@pome-sh/cli 0.29.1 → 0.31.0

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.29.1",
-  "git_sha": "c89dc0c40e2f591a46a0802285b043acf5b084bf",
-  "build_time": "2026-08-26T22:31:38.093Z"
+  "version": "0.31.0",
+  "git_sha": "0c525a5023e8941e14fb2420e222fc90baea0140",
+  "build_time": "2026-08-27T11:38:56.203Z"
 }

package/dist/{checks-BZ5L2YNC.js → checks-KGDGQ35O.js}

@@ -1,6 +1,6 @@
-import { findManifestPath, readManifest } from './chunk-XWGZ5C7Y.js';
+import { findManifestPath, readManifest } from './chunk-2V5A7NWP.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
-import './chunk-OTFDQT3H.js';
+import './chunk-72CG3JNL.js';
 import { buildEgressAllowlist } from './chunk-CBFKZZBR.js';
 import './chunk-6KJC4BTO.js';
 import './chunk-SG6ZTIMT.js';
@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-CUVRO5IV.js');
+    const { bootTwin } = await import('./twinHarness-TSAQYDC5.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,
@@ -253,7 +253,7 @@ async function checkRouting(configDir) {
       cause: `no POME_*_REST_URL / POME_*_MCP_URL read and no @pome-sh adapter found in the ${scan.filesScanned} source file(s) under ${relative(process.cwd(), configDir) || "."} \u2014 the agent has no path to the twin.`,
       fix: [
         'wire the adapter: import { withPome } from "@pome-sh/adapter-claude-sdk"; call withPome() at startup;',
-        "read the twin base URL from POME_GITHUB_REST_URL (injected by the runner) \u2014 or let your own coding agent wire it with the Gen-2 skills (`npx skills add pome-sh/digital-twins --skill '*'`)."
+        "read the twin base URL from POME_GITHUB_REST_URL (injected by the runner) \u2014 or let your own coding agent wire it with the coach skills (`npx skills add pome-sh/digital-twins --skill '*'`)."
       ].join("\n")
     };
   }

package/dist/{chunk-XWGZ5C7Y.js → chunk-2V5A7NWP.js}

@@ -1,4 +1,4 @@
-import { HostedOrchError, manifestSchema, deriveAgentSlug, SLUG_RE } from './chunk-OTFDQT3H.js';
+import { HostedOrchError, manifestSchema, deriveAgentSlug, SLUG_RE } from './chunk-72CG3JNL.js';
 import { readFile, writeFile } from 'node:fs/promises';
 import { resolve, join, dirname } from 'node:path';
 import { stringify, parse } from 'yaml';

package/dist/{chunk-OTFDQT3H.js → chunk-72CG3JNL.js}

@@ -1286,6 +1286,7 @@ function exitCodeFor(err) {
   if (err instanceof HostedAuthError) return 3;
   if (err instanceof HostedQuotaError) return 4;
   if (err instanceof HostedUsageError) return 5;
+  if (err instanceof HostedDiscardRefusedError) return 5;
   return 2;
 }
 

package/dist/{chunk-VORBQXJN.js → chunk-EMIRZNHN.js}

@@ -1,7 +1,7 @@
 import { gmailSeedSchema, defaultSeedState } from './chunk-3T5XN64P.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-Q5NBPR57.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-SRG22BIH.js';
-import { criterionSchema, normalizeTaskConfigKeys, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-OTFDQT3H.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-SDBBGCE7.js';
+import { criterionSchema, normalizeTaskConfigKeys, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-72CG3JNL.js';
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-HJX25USP.js';
 import { toTwinHttpEventRow } from './chunk-E665XWYU.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
@@ -421,7 +421,6 @@ function splitSections(markdown) {
   return sections;
 }
 var CRITERION_LINE_RE = /^[-*]\s+\[(code|model)(?::([a-z][a-z0-9_-]*))?(\s+always-scored)?\]\s+(.+)$/;
-var LEGACY_CRITERION_LINE_RE = /^[-*]\s+\[([DP])(?::([a-z][a-z0-9_-]*))?\]\s+(.+)$/;
 var NEAR_MISS_CRITERION_LINE_RE = /^[-*]\s*\[\s*(code|model)\b[^\]]*\]/;
 function nearMissCriterionMessage(line) {
   return `Criterion line "${line}" reaches for a [code]/[model] marker but does not match the criterion grammar ${CRITERION_LINE_RE.source} \u2014 fix the marker (e.g. "[code]", "[code:slack]", "[code:slack always-scored]"); a line this close to a criterion is refused rather than silently dropped as prose.`;
@@ -433,13 +432,6 @@ function parseCriteria(input, twins) {
   const criteria = [];
   for (const rawLine of input.split("\n")) {
     const line = rawLine.trim();
-    const legacy = line.match(LEGACY_CRITERION_LINE_RE);
-    if (legacy) {
-      const legacyMarker = `[${legacy[1]}${legacy[2] ? `:${legacy[2]}` : ""}]`;
-      throw new Error(
-        `Criterion "${legacyMarker} ${legacy[3].trim()}" uses a retired marker \u2014 markers were renamed [D]\u2192[code] and [P]\u2192[model] (tags carry over: [D:github]\u2192[code:github]).`
-      );
-    }
     const match = line.match(CRITERION_LINE_RE);
     if (!match) {
       if (NEAR_MISS_CRITERION_LINE_RE.test(line)) {

