@whittlelabs/sifter 0.34.0 → 0.35.0

package/bin.js

@@ -11072,6 +11072,7 @@ var require_claude_code = __commonJS({
       let finalText = null;
       const readPaths = [];
       let usage = null;
+      const toolCalls = {};
       let resultMeta = null;
       let structuredOutput = null;
       let sessionId = null;
@@ -11099,6 +11100,8 @@ var require_claude_code = __commonJS({
             const b = block;
             if (b?.type !== "tool_use")
               continue;
+            if (typeof b.name === "string")
+              toolCalls[b.name] = (toolCalls[b.name] ?? 0) + 1;
             const fp = b.input?.file_path;
             if (b.name === "Read" && typeof fp === "string") {
               readPaths.push(fp);
@@ -11125,13 +11128,19 @@ var require_claude_code = __commonJS({
           }
           const u = event.usage;
           const cost = event.total_cost_usd;
+          const turns = event.num_turns;
           usage = {
             ...typeof u?.input_tokens === "number" ? { inputTokens: u.input_tokens } : {},
             ...typeof u?.output_tokens === "number" ? { outputTokens: u.output_tokens } : {},
-            ...typeof cost === "number" ? { costUsd: cost } : {}
+            ...typeof u?.cache_read_input_tokens === "number" ? { cacheReadInputTokens: u.cache_read_input_tokens } : {},
+            ...typeof u?.cache_creation_input_tokens === "number" ? { cacheCreationInputTokens: u.cache_creation_input_tokens } : {},
+            ...typeof cost === "number" ? { costUsd: cost } : {},
+            ...typeof turns === "number" ? { turns } : {}
           };
         }
       }
+      if (usage && Object.keys(toolCalls).length > 0)
+        usage.toolCalls = toolCalls;
       return { finalText, readPaths, usage, resultMeta, structuredOutput, sessionId, model, toolInputs };
     }
   }
@@ -26124,6 +26133,257 @@ var require_chain = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/executors/output-gates.js
+var require_output_gates = __commonJS({
+  "../../packages/shuttle/dist/executors/output-gates.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isSanctionedPaint = isSanctionedPaint;
+    exports2.unsanctionedPaints = unsanctionedPaints;
+    exports2.resolvePath = resolvePath;
+    exports2.evaluateOutputGates = evaluateOutputGates;
+    exports2.renderRepairPrompt = renderRepairPrompt;
+    var INPUT_REF = "input:";
+    var COLOR_BEARING = ["fill", "stroke", "color", "stop-color", "flood-color", "lighting-color"];
+    var INERT = /* @__PURE__ */ new Set(["none", "inherit", "initial", "unset", "transparent", "currentcolor"]);
+    function isSanctionedPaint(raw) {
+      const value = raw.trim().toLowerCase();
+      if (value === "")
+        return true;
+      if (INERT.has(value))
+        return true;
+      if (/^url\(\s*['"]?#[^)'"]+['"]?\s*\)$/.test(value))
+        return true;
+      const varMatch = /^var\(\s*(--[a-z0-9-]+)\s*(?:,([\s\S]*))?\)$/.exec(value);
+      if (!varMatch)
+        return false;
+      const [, name, fallback] = varMatch;
+      if (!name.startsWith("--color-"))
+        return false;
+      return fallback === void 0 || isSanctionedPaint(fallback);
+    }
+    function unsanctionedPaints(source) {
+      const found = [];
+      const attrs = COLOR_BEARING.join("|");
+      const attribute = new RegExp(`\\b(?:${attrs})\\s*=\\s*(['"])([\\s\\S]*?)\\1`, "gi");
+      const declaration = new RegExp(`\\b(?:${attrs})\\s*:\\s*([^;"'}\\n]+)`, "gi");
+      for (const [, , value] of source.matchAll(attribute)) {
+        if (!isSanctionedPaint(value))
+          found.push(value.trim());
+      }
+      for (const [, value] of source.matchAll(declaration)) {
+        if (!isSanctionedPaint(value))
+          found.push(value.trim());
+      }
+      return found;
+    }
+    function resolvePath(root, path) {
+      let ctx = root;
+      for (const seg of path.split(".")) {
+        const project = seg.endsWith("[*]");
+        const key = project ? seg.slice(0, -3) : seg;
+        if (Array.isArray(ctx)) {
+          ctx = ctx.map((el) => key ? el?.[key] : el);
+        } else {
+          ctx = key ? ctx?.[key] : ctx;
+        }
+        if (project && !Array.isArray(ctx)) {
+          ctx = ctx == null ? [] : [ctx];
+        }
+      }
+      return ctx;
+    }
+    function resolveRef(ref, output, inputs) {
+      if (ref.startsWith(INPUT_REF)) {
+        const label = ref.slice(INPUT_REF.length);
+        const row = inputs.find((i) => i.label === label) ?? inputs.find((i) => i.label === "artifacts" && i.payload.label === label);
+        if (!row)
+          return void 0;
+        return Object.prototype.hasOwnProperty.call(row.payload, "value") ? row.payload.value : row.payload;
+      }
+      return resolvePath(output, ref);
+    }
+    function asStrings(value) {
+      if (Array.isArray(value))
+        return value.map((v) => String(v));
+      if (value == null)
+        return [];
+      return [String(value)];
+    }
+    var PRIMITIVES = {
+      /**
+       * `coverage` — the values at `got` must exactly cover the set at `want`:
+       * every wanted value present, nothing invented, none repeated. Params:
+       * `{ got: <output path>, want: <ref>, subject?: <noun> }`.
