@vike-io/cli 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes are documented here. Entries follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 0.6.0 — infra hardening + observability + skill eval harness
+
+Mostly internal-quality improvements; no new commands. Backbone for everything that follows.
+
+**New infra**
+- **Background update-check** — silent detached subprocess polls the registry once/day; next-run prints `Update available: X.Y.Z → A.B.C`. Honors `NO_UPDATE_NOTIFIER` / `CI` / `VIKE_NO_UPDATE_CHECK`.
+- **First-run-after-upgrade notice** — one-time `Updated to X.Y.Z` print.
+- **Telemetry skeleton** — anonymous UUID + 30-min session ID, fire-and-forget. NO sink endpoint wired yet (events drop silently); shape is stable so we can flip it on without refactoring. Opt-out via `DO_NOT_TRACK=1` or `VIKE_NO_TELEMETRY=1`.
+- **Centralized chain registry** (`src/chains.js`) — `ALL_CHAINS`, `EVM_CHAINS`, `WALLET_CHAINS`, `CHAIN_ALIASES`, `normaliseChain()`, `isEvmAddress()`.
+
+**Testing + release safety**
+- Two-tier vitest config — `npm test` (unit/integration, <30s) vs `npm run test:e2e` (live MCP, up to 2 min).
+- Four meta-tests added: shebang, pack-and-install (catches missing `files`), CLI help for every command, command coverage regression.
+- Pretest changeset validator — hard-fails on wrong package name in changeset frontmatter; warns on missing changeset.
+- Postinstall script hardened — global-install + TTY gates, always `exit 0`.
+
+**Skill quality evals (preview)**
+- `evals/` directory with a `uv run`-script harness: A/B-tests every question against `vike --help` only vs `vike --help + SKILL.md`. Scores per question; aggregates a Δ for each skill. If a skill doesn't move the score, it shouldn't ship. Run: `uv run --script evals/runner.py` (needs `ANTHROPIC_API_KEY`).
+- 14 starter questions in `evals/questions.yaml`.
+
+**Security**
+- `SECURITY.md` published (report at security@vike.io; 48h ack, 7d critical-fix SLA).
+- `CODEOWNERS` file (single-maintainer for now; security-sensitive paths called out).
+- Dependabot weekly PRs for npm + GitHub Actions deps.
+- `npm audit --audit-level=high` added to CI.
+
 ## 0.5.0 — initial public release
 
 AI-agent CLI for vike.io on-chain analytics, perpetuals, options flow, and prediction-market data across 11 chains.

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AI-agent CLI for vike.io on-chain analytics, perps, options, and prediction markets across 11 chains",
   "type": "module",
   "main": "src/index.js",
@@ -19,8 +19,10 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.js",
     "start": "node src/index.js",
+    "pretest": "node scripts/check-changeset.js",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
+    "test:e2e": "vitest run --config vitest.e2e.config.js",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "changeset": "changeset",

package/scripts/postinstall.js

@@ -1,20 +1,40 @@
-// Postinstall — print a friendly setup hint when the user installs vike-cli.
-// Silent in CI environments to avoid log noise.
+// Postinstall — print a friendly setup hint on global install only.
+//
+// Three defensive guards:
+// 1. Local installs (`npm i @vike-io/cli` inside a project) get nothing —
+//    the hint would be noise. Only global installs (`-g`) print.
+// 2. Non-TTY environments (CI, scripts, docker build) get nothing —
+//    nothing in here is interactive, but defensively short-circuit so a
+//    future maintainer can't accidentally prompt and hang `npm ci`.
+// 3. Any error is swallowed — postinstall must NEVER break `npm install`.
+//
+// Honors $CI and npm's --silent / loglevel=silent.
 
-if (process.env.CI || process.env.npm_config_loglevel === 'silent') {
+const isGlobal = String(process.env.npm_config_global || '') === 'true';
+const hasTTY = Boolean(process.stdout.isTTY) && Boolean(process.stderr.isTTY);
+const isQuiet = process.env.CI ||
+                process.env.npm_config_loglevel === 'silent' ||
+                process.env.npm_config_loglevel === 'error';
+
+if (!isGlobal || !hasTTY || isQuiet) {
   process.exit(0);
 }
 
