(execCb)
+const execFileP = promisify(execFileCb)
 const DAY_MS = 86_400_000 // shared with tokenpull.mjs but kept local to avoid circular import
 
 // ── File-system helpers ───────────────────────────────────────────────────────
@@ -75,10 +75,12 @@ function* parseJsonl(text, filePath) {
   }
 }
 
-/** Shell out to sqlite3 and return parsed JSON rows, or [] on error/unavailability. */
+/** Run sqlite3 -json and return parsed rows, or [] on error/unavailability.
+ *  execFile with an args array — no shell, so dbPath/sql need no quoting/escaping
+ *  (matches the execFile hardening used in tools.mjs / tokenpull.mjs). */
 async function sqliteJson(dbPath, sql) {
   try {
-    const { stdout } = await exec(`sqlite3 -json "${dbPath}" "${sql.replace(/"/g, '\\"')}"`, { timeout: 10_000 })
+    const { stdout } = await execFileP('sqlite3', ['-json', dbPath, sql], { timeout: 10_000 })
     return JSON.parse(stdout || '[]')
   } catch { return [] }
 }

package/cli.mjs

@@ -9,9 +9,7 @@
  *   npx sigrank board                live leaderboard, refreshes every 30s
  *   npx sigrank board --window 7d    board for a specific window
  *   npx sigrank board --once         print once and exit (no live refresh)
- *   npx sigrank me                   your cascade across all 4 windows
- *   npx sigrank me --platform amp    use a different platform adapter
- *   npx sigrank me --compare         raw pillar comparison: ccusage vs tokenpull vs token-dashboard
+ *   npx sigrank compare              raw pillar comparison: ccusage vs tokenpull vs token-dashboard
  *   npx sigrank watch                RT tune meter — ALL active platforms × all windows
  *   npx sigrank watch --platform X   watch one platform only (optional filter)
  *   npx sigrank watch --window 7d    watch one window only (optional filter)
@@ -24,7 +22,7 @@
  *   green = positive movement
  */
 
-import { callTool, DEFAULT_API_BASE } from './tools.mjs'
+import { callTool, DEFAULT_API_BASE, pullActivePlatforms } from './tools.mjs'
 import { classify } from './cascade.mjs'
 import { ensureIdentity, keystorePath } from './keystore.mjs'
 import { submitSignedWindow } from './submit.mjs'
@@ -314,107 +312,6 @@ async function runBoard({ window = '30d', once = false, refresh = 30 } = {}) {
   }
 }
 
