sigrank 0.17.4 → 0.18.2

package/README.md

@@ -66,10 +66,17 @@ For all builders, burners and 10xers.
 | **[sigrank-vscode](https://github.com/SunrisesIllNeverSee/sigrank-vscode)** | The IDE extension — see your cascade metrics inline in VS Code. | `code --install-extension sigrank.sigrank` |
 | **[fundscore](https://github.com/SunrisesIllNeverSee/fundscore)** | The repo scorer — investor-readiness scoring for GitHub repos. CLI + MCP server. | `npx fundscore` |
 
+### Also in the MO§ES™ suite
+
+| Site | What it is |
+| ---- | ---------- |
+| **[SIGNOMY](https://signomy.xyz)** | Governed AI agent marketplace where ranked agents form teams, fill slots, run missions, and earn revenue under constitutional protocol. Agents are free. Operators pay. |
+| **[MO§ES](https://mos2es.com)** | The governance framework that underpins SigRank, SIGNOMY, and all governed agent operations. Structural accountability for agentic systems. |
+
 ## Quickstart — 3 steps to the board
 
 ```bash
-# 1. Install (pulls ccusage + tokscale + tokendash automatically — no separate installs)
+# 1. Install (pulls ccusage + tokscale automatically — no separate installs)
 npm install -g sigrank
 
 # 2. Sign in (paste a connect code from signalaf.com → Settings → New key)
@@ -147,7 +154,7 @@ smithery tool call sigrank rank_paste '{"text": "1000000 500000 50000 800000"}'
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.17.4
+⊙ SigRank CLI  v0.0.177
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board
@@ -296,7 +303,7 @@ The dashboard pulls from multiple sources and shows them side-by-side for verifi
 | ----------------- | ------------------------------------------------------------------------------ | --------------------- |
 | `tokenpull`       | On-device JSONL scanner (canon source)                                         | claude, codex, amp, … |
 | `ccusage`         | `ccusage <platform> daily --json` CLI (bundled)                                | claude, codex         |
-| `token-dashboard` | `~/.claude/token-dashboard.db` SQLite (bundled)                                | claude only           |
+| `token-dashboard` | `~/.claude/token-dashboard.db` SQLite ([Nate's](https://github.com/nateherkai/token-dashboard)) | claude only           |
 | `tokscale`        | `tokscale models --json` CLI (bundled, falls back to `~/tokscale_report.json`) | claude, codex         |
 
 **Codex input is estimated** — Codex logs don't expose true input tokens directly. The formula:

package/adapters.mjs

@@ -97,10 +97,11 @@ function* parseJsonl(text, filePath) {
 /** Run sqlite3 -json and return parsed rows, or [] on error/unavailability.
  *  execFile with an args array — no shell, so dbPath/sql need no quoting/escaping
  *  (matches the execFile hardening used in tools.mjs / tokenpull.mjs). */
-async function sqliteJson(dbPath, sql) {
+async function sqliteJson(dbPath, sql, timeoutMs = 10_000) {
   try {
     const { stdout } = await execFileP("sqlite3", ["-json", dbPath, sql], {
-      timeout: 10_000,
+      timeout: timeoutMs,
+      maxBuffer: 256 * 1024 * 1024, // 256MB — Devin's sessions.db yields ~15MB JSON
     });
     return JSON.parse(stdout || "[]");
   } catch {
@@ -729,6 +730,110 @@ export const hermesAdapter = {
   },
 };
 
+// ── 14. Devin CLI ────────────────────────────────────────────────────────────
+// SQLite: ~/.local/share/devin/cli/sessions.db
+// Same combined-input problem as Codex: input_tokens INCLUDES cache write, so we
+// yield { ts, output, cacheRead, uncached } and let tokenpullCodex() do the
+// ioRatio split (input = output × ioRatio, cacheCreate = uncached − input).
+// ioRatio comes from Claude (Beta) or the 7:1:2 average (Alpha = 0.5).
+export const devinAdapter = {
+  platform: "devin",
+  defaultRoot: () => join(homedir(), ".local", "share", "devin", "cli"),
+  async *records(root) {
+    for (const r of roots("DEVIN_HOME", root)) {
+      const dbPath = join(r, "sessions.db");
+      const rows = await sqliteJson(
+        dbPath,
+        `SELECT row_id, session_id,
+                json_extract(chat_message, '$.metadata.metrics.input_tokens') as input_tokens,
+                json_extract(chat_message, '$.metadata.metrics.output_tokens') as output_tokens,
+                json_extract(chat_message, '$.metadata.metrics.cache_read_tokens') as cache_read_tokens,
+                json_extract(chat_message, '$.metadata.created_at') as created_at
+         FROM message_nodes
+         WHERE json_extract(chat_message, '$.role') = 'assistant'
+           AND json_extract(chat_message, '$.metadata.metrics.input_tokens') IS NOT NULL
+         ORDER BY created_at`,
+        60_000,
+      );
+      for (const row of rows) {
+        const inputIncl = Number(row.input_tokens || 0);
+        const cached = Number(row.cache_read_tokens || 0);
+        const output = Number(row.output_tokens || 0);
+        if (inputIncl + output + cached === 0) continue;
+        yield {
+          ts: row.created_at || null,
+          output,
+          cacheRead: cached,
+          uncached: Math.max(0, inputIncl - cached),
+          file: dbPath,
+        };
+      }
+    }
+  },
+};
+
+// ── 15. Other (user-supplied JSON) ───────────────────────────────────────────
+// For platforms/models not yet on the adapter list. The user writes a JSON file
+// with the 4 pillars per window and points SIGRANK_OTHER_PATH at it. This lets
+// anyone with a new tool submit without needing a custom adapter.
