@pome-sh/cli 0.43.0 → 0.43.1

package/README.md

@@ -1,168 +1,289 @@
 # Pome CLI
 
-The `pome` command runs AI-agent tasks against resettable digital twins of
-real SaaS APIs (GitHub, Stripe, …), captures the trace, and gets a verdict from
-Pome cloud.
+The `pome` CLI runs AI-agent tasks against resettable digital twins of real SaaS APIs.
+It records each run and sends hosted runs to Pome for evaluation.
 
-The CLI is **capture-only**: it records raw traces and never scores, judges, or
-correlates locally. A verdict comes only from the cloud — a hosted `pome run`
-prints it to the terminal and records it to the dashboard, and
-`pome eval <run-dir>` uploads a captured trace for a cloud verdict.
+The CLI does not score locally.
 
-**📚 Full documentation lives at [docs.pome.sh](https://docs.pome.sh).**
-Run `pome --help` (or `pome help <command>`) for the CLI reference, and
-`pome docs getting-started` to print the quickstart's URL.
+- `pome run` uses the hosted workflow by default. It records the run and prints the hosted verdict.
+- `pome run --local` uses local twins. It records one trace and does not request a verdict.
+- `pome eval` uploads existing local artifacts and prints the hosted verdict.
+
+See [docs.pome.sh](https://docs.pome.sh) for the full documentation.
+Use `pome --help` or `pome help <command>` for command details.
+
+## Requirements
+
+- Node.js 24 or later
+- A Pome account and API key for hosted runs and evaluations
+- A supported model-provider credential when the agent calls a model provider
+
+Local twin commands do not require a Pome account.
 
 ## Install
 
+Install the CLI globally:
+
 ```bash
 npm install -g @pome-sh/cli
-pome --help
 ```
 
-Or run it without installing: `npx @pome-sh/cli <command>` — e.g.
-`npx @pome-sh/cli twin start github` boots a local GitHub twin with nothing
-but Node ≥ 24.
+You can also run one command without a global installation:
+
+```bash
+npx @pome-sh/cli twin start github
+```
+
+## Set Up A Project
 
-Gmail is first-party too:
+Create the starter project in an empty directory:
 
 ```bash
-npx @pome-sh/cli twin start gmail --port 3336
-# prints POME_GMAIL_REST_URL, POME_GMAIL_MCP_URL, and POME_GMAIL_TOKEN
-pome tasks gmail --copy
+mkdir pome-example
+cd pome-example
+pome init
+pome login
+pome register agent my-agent
+pome run tasks/01-bug-happy-path.md
 ```
 
-`POME_GMAIL_TOKEN` is the same Pome session JWT as `POME_AUTH_TOKEN`; it is not
-a Google OAuth token. Hosted Gmail availability is gated separately from the
-local/OSS package release.
+`pome init` writes `pome.json`, starter tasks, and an example agent in an empty directory.
+In an existing project, it writes only the manifest unless you use `--starter`.
+
+Set `command` in `pome.json`, or pass `--agent <command>` to `pome run`.
+
+## Hosted Workflow
+
+Hosted execution is the default for `pome run`.
+The command creates hosted sandboxes, runs the agent, uploads the artifacts, and prints the verdict.
 
-## Quickstart
+Use `POME_API_KEY` instead of `pome login` in CI.
+Use `-n <count>` to run a hosted trial group of 1 to 20 trials.
+The task `runs` field supplies the count when you omit `-n`.
+
+## Local Capture And Hosted Evaluation
+
+Use `--local` to run one task against in-process twins.
+This command records artifacts but never scores them.
 
 ```bash
-pome login                       # one-time; opens the dashboard to sign in
-pome init                        # scaffolds tasks/, examples/agents/, runs/, pome.json
-pome register agent my-agent     # scopes runs to this project
-pome run tasks/01-bug-happy-path.md --agent "node examples/agents/scripted-triage-agent.ts"
-pome inspect latest              # trace/audit view of the last run
+pome run --local tasks/01-bug-happy-path.md
+pome inspect latest
+pome eval
 ```
 
-To capture a trace without the cloud (self-host), then get a verdict later:
+`pome eval` uses `<artifacts-dir>/latest.json` when you omit the run directory.
+You can also give the directory explicitly:
 
 ```bash
-pome run --local tasks/01-bug-happy-path.md   # captures a raw trace only, no verdict
-pome eval runs/01-bug-happy-path/<run-id>         # uploads it for a cloud verdict
+pome eval runs/01-bug-happy-path/<run-id>
 ```
 
-## Start from an example
+`pome eval` uploads the trace to Pome and prints the hosted verdict.
+It does not add a local score.
+
+Do not combine `--local` with `-n`.
+Local capture always runs one trial.
+
+## Standalone Twins
 
-`pome init --example <id>` fetches a complete, runnable example — its agent,
-its tasks, its `pome.json` and its lockfile — into `./<id>`:
+Start a long-running local twin:
 
 ```bash
-pome init --example minimal-viktor   # a merge bot on the GitHub + Slack twins
-cd minimal-viktor && npm install
-pome run tasks/01-clean-merge.md
+pome twin start gmail --port 3336
 ```
 
-An example is named by **id**, never by path — that is the whole point. The ids
-are derived from the example directories rather than restated anywhere, so an
-example that is renamed or deleted stops answering to the old id on the next
-command, with the valid ids printed underneath, instead of going quietly 404 in
-a link someone typed months ago. An unknown id lists every available one:
+The command prints the REST URL, MCP URL, and bearer token.
+For Gmail, `POME_GMAIL_TOKEN` is the same Pome session JWT as `POME_AUTH_TOKEN`.
+It is not a Google OAuth token.
+
+Create a seed file, then use it to start a twin:
 
 ```bash
-pome init --example nope    # → the full list, each with what it teaches
+pome twin new-seed github --out seed.json
+pome twin start github --seed seed.json
 ```
 
