@llamaventures/cli 1.15.1 → 1.17.0

package/lib/client.mjs

@@ -13,6 +13,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { execFile as _execFile } from "child_process";
 import { promisify } from "util";
+import { createHash, randomUUID } from "crypto";
 
 const execFile = promisify(_execFile);
 
@@ -43,6 +44,19 @@ export function readBriefing() {
   }
 }
 
+let packageVersionCache = null;
+
+export function getPackageVersion() {
+  if (packageVersionCache) return packageVersionCache;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf8"));
+    packageVersionCache = String(pkg.version || "unknown");
+  } catch {
+    packageVersionCache = "unknown";
+  }
+  return packageVersionCache;
+}
+
 // Canonical entrypoint. `llama-command.onrender.com` also serves the API
 // but its NextAuth callback URL doesn't match, so browser login (needed
 // to mint a token at /settings/tokens) fails there with a server-config
@@ -54,6 +68,7 @@ export const DEFAULT_BASE_URL = "https://command.llamaventures.vc";
 // agent-discovery convention.
 export const TOKEN_DIR = path.join(os.homedir(), ".llama");
 export const TOKEN_FILE = path.join(TOKEN_DIR, "token");
+export const AGENT_SESSION_FILE = path.join(TOKEN_DIR, "agent-session.json");
 
 // Legacy location used by CLI v0.1. Read for back-compat (silent migrate
 // to canonical on first use); never written for the token, but still the
@@ -123,6 +138,285 @@ export function getToken() {
   return "";
 }
 
