@whittlelabs/sifter 0.30.14 → 0.30.15

package/bin.js

@@ -10047,8 +10047,19 @@ var require_claude_code = __commonJS({
     var progress_1 = require_progress();
     var apply_1 = require_apply();
     var DEFAULT_TIMEOUT = 6e5;
-    var UNTRUSTED_TREE_ARGS = ["--setting-sources", "user", "--strict-mcp-config"];
-    var CHECKOUT_READ_TOOLS = ["Read", "Grep", "Glob", "LS"];
+    var REVIEW_TOOLS = ["Read", "Grep", "Glob"];
+    var REVIEW_RUN_ARGS = [
+      "--setting-sources",
+      "user",
+      "--strict-mcp-config",
+      "--tools",
+      REVIEW_TOOLS.join(","),
+      "--permission-mode",
+      "default",
+      "--settings",
+      JSON.stringify({ disableAllHooks: true })
+    ];
+    var RETIRED_READ_TOOLS = ["LS"];
     var HOSTED_ENV_PASSTHROUGH = [
       "PATH",
       "HOME",
@@ -10331,7 +10342,7 @@ var require_claude_code = __commonJS({
         const model = modelOverride ?? this.config.model;
         const allowedTools = local ? this.config.allowedTools : checkoutScopedTools(this.config.allowedTools);
         return new Promise((resolve, reject) => {
-          const args = ["--print", "--output-format", "stream-json", "--verbose", ...UNTRUSTED_TREE_ARGS];
+          const args = ["--print", "--output-format", "stream-json", "--verbose", ...REVIEW_RUN_ARGS];
           if (resumeSessionId)
             args.push("--resume", resumeSessionId);
           if (spec.outputSchema && typeof spec.outputSchema === "object" && Object.keys(spec.outputSchema).length > 0) {
@@ -10542,13 +10553,17 @@ var require_claude_code = __commonJS({
     function checkoutScopedTools(tools) {
       if (!tools)
         return void 0;
-      return tools.map((tool) => {
-        const name = CHECKOUT_READ_TOOLS.find((t) => tool === t || tool === `${t}(./**)`);
+      const scoped = [];
+      for (const tool of tools) {
+        if (RETIRED_READ_TOOLS.some((t) => tool === t || tool === `${t}(./**)`))
+          continue;
+        const name = REVIEW_TOOLS.find((t) => tool === t || tool === `${t}(./**)`);
         if (!name) {
-          throw new Error(`claude-code: a hosted run may use only ${CHECKOUT_READ_TOOLS.join(", ")} inside the checkout; "${tool}" is not allowed`);
+          throw new Error(`claude-code: a hosted run may use only ${REVIEW_TOOLS.join(", ")} inside the checkout; "${tool}" is not allowed`);
         }
-        return `${name}(./**)`;
-      });
+        scoped.push(`${name}(./**)`);
+      }
+      return scoped;
     }
     function buildChildEnv(modelKey, configDir) {
       if (!modelKey && !configDir)
@@ -26907,7 +26922,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.14" : pkg.version;
+var buildVersion = true ? "0.30.15" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",
@@ -26940,11 +26955,13 @@ var sifterBrand = {
   // number chosen for tidiness rather than necessity would refuse a working
   // install. `git` 2.20 (Dec 2018) is older than any supported distro and is
   // where the `--no-tags --depth=1` fetch-by-ref path the materializer uses
-  // settled; `claude` 2.0 is where `--json-schema` and the stream-json shape
-  // the executor parses arrived, and the hosted image pins 2.1.x.
+  // settled; `claude` 2.0.45 is the first release with `--json-schema`, the
+  // newest of the flags every review passes (`--tools` arrived in 2.0.31;
+  // the executor's REVIEW_RUN_ARGS names them all), and the hosted image pins
+  // 2.1.x. Below it a review fails on an unknown option.
   minimumToolVersions: {
     git: "2.20.0",
-    claude: "2.0.0"
+    claude: "2.0.45"
   },
   // Overlay-fetch origins for the signed standards-content URLs each Sift
   // tier signs (SIFT_PUBLIC_API_URL). Without these, the executor's SSRF