@whittlelabs/sifter 0.29.0 → 0.30.1

package/README.md

@@ -21,15 +21,35 @@ Visit Sift's **Settings → Pair a Sifter**. Sift will display a pairing code an
 whittle-sifter init --pairing-code=ABCD-1234
 ```
 
-The Sifter defaults to production (`https://keep.whittlelabs.com`). To pair against stage, test, or any other environment, pass `--keep-url`:
+The Sifter defaults to production. To pair against another Whittle Labs environment, name it with `--profile`: the name selects the backend as well as the directory the pairing lands in.
 
 ```bash
-whittle-sifter init \
-  --keep-url=https://keep.stage.whittlelabs.com \
-  --pairing-code=ABCD-1234
+whittle-sifter init --profile stage      # keep.stage / jobs.stage
+whittle-sifter init --profile test       # keep.test / jobs.test
+whittle-sifter init --profile studio     # a dev stack on the Studio
 ```
 
-Pairing writes credentials to `~/.sifter/config.json` (mode 0600).
+The known names are `prod`, `stage`, `test` and `studio`. For any other backend, keep the profile as a label and pass the URLs yourself; a flag always beats the environment it would otherwise have resolved:
+
+```bash
+whittle-sifter init --profile my-box \
+  --keep-url=http://box.local:3007 \
+  --jobs-url=http://box.local:3005
+```
+
+Whenever a profile or a URL flag is in play, `init` prints what it resolved before it pairs, so a host that has moved is something you see rather than something you debug:
+
+```
+Pairing environment
+  Profile:     stage
+  Environment: stage (named by this build)
+  Keep:        https://keep.stage.whittlelabs.com   from the "stage" environment
+  Jobs:        https://jobs.stage.whittlelabs.com   from the "stage" environment
+```
+
+Once the backend answers, one more line names the page it sent you to, which is its decision and not the CLI's. Add `--json` to get those two facts as JSON objects, one per line.
+
+Pairing writes credentials to `~/.sifter/<profile>/config.json` (mode 0600), or `~/.sifter/config.json` for the default profile.
 
 ## Run
 

package/bin.js

@@ -10008,6 +10008,8 @@ var require_claude_code = __commonJS({
     exports2.createClaudeCodeExecutor = createClaudeCodeExecutor;
     exports2.parseStreamJson = parseStreamJson;
     exports2.relativeWorkspaceReads = relativeWorkspaceReads;
+    exports2.globToRegExp = globToRegExp;
+    exports2.creditOverlayReads = creditOverlayReads;
     exports2.extractJsonObject = extractJsonObject;
     var child_process_1 = require("child_process");
     var fs_1 = require("fs");
@@ -10092,12 +10094,11 @@ var require_claude_code = __commonJS({
             promptOnlyScratch = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-cc-run-"));
           }
           const runCwd = workspace?.cwd ?? promptOnlyScratch;
-          const { response, readPaths, toolText } = await this.runClaude(prompt, spec, runCwd, childEnv, signal, hintedModel, reporter);
+          const { response, readPaths, toolInputs } = await this.runClaude(prompt, spec, runCwd, childEnv, signal, hintedModel, reporter, void 0, dispatch.job.id);
           if (workspace) {
             const reads = [...readPaths];
-            for (const rel of workspace.overlay?.writtenPaths ?? []) {
-              if (toolText.includes(rel))
-                reads.push(path_1.default.join(runCwd, rel));
+            for (const rel of creditOverlayReads(toolInputs, workspace.overlay?.writtenPaths ?? [])) {
+              reads.push(path_1.default.join(runCwd, rel));
             }
             response.outputs.push({
               label: "workspace_reads",
@@ -10155,14 +10156,14 @@ var require_claude_code = __commonJS({
             outputLabel: handle.outputLabel,
             outputSchema: handle.outputSchema
           };
-          const { response } = await this.runClaude(followUp, spec, scratch, handle.childEnv, signal, handle.model, null, handle.sessionId);
+          const { response } = await this.runClaude(followUp, spec, scratch, handle.childEnv, signal, handle.model, null, handle.sessionId, `${handle.sessionId}-repair`);
           return response;
         } finally {
           await fs_1.promises.rm(scratch, { recursive: true, force: true }).catch(() => {
           });
         }
       }
-      runClaude(prompt, spec, cwd, childEnv, signal, modelOverride, reporter, resumeSessionId) {
+      runClaude(prompt, spec, cwd, childEnv, signal, modelOverride, reporter, resumeSessionId, transcriptName) {
         const outputLabel = spec.outputLabel;
         const model = modelOverride ?? this.config.model;
