@hey-research-lab/check 0.0.0-stage → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md ADDED
@@ -0,0 +1,56 @@
1
+ # Changelog
2
+
3
+ All notable changes to this project are documented here. The format follows
4
+ [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
5
+ [Semantic Versioning](https://semver.org/).
6
+
7
+ ## 0.1.1 — unreleased (not yet on npm)
8
+
9
+ ### Changed
10
+
11
+ - The token check reads in HEY's own words (ruling R2, 2026-10-28): "Project names this contract",
12
+ "Not named by the project" or "Project names another contract", on the terminal answer and the card,
13
+ without the stored value in brackets. `--json` is unchanged.
14
+ - Development: vitest 4.1.12.
15
+
16
+ ### Fixed
17
+
18
+ - `--no-card` (and `--json --no-card`, `--quiet --no-card`) answers on a platform the card
19
+ renderer has no prebuilt binary for. `@resvg/resvg-js` is loaded when a card is drawn, not at
20
+ start-up; before, a missing binary crashed every run with a stack trace. Drawing a card there
21
+ now fails as `card_not_written` (exit 1) after the answer, and the message says to use
22
+ `--no-card`.
23
+ - An empty input (what bash and zsh leave of an unquoted or double-quoted `$CHIT`) says to quote
24
+ the ticker in single quotes, and an input that arrives wrapped in quotes (cmd.exe passes them
25
+ on) says to leave them out. Both still exit 2; nothing new is accepted.
26
+
27
+ ### Added
28
+
29
+ - `examples/check-many.sh`: run `hey-check --json --no-card` over a list of inputs and print a
30
+ tab-separated table.
31
+ - `docs/TROUBLESHOOTING.md`, an issue form for bugs, and Discussion category forms (Q&A, Ideas,
32
+ Show and tell) that take effect if Discussions are enabled.
33
+ - CI runs on Node.js 22 and 24 and fails when the committed `dist/` differs from a fresh build.
34
+
35
+ ### Changed
36
+
37
+ - README: install notes (single quotes for a ticker, cmd.exe, git for `npx github:`, the card
38
+ renderer's platforms), the `candidatesTotal` shape (`{ count, atLeast }`), and links to Hey
39
+ Research Lab's other open tools. SECURITY.md leads with the e-mail contact.
40
+
41
+ ## 0.1.0 — 2026-10-18
42
+
43
+ ### Added
44
+
45
+ - `hey-check <input>`: a dev check for a Robinhood Chain token or project from HEY Research Lab's
46
+ public API — HEY's answer first, then the activity status in HEY's words, the last meaningful
47
+ ship with its title and source, meaningful events in 30 days, the token contract and its
48
+ verification, up to two unknowns and HEY's citation.
49
+ - Input: a contract address (or CAIP-10 on chain 4663), a `$TICKER`, a project name or slug, an
50
+ `@handle`, or an x.com / twitter.com profile URL; validated before any request.
51
+ - A 1200×675 PNG card drawn with the bundled Geist font (`--out`, `--no-card`).
52
+ - The same-name notice: for a contract HEY has not published, the published project that
53
+ carries its name or ticker on a different contract, from HEY's scan card.
54
+ - `--json` (schema `hey.check/v1`), `--tweet`, `--quiet`, `--no-color`.
55
+ - Exit codes 0–7, including 7 for an ambiguous match (HEY does not guess).
56
+ - The `hey-check` Agent Skill (`skills/hey-check/SKILL.md`) for Claude Code, Codex and Cursor.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 HEY Research Lab
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md CHANGED
@@ -1,3 +1,409 @@
1
- # Temporary Holding Version
1
+ # hey-check
2
2
 
3
- This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
3
+ A dev check for any Robinhood Chain token or project: is anyone building it, and what did they
4
+ ship? Answered from HEY Research Lab's public record, printed in your terminal and drawn as a
5
+ shareable card.
