@whittlelabs/sifter 0.2.0 → 0.3.1

package/bin.js

@@ -3514,8 +3514,9 @@ var require_init = __commonJS({
     var store_1 = require_store();
     var spend_store_1 = require_spend_store();
     function buildInitCommand(brand) {
-      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").action(async (options) => {
+      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--cwd <path>", "Working directory for executors that run a local subprocess (e.g. claude-code)").action(async (options) => {
         try {
+          const setupOptions = parseSetupOptions(brand, options);
           const effectiveBrand = options.keepUrl || options.jobsUrl ? {
             ...brand,
             keepRegistration: {
@@ -3531,7 +3532,8 @@ var require_init = __commonJS({
               await step.run({
                 brand: effectiveBrand,
                 configDir: paths.configDir,
-                log: (line) => console.log(line)
+                log: (line) => console.log(line),
+                setupOptions
               });
             }
           }
@@ -3543,8 +3545,8 @@ var require_init = __commonJS({
           await store.write(pairing);
           const spendStore = new spend_store_1.SpendStore(paths.spendStateFile);
           const seedCaps = {
-            dailyTokens: effectiveBrand.defaultCaps.dailyTokens,
-            monthlyTokens: effectiveBrand.defaultCaps.monthlyTokens,
+            dailyTokens: setupOptions.dailyCap ?? effectiveBrand.defaultCaps.dailyTokens,
+            monthlyTokens: setupOptions.monthlyCap ?? effectiveBrand.defaultCaps.monthlyTokens,
             dailyUsd: effectiveBrand.defaultCaps.dailyUsd,
             monthlyUsd: effectiveBrand.defaultCaps.monthlyUsd
           };
@@ -3554,7 +3556,8 @@ var require_init = __commonJS({
               await step.run({
                 brand: effectiveBrand,
                 configDir: paths.configDir,
-                log: (line) => console.log(line)
+                log: (line) => console.log(line),
+                setupOptions
               });
             }
           }
@@ -3572,6 +3575,44 @@ var require_init = __commonJS({
         }
       });
     }
+    function parseSetupOptions(brand, raw) {
+      const out = {};
+      if (raw.executor !== void 0) {
+        const allowed = brand.executorAllowlist;
+        const wildcard = allowed.includes("*");
+        if (!wildcard && !allowed.includes(raw.executor)) {
+          throw new Error(`--executor=${raw.executor} is not in this brand's allowlist (${allowed.join(", ")})`);
+        }
+        out.executor = raw.executor;
+      }
+      if (raw.pollInterval !== void 0) {
+        out.pollIntervalMs = requirePositiveInt("--poll-interval", raw.pollInterval);
+      }
+      if (raw.dailyCap !== void 0) {
+        out.dailyCap = requireNonNegativeInt("--daily-cap", raw.dailyCap);
+      }
+      if (raw.monthlyCap !== void 0) {
+        out.monthlyCap = requireNonNegativeInt("--monthly-cap", raw.monthlyCap);
+      }
+      if (raw.cwd !== void 0) {
+        out.cwd = raw.cwd;
+      }
+      return out;
+    }
+    function requirePositiveInt(flag, value) {
+      const n = Number(value);
+      if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+        throw new Error(`${flag} must be a positive integer, got "${value}"`);
+      }
+      return n;
+    }
+    function requireNonNegativeInt(flag, value) {
+      const n = Number(value);
+      if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0) {
+        throw new Error(`${flag} must be a non-negative integer, got "${value}"`);
+      }
+      return n;
+    }
   }
 });
 
@@ -15068,7 +15109,7 @@ var require_schema4 = __commonJS({
       message: 'Each pool must specify at least one of "id" or "name"'
     });
     var executorSchema = zod_1.z.object({
-      type: zod_1.z.enum(["claude-code", "http-api", "webhook", "custom-script"])
+      type: zod_1.z.enum(["claude-code", "http-api", "anthropic-api", "webhook", "custom-script"])
     }).passthrough();
     var shuttleConfigSchema = zod_1.z.object({
       auth: zod_1.z.object({
@@ -16249,6 +16290,32 @@ var require_client2 = __commonJS({
           ttlSeconds: request.ttlSeconds
         });
       }
+      // ── Managed Sifter ──────────────────────────────────────────────
+      /**
+       * Reveal a hosted-Sifter customer's plaintext Anthropic API key for
+       * one dispatch. Service-token only; requires the
+       * `keep:managed-sifter-keys:reveal` scope, granted only to the
+       * `whittle-hosted-sifter` service identity.
