@whittlelabs/sifter 0.16.0 → 0.18.0

package/bin.js

@@ -3180,6 +3180,14 @@ var require_device_code = __commonJS({
         });
         log(opts.brand.strings?.pairingDoneMessage ?? `Paired ${displayName}.`);
       }
+      const jobPools = await discoverMemberPools({
+        keepApiUrl: reg.keepApiUrl,
+        jobsApiUrl: reg.jobsApiUrl,
+        clientId: token.clientId,
+        clientSecret: token.clientSecret,
+        fetcher,
+        brand: opts.brand
+      });
       return {
         schemaVersion: 1,
         keepApiUrl: reg.keepApiUrl,
@@ -3195,9 +3203,38 @@ var require_device_code = __commonJS({
           hostname: (0, os_1.hostname)(),
           user: (0, os_1.userInfo)().username
         },
-        jobPools: token.jobPools
+        jobPools
       };
     }
+    async function discoverMemberPools(opts) {
+      const tokenUrl = `${opts.keepApiUrl.replace(/\/$/, "")}/api/service-tokens`;
+      const tokenRes = await opts.fetcher(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          clientId: opts.clientId,
+          clientSecret: opts.clientSecret
+        })
+      });
+      (0, version_check_1.checkResponseMinVersion)({
+        response: tokenRes,
+        currentVersion: opts.brand.product.version,
+        packageName: opts.brand.product.packageName
+      });
+      const tokenJson = await readJson(tokenRes);
+      const poolsUrl = `${opts.jobsApiUrl.replace(/\/$/, "")}/api/my/pools`;
+      const poolsRes = await opts.fetcher(poolsUrl, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${tokenJson.data.token}` }
+      });
+      (0, version_check_1.checkResponseMinVersion)({
+        response: poolsRes,
+        currentVersion: opts.brand.product.version,
+        packageName: opts.brand.product.packageName
+      });
+      const poolsJson = await readJson(poolsRes);
+      return poolsJson.data.pools;
+    }
     async function startDeviceCode(opts) {
       const url = `${opts.keepApiUrl.replace(/\/$/, "")}/api/oauth/device`;
       const response = await opts.fetcher(url, {
@@ -15803,6 +15840,17 @@ var require_prompt_execution = __commonJS({
           }
         }
       }
+      if (spec.gates !== void 0) {
+        if (!Array.isArray(spec.gates)) {
+          throw new Error("prompt-execution: spec.gates must be an array when present");
+        }
+        for (const gate of spec.gates) {
+          const g = gate;
+          if (typeof gate !== "object" || gate === null || typeof g.name !== "string" || typeof g.primitive !== "string" || typeof g.params !== "object" || g.params === null) {
+            throw new Error("prompt-execution: each spec.gates entry must be { name, primitive, params }");
+          }
+        }
+      }
       return spec;
     }
     function renderPromptExecution(inputs) {
@@ -16022,6 +16070,8 @@ var require_prompt_execution2 = __commonJS({
         spec.costCapHint = options.costCapHint;
       if (options.progressChannel !== void 0)
         spec.progressChannel = options.progressChannel;
+      if (options.outputGates && options.outputGates.length > 0)
+        spec.gates = options.outputGates;
       if (options.rendering === "producer" && !options.prompt) {
         throw new Error("rendering='producer' requires `prompt`");
       }
@@ -18051,7 +18101,8 @@ var require_canonicalise = __commonJS({
       return {
         name: workflow.name,
         description: workflow.description ?? null,
-        ownerOrgId: opts.ownerOrgId,
+        ownerClass: opts.ownerClass,
+        ownerId: opts.ownerId,
         retainPublishedVersions: workflow.retain?.publishedVersions ?? null,
         ...opts.publish !== void 0 ? { publish: opts.publish } : {},
         nodes,
@@ -18081,6 +18132,7 @@ var require_canonicalise = __commonJS({
           promptTemplate: templateText,
           promptTemplatePath: promptOptions.promptTemplate,
           outputSchema: toJsonSchema(promptOptions.outputSchema),
+          ...promptOptions.outputGates ? { outputGates: promptOptions.outputGates } : {},
           outputLabel,
           rendering: promptOptions.rendering,
           ...promptOptions.maxAttempts !== void 0 ? { maxAttempts: promptOptions.maxAttempts } : {},
@@ -18212,18 +18264,28 @@ var require_seed_workflows = __commonJS({
       }
       const results = [];
       for (const workflow of opts.workflows) {
-        const ownerOrgId = opts.ownerSlugToOrgId[workflow.owner.slug];
-        if (ownerOrgId === void 0) {
-          throw new errors_1.SeedWorkflowsError(workflow.name, `seedWorkflows: owner.slug "${workflow.owner.slug}" not present in ownerSlugToOrgId map`);