6
+
7
+ [![CI](https://github.com/hey-research-lab/hey-check/actions/workflows/ci.yml/badge.svg)](https://github.com/hey-research-lab/hey-check/actions/workflows/ci.yml)
8
+ [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
9
+ [![Node >= 22](https://img.shields.io/badge/node-%3E%3D22-informational.svg)](package.json)
10
+ [![Robinhood Chain 4663](https://img.shields.io/badge/Robinhood%20Chain-4663-black.svg)](https://heyresearch.xyz)
11
+
12
+ ![hey-check card for Chit: Shipping, last shipped 3 days ago, 4 meaningful events in 30 days](docs/example-chit.png)
13
+
14
+ ## Why it exists
15
+
16
+ "Is the dev still building?" is the question people ask about a token before anything else, and
17
+ it is usually answered by vibes. HEY Research Lab records, with a source for every fact, which
18
+ Robinhood Chain projects are still building and what they shipped. `hey-check` asks HEY that one
19
+ question from the command line, prints the answer with its source, and draws it as a 1200×675
20
+ PNG you can post on X — the card carries HEY's link, so anyone who sees it can check the record
21
+ themselves.
22
+
23
+ It answers the builder question only. It never gives a safety verdict, a risk score, a price or
24
+ a reason to trade.
25
+
26
+ ## Why Robinhood Chain only
27
+
28
+ HEY researches one chain: Robinhood Chain, chain id `4663` (`eip155:4663`). It is implicit; there
29
+ is no network, chain or RPC option. A CAIP-10 address on another chain (`eip155:1:0x…`), or a
30
+ `--chain`/`--network` flag, is refused with `unsupported_chain` (exit 2).
31
+
32
+ ## Install
33
+
34
+ No install needed:
35
+
36
+ ```sh
37
+ npx @hey-research-lab/check '$CHIT'
38
+ npm install --global @hey-research-lab/check # or install the `hey-check` command
39
+ ```
40
+
41
+ Or straight from this repository:
42
+
43
+ ```sh
44
+ npx github:hey-research-lab/hey-check '$CHIT'
45
+ ```
46
+
47
+ Node.js 22 or later (CI runs the tests on 22 and 24). No API key, no account.
48
+
49
+ - **Quote a `$TICKER`** in single quotes (`'$CHIT'`) in bash, zsh, fish and PowerShell, or the
50
+ shell replaces it with an empty variable. In cmd.exe, leave the quotes out: `hey-check $CHIT`.
51
+ - **`npx github:` needs git** on your `PATH`: npm fetches the package with it.
52
+ - **The card** is drawn by [`@resvg/resvg-js`](https://github.com/thx/resvg-js), which has
53
+ prebuilt binaries for macOS, Windows, Linux (glibc and musl) and Android on the common
54
+ architectures. Where it has none, `--no-card` still prints the answer.
55
+
56
+ Something not working? See [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md).
57
+
58
+ ## Smallest working example
59
+
60
+ ```sh
61
+ hey-check '$CHIT'
62
+ ```
63
+
64
+ ```text
65
+ Chit is shipping consistently: 4 meaningful events in 30 days; latest ship 3 days ago.
66
+
67
+ Chit $CHIT
68
+ Status Shipping
69
+ Last ship 3 days ago (2026-10-14) — Code changes, week starting 2026-10-12 (to 2026-10-17)
70
+ https://github.com/<owner>/chit-app
71
+ Last 30 days 4 meaningful events
72
+ Contract 0xd523a627030509021cc39b6d7c8543417d3e50d8 · Project names this contract
73
+ Unknowns NOT_MEASURED — HEY read its website and found no link to docs.
74
+ NOT_MEASURED — Its website links no API description.
75
+ Page https://heyresearch.xyz/project/chit
76
+ Card ./hey-check-chit.png
77
+
78
+ Source: HEY Research Lab, builder research for Robinhood Chain — https://heyresearch.xyz/project/chit, as of 2026-10-17, rules hbm-v31
79
+ Builder evidence, not a safety verdict or investment advice.
