@pome-sh/cli 0.42.3 → 0.43.0

package/dist/src/cli/main.js

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, SESSION_TWIN_NAMES, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, runTaskHosted, discoverRunSet, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, resolveCachedAgentId, readLinkCache, postAgentResolver, writeLinkCache, ensurePomeGitignored } from '../../chunk-46POYRLY.js';
-import { assetPath, runTask, resolvePackageRoot, DEMO_TASK_NAME, demoTaskPath } from '../../chunk-WERG4AUH.js';
-import { parseTaskFile, scoreStatus, runScoreLine, narratorReadingLines, readLatestRun, readMetaSummary, outcomeOf, readConfigTwins, scoreCountsSummary, criterionRowLine, readCodeCriteria, createHostedClient, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-STMGQ7GU.js';
-import '../../chunk-VPXIGCZW.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, SESSION_TWIN_NAMES, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, parseTaskFile, runTaskHosted, scoreStatus, runScoreLine, narratorReadingLines, readLatestRun, readMetaSummary, discoverRunSet, outcomeOf, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, readConfigTwins, resolveCachedAgentId, readLinkCache, seedStateForTwin, runAgentCommand, scoreCountsSummary, criterionRowLine, readCodeCriteria, postAgentResolver, writeLinkCache, ensurePomeGitignored, writeRunArtifactsCore, createHostedClient, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-OBFHOACQ.js';
+import '../../chunk-3YCX3KUL.js';
 import '../../chunk-NW7HGA2K.js';
 import { GMAIL_CHECKS } from '../../chunk-JM6VS62R.js';
 import '../../chunk-PASFBRK4.js';
 import { LINEAR_CHECKS } from '../../chunk-TSOSDKXP.js';
 import '../../chunk-3FZY376K.js';
-import '../../chunk-5NPGY73F.js';
-import { TWIN_NAME_LIST, TWIN_REGISTRY, createGitHubSmokeApp } from '../../chunk-RPPF2KDQ.js';
-import { readManifest, writeManifest, MANIFEST_JSON, readRequiredManifest, normalizeManifestTwins } from '../../chunk-DFOQGAKS.js';
-import '../../chunk-XDU6TD4O.js';
-import { MOUNTED_TWINS, deriveAgentSlug, exitCodeFor, HostedUsageError, HostedOrchError } from '../../chunk-NNXVR46L.js';
-import '../../chunk-CBFKZZBR.js';
+import { createRecorder, bootTwin } from '../../chunk-5A6HHA54.js';
+import { TWIN_NAME_LIST, TWIN_REGISTRY, createGitHubSmokeApp } from '../../chunk-ELIEDNF3.js';
+import { getAvailablePort } from '../../chunk-XDU6TD4O.js';
+import { MOUNTED_TWINS, readManifest, deriveAgentSlug, writeManifest, MANIFEST_JSON, exitCodeFor, readRequiredManifest, HostedUsageError, HostedOrchError, normalizeManifestTwins } from '../../chunk-CS7O2ZXB.js';
+import { buildEgressAllowlist, readBlockedEgress } from '../../chunk-CBFKZZBR.js';
 import { TAPE_ASSERTABLE_TOOLS } from '../../chunk-C4BVTUA3.js';
 import { seedSchema } from '../../chunk-NBOQN5VX.js';
 import { SLACK_CHECKS } from '../../chunk-2ZGVDTJC.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-JWJYNAWI.js';
 import '../../chunk-YBWG5JK2.js';
 import '../../chunk-HRAD7MRX.js';
-import { eventSchema, isLegacyEventRow } from '../../chunk-6KJC4BTO.js';
+import { eventSchema, isLegacyEventRow } from '../../chunk-5KFDRR53.js';
 import { redactSecrets, redactEvent } from '../../chunk-SG6ZTIMT.js';
 import '../../chunk-2K6BJ3PI.js';
 import '../../chunk-FBSA5L36.js';
 import { Command } from 'commander';
 import { existsSync, readFileSync, realpathSync, statSync, constants } from 'node:fs';
 import { mkdir, readFile, writeFile, readdir, copyFile, stat, cp } from 'node:fs/promises';
-import { dirname, resolve, join, basename, relative, extname } from 'node:path';
+import { dirname, resolve, join, basename, relative, sep, extname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { execFile } from 'node:child_process';
-import { randomBytes, createHash } from 'node:crypto';
+import { serve } from '@hono/node-server';
+import { randomBytes, randomUUID, createHash } from 'node:crypto';
+import { sign } from 'hono/jwt';
+import { execFile, spawn } from 'node:child_process';
 import { createServer } from 'node:http';
 import { createInterface } from 'node:readline';
 import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
+import { createRequire } from 'node:module';
 
 async function readEventsJsonl(runDir) {
   const file = resolve(runDir, "events.jsonl");
@@ -202,6 +202,419 @@ function renderLlmTurn(event2) {
     `    cache read/create=${cache}${finish}`
   ];
 }
+var LISTENING_REGEX = /listening on 127\.0\.0\.1:(\d+)/;
+async function spawnCaptureServerChild(options) {
+  const execPath = options.execPath ?? process.execPath;
+  const binArgs = options.binArgs ?? defaultBinArgs(options.eventsOut, options.allowHosts, options.egressOut);
+  const readyTimeoutMs = options.readyTimeoutMs ?? 5e3;
+  const shutdownGraceMs = options.shutdownGraceMs ?? 5e3;
+  const child = spawn(execPath, binArgs, {
+    stdio: ["ignore", "ignore", "pipe"],
+    env: process.env
+  });
+  let stderrBuf = "";
+  let resolved = false;
+  const readyPromise = new Promise((resolve7, reject) => {
+    const onData = (chunk) => {
+      stderrBuf += chunk.toString("utf8");
+      if (stderrBuf.length > 8192) stderrBuf = stderrBuf.slice(-8192);
