sigrank 1.0.44 → 1.0.46

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 1.0.46
+
+### Security / privacy
+
+* `enroll`: device label no longer defaults to the OS hostname; default is `sigrank <version> · <platform>` (opt-in override: `device_label` arg or `SIGRANK_DEVICE_LABEL`)
+* `enroll` (MCP): refuses to re-bind an already-enrolled device; re-enroll from the CLI
+* `submit_verified`: requires `confirm: true` to publish (not for `dry_run`); CLI/TUI pass it after their own consent
+* `tokscale_developer_profile`: returns `workspace_count` only, no workspace/project names
+* `validateApiBase`: https required except loopback hosts
+* Pinned `ccusage` 20.0.30 and `tokscale` 4.18.0 exactly; removed stale `tokscale@latest` comment
+* Proxy: rejects non-loopback Host headers and cross-site browser requests (403)
+* Keystore: identity backups chmod 0600
+* README / privacy-model corrected to list exactly what leaves the machine
+
+## [1.0.44](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.44) (2026-10-05)
+
+### Features
+
+* MCP: explicit opt-in support for protocol revision 2026-07-28 via `serveStdio` — a `server/discover` probe with the modern `_meta` envelope pins the connection to the modern era; `initialize` openings keep the 2025-era protocol unchanged (dual-era serving, `legacy: 'serve'`)
+* Docs: `docs/PROTOCOL-COMPATIBILITY.md` — served eras, negotiation rules, host/client matrix
+
+### Tests
+
+* stdio characterization suite 15 → 24: 9 modern-era tests (discover negotiation, era parity, envelope-claim requirement, `-32022` late-initialize, probe→initialize fallback, modern stdout purity + EOF)
+
+## [1.0.43](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.43) (2026-10-05)
+
+### Breaking Changes
+
+* Node.js >= 20 required (was >= 18)
+
+### Features
+
+* MCP: migrated `@modelcontextprotocol/sdk` v1 → official v2 packages (`@modelcontextprotocol/server` 2.3.0); zero v1 imports remain
+* `sigrank standard --json`: `sigrank/0.1-draft` now correctly labeled `legacy_alias` under TTEOP authority (`tteop-spec@0.1.5-draft`)
+
+### Fixes
+
+* Release workflow: explicit releases only — no auto-publish after CI; real npm OIDC trusted publishing (dead NPM_TOKEN path removed); `--dry-run` + collision pre-gates; `--provenance`
+
+### Tests
+
+* 15-test SDK-agnostic stdio behavior freeze locked identical across v1 → v2 (tools/prompts/resources, error classes, stdout purity, routing, EOF) on Node 20/22/26
+
 ## [1.0.37](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.37) (2026-09-08)
 
 ### Fixes

package/MCP_SERVER_DESCRIPTION.md

@@ -1,6 +1,6 @@
 # SigRank MCP Server
 
-> Operator leaderboard measuring users, not models — 24 tools, TUI, signed submit, privacy-first.
+> Operator leaderboard measuring users, not models — 25 tools, TUI, signed submit, privacy-first.
 
 SigRank is the first leaderboard that ranks **AI operators** — the humans — by token cascade efficiency, not the models. The yield metric (Υ = cache_read × output / input²) turns raw token telemetry into a competitive ranking on [signalaf.com](https://signalaf.com).
 
