@llamaventures/cli 1.13.0 → 1.14.0

package/CHANGELOG.md

@@ -0,0 +1,370 @@
+# Changelog
+
+All notable changes to `@llamaventures/cli` are documented here.
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
+this project adheres to [Semantic Versioning](https://semver.org).
+
+## [Unreleased]
+
+## [1.14.0] — 2026-06-15
+
+### Added
+- **`llama deal enrich <dealId>`** — fetch the Llama Command deal-enrichment
+  harness for one deal. Defaults to dry-run and returns the evidence plan,
+  source plan, Monid budget/config status, write contract, memo boundary, and
+  agent handoff prompt without changing facts/links/memo.
+- **`deal_enrich` MCP tool** — same contract for MCP-native agents. External
+  agents can request `executor: "external_agent"` to receive guardrails and a
+  handoff prompt; private Monid credentials stay on the Llama Command server.
+- `--prompt` / `--handoff` on the CLI prints only the external-agent prompt.
+
+### Notes
+- Requires a Llama Command backend with `/api/deals/:dealId/enrich`.
+- Memo generation never defaults on; pass `--memo` / `generateMemo: true` only
+  when the user explicitly asks for post-enrichment Memo generation.
+
+## [1.13.0] — 2026-06-11
+
+### Added
+- **`llama deal extra set <dealId> <key> <value>`** — patch one top-level key
+  in `deals.extra` JSONB. System-admin only (server-gated, 403 otherwise).
+  Value is parsed as JSON when possible, else stored as a string. Audited to
+  `deal_events` as `field_change` with field `extra.<key>` — same
+  from→to trail as any column write. First use case: correcting stale
+  backfill provenance (`source_urls`, `identity_confidence`,
+  `enrichment_holds`) left by a mismatched-company import.
+- **`llama deal extra unset <dealId> <key>`** — delete the key (admin,
+  audited the same way).
+- Requires a Llama Command backend with the `extraKey` patch support on
+  `POST /api/deals/update`.
+
+### Fixed
+- Help text: `deal update` writable-fields list now matches the server's
+  `FIELD_TO_COLUMN` whitelist — added the missing `founderInfo`, `deckLink`,
+  `folderUrl`, `agentActive`.
+
+## [1.12.0] — 2026-06-09
+
+### Added
+- **`llama html link <dealId> --wiki <slug> [--lang en|zh] [--title "..."]`** —
+  turn a deal's HTML document card into a live, read-only pointer to a wiki
+  HTML article. One file, multiple entrances: the wiki stays the canonical
+  home and the card renders the wiki's HTML. The deal-side slug defaults to
+  the wiki slug and the title defaults to the wiki article's title. Uploads,
+  restores, and resets against a linked card are refused by the backend (409)
+  — edit the wiki source instead.
+- **`llama html unlink <dealId> <slug>`** — revert a linked card back to a
+  normal self-hosted document.
+- **`llama html docs <dealId>`** now surfaces a `linked_wiki` field on linked
+  cards (`{ slug, lang }`).
+- All of the above require a Llama Command backend with wiki-linked document
+  support.
+
+## [1.11.0] — 2026-06-02
+
+### Changed
+- **`deal_feed` (MCP) description corrected.** It previously claimed to
+  "exclude AI-generated content" — false, and it misled agents into telling
+  users the feed filtered their AI's work. The feed shows *every* contribution
+  (from a teammate, their AI assistant, or a system agent); each item now
+  carries `who` (the accountable person) and `agent` (the assistant/system
+  label, `null` when a human typed it), so human-typed and assistant-drafted
+  are distinguishable. The AI's regenerable brief/persona synthesis stays in
+  the Memo, not the feed.
+- **Agent contract (`AGENT_BRIEFING`): read it back before claiming "saved".**
+  A tool returning `ok` is not proof the content landed where the user looks —
+  agents must run `llama deal feed <id>` and confirm the item appears before
+  reporting success (the #1 failure is writing to the brief, which is
+  Memo-only and not in the feed, then reporting success anyway). Authorship is
+  automatic — CLI/MCP writes are recorded "via assistant" and can't be faked
+  human; an agent's `--attested` caps at `agent-verified`, only a signed-in
+  human vouches.
+
+Pairs with the Llama Command server-side contribution-authorship change
+(deployed 2026-06-02): the feed badges every item human-typed (✍️) vs
+assistant-drafted (🤖) and enforces the AI trust ceiling.
+
+## [1.10.0] — 2026-05-29
+
+### Added
+- **`llama memo regenerate --instructions "..."`** — steer a single memo
+  regeneration (e.g. "focus on team risk", "frame as a follow-on"). The
+  instruction is applied across the memo's narrative panels; it never
+  overrides verified facts or the GREEN/YELLOW/RED verdict. Mirrored on the
+  `memo_regenerate` MCP tool via a new optional `instructions` field.
+  Requires a Llama Command backend with memo-steering support.
+
+## [1.7.0] — 2026-05-23
+
+### Added
+- **`llama deal fact add --attested`** — the caller declares whether they
+  verified the claim against its source. With `--attested` the fact is recorded
+  as vouched; without it, it stays unverified (the honest default). You can't
+  mark a fact as human-confirmed on someone's behalf — only a person can.
+- **MCP parity with the CLI.** MCP-native agents now have the same surface as
+  CLI users (35 → 49 tools): `deal_fact_list` / `deal_fact_add` (carries the
+  same `attested` contract) / `deal_fact_verify`; `brief_edit` / `brief_delete`
+  / `brief_restore` / `brief_history` / `brief_restore_version`;
+  `mentions_resolve`; `skill_correction_list` / `add` / `delete`;
+  `deal_refresh_brief` / `deal_refresh_persona`.
+
+### Changed
+- `AGENT_BRIEFING.md`: new boundary — don't vouch for facts you haven't checked.
+
+> Note: the 1.6.0 / 1.6.1 changelog entries were never committed to `main`
+> (the releases are tagged); reconcile from the pending docs edit when convenient.
+
+## [1.5.0] — 2026-05-19
+
+### Changed
+- **`llama html upload` now requires explicit intent — no more silent