-// ── ME command ───────────────────────────────────────────────────────────────
-
-async function runMe({ platform = 'claude', compare = false } = {}) {
-  if (compare) return runCompare({ platform })
-
-  write(HIDE_CURSOR)
-  writeln(`  ${dim('reading local token logs…')}`)
-
-  let pulled
-  try {
-    pulled = await callTool('tokenpull', { platform })
-  } catch (e) {
-    write(SHOW_CURSOR)
-    write(CURSOR_UP(1) + ERASE_LINE)
-    writeln(red(`  ✗ ${e.message}`))
-    process.exit(1)
-  }
-
-  // clear the "reading…" line
-  write(CURSOR_UP(1) + ERASE_LINE)
-
-  const w = termWidth()
-  writeln()
-  writeln(`  ${gold('⊙ SigRank')} ${bold('Your Cascade')}  ${dim(`platform: ${pulled.platform ?? platform}`)}`)
-  if (pulled.estimated) writeln(`  ${dim('⚠  estimated values (cache data unavailable for this platform)')}`)
-  writeln(`  ${dim('─'.repeat(w - 4))}`)
-
-  // column headers
-  const cols_h = [
-    padEnd(dim('Window'), 8),
-    padStart(dim('Υ Yield'), 10),
-    padStart(dim('SNR'), 7),
-    padStart(dim('Leverage'), 9),
-    padStart(dim('Velocity'), 9),
-    padStart(dim('10xDEV'), 8),
-    padStart(dim('Class'), 13),
-    padStart(dim('Tokens'), 8),
-  ]
-  writeln(`    ${cols_h.join('  ')}`)
-  writeln(`  ${dim('·'.repeat(w - 4))}`)
-
-  const windows = pulled.windows ?? []
-  for (const win of windows) {
-    const cas = win.cascade
-    const isAll = win.window === 'all'
-    const wLabel = isAll ? bold('all-time') : win.window
-    const yVal   = cas?.yield  != null ? fmtYield(cas.yield)  : '—'
-    const snrVal = cas?.snr    != null ? fmtSNR(cas.snr)       : '—'
-    const levVal = cas?.leverage != null ? `${fmtLev(cas.leverage)}×` : '—'
-    const velVal = cas?.velocity != null ? cas.velocity.toFixed(2)    : '—'
-    const devVal = cas?.dev10x  != null ? cas.dev10x.toFixed(2)       : '—'
-    const cls    = colorClass(cas?.class ?? '—')
-    const tok    = fmtTokens(win.pillars?.total ?? (
-      (win.pillars?.input ?? 0) + (win.pillars?.output ?? 0) +
-      (win.pillars?.cacheCreate ?? 0) + (win.pillars?.cacheRead ?? 0)
-    ))
-
-    const row = [
-      padEnd(wLabel, 8),
-      padStart(isAll ? gold(yVal) : yVal, 10),
-      padStart(snrVal, 7),
-      padStart(levVal, 9),
-      padStart(velVal, 9),
-      padStart(devVal, 8),
-      padEnd(cls, 13),
-      padStart(tok, 8),
-    ]
-    writeln(`  ${row.join('  ')}`)
-  }
-
-  writeln(`  ${dim('─'.repeat(w - 4))}`)
-
-  // card for the best window (all-time if present, else first)
-  const best = windows.find(w => w.window === 'all') ?? windows[0]
-  if (best?.card) {
-    writeln()
-    writeln(`  ${dim('cascade read:')}`)
-    // wrap card text at terminal width
-    const cardText = best.card
-    const maxW = w - 6
-    const words = cardText.split(' ')
-    let line = ''
-    for (const word of words) {
-      if (line.length + word.length + 1 > maxW) {
-        writeln(`  ${line}`)
-        line = word
-      } else {
-        line = line ? `${line} ${word}` : word
-      }
-    }
-    if (line) writeln(`  ${line}`)
-  }
-
-  writeln()
-
-  // submit hint
-  writeln(`  ${dim('to publish:')}  ${cyan('npx sigrank submit')}  ${dim('(sign in first:')}  ${cyan('npx sigrank enroll')}${dim(' — get a code at signalaf.com → Settings)')}`)
-  writeln()
-  write(SHOW_CURSOR)
-}
-
 // ── COMPARE command ───────────────────────────────────────────────────────────
 // Side-by-side: ccusage (JSON) vs tokenpull vs token-dashboard (SQLite)
 //
@@ -756,16 +653,8 @@ const WATCH_WINDOWS = ['7d', '30d', '90d', 'all']
 // Detect which platforms have real local data (input+output > 0 in any window) via tokenpull.
 // Returns an array of pull results (the same shape tokenpullAny yields), one per active platform.
 async function detectActivePulls() {
-  const { tokenpullAny } = await import('./tokenpull.mjs')
-  const settled = await Promise.allSettled(ALL_PLATFORMS.map((p) => tokenpullAny(p)))
-  const active = []
-  for (const r of settled) {
-    if (r.status !== 'fulfilled' || !r.value) continue
-    const d = r.value
-    const live = (d.windows || []).some((w) => (w.pillars.input + w.pillars.output) > 0)
-    if (live) active.push(d)
-  }
-  return active
+  // Unified: one loader for me / watch / the TUI Dashboard (was a separate tokenpullAny loop).
+  return pullActivePlatforms()
 }
 
 async function runWatch({ platform, window: win, refresh = 30, submit = false } = {}) {
@@ -1320,8 +1209,6 @@ async function showHelp() {
   writeln(`    ${cyan('board')}                    live leaderboard (refreshes every 30s)`)
   writeln(`    ${cyan('board --window 7d')}        board for a specific window (7d, 30d, 90d, all)`)
   writeln(`    ${cyan('board --once')}             print once and exit`)
-  writeln(`    ${cyan('me')}                       single-platform cascade (claude by default)`)
-  writeln(`    ${cyan('me --platform codex')}      use a different platform adapter`)
   writeln(`    ${cyan('compare')}                  raw pillar audit: tokenpull vs ccusage vs token-dash vs tokscale`)
   writeln(`    ${cyan('compare --platform codex')} compare for a specific platform`)
   writeln(`    ${cyan('tui')}                      full tabbed TUI: Dashboard / Compare / Board / Watch`)
@@ -1346,7 +1233,6 @@ async function showHelp() {
   writeln(`    ${dim('sigrank board')}                  # live leaderboard`)
   writeln(`    ${dim('sigrank compare')}                # pillar audit (claude)`)
   writeln(`    ${dim('sigrank compare --platform codex')}`)
-  writeln(`    ${dim('sigrank me --platform codex')}`)
   writeln(`    ${dim('sigrank watch --window 7d --refresh 60')}`)
   writeln(`    ${dim('sigrank board --window all --once')}`)
   writeln()
@@ -1423,7 +1309,7 @@ async function runSubmit({ platform = 'claude', window } = {}) {
 
