@pome-sh/cli 0.23.45 → 0.23.47

package/README.md

@@ -121,14 +121,17 @@ npm test
 
 The package publishes the `pome` binary from `dist/src/cli/main.js`.
 
-### Versioning — every behavior change ships with a bump
+### Versioning — every behavior change ships with a release, and you do not write the number
 
-Bump `version` in `cli/package.json` and add the user-facing entry to
-`CHANGELOG.md` in the same PR. Merging to `main` is the release trigger:
+Add the user-facing entry to `CHANGELOG.md` under an `## Unreleased (patch)` (or
+`(minor)`) heading, above the newest released one, and leave `version` in
+`cli/package.json` alone — a PR that moves it fails CI. Merging to `main` is the
+release trigger: `.github/workflows/allocate-version.yml` allocates the number
+there, rewriting that heading and the manifest in one commit, and
 `.github/workflows/release.yml` compares the local version against npm and
-publishes when they differ. `pome --version` reports the bumped value from a
+publishes when they differ. `pome --version` reports the allocated value from a
 build-time constant, so a user can always tell whether their install carries a
-given fix.
+given fix. See [`RELEASING.md`](../RELEASING.md).
 
 ## License
 

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.23.45",
-  "git_sha": "7a8c37c3e89a791bc34e20bb69d127dc2050c304",
-  "build_time": "2026-08-13T14:37:28.198Z"
+  "version": "0.23.47",
+  "git_sha": "95240f908f2348af9ad981943e2aab76b5df844b",
+  "build_time": "2026-08-13T17:53:11.645Z"
 }

package/dist/{checks-5T2MVAUX.js → checks-T3EWJXDT.js}

@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-MRRHZ6WW.js');
+    const { bootTwin } = await import('./twinHarness-IMJBFVAL.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-OW7VVW6X.js → chunk-5EGHN6H4.js}

@@ -447,7 +447,7 @@ function isLoopbackAddress(remote) {
   return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1" || remote === "localhost";
 }
 function defaultForbidden() {
-  return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
+  return Response.json({ message: "Forbidden" }, { status: 403 });
 }
 function createAdminGate(options = {}) {
   const forbidden = options.forbidden ?? defaultForbidden;
@@ -576,11 +576,11 @@ function formTokenResolver(param = "token") {
 }
 var defaultUnauthorized = () => ({
   status: 401,
-  body: { message: "Bad credentials", documentation_url: "" }
+  body: { message: "Bad credentials" }
 });
 var defaultSidMismatch = () => ({
   status: 401,
-  body: { message: "Forbidden", documentation_url: "" }
+  body: { message: "Forbidden" }
 });
 function respond(envelope) {
   return Response.json(envelope.body, { status: envelope.status });

package/dist/{chunk-F3KQCVWU.js → chunk-AS477MNU.js}

@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-OYBYLMMI.js');
+      } = await import('./src-7Z35KM4S.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -59,9 +59,9 @@ var TWIN_REGISTRY = {
     envName: "SLACK",
     defaultPort: 3333,
     version: package_default2.version,
-    defaultSeed: async () => (await import('./src-6RAKZPHK.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-BAPCY3ID.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-6RAKZPHK.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-BAPCY3ID.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -84,10 +84,10 @@ var TWIN_REGISTRY = {
     envName: "STRIPE",
     defaultPort: 3333,
     version: package_default3.version,
-    defaultSeed: async () => (await import('./src-HRW7OZBS.js')).defaultSeed(),
+    defaultSeed: async () => (await import('./src-NMHFBKVW.js')).defaultSeed(),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-HRW7OZBS.js');
-      const { createApp } = await import('./server-KOR7UHEP.js');
+      const stripeTwin = await import('./src-NMHFBKVW.js');
+      const { createApp } = await import('./server-AJUCP5KS.js');
       const {
         applySeed: applyStripeSeed,
         createTwinStripeApp,
@@ -128,9 +128,9 @@ var TWIN_REGISTRY = {
     portEnvName: "GMAIL_TWIN_PORT",
     tokenEnvName: "POME_GMAIL_TOKEN",
     version: package_default4.version,
-    defaultSeed: async () => (await import('./src-HJRL3WKN.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-NKGQXT7H.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-HJRL3WKN.js');
+      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-NKGQXT7H.js');
       const db = openGmailTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new GmailDomain(db);
@@ -149,7 +149,7 @@ var TWIN_REGISTRY = {
     portEnvName: "LINEAR_TWIN_PORT",
     tokenEnvName: "POME_LINEAR_TOKEN",
     version: package_default5.version,
-    defaultSeed: async () => (await import('./src-UVXZQZGN.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-LE3GXOQL.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
       const {
         createLinearTwinApp,
@@ -157,7 +157,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-UVXZQZGN.js');
+      } = await import('./src-LE3GXOQL.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);
@@ -173,7 +173,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-OYBYLMMI.js');
+  const { createGitHubCloneApp } = await import('./src-7Z35KM4S.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-ZKID2HS3.js → chunk-IZIZC7ZW.js}

