@pome-sh/cli 0.21.7 → 0.21.9

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.21.7",
-  "git_sha": "96e10b0c62901bb98b27cc2542bb0dacfd13819f",
-  "build_time": "2026-08-06T00:44:03.453Z"
+  "version": "0.21.9",
+  "git_sha": "452daee9323032a6875be318ed440521e2a6e1c8",
+  "build_time": "2026-08-06T10:42:27.896Z"
 }

package/dist/{checks-4GJB73YX.js → checks-ZWCORWK4.js}

@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-KFZ2ZNAX.js');
+    const { bootTwin } = await import('./twinHarness-CJX3IXR3.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-M3X6OT4N.js → chunk-2CMCN5PW.js}

@@ -1,5 +1,5 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-A3IDZXJY.js';
-import { createFileBackedRecorderStore, createRecorderStore } from './chunk-LZIPGCQJ.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-BK7HSHRA.js';
+import { createFileBackedRecorderStore, createRecorderStore } from './chunk-35TG2GHS.js';
 
 // src/recorder/recorder.ts
 function createRecorder(options = {}) {

package/dist/{chunk-LZIPGCQJ.js → chunk-35TG2GHS.js}

@@ -1177,6 +1177,8 @@ function createFailureInjectionStore() {
     }
   };
 }
+
+// ../packages/sdk/dist/failure-injection.js
 function failureInjectionMiddleware(store, options) {
   return async (c, next) => {
     const session = c.get("session");

package/dist/{chunk-XS66ZRBJ.js → chunk-3QVSXFJI.js}

@@ -292,7 +292,7 @@ var issueThreadedReply = defineCheck({
 // ../packages/twin-linear/dist/src/check-issues.js
 var issueExists = defineCheck({
   id: "linear.issue-exists",
-  description: "Asserts an unarchived issue with this exact title exists in the named team. Declared and unused by the shipped corpus on purpose: `linear.issue-state` FAILS on a missing issue and therefore subsumes this one, so task 26 carries the state criterion alone \u2014 twin-github ships the same pair for the same reason. A vocabulary is what an author may pick from, not what the corpus happens to exercise. Title matching is EXACT and archived issues do not count, so an examinee that renames or archives the issue fails this.",
+  description: "Asserts an unarchived issue with this exact title exists in the named team. Declared and unused by the shipped corpus on purpose: `linear.issue-state` FAILS on a missing issue and therefore subsumes this one, so a task carries the state criterion alone \u2014 twin-github ships the same pair for the same reason. A vocabulary is what an author may pick from, not what the corpus happens to exercise. Title matching is EXACT and archived issues do not count, so an examinee that renames or archives the issue fails this.",
   template: 'An issue titled "{title}" exists in `{team}`',
   params: { title: issueTitle, team: teamKey },
   substrate: "final",

package/dist/{chunk-4ILBTPO4.js → chunk-5TEVH6RY.js}

@@ -2,8 +2,8 @@ import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, Hos
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-SGDUD7KK.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-ZKID2HS3.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-A3IDZXJY.js';
-import { toTwinHttpEventRow } from './chunk-LZIPGCQJ.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-BK7HSHRA.js';
+import { toTwinHttpEventRow } from './chunk-35TG2GHS.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';

package/dist/{chunk-A3IDZXJY.js → chunk-BK7HSHRA.js}

@@ -4,11 +4,11 @@ var package_default = {
 
 // ../packages/twin-slack/package.json
 var package_default2 = {
-  version: "0.3.3"};
+  version: "0.3.4"};
 
 // ../packages/twin-stripe/package.json
 var package_default3 = {
-  version: "0.4.4"};
+  version: "0.4.5"};
 
