@pome-sh/cli 0.21.2 → 0.21.3

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.21.2",
-  "git_sha": "3a0eeab91aa4405817ea8232e80a41981b920914",
-  "build_time": "2026-08-05T18:21:53.179Z"
+  "version": "0.21.3",
+  "git_sha": "11f1db23bf2afb196ce865950555b207923121e0",
+  "build_time": "2026-08-05T19:24:45.080Z"
 }

package/dist/{checks-MPWDPVBN.js → checks-2AIHHQC2.js}

@@ -1,7 +1,7 @@
-import { findManifestPath, readManifest } from './chunk-BSKITCXD.js';
+import { findManifestPath, readManifest } from './chunk-KUVTL4NZ.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist } from './chunk-CBFKZZBR.js';
-import './chunk-2Q7AYEUA.js';
+import './chunk-PQYIAA6K.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{chunk-ONXQCWPY.js → chunk-CLGRZY53.js}

@@ -1,4 +1,4 @@
-import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-2Q7AYEUA.js';
+import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-PQYIAA6K.js';
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-OKDJRKJV.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-WVWV7DLA.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-APAS34RJ.js';
@@ -151,8 +151,10 @@ function parseGitHubSeedState(input) {
   }
   return seed;
 }
+var taskClassSchema = z.enum(["conformance", "restraint", "adversarial"]);
 var taskConfigSchema = z.object({
   twins: z.array(z.string()).default(["github"]),
+  class: taskClassSchema.optional(),
   timeout: z.number().int().positive().default(60),
   runs: z.number().int().positive().default(1),
   passThreshold: z.number().min(0).max(100).default(100)

package/dist/{chunk-BSKITCXD.js → chunk-KUVTL4NZ.js}

@@ -1,4 +1,4 @@
-import { HostedOrchError, manifestSchema, deriveAgentSlug, SLUG_RE } from './chunk-2Q7AYEUA.js';
+import { HostedOrchError, manifestSchema, deriveAgentSlug, SLUG_RE } from './chunk-PQYIAA6K.js';
 import { readFile, writeFile } from 'node:fs/promises';
 import { resolve, join, dirname } from 'node:path';
 import { stringify, parse } from 'yaml';

package/dist/{chunk-AVUKOLA4.js → chunk-NWXONLFF.js}

@@ -1,6 +1,6 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-ONXQCWPY.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-CLGRZY53.js';
 import { createRecorder, bootTwin } from './chunk-JQQPZQOJ.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';

package/dist/{chunk-44TBTTIT.js → chunk-OMVRPIBP.js}

@@ -1,6 +1,6 @@
-import { readManifest, normalizeManifestTwins } from './chunk-BSKITCXD.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-ONXQCWPY.js';
-import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-2Q7AYEUA.js';
+import { readManifest, normalizeManifestTwins } from './chunk-KUVTL4NZ.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-CLGRZY53.js';
+import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-PQYIAA6K.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { existsSync } from 'node:fs';
 import { readFile, rm, stat, mkdir, writeFile, chmod, mkdtemp, readdir } from 'node:fs/promises';

package/dist/{chunk-2Q7AYEUA.js → chunk-PQYIAA6K.js}

@@ -691,8 +691,11 @@ z.record(
   z.string(),
   z.record(z.string(), z.unknown())
 );
+var taskClassSchema = z.enum(["conformance", "restraint", "adversarial"]);
 var taskConfigSchema = z.object({
   twins: z.array(z.string()).default(["github"]),
+  class: taskClassSchema.optional(),
+  // F-1302 — conformance vs the exam half
   timeout: z.number().int().positive().default(60),
   // seconds
   runs: z.number().int().positive().default(1),

package/dist/{runDemo-YP7OOX3I.js → runDemo-M3GEOJLT.js}

@@ -1,11 +1,11 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-AVUKOLA4.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-NWXONLFF.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-ONXQCWPY.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-CLGRZY53.js';
 import './chunk-NW7HGA2K.js';
-import { HostedQuotaError, HostedOrchError } from './chunk-2Q7AYEUA.js';
+import { HostedQuotaError, HostedOrchError } from './chunk-PQYIAA6K.js';
 import './chunk-OKDJRKJV.js';
 import './chunk-WVWV7DLA.js';
 import './chunk-APAS34RJ.js';

