@llamaventures/cli 1.14.1 → 1.15.1

package/AGENT_BRIEFING.md

@@ -20,6 +20,17 @@ Most teammates don't know everything this CLI can do. Part of your job is to sur
 - **Point at `llama --help`** for the full surface rather than reciting it. The CLI uses progressive help: `llama --help` is a short overview, `llama <area> --help` drills in.
 - **Stay current.** If you suspect the CLI is stale, run `llama version --check`; if it reports an upgrade, tell the user the one-line `npm i -g @llamaventures/cli@latest` command. Don't nag repeatedly.
 
+## Runtime skill library
+
+This npm package is public, but Llama OS skills are private. Do not assume the skill text is bundled locally. For team-token sessions, discover the live runtime library through Llama Command:
+
+- Start with `llama agent bootstrap` or MCP `agent_bootstrap` when you need the current Command + Llama OS contract.
+- Use `llama skills search "<task>"` or MCP `skills_search` before choosing a Llama workflow.
+- Use `llama skills show <slug>` or MCP `skills_read` only for the relevant skill.
+- Use `llama explain <command-url-or-object>` or MCP `object_inspect` for 404s, deleted wiki pages, notifier links, deal URLs, and unknown Command objects before telling the user "the system is broken."
+
+The boundary matters: public CLI/MCP discovers skills, but authenticated Command decides which skill content the token may read.
+
 ## Pipeline First (hard rule)
 
 Any time the user mentions a company name or founder name:
@@ -27,6 +38,9 @@ Any time the user mentions a company name or founder name:
 1. **Run `llama deal search "<name>"` BEFORE web search.** Always. No exceptions.
 2. If pipeline has it → pull the data, integrate into your reply silently.
 3. If pipeline doesn't have it → ask once: "New name. Add to pipeline? (Y/n)". On yes, `llama deal create`.
+   - Use `--status Outreached` when we only contacted/logged the company and have no response or effective relationship yet.
+   - Use `--status Sourced` only once there is a response, intro, meeting, or another real relationship signal.
+   - Also set `--source-direction Inbound` if the deal came into the firm; set `--source-direction Outbound` if Llama found/listed/reached out first.
 4. If user gives you new facts (status / valuation / founder note) → `llama deal update` immediately, tell the user **one line** afterward.
 
 Don't:
@@ -190,12 +204,20 @@ llama deal show <dealId>
 llama deal list [--owner ...] [--status ...]
 
 # Pipeline — write
-llama deal create "Company" --description "..."
+llama deal create "Company" --description "..." --source-direction Outbound --status Outreached
+llama deal create "Company" --description "..." --source-direction Inbound --status Sourced
 llama deal update <dealId> <field> <value>
-#   writable: status theirStage stage notes dealOwner source description website
+#   writable: status theirStage stage notes dealOwner source sourceDirection description website
 #             location founders proposedAmount roundSize valuation sector subsector
 #             foundedYear leadInvestor investors   (each write logs a deal_events row)
 
+# Our Stage vocabulary starts with:
+#   Outreached → Sourced → First Meeting → Diligence → Partner Meeting → Term Sheet → Invested
+# `Outreached` is relationship memory only. Do not inflate it to `Sourced`
+# unless a real relationship signal exists.
+# `sourceDirection` is separate: Inbound = came into the firm; Outbound =
+# we found/listed/reached out first.
+
 # Brief blocks
 llama brief blocks <dealId>
 llama brief add-text <dealId> --heading "..." --body "..."
@@ -259,7 +281,7 @@ Run `llama --help` for the full surface (~40 commands).
 
 ## MCP-native agents
 
-If you support [MCP](https://modelcontextprotocol.io), **prefer the MCP server over parsing CLI output.** The same package ships `llama-mcp` (20 typed tools, identical auth chain).
+If you support [MCP](https://modelcontextprotocol.io), **prefer the MCP server over parsing CLI output.** The same package ships `llama-mcp` (56 typed tools, identical auth chain).
 
 Add to your MCP client config (Claude Desktop / Claude Code / Cursor / OpenClaw / Codex / etc.):
 
@@ -270,6 +292,9 @@ Add to your MCP client config (Claude Desktop / Claude Code / Cursor / OpenClaw
 Tools available:
 
 - `auth_status` — verify creds + identity (call first if anything 401s)
+- `agent_bootstrap` — fetch the live Command + Llama OS runtime manifest
+- `skills_search` / `skills_read` — discover and read authenticated runtime skills
+- `object_inspect` — explain Command URLs, 404s, deleted objects, and lifecycle trail
 - `deal_search` / `deal_show` / `deal_create` / `deal_update`
 - `brief_blocks` / `brief_add_text` / `brief_add_link` / `brief_add_callout`
 - `wiki_search` / `wiki_save` (accepts `content_type: 'markdown' | 'html'` — HTML entries render as full-viewport sandboxed iframe at `/wiki/<slug>`) / `wiki_delete` / `wiki_restore` (soft-delete, reversible)

package/CHANGELOG.md

@@ -6,6 +6,36 @@ this project adheres to [Semantic Versioning](https://semver.org).
 