   let out
   try {
-    out = await callTool('submit_verified', { platform, window: typeof window === 'string' ? window : undefined })
+    out = await callTool('submit_verified', { platform, window: typeof window === 'string' ? window : undefined, dry_run: process.argv.includes('--dry-run') })
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`))
     process.exitCode = 1
@@ -1436,15 +1322,28 @@ async function runSubmit({ platform = 'claude', window } = {}) {
   }
 
   writeln()
+  let anyRanked = false
+  let anyReceivedNotRanked = false
   for (const w of out.windows || []) {
     const label = String(w.window).padEnd(8)
-    if (w.status === 'received') {
-      writeln(`  ${green('✓')} ${bold(label)} ${dim(`tier=${w.verification_tier || '—'}${w.persisted ? ' · persisted' : ''}`)}`)
+    if (w.status === 'dry_run') {
+      writeln(`  ${gold('◇')} ${bold(label)} ${gold('DRY RUN')} ${dim('· nothing sent')}`)
+    } else if (w.ranked) {
+      anyRanked = true
+      writeln(`  ${green('✓')} ${bold(label)} ${green('RANKED')} ${dim('· live on the board')}`)
+    } else if (w.status === 'received') {
+      anyReceivedNotRanked = true
+      writeln(`  ${gold('⚠')} ${bold(label)} ${gold('received · NOT ranked')} ${dim(`(tier=${w.verification_tier || '—'})`)}`)
     } else {
       writeln(`  ${red('✗')} ${bold(label)} ${dim(w.reason || w.status || 'failed')}`)
     }
   }
-  writeln(`  ${dim(`Reload your board row: signalaf.com/user/${id.codename}`)}`)
+  writeln()
+  if (anyRanked) {
+    writeln(`  ${dim('Your board row:')}  ${cyan(`signalaf.com/user/${id.codename}`)}`)
+  } else if (anyReceivedNotRanked) {
+    writeln(`  ${gold('Received, but NOT ranked')} ${dim('— this device is unenrolled or revoked. Re-enroll to rank:')}  ${cyan('npx sigrank enroll')}`)
+  }
 }
 
 export async function runCli(argv) {
@@ -1453,7 +1352,7 @@ export async function runCli(argv) {
 
   // parse --key value AND --key=value flags. E4: validate against the known set and warn
   // (don't crash) on anything unknown, so a typo'd flag is visible instead of silently ignored.
-  const KNOWN_FLAGS = new Set(['window', 'platform', 'refresh', 'once', 'submit', 'compare', 'label'])
+  const KNOWN_FLAGS = new Set(['window', 'platform', 'refresh', 'once', 'submit', 'compare', 'label', 'dry-run'])
   const flags = {}
   for (let i = 1; i < args.length; i++) {
     const a = args[i]
@@ -1485,8 +1384,6 @@ export async function runCli(argv) {
         once:    flags.once    === true || flags.once === 'true',
         refresh: Number(flags.refresh) || 30,
       })
-    } else if (cmd === 'me') {
-      await runMe({ platform: flags.platform ?? 'claude', compare: flags.compare === true || flags.compare === 'true' })
     } else if (cmd === 'compare') {
       await runCompare({ platform: flags.platform ?? 'claude' })
     } else if (cmd === 'tui') {
@@ -1517,8 +1414,11 @@ export async function runCli(argv) {
       // default: full unified view
       await runSigRank()
     } else {
-      // unknown command: show help
+      // unknown command: show help + exit non-zero so typos fail loudly (index.mjs now
+      // routes ALL arg'd invocations here instead of falling through to the MCP server)
+      writeln(red(`\n  ✗ unknown command: ${cmd}`))
       await showHelp()
+      process.exit(2)
     }
   } catch (e) {
     write(SHOW_CURSOR)

