@llamaventures/cli 1.25.0 → 2.0.0

package/contracts/core-api.json

@@ -1,9 +1,9 @@
 {
   "format": "llama.core-api-contract.v1",
   "name": "llama-core-api",
-  "apiVersion": "3.26.0",
+  "apiVersion": "4.0.0",
   "openapiVersion": "3.0.3",
-  "sha256": "1ab4db8774b6dc0d94d6d6b4dd79f8272c6a405a3474710ac4162cc8a0dc6981",
-  "pathCount": 236,
-  "operationCount": 307
+  "sha256": "69b5e29ae9585915da0fa9578abfd41099545f11eba8b2d12f14aa42cc970e4e",
+  "pathCount": 247,
+  "operationCount": 323
 }

package/contracts/required-operations.json

@@ -2,361 +2,32 @@
   "format": "llama.cli-core-api-operations.v1",
   "coreApiContract": "contracts/core-api.json",
   "requiredOperations": [
-    {
-      "method": "GET",
-      "path": "/api/admin/agent-events"
-    },
-    {
-      "method": "GET",
-      "path": "/api/admin/auth-events"
-    },
-    {
-      "method": "GET",
-      "path": "/api/admin/deal-events"
-    },
-    {
-      "method": "GET",
-      "path": "/api/admin/workflow-audit"
-    },
-    {
-      "method": "POST",
-      "path": "/api/admin/workflow-remediation"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/activity"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/briefing"
-    },
-    {
-      "method": "POST",
-      "path": "/api/agent/client-events"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/explain"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/manifest"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/preferences"
-    },
-    {
-      "method": "POST",
-      "path": "/api/agent/preferences"
-    },
-    {
-      "method": "PATCH",
-      "path": "/api/agent/preferences/{id}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/skills"
-    },
-    {
-      "method": "GET",
-      "path": "/api/agent/skills/{slug}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/create"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/deleted"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/update"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/workflow"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/workflow"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/agent-runs/{runId}/revert"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/blocks"
-    },
-    {
-      "method": "PUT",
-      "path": "/api/deals/{dealId}/blocks"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}/blocks/{blockId}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/blocks/{blockId}"
-    },
-    {
-      "method": "PATCH",
-      "path": "/api/deals/{dealId}/blocks/{blockId}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/blocks/{blockId}/history"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/blocks/{blockId}/history"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/blocks/{blockId}/restore"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/collaborators"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/collaborators"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}/collaborators/{userId}"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/collaborators/{userId}/restore"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/command-center"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/documents"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/documents"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}/documents/{slug}"
-    },
-    {
-      "method": "PATCH",
-      "path": "/api/deals/{dealId}/documents/{slug}"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}/documents/{slug}/html"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/documents/{slug}/html"
-    },
-    {
-      "method": "PUT",
-      "path": "/api/deals/{dealId}/documents/{slug}/html"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/documents/{slug}/html/history"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/documents/{slug}/html/restore/{version}"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/enrich"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/facts"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/facts"
-    },
-    {
-      "method": "PATCH",
-      "path": "/api/deals/{dealId}/facts/{factId}"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/facts/{factId}/uncontest"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/feed"
-    },
-    {
-      "method": "PUT",
-      "path": "/api/deals/{dealId}/founders"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/ingest"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/links"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/links"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}/links/{linkId}"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/links/{linkId}/restore"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/deals/{dealId}/memo"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/memo"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/memo"
-    },
-    {
-      "method": "PUT",
-      "path": "/api/deals/{dealId}/memo"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/posts"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/propose-owner"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/refresh-brief"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/restore"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/threads"
-    },
-    {
-      "method": "POST",
-      "path": "/api/deals/{dealId}/threads/{threadId}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/deals/{dealId}/timeline"
-    },
-    {
-      "method": "POST",
-      "path": "/api/external/chat"
-    },
-    {
-      "method": "POST",
-      "path": "/api/external/start-session"
-    },
-    {
-      "method": "POST",
-      "path": "/api/external/upload"
-    },
-    {
-      "method": "GET",
-      "path": "/api/me"
-    },
-    {
-      "method": "GET",
-      "path": "/api/me/nominations"
-    },
-    {
-      "method": "GET",
-      "path": "/api/mentions"
-    },
-    {
-      "method": "GET",
-      "path": "/api/mentions/unread-count"
-    },
-    {
-      "method": "POST",
-      "path": "/api/mentions/{id}/resolve"
-    },
-    {
-      "method": "POST",
-      "path": "/api/nominations/{approvalId}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/oauth/authorize"
-    },
-    {
-      "method": "POST",
-      "path": "/api/oauth/revoke"
-    },
-    {
-      "method": "POST",
-      "path": "/api/oauth/token"
-    },
-    {
-      "method": "GET",
-      "path": "/api/partner/approvals"
-    },
-    {
-      "method": "POST",
-      "path": "/api/partner/approvals"
-    },
-    {
-      "method": "GET",
-      "path": "/api/users"
-    },
-    {
-      "method": "POST",
-      "path": "/api/wiki/save"
-    },
-    {
-      "method": "GET",
-      "path": "/api/wiki/search"
-    },
-    {
-      "method": "DELETE",
-      "path": "/api/wiki/{slug}"
-    },
-    {
-      "method": "GET",
-      "path": "/api/wiki/{slug}"
-    },
-    {
-      "method": "POST",
-      "path": "/api/wiki/{slug}/restore"
-    }
+    { "method": "DELETE", "path": "/api/wiki/{slug}" },
+    { "method": "GET", "path": "/api/admin/agent-events" },
+    { "method": "GET", "path": "/api/admin/auth-events" },
+    { "method": "GET", "path": "/api/admin/deal-events" },
+    { "method": "GET", "path": "/api/agent/briefing" },
+    { "method": "GET", "path": "/api/agent/explain" },
+    { "method": "GET", "path": "/api/agent/manifest" },
+    { "method": "GET", "path": "/api/agent/preferences" },
+    { "method": "GET", "path": "/api/agent/skills" },
+    { "method": "GET", "path": "/api/agent/skills/{slug}" },
+    { "method": "GET", "path": "/api/me" },
+    { "method": "GET", "path": "/api/oauth/authorize" },
+    { "method": "GET", "path": "/api/occam/deals" },
+    { "method": "GET", "path": "/api/occam/deals/{dealId}" },
+    { "method": "GET", "path": "/api/wiki/{slug}" },
+    { "method": "GET", "path": "/api/wiki/search" },
+    { "method": "PATCH", "path": "/api/agent/preferences/{id}" },
+    { "method": "POST", "path": "/api/agent/client-events" },
+    { "method": "POST", "path": "/api/agent/preferences" },
+    { "method": "POST", "path": "/api/external/chat" },
+    { "method": "POST", "path": "/api/external/start-session" },
+    { "method": "POST", "path": "/api/external/upload" },
+    { "method": "POST", "path": "/api/oauth/revoke" },
+    { "method": "POST", "path": "/api/oauth/token" },
+    { "method": "POST", "path": "/api/occam/deals/commands" },
+    { "method": "POST", "path": "/api/wiki/{slug}/restore" },
+    { "method": "POST", "path": "/api/wiki/save" }
   ]
 }

