@bilalimamoglu/sift 0.2.0 → 0.2.2

package/dist/cli.js

@@ -13,12 +13,17 @@ import YAML from "yaml";
 import os from "os";
 import path from "path";
 var DEFAULT_CONFIG_FILENAME = "sift.config.yaml";
-var DEFAULT_CONFIG_SEARCH_PATHS = [
-  path.resolve(process.cwd(), "sift.config.yaml"),
-  path.resolve(process.cwd(), "sift.config.yml"),
-  path.join(os.homedir(), ".config", "sift", "config.yaml"),
-  path.join(os.homedir(), ".config", "sift", "config.yml")
-];
+function getDefaultGlobalConfigPath() {
+  return path.join(os.homedir(), ".config", "sift", "config.yaml");
+}
+function getDefaultConfigSearchPaths() {
+  return [
+    path.resolve(process.cwd(), "sift.config.yaml"),
+    path.resolve(process.cwd(), "sift.config.yml"),
+    getDefaultGlobalConfigPath(),
+    path.join(os.homedir(), ".config", "sift", "config.yml")
+  ];
+}
 var INSUFFICIENT_SIGNAL_TEXT = "Insufficient signal in the provided input.";
 var GENERIC_JSON_CONTRACT = '{"answer":string,"evidence":string[],"risks":string[]}';
 var CAPTURE_OMITTED_MARKER = "\n...[captured output omitted]...\n";
@@ -32,7 +37,7 @@ function findConfigPath(explicitPath) {
     }
     return resolved;
   }
-  for (const candidate of DEFAULT_CONFIG_SEARCH_PATHS) {
+  for (const candidate of getDefaultConfigSearchPaths()) {
     if (fs.existsSync(candidate)) {
       return candidate;
     }
@@ -51,23 +56,23 @@ function loadRawConfig(explicitPath) {
 // src/config/defaults.ts
 var defaultConfig = {
   provider: {
-    provider: "openai-compatible",
-    model: "gpt-4.1-mini",
+    provider: "openai",
+    model: "gpt-5-nano",
     baseUrl: "https://api.openai.com/v1",
     apiKey: "",
     jsonResponseFormat: "auto",
     timeoutMs: 2e4,
     temperature: 0.1,
-    maxOutputTokens: 220
+    maxOutputTokens: 400
   },
   input: {
     stripAnsi: true,
     redact: false,
     redactStrict: false,
-    maxCaptureChars: 25e4,
-    maxInputChars: 2e4,
-    headChars: 6e3,
-    tailChars: 6e3
+    maxCaptureChars: 4e5,
+    maxInputChars: 6e4,
+    headChars: 2e4,
+    tailChars: 2e4
   },
   runtime: {
     rawFallback: true,
@@ -101,6 +106,16 @@ var defaultConfig = {
       format: "bullets",
       policy: "log-errors"
     },
+    "typecheck-summary": {
+      question: "Summarize the blocking typecheck failures. Group repeated errors by root cause and point to the first files or symbols to fix.",
+      format: "bullets",
+      policy: "typecheck-summary"
+    },
+    "lint-failures": {
+      question: "Summarize the blocking lint failures. Group repeated rules, highlight the top offending files, and call out only failures that matter for fixing the run.",
+      format: "bullets",
+      policy: "lint-failures"
+    },
     "infra-risk": {
       question: "Assess whether the infrastructure changes are risky and whether they look safe to apply.",
       format: "verdict",
@@ -141,18 +156,21 @@ function resolveCompatibleEnvName(baseUrl) {
   return match?.envName;
 }
 function resolveProviderApiKey(provider, baseUrl, env) {
-  if (env.SIFT_PROVIDER_API_KEY) {
-    return env.SIFT_PROVIDER_API_KEY;
-  }
   if (provider === "openai-compatible") {
+    if (env.SIFT_PROVIDER_API_KEY) {
+      return env.SIFT_PROVIDER_API_KEY;
+    }
     const envName2 = resolveCompatibleEnvName(baseUrl);
     return envName2 ? env[envName2] : void 0;
   }
   if (!provider) {
-    return void 0;
+    return env.SIFT_PROVIDER_API_KEY;
   }
   const envName = PROVIDER_API_KEY_ENV[provider];
-  return envName ? env[envName] : void 0;
+  if (envName && env[envName]) {
+    return env[envName];
+  }
+  return env.SIFT_PROVIDER_API_KEY;
 }
 function getProviderApiKeyEnvNames(provider, baseUrl) {
   const envNames = ["SIFT_PROVIDER_API_KEY"];
@@ -168,14 +186,14 @@ function getProviderApiKeyEnvNames(provider, baseUrl) {
   }
   const envName = PROVIDER_API_KEY_ENV[provider];
   if (envName) {
-    envNames.push(envName);
+    return [envName, ...envNames];
