@overscore/cli 0.10.1 → 0.11.0

package/dist/index.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import fs from "fs";
 import path from "path";
+import http from "http";
+import net from "net";
 import { execSync } from "child_process";
 import { createInterface } from "readline";
-import { createHash } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import yauzl from "yauzl";
 // ── Shared helpers ──────────────────────────────────────────────────
 function parseEnv(content) {
@@ -72,7 +74,7 @@ function loadEnv() {
     }
     process.exit(1);
 }
-async function apiRequest(method, urlPath, body) {
+async function apiRequest(method, urlPath, body, command) {
     const { apiUrl, apiKey } = loadEnv();
     const baseUrl = apiUrl.replace(/\/api$/, "");
     const url = `${baseUrl}${urlPath}`;
@@ -82,6 +84,9 @@ async function apiRequest(method, urlPath, body) {
     if (body !== undefined) {
         headers["Content-Type"] = "application/json";
     }
+    if (command) {
+        headers["X-Overscore-Command"] = command;
+    }
     const res = await fetch(url, {
         method,
         headers,
@@ -332,7 +337,7 @@ async function deploy() {
 }
 async function queryList() {
     const { dashboardSlug } = loadEnv();
-    const data = (await apiRequest("GET", `/api/dashboards/${dashboardSlug}/queries`));
+    const data = (await apiRequest("GET", `/api/dashboards/${dashboardSlug}/queries`, undefined, "query-list"));
     console.log(`\n  Dashboard: ${data.dashboard}\n`);
     // Registered queries
     if (data.queries.length === 0) {
@@ -450,7 +455,7 @@ async function queryAdd(name, sql) {
     let body;
     if (datasetName) {
         // Look up the dataset UUID from project_datasets in the queries endpoint
-        const listData = (await apiRequest("GET", `/api/dashboards/${dashboardSlug}/queries`));
+        const listData = (await apiRequest("GET", `/api/dashboards/${dashboardSlug}/queries`, undefined, "query-add"));
         const dataset = (listData.project_datasets ?? []).find((ds) => ds.name === datasetName);
         if (!dataset) {
             console.error(`\n  Error: Dataset "${datasetName}" not found in this project.\n`);
@@ -466,7 +471,7 @@ async function queryAdd(name, sql) {
     else {
         body = { query_name: name, sql_text: resolvedSql };
     }
-    const data = (await apiRequest("POST", `/api/dashboards/${dashboardSlug}/queries`, body));
+    const data = (await apiRequest("POST", `/api/dashboards/${dashboardSlug}/queries`, body, "query-add"));
     console.log(`\n  Query "${data.query_name}" created.\n`);
     console.log(`  Use it in your dashboard:`);
     console.log(`    const { data } = useQuery("${data.query_name}");\n`);
@@ -638,11 +643,43 @@ async function pull(slug) {
     const versionParam = versionIndex !== -1 && process.argv[versionIndex + 1]
         ? process.argv[versionIndex + 1]
         : null;
-    // Interactive prompts for credentials
-    const apiKey = await prompt("API key (from the Hub):");
-    if (!apiKey || !apiKey.startsWith("os_")) {
-        console.error("\n  Error: API key should start with os_\n");
-        process.exit(1);
+    // Resolve API key: device token → auto-create os_ key, else prompt
