@pome-sh/cli 0.21.10 → 0.21.12

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.21.10",
-  "git_sha": "f941795a998bcf658b68cd0c20217068d09d140a",
-  "build_time": "2026-08-06T15:06:31.245Z"
+  "version": "0.21.12",
+  "git_sha": "013cfce31a6025daeedeb4c2bd47edd3db56b85a",
+  "build_time": "2026-08-07T08:56:26.617Z"
 }

package/dist/{checks-ZWCORWK4.js → checks-FLXH5OG3.js}

@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-CJX3IXR3.js');
+    const { bootTwin } = await import('./twinHarness-4RDIJIM7.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-BK7HSHRA.js → chunk-563RZ7P3.js}

@@ -1,22 +1,22 @@
 // ../packages/twin-github/package.json
 var package_default = {
-  version: "0.9.1"};
+  version: "0.9.2"};
 
 // ../packages/twin-slack/package.json
 var package_default2 = {
-  version: "0.3.4"};
+  version: "0.3.5"};
 
 // ../packages/twin-stripe/package.json
 var package_default3 = {
-  version: "0.4.5"};
+  version: "0.4.6"};
 
 // ../packages/twin-gmail/package.json
 var package_default4 = {
-  version: "0.3.4"};
+  version: "0.3.5"};
 
 // ../packages/twin-linear/package.json
 var package_default5 = {
-  version: "0.3.4"};
+  version: "0.3.5"};
 
 // src/twin/registry.ts
 var TWIN_NAME_LIST = ["github", "slack", "stripe", "gmail", "linear"];
@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-WQE3MFBD.js');
+      } = await import('./src-RDRKZ4FM.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -59,9 +59,9 @@ var TWIN_REGISTRY = {
     envName: "SLACK",
     defaultPort: 3333,
     version: package_default2.version,
-    defaultSeed: async () => (await import('./src-4ZLCEPCN.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-RUUCDQU4.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-4ZLCEPCN.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-RUUCDQU4.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -84,10 +84,10 @@ var TWIN_REGISTRY = {
     envName: "STRIPE",
     defaultPort: 3333,
     version: package_default3.version,
-    defaultSeed: async () => (await import('./src-PJGE6SSY.js')).defaultSeed(),
+    defaultSeed: async () => (await import('./src-YH33B2LP.js')).defaultSeed(),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-PJGE6SSY.js');
-      const { createApp } = await import('./server-NJBWJIS3.js');
+      const stripeTwin = await import('./src-YH33B2LP.js');
+      const { createApp } = await import('./server-DR56XIGP.js');
       const {
         applySeed: applyStripeSeed,
         createTwinStripeApp,
@@ -128,9 +128,9 @@ var TWIN_REGISTRY = {
     portEnvName: "GMAIL_TWIN_PORT",
     tokenEnvName: "POME_GMAIL_TOKEN",
     version: package_default4.version,
-    defaultSeed: async () => (await import('./src-TKGHXPEM.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-B63VPRRZ.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-TKGHXPEM.js');
+      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-B63VPRRZ.js');
       const db = openGmailTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new GmailDomain(db);
@@ -149,7 +149,7 @@ var TWIN_REGISTRY = {
     portEnvName: "LINEAR_TWIN_PORT",
     tokenEnvName: "POME_LINEAR_TOKEN",
     version: package_default5.version,
-    defaultSeed: async () => (await import('./src-CI5W335G.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-JWB5RQSN.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
       const {
         createLinearTwinApp,
@@ -157,7 +157,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-CI5W335G.js');
+      } = await import('./src-JWB5RQSN.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);
@@ -173,7 +173,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-WQE3MFBD.js');
+  const { createGitHubCloneApp } = await import('./src-RDRKZ4FM.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-5TEVH6RY.js → chunk-6BCL7HYR.js}

