@pome-sh/cli 0.4.0 → 0.5.0

package/dist/src/cli/main.js

@@ -18,7 +18,6 @@ import { runDocsCommand } from "./docs.js";
 import { runCompileSeeds } from "./compile-seeds.js";
 import { runScenariosCommand } from "./scenarios.js";
 import { runEvalCommand } from "./eval.js";
-import { runSkillsInstall } from "./skills.js";
 import { copyAnnounceLine, ensureDefaultTask, runYoursFrameLines, trialsPinFallbackLine, } from "./default-task.js";
 import { findTwin, runnableScenarios, } from "./scenarios-catalog.js";
 import { friendlyHostedError, runSessionCreate, runSessionList, runSessionStop, } from "./session.js";
@@ -141,19 +140,16 @@ export function createProgram() {
     });
     program
         .command("install")
-        .description("Wire this repo to pome with your own coding agent: checks auth (routes through pome login when needed), runs the wiring headless on your own Claude credentials, shows the full diff in this terminal, and applies it only on [y] — then verifies with pome doctor. --interactive hands off to a live agent session instead; no coding agent on PATH → prints manual wiring steps + a paste-into-any-agent prompt.")
-        .option("--interactive", "Hand off to an interactive agent session (approve edits in the agent's own UI) instead of the headless staged-diff flow.")
-        .option("--api-url <url>", "Control-plane base URL.", process.env.POME_API_URL ?? DEFAULT_CONTROL_PLANE_URL)
-        .option("--dashboard-url <url>", "App URL for Clerk sign-in (must serve /cli/login).", process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL)
-        .action(async (opts) => {
-        // Dynamic import mirrors the doctor/run commands: keep install's
-        // dependency graph out of every other command's startup path.
+        // F-893 — the Gen-1 agent-driven wiring is retired; this is a redirect to
+        // the Gen-2 path. allowUnknownOption + allowExcessArguments keep old
+        // invocations (`pome install --interactive`, `--api-url …`) landing on the
+        // redirect instead of erroring on a now-removed flag or stray operand.
+        .allowUnknownOption()
+        .allowExcessArguments()
+        .description("Retired (F-893). Prints the Gen-2 wiring path: `claude mcp add … pome` + `npx skills add pome-sh/digital-twins`, then the pome-intake / REST-launch preflight.")
+        .action(async () => {
         const { runInstall } = await import("./install.js");
-        await runInstall({
-            apiUrl: opts.apiUrl,
-            dashboardUrl: opts.dashboardUrl,
-            interactive: opts.interactive,
-        });
+        runInstall();
     });
     program
         .command("login")
@@ -211,22 +207,9 @@ export function createProgram() {
         if (code !== 0)
             process.exitCode = code;
     });
-    const skills = program
-        .command("skills")
-        .description("Manage the bundled pome agent skills (/pome-setup, /pome-test)");
-    skills
-        .command("install")
-        .description("Install /pome-setup and /pome-test into ~/.claude/skills/ (symlinked to this pome install by default)")
-        .option("--copy", "Copy each skill instead of symlinking (CI, Windows without symlink permission)", false)
-        .option("--force", "Overwrite an existing install of the same skill", false)
-        .option("--dest <dir>", "Install into <dir> instead of ~/.claude/skills/ (testing and advanced users)")
-        .action(async (opts) => {
-        await runSkillsInstall({
-            copy: opts.copy,
-            force: opts.force,
-            dest: opts.dest,
-        });
-    });
+    // F-893 — `pome skills` / `pome skills install` retired. It only symlinked
+    // the two Gen-1 tombstone skills into ~/.claude/skills/; the Gen-2 coach set
+    // installs via `npx skills add pome-sh/digital-twins`.
     const register = program
         .command("register")
         .description("Register a cloud entity (agent, ...) and link this project to it");

