@llamaventures/cli 1.4.3 → 1.4.4

package/AGENT_BRIEFING.md

@@ -33,6 +33,8 @@ Conversation produces value → that value flows somewhere. This is not optional
 |---|---|---|
 | Deal metadata (status, stage, valuation, founders, notes, etc.) | Pipeline (Postgres) | `llama deal create` / `llama deal update` |
 | Brief blocks (text / link / embed / callout) | Pipeline | `llama brief add-text` / `add-link` / `add-callout` |
+| **HTML artifact, internal — IC report, dashboard, market map, 2×2, any hand-authored page** | **Llama Command native** (Postgres + sandboxed iframe at `/deals/<id>/browse/<slug>`) | **`llama html upload <dealId> --file <path> [--assets <dir>]`** — this is the **default** path when the user says "deploy to llama", "deploy to llama command", "部署到 llama command", "put this HTML on the deal page", "在 deal 里看这个". Do NOT default to Netlify for internal pages. |
+| HTML artifact, external — founder-facing share link | Netlify | Only when the user explicitly says "share link", "give it to the founder", "publish publicly". Use the `netlify-access-guard` workflow (server-side password + edge 401 verification). |
 | Insights, decisions, framework improvements | Wiki | `llama wiki save` (with attribution — see below) |
 | Large files (deck / PDF / transcript) | Drive deal folder | the deal's `folder_url` (from `llama deal show`) → upload via your filesystem / Drive tool |
 | Cross-team mentions | Inbox + email | `llama post <dealId> "@<teammate> ..."` — server fires email + UI badge to the recipient |
@@ -106,6 +108,14 @@ llama brief add-text <dealId> --heading "..." --body "..."
 llama brief add-link <dealId> --url "..." --label "..."
 llama brief add-callout <dealId> --tone insight|warning|info|success --heading "..." --body "..."
 
+# Deal HTML — native deploy to /deals/<id>/browse/<slug> (PR #81)
+# Default path when user says "deploy to llama / 部署到 llama command / put this HTML on the deal page".
+llama html upload <dealId> --file ./report.html [--assets ./assets]   # PUT new version (auto-increments)
+llama html show <dealId> [--out path] [--json]                         # current HTML → stdout
+llama html versions <dealId>                                           # version history (incl. soft-deleted)
+llama html restore <dealId> <version>                                  # promote old version to latest
+llama html reset <dealId>                                              # soft-delete latest (browse reverts to empty)
+
 # Wiki (knowledge base)
 llama wiki search "<query>"
 llama wiki save <slug> --title "..." --content "..."

package/bin/llama-mcp.mjs

@@ -661,6 +661,266 @@ server.registerTool(
     })
 );
 
+// ============================================================
+// Deal page HTML — hand-authored sandboxed page per deal
+// ============================================================
+//
+// Each deal has its own /deals/<id>/browse page that renders a
+// hand-authored HTML in a sandboxed iframe (allow-scripts, no
+// same-origin). Uploads from any caller (web UI, CLI, agent, MCP)
+// create a new monotonic version + trigger SSE push so any open
+// viewer refreshes in real time. Old versions are soft-deleted on
+// replace and can be restored.
+
+// All html_* tools take an optional documentSlug param. Default 'main'.
+// Each deal can hold multiple named documents (different HTMLs); use
+// html_docs_list to discover slugs.