+       *
+       * Callers must use the returned key for a single Anthropic request
+       * and drop it from memory afterwards. Keep stamps `last_used_at` on
+       * every call and is the audit-of-record for who decrypted whose key
+       * when.
+       */
+      async revealManagedSifterKey(userId) {
+        return this.request("POST", `/api/managed-sifters/${encodeURIComponent(userId)}/reveal-key`);
+      }
+      /**
+       * Read a user's hosted-Sifter opt-in status. Returns `{enabled:
+       * false}` for users who never opted in (no row) and users who
+       * opted in then disabled. Service-to-service only; requires the
+       * `keep:managed-sifter-keys:read-status` scope, which is distinct
+       * from `:reveal` so a service identity can hold one without the
+       * other.
+       */
+      async getManagedSifterStatus(userId) {
+        return this.request("GET", `/api/users/${encodeURIComponent(userId)}/managed-sifter-status`);
+      }
       // ── HTTP ────────────────────────────────────────────────────────
       async request(method, path, body) {
         const url = `${this.baseUrl}${path}`;
@@ -16342,12 +16409,75 @@ var require_service_token = __commonJS({
   }
 });
 
+// ../../packages/keep/dist/agent-token.js
+var require_agent_token = __commonJS({
+  "../../packages/keep/dist/agent-token.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.AgentTokenManager = void 0;
+    var AgentTokenManager = class {
+      token = null;
+      expiresAt = 0;
+      pendingExchange = null;
+      keepApiUrl;
+      clientId;
+      clientSecret;
+      enabled;
+      onResponse;
+      constructor(config) {
+        this.keepApiUrl = config.keepApiUrl.replace(/\/$/, "");
+        this.clientId = config.clientId;
+        this.clientSecret = config.clientSecret;
+        this.enabled = !!(config.clientId && config.clientSecret && config.keepApiUrl);
+        this.onResponse = config.onResponse;
+      }
+      async getToken() {
+        if (!this.enabled)
+          return null;
+        if (this.token && Date.now() < this.expiresAt - 3e4) {
+          return this.token;
+        }
+        if (this.pendingExchange) {
+          return this.pendingExchange;
+        }
+        this.pendingExchange = this.exchange();
+        try {
+          return await this.pendingExchange;
+        } finally {
+          this.pendingExchange = null;
+        }
+      }
+      async exchange() {
+        const url = `${this.keepApiUrl}/api/agent-tokens`;
+        const response = await fetch(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            clientId: this.clientId,
+            clientSecret: this.clientSecret
+          })
+        });
+        this.onResponse?.(response);
+        const json = await response.json();
+        if (!response.ok || !json.success) {
+          const msg = json.error?.message ?? `Agent token exchange failed with status ${response.status}`;
+          throw new Error(`[AgentTokenManager] ${msg}`);
+        }
+        this.token = json.data.token;
+        this.expiresAt = Date.now() + json.data.expiresIn * 1e3;
+        return this.token;
+      }
+    };
+    exports2.AgentTokenManager = AgentTokenManager;
+  }
+});
+
 // ../../packages/keep/dist/index.js
 var require_dist3 = __commonJS({
   "../../packages/keep/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ServiceTokenManager = exports2.KeepClient = void 0;
+    exports2.AgentTokenManager = exports2.ServiceTokenManager = exports2.KeepClient = void 0;
     var client_1 = require_client2();
     Object.defineProperty(exports2, "KeepClient", { enumerable: true, get: function() {
       return client_1.KeepClient;
