@lorekit/cli 1.0.1 → 1.3.0

package/src/install.mjs

@@ -10,12 +10,16 @@ import {
   skillInstallDir,
   copyDir,
   upsertMcpServer,
+  upsertClaudeHooks,
+  resolveHookRunner,
+  CLAUDE_HOOK_EVENTS,
   resolveConnection,
   tokenKind,
+  homeDir,
 } from './config.mjs';
 import { buildRemoteUrl } from './mcp.mjs';
 import { deriveScope } from './scope.mjs';
-import { log, err, heading, status, c } from './util.mjs';
+import { log, err, heading, status, select, c } from './util.mjs';
 
 function ask(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -31,7 +35,26 @@ export async function install(args) {
   heading('LoreKit install');
   log(`  project: ${c.dim(root)}`);
 
-  // 1. Connection details.
+  // 1. Scope: this project, or user-global (every project). --global / --project
+  //    force it; otherwise prompt when interactive, else default to project.
+  let scope = args.global ? 'global' : args.project ? 'project' : null;
+  if (!scope) {
+    if (nonInteractive) {
+      scope = 'project';
+    } else {
+      scope = await select('Install LoreKit for…', [
+        { label: 'This project', value: 'project', hint: 'this repo only (.claude, .mcp.json)' },
+        { label: 'All projects (global)', value: 'global', hint: 'every project (~/.claude)' },
+      ]);
+    }
+  }
+  log(
+    `  install: ${c.dim(
+      scope === 'global' ? 'global — ~/.claude, applies to every project' : 'project — this repo only',
+    )}`,
+  );
+
+  // 2. Connection details.
   let { endpoint, token } = resolveConnection(args);
 
   if (!endpoint) {
@@ -50,46 +73,81 @@ export async function install(args) {
     token = token || null;
   }
 
-  // 2. Install the skill files.
-  const dest = skillInstallDir(root);
+  // 3. Install the skill files.
+  const dest = skillInstallDir(root, scope);
   const skillExisted = fs.existsSync(path.join(dest, 'SKILL.md'));
   const written = copyDir(SKILL_SOURCE, dest, { force: Boolean(args.force) });
 
-  // 3. Wire .mcp.json.
+  // 4. Wire the MCP config for the chosen scope.
   const remoteUrl = buildRemoteUrl(endpoint, token);
-  const { file, existed } = upsertMcpServer(root, remoteUrl);
+  const { file, existed } = upsertMcpServer(root, remoteUrl, scope);
+
+  // 4b. Wire the deterministic hooks (unless --no-hooks). This is the layer the
+  //     Claude plugin adds on top of the skill: lessons injected on every
+  //     SessionStart, a nudge on tool failure, a retrospective nudge on Stop —
+  //     firing the shared `lorekit hook` engine, which reads the same config.
+  const wireHooks = !args['no-hooks'];
+  let hooks = null;
+  if (wireHooks) {
+    hooks = upsertClaudeHooks(root, scope, resolveHookRunner());
+  }
+
+  // Show global paths relative to ~ (a repo-relative path would be a mess of
+  // ../../); project paths stay repo-relative.
+  const display = (p) =>
+    scope === 'global' ? p.replace(homeDir(), '~') : path.relative(root, p) || p;
+  const mcpLabel = scope === 'global' ? '~/.claude.json' : '.mcp.json';
 
-  // 4. Report.
+  // 5. Report.
   heading('Done');
   const skillState = !skillExisted
     ? 'installed'
     : written > 0
       ? `updated (${written} file(s) written)`
       : 'unchanged — pass --force to overwrite';
-  status(skillExisted && written === 0 ? 'info' : 'pass', `skill ${SKILL_NAME}`, `${skillState} → ${path.relative(root, dest) || dest}`);
-  status('pass', '.mcp.json', `${existed ? 'updated' : 'created'} lorekit server → ${path.relative(root, file) || file}`);
+  status(skillExisted && written === 0 ? 'info' : 'pass', `skill ${SKILL_NAME}`, `${skillState} → ${display(dest)}`);
+  status('pass', mcpLabel, `${existed ? 'updated' : 'created'} lorekit server → ${display(file)}`);
+
+  if (!wireHooks) {
+    status('info', 'hooks', 'skipped (--no-hooks) — the skill still works, but lessons are model-invoked only');
+  } else {
+    const n = hooks.added + hooks.updated;
+    const hookState =
+      n === 0
+        ? 'unchanged — already wired'
+        : `${hooks.added ? `${hooks.added} added` : ''}${hooks.added && hooks.updated ? ', ' : ''}${hooks.updated ? `${hooks.updated} updated` : ''}`;
+    status(n === 0 ? 'info' : 'pass', 'hooks', `${hookState} → ${display(hooks.file)} (${CLAUDE_HOOK_EVENTS.join(', ')})`);
+  }
 
