@pome-sh/cli 0.23.47 → 0.23.48

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.23.47",
-  "git_sha": "95240f908f2348af9ad981943e2aab76b5df844b",
-  "build_time": "2026-08-13T17:53:11.645Z"
+  "version": "0.23.48",
+  "git_sha": "0dd8faf57062539f921e76f510d0f2cea847a104",
+  "build_time": "2026-08-13T20:30:07.412Z"
 }

package/dist/{checks-T3EWJXDT.js → checks-STMFOZA5.js}

@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-IMJBFVAL.js');
+    const { bootTwin } = await import('./twinHarness-WIWX5USC.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-SFB63DN6.js → chunk-4YGE4L6O.js}

@@ -1,5 +1,5 @@
 import { readManifest, normalizeManifestTwins } from './chunk-ABM3CMQB.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-J2U6LMFM.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-BZ3RQU56.js';
 import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-X66JOOO7.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { randomUUID, createHash } from 'node:crypto';

package/dist/{chunk-J2U6LMFM.js → chunk-BZ3RQU56.js}

@@ -2,7 +2,7 @@ import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, Hos
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-B22TYIEM.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-IZIZC7ZW.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-AS477MNU.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-DZU4LAYD.js';
 import { toTwinHttpEventRow } from './chunk-5EGHN6H4.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';

package/dist/{chunk-AS477MNU.js → chunk-DZU4LAYD.js}

@@ -1,6 +1,6 @@
 // ../packages/twin-github/package.json
 var package_default = {
-  version: "0.10.11"};
+  version: "0.11.0"};
 
 // ../packages/twin-slack/package.json
 var package_default2 = {

package/dist/{chunk-VVMGE677.js → chunk-WMHGTTRH.js}

@@ -1,4 +1,4 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-AS477MNU.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-DZU4LAYD.js';
 import { createFileBackedRecorderStore, createRecorderStore } from './chunk-5EGHN6H4.js';
 
 // src/recorder/recorder.ts

package/dist/{chunk-TY5365F4.js → chunk-XWQK4XXD.js}

@@ -1,7 +1,7 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-J2U6LMFM.js';
-import { createRecorder, bootTwin } from './chunk-VVMGE677.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-BZ3RQU56.js';
+import { createRecorder, bootTwin } from './chunk-WMHGTTRH.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{runDemo-JW6EGT66.js → runDemo-63ZG7QKS.js}

@@ -1,16 +1,16 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-TY5365F4.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-XWQK4XXD.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-J2U6LMFM.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-BZ3RQU56.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedOrchError } from './chunk-X66JOOO7.js';
 import './chunk-B22TYIEM.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-IZIZC7ZW.js';
-import { bootTwin } from './chunk-VVMGE677.js';
-import './chunk-AS477MNU.js';
+import { bootTwin } from './chunk-WMHGTTRH.js';
+import './chunk-DZU4LAYD.js';
 import './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';

package/dist/{runTrialGroup-JDTUSWGS.js → runTrialGroup-SG4QQVTN.js}

@@ -1,13 +1,13 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-SFB63DN6.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-4YGE4L6O.js';
 import './chunk-ABM3CMQB.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-J2U6LMFM.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-BZ3RQU56.js';
 import './chunk-NW7HGA2K.js';
 import { HostedQuotaError, HostedTrialError } from './chunk-X66JOOO7.js';
 import './chunk-B22TYIEM.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-IZIZC7ZW.js';
-import './chunk-AS477MNU.js';
+import './chunk-DZU4LAYD.js';
 import './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';

package/dist/src/cli/main.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-SFB63DN6.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-4YGE4L6O.js';
 import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-ABM3CMQB.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-TY5365F4.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-XWQK4XXD.js';
 import '../../chunk-XDU6TD4O.js';
 import '../../chunk-CBFKZZBR.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-J2U6LMFM.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-BZ3RQU56.js';
 import '../../chunk-NW7HGA2K.js';
 import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-X66JOOO7.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-FKZZWWYC.js';
@@ -15,8 +15,8 @@ import '../../chunk-NJ246QPJ.js';
 import { LINEAR_CHECKS } from '../../chunk-XBT6ZLBG.js';
 import '../../chunk-IZIZC7ZW.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-JWJYNAWI.js';
-import '../../chunk-VVMGE677.js';
-import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-AS477MNU.js';
+import '../../chunk-WMHGTTRH.js';
+import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-DZU4LAYD.js';
 import '../../chunk-5EGHN6H4.js';
 import { isLegacyEventRow, eventSchema } from '../../chunk-VBATFCWR.js';
 import { redactEvent, redactSecrets } from '../../chunk-SG6ZTIMT.js';
@@ -2103,6 +2103,9 @@ var commitStatus = defineCheck({
 });
 