+      const match = LISTENING_REGEX.exec(stderrBuf);
+      if (match) {
+        resolved = true;
+        cleanup();
+        resolve7(Number(match[1]));
+      }
+    };
+    const onExit = (code, signal) => {
+      if (resolved) return;
+      cleanup();
+      const detail = stderrBuf.trim().slice(0, 2048);
+      reject(
+        new Error(
+          `pome capture-server exited (code=${code} signal=${signal}) before printing the listening line.${detail ? `
+stderr: ${detail}` : ""}`
+        )
+      );
+    };
+    const timer = setTimeout(() => {
+      if (resolved) return;
+      cleanup();
+      reject(
+        new Error(
+          `pome capture-server did not start listening within ${readyTimeoutMs}ms.${stderrBuf ? `
+stderr: ${stderrBuf.trim().slice(0, 2048)}` : ""}`
+        )
+      );
+    }, readyTimeoutMs);
+    const cleanup = () => {
+      clearTimeout(timer);
+      child.stderr?.off("data", onData);
+      child.off("exit", onExit);
+    };
+    child.stderr?.on("data", onData);
+    child.once("exit", onExit);
+  });
+  let port;
+  try {
+    port = await readyPromise;
+  } catch (err) {
+    if (!child.killed) child.kill("SIGKILL");
+    throw err;
+  }
+  child.stderr?.on("data", () => {
+  });
+  const pid = child.pid;
+  if (pid === void 0) {
+    child.kill("SIGKILL");
+    throw new Error("pome capture-server child has no pid after boot");
+  }
+  return {
+    port,
+    pid,
+    shutdown: makeShutdown(child, shutdownGraceMs)
+  };
+}
+function defaultBinArgs(eventsOut, allowHosts, egressOut) {
+  const script = process.argv[1];
+  if (typeof script !== "string" || script.length === 0) {
+    throw new Error(
+      "Cannot determine pome binary path (process.argv[1] is empty). Pass `binArgs` explicitly."
+    );
+  }
+  return [script, "capture-server", "--port", "0", "--events-out", eventsOut, ...egressArgs(allowHosts, egressOut)];
+}
+function egressArgs(allowHosts, egressOut) {
+  const args = [];
+  if (allowHosts && allowHosts.length > 0) args.push("--allow", allowHosts.join(","));
+  if (egressOut) args.push("--egress-out", egressOut);
+  return args;
+}
+function makeShutdown(child, graceMs) {
+  let done = null;
+  return () => {
+    if (done) return done;
+    done = new Promise((resolve7) => {
+      if (child.exitCode !== null || child.signalCode !== null) {
+        resolve7();
+        return;
+      }
+      const onExit = () => {
+        clearTimeout(killTimer);
+        resolve7();
+      };
+      child.once("exit", onExit);
+      try {
+        child.kill("SIGTERM");
+      } catch {
+        child.off("exit", onExit);
+        resolve7();
+        return;
+      }
+      const killTimer = setTimeout(() => {
+        if (child.exitCode === null && child.signalCode === null) {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+        }
+      }, graceMs);
+    });
+    return done;
+  };
+}
+function resolveTwinHttpParents(rows) {
+  const eventIdByToolUseId = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    if (row.kind === "ToolUseEvent") eventIdByToolUseId.set(row.tool_use_id, row.event_id);
+  }
+  if (eventIdByToolUseId.size === 0) return rows;
+  return rows.map((row) => {
+    if (row.kind !== "TwinHttpEvent") return row;
+    if (row.parent_event_id != null) return row;
+    const causingToolUseId = row.tool_call_id ?? row.correlation_id ?? null;
+    if (causingToolUseId === null) return row;
+    const parentEventId = eventIdByToolUseId.get(causingToolUseId);
+    return parentEventId === void 0 ? row : { ...row, parent_event_id: parentEventId };
+  });
+}
+async function mergeAdapterSignalsIntoEvents(signalsPath, eventsJsonlPath) {
+  let rawSignals;
+  try {
+    rawSignals = await readFile(signalsPath, "utf8");
+  } catch {
+    return { appended: 0, dropped: 0 };
+  }
+  let dropped = 0;
+  const signalRows = [];
+  for (const line of rawSignals.split("\n")) {
+    if (line.length === 0) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      dropped += 1;
+      continue;
+    }
+    const result = eventSchema.safeParse(parsed);
+    if (!result.success) {
+      dropped += 1;
+      continue;
+    }
+    signalRows.push(redactEvent(result.data));
+  }
+  if (signalRows.length === 0) return { appended: 0, dropped };
+  let rawEvents;
+  try {
+    rawEvents = await readFile(eventsJsonlPath, "utf8");
+  } catch {
+    rawEvents = "";
+  }
+  const eventRows = [];
+  const unparseablePassthrough = [];
+  for (const line of rawEvents.split("\n")) {
+    if (line.length === 0) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      unparseablePassthrough.push(line);
+      continue;
+    }
+    const result = eventSchema.safeParse(parsed);
+    if (result.success) {
+      eventRows.push(redactEvent(result.data));
+    } else {
+      unparseablePassthrough.push(line);
+    }
+  }
+  const merged = resolveTwinHttpParents(eventRows.concat(signalRows));
+  merged.sort((a, b) => a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : 0);
+  const sortedJsonl = merged.map((r) => JSON.stringify(r)).join("\n");