@@ -64,7 +64,7 @@ npx sigrank diagnose            # Diagnose cascade inefficiencies
 npx sigrank improve             # Get improvement suggestions
 ```
 
-## The 24 MCP Tools
+## The 25 MCP Tools
 
 ### Read-only — pure math (no auth, no filesystem)
 
@@ -81,39 +81,40 @@ npx sigrank improve             # Get improvement suggestions
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 7 | `get_leaderboard` | Fetch the live public leaderboard from signalaf.com. Returns all ranked operators sorted by yield, with codename, Υ, leverage, velocity, class, and rank position. |
-| 8 | `get_operator` | Get any operator's full profile by codename. Returns detailed metrics + per-window breakdowns (7d/30d/90d/all-time) with the four token pillars per window. |
-| 9 | `discover_peers` | Find mentors, peers, and complementary operators for your operator on the leaderboard. |
+| 7 | `get_sigrank_standard_record` | Build the portable `sigrank/0.1-draft` compatibility record (legacy alias under TTEOP authority) from token telemetry. Computes the canonical cascade locally — no network. |
+| 8 | `get_leaderboard` | Fetch the live public leaderboard from signalaf.com. Returns all ranked operators sorted by yield, with codename, Υ, leverage, velocity, class, and rank position. |
+| 9 | `get_operator` | Get any operator's full profile by codename. Returns detailed metrics + per-window breakdowns (7d/30d/90d/all-time) with the four token pillars per window. |
+| 10 | `discover_peers` | Find mentors, peers, and complementary operators for your operator on the leaderboard. |
 
 ### Read-only — local filesystem (no auth, no network)
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 10 | `tokenpull` | Pull your LOCAL token usage from session logs and rank it across all four windows — zero paste. Reads token counts, not message content. Numbers stay on your machine. 17 platform adapters. |
-| 11 | `tokenpull_compare` | Pull token usage from ALL four local sources in parallel (JSONL canon, ccusage CLI, token-dashboard SQLite, tokscale) and compare side-by-side with delta % vs baseline. |
-| 12 | `watch_tokenpull` | One poll per call — pulls local token logs and returns current cascade for the watched window. Re-call at your desired cadence to monitor. With `submit:true`, signs + publishes (rate-limited to once per 5 min). |
+| 11 | `tokenpull` | Pull your LOCAL token usage from session logs and rank it across all four windows — zero paste. Reads token counts, not message content. Numbers stay on your machine. 17 platform adapters. |
+| 12 | `tokenpull_compare` | Pull token usage from ALL four local sources in parallel (JSONL canon, ccusage CLI, token-dashboard SQLite, tokscale) and compare side-by-side with delta % vs baseline. |
+| 13 | `watch_tokenpull` | One poll per call — pulls local token logs and returns current cascade for the watched window. Re-call at your desired cadence to monitor. With `submit:true`, signs + publishes (rate-limited to once per 5 min). |
 
 ### Write — submit to board (needs enrolled identity)
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 13 | `submit_paste` | Ranks a paste of token counts AND publishes to the live board in one call. Computes local preview, then submits to server for authoritative scoring. Returns both local + server results. |
-| 14 | `tokenpull_submit` | Pull your LOCAL token usage AND publish to the board in one call — the zero-paste flow. Reads pillars per window, computes cascade, submits each window server-side. Token-only, no prompt content. |
-| 15 | `submit_verified` | Publish your LOCAL token runs as a VERIFIED operator — the enrolled, signed path. Reads pillars, builds Schema 1.0 snapshot, ed25519-signs with your device key, POSTs to board. Requires `enroll` first. |
-| 16 | `enroll` | Bind THIS device to your SigRank operator. Paste the key from signalaf.com → Settings → "New key". Generates + stores a local ed25519 keypair. Only the PUBLIC key is ever sent. |
+| 14 | `submit_paste` | Ranks a paste of token counts AND publishes to the live board in one call. Computes local preview, then submits to server for authoritative scoring. Returns both local + server results. |
+| 15 | `tokenpull_submit` | Pull your LOCAL token usage AND publish to the board in one call — the zero-paste flow. Reads pillars per window, computes cascade, submits each window server-side. Token-only, no prompt content. |
+| 16 | `submit_verified` | Publish your LOCAL token runs as a VERIFIED operator — the enrolled, signed path. Reads pillars, builds Schema 1.0 snapshot, ed25519-signs with your device key, POSTs to board. Requires `enroll` first. |
+| 17 | `enroll` | Bind THIS device to your SigRank operator. Paste the key from signalaf.com → Settings → "New key". Generates + stores a local ed25519 keypair. Only the PUBLIC key is ever sent. |
 
 ### Tokscale analytics — local tokscale data (no auth, no network)
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 17 | `tokscale_breakdown` | Per-model token breakdown across platforms (models under threshold → "other"). |
-| 18 | `tokscale_market_share` | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data. |
-| 19 | `tokscale_developer_profile` | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted. |
-| 20 | `tokscale_model_trends` | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve. |
-| 21 | `tokscale_cost_analysis` | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup. |
-| 22 | `tokscale_device_profile` | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted. |
-| 23 | `tokscale_mcp_usage` | MCP server usage: detected servers, detection window, active days. |
-| 24 | `tokscale_competitive_intel` | Competitive intelligence for any AI tool: rank, model mix, cost efficiency, share vs all competitors. |
+| 18 | `tokscale_breakdown` | Per-model token breakdown across platforms (models under threshold → "other"). |
+| 19 | `tokscale_market_share` | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data. |
+| 20 | `tokscale_developer_profile` | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted. |
+| 21 | `tokscale_model_trends` | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve. |
+| 22 | `tokscale_cost_analysis` | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup. |
+| 23 | `tokscale_device_profile` | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted. |
+| 24 | `tokscale_mcp_usage` | MCP server usage: detected servers, detection window, active days. |
+| 25 | `tokscale_competitive_intel` | Competitive intelligence for any AI tool: rank, model mix, cost efficiency, share vs all competitors. |
 
 ### Moved to bestuser-router-mcp (5 intent tools)
 
@@ -160,7 +161,7 @@ The intent-based tools (in bestuser-router-mcp) are designed to map natural-lang
 | Transport | stdio |
 | Platform | Cross-platform (Node.js) |
 | Language | JavaScript |
-| Tools | 24 |
+| Tools | 25 |
 | Auth | None for reads; Supabase anon key for submits |
 | Category | Developer Tools |
 

package/README.md

@@ -95,7 +95,7 @@ sigrank submit
 sigrank submit --dry-run
 ```
 
