@llamaventures/cli 1.16.0 → 1.17.1

package/lib/client.mjs

@@ -13,7 +13,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { execFile as _execFile } from "child_process";
 import { promisify } from "util";
-import { randomUUID } from "crypto";
+import { createHash, randomUUID } from "crypto";
 
 const execFile = promisify(_execFile);
 
@@ -217,23 +217,39 @@ function agentClientHeaders(command) {
 }
 
 const SECRET_KEY_RE = /(token|secret|password|authorization|cookie|api[_-]?key|keychain|jwt)/i;
+const CONTENT_PAYLOAD_KEY_RE = /(^|_)(html|body|content|markdown|message|text)$/i;
 
 function truncateText(text, max = 2000) {
   return text.length > max ? `${text.slice(0, max)}...[truncated]` : text;
 }
 
-function sanitizeTelemetryValue(value, depth = 0) {
+function summarizePayloadText(value) {
+  const text = String(value ?? "");
+  return {
+    redacted: true,
+    type: "text_payload",
+    chars: text.length,
+    bytes: Buffer.byteLength(text, "utf8"),
+    sha256: createHash("sha256").update(text).digest("hex"),
+  };
+}
+
+function sanitizeTelemetryValue(value, depth = 0, keyHint = "") {
   if (depth > 4) return "[max-depth]";
   if (value === null || value === undefined) return value;
-  if (typeof value === "string") return truncateText(value);
+  if (typeof value === "string") {
+    return CONTENT_PAYLOAD_KEY_RE.test(keyHint)
+      ? summarizePayloadText(value)
+      : truncateText(value);
+  }
   if (typeof value === "number" || typeof value === "boolean") return value;
   if (Array.isArray(value)) {
-    return value.slice(0, 20).map((item) => sanitizeTelemetryValue(item, depth + 1));
+    return value.slice(0, 20).map((item) => sanitizeTelemetryValue(item, depth + 1, keyHint));
   }
   if (typeof value === "object") {
     const out = {};
     for (const [key, val] of Object.entries(value).slice(0, 40)) {
-      out[key] = SECRET_KEY_RE.test(key) ? "[redacted]" : sanitizeTelemetryValue(val, depth + 1);
+      out[key] = SECRET_KEY_RE.test(key) ? "[redacted]" : sanitizeTelemetryValue(val, depth + 1, key);
     }
     return out;
   }
@@ -494,15 +510,15 @@ function unauthorizedError() {
   );
 }
 
-export async function request(method, endpoint, body) {
-  return requestWithRetry(method, endpoint, body, /* allowRetry */ true);
+export async function request(method, endpoint, body, opts = {}) {
+  return requestWithRetry(method, endpoint, body, opts, /* allowRetry */ true);
 }
 
 export async function requestSse(method, endpoint, body, opts = {}) {
   return requestSseWithRetry(method, endpoint, body, opts, /* allowRetry */ true);
 }
 
-async function requestWithRetry(method, endpoint, body, allowRetry) {
+async function requestWithRetry(method, endpoint, body, opts, allowRetry) {
   const authHeaders = await getAuthHeaders();
   if (Object.keys(authHeaders).length === 0) throw noAuthError();
   const command = inferCommand(method, endpoint);
@@ -513,6 +529,7 @@ async function requestWithRetry(method, endpoint, body, allowRetry) {
       "Content-Type": "application/json",
       ...agentClientHeaders(command),
       ...authHeaders,
+      ...(opts.headers || {}),
     },
     body: body === undefined ? undefined : JSON.stringify(body),
   });
@@ -532,7 +549,7 @@ async function requestWithRetry(method, endpoint, body, allowRetry) {
       refreshed = null;
     }
     if (refreshed) {
-      return requestWithRetry(method, endpoint, body, /* allowRetry */ false);
+      return requestWithRetry(method, endpoint, body, opts, /* allowRetry */ false);
     }
     throw unauthorizedError();
   }