package/dist/src/cli/register.d.ts

@@ -11,26 +11,4 @@ interface RegisterAgentOptions extends InteractiveSeams {
 /** Normalize a `--twins github,slack` comma list to a validated twin array. */
 export declare function normalizeRegisterTwins(raw: string | undefined): string[] | undefined;
 export declare function runRegisterAgent(opts: RegisterAgentOptions): Promise<void>;
-export interface EnsureAgentRegisteredOptions extends InteractiveSeams {
-    apiBaseUrl: string;
-    /** Where to look for the manifest. Defaults to process.cwd(). */
-    cwd?: string;
-    /** Test seam — forwarded to resolveCredentials. */
-    credentialsPath?: string;
-}
-export type EnsureAgentRegisteredResult = {
-    status: "registered";
-    agentId: string;
-    agentSlug: string;
-} | {
-    status: "already-registered";
-    agentId: string;
-    agentSlug?: string;
-} | {
-    status: "no-config";
-};
-/** Idempotent registration for `pome install`: a repo already linked under the
- *  caller's team keeps its id (no network, no duplicate); a fresh repo registers
- *  under the manifest name (or the config directory's basename). */
-export declare function ensureAgentRegistered(opts: EnsureAgentRegisteredOptions): Promise<EnsureAgentRegisteredResult>;
 export { friendlyHostedError };

package/dist/src/cli/register.js

@@ -19,7 +19,7 @@ import { postAgentResolver, resolveSeams, } from "./agent-resolver.js";
 import { resolveCredentials } from "./credentials.js";
 import { suggestFramework } from "./frameworks.js";
 import { ensurePomeGitignored, readLinkCache, resolveCachedAgentId, writeLinkCache, } from "./link-cache.js";
-import { readManifest, readRequiredManifest, writeManifest, } from "./project-config.js";
+import { readRequiredManifest, writeManifest, } from "./project-config.js";
 import { friendlyHostedError } from "./session.js";
 const SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 /** Normalize a `--twins github,slack` comma list to a validated twin array. */
@@ -160,36 +160,6 @@ export async function runRegisterAgent(opts) {
         console.error("Enabled services: not reported by this pome cloud (older control plane) — twin scoping may not have taken effect.");
     }
 }
-/** Idempotent registration for `pome install`: a repo already linked under the
- *  caller's team keeps its id (no network, no duplicate); a fresh repo registers
- *  under the manifest name (or the config directory's basename). */
-export async function ensureAgentRegistered(opts) {
-    const manifestRead = await readManifest(opts.cwd ?? process.cwd());
-    if (!manifestRead)
-        return { status: "no-config" };
-    const projectDir = dirname(manifestRead.path);
-    const creds = await resolveCredentials({
-        apiBaseUrl: opts.apiBaseUrl,
-        credentialsPath: opts.credentialsPath,
-    });
-    const cachedId = resolveCachedAgentId(await readLinkCache(projectDir), creds.teamId);
-    if (cachedId) {
-        return {
-            status: "already-registered",
-            agentId: cachedId,
-            agentSlug: manifestRead.manifest.agent.slug,
-        };
-    }
-    const name = manifestRead.manifest.agent.name ?? basename(projectDir);
-    const agent = await createAndPersistAgent({
-        creds,
-        name,
-        manifestRead,
-        projectDir,
-        seams: resolveSeams(opts),
-    });
-    return { status: "registered", agentId: agent.id, agentSlug: agent.slug };
-}
 function stripControlCharacters(value) {
     return value.replace(/[\u0000-\u001f\u007f]/g, "");
 }

package/dist/src/doctor/checks.js

@@ -164,7 +164,7 @@ async function checkRouting(configDir) {
             cause: `no POME_*_REST_URL / POME_*_MCP_URL read and no @pome-sh adapter found in the ${scan.filesScanned} source file(s) under ${relative(process.cwd(), configDir) || "."} — the agent has no path to the twin.`,
             fix: [
                 'wire the adapter: import { withPome } from "@pome-sh/adapter-claude-sdk"; call withPome() at startup;',
-                "read the twin base URL from POME_GITHUB_REST_URL (injected by the runner) — or run pome install to have your coding agent wire it.",
+                "read the twin base URL from POME_GITHUB_REST_URL (injected by the runner) — or let your own coding agent wire it with the Gen-2 skills (`npx skills add pome-sh/digital-twins`).",
             ].join("\n"),
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Digital-twin testing for AI agents — run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",
@@ -34,7 +34,6 @@
     "dist",
     "examples",
     "scenarios",
-    "skills",
     "LICENSE",
     "package.json",
     "README.md"