-Two kinds are on that list: **agents for Pome to grade**, which you run with
-`pome run`, and **integration harnesses** (Braintrust, LangSmith) that drive Pome
-from their own eval runner and are started by it, not by `pome run`. The output
-tells you which one you scaffolded.
+A supplied seed replaces the default seed.
+It does not merge with the default seed.
+
+## Commands
+
+| Command | Purpose |
+| --- | --- |
+| `pome init` | Write `pome.json` and, when applicable, starter files. |
+| `pome login` | Sign in and store a hosted API key. |
+| `pome logout` | Remove locally stored hosted credentials. |
+| `pome docs [topic]` | Print or select a documentation URL. |
+| `pome tasks [twin]` | List or copy bundled tasks. |
+| `pome checks [twin]` | List the checks that can grade `[code]` criteria. |
+| `pome checks add <file>` | Add one declared `[code]` criterion to a task. |
+| `pome checks lint <file...>` | Report `[code]` criteria that do not bind to declared checks. |
+| `pome compile-seeds [target]` | Compile prose seed state to `.seed.json` files with Claude. |
+| `pome register agent <name>` | Register an agent and write its slug to `pome.json`. |
+| `pome sandbox create` | Create a hosted sandbox. |
+| `pome sandbox list` | List hosted sandboxes. |
+| `pome sandbox stop <session-id>` | Stop a hosted sandbox. |
+| `pome run [path]` | Run one task or all task files in a directory. Hosted is the default. |
+| `pome doctor` | Check the manifest, twin routing, and egress controls. |
+| `pome eval [run-dir]` | Upload recorded artifacts and request a hosted verdict. |
+| `pome inspect <run>` | Print a trace and audit report. |
+| `pome fix-prompt [target]` | Build a repair prompt from recorded traces and hosted verdicts. |
+| `pome twin start [name]` | Start a standalone local twin. |
+| `pome twin new-seed <name...>` | Print or write a starter seed file. |
+| `pome twin status` | Check the last standalone twin and print its connection values. |
+
+## Environment Variables
+
+Global hosted configuration:
+
+| Variable | Purpose |
+| --- | --- |
+| `POME_API_KEY` | Authenticate hosted commands. This value takes precedence over stored credentials. |
+| `POME_API_URL` | Set the control-plane URL. `--api-url` takes precedence. |
+| `POME_DASHBOARD_URL` | Set the dashboard URL for login and result links. |
+
+Agent process configuration:
+
+| Variable | Purpose |
+| --- | --- |
+| `POME_AGENT_ENV_ALLOWLIST` | Add comma-separated parent variable names to the agent process. |
+| `POME_EGRESS_ALLOW` | Add comma-separated host patterns to the capture proxy allowlist. |
+| `POME_INHERIT_AGENT_ENV=1` | Pass the full parent environment to the agent. Use this only with trusted agents. |
+| `POME_TRUST_AGENT_COMMAND=1` | Run the agent command through a shell. Use this only with trusted commands. |
 
-The files come from GitHub at the commit that built your CLI, so an example is
-always the one this version was released with. `POME_EXAMPLE_REF` overrides the
-ref when you want a branch.
+The CLI passes these provider variables to the agent by default when they are set:
 
-See [docs.pome.sh](https://docs.pome.sh) for the task library, authentication,
-the Stripe/Slack twins, and everything else.
+- `AI_GATEWAY_API_KEY`
+- `ANTHROPIC_API_KEY`
+- `CLAUDE_CODE_OAUTH_TOKEN`
+- `GOOGLE_API_KEY`
+- `GOOGLE_GENERATIVE_AI_API_KEY`
+- `OPENAI_API_KEY`
+- `OPENROUTER_API_KEY`
 
-## CI one-shot — the exit-code contract
+`pome compile-seeds` requires `ANTHROPIC_API_KEY`.
 
-`pome run <task>` is the CI one-shot: one hosted, scored run, and its **exit
-code is the verdict**. Gate CI on it directly.
+Standalone twin configuration:
 