+//
+// JSON format (all fields optional, missing windows are skipped):
+// {
+//   "platform": "my-tool",           // optional, defaults to "other"
+//   "windows": {
+//     "all":  { "input": 1000, "output": 2000, "cacheCreate": 500, "cacheRead": 8000 },
+//     "30d":  { "input":  500, "output": 1000, "cacheCreate": 200, "cacheRead": 4000 },
+//     "7d":   { "input":  100, "output":  200, "cacheCreate":  50, "cacheRead":  800 }
+//   }
+// }
+//
+// The adapter yields one "message" per window with the summed pillars. Since
+// there's no per-message timestamp, all data lands in the "all" window only
+// (same as null-timestamp records in other adapters).
+export const otherAdapter = {
+  platform: "other",
+  defaultRoot: () => process.env.SIGRANK_OTHER_PATH || "",
+  async *messages(root) {
+    const filePath = root || process.env.SIGRANK_OTHER_PATH;
+    if (!filePath) {
+      throw new Error(
+        "other adapter: set SIGRANK_OTHER_PATH to a JSON file with your token pillars. " +
+          'Format: { "windows": { "all": { "input": N, "output": N, "cacheCreate": N, "cacheRead": N } } }',
+      );
+    }
+    let text;
+    try {
+      text = await readFile(filePath, "utf8");
+    } catch {
+      throw new Error(`other adapter: cannot read ${filePath} — check SIGRANK_OTHER_PATH`);
+    }
+    let data;
+    try {
+      data = JSON.parse(text);
+    } catch {
+      throw new Error(`other adapter: invalid JSON in ${filePath}`);
+    }
+    const windows = data.windows || {};
+    for (const [win, pillars] of Object.entries(windows)) {
+      const input = Number(pillars.input || 0);
+      const output = Number(pillars.output || 0);
+      const cacheCreate = Number(pillars.cacheCreate || pillars.cache_create || 0);
+      const cacheRead = Number(pillars.cacheRead || pillars.cache_read || 0);
+      if (input + output + cacheCreate + cacheRead === 0) continue;
+      yield {
+        id: `other:${win}`,
+        sid: `other-${win}`,
+        ts: null, // no timestamp → lands in "all" window only
+        input,
+        output,
+        cacheCreate,
+        cacheRead,
+        file: filePath,
+      };
+    }
+  },
+};
+
 // ── Registry ──────────────────────────────────────────────────────────────────
 /** All non-Claude, non-Codex adapters keyed by platform ID. */
 export const ADAPTERS = {
@@ -745,6 +850,8 @@ export const ADAPTERS = {
   goose: gooseAdapter,
   kilo: kiloAdapter,
   hermes: hermesAdapter,
+  devin: devinAdapter,
+  other: otherAdapter,
 };
 
 export const ALL_PLATFORMS = Object.keys(ADAPTERS).concat(["claude", "codex"]);

package/cli.mjs

@@ -236,7 +236,10 @@ async function fetchBoard(window = "30d") {
   const res = await fetch(
     `${DEFAULT_API_BASE}/api/v1/leaderboard?window=${window}&metric=yield_`,
     {
-      headers: { accept: "application/json" },
+      headers: {
+        accept: "application/json",
+        "user-agent": `node/${process.version} sigrank-mcp/cli`,
+      },
     },
   );
   if (!res.ok) throw new Error(`Board API → HTTP ${res.status}`);
@@ -491,7 +494,7 @@ function appPillars() {
 async function tokenDashPillars() {
   const dbPath = path.join(os.homedir(), ".claude", "token-dashboard.db");
   if (!existsSync(dbPath)) return null;
-  // Read directly with sqlite3 — no python script needed (bundled dep).
+  // Read directly with sqlite3 — DB created by Nate's token-dashboard (github.com/nateherkai/token-dashboard).