-That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — only the four token counts leave your machine.
+That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — what leaves your machine is limited to the four token pillars plus the identifiers listed under [Privacy](#privacy).
 
 Or just explore without signing in:
 
@@ -303,6 +303,8 @@ Or if installed globally:
 | `tokenpull_submit(codename, window?)` | `{codename?, window?}`                                                           | `tokenpull` → publish to board. Omit codename for preview                                                                                                                  |
 | `tokenpull_compare(platform?)`        | `{platform?}`                                                                    | All four sources side-by-side: tokenpull + ccusage + token-dash + tokscale. Returns pillars, cascade metrics, and delta % vs tokenpull per window                          |
 | `rank_windows`                        | `{platform?, window?}`                                                           | Multi-window cascade from local logs                                                                                                                                       |
+| `get_sigrank_standard_record`         | `{input, output, cache_write?, cache_read?}`                                     | Builds the portable `sigrank/0.1-draft` compatibility record (legacy alias under TTEOP authority) — canonical cascade, computed locally                                   |
+| `discover_peers`                      | `{codename?}`                                                                    | Find mentors, peers, and complementary operators on the leaderboard                                                                                                        |
 | `watch_tokenpull`                     | `{platform?, interval_s?}`                                                       | One cascade snapshot per call (interval_s advisory)                                                                                                                        |
 | `submit_verified`                     | `{window?, platform?, dry_run?}`                                                 | THE ranked path: builds + ed25519-signs Schema 1.0 snapshots and POSTs them. `platform:'multi'` sums all active platforms. `dry_run:true` returns the exact payload unsent |
 | `enroll`                              | `{code, device_label?}`                                                          | Bind this device with a connect code from signalaf.com → Settings                                                                                                          |
@@ -310,20 +312,17 @@ Or if installed globally:
 | `simulate_change`                     | `{text?, changes}`                                                               | Prescriptive "what if" — test proposed pillar changes and see the exact Υ delta + class change before committing                                                           |
 | `suggest_improvements`                | `{text?}`                                                                        | Generates ranked, simulated improvement suggestions — tests strategies and returns them sorted by Υ yield impact                                                           |
 | `self_improve`                        | `{text?}`                                                                        | One-click optimize: diagnoses, suggests, and simulates the best change in a single call                                                                                    |
-| `get_best_operator(n?)`               | `{n?}`                                                                           | Top N operators with behavioral framing in power-user language. Intent: "who is the best AI user?"                                                                         |
-| `compare_self(codename? \| text?)`    | `{codename?}` or `{text?}`                                                       | Your metrics vs board averages + power-user assessment + percentile + suggestion. Intent: "how do I measure up?"                                                           |
-| `compare_operators(a, b)`             | `{codename_a, codename_b}`                                                       | Side-by-side comparison with behavioral verdict. Intent: "compare operator X vs Y"                                                                                         |
-| `describe_power_user()`               | `{}`                                                                             | Static explanation of AI power user archetype + metrics explained. Intent: "what is an AI power user?"                                                                     |
-| `optimize_efficiency(codename? \| text?)` | `{codename?}` or `{text?}`                                                   | Ranked efficiency suggestions tied to your cascade shape. Intent: "how can I use AI more efficiently?"                                                                     |
 | `tokscale_breakdown(threshold?)`       | `{threshold?}`                                                                   | Per-model token breakdown across platforms (models under threshold → "other")                                                                                              |
 | `tokscale_market_share()`              | `{}`                                                                             | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data                                                                              |
-| `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted                             |
+| `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspace count (no names). Paths redacted                             |
 | `tokscale_model_trends()`              | `{}`                                                                             | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve                                                                            |
 | `tokscale_cost_analysis()`             | `{}`                                                                             | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup                                                                        |
 | `tokscale_device_profile()`            | `{}`                                                                             | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted                  |
 | `tokscale_mcp_usage()`                 | `{}`                                                                             | MCP server usage: detected servers, detection window, active days                                                                                                         |
 | `tokscale_competitive_intel(target)`   | `{target}`                                                                       | Competitive intelligence for any AI tool: rank, model mix, cost efficiency, share vs all competitors                                                                      |
 
