@whittlelabs/sifter 0.13.0 → 0.15.0

package/bin.js

@@ -3538,7 +3538,7 @@ var require_init = __commonJS({
     var store_1 = require_store();
     var spend_store_1 = require_spend_store();
     function buildInitCommand(brand) {
-      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--cwd <path>", "Working directory for executors that run a local subprocess (e.g. claude-code)").option("-p, --profile <name>", 'Config profile to pair into (isolates this pairing under its own dir; default "default")').action(async (options) => {
+      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--tmp-dir <path>", "Base directory for each job's throwaway checkout (defaults to the OS temp dir; set only when that is unsuitable)").option("-p, --profile <name>", 'Config profile to pair into (isolates this pairing under its own dir; default "default")').action(async (options) => {
         try {
           const profile = (0, apply_1.resolveProfile)(brand, options.profile);
           const setupOptions = parseSetupOptions(brand, options);
@@ -3621,8 +3621,8 @@ var require_init = __commonJS({
       if (raw.monthlyCap !== void 0) {
         out.monthlyCap = requireNonNegativeInt("--monthly-cap", raw.monthlyCap);
       }
-      if (raw.cwd !== void 0) {
-        out.cwd = raw.cwd;
+      if (raw.tmpDir !== void 0) {
+        out.tmpDir = raw.tmpDir;
       }
       return out;
     }
@@ -18896,10 +18896,11 @@ var require_workspace = __commonJS({
     var path_1 = __importDefault(require("path"));
     var DEFAULT_GIT_TIMEOUT_MS = 12e4;
     var DEFAULT_GIT_PROTOCOLS = "https:ssh:git";
-    async function prepareWorkspace(repoDir, workspace, options = {}) {
+    async function prepareWorkspace(workspace, options = {}) {
+      const tmpBase = options.tmpDir ?? os_1.default.tmpdir();
       const resolved = readGitWorkspace(workspace);
       if ("warning" in resolved) {
-        return degradedWorkspace(resolved.warning);
+        return degradedWorkspace(resolved.warning, tmpBase);
       }
       const gitWorkspace = resolved.git;
       const timeoutMs = options.commandTimeoutMs ?? DEFAULT_GIT_TIMEOUT_MS;
@@ -18907,7 +18908,6 @@ var require_workspace = __commonJS({
       const signal = options.signal;
       const authEnv = options.gitToken !== void 0 ? buildGitAuthEnv(gitWorkspace.remote, options.gitToken) : void 0;
       const git = (args, cwd) => runGit(args, cwd, { timeoutMs, signal, allowedProtocols, extraEnv: authEnv });
-      const gitCleanup = (args, cwd) => runGit(args, cwd, { timeoutMs, allowedProtocols });
       const hasCommit = (dir) => git(["cat-file", "-e", `${gitWorkspace.commit}^{commit}`], dir).then((r) => r.code === 0);
       const fetchCommit = async (dir, opts) => {
         if (await hasCommit(dir))
@@ -18915,9 +18915,6 @@ var require_workspace = __commonJS({
         const depth = opts.shallow ? ["--depth=1"] : [];
         const attempts = [];
         for (const ref of gitWorkspace.fetchRefs ?? []) {
-          if (opts.includeOrigin) {
-            attempts.push({ source: `origin ${ref}`, args: ["fetch", "--no-tags", ...depth, "origin", ref] });
-          }
           attempts.push({
             source: `${gitWorkspace.remote} ${ref}`,
             args: ["fetch", "--no-tags", ...depth, gitWorkspace.remote, ref]
@@ -18941,31 +18938,7 @@ var require_workspace = __commonJS({
         return failures2;
       };
       const notMaterialized = (failures2) => `could not materialize ${gitWorkspace.commit} from ${gitWorkspace.remote}` + (failures2.length > 0 ? ` (${failures2.join("; ")})` : "");
-      const isRepo = (await git(["rev-parse", "--git-dir"], repoDir)).code === 0;
-      if (isRepo) {
-        const failures2 = await fetchCommit(repoDir, { includeOrigin: true, shallow: false });
-        if (!await hasCommit(repoDir))
-          return degradedWorkspace(notMaterialized(failures2));
-        const tempRoot2 = await fs_1.promises.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "shuttle-ws-"));
-        const worktreeDir = path_1.default.join(tempRoot2, "checkout");
-        const add = await git(["worktree", "add", "--detach", worktreeDir, gitWorkspace.commit], repoDir);
