sigrank 1.0.45 → 1.0.46

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.0.46
+
+### Security / privacy
+
+* `enroll`: device label no longer defaults to the OS hostname; default is `sigrank <version> · <platform>` (opt-in override: `device_label` arg or `SIGRANK_DEVICE_LABEL`)
+* `enroll` (MCP): refuses to re-bind an already-enrolled device; re-enroll from the CLI
+* `submit_verified`: requires `confirm: true` to publish (not for `dry_run`); CLI/TUI pass it after their own consent
+* `tokscale_developer_profile`: returns `workspace_count` only, no workspace/project names
+* `validateApiBase`: https required except loopback hosts
+* Pinned `ccusage` 20.0.30 and `tokscale` 4.18.0 exactly; removed stale `tokscale@latest` comment
+* Proxy: rejects non-loopback Host headers and cross-site browser requests (403)
+* Keystore: identity backups chmod 0600
+* README / privacy-model corrected to list exactly what leaves the machine
+
 ## [1.0.44](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.44) (2026-10-05)
 
 ### Features

package/README.md

@@ -95,7 +95,7 @@ sigrank submit
 sigrank submit --dry-run
 ```
 
-That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — only the four token counts leave your machine.
+That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — what leaves your machine is limited to the four token pillars plus the identifiers listed under [Privacy](#privacy).
 
 Or just explore without signing in:
 
@@ -314,7 +314,7 @@ Or if installed globally:
 | `self_improve`                        | `{text?}`                                                                        | One-click optimize: diagnoses, suggests, and simulates the best change in a single call                                                                                    |
 | `tokscale_breakdown(threshold?)`       | `{threshold?}`                                                                   | Per-model token breakdown across platforms (models under threshold → "other")                                                                                              |
 | `tokscale_market_share()`              | `{}`                                                                             | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data                                                                              |
-| `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted                             |
+| `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspace count (no names). Paths redacted                             |
 | `tokscale_model_trends()`              | `{}`                                                                             | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve                                                                            |
 | `tokscale_cost_analysis()`             | `{}`                                                                             | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup                                                                        |
 | `tokscale_device_profile()`            | `{}`                                                                             | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted                  |
@@ -405,6 +405,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 
 ## Privacy
 
+- **Exactly what leaves your machine (signed submit):** the four token pillars (input, output, cache create, cache read) per window, your codename, device id, device public key, ed25519 signature, agent version, platform, message/session counts, and the weekly report block. `enroll` additionally sends a device label, which defaults to `sigrank <version> · <platform>` (your hostname is never sent unless you set `SIGRANK_DEVICE_LABEL` or pass `device_label`). Never sent: prompts, responses, file paths, repo/project names, or environment variables.
+- **MCP safety rails.** The `enroll` tool refuses to re-bind a device that is already enrolled (re-enroll from the CLI), and `submit_verified` requires `confirm: true` to publish (not needed with `dry_run`). `tokscale_developer_profile` returns workspace counts only, never workspace or project names.
 - **Token-only persistence and submission.** Local-log adapters read usage metadata only. The optional proxy necessarily handles provider-bound request and response bytes in memory, but never persists their content; it writes only token counts, model/backend metadata, and timestamps. Only token telemetry is submitted to SigRank SignalAF.
 - **Local by default.** `tokenpull` reads only the selected or detected adapter paths on your device (e.g. `~/.claude/projects` for Claude, `~/.codex` for Codex, plus additional paths for Amp, Devin, Gemini, Goose, and other supported platforms). Numbers stay on your machine unless you explicitly submit with a codename.
 - **Background tooling excluded.** Memory plugins, observers, summarizers (e.g. `claude-mem`, `mem0`, `observer-sessions`) are filtered from both Claude and Codex reads. `subagents/` are kept — they represent real operator work.