+       */
+      coverage(params, output, inputs) {
+        const subject = typeof params.subject === "string" ? params.subject : "item";
+        const got = asStrings(resolveRef(String(params.got), output, inputs));
+        const want = asStrings(resolveRef(String(params.want), output, inputs));
+        const gotSet = new Set(got);
+        const wantSet = new Set(want);
+        const missing = want.filter((v) => !gotSet.has(v));
+        const unknown = [...new Set(got.filter((v) => !wantSet.has(v)))];
+        const seen = /* @__PURE__ */ new Set();
+        const duplicated = [];
+        for (const v of got) {
+          if (seen.has(v))
+            duplicated.push(v);
+          else
+            seen.add(v);
+        }
+        if (missing.length === 0 && unknown.length === 0 && duplicated.length === 0)
+          return [];
+        const parts = [];
+        if (missing.length)
+          parts.push(`missing ${subject}(s): [${missing.join(", ")}]`);
+        if (unknown.length)
+          parts.push(`not a known ${subject}: [${unknown.join(", ")}]`);
+        if (duplicated.length)
+          parts.push(`assessed more than once: [${[...new Set(duplicated)].join(", ")}]`);
+        return [
+          `every ${subject} must be covered exactly once \u2014 ${parts.join("; ")}. Return one entry per ${subject}, using its exact id.`
+        ];
+      },
+      /**
+       * `non_empty_when` — the array at `path` must be non-empty, optionally only
+       * when `when.path` equals `when.equals`. Params:
+       * `{ path: <output path>, when?: { path: <output path>, equals: <value> } }`.
+       */
+      non_empty_when(params, output) {
+        const when = params.when;
+        if (when && typeof when.path === "string") {
+          if (resolvePath(output, when.path) !== when.equals)
+            return [];
+        }
+        const path = String(params.path);
+        const value = resolvePath(output, path);
+        if (Array.isArray(value) && value.length > 0)
+          return [];
+        const cond = when && typeof when.path === "string" ? ` when ${when.path} is ${JSON.stringify(when.equals)}` : "";
+        return [
+          `'${path}' must be a non-empty array${cond}; it was ${Array.isArray(value) ? "empty" : "absent"}.`
+        ];
+      },
+      /**
+       * `bounded_palette` — every colour in the sources at `path` must be named
+       * by role rather than written as a value. Params:
+       * `{ path: <output path>, roles?: <role names for the repair turn> }`.
+       *
+       * A drawing the model authors is markup the house did not write, and a
+       * literal in it is a colour outside the consuming palette: unproved
+       * against the colours beside it, unchecked for contrast on the ground it
+       * lands on, and fixed to one theme. The consumer strips such a paint at
+       * render, so an artifact that carries one silently loses it. Catching it
+       * HERE is what makes that a repair the model can make while it still has
+       * the drawing in hand, instead of a defect nobody sees until the picture
+       * comes out plain.