@@ -2,8 +2,8 @@ import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, Hos
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-SGDUD7KK.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-ZKID2HS3.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-BK7HSHRA.js';
-import { toTwinHttpEventRow } from './chunk-35TG2GHS.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-563RZ7P3.js';
+import { toTwinHttpEventRow } from './chunk-TV5S6WQV.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';

package/dist/{chunk-F7YLHTCM.js → chunk-75SDBO3W.js}

@@ -1,5 +1,5 @@
 import { readManifest, normalizeManifestTwins } from './chunk-KUVTL4NZ.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-5TEVH6RY.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-6BCL7HYR.js';
 import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-PQYIAA6K.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { existsSync } from 'node:fs';

package/dist/{chunk-PRCZLT4W.js → chunk-EI5ECLLN.js}

@@ -1,7 +1,7 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-5TEVH6RY.js';
-import { createRecorder, bootTwin } from './chunk-2CMCN5PW.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-6BCL7HYR.js';
+import { createRecorder, bootTwin } from './chunk-OR4X4BIY.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{chunk-2CMCN5PW.js → chunk-OR4X4BIY.js}

@@ -1,5 +1,5 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-BK7HSHRA.js';
-import { createFileBackedRecorderStore, createRecorderStore } from './chunk-35TG2GHS.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-563RZ7P3.js';
+import { createFileBackedRecorderStore, createRecorderStore } from './chunk-TV5S6WQV.js';
 
 // src/recorder/recorder.ts
 function createRecorder(options = {}) {

package/dist/{chunk-35TG2GHS.js → chunk-TV5S6WQV.js}

@@ -4,7 +4,7 @@ import { z } from 'zod';
 import { mkdirSync, openSync, createWriteStream, closeSync, writeFileSync, rmSync, readFileSync, fsync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
-import { timingSafeEqual, createHmac, randomBytes, randomUUID } from 'node:crypto';
+import { timingSafeEqual, createHmac, randomBytes, randomUUID, createHash } from 'node:crypto';
 import { verify } from 'hono/jwt';
 