package/dist/{chunk-ZYQK4PNC.js → chunk-GNMDGZJF.js}

@@ -1,5 +1,5 @@
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-VORBQXJN.js';
-import { createRecorder, bootTwin } from './chunk-S6JLWI4S.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-EMIRZNHN.js';
+import { createRecorder, bootTwin } from './chunk-WJFRBXL5.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
 import { eventSchema } from './chunk-6KJC4BTO.js';

package/dist/{chunk-EFX32JE3.js → chunk-GUAGU65D.js}

@@ -1,7 +1,7 @@
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-VORBQXJN.js';
-import { readSeedFileText, parseSeedFileText, soleTwinOf, seedsForTwins } from './chunk-B7PA7UDX.js';
-import { readManifest, normalizeManifestTwins } from './chunk-XWGZ5C7Y.js';
-import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema, isMultiTwinSeedEnvelope } from './chunk-OTFDQT3H.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-EMIRZNHN.js';
+import { readSeedFileText, parseSeedFileText, soleTwinOf, seedsForTwins } from './chunk-IHKUFGYW.js';
+import { readManifest, normalizeManifestTwins } from './chunk-2V5A7NWP.js';
+import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema, isMultiTwinSeedEnvelope } from './chunk-72CG3JNL.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { rm, readFile, stat, mkdir, writeFile, chmod, mkdtemp, readdir, rename } from 'node:fs/promises';
@@ -79,7 +79,7 @@ function looksLikeVerdictArtifactBase(parsed) {
   if (v.source !== "cloud-finalize") return false;
   if (typeof v.session_id !== "string") return false;
   if (typeof v.task_name !== "string") return false;
-  if (typeof v.task_path !== "string" && typeof v.scenario_path !== "string") return false;
+  if (typeof v.task_path !== "string") return false;
   if (v.group_id !== null && typeof v.group_id !== "string") return false;
   if (typeof v.finalized_at !== "string") return false;
   if (typeof v.passed !== "boolean") return false;
@@ -640,7 +640,7 @@ function redactSession(res) {
 }
 function formatEnvExport(res, twins) {
   const lines = [
-    `# Pome hosted session \u2014 treat as secret. Twins: ${twins.join(", ")}`,
+    `# Pome hosted sandbox \u2014 treat as secret. Twins: ${twins.join(", ")}`,
     `export POME_AUTH_TOKEN=${JSON.stringify(res.agent_token)}`,
     `export POME_SESSION_ID=${JSON.stringify(res.session_id)}`,
     // Legacy single-endpoint URL (= the primary twin's api_url). Kept for
@@ -733,7 +733,7 @@ async function runSessionCreate(opts) {
   });
   if (opts.secretsFile) {
     await writeSecretsFile(opts.secretsFile, formatEnvExport(session, twins));
-    console.error(`Wrote session secrets to ${opts.secretsFile} (mode 0600).`);
+    console.error(`Wrote sandbox secrets to ${opts.secretsFile} (mode 0600).`);
   }
   if (opts.format === "json") {
     const payload = redactSession(session);
@@ -750,7 +750,7 @@ async function runSessionCreate(opts) {
     process.exitCode = 2;
     return;
   }
-  console.error(`Session: ${session.session_id}`);
+  console.error(`Sandbox: ${session.session_id}`);
   console.error(`Expires: ${session.expires_at}`);
   if (opts.seedPath !== void 0) {
     console.error(`Seed: ${opts.seedPath} (replaces the default for ${twins.join(", ")}).`);
@@ -770,9 +770,6 @@ async function runSessionCreate(opts) {
   if (!printedAny) {
     console.error(`Twin URL: ${session.twin_url}`);
   }
-  if (opts.showSecrets) {
-    console.error("--show-secrets no longer prints secrets. Use --secrets-file <path>.");
-  }
   console.error("Secrets redacted.");
   console.error(`Dashboard: ${DEFAULT_DASHBOARD_URL}/twins/${session.session_id}`);
 }
@@ -806,7 +803,7 @@ async function runSessionList(opts) {
   }
   if (rows.length === 0) {
     const scope = opts.state === "all" ? "any" : `state=${opts.state}`;
-    console.error(`No sessions returned (${scope}).`);
+    console.error(`No sandboxes returned (${scope}).`);
     return;
   }
   for (const r of rows) {
@@ -833,12 +830,12 @@ async function runSessionStop(opts) {
       if (err.taskName) console.error(`  Task: ${err.taskName}`);
       console.error(`  Open for ${err.openSeconds}s.`);
       console.error(
-        `  To keep the run, finalize it instead. To discard it anyway: pome session stop ${err.sessionId} --discard`
+        `  To keep the run, finalize it instead. To discard it anyway: pome sandbox stop ${err.sessionId} --discard`
       );
     }
     throw err;
   }
-  console.error(`Stopped session ${opts.sessionId}.`);
+  console.error(`Stopped sandbox ${opts.sessionId}.`);
 }
 function friendlyHostedError(err) {
   if (err instanceof HostedDiscardRefusedError) {

