@overscore/cli 0.13.14 → 0.13.16

package/dist/index.js

@@ -913,7 +913,7 @@ function formatCell(value) {
 }
 async function pull(slug) {
     if (!slug) {
-        console.error("\n  Usage: npx @overscore/cli pull <dashboard-slug> [--version N]\n");
+        console.error("\n  Usage: npx @overscore/cli pull <dashboard-slug> [--version N] [--force]\n");
         console.error("  Example:");
         console.error("    npx @overscore/cli pull my-dashboard\n");
         process.exit(1);
@@ -923,35 +923,47 @@ async function pull(slug) {
     const versionParam = versionIndex !== -1 && process.argv[versionIndex + 1]
         ? process.argv[versionIndex + 1]
         : null;
-    // Resolve API key: device token → auto-create os_ key, else prompt
+    // --force skips the "directory exists, overwrite?" confirm — needed for non-interactive
+    // re-pulls (scripted rebuilds / `workspace sync`). Source is versioned in the Hub, and the
+    // clean step below already preserves node_modules + .env, so overwriting is safe.
+    const force = process.argv.includes("--force");
+    // Resolve API key: device token → auto-create os_ key, else the saved project key, else prompt.
     let apiKey = "";
     const configPath = path.join(process.env.HOME || "", ".overscore", "config");
-    if (fs.existsSync(configPath)) {
-        const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
-        const deviceToken = cfg.OVERSCORE_DEVICE_TOKEN;
-        if (deviceToken) {
-            try {
-                const keyRes = await fetch(`${HUB_URL}/api/projects/${slug}/api-keys`, {
-                    method: "POST",
-                    headers: {
-                        Authorization: `Bearer ${deviceToken}`,
-                        "Content-Type": "application/json",
-                    },
-                    body: JSON.stringify({ name: `${slug} pull key` }),
-                });
-                if (keyRes.status === 401 || keyRes.status === 403) {
-                    console.error("\n  Error: Device token is invalid or expired. Run 'npx @overscore/cli auth login' to re-authenticate.\n");
-                    process.exit(1);
-                }
-                if (keyRes.ok) {
-                    const keyData = (await keyRes.json());
-                    apiKey = keyData.raw_key || "";
-                }
+    const cfg = fs.existsSync(configPath)
+        ? parseEnv(fs.readFileSync(configPath, "utf-8"))
+        : {};
+    const deviceToken = cfg.OVERSCORE_DEVICE_TOKEN;
+    if (deviceToken) {
+        try {
+            const keyRes = await fetch(`${HUB_URL}/api/projects/${slug}/api-keys`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${deviceToken}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({ name: `${slug} pull key` }),
+            });
+            if (keyRes.status === 401 || keyRes.status === 403) {
+                console.error("\n  Error: Device token is invalid or expired. Run 'npx @overscore/cli auth login' to re-authenticate.\n");
+                process.exit(1);
             }
-            catch {
-                // Network error — fall through to prompt
+            if (keyRes.ok) {
+                const keyData = (await keyRes.json());
+                apiKey = keyData.raw_key || "";
             }
         }
+        catch {
+            // Network error — fall through to the saved key / prompt
+        }
+    }
+    // The mint above targets /api/projects/<slug>, but `slug` is a DASHBOARD slug — for any
+    // project whose name differs from the dashboard (i.e. any multi-dashboard project) that
+    // 404s and leaves apiKey empty. Fall back to the project API key saved by `auth login`:
+    // it authorizes every dashboard in the logged-in project, which is the common pull case
+    // (and what makes non-interactive `pull` / scripted rebuilds work).
+    if (!apiKey && cfg.OVERSCORE_API_KEY) {
+        apiKey = cfg.OVERSCORE_API_KEY;
     }
     if (!apiKey) {
         console.log("  Tip: Run 'npx @overscore/cli auth login' to authenticate once and skip this step.");
@@ -989,7 +1001,7 @@ async function pull(slug) {
     const zipBuffer = Buffer.from(await res.arrayBuffer());
     // Extract to ./<slug>/
     const targetDir = path.resolve(process.cwd(), slug);
-    if (fs.existsSync(targetDir)) {
+    if (fs.existsSync(targetDir) && !force) {
         const yes = await confirm(`Directory "${slug}" already exists. Overwrite source files?`);
         if (!yes) {
             console.log("  Cancelled.\n");
@@ -1608,6 +1620,37 @@ function decidePlatformWrite(fullPath, serverContent, serverHash, lastSyncedHash
     }
     return { action: "skip", reason: "user-modified" };
 }
+// The Hub platform-rules channel currently serves dashboard content (React
+// rules, deploy-dashboard/start-dashboard skills, and dashboard flavors of
+// skills the analysis template ships its own versions of). Syncing it into
+// an analysis misleads Claude and marks the analysis's own skills as
+// "user-modified" — so analyses only receive the artifact-neutral files.
+const ANALYSIS_PLATFORM_ALLOW = [
+    "platform-capabilities.md",
+    "skills/update-platform/",
+];
+function isAnalysisDir(targetDir) {
+    if (fs.existsSync(path.join(targetDir, ".overscore", "analysis.json"))) {
+        return true;
+    }
+    // Pulled bundles don't include .overscore/ — fall back to the CLAUDE.md
+    // heading, the same detection syncClaudeMdImports uses.
+    const claudeMdPath = path.join(targetDir, ".claude", "CLAUDE.md");
+    if (!fs.existsSync(claudeMdPath))
+        return false;
+    return /^#\s+Overscore\s+Analysis/im.test(fs.readFileSync(claudeMdPath, "utf-8"));
+}
+function filterPlatformFilesForArtifact(targetDir, files) {
+    if (!isAnalysisDir(targetDir))
+        return files;
+    const kept = {};
+    for (const [relPath, content] of Object.entries(files)) {
+        if (ANALYSIS_PLATFORM_ALLOW.some((p) => relPath === p || relPath.startsWith(p))) {
+            kept[relPath] = content;
+        }
+    }
+    return kept;
+}
 /**
  * Fetch the latest platform-owned Claude Code rules from the Hub and write
  * them into the project's .claude/ directory. Called from `deploy` (before
@@ -1615,6 +1658,7 @@ function decidePlatformWrite(fullPath, serverContent, serverHash, lastSyncedHash
  * paths). User-owned files (knowledge/, this-dashboard.md) are NOT touched.
  *
  * Preserves user edits via .claude/.platform-meta.json hash tracking.
+ * Analyses only receive the artifact-neutral subset (see ANALYSIS_PLATFORM_ALLOW).
  */
 async function syncPlatformRules(targetDir, baseUrl, apiKey) {
     try {
@@ -1626,10 +1670,11 @@ async function syncPlatformRules(targetDir, baseUrl, apiKey) {
         const data = (await res.json());
         if (!data.files)
             return;
+        const files = filterPlatformFilesForArtifact(targetDir, data.files);
         const meta = readPlatformMeta(targetDir);
         const written = [];
         const preserved = [];
-        for (const [relPath, content] of Object.entries(data.files)) {
+        for (const [relPath, content] of Object.entries(files)) {
             const fullPath = path.join(targetDir, ".claude", relPath);
             const serverHash = data.hashes?.[relPath] ?? md5(content);
             const lastSyncedHash = meta.last_synced[relPath] ?? null;
@@ -1695,10 +1740,11 @@ async function platformUpdate(checkOnly = false, force = false) {
         console.error("\n  Error: No files in platform-rules response.\n");
         process.exit(1);
     }
+    const files = filterPlatformFilesForArtifact(process.cwd(), data.files);
     const meta = readPlatformMeta(process.cwd());
     const updated = [];
     const preserved = [];
-    for (const [relPath, content] of Object.entries(data.files)) {
+    for (const [relPath, content] of Object.entries(files)) {
         const fullPath = path.join(process.cwd(), ".claude", relPath);
         const serverHash = data.hashes?.[relPath] ?? md5(content);
         const lastSyncedHash = meta.last_synced[relPath] ?? null;
@@ -1937,6 +1983,9 @@ const ANALYSIS_PUBLISH_BASELINE_EXCLUDE = new Set([
     ".git",
     ".DS_Store",
     ".overscore",
+    // Raw query-result cache (real warehouse rows) — never publishable, even
+    // if .overscoreignore is edited. Mirrors the dashboard deploy SOURCE_EXCLUDE.
+    "data",
 ]);
 function isBaselineExcluded(name) {
     if (ANALYSIS_PUBLISH_BASELINE_EXCLUDE.has(name))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.14",
+  "version": "0.13.16",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"

