@pome-sh/cli 0.42.4 → 0.43.1

package/dist/chunk-46POYRLY.js

@@ -1,1240 +0,0 @@
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-STMGQ7GU.js';
-import { readSeedFileText, parseSeedFileText, soleTwinOf, twinsNamedBy, seedsForTwins } from './chunk-VPXIGCZW.js';
-import { readManifest, normalizeManifestTwins } from './chunk-DFOQGAKS.js';
-import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema, isMultiTwinSeedEnvelope } from './chunk-NNXVR46L.js';
-import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
-import { randomUUID, createHash } from 'node:crypto';
-import { rm, readFile, stat, mkdir, writeFile, chmod, mkdtemp, readdir, rename } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
-import { tmpdir, homedir } from 'node:os';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { createInterface } from 'node:readline';
-
-// src/hosted/runSets.ts
-function groupRunSets(trials) {
-  const byKey = /* @__PURE__ */ new Map();
-  for (const trial of trials) {
-    const key = trial.verdict.group_id ?? `solo:${trial.verdict.session_id}`;
-    const bucket = byKey.get(key);
-    if (bucket) bucket.push(trial);
-    else byKey.set(key, [trial]);
-  }
-  const sets = [];
-  for (const bucket of byKey.values()) {
-    bucket.sort(
-      (a, b) => a.verdict.finalized_at.localeCompare(b.verdict.finalized_at)
-    );
-    const last = bucket[bucket.length - 1];
-    const hasFailed = bucket.some((t) => t.verdict.state === "fail");
-    const allPassed = bucket.every((t) => t.verdict.state === "pass");
-    sets.push({
-      groupId: bucket[0].verdict.group_id,
-      taskName: bucket[0].verdict.task_name,
-      taskPath: bucket[0].verdict.task_path,
-      trials: bucket,
-      latestFinalizedAt: last.verdict.finalized_at,
-      outcome: hasFailed ? "fail" : allPassed ? "pass" : "incomplete"
-    });
-  }
-  sets.sort((a, b) => a.latestFinalizedAt.localeCompare(b.latestFinalizedAt));
-  return sets;
-}
-function latestFailedRunSet(sets) {
-  for (let i = sets.length - 1; i >= 0; i -= 1) {
-    if (sets[i].outcome === "fail") return sets[i];
-  }
-  return null;
-}
-function latestIncompleteRunSet(sets) {
-  for (let i = sets.length - 1; i >= 0; i -= 1) {
-    if (sets[i].outcome === "incomplete") return sets[i];
-  }
-  return null;
-}
-
-// src/hosted/evalResultCache.ts
-var VERDICT_ARTIFACT_VERSION = 2;
-var VERDICT_FILENAME = "verdict.json";
-var VALID_STATES = /* @__PURE__ */ new Set([
-  "pass",
-  "fail",
-  "incomplete"
-]);
-async function writeVerdictArtifact(runDir, verdict) {
-  const tmpPath = join(runDir, `.${VERDICT_FILENAME}.${process.pid}.${randomUUID()}.tmp`);
-  try {
-    await writeFile(tmpPath, `${JSON.stringify(verdict, null, 2)}
-`, "utf8");
-    await rename(tmpPath, join(runDir, VERDICT_FILENAME));
-  } catch (err) {
-    await rm(tmpPath, { force: true }).catch(() => {
-    });
-    throw err;
-  }
-}
-function isVerdictArtifact(parsed) {
-  if (typeof parsed !== "object" || parsed === null) return false;
-  const v = parsed;
-  if (v.version !== VERDICT_ARTIFACT_VERSION) return false;
-  if (v.source !== "cloud-finalize") return false;
-  if (typeof v.session_id !== "string") return false;
-  if (typeof v.task_name !== "string") return false;
-  if (typeof v.task_path !== "string") return false;
-  if (v.group_id !== null && typeof v.group_id !== "string") return false;
-  if (typeof v.finalized_at !== "string") return false;
-  if (typeof v.passed !== "boolean") return false;
-  if (typeof v.score !== "number") return false;
-  if (typeof v.state !== "string" || !VALID_STATES.has(v.state)) return false;
-  if (typeof v.evaluated !== "number") return false;
-  if (typeof v.not_evaluated !== "number") return false;
-  if (typeof v.pre_satisfied !== "number") return false;
-  if (typeof v.total !== "number") return false;
-  if (!Array.isArray(v.criteria_results)) return false;
-  return v.criteria_results.every((r) => {
-    if (typeof r !== "object" || r === null) return false;
-    const result = r;
-    const criterion = result.criterion;
-    return typeof criterion === "object" && criterion !== null && typeof criterion.text === "string" && typeof result.reason === "string" && typeof result.passed === "boolean" && typeof result.skipped === "boolean";
-  });
-}
-var MISSING_ERROR_CODES = /* @__PURE__ */ new Set([
-  "ENOENT",
-  "ENOTDIR",
-  "ELOOP",
-  "ENAMETOOLONG"
-]);
-function isMissingFileError(err) {
-  const code = err?.code;
-  return typeof code === "string" && MISSING_ERROR_CODES.has(code);
-}
-async function readVerdictArtifactDetailed(runDir) {
-  const path = join(runDir, VERDICT_FILENAME);
-  let raw;
-  try {
-    raw = await readFile(path, "utf8");
-  } catch (err) {
-    return isMissingFileError(err) ? { status: "missing" } : { status: "unreadable" };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { status: "unreadable" };
-  }
-  if (!isVerdictArtifact(parsed)) return { status: "unreadable" };
-  return { status: "ok", trial: { runDir, verdict: parsed } };
-}
-async function scanVerdictArtifactsDetailed(artifactsRoot) {
-  const trials = [];
-  const unreadableDirs = [];
-  let slugs;
-  try {
-    slugs = await readdir(artifactsRoot);
-  } catch {
-    return { trials, unreadableDirs };
-  }
-  for (const slug of slugs) {
-    const slugDir = join(artifactsRoot, slug);
-    let runIds;
-    try {
-      runIds = await readdir(slugDir);
-    } catch {
-      continue;
-    }
-    for (const runId of runIds) {
-      const runDir = join(slugDir, runId);
-      const result = await readVerdictArtifactDetailed(runDir);
-      if (result.status === "ok") trials.push(result.trial);
-      else if (result.status === "unreadable") unreadableDirs.push(runDir);