@@ -16356,6 +16486,10 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports2, "ServiceTokenManager", { enumerable: true, get: function() {
       return service_token_1.ServiceTokenManager;
     } });
+    var agent_token_1 = require_agent_token();
+    Object.defineProperty(exports2, "AgentTokenManager", { enumerable: true, get: function() {
+      return agent_token_1.AgentTokenManager;
+    } });
   }
 });
 
@@ -16746,6 +16880,206 @@ var require_http_api = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/config/env-ref.js
+var require_env_ref = __commonJS({
+  "../../packages/shuttle/dist/config/env-ref.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolveEnvRef = resolveEnvRef;
+    exports2.isEnvRef = isEnvRef;
+    var ENV_REF_PATTERN = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/;
+    function resolveEnvRef(value, fieldName) {
+      const match = ENV_REF_PATTERN.exec(value);
+      if (!match)
+        return value;
+      const varName = match[1];
+      const resolved = process.env[varName];
+      if (resolved === void 0 || resolved === "") {
+        const subject = fieldName ? `${fieldName} (${value})` : value;
+        throw new Error(`Environment variable "${varName}" referenced by ${subject} is not set. Export it before starting the Sifter, or hard-code the value in the YAML.`);
+      }
+      return resolved;
+    }
+    function isEnvRef(value) {
+      return ENV_REF_PATTERN.test(value);
+    }
+  }
+});
+
+// ../../packages/shuttle/dist/executors/anthropic-api.js
+var require_anthropic_api = __commonJS({
+  "../../packages/shuttle/dist/executors/anthropic-api.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createAnthropicApiExecutor = createAnthropicApiExecutor;
+    var keep_1 = require_dist3();
+    var env_ref_1 = require_env_ref();
+    var DEFAULT_BASE_URL = "https://api.anthropic.com/v1/messages";
+    var DEFAULT_MODEL = "claude-sonnet-4-6";
+    var DEFAULT_MAX_TOKENS = 4096;
+    var DEFAULT_TIMEOUT_MS = 12e4;
+    var ANTHROPIC_API_VERSION = "2023-06-01";
+    var AnthropicApiExecutor = class {
+      capability;
+      instance;
+      constructor(instance) {
+        this.instance = instance;
+        this.capability = {
+          id: instance.capabilityId,
+          jobTypes: ["prompt-execution"]
+        };
+      }
+      async dispatch(req, signal) {
+        const apiKey = await this.instance.resolveKey(req);
+        const body = {
+          model: this.instance.model,
+          max_tokens: this.instance.maxTokens,
+          messages: [{ role: "user", content: req.prompt }]
+        };
+        const timeoutController = new AbortController();
+        const timer = setTimeout(() => timeoutController.abort(), this.instance.timeoutMs);
+        function onAbort() {
+          timeoutController.abort();
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+        try {
+          const response = await fetch(this.instance.baseUrl, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              "x-api-key": apiKey,
+              "anthropic-version": ANTHROPIC_API_VERSION
+            },
+            body: JSON.stringify(body),
+            signal: timeoutController.signal
+          });
+          if (!response.ok) {
+            let bodyText = "";
+            try {
+              bodyText = await response.text();
+            } catch {
+            }
+            throw new Error(`HTTP ${response.status}${bodyText ? `: ${bodyText}` : ""}`);
+          }
+          const data = await response.json();
+          const content = data.content;
+          const rawText = content?.[0]?.text ?? "";
+          const u = data.usage;
+          const usage = u ? {