   }
   return envNames;
 }
 
 // src/config/schema.ts
 import { z } from "zod";
-var providerNameSchema = z.enum(["openai-compatible"]);
+var providerNameSchema = z.enum(["openai", "openai-compatible"]);
 var outputFormatSchema = z.enum([
   "brief",
   "bullets",
@@ -190,7 +208,9 @@ var promptPolicyNameSchema = z.enum([
   "diff-summary",
   "build-failure",
   "log-errors",
-  "infra-risk"
+  "infra-risk",
+  "typecheck-summary",
+  "lint-failures"
 ]);
 var providerConfigSchema = z.object({
   provider: providerNameSchema,
@@ -324,8 +344,11 @@ function resolveConfig(options = {}) {
 import fs2 from "fs";
 import path3 from "path";
 import YAML2 from "yaml";
-function writeExampleConfig(targetPath) {
-  const resolved = path3.resolve(targetPath ?? DEFAULT_CONFIG_FILENAME);
+function writeExampleConfig(options = {}) {
+  if (options.global && options.targetPath) {
+    throw new Error("Use either --path <path> or --global, not both.");
+  }
+  const resolved = options.global ? getDefaultGlobalConfigPath() : path3.resolve(options.targetPath ?? DEFAULT_CONFIG_FILENAME);
   if (fs2.existsSync(resolved)) {
     throw new Error(`Config file already exists at ${resolved}`);
   }
@@ -334,6 +357,226 @@ function writeExampleConfig(targetPath) {
   fs2.writeFileSync(resolved, yaml, "utf8");
   return resolved;
 }
+function writeConfigFile(options) {
+  const resolved = path3.resolve(options.targetPath);
+  if (!options.overwrite && fs2.existsSync(resolved)) {
+    throw new Error(`Config file already exists at ${resolved}`);
+  }
+  const yaml = YAML2.stringify(options.config);
+  fs2.mkdirSync(path3.dirname(resolved), { recursive: true });
+  fs2.writeFileSync(resolved, yaml, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    fs2.chmodSync(resolved, 384);
+  } catch {
+  }
+  return resolved;
+}
+
+// src/commands/config-setup.ts
+import fs3 from "fs";
+import path4 from "path";
+import { createInterface } from "readline/promises";
+import { clearLine, cursorTo, emitKeypressEvents, moveCursor } from "readline";
+import { stdin as defaultStdin, stdout as defaultStdout, stderr as defaultStderr } from "process";
+function createTerminalIO() {
+  let rl;
+  function getInterface() {
+    if (!rl) {
+      rl = createInterface({
+        input: defaultStdin,
+        output: defaultStdout,
+        terminal: true
+      });
+    }
+    return rl;
+  }
+  async function select(prompt, options) {
+    const input = defaultStdin;
+    const output = defaultStdout;
+    const promptLine = `${prompt} (use \u2191/\u2193 and Enter)`;
+    let index = 0;
+    const lineCount = options.length + 1;
+    emitKeypressEvents(input);
+    input.resume();
+    const wasRaw = input.isTTY ? input.isRaw : false;
+    input.setRawMode?.(true);
+    const render = () => {
+      cursorTo(output, 0);
+      clearLine(output, 0);
+      output.write(`${promptLine}
+`);
+      for (let optionIndex = 0; optionIndex < options.length; optionIndex += 1) {
+        clearLine(output, 0);
+        output.write(`${optionIndex === index ? "\u203A" : " "} ${options[optionIndex]}
+`);
+      }
+      moveCursor(output, 0, -lineCount);
+    };
+    render();
+    return await new Promise((resolve, reject) => {
+      const onKeypress = (_value, key) => {
+        if (key.ctrl && key.name === "c") {
+          cleanup();
+          reject(new Error("Aborted."));
+          return;
+        }
+        if (key.name === "up") {
+          index = index === 0 ? options.length - 1 : index - 1;
+          render();
+          return;
+        }
+        if (key.name === "down") {
+          index = (index + 1) % options.length;
+          render();
+          return;
+        }
+        if (key.name === "return" || key.name === "enter") {
+          const selected = options[index] ?? options[0];
+          cleanup();
+          resolve(selected ?? "OpenAI");
+        }
+      };