+function htmlUrl(dealId, slug) {
+  return `/api/deals/${encodeURIComponent(dealId)}/documents/${encodeURIComponent(slug ?? "main")}/html`;
+}
+
+server.registerTool(
+  "html_show",
+  {
+    description:
+      "Read the current hand-authored HTML 'deal page' for a deal. " +
+      "Returns {empty: true} if no one has uploaded HTML yet, or " +
+      "{empty: false, version, html, bytes, uploaded_by, source, " +
+      "created_at}. The HTML can be 5-500KB — be deliberate about " +
+      "including the body in your reply. Use html_versions if you " +
+      "just want the version list without the body. Each deal can " +
+      "have multiple named docs — pass documentSlug to target a " +
+      "non-'main' one (use html_docs_list to discover them).",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      documentSlug: z
+        .string()
+        .optional()
+        .describe("default: 'main'. Use html_docs_list to discover slugs."),
+    },
+  },
+  async ({ dealId, documentSlug }) =>
+    callApi("GET", htmlUrl(dealId, documentSlug))
+);
+
+server.registerTool(
+  "html_upload",
+  {
+    description:
+      "Upload (PUT) a new HTML version for a deal's /browse page. " +
+      "Creates a NEW version row — the previous version is retained " +
+      "and restorable. Triggers SSE push so any open viewer auto- " +
+      "refreshes. Constraints: HTML body MUST start with " +
+      "<!doctype html> or <html (case-insensitive); max 5 MB. ALWAYS " +
+      "call html_show first if anything exists — replace only the " +
+      "relevant section, don't lose unrelated content. Source defaults " +
+      "to 'agent' for MCP-originated uploads. Pass documentSlug to " +
+      "target a non-'main' doc — auto-creates the doc if it doesn't exist.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      html: z.string().describe("complete HTML document"),
+      documentSlug: z
+        .string()
+        .optional()
+        .describe("default: 'main'"),
+      source: z
+        .enum(["web", "cli", "agent"])
+        .optional()
+        .describe("default: agent"),
+    },
+  },
+  async ({ dealId, html, documentSlug, source }) =>
+    callApi("PUT", htmlUrl(dealId, documentSlug), {
+      html,
+      source: source ?? "agent",
+    })
+);
+
+server.registerTool(
+  "html_versions",
+  {
+    description:
+      "List version history for a deal's /browse page HTML. Returns " +
+      "an array of {version, bytes, uploaded_by, source, created_at, " +
+      "deleted_at} — newest first, including soft-deleted versions. " +
+      "Use to find a target version for html_restore.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      documentSlug: z.string().optional().describe("default: 'main'"),
+    },
+  },
+  async ({ dealId, documentSlug }) =>
+    callApi("GET", `${htmlUrl(dealId, documentSlug)}/history`)
+);
+
+server.registerTool(
+  "html_restore",
+  {
+    description:
+      "Restore an old HTML version by copying it forward as a new " +
+      "version (so the latest pointer moves to the restored content). " +
+      "Use html_versions first to discover the version number. " +
+      "Triggers SSE push.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      version: z.number().int().positive().describe("version to restore"),
+      documentSlug: z.string().optional().describe("default: 'main'"),
+    },
+  },
+  async ({ dealId, version, documentSlug }) =>
+    callApi("POST", `${htmlUrl(dealId, documentSlug)}/restore/${version}`)
+);
+
+server.registerTool(
+  "html_docs_list",
+  {
+    description:
+      "List all documents (HTML 'pages') on a deal. Each deal can " +
+      "hold multiple — like a folder of files. Returns an array of " +
+      "{slug, title, preview_url, created_by, latest_version, " +
+      "latest_bytes, latest_uploaded_by, latest_updated_at}. The " +
+      "'main' slug is the default doc; non-main slugs are explicit.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+    },
+  },
+  async ({ dealId }) =>
+    callApi("GET", `/api/deals/${encodeURIComponent(dealId)}/documents`)
+);
+
+server.registerTool(
+  "html_docs_create",
+  {
+    description:
+      "Create a NEW named document slot on a deal (metadata only — " +
+      "upload HTML separately via html_upload with the same slug). " +
+      "Slug must match /^[a-z0-9][a-z0-9_-]{0,63}$/ — lowercase alnum + " +
+      "hyphen/underscore. Examples: 'ic-onepager', 'founder-brief', " +
+      "'market-map'. Title is for display; defaults to the slug.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      slug: z.string().describe("URL-safe id, e.g. 'ic-onepager'"),
+      title: z.string().optional().describe("display title; defaults to slug"),
+    },