package/lib/build-manifest.json

@@ -1,15 +1,15 @@
 {
   "format": "llama.cli-build.v1",
   "packageName": "@llamaventures/cli",
-  "packageVersion": "1.25.0",
-  "sourceSha": "4b70d873886c521d02cc7c75659425ed6e2989f6",
+  "packageVersion": "2.0.0",
+  "sourceSha": "1564eee5aa59c89fc4e245f0a5be0fcbe96d7bf9",
   "sourceKind": "github",
   "sourceDirty": false,
   "coreApiContract": {
     "format": "llama.core-api-contract.v1",
     "name": "llama-core-api",
-    "apiVersion": "3.26.0",
+    "apiVersion": "4.0.0",
     "openapiVersion": "3.0.3",
-    "sha256": "1ab4db8774b6dc0d94d6d6b4dd79f8272c6a405a3474710ac4162cc8a0dc6981"
+    "sha256": "69b5e29ae9585915da0fa9578abfd41099545f11eba8b2d12f14aa42cc970e4e"
   }
 }

package/lib/client.mjs

@@ -59,11 +59,11 @@ export function getPackageVersion() {
   return packageVersionCache;
 }
 
-// Canonical entrypoint. `llama-command.onrender.com` also serves the API
-// but its NextAuth callback URL doesn't match, so browser login (needed
-// to mint a token at /settings/tokens) fails there with a server-config
-// error. Always default to canonical — override with $LLAMA_API_URL only
-// if testing.
+// Canonical entrypoint. The hosting provider's assigned hostname also
+// serves the API, but its NextAuth callback URL doesn't match, so browser
+// login (needed to mint a token at /settings/tokens) fails there with a
+// server-config error. Always default to canonical — override with
+// $LLAMA_API_URL only if testing.
 export const DEFAULT_BASE_URL = "https://command.llamaventures.vc";
 