+let runtimeClient = "cli";
+let runtimeAgentClient = null;
+
+export function setClientRuntime(opts = {}) {
+  if (opts.client) runtimeClient = String(opts.client);
+  if (opts.agentClient) runtimeAgentClient = String(opts.agentClient);
+}
+
+function detectAgentClient() {
+  if (runtimeAgentClient) return runtimeAgentClient;
+  if (process.env.LLAMA_AGENT_CLIENT) return process.env.LLAMA_AGENT_CLIENT;
+  if (process.env.CODEX_SANDBOX || process.env.CODEX_CLI || process.env.OPENAI_CODEX) return "codex";
+  if (process.env.CLAUDECODE || process.env.CLAUDE_CODE || process.env.CLAUDE_CODE_ENTRYPOINT) {
+    return "claude-code";
+  }
+  if (process.env.CURSOR_AGENT || process.env.CURSOR_TRACE_ID) return "cursor";
+  return "unknown";
+}
+
+export function readAgentSession() {
+  try {
+    return JSON.parse(fs.readFileSync(AGENT_SESSION_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function writeAgentSession(session) {
+  try {
+    fs.mkdirSync(TOKEN_DIR, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(AGENT_SESSION_FILE, `${JSON.stringify(session, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(AGENT_SESSION_FILE, 0o600);
+  } catch {
+    // Telemetry state is best-effort. Never break the actual CLI command.
+  }
+}
+
+function currentAgentSessionId() {
+  const session = readAgentSession();
+  if (session.sessionId) return session.sessionId;
+  const created = {
+    sessionId: randomUUID(),
+    createdAt: new Date().toISOString(),
+  };
+  writeAgentSession(created);
+  return created.sessionId;
+}
+
+export function getLastAgentEvent() {
+  const session = readAgentSession();
+  return session.lastEventId ? session : null;
+}
+
+function rememberAgentEvent(event) {
+  if (!event?.eventId) return;
+  const session = {
+    ...readAgentSession(),
+    sessionId: event.sessionId || currentAgentSessionId(),
+    lastEventId: event.eventId,
+    lastCandidateId: event.candidateId ?? null,
+    lastCommand: event.command ?? null,
+    lastQuery: event.query ?? null,
+    lastSurface: event.surface ?? null,
+    lastRecordedAt: new Date().toISOString(),
+  };
+  writeAgentSession(session);
+}
+
+function agentClientHeaders(command) {
+  return {
+    "X-Llama-Client": runtimeClient,
+    "X-Llama-Client-Version": getPackageVersion(),
+    "X-Llama-Agent-Client": detectAgentClient(),
+    "X-Llama-Agent-Session": currentAgentSessionId(),
+    "X-Llama-Command": command || "unknown",
+  };
+}
+
+const SECRET_KEY_RE = /(token|secret|password|authorization|cookie|api[_-]?key|keychain|jwt)/i;
+const CONTENT_PAYLOAD_KEY_RE = /(^|_)(html|body|content|markdown|message|text)$/i;
+
+function truncateText(text, max = 2000) {
+  return text.length > max ? `${text.slice(0, max)}...[truncated]` : text;
+}
+
+function summarizePayloadText(value) {
+  const text = String(value ?? "");
+  return {
+    redacted: true,
+    type: "text_payload",
+    chars: text.length,
+    bytes: Buffer.byteLength(text, "utf8"),
+    sha256: createHash("sha256").update(text).digest("hex"),
+  };
+}
+
+function sanitizeTelemetryValue(value, depth = 0, keyHint = "") {
+  if (depth > 4) return "[max-depth]";
+  if (value === null || value === undefined) return value;
+  if (typeof value === "string") {
+    return CONTENT_PAYLOAD_KEY_RE.test(keyHint)
+      ? summarizePayloadText(value)
+      : truncateText(value);
+  }
+  if (typeof value === "number" || typeof value === "boolean") return value;
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item) => sanitizeTelemetryValue(item, depth + 1, keyHint));
+  }
+  if (typeof value === "object") {
+    const out = {};
+    for (const [key, val] of Object.entries(value).slice(0, 40)) {
+      out[key] = SECRET_KEY_RE.test(key) ? "[redacted]" : sanitizeTelemetryValue(val, depth + 1, key);
+    }
+    return out;
+  }
+  return String(value);
+}
+
+function parseEndpoint(endpoint) {
+  try {
+    return new URL(endpoint, "https://command.llamaventures.vc");
+  } catch {
+    return null;
+  }
+}
+
+function endpointArgs(endpoint, body) {
+  const args = {};
+  const url = parseEndpoint(endpoint);
+  if (url) {
+    for (const [key, value] of url.searchParams.entries()) args[key] = value;
+  }
+  if (body && typeof body === "object" && !Array.isArray(body)) {
+    Object.assign(args, body);
+  }
+  return sanitizeTelemetryValue(args);
+}
+
+function inferCommand(method, endpoint) {
+  const url = parseEndpoint(endpoint);
+  const pathname = url?.pathname || endpoint.split("?")[0] || "";
+  const verb = String(method || "GET").toUpperCase();
+  if (pathname === "/api/agent/client-events") return "telemetry.record";
+  if (pathname === "/api/agent/eval-feedback") return "eval.feedback";
+  if (pathname === "/api/wiki/search") return "wiki.search";
+  if (pathname === "/api/wiki/save") return "wiki.save";
+  if (/^\/api\/wiki\/[^/]+$/.test(pathname)) return verb === "GET" ? "wiki.read" : "wiki.write";
+  if (pathname === "/api/deals") return verb === "GET" ? "deal.search" : "deal.write";
+  if (pathname === "/api/deals/create") return "deal.create";
+  if (pathname === "/api/deals/update") return "deal.update";
