@llamaventures/cli 1.23.1 → 1.25.0

package/CHANGELOG.md

@@ -6,6 +6,18 @@ this project adheres to [Semantic Versioning](https://semver.org).
 
 ## [Unreleased]
 
+## [1.25.0] - 2026-08-05
+
+### Added
+- Add preview-first, revision-fenced `llama admin workflow remediate` for the
+  two allowlisted Workflow V2 false-green intake checks in Llama Command 3.26.0.
+
+## [1.24.0] - 2026-08-05
+
+### Added
+- Add `llama admin workflow audit --deal <uuid> | --all` for the read-only
+  Workflow V2 production integrity auditor in Llama Command 3.25.0.
+
 ## [1.23.1] - 2026-08-05
 
 ### Added

package/README.md

@@ -113,6 +113,26 @@ llama mentions
 llama agent-onboard                    # server-owned agent workflow contract
 ```
 
+System admins can run the read-only production integrity auditor against one
+Workflow V2 deal or every persisted V2 snapshot:
+
+```bash
+llama admin workflow audit --deal <dealId>
+llama admin workflow audit --all
+```
+
+For the two supported false-green intake checks, remediation is preview-first
+and one deal at a time. Apply requires the exact revision returned by preview:
+
+```bash
+llama admin workflow remediate --deal <dealId> --guard intake.reason_why
+llama admin workflow remediate --deal <dealId> --guard intake.reason_why \
+  --apply --expected-revision <revision> --reason "Confirmed missing canonical evidence"
+```
+
+The server can only invalidate a system-generated green. It cannot advance a
+deal, satisfy a check, change status/ownership, or override a human resolution.
+
 Status vocabulary — `Interested`: tracked before any contact ·
 `Outreached`: contacted, no response yet · `Sourced`: real relationship
 signal exists. `sourceDirection` is separate: `Inbound` came to the firm,

package/README.zh-CN.md

@@ -135,6 +135,25 @@ llama mentions
 llama agent-onboard                    # 服务端下发的 agent 工作契约
 ```
 
+系统管理员可以只读审计一个 Workflow V2 deal，或审计全部已持久化的 V2 快照：
+
+```bash
+llama admin workflow audit --deal <dealId>
+llama admin workflow audit --all
+```
+
+对当前支持的两个 intake 假绿检查，修复必须先 preview，并且一次只处理一个 deal。
+Apply 必须携带 preview 返回的精确 revision：
+
+```bash
+llama admin workflow remediate --deal <dealId> --guard intake.reason_why
+llama admin workflow remediate --deal <dealId> --guard intake.reason_why \
+  --apply --expected-revision <revision> --reason "已确认 canonical 证据缺失"
+```
+
+服务端只能把系统生成的绿灯改回未满足；不能推进 deal、把检查改成已满足、修改
+status/owner，也不能覆盖人工 resolution。
+
 Status 语义——`Interested`：接触前先记录关注 · `Outreached`：已联系、
 尚无回应 · `Sourced`：已有真实关系信号。`sourceDirection` 是独立维度：
 `Inbound` 流入，`Outbound` 我们主动。

package/bin/llama.mjs

@@ -36,6 +36,11 @@ import { LLAMA_CLI_CLIENT_ID, pkceLoopbackFlow, revokeToken as revokeOAuthToken
 import { deleteBundle, detectBackend, readBundle, writeBundle } from "../lib/oauth-storage.mjs";
 import { maybeNudgeUpdate, getUpdateNudge } from "../lib/version-check.mjs";
 import { getBuildInfo } from "../lib/build-info.mjs";
+import { workflowAuditPath } from "../lib/workflow-audit.mjs";
+import {
+  WORKFLOW_REMEDIATION_PATH,
+  workflowRemediationBody,
+} from "../lib/workflow-remediation.mjs";
 
 const requireFromHere = createRequire(import.meta.url);
 const { version: PKG_VERSION } = requireFromHere("../package.json");
@@ -603,6 +608,9 @@ Deal page HTML (hand-authored sandboxed pages on /deals/<id>/browse/<slug>):
   update_deal_browse_html tool and the MCP html_upload_file tool.
 