@@ -23,19 +23,30 @@ var LinearTwinError = class extends Error {
     };
   }
 };
-function unauthorizedEnvelope(message = "Authentication required") {
+function unauthorizedEnvelope(message = "Authentication required, not authenticated") {
   return {
     status: 401,
     body: {
       errors: [
         {
           message,
-          extensions: { code: "AUTHENTICATION_ERROR", http: { status: 401 } }
+          extensions: {
+            type: "authentication error",
+            code: "AUTHENTICATION_ERROR",
+            statusCode: 401,
+            userError: true,
+            userPresentableMessage: "You need to authenticate to access this operation.",
+            meta: {},
+            http: { status: 401 }
+          }
         }
       ]
     }
   };
 }
+function forbiddenEnvelope(message = "Forbidden") {
+  return linearErrorEnvelope(new LinearTwinError(403, "FORBIDDEN", message));
+}
 function unsupportedEnvelope(method, path) {
   return {
     status: 501,
@@ -625,4 +636,4 @@ function defaultSeedState() {
   };
 }
 
-export { ACCESS_TOKEN_TTL_SECONDS, BODY_MAX_BYTES, DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, DEFAULT_SCOPES, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, MCP_PAGE_DEFAULT, MCP_PAGE_MAX, OAUTH_CODE_TTL_SECONDS, RELAY_PAGE_DEFAULT, RELAY_PAGE_MAX, STATE_EXPORT_CAP, TITLE_MAX_BYTES, assertWebhookUrl, badUserInput, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, notFound, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError };
+export { ACCESS_TOKEN_TTL_SECONDS, BODY_MAX_BYTES, DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, DEFAULT_SCOPES, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, MCP_PAGE_DEFAULT, MCP_PAGE_MAX, OAUTH_CODE_TTL_SECONDS, RELAY_PAGE_DEFAULT, RELAY_PAGE_MAX, STATE_EXPORT_CAP, TITLE_MAX_BYTES, assertWebhookUrl, badUserInput, defaultSeedState, forbiddenEnvelope, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, notFound, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError };

package/dist/{chunk-6GS7QNCQ.js → chunk-J2U6LMFM.js}

@@ -1,9 +1,9 @@
 import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-X66JOOO7.js';
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-B22TYIEM.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
-import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-ZKID2HS3.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-F3KQCVWU.js';
-import { toTwinHttpEventRow } from './chunk-OW7VVW6X.js';
+import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-IZIZC7ZW.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-AS477MNU.js';
+import { toTwinHttpEventRow } from './chunk-5EGHN6H4.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';

package/dist/{chunk-VIB6XLX2.js → chunk-SFB63DN6.js}

@@ -1,5 +1,5 @@
 import { readManifest, normalizeManifestTwins } from './chunk-ABM3CMQB.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-6GS7QNCQ.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-J2U6LMFM.js';
 import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-X66JOOO7.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { randomUUID, createHash } from 'node:crypto';

package/dist/{chunk-5Q6D6ORU.js → chunk-TY5365F4.js}

@@ -1,7 +1,7 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-6GS7QNCQ.js';
-import { createRecorder, bootTwin } from './chunk-XIKQEAWV.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-J2U6LMFM.js';
+import { createRecorder, bootTwin } from './chunk-VVMGE677.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{chunk-XIKQEAWV.js → chunk-VVMGE677.js}

@@ -1,5 +1,5 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-F3KQCVWU.js';
-import { createFileBackedRecorderStore, createRecorderStore } from './chunk-OW7VVW6X.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-AS477MNU.js';
+import { createFileBackedRecorderStore, createRecorderStore } from './chunk-5EGHN6H4.js';
 
