@overscore/cli 0.13.0 → 0.13.1

package/dist/index.js

@@ -3,11 +3,19 @@ import fs from "fs";
 import path from "path";
 import http from "http";
 import net from "net";
+import os from "os";
 import { execSync } from "child_process";
 import { createInterface } from "readline";
 import { createHash, randomBytes } from "crypto";
 import yauzl from "yauzl";
 // ── Shared helpers ──────────────────────────────────────────────────
+// Name CLI-minted API keys after the machine + date so stale keys are
+// recognizable and revocable in the Hub UI (mitigates key sprawl). Keys are
+// project-scoped; revoke unused ones under Project Settings → API Keys.
+function cliKeyName() {
+    const host = (os.hostname() || "unknown").split(".")[0];
+    return `cli ${host} ${new Date().toISOString().slice(0, 10)}`;
+}
 function parseEnv(content) {
     const env = {};
     for (const line of content.split("\n")) {
@@ -187,7 +195,7 @@ async function refreshApiKey(projectSlug) {
         const keyRes = await fetch(`${HUB_URL}/api/projects/${projectSlug}/api-keys`, {
             method: "POST",
             headers: { Authorization: `Bearer ${deviceToken}`, "Content-Type": "application/json" },
-            body: JSON.stringify({ name: `cli-${Date.now()}` }),
+            body: JSON.stringify({ name: cliKeyName() }),
         });
         if (keyRes.ok) {
             const data = (await keyRes.json());
@@ -239,27 +247,85 @@ const SECRET_FILE_EXTENSIONS = new Set([
     ".pfx",
     ".jks",
     ".keystore",
+    ".p8",
+    ".ppk",
+    ".gpg",
+    ".asc",
+    ".tfstate", // Terraform state — often contains plaintext secrets
+    ".tfvars",
+]);
+// Exact filenames that are secrets regardless of (or lacking) an extension.
+const SECRET_FILE_NAMES = new Set([
+    "service-account.json",
+    "service_account.json",
+    "serviceaccount.json",
+    "gcp-credentials.json",
+    "credentials.json",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+    ".netrc",
+    ".pgpass",
+    ".htpasswd",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
 ]);
-function collectSourceFiles(dir, prefix) {
+function isSecretFileName(name) {
+    const lower = name.toLowerCase();
+    if (SECRET_FILE_NAMES.has(lower))
+        return true;
+    const ext = lower.substring(lower.lastIndexOf("."));
+    if (SECRET_FILE_EXTENSIONS.has(ext))
+        return true;
+    // Terraform state backups: terraform.tfstate.backup, *.tfstate.*
+    if (lower.includes(".tfstate"))
+        return true;
+    return false;
+}
+/**
+ * Walk a directory collecting deployable source files. Excludes machine-state
+ * and secrets, NEVER follows symlinks (a symlink could point at ~/.ssh/id_rsa
+ * or outside the project), and honors .overscoreignore at the project root.
+ */
+function collectSourceFiles(dir, prefix, ctx) {
+    // Initialize ignore context on the first (root) call.
+    const c = ctx ?? { patterns: loadOverscoreIgnore(dir), skipped: [] };
     const files = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        // Never traverse or upload symlinks — they can escape the project tree
+        // or point at credentials. Skip silently-but-noted.
+        if (entry.isSymbolicLink()) {
+            c.skipped.push((prefix ? `${prefix}/` : "") + entry.name + " (symlink)");
+            continue;
+        }
         if (SOURCE_EXCLUDE.has(entry.name))
             continue;
         if (entry.name.startsWith(".env"))
             continue; // .env, .env.local, .env.production, etc.
         if (entry.name.endsWith(".log"))
             continue;
-        const ext = entry.name.substring(entry.name.lastIndexOf(".")).toLowerCase();
-        if (SECRET_FILE_EXTENSIONS.has(ext))
+        if (isSecretFileName(entry.name)) {
+            c.skipped.push((prefix ? `${prefix}/` : "") + entry.name + " (secret)");
             continue;
+        }
         const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (isIgnored(relativePath, entry.isDirectory(), c.patterns))
+            continue;
         if (entry.isDirectory()) {
-            files.push(...collectSourceFiles(path.join(dir, entry.name), relativePath));
+            files.push(...collectSourceFiles(path.join(dir, entry.name), relativePath, c));
         }
         else {
             files.push(relativePath);
         }
     }
+    // Surface what was withheld so a deploy is never silently lossy on secrets.
+    if (!ctx && c.skipped.length > 0) {
+        console.log(`  Skipped ${c.skipped.length} sensitive/symlinked file(s): ${c.skipped
+            .slice(0, 10)
+            .join(", ")}${c.skipped.length > 10 ? ", …" : ""}`);
+    }
     return files;
 }
 function extractZip(zipBuffer, targetDir) {
@@ -325,9 +391,16 @@ async function deploy() {
     }
     const builtFiles = collectFiles(distDir, "");
     console.log(`  Found ${builtFiles.length} built files.`);
-    // Collect source files
-    const sourceFiles = collectSourceFiles(process.cwd(), "");
-    console.log(`  Found ${sourceFiles.length} source files.`);
+    // Collect source files (skipped entirely with --no-source). Source is saved
+    // for versioning/restore; symlinks and secrets are always excluded.
+    const noSource = process.argv.includes("--no-source");
+    const sourceFiles = noSource ? [] : collectSourceFiles(process.cwd(), "");
+    if (noSource) {
+        console.log("  Skipping source upload (--no-source).");
+    }
+    else {
+        console.log(`  Found ${sourceFiles.length} source files.`);
+    }
     // Upload via deploy API
     console.log("  Uploading...");
     const formData = new FormData();
@@ -1063,7 +1136,7 @@ async function loadAnalysisConfig() {
                 Authorization: `Bearer ${deviceToken}`,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ name: `cli-${Date.now()}` }),
+            body: JSON.stringify({ name: cliKeyName() }),
         });
         if (keyGenRes.ok) {
             const data = (await keyGenRes.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"