+Intent tools (`get_best_operator`, `compare_self`, `compare_operators`, `describe_power_user`, `optimize_efficiency`) moved to [bestuser-router-mcp](https://github.com/SunrisesIllNeverSee/bestuser-router-mcp) — `npx bestuser-router-mcp`.
+
 ---
 
 ## Cascade math
@@ -406,6 +405,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 
 ## Privacy
 
+- **Exactly what leaves your machine (signed submit):** the four token pillars (input, output, cache create, cache read) per window, your codename, device id, device public key, ed25519 signature, agent version, platform, message/session counts, and the weekly report block. `enroll` additionally sends a device label, which defaults to `sigrank <version> · <platform>` (your hostname is never sent unless you set `SIGRANK_DEVICE_LABEL` or pass `device_label`). Never sent: prompts, responses, file paths, repo/project names, or environment variables.
+- **MCP safety rails.** The `enroll` tool refuses to re-bind a device that is already enrolled (re-enroll from the CLI), and `submit_verified` requires `confirm: true` to publish (not needed with `dry_run`). `tokscale_developer_profile` returns workspace counts only, never workspace or project names.
 - **Token-only persistence and submission.** Local-log adapters read usage metadata only. The optional proxy necessarily handles provider-bound request and response bytes in memory, but never persists their content; it writes only token counts, model/backend metadata, and timestamps. Only token telemetry is submitted to SigRank SignalAF.
 - **Local by default.** `tokenpull` reads only the selected or detected adapter paths on your device (e.g. `~/.claude/projects` for Claude, `~/.codex` for Codex, plus additional paths for Amp, Devin, Gemini, Goose, and other supported platforms). Numbers stay on your machine unless you explicitly submit with a codename.
 - **Background tooling excluded.** Memory plugins, observers, summarizers (e.g. `claude-mem`, `mem0`, `observer-sessions`) are filtered from both Claude and Codex reads. `subagents/` are kept — they represent real operator work.
@@ -418,7 +419,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 
 | Var                     | Default                | Description                  |
 | ----------------------- | ---------------------- | ---------------------------- |
-| `SIGRANK_API_BASE`      | `https://signalaf.com` | Override the board host      |
+| `SIGRANK_API_BASE`      | `https://signalaf.com` | Override the board host (https required; http only for loopback) |
+| `SIGRANK_DEVICE_LABEL`  | `sigrank <version> · <platform>` | Optional device label sent at enroll |
 | `SIGRANK_FETCH_TIMEOUT` | `10000`                | Board API fetch timeout (ms) |
 
 ---

package/adapters/index.mjs

@@ -1099,6 +1099,8 @@ async function execCcusage(args) {
   if (existsSync(localEntrypoint)) {
     return execFileP(process.execPath, [localEntrypoint, ...args], options);
   }
+  // Fallback only: the bundled (pinned) ccusage above is preferred; this resolves "ccusage"
+  // from PATH when the bundled entrypoint is missing, so a PATH binary is trusted code here.
   return execFileP("ccusage", args, options);
 }
 

package/adapters/tokenpull.mjs

@@ -22,7 +22,10 @@ import { join, dirname, delimiter } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { ADAPTERS, walkFiles } from "./index.mjs";
-import { TOKSCALE_CLIENT_MAP } from "../lib/constants.mjs";
+import {
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "../lib/constants.mjs";
 
 const DAY_MS = 86_400_000;
 
@@ -516,7 +519,11 @@ async function _freshTokendash(platform = "claude") {
 // Now uses execFile (async) so the TUI stays responsive.
 async function _freshTokscale(platform = "claude") {
   try {
-    const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+    const raw = await execFileAsync(
+      "tokscale",
+      ["models", "--json"],
+      TOKSCALE_SCAN_TIMEOUT_MS,
+    );
     const data = JSON.parse(raw);
     const entries = Array.isArray(data?.entries)
       ? data.entries
@@ -557,7 +564,7 @@ async function _freshTokscale(platform = "claude") {
  *
  *   - ccusage  : `ccusage <platform> daily --json`              → 7d/30d/90d/all
  *   - tokendash: refresh + read ~/.claude/token-dashboard.db    → all (claude only)
- *   - tokscale : `bunx tokscale@latest models --json`           → all
+ *   - tokscale : `tokscale models --json` (bundled, pinned)     → all
  */
 export async function freshVerifierPillars(platform = "claude") {
   const p = platform || "claude";

