@whittlelabs/sifter 0.30.15 → 0.30.16

package/README.md

@@ -12,7 +12,7 @@ It needs three things on the machine first:
 |---|---|---|
 | Node.js | 20 or newer | [nodejs.org](https://nodejs.org), or a version manager such as [nvm](https://github.com/nvm-sh/nvm) or [fnm](https://github.com/Schniz/fnm) |
 | git | 2.20 or newer | macOS: `xcode-select --install` (or Homebrew). Linux and WSL: your package manager, e.g. `sudo apt install git` |
-| Claude Code | 2.0 or newer, signed in | `npm install -g @anthropic-ai/claude-code`, then run `claude` once and sign in |
+| Claude Code | 2.0.45 or newer, signed in | `npm install -g @anthropic-ai/claude-code`, then run `claude` once and sign in |
 
 On a Mac without the Command Line Tools, `/usr/bin/git` is only a placeholder that asks for them. The Sifter treats that as git not working, so install them first.
 
@@ -77,6 +77,24 @@ whittle-sifter run
 
 The Sifter subscribes to your job pool and waits for review jobs. Leave it running in a terminal or wrap it in your favorite process supervisor.
 
+### What a review can do
+
+A review checks out the pull request and runs Claude Code on it. The pull request is someone else's code, so the review is held to reading:
+
+- It is offered three tools, Read, Grep and Glob, and nothing else: no shell, no edits, no network tools, no subagents.
+- It loads no Claude Code settings file, neither the repository's nor yours. Your allow rules, permission mode, hooks and plugins do not apply to reviews, and no MCP server starts.
+
+Your login still works: Claude Code keeps it in your keychain or credentials file, or reads `ANTHROPIC_API_KEY`. If instead your login or provider is configured in your Claude Code settings (an `apiKeyHelper`, or an `env` block naming Bedrock, Vertex or a custom base URL), reviews will fail as signed out. Tell the Sifter to load your user settings in its `sifter.yaml` (`~/.sifter/sifter.yaml`, or `~/.sifter/<profile>/sifter.yaml` for a named profile):
+
+```yaml
+executors:
+  claude-code:
+    type: claude-code
+    claudeSettings: user
+```
+
+With it, your allow rules apply to reviews too, so a review can read whatever they let it read. The three tools, the default permission mode and the hooks staying off still hold.
+
 ### When something goes away
 
 A running Sifter deals with Sift or `claude` going away on its own, and says what it is doing:

package/bin.js

@@ -10048,17 +10048,19 @@ var require_claude_code = __commonJS({
     var apply_1 = require_apply();
     var DEFAULT_TIMEOUT = 6e5;
     var REVIEW_TOOLS = ["Read", "Grep", "Glob"];
-    var REVIEW_RUN_ARGS = [
-      "--setting-sources",
-      "user",
-      "--strict-mcp-config",
-      "--tools",
-      REVIEW_TOOLS.join(","),
-      "--permission-mode",
-      "default",
-      "--settings",
-      JSON.stringify({ disableAllHooks: true })
-    ];
+    function reviewRunArgs(settingSources) {
+      return [
+        "--setting-sources",
+        settingSources,
+        "--strict-mcp-config",
+        "--tools",
+        REVIEW_TOOLS.join(","),
+        "--permission-mode",
+        "default",
+        "--settings",
+        JSON.stringify({ disableAllHooks: true })
+      ];
+    }
     var RETIRED_READ_TOOLS = ["LS"];
     var HOSTED_ENV_PASSTHROUGH = [
       "PATH",
@@ -10091,7 +10093,7 @@ var require_claude_code = __commonJS({
     var READINESS_TIMEOUT_MS = 12e4;
     var STDERR_LIMIT = 4e3;
     var INSTALL_REMEDY = "install Claude Code (npm install -g @anthropic-ai/claude-code) where this process can find it on PATH";
-    var LOGIN_REMEDY = "run `claude` once and sign in (or set a valid ANTHROPIC_API_KEY)";
+    var LOGIN_REMEDY = "run `claude` once and sign in (or set a valid ANTHROPIC_API_KEY); if your login or provider is configured in Claude Code settings (apiKeyHelper, or an env block), set `claudeSettings: user` on the claude-code executor, since a review loads no settings file without it";
     var LIMIT_REMEDY = "wait for the plan's usage limit to reset, or raise it";
     var SIGNED_OUT = /invalid api key|please run \/login|not (?:logged|signed) in|oauth token (?:has )?expired|authentication_error|invalid x-api-key/i;
     var OUT_OF_USAGE = /usage limit|credit balance is too low|out of (?:extra )?usage|hit your (?:\w+ )?(?:usage |spend )?limit|5-hour limit/i;
@@ -10341,8 +10343,12 @@ var require_claude_code = __commonJS({
         const outputLabel = spec.outputLabel;
         const model = modelOverride ?? this.config.model;
         const allowedTools = local ? this.config.allowedTools : checkoutScopedTools(this.config.allowedTools);
+        if (!local && this.config.claudeSettings === "user") {
+          throw new Error("claude-code: `claudeSettings: user` is for an installed Sifter whose login lives in Claude Code settings; a hosted run authenticates with the key it is handed and loads no settings");
+        }
+        const settingSources = local && this.config.claudeSettings === "user" ? "user" : "";
         return new Promise((resolve, reject) => {
-          const args = ["--print", "--output-format", "stream-json", "--verbose", ...REVIEW_RUN_ARGS];
+          const args = ["--print", "--output-format", "stream-json", "--verbose", ...reviewRunArgs(settingSources)];
           if (resumeSessionId)
             args.push("--resume", resumeSessionId);
           if (spec.outputSchema && typeof spec.outputSchema === "object" && Object.keys(spec.outputSchema).length > 0) {
@@ -10542,6 +10548,12 @@ var require_claude_code = __commonJS({
         }
         validated.keepTranscripts = config.keepTranscripts;
       }
+      if (config.claudeSettings !== void 0) {
+        if (config.claudeSettings !== "user") {
+          throw new Error('"claudeSettings" may only be "user" (leave it unset to load no settings file)');
+        }
+        validated.claudeSettings = "user";
+      }
       if (config.overlayAllowedHosts !== void 0) {
         if (!Array.isArray(config.overlayAllowedHosts) || !config.overlayAllowedHosts.every((h) => typeof h === "string")) {
           throw new Error('"overlayAllowedHosts" must be an array of strings');
@@ -26922,7 +26934,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.15" : pkg.version;
+var buildVersion = true ? "0.30.16" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",