-| Exit code | Meaning |
+| Variable | Purpose |
 | --- | --- |
-| `0` | pass (hosted/scored run), or trace captured (`--local`, not scored) |
-| `1` | ran and scored **below** the pass threshold, **or ran `INCOMPLETE`** |
-| `2` | twin / orchestration error (network, 5xx, twin spawn failed) |
-| `3` | auth error (401/403) — `pome login` again, or set `POME_API_KEY` in CI |
-| `4` | quota exceeded (402/429) |
-| `5` | usage error (bad flags, missing task file) |
-
-Three rules CI must honor:
-
-- **`--local` is not a verdict.** A `--local` run captures a raw trace and never
-  scores, so its exit `0` means "trace captured," not "passed." Never gate CI on
-  a `--local` exit code — score it later with `pome eval <run-dir>`.
-- **`INCOMPLETE` shares exit `1`, and it is not the agent's failure.** A run
-  whose criteria could not all be graded exits `1` rather than mapping its
-  partial score to a code — a run whose checks never ran is not a green CI
-  signal. The cost is stated rather than hidden: **`1` cannot tell "the agent
-  regressed" from "we could not grade it."** To separate them programmatically,
-  do not compare `score` against `pass_threshold` yourself — a run with a third
-  of its criteria unevaluated can still read `score: 100, pass_threshold: 100`
-  with nothing in those two fields alone saying so. Read `state` in the
-  `verdict.json` a hosted `pome run` writes to
-  `<artifacts-dir>/<task-slug>/<session-id>/verdict.json`: `"pass"`, `"fail"`,
-  or `"incomplete"` — the same word the terminal prints beside the score, and
-  the field to gate on. The `evaluated` / `not_evaluated` / `pre_satisfied` /
-  `total` counts alongside it say how much of the task `score` covers:
-  **`score` is a percentage over `evaluated` alone**, so `not_evaluated > 0`
-  means `score` is silent about part of the run, and `evaluated: 0` means it
-  scored nothing at all (the cloud sends `0` there for want of a denominator
-  — "nothing was scored", not "nothing was correct").
-- **Trial groups map as a whole.** `pome run -n k` (k>1) collapses the whole
-  group to one code: `0` = at least one trial completed and every completed
-  trial passed; `1` = at least one completed trial failed its threshold **or was
-  incomplete**; `2` = no trial completed. Errored and incomplete trials are
-  excluded from the verdict fraction (`3 of 4 passed · 1 incomplete`) so neither
-  is counted as a pass nor charged to the agent as a loss — but a group holding
-  one cannot exit `0`.
-- **`pome fix-prompt` uses the same codes, and its `1` is only ever
-  INCOMPLETE.** Building a prompt for a failed run set exits `0` (the prompt is
-  on stdout, and stdout being non-empty is the signal that there was something
-  to fix); an all-green root exits `0` with nothing on stdout; a bad argument or
-  a root with no readable run sets exits `5`. `1` is reserved for the one case
-  where the newest non-passing set was never fully graded: no prompt is built,
-  because a run whose checks never ran is not evidence of an agent defect. This
-  matches `pome run`, where `1` also covers INCOMPLETE — the two commands do not
-  disagree about what an ungraded run exits, and `verdict.json`'s `state` stays
-  the field to read when a script needs the reason rather than the code.
-
-## Development
+| `PORT` | Set the listen port for `pome twin start`. `--port` takes precedence. |
+| `POME_SEED_JSON` | Supply seed JSON. `--seed` takes precedence. |
+| `TWIN_AUTH_SECRET` | Supply the secret that signs local session JWTs. |
+| `POME_TWIN_DATA_DIR` | Set the directory for the persisted twin secret. |
+
+The twin entry points also accept their provider-specific host, port, database, and no-seed variables.
+See [`CONTRACT.md`](../CONTRACT.md) for that runtime interface.
+
+## Artifacts
+
+The default artifact root is `runs/`.
+Use the global `--artifacts-dir <dir>` option to select another root.
+
+Each completed run uses this directory format:
+
+```text
+<artifacts-dir>/<task-slug>/<run-id>/
+```
+
+The six core files are:
+
+| File | Content |
+| --- | --- |
+| `meta.json` | Run identity, times, agent exit, twins, and format versions. |
+| `events.jsonl` | Redacted twin, model, and adapter events. |
+| `state_initial.json` | Initial state for the primary twin. |
+| `state_final.json` | Final state for the primary twin. |
+| `stdout.txt` | Redacted agent standard output. |
+| `stderr.log` | Redacted agent standard error. |
+
+A run can also contain these files:
+
+| File | Condition |
+| --- | --- |
+| `signals.jsonl` | The runner creates this adapter-event sidecar. |
+| `egress.jsonl` | The capture proxy records refused connections here. |
+| `state_final.<twin>.json` | A multi-twin run records each additional final state. |
+| `verdict.json` | A hosted `pome run` caches the hosted verdict for `pome fix-prompt`. |
+| `eval-session.json` | `pome eval` records the hosted evaluation session for safe reuse. |
+
+The artifact root also contains `latest.json`.
+It points to the most recent run directory.
+
+The CLI never writes `score.json`.
+A hosted verdict comes from Pome.
+
+## Exit Codes
+
+### Hosted `pome run` And `pome eval`
+
+| Code | Meaning |
+| --- | --- |
+| `0` | The hosted verdict is `pass`. |
+| `1` | The hosted verdict is `fail` or `incomplete`. |
+| `2` | A twin, missing agent command, malformed task configuration, network, or orchestration error prevented a verdict. |
+| `3` | Authentication failed. |
+| `4` | The account exceeded a quota. |
+| `5` | The CLI rejected the invocation during validation, for example because a path, option, or option combination is invalid. |
+
+For `pome run`, the task supplies the pass threshold.
+For `pome eval`, the pass threshold is `100`.
+
+For a hosted `pome run`, read `state` in `verdict.json` to distinguish `fail` from `incomplete`.
+The possible values are `"pass"`, `"fail"`, and `"incomplete"`.
+
+The `evaluated`, `not_evaluated`, `pre_satisfied`, and `total` fields describe grading coverage.
+`score` is a percentage over `evaluated` criteria only.
+Thus, `not_evaluated > 0` means that the score does not cover the complete task.
+
+### Hosted Trial Groups
+
+`pome run -n k` returns one code for the group when `k` is greater than `1`.
+
+| Code | Meaning |
+| --- | --- |
+| `0` | At least one trial completed and every completed trial passed. |
+| `1` | At least one completed trial failed or was incomplete. |
+| `2` | No trial completed. |
+
+Errored trials do not enter the verdict fraction.
+An incomplete trial also prevents exit `0`.
+
+### Local `pome run --local`
+
+| Code | Meaning |
+| --- | --- |
+| `0` | The agent completed and the CLI recorded the trace. This code is not a verdict. |
+| `2` | A local twin, missing agent command, malformed task configuration, or runner error prevented capture. |
+| `3` | The agent failed, timed out, or failed its preflight. |
+| `5` | The CLI rejected the invocation during validation, for example because a path, option, or option combination is invalid. |
+
+Do not use a local exit `0` as a CI quality gate.
+Run `pome eval <run-dir>` to request a verdict.
+
+### `pome fix-prompt`
+
+- Exit `0` means that the command succeeded. Standard output can be empty when all run sets passed.
+- Exit `1` means that the newest non-passing set is incomplete.
+- Exit `5` means that the target or arguments are invalid.
+
+## Contribute
+
+Run these commands from the repository root:
 
 ```bash
 npm install
-npm run typecheck
 npm run build
+npm run typecheck
 npx vitest run --project cli
 ```
 
-The package publishes the `pome` binary from `dist/src/cli/main.js`.
-
-### Versioning — every behavior change ships with a release, and you do not write the number
+Use `npm run test:contract` for the packaged twin runtime contract.
+Run `node --test contract/cli-start.test.mjs` after you build the CLI front door.
 
