@whittlelabs/sifter 0.30.12 → 0.30.14

package/bin.js

@@ -10030,6 +10030,7 @@ var require_claude_code = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.classifyEnvironmentFault = classifyEnvironmentFault;
     exports2.createClaudeCodeExecutor = createClaudeCodeExecutor;
+    exports2.checkoutScopedTools = checkoutScopedTools;
     exports2.parseStreamJson = parseStreamJson;
     exports2.relativeWorkspaceReads = relativeWorkspaceReads;
     exports2.globToRegExp = globToRegExp;
@@ -10046,6 +10047,26 @@ var require_claude_code = __commonJS({
     var progress_1 = require_progress();
     var apply_1 = require_apply();
     var DEFAULT_TIMEOUT = 6e5;
+    var UNTRUSTED_TREE_ARGS = ["--setting-sources", "user", "--strict-mcp-config"];
+    var CHECKOUT_READ_TOOLS = ["Read", "Grep", "Glob", "LS"];
+    var HOSTED_ENV_PASSTHROUGH = [
+      "PATH",
+      "HOME",
+      "TMPDIR",
+      "LANG",
+      "LC_ALL",
+      "LC_CTYPE",
+      "TZ",
+      "NODE_EXTRA_CA_CERTS",
+      "SSL_CERT_FILE",
+      "SSL_CERT_DIR",
+      "HTTPS_PROXY",
+      "HTTP_PROXY",
+      "NO_PROXY",
+      "https_proxy",
+      "http_proxy",
+      "no_proxy"
+    ];
     function describeClaudeFailure(meta, fallback) {
       if (!meta)
         return fallback;
@@ -10308,8 +10329,9 @@ var require_claude_code = __commonJS({
       runClaude(prompt, spec, cwd, childEnv, signal, modelOverride, reporter, resumeSessionId, transcriptName, local = false) {
         const outputLabel = spec.outputLabel;
         const model = modelOverride ?? this.config.model;
+        const allowedTools = local ? this.config.allowedTools : checkoutScopedTools(this.config.allowedTools);
         return new Promise((resolve, reject) => {
-          const args = ["--print", "--output-format", "stream-json", "--verbose"];
+          const args = ["--print", "--output-format", "stream-json", "--verbose", ...UNTRUSTED_TREE_ARGS];
           if (resumeSessionId)
             args.push("--resume", resumeSessionId);
           if (spec.outputSchema && typeof spec.outputSchema === "object" && Object.keys(spec.outputSchema).length > 0) {
@@ -10319,8 +10341,8 @@ var require_claude_code = __commonJS({
             args.push("--model", model);
           if (this.config.maxTurns !== void 0)
             args.push("--max-turns", String(this.config.maxTurns));
-          if (this.config.allowedTools && this.config.allowedTools.length > 0) {
-            args.push("--allowedTools", this.config.allowedTools.join(","));
+          if (allowedTools && allowedTools.length > 0) {
+            args.push("--allowedTools", allowedTools.join(","));
           }
           let child;
           try {
@@ -10517,11 +10539,27 @@ var require_claude_code = __commonJS({
       }
       return new ClaudeCodeExecutor(validated);
     }
+    function checkoutScopedTools(tools) {
+      if (!tools)
+        return void 0;
+      return tools.map((tool) => {
+        const name = CHECKOUT_READ_TOOLS.find((t) => tool === t || tool === `${t}(./**)`);
+        if (!name) {
+          throw new Error(`claude-code: a hosted run may use only ${CHECKOUT_READ_TOOLS.join(", ")} inside the checkout; "${tool}" is not allowed`);
+        }
+        return `${name}(./**)`;
+      });
+    }
     function buildChildEnv(modelKey, configDir) {
       if (!modelKey && !configDir)
         return void 0;
+      const env = {};
+      for (const name of HOSTED_ENV_PASSTHROUGH) {
+        if (process.env[name] !== void 0)
+          env[name] = process.env[name];
+      }
       return {
-        ...process.env,
+        ...env,
         ...modelKey ? { ANTHROPIC_API_KEY: modelKey } : {},
         ...configDir ? { CLAUDE_CONFIG_DIR: configDir } : {}
       };
@@ -26869,7 +26907,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.12" : pkg.version;
+var buildVersion = true ? "0.30.14" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",