 // ../packages/twin-github/dist/src/check-tape.js
+function citations(events) {
+  return events.map((event2) => event2.event_id).filter((id) => typeof id === "string" && id !== "");
+}
 var noUnsupportedEndpoint = defineCheck({
   id: "github.no-unsupported-endpoint",
   description: 'Scans the recorded call tape for any request the twin answered with fidelity "unsupported" \u2014 a route it does not implement, answered 501. It asserts nothing about whether the run SUCCEEDED, and nothing about calls that were merely rejected: a 404 or a 422 from a route the twin does implement is a semantic answer and passes this check. The tape is scoped to this twin by the engine before the check sees it, so an unsupported call to a DIFFERENT twin in a multi-twin session cannot fail it.',
@@ -2144,7 +2147,7 @@ var noUnsupportedEndpoint = defineCheck({
         reason: `no unsupported GitHub endpoint was called (${tape.length} call(s) inspected)`
       };
     }
-    const evidenceEventIds = unsupported.map((event2) => event2.event_id).filter((id) => typeof id === "string" && id !== "");
+    const evidenceEventIds = citations(unsupported);
     const outcome = {
       passed: false,
       reason: `${unsupported.length} unsupported GitHub call(s): [${unsupported.map((event2) => event2.path ?? "?").join(", ")}]`
@@ -2195,7 +2198,7 @@ var toolNeverCalled = defineCheck({
         reason: `\`${args.tool}\` was never called (${tape.length} call(s) inspected)`
       };
     }
-    const evidenceEventIds = calls.map((event2) => event2.event_id).filter((id) => typeof id === "string" && id !== "");
+    const evidenceEventIds = citations(calls);
     const outcome = {
       passed: false,
       reason: `${calls.length} call(s) to \`${args.tool}\`: [${calls.map((event2) => `${event2.method ?? "?"} ${event2.path ?? "?"}`).join(", ")}]`
@@ -2203,6 +2206,68 @@ var toolNeverCalled = defineCheck({
     return evidenceEventIds.length > 0 ? { ...outcome, evidenceEventIds } : outcome;
   }
 });
+var toolWasCalled = defineCheck({
+  id: "github.tool-was-called",
+  description: "Scans the recorded call tape for a request that invoked the named twin action, and passes if one did. The action is matched on the recorded `tool` field, which the runtime stamps identically for an MCP `tools/call` and for the REST route that performs the same thing \u2014 so it asserts about the ACTION, not about the transport the examinee chose. It counts an ATTEMPT, exactly as its prohibition sibling does: a call the twin rejected (bad arguments, 4xx) still called the action, so this measures what the examinee REACHED FOR and never whether it succeeded \u2014 a task that needs the outcome must assert the outcome on state. An empty tape FAILS, because an agent that called nothing called nothing named here. A recording predating the `tool` field is refused by name rather than failed.",
+  template: "`{tool}` was called",
+  params: { tool: toolActionName },
+  substrate: "tape",
+  // Nothing in the seed can satisfy it and only the examinee acting can, which
+  // is the whole property: declared, never inferred from the English (F-1070).
+  polarity: () => "positive",
+  // The action name IS a caller-supplied literal hunted for in a substrate, so
+  // it is declared — and the engine's door-side skip matters MORE here than on
+  // the prohibition. A redactor that ate the name would leave this check finding
+  // nothing, i.e. failing an agent that did the work.
+  subject: (args) => args.tool,
+  // Null, and admitted in `HONEST_NULL_MUTANTS`. Same closed-set argument as the
+  // sibling: the only substitutable value is the OTHER assertable action, which
+  // an agent may well have called too, and a value outside the set does not
+  // re-bind at all.
+  vacuityMutant: () => null,
+  // A POSITIVE check, so the passing world is the one where the action WAS
+  // called. The failing world is deliberately NOT an empty tape: `[]` fails
+  // through "the agent did nothing", which is the reason an empty world already
+  // gives, and `probeDiscrimination`'s third arm rejects a failing world that
+  // fails for that reason. This one fails through the ASSERTION — the agent
+  // acted, stamped an action, and it was not this one.
+  discriminatingWorlds: ({ tool }) => {
+    const other = TAPE_ASSERTABLE_TOOLS.find((name) => name !== tool) ?? null;
+    return {
+      passing: tapeWorld([
+        { twin: "github", method: "GET", path: "/repos/acme/api", status: 200, tool: null, event_id: "evt_read" },
+        { twin: "github", method: "POST", path: "/repos/acme/api/statuses/abc", status: 201, tool, event_id: "evt_did" }
+      ]),
+      failing: tapeWorld([
+        { twin: "github", method: "GET", path: "/repos/acme/api", status: 200, tool: null, event_id: "evt_read" },
+        { twin: "github", method: "POST", path: "/s/ses_1/mcp", status: 200, tool: other, event_id: "evt_other" }
+      ])
+    };
+  },
+  evaluate(args, { tape }) {
+    if (tape === null)
+      return { passed: false, reason: "tape_missing", status: "skipped" };
+    if (tape.length > 0 && !tape.some((event2) => event2.tool !== void 0)) {
+      return { passed: false, status: "skipped", reason: "tool_not_recorded" };
+    }
+    const calls = tape.filter((event2) => event2.tool === args.tool);
+    if (calls.length === 0) {
+      const recorded = [
+        ...new Set(tape.map((event2) => event2.tool).filter((name) => typeof name === "string" && name !== ""))
+      ];
+      return {
+        passed: false,
+        reason: `\`${args.tool}\` was never called (${tape.length} call(s) inspected; actions recorded: [${recorded.join(", ")}])`
+      };
+    }
+    const evidenceEventIds = citations(calls);
+    const outcome = {
+      passed: true,
+      reason: `${calls.length} call(s) to \`${args.tool}\`: [${calls.map((event2) => `${event2.method ?? "?"} ${event2.path ?? "?"}`).join(", ")}]`
+    };
+    return evidenceEventIds.length > 0 ? { ...outcome, evidenceEventIds } : outcome;
+  }
+});
 