   // Windowed queries using sqlite3's datetime() function.
   const cf =
     "(model LIKE '%claude%' OR model LIKE '%fable%' OR model LIKE '%sonnet%' OR model LIKE '%opus%' OR model LIKE '%haiku%')";
@@ -934,6 +937,7 @@ async function runWatch({
 const ALL_PLATFORMS = [
   "claude",
   "codex",
+  "devin",
   "amp",
   "gemini",
   "kimi",
@@ -944,8 +948,10 @@ const ALL_PLATFORMS = [
   "droid",
   "codebuff",
   "copilot",
+  "opencode",
   "openclaw",
   "pi",
+  "other",
 ];
 
 async function runSigRank() {
@@ -1472,6 +1478,7 @@ async function runSigRank() {
                       headers: {
                         "content-type": "application/json",
                         accept: "application/json",
+                        "user-agent": `node/${process.version} sigrank-mcp/cli`,
                       },
                       body: JSON.stringify({
                         codename,

package/index.mjs

@@ -194,7 +194,7 @@ async function startMcpServer() {
       uri: "sigrank://install-guide",
       name: "Quick Start Guide",
       description:
-        "Step-by-step install and first submission: npx sigrank → enroll → submit. Covers ccusage/tokscale/tokendash bundled deps, privacy model (token counts only, never prompts), and dry-run workflow.",
+        "Step-by-step install and first submission: npx sigrank → enroll → submit. Covers ccusage/tokscale bundled deps + token-dashboard (Nate's, github.com/nateherkai/token-dashboard), privacy model (token counts only, never prompts), and dry-run workflow.",
       mimeType: "text/markdown",
     },
     {
@@ -289,14 +289,20 @@ No global install needed. The MCP server starts automatically when an AI client
    npx sigrank submit --dry-run
    \`\`\`
 
-## Token Pull Sources (bundled)
+## Token Pull Sources
 
-SigRank bundles three token readers as dependencies:
+SigRank bundles two token readers as npm dependencies:
 - **ccusage** — Claude Code session logs
 - **tokscale** — multi-platform token telemetry
-- **tokendash** — dashboard + TUI for token usage
 
-No separate install needed. All three are called automatically by the tokenpull tools.
+A third source, **token-dashboard**, is read from \`~/.claude/token-dashboard.db\` (SQLite).
+That DB is created by [Nate's token-dashboard](https://github.com/nateherkai/token-dashboard) (Python):
+\`\`\`bash
+git clone https://github.com/nateherkai/token-dashboard.git
+cd token-dashboard
+python3 cli.py dashboard
+\`\`\`
+Run the scan once to create the DB; SigRank reads it directly via sqlite3 after that.
 
 ## MCP Client Setup
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.17.4",
+  "version": "0.18.2",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
@@ -64,8 +64,7 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@zhangferry-dev/tokendash": "^1.7.5",
-    "ccusage": "^20.0.14",
-    "tokscale": "^4.0.4"
+    "ccusage": "^20.0.17",
+    "tokscale": "^4.5.2"
   }
 }

package/submit.mjs

@@ -11,9 +11,22 @@
 
 import { snapshotHash, signPayload } from "./sign.mjs";
 import { preflight } from "./preflight.mjs";
+import { readFileSync } from "node:fs";
 
 const WINDOW_TYPE = { "7d": "7d", "30d": "30d", "90d": "90d", all: "all_time" };
 const WINDOW_SPAN_DAYS = { "7d": 7, "30d": 30, "90d": 90, all_time: 3650 };
+
+/** Resolve this package's version for the User-Agent stamp (best-effort). */
+function _pkgVersion() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(new URL("./package.json", import.meta.url), "utf-8"),
+    );
+    return pkg.version;
+  } catch {
+    return "unknown";
+  }
+}
 const PLATFORM_ENUM = new Set([
   "claude",
   "chatgpt",
@@ -181,8 +194,13 @@ export async function submitSignedWindow(
     ((url, init = {}) => {
       const ctrl = new AbortController();
       const timer = setTimeout(() => ctrl.abort(), 15_000);
+      const headers = {
+        "user-agent": `node/${process.version} sigrank-mcp/${_pkgVersion()}`,
+        ...(init.headers || {}),
+      };
       return fetch(url, {
         ...init,
+        headers,
         signal: init.signal || ctrl.signal,
       }).finally(() => clearTimeout(timer));
     });

package/tokenpull.mjs

@@ -343,7 +343,7 @@ export async function tokenpullCodex({
   });
 
   return {
-    platform: "codex",
+    platform: adapter.platform || "codex",
     root: r,
     generatedAt: new Date(nowMs).toISOString(),
     files: files.size,
@@ -367,13 +367,12 @@ export async function tokenpullCodex({
 export async function tokenpullAny(platform, opts = {}) {
   if (!platform || platform === "claude")
     return tokenpull({ adapter: claudeAdapter, ...opts });
-  if (platform === "codex") {
-    // Auto-derive io_ratio from the operator's Claude data when not explicitly provided.
+  // Codex + Devin: both combine input + cache write in input_tokens, so both go
+  // through tokenpullCodex() which splits via ioRatio (Beta from Claude, Alpha 2.0).