 var NodeSqliteTwinDatabase = class {
@@ -92,6 +92,184 @@ function openTwinDatabase(path = ":memory:", options = {}) {
   options.migrate?.(db);
   return db;
 }
+var mcpFixtureSubstrateSchema = z.enum([
+  "live-wire-unauth",
+  "live-wire-oauth",
+  "oss-source",
+  "not-captured",
+  "twin-code-transcription",
+  "twin-authored-from-vendor-docs"
+]);
+var UPSTREAM_SUBSTRATES = /* @__PURE__ */ new Set([
+  "live-wire-unauth",
+  "live-wire-oauth",
+  "oss-source"
+]);
+var TWIN_OWNED_SUBSTRATES = /* @__PURE__ */ new Set([
+  "twin-code-transcription",
+  "twin-authored-from-vendor-docs"
+]);
+var OSS_SUBSTRATES = /* @__PURE__ */ new Set(["oss-source"]);
+var sha256Hex = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase hex sha256");
+var mcpToolFixtureMetaSchema = z.strictObject({
+  twin: z.string().min(1),
+  substrate: mcpFixtureSubstrateSchema,
+  /** Where the listing was read from — a vendor URL, or the twin's own endpoint. */
+  endpoint: z.string().min(1),
+  method: z.literal("tools/list"),
+  protocol: z.string().min(1),
+  protocolVersion: z.string().min(1),
+  captureDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)"),
+  rawFileSha256: sha256Hex,
+  canonicalFileSha256: sha256Hex,
+  liveToolCount: z.number().int().positive(),
+  liveToolOrder: z.array(z.string().min(1)).min(1),
+  /**
+   * The configuration the substrate was read under. Mandatory on every
+   * upstream substrate for F-1326's reason: the remote GitHub server serves
+   * 44 tools at `/mcp/` and 85 at `/mcp/x/all`, so a capture that does not
+   * say which one it read is an unstated assumption a consumer cannot argue
+   * with.
+   */
+  configuration: z.record(z.string(), z.unknown()).optional(),
+  /**
+   * The public source tree an `oss-source` capture was built from. Mandatory
+   * on that substrate and rejected everywhere else: the whole reason to read
+   * a vendor's OSS server rather than its wire is that the answer is
+   * reproducible, and it is only reproducible from a pinned commit. Same
+   * shape and same keys as F-1326's producer writes, so a golden it produced
+   * parses here unchanged — which is what F-1327 does when it adopts an
+   * upstream capture as a twin's fixture.
+   */
+  source: z.strictObject({
+    repo: z.string().min(1),
+    commit: z.string().min(1),
+    package: z.string().min(1),
+    language: z.string().min(1).optional()
+  }).optional(),
+  /** Mandatory on twin-owned substrates: what this is, and what it is not. */
+  transcription: z.strictObject({
+    readFrom: z.string().min(1),
+    contentOrigin: z.string().min(1),
+    comparedToUpstream: z.string().min(1)
+  }).optional(),
+  notes: z.array(z.string()).optional(),
+  files: z.strictObject({ raw: z.string().min(1), canonical: z.string().min(1) })
+}).superRefine((meta, ctx) => {
+  if (UPSTREAM_SUBSTRATES.has(meta.substrate) && !meta.configuration) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["configuration"],
+      message: `substrate '${meta.substrate}' reads a real deployment, so the fixture must declare the configuration it assumed. A capture with no recorded configuration cannot be argued with.`
+    });
+  }
+  if (TWIN_OWNED_SUBSTRATES.has(meta.substrate) && !meta.transcription) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["transcription"],
+      message: `substrate '${meta.substrate}' means nobody read this table from upstream, so the fixture must carry a transcription record saying where the content came from and that it has never been compared to the vendor.`
+    });
+  }
+  if (OSS_SUBSTRATES.has(meta.substrate) && !meta.source) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["source"],
+      message: `substrate '${meta.substrate}' reads a public source tree, so the fixture must pin the repo, commit and package it was built from. An unpinned OSS capture is not reproducible.`
+    });
+  }
+  if (meta.source && !OSS_SUBSTRATES.has(meta.substrate)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["source"],
+      message: `substrate '${meta.substrate}' does not build from source, so \`source\` is a claim nothing here made.`
+    });
+  }
+  if (meta.substrate === "not-captured") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["substrate"],
+      message: `'not-captured' records the ABSENCE of a listing \u2014 it is legal in the shared vocabulary and on a status file, but not on a tool table a twin serves. Use 'twin-code-transcription' if the table was transcribed from this twin's own code.`
+    });
+  }
+});
+var canonicalMcpToolSchema = z.strictObject({
+  name: z.string().min(1),
+  description: z.string(),
+  inputSchema: z.record(z.string(), z.unknown()),
+  title: z.string().optional(),
+  outputSchema: z.record(z.string(), z.unknown()).optional(),
+  annotations: z.record(z.string(), z.unknown()).optional()
+});
+var toolsListEnvelopeSchema = z.object({
+  jsonrpc: z.string().min(1),
+  id: z.union([z.string(), z.number()]),
+  result: z.object({ tools: z.array(canonicalMcpToolSchema).min(1) })
+});
+function sha256(text) {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+function loadMcpToolFixture(modules) {
+  const parsedMeta = mcpToolFixtureMetaSchema.safeParse(modules.meta);
+  if (!parsedMeta.success) {
+    throw new Error(`MCP tool fixture: invalid provenance in meta.json \u2014 ${issues(parsedMeta.error)}`);
+  }
+  const meta = parsedMeta.data;
+  const rawBytes = JSON.stringify(modules.raw);
+  const actual = sha256(rawBytes);
+  if (actual !== meta.rawFileSha256) {
+    throw new Error(`MCP tool fixture (${meta.twin}): ${meta.files.raw} hashes to ${actual} but ${meta.files.canonical.replace(/canonical\.json$/, "meta.json")} declares rawFileSha256 ${meta.rawFileSha256}. Either the raw listing was edited by hand or the sha was typed rather than computed; both are a change to what this twin serves.`);
+  }
+  const parsedRaw = toolsListEnvelopeSchema.safeParse(modules.raw);
+  if (!parsedRaw.success) {
+    throw new Error(`MCP tool fixture (${meta.twin}): ${meta.files.raw} is not a tools/list envelope \u2014 ${issues(parsedRaw.error)}`);
+  }
+  const tools = parsedRaw.data.result.tools;
+  const toolNames = tools.map((tool) => tool.name);
+  const duplicate = toolNames.find((name, index) => toolNames.indexOf(name) !== index);
+  if (duplicate) {
+    throw new Error(`MCP tool fixture (${meta.twin}): '${duplicate}' is declared twice`);
+  }
+  if (meta.liveToolCount !== tools.length) {
+    throw new Error(`MCP tool fixture (${meta.twin}): meta declares liveToolCount ${meta.liveToolCount} but ${meta.files.raw} carries ${tools.length} tools`);
+  }
+  if (meta.liveToolOrder.join("\0") !== toolNames.join("\0")) {
+    throw new Error(`MCP tool fixture (${meta.twin}): meta.liveToolOrder no longer describes ${meta.files.raw}
+  declared: ${meta.liveToolOrder.join(", ")}
+  actual:   ${toolNames.join(", ")}`);
+  }
+  return { meta, tools, toolNames };
+}
+function deriveMcpToolTable(fixture, implementations, options = {}) {
+  const declared = new Set(fixture.toolNames);
+  const undeclared = Object.keys(implementations).filter((name) => !declared.has(name));
+  if (undeclared.length > 0) {
+    throw new Error(`MCP tool table (${fixture.meta.twin}): ${undeclared.join(", ")} ${undeclared.length === 1 ? "is" : "are"} implemented but absent from ${fixture.meta.files.raw}. The fixture is the tool table; add the tool there (with its provenance) or delete the implementation.`);
+  }
+  return fixture.tools.map((tool) => {
+    const implementation = implementations[tool.name];
+    if (!implementation) {
+      throw new Error(`MCP tool table (${fixture.meta.twin}): ${fixture.meta.files.raw} declares '${tool.name}' and this twin implements no such tool.`);
+    }
+    const outputSchema = tool.outputSchema ?? implementation.outputSchema ?? options.outputSchema;
+    const includeIsError = implementation.includeIsError ?? options.includeIsError;
+    return {
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.inputSchema,
+      ...tool.title !== void 0 ? { title: tool.title } : {},
+      ...tool.annotations !== void 0 ? { annotations: tool.annotations } : {},
+      ...outputSchema !== void 0 ? { outputSchema } : {},
+      schema: implementation.schema,
+      mutation: implementation.mutation,
+      ...implementation.contentText ? { contentText: implementation.contentText } : {},
+      ...includeIsError !== void 0 ? { includeIsError } : {},
+      handler: implementation.handler
+    };
+  });
+}
+function issues(error) {
+  return error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ");
+}
 