 ## [Unreleased]
 
+## [1.15.1] — 2026-06-16
+
+### Changed
+- Documented the new `Outreached` Our Stage across CLI, MCP, and agent
+  briefing surfaces. Agents should use `Outreached` for logged outreach
+  without a response/effective relationship, and reserve `Sourced` for real
+  relationship signals.
+- Added `sourceDirection` / `--source-direction` guidance across CLI, MCP, and
+  agent briefing surfaces. Use `Inbound` for deals that came into the firm and
+  `Outbound` for companies Llama found/listed/reached out to first.
+
+## [1.15.0] — 2026-06-15
+
+### Added
+- **`llama agent bootstrap`** — fetches the live Llama Command + Llama OS
+  runtime manifest, including the authenticated skill bundle metadata and
+  object-inspection contract.
+- **`llama skills search|show`** — discovers and reads runtime Llama OS skills
+  from Llama Command. The public npm package does not bundle private skill
+  content; Command returns only what the authenticated token may see.
+- **`llama explain <url-or-object>`** — asks Llama Command to explain URLs,
+  deleted objects, 404s, and lifecycle history before an agent guesses that
+  the system is broken.
+- MCP parity tools: **`agent_bootstrap`**, **`skills_search`**,
+  **`skills_read`**, and **`object_inspect`**.
+
+### Changed
+- `AGENT_BRIEFING.md` now teaches agents to use the authenticated runtime
+  skill gateway instead of assuming a local private `llama-os` checkout.
+
 ## [1.14.1] — 2026-06-15
 
 ### Added

package/README.md

@@ -48,7 +48,7 @@
 ```
 @llamaventures/cli
 ├── bin/llama          interactive CLI for humans + bash
-└── bin/llama-mcp      stdio MCP server, 52 typed tools — for any MCP-native agent
+└── bin/llama-mcp      stdio MCP server, 56 typed tools — for any MCP-native agent
 ```
 
 Both binaries share `lib/client.mjs` — the **same** auth chain, **same** HTTP
@@ -180,11 +180,14 @@ llama token show
 
 # Pipeline — read
 llama deal search "acme ai"
+llama deal list --owner alex --status Outreached
+llama deal list --source-direction Outbound --status Outreached
 llama deal list --owner alex --status Diligence
 llama deal show <dealId>
 
 # Pipeline — write
-llama deal create "Acme AI" --description "..." --source Gavin
+llama deal create "Acme AI" --description "..." --source Gavin --source-direction Outbound --status Outreached
+llama deal create "Acme AI" --description "..." --source Gavin --source-direction Inbound --status Sourced
 llama deal update <dealId> status Diligence
 llama deal enrich <dealId> --dry-run
 llama deal enrich <dealId> --apply --executor server_agent
@@ -193,6 +196,13 @@ llama deal agent run <dealId> --message "collect founder evidence and update typ
 llama deal delete  <dealId>     # soft (audit-logged)
 llama deal restore <dealId>
 
+# Status semantics
+# Outreached = contact/logged, but no response or effective relationship yet.
+# Sourced    = response, intro, meeting, or another real relationship signal exists.
+# sourceDirection is separate:
+# Inbound    = came into the firm.
+# Outbound   = we found/listed/reached out first.
+
 # Deal Brief — ordered, typed blocks (text · link · embed · callout)
 llama brief blocks       <dealId>
 llama brief add-text     <dealId> --heading "..." --body "..."
@@ -211,6 +221,12 @@ llama approvals   decide <approvalId> approved --note "..."
 llama timeline <dealId>
 llama post     <dealId> "message body" [--link url]
 
+# Agent runtime — live Command + private Llama OS skill gateway
+llama agent bootstrap
+llama skills search "wiki delete tombstone"
+llama skills show llama-command
+llama explain https://command.llamaventures.vc/wiki/some-page
+
 # Wiki
 llama wiki search "<query>"
 llama wiki read   <slug> [--lang en|zh]
@@ -249,13 +265,14 @@ agents can pattern-match without parsing prose.
 ## MCP server
 
 The bundled `llama-mcp` is a **stdio Model Context Protocol** server exposing
-**52 typed tools** that mirror the most-used CLI surface. Every tool is named
+**56 typed tools** that mirror the most-used CLI surface. Every tool is named
 and scoped — there is no generic API passthrough, by design (a public-package
 escape hatch reachable from a prompt-injectable agent context is exactly the
 shape we want to avoid).
 
 Coverage is grouped around the workflows agents actually need: auth
-diagnostics; deal search/show/create/update/feed; server-side deal agent runs;
+diagnostics; live agent bootstrap; authenticated Llama OS skill search/read;
+Command URL/object inspection; deal search/show/create/update/feed; server-side deal agent runs;
 deal enrichment harnesses;
 trust-rated facts; brief blocks and version history; wiki read/write/delete/restore;
 timeline posts and mentions; skill corrections; refresh triggers; external pitch intake;
@@ -277,6 +294,11 @@ The `agent_briefing` MCP **prompt** also returns
 [`AGENT_BRIEFING.md`](AGENT_BRIEFING.md) verbatim, so any new agent loading the
 server can self-onboard without leaving the protocol.
 
