@overscore/cli 0.13.1 → 0.13.4

package/dist/index.js

@@ -31,6 +31,28 @@ function parseEnv(content) {
     }
     return env;
 }
+/**
+ * Only let credentialed requests (API key + deploy/source bundle) target
+ * overscore.dev or localhost. Prevents a poisoned project .env
+ * (VITE_OVERSCORE_API_URL) from redirecting the key + uploaded bundle to an
+ * attacker host (audit L6). Falls back to the canonical Hub on anything else.
+ */
+function safeApiUrl(apiUrl) {
+    try {
+        const h = new URL(apiUrl).hostname;
+        if (h === "overscore.dev" ||
+            h.endsWith(".overscore.dev") ||
+            h === "localhost" ||
+            h === "127.0.0.1") {
+            return apiUrl;
+        }
+    }
+    catch {
+        /* invalid URL */
+    }
+    console.warn(`  Ignoring untrusted API URL "${apiUrl}"; using ${HUB_URL}/api`);
+    return `${HUB_URL}/api`;
+}
 async function loadEnv() {
     // (1) Local .env (inside a dashboard project)
     const envPath = path.resolve(process.cwd(), ".env");
@@ -41,7 +63,7 @@ async function loadEnv() {
         const dashboardSlug = env.VITE_OVERSCORE_DASHBOARD_SLUG || path.basename(process.cwd());
         const projectSlug = env.VITE_OVERSCORE_PROJECT_SLUG || "";
         if (apiUrl && apiKey) {
-            return { apiUrl, apiKey, dashboardSlug, projectSlug };
+            return { apiUrl: safeApiUrl(apiUrl), apiKey, dashboardSlug, projectSlug };
         }
         // .env has project context but no API key — generate one via device token
         if (projectSlug) {
@@ -58,7 +80,7 @@ async function loadEnv() {
                         : envContent + `VITE_OVERSCORE_API_KEY=${newKey}\n`;
                     fs.writeFileSync(envPath, updated);
                     return {
-                        apiUrl: apiUrl || `${HUB_URL}/api`,
+                        apiUrl: safeApiUrl(apiUrl || `${HUB_URL}/api`),
                         apiKey: newKey,
                         dashboardSlug,
                         projectSlug,
@@ -73,7 +95,7 @@ async function loadEnv() {
         const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
         if (cfg.OVERSCORE_API_KEY) {
             return {
-                apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                 apiKey: cfg.OVERSCORE_API_KEY,
                 dashboardSlug: path.basename(process.cwd()),
                 projectSlug: cfg.OVERSCORE_PROJECT_SLUG || "",
@@ -84,7 +106,7 @@ async function loadEnv() {
             const newKey = await refreshApiKey(cfg.OVERSCORE_PROJECT_SLUG);
             if (newKey) {
                 return {
-                    apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                    apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                     apiKey: newKey,
                     dashboardSlug: path.basename(process.cwd()),
                     projectSlug: cfg.OVERSCORE_PROJECT_SLUG,
@@ -100,7 +122,7 @@ async function loadEnv() {
         const cfg2 = parseEnv(fs.readFileSync(configPath2, "utf-8"));
         if (cfg2.OVERSCORE_API_KEY) {
             return {
-                apiUrl: cfg2.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                apiUrl: safeApiUrl(cfg2.OVERSCORE_API_URL || `${HUB_URL}/api`),
                 apiKey: cfg2.OVERSCORE_API_KEY,
                 dashboardSlug: path.basename(process.cwd()),
                 projectSlug: cfg2.OVERSCORE_PROJECT_SLUG || "",
@@ -239,6 +261,12 @@ const SOURCE_EXCLUDE = new Set([
     ".docker",
     ".gnupg",
     ".overscore",
+    // Raw exploratory query results (`query run` writes warehouse rows here).
+    // NEVER ship these in the deployed source bundle — they're real warehouse
+    // data. The analysis publish path already excludes data/ via .overscoreignore;
+    // this baseline exclusion protects the dashboard deploy path too, regardless of
+    // whether a project has a .overscoreignore.
