npm - @llamaventures/cli - Versions diffs - 1.17.2 → 1.17.3 - Mend

@llamaventures/cli 1.17.2 → 1.17.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/CHANGELOG.md +12 -0
package/README.md +103 -375
package/README.zh-CN.md +105 -339
package/package.json +1 -5
package/CONTRIBUTING.md +0 -100
package/SECURITY.md +0 -62
package/assets/llama-ventures-logo.svg +0 -25
package/scripts/verify-agent-routing.mjs +0 -816

package/CONTRIBUTING.md DELETED Viewed

@@ -1,100 +0,0 @@
-# Contributing
-Thanks for looking. This is an **internal tool** maintained by Llama Ventures
-team members. Patches from teammates are welcome; outside contributions are
-best limited to documentation fixes and broken-flow reports.
-## Local dev loop
-```bash
-git clone https://github.com/Llama-Ventures/llama-cli.git
-cd llama-cli
-npm ci
-node bin/llama.mjs --help        # CLI is ESM, runs straight from source
-node --check bin/llama.mjs        # syntax check
-node --check bin/llama-mcp.mjs    # syntax check
-npm test                          # mock-backed CLI/MCP agent routing checks
-```
-To test the CLI end-to-end against your own credentials, point it at the
-in-source binary instead of the globally installed one:
-```bash
-alias llama-dev="node $(pwd)/bin/llama.mjs"
-llama-dev auth status
-```
-To smoke-test the MCP server (no client needed):
-```bash
-printf '%s\n' \
-  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"dev","version":"1"}}}' \
-  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
-  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
-  | node bin/llama-mcp.mjs | head -200
-```
-You should see 52 named tools, including `deal_agent_run`, `deal_enrich`, the
-5 `pitch_*`, and no generic API passthrough tool.
-## Conventions
-- **Zero deps for the CLI.** `bin/llama.mjs` and `lib/client.mjs` use only Node
-  stdlib + native `fetch`. The MCP server may pull in
-  `@modelcontextprotocol/sdk`; nothing else.
-- **One auth chain, one HTTP client.** Anything new that talks to
-  `command.llamaventures.vc` goes through `lib/client.mjs::request()`. Don't
-  spawn a parallel auth path; if you need a new credential type, add it to the
-  chain there.
-- **Stable `Error[…]` prefixes.** `Error[NO_AUTH]` and `Error[UNAUTHORIZED]`
-  are part of the public contract — agents pattern-match on them. New error
-  classes need a new prefix; renaming an existing one is a major version bump.
-- **CLI and MCP stay in lockstep.** Adding a new CLI command? Add the matching
-  MCP tool in the same PR. The MCP server exposes only named, typed tools — no
-  generic API passthrough — so every server endpoint that needs agent access
-  gets its own typed wrapper.
-- **No bundler, no build step.** The CLI ships as `.mjs` files that npm copies
-  verbatim. `package.json::files` is the allowlist; CI re-verifies the tarball
-  contents on every PR.
-- **`AGENT_BRIEFING.md` is content, not chrome.** It's the behavioural contract
-  for AI agents loading the package — terse, action-oriented, no fluff.
-  Changes to it are reviewed for substance, not formatting.
-## Submitting changes
-1. Branch off `main`. Branch names are casual; prefer `<type>/<short-slug>`
-   (e.g. `feat/pitch-rate-limit-message`, `fix/agent-onboard-redaction`).
-2. Run the smoke commands above. CI on PR runs the same matrix on Node
-   18/20/22 plus a tarball-contents allowlist check.
-3. Open a PR. One commit per logical change is preferred but not enforced.
-4. Update [`CHANGELOG.md`](CHANGELOG.md) under `[Unreleased]` if the change
-   affects users (CLI / MCP surface, error format, auth, install).
-## Releasing
-Releases are cut from `main` via a GitHub Release. The
-`.github/workflows/publish.yml` workflow then publishes to npm via
-[Trusted Publishers](https://docs.npmjs.com/trusted-publishers) — no
-`NPM_TOKEN` exists in repo secrets.
-To cut a release:
-```bash
-# 1. Bump version + move CHANGELOG entries from [Unreleased] to the new tag
-npm version <patch|minor|major>     # commits + tags
-git push origin main --tags
-# 2. Open https://github.com/Llama-Ventures/llama-cli/releases/new
-#    Choose the tag, paste the CHANGELOG section, click "Publish release"
-#    → publish.yml fires, OIDC handshake → npm publish --provenance --access public
-```
-The publish workflow asserts that `package.json::version` matches the release
-tag (modulo a leading `v`). If they disagree, it fails fast — fix the
-mismatch and re-cut the release.
-## Security
-Don't file public issues for security bugs. Email
-[gavin@llamaventures.vc](mailto:gavin@llamaventures.vc). Full policy:
-[`SECURITY.md`](SECURITY.md).