+  const head = unparseablePassthrough.length > 0 ? unparseablePassthrough.join("\n") + "\n" : "";
+  await writeFile(eventsJsonlPath, head + sortedJsonl + "\n");
+  return { appended: signalRows.length, dropped };
+}
+
+// src/runner/runTaskCore.ts
+async function writeRunNoScore(input) {
+  const artifacts = await writeRunArtifactsCore({
+    artifactsDir: input.artifactsDir,
+    runId: input.runId,
+    scenario: input.scenario,
+    startedAt: input.startedAt,
+    completedAt: input.completedAt,
+    stdout: input.agentStdout,
+    stderr: input.agentStderr,
+    exitCode: input.agentExitCode,
+    events: input.events,
+    stateInitial: input.stateInitial,
+    stateFinal: input.stateFinal
+  });
+  const exitCode = input.agentExitCode !== 0 || input.agentTimedOut ? 3 : 0;
+  return { artifacts, exitCode };
+}
+
+// src/runner/runTask.ts
+function closeServer(server) {
+  return new Promise((resolvePromise, reject) => {
+    server.close((err) => err ? reject(err) : resolvePromise());
+  });
+}
+async function runTask(options) {
+  const scenario = await parseTaskFile(options.taskPath);
+  const runId = `run_${randomUUID()}`;
+  const artifactsDir = options.artifactsDir ?? "runs";
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const writeRun = writeRunNoScore;
+  const runDir = join(artifactsDir, scenario.slug, runId);
+  await mkdir(runDir, { recursive: true });
+  const signalsPath = join(runDir, "signals.jsonl");
+  await writeFile(signalsPath, "");
+  const signalsPathForEnv = sep === "\\" ? signalsPath.replace(/\\/g, "/") : signalsPath;
+  const eventsJsonlPath = join(runDir, "events.jsonl");
+  await writeFile(eventsJsonlPath, "");
+  const egressAllowHosts = buildEgressAllowlist(process.env, {
+    extraHosts: options.egressExtraHosts
+  });
+  const egressJsonlPath = join(runDir, "egress.jsonl");
+  const captureServer = options.noCapture ? null : await spawnCaptureServerChild({
+    eventsOut: resolve(eventsJsonlPath),
+    allowHosts: egressAllowHosts,
+    egressOut: resolve(egressJsonlPath),
+    execPath: options.captureServerCommand?.execPath,
+    binArgs: options.captureServerCommand ? [
+      ...options.captureServerCommand.prefixArgs,
+      "capture-server",
+      "--port",
+      "0",
+      "--events-out",
+      resolve(eventsJsonlPath),
+      ...egressArgs(egressAllowHosts, resolve(egressJsonlPath))
+    ] : void 0
+  });
+  if (captureServer) options.onCaptureServerSpawned?.(captureServer.pid);
+  const collectBlockedEgress = async () => {
+    if (!captureServer) return [];
+    await captureServer.shutdown();
+    return readBlockedEgress(egressJsonlPath);
+  };
+  const twins = scenario.config.twins.length ? scenario.config.twins : ["github"];
+  const primaryTwin2 = twins[0];
+  const isMultiTwin = twins.length > 1;
+  const sid = runId;
+  const authSecret = process.env.TWIN_AUTH_SECRET ?? randomBytes(32).toString("hex");
+  process.env.TWIN_AUTH_SECRET = authSecret;
+  const recorder = createRecorder({ eventsPath: eventsJsonlPath });
+  const booted = [];
+  const twinEnv = {};
+  const tokenEnvNames = /* @__PURE__ */ new Set();
+  const stateInitialByTwin = {};
+  let mergedClaims = {};
+  for (const twin of twins) {
+    const port = await getAvailablePort();
+    const baseUrl = `http://127.0.0.1:${port}`;
+    const harness = await bootTwin({
+      twin,
+      seedState: seedStateForTwin(scenario, twin),
+      runId,
+      twinBaseUrl: baseUrl,
+      recorder
+    });
+    stateInitialByTwin[twin] = await harness.exportState();
+    const sessionBase = `${baseUrl}/s/${sid}`;
+    twinEnv[`POME_${harness.envName}_REST_URL`] = sessionBase;
+    twinEnv[`POME_${harness.envName}_MCP_URL`] = `${sessionBase}/mcp`;
+    if (harness.tokenEnvName) tokenEnvNames.add(harness.tokenEnvName);
+    mergedClaims = { ...mergedClaims, ...harness.extraClaims ?? {} };
+    const server = serve({ fetch: harness.app.fetch, port, hostname: "127.0.0.1" });
+    booted.push({ twin, harness, server });
+  }
+  const stateInitial = stateInitialByTwin[primaryTwin2];
+  const token = await sign(
+    {
+      sid,
+      team_id: "tm_local",
+      // The self-host agent acts as `pome-agent`, the collaborator the twin
+      // seeds onto every repo. Without a login claim the REST merge gate
+      // (which checks the authenticated user has push access) rejects merges —
+      // the MCP merge path calls the domain directly and never hit this, so it
+      // was invisible until a scripted REST agent needed to merge.
+      login: "pome-agent",
+      // Twin-supplied claims (e.g. Stripe's `account_id`, so the token resolves
+      // to the account the seed data lives in) — merged across all twins.
+      // github/slack supply none.
+      ...mergedClaims,
+      exp: Math.floor(Date.now() / 1e3) + Math.max(scenario.config.timeout * 2, 600)
+    },
+    authSecret
+  );
+  const proxyEnv = captureServer ? {
+    // Agent's outbound traffic flows through the capture-server.
+    // Twin traffic is localhost, NO_PROXY excludes it so it stays a
+    // TwinHttpEvent (recorded in-process) and isn't double-counted as a
+    // proxy-captured LlmCallEvent.