+      const cleanup = () => {
+        input.off("keypress", onKeypress);
+        moveCursor(output, 0, lineCount);
+        cursorTo(output, 0);
+        clearLine(output, 0);
+        output.write("\n");
+        input.setRawMode?.(Boolean(wasRaw));
+      };
+      input.on("keypress", onKeypress);
+    });
+  }
+  return {
+    stdinIsTTY: Boolean(defaultStdin.isTTY),
+    stdoutIsTTY: Boolean(defaultStdout.isTTY),
+    ask(prompt) {
+      return getInterface().question(prompt);
+    },
+    select,
+    write(message) {
+      defaultStdout.write(message);
+    },
+    error(message) {
+      defaultStderr.write(message);
+    },
+    close() {
+      rl?.close();
+    }
+  };
+}
+function resolveSetupPath(targetPath) {
+  return targetPath ? path4.resolve(targetPath) : getDefaultGlobalConfigPath();
+}
+function buildOpenAISetupConfig(apiKey) {
+  return {
+    ...defaultConfig,
+    provider: {
+      ...defaultConfig.provider,
+      provider: "openai",
+      model: "gpt-5-nano",
+      baseUrl: "https://api.openai.com/v1",
+      apiKey
+    }
+  };
+}
+async function promptForProvider(io) {
+  if (io.select) {
+    const choice = await io.select("Select provider", ["OpenAI"]);
+    if (choice === "OpenAI") {
+      return "openai";
+    }
+  }
+  while (true) {
+    const answer = (await io.ask("Provider [OpenAI]: ")).trim().toLowerCase();
+    if (answer === "" || answer === "openai") {
+      return "openai";
+    }
+    io.error("Only OpenAI is supported in guided setup right now.\n");
+  }
+}
+async function promptForApiKey(io) {
+  while (true) {
+    const answer = (await io.ask("Enter your OpenAI API key: ")).trim();
+    if (answer.length > 0) {
+      return answer;
+    }
+    io.error("API key cannot be empty.\n");
+  }
+}
+async function promptForOverwrite(io, targetPath) {
+  while (true) {
+    const answer = (await io.ask(
+      `Config file already exists at ${targetPath}. Overwrite? [y/N]: `
+    )).trim().toLowerCase();
+    if (answer === "" || answer === "n" || answer === "no") {
+      return false;
+    }
+    if (answer === "y" || answer === "yes") {
+      return true;
+    }
+    io.error("Please answer y or n.\n");
+  }
+}
+async function configSetup(options = {}) {
+  void options.global;
+  const io = options.io ?? createTerminalIO();
+  try {
+    if (!io.stdinIsTTY || !io.stdoutIsTTY) {
+      io.error(
+        "sift config setup is interactive and requires a TTY. Use 'sift config init --global' for a non-interactive template.\n"
+      );
+      return 1;
+    }
+    const resolvedPath = resolveSetupPath(options.targetPath);
+    if (fs3.existsSync(resolvedPath)) {
+      const shouldOverwrite = await promptForOverwrite(io, resolvedPath);
+      if (!shouldOverwrite) {
+        io.write("Aborted.\n");
+        return 1;
+      }
+    }
+    const provider = await promptForProvider(io);
+    if (provider !== "openai") {
+      io.error("Unsupported provider selection.\n");
+      return 1;
+    }
+    io.write("Using OpenAI defaults.\n");
+    io.write("Default model: gpt-5-nano\n");
+    io.write("Default base URL: https://api.openai.com/v1\n");
+    io.write(
+      "You can change these later by editing the config file or running 'sift config show --show-secrets'.\n"
+    );
+    const apiKey = await promptForApiKey(io);
+    const config = buildOpenAISetupConfig(apiKey);
+    const writtenPath = writeConfigFile({
+      targetPath: resolvedPath,
+      config,
+      overwrite: true
+    });
+    io.write(`Wrote ${writtenPath}
+`);
+    io.write(
+      "This is your machine-wide default config. Repo-local sift.config.yaml can still override it later.\n"
+    );
+    const activeConfigPath = findConfigPath();
+    if (activeConfigPath && path4.resolve(activeConfigPath) !== path4.resolve(writtenPath)) {
+      io.write(
+        `Note: ${activeConfigPath} currently overrides this machine-wide config in the current directory.