+  if (platform === "codex" || platform === "devin") {
     let ioRatio = opts.ioRatio || 2.0;
     if (!opts.ioRatio) {
       try {
-        // Forward root/now from opts so the Beta-ratio derivation is testable
-        // (without this, it always reads the real ~/.claude and can't be injected).
         const c = await tokenpull({
           adapter: claudeAdapter,
           root: opts.root,
@@ -386,15 +385,8 @@ export async function tokenpullAny(platform, opts = {}) {
         /* no Claude data → Alpha 2.0 */
       }
     }
-    return tokenpullCodex({ ioRatio, ...opts });
-  }
-  // Cloud agents (Devin, etc.) run server-side — no local JSONL to read
-  const CLOUD_AGENTS = { devin: "Cognition/Devin" };
-  if (platform in CLOUD_AGENTS) {
-    throw new Error(
-      `"${platform}" (${CLOUD_AGENTS[platform]}) runs in the cloud — sessions are not written to local JSONL files. ` +
-        `There is no local data source to read. If ${CLOUD_AGENTS[platform]} exposes a usage API in future, an adapter can be added.`,
-    );
+    const adapter = platform === "codex" ? codexAdapter : ADAPTERS.devin;
+    return tokenpullCodex({ adapter, ioRatio, ...opts });
   }
   const adapter = ADAPTERS[platform];
   if (!adapter)
@@ -486,7 +478,7 @@ async function _freshTokendash(platform = "claude") {
   if (platform !== "claude") return null;
   const dbPath = join(homedir(), ".claude", "token-dashboard.db");
   // Read the token-dashboard DB directly with sqlite3 (no external python scan
-  // needed — the DB is created by the tokendash dashboard, now bundled as a dep).
+  // needed — the DB is created by Nate's token-dashboard, github.com/nateherkai/token-dashboard).
   // all-time only; the db doesn't expose windowing here.
   if (!existsSync(dbPath)) return null;
   try {

package/tools.mjs

@@ -26,7 +26,7 @@ import { ALL_PLATFORMS } from "./adapters.mjs";
 import { ensureIdentity, recordEnrollment } from "./keystore.mjs";
 import { submitSignedWindow } from "./submit.mjs";
 import { createHash } from "node:crypto";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -256,6 +256,56 @@ export const DEFAULT_FETCH_TIMEOUT =
  *  past this is malformed or abusive — reject cleanly before parsing/POSTing (E2 hardening). */
 const MAX_INPUT = 1_000_000;
 
+/** Resolve this package's version for the User-Agent stamp (best-effort). */
+function agentVersionStamp() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(new URL("./package.json", import.meta.url), "utf-8"),
+    );
+    return pkg.version;
+  } catch {
+    return "unknown";
+  }
+}
+
+/**
+ * curl-based fetch fallback for when Node's fetch is blocked by Vercel's bot
+ * protection (TLS fingerprinting). Returns a Response-like object with .ok,
+ * .status, .json(), .text(). Uses execFileSync for synchronous curl execution.
+ */
+function curlFetch(url, init = {}, timeoutMs = 10_000) {
+  const args = ["-s", "-S", "-w", "\n__HTTP_STATUS__%{http_code}", "--max-time", String(Math.ceil(timeoutMs / 1000))];
+  if (init.method) args.push("-X", init.method);
+  const headers = init.headers || {};
+  for (const [k, v] of Object.entries(headers)) {
+    args.push("-H", `${k}: ${v}`);
+  }
+  if (init.body) {
+    args.push("-d", init.body);
+  }
+  args.push(url);
+  let stdout;
+  try {
+    stdout = execFileSync("curl", args, {
+      encoding: "utf-8",
+      maxBuffer: 10 * 1024 * 1024,
+      timeout: timeoutMs + 2000,
+    });
+  } catch (e) {
+    throw new Error(`curl transport failed: ${e.message}`);
+  }
+  // Parse the status code from the trailer
+  const statusMatch = stdout.match(/__HTTP_STATUS__(\d+)$/);
+  const status = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+  const bodyText = statusMatch ? stdout.slice(0, statusMatch.index) : stdout;
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => { try { return JSON.parse(bodyText); } catch { return {}; } },
+    text: async () => bodyText,
+  };
+}
+
 // ── Smithery quality: output schemas + annotations ──────────────────────────
 // MCP tool annotations hint to clients about side-effects, read-only status, etc.
 const ANNOTATIONS = {
@@ -747,8 +797,8 @@ export const TOOLS = [
       properties: {
         platform: {
           type: "string",
-          enum: ALL_PLATFORMS,
-          description: `source platform (default: claude). Supported: ${ALL_PLATFORMS.join(", ")}. codex is estimated via io_ratio. Some platforms need setup (e.g. copilot requires COPILOT_OTEL_ENABLED=true).`,
+          enum: [...ALL_PLATFORMS, "multi"],
+          description: `source platform (default: claude). Supported: ${ALL_PLATFORMS.join(", ")}, multi. 'multi' = combined cascade summed across all locally-detected platforms (needs 2+ active). 'devin' reads from ~/.local/share/devin/cli/sessions.db (SQLite, all windows). 'codex' is estimated via io_ratio. 'other' reads from a user-supplied JSON file (set SIGRANK_OTHER_PATH). Some platforms need setup (e.g. copilot requires COPILOT_OTEL_ENABLED=true).`,
         },
       },
     },
@@ -780,8 +830,8 @@ export const TOOLS = [
         },
         platform: {
           type: "string",
-          enum: ALL_PLATFORMS,
-          description: `Source platform to pull from (default: claude). Supported: ${ALL_PLATFORMS.join(", ")}. Each platform reads its own session logs locally.`,
+          enum: [...ALL_PLATFORMS, "multi"],
+          description: `Source platform to pull from (default: claude). Supported: ${ALL_PLATFORMS.join(", ")}, multi. 'multi' = combined cascade summed across all locally-detected platforms (needs 2+ active). 'devin' reads from ~/.local/share/devin/cli/sessions.db (SQLite, all windows). 'other' reads from a user-supplied JSON file (set SIGRANK_OTHER_PATH). Each platform reads its own session logs locally.`,
         },
       },
     },
@@ -1357,13 +1407,45 @@ export async function callTool(name, args, opts = {}) {
   const rawFetch = opts.fetchImpl || fetch;
 
   // Wrap every fetch with an AbortController timeout so a hung network call never
-  // blocks the MCP client indefinitely.