+For current Llama OS skills, use the runtime tools instead of looking for a
+local private repo: `agent_bootstrap`, `skills_search`, `skills_read`, and
+`object_inspect`. The public npm package does not bundle private skill text;
+Command returns only the content visible to the authenticated token.
+
 ### Wire into your agent
 
 <details open>

package/README.zh-CN.md

@@ -48,7 +48,7 @@
 ```
 @llamaventures/cli
 ├── bin/llama          给人 + bash 用的交互式 CLI
-└── bin/llama-mcp      给 MCP 原生 agent 用的 stdio MCP server，52 个工具
+└── bin/llama-mcp      给 MCP 原生 agent 用的 stdio MCP server，56 个工具
 ```
 
 两个 binary 共享 `lib/client.mjs`——**同一**认证链、**同一** HTTP 客户端、
@@ -201,11 +201,14 @@ llama token show
 
 # Pipeline——读
 llama deal search "acme ai"
+llama deal list --owner alex --status Outreached
+llama deal list --source-direction Outbound --status Outreached
 llama deal list --owner alex --status Diligence
 llama deal show <dealId>
 
 # Pipeline——写
-llama deal create "Acme AI" --description "..." --source Gavin
+llama deal create "Acme AI" --description "..." --source Gavin --source-direction Outbound --status Outreached
+llama deal create "Acme AI" --description "..." --source Gavin --source-direction Inbound --status Sourced
 llama deal update <dealId> status Diligence
 llama deal enrich <dealId> --dry-run
 llama deal enrich <dealId> --apply --executor server_agent
@@ -214,6 +217,13 @@ llama deal agent run <dealId> --message "collect founder evidence and update typ
 llama deal delete  <dealId>     # 软删除（审计日志记录）
 llama deal restore <dealId>
 
+# Status 语义
+# Outreached = 只是联系/记录了，还没有回复或有效关系。
+# Sourced    = 已有回复、intro、会议，或其它真实关系信号。
+# sourceDirection 是单独维度：
+# Inbound    = 自然流入公司。
+# Outbound   = 我们主动发现/建名单/触达。
+
 # Deal Brief——有序的、有类型的 block（text · link · embed · callout）
 llama brief blocks       <dealId>
 llama brief add-text     <dealId> --heading "..." --body "..."
@@ -232,6 +242,12 @@ llama approvals   decide <approvalId> approved --note "..."
 llama timeline <dealId>
 llama post     <dealId> "消息内容" [--link url]
 
+# Agent runtime——Command 上的 Llama OS skill gateway
+llama agent bootstrap
+llama skills search "wiki delete tombstone"
+llama skills show llama-command
+llama explain https://command.llamaventures.vc/wiki/some-page
+
 # Wiki
 llama wiki search "<query>"
 llama wiki save <slug> --title "..." --content "..."
@@ -261,11 +277,12 @@ MCP server 在 `isError: true` 内容里返回相同的前缀，agent 不用解
 ## MCP server
 
 随包发布的 `llama-mcp` 是一个 **stdio Model Context Protocol** server，
-暴露 **52 个 typed tools**——基本镜像 CLI 最常用的命令。每个 tool 都是
+暴露 **56 个 typed tools**——基本镜像 CLI 最常用的命令。每个 tool 都是
 具名、scoped 的；**没有**通用的 API passthrough，这是有意设计的（公开
 package 里一个能被 prompt-injection 触达的逃生通道，正是我们要避开的形状）。
 
-覆盖面按 agent 真正会用的工作流分组：auth 诊断；deal search/show/create/
+覆盖面按 agent 真正会用的工作流分组：auth 诊断；live agent bootstrap；
+授权后的 Llama OS skill search/read；Command URL/object inspect；deal search/show/create/
 update/feed；服务端 deal agent run；deal enrichment harness；带 trust ladder 的事实；brief blocks
 和版本历史；wiki 读写删恢复；timeline posts 和 mentions；skill corrections；
 refresh triggers；外部 pitch intake；memo show/regenerate/save/reset；
@@ -286,6 +303,10 @@ printf '%s\n' \
 [`AGENT_BRIEFING.md`](AGENT_BRIEFING.md)——刚装上 server 的 agent
 不用离开协议就能给自己 onboard。
 
+要读当前 Llama OS skills，用 runtime tools：`agent_bootstrap`、
+`skills_search`、`skills_read`、`object_inspect`。公开 npm 包不打包私有
+skill 正文；Command 只按当前 token 的权限返回可见内容。
+
 ### 接到你的 agent 上
 
 <details open>

package/bin/llama-mcp.mjs

@@ -195,6 +195,82 @@ server.registerTool(
   }
 );
 
