@overscore/cli 0.13.8 → 0.13.9

package/dist/index.js

@@ -41,10 +41,17 @@ function parseEnv(content) {
 function safeApiUrl(apiUrl) {
     try {
         const h = new URL(apiUrl).hostname;
+        // Also allow the configured hub's host — prod by default, or a staging host
+        // only if the operator set OVERSCORE_HUB_URL (a trusted, user-set env var).
+        // If OVERSCORE_HUB_URL is unset, hubHost === overscore.dev and behavior is
+        // identical to before, so real users are unaffected.
+        const hubHost = new URL(HUB_URL).hostname;
         if (h === "overscore.dev" ||
             h.endsWith(".overscore.dev") ||
             h === "localhost" ||
-            h === "127.0.0.1") {
+            h === "127.0.0.1" ||
+            h === hubHost ||
+            h.endsWith("." + hubHost)) {
             return apiUrl;
         }
     }
@@ -911,8 +918,8 @@ async function pull(slug) {
             process.exit(1);
         }
     }
-    const apiUrl = "https://overscore.dev/api";
-    const baseUrl = apiUrl.replace(/\/api$/, "");
+    const apiUrl = `${HUB_URL}/api`;
+    const baseUrl = HUB_URL;
     const versionQuery = versionParam ? `?version=${versionParam}` : "";
     const url = `${baseUrl}/api/dashboards/${slug}/source${versionQuery}`;
     console.log(`\n  Pulling source for: ${slug}${versionParam ? ` (v${versionParam})` : ""}...`);
@@ -963,7 +970,7 @@ async function pull(slug) {
     const envContent = `# Overscore Configuration
 VITE_OVERSCORE_PROJECT_SLUG=${projectSlug}
 VITE_OVERSCORE_DASHBOARD_SLUG=${dashboardSlug}
-VITE_OVERSCORE_API_URL=https://overscore.dev/api
+VITE_OVERSCORE_API_URL=${HUB_URL}/api
 `;
     fs.writeFileSync(path.join(targetDir, ".env"), envContent, { mode: 0o600 });
     const rulesDir = path.join(targetDir, ".claude", "rules");
@@ -1125,7 +1132,23 @@ function collectFiles(dir, prefix) {
     return files;
 }
 // ── Analysis commands ──────────────────────────────────────────────
-const HUB_URL = "https://overscore.dev";
+// Hub the CLI talks to. Defaults to production. A TRUSTED override — the
+// OVERSCORE_HUB_URL env var, set deliberately by the operator (e.g. to point at
+// a staging environment during a security audit) — can repoint it. This is
+// distinct from the project-.env override (VITE_OVERSCORE_API_URL), which stays
+// restricted by safeApiUrl() so a poisoned project can't redirect the API key +
+// bundle to an attacker host (audit L6).
+const HUB_URL = (process.env.OVERSCORE_HUB_URL || "https://overscore.dev").replace(/\/+$/, "");
+// Bare host of the hub (overscore.dev, or overscore-test.com on staging) for
+// building the {slug}.<host> URLs we print back to the user.
+const HUB_HOST = (() => {
+    try {
+        return new URL(HUB_URL).hostname;
+    }
+    catch {
+        return "overscore.dev";
+    }
+})();
 function slugify(input) {
     return input
         .toLowerCase()
@@ -1792,7 +1815,7 @@ async function analysisNew(title) {
     npx @overscore/cli analysis publish
 
   The analysis will go live at:
-    https://${data.project_slug}.overscore.dev/analysis/${data.slug}
+    https://${data.project_slug}.${HUB_HOST}/analysis/${data.slug}
 `);
 }
 function loadAnalysisMetadata() {
@@ -2385,7 +2408,7 @@ async function dev() {
         apiKey = keyData.raw_key ?? null;
     }
     catch {
-        console.error("\n  Error: Could not reach overscore.dev to create dev session key.\n");
+        console.error(`\n  Error: Could not reach ${HUB_HOST} to create dev session key.\n`);
         process.exit(1);
     }
     if (!apiKey) {
@@ -2644,7 +2667,7 @@ async function templatePull(slug) {
         ? apiSlug.slice(apiSlug.indexOf("_") + 1)
         : apiSlug;
     const targetDir = path.resolve(process.cwd(), process.argv[5] || localSlug);
-    const url = `https://overscore.dev/api/templates/${apiSlug}/source`;
+    const url = `${HUB_URL}/api/templates/${apiSlug}/source`;
     console.log(`\n  Pulling template: ${slug}...`);
     let res;
     try {
@@ -2663,7 +2686,7 @@ async function templatePull(slug) {
         });
     }
     catch {
-        console.error(`\n  Error: Could not reach overscore.dev\n`);
+        console.error(`\n  Error: Could not reach ${HUB_HOST}\n`);
         process.exit(1);
     }
     if (!res.ok) {

package/dist/template-push.js

@@ -34,7 +34,8 @@
 import fs from "fs";
 import path from "path";
 import { execSync } from "child_process";
-const HUB_URL = "https://overscore.dev";
+// Trusted operator override (e.g. staging audit); defaults to production.
+const HUB_URL = (process.env.OVERSCORE_HUB_URL || "https://overscore.dev").replace(/\/+$/, "");
 // Mirrors the templates_slug_format CHECK in the marketplace migration.
 // `_` is the handle namespace delimiter in the stored slug ({handle}_{local}).
 const TEMPLATE_SLUG_RE = /^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$/;
@@ -263,7 +264,7 @@ export async function templatePush(slugArg) {
         });
     }
     catch {
-        console.error(`\n  Error: Could not reach overscore.dev\n`);
+        console.error(`\n  Error: Could not reach ${new URL(HUB_URL).hostname}\n`);
         process.exit(1);
     }
     const data = (await res.json().catch(() => ({})));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.8",
+  "version": "0.13.9",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"