 // src/recorder/recorder.ts
 function createRecorder(options = {}) {

package/dist/{runDemo-L5HORQFT.js → runDemo-JW6EGT66.js}

@@ -1,17 +1,17 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-5Q6D6ORU.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-TY5365F4.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-6GS7QNCQ.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-J2U6LMFM.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedOrchError } from './chunk-X66JOOO7.js';
 import './chunk-B22TYIEM.js';
 import './chunk-NJ246QPJ.js';
-import './chunk-ZKID2HS3.js';
-import { bootTwin } from './chunk-XIKQEAWV.js';
-import './chunk-F3KQCVWU.js';
-import './chunk-OW7VVW6X.js';
+import './chunk-IZIZC7ZW.js';
+import { bootTwin } from './chunk-VVMGE677.js';
+import './chunk-AS477MNU.js';
+import './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { readFile } from 'node:fs/promises';

package/dist/{runTrialGroup-BC47IPE2.js → runTrialGroup-JDTUSWGS.js}

@@ -1,14 +1,14 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-VIB6XLX2.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-SFB63DN6.js';
 import './chunk-ABM3CMQB.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-6GS7QNCQ.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-J2U6LMFM.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedTrialError } from './chunk-X66JOOO7.js';
 import './chunk-B22TYIEM.js';
 import './chunk-NJ246QPJ.js';
-import './chunk-ZKID2HS3.js';
-import './chunk-F3KQCVWU.js';
-import './chunk-OW7VVW6X.js';
+import './chunk-IZIZC7ZW.js';
+import './chunk-AS477MNU.js';
+import './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { randomUUID } from 'node:crypto';

package/dist/{server-KOR7UHEP.js → server-AJUCP5KS.js}

@@ -1,3 +1,3 @@
-export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-OW7VVW6X.js';
+export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 export { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';

package/dist/src/cli/main.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-VIB6XLX2.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-SFB63DN6.js';
 import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-ABM3CMQB.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-5Q6D6ORU.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-TY5365F4.js';
 import '../../chunk-XDU6TD4O.js';
 import '../../chunk-CBFKZZBR.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-6GS7QNCQ.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-J2U6LMFM.js';
 import '../../chunk-NW7HGA2K.js';
 import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-X66JOOO7.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-FKZZWWYC.js';
@@ -13,11 +13,11 @@ import { SLACK_CHECKS } from '../../chunk-IDNSKKEC.js';
 import { GMAIL_CHECKS } from '../../chunk-JM6VS62R.js';
 import '../../chunk-NJ246QPJ.js';
 import { LINEAR_CHECKS } from '../../chunk-XBT6ZLBG.js';
-import '../../chunk-ZKID2HS3.js';
+import '../../chunk-IZIZC7ZW.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-JWJYNAWI.js';
-import '../../chunk-XIKQEAWV.js';
-import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-F3KQCVWU.js';
-import '../../chunk-OW7VVW6X.js';
+import '../../chunk-VVMGE677.js';
+import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-AS477MNU.js';
+import '../../chunk-5EGHN6H4.js';
 import { isLegacyEventRow, eventSchema } from '../../chunk-VBATFCWR.js';
 import { redactEvent, redactSecrets } from '../../chunk-SG6ZTIMT.js';
 import { Command } from 'commander';
@@ -850,7 +850,7 @@ async function throwForStatus(res) {
 
 // src/task/seed-verifier.ts
 async function verifySeedWithTwin(seed) {
-  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-OYBYLMMI.js');
+  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-7Z35KM4S.js');
   const db = openGitHubCloneDatabase(":memory:");
   try {
     new GitHubDomain(db).seed(seed);
@@ -4580,7 +4580,7 @@ var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 var MAX_UNREADABLE_PATHS_SHOWN = 5;
 function readPackageVersion() {
-  if ("0.23.45".length > 0) return "0.23.45";
+  if ("0.23.47".length > 0) return "0.23.47";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -5035,7 +5035,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-5T2MVAUX.js');
+        const { runDoctorChecks } = await import('../../checks-T3EWJXDT.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -5073,7 +5073,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-BC47IPE2.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-JDTUSWGS.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5167,7 +5167,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-L5HORQFT.js');
+      const { runDemo } = await import('../../runDemo-JW6EGT66.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5185,7 +5185,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-5T2MVAUX.js');
+    const { runDoctorChecks } = await import('../../checks-T3EWJXDT.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5361,7 +5361,7 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-63756OWJ.js');
+    const { runTwinStartCommand } = await import('../../twinStart-T7SKWGEL.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("reset").argument("[name]", "Twin name (default: github)", "github").description("Reset standalone twin state").action(async (name) => {