package/dist/{chunk-B7PA7UDX.js → chunk-IHKUFGYW.js}

@@ -1,4 +1,4 @@
-import { isTwinName, TWIN_REGISTRY, TWIN_NAMES } from './chunk-SRG22BIH.js';
+import { isTwinName, TWIN_REGISTRY, TWIN_NAMES } from './chunk-SDBBGCE7.js';
 import { readFileSync } from 'node:fs';
 import { parse } from 'yaml';
 

package/dist/{chunk-SRG22BIH.js → chunk-SDBBGCE7.js}

@@ -165,7 +165,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-5YCI6VIR.js');
+      } = await import('./src-FK536BIR.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);

package/dist/{chunk-XBT6ZLBG.js → chunk-TSOSDKXP.js}

@@ -363,7 +363,7 @@ var issueState = defineCheck({
 });
 var issueHasLabel = defineCheck({
   id: "linear.issue-has-label",
-  description: "Resolves the issue, joins its `labelIds` to the workspace label catalog, and asserts the named label is among them \u2014 case-insensitively, as the legacy rule's comparison was. The join is the point: this export carries label IDS where the seed writes names and twin-github writes objects, so one concept has three shapes and only this one is exported. A label id with no catalog row is a partial export and SKIPS rather than failing.",
+  description: "Resolves the issue, joins its `labelIds` to the workspace label catalog, and asserts the named label is among them, case-insensitively. The join is the point: this export carries label IDS where the seed writes names and twin-github writes objects, so one concept has three shapes and only this one is exported. A label id with no catalog row is a partial export and SKIPS rather than failing.",
   template: 'Issue "{title}" in `{team}` has label "{label}"',
   params: { title: issueTitle, team: teamKey, label: labelName },
   substrate: "final",
@@ -429,7 +429,7 @@ var issueEstimate = defineCheck({
 });
 var issueAssignee = defineCheck({
   id: "linear.issue-assignee",
-  description: "Resolves the issue, then its assignee, and matches the given reference against that user's email, name OR displayName \u2014 every spelling the legacy rule accepted. An UNASSIGNED issue is a real FAIL. Declared with no shipped corpus user, carrying a legacy capability forward. This is the check whose `subject` earns its keep: an email reference is destroyed by a team's `PII_PATTERNS`, which the twin's own redactor has no equivalent of, so without the declaration the criterion would silently be unable to fire.",
+  description: "Resolves the issue, then its assignee, and matches the given reference against that user's email, name OR displayName. An UNASSIGNED issue is a real FAIL. Declared with no shipped corpus user. This is the check whose `subject` earns its keep: an email reference is destroyed by a team's `PII_PATTERNS`, which the twin's own redactor has no equivalent of, so without the declaration the criterion would silently be unable to fire.",
   template: 'Issue "{title}" in `{team}` is assigned to `{user}`',
   params: { title: issueTitle, team: teamKey, user: userRef },
   substrate: "final",

package/dist/{chunk-S6JLWI4S.js → chunk-WJFRBXL5.js}

@@ -1,4 +1,4 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-SRG22BIH.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-SDBBGCE7.js';
 import { createFileBackedRecorderStore, createRecorderStore } from './chunk-E665XWYU.js';
 
 // src/recorder/recorder.ts

package/dist/{runDemo-NKSDEHRR.js → runDemo-PSXUXCR5.js}

@@ -1,14 +1,14 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-ZYQK4PNC.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-VORBQXJN.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-GNMDGZJF.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-EMIRZNHN.js';
 import './chunk-NW7HGA2K.js';
 import './chunk-3T5XN64P.js';
 import './chunk-Q5NBPR57.js';
-import { bootTwin } from './chunk-S6JLWI4S.js';
-import './chunk-SRG22BIH.js';
+import { bootTwin } from './chunk-WJFRBXL5.js';
+import './chunk-SDBBGCE7.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
-import { HostedQuotaError, HostedOrchError } from './chunk-OTFDQT3H.js';
+import { HostedQuotaError, HostedOrchError } from './chunk-72CG3JNL.js';
 import './chunk-CBFKZZBR.js';
 import './chunk-HJX25USP.js';
 import './chunk-E665XWYU.js';