+        let ownerClass;
+        let ownerId;
+        if ("service" in workflow.owner) {
+          ownerClass = "service";
+          ownerId = workflow.owner.service;
+        } else {
+          const orgId = opts.ownerSlugToOrgId[workflow.owner.orgSlug];
+          if (orgId === void 0) {
+            throw new errors_1.SeedWorkflowsError(workflow.name, `seedWorkflows: owner.orgSlug "${workflow.owner.orgSlug}" not present in ownerSlugToOrgId map`);
+          }
+          ownerClass = "org";
+          ownerId = orgId;
         }
-        const opts2 = { ownerOrgId };
+        const opts2 = { ownerClass, ownerId };
         if (opts.env !== void 0)
           opts2.env = opts.env;
         if (opts.publish !== void 0)
           opts2.publish = opts.publish;
         const body = await (0, canonicalise_1.canonicaliseWorkflow)(workflow, opts2);
         logger.info(`seeding workflow ${workflow.name}`, {
-          ownerOrgId,
+          ownerClass,
+          ownerId,
           nodes: body.nodes.length,
           transitions: body.transitions.length
         });
@@ -18363,6 +18425,128 @@ var require_chain = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/executors/output-gates.js
+var require_output_gates = __commonJS({
+  "../../packages/shuttle/dist/executors/output-gates.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolvePath = resolvePath;
+    exports2.evaluateOutputGates = evaluateOutputGates;
+    exports2.renderRepairPrompt = renderRepairPrompt;
+    var INPUT_REF = "input:";
+    function resolvePath(root, path) {
+      let ctx = root;
+      for (const seg of path.split(".")) {
+        const project = seg.endsWith("[*]");
+        const key = project ? seg.slice(0, -3) : seg;
+        if (Array.isArray(ctx)) {
+          ctx = ctx.map((el) => key ? el?.[key] : el);
+        } else {
+          ctx = key ? ctx?.[key] : ctx;
+        }
+        if (project && !Array.isArray(ctx)) {
+          ctx = ctx == null ? [] : [ctx];
+        }
+      }
+      return ctx;
+    }
+    function resolveRef(ref, output, inputs) {
+      if (ref.startsWith(INPUT_REF)) {
+        const label = ref.slice(INPUT_REF.length);
+        const row = inputs.find((i) => i.label === label) ?? inputs.find((i) => i.label === "artifacts" && i.payload.label === label);
+        if (!row)
+          return void 0;
+        return Object.prototype.hasOwnProperty.call(row.payload, "value") ? row.payload.value : row.payload;
+      }
+      return resolvePath(output, ref);
+    }
+    function asStrings(value) {
+      if (Array.isArray(value))
+        return value.map((v) => String(v));
+      if (value == null)
+        return [];
+      return [String(value)];
+    }
+    var PRIMITIVES = {
+      /**
+       * `coverage` — the values at `got` must exactly cover the set at `want`:
+       * every wanted value present, nothing invented, none repeated. Params:
+       * `{ got: <output path>, want: <ref>, subject?: <noun> }`.
+       */
+      coverage(params, output, inputs) {
+        const subject = typeof params.subject === "string" ? params.subject : "item";
+        const got = asStrings(resolveRef(String(params.got), output, inputs));
+        const want = asStrings(resolveRef(String(params.want), output, inputs));
+        const gotSet = new Set(got);
+        const wantSet = new Set(want);
+        const missing = want.filter((v) => !gotSet.has(v));
+        const unknown = [...new Set(got.filter((v) => !wantSet.has(v)))];
+        const seen = /* @__PURE__ */ new Set();
+        const duplicated = [];
+        for (const v of got) {
+          if (seen.has(v))
+            duplicated.push(v);
+          else
+            seen.add(v);
+        }
+        if (missing.length === 0 && unknown.length === 0 && duplicated.length === 0)
+          return [];
+        const parts = [];
+        if (missing.length)
+          parts.push(`missing ${subject}(s): [${missing.join(", ")}]`);
+        if (unknown.length)
+          parts.push(`not a known ${subject}: [${unknown.join(", ")}]`);
+        if (duplicated.length)
+          parts.push(`assessed more than once: [${[...new Set(duplicated)].join(", ")}]`);
+        return [
+          `every ${subject} must be covered exactly once \u2014 ${parts.join("; ")}. Return one entry per ${subject}, using its exact id.`
+        ];
+      },
+      /**
+       * `non_empty_when` — the array at `path` must be non-empty, optionally only
+       * when `when.path` equals `when.equals`. Params:
+       * `{ path: <output path>, when?: { path: <output path>, equals: <value> } }`.
