@vike-io/cli 0.15.0 → 0.16.1

package/skills/vike-wallet-balances/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: vike-wallet-balances
-description: Current token balances for a wallet on the chains the server scans (Ethereum and BSC today), read from the chain at request time, with a USD value where the token is priced. Use when the user asks "what does this wallet hold" / "current portfolio of X" / "show top holdings".
+description: Current token balances for a wallet on Ethereum, BSC, Base and HyperEVM, read from the chain at request time, with a USD value where the token is priced. Use when the user asks "what does this wallet hold" / "current portfolio of X" / "show top holdings".
 allowed-tools: Bash(vike-data:*)
 ---
 
@@ -10,12 +10,12 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet balances <address>
-  [--chains ethereum,bsc]   (default: every chain the server scans)
+  [--chains ethereum,bsc,base,hyperevm]   (default: all four)
   [--min-usd 1]             (hide holdings worth less; default 1)
   [--json]
 ```
 
-`vike-data schema --pretty` shows the current chain list. A chain the tool does not scan is not silently skipped: it is named in `chain_errors`.
+Scanning all four chains is slow (tens of seconds for a busy wallet): pass `--chains` with the chain you need. Any other chain (arbitrum, polygon...) is not skipped silently: it is named in `chain_errors`. Each holding carries its own `chain`, so this is also the quickest way to see WHERE a wallet's value is before choosing `--chain` for the per-chain wallet commands.
 
 ## Example
 
@@ -33,17 +33,19 @@ vike-data wallet balances 0xd8da6bf26964af9d7eed9e03e53415d37aa96045 --chains et
   "holdings": [
     { "chain": "ethereum", "symbol": "ENS", "name": "Ethereum Name Service", "address": "0xc183...", "balance": 1144.04, "balance_raw": "1144036076063671431479", "usd_value": 6843.62, "usd_price": 5.982 },
     { "chain": "ethereum", "symbol": "WEI", "address": "0x0000...", "balance": 1.0, "balance_raw": "1", "usd_value": null, "usd_price": null },
-    { "chain": "ethereum", "symbol": "ETH", "name": "ETH", "address": null, "balance": 2.5, "balance_raw": "2500000000000000000", "usd_value": null, "usd_price": null }
+    { "chain": "ethereum", "symbol": "ETH", "name": "ETH", "address": null, "balance": 2.5, "balance_raw": "2500000000000000000", "usd_value": 9500.0, "usd_price": 3800.0 }
   ]
 }
 ```
 
-Holdings are sorted by `usd_value` descending with unpriced rows (the native coin among them) last. `chain_errors` appears only when a requested chain was refused or failed.
+Holdings are sorted by `usd_value` descending with unpriced rows last. `chain_errors` appears only when a requested chain was refused or failed.
 
 ## Reading
 
 - **`usd_value: null` is a holding, not an error**: the token has no price feed. `total_usd` sums only priced holdings, so read it as a floor, never as net worth, and never infer "worthless" from a null.
-- **The chain's native coin (ETH, BNB) is a row** with `usd_value: null`, and it is **left out of `total_usd`**. Report the native balance from its own `balance` field. It is always listed, whatever `--min-usd` says.
+- **The chain's native coin (ETH, BNB, HYPE) is a row** whenever its balance is not zero, whatever `--min-usd` says, with a USD value (counted in `total_usd`) where a price exists.
+- **On `base` and `hyperevm` a row has `symbol`, `name`, `balance` and `usd_value` only for tokens we map and price** (about 170 on base, about 50 on hyperevm). `--min-usd 0` adds every other token the wallet holds, with its contract `address` and `balance_raw` and the rest `null`: often thousands of airdrop-spam rows, so use it deliberately.
+- `hyperevm` is the HyperEVM chain only: HyperCore (Hyperliquid spot or perp accounts) is not included; Hyperliquid perp equity is `vike-data hl wallet <address>`.
 - **Any `--min-usd` above 0 also drops unpriced holdings** (an unpriced holding cannot show it clears the floor). `--min-usd 0` lists everything, including airdrop spam.
 - `total_usd` covers `chains_scanned` only. The wallet may hold value on chains the tool does not scan: say so when relevant.
 - Stablecoin-heavy wallet → likely waiting for a buy / parked dry powder
@@ -53,7 +55,7 @@ Holdings are sorted by `usd_value` descending with unpriced rows (the native coi
 
 ## Anti-patterns
 
-- Don't report `total_usd` as the wallet's value without "of priced tokens" and the native balance next to it.
+- Don't report `total_usd` as the wallet's value without "of priced tokens".
 - For wallets with 100+ tokens, the response is large — use `--min-usd 100` or higher to focus on meaningful holdings.
 - This is a point-in-time read, not history. For how the wallet got here use `wallet pnl-history`.
 