-Add the user-facing entry to `CHANGELOG.md` under an `## Unreleased (patch)` (or
-`(minor)`) heading, above the newest released one, and leave `version` in
-`cli/package.json` alone — a PR that moves it fails CI. Merging to `main` is the
-release trigger: `.github/workflows/allocate-version.yml` allocates the number
-there, rewriting that heading and the manifest in one commit, and
-`.github/workflows/release.yml` compares the local version against npm and
-publishes when they differ. `pome --version` reports the allocated value from a
-build-time constant, so a user can always tell whether their install carries a
-given fix.
+The package publishes `pome` from `cli/dist/src/cli/main.js`.
 
 ## License
 
-Apache-2.0. See [`LICENSE`](./LICENSE).
+Apache-2.0. See [`LICENSE`](../LICENSE).

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.43.0",
-  "git_sha": "589885b59adab9a5fded977620a6adc25125da85",
-  "build_time": "2026-09-01T07:18:35.031Z"
+  "version": "0.43.1",
+  "git_sha": "aa6e8ff0d76f2bfbdd8c01e72239431644cb849a",
+  "build_time": "2026-09-15T22:37:32.106Z"
 }

package/dist/{checks-QYUPKBPT.js → checks-V442KL5O.js}

@@ -182,7 +182,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-WJFDLEAO.js');
+    const { bootTwin } = await import('./twinHarness-33MAVAXV.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-ELIEDNF3.js → chunk-4DXTT3RV.js}

@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-E7NTZL2F.js');
+      } = await import('./src-G6CMFUR6.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -63,7 +63,7 @@ var TWIN_REGISTRY = {
     parseSeed: async (input) => (await import('./seed-SYJXLGWF.js')).parseSeed(input),
     seedFields: async () => Object.keys((await import('./seed-SYJXLGWF.js')).seedSchema.shape),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-7X62AGW7.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-SJDGRXC5.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -90,8 +90,8 @@ var TWIN_REGISTRY = {
     parseSeed: async (input) => (await import('./seed-E6SA4NKZ.js')).parseSeed(input),
     seedFields: async () => Object.keys((await import('./seed-E6SA4NKZ.js')).seedSchema.shape),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-ESRY2MC7.js');
-      const { createApp } = await import('./server-KC57K5AC.js');
+      const stripeTwin = await import('./src-VBXONWR3.js');
+      const { createApp } = await import('./server-2WHSHTUD.js');
       const {
         applySeed: applyStripeSeed,
         createTwinStripeApp,
@@ -136,7 +136,7 @@ var TWIN_REGISTRY = {
     parseSeed: async (input) => (await import('./seed-W3R53GHH.js')).parseSeed(input),
     seedFields: async () => Object.keys((await import('./seed-W3R53GHH.js')).gmailSeedSchema.shape),
     async boot({ seedState, runId, recorder }) {
-      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-Z63IOSCJ.js');
+      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-DBOHIQNB.js');
       const db = openGmailTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new GmailDomain(db);
@@ -165,7 +165,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-5F5OTVYT.js');
+      } = await import('./src-FRPUTB2H.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);
@@ -181,7 +181,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-E7NTZL2F.js');
+  const { createGitHubCloneApp } = await import('./src-G6CMFUR6.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-5A6HHA54.js → chunk-64AWQJ7R.js}

@@ -1,5 +1,5 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-ELIEDNF3.js';
-import { createFileBackedRecorderStore, createRecorderStore } from './chunk-HRAD7MRX.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-4DXTT3RV.js';
+import { createFileBackedRecorderStore, createRecorderStore } from './chunk-TWURH7YM.js';
 
 // src/recorder/recorder.ts
 function createRecorder(options = {}) {

package/dist/{chunk-OBFHOACQ.js → chunk-A6AM6KS4.js}

@@ -1,11 +1,11 @@
-import { readSeedFileText, parseSeedFileText, soleTwinOf, twinsNamedBy, seedsForTwins } from './chunk-3YCX3KUL.js';
+import { readSeedFileText, parseSeedFileText, soleTwinOf, twinsNamedBy, seedsForTwins } from './chunk-GQSNU3YP.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-PASFBRK4.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-3FZY376K.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-ELIEDNF3.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-4DXTT3RV.js';
 import { criterionSchema, normalizeTaskConfigKeys, finalizeResponseSchema, MOUNTED_TWINS, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, readManifest, normalizeManifestTwins, HostedQuotaError, HostedTrialError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, agentResponseSchema, isMultiTwinSeedEnvelope, sessionPublicSchema } from './chunk-CS7O2ZXB.js';
 import { seedSchema as seedSchema$1, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-NBOQN5VX.js';
 import { seedSchema } from './chunk-YBWG5JK2.js';
-import { toTwinHttpEventRow } from './chunk-HRAD7MRX.js';
+import { toTwinHttpEventRow } from './chunk-TWURH7YM.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { seedSchema as seedSchema$2 } from './chunk-2K6BJ3PI.js';
 import { mkdir, appendFile, writeFile, readFile, rm, stat, chmod, mkdtemp, readdir, rename } from 'node:fs/promises';

package/dist/{chunk-3YCX3KUL.js → chunk-GQSNU3YP.js}

@@ -1,4 +1,4 @@
-import { isTwinName, TWIN_REGISTRY, TWIN_NAMES } from './chunk-ELIEDNF3.js';
+import { isTwinName, TWIN_REGISTRY, TWIN_NAMES } from './chunk-4DXTT3RV.js';
 import { readFileSync } from 'node:fs';
 import { parse } from 'yaml';
 

