@overscore/cli 0.13.0 → 0.13.3

package/dist/index.js

@@ -3,11 +3,19 @@ import fs from "fs";
 import path from "path";
 import http from "http";
 import net from "net";
+import os from "os";
 import { execSync } from "child_process";
 import { createInterface } from "readline";
 import { createHash, randomBytes } from "crypto";
 import yauzl from "yauzl";
 // ── Shared helpers ──────────────────────────────────────────────────
+// Name CLI-minted API keys after the machine + date so stale keys are
+// recognizable and revocable in the Hub UI (mitigates key sprawl). Keys are
+// project-scoped; revoke unused ones under Project Settings → API Keys.
+function cliKeyName() {
+    const host = (os.hostname() || "unknown").split(".")[0];
+    return `cli ${host} ${new Date().toISOString().slice(0, 10)}`;
+}
 function parseEnv(content) {
     const env = {};
     for (const line of content.split("\n")) {
@@ -23,6 +31,28 @@ function parseEnv(content) {
     }
     return env;
 }
+/**
+ * Only let credentialed requests (API key + deploy/source bundle) target
+ * overscore.dev or localhost. Prevents a poisoned project .env
+ * (VITE_OVERSCORE_API_URL) from redirecting the key + uploaded bundle to an
+ * attacker host (audit L6). Falls back to the canonical Hub on anything else.
+ */
+function safeApiUrl(apiUrl) {
+    try {
+        const h = new URL(apiUrl).hostname;
+        if (h === "overscore.dev" ||
+            h.endsWith(".overscore.dev") ||
+            h === "localhost" ||
+            h === "127.0.0.1") {
+            return apiUrl;
+        }
+    }
+    catch {
+        /* invalid URL */
+    }
+    console.warn(`  Ignoring untrusted API URL "${apiUrl}"; using ${HUB_URL}/api`);
+    return `${HUB_URL}/api`;
+}
 async function loadEnv() {
     // (1) Local .env (inside a dashboard project)
     const envPath = path.resolve(process.cwd(), ".env");
@@ -33,7 +63,7 @@ async function loadEnv() {
         const dashboardSlug = env.VITE_OVERSCORE_DASHBOARD_SLUG || path.basename(process.cwd());
         const projectSlug = env.VITE_OVERSCORE_PROJECT_SLUG || "";
         if (apiUrl && apiKey) {
-            return { apiUrl, apiKey, dashboardSlug, projectSlug };
+            return { apiUrl: safeApiUrl(apiUrl), apiKey, dashboardSlug, projectSlug };
         }
         // .env has project context but no API key — generate one via device token
         if (projectSlug) {
@@ -50,7 +80,7 @@ async function loadEnv() {
                         : envContent + `VITE_OVERSCORE_API_KEY=${newKey}\n`;
                     fs.writeFileSync(envPath, updated);
                     return {
-                        apiUrl: apiUrl || `${HUB_URL}/api`,
+                        apiUrl: safeApiUrl(apiUrl || `${HUB_URL}/api`),
                         apiKey: newKey,
                         dashboardSlug,
                         projectSlug,
@@ -65,7 +95,7 @@ async function loadEnv() {
         const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
         if (cfg.OVERSCORE_API_KEY) {
             return {
-                apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                 apiKey: cfg.OVERSCORE_API_KEY,
                 dashboardSlug: path.basename(process.cwd()),
                 projectSlug: cfg.OVERSCORE_PROJECT_SLUG || "",
@@ -76,7 +106,7 @@ async function loadEnv() {
             const newKey = await refreshApiKey(cfg.OVERSCORE_PROJECT_SLUG);
             if (newKey) {
                 return {
-                    apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                    apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                     apiKey: newKey,
                     dashboardSlug: path.basename(process.cwd()),
                     projectSlug: cfg.OVERSCORE_PROJECT_SLUG,
@@ -92,7 +122,7 @@ async function loadEnv() {
         const cfg2 = parseEnv(fs.readFileSync(configPath2, "utf-8"));
         if (cfg2.OVERSCORE_API_KEY) {
             return {
-                apiUrl: cfg2.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                apiUrl: safeApiUrl(cfg2.OVERSCORE_API_URL || `${HUB_URL}/api`),
                 apiKey: cfg2.OVERSCORE_API_KEY,
                 dashboardSlug: path.basename(process.cwd()),
                 projectSlug: cfg2.OVERSCORE_PROJECT_SLUG || "",
@@ -187,7 +217,7 @@ async function refreshApiKey(projectSlug) {
         const keyRes = await fetch(`${HUB_URL}/api/projects/${projectSlug}/api-keys`, {
             method: "POST",
             headers: { Authorization: `Bearer ${deviceToken}`, "Content-Type": "application/json" },
-            body: JSON.stringify({ name: `cli-${Date.now()}` }),
+            body: JSON.stringify({ name: cliKeyName() }),
         });
         if (keyRes.ok) {
             const data = (await keyRes.json());
@@ -239,27 +269,102 @@ const SECRET_FILE_EXTENSIONS = new Set([
     ".pfx",
     ".jks",
     ".keystore",
+    ".p8",
+    ".ppk",
+    ".gpg",
+    ".asc",
+    ".tfstate", // Terraform state — often contains plaintext secrets
+    ".tfvars",
+]);
+// Exact filenames that are secrets regardless of (or lacking) an extension.