+    HTTP_PROXY: `http://127.0.0.1:${captureServer.port}`,
+    HTTPS_PROXY: `http://127.0.0.1:${captureServer.port}`,
+    NO_PROXY: "127.0.0.1,localhost"
+  } : {};
+  for (const name of tokenEnvNames) twinEnv[name] = token;
+  const env = {
+    POME_TASK: scenario.prompt,
+    POME_TWIN_NAMES: twins.join(","),
+    ...twinEnv,
+    POME_AUTH_TOKEN: token,
+    POME_RUN_ID: runId,
+    POME_ARTIFACTS_DIR: runDir,
+    POME_ADAPTER_SIGNALS_PATH: signalsPathForEnv,
+    ...options.extraAgentEnv ?? {},
+    ...proxyEnv
+  };
+  const captureFinalStates = async () => {
+    const finals = {};
+    for (const { twin, harness } of booted) {
+      finals[twin] = await harness.exportState();
+    }
+    if (isMultiTwin) {
+      for (const { twin } of booted) {
+        if (twin === primaryTwin2) continue;
+        try {
+          await writeFile(
+            join(runDir, `state_final.${twin}.json`),
+            `${JSON.stringify(redactSecrets(finals[twin]), null, 2)}
+`
+          );
+        } catch {
+        }
+      }
+    }
+    return finals[primaryTwin2];
+  };
+  try {
+    const preflight = await runAgentCommand({
+      command: options.agentCommand,
+      env,
+      // Cold agent startup can exceed 10s on CI; cap preflight below full scenario
+      // timeout but leave enough headroom for toolchain startup.
+      timeoutSeconds: Math.min(60, scenario.config.timeout),
+      preflight: true
+    });
+    if (preflight.exitCode !== 0) {
+      await recorder.flush?.();
+      const stateFinal2 = await captureFinalStates();
+      const { artifacts: artifacts2, exitCode: exitCode2 } = await writeRun({
+        artifactsDir,
+        runId,
+        scenario,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        agentStdout: preflight.stdout,
+        agentStderr: preflight.stderr,
+        agentExitCode: preflight.exitCode,
+        agentTimedOut: preflight.timedOut ?? false,
+        events: recorder.events(),
+        stateInitial,
+        stateFinal: stateFinal2
+      });
+      await mergeAdapterSignalsIntoEvents(signalsPath, eventsJsonlPath);
+      void exitCode2;
+      const blockedEgress2 = await collectBlockedEgress();
+      return { scenario, runId, artifacts: artifacts2, agent: preflight, exitCode: 3, blockedEgress: blockedEgress2 };
+    }
+    const agent = await runAgentCommand({
+      command: options.agentCommand,
+      env,
+      timeoutSeconds: scenario.config.timeout
+    });
+    await recorder.flush?.();
+    const stateFinal = await captureFinalStates();
+    const { artifacts, exitCode } = await writeRun({
+      artifactsDir,
+      runId,
+      scenario,
+      startedAt,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      agentStdout: agent.stdout,
+      agentStderr: agent.stderr,
+      agentExitCode: agent.exitCode,
+      agentTimedOut: agent.timedOut ?? false,
+      events: recorder.events(),
+      stateInitial,
+      stateFinal
+    });
+    await mergeAdapterSignalsIntoEvents(signalsPath, eventsJsonlPath);
+    const blockedEgress = await collectBlockedEgress();
+    return { scenario, runId, artifacts, agent, exitCode, blockedEgress };
+  } finally {
+    if (captureServer) await captureServer.shutdown();
+    await Promise.all(
+      booted.map(async ({ server, harness }) => {
+        await closeServer(server);
+        await harness.close();
+      })
+    );
+    await recorder.close?.();
+  }
+}
 
 // src/runner/trialCount.ts
 var MAX_TRIALS = 20;
@@ -309,8 +722,8 @@ async function startCallbackServer(expectedState) {
   let rejectCode = null;
   let settled = false;
   let deliveredCode = false;
-  const codePromise = new Promise((resolve6, reject) => {
-    resolveCode = resolve6;
+  const codePromise = new Promise((resolve7, reject) => {
+    resolveCode = resolve7;
     rejectCode = reject;
   });
   const fail = (err) => {
@@ -334,7 +747,7 @@ async function startCallbackServer(expectedState) {
       res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
       res.end("<h1>Pome login failed</h1><p>You can close this tab.</p>");
       fail(new Error(`Browser reported error: ${error}`));
-      void closeServer(server);
+      void closeServer2(server);
       return;
     }
     if (!code || state !== expectedState) {
@@ -352,11 +765,11 @@ async function startCallbackServer(expectedState) {
     res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     res.end("<h1>Pome login complete</h1><p>You can close this tab.</p>");
     succeed(code);
-    void closeServer(server);
+    void closeServer2(server);
   });
-  await new Promise((resolve6, reject) => {
+  await new Promise((resolve7, reject) => {
     server?.once("error", reject);
-    server?.listen(0, "127.0.0.1", resolve6);
+    server?.listen(0, "127.0.0.1", resolve7);
   });
   const address = server.address();
   if (!address || typeof address === "string") {
@@ -368,12 +781,12 @@ async function startCallbackServer(expectedState) {
         "Timed out waiting for browser login (5 min). Run `pome login` again."