package/dist/{chunk-HRAD7MRX.js → chunk-TWURH7YM.js}

@@ -445,6 +445,7 @@ function defineTwin(spec) {
 }
 var RESERVED_SESSION_PREFIXES = ["/_pome", "/mcp"];
 var CLIENT_IP_VAR = "pomeClientIp";
+var ADMIN_NO_PEER_OPT_IN = "TWIN_ADMIN_ALLOW_NO_PEER";
 var nodeGetConnInfo;
 function loadNodeGetConnInfo() {
   nodeGetConnInfo ??= import('@hono/node-server/conninfo').then((mod) => mod.getConnInfo, () => void 0);
@@ -490,10 +491,11 @@ function createAdminGate(options = {}) {
     }
     const remote = await getClientIp(c);
     if (!remote) {
-      if (process.env.NODE_ENV === "production")
-        return forbidden();
-      await next();
-      return;
+      if (process.env[ADMIN_NO_PEER_OPT_IN] === "1") {
+        await next();
+        return;
+      }
+      return forbidden();
     }
     if (!isLoopbackAddress(remote))
       return forbidden();
@@ -503,13 +505,22 @@ function createAdminGate(options = {}) {
 
 // ../packages/sdk/dist/auth.js
 var PROVIDER_SHAPED_TEAM_ID = "provider-shaped";
+var DEV_ONLY_INSECURE_SECRET = "dev-only-insecure-secret";
+var DEV_SECRETS_OPT_IN = "POME_ALLOW_DEV_SECRETS";
 function resolveAuthSecret() {
   const secret = process.env.TWIN_AUTH_SECRET;
-  if (!secret && process.env.NODE_ENV === "production") {
-    throw new Error("TWIN_AUTH_SECRET required in production");
-  }
-  return secret ?? "dev-only-insecure-secret";
+  if (secret)
+    return secret;
+  if (process.env[DEV_SECRETS_OPT_IN] === "1")
+    return DEV_ONLY_INSECURE_SECRET;
+  throw new MissingAuthSecretError();
 }
+var MissingAuthSecretError = class extends Error {
+  constructor() {
+    super(`TWIN_AUTH_SECRET is not set. Set it, or set ${DEV_SECRETS_OPT_IN}=1 to serve the public dev secret on a twin nothing but this machine can reach.`);
+    this.name = "MissingAuthSecretError";
+  }
+};
 var SIG_LENGTH = 22;
 function mintProviderToken(spec, options) {
   const prefix = options.prefix ?? spec.prefixes[0];
@@ -674,7 +685,14 @@ function bearerAuth(options = {}) {
       }
     }
     if (options.providerToken) {
-      const providerSid = verifyProviderToken(options.providerToken, token);
+      let providerSid;
+      try {
+        providerSid = verifyProviderToken(options.providerToken, token);
+      } catch (err) {
+        if (err instanceof MissingAuthSecretError)
+          return respond(unauthorized("invalid", { token }));
+        throw err;
+      }
       if (providerSid) {
         const mismatch2 = checkSid(providerSid);
         if (mismatch2)
@@ -1281,8 +1299,14 @@ function isLoopbackHost(value) {
 function ensureTwinAuthSecret(twin, host) {
   if (process.env.TWIN_AUTH_SECRET)
     return;
-  if (isLoopbackHost(host))
+  if (isLoopbackHost(host)) {
+    if (process.env[DEV_SECRETS_OPT_IN] === "1")
+      return;
+    const secret = randomBytes(32).toString("hex");
+    process.env.TWIN_AUTH_SECRET = secret;
+    console.log(`[twin-${twin}] TWIN_AUTH_SECRET not set \u2014 generated ${secret} for this loopback boot (not persisted; set TWIN_AUTH_SECRET to choose one, or ${DEV_SECRETS_OPT_IN}=1 for the public dev secret)`);
     return;
+  }
   const dataDir = process.env.POME_TWIN_DATA_DIR || join(".pome-data", twin);
   const secretPath = join(dataDir, "secret");
   try {

package/dist/{runTrialGroup-4QL6S7QO.js → runTrialGroup-HYGGBLMM.js}

@@ -1,13 +1,13 @@
-import { runTaskHosted, createHostedClient, parseTaskFile, resolveRunAgentIdentity, outcomeOf, isNarrated, criterionPhrase, narratorReadingLines } from './chunk-OBFHOACQ.js';
-import './chunk-3YCX3KUL.js';
+import { runTaskHosted, createHostedClient, parseTaskFile, resolveRunAgentIdentity, outcomeOf, isNarrated, criterionPhrase, narratorReadingLines } from './chunk-A6AM6KS4.js';
+import './chunk-GQSNU3YP.js';
 import './chunk-NW7HGA2K.js';
 import './chunk-PASFBRK4.js';
 import './chunk-3FZY376K.js';
-import './chunk-ELIEDNF3.js';
+import './chunk-4DXTT3RV.js';
 import { HostedQuotaError, HostedTrialError } from './chunk-CS7O2ZXB.js';
 import './chunk-NBOQN5VX.js';
 import './chunk-YBWG5JK2.js';
-import './chunk-HRAD7MRX.js';
+import './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-2K6BJ3PI.js';

package/dist/{server-KC57K5AC.js → server-2WHSHTUD.js}

@@ -1,4 +1,4 @@
-export { POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-HRAD7MRX.js';
+export { POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 export { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 export { FAILURE_INJECTION_OVERRIDE_KEY, createFailureInjectionStore, failureInjectionRuleSchema } from './chunk-FBSA5L36.js';

