@pome-sh/cli 0.23.13 → 0.23.14

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.23.13",
-  "git_sha": "65d6266c94c59cf3e9d8b5777840dd40ddc41d07",
-  "build_time": "2026-08-11T19:22:37.274Z"
+  "version": "0.23.14",
+  "git_sha": "43a7d48701b728fa11ae89ac2f7979764f57202b",
+  "build_time": "2026-08-11T19:35:40.126Z"
 }

package/dist/{checks-PIKAIYCV.js → checks-CRT2VDNJ.js}

@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-RX4JGRF7.js');
+    const { bootTwin } = await import('./twinHarness-7DY2UT3E.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-S4BTGV2F.js → chunk-2QCITOSZ.js}

@@ -1,5 +1,5 @@
 import { readManifest, normalizeManifestTwins } from './chunk-ABM3CMQB.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-LN4LYSDM.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-YOTVS3WV.js';
 import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-X66JOOO7.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { existsSync } from 'node:fs';

package/dist/{chunk-XXLZX377.js → chunk-55GQPSNU.js}

@@ -1,4 +1,4 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-K7GW44D4.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-LIU7WE6S.js';
 import { createFileBackedRecorderStore, createRecorderStore } from './chunk-TV5S6WQV.js';
 
 // src/recorder/recorder.ts

package/dist/{chunk-K7GW44D4.js → chunk-LIU7WE6S.js}

@@ -1,14 +1,14 @@
 // ../packages/twin-github/package.json
 var package_default = {
-  version: "0.10.5"};
+  version: "0.10.6"};
 
 // ../packages/twin-slack/package.json
 var package_default2 = {
-  version: "0.4.0"};
+  version: "0.4.1"};
 
 // ../packages/twin-stripe/package.json
 var package_default3 = {
-  version: "0.4.6"};
+  version: "0.4.7"};
 
 // ../packages/twin-gmail/package.json
 var package_default4 = {
@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-HY6FVT2U.js');
+      } = await import('./src-WCMVMQYY.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -59,9 +59,9 @@ var TWIN_REGISTRY = {
     envName: "SLACK",
     defaultPort: 3333,
     version: package_default2.version,
-    defaultSeed: async () => (await import('./src-ZRMSHGVJ.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-W6P253DD.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-ZRMSHGVJ.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-W6P253DD.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -84,9 +84,9 @@ var TWIN_REGISTRY = {
     envName: "STRIPE",
     defaultPort: 3333,
     version: package_default3.version,
-    defaultSeed: async () => (await import('./src-C2SRMLET.js')).defaultSeed(),
+    defaultSeed: async () => (await import('./src-ITPKDJJN.js')).defaultSeed(),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-C2SRMLET.js');
+      const stripeTwin = await import('./src-ITPKDJJN.js');
       const { createApp } = await import('./server-DR56XIGP.js');
       const {
         applySeed: applyStripeSeed,
@@ -173,7 +173,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-HY6FVT2U.js');
+  const { createGitHubCloneApp } = await import('./src-WCMVMQYY.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-JLPFOM5I.js → chunk-QN65HV4S.js}

@@ -1,7 +1,7 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-LN4LYSDM.js';
-import { createRecorder, bootTwin } from './chunk-XXLZX377.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-YOTVS3WV.js';
+import { createRecorder, bootTwin } from './chunk-55GQPSNU.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{chunk-LN4LYSDM.js → chunk-YOTVS3WV.js}