+       */
+      bounded_palette(params, output) {
+        const path = String(params.path);
+        const value = resolvePath(output, path);
+        const sources = (Array.isArray(value) ? value : [value]).filter((v) => typeof v === "string" && v.length > 0);
+        const offenders = [...new Set(sources.flatMap(unsanctionedPaints))];
+        if (offenders.length === 0)
+          return [];
+        const roles = Array.isArray(params.roles) ? params.roles.map(String) : [];
+        const vocabulary = roles.length > 0 ? ` Use one of: ${roles.join(", ")}.` : "";
+        return [
+          `'${path}' states ${offenders.length} colour value${offenders.length === 1 ? "" : "s"} directly (${offenders.slice(0, 8).join(", ")}${offenders.length > 8 ? ", \u2026" : ""}). Every colour must be named by role \u2014 var(--color-\u2026), currentColor, or none \u2014 never as a hex, rgb(), hsl() or colour name, because a value cannot adapt to the reader's theme and was never checked against the colours beside it.${vocabulary} Redraw with roles and return the whole output again.`
+        ];
+      }
+    };
+    function evaluateOutputGates(gates, output, inputs) {
+      const findings = [];
+      for (const gate of gates) {
+        const primitive = PRIMITIVES[gate.primitive];
+        if (!primitive) {
+          findings.push({ gate: gate.name, message: `unknown gate primitive '${gate.primitive}'` });
+          continue;
+        }
+        for (const message of primitive(gate.params, output, inputs)) {
+          findings.push({ gate: gate.name, message });
+        }
+      }
+      return { ok: findings.length === 0, findings };
+    }
+    function renderRepairPrompt(findings) {
+      return [
+        "Your previous answer did not satisfy these output checks. Return the corrected, complete answer that resolves every item below. Produce the same output shape with the problems fixed, and nothing else \u2014 no commentary, no explanation of the changes.",
+        "",
+        ...findings.map((f) => `- [${f.gate}] ${f.message}`)
+      ].join("\n");
+    }
+  }
+});
+
+// ../../packages/shuttle/dist/logging/logger.js
+var require_logger = __commonJS({
+  "../../packages/shuttle/dist/logging/logger.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createLogger = createLogger;
+    exports2.setGlobalLogger = setGlobalLogger;
+    exports2.getLogger = getLogger;
+    var LEVEL_ORDER = {
+      debug: 0,
+      info: 1,
+      warn: 2,
+      error: 3
+    };
+    function formatContext(context) {
+      return Object.entries(context).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
+    }
+    function formatPretty(level, message, context) {
+      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      const tag = level.toUpperCase().padEnd(5);
+      const base = `[${timestamp}] ${tag} ${message}`;
+      if (context && Object.keys(context).length > 0) {
+        return `${base} ${formatContext(context)}`;
+      }
+      return base;
+    }
+    function formatJson(level, message, context) {
+      const entry = {
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level,
+        message,
+        ...context
+      };
+      return JSON.stringify(entry);
+    }
+    function createLogger(options) {
+      const threshold = LEVEL_ORDER[options.level];
+      const format = options.format === "json" ? formatJson : formatPretty;
+      function emit(level, message, context) {
+        if (LEVEL_ORDER[level] < threshold)
+          return;
+        const line = format(level, message, context);
+        if (level === "error") {
+          console.error(line);
+        } else if (level === "warn") {
+          console.warn(line);
+        } else {
+          console.log(line);
+        }
+      }
+      return {
+        debug: (message, context) => emit("debug", message, context),
+        info: (message, context) => emit("info", message, context),
+        warn: (message, context) => emit("warn", message, context),
+        error: (message, context) => emit("error", message, context)
+      };
+    }
+    var globalLogger = createLogger({ level: "info", format: "pretty" });
+    function setGlobalLogger(logger) {
+      globalLogger = logger;
+    }
+    function getLogger() {
+      return globalLogger;
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/workspace/git.js
 var require_git = __commonJS({
   "../../packages/shuttle/dist/workspace/git.js"(exports2) {
@@ -26612,358 +26872,231 @@ var require_workspace = __commonJS({
     } });
     Object.defineProperty(exports2, "registerModifier", { enumerable: true, get: function() {