 // ../packages/twin-gmail/package.json
 var package_default4 = {
@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-RVUEXCKN.js');
+      } = await import('./src-WQE3MFBD.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -59,9 +59,9 @@ var TWIN_REGISTRY = {
     envName: "SLACK",
     defaultPort: 3333,
     version: package_default2.version,
-    defaultSeed: async () => (await import('./src-GGRWNJTK.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-4ZLCEPCN.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-GGRWNJTK.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-4ZLCEPCN.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -84,10 +84,10 @@ var TWIN_REGISTRY = {
     envName: "STRIPE",
     defaultPort: 3333,
     version: package_default3.version,
-    defaultSeed: async () => (await import('./src-4SVLX7UK.js')).defaultSeed(),
+    defaultSeed: async () => (await import('./src-PJGE6SSY.js')).defaultSeed(),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-4SVLX7UK.js');
-      const { createApp } = await import('./server-Y52EIWDP.js');
+      const stripeTwin = await import('./src-PJGE6SSY.js');
+      const { createApp } = await import('./server-NJBWJIS3.js');
       const {
         applySeed: applyStripeSeed,
         createTwinStripeApp,
@@ -128,9 +128,9 @@ var TWIN_REGISTRY = {
     portEnvName: "GMAIL_TWIN_PORT",
     tokenEnvName: "POME_GMAIL_TOKEN",
     version: package_default4.version,
-    defaultSeed: async () => (await import('./src-FLTYWM6P.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-TKGHXPEM.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-FLTYWM6P.js');
+      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-TKGHXPEM.js');
       const db = openGmailTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new GmailDomain(db);
@@ -149,7 +149,7 @@ var TWIN_REGISTRY = {
     portEnvName: "LINEAR_TWIN_PORT",
     tokenEnvName: "POME_LINEAR_TOKEN",
     version: package_default5.version,
-    defaultSeed: async () => (await import('./src-K3KTJTMG.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-CI5W335G.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
       const {
         createLinearTwinApp,
@@ -157,7 +157,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-K3KTJTMG.js');
+      } = await import('./src-CI5W335G.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);
@@ -173,7 +173,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-RVUEXCKN.js');
+  const { createGitHubCloneApp } = await import('./src-WQE3MFBD.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-5ETJZJR6.js → chunk-EU6SGN7A.js}