+    let apiKey = "";
+    const configPath = path.join(process.env.HOME || "", ".overscore", "config");
+    if (fs.existsSync(configPath)) {
+        const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
+        const deviceToken = cfg.OVERSCORE_DEVICE_TOKEN;
+        if (deviceToken) {
+            try {
+                const keyRes = await fetch(`${HUB_URL}/api/projects/${slug}/api-keys`, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${deviceToken}`,
+                        "Content-Type": "application/json",
+                    },
+                    body: JSON.stringify({ name: `${slug} pull key` }),
+                });
+                if (keyRes.status === 401 || keyRes.status === 403) {
+                    console.error("\n  Error: Device token is invalid or expired. Run 'npx @overscore/cli auth login' to re-authenticate.\n");
+                    process.exit(1);
+                }
+                if (keyRes.ok) {
+                    const keyData = (await keyRes.json());
+                    apiKey = keyData.raw_key || "";
+                }
+            }
+            catch {
+                // Network error — fall through to prompt
+            }
+        }
+    }
+    if (!apiKey) {
+        console.log("  Tip: Run 'npx @overscore/cli auth login' to authenticate once and skip this step.");
+        apiKey = await prompt("API key (from the Hub):");
+        if (!apiKey || !apiKey.startsWith("os_")) {
+            console.error("\n  Error: API key should start with os_\n");
+            process.exit(1);
+        }
     }
     const apiUrl = "https://overscore.dev/api";
     const baseUrl = apiUrl.replace(/\/api$/, "");
@@ -664,10 +701,10 @@ async function pull(slug) {
         console.error(`\n  Error: ${errorMsg}\n`);
         process.exit(1);
     }
-    const projectSlug = res.headers.get("X-VD-Project-Slug") || "";
-    const dashboardSlug = res.headers.get("X-VD-Dashboard-Slug") || slug;
-    const version = res.headers.get("X-VD-Version") || "?";
-    const commitMsg = res.headers.get("X-VD-Commit-Message") || "";
+    const projectSlug = res.headers.get("X-OS-Project-Slug") || "";
+    const dashboardSlug = res.headers.get("X-OS-Dashboard-Slug") || slug;
+    const version = res.headers.get("X-OS-Version") || "?";
+    const commitMsg = res.headers.get("X-OS-Commit-Message") || "";
     // Download the zip
     const zipBuffer = Buffer.from(await res.arrayBuffer());
     // Extract to ./<slug>/
@@ -692,11 +729,10 @@ async function pull(slug) {
         fs.mkdirSync(targetDir, { recursive: true });
     }
     await extractZip(zipBuffer, targetDir);
-    // Generate .env (only overscore config — user adds their own API keys)
+    // Generate .env (no API key — 'npx @overscore/cli dev' injects it at runtime)
     const envContent = `# Overscore Configuration
 VITE_OVERSCORE_PROJECT_SLUG=${projectSlug}
 VITE_OVERSCORE_DASHBOARD_SLUG=${dashboardSlug}
-VITE_OVERSCORE_API_KEY=${apiKey}
 VITE_OVERSCORE_API_URL=https://overscore.dev/api
 `;
     fs.writeFileSync(path.join(targetDir, ".env"), envContent, { mode: 0o600 });
@@ -749,11 +785,7 @@ VITE_OVERSCORE_API_URL=https://overscore.dev/api
 
