Prune retired Peer CLI market/checkout commands and unoffered API key options

What they did

The author audited the zkp2p/peer-cli repo and found it still shipped commands and documented options that no longer work. They confirmed the failures against production first: all 20 Peerlytics read commands returned HTTP 410 ("The Peerlytics v1 API is retired"), and `checkout list`/`checkout show` returned HTTP 404 because the Pay API only serves under `/api/v1` and has no checkout-session resource. They then deleted 25 `peer market` commands (spreads, orderbook, volume, leaderboard, protocol-stats, vaults, explorer *, deposits, intents, activity, taker/maker-history, meta *, api-key *, credits) and the four `peer checkout` commands, keeping `peer market compare` because it uses the SDK quote route and still works. Because MCP tools are generated from the same command registry, the matching `peer_market_*` and `peer_checkout_*` tools went too (read-only 97→73, full 160→131, cash unchanged at 14; CLI 147→118 commands). They removed `--api-key`, `PEER_API_KEY`, `PEER_CASH_API_KEY` and the `apiKey` config key after confirming the bundled SDK only reads it in `verifySellerPayment`, which nothing calls; likewise `--market-api-key`, `--market-base-url`, `--pay-api-key`, `--pay-base-url` and their env vars and config keys, whose only consumers were the deleted commands. `--indexer-key` still works but is hidden from help and docs. They kept masking legacy stored keys in `peer config show`, deleted dead code (`src/utils/http.ts`, `RuntimeDeps.requestJson`, context file helpers), scrubbed README, AGENTS.md, CLAUDE.md, llms.txt, server.json, CHANGELOG and deploy/AWS.md of key options, Peerlytics, checkout, staging hostnames, instance IDs, IAM roles and internal repo links, and removed `deploy/aws-health.py` (unused, hard-coded version 0.4.1 and a 97-tool catalog). They added tests for help output, unknown-option rejection, the hidden indexer key, compare validation and legacy key masking, then ran `npm ci` and `npm run check` (lint, typecheck, vitest with coverage, build).

How it went

21 files and 243 tests pass at 97.93% statement and 91.61% branch coverage. The regenerated `agents/tool-catalog.json` differs from main only by the 29 removed commands, in the same order. On the built `dist/cli.cjs` in a clean environment, help screens render, `peer checkout list` fails with "unknown command", `peer --api-key x quote ...` fails with "unknown option", and `peer market compare --from USD --amount 100 --platform wise --recipient 0x…01` returns `ok: true` with the quote route answering HTTP 200. `npm pack --dry-run` packs 21 files, and a grep of non-dist tarball files for key names, Peerlytics, AWS ARNs, instance IDs, staging hostnames and checkout found no matches; remaining hits in `dist/*.cjs` come from bundled dependencies.

Worth knowing

This is a breaking change, suggested for 0.5.0: removed commands, MCP tools, flags, env vars and config keys, plus field losses on exported types `GlobalOptions`, `RuntimeDeps.requestJson` and `PeerCashMcpConfig.apiKey`. Nothing changes for npm users or the hosted MCP server until a release containing the commit is published or deployed. The deploy workflow identifiers in `.github/workflows/deploy.yml` and `deploy/environments.yml` were left alone because moving them needs changes in shared reusable workflows. Reverting is a plain `git revert` with no data or config migration, since stored config files are only read.

Wiring

Work started from the command registry, which is the single source for both CLI commands and generated MCP tools, so one deletion propagated to both surfaces. Endpoint probing came first: each command's URL was hit against production to classify it as live or retired, which is why `peer market compare` survived on the SDK quote route while the 25 Peerlytics commands and four checkout commands were deleted. Flag removal followed the same dependency logic — `--api-key` and the market/pay base-url and key flags were traced to their only consumers, the deleted commands or an unused SDK path, before removal. `--indexer-key` was kept because it still sends `x-api-key` to the indexer, just hidden from `--help` and docs. Dead code removal (`src/utils/http.ts`, `RuntimeDeps.requestJson`, context file helpers) was done after confirming zero remaining callers. Docs and deploy files were edited in the same commit, with deploy workflow identifiers deliberately untouched. Verification ran as `npm ci` then `npm run check` (lint, typecheck, vitest with coverage, build), followed by manual smoke tests on `dist/cli.cjs` and a `npm pack --dry-run` tarball grep.

Try it yourself

Audit this repo's CLI for commands and options that no longer work, then remove them. Steps: (1) list every command and flag from the command registry and grep for the endpoints each one calls; (2) probe those endpoints against production and record status codes — treat 410/404 as retired; (3) delete retired commands and their flags, env vars and config keys, but keep any command that still hits a live route; (4) regenerate the MCP tool catalog and confirm the diff contains only the removed entries, in the same order; (5) remove dead helpers that lose their last caller; (6) scrub README, AGENTS.md, CLAUDE.md, llms.txt, server.json, CHANGELOG and deploy docs of retired endpoints, key options, staging hostnames, instance IDs, IAM role names and internal repo links; (7) add tests asserting help output omits the removed items, removed flags are rejected as unknown options, any hidden-but-working flag still resolves, and legacy stored keys stay masked in `config show`; (8) run `npm ci` and `npm run check`, then smoke-test the built `dist/cli.cjs` in a clean environment; (9) run `npm pack --dry-run` and grep the non-dist tarball files for key names, retired hostnames, ARNs and instance IDs. Report the command and tool counts before and after, and list the breaking changes for the next minor release.