@@ -2,7 +2,7 @@ import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, Hos
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-KIUIKAVU.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-ZKID2HS3.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-K7GW44D4.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-LIU7WE6S.js';
 import { toTwinHttpEventRow } from './chunk-TV5S6WQV.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';

package/dist/{runDemo-JJ43IFEG.js → runDemo-5M6UZ63N.js}

@@ -1,16 +1,16 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-JLPFOM5I.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-QN65HV4S.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-LN4LYSDM.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-YOTVS3WV.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedOrchError } from './chunk-X66JOOO7.js';
 import './chunk-KIUIKAVU.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-ZKID2HS3.js';
-import { bootTwin } from './chunk-XXLZX377.js';
-import './chunk-K7GW44D4.js';
+import { bootTwin } from './chunk-55GQPSNU.js';
+import './chunk-LIU7WE6S.js';
 import './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';

package/dist/{runTrialGroup-ECHJKYVY.js → runTrialGroup-DRMURVDS.js}

@@ -1,13 +1,13 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-S4BTGV2F.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-2QCITOSZ.js';
 import './chunk-ABM3CMQB.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-LN4LYSDM.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-YOTVS3WV.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedTrialError } from './chunk-X66JOOO7.js';
 import './chunk-KIUIKAVU.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-ZKID2HS3.js';
-import './chunk-K7GW44D4.js';
+import './chunk-LIU7WE6S.js';
 import './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';

package/dist/src/cli/main.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-S4BTGV2F.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-2QCITOSZ.js';
 import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-ABM3CMQB.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-JLPFOM5I.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-QN65HV4S.js';
 import '../../chunk-XDU6TD4O.js';
 import '../../chunk-CBFKZZBR.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-LN4LYSDM.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-YOTVS3WV.js';
 import '../../chunk-NW7HGA2K.js';
 import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-X66JOOO7.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-FKZZWWYC.js';
@@ -15,8 +15,8 @@ import '../../chunk-NJ246QPJ.js';
 import { LINEAR_CHECKS } from '../../chunk-XBT6ZLBG.js';
 import '../../chunk-ZKID2HS3.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-JWJYNAWI.js';
-import '../../chunk-XXLZX377.js';
-import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-K7GW44D4.js';
+import '../../chunk-55GQPSNU.js';
+import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-LIU7WE6S.js';
 import '../../chunk-TV5S6WQV.js';
 import { isLegacyEventRow, eventSchema } from '../../chunk-VBATFCWR.js';
 import { redactEvent, redactSecrets } from '../../chunk-SG6ZTIMT.js';
@@ -850,7 +850,7 @@ async function throwForStatus(res) {
 
 // src/task/seed-verifier.ts
 async function verifySeedWithTwin(seed) {
-  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-HY6FVT2U.js');
+  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-WCMVMQYY.js');
   const db = openGitHubCloneDatabase(":memory:");
   try {
     new GitHubDomain(db).seed(seed);
@@ -4541,7 +4541,7 @@ var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 var MAX_UNREADABLE_PATHS_SHOWN = 5;
 function readPackageVersion() {
-  if ("0.23.13".length > 0) return "0.23.13";
+  if ("0.23.14".length > 0) return "0.23.14";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -4996,7 +4996,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-PIKAIYCV.js');
+        const { runDoctorChecks } = await import('../../checks-CRT2VDNJ.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -5034,7 +5034,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-ECHJKYVY.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-DRMURVDS.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5128,7 +5128,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-JJ43IFEG.js');
+      const { runDemo } = await import('../../runDemo-5M6UZ63N.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5146,7 +5146,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-PIKAIYCV.js');
+    const { runDoctorChecks } = await import('../../checks-CRT2VDNJ.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5322,7 +5322,7 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-SIDMQ4CE.js');
+    const { runTwinStartCommand } = await import('../../twinStart-UFOABD4N.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("reset").argument("[name]", "Twin name (default: github)", "github").description("Reset standalone twin state").action(async (name) => {