package/dist/src/cli/agent-sdk.d.ts

@@ -1,32 +0,0 @@
-/** Pinned driver version — bump deliberately, in lockstep with a re-test
- *  against the oldest Claude Code binary we expect on user machines. */
-export declare const AGENT_SDK_VERSION = "0.3.202";
-/**
- * True when the machine has credentials the Claude Code binary can
- * authenticate with on its own: a stored `/login` session (keychain or
- * `$CLAUDE_CONFIG_DIR/.credentials.json`) or an explicit env credential.
- * Mirrors the SDK's own resolution; pome never reads the secret values.
- */
-export declare function detectClaudeLogin(env?: Record<string, string | undefined>, home?: string, platform?: NodeJS.Platform): boolean;
-/** Directory the pinned SDK driver is provisioned into. */
-export declare function agentSdkDir(home?: string): string;
-export declare function isAgentSdkProvisioned(dir?: string): boolean;
-/** Minimal structural view of the SDK's query() — the driver is loaded at
- *  runtime, so pome compiles against this shape, not the SDK's types. */
-export type AgentSdkQueryFn = (args: {
-    prompt: string;
-    options: Record<string, unknown>;
-}) => AsyncIterable<Record<string, unknown>>;
-export interface AgentSdkModule {
-    query: AgentSdkQueryFn;
-}
-/**
- * Install the pinned driver into `dir` using whichever package manager is
- * on PATH. `--omit=optional` skips the ~244 MB platform runtime — the
- * session runs on the user's own `claude` binary instead.
- * Returns null (with a printed reason) when no package manager is found
- * or the install fails; callers fall back to the interactive session.
- */
-export declare function provisionAgentSdk(dir?: string): Promise<boolean>;
-/** Import the provisioned driver. Returns null when not provisioned. */
-export declare function loadAgentSdk(dir?: string): Promise<AgentSdkModule | null>;

package/dist/src/cli/agent-sdk.js

@@ -1,105 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// FDRS-661 — Claude Agent SDK access for the embedded (headless) wiring
-// session: detect whether the user's own credentials exist, and lazily
-// provision the SDK driver into ~/.pome/agent-sdk/<version>.
-//
-// The SDK is deliberately NOT a dependency of @pome-sh/cli: its per-platform
-// optionalDependency bundles the Claude Code runtime (~244 MB unpacked),
-// which would sink `npx @pome-sh/cli demo` cold-start. Instead we install the
-// driver package alone (--omit=optional, a few MB) on first use, and point
-// it at the user's already-installed `claude` binary via
-// `pathToClaudeCodeExecutable` — verified against SDK 0.3.202 driving
-// Claude Code 2.1.201.
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
-/** Pinned driver version — bump deliberately, in lockstep with a re-test
- *  against the oldest Claude Code binary we expect on user machines. */
-export const AGENT_SDK_VERSION = "0.3.202";
-/** macOS keychain service Claude Code stores its `/login` credential under.
- *  Existence-only probe (no `-w`): the secret is never read or printed. */
-const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
-/**
- * True when the machine has credentials the Claude Code binary can
- * authenticate with on its own: a stored `/login` session (keychain or
- * `$CLAUDE_CONFIG_DIR/.credentials.json`) or an explicit env credential.
- * Mirrors the SDK's own resolution; pome never reads the secret values.
- */
-export function detectClaudeLogin(env = process.env, home = homedir(), platform = process.platform) {
-    if (env.ANTHROPIC_API_KEY || env.CLAUDE_CODE_OAUTH_TOKEN || env.ANTHROPIC_AUTH_TOKEN) {
-        return true;
-    }
-    const configDir = env.CLAUDE_CONFIG_DIR || join(home, ".claude");
-    try {
-        if (existsSync(join(configDir, ".credentials.json")))
-            return true;
-    }
-    catch {
-        /* unreadable — treat as absent */
-    }
-    if (platform === "darwin") {
-        try {
-            const res = spawnSync("security", ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE], { stdio: "ignore", timeout: 5000 });
-            if (res.status === 0)
-                return true;
-        }
-        catch {
-            /* lookup failed — treat as absent */
-        }
-    }
-    return false;
-}
-/** Directory the pinned SDK driver is provisioned into. */
-export function agentSdkDir(home = homedir()) {
-    return join(home, ".pome", "agent-sdk", AGENT_SDK_VERSION);
-}
-function sdkEntryPath(dir) {
-    return join(dir, "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");
-}
-export function isAgentSdkProvisioned(dir = agentSdkDir()) {
-    return existsSync(sdkEntryPath(dir));
-}
-/**
- * Install the pinned driver into `dir` using whichever package manager is
- * on PATH. `--omit=optional` skips the ~244 MB platform runtime — the
- * session runs on the user's own `claude` binary instead.
- * Returns null (with a printed reason) when no package manager is found
- * or the install fails; callers fall back to the interactive session.
- */
-export async function provisionAgentSdk(dir = agentSdkDir()) {
-    await mkdir(dir, { recursive: true });
-    const manifest = join(dir, "package.json");
-    if (!existsSync(manifest)) {
-        await writeFile(manifest, JSON.stringify({ name: "pome-agent-sdk", private: true }, null, 2));
-    }
-    const spec = `@anthropic-ai/claude-agent-sdk@${AGENT_SDK_VERSION}`;
-    const attempts = [
-        ["npm", ["install", "--omit=optional", "--no-audit", "--no-fund", spec]],
-        ["bun", ["add", "--omit=optional", spec]],
-    ];
-    for (const [bin, args] of attempts) {
-        const probe = spawnSync(bin, ["--version"], { stdio: "ignore", timeout: 10_000 });
-        if (probe.error || probe.status !== 0)
-            continue;
-        console.error(`downloading the Claude Agent SDK driver (${spec}, a few MB, one-time) …`);
-        const res = spawnSync(bin, args, { cwd: dir, stdio: "ignore", timeout: 300_000 });
-        if (res.status === 0 && isAgentSdkProvisioned(dir))
-            return true;
-        console.error(`(${bin} install of ${spec} failed)`);
-    }
-    console.error("couldn't provision the Claude Agent SDK driver (is npm or bun on PATH?).");
-    return false;
-}
-/** Import the provisioned driver. Returns null when not provisioned. */
-export async function loadAgentSdk(dir = agentSdkDir()) {
-    const entry = sdkEntryPath(dir);
-    if (!existsSync(entry))
-        return null;
-    const mod = (await import(pathToFileURL(entry).href));
-    if (typeof mod.query !== "function")
-        return null;
-    return { query: mod.query };
-}