-    }
-  }
-  unreadableDirs.sort();
-  return { trials, unreadableDirs };
-}
-async function discoverRunSet(target) {
-  const anchorResult = await readVerdictArtifactDetailed(target);
-  if (anchorResult.status === "unreadable") {
-    return {
-      kind: "trial-dir",
-      set: null,
-      incompleteSet: null,
-      totalSets: 0,
-      unreadableCount: 1,
-      unreadablePaths: [target]
-    };
-  }
-  if (anchorResult.status === "ok") {
-    const anchor = anchorResult.trial;
-    const root = join(target, "..", "..");
-    const { trials: trials2, unreadableDirs: unreadableDirs2 } = await scanVerdictArtifactsDetailed(root);
-    const sets2 = groupRunSets(trials2);
-    const own = sets2.find(
-      (s) => anchor.verdict.group_id !== null && s.groupId === anchor.verdict.group_id || anchor.verdict.group_id === null && s.trials.length === 1 && s.trials[0].verdict.session_id === anchor.verdict.session_id
-    ) ?? groupRunSets([anchor])[0];
-    return {
-      kind: "trial-dir",
-      set: own,
-      incompleteSet: null,
-      totalSets: Math.max(sets2.length, 1),
-      unreadableCount: unreadableDirs2.length,
-      unreadablePaths: unreadableDirs2
-    };
-  }
-  const { trials, unreadableDirs } = await scanVerdictArtifactsDetailed(target);
-  const sets = groupRunSets(trials);
-  const failedSet = latestFailedRunSet(sets);
-  return {
-    kind: "root",
-    set: failedSet,
-    incompleteSet: failedSet ? null : latestIncompleteRunSet(sets),
-    totalSets: sets.length,
-    unreadableCount: unreadableDirs.length,
-    unreadablePaths: unreadableDirs
-  };
-}
-var execFileAsync = promisify(execFile);
-var SERVICE = "sh.pome.cli";
-var ACCOUNT = "hosted";
-function keychainSupported() {
-  if (process.env.POME_CLI_DISABLE_KEYCHAIN === "1") return false;
-  return process.platform === "darwin";
-}
-async function writeKeychainCredentials(creds) {
-  if (!keychainSupported()) return;
-  const payload = JSON.stringify({
-    api_key: creds.api_key,
-    api_url: creds.api_url,
-    dashboard_url: creds.dashboard_url,
-    team_id: creds.team_id,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  await execFileAsync("security", [
-    "add-generic-password",
-    "-U",
-    "-s",
-    SERVICE,
-    "-a",
-    ACCOUNT,
-    "-w",
-    payload
-  ]);
-}
-async function readKeychainCredentials() {
-  if (!keychainSupported()) return null;
-  try {
-    const { stdout } = await execFileAsync("security", [
-      "find-generic-password",
-      "-s",
-      SERVICE,
-      "-a",
-      ACCOUNT,
-      "-w"
-    ]);
-    const text = stdout.trim();
-    if (!text) return null;
-    const parsed = JSON.parse(text);
-    if (typeof parsed.api_key !== "string" || !parsed.api_key.trim()) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-async function deleteKeychainCredentials() {
-  if (!keychainSupported()) return false;
-  try {
-    await execFileAsync("security", [
-      "delete-generic-password",
-      "-s",
-      SERVICE,
-      "-a",
-      ACCOUNT
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/cli/credentials.ts
-var DEFAULT_PATH = () => join(homedir(), ".pome", "credentials.json");
-async function persistCredentialsAfterLogin(credentials, path = DEFAULT_PATH()) {
-  if (keychainSupported()) {
-    try {
-      await writeKeychainCredentials(credentials);
-      try {
-        await rm(path, { force: true });
-      } catch {
-      }
-      return { stored: "keychain" };
-    } catch {
-    }
-  }
-  await writeCredentialsFile(credentials, path);
-  return { stored: "file", path };
-}
-async function clearLocalCredentials(path = DEFAULT_PATH()) {
-  await deleteKeychainCredentials();
-  try {
-    await rm(path, { force: true });
-  } catch {
-  }
-}
-async function resolveCredentials(input) {
-  const envKey = process.env.POME_API_KEY;
-  if (envKey && envKey.trim().length > 0) {
-    const apiBaseUrl = resolveApiBaseUrl(input.apiBaseUrl, void 0);
-    return { apiKey: envKey.trim(), apiBaseUrl };
-  }
-  const keychain = await readKeychainCredentials();
-  if (keychain && typeof keychain.api_key === "string" && keychain.api_key.trim().length > 0) {
-    return {
-      apiKey: keychain.api_key.trim(),
-      apiBaseUrl: resolveApiBaseUrl(input.apiBaseUrl, keychain.api_url),
-      teamId: normalizeTeamId(keychain.team_id)
-    };
-  }
-  const path = input.credentialsPath ?? DEFAULT_PATH();
-  let raw;
-  try {
-    await assertSafeCredentialFileMode(path);
-    raw = await readFile(path, "utf8");
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      throw new HostedAuthError(
-        `Hosted mode requires authentication. Run \`pome login\`, set POME_API_KEY in your environment, or sign in on macOS to store credentials in Keychain. Expected file: ${path}.`
-      );
-    }
-    throw err;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`${path} is not valid JSON.`);
-  }
-  if (typeof parsed.api_key !== "string" || parsed.api_key.trim().length === 0) {
-    throw new Error(`${path} is missing "api_key".`);
-  }
-  return {
-    apiKey: parsed.api_key.trim(),
-    apiBaseUrl: resolveApiBaseUrl(input.apiBaseUrl, parsed.api_url),
-    teamId: normalizeTeamId(parsed.team_id)
-  };
-}
-function normalizeTeamId(raw) {
-  if (typeof raw !== "string") return void 0;
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function resolveApiBaseUrl(callerInput, storedApiUrl) {
-  const candidate = callerInput ?? storedApiUrl;
-  if (typeof candidate !== "string" || candidate.trim().length === 0) {
-    throw new Error(
-      "Refusing to resolve hosted credentials: no apiBaseUrl supplied and no stored api_url found."
