@vike-io/cli 0.13.1 → 0.15.0

package/src/mcp-client.js

@@ -1,33 +1,49 @@
 import { requireApiKey, getEndpoint } from './auth.js';
+import { readPackageVersion } from './util.js';
+
+// The installed package's own version: npm_package_version is set only under `npm run`.
+export const USER_AGENT = `vike-cli/${readPackageVersion()}`;
 
 let _id = 0;
 function nextId() { return ++_id; }
 
+// A fetch error can quote a header value (an invalid one, e.g. a key pasted with a newline): never echo the key.
+export function redact(message, apiKey) {
+  return apiKey ? String(message).split(apiKey).join('vk_***') : String(message);
+}
+
+// fetch, with any error message cleared of the key.
+async function post(endpoint, apiKey, init) {
+  try {
+    return await fetch(endpoint, init);
+  } catch (err) {
+    throw Object.assign(new Error(redact(err.message, apiKey)), { name: err.name });
+  }
+}
+
 export async function callTool(toolName, args = {}, opts = {}) {
   const apiKey = opts.apiKey ?? requireApiKey();
   const endpoint = opts.endpoint ?? getEndpoint();
   const timeoutMs = opts.timeoutMs ?? 60_000;
 
-  const body = {
-    jsonrpc: '2.0',
-    id: nextId(),
-    method: 'tools/call',
-    params: { name: toolName, arguments: args },
-  };
+  // argsText: the caller's own JSON object text, sent byte for byte (a 77-digit number is not rounded).
+  const envelope = JSON.stringify({ jsonrpc: '2.0', id: nextId(), method: 'tools/call' });
+  const body = `${envelope.slice(0, -1)},"params":{"name":${JSON.stringify(toolName)},`
+    + `"arguments":${opts.argsText ?? JSON.stringify(args)}}}`;
 
   const ctrl = new AbortController();
   const t = setTimeout(() => ctrl.abort(), timeoutMs);
 
   let resp;
   try {
-    resp = await fetch(endpoint, {
+    resp = await post(endpoint, apiKey, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
         'X-API-KEY': apiKey,
-        'User-Agent': `vike-cli/${process.env.npm_package_version ?? 'dev'}`,
+        'User-Agent': USER_AGENT,
       },
-      body: JSON.stringify(body),
+      body,
       signal: ctrl.signal,
     });
   } catch (err) {
@@ -52,10 +68,15 @@ export async function callTool(toolName, args = {}, opts = {}) {
 
   // tools/call returns { content: [{type:'text', text: JSON}], isError }
   const content = json.result?.content?.[0]?.text;
-  if (!content) return json.result;
-  try { return JSON.parse(content); } catch {
-    return content;
+  let parsed = content;
+  try { parsed = JSON.parse(content); } catch { /* plain text */ }
+  if (json.result?.isError) {
+    // An in-band failure ({"error": ...}) is an error in every output mode, so the exit code is 1.
+    throw new Error(String(parsed?.error ?? parsed?.[0]?.error ?? content ?? 'tool error'));
   }
+  if (!content) return json.result;
+  // raw: the tool's text as sent, so integers above 2^53 survive.
+  return opts.raw ? content : parsed;
 }
 
 export async function listTools(opts = {}) {
@@ -67,9 +88,9 @@ export async function listTools(opts = {}) {
     method: 'tools/list',
     params: {},
   };
-  const resp = await fetch(endpoint, {
+  const resp = await post(endpoint, apiKey, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'X-API-KEY': apiKey },
+    headers: { 'Content-Type': 'application/json', 'X-API-KEY': apiKey, 'User-Agent': USER_AGENT },
     body: JSON.stringify(body),
   });
   const json = await resp.json();
@@ -82,9 +103,9 @@ export async function ping(opts = {}) {
   // JSON-RPC "Invalid or missing API key" error (soon HTTP 401), so fail early.
   const endpoint = opts.endpoint ?? getEndpoint();
   const apiKey = opts.apiKey ?? requireApiKey();
-  const resp = await fetch(endpoint, {
+  const resp = await post(endpoint, apiKey, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'X-API-KEY': apiKey },
+    headers: { 'Content-Type': 'application/json', 'X-API-KEY': apiKey, 'User-Agent': USER_AGENT },
     body: JSON.stringify({
       jsonrpc: '2.0', id: nextId(), method: 'initialize', params: {},
     }),