package/dist/{runTrialGroup-IFRZWVRB.js → runTrialGroup-T2H7T54Z.js}

@@ -1,13 +1,13 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-EFX32JE3.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-VORBQXJN.js';
-import './chunk-B7PA7UDX.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-GUAGU65D.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-EMIRZNHN.js';
+import './chunk-IHKUFGYW.js';
 import './chunk-NW7HGA2K.js';
 import './chunk-3T5XN64P.js';
 import './chunk-Q5NBPR57.js';
-import './chunk-SRG22BIH.js';
-import './chunk-XWGZ5C7Y.js';
-import { HostedQuotaError, HostedTrialError } from './chunk-OTFDQT3H.js';
+import './chunk-SDBBGCE7.js';
+import './chunk-2V5A7NWP.js';
+import { HostedQuotaError, HostedTrialError } from './chunk-72CG3JNL.js';
 import './chunk-HJX25USP.js';
 import './chunk-E665XWYU.js';
 import './chunk-6KJC4BTO.js';

package/dist/src/cli/main.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, SESSION_TWIN_NAMES, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-EFX32JE3.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-ZYQK4PNC.js';
-import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-VORBQXJN.js';
-import '../../chunk-B7PA7UDX.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, SESSION_TWIN_NAMES, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, VERDICT_ARTIFACT_VERSION, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-GUAGU65D.js';
+import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-GNMDGZJF.js';
+import { parseTaskFile, scoreStatus, runScoreLine, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, markerFor, criterionMarkerLabel, twinSkipSuffix, readCodeCriteria, createHostedClient, toTwinHttpEvent, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-EMIRZNHN.js';
+import '../../chunk-IHKUFGYW.js';
 import '../../chunk-NW7HGA2K.js';
 import { GMAIL_CHECKS } from '../../chunk-JM6VS62R.js';
 import '../../chunk-3T5XN64P.js';
-import { LINEAR_CHECKS } from '../../chunk-XBT6ZLBG.js';
+import { LINEAR_CHECKS } from '../../chunk-TSOSDKXP.js';
 import '../../chunk-Q5NBPR57.js';
-import '../../chunk-S6JLWI4S.js';
-import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-SRG22BIH.js';
-import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-XWGZ5C7Y.js';
+import '../../chunk-WJFRBXL5.js';
+import { TWIN_NAME_LIST, isTwinName, createGitHubSmokeApp } from '../../chunk-SDBBGCE7.js';
+import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-2V5A7NWP.js';
 import '../../chunk-XDU6TD4O.js';
-import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-OTFDQT3H.js';
+import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError, HostedAuthError, HostedQuotaError } from '../../chunk-72CG3JNL.js';
 import '../../chunk-CBFKZZBR.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-C4BVTUA3.js';
 import { seedSchema } from '../../chunk-HJX25USP.js';
 import { SLACK_CHECKS } from '../../chunk-2ZGVDTJC.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-JWJYNAWI.js';
 import '../../chunk-E665XWYU.js';
-import { isLegacyEventRow, eventSchema } from '../../chunk-6KJC4BTO.js';
+import { eventSchema, isLegacyEventRow } from '../../chunk-6KJC4BTO.js';
 import { redactEvent, redactSecrets } from '../../chunk-SG6ZTIMT.js';
 import '../../chunk-CF6EIU2U.js';
 import { Command } from 'commander';
@@ -35,7 +35,6 @@ import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
 import { zodOutputFormat } from '@anthropic-ai/sdk/helpers/zod';
 