@@ -193,20 +193,19 @@ var draftAddressedTo2 = defineCheck({
   template: "A draft addressed to {email} exists",
   params: { email: emailAddress },
   substrate: "final",
-  // An achievement: task 22's seed ships one draft addressed to bob, so an
-  // examinee that does nothing does not satisfy this.
+  // An achievement: the seeded mailbox already contains a draft with a
+  // recipient, so an examinee that does nothing does not satisfy this.
   polarity: () => "positive",
   //
   // THE LOAD-BEARING DECLARATION ON THIS CHECK.
   //
-  // pome-cloud's `corpus.ts` has carried a prediction about this exact criterion
-  // since F-1028: `22-gmail-inbox-triage`'s `alice@example.com` "becomes visible
-  // here as 'unguarded' the day a gmail draft-recipient predicate lands without a
-  // `subject`, which is precisely when it starts to matter." An email address is
-  // squarely inside what a team's redaction config may destroy. Without this
-  // field the evaluator has no way to turn an impossible comparison into an
-  // honest skip, so the criterion scores a vacuous verdict at both doors
-  // instead — and the count of unguarded hazards must stay at zero.
+  // `subject` names the value the assertion is actually about, and on this check
+  // that value is an email address — squarely inside what a redaction config may
+  // legitimately destroy before an evaluator ever sees the state. Declaring it
+  // is what lets a consumer detect that the comparison has become impossible and
+  // record an honest skip. Without it there is nothing to detect: the address is
+  // simply absent, the comparison silently cannot match, and the criterion
+  // reports a vacuous verdict that reads like a real one.
   subject: ({ email }) => email,
   // The address is the scanned literal, so the mutant points at it. It stays
   // email-shaped so it re-binds to this same check: a mutant that stops matching
@@ -236,7 +235,7 @@ var draftAddressedTo2 = defineCheck({
         // address. A reader following this pointer lands on the thing the
         // sentence is about — "a draft addressed to X" — and the join to the
         // message is an implementation detail of how the twin exports, not the
-        // claim (F-1197).
+        // claim.
         evidenceStatePaths: [childStatePath(DRAFTS_PATH, index)]
       };
     }
@@ -270,8 +269,9 @@ var draftCountAtLeast = defineCheck({
   // is nothing to resolve: it is compared directly against a cardinality the
   // predicate computes, so falsifying it moves the verdict THROUGH the
   // assertion. That is the same argument `stripe.payment-intent-amount` makes,
-  // and it is why this check is the second entry in pome-cloud's
-  // `NUMERIC_SENTINEL_ALLOWED`.
+  // and it is why a numeric sentinel is admissible on this check and on very few
+  // others: an evaluator that allowlists the numeric sentinel per check should
+  // expect these two.
   vacuityMutant: (args) => ({ ...args, count: String(VACUITY_SENTINEL_NUMBER) }),
   discriminatingWorlds: ({ count }) => {
     const wanted = parseCount(count) ?? 1;
@@ -316,7 +316,7 @@ var labelExists = defineCheck({
   template: "A label named {label} exists",
   params: { label: labelName },
   substrate: "final",
-  // An achievement — task 23's seed defines no `Parity Complete`, so the
+  // An achievement — the seed defines no `Parity Complete`, so the
   // examinee has to create it.
   polarity: () => "positive",
   // The name is a caller-supplied literal compared against state.
@@ -339,7 +339,7 @@ var labelExists = defineCheck({
           reason: `no label named "${label}" exists`,
           // The label COLLECTION — the honest citation for a lookup that found
           // nothing, and the arm a reader most wants to open: see for yourself
-          // that the name is not in it (F-1197).
+          // that the name is not in it.
           ...found.searched === void 0 ? {} : { evidenceStatePaths: [found.searched] }
         };
       }
@@ -393,7 +393,7 @@ var messageHasLabel = defineCheck({
       // places: the message row it resolved by id, and the join table it then
       // questioned. Labels are not nested under their message in this export —
       // that is the whole reason `messageCarriesLabel` exists — so one pointer
-      // could not say where this verdict came from (F-1197).
+      // could not say where this verdict came from.
       evidenceStatePaths: [found.path, carried.path]
     };
   }
@@ -513,7 +513,7 @@ var oneMessagePerRecipient = defineCheck({
 // ../packages/twin-gmail/dist/src/check-tape.js
 var noUnsupportedEndpoint = defineCheck({
   id: "gmail.no-unsupported-endpoint",
-  description: 'Scans the recorded call tape for any request the twin answered with fidelity "unsupported" \u2014 a route it does not implement, answered 501. It asserts nothing about whether the run SUCCEEDED, and nothing about calls that were merely rejected: a 404 or a 422 from a route the twin does implement is a semantic answer and passes this check. The tape is scoped to this twin by the engine before the check sees it, so an unsupported call to a DIFFERENT twin in a multi-twin session cannot fail it \u2014 which matters here, because task 27 runs gmail and github together.',
+  description: 'Scans the recorded call tape for any request the twin answered with fidelity "unsupported" \u2014 a route it does not implement, answered 501. It asserts nothing about whether the run SUCCEEDED, and nothing about calls that were merely rejected: a 404 or a 422 from a route the twin does implement is a semantic answer and passes this check. The tape is scoped to this twin by the engine before the check sees it, so an unsupported call to a DIFFERENT twin in a multi-twin session cannot fail it \u2014 which matters here, because a single task may run gmail and github together.',
   // No slots, and no twin word. The legacy cloud rule accepted "No unsupported
   // Gmail endpoint was called" alongside the bare form, plus plural and `were`
   // variants, because an author typed English. Under position 2 an author PICKS

package/dist/{chunk-JULH5ECU.js → chunk-F7YLHTCM.js}

@@ -1,5 +1,5 @@
 import { readManifest, normalizeManifestTwins } from './chunk-KUVTL4NZ.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-4ILBTPO4.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-5TEVH6RY.js';
 import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-PQYIAA6K.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { existsSync } from 'node:fs';