       return materialize_1.registerModifier;
-    } });
-    var git_1 = require_git();
-    Object.defineProperty(exports2, "gitMaterializer", { enumerable: true, get: function() {
-      return git_1.gitMaterializer;
-    } });
-    Object.defineProperty(exports2, "buildGitAuthEnv", { enumerable: true, get: function() {
-      return git_1.buildGitAuthEnv;
-    } });
-    var overlay_1 = require_overlay();
-    Object.defineProperty(exports2, "overlayModifier", { enumerable: true, get: function() {
-      return overlay_1.overlayModifier;
-    } });
-    Object.defineProperty(exports2, "applyOverlay", { enumerable: true, get: function() {
-      return overlay_1.applyOverlay;
-    } });
-  }
-});
-
-// ../../packages/shuttle/dist/credentials/registry.js
-var require_registry2 = __commonJS({
-  "../../packages/shuttle/dist/credentials/registry.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.registerCredentialResolver = registerCredentialResolver;
-    exports2.getCredentialResolver = getCredentialResolver;
-    var resolvers = /* @__PURE__ */ new Map();
-    function registerCredentialResolver(name, resolver) {
-      resolvers.set(name, resolver);
-    }
-    function getCredentialResolver(name) {
-      return resolvers.get(name);
-    }
-    registerCredentialResolver("managed-model-key", async (keep, principal) => {
-      const reveal = await keep.revealManagedSifterKey(principal);
-      return reveal.apiKey;
-    });
-    registerCredentialResolver("github-user-token", async (keep, principal) => {
-      try {
-        const reveal = await keep.getUserGithubToken(principal);
-        return reveal.access_token;
-      } catch {
-        return null;
-      }
-    });
-  }
-});
-
-// ../../packages/shuttle/dist/credentials/broker.js
-var require_broker = __commonJS({
-  "../../packages/shuttle/dist/credentials/broker.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createCredentialBroker = createCredentialBroker;
-    var keep_1 = require_dist2();
-    var env_ref_1 = require_env_ref();
-    var registry_1 = require_registry2();
-    function createCredentialBroker(config, deps = {}) {
-      if (typeof config !== "object" || config === null || config.apiKeyFrom !== "job-metadata") {
-        return null;
-      }
-      const cfg = config;
-      const keepApiUrl = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepApiUrl", "KEEP_API_URL");
-      const clientId = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientId", "KEEP_CLIENT_ID");
-      const clientSecret = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientSecret", "KEEP_CLIENT_SECRET");
-      const stmFactory = deps.buildServiceTokenManager ?? ((c) => new keep_1.ServiceTokenManager(c));
-      const stm = stmFactory({ keepApiUrl, clientId, clientSecret });
-      const keepFactory = deps.buildKeepClient ?? ((c) => new keep_1.KeepClient(c));
-      return {
-        async reveal({ name, principal }) {
-          const resolver = (0, registry_1.getCredentialResolver)(name);
-          if (!resolver)
-            return null;
-          const serviceToken = await stm.getToken();
-          if (!serviceToken) {
-            throw new Error("credential broker: Keep service-token exchange failed. Check KEEP_CLIENT_ID / KEEP_CLIENT_SECRET.");
-          }
-          const keep = keepFactory({ baseUrl: keepApiUrl, serviceToken });
-          return resolver(keep, principal);
-        }
-      };
-    }
-  }
-});
-
-// ../../packages/shuttle/dist/credentials/index.js
-var require_credentials = __commonJS({
-  "../../packages/shuttle/dist/credentials/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.getCredentialResolver = exports2.registerCredentialResolver = exports2.createCredentialBroker = void 0;
-    var broker_1 = require_broker();
-    Object.defineProperty(exports2, "createCredentialBroker", { enumerable: true, get: function() {
-      return broker_1.createCredentialBroker;
-    } });
-    var registry_1 = require_registry2();
-    Object.defineProperty(exports2, "registerCredentialResolver", { enumerable: true, get: function() {
-      return registry_1.registerCredentialResolver;
-    } });
-    Object.defineProperty(exports2, "getCredentialResolver", { enumerable: true, get: function() {
-      return registry_1.getCredentialResolver;
-    } });
-  }
-});
-
-// ../../packages/shuttle/dist/executors/output-gates.js
-var require_output_gates = __commonJS({
-  "../../packages/shuttle/dist/executors/output-gates.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.isSanctionedPaint = isSanctionedPaint;
-    exports2.unsanctionedPaints = unsanctionedPaints;
-    exports2.resolvePath = resolvePath;