-const lines = [
-  '',
-  '  @vike-io/cli installed.',
-  '',
-  '  Next steps:',
-  '    vike init                  — interactive setup',
-  '    vike doctor                — verify your install',
-  '    vike token search BTC      — your first query',
-  '',
-  '  Docs: https://vike.io/api',
-  '',
-];
-process.stdout.write(lines.join('\n'));
+try {
+  const lines = [
+    '',
+    '  @vike-io/cli installed.',
+    '',
+    '  Next steps:',
+    '    vike init                  — interactive setup',
+    '    vike doctor                — verify your install',
+    '    vike token search BTC      — your first query',
+    '',
+    '  Docs: https://vike.io/api',
+    '',
+  ];
+  process.stdout.write(lines.join('\n'));
+} catch {
+  // Postinstall must not fail an npm install. Swallow everything.
+}
+process.exit(0);

package/src/chains.js

@@ -0,0 +1,86 @@
+// Central chain registry. Every command that takes a --chain flag should
+// import EVM_CHAINS or ALL_CHAINS from here. Adding a chain = one edit.
+
+export const EVM_CHAINS = [
+  'ethereum',
+  'bsc',
+  'base',
+  'arbitrum',
+  'polygon',
+  'optimism',
+  'hyperevm',
+];
+
+export const NON_EVM_CHAINS = [
+  'bitcoin',
+  'solana',
+  'tron',
+  'xmr',
+  'zec',
+  'dash',
+];
+
+export const ALL_CHAINS = [...EVM_CHAINS, ...NON_EVM_CHAINS];
+
+// Chains the wallet_* tools currently support (subset of EVM_CHAINS where
+// we have indexed transfers + labels). Used by --chain validation in
+// commands like `wallet summary` / `wallet counterparties` / etc.
+export const WALLET_CHAINS = ['ethereum', 'bsc', 'base'];
+
+// Chain abbreviation map: short → canonical. We accept both forms from
+// CLI input and normalise to canonical before sending to MCP.
+export const CHAIN_ALIASES = {
+  eth: 'ethereum',
+  ethereum: 'ethereum',
+  bsc: 'bsc',
+  bnb: 'bsc',
+  base: 'base',
+  arb: 'arbitrum',
+  arbitrum: 'arbitrum',
+  poly: 'polygon',
+  polygon: 'polygon',
+  op: 'optimism',
+  optimism: 'optimism',
+  hyper: 'hyperevm',
+  hyperevm: 'hyperevm',
+  btc: 'bitcoin',
+  bitcoin: 'bitcoin',
+  sol: 'solana',
+  solana: 'solana',
+  tron: 'tron',
+  trx: 'tron',
+  xmr: 'xmr',
+  monero: 'xmr',
+  zec: 'zec',
+  zcash: 'zec',
+  dash: 'dash',
+};
+
+export function normaliseChain(input, fallback = 'ethereum') {
+  if (!input) return fallback;
+  const key = String(input).toLowerCase().trim();
+  return CHAIN_ALIASES[key] ?? input;
+}
+
+// Address-format expectations per chain. Used by `vike doctor` and
+// future input validation. EVM = 0x + 40 hex; Solana = base58 32-44 chars;
+// BTC = various encodings; privacy chains = chain-specific.
+export const ADDRESS_FORMATS = {
+  ethereum: '0x + 40 hex chars',
+  bsc: '0x + 40 hex chars',
+  base: '0x + 40 hex chars',
+  arbitrum: '0x + 40 hex chars',
+  polygon: '0x + 40 hex chars',
+  optimism: '0x + 40 hex chars',
+  hyperevm: '0x + 40 hex chars',
+  solana: 'base58, 32-44 chars',
+  bitcoin: 'bech32 / P2PKH / P2SH',
+  tron: 'base58 starting with T',
+  xmr: 'monero address (95 chars)',
+  zec: 'zcash transparent or shielded',
+  dash: 'P2PKH starting with X',
+};
+
+export function isEvmAddress(addr) {
+  return typeof addr === 'string' && /^0x[0-9a-fA-F]{40}$/.test(addr);
+}

package/src/index.js

@@ -16,13 +16,27 @@ import { registerDoctor } from './commands/doctor.js';
 import { registerSchema } from './commands/schema.js';
 import { registerLogin, registerLogout } from './commands/auth.js';
 import { readPackageVersion } from './util.js';
+import {
+  getUpdateNotification,
+  getUpgradeNotice,
+  scheduleUpdateCheck,
+} from './update-check.js';
+
+const version = readPackageVersion();
+
+// Print at-most-once notifications: upgrade-since-last-run, and update-available
+// (the latter from the previous background check). Cheap, sync, exits if quiet.
+const upgradeNotice = getUpgradeNotice(version);
+const updateNotice = getUpdateNotification(version);
+if (upgradeNotice) process.stderr.write(upgradeNotice);
+if (updateNotice) process.stderr.write(updateNotice);
 
 const program = new Command();
 
 program
   .name('vike')
   .description('AI-agent CLI for vike.io on-chain analytics')
-  .version(readPackageVersion(), '-v, --version', 'Show CLI version');
+  .version(version, '-v, --version', 'Show CLI version');
 
 registerLogin(program);
 registerLogout(program);
@@ -38,7 +52,12 @@ registerPolymarket(program);
 registerLabels(program);
 registerWeb(program);
 