+  overwrites.** Before: `llama html upload <dealId> --file <path>`
+  silently appended a new version to slug `main`, even when the deal
+  already had a different HTML artifact under that slug. After: the
+  same bare command **refuses** if `main` already has content, naming
+  the existing artifact and printing a two-line instruction
+  (`--doc main` to update it, `--new --title "..."` to add alongside).
+  The slug `main` still works as an auto-init default when the deal
+  has no documents yet — only the silent-overwrite path is gone.
+
+### Added
+- **`--new` and `--title` flags on `llama html upload`.** Explicit
+  "create a new artifact" intent.
+  - `--new --doc <slug> --title "..."` — caller picks the slug.
+  - `--new --title "Investment Thesis"` — CLI slugifies the title
+    (`investment-thesis`). Collisions auto-resolve with `-2` / `-3`
+    suffix and a stderr note.
+  - Refuses (`--new --doc <slug>`) if the named slug already exists.
+- **`--slug` as an alias for `--doc`.** When agents guess the wrong
+  flag name (the DB column is `document_slug`, so `--slug` is a
+  natural guess), the CLI now accepts it and prints a one-line
+  `note: --slug accepted as alias for --doc.` This eliminates the
+  exact silent-fall-through that caused the 1.4.4 incident.
+- **Unknown-flag stderr warnings on `llama html *` handlers.**
+  Mistyped `--out` / `--asssets` / `--doc-slug` etc. now print
+  `warning: unknown flag --X (did you mean --Y?)` (Levenshtein-1
+  matcher) to stderr. The command still proceeds — no breaking
+  change for callers wrapping legacy flags.
+- **`mode: 'created' | 'updated'`** field in `llama html upload`
+  JSON output, so scripts can branch on whether the call created a
+  new doc or appended a version.
+
+### Hardened
+- `llama html upload` pre-flights `GET /api/deals/<id>/documents` and
+  uses the response to (a) detect existing slugs (b) refuse on the
+  bare-default overwrite (c) auto-resolve title-slug collisions.
+  Adds one extra round-trip per upload; cheap insurance.
+
+### Migration notes
+- `llama html upload <id> --file X` callers targeting an empty
+  deal: **no change**, still works.
+- `llama html upload <id> --file X` callers updating an existing
+  `main` artifact: **must add `--doc main`**.
+- Agents using the natural-language flow ("deploy to llama / 部署到
+  llama command") via the deal agent or MCP tools: see the updated
+  `AGENT_BRIEFING.md` and llama-os routing tables — the agent path
+  now teaches "new vs update" upfront.
+
+## [1.4.4] — 2026-05-19
+
+### Changed
+- **`AGENT_BRIEFING.md` — document native HTML deploy as the default.**
+  After llama-command PR #81 shipped per-deal hand-authored HTML pages at
+  `/deals/<id>/browse/<slug>` (sandboxed iframe, Postgres-backed), the
+  agent briefing now teaches `llama html upload` as the default route
+  when a user says "deploy to llama", "deploy to llama command",
+  "部署到 llama command", or "put this HTML on the deal page". The
+  Netlify path (`netlify-access-guard`) is preserved but explicitly
+  narrowed to founder-facing / external share-link scenarios. Quick
+  reference section now lists the full `llama html` surface
+  (`upload`, `show`, `versions`, `restore`, `reset`).
+
+## [1.4.0] — 2026-05-12
+
+### Added
+- **`llama memo` subcommands.** Closes the CLI/MCP gap on the Memo tab —
+  long-form HTML investment memos previously only accessible through the
+  web UI. Four verbs:
+  - `llama memo show <dealId>` — fetch the current memo; default writes
+    HTML to stdout (pipeable to a file or `open`), `--out <path>` writes
+    to disk, `--json` returns the full envelope (memo + mode + inflight).
+  - `llama memo regenerate <dealId> [--opus]` — trigger server-side
+    regeneration; streams panel progress to stderr, prints final summary
+    JSON to stdout.
+  - `llama memo save <dealId> --file <path>` — upload hand-written HTML
+    as a manual override.
+  - `llama memo reset <dealId> [--all]` — drop the manual override
+    (default) or every version (`--all`).
+- **MCP `memo_*` tools.** Same surface as the CLI: `memo_show`,
+  `memo_regenerate`, `memo_save`, `memo_reset`. `memo_regenerate` is
+  synchronous (non-streaming) so the call returns the final result
+  directly to the calling agent.
+
+## [1.3.1] — 2026-05-12
+
+### Changed
+- **Documentation hygiene.** CHANGELOG backfilled for 1.2.3 and 1.2.4. Help text
+  and READMEs now describe server-enforced rate limits generically instead of
+  restating specific numbers. `package.json` description clarified.
+
+### Added
+- **Pre-publish identifier guard in CI.** Shape-based regex blocks `npm publish`
+  if any internal-style slug accidentally slips into shipped files (`bin/`,
+  `lib/`, root `.md`). Extend the pattern as new shapes surface.
+
+## [1.3.0] — 2026-05-11
+
+### Added
+- **`llama auth login` — browser-based OAuth 2.1 sign-in.** PKCE + loopback
+  flow against the Llama Command authorization server. Opens your browser,
+  routes through Google sign-in (`@llamaventures.vc` only) + consent screen,
+  redirects to a one-shot ephemeral `127.0.0.1:<port>/callback`, exchanges
+  the code for an access + refresh token pair. Replaces the 4-step
+  "mint at /settings/tokens → copy → paste → `llama token set`" path with a
+  single command. Existing `llc_...` PATs and gcloud Bearer auth continue
+  to work unchanged (priority order: OAuth → gcloud → `$LLAMA_TOKEN` →
+  `~/.llama/token` → legacy).
+- **`llama auth logout`** — RFC 7009 revoke at the AS + clear local
+  storage. Falls back to gcloud / PAT cleanly afterward.
+- **OS Keychain credential storage** via `@napi-rs/keyring` (macOS Keychain,
+  Windows Credential Manager, Linux Secret Service). File backend at
+  `~/.llama/oauth.json` (mode 0600) when no Keychain backend is available
+  (Linux containers without libsecret, CI runners) — same posture
+  `gcloud`/`gh`/`aws` ship with on Linux servers.
+- **Auto-refresh on 401.** When an OAuth-bearing call returns 401, the CLI