-var LEGACY_EVENTS_MESSAGE = "this run was produced by an older CLI version (pre-M0); rerun against current CLI to view";
 async function readEventsJsonl(runDir) {
   let raw;
   try {
@@ -47,9 +46,6 @@ async function readEventsJsonl(runDir) {
     throw err;
   }
   const rows = raw.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).map((line) => JSON.parse(line));
-  if (rows.some(isLegacyEventRow)) {
-    return { kind: "legacy" };
-  }
   const events = rows.map((row) => eventSchema.parse(row));
   return { kind: "events", events };
 }
@@ -242,7 +238,7 @@ async function loginWithClerk(options) {
     console.error(`Saved Pome credentials to ${path}`);
   }
   console.error("Pome login complete.");
-  console.error("Next: `pome session create --twin github` or `pome run <task>.md`");
+  console.error("Next: `pome sandbox create --twin github` or `pome run <task>.md`");
 }
 async function exchangeCode(input) {
   const ctrl = new AbortController();
@@ -409,7 +405,7 @@ var DOCS_TOPICS = [
   {
     id: "getting-started",
     title: "Quickstart",
-    path: "/getting-started",
+    path: "/quickstart/claude-code",
     keywords: ["install", "quickstart", "setup", "begin"]
   },
   {
@@ -424,9 +420,6 @@ var DOCS_TOPICS = [
       "register",
       "pome.json",
       "connect",
-      // Migrated from the retired skills-setup topic: wiring your own
-      // agent is now the "bring your own agent" path. ("pome-setup" / "setup"
-      // already resolve to getting-started via its "setup" keyword.)
       "wire"
     ]
   },
@@ -436,14 +429,6 @@ var DOCS_TOPICS = [
     path: "/docs/how-pome-works",
     keywords: ["twins", "scenarios", "runs", "scoring", "artifacts", "loop"]
   },
-  // The Gen-1 /setup and /test-with-pome skill pages were dropped from the docs
-  // nav, and the CLI commands that pointed at them are gone. The two
-  // topic entries are gone, but their still-live keywords are MIGRATED onto the
-  // surviving replacement topics so `pome docs <kw>` keeps routing:
-  //   wire → existing-agent;  test-with-pome / pome-test → cli-run;
-  //   eval → cli (the CLI reference index — no dedicated eval page exists).
-  //   (setup / pome-setup / register / run scenarios / /setup all already
-  //   resolve via existing substrings — see the tests.)
   {
     id: "dashboard",
     title: "Pome Dashboard",
@@ -453,7 +438,7 @@ var DOCS_TOPICS = [
   {
     id: "twins",
     title: "Twins overview",
-    path: "/docs/twins/index",
+    path: "/docs/twins/coverage",
     keywords: ["sandbox", "digital twin", "hosted"]
   },
   {
@@ -484,10 +469,8 @@ var DOCS_TOPICS = [
     id: "cli",
     title: "Command Line Interface",
     path: "/docs/cli",
-    // "eval" migrated from the retired skills-test topic: there is no
-    // dedicated `pome eval` docs page, and it is a distinct workflow from
-    // `pome inspect`, so it routes to the CLI reference index that documents
-    // every command rather than to a sibling command's page.
+    // No dedicated `pome eval` page exists, and eval is a distinct workflow
+    // from `pome inspect`, so "eval" routes to the reference index.
     keywords: ["commands", "flags", "pome run", "reference", "eval"]
   },
   {
@@ -502,26 +485,18 @@ var DOCS_TOPICS = [
       "artifacts",
       "default",
       "demo task",
-      "run yours",
-      // Migrated from the retired skills-test topic: running tasks is
-      // how you test an agent with pome.
-      "test-with-pome",
-      "pome-test"
+      "run yours"
     ]
   },
   {
-    id: "cli-session",
-    title: "pome session",
-    path: "/docs/cli/session",
-    keywords: ["session", "hosted", "sandbox", "twin"]
+    id: "cli-sandbox",
+    title: "pome sandbox",
+    path: "/docs/cli/sandbox",
+    keywords: ["sandbox", "hosted", "twin"]
   },
   {
     id: "cli-tasks",
     title: "pome tasks",
-    // The M4 docs door renamed the docs.pome.sh page from
-    // /docs/cli/scenarios to /docs/cli/tasks (a redirect keeps the old URL
-    // alive), so `path` now points at the new route. The "scenarios" keyword
-    // stays so `pome docs scenarios` still resolves to this topic.
     path: "/docs/cli/tasks",
     keywords: ["tasks", "scenarios", "catalog", "copy", "library", "twin"]
   },
@@ -548,12 +523,6 @@ var DOCS_TOPICS = [
     title: "Troubleshooting",
     path: "/docs/troubleshooting",
     keywords: ["errors", "help", "fix", "debug"]
-  },
-  {
-    id: "changelog",
-    title: "Changelog",
-    path: "/changelog",
-    keywords: ["release", "version", "news"]
   }
 ];
 
