sigrank 1.0.45 → 1.0.47

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## Unreleased
+
+### TUI
+
+* Dashboard identity block: build archetype (pixel glyph + name), Υ, operating ratio and class for your combined all-time cascade; one-line form on small terminals
+* Cascade table: Build (archetype) column per window on wide terminals; note when 7d/30d/90d are identical because no activity was logged between 7 and 90 days ago
+* Four Degrees: values match signalaf.com/wiki/four-degrees; "Your Read" and the Top column no longer compare you against your own all-time numbers; new "Where you sit" Υ line
+* Submit preview ([S]): shows every stat that will be sent per platform × window (token pillars, messages, mode, health, badges) plus what the board derives (Υ, op ratio, class, archetype), including the combined multi submission; [P] pages platforms
+* Board: [U] toggles all submissions ↔ best row per operator; large Υ shown as M/B; spaced operating ratios
+* Trends: unimplemented metrics folded into one "coming later" line; compact op ratio on narrow terminals
+* Compare: source checklist (found / how to install) instead of a wall of text; sections render whole or not at all
+* Narrow windows: footer hints wrap/compact instead of being cut off; tab bar sheds the clock/site/version before overflowing; terminal-cell-accurate widths; cut lines end in "…"; sections that don't fit are listed on a "▾ … below" line
+* Platform colors follow brand colors (Claude orange, OpenAI green, Google blue/green, Devin blue, Copilot/Qwen purple, Kilo yellow, xAI silver, OpenClaw red)
+
+## 1.0.46
+
+### Security / privacy
+
+* `enroll`: device label no longer defaults to the OS hostname; default is `sigrank <version> · <platform>` (opt-in override: `device_label` arg or `SIGRANK_DEVICE_LABEL`)
+* `enroll` (MCP): refuses to re-bind an already-enrolled device; re-enroll from the CLI
+* `submit_verified`: requires `confirm: true` to publish (not for `dry_run`); CLI/TUI pass it after their own consent
+* `tokscale_developer_profile`: returns `workspace_count` only, no workspace/project names
+* `validateApiBase`: https required except loopback hosts
+* Pinned `ccusage` 20.0.30 and `tokscale` 4.18.0 exactly; removed stale `tokscale@latest` comment
+* Proxy: rejects non-loopback Host headers and cross-site browser requests (403)
+* Keystore: identity backups chmod 0600
+* README / privacy-model corrected to list exactly what leaves the machine
+
 ## [1.0.44](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.44) (2026-10-05)
 
 ### Features

package/README.md

@@ -95,7 +95,7 @@ sigrank submit
 sigrank submit --dry-run
 ```
 
-That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — only the four token counts leave your machine.
+That's it. sigrank reads your local AI session logs on-device, derives your token cascade (Υ Yield, Leverage, Velocity, 10xDEV), and publishes to [signalaf.com](https://signalaf.com). No paste, no transcript content — what leaves your machine is limited to the four token pillars plus the identifiers listed under [Privacy](#privacy).
 
 Or just explore without signing in:
 
@@ -314,7 +314,7 @@ Or if installed globally:
 | `self_improve`                        | `{text?}`                                                                        | One-click optimize: diagnoses, suggests, and simulates the best change in a single call                                                                                    |
 | `tokscale_breakdown(threshold?)`       | `{threshold?}`                                                                   | Per-model token breakdown across platforms (models under threshold → "other")                                                                                              |
 | `tokscale_market_share()`              | `{}`                                                                             | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data                                                                              |
-| `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted                             |
+| `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspace count (no names). Paths redacted                             |
 | `tokscale_model_trends()`              | `{}`                                                                             | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve                                                                            |
 | `tokscale_cost_analysis()`             | `{}`                                                                             | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup                                                                        |
 | `tokscale_device_profile()`            | `{}`                                                                             | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted                  |
@@ -405,6 +405,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 
 ## Privacy
 
+- **Exactly what leaves your machine (signed submit):** the four token pillars (input, output, cache create, cache read) per window, your codename, device id, device public key, ed25519 signature, agent version, platform, message/session counts, and the weekly report block. `enroll` additionally sends a device label, which defaults to `sigrank <version> · <platform>` (your hostname is never sent unless you set `SIGRANK_DEVICE_LABEL` or pass `device_label`). Never sent: prompts, responses, file paths, repo/project names, or environment variables.
+- **MCP safety rails.** The `enroll` tool refuses to re-bind a device that is already enrolled (re-enroll from the CLI), and `submit_verified` requires `confirm: true` to publish (not needed with `dry_run`). `tokscale_developer_profile` returns workspace counts only, never workspace or project names.
 - **Token-only persistence and submission.** Local-log adapters read usage metadata only. The optional proxy necessarily handles provider-bound request and response bytes in memory, but never persists their content; it writes only token counts, model/backend metadata, and timestamps. Only token telemetry is submitted to SigRank SignalAF.