+const SECRET_FILE_NAMES = new Set([
+    "service-account.json",
+    "service_account.json",
+    "serviceaccount.json",
+    "gcp-credentials.json",
+    "credentials.json",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+    ".netrc",
+    ".pgpass",
+    ".htpasswd",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
 ]);
-function collectSourceFiles(dir, prefix) {
+function isSecretFileName(name) {
+    const lower = name.toLowerCase();
+    if (SECRET_FILE_NAMES.has(lower))
+        return true;
+    const ext = lower.substring(lower.lastIndexOf("."));
+    if (SECRET_FILE_EXTENSIONS.has(ext))
+        return true;
+    // Terraform state backups: terraform.tfstate.backup, *.tfstate.*
+    if (lower.includes(".tfstate"))
+        return true;
+    return false;
+}
+/**
+ * Resolve `relPath` under `baseDir`, returning the absolute path only if it
+ * stays inside `baseDir`. Knowledge-file paths come from the Hub (tenant-
+ * controlled) and are written to disk on pull/scaffold, so they MUST be
+ * contained — otherwise `../rules/data-fetching.md` could overwrite an
+ * auto-loaded Claude Code rule on a teammate's machine (audit H6).
+ */
+function safeJoinWithin(baseDir, relPath) {
+    if (typeof relPath !== "string" || relPath.length === 0 || relPath.includes("\0")) {
+        return null;
+    }
+    const base = path.resolve(baseDir);
+    const resolved = path.resolve(base, relPath);
+    if (resolved !== base && !resolved.startsWith(base + path.sep))
+        return null;
+    return resolved;
+}
+/**
+ * Walk a directory collecting deployable source files. Excludes machine-state
+ * and secrets, NEVER follows symlinks (a symlink could point at ~/.ssh/id_rsa
+ * or outside the project), and honors .overscoreignore at the project root.
+ */
+function collectSourceFiles(dir, prefix, ctx) {
+    // Initialize ignore context on the first (root) call.
+    const c = ctx ?? { patterns: loadOverscoreIgnore(dir), skipped: [] };
     const files = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        // Never traverse or upload symlinks — they can escape the project tree
+        // or point at credentials. Skip silently-but-noted.
+        if (entry.isSymbolicLink()) {
+            c.skipped.push((prefix ? `${prefix}/` : "") + entry.name + " (symlink)");
+            continue;
+        }
         if (SOURCE_EXCLUDE.has(entry.name))
             continue;
         if (entry.name.startsWith(".env"))
             continue; // .env, .env.local, .env.production, etc.
         if (entry.name.endsWith(".log"))
             continue;
-        const ext = entry.name.substring(entry.name.lastIndexOf(".")).toLowerCase();
-        if (SECRET_FILE_EXTENSIONS.has(ext))
+        if (isSecretFileName(entry.name)) {
+            c.skipped.push((prefix ? `${prefix}/` : "") + entry.name + " (secret)");
             continue;
+        }
         const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (isIgnored(relativePath, entry.isDirectory(), c.patterns))
+            continue;
         if (entry.isDirectory()) {
-            files.push(...collectSourceFiles(path.join(dir, entry.name), relativePath));
+            files.push(...collectSourceFiles(path.join(dir, entry.name), relativePath, c));
         }
         else {
             files.push(relativePath);
         }
     }
+    // Surface what was withheld so a deploy is never silently lossy on secrets.