package/dist/{src-C2SRMLET.js → src-ITPKDJJN.js}

@@ -2947,11 +2947,27 @@ var STRIPE_ROUTES = {
     bodyEncoding: "form",
     body: CUSTOMER_FIELDS_BODY
   }),
+  // F-1389 (ST-DECL-IN-001) — NOT `LIST_QUERY`. This is the one list surface
+  // that does not take `created`: `GetCustomersCustomerPaymentMethods` declares
+  // `allow_redisplay, ending_before, expand, limit, starting_after, type` and
+  // nothing else, and Stripe's measured disposition is `refuse` — it publishes
+  // `parameter_unknown`. Sharing `LIST_QUERY` here meant a request Stripe
+  // rejects outright succeeded, so an exam scored a call the real API declined.
+  // Leaving it undeclared is what makes the twin refuse it too: the declaration
+  // IS the validator, and this twin's declarer is `refuse`. That is why this
+  // one is spelled out rather than fixed by spreading a narrower shared shape —
+  // the point is the absence, and a future `LIST_QUERY` edit must not put
+  // `created` back by inheritance.
   listCustomerPaymentMethods: declareInputs({
     method: "GET",
     path: "/v1/customers/:id/payment_methods",
     pathParams: ID_PATH,
-    query: { ...LIST_QUERY, type: z.string().optional() }
+    query: {
+      limit: LIST_QUERY.limit,
+      starting_after: LIST_QUERY.starting_after,
+      ending_before: LIST_QUERY.ending_before,
+      type: z.string().optional()
+    }
   }),
   retrieveCustomer: declareInputs({
     method: "GET",

package/dist/{src-ZRMSHGVJ.js → src-W6P253DD.js}

@@ -1526,7 +1526,7 @@ function conversationsOpen(domain, args, actor, onDelta = NOOP3) {
 function filesUpload(domain, args, actor, onDelta = NOOP3) {
   const workspace = domain.requireWorkspace();
   const acting = domain.resolveActorUser(actor);
-  const channelsRaw = args.channels ?? args.channel ?? "";
+  const channelsRaw = args.channels ?? "";
   const channelIds = channelsRaw.split(",").map((s) => s.trim()).filter(Boolean).map((ref) => domain.requireChannel(ref).id);
   const id = domain.allocId(workspace.id, "F");
   const name = args.filename ?? `untitled-${id}.txt`;
@@ -2475,8 +2475,14 @@ var SLACK_WRITES = {
     timestamp: emptyIfAbsent()
   }),
   filesUpload: slackWrite("/files.upload", {
+    // F-1389 (SLACK-DECL-IN-003) — `channels` (plural, comma-separated) only.
+    // Slack has never documented a singular `channel` here, and the vendored
+    // `slack_web_openapi_v2` snapshot agrees: it declares `channels` and eight
+    // other real arguments, so it is not thin on this method. An upload
+    // addressed `channel=C123` landed in that channel here and in no channel at
+    // all on Slack. Undeclared now, so slack's measured disposition (`ignore`)
+    // discards it instead of the handler forwarding it to `domain.filesUpload`.
     channels: absentIfEmpty(),
-    channel: absentIfEmpty(),
     filename: absentIfEmpty(),
     title: absentIfEmpty(),
     filetype: absentIfEmpty(),
@@ -2645,7 +2651,6 @@ function registerSlackRoutes(app, { domain, recorder }) {
   }, actor));
   write(SLACK_WRITES.filesUpload, (args, actor, delta) => domain.filesUpload({
     channels: args.channels,
-    channel: args.channel,
     filename: args.filename,
     title: args.title,
     filetype: args.filetype,