package/identity/keystore.mjs

@@ -61,7 +61,9 @@ export function persistIdentity(identity) {
   if (existsSync(PATH)) {
     try {
       const stamp = Date.now();
-      copyFileSync(PATH, join(DIR, `${BACKUP_PREFIX}${stamp}`));
+      const bakPath = join(DIR, `${BACKUP_PREFIX}${stamp}`);
+      copyFileSync(PATH, bakPath);
+      chmodSync(bakPath, 0o600);
       pruneBackups();
     } catch {
       /* best-effort — don't block the write */

package/lib/constants.mjs

@@ -115,6 +115,18 @@ export const TOKSCALE_CLIENT_MAP = {
  */
 export const TOKSCALE_BLIND_PLATFORMS = [];
 
+/**
+ * Timeout for `tokscale` CLI invocations (models/clients/graph/report scans).
+ * The scan walks every session log on the machine; on heavy machines it runs
+ * ~55–60s and GROWS with log volume, so the old hardcoded 60s ceiling flaked —
+ * the subprocess was killed mid-scan and the caller silently got null
+ * (TUI Compare showed "no data from tokscale"). 180s gives 3x headroom and
+ * stays under tokscale's own nativeTimeoutMs default (300s).
+ * Override via SIGRANK_TOKSCALE_TIMEOUT_MS.
+ */
+export const TOKSCALE_SCAN_TIMEOUT_MS =
+  Number(process.env.SIGRANK_TOKSCALE_TIMEOUT_MS) || 180_000;
+
 /**
  * The "actually on the board" predicate. A submission is ranked only when the
  * server returns HTTP ok AND verification_tier === "verified" AND persisted

package/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/anthropics/mcpb/main/schemas/mcpb-manifest-v0.4.schema.json",
   "manifest_version": "0.4",
   "name": "sigrank",
-  "version": "1.0.43",
+  "version": "1.0.46",
   "description": "Ranks AI coding operators by token cascade efficiency (Yield = cache_read \u00d7 output / input\u00b2). 25 tools including SigRank Standard record, yield calculation, local token usage pulls, signed submission, and tokscale-powered analytics (market share, developer profiles, model trends, cost analysis, device profiles, MCP usage, competitive intelligence). Privacy-first: runs locally, only four token counts leave the machine.",
   "author": {
     "name": "SunrisesIllNeverSee",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "1.0.44",
+  "version": "1.0.46",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "Upsilon measurement engine distributed through the sigrank CLI/MCP compatibility package, with SigRank public leaderboard tools.",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
@@ -81,10 +81,10 @@
     "on-device"
   ],
   "dependencies": {
-    "token-cascade": "^0.2.1",
-    "ccusage": "^20.0.19",
-    "tokscale": "^4.7.0",
-    "@modelcontextprotocol/server": "^2.3.0"
+    "token-cascade": "0.2.1",
+    "ccusage": "20.0.30",
+    "tokscale": "4.18.0",
+    "@modelcontextprotocol/server": "2.3.0"
   },
   "devDependencies": {
     "@resvg/resvg-js": "^2.6.2",

package/presentation/cli.mjs

@@ -29,7 +29,11 @@ import { cascade, classify, CLASS_TIERS, UNCLASSED, tierOf } from "../cascade.mj
 import { ALL_PLATFORMS } from "../adapters.mjs";
 import { ensureIdentity, keystorePath } from "../keystore.mjs";
 import { submitSignedWindow } from "../submit.mjs";
-import { LEADERBOARD_METRIC, TOKSCALE_CLIENT_MAP } from "../lib/constants.mjs";
+import {
+  LEADERBOARD_METRIC,
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "../lib/constants.mjs";
 import { execFile } from "child_process";
 import { existsSync, readFileSync } from "fs";
 import os from "os";
@@ -422,7 +426,11 @@ async function ccusagePillars(platform = "claude") {
 async function tokscalePillars(platform = "claude") {
   // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
   try {
-    const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+    const raw = await execFileAsync(
+      "tokscale",
+      ["models", "--json"],
+      TOKSCALE_SCAN_TIMEOUT_MS,
+    );
     const data = JSON.parse(raw);
     const entries = Array.isArray(data?.entries)
       ? data.entries
@@ -1711,10 +1719,14 @@ async function runEnroll({ label } = {}) {
 
