@whittlelabs/sifter 0.30.16 → 0.30.18

package/README.md

@@ -69,6 +69,22 @@ Once the backend answers, one more line names the page it sent you to, which is
 
 Pairing writes credentials to `~/.sifter/<profile>/config.json` (mode 0600), or `~/.sifter/config.json` for the default profile.
 
+The environment also decides where a review may fetch your standards documents from: that environment's Sift API and nowhere else. A Sifter paired with production allows `https://api.sift.whittlelabs.com`; `stage` and `test` allow their own `api.sift` host, and `studio` allows `http://localhost:3008`. The Sifter finds its environment from the Jobs URL in its `sifter.yaml`, so an existing pairing needs nothing re-run. `run` and `doctor` print the list in use on their `overlay-hosts` line:
+
+```
+PASS  overlay-hosts        https://api.sift.whittlelabs.com
+```
+
+A backend this build does not know gets no default, and `overlay-hosts` warns that reviews would run without standards. Name the origin that backend signs standards URLs with under the `claude-code` executor in `sifter.yaml`. Your own list always replaces the environment's:
+
+```yaml
+executors:
+  claude-code:
+    type: claude-code
+    overlayAllowedHosts:
+      - http://box.local:3008
+```
+
 ## Run
 
 ```bash
@@ -118,6 +134,8 @@ Sixteen checks over everything the Sifter needs before it can review anything: a
 
 `init` and `run` run the relevant subset themselves, so `doctor` is for when the Sifter looks healthy and nothing is happening.
 
+The login check asks the CLI itself (`claude auth status`), so a login kept in the macOS Keychain counts, and it asks with the settings a review loads. A signed-out CLI fails it with the remedy `claude auth login`; a signed-in one passes as, for example, `signed in (claude.ai, max; not verified)`, because only `--deep` proves the login works. It never prints the email or organization the CLI reports. A `claude` too old to have `auth status` is checked the old way, by looking for its credentials file.
+
 ```bash
 whittle-sifter doctor --deep     # also spend one real turn proving the claude login works
 whittle-sifter doctor --json     # the verdicts as JSON, and nothing else

package/bin.js

@@ -12261,6 +12261,8 @@ var require_environment = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.resolveEnvironment = resolveEnvironment;
     exports2.applyEnvironment = applyEnvironment;
+    exports2.environmentPolledBy = environmentPolledBy;
+    exports2.executorDefaultsFor = executorDefaultsFor;
     exports2.isWorthReporting = isWorthReporting;
     exports2.renderEnvironmentReport = renderEnvironmentReport;
     exports2.renderVerificationLine = renderVerificationLine;
@@ -12301,6 +12303,28 @@ var require_environment = __commonJS({
         }
       };
     }
+    function environmentPolledBy(brand, jobsApiUrl) {
+      const wanted = normalizeUrl(jobsApiUrl);
+      for (const [name, entry] of Object.entries(brand.environments ?? {})) {
+        if (normalizeUrl(entry.jobsApiUrl) === wanted)
+          return name;
+      }
+      return null;
+    }
+    function executorDefaultsFor(brand, jobsApiUrl) {
+      const name = environmentPolledBy(brand, jobsApiUrl);
+      const tier = name === null ? void 0 : brand.environments?.[name]?.executorDefaults;
+      if (!tier)
+        return brand.executorDefaults;
+      const merged = { ...brand.executorDefaults ?? {} };
+      for (const [executor, settings] of Object.entries(tier)) {
+        merged[executor] = { ...merged[executor] ?? {}, ...settings };
+      }
+      return merged;
+    }
+    function normalizeUrl(url) {
+      return url.replace(/\/+$/, "").toLowerCase();
+    }
     function isWorthReporting(resolved) {
       return resolved.environment !== null || resolved.keep.source === "flag" || resolved.jobs.source === "flag";
     }
@@ -12448,9 +12472,15 @@ var require_checks = __commonJS({
       const user = config.executors[WORKSPACE_EXECUTOR];
       if (user === void 0)
         return null;
-      const defaults = subject.brand.executorDefaults?.[WORKSPACE_EXECUTOR] ?? {};
+      const defaults = (0, environment_1.executorDefaultsFor)(subject.brand, config.auth.jobsApiUrl)?.[WORKSPACE_EXECUTOR] ?? {};
       return { ...defaults, ...user };
     }
+    function claudeSettingsOf(config) {
+      return config.executors[WORKSPACE_EXECUTOR]?.claudeSettings;
+    }
+    function describeLogin(status) {
+      return [status.authMethod ?? "unknown method", status.subscriptionType].filter((part) => part !== null).join(", ");
+    }
     function runRoot(config, subject, osTmpDir) {
       const settings = claudeCodeSettings(config, subject);
       const tmpDir = settings?.tmpDir;
@@ -12485,7 +12515,7 @@ var require_checks = __commonJS({
         return (0, apply_1.expandHome)(subject.requestedTmpDir);
       }
       const settings = {
-        ...subject.brand.executorDefaults?.[WORKSPACE_EXECUTOR] ?? {},
+        ...(0, environment_1.executorDefaultsFor)(subject.brand, subject.brand.keepRegistration.jobsApiUrl)?.[WORKSPACE_EXECUTOR] ?? {},
         ...plan.keptBlock ?? {}