+       */
+      non_empty_when(params, output) {
+        const when = params.when;
+        if (when && typeof when.path === "string") {
+          if (resolvePath(output, when.path) !== when.equals)
+            return [];
+        }
+        const path = String(params.path);
+        const value = resolvePath(output, path);
+        if (Array.isArray(value) && value.length > 0)
+          return [];
+        const cond = when && typeof when.path === "string" ? ` when ${when.path} is ${JSON.stringify(when.equals)}` : "";
+        return [
+          `'${path}' must be a non-empty array${cond}; it was ${Array.isArray(value) ? "empty" : "absent"}.`
+        ];
+      }
+    };
+    function evaluateOutputGates(gates, output, inputs) {
+      const findings = [];
+      for (const gate of gates) {
+        const primitive = PRIMITIVES[gate.primitive];
+        if (!primitive) {
+          findings.push({ gate: gate.name, message: `unknown gate primitive '${gate.primitive}'` });
+          continue;
+        }
+        for (const message of primitive(gate.params, output, inputs)) {
+          findings.push({ gate: gate.name, message });
+        }
+      }
+      return { ok: findings.length === 0, findings };
+    }
+    function renderRepairPrompt(findings) {
+      return [
+        "Your previous answer did not satisfy these output checks. Return the corrected, complete answer that resolves every item below. Produce the same output shape with the problems fixed, and nothing else \u2014 no commentary, no explanation of the changes.",
+        "",
+        ...findings.map((f) => `- [${f.gate}] ${f.message}`)
+      ].join("\n");
+    }
+  }
+});
+
 // ../../packages/keep/dist/client.js
 var require_client2 = __commonJS({
   "../../packages/keep/dist/client.js"(exports2) {
@@ -18375,50 +18559,20 @@ var require_client2 = __commonJS({
       constructor(config) {
         this.baseUrl = config.baseUrl.replace(/\/$/, "");
         this.headers = { "Content-Type": "application/json" };
-        if (config.serviceSecret) {
-          this.headers["X-Service-Secret"] = config.serviceSecret;
-        }
         if (config.serviceToken) {
           this.headers["Authorization"] = `Bearer ${config.serviceToken}`;
         } else if (config.accessToken) {
           this.headers["Authorization"] = `Bearer ${config.accessToken}`;
         }
       }
-      // ── Claims ──────────────────────────────────────────────────────
-      async checkClaim(subject, scope, resource) {
-        return this.request("POST", "/api/claims", {
-          subject,
-          scope,
-          resource
-        });
-      }
-      async checkClaimsBatch(subject, claims) {
-        return this.request("POST", "/api/claims/batch", {
-          subject,
-          claims
-        });
-      }
-      async getEffectivePermissions(subject, context) {
-        return this.request("POST", "/api/claims/effective", {
-          subject,
-          context
-        });
-      }
-      // ── API Key Verification ────────────────────────────────────────
-      async verifyApiKey(key) {
-        return this.request("POST", "/api/keys/claims", { key });
-      }
-      // ── Service Tokens ──────────────────────────────────────────────
-      async exchangeServiceToken(clientId, clientSecret) {
-        return this.request("POST", "/api/service-tokens", {
-          clientId,
-          clientSecret
-        });
-      }
-      async verifyServiceToken(token) {
-        return this.request("POST", "/api/service-tokens/claims", {
-          token
-        });
+      // ── Actor Tokens ────────────────────────────────────────────────
+      /**
+       * Mint a short-lived `act_` token for an end user, with this client's
+       * service identity recorded as the conduit. Requires this client to be
+       * constructed with a service token holding `keep:actor-tokens:mint`.
+       */
+      async mintActorToken(actor) {
+        return this.request("POST", "/api/actor-tokens", { actor });
       }
       // ── Identity ────────────────────────────────────────────────────
       async createAccount(email, password, name) {
@@ -18510,10 +18664,9 @@ var require_client2 = __commonJS({
         return this.request("POST", `/api/users/${request.ownerPrincipalId}/service-identities`, request);
       }
       /**
-       * Bind a role (by name) to a service identity. Pool-scoped bindings
-       * pass `scopeRefs: [{kind: 'jobPool', poolId: ...}]`. User-owned
-       * pools pass `userId` as the structural principal; team/org-owned
-       * pools pass `teamId`/`orgId`.
+       * Bind a role (by name) to a service identity, anchored to a
+       * structural principal: user-owned Sifters pass `userId`;
+       * team/org-anchored bindings pass `teamId`/`orgId`.