         return new Promise((resolve, reject) => {
@@ -10251,6 +10252,9 @@ var require_claude_code = __commonJS({
               tap.end();
             }
             const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
+            if (this.config.keepTranscripts && transcriptName) {
+              void keepTranscript((0, apply_1.expandHome)(this.config.keepTranscripts), transcriptName, stdout);
+            }
             if (code === 0) {
               try {
                 const stream = parseStreamJson(stdout);
@@ -10286,7 +10290,7 @@ var require_claude_code = __commonJS({
                     } : {}
                   },
                   readPaths: stream.readPaths,
-                  toolText: stream.toolText
+                  toolInputs: stream.toolInputs
                 }));
               } catch (err) {
                 settle(() => reject(err instanceof Error ? err : new Error(String(err))));
@@ -10334,6 +10338,12 @@ var require_claude_code = __commonJS({
         }
         validated.timeout = config.timeout;
       }
+      if (config.keepTranscripts !== void 0) {
+        if (typeof config.keepTranscripts !== "string" || config.keepTranscripts.length === 0) {
+          throw new Error('"keepTranscripts" must be a non-empty directory path');
+        }
+        validated.keepTranscripts = config.keepTranscripts;
+      }
       if (config.overlayAllowedHosts !== void 0) {
         if (!Array.isArray(config.overlayAllowedHosts) || !config.overlayAllowedHosts.every((h) => typeof h === "string")) {
           throw new Error('"overlayAllowedHosts" must be an array of strings');
@@ -10358,7 +10368,7 @@ var require_claude_code = __commonJS({
       let resultMeta = null;
       let structuredOutput = null;
       let sessionId = null;
-      let toolText = "";
+      const toolInputs = [];
       for (const line of stdout.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed.startsWith("{"))
@@ -10384,7 +10394,7 @@ var require_claude_code = __commonJS({
               readPaths.push(fp);
             }
             if (b.input && typeof b.input === "object")
-              toolText += JSON.stringify(b.input);
+              toolInputs.push(JSON.stringify(b.input));
           }
         } else if (event.type === "result") {
           if (typeof event.result === "string" && event.result.trim().length > 0) {
@@ -10412,24 +10422,131 @@ var require_claude_code = __commonJS({
           };
         }
       }
-      return { finalText, readPaths, usage, resultMeta, structuredOutput, sessionId, toolText };
+      return { finalText, readPaths, usage, resultMeta, structuredOutput, sessionId, toolInputs };
     }
     var MAX_REPORTED_READS = 2e3;
     function relativeWorkspaceReads(readPaths, cwd) {
       const root = path_1.default.resolve(cwd);
+      const roots = [root];
+      try {
+        const real = (0, fs_1.realpathSync)(root);
+        if (real !== root)
+          roots.push(real);
+      } catch {
+      }
       const out = /* @__PURE__ */ new Set();
       for (const p of readPaths) {
         const resolved = path_1.default.resolve(root, p);
-        if (resolved === root)
-          continue;
-        if (!resolved.startsWith(root + path_1.default.sep))
-          continue;
-        out.add(resolved.slice(root.length + 1));
+        for (const r of roots) {
+          if (resolved === r)
+            break;
+          if (!resolved.startsWith(r + path_1.default.sep))
+            continue;
+          out.add(resolved.slice(r.length + 1));
+          break;
+        }
         if (out.size >= MAX_REPORTED_READS)
           break;
       }
       return [...out].sort();
     }
+    var GLOB_CHARS = /[*?[{]/;
+    function escapeRegExp(s) {
+      return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+    function globToRegExp(glob) {
+      let re = "^";
+      for (let i = 0; i < glob.length; i++) {
+        const ch = glob[i];
+        if (ch === "*") {
+          if (glob[i + 1] === "*") {
+            if (glob[i + 2] === "/") {
+              re += "(?:.*/)?";
+              i += 2;
+            } else {
+              re += ".*";
+              i += 1;
+            }
+          } else {
+            re += "[^/]*";
+          }
+        } else if (ch === "?") {
+          re += "[^/]";
+        } else if (ch === "[") {
+          const end = glob.indexOf("]", i + 1);
+          if (end === -1)
+            return null;
+          let cls = glob.slice(i + 1, end);
+          if (cls.startsWith("!"))