package/skills/vike-cross-venue-perps/SKILL.md

@@ -1,52 +0,0 @@
----
-name: vike-cross-venue-perps
-description: Compare a single perp symbol across all venues — funding, price, spreads. Use when the user asks "where to trade X" / "compare BTC perp across exchanges" / "best venue for ETH long".
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-cross-venue-perps
-
-Per-symbol cross-venue analysis.
-
-## Steps
-
-1. Per-venue funding
-   ```bash
-   vike-data perp funding --symbol <SYM> --json
-   ```
-2. Per-venue spread
-   ```bash
-   vike-data perp spreads --symbol <SYM> --json
-   ```
-
-## Report template
-
-> **`<SYM>` perp — venue comparison**
->
-> | Venue | Mark price | Funding (daily %) | Bid-ask edge |
-> |---|---|---|---|
-> | Binance | ... | ... | ... |
-> | Bybit | ... | ... | ... |
-> | OKX | ... | ... | ... |
-> | Aster | ... | ... | ... |
-> | Hyperliquid | ... | ... | ... |
->
-> **Best venue to long**: `<X>` (lowest funding paid)
-> **Best venue to short**: `<Y>` (highest funding received)
-> **Arb edge**: long-short spread = X%/day
-
-## Reading
-
-- Negative funding on venue → shorts pay longs (longs receive). Good place to be long.
-- Positive funding → longs pay shorts. Good place to be short.
-- A wide divergence (>0.5%/day) between two venues with similar liquidity = arb edge worth quantifying.
-
-## Anti-patterns
-
-- Don't blindly pick the venue with lowest funding without checking liquidity — Hyperliquid funding looks great on small alts but the book might be thin.
-- Funding flips frequently; the read here is "as of now", not a forecast.
-
-## Pairs well with
-
-- `vike-perp-funding-arb` for the full opportunity list across all symbols
-- `vike-perp-screener` for market overview

package/skills/vike-hl-trader-profile/SKILL.md

@@ -1,65 +0,0 @@
----
-name: vike-hl-trader-profile
-description: Profile a single Hyperliquid perp trader — leaderboard rank, recent performance, on-chain identity. Use when the user gives an HL wallet address and asks "is this trader any good" / "profile this address" / "what's this wallet's HL track record".
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-hl-trader-profile
-
-Composite profile combining ranking, identity, and trading metrics.
-
-## Steps
-
-### 1. On-chain identity + balance
-
-```bash
-vike-data wallet summary <address> --json
-```
-
-Captures: total volume, inflow/outflow, tx count, unique tokens across ETH/BSC/Base. Tells you if the address is HL-only or also active on spot chains.
-
-### 2. HL leaderboard rank
-
-```bash
-vike-data perp top-traders --window 30d --sort pnl --size 20 --json
-vike-data perp top-traders --window 7d  --sort pnl --size 20 --json
-```
-
-Search the returned rows for the address. Report rank if found, "outside top 20" otherwise.
-
-### 3. ROI + win rate context
-
-```bash
-vike-data perp top-traders --sort roi --window 30d --min-trades 10 --size 20 --json
-vike-data perp top-traders --sort win_rate --window 30d --min-trades 10 --size 20 --json
-```
-
-Same address-search; report rank or "not in top 20".
-
-## Verdict template
-
-> **`<address>` — Hyperliquid trader profile (30d)**
-> - PnL: `$X` (rank #Y of top 20) or (outside top 20)
-> - ROI: `Z%` (rank ...) or (outside top 20)
-> - Win rate: `W%` over N trades
-> - Spot activity: `<volume_usd>` total across ETH/BSC/Base, `<tokens>` unique
-> - Classification: **whale / sharp / volume / one-shot / unverified**
-
-## Classification heuristics
-
-| Pattern | Label |
-|---|---|
-| Top-20 PnL + high ROI + many trades + low DD | **Sharp** |
-| Top-20 PnL + low ROI + huge volume | **Whale** (size matters more than skill) |
-| Outside leaderboard + high win rate on <10 trades | **Unverified — too few data points** |
-| One big trade dominates PnL | **One-shot** (lucky directional bet) |
-| Wallet age < 30d | **Too new — re-check in a month** |
-
-## Anti-patterns
-
-- Don't claim "this is one of the best HL traders" from win rate alone — need volume + trade count for context.
-- A wallet outside the top 20 isn't bad — only ~0.01% of HL wallets make top 20 in any window.
-
-## Pairs well with
-
-- `vike-hl-top-traders` for the leaderboard context

