@whittlelabs/sifter 0.30.17 → 0.30.19

package/README.md

@@ -134,6 +134,8 @@ Sixteen checks over everything the Sifter needs before it can review anything: a
 
 `init` and `run` run the relevant subset themselves, so `doctor` is for when the Sifter looks healthy and nothing is happening.
 
+The login check asks the CLI itself (`claude auth status`), so a login kept in the macOS Keychain counts, and it asks with the settings a review loads. A signed-out CLI fails it with the remedy `claude auth login`; a signed-in one passes as, for example, `signed in (claude.ai, max; not verified)`, because only `--deep` proves the login works. It never prints the email or organization the CLI reports. A `claude` too old to have `auth status` is checked the old way, by looking for its credentials file.
+
 ```bash
 whittle-sifter doctor --deep     # also spend one real turn proving the claude login works
 whittle-sifter doctor --json     # the verdicts as JSON, and nothing else

package/bin.js

@@ -11433,6 +11433,69 @@ var require_exchange = __commonJS({
   }
 });
 
+// ../../packages/keep/dist/refusal-budget.js
+var require_refusal_budget = __commonJS({
+  "../../packages/keep/dist/refusal-budget.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.RefusalBudget = exports2.REFUSAL_SPAN_MS = exports2.REFUSED_EXCHANGES_PER_SPAN = exports2.KeepCredentialsRefusedError = void 0;
+    var KeepCredentialsRefusedError = class extends Error {
+      code = "CREDENTIALS_REFUSED";
+      /** Host the exchange was sent to. */
+      host;
+      /** When the manager will next send an exchange for these credentials (epoch ms). */
+      retryAt;
+      /** How long from now that is (ms); zero while the budget has room. */
+      retryAfterMs;
+      constructor(message, detail) {
+        super(message);
+        this.name = "KeepCredentialsRefusedError";
+        this.host = detail.host;
+        this.retryAt = detail.retryAt;
+        this.retryAfterMs = Math.max(0, detail.retryAt - Date.now());
+      }
+    };
+    exports2.KeepCredentialsRefusedError = KeepCredentialsRefusedError;
+    var KEEP_EXCHANGE_WINDOW_MS = 15 * 6e4;
+    exports2.REFUSED_EXCHANGES_PER_SPAN = 3;
+    exports2.REFUSAL_SPAN_MS = KEEP_EXCHANGE_WINDOW_MS + 3e4;
+    var RefusalBudget = class {
+      refusedAt = [];
+      last = null;
+      /** Throws the last refusal while the budget is spent; a no-op while it has room. */
+      check() {
+        const last = this.last;
+        if (last === null)
+          return;
+        const retryAt = this.nextExchangeAt();
+        if (Date.now() >= retryAt)
+          return;
+        const when = new Date(retryAt).toISOString().replace(/\.\d{3}Z$/, "Z");
+        throw new KeepCredentialsRefusedError(`${last.message} (refused ${this.refusedAt.length} times in ${exports2.REFUSAL_SPAN_MS / 6e4} minutes; not asking Keep again before ${when})`, { host: last.host, retryAt });
+      }
+      /** Record a 401 and return the error to throw for it. */
+      refuse(detail) {
+        this.refusedAt.push(Date.now());
+        this.last = new KeepCredentialsRefusedError(detail.message, { host: detail.host, retryAt: this.nextExchangeAt() });
+        return this.last;
+      }
+      /** Keep issued a token, which clears its count; so does this. */
+      clear() {
+        this.refusedAt = [];
+        this.last = null;
+      }
+      nextExchangeAt() {
+        const now = Date.now();
+        this.refusedAt = this.refusedAt.filter((at) => now - at < exports2.REFUSAL_SPAN_MS);
+        if (this.refusedAt.length < exports2.REFUSED_EXCHANGES_PER_SPAN)
+          return now;
+        return this.refusedAt[this.refusedAt.length - exports2.REFUSED_EXCHANGES_PER_SPAN] + exports2.REFUSAL_SPAN_MS;
+      }
+    };
+    exports2.RefusalBudget = RefusalBudget;
+  }
+});
+
 // ../../packages/keep/dist/wait-for-token.js
 var require_wait_for_token = __commonJS({
   "../../packages/keep/dist/wait-for-token.js"(exports2) {
@@ -11511,6 +11574,7 @@ var require_service_token = __commonJS({
     exports2.ServiceTokenManager = void 0;
     var rate_limited_1 = require_rate_limited();
     var exchange_1 = require_exchange();
+    var refusal_budget_1 = require_refusal_budget();
     var wait_for_token_1 = require_wait_for_token();
     var ServiceTokenManager = class {
       token = null;
@@ -11518,6 +11582,8 @@ var require_service_token = __commonJS({
       pendingExchange = null;
       /** Closed by a 429 until Keep's retry-after: no exchange is sent before it. */
       rateLimit = new rate_limited_1.RateLimitGate();
+      /** Spent by refused exchanges: past it, no exchange is sent until the oldest ages out. */
+      refusals = new refusal_budget_1.RefusalBudget();
       keepApiUrl;
       clientId;
       clientSecret;
@@ -11539,8 +11605,11 @@ var require_service_token = __commonJS({
        *
        * Throws `KeepUnavailableError` when Keep did not answer or answered 5xx,
        * `KeepRateLimitedError` when Keep's exchange limiter locked this client out
-       * (and, until the time Keep named, without asking again), and a plain `Error`
-       * for any other refusal, a 401 above all. A refresh that fails for either
+       * (and, until the time Keep named, without asking again),
+       * `KeepCredentialsRefusedError` for a 401 (and, once three fall inside one of
+       * Keep's lockout windows, without asking again until the oldest ages out:
+       * see `RefusalBudget`), and a plain `Error` for any other refusal. A refresh
+       * that fails for either
        * of the first two reasons while the cached token has not yet expired
        * answers with the cached token instead: the refresh starts 30s early
        * precisely so a failed one costs nothing.
