sigrank 1.0.45 → 1.0.47

package/proxy.mjs

@@ -311,6 +311,22 @@ export async function startProxy({
   };
 
   const server = http.createServer(async (req, res) => {
+    // DNS-rebinding / CSRF guard: only accept loopback Host headers on our own port, and
+    // refuse browser cross-site requests (Sec-Fetch-Site other than same-origin/none).
+    const hostHeader = String(req.headers.host || "");
+    const hm = /^(127\.0\.0\.1|localhost|\[::1\])(?::(\d+))?$/i.exec(hostHeader);
+    const boundPort = server.address()?.port;
+    const sfs = req.headers["sec-fetch-site"];
+    if (
+      !hm ||
+      (boundPort && Number(hm[2] || 80) !== boundPort) ||
+      (sfs !== undefined && sfs !== "same-origin" && sfs !== "none")
+    ) {
+      res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+      res.end("Forbidden\n");
+      req.resume();
+      return;
+    }
     let parsedUrl;
     try {
       parsedUrl = new URL(req.url || "/", `http://${req.headers.host || host}`);

package/resources/privacy-model.md

@@ -2,13 +2,15 @@
 
 ## What leaves your machine
 
-**Every submission path sends only four numbers:**
+**The usage content of every submission is four numbers:**
 - Input tokens
 - Output tokens
 - Cache create tokens
 - Cache read tokens
 
-That's the entire payload — no prompts, no code, no file contents, no conversation text. The MCP parses your input locally and sends only the four token counts to the server, which re-parses and re-scores them authoritatively.
+The signed path additionally carries: codename, device id, device public key, ed25519 signature, agent version, platform, message/session counts, and the weekly report block. `enroll` sends a device label (default `sigrank <version> · <platform>`; your hostname is not sent unless you set `SIGRANK_DEVICE_LABEL` or pass `device_label` yourself).
+
+Never sent: prompts, responses, code, file contents, file paths, repo or project names, or environment variables. The server re-parses and re-scores the pillars authoritatively.
 
 The optional `sigrank proxy` is a local Upsilon transport path to Anthropic/OpenAI, not a
 submission path to the SigRank leaderboard. When explicitly enabled, it necessarily receives and
@@ -32,8 +34,9 @@ only provider-reported token counts, model/backend metadata, and timestamps to
 - Your prompts or messages
 - Your code or file contents
 - Your tool calls or their results
-- Which AI platform you use (beyond token counts)
-- Your identity (only your chosen codename)
+- Your hostname (unless you opt in via a device label)
+- File paths, repo/project names, or environment variables
+- Your identity (only your chosen codename; the platform name, agent version, and message/session counts are sent)
 
 The local proxy process is different from the Upsilon service: if you opt in, it
 handles your provider traffic in memory solely to forward it to Anthropic or

package/tokscale_analytics.mjs

@@ -356,7 +356,6 @@ export async function tokscaleDeveloperProfile() {
       sessions_path_exists: c.sessions_path_exists ?? null,
       headless_supported: c.headless_supported ?? null,
       workspace_count: c.workspaces.size,
-      workspaces: [...c.workspaces].sort(),
       models: c.models,
     };
   });

package/tools/_helpers.mjs

@@ -32,6 +32,8 @@ const ALLOWED_API_HOSTS = new Set([
   "sigeconomy.com",
   "localhost",
   "127.0.0.1",
+  "::1",
+  "[::1]",
   "test.local", // test fixtures only
 ]);
 
@@ -42,6 +44,10 @@ export function validateApiBase(urlStr) {
     if (!ALLOWED_API_HOSTS.has(u.hostname)) {
       throw new Error(`Blocked: API host '${u.hostname}' is not in the allowlist`);
     }
+    const loopback = ["localhost", "127.0.0.1", "::1", "[::1]", "test.local"].includes(u.hostname);
+    if (u.protocol !== "https:" && !(loopback && u.protocol === "http:")) {
+      throw new Error(`Blocked: API base must use https (http only for loopback): ${u.protocol}//${u.hostname}`);
+    }
     return urlStr;
   } catch (e) {
     if (e.message.startsWith("Blocked:")) throw e;