     cd ${slug}
     npm install
-    code .
-    claude
-
-  Note: If this dashboard uses third-party APIs, add your
-  API keys to .env before running.
+    npx @overscore/cli dev   # starts dev server with auth injected
 
   When ready to deploy:
 
@@ -1755,67 +1787,122 @@ function analysisPreview() {
         process.exit(1);
     }
 }
+// ── dev ─────────────────────────────────────────────────────────────
+async function dev() {
+    // Must be run from inside a dashboard project folder
+    const envPath = path.resolve(process.cwd(), ".env");
+    if (!fs.existsSync(envPath)) {
+        console.error("\n  Error: No .env file found. Run this from inside a dashboard project folder.\n");
+        process.exit(1);
+    }
+    const localEnv = parseEnv(fs.readFileSync(envPath, "utf-8"));
+    const projectSlug = localEnv.VITE_OVERSCORE_PROJECT_SLUG;
+    if (!projectSlug) {
+        console.error("\n  Error: VITE_OVERSCORE_PROJECT_SLUG not set in .env.\n");
+        process.exit(1);
+    }
+    // Get device token from global config
+    const configPath = path.join(process.env.HOME || "", ".overscore", "config");
+    if (!fs.existsSync(configPath)) {
+        console.error("\n  Error: Not authenticated. Run 'npx @overscore/cli auth login' first.\n");
+        process.exit(1);
+    }
+    const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
+    const deviceToken = cfg.OVERSCORE_DEVICE_TOKEN;
+    if (!deviceToken) {
+        console.error("\n  Error: No device token found. Run 'npx @overscore/cli auth login' first.\n");
+        process.exit(1);
+    }
+    // Create a temporary dev session key
+    console.log("\n  Creating dev session key...");
+    let keyId = null;
+    let apiKey = null;
+    try {
+        const keyRes = await fetch(`${HUB_URL}/api/projects/${projectSlug}/api-keys`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${deviceToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ name: "dev session (auto-cleanup)" }),
+        });
+        if (keyRes.status === 401 || keyRes.status === 403) {
+            console.error("\n  Error: Device token is invalid or expired. Run 'npx @overscore/cli auth login' to re-authenticate.\n");
+            process.exit(1);
+        }
+        if (!keyRes.ok) {
+            const errData = await keyRes.json().catch(() => ({}));
+            console.error(`\n  Error: ${errData.error || `HTTP ${keyRes.status}`}\n`);
+            process.exit(1);
+        }
+        const keyData = (await keyRes.json());
+        keyId = keyData.id ?? null;
+        apiKey = keyData.raw_key ?? null;
+    }
+    catch {
+        console.error("\n  Error: Could not reach overscore.dev to create dev session key.\n");
+        process.exit(1);
+    }
+    if (!apiKey) {
+        console.error("\n  Error: Failed to get API key for dev session.\n");
+        process.exit(1);
+    }
+    // Best-effort cleanup: revoke the session key on exit
+    let cleaned = false;
+    async function cleanup() {
+        if (cleaned || !keyId)
+            return;
+        cleaned = true;
+        try {
+            await fetch(`${HUB_URL}/api/projects/${projectSlug}/api-keys`, {
+                method: "DELETE",
+                headers: {
+                    Authorization: `Bearer ${deviceToken}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({ id: keyId }),
+            });
+        }
+        catch {
+            // Best effort — key will remain but that's acceptable
+        }
+    }
+    // Spawn npm run dev with the key injected into the environment
+    const { spawn } = await import("child_process");
+    const child = spawn("npm", ["run", "dev"], {
+        stdio: "inherit",
+        env: { ...process.env, VITE_OVERSCORE_API_KEY: apiKey },
+    });
+    child.on("exit", async (code) => {
+        await cleanup();
+        process.exit(code ?? 0);
+    });
+    process.on("SIGINT", async () => {
+        await cleanup();
+        process.exit(0);
+    });
+    process.on("SIGTERM", async () => {
+        await cleanup();
+        process.exit(0);
+    });
+}
 // ── auth ────────────────────────────────────────────────────────────
 async function authStatus() {
-    const configDir = path.join(process.env.HOME || "", ".overscore");
-    const configPath = path.join(configDir, "config");
-    // Check global config
+    const configPath = path.join(process.env.HOME || "", ".overscore", "config");
     if (fs.existsSync(configPath)) {
         const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
-        const key = cfg.OVERSCORE_API_KEY;
+        const deviceToken = cfg.OVERSCORE_DEVICE_TOKEN;
         const project = cfg.OVERSCORE_PROJECT_SLUG;
-        if (key && project) {
-            // Verify the key is still valid
-            let valid = false;
-            try {
-                const hubUrl = cfg.OVERSCORE_API_URL?.replace(/\/api$/, "") || HUB_URL;
-                const res = await fetch(`${hubUrl}/api/projects/verify-key`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({ key }),
-                });
-                if (res.ok) {
-                    const data = (await res.json());
-                    valid = true;
-                    console.log(`
+        if (deviceToken) {
+            console.log(`
   Authenticated
 
-  Key:     ${key.slice(0, 10)}...
-  Project: ${data.project_slug || project}
-  Config:  ~/.overscore/config
-  Status:  Valid
-`);
-                }
-            }
-            catch {
-                // network error
-            }
-            if (!valid) {
-                console.log(`
-  Authentication problem
-
-  Key:     ${key.slice(0, 10)}...
-  Project: ${project}
-  Config:  ~/.overscore/config
-  Status:  Invalid or expired
-
-  Run 'npx @overscore/cli auth login' to update your key.
-`);
-            }
-            return;
-        }
-    }
-    // Check local .env
-    const envPath = path.resolve(process.cwd(), ".env");
-    if (fs.existsSync(envPath)) {
-        const env = parseEnv(fs.readFileSync(envPath, "utf-8"));
-        if (env.VITE_OVERSCORE_API_KEY) {
-            console.log(`
-  Using local .env (this project only)
+  Device token: ${deviceToken.slice(0, 12)}...
+  Project:      ${project || "—"}
+  Config:       ~/.overscore/config
 