+`
+      );
+    }
+    io.write("Try:\n");
+    io.write("  sift doctor\n");
+    io.write("  sift exec --preset test-status -- pytest\n");
+    return 0;
+  } finally {
+    io.close?.();
+  }
+}
 
 // src/commands/config.ts
 var MASKED_SECRET = "***";
@@ -354,9 +597,12 @@ function maskConfigSecrets(value) {
   }
   return output;
 }
-function configInit(targetPath) {
-  const path4 = writeExampleConfig(targetPath);
-  process.stdout.write(`${path4}
+function configInit(targetPath, global = false) {
+  const path5 = writeExampleConfig({
+    targetPath,
+    global
+  });
+  process.stdout.write(`${path5}
 `);
 }
 function configShow(configPath, showSecrets = false) {
@@ -381,10 +627,11 @@ function configValidate(configPath) {
 }
 
 // src/commands/doctor.ts
-function runDoctor(config) {
+function runDoctor(config, configPath) {
   const lines = [
     "sift doctor",
     "mode: local config completeness check",
+    `configPath: ${configPath ?? "(defaults only)"}`,
     `provider: ${config.provider.provider}`,
     `model: ${config.provider.model}`,
     `baseUrl: ${config.provider.baseUrl}`,
@@ -402,7 +649,7 @@ function runDoctor(config) {
   if (!config.provider.model) {
     problems.push("Missing provider.model");
   }
-  if (config.provider.provider === "openai-compatible" && !config.provider.apiKey) {
+  if ((config.provider.provider === "openai" || config.provider.provider === "openai-compatible") && !config.provider.apiKey) {
     problems.push("Missing provider.apiKey");
     problems.push(
       `Set one of: ${getProviderApiKeyEnvNames(
@@ -444,9 +691,150 @@ import { spawn } from "child_process";
 import { constants as osConstants } from "os";
 import pc2 from "picocolors";
 
+// src/core/gate.ts
+var FAIL_ON_SUPPORTED_PRESETS = /* @__PURE__ */ new Set(["infra-risk", "audit-critical"]);
+function parseJson(output) {
+  try {
+    return JSON.parse(output);
+  } catch {
+    return null;
+  }
+}
+function supportsFailOnPreset(presetName) {
+  return typeof presetName === "string" && FAIL_ON_SUPPORTED_PRESETS.has(presetName);
+}
+function assertSupportedFailOnPreset(presetName) {
+  if (!supportsFailOnPreset(presetName)) {
+    throw new Error(
+      "--fail-on is supported only for built-in presets: infra-risk, audit-critical."