+server.registerTool(
+  "agent_bootstrap",
+  {
+    description:
+      "Fetch the live Llama Command + Llama OS runtime manifest. Use this at " +
+      "the start of an agent session to discover current skills, the skill " +
+      "bundle version, and the object-inspection contract. Unlike the bundled " +
+      "agent_briefing prompt, this comes from authenticated Command runtime.",
+    inputSchema: {
+      limit: z.number().optional().describe("number of skill summaries to include; default 25"),
+    },
+  },
+  async ({ limit } = {}) => {
+    const params = new URLSearchParams();
+    if (limit) params.set("limit", String(limit));
+    return callApi("GET", `/api/agent/manifest${params.toString() ? `?${params}` : ""}`);
+  }
+);
+
+server.registerTool(
+  "skills_search",
+  {
+    description:
+      "Search the authenticated Llama OS runtime skill library. Call this " +
+      "before choosing a workflow for Llama pipeline/wiki/DD/research/ops tasks. " +
+      "Returns summaries only; call skills_read for the exact SKILL.md.",
+    inputSchema: {
+      q: z.string().describe("workflow/task query, e.g. 'wiki delete tombstone' or 'deal DD memo'"),
+      limit: z.number().optional().describe("default 20"),
+    },
+  },
+  async ({ q, limit }) => {
+    const params = new URLSearchParams({ q });
+    if (limit) params.set("limit", String(limit));
+    return callApi("GET", `/api/agent/skills?${params}`);
+  }
+);
+
+server.registerTool(
+  "skills_read",
+  {
+    description:
+      "Read one runtime Llama OS skill by slug. Use after skills_search. " +
+      "Returns the full SKILL.md content from Llama Command; public npm does " +
+      "not bundle private skill text.",
+    inputSchema: {
+      slug: z.string().describe("skill slug, e.g. llama-command or llama-wiki"),
+    },
+  },
+  async ({ slug }) => callApi("GET", `/api/agent/skills/${encodeURIComponent(slug)}`)
+);
+
+server.registerTool(
+  "object_inspect",
+  {
+    description:
+      "Explain a Llama Command URL or object id. Use for 404s, deleted wiki " +
+      "pages, notifier links, deal URLs, brief blocks, HTML docs, and unknown " +
+      "Command objects before guessing that the system is broken.",
+    inputSchema: {
+      q: z.string().optional().describe("URL or compact query, e.g. wiki:my-slug or a Command URL"),
+      type: z.string().optional().describe("explicit object type if not using q"),
+      id: z.string().optional().describe("explicit object id if not using q"),
+      lang: z.enum(["en", "zh"]).optional().describe("wiki language; default en"),
+    },
+  },
+  async ({ q, type, id, lang } = {}) => {
+    const params = new URLSearchParams();
+    if (q) params.set("q", q);
+    if (type) params.set("type", type);
+    if (id) params.set("id", id);
+    if (lang) params.set("lang", lang);
+    return callApi("GET", `/api/agent/explain?${params}`);
+  }
+);
+
 // ============================================================
 // Deals — read
 // ============================================================
@@ -204,7 +280,7 @@ server.registerTool(
   {
     description:
       "Search the Llama Ventures deal pipeline. Fuzzy match on company name, " +
-      "founders, description, founder info, notes, deal owner, source, and location. " +
+      "founders, description, founder info, notes, deal owner, source, source direction, and location. " +
       "Returns up to `limit` deals (default 200, cap 1000).",
     inputSchema: {
       q: z.string().optional().describe("fuzzy search query across all text fields"),
@@ -215,7 +291,7 @@ server.registerTool(
         .string()
         .optional()
         .describe(
-          "exact match on 'Our Stage' (Sourced, First Meeting, Diligence, Partner Meeting, Term Sheet, Invested, Passed, Stalled, Future, Unknown)"
+          "exact match on 'Our Stage' (Outreached, Sourced, First Meeting, Diligence, Partner Meeting, Term Sheet, Invested, Passed, Stalled, Future, Unknown). Outreached means contact was logged but no effective relationship/response exists yet."
         ),
       theirStage: z.string().optional().describe("exact match on 'Their Stage'"),
       stage: z
@@ -224,6 +300,10 @@ server.registerTool(
         .describe(
           "exact match on Round (Pre-Seed, Seed, Series A, Series B, Series C+, Stealth)"
         ),
+      sourceDirection: z
+        .string()
+        .optional()
+        .describe("exact match on source direction: Inbound, Outbound, or Unknown"),
       limit: z.number().optional().describe("max results (default 200, cap 1000)"),
       offset: z.number().optional(),
     },
@@ -242,7 +322,7 @@ server.registerTool(
   {
     description:
       "Get the full canonical record for one deal by uuid. Includes status, " +
-      "stage, founders, owner, source, valuation, all whitelisted writable fields, " +
+      "stage, founders, owner, source, sourceDirection, valuation, all whitelisted writable fields, " +
       "and the `extra` JSONB blob.",
     inputSchema: {
       dealId: z.string().describe("deal uuid"),
@@ -272,8 +352,17 @@ server.registerTool(
         .string()
         .optional()
         .describe("Pre-Seed | Seed | Series A | Series B | Series C+ | Stealth"),
-      status: z.string().optional().describe("Our Stage workflow position"),
+      status: z
+        .string()
+        .optional()
+        .describe(
+          "Our Stage workflow position. Use Outreached when we only contacted/logged them and have no response/effective relationship; use Sourced only once there is a response, intro, meeting, or other real relationship signal."
+        ),
       source: z.string().optional().describe("free-form sourced-by; recommend nominating a user"),
+      sourceDirection: z
+        .string()
+        .optional()
+        .describe("Separate direction tag: Inbound if the deal came into the firm; Outbound if Llama found/listed/reached out first; Unknown if unclear."),
       notes: z.string().optional(),
       location: z.string().optional(),
     },
@@ -286,7 +375,7 @@ server.registerTool(
   {
     description:
       "Update a single whitelisted field on a deal. Writable fields: status, theirStage, " +
-      "notes, stage, dealOwner, source, description, website, location, founders, " +
+      "notes, stage, dealOwner, source, sourceDirection, description, website, location, founders, " +
       "proposedAmount, roundSize, valuation, sector, subsector, foundedYear, leadInvestor, " +
       "investors. Logs a field_change event in deal_events.",
     inputSchema: {
@@ -1501,7 +1590,9 @@ server.registerPrompt(
       "contract: identity, Pipeline First rule, content capture, autonomy " +
       "levels (L0/L1/L2/L3), communication style, error recovery, CLI/MCP " +
       "reference, and boundaries. Read this once, internalise it, operate " +
-      "accordingly. Same content as `llama agent-onboard` from the CLI.",
+      "accordingly. Same content as `llama agent-onboard` from the CLI. " +
+      "For the live private Llama OS skill library, call agent_bootstrap, " +
+      "skills_search, and skills_read.",
   },
   async () => {
     // Gate the briefing behind a /api/me check so unauthenticated MCP