-  Key:       ${env.VITE_OVERSCORE_API_KEY.slice(0, 10)}...
-  Project:   ${env.VITE_OVERSCORE_PROJECT_SLUG || "—"}
-  Dashboard: ${env.VITE_OVERSCORE_DASHBOARD_SLUG || "—"}
+  Run 'npx @overscore/cli dev' to start the dev server.
+  Run 'npx @overscore/cli auth logout' to sign out.
 `);
             return;
         }
@@ -1823,64 +1910,126 @@ async function authStatus() {
     console.log(`
   Not authenticated
 
-  No API key found. Run 'npx @overscore/cli auth login' to set one up.
+  Run 'npx @overscore/cli auth login' to authenticate.
 `);
 }
 async function authLogin() {
     const configDir = path.join(process.env.HOME || "", ".overscore");
     const configPath = path.join(configDir, "config");
-    console.log("\n  Set up Overscore CLI authentication.\n");
-    const apiKey = await prompt("  API key (from the Hub):");
-    if (!apiKey || !apiKey.startsWith("os_")) {
-        console.error("\n  Error: API key should start with os_\n");
+    const state = randomBytes(16).toString("hex");
+    // Find a free port in range 9876–9886
+    let chosenPort = null;
+    for (let p = 9876; p <= 9886; p++) {
+        const free = await new Promise((resolve) => {
+            const srv = net.createServer();
+            srv.once("error", () => resolve(false));
+            srv.once("listening", () => { srv.close(() => resolve(true)); });
+            srv.listen(p, "127.0.0.1");
+        });
+        if (free) {
+            chosenPort = p;
+            break;
+        }
+    }
+    if (!chosenPort) {
+        console.error("\n  Error: No free port found in range 9876–9886.\n");
         process.exit(1);
     }
-    // Auto-resolve project from key
-    let projectSlug = null;
+    // Start local callback server
+    let resolveCallback;
+    const callbackPromise = new Promise((resolve) => {
+        resolveCallback = resolve;
+    });
+    const server = http.createServer((req, res) => {
+        const reqUrl = new URL(req.url ?? "/", `http://localhost:${chosenPort}`);
+        if (reqUrl.pathname !== "/callback") {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        const token = reqUrl.searchParams.get("token") ?? "";
+        const returnedState = reqUrl.searchParams.get("state") ?? "";
+        const project = reqUrl.searchParams.get("project") ?? undefined;
+        if (returnedState !== state || !token.startsWith("ocli_")) {
+            res.writeHead(400, { "Content-Type": "text/plain" });
+            res.end("Invalid callback");
+            return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`<!DOCTYPE html><html><head><title>Overscore CLI</title></head>` +
+            `<body style="font-family:sans-serif;text-align:center;padding:3rem">` +
+            `<h2>Authenticated! You can close this tab.</h2></body></html>`);
+        resolveCallback({ token, project });
+    });
+    server.listen(chosenPort, "127.0.0.1");
+    const loginUrl = `${HUB_URL}/login?next=${encodeURIComponent(`/api/cli/auth/finalize?port=${chosenPort}&state=${state}`)}&mode=signin`;
+    console.log(`\n  Opening browser to authenticate...`);
+    console.log(`\n  If your browser doesn't open automatically, visit:\n  ${loginUrl}\n`);
     try {
-        const res = await fetch(`${HUB_URL}/api/projects/verify-key`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ key: apiKey }),
-        });
-        if (res.ok) {
-            const data = (await res.json());
-            projectSlug = data.project_slug || null;
-            if (projectSlug) {
-                console.log(`\n  Detected project: ${projectSlug}`);
-            }
+        const platform = process.platform;
+        if (platform === "darwin") {
+            execSync(`open '${loginUrl}'`);
+        }
+        else if (platform === "win32") {
+            execSync(`start "" "${loginUrl}"`);
         }
         else {
-            console.error("\n  Error: API key is invalid or expired.\n");
-            process.exit(1);
+            execSync(`xdg-open '${loginUrl}'`);
         }
     }
     catch {
-        console.error("\n  Error: Could not reach overscore.dev to verify key.\n");
-        process.exit(1);
+        // Browser open failed — user can follow the printed URL
     }
-    if (!projectSlug) {
-        projectSlug = await prompt("  Project slug:");
-        if (!projectSlug) {
-            console.error("\n  Error: Project slug is required\n");
-            process.exit(1);
-        }
+    // Wait up to 120 seconds for the callback
+    const timeout = setTimeout(() => {
+        console.error("\n  Error: Timed out waiting for browser login (120s).\n");
+        server.close();
+        process.exit(1);
+    }, 120000);
+    const { token: deviceToken, project: projectSlug } = await callbackPromise;
+    clearTimeout(timeout);
+    server.close();
+    // Preserve any existing os_ API key so dashboard .env fallback still works
+    let existingApiKey = "";
+    if (fs.existsSync(configPath)) {
+        const existing = parseEnv(fs.readFileSync(configPath, "utf-8"));
+        existingApiKey = existing.OVERSCORE_API_KEY || "";
     }
     fs.mkdirSync(configDir, { recursive: true });
-    fs.writeFileSync(configPath, `OVERSCORE_API_URL=${HUB_URL}/api\nOVERSCORE_API_KEY=${apiKey}\nOVERSCORE_PROJECT_SLUG=${projectSlug}\n`, { mode: 0o600 });
+    const lines = [
+        `OVERSCORE_API_URL=${HUB_URL}/api`,
+        `OVERSCORE_DEVICE_TOKEN=${deviceToken}`,
+    ];
+    if (projectSlug)
+        lines.push(`OVERSCORE_PROJECT_SLUG=${projectSlug}`);
+    if (existingApiKey)
+        lines.push(`OVERSCORE_API_KEY=${existingApiKey}`);
+    fs.writeFileSync(configPath, lines.join("\n") + "\n", { mode: 0o600 });
     console.log(`
   Authenticated!
 