@@ -11573,6 +11642,7 @@ var require_service_token = __commonJS({
       async refresh() {
         try {
           this.rateLimit.check();
+          this.refusals.check();
           return await this.exchange();
         } catch (err) {
           const code = err?.code;
@@ -11590,8 +11660,10 @@ var require_service_token = __commonJS({
           clientSecret: this.clientSecret,
           rateLimit: this.rateLimit,
           onResponse: this.onResponse,
-          exchangeName: "Token exchange"
+          exchangeName: "Token exchange",
+          refused: (message) => this.refusals.refuse({ message: `[ServiceTokenManager] ${message}`, host: (0, exchange_1.hostOf)(this.keepApiUrl) })
         });
+        this.refusals.clear();
         this.token = data.token;
         this.expiresAt = Date.now() + data.expiresIn * 1e3;
         return this.token;
@@ -11678,7 +11750,7 @@ var require_dist2 = __commonJS({
   "../../packages/keep/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.waitForKeepToken = exports2.KeepRateLimitedError = exports2.KeepUnavailableError = exports2.AgentCredentialRevokedError = exports2.AgentTokenManager = exports2.ServiceTokenManager = exports2.KeepClient = void 0;
+    exports2.waitForKeepToken = exports2.KeepCredentialsRefusedError = exports2.KeepRateLimitedError = exports2.KeepUnavailableError = exports2.AgentCredentialRevokedError = exports2.AgentTokenManager = exports2.ServiceTokenManager = exports2.KeepClient = void 0;
     var client_1 = require_client();
     Object.defineProperty(exports2, "KeepClient", { enumerable: true, get: function() {
       return client_1.KeepClient;
@@ -11702,6 +11774,10 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "KeepRateLimitedError", { enumerable: true, get: function() {
       return rate_limited_1.KeepRateLimitedError;
     } });
+    var refusal_budget_1 = require_refusal_budget();
+    Object.defineProperty(exports2, "KeepCredentialsRefusedError", { enumerable: true, get: function() {
+      return refusal_budget_1.KeepCredentialsRefusedError;
+    } });
     var wait_for_token_1 = require_wait_for_token();
     Object.defineProperty(exports2, "waitForKeepToken", { enumerable: true, get: function() {
       return wait_for_token_1.waitForKeepToken;
@@ -12475,6 +12551,12 @@ var require_checks = __commonJS({
       const defaults = (0, environment_1.executorDefaultsFor)(subject.brand, config.auth.jobsApiUrl)?.[WORKSPACE_EXECUTOR] ?? {};
       return { ...defaults, ...user };
     }
+    function claudeSettingsOf(config) {
+      return config.executors[WORKSPACE_EXECUTOR]?.claudeSettings;
+    }
+    function describeLogin(status) {
+      return [status.authMethod ?? "unknown method", status.subscriptionType].filter((part) => part !== null).join(", ");
+    }
     function runRoot(config, subject, osTmpDir) {
       const settings = claudeCodeSettings(config, subject);
       const tmpDir = settings?.tmpDir;
@@ -12769,6 +12851,14 @@ var require_checks = __commonJS({
           if (probes.ambientAnthropicKey()) {
             return warn("claude-auth", "ANTHROPIC_API_KEY is set and will bill that account, shadowing any interactive login", "unset ANTHROPIC_API_KEY if you meant to use your Claude Code login");
           }
+          const settingSources = claudeSettingsOf(config) === "user" ? "user" : "";
+          const status = await probes.claudeAuthStatus(settingSources);
+          if (status !== null) {
+            if (!status.loggedIn) {
+              return fail("claude-auth", "the claude CLI is not signed in", settingSources === "" ? "run `claude auth login`; if your login or provider is configured in Claude Code settings (apiKeyHelper, or an env block), set `claudeSettings: user` on the claude-code executor instead" : "run `claude auth login`");
+            }
+            return pass("claude-auth", `signed in (${describeLogin(status)}; not verified)`);
+          }
           const store = await probes.claudeCredentialStore();
           if (store === null) {
             return warn("claude-auth", "no credential store found for the claude CLI (a macOS login may live in the Keychain, which this cannot read)", "run `claude` once and sign in, or run doctor --deep to spend one turn proving it");