 // ../packages/twin-github/dist/src/checks.js
 var GITHUB_CHECKS = [
@@ -2226,7 +2291,13 @@ var GITHUB_CHECKS = [
   // for first to the ones a specialised task needs — and these are the only ones
   // that assert about the RUN rather than the world it left behind.
   noUnsupportedEndpoint,
-  toolNeverCalled
+  toolNeverCalled,
+  // F-1338. Adjacent to its prohibition for the reason the two repo-scoped
+  // deltas sit together above: an author reaching for one usually wants to see
+  // the other, and these two are the same predicate read in opposite
+  // directions off one closed set of actions. It is appended rather than
+  // slotted in front so the existing listing order does not move.
+  toolWasCalled
 ];
 
 // ../packages/twin-stripe/dist/src/check-params.js
@@ -2681,11 +2752,11 @@ var refundCount = defineCheck({
 
 // ../packages/twin-stripe/dist/src/check-tape.js
 var TAPE_MISSING = { passed: false, status: "skipped", reason: "tape_missing" };
-function citations(events) {
+function citations2(events) {
   return events.map((event2) => event2.event_id).filter((id) => typeof id === "string" && id !== "");
 }
 function withCitations(outcome, events) {
-  const ids = citations(events);
+  const ids = citations2(events);
   return ids.length > 0 ? { ...outcome, evidenceEventIds: ids } : outcome;
 }
 function recordedErrorType(body) {
@@ -4580,7 +4651,7 @@ var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 var MAX_UNREADABLE_PATHS_SHOWN = 5;
 function readPackageVersion() {
-  if ("0.23.47".length > 0) return "0.23.47";
+  if ("0.23.48".length > 0) return "0.23.48";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -5035,7 +5106,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-T3EWJXDT.js');
+        const { runDoctorChecks } = await import('../../checks-STMFOZA5.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -5073,7 +5144,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-JDTUSWGS.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-SG4QQVTN.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5167,7 +5238,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-JW6EGT66.js');
+      const { runDemo } = await import('../../runDemo-63ZG7QKS.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5185,7 +5256,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-T3EWJXDT.js');
+    const { runDoctorChecks } = await import('../../checks-STMFOZA5.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5361,7 +5432,7 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-T7SKWGEL.js');
+    const { runTwinStartCommand } = await import('../../twinStart-Q4EJ4U2C.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("reset").argument("[name]", "Twin name (default: github)", "github").description("Reset standalone twin state").action(async (name) => {

package/dist/twinHarness-WIWX5USC.js

@@ -0,0 +1,5 @@
+export { UnsupportedTwinError, bootTwin } from './chunk-WMHGTTRH.js';
+export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-DZU4LAYD.js';
+import './chunk-5EGHN6H4.js';
+import './chunk-VBATFCWR.js';
+import './chunk-SG6ZTIMT.js';

package/dist/{twinStart-T7SKWGEL.js → twinStart-Q4EJ4U2C.js}

@@ -1,5 +1,5 @@
-import { bootTwin } from './chunk-VVMGE677.js';
-import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-AS477MNU.js';
+import { bootTwin } from './chunk-WMHGTTRH.js';
+import { isTwinName, TWIN_NAMES, defaultPortFor, TWIN_REGISTRY } from './chunk-DZU4LAYD.js';
 import './chunk-5EGHN6H4.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.23.47",
+  "version": "0.23.48",
   "description": "Digital-twin testing for AI agents \u2014 run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",

package/dist/twinHarness-IMJBFVAL.js

@@ -1,5 +0,0 @@
-export { UnsupportedTwinError, bootTwin } from './chunk-VVMGE677.js';
-export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-AS477MNU.js';
-import './chunk-5EGHN6H4.js';
-import './chunk-VBATFCWR.js';
-import './chunk-SG6ZTIMT.js';