-    exports2.evaluateOutputGates = evaluateOutputGates;
-    exports2.renderRepairPrompt = renderRepairPrompt;
-    var INPUT_REF = "input:";
-    var COLOR_BEARING = ["fill", "stroke", "color", "stop-color", "flood-color", "lighting-color"];
-    var INERT = /* @__PURE__ */ new Set(["none", "inherit", "initial", "unset", "transparent", "currentcolor"]);
-    function isSanctionedPaint(raw) {
-      const value = raw.trim().toLowerCase();
-      if (value === "")
-        return true;
-      if (INERT.has(value))
-        return true;
-      if (/^url\(\s*['"]?#[^)'"]+['"]?\s*\)$/.test(value))
-        return true;
-      const varMatch = /^var\(\s*(--[a-z0-9-]+)\s*(?:,([\s\S]*))?\)$/.exec(value);
-      if (!varMatch)
-        return false;
-      const [, name, fallback] = varMatch;
-      if (!name.startsWith("--color-"))
-        return false;
-      return fallback === void 0 || isSanctionedPaint(fallback);
-    }
-    function unsanctionedPaints(source) {
-      const found = [];
-      const attrs = COLOR_BEARING.join("|");
-      const attribute = new RegExp(`\\b(?:${attrs})\\s*=\\s*(['"])([\\s\\S]*?)\\1`, "gi");
-      const declaration = new RegExp(`\\b(?:${attrs})\\s*:\\s*([^;"'}\\n]+)`, "gi");
-      for (const [, , value] of source.matchAll(attribute)) {
-        if (!isSanctionedPaint(value))
-          found.push(value.trim());
-      }
-      for (const [, value] of source.matchAll(declaration)) {
-        if (!isSanctionedPaint(value))
-          found.push(value.trim());
-      }
-      return found;
-    }
-    function resolvePath(root, path) {
-      let ctx = root;
-      for (const seg of path.split(".")) {
-        const project = seg.endsWith("[*]");
-        const key = project ? seg.slice(0, -3) : seg;
-        if (Array.isArray(ctx)) {
-          ctx = ctx.map((el) => key ? el?.[key] : el);
-        } else {
-          ctx = key ? ctx?.[key] : ctx;
-        }
-        if (project && !Array.isArray(ctx)) {
-          ctx = ctx == null ? [] : [ctx];
-        }
-      }
-      return ctx;
-    }
-    function resolveRef(ref, output, inputs) {
-      if (ref.startsWith(INPUT_REF)) {
-        const label = ref.slice(INPUT_REF.length);
-        const row = inputs.find((i) => i.label === label) ?? inputs.find((i) => i.label === "artifacts" && i.payload.label === label);
-        if (!row)
-          return void 0;
-        return Object.prototype.hasOwnProperty.call(row.payload, "value") ? row.payload.value : row.payload;
-      }
-      return resolvePath(output, ref);
-    }
-    function asStrings(value) {
-      if (Array.isArray(value))
-        return value.map((v) => String(v));
-      if (value == null)
-        return [];
-      return [String(value)];
-    }
-    var PRIMITIVES = {
-      /**
-       * `coverage` — the values at `got` must exactly cover the set at `want`:
-       * every wanted value present, nothing invented, none repeated. Params:
-       * `{ got: <output path>, want: <ref>, subject?: <noun> }`.
-       */
-      coverage(params, output, inputs) {
-        const subject = typeof params.subject === "string" ? params.subject : "item";
-        const got = asStrings(resolveRef(String(params.got), output, inputs));
-        const want = asStrings(resolveRef(String(params.want), output, inputs));
-        const gotSet = new Set(got);
-        const wantSet = new Set(want);
-        const missing = want.filter((v) => !gotSet.has(v));
-        const unknown = [...new Set(got.filter((v) => !wantSet.has(v)))];
-        const seen = /* @__PURE__ */ new Set();
-        const duplicated = [];
-        for (const v of got) {
-          if (seen.has(v))
-            duplicated.push(v);
-          else
-            seen.add(v);
-        }
-        if (missing.length === 0 && unknown.length === 0 && duplicated.length === 0)
-          return [];
-        const parts = [];
-        if (missing.length)
-          parts.push(`missing ${subject}(s): [${missing.join(", ")}]`);
-        if (unknown.length)
-          parts.push(`not a known ${subject}: [${unknown.join(", ")}]`);
-        if (duplicated.length)
-          parts.push(`assessed more than once: [${[...new Set(duplicated)].join(", ")}]`);
-        return [
-          `every ${subject} must be covered exactly once \u2014 ${parts.join("; ")}. Return one entry per ${subject}, using its exact id.`
-        ];
-      },
-      /**
-       * `non_empty_when` — the array at `path` must be non-empty, optionally only
-       * when `when.path` equals `when.equals`. Params:
-       * `{ path: <output path>, when?: { path: <output path>, equals: <value> } }`.