+    "data",
 ]);
 const SECRET_FILE_EXTENSIONS = new Set([
     ".pem",
@@ -284,6 +312,23 @@ function isSecretFileName(name) {
         return true;
     return false;
 }
+/**
+ * Resolve `relPath` under `baseDir`, returning the absolute path only if it
+ * stays inside `baseDir`. Knowledge-file paths come from the Hub (tenant-
+ * controlled) and are written to disk on pull/scaffold, so they MUST be
+ * contained — otherwise `../rules/data-fetching.md` could overwrite an
+ * auto-loaded Claude Code rule on a teammate's machine (audit H6).
+ */
+function safeJoinWithin(baseDir, relPath) {
+    if (typeof relPath !== "string" || relPath.length === 0 || relPath.includes("\0")) {
+        return null;
+    }
+    const base = path.resolve(baseDir);
+    const resolved = path.resolve(base, relPath);
+    if (resolved !== base && !resolved.startsWith(base + path.sep))
+        return null;
+    return resolved;
+}
 /**
  * Walk a directory collecting deployable source files. Excludes machine-state
  * and secrets, NEVER follows symlinks (a symlink could point at ~/.ssh/id_rsa
@@ -1068,7 +1113,7 @@ async function loadAnalysisConfig() {
         const apiKey = env.VITE_OVERSCORE_API_KEY;
         const projectSlug = env.VITE_OVERSCORE_PROJECT_SLUG;
         if (apiUrl && apiKey && projectSlug) {
-            return { apiUrl, apiKey, projectSlug };
+            return { apiUrl: safeApiUrl(apiUrl), apiKey, projectSlug };
         }
     }
     // (2) ~/.overscore/config
@@ -1086,7 +1131,7 @@ async function loadAnalysisConfig() {
                 });
                 if (checkRes.ok) {
                     return {
-                        apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                        apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                         apiKey: cfg.OVERSCORE_API_KEY,
                         projectSlug: cfg.OVERSCORE_PROJECT_SLUG,
                     };
@@ -1096,7 +1141,7 @@ async function loadAnalysisConfig() {
             catch {
                 // Can't reach the hub — use saved config and hope for the best
                 return {
-                    apiUrl: cfg.OVERSCORE_API_URL || `${HUB_URL}/api`,
+                    apiUrl: safeApiUrl(cfg.OVERSCORE_API_URL || `${HUB_URL}/api`),
                     apiKey: cfg.OVERSCORE_API_KEY,
                     projectSlug: cfg.OVERSCORE_PROJECT_SLUG,
                 };
@@ -1264,9 +1309,15 @@ async function syncKnowledgeBase(targetDir, baseUrl, projectSlug, apiKey) {
         if (!data.files || data.files.length === 0)
             return false;
         fs.mkdirSync(knowledgeDir, { recursive: true });
-        // Write each knowledge file
+        // Write each knowledge file — contained within knowledgeDir (audit H6).
         for (const file of data.files) {
-            fs.writeFileSync(path.join(knowledgeDir, file.path), file.content);
+            const dest = safeJoinWithin(knowledgeDir, file.path);
+            if (!dest) {
+                console.warn(`  Skipped knowledge file with unsafe path: ${file.path}`);
+                continue;
+            }
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            fs.writeFileSync(dest, file.content);
         }
         // Generate INDEX.md
         const indexLines = [
@@ -1777,8 +1828,16 @@ function collectAnalysisFiles(dir, prefix, patterns) {
     const userPatterns = patterns ?? loadOverscoreIgnore(dir);
     const files = [];
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        // Never follow symlinks or ship secrets — same guards as the deploy path's
+        // collectSourceFiles (audit H5: this analysis-publish collector had neither,
+        // so a poisoned agent could upload service-account.json / id_rsa, or a
+        // file-target symlink to ~/.ssh/id_rsa).
+        if (entry.isSymbolicLink())
+            continue;
         if (isBaselineExcluded(entry.name))
             continue;
+        if (isSecretFileName(entry.name))
+            continue;
         const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
         if (isIgnored(relativePath, entry.isDirectory(), userPatterns))
             continue;
@@ -2332,6 +2391,17 @@ async function dev() {
         await cleanup();
         process.exit(0);
     });
+    // Also clean up on terminal close (SIGHUP) and on a crash, so the short-lived
+    // dev key isn't stranded live when the tab closes or the process throws (M12).
+    process.on("SIGHUP", async () => {
+        await cleanup();
+        process.exit(0);
+    });
+    process.on("uncaughtException", async (err) => {
+        await cleanup();
+        console.error(err);
+        process.exit(1);
+    });
 }
 // ── auth ────────────────────────────────────────────────────────────
 async function authStatus() {
@@ -2520,6 +2590,90 @@ ${installed.map((s) => `    - ${s}`).join("\n")}
   Re-run this command anytime to update.