80
+ ```
81
+
82
+ The first line is HEY's own answer. Everything below it is HEY's record in HEY's words: the
83
+ activity status (Shipping, Active, Resumed, Quiet, Dormant or Unknown), the last meaningful ship
84
+ with its title and source, the count of meaningful events in 30 days, the token contract and
85
+ whether HEY verified it, and up to two things HEY says it does not know.
86
+
87
+ ## Examples
88
+
89
+ ```sh
90
+ hey-check '$CHIT' # a ticker
91
+ hey-check 0xd523a627030509021cc39b6d7c8543417d3e50d8 # a contract address
92
+ hey-check loom # a project name or slug
93
+ hey-check @loomdesktrade # an X handle
94
+ hey-check https://x.com/loomdesktrade # an X profile URL
95
+ hey-check '$CHIT' --tweet # a ready-to-post text
96
+ hey-check '$CHIT' --json --no-card | jq .builder # for scripts and agents
97
+ hey-check '$CHIT' --out ~/Desktop/chit.png # choose where the card goes
98
+ ```
99
+
100
+ ### Check a list
101
+
102
+ [`examples/check-many.sh`](examples/check-many.sh) runs `hey-check --json --no-card` over a file
103
+ with one input per line, one second apart, and prints a tab-separated table (it needs `jq`):
104
+
105
+ ```sh
106
+ examples/check-many.sh examples/inputs.txt
107
+ ```
108
+
109
+ ```text
110
+ input outcome status last_ship page
111
+ $CHIT answered Shipping 2026-10-14 https://heyresearch.xyz/project/chit
112
+ 0xdcfe58b38ee3eb3c1b27856b7353bed7bc9550d8 not_found not a published project on HEY https://heyresearch.xyz/scan/0xdcfe58b38ee3eb3c1b27856b7353bed7bc9550d8
113
+ loom answered Shipping 2026-10-15 https://heyresearch.xyz/project/loom
114
+ pepe ambiguous 20+ matches; pass a slug or the contract
115
+ ```
116
+
117
+ That was HEY's answer on 2026-10-19 (UTC); the record moves as projects ship.
118
+
119
+ ### A token that shares a published project's name
120
+
121
+ On chain a token is its contract, never its name or ticker. When you check a contract HEY has no
122
+ published project for, `hey-check` also reads HEY's scan card, and if a published project carries
123
+ the same name or ticker on a different contract it says so, as facts, in an amber notice:
124
+
125
+ ```sh
126
+ hey-check 0xdcfe58b38ee3eb3c1b27856b7353bed7bc9550d8
127
+ ```
128
+
129
+ ```text
130
+ 0xdcfe58b38ee3eb3c1b27856b7353bed7bc9550d8 is not a published project on HEY.
131
+
132
+ HEY holds no published project for that contract. That is a statement about HEY’s index, not
133
+ about the token; … A published project carries this token’s name or ticker on a different
134
+ contract: "chit" on 0xd523a627030509021cc39b6d7c8543417d3e50d8 (the same name and ticker; an
135
+ address ending in the same four characters). On chain a token is its contract, never its name
136
+ or ticker.
137
+
138
+ Same name or ticker on another contract
139
+ Chit ($CHIT) · 0xd523a627030509021cc39b6d7c8543417d3e50d8 · https://heyresearch.xyz/project/chit
140
+
141
+ Scan https://heyresearch.xyz/scan/0xdcfe58b38ee3eb3c1b27856b7353bed7bc9550d8
142
+ Card ./hey-check-0xdcfe-50d8.png
143
+
144
+ Builder evidence, not a safety verdict or investment advice.
145
+ ```
146
+
147
+ ![hey-check card for an unpublished token: Chit is published on HEY on a different contract](docs/example-copycat.png)
148
+
149
+ ### More than one match
150
+
151
+ HEY does not guess, and neither does `hey-check`. A name or ticker that matches several
152
+ published projects lists them and exits 7; run it again with one slug or the contract:
153
+
154
+ ```sh
155
+ hey-check pepe
156
+ ```
157
+
158
+ ```text
159
+ More than one published project matches. HEY does not guess.