@@ -417,7 +419,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 
 | Var                     | Default                | Description                  |
 | ----------------------- | ---------------------- | ---------------------------- |
-| `SIGRANK_API_BASE`      | `https://signalaf.com` | Override the board host      |
+| `SIGRANK_API_BASE`      | `https://signalaf.com` | Override the board host (https required; http only for loopback) |
+| `SIGRANK_DEVICE_LABEL`  | `sigrank <version> · <platform>` | Optional device label sent at enroll |
 | `SIGRANK_FETCH_TIMEOUT` | `10000`                | Board API fetch timeout (ms) |
 
 ---

package/adapters/index.mjs

@@ -1099,6 +1099,8 @@ async function execCcusage(args) {
   if (existsSync(localEntrypoint)) {
     return execFileP(process.execPath, [localEntrypoint, ...args], options);
   }
+  // Fallback only: the bundled (pinned) ccusage above is preferred; this resolves "ccusage"
+  // from PATH when the bundled entrypoint is missing, so a PATH binary is trusted code here.
   return execFileP("ccusage", args, options);
 }
 

package/adapters/tokenpull.mjs

@@ -564,7 +564,7 @@ async function _freshTokscale(platform = "claude") {
  *
  *   - ccusage  : `ccusage <platform> daily --json`              → 7d/30d/90d/all
  *   - tokendash: refresh + read ~/.claude/token-dashboard.db    → all (claude only)
- *   - tokscale : `bunx tokscale@latest models --json`           → all
+ *   - tokscale : `tokscale models --json` (bundled, pinned)     → all
  */
 export async function freshVerifierPillars(platform = "claude") {
   const p = platform || "claude";

package/identity/keystore.mjs

@@ -61,7 +61,9 @@ export function persistIdentity(identity) {
   if (existsSync(PATH)) {
     try {
       const stamp = Date.now();
-      copyFileSync(PATH, join(DIR, `${BACKUP_PREFIX}${stamp}`));
+      const bakPath = join(DIR, `${BACKUP_PREFIX}${stamp}`);
+      copyFileSync(PATH, bakPath);
+      chmodSync(bakPath, 0o600);
       pruneBackups();
     } catch {
       /* best-effort — don't block the write */

package/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/anthropics/mcpb/main/schemas/mcpb-manifest-v0.4.schema.json",
   "manifest_version": "0.4",
   "name": "sigrank",
-  "version": "1.0.45",
+  "version": "1.0.46",
   "description": "Ranks AI coding operators by token cascade efficiency (Yield = cache_read \u00d7 output / input\u00b2). 25 tools including SigRank Standard record, yield calculation, local token usage pulls, signed submission, and tokscale-powered analytics (market share, developer profiles, model trends, cost analysis, device profiles, MCP usage, competitive intelligence). Privacy-first: runs locally, only four token counts leave the machine.",
   "author": {
     "name": "SunrisesIllNeverSee",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "1.0.45",
+  "version": "1.0.46",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "Upsilon measurement engine distributed through the sigrank CLI/MCP compatibility package, with SigRank public leaderboard tools.",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
@@ -82,8 +82,8 @@
   ],
   "dependencies": {
     "token-cascade": "0.2.1",
-    "ccusage": "^20.0.19",
-    "tokscale": "^4.7.0",
+    "ccusage": "20.0.30",
+    "tokscale": "4.18.0",
     "@modelcontextprotocol/server": "2.3.0"
   },
   "devDependencies": {

package/presentation/cli.mjs

@@ -1719,10 +1719,14 @@ async function runEnroll({ label } = {}) {
 
   let out;
   try {
-    out = await callTool("enroll", {
-      code,
-      device_label: typeof label === "string" ? label : undefined,
-    });
+    out = await callTool(
+      "enroll",
+      {
+        code,
+        device_label: typeof label === "string" ? label : undefined,
+      },
+      { allowReenroll: true }, // human at a TTY already consented above
+    );
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`));
     process.exitCode = 1;
@@ -1778,6 +1782,7 @@ async function runSubmit({ platform = "claude", window } = {}) {
       platform,
       window: typeof window === "string" ? window : undefined,
       dry_run: process.argv.includes("--dry-run"),
+      confirm: true, // explicit CLI invocation is the confirmation
     });
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`));

package/presentation/tui.mjs

@@ -2904,7 +2904,7 @@ export async function runTui({
             didMulti = false;
           for (const p of platforms) {
             try {
-              const out = await callTool("submit_verified", { platform: p });
+              const out = await callTool("submit_verified", { platform: p, confirm: true });
               const ws = out.windows || [];
               const received = ws.filter((w) => w.status === "received");
               const verified = received.filter(
@@ -2924,6 +2924,7 @@ export async function runTui({
             try {
               const out = await callTool("submit_verified", {
                 platform: "multi",
+                confirm: true,
               });
               const ws = out.windows || [];
               const received = ws.filter((w) => w.status === "received");

package/proxy.mjs

@@ -311,6 +311,22 @@ export async function startProxy({
   };
 
   const server = http.createServer(async (req, res) => {
+    // DNS-rebinding / CSRF guard: only accept loopback Host headers on our own port, and
+    // refuse browser cross-site requests (Sec-Fetch-Site other than same-origin/none).