+            cls = `^${cls.slice(1)}`;
+          re += `[${cls.replace(/\\/g, "\\\\")}]`;
+          i = end;
+        } else if (ch === "{") {
+          const end = glob.indexOf("}", i + 1);
+          if (end === -1)
+            return null;
+          re += `(?:${glob.slice(i + 1, end).split(",").map(escapeRegExp).join("|")})`;
+          i = end;
+        } else {
+          re += escapeRegExp(ch);
+        }
+      }
+      return new RegExp(`${re}$`);
+    }
+    function creditOverlayReads(toolInputs, writtenPaths) {
+      if (writtenPaths.length === 0 || toolInputs.length === 0)
+        return [];
+      const dirs = /* @__PURE__ */ new Set();
+      for (const rel of writtenPaths) {
+        const parts = rel.split("/");
+        for (let i = 1; i < parts.length; i++)
+          dirs.add(`${parts.slice(0, i).join("/")}/`);
+      }
+      const dirAlt = [...dirs].map(escapeRegExp).join("|");
+      const wordRe = dirs.size > 0 ? new RegExp(`(?:${dirAlt})[^\\s"'\`;|&<>(),\\\\]*`, "g") : null;
+      const findRe = dirs.size > 0 ? new RegExp(`\\bfind\\s+(?:\\./)?(${[...dirs].map((d) => escapeRegExp(d.slice(0, -1))).join("|")})/?(?=\\s|$)`, "g") : null;
+      const readerRe = /(?:^|[\s"])(?:-exec|-execdir|xargs)\b[^;|&]*\b(?:cat|head|tail|sed|awk|less|more|bat)\b/;
+      const credited = /* @__PURE__ */ new Set();
+      for (const input of toolInputs) {
+        for (const rel of writtenPaths) {
+          if (input.includes(rel))
+            credited.add(rel);
+        }
+        if (!wordRe)
+          continue;
+        for (const match of input.matchAll(wordRe)) {
+          const word = match[0];
+          if (!GLOB_CHARS.test(word))
+            continue;
+          const re = globToRegExp(word);
+          if (!re)
+            continue;
+          for (const rel of writtenPaths) {
+            if (re.test(rel))
+              credited.add(rel);
+          }
+        }
+        if (findRe && readerRe.test(input)) {
+          for (const match of input.matchAll(findRe)) {
+            const dir = `${match[1]}/`;
+            for (const rel of writtenPaths) {
+              if (rel.startsWith(dir))
+                credited.add(rel);
+            }
+          }
+        }
+      }
+      return [...credited].sort();
+    }
+    async function keepTranscript(dir, name, stdout) {
+      try {
+        await fs_1.promises.mkdir(dir, { recursive: true });
+        const safe = name.replace(/[^A-Za-z0-9._-]/g, "_");
+        await fs_1.promises.writeFile(path_1.default.join(dir, `${safe}.jsonl`), stdout);
+      } catch (err) {
+        console.warn(`[shuttle] could not keep the transcript for ${name} under ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
     function extractJsonObject(s) {
       const exact = tryParseObject(s);
       if (exact)
@@ -11604,6 +11721,120 @@ var require_version_check = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/branding/environment.js
+var require_environment = __commonJS({
+  "../../packages/shuttle/dist/branding/environment.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolveEnvironment = resolveEnvironment;
+    exports2.applyEnvironment = applyEnvironment;
+    exports2.isWorthReporting = isWorthReporting;
+    exports2.renderEnvironmentReport = renderEnvironmentReport;
+    exports2.renderVerificationLine = renderVerificationLine;
+    exports2.environmentReportJson = environmentReportJson;
+    exports2.verificationJson = verificationJson;
+    exports2.hostOf = hostOf;
+    function resolveEnvironment(brand, profile, overrides = {}) {
+      const table = brand.environments ?? {};
+      const known = Object.keys(table).sort();
+      const matched = Object.prototype.hasOwnProperty.call(table, profile) ? profile : null;
+      const entry = matched === null ? void 0 : table[matched];
+      return {
+        profile,
+        environment: matched,
+        known,
+        keep: pick(overrides.keepUrl, entry?.keepApiUrl, brand.keepRegistration.keepApiUrl),