-    );
-  }
-  return normalizeBaseUrl(candidate);
-}
-async function assertSafeCredentialFileMode(path) {
-  const st = await stat(path);
-  const perm = st.mode & 511;
-  if ((perm & 63) !== 0) {
-    throw new Error(
-      `Refusing to read credentials at ${path}: mode 0${perm.toString(8)} is too permissive (group/other bits must be 0). Run: chmod 600 ${path}`
-    );
-  }
-}
-async function writeCredentialsFile(credentials, path = DEFAULT_PATH()) {
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(
-    path,
-    `${JSON.stringify(
-      {
-        ...credentials,
-        created_at: (/* @__PURE__ */ new Date()).toISOString()
-      },
-      null,
-      2
-    )}
-`,
-    { mode: 384 }
-  );
-  await chmod(path, 384);
-}
-function normalizeBaseUrl(raw) {
-  return new URL(raw).toString().replace(/\/$/, "");
-}
-function resolveSeams(opts) {
-  return {
-    stdinIsTTY: opts.stdinIsTTY ?? Boolean(process.stdin.isTTY),
-    confirm: opts.confirm ?? promptYesNo,
-    ask: opts.ask ?? promptLine
-  };
-}
-async function requestAgent(creds, body) {
-  const res = await fetch(`${creds.apiBaseUrl}/v1/agents`, {
-    method: "POST",
-    headers: { "x-api-key": creds.apiKey, "content-type": "application/json" },
-    body: JSON.stringify(prunePostBody(body))
-  }).catch((err) => {
-    throw new HostedOrchError(err instanceof Error ? err.message : "network error");
-  });
-  const text = await res.text();
-  let json = {};
-  try {
-    json = text.length ? JSON.parse(text) : {};
-  } catch {
-    throw new HostedOrchError(`non-JSON response (status ${res.status})`);
-  }
-  return { ok: res.ok, status: res.status, json };
-}
-function prunePostBody(body) {
-  const out = { name: body.name };
-  if (body.slug !== void 0) out.slug = body.slug;
-  if (body.description !== void 0) out.description = body.description;
-  if (body.version !== void 0) out.version = body.version;
-  if (body.framework !== void 0) out.framework = body.framework;
-  if (body.twins && body.twins.length > 0) out.twins = body.twins;
-  if (body.confirm !== void 0) out.confirm = body.confirm;
-  return out;
-}
-function parseOkAgent(json) {
-  const parsed = agentResponseSchema.safeParse(json);
-  if (!parsed.success) {
-    throw new HostedOrchError("POST /v1/agents returned an unexpected shape");
-  }
-  return parsed.data;
-}
-function mapHttpError(status, json) {
-  const err = json.error;
-  if (status === 401 || status === 403) {
-    return new HostedAuthError(err?.message ?? `HTTP ${status}`);
-  }
-  if (status === 404) {
-    return new HostedOrchError(
-      err?.message ?? "POST /v1/agents returned 404 \u2014 check that --api-url/POME_API_URL points at a Pome control plane."
-    );
-  }
-  return new HostedOrchError(err?.message ?? `POST /v1/agents \u2192 HTTP ${status}`);
-}
-function nearMissSuggestion(json) {
-  const error = json.error;
-  if (error?.type !== "conflict") return void 0;
-  const details = error.details;
-  if (!details) return void 0;
-  const candidate = details.suggestion ?? details.slug ?? (Array.isArray(details.suggestions) ? details.suggestions[0] : void 0);
-  return typeof candidate === "string" && candidate.length > 0 ? candidate : void 0;
-}
-async function postAgentResolver(creds, body, seams) {
-  const first = await requestAgent(creds, body);
-  if (first.ok) return parseOkAgent(first.json);
-  if (first.status === 409) {
-    const suggestion = nearMissSuggestion(first.json);
-    if (suggestion) {
-      const interactive = seams.stdinIsTTY && !process.env.CI;
-      let retry;
-      if (interactive) {
-        const yes = await seams.confirm(
-          `An agent named "${suggestion}" already exists on your team. Did you mean "${suggestion}"? [y/N] `
-        );
-        retry = yes ? { ...body, slug: suggestion } : { ...body, confirm: true };
-      } else {
-        console.error(
-          `Near-miss: this slug is close to your team's existing "${suggestion}". Registering the new agent anyway (run interactively to link the existing one instead).`
-        );
-        retry = { ...body, confirm: true };
-      }
-      const second = await requestAgent(creds, retry);
-      if (second.ok) return parseOkAgent(second.json);
-      throw mapHttpError(second.status, second.json);
-    }
-  }
-  throw mapHttpError(first.status, first.json);
-}
-async function promptYesNo(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await new Promise((resolve) => rl.question(question, resolve));
-    return /^y(es)?$/i.test(answer.trim());
-  } finally {
-    rl.close();
-  }
-}
-async function promptLine(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    return (await new Promise((resolve) => rl.question(question, resolve))).trim();
-  } finally {
-    rl.close();
-  }
-}
-var POME_DIR = ".pome";
-var LINK_FILE = "link.json";
-var GITIGNORE_ENTRY = `${POME_DIR}/`;
-function linkPath(projectDir) {
-  return join(projectDir, POME_DIR, LINK_FILE);
-}
-async function readLinkCache(projectDir) {
-  let text;
-  try {
-    text = await readFile(linkPath(projectDir), "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null || typeof parsed.agent_id !== "string" || typeof parsed.team_id !== "string") {
-    return null;
-  }
-  const { agent_id, team_id } = parsed;
-  const resolved_at = typeof parsed.resolved_at === "string" ? parsed.resolved_at : "";
-  return { agent_id, team_id, resolved_at };
-}
-async function writeLinkCache(projectDir, entry) {
-  await mkdir(join(projectDir, POME_DIR), { recursive: true });
-  const body = {
-    agent_id: entry.agent_id,
-    team_id: entry.team_id,
-    resolved_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile(linkPath(projectDir), `${JSON.stringify(body, null, 2)}
-`);
-}
-function resolveCachedAgentId(cache, callerTeamId) {
-  if (!cache || !callerTeamId) return void 0;