package/index.mjs

@@ -10,7 +10,7 @@
  * CLI shortcuts (optional — the TUI never needs them):
  *   npx sigrank enroll          sign in: redeem a connect code from signalaf.com
  *   npx sigrank submit          publish your verified runs to the board
- *   npx sigrank board | me | compare | watch    read / publish helpers
+ *   npx sigrank board | compare | watch    read / publish helpers
  *   npx sigrank --help          full reference
  *
  * For AI clients (NOT human commands): in a piped/non-TTY context this starts an MCP
@@ -23,7 +23,7 @@
 
 import { Server } from '@modelcontextprotocol/sdk/server/index.js'
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
-import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
+import { CallToolRequestSchema, ListToolsRequestSchema, McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js'
 import { TOOLS, callTool } from './tools.mjs'
 import { runCli } from './cli.mjs'
 import { readFileSync } from 'node:fs'
@@ -55,6 +55,11 @@ async function startMcpServer() {
   const server = new Server({ name: 'sigrank', version: serverVersion() }, { capabilities: { tools: {} } })
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }))
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    // Unknown tool name = a client/host bug → JSON-RPC -32602 protocol error, per the MCP
+    // spec. isError results (below) are reserved for tools that ran and failed.
+    if (!TOOLS.some((t) => t.name === req.params.name)) {
+      throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${req.params.name}`)
+    }
     try {
       const out = await callTool(req.params.name, req.params.arguments)
       return { content: [{ type: 'text', text: JSON.stringify(out, null, 2) }] }
@@ -66,14 +71,14 @@ async function startMcpServer() {
 }
 
 // Route:
-//   any CLI command arg  → terminal UI / CLI command
+//   any arg              → the CLI (runCli shows help + exits non-zero on unknown commands,
+//                          so a typo never silently starts a hung MCP stdio server on a TTY)
 //   no args + TTY stdout → full tabbed TUI (interactive use)
 //   no args + piped      → MCP stdio server (AI client use)
 const cliArgs = process.argv.slice(2)
-const CLI_COMMANDS = new Set(['board', 'me', 'compare', 'tui', 'watch', 'enroll', 'submit', 'help', '--help', '-h', '--version', '-v'])
-if (cliArgs.length > 0 && (CLI_COMMANDS.has(cliArgs[0]) || cliArgs[0].startsWith('--'))) {
+if (cliArgs.length > 0) {
   runCli(process.argv)
-} else if (cliArgs.length === 0 && process.stdout.isTTY) {
+} else if (process.stdout.isTTY) {
   // Interactive terminal — launch the full tabbed TUI
   const { runTui } = await import('./tui.mjs')
   runTui()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.13.1",
+  "version": "0.14.3",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "type": "module",
   "license": "MIT",

package/submit.mjs

@@ -130,6 +130,20 @@ export async function submitSignedWindow(windowKey, pillars, messages, identity,
   const payload = buildPayload(windowKey, pillars, messages, identity, opts.platform || 'claude', opts)
   const signature = signPayload(payload, identity.private_key_pkcs8_b64)
 
+  // Dry run: build + sign exactly as a real publish, then STOP before the POST.
+  // Returns the exact payload that would be sent — the privacy proof ("token
+  // counts only") is inspectable, and nothing touches the network.
+  if (opts.dryRun) {
+    return {
+      status: 'dry_run',
+      window: WINDOW_TYPE[windowKey] || windowKey,
+      would_post: `${apiBase}/api/v1/snapshots`,
+      payload,
+      signature,
+      detail: 'Nothing sent. Re-run without dry_run to publish.',
+    }
+  }
+
   let res
   let ack
   try {
@@ -157,6 +171,9 @@ export async function submitSignedWindow(windowKey, pillars, messages, identity,
     window: WINDOW_TYPE[windowKey] || windowKey,
     verification_tier: ack.verification_tier ?? null,
     persisted: ack.persisted ?? null,
+    // ranked = actually on the board (verified + written), not just "received".
+    // An unenrolled/revoked device gets HTTP 202 received but is NEVER ranked.
+    ranked: !!(res.ok && ack.verification_tier === 'verified' && ack.persisted === true),
     snapshot_hash: payload.agent.snapshot_hash,
     reason: res.ok ? null : ack.reason || ack.status || `http_${res.status}`,
     detail: ack.detail ?? null,