package/skills/vike-wallet-batch/SKILL.md

@@ -10,7 +10,7 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet batch <addr1> <addr2> <addr3> ...
-  [--chain ethereum|bsc|base]     # default ethereum; labels and flows are read from THAT chain's tables
+  [--chain ethereum|bsc|base|hyperevm]     # default ethereum; labels and flows are read from THAT chain's tables
   [--json]
 ```
 
@@ -37,8 +37,8 @@ One row per INPUT address (preserves input order — useful when joining back to
 ## Chain behaviour
 
 - `--chain` picks the label table and the 30-day flow table. Before 2026-10-19 it was accepted and ignored (`bsc` and `base` returned Ethereum labels), so earlier results for those chains are Ethereum's.
-- **The four 30-day fields (`net_30d_usd`, `volume_30d_usd`, `tx_30d`, `tokens_30d_count`) are `null`, not 0,** where we hold no flow data: every `bsc` address, and any address we have no label for (`found: false`). Don't report null as zero activity.
-- `found: false` = the address is not in that chain's label table. It is not proof the wallet is new or clean.
+- **The four 30-day fields (`net_30d_usd`, `volume_30d_usd`, `tx_30d`, `tokens_30d_count`) are `null`, not 0,** for an address we have no label for (`found: false`). Don't report null as zero activity.
+- `found: false` = the address is not in that chain's label table. It is not proof the wallet is new or clean. Labels are sparse on `hyperevm`, so most rows there will be `found: false`.
 
 ## Reading
 

package/skills/vike-wallet-compare/SKILL.md

@@ -10,13 +10,13 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet compare <address_a> <address_b>
-  [--chain ethereum|bsc|base]
+  [--chain ethereum|bsc|base|hyperevm]
   [--window 24h|7d|30d|90d|180d|all]
   [--limit N]   (max 50)
   [--json]
 ```
 
-Compares exactly two wallets. `--chain base` is accepted, but per-wallet transfer data is documented for Ethereum and BSC: treat an empty Base result as "not covered", not "no shared activity".
+Compares exactly two wallets on one chain (`ethereum`, `bsc`, `base` or `hyperevm`; shared-counterparty labels come from that chain's own label table). Busy wallets are slow (about 20 s for a pair of market makers). For the full verdict with exchanges and routers removed, use `vike-wallets-related`.
 
 ## Output
 

package/skills/vike-wallet-counterparties/SKILL.md

@@ -10,13 +10,13 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet counterparties <address>
-  [--chain ethereum|bsc|base]
+  [--chain ethereum|bsc|base|hyperevm]
   [--window 24h|7d|30d|90d|180d|all]
   [--limit N]   (max 50)
   [--json]
 ```
 
-`--chain base` is accepted, but per-wallet transfer data is documented for Ethereum and BSC: treat an empty Base result as "not covered", not "no activity".
+Chains: `ethereum`, `bsc`, `base`, `hyperevm`. `entity` / `wallet_type` come from THAT chain's label table (empty string when unlabelled). `wallet summary` names the chain it answered for; run this per chain for the others.
 
 ## Example
 

package/skills/vike-wallet-discover/SKILL.md

@@ -13,11 +13,13 @@ vike-data wallet discover
   [--window 24h|7d|30d|90d|all]
   [--sort volume|inflow|outflow|net_flow|tx_count|pnl]
   [--order asc|desc]
-  [--chain ethereum|bsc]
+  [--chain ethereum|bsc|base|hyperevm]
   [--size N]      # default 10, max 20
   [--json]
 ```
 
+**On `base` and `hyperevm` pass `--window all`**: the command sends `30d` by default, and the shorter windows there answer only while they were rebuilt in the last 2 days (otherwise a 400). `ethereum` and `bsc` take every window.
+
 ## When to use
 
 | Question | Flags |

package/skills/vike-wallet-ens/SKILL.md

@@ -25,12 +25,12 @@ vike-data wallet ens 0x28c6c06298d514db089934071355e5743bf21d60
 ## When to use
 
 - Right after any tool returns a wallet address — show ENS as a secondary label
-- When the user pastes an address and asks "what is its ENS name" (for "who is this", start with `vike-data labels <addr>`; ENS is a display name, not an identity)
+- When the user pastes an address and asks "what is its ENS name" (for "who is this", use `vike-wallet-who-is`; ENS is a display name, not an identity)
 - When you're about to display a leaderboard with addresses — enrich each row with ENS if available
 
 ## Direction
 
-**Reverse only: address → name.** There is no name → address lookup: if the user gives `vitalik.eth`, say the tool cannot resolve it and ask for the address. The only parameter is `address`.
+**Reverse only: address → name.** This command has no name → address lookup; for `vitalik.eth` run `vike-data search vitalik.eth`, which searches the address the name points to. The only parameter is `address`.
 