package/SECURITY.md DELETED Viewed

@@ -1,62 +0,0 @@
-# Security Policy
-## Reporting security issues
-**Do not file public GitHub issues for security bugs.** A public issue
-gives an attacker a head-start before we can patch.
-Instead, email [**gavin@llamaventures.vc**](mailto:gavin@llamaventures.vc)
-with:
-- A short description of the issue
-- Steps to reproduce
-- Expected vs. actual behavior
-- The CLI version (`npm ls -g @llamaventures/cli`)
-- Any other context that helps us reproduce
-We aim to acknowledge within ~5 push cycles (best effort), patch
-promptly, and credit the reporter (if desired) once the fix ships.
-We do not run a public bug bounty program.
-## Scope
-In scope:
-- Authentication / authorization bypass in the CLI client
-- Token handling vulnerabilities (logging, transmission, storage)
-- Supply-chain attacks against the npm package or its dependencies
-- Anything that lets an unauthorized party execute Llama Command
-  operations as another team member
-Out of scope (still report; lower urgency):
-- Bugs in third-party services we depend on (Google Cloud, npm,
-  Anthropic, etc.)
-- Issues only reproducible against a fork or a modified version of
-  this CLI
-Server-side bugs (`command.llamaventures.vc`) are governed separately;
-report through the same channel.
-## Supply-chain posture
-This package follows current best practice:
-- **`@llamaventures/cli` is published via npm
-  [Trusted Publishers](https://docs.npmjs.com/trusted-publishers)** —
-  no `NPM_TOKEN` is stored in CI secrets; the GitHub Action exchanges
-  an OIDC token at publish time.
-- **All releases ship with `--provenance`** (sigstore-signed). The
-  npm registry shows a "Provenance" badge on each version, traceable
-  to the exact commit + GitHub Action workflow that built it.
-- **Minimal dependency tree.** The CLI itself is zero-deps; the
-  bundled MCP server depends only on
-  `@modelcontextprotocol/sdk` (Anthropic-maintained, pinned exact).
-- **Branch protection** on `main` prevents force-push and deletion;
-  Dependabot, secret scanning, and push-protection are enabled.
-## Disclosure
-We coordinate disclosure when a fix lands. Once a patched version
-ships, we publish a security advisory on this repo and notify
-affected users via the team's internal channels.