-  return cache.team_id === callerTeamId ? cache.agent_id : void 0;
-}
-async function ensurePomeGitignored(projectDir) {
-  const path = join(projectDir, ".gitignore");
-  let existing;
-  try {
-    existing = await readFile(path, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-    existing = null;
-  }
-  if (existing === null) {
-    await writeFile(path, `${GITIGNORE_ENTRY}
-`);
-    return;
-  }
-  const alreadyIgnored = existing.split(/\r?\n/).some((line) => line.trim() === GITIGNORE_ENTRY || line.trim() === POME_DIR);
-  if (alreadyIgnored) return;
-  const separator = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
-  await writeFile(path, `${existing}${separator}${GITIGNORE_ENTRY}
-`);
-}
-
-// src/cli/agent-identity.ts
-async function resolveRunAgentIdentity(input) {
-  const manifestRead = await readManifest(input.startDir);
-  if (!manifestRead) {
-    return input.agentVersionOverride ? { agentVersion: input.agentVersionOverride } : {};
-  }
-  const { agent } = manifestRead.manifest;
-  const agentVersion = input.agentVersionOverride ?? agent.version;
-  const base = {
-    agentVersion,
-    framework: agent.framework,
-    agentSlug: agent.slug
-  };
-  const projectDir = dirname(manifestRead.path);
-  try {
-    const creds = await resolveCredentials({
-      apiBaseUrl: input.apiBaseUrl,
-      credentialsPath: input.credentialsPath
-    });
-    const cachedId = resolveCachedAgentId(await readLinkCache(projectDir), creds.teamId);
-    if (cachedId) {
-      return { ...base, agentId: cachedId };
-    }
-    const resolved = await postAgentResolver(
-      creds,
-      {
-        name: agent.name ?? agent.slug,
-        slug: agent.slug,
-        description: agent.description,
-        version: agent.version,
-        framework: agent.framework,
-        twins: normalizeManifestTwins(manifestRead.manifest.twins)
-      },
-      resolveSeams({ stdinIsTTY: false })
-    );
-    if (creds.teamId) {
-      await writeLinkCache(projectDir, { agent_id: resolved.id, team_id: creds.teamId });
-      await ensurePomeGitignored(projectDir);
-    }
-    return { ...base, agentId: resolved.id };
-  } catch (err) {
-    console.error(
-      `pome: could not resolve agent identity (${err instanceof Error ? err.message : String(err)}); running unattributed.`
-    );
-    return base;
-  }
-}
-
-// src/cli/defaults.ts
-var DEFAULT_CONTROL_PLANE_URL = "https://api.pome.sh";
-var DEFAULT_DASHBOARD_URL = "https://app.pome.sh";
-var DEFAULT_DOCS_SITE_ORIGIN = "https://docs.pome.sh";
-function ensureMcpSuffix(url) {
-  return /\/mcp\/?$/.test(url) ? url : `${url.replace(/\/$/, "")}/mcp`;
-}
-var ALLOWED_TWINS = new Set(MOUNTED_TWINS);
-var SESSION_TWIN_NAMES = [...ALLOWED_TWINS];
-function redactSession(res) {
-  const pcIn = res.provider_credentials;
-  const pcOut = {};
-  if (pcIn.github) {
-    pcOut.github = { ...pcIn.github, token: "***redacted***" };
-  }
-  if (pcIn.stripe) {
-    pcOut.stripe = { ...pcIn.stripe, api_key: "***redacted***" };
-  }
-  if (pcIn.slack) {
-    pcOut.slack = { ...pcIn.slack, token: "***redacted***" };
-  }
-  return {
-    session_id: res.session_id,
-    session_token: res.session_token ? "***redacted***" : res.session_id,
-    twin_url: res.twin_url,
-    expires_at: res.expires_at,
-    openapi_url: res.openapi_url,
-    per_twin: res.per_twin,
-    provider_credentials: pcOut,
-    agent_token: "***redacted***"
-  };
-}
-function formatEnvExport(res, twins) {
-  const lines = [
-    `# Pome hosted sandbox \u2014 treat as secret. Twins: ${twins.join(", ")}`,
-    `export POME_AUTH_TOKEN=${JSON.stringify(res.agent_token)}`,
-    `export POME_SESSION_ID=${JSON.stringify(res.session_id)}`,
-    // Legacy single-endpoint URL (= the primary twin's api_url). Kept for
-    // agents written against the pre-multi-twin contract.
-    `export POME_TWIN_URL=${JSON.stringify(res.twin_url)}`,
-    `export POME_TWIN_NAMES=${JSON.stringify(twins.join(","))}`
-  ];
-  const fromCloud = perTwinReturnedByCloud(res);
-  for (const twin of twins) {
-    const upper = twin.toUpperCase();
-    const pt = res.per_twin?.[twin];
-    if (pt?.api_url) {
-      const mcpUrl = fromCloud ? ensureMcpSuffix(pt.mcp_url) : ensureMcpSuffix(pt.api_url);
-      lines.push(`export POME_${upper}_REST_URL=${JSON.stringify(pt.api_url)}`);
-      lines.push(
-        `export POME_${upper}_MCP_URL=${JSON.stringify(mcpUrl)}`
-      );
-    }
-    if (twin === "github") {
-      const gh = res.provider_credentials.github;
-      if (gh) {
-        lines.push(`export POME_GITHUB_TOKEN=${JSON.stringify(gh.token)}`);
-      }
-    } else if (twin === "stripe") {
-      const st = res.provider_credentials.stripe;
-      if (st) {
-        lines.push(`export POME_STRIPE_API_KEY=${JSON.stringify(st.api_key)}`);
-      }
-      if (pt?.api_url) {
-        lines.push(`export POME_STRIPE_API_BASE=${JSON.stringify(pt.api_url)}`);
-      }
-    } else if (twin === "slack") {
-      lines.push(`export POME_SLACK_TOKEN=${JSON.stringify(res.agent_token)}`);
-    } else if (twin === "gmail") {
-      lines.push(`export POME_GMAIL_TOKEN=${JSON.stringify(res.agent_token)}`);
-    }
-  }
-  return `${lines.join("\n")}
-`;
-}
-function normalizeSessionTwins(raw) {
-  const twins = raw.map((t) => t.trim().toLowerCase()).filter((t) => t.length > 0);
-  for (const twin of twins) {
-    if (!ALLOWED_TWINS.has(twin)) {
-      throw new Error(
-        `Unknown twin "${twin}". Supported: ${[...ALLOWED_TWINS].join(", ")}.`
-      );
-    }
-  }
-  const deduped = [...new Set(twins)];
-  if (deduped.length === 0) {
-    throw new Error(
-      `No twin specified. Pass --twin <name> (repeat for multi-twin). Supported: ${[...ALLOWED_TWINS].join(", ")}.`
-    );
-  }
-  return deduped;
-}
-async function resolveSessionSeed(seedPath, requestedTwins) {
-  const raw = readSeedFileText(seedPath, "pome sandbox create --seed");