package/dist/{src-OYBYLMMI.js → src-7Z35KM4S.js}

@@ -2,7 +2,7 @@ import './chunk-FKZZWWYC.js';
 import { defaultSeedState, parseSeed } from './chunk-B22TYIEM.js';
 export { defaultSeedState, parseSeed, seedSchema } from './chunk-B22TYIEM.js';
 import { routeInputDeclarer, integerInput, mountDeclaredRoute, UndeclaredInputError, MalformedBodyError } from './chunk-2Q3P45LK.js';
-import { loadMcpToolFixture, defineTwin, twinBuildInfo, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp } from './chunk-OW7VVW6X.js';
+import { loadMcpToolFixture, defineTwin, twinBuildInfo, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp } from './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { z, ZodError } from 'zod';
@@ -5652,9 +5652,17 @@ var githubTwinDefinition = defineTwin({
     seed: ({ domain, seed, reportDelta }) => {
       domain.seed(seed, reportDelta);
       return { ok: true, repositories: seed.repositories.length };
-    }
-    // The admin-gate 403 body is the gate's default GitHub envelope
-    // ({message: "Forbidden"}); no per-twin override needed.
+    },
+    // F-1497: the admin-gate 403 body is BUILT HERE now, not defaulted in
+    // `@pome-sh/sdk`. The gate is shared by all five twins, so its default
+    // cannot carry GitHub's `documentation_url`/`status` leaves — and while
+    // it defaulted, this twin's 403 said `documentation_url: ""`.
+    //
+    // The url is the GENERIC one on purpose. Real GitHub's measured 403s
+    // name the operation (3 of 3, F-1490), but `/admin/*` is a twin-only
+    // route with no GitHub operation behind it, which is the same reason
+    // `/pulls/:n/diff` and `/pulls/:n/status` stay generic (divergence 32).
+    forbidden: () => ({ status: 403, body: githubError("Forbidden", 403) })
   },
   tools: deriveMcpToolTable(githubToolFixture, githubToolImplementations),
   // Frozen healthz shape: {ok, twin, implementation, fidelity, tools,
@@ -5685,21 +5693,38 @@ var githubTwinDefinition = defineTwin({
   auth: {
     // F-712 pins (wire-frozen): Bearer-header only (no extra token
     // resolvers), raw bearer rejected (allowRawBearer=false), sid mismatch
-    // → 401 {message:"Forbidden"}, and every credential failure — expired
-    // JWT included — renders 401 {message:"Bad credentials"}. The pre-port
-    // explicit "Token expired" branch was dead code: hono/jwt's verify
-    // throws JwtTokenExpired before the branch was ever reached, so the
-    // wire always said "Bad credentials" (pre-ruled: deleting it is zero
-    // wire diff).
+    // → 401 {message:"Forbidden"}, and an expired JWT rendering as
+    // "Bad credentials". The pre-port explicit "Token expired" branch was
+    // dead code: hono/jwt's verify throws JwtTokenExpired before the branch
+    // was ever reached, so the wire always said "Bad credentials"
+    // (pre-ruled: deleting it is zero wire diff).
+    //
+    // ── F-1497 changed two things about these bodies ────────────────────
+    //
+    // 1. They are built by `githubError` now instead of by hand, which is
+    //    what gives them the `documentation_url` and `status` leaves real
+    //    GitHub sends. Measured live 2026-08-13, 401 on `GET /user`:
+    //    `{"message":…,"documentation_url":"https://docs.github.com/rest","status":"401"}`.
+    //    The url is GitHub's GENERIC one and MUST STAY generic — GitHub
+    //    names no operation on a 401 because authentication fails before
+    //    dispatch (8 of 8 measured, F-1490), which is the half of
+    //    divergence 32 that is a requirement rather than a gap. `githubError`
+    //    defaults to exactly that url and this call passes no override.
+    //
+    // 2. A MISSING credential and a BAD one no longer say the same thing.
+    //    Real GitHub, same probe: no `Authorization` header at all answers
+    //    `Requires authentication`, a bad token answers `Bad credentials`.
+    //    The engine already classifies the two (`no_token` vs `invalid`);
+    //    this twin was collapsing them.
     providerToken: { provider: "github", prefixes: ["ghp_pome_", "github_pat_pome_"] },
     allowRawBearer: false,
-    unauthorized: () => ({
+    unauthorized: (kind) => ({
       status: 401,
-      body: { message: "Bad credentials", documentation_url: "" }
+      body: githubError(kind === "no_token" ? "Requires authentication" : "Bad credentials", 401)
     }),
     sidMismatch: () => ({
       status: 401,
-      body: { message: "Forbidden", documentation_url: "" }
+      body: githubError("Forbidden", 401)
     }),
     sessionExtras: (claims) => typeof claims.login === "string" && claims.login.length > 0 ? { login: claims.login } : {}
   }