+  forces a refresh-token rotation under a cross-process file lock and
+  retries once. Two shells refreshing simultaneously can't burn each other's
+  refresh token.
+- **`llama auth status` extended.** New `activeMethod` field (`oauth` /
+  `gcloud-bearer` / `llama-token` / `none`) and `oauth` block showing
+  storage backend, client_id, scope, expiry. Existing fields preserved.
+
+### Changed
+- Bearer header on outbound requests now prefers OAuth access token over
+  gcloud identity token. Unchanged when no OAuth bundle exists.
+
+### Notes
+- Requires the Llama Command server to have `OAUTH_PROVIDER_ENABLED=true`
+  set on Render. Until that flag flips, `llama auth login` will fail with
+  a 404 on the OAuth endpoints — fall back to PATs in the meantime.
+- Phase 2.5 (RFC 8628 device authorization grant for SSH/headless
+  environments) lands in a follow-up; today's `auth login` requires a
+  browser.
+
+## [1.2.4] — 2026-05-08
+
+### Added
+- **`llama pitch finalize`** — founder-initiated wrap-up. Sends a sentinel
+  that the intake agent recognizes as "call `finalize_intake` on this turn."
+  Closes the gap where the founder is done but the agent keeps asking.
+
+### Changed
+- **Fetch timeouts on all three external API calls** — 60s on
+  `/start-session`, 180s on `/chat`, 180s on `/upload`. Without these, a
+  network hang froze the CLI indefinitely.
+- **Help polish** — `pitch help` now mentions `pitch finalize` and the
+  `LLAMA_API_URL` env override.
+
+## [1.2.3] — 2026-05-08
+
+### Security
+- **Removed a generic MCP tool that proxied arbitrary internal API paths.**
+  An unrestricted internal-API tool reachable from a prompt-injection-prone
+  agent context is the wrong shape for a public package. Power users keep
+  the `llama` CLI (40+ commands) for raw HTTP.
+
+### Changed
+- Scrubbed example identifiers from deal-list snippets (both READMEs).
+- `zod` is now a direct dependency (was resolving via transitive hoist;
+  would have broken under pnpm/yarn strict).
+- MCP server reports the real package version in `serverInfo` (was
+  hardcoded `"1.0.0"`).
+
+### Fixed
+- Operator-precedence bug in `bin/llama.mjs` token-set verify path that
+  could TypeError on rare error paths.
+- `llama --version` / `-v` / `version` now print the package version
+  cleanly (exit 0).
+
+## [1.2.2] — 2026-05-07
+
+### Changed
+- `llama pitch`: friendlier output for the upload + send paths (clearer quoting
+  hint, cleaner error surface).
+
+## [1.2.1] — 2026-05-07
+
+### Fixed
+- CI publish: bump runner Node 20 → 24 so npm 11.5+ is available — the older
+  npm silently fails the OIDC handshake against npm Trusted Publishers and the
+  registry treats the request as anonymous (404 on `PUT`).
+
+## [1.2.0] — 2026-05-06
+
+### Added
+- **External pitch family.** `llama pitch start | say | upload | status | end`
+  CLI commands plus 5 matching MCP tools (`pitch_start`, `pitch_send_message`,
+  `pitch_upload_file`, `pitch_status`, `pitch_finalize`). Talks to
+  `command.llamaventures.vc/external-agent` — no Llama token required, founder
+  / EA / external use.
+
+### Changed
+- `agent_briefing` MCP prompt + `llama agent-onboard` CLI command now gate on
+  `/api/me`; unauthenticated callers see a short bootstrap stub instead of
+  the full workflow contract.
+
+## [1.1.0] — 2026-05-04
+
+### Added
+- **`llama-mcp` stdio MCP server**, distributed in the same npm package.
+  Mirrors the most-used CLI surface as a set of named, typed tools.
+  Same auth chain, same error prefixes — CLI and MCP cannot drift.
+- `llama agent-onboard` — re-prints the bundled `AGENT_BRIEFING.md` so any
+  agent that just installed the package can self-onboard.
+
+### Changed
+- HTTP / auth / token helpers extracted into `lib/client.mjs` so CLI and MCP
+  share one implementation.
+
+## [1.0.1] — 2026-05-03
+
+### Fixed
+- `package.json`: stripped the `./` prefix from `bin` paths — npm 10 was
+  silently dropping the binaries on global install for some setups.
+
+## [1.0.0] — 2026-05-03
+
+### Added
+- Initial public release as `@llamaventures/cli` on npm.
+- CLI surface: deals (CRUD + soft-delete + restore + trash), brief blocks
+  (text / link / embed / callout, edit, history, restore-version), ownership
+  (claim / nominate / approvals), timeline + posts, deal links, deal facts,
+  collaborators, mentions inbox, skill corrections, wiki search/save, admin
+  event feeds.
+- Auth chain: `gcloud auth print-identity-token` → `$LLAMA_TOKEN` →
+  `~/.llama/token` → legacy `~/.llama-command/config.json` (auto-migrates
+  forward).
+- Stable `Error[NO_AUTH]` and `Error[UNAUTHORIZED]` prefixes for agent pattern
+  matching.
+- Supply chain: published via npm Trusted Publishers (OIDC), every release
+  signed with `--provenance`, CI matrix on Node 18 / 20 / 22.
+
+### Migrated from
+- The previous `llama-os/cli/` directory distributed via `npm link`. Existing
+  team installs auto-upgrade on the next `bin/update-check` run; the legacy
+  directory is kept as a soft fallback for the soak window and will be removed
+  in a follow-up.
+
+---
+
+[Unreleased]: https://github.com/Llama-Ventures/llama-cli/compare/v1.3.1...HEAD
+[1.3.1]: https://github.com/Llama-Ventures/llama-cli/compare/v1.3.0...v1.3.1
+[1.3.0]: https://github.com/Llama-Ventures/llama-cli/compare/v1.2.4...v1.3.0
+[1.2.4]: https://github.com/Llama-Ventures/llama-cli/compare/v1.2.3...v1.2.4
+[1.2.3]: https://github.com/Llama-Ventures/llama-cli/compare/v1.2.2...v1.2.3
+[1.2.2]: https://github.com/Llama-Ventures/llama-cli/compare/v1.2.1...v1.2.2
+[1.2.1]: https://github.com/Llama-Ventures/llama-cli/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/Llama-Ventures/llama-cli/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/Llama-Ventures/llama-cli/compare/v1.0.1...v1.1.0
+[1.0.1]: https://github.com/Llama-Ventures/llama-cli/compare/v1.0.0...v1.0.1
+[1.0.0]: https://github.com/Llama-Ventures/llama-cli/releases/tag/v1.0.0