 ## Anti-patterns
 

package/skills/vike-wallet-label-provenance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: vike-wallet-label-provenance
-description: Multi-source label cascade for an Ethereum wallet — shows what each upstream label source AND our in-house heuristic classifier says about an address, with consensus entity/type and per-source attribution. Use when the user asks "who is this address" / "what do you know about this wallet" / "is this address labeled" / "why is this wallet labeled X".
+description: Multi-source label cascade for an Ethereum wallet — shows what each upstream label source AND our in-house heuristic classifier says about an address, with consensus entity/type and per-source attribution. Use when the user asks "what do the label sources say about 0x..." / "is this address labeled" / "why is this wallet labeled X" / "do the sources agree on this label".
 allowed-tools: Bash(vike-data:*)
 ---
 
@@ -14,7 +14,7 @@ The headline differentiator: we don't just show a label, we show **which sources
 vike-data labels <address> [--json]
 ```
 
-Ethereum wallets only. For another chain, or many addresses, use `vike-data wallet batch --chain ethereum|bsc|base`, which reads each chain's own label table.
+Ethereum wallets only. For another chain, or many addresses, use `vike-data wallet batch --chain ethereum|bsc|base|hyperevm`, which reads each chain's own label table. For "who is this wallet" as a whole (labels, ENS, chain, exchanges, counterparties) use `vike-wallet-who-is`.
 
 ## Example
 
@@ -56,7 +56,7 @@ Sources are anonymised on the wire (`provider_a`, `provider_b`, ...). There are
 - **Only 1 source (± heuristic)** → moderate; mention "labeled by one source"
 - **Only the heuristic** → low; mention "predicted by heuristic"
 - **`found: true` with no sources** → the wallet is in our label table but no raw source labels it
-- **`found: false`** → the wallet is missing from our labelled-wallet table, and no source is consulted at all. It does NOT prove that no provider labels it. Say "not in our label table", not "unlabeled" or "clean".
+- **`found: false`** → every source was read and none knows the address, and it is not in our label table (`found` is true when ANY source knows it). It does NOT prove the wallet is clean or new: our sources do not cover every wallet. Say "no label source knows it", not "clean".
 
 Early answers (before 2026-10-19) carried only the Arkham-derived source and the heuristic, so older transcripts undercount sources.
 
@@ -64,7 +64,8 @@ Early answers (before 2026-10-19) carried only the Arkham-derived source and the
 
 - Don't quote any single provider's category field as "the category" — provider taxonomies vary; the `consensus.wallet_type` is the unified field.
 - A `risk_flag` of `scam` / `sanctioned` / `phishing` is high-stakes — always mention it explicitly, never bury it.
-- Don't use this for a BSC or Base address: it reads Ethereum tables only.
+- Don't use this for a BSC, Base or HyperEVM address: the consensus reads Ethereum tables only (only source `provider_e`, Polymarket wallets and their funders, answers on any EVM chain).
+- `consensus.wallet_type` can be wrong when sources disagree (the entity "vitalik buterin" read `dex` because one source says sushiswap): read the `sources` before trusting the type.
 
 ## Pairs well with
 

package/skills/vike-wallet-pnl-history/SKILL.md

@@ -10,12 +10,12 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet pnl-history <address>
-  [--chain ethereum|bsc|base]
+  [--chain ethereum|bsc|base|hyperevm]
   [--days N]   (max 365, default 30)
   [--json]
 ```
 
-`--chain base` is accepted, but per-wallet transfer data is documented for Ethereum and BSC: treat an empty Base result as "not covered", not "no activity".
+Chains: `ethereum`, `bsc`, `base`, `hyperevm`, one chain per call.
 
 ## Output
 

package/skills/vike-wallet-portfolio/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: vike-wallet-portfolio
-description: Composite wallet view — combines ENS + labels + token balances + recent flow + top counterparties in one report. Use when the user gives a wallet address and asks for a complete picture ("full report on X" / "everything about this wallet" / "wallet snapshot" / "who is this wallet").
+description: Holdings-and-activity snapshot of one wallet — ENS, labels, token balances across Ethereum, BSC, Base and HyperEVM, recent flow and top counterparties in one report. Use when the user gives a wallet address and asks for a complete picture ("full report on X" / "everything about this wallet" / "wallet snapshot" / "what does this wallet hold and do").
 allowed-tools: Bash(vike-data:*)
 ---
 
 # vike-wallet-portfolio
 
-Multi-call playbook for a complete wallet snapshot. It reports what the tools return: identity, token balances, flows and counterparties. There is **no DeFi-position data** in any tool, so never report protocol positions.
+Multi-call playbook for a complete wallet snapshot. It reports what the tools return: identity, token balances, flows and counterparties. There is **no DeFi-position data** in any tool, so never report protocol positions. For identity alone ("who is this", "is it an exchange") use `vike-wallet-who-is`.
 