       };
       const tmpDir = settings.tmpDir;
@@ -12745,6 +12775,14 @@ var require_checks = __commonJS({
           if (probes.ambientAnthropicKey()) {
             return warn("claude-auth", "ANTHROPIC_API_KEY is set and will bill that account, shadowing any interactive login", "unset ANTHROPIC_API_KEY if you meant to use your Claude Code login");
           }
+          const settingSources = claudeSettingsOf(config) === "user" ? "user" : "";
+          const status = await probes.claudeAuthStatus(settingSources);
+          if (status !== null) {
+            if (!status.loggedIn) {
+              return fail("claude-auth", "the claude CLI is not signed in", settingSources === "" ? "run `claude auth login`; if your login or provider is configured in Claude Code settings (apiKeyHelper, or an env block), set `claudeSettings: user` on the claude-code executor instead" : "run `claude auth login`");
+            }
+            return pass("claude-auth", `signed in (${describeLogin(status)}; not verified)`);
+          }
           const store = await probes.claudeCredentialStore();
           if (store === null) {
             return warn("claude-auth", "no credential store found for the claude CLI (a macOS login may live in the Keychain, which this cannot read)", "run `claude` once and sign in, or run doctor --deep to spend one turn proving it");
@@ -12823,7 +12861,8 @@ var require_checks = __commonJS({
           const hosts = settings.overlayAllowedHosts;
           const origins = Array.isArray(hosts) ? hosts.filter((h) => typeof h === "string") : [];
           if (origins.length === 0) {
-            return warn("overlay-hosts", "the overlay allowlist is empty, so every review will run standards-blind", `add overlayAllowedHosts to the ${WORKSPACE_EXECUTOR} executor, or re-run init to restore the defaults`);
+            const fallback = (0, environment_1.executorDefaultsFor)(subject.brand, config.auth.jobsApiUrl)?.[WORKSPACE_EXECUTOR]?.overlayAllowedHosts;
+            return warn("overlay-hosts", "the overlay allowlist is empty, so every review will run standards-blind", Array.isArray(fallback) && fallback.length > 0 ? `remove overlayAllowedHosts from the ${WORKSPACE_EXECUTOR} executor to use this tier's default` : `add overlayAllowedHosts to the ${WORKSPACE_EXECUTOR} executor, naming the origin your backend signs standards URLs with (this build names none for Jobs at ${(0, environment_1.hostOf)(config.auth.jobsApiUrl)})`);
           }
           return pass("overlay-hosts", origins.join(", "));
         });
@@ -12904,7 +12943,7 @@ var require_checks = __commonJS({
     };
     function mergedExecutorConfigs(config, subject) {
       const user = config.executors;
-      const defaults = subject.brand.executorDefaults;
+      const defaults = (0, environment_1.executorDefaultsFor)(subject.brand, config.auth.jobsApiUrl);
       if (!defaults)
         return user;
       const merged = {};
@@ -21357,6 +21396,7 @@ var require_probes = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createProbes = createProbes;
+    exports2.parseClaudeAuthStatus = parseClaudeAuthStatus;
     var child_process_1 = require("child_process");
     var fs_1 = require("fs");
     var promises_1 = require("fs/promises");
@@ -21575,6 +21615,10 @@ var require_probes = __commonJS({
           const candidate = path_1.default.join(configDir, ".credentials.json");
           return (0, fs_1.existsSync)(candidate) ? candidate : null;
         },
+        async claudeAuthStatus(settingSources) {
+          const outcome = await runForAnyExit("claude", ["--setting-sources", settingSources, "auth", "status", "--json"], VERSION_TIMEOUT_MS);
+          return outcome === null ? null : parseClaudeAuthStatus(outcome);
+        },
         ambientAnthropicKey: () => (process.env.ANTHROPIC_API_KEY ?? "").length > 0,
         async claudeRoundTrip() {
           const output = await runForOutput(
@@ -21595,13 +21639,37 @@ var require_probes = __commonJS({
       const outcome = await runCapturing(bin, args, timeoutMs);
       return outcome.ok ? outcome.stdout : null;
     }
+    async function runForAnyExit(bin, args, timeoutMs) {
+      const outcome = await runCapturing(bin, args, timeoutMs);
+      if (outcome.ok)
+        return outcome.stdout;
+      return outcome.exited ? outcome.stdout : null;
+    }
+    function parseClaudeAuthStatus(stdout) {
+      let parsed;
+      try {
+        parsed = JSON.parse(stdout);
+      } catch {
+        return null;
+      }
+      if (parsed === null || typeof parsed !== "object")
+        return null;
+      const { loggedIn, authMethod, subscriptionType } = parsed;
+      if (typeof loggedIn !== "boolean")
+        return null;
+      return {
+        loggedIn,
+        authMethod: typeof authMethod === "string" && authMethod.length > 0 ? authMethod : null,
+        subscriptionType: typeof subscriptionType === "string" && subscriptionType.length > 0 ? subscriptionType : null
+      };
+    }
     function runCapturing(bin, args, timeoutMs) {
       return new Promise((resolve) => {
         let child;
         try {