 // ../packages/sdk/dist/index.js
 var fidelityTierSchema = z.enum(["semantic", "shape", "unsupported"]);
@@ -107,9 +285,9 @@ function toolListExtras(tool) {
 }
 var TwinManifestError = class extends Error {
   issues;
-  constructor(message, issues = []) {
+  constructor(message, issues2 = []) {
     super(message);
-    this.issues = issues;
+    this.issues = issues2;
     this.name = "TwinManifestError";
   }
 };
@@ -1511,4 +1689,4 @@ function unregisterServeShutdown(close) {
   serveShutdownHooks.delete(close);
 }
 
-export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, defineTwin, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, openTwinDatabase, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken };
+export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, defineTwin, deriveMcpToolTable, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, loadMcpToolFixture, mintProviderToken, ok, openTwinDatabase, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken };

package/dist/{runDemo-7NYX7S5T.js → runDemo-7ZNVR4GX.js}

@@ -1,17 +1,17 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-PRCZLT4W.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-EI5ECLLN.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-5TEVH6RY.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-6BCL7HYR.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedOrchError } from './chunk-PQYIAA6K.js';
 import './chunk-SGDUD7KK.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-ZKID2HS3.js';
-import { bootTwin } from './chunk-2CMCN5PW.js';
-import './chunk-BK7HSHRA.js';
-import './chunk-35TG2GHS.js';
+import { bootTwin } from './chunk-OR4X4BIY.js';
+import './chunk-563RZ7P3.js';
+import './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { readFile } from 'node:fs/promises';