   let out;
   try {
-    out = await callTool("enroll", {
-      code,
-      device_label: typeof label === "string" ? label : undefined,
-    });
+    out = await callTool(
+      "enroll",
+      {
+        code,
+        device_label: typeof label === "string" ? label : undefined,
+      },
+      { allowReenroll: true }, // human at a TTY already consented above
+    );
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`));
     process.exitCode = 1;
@@ -1770,6 +1782,7 @@ async function runSubmit({ platform = "claude", window } = {}) {
       platform,
       window: typeof window === "string" ? window : undefined,
       dry_run: process.argv.includes("--dry-run"),
+      confirm: true, // explicit CLI invocation is the confirmation
     });
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`));

package/presentation/tui.mjs

@@ -1444,7 +1444,7 @@ function renderCompare(data) {
   const missing = [];
   if (!cc) missing.push("ccusage (npm i -g ccusage)");
   if (!td) missing.push("token-dashboard (~/.claude/token-dashboard.db)");
-  if (!ts) missing.push("tokscale (npm i -g tokscale)");
+  if (!ts) missing.push("tokscale (not installed, or scan timed out)");
   if (missing.length)
     for (const ln of wrapDim(`no data from: ${missing.join(" · ")}`)) emit(ln);
   emit();
@@ -2904,7 +2904,7 @@ export async function runTui({
             didMulti = false;
           for (const p of platforms) {
             try {
-              const out = await callTool("submit_verified", { platform: p });
+              const out = await callTool("submit_verified", { platform: p, confirm: true });
               const ws = out.windows || [];
               const received = ws.filter((w) => w.status === "received");
               const verified = received.filter(
@@ -2924,6 +2924,7 @@ export async function runTui({
             try {
               const out = await callTool("submit_verified", {
                 platform: "multi",
+                confirm: true,
               });
               const ws = out.windows || [];
               const received = ws.filter((w) => w.status === "received");

package/proxy.mjs

@@ -311,6 +311,22 @@ export async function startProxy({
   };
 
   const server = http.createServer(async (req, res) => {
+    // DNS-rebinding / CSRF guard: only accept loopback Host headers on our own port, and
+    // refuse browser cross-site requests (Sec-Fetch-Site other than same-origin/none).
+    const hostHeader = String(req.headers.host || "");
+    const hm = /^(127\.0\.0\.1|localhost|\[::1\])(?::(\d+))?$/i.exec(hostHeader);
+    const boundPort = server.address()?.port;
+    const sfs = req.headers["sec-fetch-site"];
+    if (
+      !hm ||
+      (boundPort && Number(hm[2] || 80) !== boundPort) ||
+      (sfs !== undefined && sfs !== "same-origin" && sfs !== "none")
+    ) {
+      res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+      res.end("Forbidden\n");
+      req.resume();
+      return;
+    }
     let parsedUrl;
     try {
       parsedUrl = new URL(req.url || "/", `http://${req.headers.host || host}`);

package/resources/privacy-model.md

@@ -2,13 +2,15 @@
 
 ## What leaves your machine
 
-**Every submission path sends only four numbers:**
+**The usage content of every submission is four numbers:**
 - Input tokens
 - Output tokens
 - Cache create tokens
 - Cache read tokens
 
-That's the entire payload — no prompts, no code, no file contents, no conversation text. The MCP parses your input locally and sends only the four token counts to the server, which re-parses and re-scores them authoritatively.
+The signed path additionally carries: codename, device id, device public key, ed25519 signature, agent version, platform, message/session counts, and the weekly report block. `enroll` sends a device label (default `sigrank <version> · <platform>`; your hostname is not sent unless you set `SIGRANK_DEVICE_LABEL` or pass `device_label` yourself).
+
+Never sent: prompts, responses, code, file contents, file paths, repo or project names, or environment variables. The server re-parses and re-scores the pillars authoritatively.
 
 The optional `sigrank proxy` is a local Upsilon transport path to Anthropic/OpenAI, not a
 submission path to the SigRank leaderboard. When explicitly enabled, it necessarily receives and
@@ -32,8 +34,9 @@ only provider-reported token counts, model/backend metadata, and timestamps to
 - Your prompts or messages
 - Your code or file contents
 - Your tool calls or their results
-- Which AI platform you use (beyond token counts)
-- Your identity (only your chosen codename)
+- Your hostname (unless you opt in via a device label)
+- File paths, repo/project names, or environment variables
+- Your identity (only your chosen codename; the platform name, agent version, and message/session counts are sent)
 
 The local proxy process is different from the Upsilon service: if you opt in, it
 handles your provider traffic in memory solely to forward it to Anthropic or

package/tokscale_analytics.mjs

@@ -33,7 +33,10 @@ import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { TOKSCALE_CLIENT_MAP } from "./lib/constants.mjs";
+import {
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "./lib/constants.mjs";
 