           child = (0, child_process_1.spawn)(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
         } catch (err) {
-          resolve({ ok: false, reason: describe(err) });
+          resolve({ ok: false, reason: describe(err), exited: false });
           return;
         }
         let stdout = "";
@@ -21615,7 +21683,7 @@ var require_probes = __commonJS({
         };
         const timer = setTimeout(() => {
           child.kill("SIGKILL");
-          settle({ ok: false, reason: `did not finish within ${Math.round(timeoutMs / 1e3)}s` });
+          settle({ ok: false, reason: `did not finish within ${Math.round(timeoutMs / 1e3)}s`, exited: false });
         }, timeoutMs);
         child.stdout?.on("data", (chunk) => {
           stdout += chunk.toString("utf8");
@@ -21625,7 +21693,7 @@ var require_probes = __commonJS({
         });
         child.on("error", (err) => {
           clearTimeout(timer);
-          settle({ ok: false, reason: describe(err) });
+          settle({ ok: false, reason: describe(err), exited: false });
         });
         child.on("close", (code, signal) => {
           clearTimeout(timer);
@@ -21635,7 +21703,8 @@ var require_probes = __commonJS({
           }
           const status = code === null ? `was killed by ${signal ?? "a signal"}` : `exited ${code}`;
           const said = stderr.split("\n").map((line) => line.trim()).find((line) => line.length > 0);
-          settle({ ok: false, reason: said ? `${status}: ${said}` : status });
+          const reason = said ? `${status}: ${said}` : status;
+          settle(code === null ? { ok: false, reason, exited: false } : { ok: false, reason, exited: true, stdout: stdout.trim() });
         });
       });
     }
@@ -25750,6 +25819,7 @@ var require_shuttle = __commonJS({
     var output_gates_1 = require_output_gates();
     var keep_1 = require_dist2();
     var apply_1 = require_apply();
+    var environment_1 = require_environment();
     var version_check_1 = require_version_check();
     var typed_exit_1 = require_typed_exit();
     var logger_1 = require_logger();
@@ -25951,7 +26021,7 @@ var require_shuttle = __commonJS({
         });
         const registry = new registry_1.ExecutorRegistry(this.brand.executorAllowlist);
         registerBuiltInExecutors(registry, this.brand.executorAllowlist);
-        const executors = registry.build(mergeExecutorDefaults(this.brand.executorDefaults, this.config.executors));
+        const executors = registry.build(mergeExecutorDefaults((0, environment_1.executorDefaultsFor)(this.brand, this.config.auth.jobsApiUrl), this.config.executors));
         const byStrategy = /* @__PURE__ */ new Map();
         for (const executor of executors) {
           for (const strategy of executor.strategies)
@@ -26734,8 +26804,8 @@ var require_dist5 = __commonJS({
   "../../packages/shuttle/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.scaffoldedConfigPath = exports2.planScaffold = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.environmentReportJson = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorEnvironmentError = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
-    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = void 0;
+    exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.executorDefaultsFor = exports2.environmentReportJson = exports2.environmentPolledBy = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createClaudeCodeExecutor = exports2.ExecutorEnvironmentError = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.scaffoldedConfigPath = exports2.planScaffold = void 0;
     var cli_1 = require_cli();
     Object.defineProperty(exports2, "createCli", { enumerable: true, get: function() {
       return cli_1.createCli;
@@ -26867,9 +26937,15 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "applyEnvironment", { enumerable: true, get: function() {
       return environment_1.applyEnvironment;
     } });
+    Object.defineProperty(exports2, "environmentPolledBy", { enumerable: true, get: function() {
+      return environment_1.environmentPolledBy;
+    } });
     Object.defineProperty(exports2, "environmentReportJson", { enumerable: true, get: function() {
       return environment_1.environmentReportJson;
     } });
+    Object.defineProperty(exports2, "executorDefaultsFor", { enumerable: true, get: function() {
+      return environment_1.executorDefaultsFor;
+    } });
     Object.defineProperty(exports2, "hostOf", { enumerable: true, get: function() {
       return environment_1.hostOf;
     } });
@@ -26934,7 +27010,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.16" : pkg.version;
+var buildVersion = true ? "0.30.18" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",
@@ -26975,24 +27051,12 @@ var sifterBrand = {
     git: "2.20.0",
     claude: "2.0.45"
   },
-  // Overlay-fetch origins for the signed standards-content URLs each Sift
-  // tier signs (SIFT_PUBLIC_API_URL). Without these, the executor's SSRF
-  // guard silently skips the standards overlay and every review runs
-  // standards-blind (2026-07-13). User config overrides per key.