package/tokenpull.mjs

@@ -41,7 +41,9 @@ const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
 // (ccusage, tokscale) are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
+    // NOTE: execFile does not accept a `stdio` option (it always pipes + buffers
+    // stdout/stderr against maxBuffer) — a previous `stdio` key here was silently ignored.
+    execFile(cmd, args, { timeout: timeoutMs, maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -347,7 +349,10 @@ async function _freshCcusage(platform = 'claude') {
     }
     let i = 0, o = 0, cw = 0, cr = 0
     for (const r of rows) {
-      i += r.inputTokens ?? 0; o += r.outputTokens ?? 0; cw += r.cacheCreationTokens ?? 0; cr += r.cacheReadTokens ?? 0
+      i  += r.inputTokens         ?? r.input_tokens         ?? 0
+      o  += r.outputTokens        ?? r.output_tokens        ?? 0
+      cw += r.cacheCreationTokens ?? r.cache_create_tokens  ?? 0
+      cr += r.cacheReadTokens     ?? r.cache_read_tokens    ?? 0
     }
     result['all'] = { input: i, output: o, cacheCreate: cw, cacheRead: cr }
     return result

package/tools.mjs

@@ -34,7 +34,9 @@ const _envPath = `${_localBin}${process.env.PATH ? ':' + process.env.PATH : ''}`
 // are found even when sigrank isn't globally installed.
 function execFileAsync(cmd, args, timeoutMs) {
   return new Promise((resolve, reject) => {
-    execFile(cmd, args, { timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
+    // NOTE: execFile does not accept a `stdio` option (it always pipes + buffers
+    // stdout/stderr against maxBuffer) — a previous `stdio` key here was silently ignored.
+    execFile(cmd, args, { timeout: timeoutMs, maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PATH: _envPath } }, (err, stdout) => {
       if (err) reject(err)
       else resolve(stdout.toString())
     })
@@ -71,7 +73,10 @@ async function _ccusagePillars(platform = 'claude') {
     }
     let i=0,o=0,cw=0,cr=0
     for (const r of rows) {
-      i+=r.inputTokens??0; o+=r.outputTokens??0; cw+=r.cacheCreationTokens??0; cr+=r.cacheReadTokens??0
+      i  += r.inputTokens         ?? r.input_tokens         ?? 0
+      o  += r.outputTokens        ?? r.output_tokens        ?? 0
+      cw += r.cacheCreationTokens ?? r.cache_create_tokens  ?? 0
+      cr += r.cacheReadTokens     ?? r.cache_read_tokens    ?? 0
     }
     result['all'] = { input: i, output: o, cacheCreate: cw, cacheRead: cr }
     return result
@@ -231,17 +236,19 @@ export const TOOLS = [
         all:   { type: 'string', description: 'ccusage/tokscale paste or JSON for the all-time window (optional)' },
         source_tool: { type: 'string', enum: ['ccusage', 'tokscale', 'claude_max', 'token_dashboard', 'other'], description: 'which token reader produced the paste (for cross-tool variance tracking)' },
       },
+      // at least one window paste is required (runtime check backs this up)
+      anyOf: [{ required: ['7d'] }, { required: ['30d'] }, { required: ['90d'] }, { required: ['all'] }],
     },
   },
   {
     name: 'watch_tokenpull',
     description:
-      'Watch your local token logs and re-derive your cascade whenever new sessions are written — a live tune meter. Polls at a configurable interval (default 60s) and returns the updated cascade. With submit:true (and an enrolled device) it also signs + publishes the watched window to the board each poll; default is preview-only (no submit).',
+      'One poll per call: pulls your local token logs and returns the current cascade for the watched window — the tool never blocks or loops. Re-call at your desired cadence to watch for changes (interval_s is advisory only and echoed back as poll_interval_s). With submit:true (and an enrolled device) each call may also sign + publish the watched window to the board, rate-limited to once per 5 min per platform+window; default is preview-only (no submit).',
     inputSchema: {
       type: 'object',
       properties: {
         platform:    { type: 'string', enum: ALL_PLATFORMS, description: 'platform to watch (default: claude)' },
-        interval_s:  { type: 'number', description: 'poll interval in seconds (default: 60, min: 10)' },
+        interval_s:  { type: 'number', description: 'advisory poll cadence in seconds (default: 60, min: 10) — echoed back as poll_interval_s; does not make the call block or loop' },
         window:      { type: 'string', enum: ['7d', '30d', '90d', 'all'], description: 'which window to watch (default: 7d — most sensitive to recent activity)' },
         submit:      { type: 'boolean', description: 'auto-submit the watched window to the board as a VERIFIED operator each poll (requires `enroll`; default false = preview only)' },
       },
@@ -278,12 +285,13 @@ export const TOOLS = [
   {
     name: 'submit_verified',
     description:
-      'Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine.',
+      'Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Pass dry_run:true to inspect the exact signed payload without publishing.',
     inputSchema: {
       type: 'object',
       properties: {
         window: { type: 'string', enum: ['7d', '30d', '90d', 'all'], description: 'submit only this window (default: all 4)' },
-        platform: { type: 'string', enum: ALL_PLATFORMS, description: 'source platform (default: claude)' },
+        platform: { type: 'string', enum: [...ALL_PLATFORMS, 'multi'], description: "source platform (default: claude). 'multi' = combined cascade summed across all locally-detected platforms (needs 2+ active); empty windows are skipped." },
+        dry_run: { type: 'boolean', description: 'build + sign but do NOT publish — returns the exact payload that would be POSTed (token counts only), so you can inspect before submitting' },
       },
     },
   },
@@ -295,10 +303,30 @@ const WINDOW_TYPE = { '7d': '7d', '30d': '30d', '90d': '90d', all: 'all_time' }
 // E3: client-side auto-submit cooldown for watch_tokenpull. The server already dedups
 // identical snapshots (exact hash → 422), but a noisy poll loop with submit:true could still
 // churn the network/board with near-identical rows. Cap auto-submit to once per WATCH_SUBMIT_COOLDOWN_MS
-// per window (in-memory, per process). Keyed by window so different windows don't block each other.
+// per platform+window (in-memory, per process). Keyed by platform:window so different
+// platforms/windows don't block each other, and only armed on a non-error submit so a
+// network failure doesn't lock out retries for 5 minutes.
 const WATCH_SUBMIT_COOLDOWN_MS = 5 * 60 * 1000
 const _lastWatchSubmitAt = new Map()
 