       )
     );
-    void closeServer(server);
+    void closeServer2(server);
   }, 5 * 60 * 1e3);
   timeout.unref();
   const onInt = () => {
     fail(new Error("Login cancelled (Ctrl+C). No credentials were changed."));
-    void closeServer(server);
+    void closeServer2(server);
   };
   process.once("SIGINT", onInt);
   codePromise.finally(() => {
@@ -388,26 +801,26 @@ async function startCallbackServer(expectedState) {
     async close() {
       clearTimeout(timeout);
       process.off("SIGINT", onInt);
-      await closeServer(server);
+      await closeServer2(server);
     }
   };
 }
-function closeServer(server) {
-  return new Promise((resolve6) => {
-    server?.close(() => resolve6());
+function closeServer2(server) {
+  return new Promise((resolve7) => {
+    server?.close(() => resolve7());
   });
 }
 async function openBrowser(url) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "powershell.exe" : "xdg-open";
   const args = process.platform === "win32" ? ["-NoProfile", "-Command", "Start-Process", url] : [url];
-  await new Promise((resolve6) => {
+  await new Promise((resolve7) => {
     execFile(command, args, (error) => {
       if (error) {
         console.error(
           "Could not open a browser automatically \u2014 copy the URL above into a browser."
         );
       }
-      resolve6();
+      resolve7();
     });
   });
 }
@@ -616,7 +1029,7 @@ function topicMatchesFilter(t, filter) {
   return t.id.includes(f) || t.title.toLowerCase().includes(f) || t.keywords.some((k) => k.toLowerCase().includes(f)) || t.path.toLowerCase().includes(f);
 }
 async function promptLine(rl, q) {
-  return await new Promise((resolve6) => rl.question(q, resolve6));
+  return await new Promise((resolve7) => rl.question(q, resolve7));
 }
 function printTopicUrl(topic, site) {
   console.log(`${site}${topic.path}`);
@@ -774,7 +1187,7 @@ function extractJsonPayload(text) {
 
 // src/task/seed-verifier.ts
 async function verifySeedWithTwin(seed) {
-  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-UY4Y75BD.js');
+  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-E7NTZL2F.js');
   const db = openGitHubCloneDatabase(":memory:");
   try {
     new GitHubDomain(db).seed(seed);
@@ -975,6 +1388,16 @@ function statusStamp(status) {
       return "FAIL";
   }
 }
+function resolvePackageRoot(importMetaUrl) {
+  let dir = dirname(fileURLToPath(importMetaUrl));
+  for (let i = 0; i < 6; i++) {
+    if (existsSync(join(dir, "package.json"))) return dir;
+    const parent = resolve(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
 
 // src/cli/tasks-catalog.ts
 var TASK_TWINS = [
@@ -2970,15 +3393,27 @@ function displaySentence(def) {
 function localDigest(twin) {
   return checksDigest(checksFor(twin));
 }
+function bakedVersions() {
+  try {
+    return JSON.parse('{"@pome-sh/sdk":"0.11.6","@pome-sh/wire":"0.4.1","@pome-sh/twin-github":"0.12.0","@pome-sh/twin-gmail":"0.4.0","@pome-sh/twin-linear":"0.4.1","@pome-sh/twin-slack":"0.4.1","@pome-sh/twin-stripe":"0.4.7"}');
+  } catch {
+    return {};
+  }
+}
 function pinnedVersion(pkg) {
-  const root = resolvePackageRoot(import.meta.url);
-  if (!root) return "unknown";
+  const baked = bakedVersions()[pkg];
+  if (baked) return baked;
   try {
-    const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-    return manifest.dependencies?.[pkg] ?? "unknown";
+    const require2 = createRequire(import.meta.url);
+    const manifest = JSON.parse(readFileSync(require2.resolve(`${pkg}/package.json`), "utf8"));
+    if (manifest.name === pkg && typeof manifest.version === "string") return manifest.version;
   } catch {
-    return "unknown";
   }
+  return void 0;
+}
+function pinLabel(pkg) {
+  const version = pinnedVersion(pkg);
+  return version === void 0 ? pkg : `${pkg} ${version}`;
 }
 var SUBSTRATE_HELP = {
   final: "the final state",
@@ -2997,6 +3432,10 @@ function bold3(s) {
 function argFlagsFor(def) {
   return templateSlots(def.template).params.map((name) => `--arg ${name}=${def.params[name].example}`).join(" ");
 }
+function checksHeader(twin, count2, version) {
+  const label = bold3(`${twin} \u2014 ${count2} declared check${count2 === 1 ? "" : "s"}`);
+  return version === void 0 ? label : `${label} ${dim3(`(@pome-sh/twin-${twin} ${version})`)}`;
+}
 function jsonView(twin) {
   return {
     twin,
@@ -3050,9 +3489,7 @@ async function runChecksCommand(twinArg, opts) {
     );
     return;
   }
-  console.log(
-    `${bold3(`${twin} \u2014 ${checks.length} declared check${checks.length === 1 ? "" : "s"}`)} ` + dim3(`(@pome-sh/twin-${twin} ${pinnedVersion(`@pome-sh/twin-${twin}`)})`)
-  );
+  console.log(checksHeader(twin, checks.length, pinnedVersion(`@pome-sh/twin-${twin}`)));
   console.log("");
   for (const def of checks) {
     console.log(`  ${bold3(def.id)}`);
@@ -3343,7 +3780,7 @@ function formatSkewRefusal(twin, findings) {
     `Refusing to write: this CLI and the cloud disagree about ${twin}'s vocabulary, so a sentence written here might not be graded there.`,
     ...findings.flatMap(bullet),
     "",
-    `  local @pome-sh/twin-${twin} ${pinnedVersion(`@pome-sh/twin-${twin}`)}` + (sdkImplicated ? `, @pome-sh/sdk ${pinnedVersion("@pome-sh/sdk")}` : ""),
+    `  local ${pinLabel(`@pome-sh/twin-${twin}`)}` + (sdkImplicated ? `, ${pinLabel("@pome-sh/sdk")}` : ""),
     ...sdkImplicated ? [`  The cloud publishes no sdk version here, so that is the only pin this CLI can name.`] : [],