+  // The overlay-fetch allowlist is NOT here: each tier signs its standards
+  // URLs with its own Sift origin (SIFT_PUBLIC_API_URL), so the origin is a
+  // property of the tier and lives on its `environments` entry below. A
+  // Sifter paired to production allows production's origin and nothing else.
   executorDefaults: {
     "claude-code": {
-      overlayAllowedHosts: [
-        "https://api.sift.whittlelabs.com",
-        "https://api.sift.stage.whittlelabs.com",
-        // The test tier signs overlay URLs too, and a Sifter the E2E suite
-        // runs on the runner reaches Sift by this host rather than by the
-        // in-cluster service name the hosted worker uses. Without it that
-        // Sifter passes its own preflight — the check asks only that the list
-        // is non-empty — and then runs every review standards-blind, which is
-        // the exact silence of 2026-07-13.
-        "https://api.sift.test.whittlelabs.com",
-        "http://localhost:3008"
-      ],
       // Transcript retention is a diagnostic switch a person flips for one
       // session, so it rides the environment rather than a file they would
       // have to remember to unset. The shared package reads no env of its
@@ -27016,22 +27080,40 @@ var sifterBrand = {
   // `studio` is the local dev fleet on this machine, reachable over Tailscale
   // at the `studio.whittlelabs.com` hostname rather than `localhost`, because
   // a pairing made from a phone or a second machine has to resolve too.
+  //
+  // Each entry also carries the origin that tier signs overlay URLs with.
+  // A run matches its tier by the Jobs URL its config polls (written from the
+  // pairing, and held equal to it by `pairing-environment`), so an existing
+  // pairing picks up its own tier's origin without re-pairing, and a user's
+  // own `overlayAllowedHosts` still wins. Without the right origin the
+  // executor's SSRF guard silently skips the standards overlay and every
+  // review runs standards-blind (2026-07-13); tests/overlay-hosts.test.ts
+  // holds every tier to naming its own.
   environments: {
     prod: {
       keepApiUrl: "https://keep.whittlelabs.com",
-      jobsApiUrl: "https://jobs.whittlelabs.com"
+      jobsApiUrl: "https://jobs.whittlelabs.com",
+      executorDefaults: overlayOrigin("https://api.sift.whittlelabs.com")
     },
     stage: {
       keepApiUrl: "https://keep.stage.whittlelabs.com",
-      jobsApiUrl: "https://jobs.stage.whittlelabs.com"
+      jobsApiUrl: "https://jobs.stage.whittlelabs.com",
+      executorDefaults: overlayOrigin("https://api.sift.stage.whittlelabs.com")
     },
     test: {
       keepApiUrl: "https://keep.test.whittlelabs.com",
-      jobsApiUrl: "https://jobs.test.whittlelabs.com"
+      jobsApiUrl: "https://jobs.test.whittlelabs.com",
+      // The public host, because a Sifter the E2E suite runs on the runner
+      // reaches Sift by it rather than by the in-cluster service name the
+      // test tier's hosted worker uses (that worker sets its own list).
+      executorDefaults: overlayOrigin("https://api.sift.test.whittlelabs.com")
     },
     studio: {
       keepApiUrl: "http://studio.whittlelabs.com:3007",
-      jobsApiUrl: "http://studio.whittlelabs.com:3005"
+      jobsApiUrl: "http://studio.whittlelabs.com:3005",
+      // The dev fleet's Sift signs with SIFT_PUBLIC_API_URL from its .env,
+      // which is localhost.
+      executorDefaults: overlayOrigin("http://localhost:3008")
     }
   },
   keepRegistration: {
@@ -27119,6 +27201,9 @@ var sifterBrand = {
     }
   ]
 };
+function overlayOrigin(origin) {
+  return { "claude-code": { overlayAllowedHosts: [origin] } };
+}
 async function buildExecutorBlock(executor, ctx) {
   switch (executor) {
     case "claude-code": {