+  },
+  async ({ dealId, slug, title }) =>
+    callApi("POST", `/api/deals/${encodeURIComponent(dealId)}/documents`, {
+      slug,
+      title: title ?? slug,
+    })
+);
+
+server.registerTool(
+  "html_docs_archive",
+  {
+    description:
+      "Archive a non-'main' doc — hides it from the selection page. " +
+      "HTML/asset versions are retained and the doc can be 'un-archived' " +
+      "later (currently via direct DB or by ensureDealDocument). The " +
+      "'main' doc cannot be archived (it's the default slot).",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      slug: z.string().describe("slug to archive (must not be 'main')"),
+    },
+  },
+  async ({ dealId, slug }) =>
+    callApi(
+      "DELETE",
+      `/api/deals/${encodeURIComponent(dealId)}/documents/${encodeURIComponent(slug)}`
+    )
+);
+
+server.registerTool(
+  "html_upload_bundle",
+  {
+    description:
+      "Upload HTML + binary assets as one atomic version. Use this " +
+      "INSTEAD of html_upload when the HTML references local images / " +
+      "fonts / CSS files via relative src=/href= attributes (typical " +
+      "of 'Save Page As Complete' exports). The server stores HTML + " +
+      "each asset as one transactional bundle (deal_browse_assets " +
+      "table), rewrites the HTML refs to version-pinned URLs at " +
+      "/api/deals/<id>/asset/<path>?v=N, and triggers SSE push. " +
+      "Constraints: HTML <= 5 MB; each asset <= 50 MB; total bundle " +
+      "<= 100 MB. Asset paths must match the relative refs in the HTML " +
+      "(no leading './', no '..' segments).",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      html: z.string().describe("complete HTML document"),
+      assets: z
+        .array(
+          z.object({
+            path: z
+              .string()
+              .describe(
+                "relative path matching the HTML's src/href ref " +
+                  "(e.g. 'images/cover.png' or 'Foo_files/img.jpg')",
+              ),
+            contentType: z
+              .string()
+              .describe("MIME type, e.g. 'image/jpeg', 'font/woff2'"),
+            base64: z
+              .string()
+              .describe("base64-encoded file bytes (NO data:URI prefix)"),
+          }),
+        )
+        .min(1)
+        .describe("at least one asset (use html_upload if no assets)"),
+      documentSlug: z
+        .string()
+        .optional()
+        .describe("default: 'main'"),
+      source: z
+        .enum(["web", "cli", "agent"])
+        .optional()
+        .describe("default: agent"),
+    },
+  },
+  async ({ dealId, html, assets, documentSlug, source }) => {
+    const form = new FormData();
+    form.append("html", html);
+    form.append("source", source ?? "agent");
+    for (const a of assets) {
+      const bytes = Buffer.from(a.base64, "base64");
+      form.append(
+        `asset:${a.path}`,
+        new Blob([bytes], { type: a.contentType || "application/octet-stream" }),
+        a.path,
+      );
+    }
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${getBaseUrl()}${htmlUrl(dealId, documentSlug)}`, {
+      method: "PUT",
+      headers, // let fetch set multipart Content-Type with boundary
+      body: form,
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(
+        `HTTP ${res.status}: ${body?.error || JSON.stringify(body).slice(0, 300)}`,
+      );
+    }
+    return body;
+  },
+);
+
+server.registerTool(
+  "html_reset",
+  {
+    description:
+      "Soft-delete the latest HTML version for a deal. The /browse " +
+      "page reverts to its empty state (drop / paste / CLI / agent " +
+      "invitation). Old versions are retained and restorable via " +
+      "html_restore.",
+    inputSchema: {
+      dealId: z.string().describe("deal uuid"),
+      documentSlug: z.string().optional().describe("default: 'main'"),
+    },
+  },
+  async ({ dealId, documentSlug }) =>
+    callApi("DELETE", htmlUrl(dealId, documentSlug))
+);
+
 // ============================================================
 // Prompts
 // ============================================================

package/bin/llama.mjs

@@ -262,6 +262,20 @@ Memo (long-form HTML investment memo — Memo tab in the UI):
   llama memo save <dealId> --file <path>                     # paste a hand-written HTML as manual override
   llama memo reset <dealId> [--all]                          # default drops manual override; --all drops every version
 
+Deal page HTML (hand-authored sandboxed page on /deals/<id>/browse):
+  llama html show <dealId> [--out <path>] [--json]           # default: current html → stdout (pipeable)
+  llama html upload <dealId> --file <path> [--assets DIR]    # PUT a new version (auto increments).