+  if (/^\/api\/deals\/[^/]+\/threads\/[^/]+$/.test(pathname)) return "deal.agent.run";
+  if (/^\/api\/deals\/[^/]+\/threads$/.test(pathname)) return "deal.thread.create";
+  if (/^\/api\/deals\/[^/]+\/facts/.test(pathname)) return verb === "GET" ? "deal.fact.list" : "deal.fact.write";
+  if (/^\/api\/deals\/[^/]+\/posts$/.test(pathname)) return "deal.post";
+  if (/^\/api\/deals\/[^/]+\/blocks/.test(pathname)) return verb === "GET" ? "brief.blocks" : "brief.write";
+  if (/^\/api\/deals\/[^/]+$/.test(pathname)) return verb === "GET" ? "deal.show" : "deal.write";
+  if (pathname === "/api/me") return "auth.status";
+  if (pathname.startsWith("/api/agent/skills")) return "skills.read";
+  if (pathname === "/api/agent/manifest") return "agent.bootstrap";
+  if (pathname === "/api/agent/briefing") return "agent.briefing";
+  return `${verb.toLowerCase()} ${pathname || endpoint}`;
+}
+
+function queryForCommand(command, args) {
+  if (!command.endsWith(".search")) return null;
+  return args?.q || args?.search || args?.query || null;
+}
+
+function summarizeResultIds(data) {
+  const result = {};
+  const topDeals = [];
+  const topWiki = [];
+
+  const collectDeal = (deal) => {
+    const id = deal?.uuid || deal?.id || deal?.dealId || deal?.deal_uuid;
+    if (!id) return;
+    topDeals.push({ id, name: deal.companyName || deal.company_name || deal.name || null });
+  };
+  const collectWiki = (item) => {
+    if (!item?.slug) return;
+    topWiki.push({ slug: item.slug, title: item.title || null });
+  };
+
+  if (Array.isArray(data)) {
+    for (const item of data.slice(0, 20)) {
+      collectDeal(item);
+      collectWiki(item);
+    }
+    result.resultCount = data.length;
+  } else if (data && typeof data === "object") {
+    const deals = Array.isArray(data.deals) ? data.deals : [];
+    const articles = Array.isArray(data.articles) ? data.articles : [];
+    const results = Array.isArray(data.results) ? data.results : [];
+    for (const deal of deals.slice(0, 20)) collectDeal(deal);
+    for (const item of [...articles, ...results].slice(0, 20)) collectWiki(item);
+    if (typeof data.total === "number") result.total = data.total;
+    if (deals.length) result.resultCount = deals.length;
+    if (articles.length || results.length) result.resultCount = articles.length + results.length;
+  }
+
+  if (topDeals.length) result.deals = topDeals;
+  if (topWiki.length) result.wiki = topWiki;
+  return result;
+}
+
+function summarizeResult(data) {
+  if (data === null || data === undefined) return null;
+  if (Array.isArray(data)) return `${data.length} result(s)`;
+  if (typeof data === "object") {
+    if (Array.isArray(data.deals)) return `${data.deals.length} deal result(s); total=${data.total ?? "unknown"}`;
+    if (Array.isArray(data.results)) return `${data.results.length} result(s)`;
+    if (data.ok !== undefined) return `ok=${Boolean(data.ok)}`;
+  }
+  return truncateText(typeof data === "string" ? data : JSON.stringify(sanitizeTelemetryValue(data)), 2000);
+}
+
+function shouldSkipTelemetry(endpoint) {
+  if (process.env.LLAMA_TELEMETRY === "0") return true;
+  const pathname = parseEndpoint(endpoint)?.pathname || endpoint;
+  return pathname === "/api/agent/client-events" || pathname === "/api/agent/eval-feedback";
+}
+
+async function recordClientTelemetry({
+  authHeaders,
+  method,
+  endpoint,
+  body,
+  command,
+  status,
+  httpStatus,
+  latencyMs,
+  data,
+  errorMessage,
+}) {
+  if (shouldSkipTelemetry(endpoint)) return;
+  const args = endpointArgs(endpoint, body);
+  const sessionId = currentAgentSessionId();
+  const payload = {
+    client: runtimeClient,
+    clientVersion: getPackageVersion(),
+    agentClient: detectAgentClient(),
+    sessionId,
+    command,
+    method: String(method || "GET").toUpperCase(),
+    endpoint,
+    status,
+    httpStatus,
+    latencyMs,
+    args,
+    query: queryForCommand(command, args),
+    resultSummary: status === "success" ? summarizeResult(data) : null,
+    resultIds: status === "success" ? summarizeResultIds(data) : {},
+    errorMessage: errorMessage ? truncateText(String(errorMessage), 2000) : null,
+  };
+  try {
+    const res = await fetch(`${getBaseUrl()}/api/agent/client-events`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...agentClientHeaders("telemetry.record"),
+        ...authHeaders,
+      },
+      body: JSON.stringify(payload),
+    });
+    if (!res.ok) return;
+    const recorded = await res.json().catch(() => null);
+    rememberAgentEvent({
+      ...recorded,
+      sessionId,
+      command,
+      query: payload.query,
+      surface: command.startsWith("deal.") ? "deal" : command.startsWith("wiki.") ? "wiki" : null,
+    });
+  } catch {
+    // Best-effort by design. The actual llama command already succeeded or
+    // failed; telemetry must never alter that outcome.
+  }
+}
+
 // Try `gcloud auth print-identity-token`. Returns the JWT or null. Zero-config
 // win for any team member who has gcloud + their @llamaventures.vc account
 // already set up — the server's Bearer auth path verifies and auto-creates
@@ -216,22 +510,26 @@ function unauthorizedError() {
   );
 }
 
