@whittlelabs/sifter 0.13.0 → 0.14.0

package/bin.js

@@ -20747,6 +20747,7 @@ var require_shuttle = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Shuttle = void 0;
+    exports2.mergeExecutorDefaults = mergeExecutorDefaults;
     var os_1 = require("os");
     var jobs_1 = require_dist2();
     var self_update_1 = require_self_update();
@@ -20806,7 +20807,7 @@ var require_shuttle = __commonJS({
         });
         const registry = new registry_1.ExecutorRegistry(this.brand.executorAllowlist);
         registerBuiltInExecutors(registry, this.brand.executorAllowlist);
-        const executors = registry.build(this.config.executors);
+        const executors = registry.build(mergeExecutorDefaults(this.brand.executorDefaults, this.config.executors));
         const byStrategy = /* @__PURE__ */ new Map();
         for (const executor of executors) {
           for (const strategy of executor.strategies)
@@ -20965,6 +20966,15 @@ var require_shuttle = __commonJS({
       }
     };
     exports2.Shuttle = Shuttle;
+    function mergeExecutorDefaults(defaults, userExecutors) {
+      if (!defaults)
+        return userExecutors;
+      const merged = {};
+      for (const [name, userConfig] of Object.entries(userExecutors)) {
+        merged[name] = { ...defaults[name] ?? {}, ...userConfig };
+      }
+      return merged;
+    }
     function registerBuiltInExecutors(registry, allowlist) {
       const all = [
         ["claude-code", claude_code_1.createClaudeCodeExecutor],
@@ -21539,7 +21549,7 @@ var import_shuttle = __toESM(require_dist5());
 // package.json
 var package_default = {
   name: "@whittlelabs/sifter",
-  version: "0.13.0",
+  version: "0.14.0",
   description: "Whittle Sifter: paired AI reviewer for Whittle Sift job pools.",
   bin: {
     "whittle-sifter": "./dist/bin.js"
@@ -21598,6 +21608,19 @@ var sifterBrand = {
     configSearchPaths: ["~/.sifter/sifter.yaml"]
   },
   executorAllowlist: ["claude-code", "anthropic-api", "http-api", "webhook", "custom-script"],
+  // Overlay-fetch origins for the signed standards-content URLs each Sift
+  // tier signs (SIFT_PUBLIC_API_URL). Without these, the executor's SSRF
+  // guard silently skips the standards overlay and every review runs
+  // standards-blind (2026-07-13). User config overrides per key.
+  executorDefaults: {
+    "claude-code": {
+      overlayAllowedHosts: [
+        "https://api.sift.whittlelabs.com",
+        "https://api.sift.stage.whittlelabs.com",
+        "http://localhost:3008"
+      ]
+    }
+  },
   keepRegistration: {
     keepApiUrl: process.env.KEEP_API_URL ?? "https://keep.whittlelabs.com",
     jobsApiUrl: process.env.JOBS_API_URL ?? "https://jobs.whittlelabs.com",