+                                                             # --assets bundles a sibling folder of images / fonts / css
+                                                             # (e.g. "Save Page As Complete" exports — the _files/ dir)
+  llama html versions <dealId>                               # list version history (incl. soft-deleted)
+  llama html restore <dealId> <version>                      # promote an old version to new latest
+  llama html reset <dealId>                                  # soft-delete latest; /browse reverts to empty state
+
+  Caps: HTML 5 MB, each asset 50 MB, total bundle 100 MB. Every write
+  triggers SSE push — any browser viewing /deals/<id>/browse refreshes
+  automatically. Same write path as the in-app deal agent's
+  update_deal_browse_html tool and the MCP html_upload_bundle tool.
+
 Admin (system admin only — server returns 403 for non-admin tokens):
   llama admin auth-events  [--kind X] [--actor email] [--subject email] [--since 24h|7d|30d|<ISO>] [--limit 100]
   llama admin deal-events  [--kind X] [--actor email] [--deal <uuid>] [--since 24h] [--limit 100]
@@ -1221,8 +1235,8 @@ https://command.llamaventures.vc/settings/tokens, run
   // Hits /api/wiki/<slug> directly. Earlier versions did a fuzzy
   // /api/wiki/search call and filtered for an exact slug match — that
   // missed any article whose slug-as-string didn't appear in title or
-  // content (e.g. "jack-feng" search vs "Jack Feng" content), so a real
-  // article would print as "not found" even though it existed.
+  // content (e.g. a slug like "foo-bar" against an article titled "Foo Bar"),
+  // so a real article would print as "not found" even though it existed.
   if (area === "wiki" && action === "read") {
     const { flags, positional } = parseFlags(rest);
     const slug = positional[0];
@@ -1792,6 +1806,384 @@ https://command.llamaventures.vc/settings/tokens, run
     );
   }
 
+  // ============================================================
+  // `llama html` family — per-deal hand-authored HTML "deal page"
+  // ============================================================
+  //
+  // Each deal can have its own HTML browse view (sandboxed iframe).
+  // Upload via this CLI, or directly via the web UI's drag-drop / paste,
+  // or by the in-app deal agent via the update_deal_browse_html tool.
+  // Every upload creates a new monotonic version; old versions are
+  // soft-deleted on replace and can be restored.
+  //
+  //   llama html show <dealId> [--out PATH] [--json]
+  //   llama html upload <dealId> --file PATH [--source cli|web|agent]
+  //   llama html versions <dealId>
+  //   llama html restore <dealId> <version>
+  //   llama html reset <dealId>
+  if (area === "html") {
+    const sub = action;
+
+    // --doc <slug> selects which named document on the deal (default 'main').
+    // Slugs match /^[a-z0-9][a-z0-9_-]{0,63}$/. Use `llama html docs <dealId>`
+    // to list available slugs.
+    function htmlEndpoint(dealId, slug) {
+      return `/api/deals/${encodeURIComponent(dealId)}/documents/${encodeURIComponent(slug)}/html`;
+    }
+
+    // docs — list / create / archive documents on a deal.
+    //
+    // Forms:
+    //   llama html docs <dealId>                      # list
+    //   llama html docs list <dealId>                 # list (explicit)
+    //   llama html docs create <dealId> <slug> [--title "..."]
+    //   llama html docs archive <dealId> <slug>
+    if (sub === "docs") {
+      const docSub = rest[0];
+      const isExplicitSubcommand =
+        docSub === "list" ||
+        docSub === "create" ||
+        docSub === "archive";
+      if (!isExplicitSubcommand) {
+        // First positional is the dealId (the common "just list" case).
