@overscore/cli 0.13.13 → 0.13.15

package/dist/index.js

@@ -1608,6 +1608,37 @@ function decidePlatformWrite(fullPath, serverContent, serverHash, lastSyncedHash
     }
     return { action: "skip", reason: "user-modified" };
 }
+// The Hub platform-rules channel currently serves dashboard content (React
+// rules, deploy-dashboard/start-dashboard skills, and dashboard flavors of
+// skills the analysis template ships its own versions of). Syncing it into
+// an analysis misleads Claude and marks the analysis's own skills as
+// "user-modified" — so analyses only receive the artifact-neutral files.
+const ANALYSIS_PLATFORM_ALLOW = [
+    "platform-capabilities.md",
+    "skills/update-platform/",
+];
+function isAnalysisDir(targetDir) {
+    if (fs.existsSync(path.join(targetDir, ".overscore", "analysis.json"))) {
+        return true;
+    }
+    // Pulled bundles don't include .overscore/ — fall back to the CLAUDE.md
+    // heading, the same detection syncClaudeMdImports uses.
+    const claudeMdPath = path.join(targetDir, ".claude", "CLAUDE.md");
+    if (!fs.existsSync(claudeMdPath))
+        return false;
+    return /^#\s+Overscore\s+Analysis/im.test(fs.readFileSync(claudeMdPath, "utf-8"));
+}
+function filterPlatformFilesForArtifact(targetDir, files) {
+    if (!isAnalysisDir(targetDir))
+        return files;
+    const kept = {};
+    for (const [relPath, content] of Object.entries(files)) {
+        if (ANALYSIS_PLATFORM_ALLOW.some((p) => relPath === p || relPath.startsWith(p))) {
+            kept[relPath] = content;
+        }
+    }
+    return kept;
+}
 /**
  * Fetch the latest platform-owned Claude Code rules from the Hub and write
  * them into the project's .claude/ directory. Called from `deploy` (before
@@ -1615,6 +1646,7 @@ function decidePlatformWrite(fullPath, serverContent, serverHash, lastSyncedHash
  * paths). User-owned files (knowledge/, this-dashboard.md) are NOT touched.
  *
  * Preserves user edits via .claude/.platform-meta.json hash tracking.
+ * Analyses only receive the artifact-neutral subset (see ANALYSIS_PLATFORM_ALLOW).
  */
 async function syncPlatformRules(targetDir, baseUrl, apiKey) {
     try {
@@ -1626,10 +1658,11 @@ async function syncPlatformRules(targetDir, baseUrl, apiKey) {
         const data = (await res.json());
         if (!data.files)
             return;
+        const files = filterPlatformFilesForArtifact(targetDir, data.files);
         const meta = readPlatformMeta(targetDir);
         const written = [];
         const preserved = [];
-        for (const [relPath, content] of Object.entries(data.files)) {
+        for (const [relPath, content] of Object.entries(files)) {
             const fullPath = path.join(targetDir, ".claude", relPath);
             const serverHash = data.hashes?.[relPath] ?? md5(content);
             const lastSyncedHash = meta.last_synced[relPath] ?? null;
@@ -1695,10 +1728,11 @@ async function platformUpdate(checkOnly = false, force = false) {
         console.error("\n  Error: No files in platform-rules response.\n");
         process.exit(1);
     }
+    const files = filterPlatformFilesForArtifact(process.cwd(), data.files);
     const meta = readPlatformMeta(process.cwd());
     const updated = [];
     const preserved = [];
-    for (const [relPath, content] of Object.entries(data.files)) {
+    for (const [relPath, content] of Object.entries(files)) {
         const fullPath = path.join(process.cwd(), ".claude", relPath);
         const serverHash = data.hashes?.[relPath] ?? md5(content);
         const lastSyncedHash = meta.last_synced[relPath] ?? null;
@@ -1901,6 +1935,27 @@ async function analysisNew(title) {
     https://${data.project_slug}.${HUB_HOST}/analysis/${data.slug}
 `);
 }
+async function dashboardCreate(name, slugArg, description) {
+    if (!name || name.startsWith("--")) {
+        console.error('\n  Usage: npx @overscore/cli dashboard create "<name>" [--slug <slug>] [--description <text>]\n');
+        process.exit(1);
+    }
+    // Reuses the project-level config/request helpers (resolve project + key, then POST).
+    const cfg = await loadAnalysisConfig();
+    console.log(`\n  Creating dashboard: "${name}"\n`);
+    const data = (await analysisApiRequest(cfg, "POST", `/api/projects/${cfg.projectSlug}/dashboards`, { name, slug: slugArg, description }));
+    console.log(`  Dashboard created: ${data.name}
+  Slug:    ${data.slug}
+  Project: ${data.project_slug}
+
+  Next step — scaffold the local folder for it:
+
+    npm create overscore@latest -- --project ${data.project_slug} --dashboard ${data.slug}
+
+  then build it and \`npx @overscore/cli deploy\`. It will be live at:
+    https://${data.project_slug}.${HUB_HOST}/${data.slug}/
+`);
+}
 function loadAnalysisMetadata() {
     const metaPath = path.resolve(process.cwd(), ".overscore", "analysis.json");
     if (!fs.existsSync(metaPath)) {
@@ -1916,6 +1971,9 @@ const ANALYSIS_PUBLISH_BASELINE_EXCLUDE = new Set([
     ".git",
     ".DS_Store",
     ".overscore",
+    // Raw query-result cache (real warehouse rows) — never publishable, even
+    // if .overscoreignore is edited. Mirrors the dashboard deploy SOURCE_EXCLUDE.
+    "data",
 ]);
 function isBaselineExcluded(name) {
     if (ANALYSIS_PUBLISH_BASELINE_EXCLUDE.has(name))
@@ -2915,6 +2973,25 @@ else if (command === "analysis") {
 `);
     }
 }
+else if (command === "dashboard") {
+    if (subcommand === "create") {
+        const slugIdx = process.argv.indexOf("--slug");
+        const descIdx = process.argv.indexOf("--description");
+        dashboardCreate(process.argv[4], slugIdx !== -1 ? process.argv[slugIdx + 1] : undefined, descIdx !== -1 ? process.argv[descIdx + 1] : undefined);
+    }
+    else {
+        console.log(`
+  overscore dashboard — Manage dashboards
+
+  Commands:
+    create "<name>" [--slug <slug>] [--description <text>]
+                            Create a new (empty) dashboard in your project
+
+  Examples:
+    npx @overscore/cli dashboard create "Sales Pipeline (metrics)" --slug sales-pipeline-metrics
+`);
+    }
+}
 else if (command === "platform") {
     if (subcommand === "update") {
         const checkOnly = process.argv.includes("--check");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.13",
+  "version": "0.13.15",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"