        *
        * Requires `keep:role-bindings:write`.
        */
@@ -19533,11 +19686,40 @@ var require_claude_code = __commonJS({
             });
         }
       }
-      runClaude(prompt, spec, cwd, childEnv, signal, modelOverride, reporter) {
+      /**
+       * In-session gate repair (ADR 0017): resume the session `execute()` returned a
+       * handle for and correct its output. The repair turn works from the resumed
+       * session's own context (no checkout needed), under the same `--json-schema`
+       * constraint. A throwaway cwd hosts the run; the same handle rides back out so
+       * a second repair round can resume again.
+       */
+      async continue(continuation, followUp, signal, _ctx) {
+        const handle = continuation;
+        if (!handle || typeof handle.sessionId !== "string") {
+          throw new Error("claude-code continue: missing session to resume");
+        }
+        const tmpBase = this.config.tmpDir ? (0, apply_1.expandHome)(this.config.tmpDir) : os_1.default.tmpdir();
+        const scratch = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-cc-resume-"));
+        try {
+          const spec = {
+            rendering: "producer",
+            outputLabel: handle.outputLabel,
+            outputSchema: handle.outputSchema
+          };
+          const { response } = await this.runClaude(followUp, spec, scratch, handle.childEnv, signal, handle.model, null, handle.sessionId);
+          return response;
+        } finally {
+          await fs_1.promises.rm(scratch, { recursive: true, force: true }).catch(() => {
+          });
+        }
+      }
+      runClaude(prompt, spec, cwd, childEnv, signal, modelOverride, reporter, resumeSessionId) {
         const outputLabel = spec.outputLabel;
         const model = modelOverride ?? this.config.model;
         return new Promise((resolve, reject) => {
           const args = ["--print", "--output-format", "stream-json", "--verbose"];
+          if (resumeSessionId)
+            args.push("--resume", resumeSessionId);
           if (spec.outputSchema && typeof spec.outputSchema === "object" && Object.keys(spec.outputSchema).length > 0) {
             args.push("--json-schema", JSON.stringify(spec.outputSchema));
           }
@@ -19632,7 +19814,18 @@ var require_claude_code = __commonJS({
                       aiProvider: "claude-code",
                       ...model ? { aiModel: model } : {},
                       ...stream.usage ?? {}
-                    }
+                    },
+                    // In-session repair handle (ADR 0017): present only when the run
+                    // reported a session id, so the runner can `--resume` it.
+                    ...stream.sessionId ? {
+                      continuation: {
+                        sessionId: stream.sessionId,
+                        model,
+                        childEnv,
+                        outputLabel,
+                        outputSchema: spec.outputSchema
+                      }
+                    } : {}
                   },
                   readPaths: stream.readPaths,
                   toolText: stream.toolText
@@ -19732,6 +19925,7 @@ var require_claude_code = __commonJS({
       let usage = null;
       let resultMeta = null;
       let structuredOutput = null;
+      let sessionId = null;
       let toolText = "";
       for (const line of stdout.split("\n")) {
         const trimmed = line.trim();
@@ -19743,6 +19937,8 @@ var require_claude_code = __commonJS({
         } catch {
           continue;
         }
+        if (typeof event.session_id === "string")
+          sessionId = event.session_id;
         if (event.type === "assistant") {
           const content = event.message?.content;
           if (!Array.isArray(content))
@@ -19779,7 +19975,7 @@ var require_claude_code = __commonJS({
           };
         }
       }
-      return { finalText, readPaths, usage, resultMeta, structuredOutput, toolText };
+      return { finalText, readPaths, usage, resultMeta, structuredOutput, sessionId, toolText };
     }
     var MAX_REPORTED_READS = 2e3;
     function relativeWorkspaceReads(readPaths, cwd) {
@@ -20043,7 +20239,6 @@ var require_anthropic_api = __commonJS({
       }
       async execute(dispatch, signal) {
         const { prompt, spec } = (0, loom_1.renderPromptExecution)(dispatch.inputs);
-        const outputLabel = spec.outputLabel;
         const providerHints = (0, loom_1.pickProviderHints)(spec, this.instance.capabilityId);
         const apiKey = await this.instance.resolveKey(providerHints);
         const hintedModel = providerHints.model;
@@ -20052,6 +20247,33 @@ var require_anthropic_api = __commonJS({
           max_tokens: this.instance.maxTokens,
           messages: [{ role: "user", content: prompt }]
         };
+        return this.callApi(apiKey, body, spec, spec.outputLabel, signal);
+      }
+      /**
+       * In-session gate repair (ADR 0017): re-call the Messages API with the prior
+       * conversation plus the model's own last turn plus the repair turn, under the
+       * same output contract. A fresh conversation is not started — the appended
+       * assistant turn gives the model its previous answer to correct.