160
+
161
+ pepes Pepes ($Pepes) · Shipping · 0xe2c4…5644
162
+ …
163
+ Showing 8 of 19 matches.
164
+
165
+ Pick one: hey-check pepes (or pass the token's 0x contract address)
166
+ ```
167
+
168
+ ## The card
169
+
170
+ A 1200×675 PNG (X's large image size): the project's name and ticker, HEY's activity status, when
171
+ it last shipped and what, the meaningful events in 30 days, the contract and whether HEY verified
172
+ it, the HEY page it came from, the UTC date it was checked, and the line "Builder evidence, not a
173
+ safety verdict or investment advice." Lime marks HEY's building states (Shipping, Active,
174
+ Resumed) and nothing else; amber appears only for a same-name notice.
175
+
176
+ - Written to `./hey-check-<slug>.png` (or `hey-check-0xabcd-1234.png` for a contract) in the
177
+ current directory, or to `--out <file.png>`. The path must end in `.png` and its directory
178
+ must exist. A symbolic link at the path is refused; nothing is written anywhere else.
179
+ - Drawn with the bundled Geist font only (system fonts are never loaded), so it looks the same
180
+ on every machine. Characters Geist cannot draw (emoji, CJK, Arabic …) are left off the card; a
181
+ name with none it can draw shows the project's slug.
182
+ - No card for an ambiguous match, or with `--no-card`.
183
+
184
+ ## Options
185
+
186
+ | Option | Meaning |
187
+ | -------------------- | ------------------------------------------------------------------------------------------------ |
188
+ | `--json` | Print exactly one JSON document (`hey.check/v1`, below) on stdout. |
189
+ | `--no-card` | Do not draw the PNG. |
190
+ | `-o`, `--out <file>` | Where to write the card (must end in `.png`). |
191
+ | `--tweet` | Print a ready-to-post text instead of the report (the card is still written unless `--no-card`). |
192
+ | `--quiet` | One line: slug, status and last ship (one slug per line for an ambiguous match). |
193
+ | `--no-color` | No ANSI styling. Also `NO_COLOR=1`, and whenever stdout is not a terminal. |
194
+ | `-h`, `--help` | Help. |
195
+ | `-v`, `--version` | Version. |
196
+
197
+ `--tweet` prints the builder fact and HEY's page link, under 280 characters as X counts them (a
198
+ link counts as 23), and nothing about price:
199
+
200
+ ```text
201
+ Dev check on Chit ($CHIT), Robinhood Chain: Shipping. Last shipped 3 days ago; 4 meaningful events in 30 days.
202
+
203
+ Builder evidence from HEY Research Lab, not a safety verdict: https://heyresearch.xyz/project/chit
204
+ ```
205
+
206
+ ## JSON output
207
+
208
+ `--json` prints a stable object built from HEY's answer. It keeps HEY's state words verbatim and
209
+ holds builder evidence only: HEY's market and usage context are never read, so no price,
210
+ valuation, liquidity or volume field exists in it. A value HEY did not send is `null`, never `0`,
211
+ `false` or "none".