package/CONTRIBUTING.md

@@ -0,0 +1,99 @@
+# Contributing
+
+Thanks for looking. This is an **internal tool** maintained by Llama Ventures
+team members. Patches from teammates are welcome; outside contributions are
+best limited to documentation fixes and broken-flow reports.
+
+## Local dev loop
+
+```bash
+git clone https://github.com/Llama-Ventures/llama-cli.git
+cd llama-cli
+npm ci
+node bin/llama.mjs --help        # CLI is ESM, runs straight from source
+node --check bin/llama.mjs        # syntax check
+node --check bin/llama-mcp.mjs    # syntax check
+```
+
+To test the CLI end-to-end against your own credentials, point it at the
+in-source binary instead of the globally installed one:
+
+```bash
+alias llama-dev="node $(pwd)/bin/llama.mjs"
+llama-dev auth status
+```
+
+To smoke-test the MCP server (no client needed):
+
+```bash
+printf '%s\n' \
+  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"dev","version":"1"}}}' \
+  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
+  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
+  | node bin/llama-mcp.mjs | head -200
+```
+
+You should see 51 named tools, including `deal_enrich`, the 5 `pitch_*`, and
+no generic API passthrough tool.
+
+## Conventions
+
+- **Zero deps for the CLI.** `bin/llama.mjs` and `lib/client.mjs` use only Node
+  stdlib + native `fetch`. The MCP server may pull in
+  `@modelcontextprotocol/sdk`; nothing else.
+- **One auth chain, one HTTP client.** Anything new that talks to
+  `command.llamaventures.vc` goes through `lib/client.mjs::request()`. Don't
+  spawn a parallel auth path; if you need a new credential type, add it to the
+  chain there.
+- **Stable `Error[…]` prefixes.** `Error[NO_AUTH]` and `Error[UNAUTHORIZED]`
+  are part of the public contract — agents pattern-match on them. New error
+  classes need a new prefix; renaming an existing one is a major version bump.
+- **CLI and MCP stay in lockstep.** Adding a new CLI command? Add the matching
+  MCP tool in the same PR. The MCP server exposes only named, typed tools — no
+  generic API passthrough — so every server endpoint that needs agent access
+  gets its own typed wrapper.
+- **No bundler, no build step.** The CLI ships as `.mjs` files that npm copies
+  verbatim. `package.json::files` is the allowlist; CI re-verifies the tarball
+  contents on every PR.
+- **`AGENT_BRIEFING.md` is content, not chrome.** It's the behavioural contract
+  for AI agents loading the package — terse, action-oriented, no fluff.
+  Changes to it are reviewed for substance, not formatting.
+
+## Submitting changes
+
+1. Branch off `main`. Branch names are casual; prefer `<type>/<short-slug>`
+   (e.g. `feat/pitch-rate-limit-message`, `fix/agent-onboard-redaction`).
+2. Run the smoke commands above. CI on PR runs the same matrix on Node
+   18/20/22 plus a tarball-contents allowlist check.
+3. Open a PR. One commit per logical change is preferred but not enforced.
+4. Update [`CHANGELOG.md`](CHANGELOG.md) under `[Unreleased]` if the change
+   affects users (CLI / MCP surface, error format, auth, install).
+
+## Releasing
+
+Releases are cut from `main` via a GitHub Release. The
+`.github/workflows/publish.yml` workflow then publishes to npm via
+[Trusted Publishers](https://docs.npmjs.com/trusted-publishers) — no
+`NPM_TOKEN` exists in repo secrets.
+
+To cut a release:
+
+```bash
+# 1. Bump version + move CHANGELOG entries from [Unreleased] to the new tag
+npm version <patch|minor|major>     # commits + tags
+git push origin main --tags
+
+# 2. Open https://github.com/Llama-Ventures/llama-cli/releases/new
+#    Choose the tag, paste the CHANGELOG section, click "Publish release"
+#    → publish.yml fires, OIDC handshake → npm publish --provenance --access public
+```
+
+The publish workflow asserts that `package.json::version` matches the release
+tag (modulo a leading `v`). If they disagree, it fails fast — fix the
+mismatch and re-cut the release.
+
+## Security
+
+Don't file public issues for security bugs. Email
+[gavin@llamaventures.vc](mailto:gavin@llamaventures.vc). Full policy:
+[`SECURITY.md`](SECURITY.md).

package/README.md

@@ -48,7 +48,7 @@
 ```
 @llamaventures/cli
 ├── bin/llama          interactive CLI for humans + bash
-└── bin/llama-mcp      stdio MCP server, 20 tools — for any MCP-native agent
+└── bin/llama-mcp      stdio MCP server, 51 typed tools — for any MCP-native agent
 ```
 
 Both binaries share `lib/client.mjs` — the **same** auth chain, **same** HTTP
@@ -186,6 +186,8 @@ llama deal show <dealId>
 # Pipeline — write
 llama deal create "Acme AI" --description "..." --source Gavin
 llama deal update <dealId> status Diligence
+llama deal enrich <dealId> --dry-run
+llama deal enrich <dealId> --executor external_agent --prompt
 llama deal delete  <dealId>     # soft (audit-logged)
 llama deal restore <dealId>
 
