@whittlelabs/sifter 0.22.3 → 0.24.0

package/README.md

@@ -4,8 +4,8 @@ The Whittle Sifter is a paired AI reviewer for [Whittle Sift](https://sift.whitt
 
 ## Install
 
-`@whittlelabs/sifter` is published publicly to npmjs.com (released by
-`sifter-release.yml` on a version bump):
+`@whittlelabs/sifter` is published publicly to npmjs.com (released by the
+delivery pipeline on a version bump):
 
 ```bash
 npm install -g @whittlelabs/sifter

package/bin.js

@@ -18983,11 +18983,36 @@ var require_client2 = __commonJS({
         return this.request("POST", "/api/actor-tokens", { actor });
       }
       // ── Identity ────────────────────────────────────────────────────
+      /**
+       * Sign up. This NEVER returns an account or a session: Keep answers 201 with
+       * an email-verification challenge, which is answered at
+       * POST /api/challenges/:token/response to mint a session.
+       */
       async createAccount(email, password, name) {
-        return this.request("POST", "/api/accounts", { email, password, name });
+        const body = await this.envelope("POST", "/api/accounts", { email, password, name });
+        if (!body.challenge) {
+          throw new Error("sign-up returned no challenge; the contract expects one");
+        }
+        return body.challenge;
       }
+      /**
+       * Sign in. Two legitimate outcomes, neither an error: a session, or a
+       * challenge (MFA, unverified email). Both arrive on HTTP 200.
+       */
       async createSession(email, password) {
-        return this.request("POST", "/api/sessions", { email, password });
+        const body = await this.envelope("POST", "/api/sessions", { email, password });
+        if (body.challenge) {
+          return { kind: "challenge", challenge: body.challenge };
+        }
+        const data = body.data;
+        if (!data?.session) {
+          throw new Error("sign-in returned neither a session nor a challenge");
+        }
+        return { kind: "session", user: data.user, session: data.session };
+      }
+      /** Answer a challenge and obtain the session it was standing in for. */
+      async respondToChallenge(challengeToken, type, response) {
+        return this.request("POST", `/api/challenges/${encodeURIComponent(challengeToken)}/response`, { type, response });
       }
       async destroySession(refreshToken) {
         await this.request("DELETE", "/api/sessions", refreshToken ? { refreshToken } : void 0);
@@ -19133,6 +19158,28 @@ var require_client2 = __commonJS({
         return this.request("GET", `/api/users/${encodeURIComponent(userId)}/github-token`);
       }
       // ── HTTP ────────────────────────────────────────────────────────
+      /**
+       * Reads the response envelope WITHOUT treating `success: false` as a
+       * failure. Sign-in and sign-up use it because a challenge arrives on a 2xx
+       * with success:false and no error object — `request` would raise a
+       * misleading "Request failed with status 200" and give the caller no way to
+       * tell MFA from a bad password (whittlelabs#530). A real error still throws.
+       */
+      async envelope(method, path, body) {
+        const response = await fetch(`${this.baseUrl}${path}`, {
+          method,
+          headers: this.headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        const json = await response.json();
+        if (!response.ok || !json.success && !json.challenge) {
+          const error = new Error(json.error?.message ?? `Request failed with status ${response.status}`);
+          error.code = json.error?.code;
+          error.statusCode = response.status;
+          throw error;
+        }
+        return json;
+      }
       async request(method, path, body) {
         const url = `${this.baseUrl}${path}`;
         const response = await fetch(url, {
@@ -19873,6 +19920,15 @@ var require_claude_code = __commonJS({
     var progress_1 = require_progress();
     var apply_1 = require_apply();
     var DEFAULT_TIMEOUT = 6e5;
+    function describeClaudeFailure(meta, fallback) {
+      if (!meta)
+        return fallback;
+      const status = meta.apiErrorStatus !== null ? ` (provider HTTP ${meta.apiErrorStatus})` : "";
+      if (meta.detail)
+        return `${meta.detail}${status}`;
+      const subtype = meta.subtype && meta.subtype !== "success" ? `: ${meta.subtype}` : "";
+      return `${fallback}${subtype}${status}`;
+    }
     var ClaudeCodeExecutor = class {
       capability;
       strategies = [loom_1.PROMPT_EXECUTION_STRATEGY];
@@ -20100,7 +20156,7 @@ var require_claude_code = __commonJS({
               try {
                 const stream = parseStreamJson(stdout);
                 if (stream.resultMeta?.isError) {
-                  throw new Error(`Claude Code reported ${stream.resultMeta.subtype ?? "an error"} on its terminal event`);
+                  throw new Error(describeClaudeFailure(stream.resultMeta, "Claude Code reported a failure"));
                 }
                 const answerText = stream.finalText ?? stdout;
                 const parsed = stream.structuredOutput ?? extractJsonObject(answerText);
@@ -20137,7 +20193,12 @@ var require_claude_code = __commonJS({
                 settle(() => reject(err instanceof Error ? err : new Error(String(err))));
               }
             } else {
-              settle(() => reject(new Error(`Claude Code exited with code ${code}`)));
+              let meta = null;
+              try {
+                meta = parseStreamJson(stdout).resultMeta;
+              } catch {
+              }
+              settle(() => reject(new Error(describeClaudeFailure(meta, `Claude Code exited with code ${code}`))));
             }
           });
         });
@@ -20232,7 +20293,12 @@ var require_claude_code = __commonJS({
           }
           resultMeta = {
             subtype: typeof event.subtype === "string" ? event.subtype : null,
-            isError: event.is_error === true
+            isError: event.is_error === true,
+            // On a failure the CLI puts a human-readable reason in `result` — the
+            // model was unavailable, spend limit hit, and so on. It is the only
+            // place that reason exists, so keep it for the failure message.
+            detail: typeof event.result === "string" && event.result.trim().length > 0 ? event.result.trim() : null,
+            apiErrorStatus: typeof event.api_error_status === "number" ? event.api_error_status : null
           };
           const so = event.structured_output;
           if (so && typeof so === "object" && !Array.isArray(so)) {
@@ -22302,7 +22368,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.22.3" : pkg.version;
+var buildVersion = true ? "0.24.0" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",