package/dist/{chunk-IY6G5NWT.js → chunk-LH4EGGQW.js}

@@ -98,7 +98,7 @@ var noMessageContaining = defineCheck({
   params: { needle: messageNeedle, scope: messageScope },
   substrate: "final",
   polarity: () => "negative",
-  // The quoted needle IS the subject (F-1028).
+  // The quoted needle IS the subject.
   subject: ({ needle }) => needle,
   // The needle is SCANNED, so falsifying it is a real trigger. The scope only
   // narrows the candidate set, so a closed set costs nothing here.
@@ -127,7 +127,7 @@ var noMessageContaining = defineCheck({
       passed: !hit,
       reason: hit ? `${publicOnly ? "public " : ""}channel "${hit.name}" has a message containing "${needle}"` : `no ${publicOnly ? "public channel" : "channel"} has a message containing "${needle}" (${candidates.length} channel(s) scanned)`,
       // The workspace's channel list, on BOTH arms and under both scopes
-      // (F-1197). Not the hitting channel on a fail and the list on a pass:
+      // Not the hitting channel on a fail and the list on a pass:
       // a citation whose PRECISION moves with the verdict is fine, but one whose
       // PRESENCE does is not, and once both arms must cite, the list is the
       // honest answer under `any public channel` too — the public set is
@@ -144,11 +144,10 @@ var noMessagePosted = defineCheck({
   substrate: "final",
   polarity: () => "negative",
   // No subject, and NOT merely because a channel name is a selector no redactor
-  // can eat. pome-cloud's `corpus.test.ts` proves the UNGUARDED
-  // redaction-hazard arm — "a predicate that compares a literal but forgets
-  // `subject`" — using THIS check with a channel named like a key. Declaring a
-  // subject here would reclassify that case as `dead` and leave the
-  // forgot-`subject` regression arm with nothing to test.
+  // can eat. This check is the canonical example of a predicate that compares a
+  // literal and deliberately declares no subject, so it is the one a consumer's
+  // own test suite is likely to reach for when exercising that case. Declaring a
+  // subject here would change which category it demonstrates.
   subject: () => null,
   // No falsifiable trigger. The channel is the only literal and it only
   // RESOLVES: a sentinel channel is `channel_not_found`, which skips, so the

package/dist/{chunk-WR7KP3LE.js → chunk-PRCZLT4W.js}

@@ -1,7 +1,7 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-4ILBTPO4.js';
-import { createRecorder, bootTwin } from './chunk-M3X6OT4N.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-5TEVH6RY.js';
+import { createRecorder, bootTwin } from './chunk-2CMCN5PW.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{runDemo-BCB6EDDN.js → runDemo-7NYX7S5T.js}

@@ -1,17 +1,17 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-WR7KP3LE.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-PRCZLT4W.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-4ILBTPO4.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-5TEVH6RY.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedOrchError } from './chunk-PQYIAA6K.js';
 import './chunk-SGDUD7KK.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-ZKID2HS3.js';
-import { bootTwin } from './chunk-M3X6OT4N.js';
-import './chunk-A3IDZXJY.js';
-import './chunk-LZIPGCQJ.js';
+import { bootTwin } from './chunk-2CMCN5PW.js';
+import './chunk-BK7HSHRA.js';
+import './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { readFile } from 'node:fs/promises';

package/dist/{runTrialGroup-YCSGW56C.js → runTrialGroup-BYUY5WJ7.js}

@@ -1,14 +1,14 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-JULH5ECU.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-F7YLHTCM.js';
 import './chunk-KUVTL4NZ.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-4ILBTPO4.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-5TEVH6RY.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedTrialError } from './chunk-PQYIAA6K.js';
 import './chunk-SGDUD7KK.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-ZKID2HS3.js';
-import './chunk-A3IDZXJY.js';
-import './chunk-LZIPGCQJ.js';
+import './chunk-BK7HSHRA.js';
+import './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { randomUUID } from 'node:crypto';

package/dist/{server-Y52EIWDP.js → server-NJBWJIS3.js}

@@ -1,3 +1,3 @@
-export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-LZIPGCQJ.js';
+export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 export { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';