     `  Update with \`npm i -g @pome-sh/cli@latest\`. If this CLI is already current, the cloud is behind \u2014 that is a deploy, not something you can fix here.`
   ].join("\n");
@@ -3368,14 +3805,13 @@ function parseArgFlags(pairs) {
   return args;
 }
 async function handshake(twin, fetchRemote) {
-  const pin = pinnedVersion(`@pome-sh/twin-${twin}`);
   let remote;
   try {
     remote = await fetchRemote(twin);
   } catch (err) {
     return {
       kind: "unverified",
-      note: `Not verified against the cloud (${err instanceof Error ? err.message : "unreachable"}). Writing from the local pin: @pome-sh/twin-${twin} ${pin}.`
+      note: `Not verified against the cloud (${err instanceof Error ? err.message : "unreachable"}). Writing from the local pin: ${pinLabel(`@pome-sh/twin-${twin}`)}.`
     };
   }
   if (localDigest(twin) === remote.digest) return { kind: "match" };
@@ -3949,6 +4385,29 @@ async function runEvalCommand(runDirArg, opts) {
     process.exitCode = code;
   }
 }
+function assetPath(...segments) {
+  const root = resolvePackageRoot(import.meta.url);
+  if (!root) {
+    throw new Error(
+      `Could not locate the @pome-sh/cli package root (no enclosing package.json) while resolving the packaged asset ${segments.join("/")}.`
+    );
+  }
+  const candidate = join(root, "assets", ...segments);
+  if (!existsSync(candidate)) {
+    throw new Error(
+      `Packaged asset not found at ${candidate}. This is a packaging bug \u2014 \`assets/\` must be listed in cli/package.json \`files\`.`
+    );
+  }
+  return candidate;
+}
+
+// src/demo/task.ts
+var DEMO_TASK_NAME = "first-run-demo";
+function demoTaskPath() {
+  return assetPath("demo", "first-run-demo.md");
+}
+
+// src/cli/default-task.ts
 var DEFAULT_TASK_TRIALS = 5;
 var DEFAULT_TASK_DIR = "tasks";
 var DEFAULT_TASK_FILENAME = `${DEMO_TASK_NAME}.md`;
@@ -4203,126 +4662,6 @@ async function runRegisterAgent(opts) {
 function stripControlCharacters(value) {
   return value.replace(/[\u0000-\u001f\u007f]/g, "");
 }
-var CLAUDE_SDK_AGENT_RELATIVE = "examples/agents/claude-sdk-agent.ts";
-var CLAUDE_SDK_AGENT_SOURCE = `// SPDX-License-Identifier: Apache-2.0
-//
-// Scaffolded by \`pome init --sdk claude\`. Minimal Claude Agent SDK starter
-// wired through @pome-sh/adapter-claude-sdk so \`pome run\` captures adapter
-// signals. Swap the tool body for your own agent logic.
-
-import { createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";
-import { query, tool, withPome } from "@pome-sh/adapter-claude-sdk";
-import { z } from "zod";
-
-withPome();
-
-const restUrl = process.env.POME_GITHUB_REST_URL;
-const authToken = process.env.POME_AUTH_TOKEN;
-const task =
-  process.env.POME_TASK?.trim() ||
-  "List open issues in acme/api and summarize their titles.";
-
-if (!restUrl) {
-  throw new Error(
-    "POME_GITHUB_REST_URL is required (injected by \`pome run\`, or set it when driving a twin yourself).",
-  );
-}
-
-if (process.env.POME_PREFLIGHT === "1") {
-  const res = await fetch(\`\${restUrl.replace(/\\/+$/, "")}/rate_limit\`, {
-    headers: {
-      accept: "application/vnd.github+json",
-      ...(authToken ? { authorization: \`Bearer \${authToken}\` } : {}),
-    },
-  });
-  if (!res.ok) {
-    throw new Error(\`preflight failed: HTTP \${res.status}\`);
-  }
-  console.log("preflight ok");
-  process.exit(0);
-}
-
-const listOpenIssues = tool(
-  "list_open_issues",
-  "List open issues on the GitHub twin for owner/repo.",
-  {
-    owner: z.string(),
-    repo: z.string(),
-  },
-  async ({ owner, repo }) => {
-    const res = await fetch(
-      \`\${restUrl.replace(/\\/+$/, "")}/repos/\${owner}/\${repo}/issues?state=open\`,
-      {
-        headers: {
-          accept: "application/vnd.github+json",
-          ...(authToken ? { authorization: \`Bearer \${authToken}\` } : {}),
-        },
-      },
-    );
-    const body = await res.text();
-    if (!res.ok) {
-      return {
-        content: [{ type: "text" as const, text: \`HTTP \${res.status}: \${body}\` }],
-        isError: true,
-      };
-    }
-    return { content: [{ type: "text" as const, text: body }] };
-  },
-);
-
-const server = createSdkMcpServer({
-  name: "github-twin",
-  version: "0.1.0",
-  tools: [listOpenIssues],
-});
-
-for await (const message of query({
-  prompt: task,
-  options: {
-    permissionMode: "bypassPermissions",
-    maxTurns: 10,
-    allowedTools: ["list_open_issues"],
-    mcpServers: {
-      "github-twin": {
-        type: "sdk",
-        name: "github-twin",
-        instance: server.instance,
-      },
-    },
-  },
-})) {
-  if (message.type === "result" && message.subtype === "success" && message.result) {
-    console.log(message.result);
-  }
-}
-`;
-async function writeSdkScaffold(sdk) {
-  switch (sdk) {
-    case "claude":
-      return writeClaudeSdkScaffold();
-    case "claude-managed":
-      throw new ClaudeManagedDeferredError();
-  }
-}
-async function writeClaudeSdkScaffold() {
-  const path = join(process.cwd(), CLAUDE_SDK_AGENT_RELATIVE);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, CLAUDE_SDK_AGENT_SOURCE, "utf8");
-  return {
-    agentSdkValue: "claude-agent-sdk",
-    agentCommand: `npx tsx ${CLAUDE_SDK_AGENT_RELATIVE}`,
-    exampleAgentRelativePath: CLAUDE_SDK_AGENT_RELATIVE,
-    postInstallHint: "Next steps:\n  1. npm install @pome-sh/adapter-claude-sdk @anthropic-ai/claude-agent-sdk zod\n  2. pome login\n  3. pome register agent <name>\n  4. pome run tasks/01-bug-happy-path.md\n\nSee `pome docs getting-started` for a narrative walkthrough."