@@ -4653,7 +4622,7 @@ var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 var MAX_UNREADABLE_PATHS_SHOWN = 5;
 function readPackageVersion() {
-  if ("0.29.1".length > 0) return "0.29.1";
+  if ("0.31.0".length > 0) return "0.31.0";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -4751,12 +4720,6 @@ function createProgram() {
     }
     console.error(postInitMessage);
   });
-  program.command("install").allowUnknownOption().allowExcessArguments().description(
-    "Retired. Prints the Gen-2 wiring path: `claude mcp add \u2026 pome` + `npx skills add pome-sh/digital-twins --skill '*'`, then the pome-intake / REST-launch preflight."
-  ).action(async () => {
-    const { runInstall } = await import('../../install-4OATBKG3.js');
-    runInstall();
-  });
   program.command("login").description("Sign in with Clerk and store a hosted team API key (macOS Keychain or ~/.pome/credentials.json)").option(
     "--api-url <url>",
     "Control-plane base URL.",
@@ -4786,7 +4749,7 @@ function createProgram() {
     "Override docs site origin (default https://docs.pome.sh)"
   ).option(
     "--url",
-    "Print docs.pome.sh URLs (default behavior; retained for compatibility).",
+    "Print the URL instead of opening the interactive topic picker.",
     false
   ).description(
     "Navigate canonical narrative docs on docs.pome.sh"
@@ -4819,7 +4782,7 @@ function createProgram() {
     }
   );
   const checks = program.command("checks").argument("[twin]", "Twin id (e.g. github). Omit to list twins that declare checks.").option("--json", "Emit the declaration as JSON (for skills and agents).", false).description(
-    "Browse the typed checks a twin declares \u2014 the closed set [code] criteria come from"
+    "Browse the typed checks a twin declares \u2014 the closed set a [code] criterion is graded by"
   ).action(async (twin2, opts) => {
     await runChecksCommand(twin2, { json: opts.json });
   });
@@ -4894,10 +4857,10 @@ function createProgram() {
       }
     }
   );
-  const session = program.command("session").alias("sandbox").description(
-    "Hosted sandbox sessions (same API as the dashboard Twins page \u2014 requires login)"
+  const session = program.command("sandbox").description(
+    "Hosted sandboxes (same API as the dashboard Twins page \u2014 requires login)"
   );
-  session.command("create").description("Create a hosted sandbox session for one or more twins and print its connection info").option(
+  session.command("create").description("Create a hosted sandbox for one or more twins and print its connection info").option(
     "--twin <name>",
     // The enumeration is derived, never typed: this line is the public
     // discovery surface for which twins exist, and a hand-written copy of the
@@ -4911,7 +4874,7 @@ function createProgram() {
     // reject the invocation before the action runs, so the check moved into
     // `runSessionCreate`, which fails with the same "No twin specified"
     // sentence when neither source supplies one.
-    `${SESSION_TWIN_NAMES.join(" | ")}. Repeat the flag for a multi-twin session (e.g. --twin github --twin gmail). Optional when --seed names exactly one twin.`,
+    `${SESSION_TWIN_NAMES.join(" | ")}. Repeat the flag for a multi-twin sandbox (e.g. --twin github --twin gmail). Optional when --seed names exactly one twin.`,
     (value, previous = []) => [...previous, value]
   ).option(
     "--seed <path>",
@@ -4920,7 +4883,7 @@ function createProgram() {
     "--api-url <url>",
     "Control-plane URL",
     process.env.POME_API_URL ?? DEFAULT_CONTROL_PLANE_URL
-  ).option("--show-secrets", "Deprecated: secrets are never printed; use --secrets-file", false).option(
+  ).option(
     "--secrets-file <path>",
     "Write shell exports containing session secrets to a local file with mode 0600"
   ).option(
@@ -4939,7 +4902,6 @@ function createProgram() {
         await runSessionCreate({
           apiBaseUrl: opts.apiUrl,
           twins: opts.twin ?? [],
-          showSecrets: opts.showSecrets,
           format,
           secretsFile: opts.secretsFile,
           seedPath: opts.seed
@@ -4950,7 +4912,7 @@ function createProgram() {
       }
     }
   );
-  session.command("list").description("List hosted sessions (defaults to --state running, like the dashboard)").option(
+  session.command("list").description("List hosted sandboxes (defaults to --state running, like the dashboard)").option(
     "--api-url <url>",
     "Control-plane URL",
     process.env.POME_API_URL ?? DEFAULT_CONTROL_PLANE_URL
@@ -4987,7 +4949,7 @@ function createProgram() {
       }
     }
   );
-  session.command("stop").alias("kill").description("Stop a hosted session (aliased as `kill`)").argument("<session-id>", "Session id (ses_\u2026)").option(
+  session.command("stop").description("Stop a hosted sandbox").argument("<session-id>", "Sandbox id (ses_\u2026)").option(
     "--api-url <url>",
     "Control-plane URL",
     process.env.POME_API_URL ?? DEFAULT_CONTROL_PLANE_URL
@@ -5006,7 +4968,7 @@ function createProgram() {
       } catch (err) {
         const friendly = friendlyHostedError(err);
         if (friendly) console.error(friendly);
-        process.exitCode = 2;
+        process.exitCode = exitCodeFor(err);
       }
     }
   );
@@ -5016,7 +4978,7 @@ function createProgram() {
   ).option("--agent <command>", "Agent command to run").option(
     "-n, --trials <count>",