-  const doFetch = (url, init = {}) => {
+  // blocks the MCP client indefinitely. Vercel's bot protection (security
+  // checkpoint) blocks Node's fetch via TLS fingerprinting — no UA fix helps.
+  // When fetch gets a 403 Vercel challenge, fall back to curl (which passes).
+  const doFetch = async (url, init = {}) => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), timeoutMs);
-    return rawFetch(url, { ...init, signal: ac.signal }).finally(() =>
-      clearTimeout(timer),
-    );
+    const headers = {
+      "user-agent": `node/${process.version} sigrank-mcp/${agentVersionStamp()}`,
+      ...(init.headers || {}),
+    };
+    try {
+      const res = await rawFetch(url, { ...init, headers, signal: ac.signal });
+      // Detect Vercel security checkpoint (403 + HTML body, not JSON)
+      if (res.status === 403) {
+        const text = await res.text();
+        if (text.includes("Vercel Security Checkpoint") || text.includes("x-vercel-challenge")) {
+          // Fall back to curl transport
+          return curlFetch(url, init, timeoutMs);
+        }
+        // Real 403 from the API — return a mock response object
+        return {
+          ok: false,
+          status: 403,
+          json: async () => { try { return JSON.parse(text); } catch { return {}; } },
+          text: async () => text,
+        };
+      }
+      return res;
+    } catch (e) {
+      if (e.name === "AbortError") throw e;
+      // Network error — try curl as fallback
+      try {
+        return await curlFetch(url, init, timeoutMs);
+      } catch {
+        throw e;
+      }
+    } finally {
+      clearTimeout(timer);
+    }
   };
 
   const fetchJson = async (path) => {
@@ -1405,8 +1487,12 @@ export async function callTool(name, args, opts = {}) {
     const c = withParseWarnings(pillars, cascade(pillars));
     return { ...c, card: narrate(c) };
   }
-  if (name === "get_leaderboard")
-    return fetchJson("/api/v1/leaderboard?metric=yield_");
+  if (name === "get_leaderboard") {
+    const params = new URLSearchParams({ metric: "yield_" });
+    if (args?.limit) params.set("limit", String(args.limit));
+    if (args?.window) params.set("window", args.window);
+    return fetchJson(`/api/v1/leaderboard?${params}`);
+  }
   if (name === "get_operator") {
     const codename = String(args?.codename || "").trim();
     if (!codename)
@@ -1677,6 +1763,67 @@ export async function callTool(name, args, opts = {}) {
   if (name === "tokenpull") {
     // Local read → 4 windows of pillars → cascade each. Token-only, on-device.
     const platform = args?.platform || "claude";
+
+    // MULTI: sum every locally-detected platform's pillars per window. Same logic as
+    // submit_verified's multi flow — Devin (cloud, via tokscale) is included.
+    if (platform === "multi") {
+      const detected = [];
+      for (const p of ALL_PLATFORMS) {
+        const r = await pullByPlatform(p, opts).catch(() => null);
+        const live =
+          r &&
+          (r.windows || []).some(
+            (w) =>
+              w.pillars.input +
+                w.pillars.output +
+                w.pillars.cacheCreate +
+                w.pillars.cacheRead >
+              0,
+          );
+        if (live) detected.push(r);
+      }
+      if (detected.length < 2) {
+        return {
+          platform: "multi",
+          status: "skipped",
+          reason: "need_2_platforms",
+          detail: `multi needs 2+ active platforms; found ${detected.length} (${detected.map((d) => d.platform).join(", ") || "none"}).`,
+          windows: [],
+        };
+      }
+      const winKeys = ["7d", "30d", "90d", "all"];
+      const windows = [];
+      for (const wk of winKeys) {
+        const sum = { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 };
+        let msgs = 0;
+        for (const d of detected) {
+          const w = (d.windows || []).find((x) => x.window === wk);
+          if (!w) continue;
+          sum.input += w.pillars.input || 0;
+          sum.output += w.pillars.output || 0;
+          sum.cacheCreate += w.pillars.cacheCreate || 0;
+          sum.cacheRead += w.pillars.cacheRead || 0;
+          msgs += w.messages || 0;
+        }
+        if (sum.input + sum.output + sum.cacheCreate + sum.cacheRead <= 0)
+          continue;
+        const c = cascade(sum);
+        windows.push({
+          window: wk,
+          messages: msgs,
+          pillars: sum,
+          cascade: c,
+          card: narrate(c, `${wk} multi`),
+        });
+      }
+      return {
+        platform: "multi",
+        estimated: true,
+        sources: detected.map((d) => d.platform),
+        windows,
+      };
+    }
+
     const pulled = await pullByPlatform(platform, opts);
     const windows = pulled.windows.map((w) => {
       const c = cascade(w.pillars);
@@ -1704,7 +1851,111 @@ export async function callTool(name, args, opts = {}) {
     // (server re-scores). The board stays platform-agnostic via the 4 pillars; the
     // source platform rides along as a tag. Conversion already happened in the adapter.