package/dist/{src-6RAKZPHK.js → src-BAPCY3ID.js}

@@ -1,7 +1,7 @@
 export { SLACK_CHECKS } from './chunk-IDNSKKEC.js';
 import './chunk-JWJYNAWI.js';
 import { routeInputDeclarer, booleanInput, integerInput, mountDeclaredRoute, UndeclaredInputError } from './chunk-2Q3P45LK.js';
-import { loadMcpToolFixture, defineTwin, queryTokenResolver, formTokenResolver, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp } from './chunk-OW7VVW6X.js';
+import { loadMcpToolFixture, defineTwin, queryTokenResolver, formTokenResolver, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp } from './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { z, ZodError } from 'zod';

package/dist/{src-UVXZQZGN.js → src-LE3GXOQL.js}

@@ -1,9 +1,9 @@
 export { LINEAR_CHECKS } from './chunk-XBT6ZLBG.js';
-import { MCP_PAGE_MAX, defaultSeedState, linearSeedSchema, notFound, badUserInput, MCP_PAGE_DEFAULT, DEFAULT_LINEAR_EMAIL, RELAY_PAGE_MAX, RELAY_PAGE_DEFAULT, STATE_EXPORT_CAP, parseSeed, DEFAULT_LINEAR_CLOCK, LINEAR_PROVIDER_TOKEN_PREFIX, DEFAULT_LINEAR_SID, DEFAULT_SCOPES, linearErrorEnvelope, unauthorizedEnvelope, unsupportedEnvelope, assertWebhookUrl, ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_SECONDS, TITLE_MAX_BYTES, BODY_MAX_BYTES, LinearTwinError, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX } from './chunk-ZKID2HS3.js';
-export { DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, STATE_EXPORT_CAP, assertWebhookUrl, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError } from './chunk-ZKID2HS3.js';
+import { MCP_PAGE_MAX, defaultSeedState, linearSeedSchema, notFound, badUserInput, MCP_PAGE_DEFAULT, DEFAULT_LINEAR_EMAIL, RELAY_PAGE_MAX, RELAY_PAGE_DEFAULT, STATE_EXPORT_CAP, parseSeed, DEFAULT_LINEAR_CLOCK, LINEAR_PROVIDER_TOKEN_PREFIX, DEFAULT_LINEAR_SID, DEFAULT_SCOPES, linearErrorEnvelope, unauthorizedEnvelope, unsupportedEnvelope, forbiddenEnvelope, assertWebhookUrl, ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_SECONDS, TITLE_MAX_BYTES, BODY_MAX_BYTES, LinearTwinError, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX } from './chunk-IZIZC7ZW.js';
+export { DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, STATE_EXPORT_CAP, assertWebhookUrl, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError } from './chunk-IZIZC7ZW.js';
 import './chunk-JWJYNAWI.js';
 import { routeInputDeclarer, mountDeclaredRoute, UndeclaredInputError } from './chunk-2Q3P45LK.js';
-import { loadMcpToolFixture, deriveMcpToolTable, openTwinDatabase, defineTwin, createApp } from './chunk-OW7VVW6X.js';
+import { loadMcpToolFixture, deriveMcpToolTable, openTwinDatabase, defineTwin, createApp } from './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { createHmac, timingSafeEqual, createHash, randomBytes } from 'node:crypto';
@@ -5461,7 +5461,10 @@ function createLinearTwinDefinition(db) {
         domain.seed(seed);
         reportDelta(linearStateDelta(before, domain.exportState()));
         return { ok: true };
-      }
+      },
+      // F-1497 — declared, so the shared gate in `@pome-sh/sdk` stops
+      // answering a GraphQL twin with GitHub's `{message, documentation_url}`.
+      forbidden: () => forbiddenEnvelope()
     },
     recordingProjection: projectLinearRecording,
     errorEnvelope: linearErrorEnvelope,
@@ -5476,8 +5479,14 @@ function createLinearTwinDefinition(db) {
       requirePathSid: false,
       allowRawBearer: true,
       resolveCredential: (token2) => resolveLinearCredential(db, token2),
-      unauthorized: () => unauthorizedEnvelope("Bad credentials"),
-      sidMismatch: () => unauthorizedEnvelope("Session id mismatch"),
+      // Both take `unauthorizedEnvelope`'s default: Linear answers a bad
+      // bearer and a missing one with the SAME body (measured 2026-08-13,
+      // F-1497), and has no session-id concept to give the mismatch leg a
+      // third one. The messages that used to be here — "Bad credentials" and
+      // "Session id mismatch" — were the twin's own inventions, and the first
+      // was GitHub's.
+      unauthorized: () => unauthorizedEnvelope(),
+      sidMismatch: () => unauthorizedEnvelope(),
       sessionExtras: (claims) => ({
         linear_email: typeof claims.linear_email === "string" && claims.linear_email.length > 0 ? claims.linear_email.toLowerCase() : DEFAULT_LINEAR_EMAIL,
         scopes: [...DEFAULT_SCOPES]