   const kind = tokenKind(token);
   if (kind === 'none') {
     status('warn', 'token', 'none configured — reads/writes will fail until a token is set');
   } else if (kind === 'read-only') {
     status('warn', 'token', 'read-only (lk_ro_*) — the skill can read lessons but not write them');
+  } else if (kind === 'write-only') {
+    status('warn', 'token', 'write-only (lk_wo_*) — the skill can write lessons but not read them');
   } else if (kind === 'unknown') {
-    status('warn', 'token', 'unrecognized prefix — expected lk_rw_* or lk_ro_*');
+    status('warn', 'token', 'unrecognized prefix — expected lk_rw_*, lk_ro_*, or lk_wo_*');
   } else {
     status('pass', 'token', 'read+write (lk_rw_*)');
   }
 
-  const scope = deriveScope(root);
-  if (scope.hasRemote) {
-    status('info', 'scope', `${scope.repoScope}${scope.branchScope ? `  ·  ${scope.branchScope}` : ''}`);
+  const gitScope = deriveScope(root);
+  if (gitScope.hasRemote) {
+    status('info', 'scope', `${gitScope.repoScope}${gitScope.branchScope ? `  ·  ${gitScope.branchScope}` : ''}`);
   } else {
     status('warn', 'scope', 'no git remote — lessons will fall back to global');
   }
 
   log(`\n  Next: ${c.cyan('npx @lorekit/cli doctor')} to verify the connection.`);
   if (token) {
-    log(`  ${c.dim('Note: your token now lives in .mcp.json — keep it out of version control.')}`);
+    log(
+      `  ${c.dim(
+        scope === 'global'
+          ? 'Note: your token now lives in ~/.claude.json (used by every project) — keep that file private.'
+          : 'Note: your token now lives in .mcp.json — keep it out of version control.',
+      )}`,
+    );
   }
   return 0;
 }

package/src/mcp-server.mjs

@@ -30,7 +30,24 @@ export const TOOL_DEFS = [
   {
     name: 'memory.write',
     description: 'Store or update a lesson',
-    inputSchema: { type: 'object', required: ['scope', 'key', 'value'] },
+    inputSchema: {
+      type: 'object',
+      required: ['scope', 'key', 'value'],
+      properties: {
+        scope: { type: 'string' },
+        key: { type: 'string' },
+        value: { type: 'string' },
+        tags: { type: 'array', items: { type: 'string' } },
+        source_agent: { type: 'string' },
+        trigger: { type: 'string' },
+        created_at: {
+          type: 'string',
+          format: 'date-time',
+          description:
+            'Optional ISO 8601 creation date for migrating a pre-existing memory. Rejected if invalid or in the future. Applies only when the memory is first created.',
+        },
+      },
+    },
   },
   {
     name: 'memory.read',

package/src/store/created-at.mjs

@@ -0,0 +1,28 @@
+// Zero-dependency mirror of the created_at validation used by the hosted MCP
+// server (packages/mcp-core/src/created-at.ts). Keeps the local `lorekit mcp`
+// stdio server's memory.write contract identical to the remote one: an optional
+// ISO 8601 creation-date override, rejected when invalid or future-dated.
+
+export const CLOCK_SKEW_MS = 60_000;
+
+// Validate and normalise an optional created_at override.
+// Returns the ISO 8601 string, or null when no override was supplied.
+// Throws Error on an invalid or future-dated value.
+export function normalizeCreatedAt(input, now = new Date()) {
+  if (input === undefined || input === null) return null;
+  if (typeof input !== 'string') {
+    throw new Error('created_at must be an ISO 8601 date-time string');
+  }
+  const trimmed = input.trim();
+  if (trimmed === '') {
+    throw new Error('created_at must be an ISO 8601 date-time string');
+  }
+  const ms = Date.parse(trimmed);
+  if (Number.isNaN(ms)) {
+    throw new Error(`created_at is not a valid date-time: ${input}`);
+  }
+  if (ms > now.getTime() + CLOCK_SKEW_MS) {
+    throw new Error('created_at cannot be in the future');
+  }
+  return new Date(ms).toISOString();
+}