+    );
+  }
+}
+function assertSupportedFailOnFormat(args) {
+  const expectedFormat = args.presetName === "infra-risk" ? "verdict" : "json";
+  if (args.format !== expectedFormat) {
+    throw new Error(
+      `--fail-on requires the default ${expectedFormat} format for preset ${args.presetName}.`
+    );
+  }
+}
+function evaluateGate(args) {
+  const parsed = parseJson(args.output);
+  if (!parsed || typeof parsed !== "object") {
+    return { shouldFail: false };
+  }
+  if (args.presetName === "infra-risk") {
+    return {
+      shouldFail: parsed["verdict"] === "fail"
+    };
+  }
+  if (args.presetName === "audit-critical") {
+    const status = parsed["status"];
+    const vulnerabilities = parsed["vulnerabilities"];
+    return {
+      shouldFail: status === "ok" && Array.isArray(vulnerabilities) && vulnerabilities.length > 0
+    };
+  }
+  return { shouldFail: false };
+}
+
 // src/core/run.ts
 import pc from "picocolors";
 
+// src/providers/systemInstruction.ts
+var REDUCTION_SYSTEM_INSTRUCTION = "You reduce noisy command output into compact answers for agents and automation.";
+
+// src/providers/openai.ts
+function usesNativeJsonResponseFormat(mode) {
+  return mode !== "off";
+}
+function extractResponseText(payload) {
+  if (typeof payload?.output_text === "string") {
+    return payload.output_text.trim();
+  }
+  if (!Array.isArray(payload?.output)) {
+    return "";
+  }
+  return payload.output.flatMap((item) => Array.isArray(item?.content) ? item.content : []).map((item) => item?.type === "output_text" ? item.text : "").filter((text) => typeof text === "string" && text.trim().length > 0).join("").trim();
+}
+async function buildOpenAIError(response) {
+  let detail = `Provider returned HTTP ${response.status}`;
+  try {
+    const data = await response.json();
+    const message = data?.error?.message;
+    if (typeof message === "string" && message.trim().length > 0) {
+      detail = `${detail}: ${message.trim()}`;
+    }
+  } catch {
+  }
+  return new Error(detail);
+}
+var OpenAIProvider = class {
+  name = "openai";
+  baseUrl;
+  apiKey;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.apiKey = options.apiKey;
+  }
+  async generate(input) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), input.timeoutMs);
+    try {
+      const url = new URL("responses", `${this.baseUrl}/`);
+      const response = await fetch(url, {
+        method: "POST",
+        signal: controller.signal,
+        headers: {
+          "content-type": "application/json",
+          ...this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}
+        },
+        body: JSON.stringify({
+          model: input.model,
+          instructions: REDUCTION_SYSTEM_INSTRUCTION,
+          input: input.prompt,
+          reasoning: {
+            effort: "minimal"
+          },
+          text: {
+            verbosity: "low",
+            ...input.responseMode === "json" && usesNativeJsonResponseFormat(input.jsonResponseFormat) ? {
+              format: {
+                type: "json_object"
+              }
+            } : {}
+          },
+          max_output_tokens: input.maxOutputTokens
+        })
+      });
+      if (!response.ok) {
+        throw await buildOpenAIError(response);
+      }
+      const data = await response.json();
+      const text = extractResponseText(data);
+      if (!text) {
+        throw new Error("Provider returned an empty response");
+      }
+      return {
+        text,
+        usage: data?.usage ? {
+          inputTokens: data.usage.input_tokens,
+          outputTokens: data.usage.output_tokens,
+          totalTokens: data.usage.total_tokens
+        } : void 0,
+        raw: data
+      };
+    } catch (error) {
+      if (error.name === "AbortError") {
+        throw new Error("Provider request timed out");
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+};
+
 // src/providers/openaiCompatible.ts
 function supportsNativeJsonResponseFormat(baseUrl, mode) {
   if (mode === "off") {
@@ -467,6 +855,18 @@ function extractMessageText(payload) {
   }
   return "";
 }
+async function buildOpenAICompatibleError(response) {
+  let detail = `Provider returned HTTP ${response.status}`;
+  try {
+    const data = await response.json();
+    const message = data?.error?.message;
+    if (typeof message === "string" && message.trim().length > 0) {
+      detail = `${detail}: ${message.trim()}`;
+    }
+  } catch {
+  }
+  return new Error(detail);
+}
 var OpenAICompatibleProvider = class {
   name = "openai-compatible";
   baseUrl;
@@ -495,7 +895,7 @@ var OpenAICompatibleProvider = class {
           messages: [
             {
               role: "system",
-              content: "You reduce noisy command output into compact answers for agents and automation."