 // Canonical token location (single line, mode 0600). Aligns with the
@@ -212,6 +212,7 @@ function agentClientHeaders(command) {
   return {
     "X-Llama-Client": runtimeClient,
     "X-Llama-Client-Version": getPackageVersion(),
+    "X-Llama-Client-Capabilities": "core.read.v1,occam.deal.v1",
     "X-Llama-Client-Source-Sha": build.sourceSha,
     "X-Llama-API-Contract-Version": build.coreApiContract.apiVersion,
     "X-Llama-API-Contract-Digest": build.coreApiContract.sha256,
@@ -290,6 +291,9 @@ function inferCommand(method, endpoint) {
   if (pathname === "/api/wiki/search") return "wiki.search";
   if (pathname === "/api/wiki/save") return "wiki.save";
   if (/^\/api\/wiki\/[^/]+$/.test(pathname)) return verb === "GET" ? "wiki.read" : "wiki.write";
+  if (pathname === "/api/occam/deals") return "deal.search";
+  if (pathname === "/api/occam/deals/commands") return "deal.write";
+  if (/^\/api\/occam\/deals\/[^/]+$/.test(pathname)) return "deal.read";
   if (pathname === "/api/deals") return verb === "GET" ? "deal.search" : "deal.write";
   if (pathname === "/api/deals/create") return "deal.create";
   if (pathname === "/api/deals/update") return "deal.update";
@@ -536,12 +540,14 @@ function apiResponseError(data, status) {
     );
     error.code = data.code;
     error.details = data;
+    error.status = status;
     return error;
   }
   if (data?.code !== "MENTION_APPROVAL_REQUIRED") {
     const error = new Error(message);
     if (typeof data?.code === "string") error.code = data.code;
     error.details = data;
+    error.status = status;
     return error;
   }
   const recipients = Array.isArray(data?.cue?.recipients)
@@ -563,6 +569,7 @@ function apiResponseError(data, status) {
   );
   error.code = data.code;
   error.details = data;
+  error.status = status;
   return error;
 }
 