     "Run <count> isolated trials of the task as ONE trial group (integer 1-20; hosted only). Default is the task config's `runs` field (capped at 20). k>1 mints sessions with a shared group id up to your plan's concurrent-twin quota (remaining trials reuse slots as earlier trials finish), runs trials at that concurrency, prints the per-trial verdict table (numeric cloud-judge scores), and exits 0 iff at least one trial completed and every completed trial passed (1: a completed trial failed; 2: nothing completed). k=1 keeps today's single-run behavior exactly."
-  ).option("--artifacts-dir <dir>", "Directory for run artifacts", "runs").option("--hosted", "Deprecated: hosted is now the default. Flag is a no-op.").option(
+  ).option("--artifacts-dir <dir>", "Directory for run artifacts", "runs").option(
     "--api-url <url>",
     "Control-plane base URL.",
     process.env.POME_API_URL ?? DEFAULT_CONTROL_PLANE_URL
@@ -5099,13 +5061,6 @@ function createProgram() {
       const agentCommand = resolvedCommand ?? DEFAULT_AGENT_COMMAND;
       let worstExit = 0;
       const useLocal = options.local === true || process.env.POME_LOCAL === "1";
-      if (options.hosted && useLocal) {
-        console.error(
-          "Warning: --hosted is a no-op; running against a local twin (--local / POME_LOCAL=1). Drop it to record runs to the cloud."
-        );
-      } else if (options.hosted) {
-        console.error("Note: --hosted is now the default; the flag is a deprecated no-op and will be removed in a future release.");
-      }
       if (trialsFlag !== void 0 && useLocal) {
         console.error(
           "-n/--trials needs the hosted path (verdicts come from the cloud judge); --local runs capture a single trace. Drop --local or -n."
@@ -5114,7 +5069,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-BZ5L2YNC.js');
+        const { runDoctorChecks } = await import('../../checks-KGDGQ35O.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -5123,7 +5078,7 @@ function createProgram() {
           console.error(
             "pome run: wiring check failed \u2014 refusing to spawn the agent. Fix the cause above and re-run (there is no --force)."
           );
-          process.exitCode = 1;
+          process.exitCode = 5;
           return;
         }
       }
@@ -5152,7 +5107,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-IFRZWVRB.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-T2H7T54Z.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5246,7 +5201,7 @@ function createProgram() {
         process.exitCode = 5;
         return;
       }
-      const { runDemo } = await import('../../runDemo-NKSDEHRR.js');
+      const { runDemo } = await import('../../runDemo-PSXUXCR5.js');
       const result = await runDemo({
         apiBase: opts.apiUrl.replace(/\/$/, ""),
         dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
@@ -5264,7 +5219,7 @@ function createProgram() {
   program.command("doctor").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-BZ5L2YNC.js');
+    const { runDoctorChecks } = await import('../../checks-KGDGQ35O.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5298,11 +5253,6 @@ function createProgram() {
     const latest = run === "latest" ? await readLatestRun(options.artifactsDir) : void 0;
     const runDir = latest?.run_dir ?? resolve(run);
     const eventsResult = await readEventsJsonl(runDir);
-    if (eventsResult.kind === "legacy") {
-      console.error(LEGACY_EVENTS_MESSAGE);
-      process.exitCode = 2;
-      return;
-    }
     const meta = await readMetaSummary(runDir);
     console.log(`Run: ${latest?.run_id ?? run}`);
     console.log(`Directory: ${runDir}`);
@@ -5324,7 +5274,7 @@ function createProgram() {
     "[task]",
     "Path to the task .md file (only with an events.jsonl target)"
   ).description(
-    "Assemble a paste-into-IDE fix prompt (no LLM call, no network). With no args, reads the latest FAILED run set under ./runs: the persisted cloud verdicts (verdict.json) become grouped failure signatures over the raw traces, in one prompt. Point it at a trial run dir to target that set, or use the legacy `<events.jsonl> <task.md>` form for a single trace."
+    "Assemble a paste-into-IDE fix prompt (no LLM call, no network). With no args, reads the latest FAILED run set under ./runs: the persisted cloud verdicts (verdict.json) become grouped failure signatures over the raw traces, in one prompt. Point it at a trial run dir to target that set, or point it at an `events.jsonl` with its task file for a single trace."
   ).action(async (target, taskArg) => {
     if (target !== void 0 && target.endsWith(".jsonl")) {
       if (!taskArg) {
@@ -5446,13 +5396,13 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-ZDWFU6M4.js');
+    const { runTwinStartCommand } = await import('../../twinStart-VUCN4CFY.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("seed").argument("<name...>", `Twin name (${TWIN_NAME_LIST.join(" | ")}). Repeat for one file covering several.`).option("--out <path>", "Write to this file instead of stdout. Refuses to overwrite.").description(
     "Print a starter seed file for a twin, generated from the twin's own starting state"
   ).action(async (names, options) => {
-    const { runTwinSeedCommand } = await import('../../twinSeed-MOQXJDEG.js');
+    const { runTwinSeedCommand } = await import('../../twinSeed-XIKTIHX2.js');
     await runTwinSeedCommand(names, options);
   });
   twin.command("reset").argument("[name]", "Twin name (default: github)", "github").description("Reset standalone twin state").action(async (name) => {