package/dist/src/cli/main.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, SESSION_TWIN_NAMES, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, parseTaskFile, runTaskHosted, scoreStatus, runScoreLine, narratorReadingLines, readLatestRun, readMetaSummary, discoverRunSet, outcomeOf, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, readConfigTwins, resolveCachedAgentId, readLinkCache, seedStateForTwin, runAgentCommand, scoreCountsSummary, criterionRowLine, readCodeCriteria, postAgentResolver, writeLinkCache, ensurePomeGitignored, writeRunArtifactsCore, createHostedClient, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-OBFHOACQ.js';
-import '../../chunk-3YCX3KUL.js';
+import { DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL, clearLocalCredentials, friendlyHostedError, SESSION_TWIN_NAMES, runSessionCreate, runSessionList, runSessionStop, resolveCredentials, parseTaskFile, runTaskHosted, scoreStatus, runScoreLine, narratorReadingLines, readLatestRun, readMetaSummary, discoverRunSet, outcomeOf, persistCredentialsAfterLogin, DEFAULT_DOCS_SITE_ORIGIN, resolveSeams, readConfigTwins, resolveCachedAgentId, readLinkCache, seedStateForTwin, runAgentCommand, scoreCountsSummary, criterionRowLine, readCodeCriteria, postAgentResolver, writeLinkCache, ensurePomeGitignored, writeRunArtifactsCore, createHostedClient, redactJsonl, scoreFromFinalizeResponse, parseGitHubSeedState, uploadRunBlobs, isPreSatisfied } from '../../chunk-A6AM6KS4.js';
+import '../../chunk-GQSNU3YP.js';
 import '../../chunk-NW7HGA2K.js';
 import { GMAIL_CHECKS } from '../../chunk-JM6VS62R.js';
 import '../../chunk-PASFBRK4.js';
 import { LINEAR_CHECKS } from '../../chunk-TSOSDKXP.js';
 import '../../chunk-3FZY376K.js';
-import { createRecorder, bootTwin } from '../../chunk-5A6HHA54.js';
-import { TWIN_NAME_LIST, TWIN_REGISTRY, createGitHubSmokeApp } from '../../chunk-ELIEDNF3.js';
+import { createRecorder, bootTwin } from '../../chunk-64AWQJ7R.js';
+import { TWIN_NAME_LIST, TWIN_REGISTRY, createGitHubSmokeApp } from '../../chunk-4DXTT3RV.js';
 import { getAvailablePort } from '../../chunk-XDU6TD4O.js';
 import { MOUNTED_TWINS, readManifest, deriveAgentSlug, writeManifest, MANIFEST_JSON, exitCodeFor, readRequiredManifest, HostedUsageError, HostedOrchError, normalizeManifestTwins } from '../../chunk-CS7O2ZXB.js';
 import { buildEgressAllowlist, readBlockedEgress } from '../../chunk-CBFKZZBR.js';
@@ -16,7 +16,7 @@ import { seedSchema } from '../../chunk-NBOQN5VX.js';
 import { SLACK_CHECKS } from '../../chunk-2ZGVDTJC.js';
 import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath, templateSlots, renderCheck, checksDigest, checkPattern, checkNearMissPattern } from '../../chunk-JWJYNAWI.js';
 import '../../chunk-YBWG5JK2.js';
-import '../../chunk-HRAD7MRX.js';
+import '../../chunk-TWURH7YM.js';
 import { eventSchema, isLegacyEventRow } from '../../chunk-5KFDRR53.js';
 import { redactSecrets, redactEvent } from '../../chunk-SG6ZTIMT.js';
 import '../../chunk-2K6BJ3PI.js';
@@ -1187,7 +1187,7 @@ function extractJsonPayload(text) {
 