+              content: REDUCTION_SYSTEM_INSTRUCTION
             },
             {
               role: "user",
@@ -505,7 +905,7 @@ var OpenAICompatibleProvider = class {
         })
       });
       if (!response.ok) {
-        throw new Error(`Provider returned HTTP ${response.status}`);
+        throw await buildOpenAICompatibleError(response);
       }
       const data = await response.json();
       const text = extractMessageText(data);
@@ -534,6 +934,12 @@ var OpenAICompatibleProvider = class {
 
 // src/providers/factory.ts
 function createProvider(config) {
+  if (config.provider.provider === "openai") {
+    return new OpenAIProvider({
+      baseUrl: config.provider.baseUrl,
+      apiKey: config.provider.apiKey
+    });
+  }
   if (config.provider.provider === "openai-compatible") {
     return new OpenAICompatibleProvider({
       baseUrl: config.provider.baseUrl,
@@ -659,6 +1065,33 @@ var BUILT_IN_POLICIES = {
       `If there is no clear error signal, reply exactly with: ${INSUFFICIENT_SIGNAL_TEXT}`
     ]
   },
+  "typecheck-summary": {
+    name: "typecheck-summary",
+    responseMode: "text",
+    taskRules: [
+      "Return at most 5 short bullet points.",
+      "Determine whether the typecheck failed or passed.",
+      "Group repeated diagnostics into root-cause buckets instead of echoing many duplicate lines.",
+      "Mention the first concrete files, symbols, or error categories to fix when they are visible.",
+      "Prefer compiler or type-system errors over timing, progress, or summary noise.",
+      "If the output clearly indicates success, say that briefly and do not add extra bullets.",
+      `If you cannot tell whether the typecheck failed, reply exactly with: ${INSUFFICIENT_SIGNAL_TEXT}`
+    ]
+  },
+  "lint-failures": {
+    name: "lint-failures",
+    responseMode: "text",
+    taskRules: [
+      "Return at most 5 short bullet points.",
+      "Determine whether lint failed or whether there are no blocking lint failures.",
+      "Group repeated rule violations instead of listing the same rule many times.",
+      "Mention the top offending files and rule names when they are visible.",
+      "Distinguish blocking failures from warnings only when that distinction is clearly visible in the input.",
+      "Do not invent autofixability; only mention autofix or --fix support when the tool output explicitly says so.",
+      "If the output clearly indicates success or no blocking failures, say that briefly and stop.",
+      `If there is not enough evidence to determine the lint result, reply exactly with: ${INSUFFICIENT_SIGNAL_TEXT}`
+    ]
+  },
   "infra-risk": {
     name: "infra-risk",
     responseMode: "json",
@@ -1228,6 +1661,15 @@ function buildCommandPreview(request) {
   }
   return (request.command ?? []).join(" ");
 }
+function getExecSuccessShortcut(args) {
+  if (args.exitCode !== 0) {
+    return null;
+  }
+  if (args.presetName === "typecheck-summary" && args.capturedOutput.trim() === "") {
+    return "No type errors.";
+  }
+  return null;
+}
 async function runExec(request) {
   const hasArgvCommand = Array.isArray(request.command) && request.command.length > 0;
   const hasShellCommand = typeof request.shellCommand === "string";
@@ -1292,6 +1734,7 @@ async function runExec(request) {
     throw childSpawnError;
   }
   const exitCode = normalizeChildExitCode(childStatus, childSignal);
+  const capturedOutput = capture.render();
   if (request.config.runtime.verbose) {
     process.stderr.write(
       `${pc2.dim("sift")} child_exit=${exitCode} captured_chars=${capture.getTotalChars()} capture_truncated=${capture.wasTruncated()}
@@ -1299,12 +1742,34 @@ async function runExec(request) {
     );
   }
   if (!bypassed) {
+    const execSuccessShortcut = getExecSuccessShortcut({
+      presetName: request.presetName,
+      exitCode,
+      capturedOutput
+    });
+    if (execSuccessShortcut && !request.dryRun) {
+      if (request.config.runtime.verbose) {
+        process.stderr.write(
+          `${pc2.dim("sift")} exec_shortcut=${request.presetName}
+`
+        );
+      }
+      process.stdout.write(`${execSuccessShortcut}
+`);
+      return exitCode;
+    }
     const output = await runSift({