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.16.0",
+  "version": "1.17.1",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {
     "test": "npm run test:agent-routing",
-    "test:agent-routing": "node scripts/verify-agent-routing.mjs"
+    "test:agent-routing": "node scripts/verify-agent-routing.mjs",
+    "verify:release": "npm test && npm pack --dry-run"
   },
   "bin": {
     "llama": "bin/llama.mjs",

package/scripts/verify-agent-routing.mjs

@@ -2,14 +2,21 @@
 
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { createServer } from "node:http";
-import { existsSync } from "node:fs";
-import { mkdtemp, rm } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const packageJson = JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8"));
+assert.equal(
+  packageJson.scripts?.["verify:release"],
+  "npm test && npm pack --dry-run",
+  "CLI release gate must run agent routing tests and npm pack dry-run",
+);
 assert.equal(
   existsSync(path.join(repoRoot, "docs/agent-skills.bundle.json")),
   false,
@@ -20,9 +27,30 @@ assert.equal(
   false,
   "public llama-cli must not copy the Command-side skill mirror",
 );
+const cliSource = readFileSync(path.join(repoRoot, "bin/llama.mjs"), "utf8");
+assert.match(
+  cliSource,
+  /About ONE specific deal\? \.{8} llama html publish <deal-id-or-name> --file <path> --title "\.\.\."/,
+  "top-level help must route deal-specific HTML to the agent-safe publish path",
+);
+assert.doesNotMatch(
+  cliSource,
+  /For deal-specific HTML use "llama html upload <dealId>"/,
+  "wiki help must not route deal-specific HTML to the low-level upload path",
+);
 const calls = [];
 let threadSeq = 0;
 let eventSeq = 0;
+const htmlDocs = new Map();
+
+function sha256Hex(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function docsForDeal(dealId) {
+  if (!htmlDocs.has(dealId)) htmlDocs.set(dealId, new Map());
+  return htmlDocs.get(dealId);
+}
 
 async function readJson(req) {
   let raw = "";
@@ -72,6 +100,7 @@ const server = createServer(async (req, res) => {
         agentClient: req.headers["x-llama-agent-client"] ?? null,
         session: req.headers["x-llama-agent-session"] ?? null,
         command: req.headers["x-llama-command"] ?? null,
+        uploadId: req.headers["x-llama-upload-id"] ?? null,
       },
     });
 
@@ -198,6 +227,104 @@ const server = createServer(async (req, res) => {
       return;
     }
 
+    if (req.method === "GET" && url.pathname === "/api/deals") {
+      writeJson(res, {
+        deals: [
+          {
+            uuid: "deal-html",
+            companyName: "Acme AI",
+            founders: "Ada Founder",
+            description: "mock deal for HTML upload tests",
+          },
+        ],
+        total: 1,
+        limit: Number(url.searchParams.get("limit") || 200),
+        offset: 0,
+      });
+      return;
+    }
+
+    const docsMatch = url.pathname.match(/^\/api\/deals\/([^/]+)\/documents$/);
+    if (docsMatch) {
+      const dealId = decodeURIComponent(docsMatch[1]);
+      if (dealId !== "deal-html") {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "deal not found" }));
+        return;
+      }
+      if (req.method === "GET") {
+        const docs = Array.from(docsForDeal(dealId).entries()).map(([slug, doc]) => ({
+          slug,
+          title: doc.title,
+          latest_version: doc.version ?? null,
+          latest_updated_at: doc.version ? "2026-06-23T04:00:00Z" : null,
+        }));
+        writeJson(res, { documents: docs });
+        return;
+      }
+      if (req.method === "POST") {
+        const docs = docsForDeal(dealId);
+        const slug = body?.slug;
+        docs.set(slug, {
+          ...(docs.get(slug) || {}),
+          title: body?.title || slug,
+        });
+        writeJson(res, { ok: true, slug, title: body?.title || slug });
+        return;
+      }
+    }
+
+    const htmlMatch = url.pathname.match(/^\/api\/deals\/([^/]+)\/documents\/([^/]+)\/html$/);
+    if (htmlMatch) {
+      const dealId = decodeURIComponent(htmlMatch[1]);
+      const slug = decodeURIComponent(htmlMatch[2]);
+      const docs = docsForDeal(dealId);
+      if (req.method === "PUT") {
+        const html = typeof body?.html === "string" ? body.html : "";
+        const previous = docs.get(slug) || { title: slug, version: 0 };
+        const version = Number(previous.version || 0) + 1;
+        const bytes = Buffer.byteLength(html, "utf8");
+        const sha256 = sha256Hex(html);
+        docs.set(slug, {
+          ...previous,
+          html,
+          version,
+          bytes,
+          sha256,
+          source: body?.source || "cli",
+          client_upload_id: body?.client_upload_id || null,
+        });
+        writeJson(res, {
+          ok: true,
+          document_slug: slug,
+          version,
+          bytes,
+          sha256,
+          client_upload_id: body?.client_upload_id || null,
+          idempotent_replay: false,
+        });
+        return;
+      }
+      if (req.method === "GET") {
+        const doc = docs.get(slug);
+        if (!doc?.html) {
+          writeJson(res, { empty: true });
+          return;
+        }
+        writeJson(res, {
+          empty: false,
+          document_slug: slug,
+          version: doc.version,
+          bytes: doc.bytes,
+          sha256: doc.sha256,
+          source: doc.source,
+          created_at: "2026-06-23T04:00:00Z",
+          html: doc.html,
+        });
+        return;
+      }
+    }
+
     if (req.method === "POST" && /^\/api\/deals\/[^/]+\/threads$/.test(url.pathname)) {
       threadSeq += 1;
       writeJson(res, { id: `thread-${threadSeq}` });
@@ -495,6 +622,68 @@ try {
     messageIncludes: ["custom server task"],
   });
 
