@pome-sh/cli 0.42.4 → 0.43.1

package/dist/{chunk-NNXVR46L.js → chunk-CS7O2ZXB.js}

@@ -1,8 +1,11 @@
 import { seedSchema as seedSchema$2 } from './chunk-NBOQN5VX.js';
 import { seedSchema } from './chunk-YBWG5JK2.js';
-import { twinIdSchema } from './chunk-6KJC4BTO.js';
+import { twinIdSchema } from './chunk-5KFDRR53.js';
 import { seedSchema as seedSchema$1 } from './chunk-2K6BJ3PI.js';
 import { z } from 'zod';
+import { readFile, writeFile } from 'node:fs/promises';
+import { resolve, join, dirname } from 'node:path';
+import { stringify, parse } from 'yaml';
 
 var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SLUG_MAX_LENGTH = 64;
@@ -1146,5 +1149,114 @@ function exitCodeFor(err) {
   if (err instanceof HostedDiscardRefusedError) return 5;
   return 2;
 }
+var MANIFEST_JSON = "pome.json";
+var MANIFEST_YAML = "pome.yaml";
+var MANIFEST_YML = "pome.yml";
+var MANIFEST_FILES = [MANIFEST_JSON, MANIFEST_YAML, MANIFEST_YML];
+var SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
+var YAML_SCHEMA_COMMENT = `# yaml-language-server: $schema=${SCHEMA_URL}`;
+function formatFor(fileName) {
+  return fileName === MANIFEST_JSON ? "json" : "yaml";
+}
+async function findManifestPath(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (; ; ) {
+    const present = [];
+    for (const fileName of MANIFEST_FILES) {
+      if (await fileExists(join(dir, fileName))) present.push(fileName);
+    }
+    if (present.length > 1) {
+      throw new HostedOrchError(
+        `Multiple pome manifests in ${dir}: ${present.join(", ")}. Keep exactly one (pome.json is canonical).`
+      );
+    }
+    if (present.length === 1) {
+      const fileName = present[0];
+      return { path: join(dir, fileName), format: formatFor(fileName) };
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+async function readManifest(startDir = process.cwd()) {
+  const found = await findManifestPath(startDir);
+  if (!found) return null;
+  const text = await readFile(found.path, "utf8");
+  const raw = parseManifestText(text, found);
+  const manifest = validateManifest(raw, found.path);
+  return { ...found, manifest, raw };
+}
+async function readRequiredManifest(startDir = process.cwd()) {
+  const read = await readManifest(startDir);
+  if (!read) {
+    throw new HostedOrchError(
+      `No pome manifest found (${MANIFEST_JSON} or ${MANIFEST_YAML}). Run \`pome init\` first.`
+    );
+  }
+  return read;
+}
+async function writeManifest(path, format, data) {
+  if (format === "json") {
+    await writeFile(path, `${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  const { $schema: _dropped, ...body } = data;
+  await writeFile(path, `${YAML_SCHEMA_COMMENT}
+${stringify(body)}`);
+}
+function parseManifestText(text, found) {
+  let parsed;
+  try {
+    parsed = found.format === "json" ? JSON.parse(text) : parse(text);
+  } catch (err) {
+    throw new HostedOrchError(
+      `${found.path} is not valid ${found.format.toUpperCase()}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new HostedOrchError(`${found.path} is not a ${found.format} object`);
+  }
+  return parsed;
+}
+function validateManifest(raw, path) {
+  const result = manifestSchema.safeParse(raw);
+  if (result.success) return result.data;
+  const slugIssue = result.error.issues.find(
+    (issue) => issue.path[0] === "agent" && issue.path[1] === "slug"
+  );
+  if (slugIssue) {
+    throw new HostedOrchError(slugErrorMessage(raw, path));
+  }
+  const summary = result.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+  throw new HostedOrchError(`Invalid pome manifest ${path}: ${summary}`);
+}
+function slugErrorMessage(raw, path) {
+  const agent = typeof raw.agent === "object" && raw.agent !== null ? raw.agent : {};
+  const name = typeof agent.name === "string" ? agent.name : "";
+  const badSlug = typeof agent.slug === "string" ? agent.slug : "";
+  const suggestion = deriveAgentSlug(name || badSlug);
+  const base = `Invalid agent.slug in ${path}: must match ${SLUG_RE} (lowercase kebab-case, max 64 chars).`;
+  return suggestion.length > 0 ? `${base} Did you mean "${suggestion}"?` : base;
+}
+function normalizeManifestTwins(manifestTwins) {
+  if (manifestTwins === void 0) return void 0;
+  const out = /* @__PURE__ */ new Set();
+  for (const twin of manifestTwins) {
+    const norm = twin.trim().toLowerCase();
+    if (norm.length > 0) out.add(norm);
+  }
+  return out.size > 0 ? [...out] : void 0;
+}
+async function fileExists(path) {
+  try {
+    await readFile(path, "utf8");
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+}
 