package/dist/src/cli/main.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, loadTrialEvents, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-JULH5ECU.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, loadTrialEvents, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-F7YLHTCM.js';
 import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-KUVTL4NZ.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-WR7KP3LE.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-PRCZLT4W.js';
 import '../../chunk-XDU6TD4O.js';
 import '../../chunk-CBFKZZBR.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, readConfigTwins, scoreCountsSummary, markerFor, outcomeOf, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs } from '../../chunk-4ILBTPO4.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, readConfigTwins, scoreCountsSummary, markerFor, outcomeOf, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs } from '../../chunk-5TEVH6RY.js';
 import '../../chunk-NW7HGA2K.js';
 import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-PQYIAA6K.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-FKZZWWYC.js';
 import { seedSchema } from '../../chunk-SGDUD7KK.js';
-import { SLACK_CHECKS } from '../../chunk-IY6G5NWT.js';
-import { GMAIL_CHECKS } from '../../chunk-5ETJZJR6.js';
+import { SLACK_CHECKS } from '../../chunk-LH4EGGQW.js';
+import { GMAIL_CHECKS } from '../../chunk-EU6SGN7A.js';
 import '../../chunk-NJ246QPJ.js';
-import { LINEAR_CHECKS } from '../../chunk-XS66ZRBJ.js';
+import { LINEAR_CHECKS } from '../../chunk-3QVSXFJI.js';
 import '../../chunk-ZKID2HS3.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-NY55QTVQ.js';
-import '../../chunk-M3X6OT4N.js';
-import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-A3IDZXJY.js';
-import '../../chunk-LZIPGCQJ.js';
+import '../../chunk-2CMCN5PW.js';
+import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-BK7HSHRA.js';
+import '../../chunk-35TG2GHS.js';
 import { isLegacyEventRow, eventSchema } from '../../chunk-VBATFCWR.js';
 import { redactEvent, redactSecrets } from '../../chunk-SG6ZTIMT.js';
 import { Command } from 'commander';
@@ -850,7 +850,7 @@ async function throwForStatus(res) {
 