package/dist/{src-HJRL3WKN.js → src-NKGQXT7H.js}

@@ -3,7 +3,7 @@ import { gmailErrorEnvelope, gmailSeedSchema, parseSeed, defaultSeedState, notFo
 export { DEFAULT_GMAIL_AGENT_EMAIL, GmailError, SEARCH_MAILBOX_MESSAGE_BUDGET, agentPathInboxMailbox, defaultSeedState, gmailErrorEnvelope, gmailSeedSchema, loadSeedFromEnv, parseSearchQuery, parseSeed, validateSearchQuery } from './chunk-NJ246QPJ.js';
 import './chunk-JWJYNAWI.js';
 import { routeInputDeclarer, integerInput, booleanInput, repeatedInput, mountDeclaredRoute, UndeclaredInputError, MalformedBodyError } from './chunk-2Q3P45LK.js';
-import { loadMcpToolFixture, deriveMcpToolTable, defineTwin, openTwinDatabase, createApp } from './chunk-OW7VVW6X.js';
+import { loadMcpToolFixture, deriveMcpToolTable, defineTwin, openTwinDatabase, createApp } from './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { createHash, createHmac, timingSafeEqual, randomBytes } from 'node:crypto';
@@ -3861,18 +3861,20 @@ function registerGmailRoutes(app, context) {
 }
 
 // ../packages/twin-gmail/dist/src/twin.js
-function unauthorized() {
+var OAUTH_TAIL = "Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.";
+function unauthorized(kind = "invalid") {
+  const missing = kind === "no_token";
   return {
     status: 401,
     body: {
       error: {
         code: 401,
-        message: "Request had invalid authentication credentials.",
+        message: missing ? `Request is missing required authentication credential. ${OAUTH_TAIL}` : `Request had invalid authentication credentials. ${OAUTH_TAIL}`,
         errors: [
           {
-            message: "Invalid Credentials",
+            message: missing ? "Login Required." : "Invalid Credentials",
             domain: "global",
-            reason: "authError",
+            reason: missing ? "required" : "authError",
             location: "Authorization",
             locationType: "header"
           }
@@ -3882,6 +3884,19 @@ function unauthorized() {
     }
   };
 }
+function adminForbidden() {
+  return {
+    status: 403,
+    body: {
+      error: {
+        code: 403,
+        message: "Forbidden",
+        errors: [{ message: "Forbidden", domain: "global", reason: "forbidden" }],
+        status: "PERMISSION_DENIED"
+      }
+    }
+  };
+}
 var gmailTwinDefinition = defineTwin({
   id: "gmail",
   version: process.env.POME_TWIN_VERSION ?? "0.1.0",
@@ -3910,7 +3925,8 @@ var gmailTwinDefinition = defineTwin({
       domain.seed(seed);
       reportDelta(gmailStateDelta(before, domain.exportState()));
       return { ok: true };
-    }
+    },
+    forbidden: adminForbidden
   },
   recordingProjection: projectGmailRecording,
   errorEnvelope: gmailErrorEnvelope,
@@ -3927,7 +3943,9 @@ var gmailTwinDefinition = defineTwin({
   }),
   auth: {
     unauthorized,
-    sidMismatch: unauthorized,
+    // A credential that belongs to another session is a credential this one
+    // cannot use — the INVALID body, not the missing one.
+    sidMismatch: () => unauthorized("invalid"),
     sessionExtras: (claims) => ({
       gmail_email: typeof claims.gmail_email === "string" && claims.gmail_email.length > 0 ? claims.gmail_email.toLowerCase() : DEFAULT_GMAIL_EMAIL
     })