-        if (add.code !== 0) {
-          await fs_1.promises.rm(tempRoot2, { recursive: true, force: true }).catch(() => {
-          });
-          return degradedWorkspace(`git worktree add failed: ${firstLine(add.stderr)}`);
-        }
-        return {
-          cwd: worktreeDir,
-          materialized: true,
-          cleanup: async () => {
-            await gitCleanup(["worktree", "remove", "--force", worktreeDir], repoDir);
-            await gitCleanup(["worktree", "prune"], repoDir);
-            await fs_1.promises.rm(tempRoot2, { recursive: true, force: true }).catch(() => {
-            });
-          }
-        };
-      }
-      const tempRoot = await fs_1.promises.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "shuttle-ws-"));
+      const tempRoot = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-ws-"));
       const checkoutDir = path_1.default.join(tempRoot, "checkout");
       const removeTempRoot = async () => {
         await fs_1.promises.rm(tempRoot, { recursive: true, force: true }).catch(() => {
@@ -18975,17 +18948,17 @@ var require_workspace = __commonJS({
       const init = await git(["init", "-q"], checkoutDir);
       if (init.code !== 0) {
         await removeTempRoot();
-        return degradedWorkspace(`git init failed: ${firstLine(init.stderr)}`);
+        return degradedWorkspace(`git init failed: ${firstLine(init.stderr)}`, tmpBase);
       }
-      const failures = await fetchCommit(checkoutDir, { includeOrigin: false, shallow: true });
+      const failures = await fetchCommit(checkoutDir, { shallow: true });
       if (!await hasCommit(checkoutDir)) {
         await removeTempRoot();
-        return degradedWorkspace(notMaterialized(failures));
+        return degradedWorkspace(notMaterialized(failures), tmpBase);
       }
       const checkout = await git(["checkout", "--detach", gitWorkspace.commit], checkoutDir);
       if (checkout.code !== 0) {
         await removeTempRoot();
-        return degradedWorkspace(`git checkout failed: ${firstLine(checkout.stderr)}`);
+        return degradedWorkspace(`git checkout failed: ${firstLine(checkout.stderr)}`, tmpBase);
       }
       return { cwd: checkoutDir, materialized: true, cleanup: removeTempRoot };
     }
@@ -19033,8 +19006,8 @@ var require_workspace = __commonJS({
       }
       return { git };
     }
-    async function degradedWorkspace(warning) {
-      const scratchDir = await fs_1.promises.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "shuttle-ws-degraded-"));
+    async function degradedWorkspace(warning, tmpBase = os_1.default.tmpdir()) {
+      const scratchDir = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-ws-degraded-"));
       return {
         cwd: scratchDir,
         materialized: false,
@@ -19329,12 +19302,15 @@ var require_claude_code = __commonJS({
           configDir = path_1.default.join(jobScratch, "claude-config");
           await fs_1.promises.mkdir(configDir);
         }
+        const tmpBase = this.config.tmpDir ? (0, apply_1.expandHome)(this.config.tmpDir) : os_1.default.tmpdir();
         let workspace = null;
+        let promptOnlyScratch = null;
         let overlayResult = null;
         try {
           if (spec.workspace) {
-            workspace = await (0, workspace_1.prepareWorkspace)(this.config.cwd, spec.workspace, {
+            workspace = await (0, workspace_1.prepareWorkspace)(spec.workspace, {
               signal,
+              tmpDir: tmpBase,
               ...credentials?.githubToken ? { gitToken: credentials.githubToken } : {}
             });
             if (spec.workspace.overlay) {
@@ -19347,7 +19323,10 @@ var require_claude_code = __commonJS({
           const childEnv = buildChildEnv(credentials, configDir);
           const claudeHints = (0, loom_1.pickProviderHints)(spec, "claude-code");
           const hintedModel = typeof claudeHints.model === "string" && claudeHints.model.length > 0 ? claudeHints.model : void 0;
-          const runCwd = workspace?.cwd ?? this.config.cwd;
+          if (!workspace) {