+// ── Shared active-platform loader ───────────────────────────────────────────
+// THE single data path for "show my cascade across platforms" — used by `me`,
+// `watch`, and the TUI Dashboard so they can't drift apart again. Pulls each
+// target platform via the tokenpull tool (enriched: pillars + cascade + card),
+// keeps only platforms with real local data, and sorts claude → codex → rest.
+// Pass `platforms` to scope it (e.g. ['claude'] for a fast first paint).
+export async function pullActivePlatforms({ platforms } = {}, opts = {}) {
+  const targets = platforms && platforms.length ? platforms : ALL_PLATFORMS
+  const settled = await Promise.allSettled(targets.map((p) => callTool('tokenpull', { platform: p }, opts)))
+  const active = settled
+    .filter((r) => r.status === 'fulfilled' && r.value)
+    .map((r) => r.value)
+    .filter((d) => (d.windows || []).some((w) => ((w.pillars?.input ?? 0) + (w.pillars?.output ?? 0)) > 0))
+  const rank = (p) => (p === 'claude' ? -2 : p === 'codex' ? -1 : ALL_PLATFORMS.indexOf(p))
+  active.sort((a, b) => rank(a.platform) - rank(b.platform))
+  return active
+}
+
 export async function callTool(name, args, opts = {}) {
   const apiBase = opts.apiBase || DEFAULT_API_BASE
   const timeoutMs = opts.fetchTimeout ?? DEFAULT_FETCH_TIMEOUT
@@ -330,6 +358,10 @@ export async function callTool(name, args, opts = {}) {
 
   if (name === 'rank_paste') {
     if (!args?.text) throw new Error('rank_paste requires a non-empty `text` argument.')
+    // E2: reject oversized pastes before parsing (parity with submit_paste / rank_windows).
+    if (typeof args.text === 'string' && args.text.length > MAX_INPUT) {
+      return { status: 'error', reason: 'input_too_large', detail: `text exceeds ${MAX_INPUT} chars (${args.text.length}). Paste only the token-count table, not full output.` }
+    }
     const pillars = parsePillars(args.text)
     const c = withParseWarnings(pillars, cascade(pillars))
     return { ...c, card: narrate(c) }
@@ -420,7 +452,7 @@ export async function callTool(name, args, opts = {}) {
           msgs += w.messages || 0
         }
         if (sum.input + sum.output + sum.cacheCreate + sum.cacheRead <= 0) continue // skip empty window
-        const r = await submitSignedWindow(wk, sum, msgs, id, { apiBase, fetchImpl: doFetch, platform: 'multi', now: opts.now })
+        const r = await submitSignedWindow(wk, sum, msgs, id, { apiBase, fetchImpl: doFetch, platform: 'multi', now: opts.now, dryRun: !!args?.dry_run })
         out.push({ window: wk, pillars: sum, ...r })
       }
       return { platform: 'multi', codename: id.codename, operator_id: id.operator_id, sources: detected.map((d) => d.platform), windows: out }
@@ -435,6 +467,7 @@ export async function callTool(name, args, opts = {}) {
         fetchImpl: doFetch,
         platform: pulled.platform,
         now: opts.now,
+        dryRun: !!args?.dry_run,
       })
       out.push({ window: w.window, pillars: w.pillars, ...r })
     }
@@ -472,7 +505,8 @@ export async function callTool(name, args, opts = {}) {
     })
     let ack
     try { ack = await res.json() } catch { ack = { status: 'error', detail: `HTTP ${res.status} (non-JSON response)` } }
-    return { ...c, card, submission: { ...stamp, httpStatus: res.status, ...ack } }
+    const ranked = !!(res.ok && ack.verification_tier === 'verified' && ack.persisted === true)
+    return { ...c, card, ranked, submission: { ...stamp, httpStatus: res.status, ranked, ...ack } }
   }
 