-  const origin = `--seed ${seedPath}`;
-  const file = parseSeedFileText(raw, origin);
-  const sole = soleTwinOf(file);
-  if (requestedTwins.length === 0 && sole === void 0) {
-    const named = twinsNamedBy(file);
-    throw new Error(
-      named.length === 0 ? `${origin} is a flat seed, so it does not name a twin. Pass the name: pome sandbox create --twin <${SESSION_TWIN_NAMES.join("|")}> --seed ${seedPath}` : `${origin} names ${named.length} twins (${named.join(", ")}), so it does not say which the sandbox is for. Pass the name: ${named.map((twin) => `--twin ${twin}`).join(" ")} --seed ${seedPath}`
-    );
-  }
-  const twins = normalizeSessionTwins(
-    requestedTwins.length > 0 ? requestedTwins : [sole]
-  );
-  const byTwin = await seedsForTwins(file, twins, origin);
-  return {
-    twins,
-    seed: isMultiTwinSeedEnvelope(twins) ? byTwin : byTwin[twins[0]]
-  };
-}
-async function runSessionCreate(opts) {
-  const resolvedSeed = opts.seedPath === void 0 ? void 0 : await resolveSessionSeed(opts.seedPath, opts.twins);
-  const twins = resolvedSeed?.twins ?? normalizeSessionTwins(opts.twins);
-  const creds = await resolveCredentials({ apiBaseUrl: opts.apiBaseUrl });
-  const client = createHostedClient({
-    baseUrl: creds.apiBaseUrl,
-    apiKey: creds.apiKey
-  });
-  const identity = await resolveRunAgentIdentity({
-    startDir: process.cwd(),
-    apiBaseUrl: creds.apiBaseUrl
-  });
-  const session = await client.createSession({
-    twins,
-    taskSource: "# ..\n",
-    idempotencyKey: randomUUID(),
-    agentId: identity.agentId,
-    agentVersion: identity.agentVersion,
-    ...resolvedSeed ? { seed: resolvedSeed.seed } : {}
-  });
-  if (opts.secretsFile) {
-    await writeSecretsFile(opts.secretsFile, formatEnvExport(session, twins));
-    console.error(`Wrote sandbox secrets to ${opts.secretsFile} (mode 0600).`);
-  }
-  if (opts.json) {
-    const payload = redactSession(session);
-    console.log(JSON.stringify(payload, null, 2));
-    return;
-  }
-  console.error(`Sandbox: ${session.session_id}`);
-  console.error(`Expires: ${session.expires_at}`);
-  if (opts.seedPath !== void 0) {
-    console.error(`Seed: ${opts.seedPath} (replaces the default for ${twins.join(", ")}).`);
-  }
-  let printedAny = false;
-  const mcpFromCloud = perTwinReturnedByCloud(session);
-  for (const twin of twins) {
-    const pt = session.per_twin?.[twin];
-    if (pt) {
-      const label = twins.length > 1 ? `${twin} ` : "";
-      const mcpUrl = mcpFromCloud ? ensureMcpSuffix(pt.mcp_url) : ensureMcpSuffix(pt.api_url);
-      console.error(`${label}API: ${pt.api_url}`);
-      console.error(`${label}MCP: ${mcpUrl}`);
-      printedAny = true;
-    }
-  }
-  if (!printedAny) {
-    console.error(`Twin URL: ${session.twin_url}`);
-  }
-  console.error("Secrets redacted.");
-  console.error(`Dashboard: ${DEFAULT_DASHBOARD_URL}/twins/${session.session_id}`);
-}
-async function writeSecretsFile(path, contents) {
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(path, contents, { mode: 384 });
-  await chmod(path, 384);
-}
-function displayState(serverState) {
-  if (serverState === "ready") return "running";
-  return serverState;
-}
-function matchesStateFilter(serverState, filter) {
-  if (filter === "all") return true;
-  if (filter === "running") return serverState === "ready" || serverState === "running";
-  return serverState === filter;
-}
-async function runSessionList(opts) {
-  const creds = await resolveCredentials({ apiBaseUrl: opts.apiBaseUrl });
-  const client = createHostedClient({
-    baseUrl: creds.apiBaseUrl,
-    apiKey: creds.apiKey
-  });
-  const fetchLimit = opts.state === "all" ? opts.limit : Math.min(opts.limit * 4, 200);
-  const all = await client.listSessions({ limit: fetchLimit });
-  const filtered = all.filter((r) => matchesStateFilter(r.state, opts.state));
-  const rows = filtered.slice(0, opts.limit);
-  if (opts.json) {
-    console.log(JSON.stringify(rows, null, 2));
-    return;
-  }
-  if (rows.length === 0) {
-    const scope = opts.state === "all" ? "any" : `state=${opts.state}`;
-    console.error(`No sandboxes returned (${scope}).`);
-    return;
-  }
-  for (const r of rows) {
-    console.error(
-      `${r.id}	${displayState(r.state)}	${r.twins.join(",")}	expires ${r.expires_at}`
-    );
-  }
-}
-async function runSessionStop(opts) {
-  const creds = await resolveCredentials({ apiBaseUrl: opts.apiBaseUrl });
-  const client = createHostedClient({
-    baseUrl: creds.apiBaseUrl,
-    apiKey: creds.apiKey
-  });
-  try {
-    await client.deleteSession(opts.sessionId, false, {
-      discard: opts.discard === true
-    });
-  } catch (err) {
-    if (err instanceof HostedDiscardRefusedError) {
-      console.error(
-        `Refused to stop ${err.sessionId}: it is still open (${err.state}), so its run has not been graded \u2014 Pome creates the run row at finalize, and stopping now discards it.`
-      );
-      if (err.taskName) console.error(`  Task: ${err.taskName}`);
-      console.error(`  Open for ${err.openSeconds}s.`);
-      console.error(
-        `  To keep the run, finalize it instead. To discard it anyway: pome sandbox stop ${err.sessionId} --discard`
-      );
-    }
-    throw err;
-  }
-  console.error(`Stopped sandbox ${opts.sessionId}.`);
-}
-function friendlyHostedError(err) {
-  if (err instanceof HostedDiscardRefusedError) {
-    return "";
-  }
-  if (err instanceof HostedAuthError) {
-    return `${err.message} \xB7 Run \`pome login\` or set a valid POME_API_KEY.`;
-  }
-  if (err instanceof HostedQuotaError) {
-    return `${err.message} \xB7 Quota or billing limit \u2014 check your team plan in the dashboard.`;
-  }
-  if (err instanceof HostedOrchError) {
-    const m = err.message;
-    if (/422|validation/i.test(m)) {
-      return `${m} \xB7 Check twin name and request body.`;