@@ -223,7 +225,7 @@ llama mentions
 llama mentions resolve <mentionId>
 ```
 
-Run `llama --help` for the full surface (~40 commands across deals, briefs,
+Run `llama --help` for the full surface (50+ commands across deals, briefs,
 ownership, timeline, facts, wiki, mentions, skill corrections, and admin event
 feeds). Soft-delete is the default everywhere — every removal is reversible
 and audit-logged via `deal_events`.
@@ -245,30 +247,26 @@ agents can pattern-match without parsing prose.
 ## MCP server
 
 The bundled `llama-mcp` is a **stdio Model Context Protocol** server exposing
-**19 typed tools** that mirror the most-used CLI surface. Every tool is named
+**51 typed tools** that mirror the most-used CLI surface. Every tool is named
 and scoped — there is no generic API passthrough, by design (a public-package
 escape hatch reachable from a prompt-injectable agent context is exactly the
 shape we want to avoid).
 
-```
-auth_status
-
-deal_search            deal_show
-deal_create            deal_update
-
-brief_blocks           brief_add_text
-brief_add_link         brief_add_callout
+Coverage is grouped around the workflows agents actually need: auth
+diagnostics; deal search/show/create/update/feed; deal enrichment harnesses;
+trust-rated facts; brief blocks and version history; wiki read/write/delete/restore;
+timeline posts and mentions; skill corrections; refresh triggers; external pitch intake;
+memo show/regenerate/save/reset; and deal-scoped HTML docs, versions, bundles, and
+restore/reset.
 
-timeline               post
+For the exact live list, smoke-test the server with `tools/list`:
 
-wiki_search            wiki_save
-wiki_delete            wiki_restore
-
-mentions_list
-
-pitch_start            pitch_send_message
-pitch_upload_file      pitch_status
-pitch_finalize
+```bash
+printf '%s\n' \
+  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"dev","version":"1"}}}' \
+  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
+  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
+  | llama-mcp
 ```
 
 Auth is identical to the CLI's chain (gcloud → `$LLAMA_TOKEN` → `~/.llama/token`).

package/README.zh-CN.md

@@ -48,7 +48,7 @@
 ```
 @llamaventures/cli
 ├── bin/llama          给人 + bash 用的交互式 CLI
-└── bin/llama-mcp      给 MCP 原生 agent 用的 stdio MCP server，20 个工具
+└── bin/llama-mcp      给 MCP 原生 agent 用的 stdio MCP server，51 个工具
 ```
 
 两个 binary 共享 `lib/client.mjs`——**同一**认证链、**同一** HTTP 客户端、
@@ -207,6 +207,8 @@ llama deal show <dealId>
 # Pipeline——写
 llama deal create "Acme AI" --description "..." --source Gavin
 llama deal update <dealId> status Diligence
+llama deal enrich <dealId> --dry-run
+llama deal enrich <dealId> --executor external_agent --prompt
 llama deal delete  <dealId>     # 软删除（审计日志记录）
 llama deal restore <dealId>
 
@@ -237,7 +239,7 @@ llama mentions
 llama mentions resolve <mentionId>
 ```
 
-跑 `llama --help` 看完整命令清单（约 40 个命令，覆盖 deals、briefs、ownership、
+跑 `llama --help` 看完整命令清单（50+ 个命令，覆盖 deals、briefs、ownership、
 timeline、facts、wiki、mentions、skill corrections、admin event feeds）。
 所有删除默认软删除——可恢复，且通过 `deal_events` 留下审计痕迹。
 
@@ -257,28 +259,24 @@ MCP server 在 `isError: true` 内容里返回相同的前缀，agent 不用解
 ## MCP server
 
 随包发布的 `llama-mcp` 是一个 **stdio Model Context Protocol** server，
-暴露 **19 个 typed tools**——基本镜像 CLI 最常用的命令。每个 tool 都是
+暴露 **51 个 typed tools**——基本镜像 CLI 最常用的命令。每个 tool 都是
 具名、scoped 的；**没有**通用的 API passthrough，这是有意设计的（公开
 package 里一个能被 prompt-injection 触达的逃生通道，正是我们要避开的形状）。
 
-```
-auth_status
-
-deal_search            deal_show
-deal_create            deal_update
-
-brief_blocks           brief_add_text
-brief_add_link         brief_add_callout
+覆盖面按 agent 真正会用的工作流分组：auth 诊断；deal search/show/create/
+update/feed；deal enrichment harness；带 trust ladder 的事实；brief blocks
+和版本历史；wiki 读写删恢复；timeline posts 和 mentions；skill corrections；
+refresh triggers；外部 pitch intake；memo show/regenerate/save/reset；
+以及 deal-scoped HTML docs、versions、bundles、restore/reset。
 
-timeline               post
+精确的 live list 以 `tools/list` 为准：
 
-wiki_search            wiki_save
-
-mentions_list
-
-pitch_start            pitch_send_message
-pitch_upload_file      pitch_status
-pitch_finalize
+```bash
+printf '%s\n' \
+  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"dev","version":"1"}}}' \
+  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
+  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
+  | llama-mcp
 ```
 
 认证链跟 CLI 完全一样（gcloud → `$LLAMA_TOKEN` → `~/.llama/token`）。

package/SECURITY.md

@@ -0,0 +1,62 @@
+# Security Policy
+
+## Reporting security issues
+
+**Do not file public GitHub issues for security bugs.** A public issue
+gives an attacker a head-start before we can patch.
+
+Instead, email [**gavin@llamaventures.vc**](mailto:gavin@llamaventures.vc)
+with:
+
+- A short description of the issue
+- Steps to reproduce
+- Expected vs. actual behavior
+- The CLI version (`npm ls -g @llamaventures/cli`)
+- Any other context that helps us reproduce
+
+We aim to acknowledge within ~5 push cycles (best effort), patch
+promptly, and credit the reporter (if desired) once the fix ships.
+We do not run a public bug bounty program.
+
+## Scope
+
+In scope:
+
+- Authentication / authorization bypass in the CLI client
+- Token handling vulnerabilities (logging, transmission, storage)
+- Supply-chain attacks against the npm package or its dependencies
+- Anything that lets an unauthorized party execute Llama Command
+  operations as another team member
+
+Out of scope (still report; lower urgency):
+
+- Bugs in third-party services we depend on (Google Cloud, npm,
+  Anthropic, etc.)
+- Issues only reproducible against a fork or a modified version of
+  this CLI
+
+Server-side bugs (`command.llamaventures.vc`) are governed separately;
+report through the same channel.
+
+## Supply-chain posture
+
+This package follows current best practice:
+
+- **`@llamaventures/cli` is published via npm
+  [Trusted Publishers](https://docs.npmjs.com/trusted-publishers)** —
+  no `NPM_TOKEN` is stored in CI secrets; the GitHub Action exchanges
+  an OIDC token at publish time.
+- **All releases ship with `--provenance`** (sigstore-signed). The
+  npm registry shows a "Provenance" badge on each version, traceable
+  to the exact commit + GitHub Action workflow that built it.
+- **Minimal dependency tree.** The CLI itself is zero-deps; the
+  bundled MCP server depends only on
+  `@modelcontextprotocol/sdk` (Anthropic-maintained, pinned exact).
+- **Branch protection** on `main` prevents force-push and deletion;
+  Dependabot, secret scanning, and push-protection are enabled.
+
+## Disclosure
+
+We coordinate disclosure when a fix lands. Once a patched version
+ships, we publish a security advisory on this repo and notify
+affected users via the team's internal channels.