package/src/store/local.mjs

@@ -8,6 +8,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { serializeEntry, parseEntry, slugify, scopeToDir } from './format.mjs';
+import { normalizeCreatedAt } from './created-at.mjs';
 
 export function createLocalStore(baseDir) {
   return new LocalStore(baseDir);
@@ -82,19 +83,34 @@ class LocalStore {
 
   // write(...) → { ok, entry } — upsert by scope+key. Preserves `created` and
   // refreshes `updated`; writing an archived key revives it.
-  async write({ scope, key, value, tags, source_agent, trigger } = {}) {
+  //
+  // `created_at` is an optional ISO 8601 override for migrating a pre-existing
+  // memory (mirrors the hosted memory.write param). It applies only when the
+  // entry is first created — on both `created` and `updated`, so a migrated
+  // memory is dated by its original time everywhere — and is ignored for an
+  // existing key (a creation date never moves). Returns { ok:false, error } on
+  // an invalid or future-dated value rather than throwing, matching the store
+  // contract's error surfacing.
+  async write({ scope, key, value, tags, source_agent, trigger, created_at } = {}) {
+    let override;
+    try {
+      override = normalizeCreatedAt(created_at);
+    } catch (e) {
+      return { ok: false, error: e.message };
+    }
     const dir = this._dir(scope);
     fs.mkdirSync(dir, { recursive: true });
     const now = new Date().toISOString();
     const existing = this._findByKey(scope, key);
+    const created = existing ? existing.entry.created || now : override || now;
     const entry = {
       scope,
       key,
       tags: Array.isArray(tags) ? tags : [],
       source_agent: source_agent || null,
       trigger: trigger || null,
-      created: existing ? existing.entry.created || now : now,
-      updated: now,
+      created,
+      updated: existing ? now : override || now,
       archived_at: null,
       value: value == null ? '' : String(value),
     };

package/src/telemetry-token.mjs

@@ -0,0 +1,17 @@
+// Build-time injection point for the Dash0 ingesting-only telemetry token.
+//
+// The committed value is EMPTY on purpose — default telemetry stays off in the
+// source tree and nothing secret is ever committed to git. The release workflow
+// (.github/workflows/release.yml → publish-cli) overwrites this file at publish
+// time from the LOREKIT_TELEMETRY_TOKEN secret via
+// scripts/inject-telemetry-token.mjs, so only the *published npm tarball*
+// carries the token.
+//
+// The token is public by design once published (anyone can unpack the tarball),
+// so it MUST be a Dash0 *ingesting-only* token — it can POST spans but cannot
+// read, query, or manage anything.
+//
+// At runtime this is only the lowest-priority source: an explicit
+// LOREKIT_TELEMETRY_TOKEN env var or OTEL_EXPORTER_OTLP_HEADERS still win (see
+// resolveTelemetryConfig in telemetry.mjs).
+export const TELEMETRY_TOKEN = '';