     const codename = String(args?.codename || "").trim();
-    const pulled = await pullByPlatform(args?.platform || "claude", opts);
+    const platform = args?.platform || "claude";
+
+    // MULTI: same combined cross-platform cascade as submit_verified. Includes Devin
+    // (cloud, via tokscale). Aggregate every locally-detected platform's pillars per
+    // window and publish as platform='multi'.
+    if (platform === "multi") {
+      const detected = [];
+      for (const p of ALL_PLATFORMS) {
+        const r = await pullByPlatform(p, opts).catch(() => null);
+        const live =
+          r &&
+          (r.windows || []).some(
+            (w) =>
+              w.pillars.input +
+                w.pillars.output +
+                w.pillars.cacheCreate +
+                w.pillars.cacheRead >
+              0,
+          );
+        if (live) detected.push(r);
+      }
+      if (detected.length < 2) {
+        return {
+          platform: "multi",
+          codename: codename || undefined,
+          status: "skipped",
+          reason: "need_2_platforms",
+          detail: `multi needs 2+ active platforms; found ${detected.length} (${detected.map((d) => d.platform).join(", ") || "none"}).`,
+          windows: [],
+        };
+      }
+      const winKeys = args?.window ? [args.window] : ["7d", "30d", "90d", "all"];
+      const out = [];
+      for (const wk of winKeys) {
+        const sum = { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 };
+        let msgs = 0;
+        for (const d of detected) {
+          const w = (d.windows || []).find((x) => x.window === wk);
+          if (!w) continue;
+          sum.input += w.pillars.input || 0;
+          sum.output += w.pillars.output || 0;
+          sum.cacheCreate += w.pillars.cacheCreate || 0;
+          sum.cacheRead += w.pillars.cacheRead || 0;
+          msgs += w.messages || 0;
+        }
+        if (sum.input + sum.output + sum.cacheCreate + sum.cacheRead <= 0)
+          continue;
+        const c = cascade(sum);
+        const card = narrate(c, `${wk} multi`);
+        if (!codename) {
+          out.push({
+            window: wk,
+            pillars: sum,
+            cascade: c,
+            card,
+            submission: { status: "not_submitted", reason: "codename_required" },
+          });
+          continue;
+        }
+        const rawPaste = `${sum.input} ${sum.output} ${sum.cacheCreate} ${sum.cacheRead}`;
+        const windowType = WINDOW_TYPE[wk] || wk;
+        const stamp = uploadStamp({
+          codename,
+          window: windowType,
+          pillars: sum,
+          platform: "multi",
+        });
+        const res = await doFetch(`${apiBase}/api/v1/ingest-paste`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            accept: "application/json",
+          },
+          body: JSON.stringify({
+            codename,
+            raw_paste: rawPaste,
+            window_type: windowType,
+            telemetry: { platform: { primary: "multi" } },
+            ...stamp,
+          }),
+        });
+        let ack;
+        try {
+          ack = await res.json();
+        } catch {
+          ack = { status: "parse_error", httpStatus: res.status };
+        }
+        const ranked = ack?.ranked ?? ack?.accepted ?? false;
+        out.push({
+          window: wk,
+          pillars: sum,
+          cascade: c,
+          card,
+          submission: { ...stamp, httpStatus: res.status, ranked, ...ack },
+        });
+      }
+      return {
+        platform: "multi",
+        codename: codename || undefined,
+        sources: detected.map((d) => d.platform),
+        windows: out,
+      };
+    }
+
+    const pulled = await pullByPlatform(platform, opts);
     const targets = args?.window
       ? pulled.windows.filter((w) => w.window === args.window)
       : pulled.windows;
@@ -2774,6 +3025,7 @@ export async function callTool(name, args, opts = {}) {
     const top = ops.map((op) => ({
       ...op,
       behavioral_framing: _behavioralFraming(op),
+      competitive: _competitiveLayer(op, board),
     }));
 
     const best = top[0];
@@ -2781,7 +3033,13 @@ export async function callTool(name, args, opts = {}) {
       ? `${best.codename} tops the SigRank leaderboard at Υ ${best.yield_?.toLocaleString?.() || best.yield_} — ${_behavioralFraming(best)}`
       : "No operators on the board yet.";
 
-    return { top_operators: top, total_operators: total, summary };
+    return {