 `);
 }
+// ── template pull ──────────────────────────────────────────────────
+async function templatePull(slug) {
+    if (!slug) {
+        console.error("\n  Usage: npx @overscore/cli template pull <template-slug> [dir]\n");
+        console.error("  Example:");
+        console.error("    npx @overscore/cli template pull mrr-tracker\n");
+        process.exit(1);
+    }
+    const targetDir = path.resolve(process.cwd(), process.argv[4] || slug);
+    const url = `https://overscore.dev/api/templates/${slug}/source`;
+    console.log(`\n  Pulling template: ${slug}...`);
+    let res;
+    try {
+        res = await fetch(url, {
+            // Optional: attach device token if available, for attribution in install counting
+            headers: (() => {
+                const configPath = path.join(process.env.HOME || "", ".overscore", "config");
+                if (fs.existsSync(configPath)) {
+                    const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
+                    if (cfg.OVERSCORE_DEVICE_TOKEN) {
+                        return { Authorization: `Bearer ${cfg.OVERSCORE_DEVICE_TOKEN}` };
+                    }
+                }
+                return {};
+            })(),
+        });
+    }
+    catch {
+        console.error(`\n  Error: Could not reach overscore.dev\n`);
+        process.exit(1);
+    }
+    if (!res.ok) {
+        let errorMsg = `HTTP ${res.status}`;
+        try {
+            const body = await res.json();
+            errorMsg = body.error || errorMsg;
+        }
+        catch {
+            //
+        }
+        console.error(`\n  Error: ${errorMsg}\n`);
+        process.exit(1);
+    }
+    const templateSlug = res.headers.get("X-OS-Template-Slug") || slug;
+    const templateVersion = res.headers.get("X-OS-Template-Version") || "0";
+    const zipBuffer = Buffer.from(await res.arrayBuffer());
+    // Confirm overwrite if dir exists
+    if (fs.existsSync(targetDir)) {
+        const yes = await confirm(`Directory "${path.basename(targetDir)}" already exists. Overwrite?`);
+        if (!yes) {
+            console.log("  Cancelled.\n");
+            return;
+        }
+        for (const entry of fs.readdirSync(targetDir)) {
+            if (entry === "node_modules")
+                continue;
+            fs.rmSync(path.join(targetDir, entry), { recursive: true, force: true });
+        }
+    }
+    else {
+        fs.mkdirSync(targetDir, { recursive: true });
+    }
+    // Extract zip
+    await extractZip(zipBuffer, targetDir);
+    // Write provenance: templates don't have .env (unbound to a project)
+    // Instead, .overscore/template.json records the pull metadata
+    const oscoreDir = path.join(targetDir, ".overscore");
+    fs.mkdirSync(oscoreDir, { recursive: true });
+    fs.writeFileSync(path.join(oscoreDir, "template.json"), JSON.stringify({
+        template_slug: templateSlug,
+        template_version: templateVersion,
+        pulled_at: new Date().toISOString(),
+    }, null, 2));
+    console.log(`
+  ✓ Template extracted to: ${path.relative(process.cwd(), targetDir)}
+
+  Next steps:
+    cd ${path.relative(process.cwd(), targetDir)}
+    npm install
+    npx @overscore/cli dev
+
+  This template runs on mock data — no warehouse connection or API key needed.
+`);
+}
 // ── Routing ─────────────────────────────────────────────────────────
 const command = process.argv[2];
 const subcommand = process.argv[3];
@@ -2552,6 +2706,23 @@ else if (command === "auth") {
         authStatus();
     }
 }
+else if (command === "template") {
+    if (subcommand === "pull") {
+        templatePull(process.argv[4]);
+    }
+    else {
+        console.log(`
+  overscore template — Manage marketplace templates
+
+  Commands:
+    pull <slug> [dir]        Download and extract a template
+
+  Examples:
+    npx @overscore/cli template pull mrr-tracker
+    npx @overscore/cli template pull mrr-tracker my-mrr-dash
+`);
+    }
+}
 else if (command === "analysis") {
     if (subcommand === "new") {
         analysisNew(process.argv[4]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.1",
+  "version": "0.13.4",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"