@whittlelabs/sifter 0.12.0 → 0.14.0

package/bin.js

@@ -15728,6 +15728,28 @@ var require_self_update = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/lifecycle/decommission.js
+var require_decommission = __commonJS({
+  "../../packages/shuttle/dist/lifecycle/decommission.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.readDecommissionDirective = readDecommissionDirective;
+    exports2.shutdownOnDecommission = shutdownOnDecommission;
+    function readDecommissionDirective(directives) {
+      const raw = directives.decommission;
+      if (!raw || typeof raw !== "object")
+        return null;
+      return raw;
+    }
+    async function shutdownOnDecommission(opts) {
+      const { productTitle, directive, logger, hooks } = opts;
+      logger.info(`${productTitle} was decommissioned from the product settings page; draining and exiting.`, directive.decommissioned_at ? { decommissionedAt: directive.decommissioned_at } : void 0);
+      await hooks.stopLoop();
+      (hooks.exit ?? ((code) => process.exit(code)))(0);
+    }
+  }
+});
+
 // ../../packages/loom/dist/runtime/prompt-execution.js
 var require_prompt_execution = __commonJS({
   "../../packages/loom/dist/runtime/prompt-execution.js"(exports2) {
@@ -20725,9 +20747,11 @@ var require_shuttle = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Shuttle = void 0;
+    exports2.mergeExecutorDefaults = mergeExecutorDefaults;
     var os_1 = require("os");
     var jobs_1 = require_dist2();
     var self_update_1 = require_self_update();
+    var decommission_1 = require_decommission();
     var loom_1 = require_dist3();
     var chain_1 = require_chain();
     var keep_1 = require_dist4();
@@ -20783,7 +20807,7 @@ var require_shuttle = __commonJS({
         });
         const registry = new registry_1.ExecutorRegistry(this.brand.executorAllowlist);
         registerBuiltInExecutors(registry, this.brand.executorAllowlist);
-        const executors = registry.build(this.config.executors);
+        const executors = registry.build(mergeExecutorDefaults(this.brand.executorDefaults, this.config.executors));
         const byStrategy = /* @__PURE__ */ new Map();
         for (const executor of executors) {
           for (const strategy of executor.strategies)
@@ -20893,6 +20917,18 @@ var require_shuttle = __commonJS({
           },
           onJob,
           onDirectives: async (directives) => {
+            const decommission = (0, decommission_1.readDecommissionDirective)(directives);
+            if (decommission) {
+              await (0, decommission_1.shutdownOnDecommission)({
+                productTitle: this.brand.product.title,
+                directive: decommission,
+                logger: subscribeLogger,
+                hooks: {
+                  stopLoop: () => this.subscription?.stop() ?? Promise.resolve()
+                }
+              });
+              return;
+            }
             const directive = (0, self_update_1.readUpgradeDirective)(directives, this.brand.product.version, attemptedUpgrades);
             if (!directive)
               return;
@@ -20930,6 +20966,15 @@ var require_shuttle = __commonJS({
       }
     };
     exports2.Shuttle = Shuttle;
+    function mergeExecutorDefaults(defaults, userExecutors) {
+      if (!defaults)
+        return userExecutors;
+      const merged = {};
+      for (const [name, userConfig] of Object.entries(userExecutors)) {
+        merged[name] = { ...defaults[name] ?? {}, ...userConfig };
+      }
+      return merged;
+    }
     function registerBuiltInExecutors(registry, allowlist) {
       const all = [
         ["claude-code", claude_code_1.createClaudeCodeExecutor],
@@ -21504,7 +21549,7 @@ var import_shuttle = __toESM(require_dist5());
 // package.json
 var package_default = {
   name: "@whittlelabs/sifter",
-  version: "0.12.0",
+  version: "0.14.0",
   description: "Whittle Sifter: paired AI reviewer for Whittle Sift job pools.",
   bin: {
     "whittle-sifter": "./dist/bin.js"
@@ -21563,6 +21608,19 @@ var sifterBrand = {
     configSearchPaths: ["~/.sifter/sifter.yaml"]
   },
   executorAllowlist: ["claude-code", "anthropic-api", "http-api", "webhook", "custom-script"],
+  // Overlay-fetch origins for the signed standards-content URLs each Sift
+  // tier signs (SIFT_PUBLIC_API_URL). Without these, the executor's SSRF
+  // guard silently skips the standards overlay and every review runs
+  // standards-blind (2026-07-13). User config overrides per key.
+  executorDefaults: {
+    "claude-code": {
+      overlayAllowedHosts: [
+        "https://api.sift.whittlelabs.com",
+        "https://api.sift.stage.whittlelabs.com",
+        "http://localhost:3008"
+      ]
+    }
+  },
   keepRegistration: {
     keepApiUrl: process.env.KEEP_API_URL ?? "https://keep.whittlelabs.com",
     jobsApiUrl: process.env.JOBS_API_URL ?? "https://jobs.whittlelabs.com",