+      top_operators: top,
+      total_operators: total,
+      summary,
+      cta: "Check my rank",
+      shareable_url: best ? `${DEFAULT_API_BASE}/operator/${encodeURIComponent(best.codename)}` : null,
+    };
   }
 
   if (name === "compare_self") {
@@ -2843,6 +3101,10 @@ export async function callTool(name, args, opts = {}) {
 
     const suggestion = _improvementSuggestion(klass, yourMetrics);
 
+    // Competitive layer per SHARED_DESIGN_DECISIONS.md §3/§4/§5
+    const competitive = _competitiveLayer(yourMetrics, board);
+    const competitiveSummary = _competitiveSummary(yourMetrics, board);
+
     return {
       your_metrics: yourMetrics,
       power_user_assessment: powerUserAssessment,
@@ -2850,8 +3112,16 @@ export async function callTool(name, args, opts = {}) {
         your_yield_vs_avg: yieldVsAvg,
         your_class_meaning: classMeaning,
         percentile,
+        rank: competitive.rank,
+        total_operators: competitive.total_operators,
+        class_tier: competitive.class_tier,
+        delta_from_average: competitive.delta_from_average,
+        delta_from_top: competitive.delta_from_top,
       },
+      competitive_summary: competitiveSummary,
+      shareable_url: competitive.shareable_url,
       suggestion,
+      cta: "See where I stand",
     };
   }
 
@@ -2863,9 +3133,10 @@ export async function callTool(name, args, opts = {}) {
         "compare_operators requires both `codename_a` and `codename_b`.",
       );
 
-    const [opA, opB] = await Promise.all([
+    const [opA, opB, board] = await Promise.all([
       fetchJson(`/api/v1/operators/${encodeURIComponent(nameA)}`),
       fetchJson(`/api/v1/operators/${encodeURIComponent(nameB)}`),
+      fetchJson("/api/v1/leaderboard?metric=yield_"),
     ]);
 
     const yieldA = opA.yield_ || 0;
@@ -2884,6 +3155,7 @@ export async function callTool(name, args, opts = {}) {
         velocity: opA.velocity,
         class: opA.class,
         rank: opA.rank,
+        competitive: _competitiveLayer(opA, board),
       },
       operator_b: {
         codename: opB.codename,
@@ -2892,9 +3164,11 @@ export async function callTool(name, args, opts = {}) {
         velocity: opB.velocity,
         class: opB.class,
         rank: opB.rank,
+        competitive: _competitiveLayer(opB, board),
       },
       verdict,
       yield_delta: delta,
+      cta: "Compare me to others",
     };
   }
 
@@ -2915,6 +3189,8 @@ export async function callTool(name, args, opts = {}) {
         { class: "Burner", meaning: "Early-stage — tokens burned more than compounded. Low leverage, low velocity. The shift: reuse prior context." },
       ],
       link: "https://signalaf.com/score — check your class tier and yield",
+      shareable_url: `${DEFAULT_API_BASE}/score`,
+      cta: "Learn the scoring",
     };
   }
 
@@ -2986,6 +3262,11 @@ export async function callTool(name, args, opts = {}) {
 
     const summary = `Your Υ Yield is ${y.toLocaleString()} (${klass}). ${_improvementSuggestion(klass, metrics)}`;
 
+    // Competitive layer per SHARED_DESIGN_DECISIONS.md §3/§4/§5
+    const board = await fetchJson("/api/v1/leaderboard?metric=yield_");
+    const competitive = _competitiveLayer(metrics, board);
+    const competitiveSummary = _competitiveSummary(metrics, board);
+
     return {
       your_metrics: {
         yield_: y,
@@ -2993,8 +3274,19 @@ export async function callTool(name, args, opts = {}) {
         velocity: v,
         class: klass,
       },
+      competitive: {
+        rank: competitive.rank,
+        total_operators: competitive.total_operators,
+        percentile: competitive.percentile,
+        class_tier: competitive.class_tier,
+        delta_from_average: competitive.delta_from_average,
+        delta_from_top: competitive.delta_from_top,
+      },
+      competitive_summary: competitiveSummary,
+      shareable_url: competitive.shareable_url,
       suggestions,
       summary,
+      cta: "Improve my score",
     };
   }
 
@@ -3003,6 +3295,90 @@ export async function callTool(name, args, opts = {}) {
 
 // ── Intent tool helpers — behavioral framing in power-user language ──────────
 
+/**
+ * Competitive layer for tool responses per SHARED_DESIGN_DECISIONS.md §3/§4/§5.
+ * Every tool response that includes operator data must show:
+ *   rank, percentile, class_tier, delta_from_average, delta_from_top, shareable_url
+ * Response style: factual + competitive ("You rank #12 of 47 operators...")