-  };
-}
-var ClaudeManagedDeferredError = class extends Error {
-  constructor() {
-    super(
-      "Claude Managed Agent is not yet supported \u2014 three blockers (no injection point inside Anthropic-hosted runtime, no sidechannel for adapter signals, Managed Agents API still moving). Follow the tracking issue for v2 timing. For now, use `pome init` (without --sdk) or `pome init --sdk claude`."
-    );
-    this.name = "ClaudeManagedDeferredError";
-  }
-};
 
 // src/cli/example-catalog.ts
 var CATALOG_EXAMPLES = [
@@ -4622,7 +4961,7 @@ function firstSentence(description) {
 function resolveExampleRef(env = process.env) {
   const override = env.POME_EXAMPLE_REF?.trim();
   if (override) return override;
-  const baked = "427e67af93e006eada090db181006321bd24b62e".trim() ;
+  const baked = "589885b59adab9a5fded977620a6adc25125da85".trim() ;
   return FULL_SHA.test(baked) ? baked : "main";
 }
 function rawUrlFor(example, file, ref) {
@@ -4985,7 +5324,7 @@ var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 var MAX_UNREADABLE_PATHS_SHOWN = 5;
 function readPackageVersion() {
-  if ("0.42.3".length > 0) return "0.42.3";
+  if ("0.43.0".length > 0) return "0.43.0";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -5014,13 +5353,10 @@ function createProgram() {
     process.env.POME_API_URL ?? DEFAULT_CONTROL_PLANE_URL
   ).option("--artifacts-dir <dir>", "Directory for run artifacts", "runs");
   program.name("pome").description(
-    "Test AI agents against digital twins of real SaaS APIs. Runs are recorded to app.pome.sh. Start with `pome demo`."
+    "Test AI agents against digital twins of real SaaS APIs. Runs are recorded to app.pome.sh. Start with `pome init`."
   ).version(PACKAGE_VERSION).showHelpAfterError("(add --help for usage)");
   program.command("init").summary("Set up Pome in this project").description(
     "Create pome.json, plus starter files in a new project \u2014 or, with --example <id>, fetch a complete runnable example into ./<id>"
-  ).option(
-    "--sdk <name>",
-    "Scaffold for a specific agent SDK (claude | claude-managed). Adds the SDK-specific example file and pre-fills agent.framework so the dashboard badges runs correctly."
   ).option(
     "--bare",
     "Write only the manifest \u2014 skip the starter task library and sample agents. Auto-selected when the current directory already has a package.json (the bring-your-own-agent case)."
@@ -5031,10 +5367,9 @@ function createProgram() {
     "--example <id>",
     `Scaffold a complete bundled example into ./<id> instead of a starter project. Ids: ${exampleIds().join(", ")}.`
   ).action(async (opts) => {
-    const sdk = opts.sdk?.trim();
     const exampleId = opts.example?.trim();
     if (exampleId !== void 0) {
-      const conflicting = ["sdk", "bare", "starter"].filter(
+      const conflicting = ["bare", "starter"].filter(
         (flag) => opts[flag] !== void 0 && opts[flag] !== false
       );
       if (conflicting.length > 0) {
@@ -5059,18 +5394,6 @@ function createProgram() {
       }
       return;
     }
-    if (sdk !== void 0 && sdk !== "claude" && sdk !== "claude-managed") {
-      console.error(
-        `Unknown --sdk value "${opts.sdk}". Supported: claude, claude-managed.`
-      );
-      process.exitCode = 2;
-      return;
-    }
-    if (sdk === "claude-managed") {
-      console.error(new ClaudeManagedDeferredError().message);
-      process.exitCode = 2;
-      return;
-    }
     if (opts.bare && opts.starter) {
       console.error("Pass at most one of --bare / --starter.");
       process.exitCode = 2;
@@ -5086,22 +5409,13 @@ function createProgram() {
       await mkdir("runs", { recursive: true });
       await copyStarterFiles();
     }
-    let command = bare ? void 0 : DEFAULT_AGENT_COMMAND;
-    let framework;
-    let postInitMessage = bare ? 'Pome initialized (existing project \u2014 starter library skipped).\nNext steps:\n  1. Set "command" in pome.json to your agent\'s launch command\n  2. pome login                    # one-time, opens the dashboard to sign in\n  3. pome register agent <name>    # scopes runs to this project (writes agent.slug to pome.json)\n  4. pome run <your-task>.md\n\nOptional follow-ups:\n  - pome tasks github --copy       # drop the starter task library into tasks/\n  - pome init --sdk claude         # scaffold a Claude Agent SDK starter\n\nSee `pome docs getting-started` for a narrative walkthrough.' : "Pome initialized.\nNext steps:\n  1. pome login                    # one-time, opens the dashboard to sign in\n  2. pome register agent <name>    # scopes runs to this project (writes agent.slug to pome.json)\n  3. pome run tasks/01-bug-happy-path.md\n\nOptional follow-ups:\n  - pome init --sdk claude         # scaffold a Claude Agent SDK starter\n  - pome tasks stripe --copy       # add Stripe payment tasks when needed\n\nSee `pome docs getting-started` for a narrative walkthrough.";
-    if (sdk) {
-      const scaffold = await writeSdkScaffold(sdk);
-      command = scaffold.agentCommand;
-      framework = scaffold.agentSdkValue;
-      postInitMessage = `Pome initialized with --sdk ${sdk}. Scaffolded ${scaffold.exampleAgentRelativePath}.