 - **Local by default.** `tokenpull` reads only the selected or detected adapter paths on your device (e.g. `~/.claude/projects` for Claude, `~/.codex` for Codex, plus additional paths for Amp, Devin, Gemini, Goose, and other supported platforms). Numbers stay on your machine unless you explicitly submit with a codename.
 - **Background tooling excluded.** Memory plugins, observers, summarizers (e.g. `claude-mem`, `mem0`, `observer-sessions`) are filtered from both Claude and Codex reads. `subagents/` are kept — they represent real operator work.
@@ -417,7 +419,8 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 
 | Var                     | Default                | Description                  |
 | ----------------------- | ---------------------- | ---------------------------- |
-| `SIGRANK_API_BASE`      | `https://signalaf.com` | Override the board host      |
+| `SIGRANK_API_BASE`      | `https://signalaf.com` | Override the board host (https required; http only for loopback) |
+| `SIGRANK_DEVICE_LABEL`  | `sigrank <version> · <platform>` | Optional device label sent at enroll |
 | `SIGRANK_FETCH_TIMEOUT` | `10000`                | Board API fetch timeout (ms) |
 
 ---

package/adapters/index.mjs

@@ -1099,6 +1099,8 @@ async function execCcusage(args) {
   if (existsSync(localEntrypoint)) {
     return execFileP(process.execPath, [localEntrypoint, ...args], options);
   }
+  // Fallback only: the bundled (pinned) ccusage above is preferred; this resolves "ccusage"
+  // from PATH when the bundled entrypoint is missing, so a PATH binary is trusted code here.
   return execFileP("ccusage", args, options);
 }
 

package/adapters/tokenpull.mjs

@@ -564,7 +564,7 @@ async function _freshTokscale(platform = "claude") {
  *
  *   - ccusage  : `ccusage <platform> daily --json`              → 7d/30d/90d/all
  *   - tokendash: refresh + read ~/.claude/token-dashboard.db    → all (claude only)
- *   - tokscale : `bunx tokscale@latest models --json`           → all
+ *   - tokscale : `tokscale models --json` (bundled, pinned)     → all
  */
 export async function freshVerifierPillars(platform = "claude") {
   const p = platform || "claude";

package/identity/keystore.mjs

@@ -61,7 +61,9 @@ export function persistIdentity(identity) {
   if (existsSync(PATH)) {
     try {
       const stamp = Date.now();
-      copyFileSync(PATH, join(DIR, `${BACKUP_PREFIX}${stamp}`));
+      const bakPath = join(DIR, `${BACKUP_PREFIX}${stamp}`);
+      copyFileSync(PATH, bakPath);
+      chmodSync(bakPath, 0o600);
       pruneBackups();
     } catch {
       /* best-effort — don't block the write */

package/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/anthropics/mcpb/main/schemas/mcpb-manifest-v0.4.schema.json",
   "manifest_version": "0.4",
   "name": "sigrank",
-  "version": "1.0.45",
+  "version": "1.0.47",
   "description": "Ranks AI coding operators by token cascade efficiency (Yield = cache_read \u00d7 output / input\u00b2). 25 tools including SigRank Standard record, yield calculation, local token usage pulls, signed submission, and tokscale-powered analytics (market share, developer profiles, model trends, cost analysis, device profiles, MCP usage, competitive intelligence). Privacy-first: runs locally, only four token counts leave the machine.",
   "author": {
     "name": "SunrisesIllNeverSee",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "1.0.45",
+  "version": "1.0.47",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "Upsilon measurement engine distributed through the sigrank CLI/MCP compatibility package, with SigRank public leaderboard tools.",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
@@ -82,8 +82,8 @@
   ],
   "dependencies": {
     "token-cascade": "0.2.1",
-    "ccusage": "^20.0.19",
-    "tokscale": "^4.7.0",
+    "ccusage": "20.0.30",
+    "tokscale": "4.18.0",
     "@modelcontextprotocol/server": "2.3.0"
   },
   "devDependencies": {

package/presentation/cli.mjs

@@ -1719,10 +1719,14 @@ async function runEnroll({ label } = {}) {
 
   let out;
   try {
-    out = await callTool("enroll", {
-      code,
-      device_label: typeof label === "string" ? label : undefined,
-    });
+    out = await callTool(
+      "enroll",
+      {
+        code,
+        device_label: typeof label === "string" ? label : undefined,
+      },
+      { allowReenroll: true }, // human at a TTY already consented above
+    );
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`));
     process.exitCode = 1;
@@ -1778,6 +1782,7 @@ async function runSubmit({ platform = "claude", window } = {}) {
       platform,
       window: typeof window === "string" ? window : undefined,
       dry_run: process.argv.includes("--dry-run"),
+      confirm: true, // explicit CLI invocation is the confirmation
     });
   } catch (e) {
     writeln(red(`  ✗ ${e.message}`));

package/presentation/tui-themes.mjs

@@ -132,40 +132,31 @@ export function getThemeNames() {
 // (the default theme). For light theme, darker 256-color variants are used.