package/src/telemetry.mjs

@@ -0,0 +1,325 @@
+// LoreKit CLI — self-contained OpenTelemetry export for command usage.
+//
+// The CLI is strictly zero-dependency (see packages/cli/package.json), so this
+// mirrors the Edge Function's SDK-free approach (supabase/functions/_shared/
+// otel.ts): OTLP/JSON over the global fetch (Node 18+), no @opentelemetry/*
+// packages. One span + one counter data point per human-facing command
+// (install / doctor / migrate), fired to Dash0 so the maintainers can see
+// which commands people actually run.
+//
+// Privacy — this runs on end-users' machines, so it is deliberately narrow:
+//   • Opt-out honored: LOREKIT_TELEMETRY=0|off|false|no|disable, or the
+//     cross-vendor DO_NOT_TRACK=1, disables all export.
+//   • No PII is ever attached: only the command name, a bounded allow-list of
+//     boolean flags, the CLI/runtime/OS identity, and the outcome. Never a
+//     path, cwd, token, endpoint, repo, or scope string.
+//   • Disabled outright when no OTLP endpoint resolves.
+//
+// The default endpoint + token below are baked into the published package and
+// are therefore public by design. The token MUST be Dash0 ingestion-only
+// (write/POST spans, no read/query/manage) — anyone can unpack the npm tarball
+// and read it. It is NOT committed to git: the release workflow injects it into
+// telemetry-token.mjs at publish time from a secret (see that file). Standard
+// OTEL_EXPORTER_OTLP_* env vars — or LOREKIT_TELEMETRY_TOKEN — override it.
+
+import process from 'node:process';
+import { TELEMETRY_TOKEN } from './telemetry-token.mjs';
+
+// ── Baked-in defaults (public by design) ──────────────────────────────────────
+// The endpoint is a committed default; the token is injected at publish time
+// (empty in the source tree, so default export stays off until built/injected).
+const DEFAULT_ENDPOINT = 'https://ingress.us-east-1.aws.dash0.com';
+const DEFAULT_TOKEN = TELEMETRY_TOKEN; // injected from LOREKIT_TELEMETRY_TOKEN at publish
+const DEFAULT_DATASET = 'lorekit-cli';
+
+// Flags worth counting (e.g. how many installs are --global). Bounded on
+// purpose: only these booleans are ever attached, never free-form values.
+const FLAG_ATTRS = ['global', 'project', 'deep', 'yes', 'force', 'no-hooks'];
+
+const OFF_VALUES = new Set(['0', 'off', 'false', 'no', 'disable', 'disabled']);
+
+// ── Config resolution ─────────────────────────────────────────────────────────
+
+/**
+ * Resolve telemetry config from env + baked-in defaults.
+ * Returns { enabled: false } when disabled or unconfigured, else the endpoint
+ * and headers to export with.
+ */
+export function resolveTelemetryConfig(env = process.env) {
+  const optOut = env.LOREKIT_TELEMETRY;
+  if (optOut !== undefined && OFF_VALUES.has(String(optOut).trim().toLowerCase())) {
+    return { enabled: false };
+  }
+  // DNT spec designates exactly `1` as the opt-out signal (consoledonottrack.com).
+  // Match it precisely — a stray `DO_NOT_TRACK=false` should NOT disable export
+  // (use LOREKIT_TELEMETRY for the loose app-specific opt-out values).
+  if (env.DO_NOT_TRACK && String(env.DO_NOT_TRACK).trim() === '1') {
+    return { enabled: false };
+  }
+
+  const endpoint = (env.OTEL_EXPORTER_OTLP_ENDPOINT || DEFAULT_ENDPOINT || '')
+    .trim()
+    .replace(/\/+$/, '');
+  if (!endpoint) return { enabled: false };
+
+  const headers = {};
+  // Auth header priority (highest first):
+  //   1. OTEL_EXPORTER_OTLP_HEADERS — explicit comma list of key=value.
+  //   2. LOREKIT_TELEMETRY_TOKEN    — a bare bearer token via env (e.g. set as a
+  //      GitHub Actions secret to inject the token, or for local testing).
+  //   3. DEFAULT_TOKEN              — baked into the tarball at publish time.
+  const rawHeaders = env.OTEL_EXPORTER_OTLP_HEADERS;
+  const envToken = env.LOREKIT_TELEMETRY_TOKEN ? String(env.LOREKIT_TELEMETRY_TOKEN).trim() : '';
+  if (rawHeaders) {
+    for (const pair of String(rawHeaders).split(',')) {
+      const idx = pair.indexOf('=');
+      if (idx > 0) headers[pair.slice(0, idx).trim()] = pair.slice(idx + 1).trim();
+    }
+  } else if (envToken) {
+    headers['Authorization'] = `Bearer ${envToken}`;
+  } else if (DEFAULT_TOKEN) {
+    headers['Authorization'] = `Bearer ${DEFAULT_TOKEN}`;
+  }
+