package/skills/vike-perp-funding-arb/SKILL.md

@@ -1,53 +0,0 @@
----
-name: vike-perp-funding-arb
-description: Find cross-venue funding-rate arbitrage opportunities on perpetual futures. Use when the user asks "any funding arb today" / "where to long-short X for funding" / "highest funding rates".
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-perp-funding-arb
-
-Cross-venue funding rates across Binance, Bybit, OKX, Aster, and Hyperliquid.
-
-## Commands
-
-### A. All arb opportunities (default)
-
-```bash
-vike-data perp funding --json
-```
-
-Returns pre-ranked rows where the spread between the highest-funding venue and the lowest is ≥ 0.3% (daily normalized). Each row already includes:
-- `symbol`
-- `long_exchange`, `long_daily_pct` (pay funding here)
-- `short_exchange`, `short_daily_pct` (receive funding here)
-- `spread_daily_pct`
-
-**These are pre-ranked — just cite the top N rows directly. No further sorting needed.**
-
-### B. Single symbol per-venue rates
-
-```bash
-vike-data perp funding --symbol BTC --json
-```
-
-Returns one row per venue: `{exchange, funding_rate_daily_pct, mark_price, ...}`.
-
-## Reading the arb
-
-```
-spread_daily_pct = 0.42%   →  ~$420/day per $100k notional, gross
-                              (before fees, slippage, transfer costs)
-```
-
-A funding arb at 0.4–1% daily is real. > 3% daily on a liquid pair is almost always a halted-trading / venue-mispricing artifact — verify with `vike-data perp spreads --symbol <sym>` to make sure the underlying spot/perp prices are sane.
-
-## Anti-patterns
-
-- Don't quote a daily funding rate as "annualized" without converting (× 365). Some users expect annual; some daily; be explicit.
-- Funding flips every 1–8 hours depending on the venue. The number you see is the current-window rate, not a forecast — don't extrapolate without saying so.
-- Spread < 0.3% daily is filtered out at the source (not enough to cover fees + execution). Don't try to lower the filter; below that the trade doesn't work.
-
-## Pairs well with
-
-- `vike-perp-spread-arb` to confirm spot/perp basis is sane
-- `vike-cross-venue-perps` for the full per-venue picture on one symbol