+    const hostHeader = String(req.headers.host || "");
+    const hm = /^(127\.0\.0\.1|localhost|\[::1\])(?::(\d+))?$/i.exec(hostHeader);
+    const boundPort = server.address()?.port;
+    const sfs = req.headers["sec-fetch-site"];
+    if (
+      !hm ||
+      (boundPort && Number(hm[2] || 80) !== boundPort) ||
+      (sfs !== undefined && sfs !== "same-origin" && sfs !== "none")
+    ) {
+      res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+      res.end("Forbidden\n");
+      req.resume();
+      return;
+    }
     let parsedUrl;
     try {
       parsedUrl = new URL(req.url || "/", `http://${req.headers.host || host}`);

package/resources/privacy-model.md

@@ -2,13 +2,15 @@
 
 ## What leaves your machine
 
-**Every submission path sends only four numbers:**
+**The usage content of every submission is four numbers:**
 - Input tokens
 - Output tokens
 - Cache create tokens
 - Cache read tokens
 
-That's the entire payload — no prompts, no code, no file contents, no conversation text. The MCP parses your input locally and sends only the four token counts to the server, which re-parses and re-scores them authoritatively.
+The signed path additionally carries: codename, device id, device public key, ed25519 signature, agent version, platform, message/session counts, and the weekly report block. `enroll` sends a device label (default `sigrank <version> · <platform>`; your hostname is not sent unless you set `SIGRANK_DEVICE_LABEL` or pass `device_label` yourself).
+
+Never sent: prompts, responses, code, file contents, file paths, repo or project names, or environment variables. The server re-parses and re-scores the pillars authoritatively.
 
 The optional `sigrank proxy` is a local Upsilon transport path to Anthropic/OpenAI, not a
 submission path to the SigRank leaderboard. When explicitly enabled, it necessarily receives and
@@ -32,8 +34,9 @@ only provider-reported token counts, model/backend metadata, and timestamps to
 - Your prompts or messages
 - Your code or file contents
 - Your tool calls or their results
-- Which AI platform you use (beyond token counts)
-- Your identity (only your chosen codename)
+- Your hostname (unless you opt in via a device label)
+- File paths, repo/project names, or environment variables
+- Your identity (only your chosen codename; the platform name, agent version, and message/session counts are sent)
 
 The local proxy process is different from the Upsilon service: if you opt in, it
 handles your provider traffic in memory solely to forward it to Anthropic or

package/tokscale_analytics.mjs

@@ -356,7 +356,6 @@ export async function tokscaleDeveloperProfile() {
       sessions_path_exists: c.sessions_path_exists ?? null,
       headless_supported: c.headless_supported ?? null,
       workspace_count: c.workspaces.size,
-      workspaces: [...c.workspaces].sort(),
       models: c.models,
     };
   });

package/tools/_helpers.mjs

@@ -32,6 +32,8 @@ const ALLOWED_API_HOSTS = new Set([
   "sigeconomy.com",
   "localhost",
   "127.0.0.1",
+  "::1",
+  "[::1]",
   "test.local", // test fixtures only
 ]);
 
@@ -42,6 +44,10 @@ export function validateApiBase(urlStr) {
     if (!ALLOWED_API_HOSTS.has(u.hostname)) {
       throw new Error(`Blocked: API host '${u.hostname}' is not in the allowlist`);
     }
+    const loopback = ["localhost", "127.0.0.1", "::1", "[::1]", "test.local"].includes(u.hostname);
+    if (u.protocol !== "https:" && !(loopback && u.protocol === "http:")) {
+      throw new Error(`Blocked: API base must use https (http only for loopback): ${u.protocol}//${u.hostname}`);
+    }
     return urlStr;
   } catch (e) {
     if (e.message.startsWith("Blocked:")) throw e;

package/tools/enroll.mjs

@@ -2,7 +2,6 @@
  * tools/enroll.mjs — enroll tool.