package/dist/{src-5YCI6VIR.js → src-FK536BIR.js}

@@ -1,4 +1,4 @@
-export { LINEAR_CHECKS } from './chunk-XBT6ZLBG.js';
+export { LINEAR_CHECKS } from './chunk-TSOSDKXP.js';
 import { MCP_PAGE_MAX, defaultSeedState, linearSeedSchema, notFound, badUserInput, MCP_PAGE_DEFAULT, DEFAULT_LINEAR_EMAIL, RELAY_PAGE_MAX, RELAY_PAGE_DEFAULT, STATE_EXPORT_CAP, parseSeed, DEFAULT_LINEAR_CLOCK, LINEAR_PROVIDER_TOKEN_PREFIX, DEFAULT_LINEAR_SID, DEFAULT_SCOPES, linearErrorEnvelope, unauthorizedEnvelope, unsupportedEnvelope, forbiddenEnvelope, assertWebhookUrl, ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_SECONDS, TITLE_MAX_BYTES, BODY_MAX_BYTES, LinearTwinError, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX } from './chunk-Q5NBPR57.js';
 export { DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, STATE_EXPORT_CAP, assertWebhookUrl, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError } from './chunk-Q5NBPR57.js';
 import './chunk-JWJYNAWI.js';

package/dist/twinHarness-TSAQYDC5.js

@@ -0,0 +1,6 @@
+export { UnsupportedTwinError, bootTwin } from './chunk-WJFRBXL5.js';
+export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-SDBBGCE7.js';
+import './chunk-E665XWYU.js';
+import './chunk-6KJC4BTO.js';
+import './chunk-SG6ZTIMT.js';
+import './chunk-CF6EIU2U.js';

package/dist/{twinSeed-MOQXJDEG.js → twinSeed-XIKTIHX2.js}

@@ -1,4 +1,4 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-SRG22BIH.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-SDBBGCE7.js';
 import { writeFile } from 'node:fs/promises';
 
 async function generateSeedFile(twins) {

package/dist/{twinStart-ZDWFU6M4.js → twinStart-VUCN4CFY.js}

@@ -1,6 +1,6 @@
-import { readSeedFileText, seedForTwin, parseSeedFileText, soleTwinOf, twinsNamedBy } from './chunk-B7PA7UDX.js';
-import { bootTwin } from './chunk-S6JLWI4S.js';
-import { TWIN_REGISTRY, isTwinName, TWIN_NAMES, defaultPortFor } from './chunk-SRG22BIH.js';
+import { readSeedFileText, seedForTwin, parseSeedFileText, soleTwinOf, twinsNamedBy } from './chunk-IHKUFGYW.js';
+import { bootTwin } from './chunk-WJFRBXL5.js';
+import { TWIN_REGISTRY, isTwinName, TWIN_NAMES, defaultPortFor } from './chunk-SDBBGCE7.js';
 import './chunk-E665XWYU.js';
 import './chunk-6KJC4BTO.js';
 import './chunk-SG6ZTIMT.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.29.1",
+  "version": "0.31.0",
   "description": "Digital-twin testing for AI agents \u2014 run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",

package/dist/install-4OATBKG3.js

@@ -1,22 +0,0 @@
-// src/cli/install.ts
-var GEN2_REDIRECT = [
-  "pome install (Gen-1 agent-driven wiring) is retired.",
-  "",
-  "Wire your own agent to pome the Gen-2 way:",
-  "  1. claude mcp add --transport http pome https://mcp.pome.sh/mcp",
-  "                                           # connect the pome control MCP",
-  "  2. npx skills add pome-sh/digital-twins --skill '*'",
-  "                                           # install the Gen-2 coach skills",
-  "                                           # (--skill '*' takes all six; the",
-  "                                           #  picker opens with none ticked)",
-  "  3. run the pome-intake skill to register the examinee and check twin",
-  "     coverage (self-hosted REST agent: use the coach's REST-launch preflight).",
-  "",
-  "Already have pome.json? `pome register agent <name>` and `pome doctor` still apply.",
-  "See `pome docs getting-started`."
-];
-function runInstall() {
-  for (const line of GEN2_REDIRECT) console.error(line);
-}
-
-export { runInstall };

package/dist/twinHarness-CUVRO5IV.js

@@ -1,6 +0,0 @@
-export { UnsupportedTwinError, bootTwin } from './chunk-S6JLWI4S.js';
-export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-SRG22BIH.js';
-import './chunk-E665XWYU.js';
-import './chunk-6KJC4BTO.js';
-import './chunk-SG6ZTIMT.js';
-import './chunk-CF6EIU2U.js';