 // Monochrome theme returns no color (bold only) — colorblind-safe.
 //
-// Color assignments (dark theme 256-color codes):
-//   claude    = 75  (blue-cyan)
-//   codex     = 114 (green)
-//   amp       = 179 (orange)
-//   gemini    = 129 (purple-magenta)
-//   kimi      = 213 (pink)
-//   qwen      = 68  (steel blue)
-//   goose     = 142 (olive)
-//   kilo      = 166 (dark orange)
-//   hermes    = 96  (plum)
-//   droid     = 167 (salmon)
-//   codebuff  = 72  (teal-green)
-//   copilot   = 33  (bright blue)
-//   openclaw  = 136 (gold-brown)
-//   pi        = 177 (light purple)
-//   omp       = 220 (gold — the "oh my pi" platform gets gold)
-//   opencode  = 60  (slate)
-//   devin     = 30  (teal)
-//   proxy     = 245 (gray — synthetic passthrough)
-//   other     = 245 (gray — catch-all)
 
+// Brand-matched (owner 2026-10-15: "claude orange, devin blue, etc"):
+//   claude Anthropic orange · codex OpenAI green · gemini Google blue ·
+//   antigravity Google green · devin Cognition blue · copilot GitHub purple ·
+//   qwen purple · kilo yellow · grok xAI silver · openclaw lobster red ·
+//   amp red · kimi Moonshot blue · hermes Nous blue · droid Factory orange ·
+//   codebuff acid green · pi gold (π palette) · zcode Z.ai blue.
+//   goose / opencode have monochrome brands → distinct neutral greys.
+//   omp keeps its gold. Codes nudged where the nearest brand code collided
+//   with another platform (amp 196 vs openclaw 203, droid 208 vs 202, …).
 const PLATFORM_COLORS_DARK = {
-  claude: 75, codex: 114, amp: 179, gemini: 129, kimi: 213,
-  qwen: 68, goose: 142, kilo: 166, hermes: 96, droid: 167,
-  codebuff: 72, copilot: 33, openclaw: 136, pi: 177, omp: 220,
-  opencode: 60, devin: 30, proxy: 245, other: 245,
+  claude: 173, codex: 36, amp: 196, gemini: 69, kimi: 33,
+  qwen: 63, goose: 245, kilo: 227, hermes: 27, droid: 208,
+  codebuff: 48, copilot: 98, openclaw: 203, pi: 179, omp: 220,
+  opencode: 252, devin: 39, proxy: 240, other: 240,
+  antigravity: 71, grok: 250, zcode: 111,
 };
 
 // Light theme: darker shades of the same hues for contrast on white
 const PLATFORM_COLORS_LIGHT = {
-  claude: 24, codex: 28, amp: 130, gemini: 54, kimi: 90,
-  qwen: 19, goose: 100, kilo: 130, hermes: 54, droid: 124,
-  codebuff: 23, copilot: 19, openclaw: 130, pi: 90, omp: 130,
-  opencode: 19, devin: 23, proxy: 242, other: 242,
+  claude: 130, codex: 29, amp: 160, gemini: 26, kimi: 27,
+  qwen: 56, goose: 243, kilo: 136, hermes: 21, droid: 94,
+  codebuff: 29, copilot: 55, openclaw: 124, pi: 136, omp: 136,
+  opencode: 243, devin: 25, proxy: 242, other: 242,
+  antigravity: 28, grok: 240, zcode: 24,
 };
 
 /**
@@ -187,3 +178,27 @@ export function platformColor(platform) {
   }
   return (s) => `${ESC}38;5;${code}m${s}${currentTheme.reset}`;
 }
+
+// ── Build archetype colors ──────────────────────────────────────────────────
+// Hues follow signalaf.com/field (build archetypes), mapped to 256-color codes.
+// Keys match classifyArchetype().key in presentation/narrate.mjs.
+const ARCHETYPE_COLORS_DARK = {
+  convergent: 140, kinetic: 204, amplifier: 209, recursive: 178, builder: 214,
+  archivist: 35, "deep-reader": 41, contextual: 79, priming: 74, "input-bound": 33,
+};
+const ARCHETYPE_COLORS_LIGHT = {
+  convergent: 97, kinetic: 161, amplifier: 166, recursive: 136, builder: 130,
+  archivist: 29, "deep-reader": 28, contextual: 30, priming: 31, "input-bound": 25,
+};
+
+/** Paint function for a build archetype key, theme-aware (monochrome → bold). */
+export function archetypeColor(key) {
+  const themeName = currentTheme.name;
+  if (themeName === "monochrome") {
+    return (s) => `${currentTheme.bold}${s}${currentTheme.reset}`;
+  }
+  const map = themeName === "light" ? ARCHETYPE_COLORS_LIGHT : ARCHETYPE_COLORS_DARK;
+  const code = map[key];
+  if (code == null) return (s) => `${currentTheme.cyan}${s}${currentTheme.reset}`;
+  return (s) => `${ESC}38;5;${code}m${s}${currentTheme.reset}`;
+}