-  Key:     ${apiKey.slice(0, 10)}...
-  Project: ${projectSlug}
-  Config:  ~/.overscore/config
-
-  You're ready to use the CLI.
+  Device token saved to ~/.overscore/config.
+  You won't need to copy API keys manually — create-overscore and pull
+  will authenticate automatically from now on.
 `);
 }
 async function authLogout() {
     const configPath = path.join(process.env.HOME || "", ".overscore", "config");
     if (fs.existsSync(configPath)) {
+        // Attempt server-side revocation of the device token (non-fatal)
+        try {
+            const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
+            const deviceToken = cfg.OVERSCORE_DEVICE_TOKEN;
+            if (deviceToken) {
+                await fetch(`${HUB_URL}/api/cli/auth/revoke`, {
+                    method: "POST",
+                    headers: { Authorization: `Bearer ${deviceToken}` },
+                });
+            }
+        }
+        catch {
+            // Ignore — Hub may be unreachable
+        }
         fs.unlinkSync(configPath);
         console.log("\n  Logged out. Global config removed.\n");
     }
@@ -1927,7 +2076,10 @@ ${installed.map((s) => `    - ${s}`).join("\n")}
 // ── Routing ─────────────────────────────────────────────────────────
 const command = process.argv[2];
 const subcommand = process.argv[3];
-if (command === "deploy") {
+if (command === "dev") {
+    dev();
+}
+else if (command === "deploy") {
     deploy();
 }
 else if (command === "pull") {
@@ -2036,8 +2188,9 @@ else {
 
   Commands:
     auth                   Check authentication status
-    auth login             Set up or update your API key
+    auth login             Authenticate via browser (one time per machine)
     auth logout            Remove saved credentials
+    dev                    Start the dev server (injects auth automatically)
     list                   List all dashboards in the project
     deploy                 Build and deploy the dashboard
     pull <slug>            Pull source code from the hub
@@ -2047,6 +2200,8 @@ else {
     install-skills         Install the Overscore skill library into ~/.claude/skills/
 
   Usage:
+    npx @overscore/cli auth login
+    npx @overscore/cli dev
     npx @overscore/cli list
     npx @overscore/cli deploy --message "description"
     npx @overscore/cli pull <slug>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"