package/skills/vike-perp-screener/SKILL.md

@@ -1,48 +0,0 @@
----
-name: vike-perp-screener
-description: Snapshot the current state of perpetual-futures markets — funding rates, cross-venue spreads, and HL leaderboard in one read. Use when the user asks "what's happening in perps today" / "perp market overview".
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-perp-screener
-
-One-shot market overview for perpetuals.
-
-## Workflow (3 parallel calls)
-
-```bash
-vike-data perp funding --json &              # top funding-arb opportunities
-vike-data perp spreads --json &              # top spot-perp price spreads
-vike-data perp top-traders --window 1d --sort pnl --size 10 --json &
-wait
-```
-
-## Report template
-
-> **Perp market snapshot (last 24h)**
->
-> **Top funding arbs (>0.3% daily spread)**
-> - `BTC`: long Bybit @ -0.5%/d, short Hyperliquid @ +0.8%/d → spread 1.3%/d
-> - ...
->
-> **Top cross-venue price spreads (>0.5%)**
-> - `SOL`: buy Aster @ 138.20, sell OKX @ 139.05 → 0.61%
-> - ...
->
-> **Top HL traders last 24h (by PnL)**
-> - `0xabc...` +$X, rank #1 — ...
-> - ...
-
-## When to skip the 3-call screener
-
-- User asked specifically about one symbol → use `vike-cross-venue-perps` instead.
-- User asked about a single trader → use `vike-hl-trader-profile`.
-
-## Anti-patterns
-
-- Don't quote funding rates in 8h chunks when the underlying API returns daily — be consistent (daily %).
-- "Top by PnL last 24h" is noise for swing-trader narratives; only useful for "who's hot right now". Use 7d or 30d for skill claims.
-
-## Pairs well with
-
-- `vike-perp-funding-arb` for the funding-only deep dive

package/skills/vike-perp-spread-arb/SKILL.md

@@ -1,38 +0,0 @@
----
-name: vike-perp-spread-arb
-description: Cross-venue perp price spread (buy on venue A, sell on venue B). Use when the user asks "any perp arb today" / "price differences across exchanges" / "where's X cheapest".
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-perp-spread-arb
-
-## Command
-
-```bash
-vike-data perp spreads --json                 # full matrix, all symbols with spread >= 0.5%
-vike-data perp spreads --symbol BTC --json    # one specific symbol
-```
-
-## Output
-
-Pre-ranked rows: `symbol`, `buy_exchange`, `buy_price`, `sell_exchange`, `sell_price`, `spread_pct`.
-
-Outliers (> 400 bps off the cross-venue median) are filtered upstream — typically these are unit-mismatch listings like `1000SHIB` vs `SHIB`, or stale prices.
-
-## Reading
-
-`spread_pct = 0.7%` on a liquid pair = real arb opportunity, **before fees + transfer time**. Realistic net edge:
-- 30-60 bps after taker fees
-- Cross-venue settlement adds latency — fast inventory rotation matters more than per-trade size
-- Always check `vike-perp-funding-arb` for the same symbol — funding can amplify or kill the trade economics
-
-## Anti-patterns
-
-- Quoting a spread as "free money" without mentioning fees / transfer time
-- Trading 1000-token-suffix pairs without normalizing — `1000PEPE` on Binance ≠ `PEPE` on Bybit; if the spread looks insane it's probably this
-- Treating the buy/sell exchanges as static — the spreads update minute-by-minute; the row you see is current snapshot, not forecast
-
-## Pairs well with
-
-- `vike-perp-funding-arb` (combine for the full carry picture)
-- `vike-cross-venue-perps` for one-symbol depth