       ...request,
-      stdin: capture.render()
+      stdin: capturedOutput
     });
     process.stdout.write(`${output}
 `);
+    if (request.failOn && !request.dryRun && exitCode === 0 && supportsFailOnPreset(request.presetName) && evaluateGate({
+      presetName: request.presetName,
+      output
+    }).shouldFail) {
+      return 1;
+    }
   }
   return exitCode;
 }
@@ -1334,6 +1799,12 @@ function getPreset(config, name) {
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var cli = cac("sift");
+var HELP_BANNER = [
+  "   \\\\  //",
+  "    \\\\//",
+  "     ||",
+  "     o"
+].join("\n");
 function toNumber(value) {
   if (value === void 0 || value === null || value === "") {
     return void 0;
@@ -1372,15 +1843,25 @@ function buildCliOverrides(options) {
   return overrides;
 }
 function applySharedOptions(command) {
-  return command.option("--provider <provider>", "Provider: openai-compatible").option("--model <model>", "Model name").option("--base-url <url>", "Provider base URL").option(
+  return command.option("--provider <provider>", "Provider: openai | openai-compatible").option("--model <model>", "Model name").option("--base-url <url>", "Provider base URL").option(
     "--api-key <key>",
-    "Provider API key (or set SIFT_PROVIDER_API_KEY; OPENAI_API_KEY also works for api.openai.com)"
+    "Provider API key (or set OPENAI_API_KEY for provider=openai; use SIFT_PROVIDER_API_KEY or endpoint-native envs for openai-compatible)"
   ).option(
     "--json-response-format <mode>",
     "JSON response format mode: auto | on | off"
-  ).option("--timeout-ms <ms>", "Request timeout in milliseconds").option("--format <format>", "brief | bullets | json | verdict").option("--max-capture-chars <n>", "Maximum raw child output chars kept in memory").option("--max-input-chars <n>", "Maximum input chars sent to the model").option("--head-chars <n>", "Head chars to preserve during truncation").option("--tail-chars <n>", "Tail chars to preserve during truncation").option("--strip-ansi", "Force ANSI stripping").option("--redact", "Enable standard redaction").option("--redact-strict", "Enable strict redaction").option("--raw-fallback", "Enable raw fallback text output").option("--dry-run", "Show the reduced input and prompt without calling the provider").option("--config <path>", "Path to config file").option("--verbose", "Enable verbose stderr logging");
+  ).option("--timeout-ms <ms>", "Request timeout in milliseconds").option("--format <format>", "brief | bullets | json | verdict").option("--max-capture-chars <n>", "Maximum raw child output chars kept in memory").option("--max-input-chars <n>", "Maximum input chars sent to the model").option("--head-chars <n>", "Head chars to preserve during truncation").option("--tail-chars <n>", "Tail chars to preserve during truncation").option("--strip-ansi", "Force ANSI stripping").option("--redact", "Enable standard redaction").option("--redact-strict", "Enable strict redaction").option("--raw-fallback", "Enable raw fallback text output").option("--dry-run", "Show the reduced input and prompt without calling the provider").option(
+    "--fail-on",
+    "Fail with exit code 1 when a supported built-in preset produces a blocking result"
+  ).option("--config <path>", "Path to config file").option("--verbose", "Enable verbose stderr logging");
 }
 async function executeRun(args) {
+  if (Boolean(args.options.failOn)) {
+    assertSupportedFailOnPreset(args.presetName);
+    assertSupportedFailOnFormat({
+      presetName: args.presetName,
+      format: args.format
+    });
+  }
   const config = resolveConfig({
     configPath: args.options.config,
     env: process.env,
@@ -1393,12 +1874,19 @@ async function executeRun(args) {
     stdin,
     config,
     dryRun: Boolean(args.options.dryRun),
+    presetName: args.presetName,
     policyName: args.policyName,
     outputContract: args.outputContract,
     fallbackJson: args.fallbackJson
   });
   process.stdout.write(`${output}
 `);
+  if (Boolean(args.options.failOn) && !Boolean(args.options.dryRun) && args.presetName && evaluateGate({
+    presetName: args.presetName,
+    output
+  }).shouldFail) {
+    process.exitCode = 1;
+  }
 }
 function extractExecCommand(options) {