+  // With the baked-in default endpoint we need the baked-in token (or explicit
+  // headers) to authenticate — no point exporting an unauthenticated request.
+  const usingDefaultEndpoint = !env.OTEL_EXPORTER_OTLP_ENDPOINT;
+  if (usingDefaultEndpoint && Object.keys(headers).length === 0) {
+    return { enabled: false };
+  }
+
+  const dataset = env.DASH0_DATASET || DEFAULT_DATASET;
+  if (dataset) headers['Dash0-Dataset'] = dataset;
+
+  return { enabled: true, endpoint, headers };
+}
+
+// ── ID + value helpers (mirror _shared/otel.ts) ───────────────────────────────
+
+export function randHex(bytes) {
+  const b = new Uint8Array(bytes);
+  // `crypto` here is the WebCrypto global (globalThis.crypto), a stable global
+  // since Node 19 and also present on Node 18 — hence used unqualified rather
+  // than imported. (Do NOT `import crypto from 'node:crypto'`: that module's
+  // default export does not expose getRandomValues; only `webcrypto` does.)
+  crypto.getRandomValues(b);
+  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+}
+
+function toOtlpValue(v) {
+  if (typeof v === 'number') return Number.isInteger(v) ? { intValue: String(v) } : { doubleValue: v };
+  if (typeof v === 'boolean') return { boolValue: v };
+  return { stringValue: String(v) };
+}
+
+// Map a flat attribute bag to the OTLP key/value list shape.
+function toOtlpAttributes(attributes) {
+  return Object.entries(attributes).map(([key, value]) => ({ key, value: toOtlpValue(value) }));
+}
+
+function resourceAttributes(version) {
+  return [
+    { key: 'service.name', value: { stringValue: 'lorekit-cli' } },
+    { key: 'service.namespace', value: { stringValue: 'lorekit' } },
+    { key: 'service.version', value: { stringValue: String(version) } },
+    { key: 'process.runtime.name', value: { stringValue: 'nodejs' } },
+    { key: 'process.runtime.version', value: { stringValue: process.versions.node } },
+    { key: 'os.type', value: { stringValue: process.platform } },
+    { key: 'host.arch', value: { stringValue: process.arch } },
+  ];
+}
+
+// ── Payload builders (pure — unit-tested) ─────────────────────────────────────
+
+/**
+ * Collect the bounded, non-PII attributes for a command invocation. Only the
+ * command name, allow-listed boolean flags, the outcome and the exit code.
+ */
+export function commandAttributes({ command, args = {}, outcome, exitCode }) {
+  const attrs = { 'lorekit.cli.command': command, 'lorekit.cli.outcome': outcome };
+  if (typeof exitCode === 'number') attrs['lorekit.cli.exit_code'] = exitCode;
+  for (const flag of FLAG_ATTRS) {
+    if (args[flag]) attrs[`lorekit.cli.flag.${flag}`] = true;
+  }
+  return attrs;
+}
+
+export function buildTracePayload({ version, name, attributes, startMs, endMs, status, statusMessage }) {
+  return {
+    resourceSpans: [
+      {
+        resource: { attributes: resourceAttributes(version) },
+        scopeSpans: [
+          {
+            scope: { name: 'lorekit-cli', version: String(version) },
+            spans: [
+              {
+                traceId: randHex(16),
+                spanId: randHex(8),
+                name,
+                kind: 1, // INTERNAL
+                startTimeUnixNano: String(startMs * 1_000_000),
+                endTimeUnixNano: String(endMs * 1_000_000),
+                attributes: toOtlpAttributes(attributes),
+                status: {
+                  code: status === 'error' ? 2 : 1,
+                  ...(statusMessage ? { message: statusMessage } : {}),
+                },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+}
+
+export function buildMetricsPayload({ version, attributes, startMs, endMs }) {
+  return {
+    resourceMetrics: [
+      {
+        resource: { attributes: resourceAttributes(version) },
+        scopeMetrics: [
+          {
+            scope: { name: 'lorekit-cli', version: String(version) },
+            metrics: [
+              {
+                name: 'lorekit.cli.invocations',
+                description: 'Count of LoreKit CLI command invocations',
+                unit: '1',
+                sum: {
+                  aggregationTemporality: 1, // DELTA — a single-shot CLI reports +1
+                  isMonotonic: true,
+                  dataPoints: [
+                    {
+                      asInt: '1',