package/assets/llama-ventures-logo.svg

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 224 76.32">
+  <g>
+    <g>
+      <path d="M69.84,26.89h7.64v4.53h-13.48V7.33h5.84v19.56Z"/>
+      <path d="M86.13,7.33v24.04h-5.7V7.33h5.7Z"/>
+      <path d="M90.96,16.53c.74-1.5,1.76-2.65,3.04-3.45,1.28-.81,2.72-1.21,4.3-1.21,1.35,0,2.54.28,3.56.83s1.81,1.28,2.36,2.17v-2.73h5.88v19.26h-5.88v-2.73c-.57.9-1.37,1.62-2.39,2.17-1.02.55-2.21.83-3.56.83-1.56,0-2.98-.41-4.27-1.22-1.29-.82-2.3-1.98-3.04-3.49-.75-1.51-1.12-3.25-1.12-5.23s.37-3.72,1.12-5.21ZM103,18.29c-.81-.85-1.81-1.28-2.97-1.28s-2.16.42-2.98,1.26c-.81.84-1.22,2-1.22,3.47s.41,2.64,1.22,3.51c.81.86,1.81,1.29,2.98,1.29s2.16-.42,2.97-1.28c.81-.85,1.22-2.01,1.22-3.49s-.41-2.64-1.22-3.49Z"/>
+      <path d="M143.78,14.24c1.4,1.44,2.1,3.44,2.1,6v11.18h-5.82v-10.39c0-1.24-.32-2.19-.97-2.86-.65-.68-1.54-1.01-2.68-1.01s-2.04.34-2.68,1.01c-.65.67-.97,1.63-.97,2.86v10.39h-5.82v-10.39c0-1.24-.32-2.19-.97-2.86-.65-.68-1.54-1.01-2.68-1.01s-2.03.34-2.68,1.01c-.65.67-.98,1.63-.98,2.86v10.39h-5.85V12.28h5.85v2.4c.59-.8,1.37-1.43,2.33-1.9.96-.47,2.04-.7,3.25-.7,1.44,0,2.72.31,3.85.92,1.13.62,2.01,1.5,2.65,2.64.66-1.05,1.56-1.91,2.7-2.57,1.14-.66,2.38-.99,3.72-.99,2.37,0,4.26.72,5.66,2.16Z"/>
+      <path d="M149.87,16.6c.74-1.49,1.75-2.63,3.03-3.44s2.71-1.2,4.28-1.2c1.35,0,2.53.27,3.55.82,1.01.55,1.8,1.27,2.34,2.16v-2.72h5.86v19.17h-5.86v-2.72c-.57.89-1.36,1.62-2.38,2.16-1.01.55-2.2.82-3.54.82-1.56,0-2.97-.41-4.25-1.22s-2.29-1.97-3.03-3.47c-.74-1.5-1.11-3.24-1.11-5.21s.37-3.7,1.11-5.19ZM161.86,18.36c-.81-.85-1.8-1.27-2.96-1.27s-2.15.42-2.96,1.25c-.81.84-1.22,1.99-1.22,3.45s.41,2.63,1.22,3.49c.81.86,1.8,1.29,2.96,1.29s2.15-.42,2.96-1.27,1.22-2,1.22-3.47-.4-2.62-1.22-3.47Z"/>
+    </g>
+    <g>
+      <path d="M88.31,42.57l-8.62,24.05-7.19-.14-8.5-23.91h6.3l5.57,17.41,6.27-17.41h6.17Z"/>
+      <path d="M106.78,57.98l-13.12.07c.09,1.16.46,2.04,1.12,2.65.66.61,1.46.92,2.42.92,1.42,0,2.41-.6,2.97-1.8h6.17c-.31,1.21-.86,2.45-1.67,3.42-.81.98-1.87,1.77-3.09,2.33s-2.73.9-4.24.9c-1.82,0-3.79-.59-5.21-1.37-1.42-.78-2.42-2.01-3.22-3.45-.8-1.44-1.2-3.11-1.2-5.04s.58-4,1.37-5.45c.79-1.45,2.09-2.48,3.51-3.26,1.42-.78,3.21-1.15,5.06-1.15s3.43.55,4.83,1.31c1.4.75,2.56,2.1,3.35,3.5s1.07,2.89,1.07,4.76c0,.53-.03,1.09-.1,1.67ZM100.83,54.89c0-.98-.33-1.76-1-2.33-.67-.58-1.5-.87-2.5-.87s-1.76.28-2.42.84c-.66.56-1.06,1.34-1.22,2.37h7.13Z"/>
+      <path d="M126.7,49.22c1.3,1.41,2.3,3.49,2.3,5.96v11.44h-5.78s-.04-10.69-.04-10.69c0-1.25-.49-2.07-1.13-2.76-.65-.69-1.54-1.06-2.81-1-1.09.05-1.89.57-2.54,1.26s-.91,1.61-.91,2.86v10.32h-5.79v-19.13h5.79v2.47c.58-.82,1.17-1.47,2.15-1.95.98-.48,2.08-.72,3.3-.72,2.18,0,4.17.53,5.47,1.94Z"/>
+      <path d="M143.61,61.6v5.02h-2.9c-2.06,0-4.1-.8-5.25-1.81-1.16-1.01-1.43-3.02-1.43-5.31v-7.1s-2.39,0-2.39,0v-4.91h2.39v-4.66s5.79,0,5.79,0v4.66h3.79v4.91h-3.78v7.2c0,.56.15,1.41.41,1.65.27.24.71.37,1.33.37h2.03Z"/>
+      <path d="M165.77,47.34v19.01h-5.79l-.03-2.74c-.58.82-1.77,1.75-2.76,2.25-.99.5-2.08.75-3.28.75-1.42,0-2.68-.32-3.77-.95-1.09-.63-1.88-2.02-2.48-3.21-.6-1.2-.9-2.61-.9-4.24v-10.87h5.67v10.1c0,1.24.32,2.21.97,2.9.64.69,1.51,1.03,2.6,1.03s1.99-.34,2.63-1.03c.64-.69.97-1.66.97-2.9v-10.1h6.17Z"/>