+            promptOnlyScratch = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-cc-run-"));
+          }
+          const runCwd = workspace?.cwd ?? promptOnlyScratch;
           const { response, readPaths } = await this.runClaude(prompt, spec, runCwd, childEnv, signal, hintedModel);
           if (workspace) {
             response.outputs.push({
@@ -19372,6 +19351,9 @@ var require_claude_code = __commonJS({
         } finally {
           if (workspace)
             await workspace.cleanup();
+          if (promptOnlyScratch)
+            await fs_1.promises.rm(promptOnlyScratch, { recursive: true, force: true }).catch(() => {
+            });
           if (jobScratch)
             await fs_1.promises.rm(jobScratch, { recursive: true, force: true }).catch(() => {
             });
@@ -19477,12 +19459,13 @@ var require_claude_code = __commonJS({
       }
     };
     function createClaudeCodeExecutor(config, capabilityId = "claude-code", deps = {}) {
-      const cwdRaw = config.cwd;
-      if (typeof cwdRaw !== "string" || cwdRaw.length === 0) {
-        throw new Error('ClaudeCodeExecutor requires a non-empty "cwd" string in config');
+      const validated = { capabilityId };
+      if (config.tmpDir !== void 0) {
+        if (typeof config.tmpDir !== "string" || config.tmpDir.length === 0) {
+          throw new Error('"tmpDir" must be a non-empty string');
+        }
+        validated.tmpDir = config.tmpDir;
       }
-      const cwd = (0, apply_1.expandHome)(cwdRaw);
-      const validated = { cwd, capabilityId };
       if (config.model !== void 0) {
         if (typeof config.model !== "string")
           throw new Error('"model" must be a string');
@@ -20747,6 +20730,7 @@ var require_shuttle = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Shuttle = void 0;
+    exports2.mergeExecutorDefaults = mergeExecutorDefaults;
     var os_1 = require("os");
     var jobs_1 = require_dist2();
     var self_update_1 = require_self_update();
@@ -20806,7 +20790,7 @@ var require_shuttle = __commonJS({
         });
         const registry = new registry_1.ExecutorRegistry(this.brand.executorAllowlist);
         registerBuiltInExecutors(registry, this.brand.executorAllowlist);
-        const executors = registry.build(this.config.executors);
+        const executors = registry.build(mergeExecutorDefaults(this.brand.executorDefaults, this.config.executors));
         const byStrategy = /* @__PURE__ */ new Map();
         for (const executor of executors) {
           for (const strategy of executor.strategies)
@@ -20965,6 +20949,15 @@ var require_shuttle = __commonJS({
       }
     };
     exports2.Shuttle = Shuttle;
+    function mergeExecutorDefaults(defaults, userExecutors) {
+      if (!defaults)
+        return userExecutors;
+      const merged = {};
+      for (const [name, userConfig] of Object.entries(userExecutors)) {
+        merged[name] = { ...defaults[name] ?? {}, ...userConfig };
+      }
+      return merged;
+    }
     function registerBuiltInExecutors(registry, allowlist) {
       const all = [
         ["claude-code", claude_code_1.createClaudeCodeExecutor],
@@ -21532,14 +21525,13 @@ var import_shuttle2 = __toESM(require_dist5());
 // src/brand.ts
 var import_path = require("path");
 var import_promises = require("fs/promises");
-var import_readline = require("readline");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
 
 // package.json
 var package_default = {
   name: "@whittlelabs/sifter",
-  version: "0.13.0",
+  version: "0.15.0",
   description: "Whittle Sifter: paired AI reviewer for Whittle Sift job pools.",
   bin: {
     "whittle-sifter": "./dist/bin.js"
@@ -21598,6 +21590,19 @@ var sifterBrand = {
     configSearchPaths: ["~/.sifter/sifter.yaml"]
   },
   executorAllowlist: ["claude-code", "anthropic-api", "http-api", "webhook", "custom-script"],
+  // Overlay-fetch origins for the signed standards-content URLs each Sift
+  // tier signs (SIFT_PUBLIC_API_URL). Without these, the executor's SSRF
+  // guard silently skips the standards overlay and every review runs
+  // standards-blind (2026-07-13). User config overrides per key.