package/assets/llama-ventures-logo.svg DELETED Viewed

@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 224 76.32">
-  <g>
-    <g>
-      <path d="M69.84,26.89h7.64v4.53h-13.48V7.33h5.84v19.56Z"/>
-      <path d="M86.13,7.33v24.04h-5.7V7.33h5.7Z"/>
-      <path d="M90.96,16.53c.74-1.5,1.76-2.65,3.04-3.45,1.28-.81,2.72-1.21,4.3-1.21,1.35,0,2.54.28,3.56.83s1.81,1.28,2.36,2.17v-2.73h5.88v19.26h-5.88v-2.73c-.57.9-1.37,1.62-2.39,2.17-1.02.55-2.21.83-3.56.83-1.56,0-2.98-.41-4.27-1.22-1.29-.82-2.3-1.98-3.04-3.49-.75-1.51-1.12-3.25-1.12-5.23s.37-3.72,1.12-5.21ZM103,18.29c-.81-.85-1.81-1.28-2.97-1.28s-2.16.42-2.98,1.26c-.81.84-1.22,2-1.22,3.47s.41,2.64,1.22,3.51c.81.86,1.81,1.29,2.98,1.29s2.16-.42,2.97-1.28c.81-.85,1.22-2.01,1.22-3.49s-.41-2.64-1.22-3.49Z"/>
-      <path d="M143.78,14.24c1.4,1.44,2.1,3.44,2.1,6v11.18h-5.82v-10.39c0-1.24-.32-2.19-.97-2.86-.65-.68-1.54-1.01-2.68-1.01s-2.04.34-2.68,1.01c-.65.67-.97,1.63-.97,2.86v10.39h-5.82v-10.39c0-1.24-.32-2.19-.97-2.86-.65-.68-1.54-1.01-2.68-1.01s-2.03.34-2.68,1.01c-.65.67-.98,1.63-.98,2.86v10.39h-5.85V12.28h5.85v2.4c.59-.8,1.37-1.43,2.33-1.9.96-.47,2.04-.7,3.25-.7,1.44,0,2.72.31,3.85.92,1.13.62,2.01,1.5,2.65,2.64.66-1.05,1.56-1.91,2.7-2.57,1.14-.66,2.38-.99,3.72-.99,2.37,0,4.26.72,5.66,2.16Z"/>
-      <path d="M149.87,16.6c.74-1.49,1.75-2.63,3.03-3.44s2.71-1.2,4.28-1.2c1.35,0,2.53.27,3.55.82,1.01.55,1.8,1.27,2.34,2.16v-2.72h5.86v19.17h-5.86v-2.72c-.57.89-1.36,1.62-2.38,2.16-1.01.55-2.2.82-3.54.82-1.56,0-2.97-.41-4.25-1.22s-2.29-1.97-3.03-3.47c-.74-1.5-1.11-3.24-1.11-5.21s.37-3.7,1.11-5.19ZM161.86,18.36c-.81-.85-1.8-1.27-2.96-1.27s-2.15.42-2.96,1.25c-.81.84-1.22,1.99-1.22,3.45s.41,2.63,1.22,3.49c.81.86,1.8,1.29,2.96,1.29s2.15-.42,2.96-1.27,1.22-2,1.22-3.47-.4-2.62-1.22-3.47Z"/>
-    </g>
-    <g>
-      <path d="M88.31,42.57l-8.62,24.05-7.19-.14-8.5-23.91h6.3l5.57,17.41,6.27-17.41h6.17Z"/>
-      <path d="M106.78,57.98l-13.12.07c.09,1.16.46,2.04,1.12,2.65.66.61,1.46.92,2.42.92,1.42,0,2.41-.6,2.97-1.8h6.17c-.31,1.21-.86,2.45-1.67,3.42-.81.98-1.87,1.77-3.09,2.33s-2.73.9-4.24.9c-1.82,0-3.79-.59-5.21-1.37-1.42-.78-2.42-2.01-3.22-3.45-.8-1.44-1.2-3.11-1.2-5.04s.58-4,1.37-5.45c.79-1.45,2.09-2.48,3.51-3.26,1.42-.78,3.21-1.15,5.06-1.15s3.43.55,4.83,1.31c1.4.75,2.56,2.1,3.35,3.5s1.07,2.89,1.07,4.76c0,.53-.03,1.09-.1,1.67ZM100.83,54.89c0-.98-.33-1.76-1-2.33-.67-.58-1.5-.87-2.5-.87s-1.76.28-2.42.84c-.66.56-1.06,1.34-1.22,2.37h7.13Z"/>
-      <path d="M126.7,49.22c1.3,1.41,2.3,3.49,2.3,5.96v11.44h-5.78s-.04-10.69-.04-10.69c0-1.25-.49-2.07-1.13-2.76-.65-.69-1.54-1.06-2.81-1-1.09.05-1.89.57-2.54,1.26s-.91,1.61-.91,2.86v10.32h-5.79v-19.13h5.79v2.47c.58-.82,1.17-1.47,2.15-1.95.98-.48,2.08-.72,3.3-.72,2.18,0,4.17.53,5.47,1.94Z"/>
-      <path d="M143.61,61.6v5.02h-2.9c-2.06,0-4.1-.8-5.25-1.81-1.16-1.01-1.43-3.02-1.43-5.31v-7.1s-2.39,0-2.39,0v-4.91h2.39v-4.66s5.79,0,5.79,0v4.66h3.79v4.91h-3.78v7.2c0,.56.15,1.41.41,1.65.27.24.71.37,1.33.37h2.03Z"/>
-      <path d="M165.77,47.34v19.01h-5.79l-.03-2.74c-.58.82-1.77,1.75-2.76,2.25-.99.5-2.08.75-3.28.75-1.42,0-2.68-.32-3.77-.95-1.09-.63-1.88-2.02-2.48-3.21-.6-1.2-.9-2.61-.9-4.24v-10.87h5.67v10.1c0,1.24.32,2.21.97,2.9.64.69,1.51,1.03,2.6,1.03s1.99-.34,2.63-1.03c.64-.69.97-1.66.97-2.9v-10.1h6.17Z"/>