package/dist/{src-HRW7OZBS.js → src-NMHFBKVW.js}

@@ -1,5 +1,5 @@
 import { routeInputDeclarer, bracketedQuery, integerInput, booleanInput, mountDeclaredRoute, UndeclaredInputError } from './chunk-2Q3P45LK.js';
-import { failureInjectionRuleSchema, loadMcpToolFixture, openTwinDatabase, createFailureInjectionStore, defineTwin, twinBuildInfo, deriveMcpToolTable, failureInjectionMiddleware, createApp, FAILURE_INJECTION_OVERRIDE_KEY, recordedRequestHeaders, UnknownToolError } from './chunk-OW7VVW6X.js';
+import { failureInjectionRuleSchema, loadMcpToolFixture, openTwinDatabase, createFailureInjectionStore, defineTwin, twinBuildInfo, deriveMcpToolTable, failureInjectionMiddleware, createApp, FAILURE_INJECTION_OVERRIDE_KEY, recordedRequestHeaders, UnknownToolError } from './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { z, ZodError } from 'zod';
@@ -4337,6 +4337,7 @@ function stripeToolInputSchema(schema) {
 }
 
 // ../packages/twin-stripe/dist/src/twin.js
+var NO_API_KEY_MESSAGE = "You did not provide an API key. You need to provide your API key in the Authorization header, using Bearer auth (e.g. 'Authorization: Bearer YOUR_SECRET_KEY'). See https://stripe.com/docs/api#authentication for details, or we can help at https://support.stripe.com/.";
 var stripeSeedSchema = z.preprocess((value) => value === null || value === void 0 ? defaultSeed() : value, seedSchema);
 function tthwSeconds(startedAtMs, nowMs = Date.now) {
   const ms = Math.max(0, nowMs() - startedAtMs);
@@ -4517,7 +4518,7 @@ function createStripeTwinDefinition(opts) {
         return row ? { sid: row.sid, account_id: row.account_id, via: "api_key" } : void 0;
       },
       unauthorized: (kind, info) => {
-        const message = kind === "expired" ? "Token expired" : info?.token && looksLikeApiKey(info.token) ? "Invalid API Key provided." : "Bad credentials";
+        const message = kind === "no_token" ? NO_API_KEY_MESSAGE : kind === "expired" ? "Token expired" : info?.token && looksLikeApiKey(info.token) ? "Invalid API Key provided." : "Bad credentials";
         const envelope = unauthorized(message);
         return { status: envelope.status, body: envelope.body };
       },

package/dist/twinHarness-IMJBFVAL.js

@@ -0,0 +1,5 @@
+export { UnsupportedTwinError, bootTwin } from './chunk-VVMGE677.js';
+export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-AS477MNU.js';
+import './chunk-5EGHN6H4.js';
+import './chunk-VBATFCWR.js';
+import './chunk-SG6ZTIMT.js';

package/dist/{twinStart-63756OWJ.js → twinStart-T7SKWGEL.js}

@@ -1,6 +1,6 @@
-import { bootTwin } from './chunk-XIKQEAWV.js';
-import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-F3KQCVWU.js';
-import './chunk-OW7VVW6X.js';
+import { bootTwin } from './chunk-VVMGE677.js';
+import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-AS477MNU.js';
+import './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
 import { randomBytes } from 'node:crypto';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.23.45",
+  "version": "0.23.47",
   "description": "Digital-twin testing for AI agents \u2014 run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",

package/dist/twinHarness-MRRHZ6WW.js

@@ -1,5 +0,0 @@
-export { UnsupportedTwinError, bootTwin } from './chunk-XIKQEAWV.js';
-export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-F3KQCVWU.js';
-import './chunk-OW7VVW6X.js';
-import './chunk-VBATFCWR.js';
-import './chunk-SG6ZTIMT.js';