+      <path d="M178.26,48.17c1-.59,2.41-.82,3.64-.82v6.17h-1.85c-1.42,0-2.38.33-3.09.94-.71.61-1.11,1.55-1.11,3.09v9.06h-5.79v-19.13h5.7v3.1c.67-1.02,1.5-1.83,2.5-2.42Z"/>
+      <path d="M202.59,58.03h-13.25c.09,1.19.47,2.09,1.15,2.71.67.63,1.5.94,2.48.94,1.46,0,2.47-.61,3.05-1.84h6.23c-.32,1.25-.9,2.38-1.73,3.38-.83,1-1.88,1.79-3.13,2.36-1.26.57-2.66.85-4.21.85-1.87,0-3.54-.4-5-1.19-1.46-.79-2.6-1.93-3.42-3.41-.82-1.48-1.23-3.21-1.23-5.19s.4-3.71,1.21-5.19c.81-1.48,1.95-2.62,3.41-3.41,1.46-.8,3.14-1.19,5.03-1.19s3.49.39,4.93,1.16c1.44.77,2.56,1.88,3.37,3.31s1.21,3.11,1.21,5.02c0,.55-.03,1.12-.1,1.71ZM196.7,54.79c0-1-.34-1.8-1.03-2.39-.68-.59-1.54-.89-2.57-.89s-1.81.29-2.48.86c-.67.57-1.09,1.37-1.25,2.42h7.33Z"/>
+      <path d="M106.77,58.03h-13.25c.09,1.19.47,2.09,1.15,2.71.67.63,1.5.94,2.48.94,1.46,0,2.47-.61,3.05-1.84h6.23c-.32,1.25-.9,2.38-1.73,3.38-.83,1-1.88,1.79-3.13,2.36-1.26.57-2.66.85-4.21.85-1.87,0-3.54-.4-5-1.19-1.46-.79-2.6-1.93-3.42-3.41-.82-1.48-1.23-3.21-1.23-5.19s.4-3.71,1.21-5.19c.81-1.48,1.95-2.62,3.41-3.41,1.46-.8,3.14-1.19,5.03-1.19s3.49.39,4.93,1.16c1.44.77,2.56,1.88,3.37,3.31s1.21,3.11,1.21,5.02c0,.55-.03,1.12-.1,1.71ZM100.88,54.79c0-1-.34-1.8-1.03-2.39-.68-.59-1.54-.89-2.57-.89s-1.81.29-2.48.86c-.67.57-1.09,1.37-1.25,2.42h7.33Z"/>
+      <path d="M209.1,65.57c-1.28-.57-2.29-1.35-3.03-2.35-.74-.99-1.15-2.11-1.24-3.34h5.68c.07.66.37,1.2.91,1.61.54.41,1.2.62,1.98.62.72,0,1.27-.14,1.66-.43.39-.28.59-.66.59-1.11,0-.55-.28-.95-.84-1.22-.56-.26-1.47-.56-2.72-.88-1.34-.32-2.47-.66-3.36-1.01-.9-.35-1.67-.92-2.32-1.68-.65-.76-.98-1.8-.98-3.1,0-1.1.3-2.1.89-3,.59-.9,1.47-1.62,2.62-2.14,1.15-.53,2.53-.79,4.12-.79,2.35,0,4.21.59,5.56,1.78,1.36,1.19,2.14,2.77,2.34,4.73h-5.31c-.09-.66-.37-1.19-.86-1.58-.48-.39-1.12-.58-1.9-.58-.67,0-1.19.13-1.55.39s-.54.62-.54,1.08c0,.55.29.96.86,1.23.57.28,1.46.55,2.67.82,1.39.37,2.52.73,3.4,1.08.87.35,1.64.93,2.3,1.72.66.79,1,1.84,1.02,3.17,0,1.12-.31,2.12-.92,3-.62.88-1.5,1.57-2.65,2.07-1.15.5-2.5.75-4.02.75-1.64,0-3.09-.28-4.37-.86Z"/>
+    </g>
+  </g>
+  <path d="M48.7,50.5c3.49.32,6.76,2.94,8.15,6.08,3.09,6.98-1.33,14.02-8.65,15.07-9.08-.47-18.69.74-27.71.12-6.65-.46-10.81-5.53-10.25-12.13l6.28-25.63c-2.05-.02-4.19-.55-6.11-1.26-2.04-.75-4.19-1.79-5.33-3.74-3.04-5.19,1.25-9.8,5.21-12.75-1.81-4.39,2.75-6.87,6.59-6.06.9-3.1,4.51-4.16,7.01-2.12.61.5,1.37,2.23,2.32,1.05.83-1.03,1.11-3.35,1.02-4.64-.06-.81-.79-2.28.57-2.34.91-.04,2.41,1.95,2.85,2.69,1.48,2.49,1.77,5.72.61,8.39,2.83-.4,5.16-1.93,6.73-4.29.48-.72.81-2.17,1.87-1.85.59.18.96,2.01,1.06,2.59.65,3.9-1.25,7.48-4.51,9.55.65,2.66,1.28,5.32,1.63,8.05.99,7.74.41,15.67-1.62,23.2h12.28v.02ZM26.67,18.33c-4.94-4.2-11.7-1.55-15.83,2.4-.27.26-1.14,1.11-1.26,1.39-.09.21.08.17.16.21.66.39,1.73.61,2.01,1.39.47,1.33-.45,2.61-1.85,2.49-.42-.04-1.91-.89-2.08-.76.18,1.93,1.71,2.95,3.37,3.62,3.11,1.24,6.67,1.29,9.98,1.09l.26.14-3.65,14.92c10.85-2.11,18.01-19.14,8.89-26.88h0Z"/>
+  <path d="M23.15,21.22c1.95,1.35-.13,4.72-2.34,3.28s-.04-4.95,2.34-3.28Z"/>
+</svg>

package/bin/llama-mcp.mjs

@@ -786,6 +786,52 @@ server.registerTool(
     callApi("POST", `/api/deals/${encodeURIComponent(dealId)}/refresh-persona`, { persona })
 );
 