 ## Workflow (run in parallel where possible)
 
@@ -15,20 +15,20 @@ ADDR=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045
 
 vike-data wallet ens     $ADDR --json &     # 1 credit
 vike-data labels         $ADDR --json &     # 1 credit
-vike-data wallet summary $ADDR --json &     # 2 credits
-vike-data wallet balances $ADDR --json &    # 3 credits (Ethereum and BSC)
-vike-data wallet counterparties $ADDR --window 30d --limit 10 --json &   # 2 credits
+vike-data wallet summary $ADDR --json &     # 2 credits - names its `chain`
+vike-data wallet balances $ADDR --json &    # 3 credits - all four chains; add --chains to narrow (faster)
 wait
+vike-data wallet counterparties $ADDR --chain <summary.chain> --window 30d --limit 10 --json   # 2 credits
 ```
 
-Then label the counterparties in one call: `vike-data wallet batch <cp1> <cp2> ... --json` (2 credits). A top counterparty that is a CEX tells you which exchange the wallet uses; an unlabelled high-volume counterparty is worth a `wallet compare` or `wallet trace`.
+Then label the counterparties with an empty `entity` in one call: `vike-data wallet batch <cp1> <cp2> ... --chain <summary.chain> --json` (2 credits). A top counterparty that is a CEX tells you which exchange the wallet uses; an unlabelled high-volume counterparty is worth a `wallet compare` or `wallet trace`.
 
 ## Report template
 
 > **`<ENS or 0x...>` — wallet snapshot**
 > - **Identity:** `<ens.eth>` · `<entity (from labels)>` · `<wallet_type>` (confidence: `<H/M/L>`). If `labels` says `found: false`, say "not in our label table".
-> - **Priced token holdings:** `$X` (floor: unpriced tokens and the native coin are excluded from the total) across `<chains_scanned>`. Top 3 by USD: `<symbol1 $X>`, ... Native balance: `<n ETH/BNB>`.
-> - **30d flow:** `+/-$Z` net (`summary["30d"].net_flow`), one chain.
+> - **Priced token holdings:** `$X` (floor: unpriced tokens are excluded; on Base and HyperEVM only mapped and priced tokens show) across `<chains_scanned>`. Top 3 by USD: `<symbol1 $X on chain>`, ... Native balance: `<n ETH/BNB/HYPE>`.
+> - **30d flow on `<chain>`:** `+/-$Z` net (`summary["30d"].net_flow`), one chain.
 > - **Activity:** `<tx_count>` transfers in 30d, `<tokens_traded>` tokens traded all-time.
 > - **Top counterparties:** `<entity or address>` · `$volume`, ...
 > - **Vibe check:** `<saver / trader / farmer / institutional / inactive / fresh>`
@@ -51,9 +51,11 @@ Then label the counterparties in one call: `vike-data wallet batch <cp1> <cp2> .
 
 ## When to use a focused skill instead
 
+- "Who is X" / "is it an exchange" → `vike-wallet-who-is`
 - "Just labels for X" → `vike-wallet-label-provenance`
 - "What does X hold" → `vike-wallet-balances`
 - "Top counterparties of X" → `vike-wallet-counterparties`
+- "X's Hyperliquid account" → `vike-hl-trader-profile`
 
 ## Pairs well with
 

package/skills/vike-wallet-summary/SKILL.md

@@ -12,19 +12,19 @@ allowed-tools: Bash(vike-data:*)
 vike-data wallet summary <address> [--json]
 ```
 
-No chain flag: one call returns every window, for one chain.
+No chain flag: one call returns every window, for one chain. To ask a given chain use the tool directly: `vike-data call wallet_summary --args '{"address":"0x...","chain":"base"}'` (`ethereum`, `bsc`, `base` or `hyperevm`).
 
 ## Output
 
-A JSON object keyed by window: `all`, `90d`, `30d`, `7d`, `24h`. Each window holds:
+A JSON object with a `chain` field and one block per window: `all`, `90d`, `30d`, `7d`, `24h`. Each window holds:
 
 `total_volume`, `total_inflow`, `total_outflow`, `net_flow` (USD), `tx_count`, `tokens_traded`, `first_seen`, `last_active`.
 