 // Resolve local node_modules/.bin for the bundled tokscale binary.
 const _pkgRoot = path.dirname(fileURLToPath(import.meta.url));
@@ -61,13 +64,14 @@ function execFileAsync(cmd, args, timeoutMs) {
   });
 }
 
-// tokscale subcommand timeouts. `models` is fast (~5s); `graph` and `report`
-// walk every session log and can take ~30s on a heavy machine. 60s ceiling.
-const T_MODELS = 60_000;
-const T_MONTHLY = 60_000;
-const T_CLIENTS = 30_000;
-const T_GRAPH = 60_000;
-const T_REPORT = 60_000;
+// tokscale subcommand timeouts. `models`/`clients`/`graph`/`report` all walk the
+// session logs — on a heavy machine the scan runs ~55-60s and grows with log
+// volume, so they share TOKSCALE_SCAN_TIMEOUT_MS (was a flat 60s that flaked).
+const T_MODELS = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_MONTHLY = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_CLIENTS = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_GRAPH = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_REPORT = TOKSCALE_SCAN_TIMEOUT_MS;
 
 const HOME = os.homedir();
 
@@ -352,7 +356,6 @@ export async function tokscaleDeveloperProfile() {
       sessions_path_exists: c.sessions_path_exists ?? null,
       headless_supported: c.headless_supported ?? null,
       workspace_count: c.workspaces.size,
-      workspaces: [...c.workspaces].sort(),
       models: c.models,
     };
   });

package/tools/_helpers.mjs

@@ -32,6 +32,8 @@ const ALLOWED_API_HOSTS = new Set([
   "sigeconomy.com",
   "localhost",
   "127.0.0.1",
+  "::1",
+  "[::1]",
   "test.local", // test fixtures only
 ]);
 
@@ -42,6 +44,10 @@ export function validateApiBase(urlStr) {
     if (!ALLOWED_API_HOSTS.has(u.hostname)) {
       throw new Error(`Blocked: API host '${u.hostname}' is not in the allowlist`);
     }
+    const loopback = ["localhost", "127.0.0.1", "::1", "[::1]", "test.local"].includes(u.hostname);
+    if (u.protocol !== "https:" && !(loopback && u.protocol === "http:")) {
+      throw new Error(`Blocked: API base must use https (http only for loopback): ${u.protocol}//${u.hostname}`);
+    }
     return urlStr;
   } catch (e) {
     if (e.message.startsWith("Blocked:")) throw e;

package/tools/_verifiers.mjs

@@ -10,6 +10,7 @@ import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { execFileAsync } from "./_helpers.mjs";
+import { TOKSCALE_SCAN_TIMEOUT_MS } from "../lib/constants.mjs";
 
 async function _ccusagePillars(platform = "claude") {
   try {
@@ -87,7 +88,11 @@ async function _tokenDashPillars() {
 async function _tokscalePillars(platform = "claude") {
   // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
   try {
-    const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+    const raw = await execFileAsync(
+      "tokscale",
+      ["models", "--json"],
+      TOKSCALE_SCAN_TIMEOUT_MS,
+    );
     const data = JSON.parse(raw);
     const entries = Array.isArray(data?.entries)
       ? data.entries

package/tools/enroll.mjs

@@ -2,7 +2,6 @@
  * tools/enroll.mjs — enroll tool.
  */
 
-import os from "node:os";
 import { ensureIdentity, recordEnrollment } from "../identity/keystore.mjs";
 import { ENROLL_OUTPUT, ANNOTATIONS } from "./_schemas.mjs";
 import { TERMS_VERSION, PRIVACY_VERSION } from "../lib/constants.mjs";
@@ -28,7 +27,7 @@ export const TOOL_DEF = {
       device_label: {
         type: "string",
         description:
-          "optional label for this device (default: hostname · agent version)",
+          "optional label for this device (default: sigrank <version> · <platform>; hostnames are never sent unless you pass a label yourself)",
       },
     },
     required: ["code"],
@@ -45,8 +44,23 @@ export async function handleEnroll(args, ctx) {
       "enroll requires a `code` — paste your connect code from signalaf.com → Settings → Connect a device.",
     );
   const id = ctx.opts.identity || ensureIdentity();
+  // Re-enroll guard: a model-invoked MCP call must never silently re-bind a device that
+  // already has an operator. The human CLI/TUI path sets opts.allowReenroll after its own
+  // explicit consent prompt.
+  if (id.codename && !ctx.opts.allowReenroll) {
+    return {
+      status: "already_enrolled",
+      codename: id.codename,
+      operator_id: id.operator_id ?? null,
+      device_id: id.device_id,
+      detail:
+        "This device is already enrolled. To re-enroll, run `npx sigrank enroll` in a terminal yourself; the MCP tool will not re-bind an enrolled device.",
+    };
+  }
   const deviceLabel = String(
-    args?.device_label || `${os.hostname()} · ${id.agent_version}`,
+    args?.device_label ||
+      process.env.SIGRANK_DEVICE_LABEL ||
+      `sigrank ${id.agent_version} · ${process.platform}`,
   ).slice(0, 120);
   const res = await ctx.doFetch(`${ctx.apiBase}/api/v1/devices/enroll`, {
     method: "POST",