-    }
-    if (/503|spawn/i.test(m)) {
-      return `${m} \xB7 Control plane could not start the sandbox \u2014 retry later.`;
-    }
-    return m;
-  }
-  if (err instanceof Error) return err.message;
-  return String(err);
-}
-function buildAgentEnv(params) {
-  const {
-    session,
-    twins,
-    perTwinFromCloud,
-    prompt,
-    otlpEndpoint,
-    apiKey,
-    agentId,
-    runId,
-    artifactsDir,
-    slug,
-    signalsPath
-  } = params;
-  const env = {
-    POME_TASK: prompt,
-    POME_TWIN_NAMES: twins.join(","),
-    POME_OTEL_EXPORTER_OTLP_ENDPOINT: otlpEndpoint,
-    POME_OTEL_EXPORTER_OTLP_HEADERS: `x-api-key=${apiKey}`,
-    OTEL_SERVICE_NAME: agentId ?? "pome-agent",
-    OTEL_RESOURCE_ATTRIBUTES: `pome.session_id=${session.session_id},pome.run_id=${runId}${agentId ? `,pome.agent_id=${agentId}` : ""}`,
-    // The twin base URL, same value the self-host docs teach agents to fall
-    // back on. Agent code written against the standalone docker twin
-    // reads POME_TWIN_BASE_URL with a 127.0.0.1:3333 fallback; without this
-    // injection that fallback fires on hosted runs and the agent probes a
-    // loopback port nothing listens on. Legacy = the primary twin's bare url.
-    POME_TWIN_BASE_URL: session.twin_url,
-    // Legacy unconditional block (origin/main parity). Injected on EVERY hosted
-    // run regardless of twin; the per-twin overlay below overwrites these in
-    // place for github/stripe when those twins are in the session.
-    POME_GITHUB_REST_URL: session.twin_url,
-    POME_GITHUB_MCP_URL: `${session.twin_url}/mcp`,
-    POME_GITHUB_TOKEN: session.provider_credentials.github?.token ?? session.agent_token,
-    POME_STRIPE_API_BASE: session.twin_url,
-    // Always use the JWT agent_token as the Stripe SDK's Bearer in hosted mode.
-    // The cloud also returns `provider_credentials.stripe.api_key` (an
-    // HMAC-signed `sk_test_pome_*`), but the pome-cloud proxy only accepts
-    // JWTs — it routes by verifying the bearer against `agent_token`. A
-    // stripe-style key short-circuits to the proxy's opaque 404 before the
-    // request reaches the twin pod. The Stripe SDK sends any opaque string as
-    // `Authorization: Bearer …`, and twin-stripe's dual-auth accepts JWTs
-    // natively, so the JWT round-trips cleanly end-to-end.
-    POME_STRIPE_API_KEY: session.agent_token,
-    POME_AUTH_TOKEN: session.agent_token,
-    POME_RUN_ID: runId,
-    POME_ARTIFACTS_DIR: join(artifactsDir, slug, runId),
-    POME_ADAPTER_SIGNALS_PATH: signalsPath
-  };
-  for (const twin of twins) {
-    const upper = twin.toUpperCase();
-    const pt = session.per_twin?.[twin];
-    const apiUrl = pt?.api_url ?? session.twin_url;
-    const mcpUrl = perTwinFromCloud && pt?.mcp_url ? ensureMcpSuffix(pt.mcp_url) : `${apiUrl.replace(/\/$/, "")}/mcp`;
-    env[`POME_${upper}_REST_URL`] = apiUrl;
-    env[`POME_${upper}_MCP_URL`] = mcpUrl;
-    if (twin === "github") {
-      env.POME_GITHUB_TOKEN = session.provider_credentials.github?.token ?? session.agent_token;
-    } else if (twin === "stripe") {
-      env.POME_STRIPE_API_BASE = apiUrl;
-      env.POME_STRIPE_API_KEY = session.agent_token;
-    } else if (twin === "slack") {
-      env.POME_SLACK_TOKEN = session.agent_token;
-    } else if (twin === "gmail") {
-      env.POME_GMAIL_TOKEN = session.agent_token;
-    }
-  }
-  return env;
-}
-async function runTaskHosted(options) {
-  const scenario = await parseTaskFile(options.taskPath);
-  const taskSource = await readFile(options.taskPath, "utf8");
-  const taskHash = createHash("sha256").update(taskSource).digest("hex");
-  const artifactsDir = options.artifactsDir ?? "runs";
-  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const client = options.client ?? createHostedClient({ baseUrl: options.hosted.baseUrl, apiKey: options.hosted.apiKey });
-  const identity = await resolveRunAgentIdentity({
-    startDir: dirname(options.taskPath),
-    apiBaseUrl: options.hosted.baseUrl,
-    agentVersionOverride: options.agentVersion
-  });
-  const agentId = identity.agentId;
-  const agentVersion = identity.agentVersion;
-  const agentSdk = identity.framework ?? null;
-  const signalsDir = await mkdtemp(join(tmpdir(), "pome-signals-"));
-  const signalsPath = join(signalsDir, `${randomUUID()}.jsonl`);
-  await writeFile(signalsPath, "");
-  const session = await createSessionOrExplain(
-    client,
-    options.premintedSession,
-    {
-      taskSource,
-      twins: scenario.config.twins,
-      agentId,
-      agentVersion,
-      seed: scenario.seedState
-    }
-  );
-  const twins = scenario.config.twins;
-  const primaryTwin = twins[0];
-  const isMultiTwin = twins.length > 1;
-  const twinApiUrl = (twin) => session.per_twin?.[twin]?.api_url ?? session.twin_url;
-  const runId = session.session_id;
-  try {
-    const stateInitialByTwin = await fetchStateForTwins(
-      client,
-      twins,
-      twinApiUrl,
-      session.agent_token
-    );
-    const stateInitial = stateInitialByTwin[primaryTwin];
-    const otlpEndpoint = process.env.POME_OTEL_COLLECTOR_URL?.trim() || new URL(
-      `/v1/sessions/${session.session_id}/traces`,
-      options.hosted.baseUrl
-    ).toString();
-    const env = buildAgentEnv({
-      session,
-      twins,
-      perTwinFromCloud: perTwinReturnedByCloud(session),
-      prompt: scenario.prompt,
-      otlpEndpoint,
-      apiKey: options.hosted.apiKey,
-      agentId,
-      runId,
-      artifactsDir,
-      slug: scenario.slug,
-      signalsPath
-    });
-    const preflightTimeoutSeconds = Math.min(10, scenario.config.timeout);
-    const preflight = await runAgentCommand({
-      command: options.agentCommand,
-      env,
-      timeoutSeconds: preflightTimeoutSeconds,
-      preflight: true
-    });
-    let agentResult = preflight;
-    if (preflight.exitCode === 0) {