+            inputTokens: u.input_tokens,
+            outputTokens: u.output_tokens,
+            aiProvider: "anthropic",
+            aiModel: this.instance.model
+          } : void 0;
+          return {
+            rawText,
+            parsed: safeJsonParse(rawText),
+            ...usage ? { usage } : {}
+          };
+        } finally {
+          clearTimeout(timer);
+          signal.removeEventListener("abort", onAbort);
+        }
+      }
+    };
+    function createAnthropicApiExecutor(config, capabilityId = "anthropic-api", deps = {}) {
+      const rawApiKeyFrom = config.apiKeyFrom;
+      const rawApiKey = config.apiKey;
+      if (rawApiKeyFrom !== void 0 && rawApiKey !== void 0) {
+        throw new Error('AnthropicApiExecutor accepts either "apiKey" (static) or "apiKeyFrom" (dynamic), not both');
+      }
+      const resolveKey = rawApiKeyFrom !== void 0 ? buildDynamicResolver(config, deps) : buildStaticResolver(rawApiKey);
+      let baseUrl = DEFAULT_BASE_URL;
+      if (config.baseUrl !== void 0) {
+        if (typeof config.baseUrl !== "string" || config.baseUrl.length === 0) {
+          throw new Error('"baseUrl" must be a non-empty string when set');
+        }
+        baseUrl = config.baseUrl;
+      }
+      let model = DEFAULT_MODEL;
+      if (config.model !== void 0) {
+        if (typeof config.model !== "string" || config.model.length === 0) {
+          throw new Error('"model" must be a non-empty string when set');
+        }
+        model = config.model;
+      }
+      let maxTokens = DEFAULT_MAX_TOKENS;
+      if (config.maxTokens !== void 0) {
+        if (typeof config.maxTokens !== "number" || config.maxTokens <= 0) {
+          throw new Error('"maxTokens" must be a positive number');
+        }
+        maxTokens = config.maxTokens;
+      }
+      let timeoutMs = DEFAULT_TIMEOUT_MS;
+      if (config.timeout !== void 0) {
+        if (typeof config.timeout !== "number" || config.timeout <= 0) {
+          throw new Error('"timeout" must be a positive number');
+        }
+        timeoutMs = config.timeout;
+      }
+      return new AnthropicApiExecutor({
+        resolveKey,
+        baseUrl,
+        model,
+        maxTokens,
+        timeoutMs,
+        capabilityId
+      });
+    }
+    function buildStaticResolver(rawApiKey) {
+      if (typeof rawApiKey !== "string" || rawApiKey.length === 0) {
+        throw new Error('AnthropicApiExecutor requires a non-empty "apiKey" string in config (or "apiKeyFrom: \\"job-metadata\\"" for dynamic key mode)');
+      }
+      const resolved = (0, env_ref_1.resolveEnvRef)(rawApiKey, "apiKey");
+      return async () => resolved;
+    }
+    function buildDynamicResolver(config, deps) {
+      if (config.apiKeyFrom !== "job-metadata") {
+        throw new Error(`Unsupported "apiKeyFrom" value: ${JSON.stringify(config.apiKeyFrom)}. Only "job-metadata" is supported in v0.2.`);
+      }
+      const keepApiUrl = resolveStringConfig(config, "keepApiUrl", "KEEP_API_URL");
+      const clientId = resolveStringConfig(config, "keepClientId", "KEEP_CLIENT_ID");
+      const clientSecret = resolveStringConfig(config, "keepClientSecret", "KEEP_CLIENT_SECRET");
+      const stmFactory = deps.buildServiceTokenManager ?? ((cfg) => new keep_1.ServiceTokenManager(cfg));
+      const stm = stmFactory({ keepApiUrl, clientId, clientSecret });
+      const keepClientFactory = deps.buildKeepClient ?? ((cfg) => new keep_1.KeepClient(cfg));
+      return async (req) => {
+        const hints = req.providerHints ?? {};
+        const customerId = typeof hints.customerId === "string" ? hints.customerId : void 0;
+        if (!customerId) {