 // src/task/seed-verifier.ts
 async function verifySeedWithTwin(seed) {
-  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-RVUEXCKN.js');
+  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-WQE3MFBD.js');
   const db = openGitHubCloneDatabase(":memory:");
   try {
     new GitHubDomain(db).seed(seed);
@@ -1589,7 +1589,7 @@ var issueStateCheck = defineCheck({
   template: "Issue #{issue} in `{repo}` is in state {state}",
   params: { issue: issueNumber, repo: repoRef, state: issueState },
   substrate: "final",
-  // Per-arg. "is closed" asks the examinee to close it; "is open" is F-915's
+  // Per-arg. "is closed" asks the examinee to close it; "is open" is the twin's
   // "the agent did not close issue #1" — a prohibition wearing a state word.
   polarity: ({ state }) => state === "open" ? "negative" : "positive",
   subject: () => null,
@@ -1619,7 +1619,7 @@ var issueStateCheck = defineCheck({
         // The ROW, not `…/state` — the field this branch exists for is the one
         // that is absent, and a pointer at it would not resolve. Pointing at the
         // row is what lets a reader see the gap for themselves instead of taking
-        // the reason's word for it (F-1197).
+        // the reason's word for it.
         evidenceStatePaths: [found.path]
       };
     }
@@ -1639,7 +1639,7 @@ var issueHasLabel = defineCheck({
   substrate: "final",
   polarity: () => "positive",
   // The label is a caller-supplied literal compared against the state tree, so
-  // a redactor that destroys it makes this check unable to fire (F-1028).
+  // a redactor that destroys it makes this check unable to fire.
   subject: ({ label }) => label,
   // The label is what the scan ranges over; the issue number only resolves.
   vacuityMutant: (args) => ({ ...args, label: VACUITY_SENTINEL }),
@@ -1769,7 +1769,7 @@ var pullRequestStateCheck = defineCheck({
   template: "Pull request #{pr} in `{repo}` is {state}",
   params: { pr: prNumber, repo: repoRef, state: pullRequestState },
   substrate: "final",
-  // Per-arg, and the reason polarity takes the args at all: task 05 asserts
+  // Per-arg, and the reason polarity takes the args at all: one shipped task asserts
   // "PR #1 is merged" and "PR #2 is not merged" through this one template.
   // "open" is the same prohibition as the issue check's.
   polarity: ({ state }) => state === "not merged" || state === "open" ? "negative" : "positive",
@@ -1809,7 +1809,7 @@ var pullRequestStateCheck = defineCheck({
         status: "skipped",
         reason: `pull request #${pr} has no ${onMergeFlag ? "merged" : "state"} field in state_final (state_incomplete)`,
         // The ROW: the field this branch exists for is the absent one, so a
-        // pointer at it would resolve to nothing (F-1197).
+        // pointer at it would resolve to nothing.
         evidenceStatePaths: [found.path]
       };
     }
@@ -1924,7 +1924,7 @@ var pullRequestReviewExists = defineCheck({
 // ../packages/twin-github/dist/src/check-repos.js
 var noNewLabels = defineCheck({
   id: "github.no-new-labels",
-  // F-1074 — the same explanation the comment below carries, in the one place
+  // The same explanation the comment below carries, in the one place
   // an author can actually reach it.
   description: "Compares the repository's label DEFINITIONS in the seed against the final state. Applying an ALREADY-DEFINED label to an issue PASSES this check \u2014 only creating a label the repo did not already define fails it. `addIssueLabels` rejects an undefined label, so an examinee cannot apply a new one without creating it first, which is what makes this tight. Needs the seed: it is a delta, not a state assertion.",
   // The repo is named on purpose. Without it the sentence reads as an
@@ -2110,7 +2110,7 @@ var noUnsupportedEndpoint = defineCheck({
   // and under position 2 an author PICKS the check rather than typing it — so
   // the legacy regex's optional twin word ("No unsupported GitHub endpoint was
   // called") and its plural/`were` variants are retired rather than ported,
-  // exactly as F-1075 retired `issue-has-label-generic`.
+  // exactly as the generic `issue-has-label` phrasing was retired.
   template: "No unsupported endpoint was called",
   params: {},
   substrate: "tape",
@@ -2124,7 +2124,7 @@ var noUnsupportedEndpoint = defineCheck({
   // trigger is "a call with fidelity=unsupported exists", which lives on the
   // tape and not in the sentence. Reported as `no_trigger`, never as clean.
   vacuityMutant: () => null,
-  // F-1076 already shipped both of these as tests; this is the same pair,
+  // Both of these already shipped as tests; this is the same pair,
   // promoted to the declaration.
   discriminatingWorlds: () => ({
     passing: tapeWorld([
@@ -2439,7 +2439,7 @@ var paymentIntentAmount = defineCheck({
     return {
       passed: found,
       reason: found ? `a PaymentIntent exists with amount ${wanted}` : `no PaymentIntent has amount ${wanted} (amounts: [${pis.map((pi) => pi.amount ?? "?").join(", ")}])`,
-      // The COLLECTION, not the matching row (F-1197). Every check in this file
+      // The COLLECTION, not the matching row. Every check in this file
       // scans a whole collection and answers a question about the set — "does
       // one exist with…" — so the set is what was read. Citing the hit on a pass
       // and the collection on a fail would make the pointer's shape track the
@@ -2567,7 +2567,7 @@ var eventEmitted = defineCheck({
   id: "stripe.event-emitted",
   description: "Asserts the account's event log contains at least one event of this type. The twin delivers no webhooks in v1 \u2014 an examinee observes events by polling `GET /v1/events` \u2014 so this reads the log the twin appended, not anything the examinee received. It asserts nothing about WHICH resource the event names: `payment_intent.succeeded` is emitted by both the card confirm path and the x402 crypto-deposit settlement, and this check deliberately does not distinguish them, because the criterion asking for it is about the outcome rather than the rail. An absent `events` key is a SKIP.",
   // No quotes, and that is load-bearing: the corpus already says
-  // `payment_intent.succeeded is emitted`, so this template re-renders task 12's
+  // `payment_intent.succeeded is emitted`, so this template re-renders that task's
   // existing criterion byte-identically and the migration rewrites it not at
   // all. The dot lives inside the closed set's members, which `oneOf` escapes,
   // so it matches a dot rather than any character.
@@ -2629,7 +2629,7 @@ var refundExists = defineCheck({
     return {
       passed: rows.found.length > 0,
       reason: rows.found.length > 0 ? `charge "${args.charge}" has ${rows.found.length} refund row(s)` : `charge "${args.charge}" has no refund rows`,
-      // The refund COLLECTION (F-1197). Rows are not nested under their charge —
+      // The refund COLLECTION. Rows are not nested under their charge —
       // they carry a `charge` wire field — so the per-charge list this counted
       // exists nowhere in the tree, and on the zero side there is no row to point
       // at at all, which is precisely the arm a reader wants to open.
@@ -4490,7 +4490,7 @@ var DEFAULT_AGENT_FILE = "examples/agents/scripted-triage-agent.ts";
 var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 function readPackageVersion() {
-  if ("0.21.7".length > 0) return "0.21.7";
+  if ("0.21.9".length > 0) return "0.21.9";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -4945,7 +4945,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-4GJB73YX.js');
+        const { runDoctorChecks } = await import('../../checks-ZWCORWK4.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -4983,7 +4983,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-YCSGW56C.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-BYUY5WJ7.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5077,7 +5077,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-BCB6EDDN.js');
+      const { runDemo } = await import('../../runDemo-7NYX7S5T.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5095,7 +5095,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-4GJB73YX.js');
+    const { runDoctorChecks } = await import('../../checks-ZWCORWK4.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5227,7 +5227,7 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-4OGP2GBY.js');
+    const { runTwinStartCommand } = await import('../../twinStart-5ZWCVBPZ.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("reset").argument("[name]", "Twin name (default: github)", "github").description("Reset standalone twin state").action(async (name) => {