package/dist/{src-HY6FVT2U.js → src-WCMVMQYY.js}

@@ -25,6 +25,22 @@ var repositoryBody = {
 var commentBody = { body: z.string().min(1) };
 var GITHUB_ROUTES = {
   // ----- search -----
+  //
+  // GH-DECL-IN-001 / GH-DECL-IN-002 (F-1389) — all five take `q` and nothing but
+  // `q`. GitHub's search API has ONE scoping input and encodes every filter as a
+  // qualifier inside it (`repo:octocat/hello-world`, `state:open`); its OpenAPI
+  // declares `q, sort, order, per_page, page`. `/search/code`,
+  // `/search/commits` and `/search/issues` used to declare `owner` / `repo`
+  // (and `state`) alongside and scope by them, so the same request was scoped
+  // here and unscoped on GitHub.
+  //
+  // They are undeclared rather than refused, per github's measured `ignore`
+  // ruling — a request still sending them gets the answer it would have got
+  // without them, which is what real GitHub does. The scoping moved into `q`:
+  // `domain/search.ts` parses `repo:` / `user:` / `org:` / `state:` out of it.
+  // Both halves had to land together — deleting the parameters alone would have
+  // left `q=idempotency repo:acme/api` still answering zero, which is the
+  // mirror defect and the worse one.
   searchRepositories: declareInputs({
     method: "GET",
     path: "/search/repositories",
@@ -33,23 +49,12 @@ var GITHUB_ROUTES = {
   searchCode: declareInputs({
     method: "GET",
     path: "/search/code",
-    query: {
-      q: z.string().optional(),
-      owner: z.string().optional(),
-      repo: z.string().optional(),
-      ...pageQuery
-    }
+    query: { q: z.string().optional(), ...pageQuery }
   }),
   searchIssues: declareInputs({
     method: "GET",
     path: "/search/issues",
-    query: {
-      q: z.string().optional(),
-      owner: z.string().optional(),
-      repo: z.string().optional(),
-      state: stateFilter,
-      ...pageQuery
-    }
+    query: { q: z.string().optional(), ...pageQuery }
   }),
   searchUsers: declareInputs({
     method: "GET",
@@ -59,12 +64,7 @@ var GITHUB_ROUTES = {
   searchCommits: declareInputs({
     method: "GET",
     path: "/search/commits",
-    query: {
-      q: z.string().optional(),
-      owner: z.string().optional(),
-      repo: z.string().optional(),
-      ...pageQuery
-    }
+    query: { q: z.string().optional(), ...pageQuery }
   }),
   // ----- repositories -----
   getRepository: declareInputs({
@@ -76,15 +76,22 @@ var GITHUB_ROUTES = {
     method: "POST",
     path: "/user/repos",
     bodyEncoding: "json",
-    body: { ...repositoryBody, owner: z.string().min(1).optional() }
+    // F-1389 (GH-DECL-IN-003) — no `owner`. This surface creates a repository
+    // for the AUTHENTICATED USER, which is its whole meaning;
+    // `repos/create-for-authenticated-user` declares 23 body properties and
+    // `owner` is not one. `routes.ts` passed the body straight to
+    // `domain.createRepository`, so the one surface defined not to take an
+    // owner could be made to create a repository under an arbitrary one.
+    // Undeclared now, so `parse()` never hands it to the handler, and github's
+    // measured disposition (`ignore`) discards it rather than 422-ing a request
+    // real GitHub accepts and ignores.
+    body: { ...repositoryBody }
   }),
-  // `owner` is declared in BOTH locations, because the twin accepts it in both.
-  //
-  // The handler spreads the body schema and then overwrites `owner` with the
-  // path value, so the body copy is read and discarded. Declaring only the path
-  // one would turn that into a 422 for a request the twin has always accepted —
-  // a divergence this ticket invented rather than found. The declaration records
-  // what is true: two locations, one of which the handler ignores.
+  // `owner` stays declared on the ORG surface, and the contrast is the whole
+  // argument: there the handler overwrites it with the path value, so the body
+  // copy is read and discarded and nothing observable differs. That one is
+  // registered `accepted` (GH-DECL-IN-004); the `/user/repos` one above was
+  // registered `open-defect` because there the body copy reached the domain.
   createOrgRepository: declareInputs({
     method: "POST",
     path: "/orgs/:owner/repos",
@@ -121,8 +128,16 @@ var GITHUB_ROUTES = {
       message: z.string().min(1),
       content: z.string(),
       branch: z.string().optional(),
-      sha: z.string().optional(),
-      encoding: z.enum(["utf-8", "base64"]).optional()
+      sha: z.string().optional()
+      // F-1389 (GH-DECL-IN-005) — no `encoding`. GitHub declares `content` as
+      // "the new file content, using Base64 encoding" and takes no `encoding`
+      // parameter: base64 is the only encoding this surface has. Undeclared
+      // now, so github's measured disposition (`ignore`) discards it.
+      //
+      // ⚠️ This closes the DECLARED drift, not the behavioural one. The twin
+      // still treats `content` as plain text rather than base64 — recorded as
+      // divergence 24, and unified across both doors in the follow-up ticket
+      // that owns the 47-call-site migration.
     }
   }),
   listCommits: declareInputs({
@@ -3306,6 +3321,39 @@ function addCollaboratorAction(domain, input, onDelta) {
 }
 