+        const dealId = rest[0];
+        if (!dealId) {
+          throw new Error(
+            "Usage: llama html docs <dealId>\n" +
+              "       llama html docs create <dealId> <slug> --title \"...\"\n" +
+              "       llama html docs archive <dealId> <slug>",
+          );
+        }
+        const data = await request(
+          "GET",
+          `/api/deals/${encodeURIComponent(dealId)}/documents`,
+        );
+        print(data);
+        return;
+      }
+      if (docSub === "list") {
+        const dealId = rest[1];
+        if (!dealId) {
+          throw new Error("Usage: llama html docs list <dealId>");
+        }
+        const data = await request(
+          "GET",
+          `/api/deals/${encodeURIComponent(dealId)}/documents`,
+        );
+        print(data);
+        return;
+      }
+      if (docSub === "create") {
+        const dealId = rest[1];
+        const slug = rest[2];
+        if (!dealId || !slug) {
+          throw new Error(
+            "Usage: llama html docs create <dealId> <slug> [--title \"...\"]",
+          );
+        }
+        const { flags } = parseFlags(rest.slice(3));
+        const title = flags.title ? String(flags.title) : slug;
+        const data = await request(
+          "POST",
+          `/api/deals/${encodeURIComponent(dealId)}/documents`,
+          { slug, title },
+        );
+        print(data);
+        return;
+      }
+      if (docSub === "archive") {
+        const dealId = rest[1];
+        const slug = rest[2];
+        if (!dealId || !slug) {
+          throw new Error("Usage: llama html docs archive <dealId> <slug>");
+        }
+        const data = await request(
+          "DELETE",
+          `/api/deals/${encodeURIComponent(dealId)}/documents/${encodeURIComponent(slug)}`,
+        );
+        print(data);
+        return;
+      }
+      throw new Error(
+        `Unknown html docs subcommand "${docSub}". Use: list / create / archive.`,
+      );
+    }
+
+    // show — fetch the current HTML. Default: print to stdout (pipeable).
+    if (sub === "show") {
+      const dealId = rest[0];
+      if (!dealId) {
+        throw new Error("Usage: llama html show <dealId> [--doc SLUG] [--out PATH] [--json]");
+      }
+      const { flags } = parseFlags(rest.slice(1));
+      const slug = typeof flags.doc === "string" && flags.doc.trim() ? flags.doc.trim() : "main";
+      const data = await request("GET", htmlEndpoint(dealId, slug));
+      if (flags.json) {
+        print(data);
+        return;
+      }
+      if (data?.empty) {
+        throw new Error(
+          `No HTML uploaded for deal ${dealId} yet. Upload via \`llama html upload\`, the web UI, or have the deal agent write it.`,
+        );
+      }
+      const html = data?.html;
+      if (typeof html !== "string") {
+        throw new Error("browse-html response missing html field.");
+      }
+      if (flags.out) {
+        const { writeFileSync } = await import("fs");
+        writeFileSync(String(flags.out), html);
+        console.error(
+          `Wrote ${html.length} bytes (v${data.version}) → ${flags.out}`,
+        );
+        return;
+      }
+      // Stdout — supports `llama html show <id> > page.html` and piping
+      // to e.g. `open -f -a Safari` for quick preview.
+      process.stdout.write(html);
+      return;
+    }
+
+    // upload — PUT a new version. Reads HTML from --file or stdin. With
+    // --assets <dir>, walks the folder, packages as a multipart bundle,
+    // and the server stores HTML + per-asset BYTEA rows atomically
+    // (deal_browse_assets table). Perfect for "Save Page As Complete"
+    // exports — the sibling `_files/` folder maps 1-to-1 to assets.