+    if (!ctx && c.skipped.length > 0) {
+        console.log(`  Skipped ${c.skipped.length} sensitive/symlinked file(s): ${c.skipped
+            .slice(0, 10)
+            .join(", ")}${c.skipped.length > 10 ? ", …" : ""}`);
+    }
     return files;
 }
 function extractZip(zipBuffer, targetDir) {
@@ -325,9 +430,16 @@ async function deploy() {
     }
     const builtFiles = collectFiles(distDir, "");
     console.log(`  Found ${builtFiles.length} built files.`);
-    // Collect source files
-    const sourceFiles = collectSourceFiles(process.cwd(), "");
-    console.log(`  Found ${sourceFiles.length} source files.`);
+    // Collect source files (skipped entirely with --no-source). Source is saved
+    // for versioning/restore; symlinks and secrets are always excluded.
+    const noSource = process.argv.includes("--no-source");
+    const sourceFiles = noSource ? [] : collectSourceFiles(process.cwd(), "");
+    if (noSource) {
+        console.log("  Skipping source upload (--no-source).");
+    }
+    else {
+        console.log(`  Found ${sourceFiles.length} source files.`);
+    }
     // Upload via deploy API
     console.log("  Uploading...");
     const formData = new FormData();
@@ -995,7 +1107,7 @@ async function loadAnalysisConfig() {
         const apiKey = env.VITE_OVERSCORE_API_KEY;
         const projectSlug = env.VITE_OVERSCORE_PROJECT_SLUG;
         if (apiUrl && apiKey && projectSlug) {
-            return { apiUrl, apiKey, projectSlug };
+            return { apiUrl: safeApiUrl(apiUrl), apiKey, projectSlug };
         }
     }
     // (2) ~/.overscore/config
@@ -1013,7 +1125,7 @@ async function loadAnalysisConfig() {
                 });
                 if (checkRes.ok) {
                     return {
-                        apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                        apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                         apiKey: cfg.OVERSCORE_API_KEY,
                         projectSlug: cfg.OVERSCORE_PROJECT_SLUG,
                     };
@@ -1023,7 +1135,7 @@ async function loadAnalysisConfig() {
             catch {
                 // Can't reach the hub — use saved config and hope for the best
                 return {
-                    apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                    apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                     apiKey: cfg.OVERSCORE_API_KEY,
                     projectSlug: cfg.OVERSCORE_PROJECT_SLUG,
                 };
@@ -1063,7 +1175,7 @@ async function loadAnalysisConfig() {
                 Authorization: `Bearer ${deviceToken}`,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ name: `cli-${Date.now()}` }),
+            body: JSON.stringify({ name: cliKeyName() }),
         });
         if (keyGenRes.ok) {
             const data = (await keyGenRes.json());
@@ -1191,9 +1303,15 @@ async function syncKnowledgeBase(targetDir, baseUrl, projectSlug, apiKey) {
         if (!data.files || data.files.length === 0)
             return false;
         fs.mkdirSync(knowledgeDir, { recursive: true });
-        // Write each knowledge file
+        // Write each knowledge file — contained within knowledgeDir (audit H6).
         for (const file of data.files) {
-            fs.writeFileSync(path.join(knowledgeDir, file.path), file.content);
+            const dest = safeJoinWithin(knowledgeDir, file.path);
+            if (!dest) {
+                console.warn(`  Skipped knowledge file with unsafe path: ${file.path}`);
+                continue;
+            }
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            fs.writeFileSync(dest, file.content);
         }
         // Generate INDEX.md
         const indexLines = [
@@ -1704,8 +1822,16 @@ function collectAnalysisFiles(dir, prefix, patterns) {
     const userPatterns = patterns ?? loadOverscoreIgnore(dir);
     const files = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        // Never follow symlinks or ship secrets — same guards as the deploy path's
+        // collectSourceFiles (audit H5: this analysis-publish collector had neither,
+        // so a poisoned agent could upload service-account.json / id_rsa, or a
+        // file-target symlink to ~/.ssh/id_rsa).
+        if (entry.isSymbolicLink())
+            continue;
         if (isBaselineExcluded(entry.name))
             continue;
+        if (isSecretFileName(entry.name))
+            continue;
         const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
         if (isIgnored(relativePath, entry.isDirectory(), userPatterns))
             continue;
@@ -2259,6 +2385,17 @@ async function dev() {
         await cleanup();
         process.exit(0);
     });
+    // Also clean up on terminal close (SIGHUP) and on a crash, so the short-lived
+    // dev key isn't stranded live when the tab closes or the process throws (M12).