-` + scaffold.postInstallHint;
-    }
+    const command = bare ? void 0 : DEFAULT_AGENT_COMMAND;
+    const postInitMessage = bare ? 'Pome initialized (existing project \u2014 starter library skipped).\nNext steps:\n  1. Set "command" in pome.json to your agent\'s launch command\n  2. pome login                    # one-time, opens the dashboard to sign in\n  3. pome register agent <name>    # scopes runs to this project (writes agent.slug to pome.json)\n  4. pome run <your-task>.md\n\nOptional follow-ups:\n  - pome tasks github --copy       # drop the starter task library into tasks/\n\nSee `pome docs getting-started` for a narrative walkthrough.' : "Pome initialized.\nNext steps:\n  1. pome login                    # one-time, opens the dashboard to sign in\n  2. pome register agent <name>    # scopes runs to this project (writes agent.slug to pome.json)\n  3. pome run tasks/01-bug-happy-path.md\n\nOptional follow-ups:\n  - pome tasks stripe --copy       # add Stripe payment tasks when needed\n\nSee `pome docs getting-started` for a narrative walkthrough.";
     const tasksDir = !bare || await hasMarkdownTasks("tasks") ? "tasks" : void 0;
     const existing = await readManifest(process.cwd());
     if (!existing) {
       const slug = deriveAgentSlug(basename(process.cwd())) || "my-agent";
       const agent = { slug };
-      if (framework) agent.framework = framework;
       const manifest = {
         $schema: MANIFEST_SCHEMA_URL,
         agent
@@ -5111,15 +5425,6 @@ function createProgram() {
       manifest.artifacts_dir = "runs";
       manifest.pass_threshold = 100;
       await writeManifest(join(process.cwd(), MANIFEST_JSON), "json", manifest);
-    } else if (sdk) {
-      const priorAgent = typeof existing.raw.agent === "object" && existing.raw.agent !== null ? existing.raw.agent : {};
-      const nextAgent = { ...priorAgent };
-      if (framework) nextAgent.framework = framework;
-      await writeManifest(existing.path, existing.format, {
-        ...existing.raw,
-        agent: nextAgent,
-        command
-      });
     }
     console.error(postInitMessage);
   });
@@ -5423,7 +5728,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-BKMTBJSO.js');
+        const { runDoctorChecks } = await import('../../checks-QYUPKBPT.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -5461,7 +5766,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-BP446HIE.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-4QL6S7QO.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5540,39 +5845,10 @@ function createProgram() {
       process.exitCode = worstExit;
     }
   );
-  program.command("demo").summary("Run a sample task, no account needed").description(
-    "Zero-auth first-run demo: boots a local GitHub twin, runs the bundled demo agent for 5 isolated trials (model calls via pome's anonymous demo gateway), and prints per-trial verdicts evaluated in Pome cloud. No signup, no API keys; ends with a no-login preview link."
-  ).option(
-    "--trials <n>",
-    "Number of trials to run, 1 to 10",
-    "5"
-  ).action(
-    async (opts, cmd) => {
-      const trials = Number.parseInt(opts.trials, 10);
-      if (!Number.isInteger(trials) || trials < 1 || trials > 10) {
-        console.error(`Invalid --trials "${opts.trials}" (expected 1-10).`);
-        process.exitCode = 5;
-        return;
-      }
-      const { runDemo } = await import('../../runDemo-DRDMCG25.js');
-      const result = await runDemo({
-        apiBase: globals(cmd).apiUrl.replace(/\/$/, ""),
-        dashboardBase: process.env.POME_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL,
-        trials,
-        artifactsDir: globals(cmd).artifactsDir
-      });
-      process.exitCode = result.exitCode;
-    }
-  );
-  program.command("demo-agent", { hidden: true }).description("Internal: the bundled demo agent process (spawned by `pome demo`).").action(async () => {
-    const { runDemoAgentCommand } = await import('../../agent-Q2UTRJYL.js');
-    const code = await runDemoAgentCommand();
-    if (code !== 0) process.exitCode = code;
-  });
   program.command("doctor").summary("Check the agent and twin wiring").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-BKMTBJSO.js');
+    const { runDoctorChecks } = await import('../../checks-QYUPKBPT.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -5740,13 +6016,13 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-QQU6OIO4.js');
+    const { runTwinStartCommand } = await import('../../twinStart-QQ64EV3P.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("new-seed").argument("<name...>", `Twin name (${TWIN_NAME_LIST.join(" | ")}). Repeat for one file covering several.`).option("--out <path>", "Write to this file instead of stdout. Refuses to overwrite.").summary("Print a new starter seed file for a twin").description(
     "Print a new starter seed file for a twin, generated from the twin's own starting state. One twin is flat, several are the per-twin envelope. Boot it with `twin start <twin> --seed`, seed a sandbox with `sandbox create --twin <twin> --seed`, or drop it beside a task as <task>.seed.json"
   ).action(async (names, options) => {
-    const { runTwinSeedCommand } = await import('../../twinSeed-X6VHBOLM.js');
+    const { runTwinSeedCommand } = await import('../../twinSeed-4VQ7RRCL.js');
     await runTwinSeedCommand(names, options);
   });
   twin.command("status").summary("Say whether the local twin is running").description(