+                      startTimeUnixNano: String(startMs * 1_000_000),
+                      timeUnixNano: String(endMs * 1_000_000),
+                      attributes: toOtlpAttributes(attributes),
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+}
+
+// ── Export ────────────────────────────────────────────────────────────────────
+
+async function post(url, headers, payload, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', ...headers },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    });
+  } catch {
+    // Telemetry is best-effort — never surface a network/abort error.
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Export the trace + metric for one command. Best-effort and time-bounded so it
+ * can never delay or fail the CLI. Awaited before process exit (Node would
+ * otherwise drop the in-flight request), but capped at timeoutMs.
+ */
+export async function exportInvocation(config, { version, name, attributes, startMs, endMs, status, statusMessage }, { timeoutMs = 1500 } = {}) {
+  if (!config || !config.enabled) return;
+  const trace = buildTracePayload({ version, name, attributes, startMs, endMs, status, statusMessage });
+  const metric = buildMetricsPayload({ version, attributes, startMs, endMs });
+  await Promise.all([
+    post(`${config.endpoint}/v1/traces`, config.headers, trace, timeoutMs),
+    post(`${config.endpoint}/v1/metrics`, config.headers, metric, timeoutMs),
+  ]);
+}
+
+// ── Command wrapper ───────────────────────────────────────────────────────────
+
+/**
+ * A bounded, non-PII label for a thrown error: its `code` (e.g. `ENOENT`) or,
+ * failing that, its constructor name (e.g. `TypeError`). Never the free-form
+ * message, which can carry paths and other user data.
+ */
+function errorLabel(e) {
+  if (e && typeof e.code === 'string' && e.code) return e.code;
+  if (e && e.constructor && e.constructor.name) return e.constructor.name;
+  return 'Error';
+}
+
+/**
+ * Time a human-facing command, record its outcome, and export one span + one
+ * counter point. Returns the command's exit code unchanged. Telemetry failures
+ * are swallowed — the command result is never affected.
+ *
+ * @param {string} command  bounded: install | doctor | migrate
+ * @param {object} args     parsed CLI args (read for allow-listed flags only)
+ * @param {string} version  CLI version (from package.json)
+ * @param {() => Promise<number>} run  the command handler
+ */
+export async function traceCommand(command, args, version, run) {
+  let config;
+  try {
+    config = resolveTelemetryConfig();
+  } catch {
+    config = { enabled: false };
+  }
+
+  // Fast path: no export configured → run with zero overhead.
+  if (!config.enabled) return run();
+
+  const startMs = Date.now();
+  let exitCode = 0;
+  let status = 'ok';
+  let statusMessage;
+  try {
+    exitCode = await run();
+    if (typeof exitCode === 'number' && exitCode !== 0) {
+      status = 'error';
+      statusMessage = `exit ${exitCode}`;
+    }
+    return exitCode;
+  } catch (e) {
+    status = 'error';
+    // Record only a bounded, non-PII identifier — NEVER e.message. Node fs /
+    // network error messages embed absolute paths (e.g. "ENOENT: ... open
+    // '/home/me/proj/.mcp.json'"), which must never reach an exported span. The
+    // error status code already conveys failure.
+    statusMessage = errorLabel(e);
+    exitCode = 1;
+    throw e;
+  } finally {
+    // NOTE: on a thrown command error the `throw e` above is deferred until this
+    // finally settles, so a crash still awaits `exportInvocation` (up to
+    // timeoutMs, default 1500 ms) before propagating. This is intentional — the
+    // in-flight span would otherwise be dropped on exit. Do not shorten the
+    // timeout without weighing this "crash appears to hang ~1.5 s" trade-off.
+    try {
+      const attributes = commandAttributes({
+        command,
+        args,
+        outcome: status === 'error' ? 'error' : 'ok',
+        exitCode: typeof exitCode === 'number' ? exitCode : undefined,
+      });
+      await exportInvocation(config, {
+        version,
+        name: `lorekit.cli.${command}`,
+        attributes,
+        startMs,
+        endMs: Date.now(),
+        status,
+        statusMessage,
+      });
+    } catch {
+      // never let telemetry break the CLI
+    }
+  }
+}