 // ../packages/twin-github/dist/src/domain/search.js
+var QUALIFIER = /(^|\s)(repo|user|org|state):(\S+)/gi;
+function parseSearchQuery(raw, options = {}) {
+  const owners = [];
+  const fullNames = [];
+  let state;
+  const text = raw.replace(QUALIFIER, (whole, lead, key, rawValue) => {
+    const value = rawValue.toLowerCase();
+    switch (key.toLowerCase()) {
+      case "repo":
+        if (!value.includes("/"))
+          return whole;
+        fullNames.push(value);
+        return lead;
+      case "user":
+      case "org":
+        owners.push(value);
+        return lead;
+      case "state":
+        if (!options.state || value !== "open" && value !== "closed")
+          return whole;
+        state = value;
+        return lead;
+      default:
+        return whole;
+    }
+  });
+  return { text: text.replace(/\s+/g, " ").trim().toLowerCase(), owners, fullNames, state };
+}
+function inScope(parsed, owner, fullName) {
+  if (parsed.owners.length === 0 && parsed.fullNames.length === 0)
+    return true;
+  return parsed.fullNames.includes(fullName.toLowerCase()) || parsed.owners.includes(owner.toLowerCase());
+}
 function searchRepositories(domain, input) {
   const query = (input.query ?? input.q ?? "").toLowerCase();
   const repos = domain.db.prepare("SELECT * FROM repositories ORDER BY full_name ASC").all().filter((repo) => !query || repo.full_name.toLowerCase().includes(query) || repo.description.toLowerCase().includes(query));
@@ -3319,13 +3367,14 @@ function searchUsers(domain, input) {
   return { total_count: users.length, incomplete_results: false, items: paginate(users, input.page, input.per_page ?? input.perPage).map((user) => userJson(user.login, user.type)) };
 }
 function searchCode(domain, input) {
-  const query = (input.query ?? input.q ?? "").toLowerCase();
+  const parsed = parseSearchQuery(input.query ?? input.q ?? "");
   let rows = domain.db.prepare("SELECT files.*, repositories.owner, repositories.name, repositories.full_name, repositories.description, repositories.private, repositories.default_branch, repositories.fork, repositories.parent_full_name, repositories.entity_counter, repositories.created_at, repositories.updated_at FROM files INNER JOIN repositories ON files.repo_id = repositories.id WHERE files.branch = repositories.default_branch ORDER BY repositories.full_name, files.path").all();
   if (input.owner)
     rows = rows.filter((row) => row.owner === input.owner);
   if (input.repo)
     rows = rows.filter((row) => row.name === input.repo);
-  rows = rows.filter((row) => !query || row.path.toLowerCase().includes(query) || row.content.toLowerCase().includes(query));
+  rows = rows.filter((row) => inScope(parsed, row.owner, row.full_name));
+  rows = rows.filter((row) => !parsed.text || row.path.toLowerCase().includes(parsed.text) || row.content.toLowerCase().includes(parsed.text));
   return {
     total_count: rows.length,
     incomplete_results: false,
@@ -3341,19 +3390,20 @@ function searchCode(domain, input) {
   };
 }
 function searchCommits(domain, input) {
-  const query = (input.query ?? input.q ?? "").toLowerCase();
+  const parsed = parseSearchQuery(input.query ?? input.q ?? "");
   let repos = domain.db.prepare("SELECT * FROM repositories ORDER BY full_name ASC").all();
   if (input.owner)
     repos = repos.filter((repo) => repo.owner === input.owner);
   if (input.repo)
     repos = repos.filter((repo) => repo.name === input.repo);
+  repos = repos.filter((repo) => inScope(parsed, repo.owner, repo.full_name));