+  const largeHtmlPath = path.join(homeDir, "full-memo.html");
+  const largeHtml =
+    "<!doctype html><html><head><title>Full Memo</title></head><body>" +
+    `<p>${"agent-safe upload ".repeat(18000)}</p>` +
+    "</body></html>";
+  assert.ok(
+    Buffer.byteLength(largeHtml, "utf8") > 252 * 1024,
+    "routing test HTML must exceed the incident-sized 252KB memo",
+  );
+  await writeFile(largeHtmlPath, largeHtml);
+
+  resetCalls();
+  const publishRun = await runCli(
+    [
+      "html",
+      "publish",
+      "Acme AI",
+      "--file",
+      largeHtmlPath,
+      "--title",
+      "Full Memo",
+      "--doc",
+      "full-memo",
+    ],
+    baseUrl,
+    homeDir,
+  );
+  const publishPayload = JSON.parse(publishRun.stdout);
+  assert.equal(publishPayload.ok, true);
+  assert.equal(publishPayload.deal_uuid, "deal-html");
+  assert.equal(publishPayload.document_slug, "full-memo");
+  assert.equal(publishPayload.verified?.ok, true);
+  assert.match(publishPayload.client_upload_id, /^cli-[0-9a-f-]{36}$/);
+  assert.match(publishPayload.sha256, /^[a-f0-9]{64}$/);
+  assert.equal(publishPayload.verified?.sha256, publishPayload.sha256);
+  assert.deepEqual(paths(), [
+    "GET /api/deals/Acme%20AI/documents",
+    "GET /api/deals",
+    "GET /api/deals/deal-html/documents",
+    "POST /api/deals/deal-html/documents",
+    "PUT /api/deals/deal-html/documents/full-memo/html",
+    "GET /api/deals/deal-html/documents/full-memo/html",
+  ]);
+  assert.equal(businessCalls()[4].body?.html, largeHtml);
+  assert.equal(businessCalls()[4].body?.source, "cli");
+  assert.equal(businessCalls()[4].body?.client_upload_id, publishPayload.client_upload_id);
+  assert.equal(businessCalls()[4].headers.uploadId, publishPayload.client_upload_id);
+  const publishTelemetry = telemetryCalls().find(
+    (call) =>
+      call.body?.method === "PUT" &&
+      call.body?.endpoint === "/api/deals/deal-html/documents/full-memo/html",
+  );
+  assert.ok(publishTelemetry, "publish upload request must record telemetry");
+  assert.equal(publishTelemetry.body?.args?.html?.redacted, true);
+  assert.equal(publishTelemetry.body?.args?.html?.bytes, Buffer.byteLength(largeHtml, "utf8"));
+  assert.equal(publishTelemetry.body?.args?.html?.sha256, sha256Hex(largeHtml));
+  assert.doesNotMatch(
+    JSON.stringify(telemetryCalls()),
+    /agent-safe upload agent-safe upload agent-safe upload/,
+    "telemetry must not contain raw memo HTML text",
+  );
+
   resetCalls();
   const mcpResult = await callMcpTool(
     "deal_enrich",
@@ -518,6 +707,75 @@ try {
   assert.equal(payload.threadId, "thread-1");
   assert.equal(payload.text, "agent done");
 