212
+
213
+ ```json
214
+ {
215
+ "schema": "hey.check/v1",
216
+ "ok": true,
217
+ "outcome": "answered",
218
+ "chain": { "name": "Robinhood Chain", "chainId": 4663, "caip2": "eip155:4663" },
219
+ "input": { "raw": "$CHIT", "kind": "ticker", "sent": { "q": "$CHIT" } },
220
+ "answer": "Chit is shipping consistently: 4 meaningful events in 30 days; latest ship 3 days ago.",
221
+ "project": {
222
+ "slug": "chit",
223
+ "name": "Chit",
224
+ "symbol": "CHIT",
225
+ "url": "https://heyresearch.xyz/project/chit",
226
+ "researchLevel": "VERIFIED_BUILDER",
227
+ "catalogStatus": "VERIFIED_BUILDER"
228
+ },
229
+ "builder": {
230
+ "activityStatus": "SHIPPING",
231
+ "activityLabel": "Shipping",
232
+ "activityMeasured": true,
233
+ "lastMeaningfulShipAt": "2026-10-14T08:20:49.000Z",
234
+ "meaningfulEvents30d": 4
235
+ },
236
+ "latestShip": {
237
+ "id": "ship:74a69137-9a47-401b-b18d-62d4e778d069",
238
+ "title": "Code changes, week starting 2026-10-12 (to 2026-10-17)",
239
+ "occurredAt": "2026-10-14T08:20:49.000Z",
240
+ "precision": "WEEK",
241
+ "sourceUrl": "https://github.com/<owner>/chit-app",
242
+ "receiptUrl": "https://heyresearch.xyz/api/evidence/ship%3A74a69137-9a47-401b-b18d-62d4e778d069"
243
+ },
244
+ "contract": {
245
+ "address": "0xd523a627030509021cc39b6d7c8543417d3e50d8",
246
+ "verification": "VERIFIED"
247
+ },
248
+ "unknowns": [
249
+ {
250
+ "category": "NOT_MEASURED",
251
+ "dimension": "officialDocs",
252
+ "text": "HEY read its website and found no link to docs.",
253
+ "reason": "no_docs_link_found"
254
+ }
255
+ ],
256
+ "candidates": null,
257
+ "candidatesTotal": null,
258
+ "notFound": null,
259
+ "citation": "Source: HEY Research Lab, builder research for Robinhood Chain — https://heyresearch.xyz/project/chit, as of 2026-10-17, rules hbm-v31",
260
+ "page": "https://heyresearch.xyz/project/chit",
261
+ "card": { "path": "./hey-check-chit.png" },
262
+ "tweet": null,
263
+ "boundary": "Builder evidence, not a safety verdict or investment advice.",
264
+ "disclaimer": "Public, source-backed activity HEY recorded. …",
265
+ "error": null,
266
+ "source": {
267
+ "requests": [
268
+ {
269
+ "url": "https://heyresearch.xyz/api/agent/research_project?q=%24CHIT",
270
+ "status": 200,
271
+ "requestId": "…"
272
+ }
273
+ ],
274
+ "asOf": "2026-10-17T22:58:21.063Z",
275
+ "fetchedAt": "2026-10-17T23:00:00.000Z"
276
+ }
277
+ }
278
+ ```
279
+
280
+ | Field | Meaning |
281
+ | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
282
+ | `outcome` | `answered` (a published project), `ambiguous` (several match; see `candidates`), `not_found` (see `notFound`), or `null` on an error. |
283
+ | `input.kind` | `address`, `ticker`, `name`, `handle` or `x_profile`; `input.sent` is the query HEY received. |
284
+ | `answer` | HEY's answer: its first sentence when answered, HEY's message otherwise. |
285
+ | `builder.activityStatus` | HEY's code verbatim: `SHIPPING`, `ACTIVE`, `RESUMED`, `QUIET`, `DORMANT`, `UNKNOWN`; `activityLabel` is its word. |
286
+ | `latestShip` | HEY's latest meaningful change with its evidence id, source URL and receipt; `null` when HEY's answer carries none. |
287
+ | `contract.verification` | `VERIFIED`, `UNVERIFIED` or `MISMATCH`, as HEY says it; `contract` is `null` when HEY records no token for the project. |
288
+ | `unknowns` | Every gap HEY lists (deduplicated), with HEY's category (`NOT_MEASURED`, `NOT_VERIFIED`, `STALE`, `INSUFFICIENT_EVIDENCE`, `UNKNOWN`). |
289
+ | `candidates`, `candidatesTotal` | For `ambiguous`: the projects HEY listed, and how many matched in all as `{ count, atLeast }` (`atLeast: true`: at least `count` matched). |
290