-      await writeFile(signalsPath, "");
-      agentResult = await runAgentCommand({
-        command: options.agentCommand,
-        env,
-        timeoutSeconds: scenario.config.timeout
-      });
-    }
-    if (options.abandonOnFailure && (agentResult.timedOut || agentResult.exitCode !== 0)) {
-      const failed = preflight.exitCode !== 0 ? preflight : agentResult;
-      const cause = stderrTail(failed.stderr);
-      const failure = preflight.exitCode !== 0 ? {
-        errorCode: "preflight_failed",
-        reason: preflight.timedOut ? `agent preflight timed out after ${preflightTimeoutSeconds}s` : `agent preflight failed${cause ? ` \u2014 ${cause}` : ""}`
-      } : agentResult.timedOut ? {
-        errorCode: "agent_timeout",
-        reason: `agent timed out after ${scenario.config.timeout}s`
-      } : {
-        errorCode: "agent_exit_nonzero",
-        reason: `agent exited non-zero (exit ${agentResult.exitCode})${cause ? ` \u2014 ${cause}` : ""}`
-      };
-      try {
-        const runDir = join(artifactsDir, scenario.slug, runId);
-        await mkdir(runDir, { recursive: true });
-        await writeFile(join(runDir, "stdout.txt"), redactSecrets(failed.stdout));
-        await writeFile(join(runDir, "stderr.log"), redactSecrets(failed.stderr));
-      } catch {
-      }
-      await abandonBestEffort(client, session.session_id, failure.errorCode);
-      throw new HostedTrialError(failure.reason, failure.errorCode);
-    }
-    const stateFinalByTwin = {};
-    const eventsByTwin = {};
-    await Promise.all(
-      twins.map(async (twin) => {
-        const [sf, ev] = await Promise.all([
-          client.fetchState({ twinUrl: twinApiUrl(twin), agentToken: session.agent_token }),
-          client.fetchEvents({ twinUrl: twinApiUrl(twin), agentToken: session.agent_token })
-        ]);
-        stateFinalByTwin[twin] = sf;
-        eventsByTwin[twin] = isMultiTwin ? ev.map((e) => tagEventTwin(e, twin)) : ev;
-      })
-    );
-    const stateFinal = stateFinalByTwin[primaryTwin];
-    const events = isMultiTwin ? mergeEventsByTimestamp(twins.flatMap((t) => eventsByTwin[t] ?? [])) : eventsByTwin[primaryTwin] ?? [];
-    const legacyEvents = events;
-    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const durationMs = Date.parse(completedAt) - Date.parse(startedAt);
-    const artifacts = await writeRunArtifactsCore({
-      artifactsDir,
-      runId,
-      scenario,
-      startedAt,
-      completedAt,
-      stdout: agentResult.stdout,
-      stderr: agentResult.stderr,
-      exitCode: agentResult.exitCode,
-      events: legacyEvents,
-      stateInitial,
-      stateFinal
-    });
-    if (isMultiTwin) {
-      for (const twin of twins) {
-        if (twin === primaryTwin) continue;
-        try {
-          await writeFile(
-            join(artifacts.runDir, `state_final.${twin}.json`),
-            `${JSON.stringify(redactSecrets(stateFinalByTwin[twin]), null, 2)}
-`
-          );
-        } catch (err) {
-          console.warn(
-            `[pome] state_final.${twin}.json not written (${err instanceof Error ? err.message : String(err)})`
-          );
-        }
-      }
-    }
-    const eventsJsonl = legacyEvents.map((e) => JSON.stringify(redactEvent(toTwinHttpEvent(e)))).join("\n") + "\n";
-    const stateInitialJson = JSON.stringify(redactSecrets(stateInitial));
-    const stateFinalJson = JSON.stringify(redactSecrets(stateFinal));
-    let signalsJsonl = "";
-    try {
-      signalsJsonl = redactJsonl(
-        await readFile(signalsPath, "utf8").catch(() => "")
-      );
-    } catch (err) {
-      console.warn(
-        `[pome] signals.jsonl upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with signals_storage_key=null`
-      );
-    }
-    const metaJson = await readFile(join(artifacts.runDir, "meta.json"), "utf8").catch(
-      () => "{}"
-    );
-    const perTwinState = isMultiTwin ? Object.fromEntries(
-      twins.map((twin) => [
-        twin,
-        {
-          initialJson: JSON.stringify(redactSecrets(stateInitialByTwin[twin])),
-          finalJson: JSON.stringify(redactSecrets(stateFinalByTwin[twin]))
-        }
-      ])
-    ) : void 0;
-    const uploaded = await uploadRunBlobs(client, session.session_id, {
-      eventsJsonl,
-      stateInitialJson,
-      stateFinalJson,
-      signalsJsonl,
-      metaJson,
-      twins: isMultiTwin ? twins : void 0,
-      perTwinState
-    });
-    const eventsJsonlUrl = uploaded.eventsKey;
-    const stateKeys = {
-      initialKey: uploaded.stateInitialKey,
-      finalKey: uploaded.stateFinalKey
-    };
-    const signalsKey = uploaded.signalsKey;
-    const criteriaDefs = scenario.criteria.map((c, idx) => ({
-      id: `crit_${idx}`,
-      text: c.text,
-      kind: c.type,
-      ...c.twin ? { twin: c.twin } : {},
-      ...c.alwaysScored ? { always_scored: true } : {}
-    }));
-    const stopReason = agentResult.timedOut ? "agent_timeout" : agentResult.exitCode === 0 ? "agent_exit_0" : "agent_exit_nonzero";
-    const finalized = await client.finalize(session.session_id, {
-      stopReason,
-      exitCode: agentResult.exitCode ?? 0,
-      durationMs,
-      agentModel: options.agentModel ?? "unknown",
-      agentSdk,
-      criteria: criteriaDefs,
-      taskName: scenario.slug,
-      taskHash,
-      taskPrompt: scenario.prompt,
-      expectedBehavior: scenario.expectedBehavior,
-      // Explicit overrides when uploads succeeded; otherwise let cloud fall
-      // back. For events.jsonl the conventional `team-<>/session-<>/events.jsonl`
-      // path matches what /result-upload-url signs, so omitting traceStorageKey
-      // still resolves correctly. For state blobs there is no conventional
-      // fallback today — omitting them means cloud's judge sees
-      // "{}", which we accept as best-effort degradation.