-- **One chain only.** The figures are for the chain where the wallet was most recently active, never summed across chains, and the response does not say which. For a specific chain use `wallet transactions --chain` or `wallet pnl-history --chain`.
-- **`tokens_traded`, `first_seen` and `last_active` are all-time** and repeat in every window: read them from `all` and ignore the copies. There is no per-window token count.
+- **One chain only, named in `chain`.** Without a chain the figures are for the more recently active of Ethereum and BSC, never summed; Base or HyperEVM answer only for a wallet with no priced Ethereum or BSC volume. Always say which chain the numbers are for; `wallet balances` shows which chain holds the value.
+- **`tokens_traded` is per window** (distinct tokens moved in it). **`first_seen` and `last_active` are all-time** and repeat in every window: read them from `all`.
 - A window with no activity is present and zeroed (`24h` often is), not omitted.
 - Refreshed nightly: a wallet active in the last hours may not show yet.
-- It carries no PnL, no holdings, no labels and no Hyperliquid data. For those: `wallet balances`, `labels` / `wallet batch`, and `perp top-traders`.
+- It carries no PnL, no holdings, no labels and no Hyperliquid data. For those: `wallet balances`, `labels` / `wallet batch`, and `hl wallet`.
 
 ## Reading tips
 
@@ -39,7 +39,7 @@ A JSON object keyed by window: `all`, `90d`, `30d`, `7d`, `24h`. Each window hol
 
 - Don't claim a wallet is "smart money" based on summary alone: it has no PnL. Check labels with `vike-data labels <addr>` or `vike-data wallet batch`.
 - A single big inflow can dominate `net_flow` for a window — eyeball `tx_count` to gauge whether it's one trade or many.
-- Don't describe the result as "across ETH/BSC/Base": it is one chain.
+- Don't describe the result as "across ETH/BSC/Base/HyperEVM": it is one chain.
 
 ## Pairs well with
 

package/skills/vike-wallet-trace/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: vike-wallet-trace
-description: Counterparty graph traversal from a root wallet outward. At each hop, expand to the top N counterparties by USD volume; edges carry the direction of the flow. Use when the user asks "where did funds from X go" / "follow the money 3 hops out" / "trace the network around this wallet" / wallet investigation.
+description: Counterparty graph traversal from a root wallet outward. At each hop, expand to the top N counterparties by USD volume; edges carry the direction of the flow. Use when the user asks for "the counterparty graph of X" / "trace 3 hops around this wallet" / "show the network around X" / "who is connected to this wallet within N hops".
 allowed-tools: Bash(vike-data:*)
 ---
 
@@ -10,7 +10,7 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet trace <address>
-  [--chain ethereum|bsc|base]
+  [--chain ethereum|bsc|base|hyperevm]
   [--depth N]    (1-5, default 2)
   [--width N]    (1-10, default 5)
   [--window 24h|7d|30d|90d|all]
@@ -18,7 +18,7 @@ vike-data wallet trace <address>
   [--json]
 ```
 
-`--chain base` is accepted, but per-wallet transfer data is documented for Ethereum and BSC: treat an empty Base result as "not covered", not "no activity".
+Chains: `ethereum`, `bsc`, `base`, `hyperevm`; node labels come from that chain's own label table. The command expands each hop by combined volume in both directions; the tool also takes `direction` `out` (where funds went) or `in` (where they came from), reached with `vike-data call wallet_trace --args '{"address":"0x...","direction":"out","depth":2}'`.
 
 ## Output
 
@@ -87,3 +87,4 @@ Tell them to click the **Graph** tab. It renders the same trace data as a force-
 - `vike-data labels <addr>` / `vike-data wallet batch <addr...>` — identify the nodes
 - `vike-data wallet compare <addr_a> <addr_b>` — confirm relatedness once trace surfaces candidates
 - `vike-data wallet transactions <addr>` — drill into specific transfers between two nodes
+- `vike-follow-the-money` — the incident playbook (order of calls, stop rules, a live watch); `vike-wallets-related` — evidence of a shared owner

package/skills/vike-wallet-transactions/SKILL.md

@@ -10,7 +10,7 @@ allowed-tools: Bash(vike-data:*)
 