-export { HostedAuthError, HostedDiscardRefusedError, HostedOrchError, HostedQuotaError, HostedTrialError, HostedUsageError, MOUNTED_TWINS, SLUG_RE, agentResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, criterionSchema, deriveAgentSlug, exitCodeFor, finalizeResponseSchema, isMultiTwinSeedEnvelope, manifestSchema, normalizeTaskConfigKeys, sessionPublicSchema, submitResultResponseSchema };
+export { HostedAuthError, HostedDiscardRefusedError, HostedOrchError, HostedQuotaError, HostedTrialError, HostedUsageError, MANIFEST_JSON, MOUNTED_TWINS, agentResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, criterionSchema, deriveAgentSlug, exitCodeFor, finalizeResponseSchema, findManifestPath, isMultiTwinSeedEnvelope, normalizeManifestTwins, normalizeTaskConfigKeys, readManifest, readRequiredManifest, sessionPublicSchema, submitResultResponseSchema, writeManifest };

package/dist/{chunk-VPXIGCZW.js → chunk-GQSNU3YP.js}

@@ -1,4 +1,4 @@
-import { isTwinName, TWIN_REGISTRY, TWIN_NAMES } from './chunk-RPPF2KDQ.js';
+import { isTwinName, TWIN_REGISTRY, TWIN_NAMES } from './chunk-4DXTT3RV.js';
 import { readFileSync } from 'node:fs';
 import { parse } from 'yaml';
 

package/dist/{chunk-HRAD7MRX.js → chunk-TWURH7YM.js}

@@ -445,6 +445,7 @@ function defineTwin(spec) {
 }
 var RESERVED_SESSION_PREFIXES = ["/_pome", "/mcp"];
 var CLIENT_IP_VAR = "pomeClientIp";
+var ADMIN_NO_PEER_OPT_IN = "TWIN_ADMIN_ALLOW_NO_PEER";
 var nodeGetConnInfo;
 function loadNodeGetConnInfo() {
   nodeGetConnInfo ??= import('@hono/node-server/conninfo').then((mod) => mod.getConnInfo, () => void 0);
@@ -490,10 +491,11 @@ function createAdminGate(options = {}) {
     }
     const remote = await getClientIp(c);
     if (!remote) {
-      if (process.env.NODE_ENV === "production")
-        return forbidden();
-      await next();
-      return;
+      if (process.env[ADMIN_NO_PEER_OPT_IN] === "1") {
+        await next();
+        return;
+      }
+      return forbidden();
     }
     if (!isLoopbackAddress(remote))
       return forbidden();
@@ -503,13 +505,22 @@ function createAdminGate(options = {}) {
 