+    process.on("SIGHUP", async () => {
+        await cleanup();
+        process.exit(0);
+    });
+    process.on("uncaughtException", async (err) => {
+        await cleanup();
+        console.error(err);
+        process.exit(1);
+    });
 }
 // ── auth ────────────────────────────────────────────────────────────
 async function authStatus() {
@@ -2447,6 +2584,90 @@ ${installed.map((s) => `    - ${s}`).join("\n")}
   Re-run this command anytime to update.
 `);
 }
+// ── template pull ──────────────────────────────────────────────────
+async function templatePull(slug) {
+    if (!slug) {
+        console.error("\n  Usage: npx @overscore/cli template pull <template-slug> [dir]\n");
+        console.error("  Example:");
+        console.error("    npx @overscore/cli template pull mrr-tracker\n");
+        process.exit(1);
+    }
+    const targetDir = path.resolve(process.cwd(), process.argv[4] || slug);
+    const url = `https://overscore.dev/api/templates/${slug}/source`;
+    console.log(`\n  Pulling template: ${slug}...`);
+    let res;
+    try {
+        res = await fetch(url, {
+            // Optional: attach device token if available, for attribution in install counting
+            headers: (() => {
+                const configPath = path.join(process.env.HOME || "", ".overscore", "config");
+                if (fs.existsSync(configPath)) {
+                    const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
+                    if (cfg.OVERSCORE_DEVICE_TOKEN) {
+                        return { Authorization: `Bearer ${cfg.OVERSCORE_DEVICE_TOKEN}` };
+                    }
+                }
+                return {};
+            })(),
+        });
+    }
+    catch {
+        console.error(`\n  Error: Could not reach overscore.dev\n`);
+        process.exit(1);
+    }
+    if (!res.ok) {
+        let errorMsg = `HTTP ${res.status}`;
+        try {
+            const body = await res.json();
+            errorMsg = body.error || errorMsg;
+        }
+        catch {
+            //
+        }
+        console.error(`\n  Error: ${errorMsg}\n`);
+        process.exit(1);
+    }
+    const templateSlug = res.headers.get("X-OS-Template-Slug") || slug;
+    const templateVersion = res.headers.get("X-OS-Template-Version") || "0";
+    const zipBuffer = Buffer.from(await res.arrayBuffer());
+    // Confirm overwrite if dir exists
+    if (fs.existsSync(targetDir)) {
+        const yes = await confirm(`Directory "${path.basename(targetDir)}" already exists. Overwrite?`);
+        if (!yes) {
+            console.log("  Cancelled.\n");
+            return;
+        }
+        for (const entry of fs.readdirSync(targetDir)) {
+            if (entry === "node_modules")
+                continue;
+            fs.rmSync(path.join(targetDir, entry), { recursive: true, force: true });
+        }
+    }
+    else {
+        fs.mkdirSync(targetDir, { recursive: true });
+    }
+    // Extract zip
+    await extractZip(zipBuffer, targetDir);
+    // Write provenance: templates don't have .env (unbound to a project)
+    // Instead, .overscore/template.json records the pull metadata
+    const oscoreDir = path.join(targetDir, ".overscore");
+    fs.mkdirSync(oscoreDir, { recursive: true });
+    fs.writeFileSync(path.join(oscoreDir, "template.json"), JSON.stringify({
+        template_slug: templateSlug,
+        template_version: templateVersion,
+        pulled_at: new Date().toISOString(),
+    }, null, 2));
+    console.log(`
+  ✓ Template extracted to: ${path.relative(process.cwd(), targetDir)}
+
+  Next steps:
+    cd ${path.relative(process.cwd(), targetDir)}
+    npm install
+    npx @overscore/cli dev
+
+  This template runs on mock data — no warehouse connection or API key needed.
+`);
+}
 // ── Routing ─────────────────────────────────────────────────────────
 const command = process.argv[2];
 const subcommand = process.argv[3];
@@ -2479,6 +2700,23 @@ else if (command === "auth") {
         authStatus();
     }
 }
+else if (command === "template") {
+    if (subcommand === "pull") {
+        templatePull(process.argv[4]);
+    }
+    else {
+        console.log(`
+  overscore template — Manage marketplace templates
+
+  Commands:
+    pull <slug> [dir]        Download and extract a template
+
+  Examples:
+    npx @overscore/cli template pull mrr-tracker
+    npx @overscore/cli template pull mrr-tracker my-mrr-dash
+`);
+    }
+}
 else if (command === "analysis") {
     if (subcommand === "new") {
         analysisNew(process.argv[4]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.0",
+  "version": "0.13.3",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"