 ```bash
 vike-data wallet transactions <address>     # alias: vike-data wallet txs
-  [--chain ethereum|bsc|base]
+  [--chain ethereum|bsc|base|hyperevm]
   [--direction in|out|all]
   [--days N]   (max 365)
   [--limit N]  (max 500)
@@ -19,7 +19,7 @@ vike-data wallet transactions <address>     # alias: vike-data wallet txs
   [--json]
 ```
 
-`--chain base` is accepted, but per-wallet transfer data is documented for Ethereum and BSC: treat an empty Base result as "not covered", not "no activity".
+Chains: `ethereum`, `bsc`, `base`, `hyperevm`. The same address has a separate history per chain: pass `--chain` for each.
 
 ## Examples
 

package/skills/vike-wallet-who-is/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: vike-wallet-who-is
+description: Say who is behind one EVM address from vike's search, its label sources, ENS name, the chain it is active on, the exchanges it uses and its biggest counterparties. Tells an exchange, fund, market maker or contract from an ordinary user. Use when the user asks "who is 0x..." / "whose wallet is this" / "is this an exchange or a fund" / "which exchange does this wallet use" / "what kind of wallet is this".
+allowed-tools: Bash(vike-data:*)
+---
+
+# vike-wallet-who-is
+
+Identity playbook for ONE address: what vike already calls it, labels, ENS, the chain that matters, which exchanges and wallets it moves money with. About 12 credits. For holdings and a flow snapshot use `vike-wallet-portfolio`.
+
+## Chain
+
+```bash
+ADDR=0x28C6c06298d514Db089934071355E5743bf21d60
+vike-data search $ADDR --json                    # 1  entity, HL trader, vault, builder, Polymarket wallet: whatever vike knows it as
+vike-data labels $ADDR --json                    # 1  label sources + consensus (Ethereum label table)
+vike-data wallet ens $ADDR --json                # 1  reverse ENS; "ens" can be null
+vike-data wallet summary $ADDR --json            # 2  READ its `chain` field before anything else
+vike-data wallet exchange-usage $ADDR --chain <summary.chain> --window 365d --json        # 3  which exchanges, with USD and shares
+vike-data wallet counterparties $ADDR --chain <summary.chain> --window 90d --limit 20 --json   # 2
+vike-data wallet batch <counterparties with an empty entity> --chain <summary.chain> --json    # 2, max 100 addresses
+```
+
+Chains: `ethereum`, `bsc`, `base`, `hyperevm` on every wallet command here. The user gave a name, not an address? `vike-data search vitalik.eth` searches the address an ENS name points to.
+
+## Reading each step
+
+- **`search`**: its `wallets`, `traders`, `vaults`, `builders` and `polymarket` sections say where vike already knows the address (a labelled entity, a Hyperliquid trader, a Polymarket proxy and its owner). Empty sections are not evidence of anything.
+- **`labels`**: `found: false` = not in our label table; it is not proof the wallet is an ordinary user. Otherwise read `consensus` (`entity`, `wallet_type`, `confidence`, `risk_flag`) AND `sources[]`. When sources disagree the consensus type can be wrong: for `0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045` the entity is "vitalik buterin" but `wallet_type` read `dex` because one source says "sushiswap". Report the entity the sources agree on, not the type.
+- **`summary.chain`** is the more recently active of ethereum and bsc, never a sum; base or hyperevm only for a wallet with no priced ethereum/bsc volume. If the figures look tiny, run `vike-data wallet balances $ADDR` (each holding carries its `chain`) and ask that chain directly: `vike-data call wallet_summary --args '{"address":"0x...","chain":"base"}'`.
+- **`exchange-usage`**: `exchanges[]` with `sent_usd`, `recv_usd`, `sent_share`, first and last seen; `pattern: "sweeps_to_single_cex"` means 90%+ of its outgoing USD went to one exchange: an OBSERVED pattern, not proof it is a deposit address. Figures are a lower bound (an unlabelled exchange address is invisible; labels are sparse on hyperevm). A very active wallet is refused over a long window: narrow `--window`.
+- **`counterparties`** rows already carry `entity` and `wallet_type` (empty string when unlabelled); only the empty ones need `wallet batch`, which adds `confidence`, `risk_flag` and 30-day flow from that chain's own tables.
+- **The wallet itself is `cex`**: it is the exchange's own wallet, not a person. `wallet_type: dex` on a counterparty is a router or pool: many of them = an active trader, not a relationship.
+- Optional, "who funded it": `vike-data wallet first-funder $ADDR --chain <chain>` gives the earliest inbound coin and token transfers with the senders' labels. It is not proof of the funder: contract calls and bridges are absent and history starts on a different date per chain (`coverage.history_from`).
+
+## Answer template
+