 // src/task/seed-verifier.ts
 async function verifySeedWithTwin(seed) {
-  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-E7NTZL2F.js');
+  const { GitHubDomain, openGitHubCloneDatabase } = await import('../../src-G6CMFUR6.js');
   const db = openGitHubCloneDatabase(":memory:");
   try {
     new GitHubDomain(db).seed(seed);
@@ -3395,7 +3395,7 @@ function localDigest(twin) {
 }
 function bakedVersions() {
   try {
-    return JSON.parse('{"@pome-sh/sdk":"0.11.6","@pome-sh/wire":"0.4.1","@pome-sh/twin-github":"0.12.0","@pome-sh/twin-gmail":"0.4.0","@pome-sh/twin-linear":"0.4.1","@pome-sh/twin-slack":"0.4.1","@pome-sh/twin-stripe":"0.4.7"}');
+    return JSON.parse('{"@pome-sh/sdk":"0.11.6","@pome-sh/wire":"0.4.2","@pome-sh/twin-github":"0.12.0","@pome-sh/twin-gmail":"0.4.0","@pome-sh/twin-linear":"0.4.1","@pome-sh/twin-slack":"0.4.1","@pome-sh/twin-stripe":"0.4.7"}');
   } catch {
     return {};
   }
@@ -4961,7 +4961,7 @@ function firstSentence(description) {
 function resolveExampleRef(env = process.env) {
   const override = env.POME_EXAMPLE_REF?.trim();
   if (override) return override;
-  const baked = "589885b59adab9a5fded977620a6adc25125da85".trim() ;
+  const baked = "aa6e8ff0d76f2bfbdd8c01e72239431644cb849a".trim() ;
   return FULL_SHA.test(baked) ? baked : "main";
 }
 function rawUrlFor(example, file, ref) {
@@ -5324,7 +5324,7 @@ var DEFAULT_AGENT_COMMAND = `node ${DEFAULT_AGENT_FILE}`;
 var MANIFEST_SCHEMA_URL = "https://pome.sh/schemas/v1/pome.json";
 var MAX_UNREADABLE_PATHS_SHOWN = 5;
 function readPackageVersion() {
-  if ("0.43.0".length > 0) return "0.43.0";
+  if ("0.43.1".length > 0) return "0.43.1";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
@@ -5728,7 +5728,7 @@ function createProgram() {
         return;
       }
       {
-        const { runDoctorChecks } = await import('../../checks-QYUPKBPT.js');
+        const { runDoctorChecks } = await import('../../checks-V442KL5O.js');
         const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
         const doctorReport = await runDoctorChecks({ mode: useLocal ? "full" : "hosted" });
         if (!doctorReport.ok) {
@@ -5766,7 +5766,7 @@ function createProgram() {
               taskForRuns.config.runs
             );
             if (k > 1) {
-              const { runTrialGroup } = await import('../../runTrialGroup-4QL6S7QO.js');
+              const { runTrialGroup } = await import('../../runTrialGroup-HYGGBLMM.js');
               const fileForRerun = relative(process.cwd(), file);
               const rerunCommand = defaultTask ? options.trials !== void 0 ? `pome run -n ${k}` : "pome run" : `pome run ${fileForRerun && !fileForRerun.startsWith("..") ? fileForRerun : file} -n ${k}`;
               const groupResult = await runTrialGroup({
@@ -5848,7 +5848,7 @@ function createProgram() {
   program.command("doctor").summary("Check the agent and twin wiring").description(
     "Check the agent\u2194twin wiring: pome.json (or pome.yaml) present + valid, the local twin boots + serves, requests routed to the twin (not a hardcoded production host), egress floor active. On failure prints one named cause (file:line where knowable) + one concrete fix and exits non-zero."
   ).action(async () => {
-    const { runDoctorChecks } = await import('../../checks-QYUPKBPT.js');
+    const { runDoctorChecks } = await import('../../checks-V442KL5O.js');
     const { renderDoctorReport } = await import('../../render-ZQQ4UMNO.js');
     const report = await runDoctorChecks();
     for (const line of renderDoctorReport(report, { passNote: true })) console.error(line);
@@ -6016,13 +6016,13 @@ function createProgram() {
   ).description(
     "Start a standalone twin as a long-lived foreground server (Ctrl-C to stop)"
   ).action(async (name, options) => {
-    const { runTwinStartCommand } = await import('../../twinStart-QQ64EV3P.js');
+    const { runTwinStartCommand } = await import('../../twinStart-3Q74IURZ.js');
     await runTwinStartCommand(name, options);
   });
   twin.command("new-seed").argument("<name...>", `Twin name (${TWIN_NAME_LIST.join(" | ")}). Repeat for one file covering several.`).option("--out <path>", "Write to this file instead of stdout. Refuses to overwrite.").summary("Print a new starter seed file for a twin").description(
     "Print a new starter seed file for a twin, generated from the twin's own starting state. One twin is flat, several are the per-twin envelope. Boot it with `twin start <twin> --seed`, seed a sandbox with `sandbox create --twin <twin> --seed`, or drop it beside a task as <task>.seed.json"
   ).action(async (names, options) => {
-    const { runTwinSeedCommand } = await import('../../twinSeed-4VQ7RRCL.js');
+    const { runTwinSeedCommand } = await import('../../twinSeed-J7UAY3GM.js');
     await runTwinSeedCommand(names, options);
   });
   twin.command("status").summary("Say whether the local twin is running").description(

package/dist/{src-Z63IOSCJ.js → src-DBOHIQNB.js}

@@ -3,7 +3,7 @@ import { gmailErrorEnvelope, gmailSeedSchema, parseSeed, defaultSeedState, notFo
 export { DEFAULT_GMAIL_AGENT_EMAIL, GmailError, SEARCH_MAILBOX_MESSAGE_BUDGET, agentPathInboxMailbox, defaultSeedState, gmailErrorEnvelope, gmailSeedSchema, loadSeedFromEnv, parseSearchQuery, parseSeed, validateSearchQuery } from './chunk-PASFBRK4.js';
 import './chunk-JWJYNAWI.js';
 import { routeInputDeclarer, integerInput, booleanInput, repeatedInput, mountDeclaredRoute, UndeclaredInputError, MalformedBodyError } from './chunk-IZFM7W2V.js';
-import { loadMcpToolFixture, deriveMcpToolTable, defineTwin, openTwinDatabase, createApp } from './chunk-HRAD7MRX.js';
+import { loadMcpToolFixture, deriveMcpToolTable, defineTwin, openTwinDatabase, createApp } from './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-FBSA5L36.js';

package/dist/{src-5F5OTVYT.js → src-FRPUTB2H.js}

@@ -3,7 +3,7 @@ import { MCP_PAGE_MAX, defaultSeedState, linearSeedSchema, notFound, badUserInpu
 export { DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, STATE_EXPORT_CAP, assertWebhookUrl, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError } from './chunk-3FZY376K.js';
 import './chunk-JWJYNAWI.js';
 import { routeInputDeclarer, mountDeclaredRoute, UndeclaredInputError } from './chunk-IZFM7W2V.js';
-import { loadMcpToolFixture, deriveMcpToolTable, openTwinDatabase, defineTwin, createApp } from './chunk-HRAD7MRX.js';
+import { loadMcpToolFixture, deriveMcpToolTable, openTwinDatabase, defineTwin, createApp } from './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-FBSA5L36.js';

package/dist/{src-E7NTZL2F.js → src-G6CMFUR6.js}

@@ -2,7 +2,7 @@ import './chunk-C4BVTUA3.js';
 import { defaultSeedState, parseSeed } from './chunk-NBOQN5VX.js';
 export { defaultSeedState, parseSeed, seedSchema } from './chunk-NBOQN5VX.js';
 import { routeInputDeclarer, integerInput, mountDeclaredRoute, UndeclaredInputError, MalformedBodyError } from './chunk-IZFM7W2V.js';
-import { loadMcpToolFixture, defineTwin, twinBuildInfo, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp, typeDisagreements } from './chunk-HRAD7MRX.js';
+import { loadMcpToolFixture, defineTwin, twinBuildInfo, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp, typeDisagreements } from './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-FBSA5L36.js';