   const matches = [];
   for (const repo of repos) {
     const branch = domain.db.prepare("SELECT * FROM branches WHERE repo_id = ? AND name = ?").get(repo.id, repo.default_branch);
     if (!branch?.head_sha)
       continue;
     for (const commit of domain.commitAncestry(repo.id, branch.head_sha)) {
-      if (!query || commit.message.toLowerCase().includes(query) || commit.author_login.toLowerCase().includes(query))
+      if (!parsed.text || commit.message.toLowerCase().includes(parsed.text) || commit.author_login.toLowerCase().includes(parsed.text))
         matches.push({ commit, repo });
     }
   }
@@ -3364,15 +3414,17 @@ function searchCommits(domain, input) {
   };
 }
 function searchIssues(domain, input) {
-  const query = (input.query ?? input.q ?? "").toLowerCase();
+  const parsed = parseSearchQuery(input.query ?? input.q ?? "", { state: true });
   const rows = domain.db.prepare("SELECT issues.*, repositories.owner, repositories.name, repositories.full_name, repositories.description, repositories.private, repositories.default_branch, repositories.fork, repositories.parent_full_name, repositories.entity_counter, repositories.created_at AS repo_created_at, repositories.updated_at AS repo_updated_at FROM issues INNER JOIN repositories ON issues.repo_id = repositories.id ORDER BY issues.updated_at DESC").all();
-  let filtered = rows.filter((issue) => !query || issue.title.toLowerCase().includes(query) || issue.body.toLowerCase().includes(query) || issue.full_name.toLowerCase().includes(query));
+  let filtered = rows.filter((issue) => !parsed.text || issue.title.toLowerCase().includes(parsed.text) || issue.body.toLowerCase().includes(parsed.text) || issue.full_name.toLowerCase().includes(parsed.text));
+  filtered = filtered.filter((issue) => inScope(parsed, issue.owner, issue.full_name));
   if (input.owner)
     filtered = filtered.filter((issue) => issue.owner === input.owner);
   if (input.repo)
     filtered = filtered.filter((issue) => issue.name === input.repo);
-  if (input.state && input.state !== "all")
-    filtered = filtered.filter((issue) => issue.state === input.state);
+  const state = parsed.state ?? (input.state === "all" ? void 0 : input.state);
+  if (state)
+    filtered = filtered.filter((issue) => issue.state === state);
   return {
     total_count: filtered.length,
     incomplete_results: false,

package/dist/twinHarness-7DY2UT3E.js

@@ -0,0 +1,5 @@
+export { UnsupportedTwinError, bootTwin } from './chunk-55GQPSNU.js';
+export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-LIU7WE6S.js';
+import './chunk-TV5S6WQV.js';
+import './chunk-VBATFCWR.js';
+import './chunk-SG6ZTIMT.js';

package/dist/{twinStart-SIDMQ4CE.js → twinStart-UFOABD4N.js}

@@ -1,5 +1,5 @@
-import { bootTwin } from './chunk-XXLZX377.js';
-import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-K7GW44D4.js';
+import { bootTwin } from './chunk-55GQPSNU.js';
+import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-LIU7WE6S.js';
 import './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.23.13",
+  "version": "0.23.14",
   "description": "Digital-twin testing for AI agents \u2014 run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",

package/dist/twinHarness-RX4JGRF7.js

@@ -1,5 +0,0 @@
-export { UnsupportedTwinError, bootTwin } from './chunk-XXLZX377.js';
-export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-K7GW44D4.js';
-import './chunk-TV5S6WQV.js';
-import './chunk-VBATFCWR.js';
-import './chunk-SG6ZTIMT.js';