+> `<ENS or 0x...>` is `<entity>` (`<wallet_type>`, confidence `<c>`, `<n>` sources agree). Active on `<chain>`; 90d volume `$X`, last active `<date>`. Exchanges: `<entity>` `$sent` / `$received`. It mostly deals with `<top labelled counterparties>`; the largest unlabelled counterparty is `<0x...>` ($V). `<Not labelled: say so.>`
+
+## Anti-patterns
+
+- Don't name a real-world person from a label, and don't claim two wallets share an owner: that is `vike-wallets-related`, and it is evidence, not proof.
+- Don't read `summary` as the wallet's whole activity: it is one chain.
+- Don't call a wallet "clean" because `risk_flag` is empty or `found` is false.
+
+## Pairs well with
+
+- `vike-wallet-label-provenance` for the raw per-source labels, `vike-wallet-portfolio` for holdings
+- `vike-follow-the-money` to see where its money went, `vike-wallets-related` to test a link between two addresses
+- `vike-hl-trader-profile` when `search` lists it as a Hyperliquid trader, `vike-polymarket-trader` for a Polymarket wallet

package/skills/vike-wallets-related/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: vike-wallets-related
+description: Gather evidence on whether two wallets, or a wallet and its possible siblings, belong to the same entity - labels, first funders, shared counterparties and tokens with exchanges and routers removed, direct links, a depth-2 trace - with confidence tiers. Use when the user asks "are these wallets the same person" / "find wallets related to 0x..." / "is this a sybil cluster" / "does B belong to A".
+allowed-tools: Bash(vike-data:*)
+---
+
+# vike-wallets-related
+
+Evidence, never proof: no tool exposes a deposit-address owner or a cluster id. Cap the cluster at 10 wallets and ask before widening. About 20-30 credits.
+
+## Chain
+
+```bash
+vike-data labels $A --json                                           # 1  A and B: same entity already?
+vike-data labels $B --json
+vike-data wallet first-funder $A --json                              # 2  earliest inbound coin and token, sender labelled
+vike-data wallet first-funder $B --json
+vike-data wallet compare $A $B --window 90d --limit 50 --json        # 3, up to ~20 s on busy wallets
+vike-data wallet batch <shared counterparties> --json                # 2  label them, drop exchanges and routers
+vike-data wallet trace $A --depth 2 --width 10 --window 90d --min-usd 1000 --json   # 4  is B in A's neighbourhood?
+```
+
+Add `--chain bsc|base|hyperevm` to every wallet command when the wallets live there (default ethereum); `labels` reads the Ethereum label table, so on other chains use `wallet batch --chain`.
+
+## Siblings mode (only A is known)
+
+`wallet counterparties $A --window 90d --limit 50`, label them with `wallet batch`, drop `cex`, `dex`, `market_maker` and contract rows, keep the highest-volume unlabelled or `user` wallets, then `wallet compare $A <candidate>` for the top 3-5, `wallet first-funder` on each, and `wallet trace` once. Stop at 10 wallets.
+
+## Reading
+
+- `compare` returns `shared_counterparties` (`wallet`, `a_volume_usd`, `b_volume_usd`, `entity`, `wallet_type`) and `shared_tokens`. The big shared rows are almost always an exchange, a router or USDT/USDC/the native coin: in a live market-maker pair the top shared counterparties were Binance, another wallet of the same firm and Coinbase, the shared tokens ETH, USDT and USDC. **Remove CEX, router and stablecoin overlap before counting anything.**
+- **Direct links**: B appearing as a node of A's trace (an edge with `out_usd` or `in_usd` > 0 between them) is stronger than any overlap.
+- **First funders**: the same non-exchange sender in `first_native_in` or `first_token_in` of both is a link; the same exchange hot wallet is not (everyone withdrawing from it shares it). Native rows hold top-level sends only and history starts per chain (`coverage.history_from`): no match is not evidence against.
+
+| Tier | Evidence |
+|---|---|
+| High | the same entity in `labels` / `batch` for both; or a direct transfer between them AND a shared non-CEX counterparty |
+| Medium | several shared non-exchange counterparties AND shared niche tokens (not stablecoins/ETH); one direct link of size; or the same non-exchange first funder |
+| Low / none | overlap only through exchanges, routers, stablecoins; matching ENS style; funding from the same CEX |
+
+State the tier and the list of what was removed.
+
+## Anti-patterns
+
+- Don't claim "same person" from a shared CEX hot wallet: everyone who uses that exchange shares it.
+- Don't trace through exchanges or past 10 wallets; don't trace at `--min-usd 0`.
+- Don't call two wallets unrelated from one chain: run the commands on the chain where both are active (`wallet balances` shows where the value is).
+
+## Pairs well with
+
+- `vike-wallet-who-is`, `vike-wallet-compare`, `vike-wallet-counterparties`, `vike-wallet-trace`, `vike-wallet-batch`
+- `vike-polymarket-trader`: for Polymarket wallets, `polymarket wallet` returns `correlated`, the wallets trading the same markets

package/skills.sh.json

@@ -4,35 +4,41 @@
   "groupings": [