-       */
-      non_empty_when(params, output) {
-        const when = params.when;
-        if (when && typeof when.path === "string") {
-          if (resolvePath(output, when.path) !== when.equals)
-            return [];
-        }
-        const path = String(params.path);
-        const value = resolvePath(output, path);
-        if (Array.isArray(value) && value.length > 0)
-          return [];
-        const cond = when && typeof when.path === "string" ? ` when ${when.path} is ${JSON.stringify(when.equals)}` : "";
-        return [
-          `'${path}' must be a non-empty array${cond}; it was ${Array.isArray(value) ? "empty" : "absent"}.`
-        ];
-      },
-      /**
-       * `bounded_palette` — every colour in the sources at `path` must be named
-       * by role rather than written as a value. Params:
-       * `{ path: <output path>, roles?: <role names for the repair turn> }`.
-       *
-       * A drawing the model authors is markup the house did not write, and a
-       * literal in it is a colour outside the consuming palette: unproved
-       * against the colours beside it, unchecked for contrast on the ground it
-       * lands on, and fixed to one theme. The consumer strips such a paint at
-       * render, so an artifact that carries one silently loses it. Catching it
-       * HERE is what makes that a repair the model can make while it still has
-       * the drawing in hand, instead of a defect nobody sees until the picture
-       * comes out plain.
-       */
-      bounded_palette(params, output) {
-        const path = String(params.path);
-        const value = resolvePath(output, path);
-        const sources = (Array.isArray(value) ? value : [value]).filter((v) => typeof v === "string" && v.length > 0);
-        const offenders = [...new Set(sources.flatMap(unsanctionedPaints))];
-        if (offenders.length === 0)
-          return [];
-        const roles = Array.isArray(params.roles) ? params.roles.map(String) : [];
-        const vocabulary = roles.length > 0 ? ` Use one of: ${roles.join(", ")}.` : "";
-        return [
-          `'${path}' states ${offenders.length} colour value${offenders.length === 1 ? "" : "s"} directly (${offenders.slice(0, 8).join(", ")}${offenders.length > 8 ? ", \u2026" : ""}). Every colour must be named by role \u2014 var(--color-\u2026), currentColor, or none \u2014 never as a hex, rgb(), hsl() or colour name, because a value cannot adapt to the reader's theme and was never checked against the colours beside it.${vocabulary} Redraw with roles and return the whole output again.`
-        ];
-      }
-    };
-    function evaluateOutputGates(gates, output, inputs) {
-      const findings = [];
-      for (const gate of gates) {
-        const primitive = PRIMITIVES[gate.primitive];
-        if (!primitive) {
-          findings.push({ gate: gate.name, message: `unknown gate primitive '${gate.primitive}'` });
-          continue;
+    } });
+    var git_1 = require_git();
+    Object.defineProperty(exports2, "gitMaterializer", { enumerable: true, get: function() {
+      return git_1.gitMaterializer;
+    } });
+    Object.defineProperty(exports2, "buildGitAuthEnv", { enumerable: true, get: function() {
+      return git_1.buildGitAuthEnv;
+    } });
+    var overlay_1 = require_overlay();
+    Object.defineProperty(exports2, "overlayModifier", { enumerable: true, get: function() {
+      return overlay_1.overlayModifier;
+    } });
+    Object.defineProperty(exports2, "applyOverlay", { enumerable: true, get: function() {
+      return overlay_1.applyOverlay;
+    } });
+  }
+});
+
+// ../../packages/shuttle/dist/core/run-dispatch.js
+var require_run_dispatch = __commonJS({
+  "../../packages/shuttle/dist/core/run-dispatch.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.GATE_REPAIR_BUDGET = void 0;
+    exports2.runDispatch = runDispatch;
+    exports2.runOutputGates = runOutputGates;
+    exports2.mergeRepairedResponse = mergeRepairedResponse;
+    var loom_1 = require_dist();
+    var output_gates_1 = require_output_gates();
+    var logger_1 = require_logger();
+    var workspace_1 = require_workspace();
+    exports2.GATE_REPAIR_BUDGET = 2;
+    async function runDispatch(dispatch, executor, options) {
+      const { credentials, signal } = options;
+      const environment = executor.prepareEnvironment ? await executor.prepareEnvironment(dispatch) : void 0;
+      let workspace = null;
+      if (environment?.workspaceRequest) {
+        try {