 // ../packages/sdk/dist/auth.js
 var PROVIDER_SHAPED_TEAM_ID = "provider-shaped";
+var DEV_ONLY_INSECURE_SECRET = "dev-only-insecure-secret";
+var DEV_SECRETS_OPT_IN = "POME_ALLOW_DEV_SECRETS";
 function resolveAuthSecret() {
   const secret = process.env.TWIN_AUTH_SECRET;
-  if (!secret && process.env.NODE_ENV === "production") {
-    throw new Error("TWIN_AUTH_SECRET required in production");
-  }
-  return secret ?? "dev-only-insecure-secret";
+  if (secret)
+    return secret;
+  if (process.env[DEV_SECRETS_OPT_IN] === "1")
+    return DEV_ONLY_INSECURE_SECRET;
+  throw new MissingAuthSecretError();
 }
+var MissingAuthSecretError = class extends Error {
+  constructor() {
+    super(`TWIN_AUTH_SECRET is not set. Set it, or set ${DEV_SECRETS_OPT_IN}=1 to serve the public dev secret on a twin nothing but this machine can reach.`);
+    this.name = "MissingAuthSecretError";
+  }
+};
 var SIG_LENGTH = 22;
 function mintProviderToken(spec, options) {
   const prefix = options.prefix ?? spec.prefixes[0];
@@ -674,7 +685,14 @@ function bearerAuth(options = {}) {
       }
     }
     if (options.providerToken) {
-      const providerSid = verifyProviderToken(options.providerToken, token);
+      let providerSid;
+      try {
+        providerSid = verifyProviderToken(options.providerToken, token);
+      } catch (err) {
+        if (err instanceof MissingAuthSecretError)
+          return respond(unauthorized("invalid", { token }));
+        throw err;
+      }
       if (providerSid) {
         const mismatch2 = checkSid(providerSid);
         if (mismatch2)
@@ -1281,8 +1299,14 @@ function isLoopbackHost(value) {
 function ensureTwinAuthSecret(twin, host) {
   if (process.env.TWIN_AUTH_SECRET)
     return;
-  if (isLoopbackHost(host))
+  if (isLoopbackHost(host)) {
+    if (process.env[DEV_SECRETS_OPT_IN] === "1")
+      return;
+    const secret = randomBytes(32).toString("hex");
+    process.env.TWIN_AUTH_SECRET = secret;
+    console.log(`[twin-${twin}] TWIN_AUTH_SECRET not set \u2014 generated ${secret} for this loopback boot (not persisted; set TWIN_AUTH_SECRET to choose one, or ${DEV_SECRETS_OPT_IN}=1 for the public dev secret)`);
     return;
+  }
   const dataDir = process.env.POME_TWIN_DATA_DIR || join(".pome-data", twin);
   const secretPath = join(dataDir, "secret");
   try {

package/dist/{runTrialGroup-BP446HIE.js → runTrialGroup-HYGGBLMM.js}

@@ -1,24 +1,34 @@
-import { newGroupId } from './chunk-JNXZBK3O.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-46POYRLY.js';
-import { createHostedClient, parseTaskFile, outcomeOf, isNarrated, criterionPhrase, narratorReadingLines } from './chunk-STMGQ7GU.js';
-import './chunk-VPXIGCZW.js';
+import { runTaskHosted, createHostedClient, parseTaskFile, resolveRunAgentIdentity, outcomeOf, isNarrated, criterionPhrase, narratorReadingLines } from './chunk-A6AM6KS4.js';
+import './chunk-GQSNU3YP.js';
 import './chunk-NW7HGA2K.js';
 import './chunk-PASFBRK4.js';
 import './chunk-3FZY376K.js';
-import './chunk-RPPF2KDQ.js';
-import './chunk-DFOQGAKS.js';
-import { HostedQuotaError, HostedTrialError } from './chunk-NNXVR46L.js';
+import './chunk-4DXTT3RV.js';
+import { HostedQuotaError, HostedTrialError } from './chunk-CS7O2ZXB.js';
 import './chunk-NBOQN5VX.js';
 import './chunk-YBWG5JK2.js';
-import './chunk-HRAD7MRX.js';
-import './chunk-6KJC4BTO.js';
+import './chunk-TWURH7YM.js';
+import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-2K6BJ3PI.js';
 import './chunk-FBSA5L36.js';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, randomBytes } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 
+var NANOID_ALPHABET = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+function nanoid(size = 21) {
+  const bytes = randomBytes(size);
+  let id = "";
+  for (let i = 0; i < size; i += 1) {
+    id += NANOID_ALPHABET[bytes[i] & 63];
+  }
+  return id;
+}
+function newGroupId() {
+  return `grp_${nanoid(21)}`;
+}
+
 // src/runner/groupRender.ts
 function flagHintLine(agentCommandSource) {
   return `-n sets how many isolated trials to run \xB7 the agent command comes from ${agentCommandSource}`;

package/dist/{server-GDK4TBTL.js → server-2WHSHTUD.js}

@@ -1,4 +1,4 @@
-export { POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-HRAD7MRX.js';
-import './chunk-6KJC4BTO.js';
+export { POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-TWURH7YM.js';
+import './chunk-5KFDRR53.js';
 export { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 export { FAILURE_INJECTION_OVERRIDE_KEY, createFailureInjectionStore, failureInjectionRuleSchema } from './chunk-FBSA5L36.js';