+          throw new Error("AnthropicApiExecutor dynamic-key mode requires providerHints.customerId on every job");
+        }
+        const serviceToken = await stm.getToken();
+        if (!serviceToken) {
+          throw new Error("AnthropicApiExecutor dynamic-key mode failed to exchange a Keep service token. Check KEEP_CLIENT_ID / KEEP_CLIENT_SECRET.");
+        }
+        const keep = keepClientFactory({ baseUrl: keepApiUrl, serviceToken });
+        const reveal = await keep.revealManagedSifterKey(customerId);
+        return reveal.apiKey;
+      };
+    }
+    function resolveStringConfig(config, field, envFallback) {
+      const raw = config[field];
+      if (typeof raw === "string" && raw.length > 0) {
+        return (0, env_ref_1.resolveEnvRef)(raw, field);
+      }
+      const fromEnv = process.env[envFallback];
+      if (fromEnv && fromEnv.length > 0) {
+        return fromEnv;
+      }
+      throw new Error(`AnthropicApiExecutor dynamic-key mode requires "${field}" in config or the ${envFallback} env var`);
+    }
+    function safeJsonParse(s) {
+      try {
+        const parsed = JSON.parse(s);
+        return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/executors/webhook.js
 var require_webhook = __commonJS({
   "../../packages/shuttle/dist/executors/webhook.js"(exports2) {
@@ -17458,6 +17792,7 @@ var require_shuttle = __commonJS({
     var registry_1 = require_registry();
     var claude_code_1 = require_claude_code();
     var http_api_1 = require_http_api();
+    var anthropic_api_1 = require_anthropic_api();
     var webhook_1 = require_webhook();
     var custom_script_1 = require_custom_script();
     var logger_2 = require_logger2();
@@ -17555,6 +17890,7 @@ var require_shuttle = __commonJS({
       const all = [
         ["claude-code", claude_code_1.createClaudeCodeExecutor],
         ["http-api", http_api_1.createHttpApiExecutor],
+        ["anthropic-api", anthropic_api_1.createAnthropicApiExecutor],
         ["webhook", webhook_1.createWebhookExecutor],
         ["custom-script", custom_script_1.createCustomScriptExecutor]
       ];
@@ -17569,7 +17905,7 @@ var require_shuttle = __commonJS({
       const store = new store_1.PairingConfigStore(pairingFile);
       if (store.exists()) {
         const pairing = store.read();
-        const tokens = new keep_1.ServiceTokenManager({
+        const tokens = new keep_1.AgentTokenManager({
           keepApiUrl: pairing.keepApiUrl,
           clientId: pairing.credentials.clientId,
           clientSecret: pairing.credentials.clientSecret,
@@ -18099,69 +18435,67 @@ var require_dist4 = __commonJS({
   }
 });
 
-// package.json
-var require_package = __commonJS({
-  "package.json"(exports2, module2) {
-    module2.exports = {
-      name: "@whittlelabs/sifter",
-      version: "0.2.0",
-      description: "Whittle Sifter: paired AI reviewer for Whittle Sift attention pools.",
-      bin: {
-        "whittle-sifter": "./dist/bin.js"
-      },
-      main: "dist/bin.js",
-      engines: {
-        node: ">=20"
-      },
-      scripts: {
-        dev: "tsx watch src/bin.ts",
-        build: "node scripts/bundle.mjs",
-        typecheck: "tsc --noEmit",
-        start: "node dist/bin.js",
-        lint: "eslint src/"
-      },
-      publishConfig: {
-        registry: "https://registry.npmjs.org/",
-        access: "public"
-      },
-      repository: {
-        type: "git",
-        url: "https://github.com/whittlelabs/whittlelabs.git",
-        directory: "apps/whittle-sifter"
-      },
-      author: "Whittle Labs",
-      license: "UNLICENSED",
-      private: false,
-      dependencies: {
-        "@whittlelabs/shuttle": "workspace:*",