+ | `notFound` | For `not_found`: HEY's message, the contract, the scan page, and `namesakes` (published projects with the same name or ticker on another contract). `namesakesRead: false` means the scan card could not be read — not that there are none. |
291
+ | `card` | `{ "path" }` when a card was written, else `null`. |
292
+ | `tweet` | The post text with `--tweet`, else `null`. |
293
+ | `disclaimer` | HEY's own disclaimer, relayed. |
294
+ | `error` | `{ code, message, retryable, requestId?, retryAfterSeconds? }` on failure (`ok: false`), or when the card could not be written (`ok: true`, exit 1). |
295
+
296
+ ## Exit codes
297
+
298
+ | Code | Meaning |
299
+ | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
300
+ | 0 | Answered: HEY holds a published project for the input. |
301
+ | 1 | Answered, but the card could not be written (path, symlink, permissions, or no card renderer for this platform: use `--no-card`). |
302
+ | 2 | Usage error: input that is not an address, `$TICKER`, name, `@handle` or x.com profile URL, the zero or burn address, a bad flag, `unsupported_chain`. No request is made. |
303
+ | 3 | HEY refused the request (an `invalid_request` other than `ambiguous`). |
304
+ | 4 | Not published: HEY holds no published project for the input. That is a statement about HEY's index, not about the token. |
305
+ | 5 | Rate limited (429). Wait the printed delay; `hey-check` does not retry. |
306
+ | 6 | Network failure, timeout, redirect, an unreadable or oversized answer, or a HEY 5xx. |
307
+ | 7 | More than one published project matches; HEY does not guess. Pick one from the list. |
308
+
309
+ Codes 0 and 2–6 mean the same in every HEY Research Lab CLI; 1 and 7 are this tool's.
310
+
311
+ ## Use it from an AI agent: the `/devcheck` skill
312
+
313
+ [`skills/hey-check/SKILL.md`](skills/hey-check/SKILL.md) is an [Agent
314
+ Skill](https://agentskills.io/specification). Installed, it lets you ask your coding agent
315
+ "/devcheck $CHIT" or "is anyone building 0xd523…?" and get HEY's builder answer with its source
316
+ and the boundary that it is not a safety verdict. The agent runs `npx -y
317
+ github:hey-research-lab/hey-check <input> --json --no-card` (or, if it is connected, HEY's hosted
318
+ MCP server at `https://heyresearch.xyz/mcp`, tool `research_answer`).
319
+
320
+ **Claude Code** — user scope (every project) or project scope:
321
+
322
+ ```sh
323
+ git clone --depth 1 https://github.com/hey-research-lab/hey-check /tmp/hey-check
324
+ mkdir -p ~/.claude/skills && cp -R /tmp/hey-check/skills/hey-check ~/.claude/skills/
325
+ # or, for one project: cp -R /tmp/hey-check/skills/hey-check .claude/skills/
326
+ ```
327
+
328
+ **OpenAI Codex** — Codex reads `~/.agents/skills/` (user) and `.agents/skills/` (repository):
329
+
330
+ ```sh
331
+ mkdir -p ~/.agents/skills && cp -R /tmp/hey-check/skills/hey-check ~/.agents/skills/
332
+ ```
333
+
334
+ **Cursor** — Cursor reads `~/.cursor/skills/` (user) and `.cursor/skills/` (project):
335
+
336
+ ```sh
337
+ mkdir -p ~/.cursor/skills && cp -R /tmp/hey-check/skills/hey-check ~/.cursor/skills/
338
+ ```
339
+
340
+ Or with the skills CLI, for any of them: `npx skills add hey-research-lab/hey-check`.
341
+
342
+ ## How it relates to HEY Research Lab
343
+
344
+ `hey-check` reads HEY's public API with plain HTTPS GET requests to `https://heyresearch.xyz`, at
345
+ most two a run:
346
+
347
+ - `GET /api/agent/research_project?address=<0x…>` for a contract, `?q=<text>` for a `$TICKER`,
348
+ name, slug or `@handle` (HEY's agent answer, AgentIntelligenceResponse v1). When the input is
349
+ exactly one candidate's slug in an `ambiguous` answer, it asks once more with `?project=<slug>`.
350
+ - `GET /api/v1/scan?chain=4663&token=<0x…>` only for a contract HEY has no published project for,
351
+ to read `publishedNamesakes`.