+        jobs: pick(overrides.jobsUrl, entry?.jobsApiUrl, brand.keepRegistration.jobsApiUrl)
+      };
+    }
+    function pick(flag, fromEnvironment, brandDefault) {
+      if (flag)
+        return { url: flag, source: "flag" };
+      if (fromEnvironment)
+        return { url: fromEnvironment, source: "environment" };
+      return { url: brandDefault, source: "brand-default" };
+    }
+    function applyEnvironment(brand, resolved) {
+      const reg = brand.keepRegistration;
+      if (resolved.keep.url === reg.keepApiUrl && resolved.jobs.url === reg.jobsApiUrl) {
+        return brand;
+      }
+      return {
+        ...brand,
+        keepRegistration: {
+          ...reg,
+          keepApiUrl: resolved.keep.url,
+          jobsApiUrl: resolved.jobs.url
+        }
+      };
+    }
+    function isWorthReporting(resolved) {
+      return resolved.environment !== null || resolved.keep.source === "flag" || resolved.jobs.source === "flag";
+    }
+    function renderEnvironmentReport(resolved) {
+      return [
+        "",
+        "Pairing environment",
+        field("Profile", resolved.profile),
+        field("Environment", describeEnvironment(resolved)),
+        field("Keep", `${resolved.keep.url}   ${describeSource(resolved, resolved.keep)}`),
+        field("Jobs", `${resolved.jobs.url}   ${describeSource(resolved, resolved.jobs)}`),
+        ""
+      ];
+    }
+    function renderVerificationLine(verificationUri) {
+      return field("Verify at", `${hostOf(verificationUri)}   as Keep reported it`);
+    }
+    function environmentReportJson(resolved) {
+      return JSON.stringify({
+        kind: "pairing-environment",
+        profile: resolved.profile,
+        environment: resolved.environment,
+        known: resolved.known,
+        keep: resolved.keep,
+        jobs: resolved.jobs
+      });
+    }
+    function verificationJson(verificationUri) {
+      return JSON.stringify({
+        kind: "pairing-verification",
+        verificationUri,
+        host: hostOf(verificationUri),
+        source: "keep"
+      });
+    }
+    function field(label, value) {
+      return `  ${`${label}:`.padEnd(13)}${value}`;
+    }
+    function describeEnvironment(resolved) {
+      if (resolved.environment !== null) {
+        return `${resolved.environment} (named by this build)`;
+      }
+      if (resolved.known.length === 0) {
+        return "none (this build declares no environments)";
+      }
+      return `none (this build knows ${resolved.known.join(", ")})`;
+    }
+    function describeSource(resolved, url) {
+      switch (url.source) {
+        case "flag":
+          return "from the flag you passed";
+        case "environment":
+          return `from the "${resolved.environment ?? ""}" environment`;
+        default:
+          return "from the brand default";
+      }
+    }
+    function hostOf(url) {
+      try {
+        return new URL(url).host;
+      } catch {
+        return url;
+      }
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/preflight/checks.js
 var require_checks = __commonJS({
   "../../packages/shuttle/dist/preflight/checks.js"(exports2) {
@@ -11619,6 +11850,7 @@ var require_checks = __commonJS({
     var loom_1 = require_dist();
     var version_check_1 = require_version_check();
     var apply_1 = require_apply();
+    var environment_1 = require_environment();
     var NODE_FLOOR = "20.0.0";
     var DISK_FLOOR_BYTES = 1024 * 1024 * 1024;
     var WORKSPACE_EXECUTOR = "claude-code";
@@ -11745,7 +11977,7 @@ var require_checks = __commonJS({
           if (strays.length > 0) {
             return fail("pairing-environment", `the config claims from ${strays.join(", ")}, which this pairing is not rostered into`, `run \`${subject.brand.product.cliBinary} init\` to rewrite the config from this pairing`);
           }
-          return pass("pairing-environment", `config and pairing both use ${pairing.jobsApiUrl}`);