package/dist/src/cli/embedded-wiring.d.ts

@@ -1,47 +0,0 @@
-import type { AgentSdkQueryFn } from "./agent-sdk.js";
-/** Tools the staging session may use. Everything else — Bash above all —
- *  is refused: package installs and verification are pome's job, after
- *  the diff is approved. NOTE: never mirror these into `allowedTools`;
- *  bare allowedTools entries auto-approve before canUseTool is consulted. */
-export declare const STAGING_TOOLS: readonly ["Read", "Edit", "Write", "Glob", "Grep"];
-/** First message of the headless session. The pome-setup skill (injected
- *  into the shadow's .claude/skills) carries the wiring knowledge; this
- *  adapts its interactive contract to staging: edits land automatically,
- *  the human approves ONE combined diff in pome's terminal afterwards. */
-export declare const EMBEDDED_KICKOFF_PROMPT: string;
-export type EmbeddedWiringOutcome = {
-    kind: "applied";
-    files: number;
-    packageJsonChanged: boolean;
-} | {
-    kind: "declined";
-} | {
-    kind: "no-diff";
-    reason: string;
-} | {
-    kind: "session-error";
-    reason: string;
-};
-export interface EmbeddedWiringOptions {
-    /** The real repo root the approved diff is applied to. */
-    cwd: string;
-    /** The user's Claude Code binary — passed as pathToClaudeCodeExecutable. */
-    claudePath: string;
-    /** Packaged pome-setup skill directory (contains SKILL.md). */
-    skillSourceDir: string;
-    /** The provisioned SDK's query(). Injected — the test seam. */
-    query: AgentSdkQueryFn;
-    /** [y/N] prompt. */
-    confirm: (question: string) => Promise<boolean>;
-    /** Line sink, default console.error. */
-    log?: (line: string) => void;
-}
-export declare function runEmbeddedWiring(options: EmbeddedWiringOptions): Promise<EmbeddedWiringOutcome>;
-/** Path-confining permission gate. Exported for direct unit tests. */
-export declare function buildStagingCanUseTool(shadowRoot: string, log: (line: string) => void): (toolName: string, input: Record<string, unknown>) => Promise<{
-    behavior: "allow";
-    updatedInput: Record<string, unknown>;
-} | {
-    behavior: "deny";
-    message: string;
-}>;