-        yaml: "^2.7.1"
-      },
-      devDependencies: {
-        "@types/node": "^20.10.5",
-        esbuild: "^0.25.0",
-        tsx: "^4.21.0",
-        typescript: "^5.3.3"
-      }
-    };
-  }
-});
-
 // src/bin.ts
 var import_shuttle2 = __toESM(require_dist4());
 
 // src/brand.ts
 var import_path = require("path");
 var import_promises = require("fs/promises");
+var import_readline = require("readline");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist4());
-var pkg = require_package();
+
+// package.json
+var package_default = {
+  name: "@whittlelabs/sifter",
+  version: "0.3.1",
+  description: "Whittle Sifter: paired AI reviewer for Whittle Sift attention pools.",
+  bin: {
+    "whittle-sifter": "./dist/bin.js"
+  },
+  main: "dist/bin.js",
+  engines: {
+    node: ">=20"
+  },
+  scripts: {
+    dev: "tsx watch src/bin.ts",
+    build: "node scripts/bundle.mjs",
+    typecheck: "tsc --noEmit",
+    start: "node dist/bin.js",
+    lint: "eslint src/"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org/",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/whittlelabs/whittlelabs.git",
+    directory: "apps/whittle-sifter"
+  },
+  author: "Whittle Labs",
+  license: "UNLICENSED",
+  private: false,
+  dependencies: {
+    "@whittlelabs/shuttle": "workspace:*",
+    yaml: "^2.7.1"
+  },
+  devDependencies: {
+    "@types/node": "^20.10.5",
+    esbuild: "^0.25.0",
+    tsx: "^4.21.0",
+    typescript: "^5.3.3"
+  }
+};
+
+// src/brand.ts
 var sifterBrand = {
   product: {
     id: "sifter",
     title: "Whittle Sifter",
     cliBinary: "whittle-sifter",
     packageName: "@whittlelabs/sifter",
-    version: pkg.version,
+    version: package_default.version,
     description: "Pairs with Whittle Sift to run AI code reviews on your hardware with your credentials."
   },
   paths: {
@@ -18172,10 +18506,10 @@ var sifterBrand = {
     // shared config across multiple machines.
     configSearchPaths: ["~/.sifter/sifter.yaml"]
   },
-  executorAllowlist: ["claude-code", "http-api", "webhook", "custom-script"],
+  executorAllowlist: ["claude-code", "anthropic-api", "http-api", "webhook", "custom-script"],
   keepRegistration: {
-    keepApiUrl: process.env.KEEP_API_URL ?? "https://keep.staging.whittlelabs.com",
-    jobsApiUrl: process.env.JOBS_API_URL ?? "https://jobs.staging.whittlelabs.com",
+    keepApiUrl: process.env.KEEP_API_URL ?? "https://keep.stage.whittlelabs.com",
+    jobsApiUrl: process.env.JOBS_API_URL ?? "https://jobs.stage.whittlelabs.com",
     oauthClientId: process.env.SIFTER_OAUTH_CLIENT_ID ?? "sifter",
     orgSlug: "whittle-labs",
     roleSlug: "sift-sifter",
@@ -18191,20 +18525,39 @@ var sifterBrand = {
       id: "scaffold-run-config",
       phase: "post-pair",
       // The substrate's run command requires a YAML describing pools,
-      // executors, and Jobs auth. At v0.1 the Sifter has no per-user
-      // executor variation worth surfacing, so we synthesize the YAML
-      // here from the pairing config that init just wrote. The user
-      // never has to author the file by hand. If the file already
-      // exists from a prior pair, leave it alone so any local tweaks
-      // survive re-pairing.
-      run: async ({ configDir }) => {
-        const yamlPath = (0, import_path.join)(configDir, "sifter.yaml");
-        const pairing = new import_shuttle.PairingConfigStore((0, import_path.join)(configDir, "config.json")).read();
+      // executors, and Jobs auth. The web form that minted the pair command
+      // bakes the user's product-level choices (executor type, poll interval)
+      // into the init flags; this step reads them from `ctx.setupOptions`.
