@overscore/cli 0.13.14 → 0.13.15

package/dist/index.js

@@ -1608,6 +1608,37 @@ function decidePlatformWrite(fullPath, serverContent, serverHash, lastSyncedHash
     }
     return { action: "skip", reason: "user-modified" };
 }
+// The Hub platform-rules channel currently serves dashboard content (React
+// rules, deploy-dashboard/start-dashboard skills, and dashboard flavors of
+// skills the analysis template ships its own versions of). Syncing it into
+// an analysis misleads Claude and marks the analysis's own skills as
+// "user-modified" — so analyses only receive the artifact-neutral files.
+const ANALYSIS_PLATFORM_ALLOW = [
+    "platform-capabilities.md",
+    "skills/update-platform/",
+];
+function isAnalysisDir(targetDir) {
+    if (fs.existsSync(path.join(targetDir, ".overscore", "analysis.json"))) {
+        return true;
+    }
+    // Pulled bundles don't include .overscore/ — fall back to the CLAUDE.md
+    // heading, the same detection syncClaudeMdImports uses.
+    const claudeMdPath = path.join(targetDir, ".claude", "CLAUDE.md");
+    if (!fs.existsSync(claudeMdPath))
+        return false;
+    return /^#\s+Overscore\s+Analysis/im.test(fs.readFileSync(claudeMdPath, "utf-8"));
+}
+function filterPlatformFilesForArtifact(targetDir, files) {
+    if (!isAnalysisDir(targetDir))
+        return files;
+    const kept = {};
+    for (const [relPath, content] of Object.entries(files)) {
+        if (ANALYSIS_PLATFORM_ALLOW.some((p) => relPath === p || relPath.startsWith(p))) {
+            kept[relPath] = content;
+        }
+    }
+    return kept;
+}
 /**
  * Fetch the latest platform-owned Claude Code rules from the Hub and write
  * them into the project's .claude/ directory. Called from `deploy` (before
@@ -1615,6 +1646,7 @@ function decidePlatformWrite(fullPath, serverContent, serverHash, lastSyncedHash
  * paths). User-owned files (knowledge/, this-dashboard.md) are NOT touched.
  *
  * Preserves user edits via .claude/.platform-meta.json hash tracking.
+ * Analyses only receive the artifact-neutral subset (see ANALYSIS_PLATFORM_ALLOW).
  */
 async function syncPlatformRules(targetDir, baseUrl, apiKey) {
     try {
@@ -1626,10 +1658,11 @@ async function syncPlatformRules(targetDir, baseUrl, apiKey) {
         const data = (await res.json());
         if (!data.files)
             return;
+        const files = filterPlatformFilesForArtifact(targetDir, data.files);
         const meta = readPlatformMeta(targetDir);
         const written = [];
         const preserved = [];
-        for (const [relPath, content] of Object.entries(data.files)) {
+        for (const [relPath, content] of Object.entries(files)) {
             const fullPath = path.join(targetDir, ".claude", relPath);
             const serverHash = data.hashes?.[relPath] ?? md5(content);
             const lastSyncedHash = meta.last_synced[relPath] ?? null;
@@ -1695,10 +1728,11 @@ async function platformUpdate(checkOnly = false, force = false) {
         console.error("\n  Error: No files in platform-rules response.\n");
         process.exit(1);
     }
+    const files = filterPlatformFilesForArtifact(process.cwd(), data.files);
     const meta = readPlatformMeta(process.cwd());
     const updated = [];
     const preserved = [];
-    for (const [relPath, content] of Object.entries(data.files)) {
+    for (const [relPath, content] of Object.entries(files)) {
         const fullPath = path.join(process.cwd(), ".claude", relPath);
         const serverHash = data.hashes?.[relPath] ?? md5(content);
         const lastSyncedHash = meta.last_synced[relPath] ?? null;
@@ -1937,6 +1971,9 @@ const ANALYSIS_PUBLISH_BASELINE_EXCLUDE = new Set([
     ".git",
     ".DS_Store",
     ".overscore",
+    // Raw query-result cache (real warehouse rows) — never publishable, even
+    // if .overscoreignore is edited. Mirrors the dashboard deploy SOURCE_EXCLUDE.
+    "data",
 ]);
 function isBaselineExcluded(name) {
     if (ANALYSIS_PUBLISH_BASELINE_EXCLUDE.has(name))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.14",
+  "version": "0.13.15",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"

package/templates/analysis/.claude/rules/report-html.md

@@ -11,7 +11,7 @@ paths:
 
 - **Inline all CSS.** No `<link rel="stylesheet">`, no Tailwind CDN, no Google Fonts (or use a `data:` URI / system stack). Use a single `<style>` block in the `<head>`.
 - **Bake the data into the HTML.** No `fetch()`, no `XMLHttpRequest`, no API calls. The numbers must be visible to anyone who opens the file with no logins, no tokens, no broken external dependencies.
-- **Charts are inline.** Inline SVG is the safest option. Embedded base64 PNGs are OK. A self-contained chart library (Recharts/D3 from CDN) is acceptable **only if the data is already baked into the page** and the script tag is inline-loaded — but inline SVG is preferred because it survives indefinitely.
+- **Charts are inline.** Inline SVG is the safest option. Embedded base64 PNGs are OK. **No CDN or external `<script src>` — the published report is served under a CSP that blocks all external scripts**, so a CDN-loaded chart library works in local preview but silently breaks after publish. If you must use a JS chart library, paste its source into an inline `<script>` block — but inline SVG is preferred because it survives indefinitely.
 - **No `useQuery`, no `@overscore/client`, no React.** This is a static HTML file, not a React app.
 
 ## Aesthetic direction