 Admin (system admin only — server returns 403 for non-admin tokens):
+  llama admin workflow audit --deal <uuid> | --all
+  llama admin workflow remediate --deal <uuid> --guard intake.reason_why[,intake.founder_identity]
+                                [--apply --expected-revision <n> --reason "..."]
   llama admin auth-events  [--kind X] [--actor email] [--subject email] [--since 24h|7d|30d|<ISO>] [--limit 100]
   llama admin deal-events  [--kind X] [--actor email] [--deal <uuid>] [--since 24h] [--limit 100]
   llama admin agent-events [--kind tool_call|loop_stalled|max_turns_reached] [--agent-kind deal|secretary|main|inbox]
@@ -2403,12 +2411,37 @@ Routing — is this the right command?
   //   - agent-events : every AI tool call / loop_stalled / max_turns (AI ops)
   if (area === "admin") {
     const sub = action;
-    const valid = ["auth-events", "deal-events", "agent-events"];
+    const valid = ["workflow", "auth-events", "deal-events", "agent-events"];
     if (!valid.includes(sub)) {
       throw new Error(
         `Unknown admin sub-command "${sub || ""}". Use: ${valid.join(", ")}`
       );
     }
+    if (sub === "workflow") {
+      if (!["audit", "remediate"].includes(rest[0])) {
+        throw new Error("Usage: llama admin workflow audit|remediate ...");
+      }
+      if (rest[0] === "audit") {
+        const { flags } = parseFlags(rest.slice(1), ["deal", "all"]);
+        // @core-api-operation GET /api/admin/workflow-audit
+        print(await request("GET", workflowAuditPath(flags)));
+        return;
+      }
+      const { flags } = parseFlags(rest.slice(1), [
+        "deal",
+        "guard",
+        "apply",
+        "expected-revision",
+        "reason",
+      ]);
+      const body = workflowRemediationBody(
+        flags,
+        flags.apply === true ? `cli-workflow-remediation-${randomUUID()}` : undefined,
+      );
+      // @core-api-operation POST /api/admin/workflow-remediation
+      print(await request("POST", WORKFLOW_REMEDIATION_PATH, body));
+      return;
+    }
     const { flags } = parseFlags(rest);
     const params = new URLSearchParams();
     // Common filters across all three.

package/contracts/core-api.json

@@ -1,9 +1,9 @@
 {
   "format": "llama.core-api-contract.v1",
   "name": "llama-core-api",
-  "apiVersion": "3.23.0",
+  "apiVersion": "3.26.0",
   "openapiVersion": "3.0.3",
-  "sha256": "b959a28605693097ba8d8d9345729070d54fcce08f004abcfe9b8c2fd2dabc6d",
-  "pathCount": 233,
-  "operationCount": 304
+  "sha256": "1ab4db8774b6dc0d94d6d6b4dd79f8272c6a405a3474710ac4162cc8a0dc6981",
+  "pathCount": 236,
+  "operationCount": 307
 }

package/contracts/required-operations.json

@@ -14,6 +14,14 @@
       "method": "GET",
       "path": "/api/admin/deal-events"
     },
+    {
+      "method": "GET",
+      "path": "/api/admin/workflow-audit"
+    },
+    {
+      "method": "POST",
+      "path": "/api/admin/workflow-remediation"
+    },
     {
       "method": "GET",
       "path": "/api/agent/activity"

package/lib/build-manifest.json

@@ -1,15 +1,15 @@
 {
   "format": "llama.cli-build.v1",
   "packageName": "@llamaventures/cli",
-  "packageVersion": "1.23.1",
-  "sourceSha": "8d5824095c03137b224bdbff50bc6be144d37486",
+  "packageVersion": "1.25.0",
+  "sourceSha": "4b70d873886c521d02cc7c75659425ed6e2989f6",
   "sourceKind": "github",
   "sourceDirty": false,
   "coreApiContract": {
     "format": "llama.core-api-contract.v1",
     "name": "llama-core-api",
-    "apiVersion": "3.23.0",
+    "apiVersion": "3.26.0",
     "openapiVersion": "3.0.3",
-    "sha256": "b959a28605693097ba8d8d9345729070d54fcce08f004abcfe9b8c2fd2dabc6d"
+    "sha256": "1ab4db8774b6dc0d94d6d6b4dd79f8272c6a405a3474710ac4162cc8a0dc6981"
   }
 }