352
+
353
+ It computes nothing of its own: the activity status, the last ship, the event count, the token
354
+ verification and every unknown are HEY's, decided by HEY's private quality gate and relayed with
355
+ their source. Public API docs: <https://heyresearch.xyz/docs/public-api>. The same answers are
356
+ served to agents by the hosted MCP server, <https://heyresearch.xyz/mcp>. For every other read
357
+ (ships, changes, evidence, unknowns), use [`@hey-research-lab/cli`](https://github.com/hey-research-lab/hey-cli).
358
+
359
+ Other open tools from Hey Research Lab:
360
+
361
+ - [`hey-cli`](https://github.com/hey-research-lab/hey-cli): every public read (projects, ships,
362
+ changes, evidence, unknowns) from the terminal, with JSON output.
363
+ - [`chainprint`](https://github.com/hey-research-lab/chainprint): an offline scan of a source tree
364
+ for evidence that the code targets Robinhood Chain.
365
+ - [`rhchain-registry`](https://github.com/hey-research-lab/rhchain-registry): Robinhood Chain
366
+ infrastructure (factories, DEXes, launchpads and more), each entry citing its public sources.
367
+ - [`hey-data`](https://github.com/hey-research-lab/hey-data): NDJSON snapshots of HEY's public
368
+ builder records.
369
+ - [`awesome-robinhood-chain`](https://github.com/hey-research-lab/awesome-robinhood-chain): projects
370
+ building on Robinhood Chain, each with public evidence that it ships.
371
+
372
+ ## What it does NOT prove
373
+
374
+ `hey-check` relays HEY's builder evidence: whether HEY recorded meaningful development and what
375
+ was shipped, with its source. It does not prove that a token is safe, that a project is
376
+ legitimate, or anything about a token's price or future, and nothing it prints or draws is
377
+ investment advice or an endorsement by HEY. A shared name or ticker is a fact about names, not a
378
+ verdict on either token. "Not a published project on HEY" is a statement about HEY's index, not
379
+ about the token, and an unknown value means HEY does not know — not zero.
380
+
381
+ HEY Research Lab is an independent research project and is not affiliated with, endorsed by or partnered with Robinhood Markets, Inc. or Robinhood Chain.
382
+
383
+ ## Security
384
+
385
+ See [SECURITY.md](SECURITY.md). `hey-check` makes HTTPS GET requests to `https://heyresearch.xyz`
386
+ only (at most two a run), follows no redirect, gives up after 15 seconds, reads at most 1 MiB of
387
+ an answer, and refuses an answer carrying a `__proto__`, `constructor` or `prototype` key. Input
388
+ is validated before any request. Text from HEY and its sources (project names, ship titles) is
389
+ treated as untrusted: control, escape, invisible and bidirectional-override characters are
390
+ stripped before it reaches your terminal, the JSON or the card, and it is XML-escaped into the
391
+ card's SVG. It writes one file, the card, at the path shown, never through a symbolic link, and
392
+ runs no child processes.
393
+
394
+ ## Contributing
395
+
396
+ See [CONTRIBUTING.md](CONTRIBUTING.md). `pnpm install && pnpm scan && pnpm lint && pnpm typecheck
397
+ && pnpm test && pnpm build`; tests run against saved fixtures with the network blocked.
398
+ `pnpm card:examples` redraws the two example cards in `docs/` from the fixtures. Never commit a
399
+ secret or a `.env` with values.
400
+
401
+ Runtime dependency: [`@resvg/resvg-js`](https://github.com/thx/resvg-js) (MPL-2.0), which turns
402
+ the card's SVG into a PNG without a browser — the one dependency the card needs.
403
+
404
+ ## Licence
405
+
406
+ Code: MIT © 2026 HEY Research Lab. See [LICENSE](LICENSE).
407
+
408
+ The bundled font, Geist (`assets/fonts/`), is © 2024 The Geist Project Authors and licensed under
409
+ the SIL Open Font License 1.1; see [`assets/fonts/OFL.txt`](assets/fonts/OFL.txt).
