create-hedgeboard 1.2.0 → 1.4.0

package/index.js

@@ -51,7 +51,7 @@ function parseArgs() {
     npx create-hedgeboard --key YOUR_API_KEY --dir ./my-workspace
 
   Options:
-    --key, -k   Your HedgeBoard API key (required)
+    --key, -k   Your HB SEC Filing Data API key (optional)
     --dir, -d   Output directory (default: ./hedgeboard)
     --help, -h  Show this help
 `);
@@ -60,12 +60,8 @@ function parseArgs() {
     }
 
     if (!opts.key) {
-        console.error(
-            "Error: --key is required.\n" +
-            "  Get your API key at https://www.hedgeboardhq.com/dashboard\n\n" +
-            "  Usage: npx create-hedgeboard --key YOUR_API_KEY"
-        );
-        process.exit(1);
+        // Key is optional — platform works without it
+        opts.key = "";
     }
 
     return opts;
@@ -97,18 +93,85 @@ function fetchBuffer(url, headers = {}) {
 }
 
 // ---------------------------------------------------------------------------
-// ZIP extraction (pure JS, no dependencies)
+// Recursive directory copy (pure JS, no shell — replaces cp -r)
+// ---------------------------------------------------------------------------
+
+function copyDirRecursive(src, dest) {
+    fs.mkdirSync(dest, { recursive: true });
+    for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            copyDirRecursive(srcPath, destPath);
+        } else {
+            fs.copyFileSync(srcPath, destPath);
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// ZIP extraction (pure JS — uses only Node built-in zlib, no dependencies)
 // ---------------------------------------------------------------------------
 
 function extractZip(zipBuffer, destDir) {
-    // Simple ZIP parser — handles DEFLATE and STORE methods
-    // For robustness in production, consider using a proper zip library
-    const { execSync } = require("child_process");
-    const tmpZip = path.join(require("os").tmpdir(), `hedgeboard-${Date.now()}.zip`);
-    fs.writeFileSync(tmpZip, zipBuffer);
+    const zlib = require("zlib");
     fs.mkdirSync(destDir, { recursive: true });
-    execSync(`unzip -o -q "${tmpZip}" -d "${destDir}"`);
-    fs.unlinkSync(tmpZip);
+
+    // Parse ZIP central directory (from end-of-central-directory record)
+    const buf = Buffer.isBuffer(zipBuffer) ? zipBuffer : Buffer.from(zipBuffer);
+    let offset = 0;
+
+    while (offset < buf.length - 4) {
+        // Local file header signature = 0x04034b50
+        const sig = buf.readUInt32LE(offset);
+        if (sig !== 0x04034b50) break;
+
+        const method = buf.readUInt16LE(offset + 8);
+        const compSize = buf.readUInt32LE(offset + 18);
+        const uncompSize = buf.readUInt32LE(offset + 22);
+        const nameLen = buf.readUInt16LE(offset + 26);
+        const extraLen = buf.readUInt16LE(offset + 28);
+        const nameStart = offset + 30;
+        const name = buf.toString("utf8", nameStart, nameStart + nameLen);
+        const dataStart = nameStart + nameLen + extraLen;
+
+        offset = dataStart + compSize;
+
+        // Skip directories (with path traversal guard — P3-9)
+        if (name.endsWith("/")) {
+            const dirPath = path.join(destDir, name);
+            if (!dirPath.startsWith(path.resolve(destDir) + path.sep) &&
+                dirPath !== path.resolve(destDir)) {
+                console.warn(`  Skipping ${name}: path traversal detected`);
+                continue;
+            }
+            fs.mkdirSync(dirPath, { recursive: true });
+            continue;
+        }
+
+        // Path traversal guard — prevent ../../.bashrc attacks (P0-8)
+        const filePath = path.join(destDir, name);
+        if (!filePath.startsWith(path.resolve(destDir) + path.sep) &&
+            filePath !== path.resolve(destDir)) {
+            console.warn(`  Skipping ${name}: path traversal detected`);
+            continue;
+        }
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+
+        const rawData = buf.subarray(dataStart, dataStart + compSize);
+
+        if (method === 0) {
+            // STORE — no compression
+            fs.writeFileSync(filePath, rawData);
+        } else if (method === 8) {
+            // DEFLATE — use raw inflate (no zlib header)
+            const inflated = zlib.inflateRawSync(rawData);
+            fs.writeFileSync(filePath, inflated);
+        } else {
+            // Unsupported method — skip
+            console.warn(`  Skipping ${name}: unsupported compression method ${method}`);
+        }
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -143,7 +206,7 @@ ${c.dim}    ██████╔╝██║   ██║███████
 ${c.dim}    ██╔══██╗██║   ██║██╔══██║██╔══██╗██║  ██║${c.reset}
 ${c.dim}    ██████╔╝╚██████╔╝██║  ██║██║  ██║██████╔╝${c.reset}
 ${c.dim}    ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝ ${c.reset}
-${c.dim}    AI-Native Financial Intelligence — v1.0.8${c.reset}
+${c.dim}    AI-Native Financial Intelligence — v1.3.0${c.reset}
 `);
 }
 
@@ -156,15 +219,19 @@ async function main() {
 
     banner();
 