package/tools/index.mjs

@@ -12,6 +12,7 @@ import { buildFetch, DEFAULT_API_BASE, DEFAULT_FETCH_TIMEOUT } from "./_helpers.
 import {
   TOKSCALE_CLIENT_MAP,
   TOKSCALE_BLIND_PLATFORMS,
+  TOKSCALE_SCAN_TIMEOUT_MS,
 } from "../lib/constants.mjs";
 
 import { TOOL_DEF as rankPasteTool, handleRankPaste } from "./rank-paste.mjs";
@@ -83,7 +84,11 @@ export const TOOLS = [
 
 /** Run `tokscale models --json` and return the list of our platform names. */
 async function _tokscaleDetectClients() {
-  const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+  const raw = await execFileAsync(
+    "tokscale",
+    ["models", "--json"],
+    TOKSCALE_SCAN_TIMEOUT_MS,
+  );
   const data = JSON.parse(raw);
   const entries = Array.isArray(data?.entries)
     ? data.entries

package/tools/submit-verified.mjs

@@ -12,7 +12,7 @@ import { _computeReportBlock } from "./_report.mjs";
 export const TOOL_DEF = {
   name: "submit_verified",
   description:
-    "Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Pass dry_run:true to inspect the exact signed payload without publishing.",
+    "Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Publishing requires `confirm: true` (ask the user first); pass dry_run:true to inspect the exact signed payload without publishing and without confirm.",
   annotations: {
     title: "Submit verified score",
     ...ANNOTATIONS.destructiveHint,
@@ -33,6 +33,11 @@ export const TOOL_DEF = {
         description:
           "source platform (default: claude). 'multi' = combined cascade summed across all locally-detected platforms (needs 2+ active); empty windows are skipped.",
       },
+      confirm: {
+        type: "boolean",
+        description:
+          "REQUIRED to publish: must be true, set only after the user has explicitly approved submitting. Not needed with dry_run:true.",
+      },
       dry_run: {
         type: "boolean",
         description:
@@ -52,6 +57,13 @@ export async function handleSubmitVerified(args, ctx) {
       detail: "Run `npx sigrank-mcp enroll` to bind this device first.",
     };
   }
+  if (!args?.dry_run && args?.confirm !== true) {
+    return {
+      status: "confirmation_required",
+      detail:
+        "submit_verified publishes to the public board. Ask the user for approval, then call again with confirm: true (or use dry_run: true to preview).",
+    };
+  }
   const platform = args?.platform || "claude";
 
   // MULTI: the combined cross-platform cascade. The dashboard already SUMS every

package/tools/tokscale-breakdown.mjs

@@ -4,7 +4,10 @@
 
 import { execFileAsync } from "./_helpers.mjs";
 import { ANNOTATIONS } from "./_schemas.mjs";
-import { TOKSCALE_CLIENT_MAP } from "../lib/constants.mjs";
+import {
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "../lib/constants.mjs";
 
 export const TOOL_DEF = {
   name: "tokscale_breakdown",
@@ -47,7 +50,11 @@ export const TOOL_DEF = {
  * Returns: { platform: [{ model, input, output, cacheRead, cacheCreate, pct }] }
  */
 export async function tokscaleModelBreakdown(threshold = 0.01) {
-  const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+  const raw = await execFileAsync(
+    "tokscale",
+    ["models", "--json"],
+    TOKSCALE_SCAN_TIMEOUT_MS,
+  );
   const data = JSON.parse(raw);
   const entries = Array.isArray(data?.entries)
     ? data.entries

package/tools/tokscale-developer-profile.mjs

@@ -20,7 +20,7 @@ export const TOOL_DEF = {
     properties: {
       tools: {
         type: "array",
-        description: "Per-tool profile with model mix, token pillars, session counts, workspaces",
+        description: "Per-tool profile with model mix, token pillars, session counts, workspace count",
       },
       summary: {
         type: "object",