@whittlelabs/sifter 0.29.0 → 0.30.0

package/README.md

@@ -21,15 +21,35 @@ Visit Sift's **Settings → Pair a Sifter**. Sift will display a pairing code an
 whittle-sifter init --pairing-code=ABCD-1234
 ```
 
-The Sifter defaults to production (`https://keep.whittlelabs.com`). To pair against stage, test, or any other environment, pass `--keep-url`:
+The Sifter defaults to production. To pair against another Whittle Labs environment, name it with `--profile`: the name selects the backend as well as the directory the pairing lands in.
 
 ```bash
-whittle-sifter init \
-  --keep-url=https://keep.stage.whittlelabs.com \
-  --pairing-code=ABCD-1234
+whittle-sifter init --profile stage      # keep.stage / jobs.stage
+whittle-sifter init --profile test       # keep.test / jobs.test
+whittle-sifter init --profile studio     # a dev stack on the Studio
 ```
 
-Pairing writes credentials to `~/.sifter/config.json` (mode 0600).
+The known names are `prod`, `stage`, `test` and `studio`. For any other backend, keep the profile as a label and pass the URLs yourself; a flag always beats the environment it would otherwise have resolved:
+
+```bash
+whittle-sifter init --profile my-box \
+  --keep-url=http://box.local:3007 \
+  --jobs-url=http://box.local:3005
+```
+
+Whenever a profile or a URL flag is in play, `init` prints what it resolved before it pairs, so a host that has moved is something you see rather than something you debug:
+
+```
+Pairing environment
+  Profile:     stage
+  Environment: stage (named by this build)
+  Keep:        https://keep.stage.whittlelabs.com   from the "stage" environment
+  Jobs:        https://jobs.stage.whittlelabs.com   from the "stage" environment
+```
+
+Once the backend answers, one more line names the page it sent you to, which is its decision and not the CLI's. Add `--json` to get those two facts as JSON objects, one per line.
+
+Pairing writes credentials to `~/.sifter/<profile>/config.json` (mode 0600), or `~/.sifter/config.json` for the default profile.
 
 ## Run
 

package/bin.js

@@ -11604,6 +11604,120 @@ var require_version_check = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/branding/environment.js
+var require_environment = __commonJS({
+  "../../packages/shuttle/dist/branding/environment.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolveEnvironment = resolveEnvironment;
+    exports2.applyEnvironment = applyEnvironment;
+    exports2.isWorthReporting = isWorthReporting;
+    exports2.renderEnvironmentReport = renderEnvironmentReport;
+    exports2.renderVerificationLine = renderVerificationLine;
+    exports2.environmentReportJson = environmentReportJson;
+    exports2.verificationJson = verificationJson;
+    exports2.hostOf = hostOf;
+    function resolveEnvironment(brand, profile, overrides = {}) {
+      const table = brand.environments ?? {};
+      const known = Object.keys(table).sort();
+      const matched = Object.prototype.hasOwnProperty.call(table, profile) ? profile : null;
+      const entry = matched === null ? void 0 : table[matched];
+      return {
+        profile,
+        environment: matched,
+        known,
+        keep: pick(overrides.keepUrl, entry?.keepApiUrl, brand.keepRegistration.keepApiUrl),
+        jobs: pick(overrides.jobsUrl, entry?.jobsApiUrl, brand.keepRegistration.jobsApiUrl)
+      };
+    }
+    function pick(flag, fromEnvironment, brandDefault) {
+      if (flag)
+        return { url: flag, source: "flag" };
+      if (fromEnvironment)
+        return { url: fromEnvironment, source: "environment" };
+      return { url: brandDefault, source: "brand-default" };
+    }
+    function applyEnvironment(brand, resolved) {
+      const reg = brand.keepRegistration;