package/tools/enroll.mjs

@@ -2,7 +2,6 @@
  * tools/enroll.mjs — enroll tool.
  */
 
-import os from "node:os";
 import { ensureIdentity, recordEnrollment } from "../identity/keystore.mjs";
 import { ENROLL_OUTPUT, ANNOTATIONS } from "./_schemas.mjs";
 import { TERMS_VERSION, PRIVACY_VERSION } from "../lib/constants.mjs";
@@ -28,7 +27,7 @@ export const TOOL_DEF = {
       device_label: {
         type: "string",
         description:
-          "optional label for this device (default: hostname · agent version)",
+          "optional label for this device (default: sigrank <version> · <platform>; hostnames are never sent unless you pass a label yourself)",
       },
     },
     required: ["code"],
@@ -45,8 +44,23 @@ export async function handleEnroll(args, ctx) {
       "enroll requires a `code` — paste your connect code from signalaf.com → Settings → Connect a device.",
     );
   const id = ctx.opts.identity || ensureIdentity();
+  // Re-enroll guard: a model-invoked MCP call must never silently re-bind a device that
+  // already has an operator. The human CLI/TUI path sets opts.allowReenroll after its own
+  // explicit consent prompt.
+  if (id.codename && !ctx.opts.allowReenroll) {
+    return {
+      status: "already_enrolled",
+      codename: id.codename,
+      operator_id: id.operator_id ?? null,
+      device_id: id.device_id,
+      detail:
+        "This device is already enrolled. To re-enroll, run `npx sigrank enroll` in a terminal yourself; the MCP tool will not re-bind an enrolled device.",
+    };
+  }
   const deviceLabel = String(
-    args?.device_label || `${os.hostname()} · ${id.agent_version}`,
+    args?.device_label ||
+      process.env.SIGRANK_DEVICE_LABEL ||
+      `sigrank ${id.agent_version} · ${process.platform}`,
   ).slice(0, 120);
   const res = await ctx.doFetch(`${ctx.apiBase}/api/v1/devices/enroll`, {
     method: "POST",

package/tools/submit-verified.mjs

@@ -12,7 +12,7 @@ import { _computeReportBlock } from "./_report.mjs";
 export const TOOL_DEF = {
   name: "submit_verified",
   description:
-    "Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Pass dry_run:true to inspect the exact signed payload without publishing.",
+    "Publish your LOCAL token runs to the SigRank board as a VERIFIED operator — the enrolled, signed path. Reads your pillars (tokenpull), builds the canonical Schema 1.0 snapshot per window, ed25519-signs it with your device key, and POSTs to /api/v1/snapshots. Requires `npx sigrank-mcp enroll` first (a bound device). Only signed submissions from a trusted device rank on the board. Token-only; the private key never leaves your machine. Publishing requires `confirm: true` (ask the user first); pass dry_run:true to inspect the exact signed payload without publishing and without confirm.",
   annotations: {
     title: "Submit verified score",
     ...ANNOTATIONS.destructiveHint,
@@ -33,6 +33,11 @@ export const TOOL_DEF = {
         description:
           "source platform (default: claude). 'multi' = combined cascade summed across all locally-detected platforms (needs 2+ active); empty windows are skipped.",
       },
+      confirm: {
+        type: "boolean",
+        description:
+          "REQUIRED to publish: must be true, set only after the user has explicitly approved submitting. Not needed with dry_run:true.",
+      },
       dry_run: {
         type: "boolean",
         description:
@@ -52,6 +57,13 @@ export async function handleSubmitVerified(args, ctx) {
       detail: "Run `npx sigrank-mcp enroll` to bind this device first.",
     };
   }
+  if (!args?.dry_run && args?.confirm !== true) {
+    return {
+      status: "confirmation_required",
+      detail:
+        "submit_verified publishes to the public board. Ask the user for approval, then call again with confirm: true (or use dry_run: true to preview).",
+    };
+  }
   const platform = args?.platform || "claude";
 
   // MULTI: the combined cross-platform cascade. The dashboard already SUMS every

package/tools/tokscale-developer-profile.mjs

@@ -20,7 +20,7 @@ export const TOOL_DEF = {
     properties: {
       tools: {
         type: "array",
-        description: "Per-tool profile with model mix, token pillars, session counts, workspaces",
+        description: "Per-tool profile with model mix, token pillars, session counts, workspace count",
       },
       summary: {
         type: "object",