package/dist/{runTrialGroup-BYUY5WJ7.js → runTrialGroup-7KEOFQEU.js}

@@ -1,14 +1,14 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-F7YLHTCM.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-75SDBO3W.js';
 import './chunk-KUVTL4NZ.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-5TEVH6RY.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-6BCL7HYR.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedTrialError } from './chunk-PQYIAA6K.js';
 import './chunk-SGDUD7KK.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-ZKID2HS3.js';
-import './chunk-BK7HSHRA.js';
-import './chunk-35TG2GHS.js';
+import './chunk-563RZ7P3.js';
+import './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { randomUUID } from 'node:crypto';

package/dist/{server-NJBWJIS3.js → server-DR56XIGP.js}

@@ -1,3 +1,3 @@
-export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-35TG2GHS.js';
+export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 export { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';

package/dist/src/cli/main.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, loadTrialEvents, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-F7YLHTCM.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, loadTrialEvents, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-75SDBO3W.js';
 import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-KUVTL4NZ.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-PRCZLT4W.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-EI5ECLLN.js';
 import '../../chunk-XDU6TD4O.js';
 import '../../chunk-CBFKZZBR.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, readConfigTwins, scoreCountsSummary, markerFor, outcomeOf, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs } from '../../chunk-5TEVH6RY.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, readConfigTwins, scoreCountsSummary, markerFor, outcomeOf, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs } from '../../chunk-6BCL7HYR.js';
 import '../../chunk-NW7HGA2K.js';
 import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-PQYIAA6K.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-FKZZWWYC.js';
@@ -15,9 +15,9 @@ import '../../chunk-NJ246QPJ.js';
 import { LINEAR_CHECKS } from '../../chunk-3QVSXFJI.js';
 import '../../chunk-ZKID2HS3.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-NY55QTVQ.js';
-import '../../chunk-2CMCN5PW.js';
-import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-BK7HSHRA.js';
-import '../../chunk-35TG2GHS.js';
+import '../../chunk-OR4X4BIY.js';
+import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-563RZ7P3.js';
+import '../../chunk-TV5S6WQV.js';
 import { isLegacyEventRow, eventSchema } from '../../chunk-VBATFCWR.js';
 import { redactEvent, redactSecrets } from '../../chunk-SG6ZTIMT.js';
 import { Command } from 'commander';
@@ -850,7 +850,7 @@ async function throwForStatus(res) {
 
 // src/task/seed-verifier.ts
 async function verifySeedWithTwin(seed) {
-  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-WQE3MFBD.js');
+  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-RDRKZ4FM.js');
   const db = openGitHubCloneDatabase(":memory:");
   try {
     new GitHubDomain(db).seed(seed);
@@ -4490,7 +4490,7 @@ var DEFAULT_AGENT_FILE = "examples/agents/scripted-triage-agent.ts";
 var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 function readPackageVersion() {
-  if ("0.21.10".length > 0) return "0.21.10";
+  if ("0.21.12".length > 0) return "0.21.12";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -4945,7 +4945,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-ZWCORWK4.js');
+        const { runDoctorChecks } = await import('../../checks-FLXH5OG3.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -4983,7 +4983,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-BYUY5WJ7.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-7KEOFQEU.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5077,7 +5077,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-7NYX7S5T.js');
+      const { runDemo } = await import('../../runDemo-7ZNVR4GX.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5095,7 +5095,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-ZWCORWK4.js');
+    const { runDoctorChecks } = await import('../../checks-FLXH5OG3.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5227,7 +5227,7 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-5ZWCVBPZ.js');
+    const { runTwinStartCommand } = await import('../../twinStart-Y525LQUR.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("reset").argument("[name]", "Twin name (default: github)", "github").description("Reset standalone twin state").action(async (name) => {