package/bin/llama.mjs

@@ -141,7 +141,7 @@ function clientSideMatch(deal, filters) {
     const fields = [
       deal.companyName, deal.founders, deal.founderInfo,
       deal.description, deal.notes, deal.dealOwner,
-      deal.source, deal.location,
+      deal.source, deal.sourceDirection, deal.location,
     ];
     if (!fields.some((f) => incl(f, filters.q))) return false;
   }
@@ -151,6 +151,7 @@ function clientSideMatch(deal, filters) {
   if (filters.status && !eq(deal.status, filters.status)) return false;
   if (filters.theirStage && !eq(deal.theirStage, filters.theirStage)) return false;
   if (filters.stage && !eq(deal.stage, filters.stage)) return false;
+  if (filters.sourceDirection && !eq(deal.sourceDirection, filters.sourceDirection)) return false;
   return true;
 }
 
@@ -158,11 +159,14 @@ function clientSideMatch(deal, filters) {
 function buildDealsQuery(q, flags) {
   const params = new URLSearchParams();
   if (q) params.set("q", q);
-  for (const key of ["companyName", "founder", "owner", "status", "theirStage", "stage", "limit", "offset"]) {
+  for (const key of ["companyName", "founder", "owner", "status", "theirStage", "stage", "sourceDirection", "limit", "offset"]) {
     if (flags[key] !== undefined && flags[key] !== true) {
       params.set(key, String(flags[key]));
     }
   }
+  if (flags["source-direction"] !== undefined && flags["source-direction"] !== true) {
+    params.set("sourceDirection", String(flags["source-direction"]));
+  }
   return params;
 }
 
@@ -185,6 +189,7 @@ async function searchDeals(q, flags) {
       status: flags.status,
       theirStage: flags.theirStage,
       stage: flags.stage,
+      sourceDirection: flags.sourceDirection || flags["source-direction"],
     };
     const filtered = result.filter((d) => clientSideMatch(d, filters));
     const limit = Number(flags.limit) > 0 ? Number(flags.limit) : 200;
@@ -273,6 +278,10 @@ const HELP_FULL = `Llama Command CLI
 
 Agent onboarding (run once on first install):
   llama agent-onboard                  # print AGENT_BRIEFING.md — the workflow contract for AI agents
+  llama agent bootstrap                # fetch live Command + Llama OS skill manifest
+  llama skills search "pipeline update" # discover relevant runtime skills
+  llama skills show llama-pipeline      # read a skill from Command
+  llama explain <url-or-object>         # explain Command URL/object status + lifecycle
 
 External pitch — talk to Llama Ventures' intake agent (no token required):
   llama pitch start --name "Jane Doe" --email "jane@acme.ai"
@@ -293,15 +302,16 @@ auto-detects \`gcloud auth print-identity-token\` and uses Bearer auth.
 Manually-set \`llc_\` tokens are used as a fallback.
 