Binary file
Binary file
Binary file
@@ -0,0 +1,93 @@
1
+ Copyright 2024 The Geist Project Authors (https://github.com/vercel/geist-font)
2
+
3
+ This Font Software is licensed under the SIL Open Font License, Version 1.1.
4
+ This license is copied below, and is also available with a FAQ at:
5
+ https://openfontlicense.org
6
+
7
+
8
+ -----------------------------------------------------------
9
+ SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
10
+ -----------------------------------------------------------
11
+
12
+ PREAMBLE
13
+ The goals of the Open Font License (OFL) are to stimulate worldwide
14
+ development of collaborative font projects, to support the font creation
15
+ efforts of academic and linguistic communities, and to provide a free and
16
+ open framework in which fonts may be shared and improved in partnership
17
+ with others.
18
+
19
+ The OFL allows the licensed fonts to be used, studied, modified and
20
+ redistributed freely as long as they are not sold by themselves. The
21
+ fonts, including any derivative works, can be bundled, embedded,
22
+ redistributed and/or sold with any software provided that any reserved
23
+ names are not used by derivative works. The fonts and derivatives,
24
+ however, cannot be released under any other type of license. The
25
+ requirement for fonts to remain under this license does not apply
26
+ to any document created using the fonts or their derivatives.
27
+
28
+ DEFINITIONS
29
+ "Font Software" refers to the set of files released by the Copyright
30
+ Holder(s) under this license and clearly marked as such. This may
31
+ include source files, build scripts and documentation.
32
+
33
+ "Reserved Font Name" refers to any names specified as such after the
34
+ copyright statement(s).
35
+
36
+ "Original Version" refers to the collection of Font Software components as
37
+ distributed by the Copyright Holder(s).
38
+
39
+ "Modified Version" refers to any derivative made by adding to, deleting,
40
+ or substituting -- in part or in whole -- any of the components of the
41
+ Original Version, by changing formats or by porting the Font Software to a
42
+ new environment.
43
+
44
+ "Author" refers to any designer, engineer, programmer, technical
45
+ writer or other person who contributed to the Font Software.
46
+
47
+ PERMISSION & CONDITIONS
48
+ Permission is hereby granted, free of charge, to any person obtaining
49
+ a copy of the Font Software, to use, study, copy, merge, embed, modify,
50
+ redistribute, and sell modified and unmodified copies of the Font
51
+ Software, subject to the following conditions:
52
+
53
+ 1) Neither the Font Software nor any of its individual components,
54
+ in Original or Modified Versions, may be sold by itself.
55
+
56
+ 2) Original or Modified Versions of the Font Software may be bundled,
57
+ redistributed and/or sold with any software, provided that each copy
58
+ contains the above copyright notice and this license. These can be
59
+ included either as stand-alone text files, human-readable headers or
60
+ in the appropriate machine-readable metadata fields within text or
61
+ binary files as long as those fields can be easily viewed by the user.
62
+
63
+ 3) No Modified Version of the Font Software may use the Reserved Font
64
+ Name(s) unless explicit written permission is granted by the corresponding
65
+ Copyright Holder. This restriction only applies to the primary font name as
66
+ presented to the users.
67
+
68
+ 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
69
+ Software shall not be used to promote, endorse or advertise any
70
+ Modified Version, except to acknowledge the contribution(s) of the
71
+ Copyright Holder(s) and the Author(s) or with their explicit written
72
+ permission.
73
+
74
+ 5) The Font Software, modified or unmodified, in part or in whole,
75
+ must be distributed entirely under this license, and must not be
76
+ distributed under any other license. The requirement for fonts to
77
+ remain under this license does not apply to any document created
78
+ using the Font Software.
79
+
80
+ TERMINATION
81
+ This license becomes null and void if any of the above conditions are
82
+ not met.
83
+
84
+ DISCLAIMER
85
+ THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
86
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
87
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
88
+ OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
89
+ COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
90
+ INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
91
+ DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
92
+ FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
93
+ OTHER DEALINGS IN THE FONT SOFTWARE.