+      //
+      // A re-pair must refresh the pairing-derived fields (Jobs URL, service
+      // identity, pools) even when sifter.yaml already exists — otherwise a
+      // stale file silently shadows the new pairing (exactly how a leftover
+      // `localhost:3005` and an old `cwd` once survived a fresh pair). So we
+      // merge rather than skip: rebuild the pairing fields from `pairing`, carry
+      // over the user's executor block (e.g. claude-code `cwd`) and polling
+      // unless a fresh flag overrides them, and log what happened. We only
+      // (re)scaffold an executor block — which may prompt for `cwd` — when there
+      // isn't one to preserve.
+      run: async (ctx) => {
+        const yamlPath = (0, import_path.join)(ctx.configDir, "sifter.yaml");
+        const pairing = new import_shuttle.PairingConfigStore((0, import_path.join)(ctx.configDir, "config.json")).read();
         if (pairing.attentionPools.length === 0) {
           throw new Error(
             "Pairing returned no attention pools. The Sift backend should have provisioned one for this user during pre-pair."
           );
         }
+        let existing = {};
+        try {
+          existing = (0, import_yaml.parse)(await (0, import_promises.readFile)(yamlPath, "utf8")) ?? {};
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+        }
+        const isUpdate = Object.keys(existing).length > 0;
+        const existingExecutors = existing.executors ?? {};
+        const existingPools = Array.isArray(existing.pools) ? existing.pools : [];
+        const priorExecutor = typeof existingPools[0]?.executor === "string" ? existingPools[0].executor : void 0;
+        const executor = ctx.setupOptions.executor ?? priorExecutor ?? "claude-code";
+        const executorBlock = !ctx.setupOptions.executor && existingExecutors[executor] !== void 0 ? existingExecutors[executor] : await buildExecutorBlock(executor, ctx);
         const doc = {
           auth: {
             jobsApiUrl: pairing.jobsApiUrl
@@ -18216,21 +18569,55 @@ var sifterBrand = {
           pools: pairing.attentionPools.map((p) => ({
             id: p.id,
             name: p.name,
-            executor: "claude-code"
+            executor
           })),
           executors: {
-            "claude-code": { type: "claude-code" }
+            ...existingExecutors,
+            [executor]: executorBlock
           }
         };
-        await (0, import_promises.mkdir)(configDir, { recursive: true });
-        await (0, import_promises.writeFile)(yamlPath, (0, import_yaml.stringify)(doc), { flag: "wx" }).catch((err) => {
-          if (err.code === "EEXIST") return;
-          throw err;
-        });
+        const pollIntervalMs = ctx.setupOptions.pollIntervalMs ?? existing.polling?.intervalMs;
+        if (pollIntervalMs !== void 0) {
+          doc.polling = { intervalMs: pollIntervalMs };
+        }
+        await (0, import_promises.mkdir)(ctx.configDir, { recursive: true });
+        await (0, import_promises.writeFile)(yamlPath, (0, import_yaml.stringify)(doc));
+        ctx.log(
+          isUpdate ? `Refreshed ${yamlPath} from this pairing (Jobs URL, identity, pools); kept your executor and polling settings.` : `Wrote ${yamlPath}.`
+        );
       }
     }
   ]
 };
+async function buildExecutorBlock(executor, ctx) {
+  switch (executor) {
+    case "claude-code": {
+      const cwd = ctx.setupOptions.cwd ?? await promptForCwd(`Where should Claude Code run? [${process.cwd()}]: `, process.cwd());
+      return { type: "claude-code", cwd };
+    }
+    case "anthropic-api": {
+      return {
+        type: "anthropic-api",
+        apiKey: "${ANTHROPIC_API_KEY}"
+      };
+    }
+    default:
+      return { type: executor };
+  }
+}
+async function promptForCwd(prompt, fallback) {
+  if (!process.stdin.isTTY) return fallback;
+  const rl = (0, import_readline.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(prompt, (input) => resolve(input));
+    });
+    const trimmed = answer.trim();
+    return trimmed.length === 0 ? fallback : trimmed;
+  } finally {
+    rl.close();
+  }
+}
 
 // src/bin.ts
 (0, import_shuttle2.createCli)(sifterBrand).parseAsync(process.argv).catch((err) => {