package/dist/{src-7X62AGW7.js → src-SJDGRXC5.js}

@@ -3,7 +3,7 @@ import './chunk-JWJYNAWI.js';
 import { defaultSeedState, parseSeed } from './chunk-YBWG5JK2.js';
 export { defaultSeedState, loadSeedFromEnv, parseSeed, seedSchema } from './chunk-YBWG5JK2.js';
 import { routeInputDeclarer, booleanInput, integerInput, mountDeclaredRoute, UndeclaredInputError } from './chunk-IZFM7W2V.js';
-import { loadMcpToolFixture, defineTwin, queryTokenResolver, formTokenResolver, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp, typeDisagreements } from './chunk-HRAD7MRX.js';
+import { loadMcpToolFixture, defineTwin, queryTokenResolver, formTokenResolver, deriveMcpToolTable, UnknownToolError, openTwinDatabase, createApp, typeDisagreements } from './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-FBSA5L36.js';

package/dist/{src-ESRY2MC7.js → src-VBXONWR3.js}

@@ -1,5 +1,5 @@
 import { routeInputDeclarer, bracketedQuery, integerInput, booleanInput, mountDeclaredRoute, UndeclaredInputError } from './chunk-IZFM7W2V.js';
-import { loadMcpToolFixture, openTwinDatabase, defineTwin, twinBuildInfo, deriveMcpToolTable, failureInjectionMiddleware, createApp, recordedRequestHeaders, UnknownToolError } from './chunk-HRAD7MRX.js';
+import { loadMcpToolFixture, openTwinDatabase, defineTwin, twinBuildInfo, deriveMcpToolTable, failureInjectionMiddleware, createApp, recordedRequestHeaders, UnknownToolError } from './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import { defaultSeed, seedSchema } from './chunk-2K6BJ3PI.js';

package/dist/twinHarness-33MAVAXV.js

@@ -0,0 +1,6 @@
+export { UnsupportedTwinError, bootTwin } from './chunk-64AWQJ7R.js';
+export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-4DXTT3RV.js';
+import './chunk-TWURH7YM.js';
+import './chunk-5KFDRR53.js';
+import './chunk-SG6ZTIMT.js';
+import './chunk-FBSA5L36.js';

package/dist/{twinSeed-4VQ7RRCL.js → twinSeed-J7UAY3GM.js}

@@ -1,4 +1,4 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-ELIEDNF3.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-4DXTT3RV.js';
 import { writeFile } from 'node:fs/promises';
 
 async function generateSeedFile(twins) {

package/dist/{twinStart-QQ64EV3P.js → twinStart-3Q74IURZ.js}

@@ -1,18 +1,24 @@
-import { readSeedFileText, seedForTwin, parseSeedFileText, soleTwinOf, twinsNamedBy } from './chunk-3YCX3KUL.js';
-import { bootTwin } from './chunk-5A6HHA54.js';
-import { TWIN_REGISTRY, isTwinName, TWIN_NAMES, defaultPortFor } from './chunk-ELIEDNF3.js';
-import './chunk-HRAD7MRX.js';
+import { readSeedFileText, seedForTwin, parseSeedFileText, soleTwinOf, twinsNamedBy } from './chunk-GQSNU3YP.js';
+import { bootTwin } from './chunk-64AWQJ7R.js';
+import { TWIN_REGISTRY, isTwinName, TWIN_NAMES, defaultPortFor } from './chunk-4DXTT3RV.js';
+import './chunk-TWURH7YM.js';
 import './chunk-5KFDRR53.js';
 import './chunk-SG6ZTIMT.js';
 import './chunk-FBSA5L36.js';
 import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { mkdir, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { mkdir, writeFile, chmod } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
 import { serve } from '@hono/node-server';
 import { sign } from 'hono/jwt';
 
 var STANDALONE_SID = "standalone";
+var STANDALONE_STATUS_PATH = ".pome/twin-status.json";
+async function writeStandaloneStatusFile(status, path = STANDALONE_STATUS_PATH) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, JSON.stringify(status, null, 2), { mode: 384 });
+  await chmod(path, 384);
+}
 function resolveStandaloneAuthSecret(twin, env = process.env) {
   const injected = env.TWIN_AUTH_SECRET;
   if (injected) return { secret: injected, source: "env" };
@@ -129,15 +135,13 @@ async function runTwinStartCommand(nameArg, options) {
         resolve();
       });
     });
-    await mkdir(".pome", { recursive: true });
-    await writeFile(
-      ".pome/twin-status.json",
-      JSON.stringify(
-        { name, url: restUrl, rest_url: restUrl, mcp_url: mcpUrl, auth_token: token },
-        null,
-        2
-      )
-    );
+    await writeStandaloneStatusFile({
+      name,
+      url: restUrl,
+      rest_url: restUrl,
+      mcp_url: mcpUrl,
+      auth_token: token
+    });
   } catch (err) {
     await new Promise((resolve) => server.close(() => resolve()));
     await harness.close();
@@ -180,4 +184,4 @@ async function runTwinStartCommand(nameArg, options) {
   process.once("SIGTERM", shutdown);
 }
 
-export { resolveStandaloneAuthSecret, resolveStandaloneSeed, resolveStandaloneTwin, runTwinStartCommand };
+export { STANDALONE_STATUS_PATH, resolveStandaloneAuthSecret, resolveStandaloneSeed, resolveStandaloneTwin, runTwinStartCommand, writeStandaloneStatusFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.43.0",
+  "version": "0.43.1",
   "description": "Test AI agents against digital twins of real SaaS APIs. Records tool-call traces and scores them on pome.sh.",
   "keywords": [
     "ai",

package/dist/twinHarness-WJFDLEAO.js

@@ -1,6 +0,0 @@
-export { UnsupportedTwinError, bootTwin } from './chunk-5A6HHA54.js';
-export { STRIPE_LOCAL_ACCOUNT_ID } from './chunk-ELIEDNF3.js';
-import './chunk-HRAD7MRX.js';
-import './chunk-5KFDRR53.js';
-import './chunk-SG6ZTIMT.js';
-import './chunk-FBSA5L36.js';