-      <path d="M178.26,48.17c1-.59,2.41-.82,3.64-.82v6.17h-1.85c-1.42,0-2.38.33-3.09.94-.71.61-1.11,1.55-1.11,3.09v9.06h-5.79v-19.13h5.7v3.1c.67-1.02,1.5-1.83,2.5-2.42Z"/>
-      <path d="M202.59,58.03h-13.25c.09,1.19.47,2.09,1.15,2.71.67.63,1.5.94,2.48.94,1.46,0,2.47-.61,3.05-1.84h6.23c-.32,1.25-.9,2.38-1.73,3.38-.83,1-1.88,1.79-3.13,2.36-1.26.57-2.66.85-4.21.85-1.87,0-3.54-.4-5-1.19-1.46-.79-2.6-1.93-3.42-3.41-.82-1.48-1.23-3.21-1.23-5.19s.4-3.71,1.21-5.19c.81-1.48,1.95-2.62,3.41-3.41,1.46-.8,3.14-1.19,5.03-1.19s3.49.39,4.93,1.16c1.44.77,2.56,1.88,3.37,3.31s1.21,3.11,1.21,5.02c0,.55-.03,1.12-.1,1.71ZM196.7,54.79c0-1-.34-1.8-1.03-2.39-.68-.59-1.54-.89-2.57-.89s-1.81.29-2.48.86c-.67.57-1.09,1.37-1.25,2.42h7.33Z"/>
-      <path d="M106.77,58.03h-13.25c.09,1.19.47,2.09,1.15,2.71.67.63,1.5.94,2.48.94,1.46,0,2.47-.61,3.05-1.84h6.23c-.32,1.25-.9,2.38-1.73,3.38-.83,1-1.88,1.79-3.13,2.36-1.26.57-2.66.85-4.21.85-1.87,0-3.54-.4-5-1.19-1.46-.79-2.6-1.93-3.42-3.41-.82-1.48-1.23-3.21-1.23-5.19s.4-3.71,1.21-5.19c.81-1.48,1.95-2.62,3.41-3.41,1.46-.8,3.14-1.19,5.03-1.19s3.49.39,4.93,1.16c1.44.77,2.56,1.88,3.37,3.31s1.21,3.11,1.21,5.02c0,.55-.03,1.12-.1,1.71ZM100.88,54.79c0-1-.34-1.8-1.03-2.39-.68-.59-1.54-.89-2.57-.89s-1.81.29-2.48.86c-.67.57-1.09,1.37-1.25,2.42h7.33Z"/>
-      <path d="M209.1,65.57c-1.28-.57-2.29-1.35-3.03-2.35-.74-.99-1.15-2.11-1.24-3.34h5.68c.07.66.37,1.2.91,1.61.54.41,1.2.62,1.98.62.72,0,1.27-.14,1.66-.43.39-.28.59-.66.59-1.11,0-.55-.28-.95-.84-1.22-.56-.26-1.47-.56-2.72-.88-1.34-.32-2.47-.66-3.36-1.01-.9-.35-1.67-.92-2.32-1.68-.65-.76-.98-1.8-.98-3.1,0-1.1.3-2.1.89-3,.59-.9,1.47-1.62,2.62-2.14,1.15-.53,2.53-.79,4.12-.79,2.35,0,4.21.59,5.56,1.78,1.36,1.19,2.14,2.77,2.34,4.73h-5.31c-.09-.66-.37-1.19-.86-1.58-.48-.39-1.12-.58-1.9-.58-.67,0-1.19.13-1.55.39s-.54.62-.54,1.08c0,.55.29.96.86,1.23.57.28,1.46.55,2.67.82,1.39.37,2.52.73,3.4,1.08.87.35,1.64.93,2.3,1.72.66.79,1,1.84,1.02,3.17,0,1.12-.31,2.12-.92,3-.62.88-1.5,1.57-2.65,2.07-1.15.5-2.5.75-4.02.75-1.64,0-3.09-.28-4.37-.86Z"/>
-    </g>
-  </g>
-  <path d="M48.7,50.5c3.49.32,6.76,2.94,8.15,6.08,3.09,6.98-1.33,14.02-8.65,15.07-9.08-.47-18.69.74-27.71.12-6.65-.46-10.81-5.53-10.25-12.13l6.28-25.63c-2.05-.02-4.19-.55-6.11-1.26-2.04-.75-4.19-1.79-5.33-3.74-3.04-5.19,1.25-9.8,5.21-12.75-1.81-4.39,2.75-6.87,6.59-6.06.9-3.1,4.51-4.16,7.01-2.12.61.5,1.37,2.23,2.32,1.05.83-1.03,1.11-3.35,1.02-4.64-.06-.81-.79-2.28.57-2.34.91-.04,2.41,1.95,2.85,2.69,1.48,2.49,1.77,5.72.61,8.39,2.83-.4,5.16-1.93,6.73-4.29.48-.72.81-2.17,1.87-1.85.59.18.96,2.01,1.06,2.59.65,3.9-1.25,7.48-4.51,9.55.65,2.66,1.28,5.32,1.63,8.05.99,7.74.41,15.67-1.62,23.2h12.28v.02ZM26.67,18.33c-4.94-4.2-11.7-1.55-15.83,2.4-.27.26-1.14,1.11-1.26,1.39-.09.21.08.17.16.21.66.39,1.73.61,2.01,1.39.47,1.33-.45,2.61-1.85,2.49-.42-.04-1.91-.89-2.08-.76.18,1.93,1.71,2.95,3.37,3.62,3.11,1.24,6.67,1.29,9.98,1.09l.26.14-3.65,14.92c10.85-2.11,18.01-19.14,8.89-26.88h0Z"/>
-  <path d="M23.15,21.22c1.95,1.35-.13,4.72-2.34,3.28s-.04-4.95,2.34-3.28Z"/>
-</svg>