-    // 1. Validate API key against the app
-    process.stdout.write(`  ${c.gray}◆${c.reset} Validating API key ${c.dim}...${c.reset} `);
-    try {
-        const resp = await fetchBuffer(`${APP_URL}/api/data-sources?key=${key}`);
-        const data = JSON.parse(resp.toString());
-        if (data.error) throw new Error(data.error);
-        console.log(`${c.green}✓${c.reset}`);
-    } catch (err) {
-        console.log(`${c.green}✓${c.reset} ${c.dim}(offline)${c.reset}`);
+    // 1. Validate API key against the app (if provided)
+    if (key) {
+        process.stdout.write(`  ${c.gray}◆${c.reset} Validating API key ${c.dim}...${c.reset} `);
+        try {
+            const resp = await fetchBuffer(`${APP_URL}/api/data-sources`, {
+                "x-api-key": key,
+            });
+            const data = JSON.parse(resp.toString());
+            if (data.error) throw new Error(data.error);
+            console.log(`${c.green}✓${c.reset}`);
+        } catch (err) {
+            console.log(`${c.green}✓${c.reset} ${c.dim}(offline)${c.reset}`);
+        }
     }
 
     // 2. Download toolkit from S3
@@ -191,8 +258,8 @@ async function main() {
         if (fs.existsSync(extractedDir)) {
             fs.mkdirSync(path.dirname(absDir), { recursive: true });
             if (fs.existsSync(absDir)) {
-                const { execSync } = require("child_process");
-                execSync(`cp -r "${extractedDir}/"* "${absDir}/"`);
+                // Merge into existing dir — pure JS, no shell (P3-8)
+                copyDirRecursive(extractedDir, absDir);
             } else {
                 fs.renameSync(extractedDir, absDir);
             }
@@ -205,13 +272,20 @@ async function main() {
         process.exit(1);
     }
 
-    // 4. Write .env with the user's API key
-    process.stdout.write(`  ${c.gray}◆${c.reset} Configuring API key ${c.dim}...${c.reset} `);
+    // 4. Write .env with the user's API key (if provided)
+    process.stdout.write(`  ${c.gray}◆${c.reset} Configuring workspace ${c.dim}...${c.reset} `);
     const envPath = path.join(absDir, ".env");
-    fs.writeFileSync(
-        envPath,
-        `# HedgeBoard API\nHEDGEBOARD_API_KEY=${key}\nHEDGEBOARD_API_URL=${API_URL}\n`
-    );
+    if (key) {
+        fs.writeFileSync(
+            envPath,
+            `# HedgeBoard Data Sources\nHEDGEBOARD_API_KEY=${key}\nHEDGEBOARD_API_URL=${API_URL}\n`
+        );
+    } else {
+        fs.writeFileSync(
+            envPath,
+            `# HedgeBoard Data Sources\n# Add your HB SEC Filing Data key from: https://www.hedgeboardhq.com/dashboard\nHEDGEBOARD_API_KEY=\nHEDGEBOARD_API_URL=${API_URL}\n`
+        );
+    }
     console.log(`${c.green}✓${c.reset}`);
 
     // 5. Summary
@@ -222,15 +296,19 @@ async function main() {
 ${c.dim}  ─────────────────────────────────────${c.reset}
 
   ${c.bold}Directory${c.reset}   ${c.cyan}${relDir}/${c.reset}
-  ${c.bold}API Key${c.reset}     ${c.dim}${key.slice(0, 8)}${"•".repeat(12)}${key.slice(-4)}${c.reset}
+  ${key
+            ? `${c.bold}API Key${c.reset}     ${c.dim}${key.slice(0, 8)}${"•".repeat(12)}${key.slice(-4)}${c.reset}`
+            : `${c.bold}API Key${c.reset}     ${c.dim}not set — add from dashboard${c.reset}`
+        }
   ${c.bold}API URL${c.reset}     ${c.dim}${API_URL}${c.reset}
 
   ${c.bold}What's inside:${c.reset}
   ${c.gray}├──${c.reset} ${c.white}INSTRUCTIONS.md${c.reset}  ${c.dim}Agent instructions & prompt${c.reset}
-  ${c.gray}├──${c.reset} ${c.white}data/${c.reset}            ${c.dim}SEC data fetching modules${c.reset}
+  ${c.gray}├──${c.reset} ${c.white}data/${c.reset}            ${c.dim}Data source adapters${c.reset}
   ${c.gray}├──${c.reset} ${c.white}viz/${c.reset}             ${c.dim}Dashboard templates & charts${c.reset}
   ${c.gray}├──${c.reset} ${c.white}brand/${c.reset}           ${c.dim}Your brand settings${c.reset}
   ${c.gray}├──${c.reset} ${c.white}modules/${c.reset}         ${c.dim}356 analysis recipes + indexes${c.reset}
+  ${c.gray}├──${c.reset} ${c.white}docs/${c.reset}            ${c.dim}Data catalog — 35 providers, 15 categories${c.reset}
   ${c.gray}└──${c.reset} ${c.white}output/${c.reset}          ${c.dim}Generated dashboards land here${c.reset}
 
 ${c.dim}  ─────────────────────────────────────${c.reset}
@@ -243,7 +321,7 @@ ${c.dim}  ───────────────────────
   ${c.cyan}2.${c.reset} Ask something:
      ${c.magenta}"Give me a company overview of Apple"${c.reset}
 
-  ${c.cyan}3.${c.reset} Customize your brand at:
+  ${c.cyan}3.${c.reset} Connect data sources at:
      ${c.underline}https://www.hedgeboardhq.com/dashboard${c.reset}
 `);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "create-hedgeboard",
-    "version": "1.2.0",
+    "version": "1.4.0",
     "description": "Set up a HedgeBoard financial intelligence workspace",
     "bin": {
         "create-hedgeboard": "index.js"