 Deals:
-  llama deal create "Company" --source <name> --description "..." --website https://...
+  llama deal create "Company" --source <name> --source-direction Inbound|Outbound --description "..." --status Outreached|Sourced --website https://...
   llama deal show <dealId>
   llama deal feed <dealId>                                     # every contribution (facts + notes), human-typed or assistant-drafted, newest first
   llama deal update <dealId> <field> <value>
-      Writable fields: status, theirStage, stage, notes, dealOwner, source,
+      Writable fields: status, theirStage, stage, notes, dealOwner, source, sourceDirection,
       description, website, location, founders, founderInfo, proposedAmount,
       roundSize, valuation, deckLink, folderUrl, sector, subsector,
       foundedYear, leadInvestor, investors, agentActive.
       e.g.  llama deal update <dealId> website https://acme.ai
+            llama deal update <dealId> status Outreached
             llama deal update <dealId> sector "Developer Tools"
             llama deal update <dealId> foundedYear 2024
             llama deal update <dealId> leadInvestor "Acme Capital"
@@ -316,7 +326,7 @@ Deals:
       string. Audited to deal_events as field_change "extra.<key>".
   llama deal extra unset <dealId> <key>              # delete the key (admin)
   llama deal search <query> [--founder name] [--owner <user-key>] [--status Diligence]
-                            [--theirStage Raising] [--stage Seed]
+                            [--theirStage Raising] [--stage Seed] [--source-direction Inbound]
                             [--limit 200] [--offset 0]
   llama deal list [--owner ...] [--status ...] [...same flags as search]
 
@@ -512,6 +522,9 @@ Common:
   llama deal feed <dealId>          every contribution (facts + notes), newest first
   llama post <dealId> "..."         add a note to a deal
   llama agent-onboard               print the AI-agent workflow contract
+  llama agent bootstrap             live Llama OS skill manifest from Command
+  llama skills search "<query>"     discover which skill to read
+  llama explain <url-or-object>     explain Command URLs, 404s, deleted objects
 
 Command groups — run \`llama help <group>\` for that group's commands:
   deal        create · show · feed · update · enrich · search · collaborators · links · delete
@@ -524,6 +537,8 @@ Command groups — run \`llama help <group>\` for that group's commands:
   pitch       external founder intake (no token needed)
   ownership   claim · nominate · approvals
   admin       audit events (system admin only)
+  agent       bootstrap · skills · explain for AI agents
+  skills      search · show runtime Llama OS skills
   auth        setup · tokens · auth status
 
   llama help all     the full command reference (everything at once)
@@ -543,6 +558,8 @@ const HELP_AREA_MATCH = {
   pitch: [/^External pitch/],
   ownership: [/^Ownership/, /^Approvals/],
   admin: [/^Admin/],
+  agent: [/^Agent onboarding/],
+  skills: [/^Agent onboarding/],
   auth: [/^Setup/, /^Zero-config/, /^Token discovery/, /^Env/],
 };
 
@@ -931,6 +948,95 @@ https://command.llamaventures.vc/settings/tokens, run
     return;
   }
 