   const passthrough = Array.isArray(options["--"]) ? options["--"].map((value) => String(value)) : [];
@@ -1415,6 +1903,13 @@ function extractExecCommand(options) {
   };
 }
 async function executeExec(args) {
+  if (Boolean(args.options.failOn)) {
+    assertSupportedFailOnPreset(args.presetName);
+    assertSupportedFailOnFormat({
+      presetName: args.presetName,
+      format: args.format
+    });
+  }
   const config = resolveConfig({
     configPath: args.options.config,
     env: process.env,
@@ -1426,6 +1921,8 @@ async function executeExec(args) {
     format: args.format,
     config,
     dryRun: Boolean(args.options.dryRun),
+    failOn: Boolean(args.options.failOn),
+    presetName: args.presetName,
     policyName: args.policyName,
     outputContract: args.outputContract,
     fallbackJson: args.fallbackJson,
@@ -1444,6 +1941,7 @@ applySharedOptions(
   await executeRun({
     question: preset.question,
     format: options.format ?? preset.format,
+    presetName: name,
     policyName: options.format === void 0 || options.format === preset.format ? preset.policy : void 0,
     options,
     outputContract: preset.outputContract,
@@ -1472,6 +1970,7 @@ applySharedOptions(
     await executeExec({
       question: preset.question,
       format: options.format ?? preset.format,
+      presetName,
       policyName: options.format === void 0 || options.format === preset.format ? preset.policy : void 0,
       options,
       outputContract: preset.outputContract,
@@ -1491,10 +1990,23 @@ applySharedOptions(
 });
 cli.command(
   "config <action>",
-  "Config commands: init | show | validate (show/validate use resolved runtime config)"
-).usage("config <init|show|validate> [options]").example("config init").example("config show").example("config validate --config ./sift.config.yaml").option("--path <path>", "Target config path for init").option("--config <path>", "Path to config file").option("--show-secrets", "Show secret values in config show").action((action, options) => {
+  "Config commands: setup | init | show | validate (show/validate use resolved runtime config)"
+).usage("config <setup|init|show|validate> [options]").example("config setup").example("config setup --global").example("config setup --path ~/.config/sift/config.yaml").example("config init").example("config init --global").example("config show").example("config validate --config ./sift.config.yaml").option("--path <path>", "Target config path for init or setup").option(
+  "--global",
+  "Use the machine-wide config path (~/.config/sift/config.yaml) for init or setup"
+).option("--config <path>", "Path to config file").option("--show-secrets", "Show secret values in config show").action(async (action, options) => {
+  if (action === "setup") {
+    process.exitCode = await configSetup({
+      targetPath: options.path,
+      global: Boolean(options.global)
+    });
+    return;
+  }
   if (action === "init") {
-    configInit(options.path);
+    configInit(
+      options.path,
+      Boolean(options.global)
+    );
     return;
   }
   if (action === "show") {
@@ -1511,11 +2023,12 @@ cli.command(
   throw new Error(`Unknown config action: ${action}`);
 });
 cli.command("doctor", "Check local runtime config completeness").usage("doctor [options]").option("--config <path>", "Path to config file").action((options) => {
+  const configPath = findConfigPath(options.config);
   const config = resolveConfig({
     configPath: options.config,
     env: process.env
   });
-  process.exitCode = runDoctor(config);
+  process.exitCode = runDoctor(config, configPath);
 });
 cli.command("presets <action> [name]", "Preset commands: list | show").usage("presets <list|show> [name] [options]").example("presets list").example("presets show infra-risk").option("--config <path>", "Path to config file").option("--internal", "Show internal preset fields in presets show").action((action, name, options) => {
   const config = resolveConfig({
@@ -1548,7 +2061,13 @@ applySharedOptions(
     options
   });
 });
-cli.help();
+cli.help((sections) => [
+  {
+    body: `${HELP_BANNER}
+`
+  },
+  ...sections
+]);
 cli.version(pkg.version);
 async function main() {
   cli.parse(process.argv, { run: false });