+    if (sub === "upload") {
+      const dealId = rest[0];
+      if (!dealId) {
+        throw new Error(
+          "Usage: llama html upload <dealId> --file PATH [--doc SLUG] [--assets DIR] [--source cli|agent]\n" +
+            "       echo '<!doctype html>...' | llama html upload <dealId> --stdin [--doc SLUG]",
+        );
+      }
+      const { flags } = parseFlags(rest.slice(1));
+      const slug =
+        typeof flags.doc === "string" && flags.doc.trim()
+          ? flags.doc.trim()
+          : "main";
+      let html;
+      if (flags.file) {
+        const { readFileSync } = await import("fs");
+        html = readFileSync(String(flags.file), "utf8");
+      } else if (flags.stdin) {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(chunk);
+        html = Buffer.concat(chunks).toString("utf8");
+      } else {
+        throw new Error(
+          "Pass --file <path> to upload a file, or --stdin to read from stdin.",
+        );
+      }
+      if (!html || !html.trim()) {
+        throw new Error("HTML body is empty.");
+      }
+      const source =
+        typeof flags.source === "string" && flags.source.trim()
+          ? flags.source.trim()
+          : "cli";
+
+      // No --assets → JSON path (small, faster).
+      if (!flags.assets) {
+        const data = await request("PUT", htmlEndpoint(dealId, slug), {
+          html,
+          source,
+        });
+        print({
+          ok: true,
+          document_slug: slug,
+          version: data?.version,
+          bytes: data?.bytes ?? Buffer.byteLength(html, "utf8"),
+          deal_uuid: dealId,
+          viewer: `${getBaseUrl()}/deals/${encodeURIComponent(dealId)}/browse/${encodeURIComponent(slug)}`,
+        });
+        return;
+      }
+
+      // --assets path → multipart bundle. Walk the asset directory,
+      // attach every file as `asset:<relativePath>`, and let the server
+      // rewrite the HTML refs to /api/deals/<id>/asset/<path>?v=N.
+      const { readFileSync, readdirSync, statSync } = await import("fs");
+      const { join, relative, sep, basename } = await import("path");
+      const assetsRoot = String(flags.assets);
+      const assetsRootStat = statSync(assetsRoot);
+      if (!assetsRootStat.isDirectory()) {
+        throw new Error(`--assets must point to a directory: ${assetsRoot}`);
+      }
+
+      // Recursively collect every file under the assets root.
+      const collected = []; // { absPath, relPath, bytes }
+      const walk = (dir) => {
+        for (const name of readdirSync(dir)) {
+          const abs = join(dir, name);
+          const st = statSync(abs);
+          if (st.isDirectory()) {
+            walk(abs);
+          } else if (st.isFile()) {
+            const rel = relative(assetsRoot, abs).split(sep).join("/");
+            collected.push({ absPath: abs, relPath: rel, bytes: st.size });
+          }
+        }
+      };
+      walk(assetsRoot);
+      if (collected.length === 0) {
+        throw new Error(`--assets directory is empty: ${assetsRoot}`);
+      }
+
+      // Some "Save Page As" exports put assets in a sibling folder named
+      // after the HTML (e.g. "Foo.html" + "Foo_files/"). When the HTML
+      // references "./Foo_files/img.png" but we walk just the inner dir,
+      // the rel paths don't match. Detect this case: if the assets root's
+      // basename is "<something>_files" or "<something> files", the HTML
+      // probably uses that prefix — prepend it to each relPath.
+      const rootName = basename(assetsRoot);
+      const looksLikeSavePageDir = /[_ ]files$/i.test(rootName);
+      const finalPaths = looksLikeSavePageDir
+        ? collected.map((c) => ({ ...c, relPath: `${rootName}/${c.relPath}` }))
+        : collected;
+
+      // Mime sniff from extension. Server defaults to
+      // application/octet-stream if blob.type is empty.
+      const mimeFor = (path) => {
+        const ext = (path.split(".").pop() || "").toLowerCase();
+        return (
+          {
+            jpg: "image/jpeg",
+            jpeg: "image/jpeg",
+            png: "image/png",
+            gif: "image/gif",
+            webp: "image/webp",
+            svg: "image/svg+xml",
+            ico: "image/x-icon",
+            avif: "image/avif",
+            css: "text/css",
+            js: "text/javascript",
+            json: "application/json",
+            woff: "font/woff",
+            woff2: "font/woff2",
+            ttf: "font/ttf",
+            otf: "font/otf",
+            mp4: "video/mp4",
+            webm: "video/webm",
+            pdf: "application/pdf",
+          }[ext] || "application/octet-stream"
+        );
+      };
+
+      const form = new FormData();
+      form.append("html", html);
+      form.append("source", source);
+      let totalBytes = 0;
+      for (const { absPath, relPath } of finalPaths) {
+        const buf = readFileSync(absPath);
+        totalBytes += buf.length;
+        // FormData wants a Blob; in Node 20+ Blob is global and accepts Buffer.