+          workspace = await (0, workspace_1.materializeWorkspace)(environment.workspaceRequest, {
+            ...environment.materializeOptions ?? {},
+            credentials,
+            signal
+          });
+        } catch (err) {
+          (0, logger_1.getLogger)().warn("workspace materialization failed; running prompt-only", {
+            jobId: dispatch.job.id,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          workspace = null;
         }
-        for (const message of primitive(gate.params, output, inputs)) {
-          findings.push({ gate: gate.name, message });
+      }
+      const ctx = {
+        ...options.reportProgress ? { reportProgress: options.reportProgress } : {},
+        workspace,
+        credentials
+      };
+      let response;
+      try {
+        response = await executor.execute(dispatch, signal, ctx);
+      } catch (error) {
+        return { kind: "executor-failed", error };
+      } finally {
+        if (workspace)
+          await workspace.cleanup();
+      }
+      const gated = await runOutputGates(dispatch, response, executor, signal, ctx);
+      if (!gated.ok)
+        return { kind: "gate-failed", reason: gated.reason };
+      return { kind: "completed", response: gated.response };
+    }
+    async function runOutputGates(dispatch, response, executor, signal, ctx) {
+      let spec;
+      try {
+        spec = (0, loom_1.readPromptExecutionSpec)(dispatch.inputs);
+      } catch {
+        return { ok: true, response };
+      }
+      const gates = spec.gates;
+      if (!gates || gates.length === 0)
+        return { ok: true, response };
+      let current = response;
+      let result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
+      let attempts = 0;
+      while (!result.ok && attempts < exports2.GATE_REPAIR_BUDGET && current.continuation !== void 0 && typeof executor.continue === "function") {
+        try {
+          const repaired = await executor.continue(current.continuation, (0, output_gates_1.renderRepairPrompt)(result.findings), signal, ctx);
+          current = mergeRepairedResponse(current, repaired);
+        } catch {
+          break;
         }
+        result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
+        attempts += 1;
       }
-      return { ok: findings.length === 0, findings };
+      if (result.ok)
+        return { ok: true, response: current };
+      const detail = result.findings.map((f) => `[${f.gate}] ${f.message}`).join(" | ");
+      return {
+        ok: false,
+        reason: `output gate(s) failed${attempts > 0 ? ` after ${attempts} repair attempt(s)` : ""}: ${detail}`
+      };
     }
-    function renderRepairPrompt(findings) {
-      return [
-        "Your previous answer did not satisfy these output checks. Return the corrected, complete answer that resolves every item below. Produce the same output shape with the problems fixed, and nothing else \u2014 no commentary, no explanation of the changes.",
-        "",
-        ...findings.map((f) => `- [${f.gate}] ${f.message}`)
-      ].join("\n");
+    function mergeRepairedResponse(original, repaired) {
+      const replaced = new Set(repaired.outputs.map((o) => o.label));
+      const outputs = [...original.outputs.filter((o) => !replaced.has(o.label)), ...repaired.outputs];
+      const usage = sumUsage(original.usage, repaired.usage);
+      return {
+        ...original,
+        ...repaired,
+        outputs,
+        ...usage ? { usage } : {}
+      };
+    }
+    var ADDITIVE_USAGE = [
+      "inputTokens",
+      "outputTokens",
+      "cacheReadInputTokens",
+      "cacheCreationInputTokens",
+      "costUsd",
+      "turns"
+    ];
+    function sumUsage(a, b) {
+      if (!a)
+        return b;
+      if (!b)
+        return a;
+      const sum = { ...a, ...b };
+      for (const key of ADDITIVE_USAGE) {
+        if (a[key] === void 0 && b[key] === void 0)
+          continue;
+        sum[key] = (a[key] ?? 0) + (b[key] ?? 0);
+      }
+      if (a.toolCalls || b.toolCalls) {
+        const calls = { ...a.toolCalls ?? {} };
+        for (const [name, n] of Object.entries(b.toolCalls ?? {}))
+          calls[name] = (calls[name] ?? 0) + n;
+        sum.toolCalls = calls;
+      }
+      return sum;
     }
   }
 });
 
-// ../../packages/shuttle/dist/logging/logger.js
-var require_logger = __commonJS({
-  "../../packages/shuttle/dist/logging/logger.js"(exports2) {
+// ../../packages/shuttle/dist/credentials/registry.js
+var require_registry2 = __commonJS({