+server.registerTool(
+  "deal_enrich",
+  {
+    description:
+      "Run the Llama Command deal enrichment planner/trigger for one deal. " +
+      "Default is dry-run: returns evidence plan, source plan, Monid budget/config " +
+      "status, and planned writes without changing facts/links/memo. Set apply=true " +
+      "only when the user explicitly wants the enrichment run recorded/applied. " +
+      "generateMemo never defaults on; pass true only when the user explicitly asks " +
+      "for Memo generation after enrichment.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      dryRun: z.boolean().optional().describe("default true unless apply=true"),
+      apply: z.boolean().optional().describe("record/apply the enrichment intent server-side"),
+      executor: z
+        .enum(["server_agent", "external_agent", "planner"])
+        .optional()
+        .describe("who will execute the harness; external_agent returns guardrails for a user-owned agent"),
+      sources: z
+        .array(z.enum(["website", "github", "linkedin", "yc", "launch", "web", "monid"]))
+        .optional()
+        .describe("source families to use; defaults to the standard enrichment set"),
+      budgetCents: z
+        .number()
+        .int()
+        .min(0)
+        .max(500)
+        .optional()
+        .describe("Monid spend cap for this run, in cents; default is 50 when Monid is requested"),
+      generateMemo: z
+        .boolean()
+        .optional()
+        .describe("explicitly request memo regeneration after enrichment; default false"),
+    },
+  },
+  async ({ dealId, dryRun, apply, executor, sources, budgetCents, generateMemo }) =>
+    callApi("POST", `/api/deals/${encodeURIComponent(dealId)}/enrich`, {
+      dryRun,
+      apply,
+      executor,
+      sources,
+      budgetCents,
+      generateMemo,
+    })
+);
+
 // ============================================================
 // External pitch (founder intake) — no Llama Command token required
 // ============================================================

package/bin/llama.mjs

@@ -235,6 +235,9 @@ Deals:
             llama deal update <dealId> sector "Developer Tools"
             llama deal update <dealId> foundedYear 2024
             llama deal update <dealId> leadInvestor "Acme Capital"
+  llama deal enrich <dealId> [--dry-run] [--apply] [--executor server_agent|external_agent|planner]
+                            [--sources website,github,linkedin,yc,monid] [--budget-cents 50]
+                            [--memo] [--prompt]                # evidence harness + server-side enrichment trigger
   llama deal extra set <dealId> <key> <value>        # system-admin only
       Patch one top-level key in deals.extra JSONB. Value is parsed as
       JSON when possible ('{"a":1}', 'true', '3'), else stored as a
@@ -439,7 +442,7 @@ Common:
   llama agent-onboard               print the AI-agent workflow contract
 
 Command groups — run \`llama help <group>\` for that group's commands:
-  deal        create · show · feed · update · search · collaborators · links · delete
+  deal        create · show · feed · update · enrich · search · collaborators · links · delete
   brief       brief blocks: list · add · edit · history · refresh
   facts       deal facts + skill corrections (the sourced, trust-rated layer)
   timeline    timeline · posts · mentions
@@ -1157,6 +1160,62 @@ https://command.llamaventures.vc/settings/tokens, run
     return;
   }
 
+  // ----- Deal enrichment: evidence plan + server-side enrichment trigger -----
+  // The server owns Monid credentials and all write/audit behavior. CLI only
+  // passes intent; default is dry-run so agents can inspect the harness before
+  // creating facts/links or touching memo state.
+  if (area === "deal" && action === "enrich") {
+    const dealId = rest[0];
+    if (!dealId) {
+      throw new Error(
+        "Usage: llama deal enrich <dealId> [--dry-run] [--apply] " +
+        "[--executor server_agent|external_agent|planner] " +
+        "[--sources website,github,linkedin,yc,monid] [--budget-cents 50] [--memo] [--prompt]"
+      );
+    }
+    const { flags } = parseFlags(rest.slice(1), [
+      "dry-run",
+      "apply",
+      "executor",
+      "sources",
+      "budget-cents",
+      "memo",
+      "generate-memo",
+      "prompt",
+      "handoff",
+    ]);
+    const sources =
+      flags.sources && flags.sources !== true
+        ? String(flags.sources)
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : undefined;
+    const budgetCents =
+      flags["budget-cents"] !== undefined && flags["budget-cents"] !== true
+        ? Number(flags["budget-cents"])
+        : undefined;
+
+    const result = await request(
+      "POST",
+      `/api/deals/${encodeURIComponent(dealId)}/enrich`,
+      {
+        dryRun: flags.apply === true ? false : true,
+        apply: flags.apply === true,
+        executor: flags.executor && flags.executor !== true ? String(flags.executor) : undefined,
+        sources,
+        budgetCents,
+        generateMemo: flags.memo === true || flags["generate-memo"] === true,
+      }
+    );
+    if (flags.prompt === true || flags.handoff === true) {
+      print(result?.agentHarness?.handoffPrompt || result?.agentHarness?.systemInjection || "");
+    } else {
+      print(result);
+    }
+    return;
+  }
+
   // ----- Collaborators (deal team — non-owner contributors) -----
   // Accepts --user as numeric id OR @llamaventures.vc email; emails are
   // resolved to id via /api/users so the CLI matches how the web picker

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "bin": {
@@ -8,10 +8,15 @@
     "llama-mcp": "bin/llama-mcp.mjs"
   },
   "files": [
+    "assets/",
     "bin/",
     "lib/",
     "AGENT_BRIEFING.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
     "README.md",
+    "README.zh-CN.md",
+    "SECURITY.md",
     "LICENSE"
   ],
   "engines": {