package/lib/workflow-audit.mjs

@@ -0,0 +1,13 @@
+export function workflowAuditPath(flags) {
+  const deal = typeof flags.deal === "string" && flags.deal.trim()
+    ? flags.deal.trim()
+    : null;
+  const all = flags.all === true;
+  if ((!deal && !all) || (deal && all)) {
+    throw new Error("Usage: llama admin workflow audit --deal <uuid> | --all");
+  }
+  const params = new URLSearchParams();
+  if (deal) params.set("deal", deal);
+  if (all) params.set("all", "true");
+  return `/api/admin/workflow-audit?${params.toString()}`;
+}

package/lib/workflow-remediation.mjs

@@ -0,0 +1,45 @@
+export const WORKFLOW_REMEDIATION_PATH = "/api/admin/workflow-remediation";
+export const WORKFLOW_REMEDIATION_GUARDS = [
+  "intake.founder_identity",
+  "intake.reason_why",
+];
+
+export function workflowRemediationBody(flags, requestId) {
+  const dealId = typeof flags.deal === "string" ? flags.deal.trim() : "";
+  const rawGuards = typeof flags.guard === "string" ? flags.guard : "";
+  const guardKeys = [...new Set(
+    rawGuards.split(",").map((value) => value.trim()).filter(Boolean),
+  )];
+  if (!dealId || guardKeys.length < 1 || guardKeys.length > 2 ||
+    guardKeys.some((key) => !WORKFLOW_REMEDIATION_GUARDS.includes(key))) {
+    throw new Error(
+      "Usage: llama admin workflow remediate --deal <uuid> " +
+      "--guard intake.reason_why[,intake.founder_identity] " +
+      "[--apply --expected-revision <n> --reason \"...\"]",
+    );
+  }
+
+  if (flags.apply !== true) {
+    if (flags["expected-revision"] !== undefined || flags.reason !== undefined) {
+      throw new Error("--expected-revision and --reason require --apply");
+    }
+    return { action: "preview", dealId, guardKeys };
+  }
+
+  const expectedRevision = Number(flags["expected-revision"]);
+  const reason = typeof flags.reason === "string" ? flags.reason.trim() : "";
+  if (!Number.isInteger(expectedRevision) || expectedRevision < 0 || !reason) {
+    throw new Error("--apply requires --expected-revision <n> from preview and --reason \"...\"");
+  }
+  if (typeof requestId !== "string" || !requestId) {
+    throw new Error("workflow remediation apply requires a request ID");
+  }
+  return {
+    action: "apply",
+    dealId,
+    guardKeys,
+    expectedRevision,
+    requestId,
+    reason,
+  };
+}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.23.1",
+  "version": "1.25.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {
     "test": "npm run test:agent-routing && npm run test:contract",
     "test:agent-routing": "node scripts/verify-agent-routing.mjs",
-    "test:contract": "node --test scripts/build-manifest.test.mjs scripts/core-api-call-sites.test.mjs scripts/investment-workflow-contract.test.mjs scripts/server-compatibility.test.mjs scripts/verify-core-api-contract.test.mjs && node scripts/verify-core-api-contract.mjs",
+    "test:contract": "node --test scripts/build-manifest.test.mjs scripts/core-api-call-sites.test.mjs scripts/investment-workflow-contract.test.mjs scripts/server-compatibility.test.mjs scripts/verify-core-api-contract.test.mjs scripts/workflow-audit.test.mjs scripts/workflow-remediation.test.mjs && node scripts/verify-core-api-contract.mjs",
     "verify:artifact": "node scripts/verify-release-artifact.mjs",
     "verify:release": "npm test && npm run verify:artifact && node scripts/verify-tarball-clean.mjs",
     "prepack": "node scripts/prepare-build-manifest.mjs",