@@ -21382,6 +21472,7 @@ var require_probes = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createProbes = createProbes;
+    exports2.parseClaudeAuthStatus = parseClaudeAuthStatus;
     var child_process_1 = require("child_process");
     var fs_1 = require("fs");
     var promises_1 = require("fs/promises");
@@ -21600,6 +21691,10 @@ var require_probes = __commonJS({
           const candidate = path_1.default.join(configDir, ".credentials.json");
           return (0, fs_1.existsSync)(candidate) ? candidate : null;
         },
+        async claudeAuthStatus(settingSources) {
+          const outcome = await runForAnyExit("claude", ["--setting-sources", settingSources, "auth", "status", "--json"], VERSION_TIMEOUT_MS);
+          return outcome === null ? null : parseClaudeAuthStatus(outcome);
+        },
         ambientAnthropicKey: () => (process.env.ANTHROPIC_API_KEY ?? "").length > 0,
         async claudeRoundTrip() {
           const output = await runForOutput(
@@ -21620,13 +21715,37 @@ var require_probes = __commonJS({
       const outcome = await runCapturing(bin, args, timeoutMs);
       return outcome.ok ? outcome.stdout : null;
     }
+    async function runForAnyExit(bin, args, timeoutMs) {
+      const outcome = await runCapturing(bin, args, timeoutMs);
+      if (outcome.ok)
+        return outcome.stdout;
+      return outcome.exited ? outcome.stdout : null;
+    }
+    function parseClaudeAuthStatus(stdout) {
+      let parsed;
+      try {
+        parsed = JSON.parse(stdout);
+      } catch {
+        return null;
+      }
+      if (parsed === null || typeof parsed !== "object")
+        return null;
+      const { loggedIn, authMethod, subscriptionType } = parsed;
+      if (typeof loggedIn !== "boolean")
+        return null;
+      return {
+        loggedIn,
+        authMethod: typeof authMethod === "string" && authMethod.length > 0 ? authMethod : null,
+        subscriptionType: typeof subscriptionType === "string" && subscriptionType.length > 0 ? subscriptionType : null
+      };
+    }
     function runCapturing(bin, args, timeoutMs) {
       return new Promise((resolve) => {
         let child;
         try {
           child = (0, child_process_1.spawn)(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
         } catch (err) {
-          resolve({ ok: false, reason: describe(err) });
+          resolve({ ok: false, reason: describe(err), exited: false });
           return;
         }
         let stdout = "";
@@ -21640,7 +21759,7 @@ var require_probes = __commonJS({
         };
         const timer = setTimeout(() => {
           child.kill("SIGKILL");
-          settle({ ok: false, reason: `did not finish within ${Math.round(timeoutMs / 1e3)}s` });
+          settle({ ok: false, reason: `did not finish within ${Math.round(timeoutMs / 1e3)}s`, exited: false });
         }, timeoutMs);
         child.stdout?.on("data", (chunk) => {
           stdout += chunk.toString("utf8");
@@ -21650,7 +21769,7 @@ var require_probes = __commonJS({
         });
         child.on("error", (err) => {
           clearTimeout(timer);
-          settle({ ok: false, reason: describe(err) });
+          settle({ ok: false, reason: describe(err), exited: false });
         });
         child.on("close", (code, signal) => {
           clearTimeout(timer);
@@ -21660,7 +21779,8 @@ var require_probes = __commonJS({
           }
           const status = code === null ? `was killed by ${signal ?? "a signal"}` : `exited ${code}`;
           const said = stderr.split("\n").map((line) => line.trim()).find((line) => line.length > 0);
-          settle({ ok: false, reason: said ? `${status}: ${said}` : status });
+          const reason = said ? `${status}: ${said}` : status;
+          settle(code === null ? { ok: false, reason, exited: false } : { ok: false, reason, exited: true, stdout: stdout.trim() });
         });
       });
     }
@@ -26966,7 +27086,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.17" : pkg.version;
+var buildVersion = true ? "0.30.19" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",