  */
 
-import os from "node:os";
 import { ensureIdentity, recordEnrollment } from "../identity/keystore.mjs";
 import { ENROLL_OUTPUT, ANNOTATIONS } from "./_schemas.mjs";
 import { TERMS_VERSION, PRIVACY_VERSION } from "../lib/constants.mjs";
@@ -28,7 +27,7 @@ export const TOOL_DEF = {
       device_label: {
         type: "string",
         description:
-          "optional label for this device (default: hostname · agent version)",
+          "optional label for this device (default: sigrank <version> · <platform>; hostnames are never sent unless you pass a label yourself)",
       },
     },
     required: ["code"],
@@ -45,8 +44,23 @@ export async function handleEnroll(args, ctx) {
       "enroll requires a `code` — paste your connect code from signalaf.com → Settings → Connect a device.",
     );
   const id = ctx.opts.identity || ensureIdentity();
+  // Re-enroll guard: a model-invoked MCP call must never silently re-bind a device that
+  // already has an operator. The human CLI/TUI path sets opts.allowReenroll after its own
+  // explicit consent prompt.
+  if (id.codename && !ctx.opts.allowReenroll) {
+    return {
+      status: "already_enrolled",
+      codename: id.codename,
+      operator_id: id.operator_id ?? null,
+      device_id: id.device_id,
+      detail:
+        "This device is already enrolled. To re-enroll, run `npx sigrank enroll` in a terminal yourself; the MCP tool will not re-bind an enrolled device.",
+    };
+  }
   const deviceLabel = String(
-    args?.device_label || `${os.hostname()} · ${id.agent_version}`,
+    args?.device_label ||
+      process.env.SIGRANK_DEVICE_LABEL ||
+      `sigrank ${id.agent_version} · ${process.platform}`,
   ).slice(0, 120);
   const res = await ctx.doFetch(`${ctx.apiBase}/api/v1/devices/enroll`, {
     method: "POST",

package/tools/submit-verified.mjs

@@ -12,7 +12,7 @@ import { _computeReportBlock } from "./_report.mjs";
 export const TOOL_DEF = {
   name: "submit_verified",
   description:
-    "Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Pass dry_run:true to inspect the exact signed payload without publishing.",
+    "Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Publishing requires `confirm: true` (ask the user first); pass dry_run:true to inspect the exact signed payload without publishing and without confirm.",
   annotations: {
     title: "Submit verified score",
     ...ANNOTATIONS.destructiveHint,
@@ -33,6 +33,11 @@ export const TOOL_DEF = {
         description:
           "source platform (default: claude). 'multi' = combined cascade summed across all locally-detected platforms (needs 2+ active); empty windows are skipped.",
       },
+      confirm: {
+        type: "boolean",
+        description:
+          "REQUIRED to publish: must be true, set only after the user has explicitly approved submitting. Not needed with dry_run:true.",
+      },
       dry_run: {
         type: "boolean",
         description:
@@ -52,6 +57,13 @@ export async function handleSubmitVerified(args, ctx) {
       detail: "Run `npx sigrank-mcp enroll` to bind this device first.",
     };
   }
+  if (!args?.dry_run && args?.confirm !== true) {
+    return {
+      status: "confirmation_required",
+      detail:
+        "submit_verified publishes to the public board. Ask the user for approval, then call again with confirm: true (or use dry_run: true to preview).",
+    };
+  }
   const platform = args?.platform || "claude";
 
   // MULTI: the combined cross-platform cascade. The dashboard already SUMS every

package/tools/tokscale-developer-profile.mjs

@@ -20,7 +20,7 @@ export const TOOL_DEF = {
     properties: {
       tools: {
         type: "array",
-        description: "Per-tool profile with model mix, token pillars, session counts, workspaces",
+        description: "Per-tool profile with model mix, token pillars, session counts, workspace count",
       },
       summary: {
         type: "object",