package/lib/deal-actions.mjs

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+
+export const DEAL_ACTIONS = Object.freeze(["search", "read", "create", "write"]);
+export const DEAL_WRITE_OPERATIONS = Object.freeze([
+  "input.submit",
+  "information.put",
+  "page.patch",
+  "artifact.put",
+]);
+
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function ensureIdempotencyKey(command) {
+  if (typeof command?.idempotencyKey === "string" && command.idempotencyKey.trim()) {
+    return command;
+  }
+  const digest = createHash("sha256").update(canonicalJson(command)).digest("hex").slice(0, 40);
+  return { ...command, idempotencyKey: `cli:${digest}` };
+}
+
+export function validateCommandOrigin(command) {
+  const origin = command?.origin;
+  if (!origin || !["user", "agent", "system"].includes(origin.kind)) {
+    throw new Error("Mutation JSON must include origin.kind: user, agent, or system");
+  }
+  if (
+    origin.kind === "user" &&
+    !(typeof origin.originalUserUtterance === "string" && origin.originalUserUtterance.trim()) &&
+    !(typeof origin.originatingChatRecordId === "string" && origin.originatingChatRecordId.trim())
+  ) {
+    throw new Error(
+      "User-originated mutation JSON must preserve origin.originalUserUtterance or origin.originatingChatRecordId",
+    );
+  }
+  return command;
+}
+
+export async function readJsonInput(path, stdin = process.stdin) {
+  if (!path || path === true) throw new Error("--json <file|-> is required");
+  const text = path === "-"
+    ? await new Promise((resolve, reject) => {
+        let value = "";
+        stdin.setEncoding("utf8");
+        stdin.on("data", (chunk) => { value += chunk; });
+        stdin.on("end", () => resolve(value));
+        stdin.on("error", reject);
+      })
+    : await readFile(path, "utf8");
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    throw new Error(`Invalid JSON from ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+export function buildDealSearchPath(query, flags = {}) {
+  const params = new URLSearchParams();
+  if (query) params.set("q", query);
+  if (flags.state && flags.state !== true) params.set("state", String(flags.state));
+  if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+  return `/api/occam/deals${params.size ? `?${params}` : ""}`;
+}
+
+export function buildDealReadPath(dealId, detail = "overview") {
+  if (!dealId || dealId.startsWith("--")) {
+    throw new Error("Usage: llama deal read <dealId> [--detail overview|memory|files|conversation|history|all]");
+  }
+  const expansion = {
+    overview: "",
+    memory: "information",
+    files: "artifacts",
+    conversation: "chat",
+    history: "feed",
+    all: "information,artifacts,chat,feed",
+  }[detail];
+  if (expansion === undefined) throw new Error(`Unknown detail: ${detail}`);
+  return `/api/occam/deals/${encodeURIComponent(dealId)}${expansion ? `?expand=${expansion}` : ""}`;
+}
+
+export function prepareDealCommand(action, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Mutation JSON must be an object");
+  }
+  const command = action === "create" ? { operation: "deal.create", ...input } : input;
+  if (action === "create" && command.operation !== "deal.create") {
+    throw new Error("create JSON must describe one deal.create intent");
+  }
+  if (action === "write" && !DEAL_WRITE_OPERATIONS.includes(command.operation)) {
+    throw new Error(`write JSON operation must be ${DEAL_WRITE_OPERATIONS.join(", ")}`);
+  }
+  return ensureIdempotencyKey(validateCommandOrigin(command));
+}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.25.0",
+  "version": "2.0.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {
     "test": "npm run test:agent-routing && npm run test:contract",
     "test:agent-routing": "node scripts/verify-agent-routing.mjs",
-    "test:contract": "node --test scripts/build-manifest.test.mjs scripts/core-api-call-sites.test.mjs scripts/investment-workflow-contract.test.mjs scripts/server-compatibility.test.mjs scripts/verify-core-api-contract.test.mjs scripts/workflow-audit.test.mjs scripts/workflow-remediation.test.mjs && node scripts/verify-core-api-contract.mjs",
+    "test:contract": "node --test scripts/build-manifest.test.mjs scripts/core-api-call-sites.test.mjs scripts/deal-actions-cli.test.mjs scripts/deal-actions.test.mjs scripts/mcp-four-action-surface.test.mjs scripts/server-compatibility.test.mjs scripts/verify-core-api-contract.test.mjs && node scripts/verify-core-api-contract.mjs",
     "verify:artifact": "node scripts/verify-release-artifact.mjs",
     "verify:release": "npm test && npm run verify:artifact && node scripts/verify-tarball-clean.mjs",
     "prepack": "node scripts/prepare-build-manifest.mjs",
@@ -56,7 +56,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
     "@napi-rs/keyring": "^1.3.0",
     "zod": "^4.4.3"
   }

package/contracts/investment-workflow-v2.md

@@ -1,19 +0,0 @@
-# Investment Workflow V2 client contract
-
-CLI and MCP treat `GET/POST /api/deals/{dealId}/workflow` as the only workflow
-read/write surface. A write must first read the current revision, submit one
-typed command with a unique request id, and display the canonical response.
-
-Never add a client shortcut that writes `deals.status`,
-`extra.investment_workflow_v2` snapshots, `extra.stage_gates`, or
-`extra.stage4_gate`. Partner
-decisions are always made by the authenticated Partner; admin capability does
-not imply permission to impersonate a decision maker.
-
-`workflow initialize` is the audited bootstrap command for legacy migration.
-It persists the state returned by `workflow show` without advancing a stage or
-resolving a guard. Never translate legacy approvals into V2 approvals silently.
-
-Post-IC compatibility status is also owned by V2. Use `workflow
-execution-status` / `workflow_update_execution_status` for Term Sheet, Verbal
-Commit, and Invested; never reopen direct `deal update ... status` writes.

package/lib/workflow-audit.mjs

@@ -1,13 +0,0 @@
-export function workflowAuditPath(flags) {
-  const deal = typeof flags.deal === "string" && flags.deal.trim()
-    ? flags.deal.trim()
-    : null;
-  const all = flags.all === true;
-  if ((!deal && !all) || (deal && all)) {
-    throw new Error("Usage: llama admin workflow audit --deal <uuid> | --all");
-  }
-  const params = new URLSearchParams();
-  if (deal) params.set("deal", deal);
-  if (all) params.set("all", "true");
-  return `/api/admin/workflow-audit?${params.toString()}`;
-}