package/templates/analysis/.claude/rules/report-html.md

@@ -11,7 +11,7 @@ paths:
 
 - **Inline all CSS.** No `<link rel="stylesheet">`, no Tailwind CDN, no Google Fonts (or use a `data:` URI / system stack). Use a single `<style>` block in the `<head>`.
 - **Bake the data into the HTML.** No `fetch()`, no `XMLHttpRequest`, no API calls. The numbers must be visible to anyone who opens the file with no logins, no tokens, no broken external dependencies.
-- **Charts are inline.** Inline SVG is the safest option. Embedded base64 PNGs are OK. A self-contained chart library (Recharts/D3 from CDN) is acceptable **only if the data is already baked into the page** and the script tag is inline-loaded — but inline SVG is preferred because it survives indefinitely.
+- **Charts are inline.** Inline SVG is the safest option. Embedded base64 PNGs are OK. **No CDN or external `<script src>` — the published report is served under a CSP that blocks all external scripts**, so a CDN-loaded chart library works in local preview but silently breaks after publish. If you must use a JS chart library, paste its source into an inline `<script>` block — but inline SVG is preferred because it survives indefinitely.
 - **No `useQuery`, no `@overscore/client`, no React.** This is a static HTML file, not a React app.
 
 ## Aesthetic direction