   if (name === 'tokenpull') {
@@ -512,7 +546,10 @@ export async function callTool(name, args, opts = {}) {
       })
       let ack
       try { ack = await res.json() } catch { ack = { status: 'error', detail: `HTTP ${res.status} (non-JSON)` } }
-      out.push({ window: w.window, pillars: w.pillars, cascade: c, card, submission: { ...stamp, httpStatus: res.status, ...ack } })
+      // ranked = actually on the board (verified + persisted), not just received — parity
+      // with submit_verified (submit.mjs). An unenrolled/revoked device gets 202 but is NEVER ranked.
+      const ranked = !!(res.ok && ack.verification_tier === 'verified' && ack.persisted === true)
+      out.push({ window: w.window, pillars: w.pillars, cascade: c, card, ranked, submission: { ...stamp, httpStatus: res.status, ranked, ...ack } })
     }
     return { platform: pulled.platform, codename: codename || null, generatedAt: pulled.generatedAt, windows: out }
   }
@@ -577,21 +614,23 @@ export async function callTool(name, args, opts = {}) {
     if (args?.submit === true) {
       const id = opts.identity || ensureIdentity()
       if (id.codename && id.operator_id && id.private_key_pkcs8_b64) {
-        // E3: client-side cooldown — at most one auto-submit per window per 5 min. Prevents a
-        // fast poll loop from churning the board even before the server's hash-dedup kicks in.
+        // E3: client-side cooldown — at most one auto-submit per platform+window per 5 min.
+        // Prevents a fast poll loop from churning the board even before the server's
+        // hash-dedup kicks in. Armed only on a non-error outcome so failed submits retry.
         const clockNow = typeof opts.now === 'number' ? opts.now : Date.now()
-        const last = _lastWatchSubmitAt.get(watchWindow)
+        const cdKey = `${pulled.platform}:${watchWindow}`
+        const last = _lastWatchSubmitAt.get(cdKey)
         if (last != null && clockNow - last < WATCH_SUBMIT_COOLDOWN_MS) {
           const waitS = Math.ceil((WATCH_SUBMIT_COOLDOWN_MS - (clockNow - last)) / 1000)
-          auth_submit = { status: 'cooldown', detail: `auto-submit for '${watchWindow}' on cooldown — next in ~${waitS}s (max once / 5 min).`, retry_after_s: waitS }
+          auth_submit = { status: 'cooldown', detail: `auto-submit for '${cdKey}' on cooldown — next in ~${waitS}s (max once / 5 min).`, retry_after_s: waitS }
         } else {
-          _lastWatchSubmitAt.set(watchWindow, clockNow)
           auth_submit = await submitSignedWindow(watchWindow, win.pillars, win.messages, id, {
             apiBase,
             fetchImpl: doFetch,
             platform: pulled.platform,
             now: opts.now,
           })
+          if (auth_submit?.status !== 'error') _lastWatchSubmitAt.set(cdKey, clockNow)
         }
       } else {
         auth_submit = { status: 'not_enrolled', detail: 'Run `npx sigrank-mcp enroll` to auto-submit verified runs.' }

package/tui.mjs

@@ -12,7 +12,8 @@
  *   - Dashboard + Compare load once, refresh on [R].
  */
 
-import { callTool, DEFAULT_API_BASE } from './tools.mjs'
+import { callTool, DEFAULT_API_BASE, pullActivePlatforms } from './tools.mjs'
+import { ALL_PLATFORMS } from './adapters.mjs'
 import { freshVerifierPillars } from './tokenpull.mjs'
 import { isSignedIn, isCodeChar } from './connect.mjs'
 import { loadIdentity, clearIdentity } from './keystore.mjs'
@@ -231,54 +232,33 @@ function sparkline(values) {
 // still used by the `tokenpull_compare` MCP tool.)
 