package/skills/vike-polymarket-screener/SKILL.md

@@ -1,59 +0,0 @@
----
-name: vike-polymarket-screener
-description: Polymarket market screener combining trending markets + smart-money flows + mispricings in one pass. Use when the user asks "give me a Polymarket overview" / "what's happening in prediction markets today".
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-polymarket-screener
-
-Composite playbook — 3 parallel calls for a complete prediction-market snapshot.
-
-## Workflow
-
-```bash
-vike-data polymarket markets --category all --limit 10 --json &
-vike-data polymarket smart-money --mode flows --hours 24 --json &
-vike-data polymarket smart-money --mode mispricings --hours 24 --json &
-wait
-```
-
-## Report template
-
-> **Polymarket snapshot (last 24h)**
->
-> **Top 5 trending markets by volume**
-> - `<question>` (`<category>`) — Yes mid `<m>`, 24h vol `$X` — ends `<date>`
-> - ...
->
-> **Top 5 smart-money inflows**
-> - `<title>` (`<slug>`) — `<smart_wallets>` cohort wallets, net inflow `$X`, latest Yes mid `<m>`
-> - ...
->
-> **Top 5 mispricings**
-> - `<title>` (`<side>`) — cohort avg buy `<p>`, current mid `<m>`, delta `<d>%`, cohort buy `$X`
-> - ...
-
-## When to use the focused skill instead
-
-| User asked | Use |
-|---|---|
-| "What's hot on Polymarket" (just lists) | `vike-polymarket-markets` only |
-| "Profile this PM wallet" | `vike-polymarket-trader` |
-| "Deep-dive market X" | `vike-polymarket-market-detail` |
-| "Smart-money signals" | `vike-polymarket-smart-money` |
-| "Full overview" or "give me everything" | This skill |
-
-## Cost note
-
-3 parallel tool calls = ~5 credits total.
-
-## Anti-patterns
-
-- Don't report all three sections if the user asked a narrower question. Trim aggressively.
-- Trending markets sorted by volume include resolved markets that closed earlier today — verify `end_date` if you're recommending a position.
-- `mispricings` mode requires `--hours` to be ≥ 6 for stable signal; below that, intraday noise dominates.
-
-## Pairs well with
-
-- `vike-polymarket-trader` — drill into any interesting wallet
-- `vike-polymarket-market-detail` — drill into any flagged market

package/skills/vike-router/SKILL.md

@@ -1,54 +0,0 @@
----
-name: vike-router
-description: Entry point — decide which vike skill to use. Read this first when the user asks anything about on-chain analytics, perps, prediction markets, wallets, or tokens.
-allowed-tools: Bash(vike-data:*)
----
-
-# vike-router
-
-Route the user's question to the right `vike-*` skill.
-
-## Routing table
-
-| User asks about ... | Use skill |
-|---|---|
-| Token by symbol/name → address | `vike-token-search` |
-| Token holders / who bought / sold | `vike-token-transfers` |
-| Token price chart / DEX OHLCV by contract address | `vike-token-research` |
-| Generic token research (everything) | `vike-token-research` |
-| Single wallet's metrics | `vike-wallet-summary` |
-| Top wallets / leaderboard | `vike-wallet-discover` |
-| "Find smart money on X" | `vike-smart-money-discovery` |
-| Perp funding rates / arb opportunities | `vike-perp-funding-arb` |
-| Cross-venue perp price spreads | `vike-perp-spread-arb` |
-| Top Hyperliquid perp traders | `vike-hl-top-traders` |
-| Match an HL share card → wallet (reverse-lookup) | `vike-hl-position-match` |
-| Profile a single HL perp trader | `vike-hl-trader-profile` |
-| HL market overview (vol/OI/funding) | `vike-perp-screener` |
-| Compare a symbol across all perp venues | `vike-cross-venue-perps` |
-| Historical candles (Hyperliquid perp/spot, Polymarket outcome token) | `vike-candles` |
-| Create / list / edit alerts | `vike-alerts-setup` |
-| Auth / setup / "I just installed it" | `vike-core` |
-
-## Quick command map
-
-```
-vike-data token   search | transfers | screener | holders
-vike-data wallet  summary | discover
-vike-data perp    funding | spreads | top-traders
-vike-data candles hl <symbol> | polymarket <token_id>
-vike-data alerts  list | channels | create | edit | delete
-vike-data init | doctor | schema | whoami | login | logout
-```
-
-## Bias
-
-- If unsure between two skills, prefer the **task skill** (specific workflow) over the **per-tool skill** (single command).
-- If the user wants raw data, use the per-tool skill with `--json`.
-- If the user is exploring, lead with `vike-data schema --pretty` to show what's available.
-
-## Cost note
-
-Cheap (free-tier safe): `token search`, `wallet summary`, `alerts list`, `schema`, `doctor`, `whoami`.
-
-Heavier (count against quota): `wallet discover` (full pages), `perp top-traders` (large filters), `token transfers` (long periods).