-export async function request(method, endpoint, body) {
-  return requestWithRetry(method, endpoint, body, /* allowRetry */ true);
+export async function request(method, endpoint, body, opts = {}) {
+  return requestWithRetry(method, endpoint, body, opts, /* allowRetry */ true);
 }
 
 export async function requestSse(method, endpoint, body, opts = {}) {
   return requestSseWithRetry(method, endpoint, body, opts, /* allowRetry */ true);
 }
 
-async function requestWithRetry(method, endpoint, body, allowRetry) {
+async function requestWithRetry(method, endpoint, body, opts, allowRetry) {
   const authHeaders = await getAuthHeaders();
   if (Object.keys(authHeaders).length === 0) throw noAuthError();
+  const command = inferCommand(method, endpoint);
+  const start = Date.now();
   const res = await fetch(`${getBaseUrl()}${endpoint}`, {
     method,
     headers: {
       "Content-Type": "application/json",
+      ...agentClientHeaders(command),
       ...authHeaders,
+      ...(opts.headers || {}),
     },
     body: body === undefined ? undefined : JSON.stringify(body),
   });
@@ -251,7 +549,7 @@ async function requestWithRetry(method, endpoint, body, allowRetry) {
       refreshed = null;
     }
     if (refreshed) {
-      return requestWithRetry(method, endpoint, body, /* allowRetry */ false);
+      return requestWithRetry(method, endpoint, body, opts, /* allowRetry */ false);
     }
     throw unauthorizedError();
   }
@@ -267,18 +565,45 @@ async function requestWithRetry(method, endpoint, body, allowRetry) {
   }
   if (!res.ok) {
     const message = typeof data === "object" && data?.error ? data.error : `HTTP ${res.status}`;
+    await recordClientTelemetry({
+      authHeaders,
+      method,
+      endpoint,
+      body,
+      command,
+      status: "error",
+      httpStatus: res.status,
+      latencyMs: Date.now() - start,
+      data: null,
+      errorMessage: message,
+    });
     throw new Error(message);
   }
+  await recordClientTelemetry({
+    authHeaders,
+    method,
+    endpoint,
+    body,
+    command,
+    status: "success",
+    httpStatus: res.status,
+    latencyMs: Date.now() - start,
+    data,
+    errorMessage: null,
+  });
   return data;
 }
 
 async function requestSseWithRetry(method, endpoint, body, opts, allowRetry) {
   const authHeaders = await getAuthHeaders();
   if (Object.keys(authHeaders).length === 0) throw noAuthError();
+  const command = inferCommand(method, endpoint);
+  const start = Date.now();
   const res = await fetch(`${getBaseUrl()}${endpoint}`, {
     method,
     headers: {
       "Content-Type": "application/json",
+      ...agentClientHeaders(command),
       ...authHeaders,
     },
     body: body === undefined ? undefined : JSON.stringify(body),
@@ -309,6 +634,18 @@ async function requestSseWithRetry(method, endpoint, body, opts, allowRetry) {
       data = text;
     }
     const message = typeof data === "object" && data?.error ? data.error : `HTTP ${res.status}`;
+    await recordClientTelemetry({
+      authHeaders,
+      method,
+      endpoint,
+      body,
+      command,
+      status: "error",
+      httpStatus: res.status,
+      latencyMs: Date.now() - start,
+      data: null,
+      errorMessage: message,
+    });
     throw new Error(message);
   }
 
@@ -343,6 +680,18 @@ async function requestSseWithRetry(method, endpoint, body, opts, allowRetry) {
     for (const frame of frames) handleFrame(frame);
   }
   if (buf.trim()) handleFrame(buf);
+  await recordClientTelemetry({
+    authHeaders,
+    method,
+    endpoint,
+    body,
+    command,
+    status: "success",
+    httpStatus: res.status,
+    latencyMs: Date.now() - start,
+    data: { ok: true, textLength: text.length, events: events.length },
+    errorMessage: null,
+  });
   return { text, events };
 }
 

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.15.1",
+  "version": "1.17.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {
     "test": "npm run test:agent-routing",
-    "test:agent-routing": "node scripts/verify-agent-routing.mjs"
+    "test:agent-routing": "node scripts/verify-agent-routing.mjs",
+    "verify:release": "npm test && npm pack --dry-run"
   },
   "bin": {
     "llama": "bin/llama.mjs",