-program.parseAsync(process.argv).catch((err) => {
-  console.error(`vike: ${err.message ?? err}`);
-  process.exitCode = 1;
-});
+program.parseAsync(process.argv)
+  .catch((err) => {
+    console.error(`vike: ${err.message ?? err}`);
+    process.exitCode = 1;
+  })
+  .finally(() => {
+    // Fire-and-forget background check, detached subprocess. Survives our exit.
+    scheduleUpdateCheck();
+  });

package/src/telemetry.js

@@ -0,0 +1,120 @@
+// Anonymous, opt-out telemetry skeleton.
+//
+// Design decisions:
+// - Honors DO_NOT_TRACK=1 (industry standard) AND VIKE_NO_TELEMETRY=1
+// - Honors CI / NODE_ENV=test (never phones home from CI)
+// - Persistent UUIDv4 in ~/.vike/telemetry-id (regenerated on delete)
+// - Rolling 30-min session ID — same session_id within a 30-min window
+// - AbortController + 1000ms timeout, timer.unref() so we can't keep
+//   the process alive
+// - Payload includes: flag NAMES (no values), latency, success/error_code,
+//   chain (if relevant). NEVER the actual data the user queried.
+// - Fire-and-forget: errors are swallowed
+//
+// THE SINK IS NOT YET WIRED. `_send()` is a no-op until we have an
+// endpoint. Keeping the API shape stable now so we can flip the switch
+// later without a refactor.
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const CONFIG_DIR = join(homedir(), '.vike');
+const ID_FILE = join(CONFIG_DIR, 'telemetry-id');
+const SESSION_FILE = join(CONFIG_DIR, 'session');
+const SESSION_TTL_MS = 30 * 60 * 1000;
+const ENDPOINT = process.env.VIKE_TELEMETRY_ENDPOINT || '';
+const REQUEST_TIMEOUT_MS = 1000;
+
+function disabled() {
+  return process.env.DO_NOT_TRACK === '1' ||
+         process.env.VIKE_NO_TELEMETRY === '1' ||
+         process.env.CI ||
+         process.env.NODE_ENV === 'test';
+}
+
+function ensureDir() {
+  if (!existsSync(CONFIG_DIR)) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  }
+}
+
+function getDeviceId() {
+  try {
+    if (existsSync(ID_FILE)) return readFileSync(ID_FILE, 'utf8').trim();
+  } catch { /* ignore */ }
+  const id = randomUUID();
+  try { ensureDir(); writeFileSync(ID_FILE, id, { mode: 0o600 }); } catch { /* ignore */ }
+  return id;
+}
+
+function getSessionId() {
+  let prev = null;
+  try {
+    if (existsSync(SESSION_FILE)) {
+      prev = JSON.parse(readFileSync(SESSION_FILE, 'utf8'));
+    }
+  } catch { /* ignore */ }
+  const now = Date.now();
+  // Reuse session if within TTL; cheaply update touched timestamp at most
+  // once per minute to avoid hammering the file on rapid commands.
+  if (prev && prev.id && now - (prev.touched || 0) < SESSION_TTL_MS) {
+    if (now - (prev.touched || 0) > 60_000) {
+      try { writeFileSync(SESSION_FILE, JSON.stringify({ id: prev.id, touched: now })); }
+      catch { /* ignore */ }
+    }
+    return prev.id;
+  }
+  const id = randomUUID();
+  try {
+    ensureDir();
+    writeFileSync(SESSION_FILE, JSON.stringify({ id, touched: now }));
+  } catch { /* ignore */ }
+  return id;
+}
+
+function _send(event, payload) {
+  if (disabled() || !ENDPOINT) return;
+  // Fire-and-forget. No await; can't keep the process alive.
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), REQUEST_TIMEOUT_MS);
+  if (typeof timer.unref === 'function') timer.unref();
+  fetch(ENDPOINT, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      event,
+      device_id: getDeviceId(),
+      session_id: getSessionId(),
+      ts: Date.now(),
+      ...payload,
+    }),
+    signal: ctrl.signal,
+  })
+    .catch(() => { /* fire-and-forget */ })
+    .finally(() => clearTimeout(timer));
+}
+
+function flagNames(opts) {
+  // Extract flag names from a commander options object. Values stripped.
+  if (!opts || typeof opts !== 'object') return [];
+  return Object.keys(opts).filter((k) => !k.startsWith('_') && k !== 'parent');
+}
+
+export function trackCommandSucceeded(command, opts, { durationMs } = {}) {
+  _send('command_succeeded', {
+    command,
+    flags: flagNames(opts),
+    duration_ms: typeof durationMs === 'number' ? Math.round(durationMs) : null,
+  });
+}
+
+export function trackCommandFailed(command, opts, { errorCode, durationMs } = {}) {
+  _send('command_failed', {
+    command,
+    flags: flagNames(opts),
+    error_code: errorCode || 'unknown',
+    duration_ms: typeof durationMs === 'number' ? Math.round(durationMs) : null,
+  });
+}