package/dist/{src-GGRWNJTK.js → src-4ZLCEPCN.js}

@@ -1,6 +1,6 @@
-export { SLACK_CHECKS } from './chunk-IY6G5NWT.js';
+export { SLACK_CHECKS } from './chunk-LH4EGGQW.js';
 import './chunk-NY55QTVQ.js';
-import { defineTwin, queryTokenResolver, formTokenResolver, UnknownToolError, openTwinDatabase, createApp } from './chunk-LZIPGCQJ.js';
+import { defineTwin, queryTokenResolver, formTokenResolver, UnknownToolError, openTwinDatabase, createApp } from './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { z, ZodError } from 'zod';

package/dist/{src-K3KTJTMG.js → src-CI5W335G.js}

@@ -1,8 +1,8 @@
-export { LINEAR_CHECKS } from './chunk-XS66ZRBJ.js';
+export { LINEAR_CHECKS } from './chunk-3QVSXFJI.js';
 import { MCP_PAGE_MAX, defaultSeedState, linearSeedSchema, notFound, badUserInput, MCP_PAGE_DEFAULT, DEFAULT_LINEAR_EMAIL, RELAY_PAGE_MAX, RELAY_PAGE_DEFAULT, STATE_EXPORT_CAP, parseSeed, DEFAULT_LINEAR_CLOCK, LINEAR_PROVIDER_TOKEN_PREFIX, DEFAULT_LINEAR_SID, DEFAULT_SCOPES, linearErrorEnvelope, unauthorizedEnvelope, unsupportedEnvelope, assertWebhookUrl, ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_SECONDS, TITLE_MAX_BYTES, BODY_MAX_BYTES, LinearTwinError, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX } from './chunk-ZKID2HS3.js';
 export { DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, STATE_EXPORT_CAP, assertWebhookUrl, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError } from './chunk-ZKID2HS3.js';
 import './chunk-NY55QTVQ.js';
-import { openTwinDatabase, defineTwin, createApp } from './chunk-LZIPGCQJ.js';
+import { openTwinDatabase, defineTwin, createApp } from './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { createHmac, timingSafeEqual, createHash, randomBytes } from 'node:crypto';