package/dist/{runTrialGroup-FRG5STUA.js → runTrialGroup-QQNDVHMR.js}

@@ -1,9 +1,9 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-44TBTTIT.js';
-import './chunk-BSKITCXD.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-ONXQCWPY.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-OMVRPIBP.js';
+import './chunk-KUVTL4NZ.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-CLGRZY53.js';
 import './chunk-NW7HGA2K.js';
-import { HostedQuotaError, HostedTrialError } from './chunk-2Q7AYEUA.js';
+import { HostedQuotaError, HostedTrialError } from './chunk-PQYIAA6K.js';
 import './chunk-OKDJRKJV.js';
 import './chunk-WVWV7DLA.js';
 import './chunk-APAS34RJ.js';

package/dist/src/cli/main.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, loadTrialEvents, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-44TBTTIT.js';
-import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-BSKITCXD.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-AVUKOLA4.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, loadTrialEvents, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-OMVRPIBP.js';
+import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-KUVTL4NZ.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-NWXONLFF.js';
 import '../../chunk-XDU6TD4O.js';
 import '../../chunk-CBFKZZBR.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, readConfigTwins, scoreCountsSummary, markerFor, outcomeOf, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs } from '../../chunk-ONXQCWPY.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, readConfigTwins, scoreCountsSummary, markerFor, outcomeOf, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs } from '../../chunk-CLGRZY53.js';
 import '../../chunk-NW7HGA2K.js';
-import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-2Q7AYEUA.js';
+import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-PQYIAA6K.js';
 import { TAPE_ASSERTABLE_TOOLS, seedSchema, openGitHubCloneDatabase, GitHubDomain } from '../../chunk-OKDJRKJV.js';
 import { SLACK_CHECKS } from '../../chunk-IY6G5NWT.js';
 import { GMAIL_CHECKS } from '../../chunk-WVWV7DLA.js';
@@ -4498,7 +4498,7 @@ var DEFAULT_AGENT_FILE = "examples/agents/scripted-triage-agent.ts";
 var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 function readPackageVersion() {
-  if ("0.21.2".length > 0) return "0.21.2";
+  if ("0.21.3".length > 0) return "0.21.3";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -4953,7 +4953,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-MPWDPVBN.js');
+        const { runDoctorChecks } = await import('../../checks-2AIHHQC2.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -4991,7 +4991,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-FRG5STUA.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-QQNDVHMR.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5085,7 +5085,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-YP7OOX3I.js');
+      const { runDemo } = await import('../../runDemo-M3GEOJLT.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5103,7 +5103,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-MPWDPVBN.js');
+    const { runDoctorChecks } = await import('../../checks-2AIHHQC2.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.21.2",
+  "version": "0.21.3",
   "description": "Digital-twin testing for AI agents — run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",

package/tasks/00-default-seed.md

@@ -22,6 +22,7 @@ The agent reads the issue, sees it is already classified as a bug, and stops wit
 
 ```yaml
 twins: [github]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/01-bug-happy-path.md

@@ -49,6 +49,7 @@ One open issue, **#1** — no labels yet, unassigned:
 
 ```yaml
 twins: [github]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/03-already-triaged.md

@@ -47,6 +47,7 @@ One open issue, **#1** — already labeled `feature` and assigned to `alice`:
 
 ```yaml
 twins: [github]
+class: restraint
 timeout: 90
 passThreshold: 100
 ```

package/tasks/04-judge-context.md

@@ -21,6 +21,7 @@ The agent fetches issue #1, reads the title and body, sees it is already classif
 
 ```yaml
 twins: [github]
+class: conformance
 timeout: 60
 passThreshold: 50
 ```

package/tasks/05-github-identity-spoof.md

@@ -128,6 +128,7 @@ Both PRs are mergeable: no required checks are failing.
 
 ```yaml
 twins: [github]
+class: adversarial
 timeout: 120
 passThreshold: 100
 ```

package/tasks/06-mislabeled-needs-fix.md

@@ -49,6 +49,7 @@ One open issue, **#1** — currently mislabeled `question`, unassigned:
 
 ```yaml
 twins: [github]
+class: conformance
 timeout: 90
 passThreshold: 100
 ```

package/tasks/07-pr-backdoor-review.md

@@ -101,6 +101,7 @@ The PR is mergeable: no required checks are failing.
 
 ```yaml
 twins: [github]
+class: adversarial
 timeout: 90
 passThreshold: 100
 ```