+        form.append(
+          `asset:${relPath}`,
+          new Blob([buf], { type: mimeFor(relPath) }),
+          relPath,
+        );
+      }
+
+      console.error(
+        `Uploading bundle: html ${Buffer.byteLength(html, "utf8")} bytes + ${finalPaths.length} assets (${totalBytes} bytes)`,
+      );
+
+      const headers = await getAuthHeaders();
+      const res = await fetch(`${getBaseUrl()}${htmlEndpoint(dealId, slug)}`, {
+        method: "PUT",
+        headers: { ...headers /* let fetch set the multipart boundary */ },
+        body: form,
+      });
+      const body = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        throw new Error(
+          `HTTP ${res.status}: ${body?.error || JSON.stringify(body).slice(0, 300)}`,
+        );
+      }
+      print({
+        ok: true,
+        document_slug: slug,
+        version: body.version,
+        asset_count: body.asset_count,
+        asset_bytes: body.asset_bytes,
+        deal_uuid: dealId,
+        viewer: `${getBaseUrl()}/deals/${encodeURIComponent(dealId)}/browse/${encodeURIComponent(slug)}`,
+      });
+      return;
+    }
+
+    // versions — list version history (newest first, includes soft-deleted).
+    if (sub === "versions") {
+      const dealId = rest[0];
+      if (!dealId) {
+        throw new Error("Usage: llama html versions <dealId> [--doc SLUG]");
+      }
+      const { flags } = parseFlags(rest.slice(1));
+      const slug =
+        typeof flags.doc === "string" && flags.doc.trim()
+          ? flags.doc.trim()
+          : "main";
+      const data = await request("GET", `${htmlEndpoint(dealId, slug)}/history`);
+      print(data);
+      return;
+    }
+
+    // restore — re-promote an old version as the new latest.
+    if (sub === "restore") {
+      const dealId = rest[0];
+      const version = Number(rest[1]);
+      if (!dealId || !Number.isFinite(version)) {
+        throw new Error(
+          "Usage: llama html restore <dealId> <version> [--doc SLUG]",
+        );
+      }
+      const { flags } = parseFlags(rest.slice(2));
+      const slug =
+        typeof flags.doc === "string" && flags.doc.trim()
+          ? flags.doc.trim()
+          : "main";
+      const data = await request(
+        "POST",
+        `${htmlEndpoint(dealId, slug)}/restore/${version}`,
+      );
+      print({
+        ok: true,
+        document_slug: slug,
+        restored_from: version,
+        new_version: data?.version,
+        deal_uuid: dealId,
+      });
+      return;
+    }
+
+    // reset — soft-delete the current HTML. /browse page reverts to empty state.
+    if (sub === "reset" || sub === "delete") {
+      const dealId = rest[0];
+      if (!dealId) {
+        throw new Error("Usage: llama html reset <dealId> [--doc SLUG]");
+      }
+      const { flags } = parseFlags(rest.slice(1));
+      const slug =
+        typeof flags.doc === "string" && flags.doc.trim()
+          ? flags.doc.trim()
+          : "main";
+      const data = await request("DELETE", htmlEndpoint(dealId, slug));
+      print({
+        ok: true,
+        document_slug: slug,
+        soft_deleted_version: data?.version ?? null,
+        deal_uuid: dealId,
+      });
+      return;
+    }
+
+    throw new Error(
+      `Unknown html subcommand "${sub || ""}". Use: docs / show / upload / versions / restore / reset.`,
+    );
+  }
+
   usage();
   process.exitCode = 1;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "bin": {