+       */
+      async continue(continuation, followUp, signal, _ctx) {
+        const handle = continuation;
+        if (!handle || !Array.isArray(handle.messages)) {
+          throw new Error("anthropic-api continue: missing conversation to resume");
+        }
+        const spec = {
+          rendering: "producer",
+          outputLabel: handle.outputLabel,
+          outputSchema: handle.outputSchema
+        };
+        const body = {
+          model: handle.model,
+          max_tokens: handle.maxTokens,
+          messages: [...handle.messages, { role: "user", content: followUp }]
+        };
+        return this.callApi(handle.apiKey, body, spec, handle.outputLabel, signal);
+      }
+      /** Shared Messages-API call + parse + validate, used by execute and continue. */
+      async callApi(apiKey, body, spec, outputLabel, signal) {
         const timeoutController = new AbortController();
         const timer = setTimeout(() => timeoutController.abort(), this.instance.timeoutMs);
         function onAbort() {
@@ -20099,7 +20321,17 @@ var require_anthropic_api = __commonJS({
             outputs: [{ label: outputLabel, content: parsed ?? { raw: rawText } }],
             rawText,
             parsed,
-            ...usage ? { usage } : {}
+            ...usage ? { usage } : {},
+            // In-session repair handle (ADR 0017): the conversation with the model's
+            // answer appended, ready for `continue()` to add the repair turn.
+            continuation: {
+              apiKey,
+              model: body.model,
+              maxTokens: body.max_tokens,
+              messages: [...body.messages, { role: "assistant", content: rawText }],
+              outputLabel,
+              outputSchema: spec.outputSchema
+            }
           };
         } finally {
           clearTimeout(timer);
@@ -20932,6 +21164,7 @@ var require_shuttle = __commonJS({
     var decommission_1 = require_decommission();
     var loom_1 = require_dist3();
     var chain_1 = require_chain();
+    var output_gates_1 = require_output_gates();
     var keep_1 = require_dist4();
     var apply_1 = require_apply();
     var version_check_1 = require_version_check();
@@ -20946,6 +21179,37 @@ var require_shuttle = __commonJS({
     var audit_log_1 = require_audit_log();
     var spend_tracker_1 = require_spend_tracker();
     var store_1 = require_store();
+    var GATE_REPAIR_BUDGET = 2;
+    async function runOutputGates(dispatch, response, executor, signal, ctx) {
+      let spec;
+      try {
+        spec = (0, loom_1.readPromptExecutionSpec)(dispatch.inputs);
+      } catch {
+        return { ok: true, response };
+      }
+      const gates = spec.gates;
+      if (!gates || gates.length === 0)
+        return { ok: true, response };
+      let current = response;
+      let result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
+      let attempts = 0;
+      while (!result.ok && attempts < GATE_REPAIR_BUDGET && current.continuation !== void 0 && typeof executor.continue === "function") {
+        try {
+          current = await executor.continue(current.continuation, (0, output_gates_1.renderRepairPrompt)(result.findings), signal, ctx);
+        } catch {
+          break;
+        }
+        result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
+        attempts += 1;
+      }
+      if (result.ok)
+        return { ok: true, response: current };
+      const detail = result.findings.map((f) => `[${f.gate}] ${f.message}`).join(" | ");
+      return {
+        ok: false,
+        reason: `output gate(s) failed${attempts > 0 ? ` after ${attempts} repair attempt(s)` : ""}: ${detail}`
+      };
+    }
     var Shuttle = class {
       brand;
       config;
@@ -21056,6 +21320,12 @@ var require_shuttle = __commonJS({
             await observerChain.notify({ kind: "attendance.closed", jobId, attendanceId, status: "failed", reason, totalDurationMs: Date.now() - startedAt }, onObserverError);
             return { status: "failed", reason };
           }
+          const gated = await runOutputGates(dispatch, response, executor, signal, executionCtx);
+          if (!gated.ok) {
+            await observerChain.notify({ kind: "attendance.closed", jobId, attendanceId, status: "failed", reason: gated.reason, totalDurationMs: Date.now() - startedAt }, onObserverError);
+            return { status: "failed", reason: gated.reason };
+          }
+          response = gated.response;
           await observerChain.notify({
             kind: "executor.dispatch.completed",
             jobId,
@@ -21728,7 +21998,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.16.0" : pkg.version;
+var buildVersion = true ? "0.18.0" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",