package/src/update-check.js

@@ -0,0 +1,126 @@
+// Background update check — reads cached result synchronously on startup,
+// kicks off the registry probe as a detached subprocess that survives
+// process exit. Zero blocking I/O on the user's command.
+//
+// Pattern: print a one-liner the *next* time the user runs us, after the
+// background check has cached the result. No "checking for updates..."
+// spinner ever appears.
+//
+// Honors NO_UPDATE_NOTIFIER and CI (industry-standard opt-out).
+
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CONFIG_DIR = join(homedir(), '.vike');
+const CHECK_FILE = join(CONFIG_DIR, 'update-check.json');
+const LAST_VERSION_FILE = join(CONFIG_DIR, 'last-version.json');
+const PACKAGE_NAME = '@vike-io/cli';
+const REGISTRY = 'https://registry.npmjs.org';
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 1 day
+
+function suppressed() {
+  return process.env.NO_UPDATE_NOTIFIER === '1' ||
+         process.env.CI ||
+         process.env.NODE_ENV === 'test' ||
+         process.env.VIKE_NO_UPDATE_CHECK === '1';
+}
+
+function readCache() {
+  if (!existsSync(CHECK_FILE)) return null;
+  try { return JSON.parse(readFileSync(CHECK_FILE, 'utf8')); } catch { return null; }
+}
+
+function writeCache(latest) {
+  try {
+    if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(CHECK_FILE, JSON.stringify({ latest, checkedAt: Date.now() }, null, 2));
+  } catch { /* ignore */ }
+}
+
+function cmpSemver(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
+  }
+  return 0;
+}
+
+// Synchronous: read whatever the background process last cached.
+// Returns a notification string or null. Call at startup.
+export function getUpdateNotification(currentVersion) {
+  if (suppressed()) return null;
+  const cache = readCache();
+  if (!cache || !cache.latest) return null;
+  if (cmpSemver(cache.latest, currentVersion) > 0) {
+    return (
+      `\n  Update available: ${currentVersion} → ${cache.latest}\n` +
+      `  Run: npm install -g ${PACKAGE_NAME}\n`
+    );
+  }
+  return null;
+}
+
+// Fire the check as a detached subprocess. Doesn't block process exit.
+// Honors a 1-day cache window — re-checking on every command would
+// hammer the npm registry.
+export function scheduleUpdateCheck() {
+  if (suppressed()) return;
+  const cache = readCache();
+  if (cache && Date.now() - (cache.checkedAt || 0) < CHECK_INTERVAL_MS) return;
+
+  const __filename = fileURLToPath(import.meta.url);
+  // Inline child script — no separate file needed, no dependency on
+  // package layout, survives `npm install -g` symlinking.
+  const code = `
+    const https = require('https');
+    const fs = require('fs');
+    const path = require('path');
+    const os = require('os');
+    const file = path.join(os.homedir(), '.vike', 'update-check.json');
+    https.get('${REGISTRY}/${PACKAGE_NAME}/latest', { timeout: 5000 }, (r) => {
+      let buf = '';
+      r.on('data', (c) => { buf += c; });
+      r.on('end', () => {
+        try {
+          const v = JSON.parse(buf).version;
+          if (!v) return;
+          fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+          fs.writeFileSync(file, JSON.stringify({ latest: v, checkedAt: Date.now() }));
+        } catch {}
+      });
+    }).on('error', () => {}).on('timeout', function () { this.destroy(); });
+  `;
+
+  try {
+    const child = spawn(process.execPath, ['-e', code], {
+      detached: true,
+      stdio: 'ignore',
+    });
+    child.unref();
+  } catch { /* ignore */ }
+}
+
+// First-run-after-upgrade hook. Stores last-seen version; if it changes,
+// prints a one-time "you upgraded" notice on the next command.
+export function getUpgradeNotice(currentVersion) {
+  if (suppressed()) return null;
+  let last = null;
+  try {
+    if (existsSync(LAST_VERSION_FILE)) {
+      last = JSON.parse(readFileSync(LAST_VERSION_FILE, 'utf8')).version;
+    }
+  } catch { /* ignore */ }
+  try {
+    if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(LAST_VERSION_FILE, JSON.stringify({ version: currentVersion }));
+  } catch { /* ignore */ }
+  if (last && last !== currentVersion && cmpSemver(currentVersion, last) > 0) {
+    return `\n  Updated to ${currentVersion} (was ${last}).\n`;
+  }
+  return null;
+}