+  // Live runtime bootstrap from Llama Command. Unlike agent-onboard, this is
+  // not bundled in the public npm package; Command returns the current
+  // authenticated skill manifest and object-inspection contract.
+  if (area === "agent" && action === "bootstrap") {
+    const { flags } = parseFlags(rest, ["json", "limit"]);
+    const params = new URLSearchParams();
+    if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+    const manifest = await request("GET", `/api/agent/manifest${params.toString() ? `?${params}` : ""}`);
+    if (flags.json) {
+      print(manifest);
+    } else {
+      process.stdout.write(`${manifest.briefing || JSON.stringify(manifest, null, 2)}\n`);
+    }
+    return;
+  }
+
+  if (area === "skills" || (area === "agent" && action === "skills")) {
+    const sub = area === "skills" ? action : rest[0];
+    const args = area === "skills" ? rest : rest.slice(1);
+    if (!sub || sub === "list") {
+      const { flags } = parseFlags(args, ["json", "limit"]);
+      const params = new URLSearchParams();
+      if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+      const result = await request("GET", `/api/agent/skills${params.toString() ? `?${params}` : ""}`);
+      print(result);
+      return;
+    }
+    if (sub === "search") {
+      const { flags, positional } = parseFlags(args, ["json", "limit"]);
+      const q = positional.join(" ").trim();
+      if (!q) throw new Error("Usage: llama skills search <query> [--limit 20]");
+      const params = new URLSearchParams({ q });
+      if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+      const result = await request("GET", `/api/agent/skills?${params}`);
+      print(result);
+      return;
+    }
+    if (sub === "show" || sub === "read") {
+      const { flags, positional } = parseFlags(args, ["json"]);
+      const slug = positional[0];
+      if (!slug) throw new Error("Usage: llama skills show <slug> [--json]");
+      const result = await request("GET", `/api/agent/skills/${encodeURIComponent(slug)}`);
+      if (flags.json) {
+        print(result);
+      } else {
+        process.stdout.write(`${result.skill?.content || JSON.stringify(result, null, 2)}\n`);
+      }
+      return;
+    }
+    throw new Error(`Unknown skills subcommand "${sub}". Use: list / search / show.`);
+  }
+
+  if (area === "explain" || (area === "agent" && action === "explain")) {
+    const args = area === "explain" ? [action, ...rest].filter(Boolean) : rest;
+    const { flags, positional } = parseFlags(args, ["json", "type", "id", "lang"]);
+    const params = new URLSearchParams();
+    const q = positional.join(" ").trim();
+    if (q) params.set("q", q);
+    if (flags.type && flags.type !== true) params.set("type", String(flags.type));
+    if (flags.id && flags.id !== true) params.set("id", String(flags.id));
+    if (flags.lang === "zh") params.set("lang", "zh");
+    if (!params.has("q") && !(params.has("type") && params.has("id"))) {
+      throw new Error("Usage: llama explain <url-or-object> OR llama explain --type <type> --id <id>");
+    }
+    const result = await request("GET", `/api/agent/explain?${params}`);
+    if (flags.json) {
+      print(result);
+    } else {
+      const target = result.result?.target;
+      const lifecycle = result.result?.lifecycle || [];
+      const lines = [
+        `${target?.objectType || "object"} ${target?.objectId || ""}`,
+        `Status: ${target?.status || "unknown"}`,
+        `Title: ${target?.title || "Untitled"}`,
+        target?.detail ? `Detail: ${target.detail}` : null,
+        target?.url ? `URL: ${target.url}` : null,
+        `Lifecycle events: ${lifecycle.length}`,
+      ].filter(Boolean);
+      if (lifecycle[0]) {
+        lines.push(
+          `Latest lifecycle: ${lifecycle[0].action} by ${lifecycle[0].actor_label || "unknown"} at ${lifecycle[0].created_at}`,
+        );
+        if (lifecycle[0].reason) lines.push(`Reason: ${lifecycle[0].reason}`);
+      }
+      process.stdout.write(`${lines.join("\n")}\n`);
+    }
+    return;
+  }
+
   // `llama pitch ...` — external founder-pitch family. No Llama token
   // required; bootstraps a session against /api/external/* via PoW + cookie.
   // See lib/external.mjs and AGENT_BRIEFING.md for the full surface.
@@ -1143,6 +1249,7 @@ https://command.llamaventures.vc/settings/tokens, run
     const body = {
       companyName,
       source: flags.source,
+      sourceDirection: flags.sourceDirection || flags["source-direction"],
       description: flags.description,
       website: flags.website,
       notes: flags.notes,
@@ -1219,7 +1326,7 @@ https://command.llamaventures.vc/settings/tokens, run
     const q = positional.join(" ").trim();
     if (!q && Object.keys(flags).length === 0) {
       throw new Error(
-        `Usage: llama deal search <query> [--founder ...] [--owner ...] [--status ...] [--stage ...] [--limit N]`
+        `Usage: llama deal search <query> [--founder ...] [--owner ...] [--status ...] [--stage ...] [--source-direction Inbound|Outbound] [--limit N]`
       );
     }
     print(await searchDeals(q, flags));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.14.1",
+  "version": "1.15.1",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {

package/scripts/verify-agent-routing.mjs

@@ -3,12 +3,23 @@
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
+import { existsSync } from "node:fs";
 import { mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+assert.equal(
+  existsSync(path.join(repoRoot, "docs/agent-skills.bundle.json")),
+  false,
+  "public llama-cli must not bundle private Llama OS skill content",
+);
+assert.equal(
+  existsSync(path.join(repoRoot, "src/data/llama-os-skills.bundle.json")),
+  false,
+  "public llama-cli must not copy the Command-side skill mirror",
+);
 const calls = [];
 let threadSeq = 0;
 
@@ -49,7 +60,81 @@ const server = createServer(async (req, res) => {
   try {
     const body = await readJson(req);
     const url = new URL(req.url, "http://localhost");
-    calls.push({ method: req.method, path: url.pathname, body });
+    calls.push({
+      method: req.method,
+      path: url.pathname,
+      query: Object.fromEntries(url.searchParams.entries()),
+      body,
+    });
+
+    if (req.method === "GET" && url.pathname === "/api/agent/manifest") {
+      writeJson(res, {
+        ok: true,
+        briefing: "runtime briefing: use skills_search, skills_read, and object_inspect",
+        llama_os: {
+          visible_skill_count: 49,
+          included_skill_count: Number(url.searchParams.get("limit") || 25),
+        },
+        skills: [
+          {
+            slug: "llama-command",
+            description: "Llama Command runtime skill",
+          },
+        ],
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/agent/skills") {
+      writeJson(res, {
+        ok: true,
+        q: url.searchParams.get("q"),
+        count: 1,
+        skills: [
+          {
+            slug: "llama-command",
+            description: "Llama Command runtime skill",
+          },
+        ],
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/agent/skills/llama-command") {
+      writeJson(res, {
+        ok: true,
+        skill: {
+          slug: "llama-command",
+          content: "---\nname: llama-command\n---\n# Llama Command runtime skill\n",
+        },
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/agent/explain") {
+      writeJson(res, {
+        ok: true,
+        result: {
+          target: {
+            objectType: "wiki_article",
+            objectId: "missing-page",
+            status: "deleted",
+            title: "Missing Page",
+            detail: "Deleted by Kevin Yu",
+            url: "https://command.llamaventures.vc/wiki/missing-page",
+          },
+          lifecycle: [
+            {
+              action: "deleted",
+              actor_label: "Kevin Yu",
+              created_at: "2026-06-15T19:02:00Z",
+              reason: "user_deleted",
+            },
+          ],
+        },
+      });
+      return;
+    }
 