+  resetCalls();
+  const inlineGuard = await callMcpTool(
+    "html_upload",
+    {
+      dealId: "deal-html",
+      documentSlug: "inline-too-large",
+      html: largeHtml,
+    },
+    baseUrl,
+    homeDir,
+  );
+  assert.equal(inlineGuard.isError, true);
+  assert.match(inlineGuard.content?.[0]?.text ?? "", /Use html_upload_file/);
+  assert.deepEqual(paths(), []);
+
+  resetCalls();
+  const inlineBundleGuard = await callMcpTool(
+    "html_upload_bundle",
+    {
+      dealId: "deal-html",
+      documentSlug: "bundle-too-large",
+      html: largeHtml,
+      assets: [
+        {
+          path: "full-memo_files/cover.txt",
+          contentType: "text/plain",
+          base64: Buffer.from("asset").toString("base64"),
+        },
+      ],
+    },
+    baseUrl,
+    homeDir,
+  );
+  assert.equal(inlineBundleGuard.isError, true);
+  assert.match(inlineBundleGuard.content?.[0]?.text ?? "", /Use html_upload_file/);
+  assert.deepEqual(paths(), []);
+
+  resetCalls();
+  const mcpFile = await callMcpTool(
+    "html_upload_file",
+    {
+      dealId: "deal-html",
+      documentSlug: "mcp-file",
+      filePath: largeHtmlPath,
+    },
+    baseUrl,
+    homeDir,
+  );
+  const mcpFilePayload = JSON.parse(mcpFile.content?.[0]?.text ?? "{}");
+  assert.equal(mcpFilePayload.ok, true);
+  assert.equal(mcpFilePayload.verified?.ok, true);
+  assert.match(mcpFilePayload.client_upload_id, /^mcp-[0-9a-f-]{36}$/);
+  assert.match(mcpFilePayload.sha256, /^[a-f0-9]{64}$/);
+  assert.equal(mcpFilePayload.verified?.sha256, mcpFilePayload.sha256);
+  assert.deepEqual(paths(), [
+    "PUT /api/deals/deal-html/documents/mcp-file/html",
+    "GET /api/deals/deal-html/documents/mcp-file/html",
+  ]);
+  assert.equal(businessCalls()[0].body?.client_upload_id, mcpFilePayload.client_upload_id);
+  assert.equal(businessCalls()[0].headers.uploadId, mcpFilePayload.client_upload_id);
+  const mcpFileTelemetry = telemetryCalls().find(
+    (call) =>
+      call.body?.method === "PUT" &&
+      call.body?.endpoint === "/api/deals/deal-html/documents/mcp-file/html",
+  );
+  assert.ok(mcpFileTelemetry, "MCP file upload request must record telemetry");
+  assert.equal(mcpFileTelemetry.body?.args?.html?.redacted, true);
+  assert.equal(mcpFileTelemetry.body?.args?.html?.sha256, sha256Hex(largeHtml));
+
   resetCalls();
   const mcpBootstrap = await callMcpTool("agent_bootstrap", { limit: 2 }, baseUrl, homeDir);
   const bootstrapPayload = JSON.parse(mcpBootstrap.content?.[0]?.text ?? "{}");