@llamaventures/cli 1.8.0 → 1.9.0

package/AGENT_BRIEFING.md

@@ -11,6 +11,15 @@ You are not just an AI assistant. You're an **extension of a team member** — w
 - **Be direct, terse, action-oriented.** Save your words for the genuine judgment calls.
 - **Critical when thinking, helpful when executing.** Push back on weak logic, then ship the work cleanly.
 
+## Onboard the human (teach as you go)
+
+Most teammates don't know everything this CLI can do. Part of your job is to surface capabilities — without turning into a feature brochure.
+
+- **First substantive interaction:** in one or two lines, point at the 2-3 capabilities most relevant to what they're doing right now, then do the work. Don't dump the whole command surface. (Examples by intent: someone pasting deal info → "I'll split that into facts vs notes and file it"; someone with a write-up → the artifact decision tree below; someone exploring → `llama deal search` / `llama deal feed`.)
+- **Teach in context, one line at a time.** When they do something that touches a feature they may not know, mention it once — e.g. after filing a fact: "Filed. `llama deal feed <id>` shows everything the team's added on this deal." Never more than one such aside per turn.
+- **Point at `llama --help`** for the full surface rather than reciting it. The CLI uses progressive help: `llama --help` is a short overview, `llama <area> --help` drills in.
+- **Stay current.** If you suspect the CLI is stale, run `llama version --check`; if it reports an upgrade, tell the user the one-line `npm i -g @llamaventures/cli@latest` command. Don't nag repeatedly.
+
 ## Pipeline First (hard rule)
 
 Any time the user mentions a company name or founder name:

package/bin/llama.mjs

@@ -30,6 +30,7 @@ import {
 } from "../lib/external.mjs";
 import { LLAMA_CLI_CLIENT_ID, pkceLoopbackFlow, revokeToken as revokeOAuthToken } from "../lib/oauth-flow.mjs";
 import { deleteBundle, detectBackend, readBundle, writeBundle } from "../lib/oauth-storage.mjs";
+import { maybeNudgeUpdate, getUpdateNudge } from "../lib/version-check.mjs";
 
 function parseFlags(args, knownFlags = null) {
   const flags = {};
@@ -763,6 +764,14 @@ async function main() {
     const { createRequire } = await import("module");
     const requireFromHere = createRequire(import.meta.url);
     const { version } = requireFromHere("../package.json");
+    // `llama version --check` — explicitly check npm for a newer release and
+    // print the upgrade line (or "up to date"). Lets an agent surface the
+    // nudge on demand, separate from the throttled, TTY-gated auto-nudge.
+    if (action === "--check" || action === "check") {
+      const nudge = await getUpdateNudge();
+      console.log(nudge || `llama CLI ${version} — up to date`);
+      return;
+    }
     console.log(version);
     return;
   }
@@ -2633,7 +2642,12 @@ Routing — is this the right command?
   process.exitCode = 1;
 }
 
-main().catch((error) => {
-  console.error(`Error: ${error.message}`);
-  process.exit(1);
-});
+main()
+  // Soft, throttled, TTY-gated update nudge. Runs AFTER the command's own
+  // output and is awaited so the registry check completes before exit — but
+  // it can never fail the command (all errors swallowed internally).
+  .then(() => maybeNudgeUpdate())
+  .catch((error) => {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  });

package/lib/version-check.mjs

@@ -0,0 +1,118 @@
+// Soft update nudge for @llamaventures/cli.
+//
+// Philosophy: minimal friction. We NEVER block a command and we NEVER spam.
+// The npm registry is the source of truth for "latest published", so we
+// query it directly — no llama-command changes, nothing to keep in sync.
+//
+// Friction controls, all of which must pass before we print anything:
+//   1. TTY-gated   — only nudge an interactive human (process.stdout.isTTY).
+//                    MCP server / piped output / CI → silent, so agents and
+//                    scripts never see noise that could corrupt parsed output.
+//   2. Throttled   — at most once per 24h, tracked by a timestamp file.
+//   3. stderr only — the nudge never touches stdout, so `llama ... | jq` etc
+//                    stay clean even in the rare case it does print.
+//   4. Best-effort — every error path (offline, registry down, parse fail) is
+//                    swallowed. A nudge must never break or delay a command.
+
+import fs from "fs";
+import path from "path";
+import { createRequire } from "module";
+import { TOKEN_DIR } from "./client.mjs";
+
+const REGISTRY_URL = "https://registry.npmjs.org/@llamaventures/cli/latest";
+const STAMP_FILE = path.join(TOKEN_DIR, ".update-check");
+const THROTTLE_MS = 24 * 60 * 60 * 1000; // once per day
+const FETCH_TIMEOUT_MS = 2000;
+
+function installedVersion() {
+  try {
+    const requireFromHere = createRequire(import.meta.url);
+    return requireFromHere("../package.json").version;
+  } catch {
+    return null;
+  }
+}
+
+// Compare two semver strings. Returns true if `latest` is strictly newer than
+// `current`. Pre-release tags are ignored (we only ship plain x.y.z).
+function isNewer(latest, current) {
+  const a = String(latest).split(".").map((n) => parseInt(n, 10));
+  const b = String(current).split(".").map((n) => parseInt(n, 10));
+  for (let i = 0; i < 3; i++) {
+    const x = a[i] || 0;
+    const y = b[i] || 0;
+    if (x > y) return true;
+    if (x < y) return false;
+  }
+  return false;
+}
+
+function checkedRecently() {
+  try {
+    const last = parseInt(fs.readFileSync(STAMP_FILE, "utf8").trim(), 10);
+    return Number.isFinite(last) && Date.now() - last < THROTTLE_MS;
+  } catch {
+    return false;
+  }
+}
+
+function touchStamp() {
+  try {
+    fs.mkdirSync(TOKEN_DIR, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(STAMP_FILE, `${Date.now()}\n`, { mode: 0o600 });
+  } catch {
+    // Best-effort. If we can't write the stamp we may nudge again tomorrow —
+    // harmless. Never throw.
+  }
+}
+
+async function fetchLatest() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    // The /latest convenience endpoint returns full JSON under the default
+    // Accept. (The abbreviated "vnd.npm.install-v1+json" metadata type is only
+    // valid on the full packument endpoint — it 406s here.)
+    const res = await fetch(REGISTRY_URL, { signal: controller.signal });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data?.version === "string" ? data.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Compute the nudge line without any side effects (no TTY/throttle gating).
+ * Returns the one-line string if an upgrade is available, else null. Used by
+ * the explicit `llama version --check` command so an agent can surface it.
+ */
+export async function getUpdateNudge() {
+  const current = installedVersion();
+  if (!current) return null;
+  const latest = await fetchLatest();
+  if (!latest || !isNewer(latest, current)) return null;
+  return `⬆ llama CLI ${current} → ${latest} available · npm i -g @llamaventures/cli@latest`;
+}
+
+/**
+ * Fire-and-forget soft nudge for interactive humans. Safe to call without
+ * awaiting; resolves to true if it printed a nudge, false otherwise. Honors
+ * all four friction controls above. Set $LLAMA_NO_UPDATE_CHECK=1 to disable.
+ */
+export async function maybeNudgeUpdate() {
+  try {
+    if (process.env.LLAMA_NO_UPDATE_CHECK) return false;
+    if (!process.stdout.isTTY) return false; // humans only
+    if (checkedRecently()) return false;
+    touchStamp(); // stamp before the network call so a slow/failed check still throttles
+    const nudge = await getUpdateNudge();
+    if (!nudge) return false;
+    process.stderr.write(`${nudge}\n`);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "bin": {