     if (req.method === "POST" && /^\/api\/deals\/[^/]+\/threads$/.test(url.pathname)) {
       threadSeq += 1;
@@ -228,6 +313,31 @@ const baseUrl = `http://${address.address}:${address.port}`;
 const homeDir = await mkdtemp(path.join(os.tmpdir(), "llama-cli-routing-"));
 
 try {
+  resetCalls();
+  const bootstrapRun = await runCli(["agent", "bootstrap", "--limit", "3"], baseUrl, homeDir);
+  assert.match(bootstrapRun.stdout, /runtime briefing/);
+  assert.deepEqual(paths(), ["GET /api/agent/manifest"]);
+  assert.equal(calls[0].query.limit, "3");
+
+  resetCalls();
+  const skillSearchRun = await runCli(["skills", "search", "pipeline", "--limit", "5"], baseUrl, homeDir);
+  assert.match(skillSearchRun.stdout, /llama-command/);
+  assert.deepEqual(paths(), ["GET /api/agent/skills"]);
+  assert.equal(calls[0].query.q, "pipeline");
+  assert.equal(calls[0].query.limit, "5");
+
+  resetCalls();
+  const skillShowRun = await runCli(["skills", "show", "llama-command"], baseUrl, homeDir);
+  assert.match(skillShowRun.stdout, /# Llama Command runtime skill/);
+  assert.deepEqual(paths(), ["GET /api/agent/skills/llama-command"]);
+
+  resetCalls();
+  const explainRun = await runCli(["explain", "https://command.llamaventures.vc/wiki/missing-page"], baseUrl, homeDir);
+  assert.match(explainRun.stdout, /Status: deleted/);
+  assert.match(explainRun.stdout, /Deleted by Kevin Yu/);
+  assert.deepEqual(paths(), ["GET /api/agent/explain"]);
+  assert.equal(calls[0].query.q, "https://command.llamaventures.vc/wiki/missing-page");
+
   resetCalls();
   const enrichRun = await runCli(
     [
@@ -299,6 +409,37 @@ try {
   assert.equal(payload.threadId, "thread-1");
   assert.equal(payload.text, "agent done");
 
+  resetCalls();
+  const mcpBootstrap = await callMcpTool("agent_bootstrap", { limit: 2 }, baseUrl, homeDir);
+  const bootstrapPayload = JSON.parse(mcpBootstrap.content?.[0]?.text ?? "{}");
+  assert.equal(bootstrapPayload.ok, true);
+  assert.deepEqual(paths(), ["GET /api/agent/manifest"]);
+  assert.equal(calls[0].query.limit, "2");
+
+  resetCalls();
+  const mcpSkills = await callMcpTool("skills_search", { q: "command", limit: 4 }, baseUrl, homeDir);
+  const skillsPayload = JSON.parse(mcpSkills.content?.[0]?.text ?? "{}");
+  assert.equal(skillsPayload.skills?.[0]?.slug, "llama-command");
+  assert.deepEqual(paths(), ["GET /api/agent/skills"]);
+  assert.equal(calls[0].query.q, "command");
+
+  resetCalls();
+  const mcpSkillRead = await callMcpTool("skills_read", { slug: "llama-command" }, baseUrl, homeDir);
+  const skillPayload = JSON.parse(mcpSkillRead.content?.[0]?.text ?? "{}");
+  assert.match(skillPayload.skill?.content ?? "", /# Llama Command runtime skill/);
+  assert.deepEqual(paths(), ["GET /api/agent/skills/llama-command"]);
+
+  resetCalls();
+  const mcpInspect = await callMcpTool(
+    "object_inspect",
+    { q: "https://command.llamaventures.vc/wiki/missing-page" },
+    baseUrl,
+    homeDir,
+  );
+  const inspectPayload = JSON.parse(mcpInspect.content?.[0]?.text ?? "{}");
+  assert.equal(inspectPayload.result?.target?.status, "deleted");
+  assert.deepEqual(paths(), ["GET /api/agent/explain"]);
+
   console.log("agent routing verification passed");
 } finally {
   await close(server);