-      traceStorageKey: eventsJsonlUrl ?? void 0,
-      stateInitialStorageKey: stateKeys.initialKey ?? void 0,
-      stateFinalStorageKey: stateKeys.finalKey ?? void 0,
-      signalsStorageKey: signalsKey ?? void 0,
-      // Multi-twin (M3): per-twin state storage keys (>=1 key per entry).
-      // Undefined for single-twin / an older cloud that returned no per_twin
-      // upload block — the cloud then scores the primary twin from the flat keys.
-      perTwinStateKeys: uploaded.perTwinStateKeys
-    });
-    const score = scoreFromFinalizeResponse(finalized);
-    const verdict = scoreStatus(score, scenario.config.passThreshold);
-    const exitCode = verdict === "pass" ? 0 : 1;
-    try {
-      const counts = evaluationCounts(score);
-      await writeVerdictArtifact(artifacts.runDir, {
-        version: VERDICT_ARTIFACT_VERSION,
-        source: "cloud-finalize",
-        task_name: scenario.slug,
-        task_path: options.taskPath,
-        group_id: options.groupId ?? null,
-        session_id: session.session_id,
-        cloud_run_id: finalized.run_id,
-        cloud_dashboard_url: finalized.dashboard_url,
-        judge_model: score.judge_model,
-        score: finalized.score,
-        pass_threshold: scenario.config.passThreshold,
-        state: verdict,
-        passed: exitCode === 0,
-        evaluated: counts.evaluated,
-        not_evaluated: counts.notEvaluated,
-        pre_satisfied: counts.preSatisfied,
-        total: counts.total,
-        criteria_results: score.results,
-        duration_ms: durationMs,
-        finalized_at: (/* @__PURE__ */ new Date()).toISOString()
-      });
-    } catch (err) {
-      console.warn(
-        `[pome] verdict.json not written (${err instanceof Error ? err.message : String(err)}); pome fix-prompt won't see this trial`
-      );
-    }
-    return {
-      scenario,
-      runId,
-      cloudRunId: finalized.run_id,
-      cloudDashboardUrl: finalized.dashboard_url,
-      artifacts,
-      score,
-      verdict,
-      exitCode,
-      durationMs
-    };
-  } catch (err) {
-    if (options.abandonOnFailure && !(err instanceof HostedTrialError)) {
-      await abandonBestEffort(client, session.session_id, "trial_crashed");
-    }
-    throw err;
-  } finally {
-    await client.deleteSession(session.session_id, true, { discard: true }).catch(() => void 0);
-    await rm(signalsDir, { recursive: true, force: true }).catch(() => void 0);
-  }
-}
-async function createSessionOrExplain(client, preminted, input) {
-  if (preminted) return preminted;
-  try {
-    return await client.createSession(input);
-  } catch (err) {
-    if (err instanceof HostedOrchError && err.status === 422 && (err.type === "multi_twin_unsupported" || /multi_twin_unsupported/i.test(err.message))) {
-      throw new HostedOrchError(
-        "this pome cloud does not support multi-twin sessions yet",
-        err.requestId,
-        err.status,
-        err.type
-      );
-    }
-    throw err;
-  }
-}
-async function fetchStateForTwins(client, twins, twinApiUrl, agentToken) {
-  const byTwin = {};
-  await Promise.all(
-    twins.map(async (twin) => {
-      byTwin[twin] = await client.fetchState({
-        twinUrl: twinApiUrl(twin),
-        agentToken
-      });
-    })
-  );
-  return byTwin;
-}
-function tagEventTwin(event, twin) {
-  if (event && typeof event === "object") {
-    const existing = event.twin;
-    if (existing === void 0 || existing === null || existing === "") {
-      return { ...event, twin };
-    }
-  }
-  return event;
-}
-function mergeEventsByTimestamp(events) {
-  const tsOf = (e) => {
-    const ts = e.ts;
-    return typeof ts === "string" ? ts : "";
-  };
-  return events.map((event, index) => ({ event, index })).sort((a, b) => {
-    const ta = tsOf(a.event);
-    const tb = tsOf(b.event);
-    if (ta < tb) return -1;
-    if (ta > tb) return 1;
-    return a.index - b.index;
-  }).map(({ event }) => event);
-}
-function stderrTail(stderr) {
-  const last = stderr.split("\n").map((line) => line.trim()).filter(Boolean).at(-1);
-  if (!last) return null;
-  const flat = redactSecrets(last.replace(/\s+/g, " ")).trim();
-  return flat.length > 160 ? `${flat.slice(0, 157)}\u2026` : flat;
-}
-async function abandonBestEffort(client, sessionId, errorCode) {
-  try {
-    await client.abandonSession(sessionId, { errorCode });
-  } catch (err) {
-    console.warn(
-      `[pome] session abandon skipped (${err instanceof Error ? err.message : String(err)}); the expiry sweeper will close ${sessionId}`
-    );
-  }
-}
-
-export { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, DEFAULT_DOCS_SITE_ORIGIN, SESSION_TWIN_NAMES, clearLocalCredentials, discoverRunSet, ensurePomeGitignored, friendlyHostedError, persistCredentialsAfterLogin, postAgentResolver, readLinkCache, resolveCachedAgentId, resolveCredentials, resolveRunAgentIdentity, resolveSeams, runSessionCreate, runSessionList, runSessionStop, runTaskHosted, writeLinkCache };