 async function loadDashboardData() {
-  const { tokenpullAny } = await import('./tokenpull.mjs')
-  const ALL_PLATFORMS = [
-    'claude','codex','amp','gemini','kimi','qwen','goose','kilo',
-    'hermes','droid','codebuff','copilot','openclaw','pi',
-  ]
   const boardPromise = Promise.race([
     fetch(`${DEFAULT_API_BASE}/api/v1/leaderboard?window=30d&metric=yield_`, { headers: { accept: 'application/json' } })
       .then(r => r.ok ? r.json() : null).catch(() => null),
     new Promise(r => setTimeout(() => r(null), 5000)),
   ])
 
-  // FIX 0: progressive load — render the primary platform (claude) FAST first,
-  // then fill the other 13 as they resolve. The caller passes an onFirst callback
-  // that fires when claude is ready so the user sees their cascade within ~1 read,
-  // not after a 14-platform barrier.
-  const claudeResult = await tokenpullAny('claude').catch(() => null)
+  // FIX 0 + unify (0.14): progressive load via the SHARED loader (pullActivePlatforms) — paint the
+  // primary platform (claude) FAST, then fill the rest in fillDashboardRest. This is the SAME loader
+  // `me` and `watch` use, so the three views can't drift apart. (Verifier comparison still runs
+  // FRESH + on-demand in the Compare tab — see loadCompareData — never on this Dashboard path.)
+  const active = await pullActivePlatforms({ platforms: ['claude'] }).catch(() => [])
 
-  const active = []
-  if (claudeResult) {
-    const all = claudeResult.windows?.find(w => w.window === 'all')
-    if (all && (all.pillars.input ?? 0) + (all.pillars.output ?? 0) > 0) active.push(claudeResult)
-  }
-
-  // FIX A1 (2026-06-27): removed the 14× SYNCHRONOUS ccusage `verifierMap` build (measured 39,816 ms)
-  // that blocked the very first Dashboard paint — and the render never read `verifierMap` or `tdPillars`.
-  // (Also dropped the discarded second `tokenDashPillars()` call above.) Verifier comparison
-  // (ccusage / tokscale / token-dashboard) now runs FRESH + on-demand in the Compare tab, scoped to
-  // active platforms — see loadCompareData. Dashboard paints from tokenpull in ~2s.
   const boardData = await boardPromise
-  return { active, verifierMap: {}, tdPillars: null, boardData, _loading: true, _remaining: ALL_PLATFORMS.slice(1) }
+  return { active, verifierMap: {}, tdPillars: null, boardData, _loading: true, _remaining: ALL_PLATFORMS.filter(p => p !== 'claude') }
 }
 
 /** FIX 0: fill the remaining platforms after the primary render. Mutates dashData.active. */
 async function fillDashboardRest(dashData) {
   if (!dashData?._remaining) return false
-  const { tokenpullAny } = await import('./tokenpull.mjs')
-  const rest = await Promise.allSettled(dashData._remaining.map(p => tokenpullAny(p)))
-  for (const r of rest) {
-    if (r.status !== 'fulfilled') continue
-    const d = r.value
-    const all = d.windows?.find(w => w.window === 'all')
-    if (!all) continue
-    if ((all.pillars.input ?? 0) + (all.pillars.output ?? 0) === 0) continue
+  // Unify: fill the remaining platforms through the SAME shared loader.
+  const rest = await pullActivePlatforms({ platforms: dashData._remaining }).catch(() => [])
+  for (const d of rest) {
     if (!dashData.active.find(a => a.platform === d.platform)) dashData.active.push(d)
   }
-  // sort active by ALL_PLATFORMS order for stable display
-  const order = ['claude','codex','amp','gemini','kimi','qwen','goose','kilo','hermes','droid','codebuff','copilot','openclaw','pi']
-  dashData.active.sort((a, b) => order.indexOf(a.platform) - order.indexOf(b.platform))
+  // stable display order: claude → codex → rest (matches the shared loader)
+  const rank = (p) => (p === 'claude' ? -2 : p === 'codex' ? -1 : ALL_PLATFORMS.indexOf(p))
+  dashData.active.sort((a, b) => rank(a.platform) - rank(b.platform))
   dashData._loading = false
   dashData._remaining = null
   return true