package/dist/{src-4SVLX7UK.js → src-PJGE6SSY.js}

@@ -1,4 +1,4 @@
-import { failureInjectionRuleSchema, openTwinDatabase, createFailureInjectionStore, defineTwin, twinBuildInfo, failureInjectionMiddleware, createApp, FAILURE_INJECTION_OVERRIDE_KEY, recordedRequestHeaders, UnknownToolError } from './chunk-LZIPGCQJ.js';
+import { failureInjectionRuleSchema, openTwinDatabase, createFailureInjectionStore, defineTwin, twinBuildInfo, failureInjectionMiddleware, createApp, FAILURE_INJECTION_OVERRIDE_KEY, recordedRequestHeaders, UnknownToolError } from './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { z, ZodError } from 'zod';

package/dist/{src-FLTYWM6P.js → src-TKGHXPEM.js}

@@ -1,8 +1,8 @@
-export { GMAIL_CHECKS } from './chunk-5ETJZJR6.js';
+export { GMAIL_CHECKS } from './chunk-EU6SGN7A.js';
 import { gmailErrorEnvelope, gmailSeedSchema, parseSeed, defaultSeedState, notFound, invalidArgument, checkFault, unsupported, validateSearchQuery, SEARCH_MAILBOX_MESSAGE_BUDGET, GmailError, parseSearchQuery, CATEGORY_LABELS, parseDate, parseSize, KNOWN_FIELDS, parseDuration, assertHasOperator } from './chunk-NJ246QPJ.js';
 export { DEFAULT_GMAIL_AGENT_EMAIL, GmailError, SEARCH_MAILBOX_MESSAGE_BUDGET, agentPathInboxMailbox, defaultSeedState, gmailErrorEnvelope, gmailSeedSchema, loadSeedFromEnv, parseSearchQuery, parseSeed, validateSearchQuery } from './chunk-NJ246QPJ.js';
 import './chunk-NY55QTVQ.js';
-import { defineTwin, openTwinDatabase, createApp } from './chunk-LZIPGCQJ.js';
+import { defineTwin, openTwinDatabase, createApp } from './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { createHash, createHmac, timingSafeEqual, randomBytes } from 'node:crypto';

package/dist/{src-RVUEXCKN.js → src-WQE3MFBD.js}

@@ -1,7 +1,7 @@
 import './chunk-FKZZWWYC.js';
 import { defaultSeedState, parseSeed } from './chunk-SGDUD7KK.js';
 export { defaultSeedState, parseSeed, seedSchema } from './chunk-SGDUD7KK.js';
-import { defineTwin, twinBuildInfo, UnknownToolError, openTwinDatabase, createApp } from './chunk-LZIPGCQJ.js';
+import { defineTwin, twinBuildInfo, UnknownToolError, openTwinDatabase, createApp } from './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { z, ZodError } from 'zod';

package/dist/twinHarness-CJX3IXR3.js

@@ -0,0 +1,5 @@
+export { UnsupportedTwinError, bootTwin } from './chunk-2CMCN5PW.js';
+export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-BK7HSHRA.js';
+import './chunk-35TG2GHS.js';
+import './chunk-VBATFCWR.js';
+import './chunk-SG6ZTIMT.js';

package/dist/{twinStart-4OGP2GBY.js → twinStart-5ZWCVBPZ.js}

@@ -1,6 +1,6 @@
-import { bootTwin } from './chunk-M3X6OT4N.js';
-import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-A3IDZXJY.js';
-import './chunk-LZIPGCQJ.js';
+import { bootTwin } from './chunk-2CMCN5PW.js';
+import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-BK7HSHRA.js';
+import './chunk-35TG2GHS.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { randomBytes } from 'node:crypto';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.21.7",
-  "description": "Digital-twin testing for AI agents — run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
+  "version": "0.21.9",
+  "description": "Digital-twin testing for AI agents \u2014 run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",
     "agents",

package/dist/twinHarness-KFZ2ZNAX.js

@@ -1,5 +0,0 @@
-export { UnsupportedTwinError, bootTwin } from './chunk-M3X6OT4N.js';
-export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-A3IDZXJY.js';
-import './chunk-LZIPGCQJ.js';
-import './chunk-VBATFCWR.js';
-import './chunk-SG6ZTIMT.js';