+          return pass("pairing-environment", `paired with Keep at ${(0, environment_1.hostOf)(pairing.keepApiUrl)}, claiming from Jobs at ${(0, environment_1.hostOf)(pairing.jobsApiUrl)}`);
         });
       }
     };
@@ -22369,6 +22601,7 @@ var require_device_code = __commonJS({
             throw err;
           throw new Error(webFirstRemedy(opts.brand, err));
         }
+        opts.onVerificationUri?.(device.verificationUri);
         const invitation = (0, terminal_1.renderPairingInvitation)({
           header: opts.brand.strings?.pairingHeader ?? `Pair your ${opts.brand.product.title}`,
           verificationUri: device.verificationUri,
@@ -22712,24 +22945,31 @@ var require_init = __commonJS({
     var fsp = __importStar(require("fs/promises"));
     var commander_1 = require_commander();
     var apply_1 = require_apply();
+    var environment_1 = require_environment();
     var device_code_1 = require_device_code();
     var store_1 = require_store();
     var spend_store_1 = require_spend_store();
     var typed_exit_1 = require_typed_exit();
     var preflight_1 = require_preflight();
     function buildInitCommand(brand) {
-      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--tmp-dir <path>", "Base directory for each job's throwaway checkout (defaults to the OS temp dir; set only when that is unsuitable)").option("-p, --profile <name>", 'Config profile to pair into (isolates this pairing under its own dir; default "default")').action(async (options) => {
+      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL, beating both the profile's environment and the brand default").option("--jobs-url <url>", "Override the Jobs API URL, beating both the profile's environment and the brand default").option("--json", "Print the resolved pairing environment as JSON, one object per line; the rest of the output is unchanged").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--tmp-dir <path>", "Base directory for each job's throwaway checkout (defaults to the OS temp dir; set only when that is unsuitable)").option("-p, --profile <name>", profileFlagDescription(brand)).action(async (options) => {
         try {
           const profile = (0, apply_1.resolveProfile)(brand, options.profile);
           const setupOptions = parseSetupOptions(brand, options);
-          const effectiveBrand = options.keepUrl || options.jobsUrl ? {
-            ...brand,
-            keepRegistration: {
-              ...brand.keepRegistration,
-              ...options.keepUrl ? { keepApiUrl: options.keepUrl } : {},
-              ...options.jobsUrl ? { jobsApiUrl: options.jobsUrl } : {}
-            }
-          } : brand;
+          const asJson = options.json === true;
+          const environment = (0, environment_1.resolveEnvironment)(brand, profile, {
+            keepUrl: options.keepUrl,
+            jobsUrl: options.jobsUrl
+          });
+          const effectiveBrand = (0, environment_1.applyEnvironment)(brand, environment);
+          const report = (0, environment_1.isWorthReporting)(environment);
+          if (report) {
+            if (asJson)
+              console.log((0, environment_1.environmentReportJson)(environment));
+            else
+              for (const line of (0, environment_1.renderEnvironmentReport)(environment))
+                console.log(line);
+          }
           const paths = (0, apply_1.resolvePaths)(effectiveBrand, profile);
           await fsp.mkdir(paths.configDir, { recursive: true });
           for (const step of effectiveBrand.setupSteps ?? []) {
@@ -22759,7 +22999,14 @@ var require_init = __commonJS({
           }
           const pairing = await (0, device_code_1.pair)({
             brand: effectiveBrand,
-            pairingCode: options.pairingCode
+            pairingCode: options.pairingCode,
+            // Keep's answer is the half no local table can predict: it
+            // builds `verification_uri` from its OWN configuration, so a
+            // tier pointed at a page nobody serves looks exactly like a
+            // healthy one until an operator opens the link.