package/templates/analysis/.claude/rules/report-html.md

@@ -11,7 +11,7 @@ paths:
 
 - **Inline all CSS.** No `<link rel="stylesheet">`, no Tailwind CDN, no Google Fonts (or use a `data:` URI / system stack). Use a single `<style>` block in the `<head>`.
 - **Bake the data into the HTML.** No `fetch()`, no `XMLHttpRequest`, no API calls. The numbers must be visible to anyone who opens the file with no logins, no tokens, no broken external dependencies.
-- **Charts are inline.** Inline SVG is the safest option. Embedded base64 PNGs are OK. A self-contained chart library (Recharts/D3 from CDN) is acceptable **only if the data is already baked into the page** and the script tag is inline-loaded — but inline SVG is preferred because it survives indefinitely.
+- **Charts are inline.** Inline SVG is the safest option. Embedded base64 PNGs are OK. **No CDN or external `<script src>` — the published report is served under a CSP that blocks all external scripts**, so a CDN-loaded chart library works in local preview but silently breaks after publish. If you must use a JS chart library, paste its source into an inline `<script>` block — but inline SVG is preferred because it survives indefinitely.
 - **No `useQuery`, no `@overscore/client`, no React.** This is a static HTML file, not a React app.
 
 ## Aesthetic direction