     {
       "title": "Quick start",
-      "description": "Start here. The umbrella skill routes user questions to the right specialized skill below; vike-core covers install and auth.",
+      "description": "Start here. The umbrella skill routes user questions to the right specialized skill below; vike-core covers install and auth; vike-daily-brief is a cheap cross-market rundown.",
       "skills": [
         "vike",
-        "vike-core"
+        "vike-core",
+        "vike-daily-brief"
       ]
     },
     {
       "title": "Tokens",
-      "description": "Resolve, screen, and research tokens on Ethereum, BSC and Base. Smart-money inflow (Ethereum), holders, top buyers and sellers.",
+      "description": "Resolve, screen, and research tokens on Ethereum, BSC, Base and HyperEVM. Smart-money inflow and its trend over time (Ethereum), holders and holder due diligence, top buyers and sellers.",
       "skills": [
         "vike-token-search",
         "vike-token-research",
         "vike-token-transfers",
         "vike-token-holders",
+        "vike-token-holder-diligence",
         "vike-token-screener",
-        "vike-smart-money-discovery"
+        "vike-smart-money-discovery",
+        "vike-token-smart-money-trend"
       ]
     },
     {
       "title": "Wallets",
-      "description": "Per-wallet profile, flows, counterparty graphs, ENS, batch labelling, label provenance.",
+      "description": "Who a wallet is, per-wallet profile, flows, counterparty graphs, incident tracing, relatedness evidence, ENS, batch labelling, label provenance, on Ethereum, BSC, Base and HyperEVM.",
       "skills": [
+        "vike-wallet-who-is",
         "vike-wallet-summary",
         "vike-wallet-portfolio",
         "vike-wallet-discover",
         "vike-wallet-transactions",
         "vike-wallet-counterparties",
         "vike-wallet-trace",
+        "vike-follow-the-money",
         "vike-wallet-compare",
+        "vike-wallets-related",
         "vike-wallet-batch",
         "vike-wallet-pnl-history",
         "vike-wallet-balances",
@@ -42,18 +48,25 @@
     },
     {
       "title": "CEX perps",
-      "description": "Funding-rate arb and per-symbol venue comparison, plus cross-venue perp price gaps and a market snapshot.",
+      "description": "Funding-rate arb and per-symbol venue comparison, cross-venue perp price gaps, open interest and long/short lean per venue, and a crowding read that nets open interest against price.",
       "skills": [
         "vike-perp-funding",
-        "vike-perp-overview"
+        "vike-perp-overview",
+        "vike-perp-crowding"
       ]
     },
     {
       "title": "Hyperliquid perps",
-      "description": "Top traders, one wallet's profile and activity, and share-card reverse-lookup; the `vike-data hl` commands are routed by the umbrella skill.",
+      "description": "Top traders and leaderboards, one-wallet profiles, wallet-cohort positioning and its backtest method, single-symbol briefings, liquidation risk, builder codes, and share-card reverse-lookup.",
       "skills": [
         "vike-hl-top-traders",
-        "vike-hl-position-match"
+        "vike-hl-trader-profile",
+        "vike-hl-position-match",
+        "vike-hl-cohort-positioning",
+        "vike-hl-cohort-backtest",
+        "vike-hl-asset-briefing",
+        "vike-hl-liquidation-radar",
+        "vike-hl-builder-intel"
       ]
     },
     {
@@ -65,12 +78,14 @@
     },
     {
       "title": "Polymarket",
-      "description": "Prediction-market discovery, single-market deep-dives, trader profiles, and smart-money signals with a market overview.",
+      "description": "Prediction-market discovery, single-market deep-dives and due diligence (order book, tape, trades with wallets, holders, on-chain settlement), trader profiles, smart-money signals, and the free L2 Parquet archive.",
       "skills": [
         "vike-polymarket-markets",
         "vike-polymarket-market-detail",
+        "vike-pm-market-diligence",
         "vike-polymarket-trader",
-        "vike-polymarket-smart-money"
+        "vike-polymarket-smart-money",
+        "vike-pm-l2-archive"
       ]
     },
     {

package/src/commands/stream.js

@@ -9,7 +9,7 @@ import { addTool } from './tool-command.js';
 export const STREAM_PATHS = ['hl', 'hl-cohorts', 'onchain', 'polymarket'];
 const MAX_SUBSCRIPTIONS = 100;          // per connection, the server's cap
 const IDLE_MS = 60_000;                 // the server pings every 15 s: a minute of silence is a dead connection
-const NUMBER_KEYS = new Set(['min_usd', 'min_amount', 'min_move']);
+const NUMBER_KEYS = new Set(['min_usd', 'min_amount', 'min_move', 'min_leverage']);
 const ONE_VALUE_KEYS = new Set(['side', 'direction', 'event', 'axis', 'move', 'role']);   // every other key is a list
 // No channel list here: the server decides which channels a path serves (`stream info` lists them) and refuses
 // an unknown one with `unknown_channel`.