+            ...report ? {
+              onVerificationUri: (uri) => console.log(asJson ? (0, environment_1.verificationJson)(uri) : (0, environment_1.renderVerificationLine)(uri))
+            } : {}
           });
           const store = new store_1.PairingConfigStore(paths.configFile);
           await store.write(pairing);
@@ -22799,6 +23046,13 @@ var require_init = __commonJS({
         }
       });
     }
+    function profileFlagDescription(brand) {
+      const known = Object.keys(brand.environments ?? {}).sort();
+      const base = 'Config profile to pair into (isolates this pairing under its own dir; default "default")';
+      if (known.length === 0)
+        return base;
+      return `${base}. These names also select the backend: ${known.join(", ")}`;
+    }
     function parseSetupOptions(brand, raw) {
       const out = {};
       if (raw.executor !== void 0) {
@@ -25096,7 +25350,8 @@ var require_dist5 = __commonJS({
   "../../packages/shuttle/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.environmentReportJson = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.revokePairing = void 0;
     var cli_1 = require_cli();
     Object.defineProperty(exports2, "createCli", { enumerable: true, get: function() {
       return cli_1.createCli;
@@ -25220,6 +25475,31 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "renderTemplate", { enumerable: true, get: function() {
       return apply_1.renderTemplate;
     } });
+    var environment_1 = require_environment();
+    Object.defineProperty(exports2, "applyEnvironment", { enumerable: true, get: function() {
+      return environment_1.applyEnvironment;
+    } });
+    Object.defineProperty(exports2, "environmentReportJson", { enumerable: true, get: function() {
+      return environment_1.environmentReportJson;
+    } });
+    Object.defineProperty(exports2, "hostOf", { enumerable: true, get: function() {
+      return environment_1.hostOf;
+    } });
+    Object.defineProperty(exports2, "isWorthReporting", { enumerable: true, get: function() {
+      return environment_1.isWorthReporting;
+    } });
+    Object.defineProperty(exports2, "renderEnvironmentReport", { enumerable: true, get: function() {
+      return environment_1.renderEnvironmentReport;
+    } });
+    Object.defineProperty(exports2, "renderVerificationLine", { enumerable: true, get: function() {
+      return environment_1.renderVerificationLine;
+    } });
+    Object.defineProperty(exports2, "resolveEnvironment", { enumerable: true, get: function() {
+      return environment_1.resolveEnvironment;
+    } });
+    Object.defineProperty(exports2, "verificationJson", { enumerable: true, get: function() {
+      return environment_1.verificationJson;
+    } });
     var defaults_1 = require_defaults2();
     Object.defineProperty(exports2, "SUBSTRATE_BRAND", { enumerable: true, get: function() {
       return defaults_1.SUBSTRATE_BRAND;
@@ -25259,7 +25539,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist4());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.29.0" : pkg.version;
+var buildVersion = true ? "0.30.1" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",
@@ -25304,7 +25584,46 @@ var sifterBrand = {
         "https://api.sift.whittlelabs.com",
         "https://api.sift.stage.whittlelabs.com",
         "http://localhost:3008"
-      ]
+      ],
+      // Transcript retention is a diagnostic switch a person flips for one
+      // session, so it rides the environment rather than a file they would
+      // have to remember to unset. The shared package reads no env of its
+      // own (BE-005); this brand is where the variable becomes config.
+      ...process.env.SHUTTLE_KEEP_TRANSCRIPTS ? { keepTranscripts: process.env.SHUTTLE_KEEP_TRANSCRIPTS } : {}
+    }
+  },
+  // The environments Whittle Labs operates, keyed by the profile name that
+  // selects one. `init --profile stage` resolves both URLs from here, so a
+  // non-prod pairing is one flag instead of three and there is no host to
+  // mistype. `--keep-url` / `--jobs-url` still win, which is what keeps a
+  // backend Whittle Labs does not run reachable.
+  //
+  // `prod` is stated even though it duplicates the defaults below: a person
+  // reading `--help` should see the whole set, and a profile literally named
+  // `prod` should resolve rather than fall through to a default that only
+  // happens to agree. The DEFAULT profile ("default") is deliberately not a
+  // key — it is not an environment name, and it keeps its historic meaning
+  // of "the brand's own defaults", which are production's.
+  //
+  // `studio` is the local dev fleet on this machine, reachable over Tailscale
+  // at the `studio.whittlelabs.com` hostname rather than `localhost`, because
+  // a pairing made from a phone or a second machine has to resolve too.
+  environments: {
+    prod: {
+      keepApiUrl: "https://keep.whittlelabs.com",
+      jobsApiUrl: "https://jobs.whittlelabs.com"
+    },
+    stage: {
+      keepApiUrl: "https://keep.stage.whittlelabs.com",
+      jobsApiUrl: "https://jobs.stage.whittlelabs.com"
+    },
+    test: {
+      keepApiUrl: "https://keep.test.whittlelabs.com",
+      jobsApiUrl: "https://jobs.test.whittlelabs.com"
+    },
+    studio: {
+      keepApiUrl: "http://studio.whittlelabs.com:3007",
+      jobsApiUrl: "http://studio.whittlelabs.com:3005"
     }
   },
   keepRegistration: {