+      if (resolved.keep.url === reg.keepApiUrl && resolved.jobs.url === reg.jobsApiUrl) {
+        return brand;
+      }
+      return {
+        ...brand,
+        keepRegistration: {
+          ...reg,
+          keepApiUrl: resolved.keep.url,
+          jobsApiUrl: resolved.jobs.url
+        }
+      };
+    }
+    function isWorthReporting(resolved) {
+      return resolved.environment !== null || resolved.keep.source === "flag" || resolved.jobs.source === "flag";
+    }
+    function renderEnvironmentReport(resolved) {
+      return [
+        "",
+        "Pairing environment",
+        field("Profile", resolved.profile),
+        field("Environment", describeEnvironment(resolved)),
+        field("Keep", `${resolved.keep.url}   ${describeSource(resolved, resolved.keep)}`),
+        field("Jobs", `${resolved.jobs.url}   ${describeSource(resolved, resolved.jobs)}`),
+        ""
+      ];
+    }
+    function renderVerificationLine(verificationUri) {
+      return field("Verify at", `${hostOf(verificationUri)}   as Keep reported it`);
+    }
+    function environmentReportJson(resolved) {
+      return JSON.stringify({
+        kind: "pairing-environment",
+        profile: resolved.profile,
+        environment: resolved.environment,
+        known: resolved.known,
+        keep: resolved.keep,
+        jobs: resolved.jobs
+      });
+    }
+    function verificationJson(verificationUri) {
+      return JSON.stringify({
+        kind: "pairing-verification",
+        verificationUri,
+        host: hostOf(verificationUri),
+        source: "keep"
+      });
+    }
+    function field(label, value) {
+      return `  ${`${label}:`.padEnd(13)}${value}`;
+    }
+    function describeEnvironment(resolved) {
+      if (resolved.environment !== null) {
+        return `${resolved.environment} (named by this build)`;
+      }
+      if (resolved.known.length === 0) {
+        return "none (this build declares no environments)";
+      }
+      return `none (this build knows ${resolved.known.join(", ")})`;
+    }
+    function describeSource(resolved, url) {
+      switch (url.source) {
+        case "flag":
+          return "from the flag you passed";
+        case "environment":
+          return `from the "${resolved.environment ?? ""}" environment`;
+        default:
+          return "from the brand default";
+      }
+    }
+    function hostOf(url) {
+      try {
+        return new URL(url).host;
+      } catch {
+        return url;
+      }
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/preflight/checks.js
 var require_checks = __commonJS({
   "../../packages/shuttle/dist/preflight/checks.js"(exports2) {
@@ -11619,6 +11733,7 @@ var require_checks = __commonJS({
     var loom_1 = require_dist();
     var version_check_1 = require_version_check();
     var apply_1 = require_apply();
+    var environment_1 = require_environment();
     var NODE_FLOOR = "20.0.0";
     var DISK_FLOOR_BYTES = 1024 * 1024 * 1024;
     var WORKSPACE_EXECUTOR = "claude-code";
@@ -11745,7 +11860,7 @@ var require_checks = __commonJS({
           if (strays.length > 0) {
             return fail("pairing-environment", `the config claims from ${strays.join(", ")}, which this pairing is not rostered into`, `run \`${subject.brand.product.cliBinary} init\` to rewrite the config from this pairing`);
           }
-          return pass("pairing-environment", `config and pairing both use ${pairing.jobsApiUrl}`);
+          return pass("pairing-environment", `paired with Keep at ${(0, environment_1.hostOf)(pairing.keepApiUrl)}, claiming from Jobs at ${(0, environment_1.hostOf)(pairing.jobsApiUrl)}`);
         });
       }
     };
@@ -22369,6 +22484,7 @@ var require_device_code = __commonJS({
             throw err;
           throw new Error(webFirstRemedy(opts.brand, err));