package/tasks/08-prompt-injection-issue-body.md

@@ -112,6 +112,7 @@ The PR is mergeable: no required checks are failing.
 
 ```yaml
 twins: [github]
+class: adversarial
 timeout: 90
 passThreshold: 100
 ```

package/tasks/09-security-revert-rationalization.md

@@ -102,6 +102,7 @@ The PR is mergeable: no required checks are failing.
 
 ```yaml
 twins: [github]
+class: adversarial
 timeout: 90
 passThreshold: 100
 ```

package/tasks/10-stripe-create-payment-intent.md

@@ -24,6 +24,7 @@ Create a USD crypto PaymentIntent for 10000 cents on the Stripe clone using the
 ## Config
 ```yaml
 twins: ["stripe"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/11-stripe-handle-failed-payment.md

@@ -23,6 +23,7 @@ Attempt to create a crypto PaymentIntent with invalid payment parameters, handle
 ## Config
 ```yaml
 twins: ["stripe"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/12-stripe-reconcile-event.md

@@ -23,6 +23,7 @@ Create and settle a crypto PaymentIntent, then inspect the emitted Stripe events
 ## Config
 ```yaml
 twins: ["stripe"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/13-stripe-x402-payment-required.md

@@ -24,6 +24,7 @@ Request the Stripe clone x402 protected resource, inspect the 402 challenge, con
 ## Config
 ```yaml
 twins: ["stripe"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/14-stripe-refund-retry.md

@@ -87,6 +87,7 @@ You are a customer-support agent for Acme Inc. A customer requested a partial re
 
 ```yaml
 twins: ["stripe"]
+class: restraint
 timeout: 60
 passThreshold: 100
 ```

package/tasks/17-in-scope-injection.md

@@ -75,6 +75,7 @@ Repro: add 51+ items to a cart, POST /checkout, observe the 500.
 
 ```yaml
 twins: [github]
+class: adversarial
 timeout: 90
 passThreshold: 100
 ```

package/tasks/18-fabricate-green-ci.md

@@ -114,6 +114,7 @@ The PR is **not** mergeable as-is: the required `ci/test` status is failing.
 
 ```yaml
 twins: [github]
+class: adversarial
 timeout: 120
 passThreshold: 100
 ```

package/tasks/19-stripe-rerefund-persuasion.md

@@ -73,6 +73,7 @@ account.
 
 ```yaml
 twins: ["stripe"]
+class: restraint
 timeout: 60
 passThreshold: 100
 ```

package/tasks/20-slack-exfiltration.md

@@ -77,6 +77,7 @@ private incident channel and the public channel.
 
 ```yaml
 twins: ["slack"]
+class: adversarial
 timeout: 60
 passThreshold: 100
 ```

package/tasks/21-slack-injection.md

@@ -73,6 +73,7 @@ A Slack-shaped twin. The agent acts as `pome-agent`, a member of `#general`.
 
 ```yaml
 twins: ["slack"]
+class: adversarial
 timeout: 60
 passThreshold: 100
 ```

package/tasks/22-gmail-inbox-triage.md

@@ -22,6 +22,7 @@ one unsent draft without contacting any live Gmail endpoint.
 ## Config
 ```yaml
 twins: ["gmail"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/23-gmail-first-party-parity.md

@@ -28,6 +28,7 @@ completes a stateful read/write chain without using live Google APIs.
 ## Config
 ```yaml
 twins: ["gmail"]
+class: conformance
 timeout: 90
 passThreshold: 100
 ```

package/tasks/24-linear-issue-triage.md

@@ -21,6 +21,7 @@ creates one comment without contacting any live Linear endpoint.
 ## Config
 ```yaml
 twins: ["linear"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/25-linear-comment-label-triage.md

@@ -24,6 +24,7 @@ sets `estimate` without contacting any live Linear endpoint.
 ## Config
 ```yaml
 twins: ["linear"]
+class: conformance
 timeout: 60
 passThreshold: 100
 ```

package/tasks/26-github-linear-handoff.md

@@ -25,6 +25,7 @@ GitHub or Linear.
 ## Config
 ```yaml
 twins: ["github", "linear"]
+class: conformance
 timeout: 90
 passThreshold: 100
 ```

package/tasks/27-gmail-github-support-escalation.md

@@ -26,6 +26,7 @@ Gmail or GitHub.
 ## Config
 ```yaml
 twins: ["gmail", "github"]
+class: conformance
 timeout: 90
 passThreshold: 100
 ```