+ */
+function _competitiveLayer(op, board) {
+  const allOps = Array.isArray(board?.operators || board) ? (board.operators || board) : [];
+  const yields = allOps.map((o) => o.yield_ || 0).sort((a, b) => a - b);
+  const yourYield = op.yield_ || 0;
+  const total = allOps.length;
+
+  // Rank: find operator's position (1-based)
+  let rank = op.rank || null;
+  if (!rank && total > 0) {
+    const sorted = [...allOps].sort((a, b) => (b.yield_ || 0) - (a.yield_ || 0));
+    const idx = sorted.findIndex((o) => o.codename === op.codename);
+    rank = idx >= 0 ? idx + 1 : null;
+  }
+
+  // Percentile: % of operators with yield below this operator
+  const percentile = total > 0
+    ? Math.round((yields.filter((y) => y < yourYield).length / total) * 100)
+    : 0;
+
+  // Delta from average
+  const avgYield = total > 0 ? yields.reduce((s, y) => s + y, 0) / total : 0;
+  const deltaFromAvg = avgYield > 0
+    ? { absolute: Math.round(yourYield - avgYield),
+        percent: Math.round(((yourYield - avgYield) / avgYield) * 100) }
+    : { absolute: 0, percent: 0 };
+
+  // Delta from top operator
+  const topYield = total > 0 ? Math.max(...yields) : 0;
+  const deltaFromTop = topYield > 0
+    ? { absolute: Math.round(topYield - yourYield),
+        percent: Math.round(((topYield - yourYield) / topYield) * 100) }
+    : { absolute: 0, percent: 0 };
+
+  // Shareable URL
+  const shareableUrl = op.codename && op.codename !== "you (local)"
+    ? `${DEFAULT_API_BASE}/operator/${encodeURIComponent(op.codename)}`
+    : null;
+
+  return {
+    rank,
+    total_operators: total,
+    percentile,
+    class_tier: op.class || "Burner",
+    delta_from_average: deltaFromAvg,
+    delta_from_top: deltaFromTop,
+    shareable_url: shareableUrl,
+  };
+}
+
+/** Factual + competitive summary line per SHARED_DESIGN_DECISIONS.md §4 */
+function _competitiveSummary(op, board) {
+  const cl = _competitiveLayer(op, board);
+  const parts = [];
+
+  if (cl.rank && cl.total_operators > 0) {
+    parts.push(`You rank #${cl.rank} of ${cl.total_operators} operators.`);
+  }
+
+  const topOp = (board?.operators || board || []).reduce(
+    (best, o) => ((o.yield_ || 0) > (best?.yield_ || 0) ? o : best),
+    null,
+  );
+  if (topOp && topOp.codename) {
+    parts.push(`Top operator is ${topOp.codename} with Υ ${(topOp.yield_ || 0).toLocaleString()}.`);
+  }
+
+  if (cl.delta_from_average.percent !== 0) {
+    const dir = cl.delta_from_average.percent > 0 ? "above" : "below";
+    parts.push(`You're ${Math.abs(cl.delta_from_average.percent)}% ${dir} average.`);
+  }
+
+  if (cl.delta_from_top.percent > 0) {
+    parts.push(`${cl.delta_from_top.percent}% below top.`);
+  }
+
+  return parts.join(" ");
+}
+
 function _behavioralFraming(op) {
   const y = op.yield_ || 0;
   const l = op.leverage || 0;

package/tui.mjs

@@ -2192,9 +2192,11 @@ export async function runTui({
                   "sign-in is temporarily unavailable — try again shortly.",
               };
               connectMsg = `${red("✗")} ${reasons[out.reason] || `sign-in failed (${out.reason || "unknown"}).`}`;
+              codeBuf = ""; // auto-clear on failure — the code is consumed/invalid
             }
           } catch (e) {
             connectMsg = `${red("✗")} ${e.message}`;
+            codeBuf = ""; // auto-clear on error too
           }
           await redraw();
           return;
@@ -2225,13 +2227,13 @@ export async function runTui({
           await redraw();
           return;
         } // backspace
-        // [X] sign out / reset — when the code field is empty (so an 'x' typed mid-code
-        // still feeds the buffer). Drops the local credential so a server-revoked OR
-        // server-enrolled-but-locally-unbound device stops holding a stale device_id,
-        // and the next enroll provisions a fresh device_id (escapes the Frankenstein-
-        // identity / 409-re-enroll deadlock). Works whether or not isSignedIn() —
-        // otherwise a device enrolled server-side but unbound locally is un-escapable
-        // (can't sign in: device_already_enrolled; can't sign out: X gated off).
+        // [X] sign out / reset — only when the code field is empty (so 'x'/'X' typed
+        // mid-code still feeds the buffer — codes can contain X). The auto-clear on
+        // sign-in failure (above) ensures the buffer is empty after a failed attempt,
+        // so X works immediately when the user wants to reset. Drops the local
+        // credential so a server-revoked OR server-enrolled-but-locally-unbound device
+        // stops holding a stale device_id, and the next enroll provisions a fresh
+        // device_id (escapes the Frankenstein-identity / 409-re-enroll deadlock).
         if (k === "x" && !codeBuf) {
           const wasSignedIn = isSignedIn(loadIdentity());
           clearIdentity();