         }
+        opts.onVerificationUri?.(device.verificationUri);
         const invitation = (0, terminal_1.renderPairingInvitation)({
           header: opts.brand.strings?.pairingHeader ?? `Pair your ${opts.brand.product.title}`,
           verificationUri: device.verificationUri,
@@ -22712,24 +22828,31 @@ var require_init = __commonJS({
     var fsp = __importStar(require("fs/promises"));
     var commander_1 = require_commander();
     var apply_1 = require_apply();
+    var environment_1 = require_environment();
     var device_code_1 = require_device_code();
     var store_1 = require_store();
     var spend_store_1 = require_spend_store();
     var typed_exit_1 = require_typed_exit();
     var preflight_1 = require_preflight();
     function buildInitCommand(brand) {
-      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--tmp-dir <path>", "Base directory for each job's throwaway checkout (defaults to the OS temp dir; set only when that is unsuitable)").option("-p, --profile <name>", 'Config profile to pair into (isolates this pairing under its own dir; default "default")').action(async (options) => {
+      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL, beating both the profile's environment and the brand default").option("--jobs-url <url>", "Override the Jobs API URL, beating both the profile's environment and the brand default").option("--json", "Print the resolved pairing environment as JSON, one object per line; the rest of the output is unchanged").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--tmp-dir <path>", "Base directory for each job's throwaway checkout (defaults to the OS temp dir; set only when that is unsuitable)").option("-p, --profile <name>", profileFlagDescription(brand)).action(async (options) => {
         try {
           const profile = (0, apply_1.resolveProfile)(brand, options.profile);
           const setupOptions = parseSetupOptions(brand, options);
-          const effectiveBrand = options.keepUrl || options.jobsUrl ? {
-            ...brand,
-            keepRegistration: {
-              ...brand.keepRegistration,
-              ...options.keepUrl ? { keepApiUrl: options.keepUrl } : {},
-              ...options.jobsUrl ? { jobsApiUrl: options.jobsUrl } : {}
-            }
-          } : brand;
+          const asJson = options.json === true;
+          const environment = (0, environment_1.resolveEnvironment)(brand, profile, {
+            keepUrl: options.keepUrl,
+            jobsUrl: options.jobsUrl
+          });
+          const effectiveBrand = (0, environment_1.applyEnvironment)(brand, environment);
+          const report = (0, environment_1.isWorthReporting)(environment);
+          if (report) {
+            if (asJson)
+              console.log((0, environment_1.environmentReportJson)(environment));
+            else
+              for (const line of (0, environment_1.renderEnvironmentReport)(environment))
+                console.log(line);
+          }
           const paths = (0, apply_1.resolvePaths)(effectiveBrand, profile);
           await fsp.mkdir(paths.configDir, { recursive: true });
           for (const step of effectiveBrand.setupSteps ?? []) {
@@ -22759,7 +22882,14 @@ var require_init = __commonJS({
           }
           const pairing = await (0, device_code_1.pair)({
             brand: effectiveBrand,
-            pairingCode: options.pairingCode
+            pairingCode: options.pairingCode,
+            // Keep's answer is the half no local table can predict: it
+            // builds `verification_uri` from its OWN configuration, so a
+            // tier pointed at a page nobody serves looks exactly like a
+            // healthy one until an operator opens the link.