+  executorDefaults: {
+    "claude-code": {
+      overlayAllowedHosts: [
+        "https://api.sift.whittlelabs.com",
+        "https://api.sift.stage.whittlelabs.com",
+        "http://localhost:3008"
+      ]
+    }
+  },
   keepRegistration: {
     keepApiUrl: process.env.KEEP_API_URL ?? "https://keep.whittlelabs.com",
     jobsApiUrl: process.env.JOBS_API_URL ?? "https://jobs.whittlelabs.com",
@@ -21623,12 +21628,11 @@ var sifterBrand = {
       // A re-pair must refresh the pairing-derived fields (Jobs URL, service
       // identity, pools) even when sifter.yaml already exists — otherwise a
       // stale file silently shadows the new pairing (exactly how a leftover
-      // `localhost:3005` and an old `cwd` once survived a fresh pair). So we
-      // merge rather than skip: rebuild the pairing fields from `pairing`, carry
-      // over the user's executor block (e.g. claude-code `cwd`) and polling
-      // unless a fresh flag overrides them, and log what happened. We only
-      // (re)scaffold an executor block — which may prompt for `cwd` — when there
-      // isn't one to preserve.
+      // `localhost:3005` once survived a fresh pair). So we merge rather than
+      // skip: rebuild the pairing fields from `pairing`, carry over the user's
+      // executor block (e.g. a claude-code `tmpDir`) and polling unless a fresh
+      // flag overrides them, and log what happened. We only (re)scaffold an
+      // executor block when there isn't one to preserve.
       run: async (ctx) => {
         const yamlPath = (0, import_path.join)(ctx.configDir, "sifter.yaml");
         const pairing = new import_shuttle.PairingConfigStore((0, import_path.join)(ctx.configDir, "config.json")).read();
@@ -21683,8 +21687,10 @@ var sifterBrand = {
 async function buildExecutorBlock(executor, ctx) {
   switch (executor) {
     case "claude-code": {
-      const cwd = ctx.setupOptions.cwd ?? await promptForCwd(`Where should Claude Code run? [${process.cwd()}]: `, process.cwd());
-      return { type: "claude-code", cwd };
+      return {
+        type: "claude-code",
+        ...ctx.setupOptions.tmpDir ? { tmpDir: ctx.setupOptions.tmpDir } : {}
+      };
     }
     case "anthropic-api": {
       return {
@@ -21696,19 +21702,6 @@ async function buildExecutorBlock(executor, ctx) {
       return { type: executor };
   }
 }
-async function promptForCwd(prompt, fallback) {
-  if (!process.stdin.isTTY) return fallback;
-  const rl = (0, import_readline.createInterface)({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = await new Promise((resolve) => {
-      rl.question(prompt, (input) => resolve(input));
-    });
-    const trimmed = answer.trim();
-    return trimmed.length === 0 ? fallback : trimmed;
-  } finally {
-    rl.close();
-  }
-}
 
 // src/bin.ts
 (0, import_shuttle2.createCli)(sifterBrand).parseAsync(process.argv).catch((err) => {