+            ...report ? {
+              onVerificationUri: (uri) => console.log(asJson ? (0, environment_1.verificationJson)(uri) : (0, environment_1.renderVerificationLine)(uri))
+            } : {}
           });
           const store = new store_1.PairingConfigStore(paths.configFile);
           await store.write(pairing);
@@ -22799,6 +22929,13 @@ var require_init = __commonJS({
         }
       });
     }
+    function profileFlagDescription(brand) {
+      const known = Object.keys(brand.environments ?? {}).sort();
+      const base = 'Config profile to pair into (isolates this pairing under its own dir; default "default")';
+      if (known.length === 0)
+        return base;
+      return `${base}. These names also select the backend: ${known.join(", ")}`;
+    }
     function parseSetupOptions(brand, raw) {
       const out = {};
       if (raw.executor !== void 0) {
@@ -25096,7 +25233,8 @@ var require_dist5 = __commonJS({
   "../../packages/shuttle/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.environmentReportJson = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.revokePairing = void 0;
     var cli_1 = require_cli();
     Object.defineProperty(exports2, "createCli", { enumerable: true, get: function() {
       return cli_1.createCli;
@@ -25220,6 +25358,31 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "renderTemplate", { enumerable: true, get: function() {
       return apply_1.renderTemplate;
     } });
+    var environment_1 = require_environment();
+    Object.defineProperty(exports2, "applyEnvironment", { enumerable: true, get: function() {
+      return environment_1.applyEnvironment;
+    } });
+    Object.defineProperty(exports2, "environmentReportJson", { enumerable: true, get: function() {
+      return environment_1.environmentReportJson;
+    } });
+    Object.defineProperty(exports2, "hostOf", { enumerable: true, get: function() {
+      return environment_1.hostOf;
+    } });
+    Object.defineProperty(exports2, "isWorthReporting", { enumerable: true, get: function() {
+      return environment_1.isWorthReporting;
+    } });
+    Object.defineProperty(exports2, "renderEnvironmentReport", { enumerable: true, get: function() {
+      return environment_1.renderEnvironmentReport;
+    } });
+    Object.defineProperty(exports2, "renderVerificationLine", { enumerable: true, get: function() {
+      return environment_1.renderVerificationLine;
+    } });
+    Object.defineProperty(exports2, "resolveEnvironment", { enumerable: true, get: function() {
+      return environment_1.resolveEnvironment;
+    } });
+    Object.defineProperty(exports2, "verificationJson", { enumerable: true, get: function() {
+      return environment_1.verificationJson;
+    } });
     var defaults_1 = require_defaults2();
     Object.defineProperty(exports2, "SUBSTRATE_BRAND", { enumerable: true, get: function() {
       return defaults_1.SUBSTRATE_BRAND;
@@ -25259,7 +25422,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist4());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.29.0" : pkg.version;
+var buildVersion = true ? "0.30.0" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",
@@ -25307,6 +25470,40 @@ var sifterBrand = {
       ]
     }
   },
+  // The environments Whittle Labs operates, keyed by the profile name that
+  // selects one. `init --profile stage` resolves both URLs from here, so a
+  // non-prod pairing is one flag instead of three and there is no host to
+  // mistype. `--keep-url` / `--jobs-url` still win, which is what keeps a
+  // backend Whittle Labs does not run reachable.
+  //
+  // `prod` is stated even though it duplicates the defaults below: a person
+  // reading `--help` should see the whole set, and a profile literally named
+  // `prod` should resolve rather than fall through to a default that only
+  // happens to agree. The DEFAULT profile ("default") is deliberately not a
+  // key — it is not an environment name, and it keeps its historic meaning
+  // of "the brand's own defaults", which are production's.
+  //
+  // `studio` is the local dev fleet on this machine, reachable over Tailscale
+  // at the `studio.whittlelabs.com` hostname rather than `localhost`, because
+  // a pairing made from a phone or a second machine has to resolve too.
+  environments: {
+    prod: {
+      keepApiUrl: "https://keep.whittlelabs.com",
+      jobsApiUrl: "https://jobs.whittlelabs.com"
+    },
+    stage: {
+      keepApiUrl: "https://keep.stage.whittlelabs.com",
+      jobsApiUrl: "https://jobs.stage.whittlelabs.com"
+    },
+    test: {
+      keepApiUrl: "https://keep.test.whittlelabs.com",
+      jobsApiUrl: "https://jobs.test.whittlelabs.com"
+    },
+    studio: {
+      keepApiUrl: "http://studio.whittlelabs.com:3007",
+      jobsApiUrl: "http://studio.whittlelabs.com:3005"
+    }
+  },
   keepRegistration: {
     keepApiUrl: process.env.KEEP_API_URL ?? "https://keep.whittlelabs.com",
     jobsApiUrl: process.env.JOBS_API_URL ?? "https://jobs.whittlelabs.com",