+  "../../packages/shuttle/dist/credentials/registry.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createLogger = createLogger;
-    exports2.setGlobalLogger = setGlobalLogger;
-    exports2.getLogger = getLogger;
-    var LEVEL_ORDER = {
-      debug: 0,
-      info: 1,
-      warn: 2,
-      error: 3
-    };
-    function formatContext(context) {
-      return Object.entries(context).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
-    }
-    function formatPretty(level, message, context) {
-      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-      const tag = level.toUpperCase().padEnd(5);
-      const base = `[${timestamp}] ${tag} ${message}`;
-      if (context && Object.keys(context).length > 0) {
-        return `${base} ${formatContext(context)}`;
-      }
-      return base;
+    exports2.registerCredentialResolver = registerCredentialResolver;
+    exports2.getCredentialResolver = getCredentialResolver;
+    var resolvers = /* @__PURE__ */ new Map();
+    function registerCredentialResolver(name, resolver) {
+      resolvers.set(name, resolver);
     }
-    function formatJson(level, message, context) {
-      const entry = {
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        level,
-        message,
-        ...context
-      };
-      return JSON.stringify(entry);
+    function getCredentialResolver(name) {
+      return resolvers.get(name);
     }
-    function createLogger(options) {
-      const threshold = LEVEL_ORDER[options.level];
-      const format = options.format === "json" ? formatJson : formatPretty;
-      function emit(level, message, context) {
-        if (LEVEL_ORDER[level] < threshold)
-          return;
-        const line = format(level, message, context);
-        if (level === "error") {
-          console.error(line);
-        } else if (level === "warn") {
-          console.warn(line);
-        } else {
-          console.log(line);
-        }
+    registerCredentialResolver("managed-model-key", async (keep, principal) => {
+      const reveal = await keep.revealManagedSifterKey(principal);
+      return reveal.apiKey;
+    });
+    registerCredentialResolver("github-user-token", async (keep, principal) => {
+      try {
+        const reveal = await keep.getUserGithubToken(principal);
+        return reveal.access_token;
+      } catch {
+        return null;
+      }
+    });
+  }
+});
+
+// ../../packages/shuttle/dist/credentials/broker.js
+var require_broker = __commonJS({
+  "../../packages/shuttle/dist/credentials/broker.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createCredentialBroker = createCredentialBroker;
+    var keep_1 = require_dist2();
+    var env_ref_1 = require_env_ref();
+    var registry_1 = require_registry2();
+    function createCredentialBroker(config, deps = {}) {
+      if (typeof config !== "object" || config === null || config.apiKeyFrom !== "job-metadata") {
+        return null;
       }
+      const cfg = config;
+      const keepApiUrl = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepApiUrl", "KEEP_API_URL");
+      const clientId = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientId", "KEEP_CLIENT_ID");
+      const clientSecret = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientSecret", "KEEP_CLIENT_SECRET");
+      const stmFactory = deps.buildServiceTokenManager ?? ((c) => new keep_1.ServiceTokenManager(c));
+      const stm = stmFactory({ keepApiUrl, clientId, clientSecret });
+      const keepFactory = deps.buildKeepClient ?? ((c) => new keep_1.KeepClient(c));
       return {
-        debug: (message, context) => emit("debug", message, context),
-        info: (message, context) => emit("info", message, context),
-        warn: (message, context) => emit("warn", message, context),
-        error: (message, context) => emit("error", message, context)
+        async reveal({ name, principal }) {
+          const resolver = (0, registry_1.getCredentialResolver)(name);
+          if (!resolver)
+            return null;
+          const serviceToken = await stm.getToken();
+          if (!serviceToken) {
+            throw new Error("credential broker: Keep service-token exchange failed. Check KEEP_CLIENT_ID / KEEP_CLIENT_SECRET.");
+          }
+          const keep = keepFactory({ baseUrl: keepApiUrl, serviceToken });
+          return resolver(keep, principal);
+        }
       };
     }
-    var globalLogger = createLogger({ level: "info", format: "pretty" });
-    function setGlobalLogger(logger) {
-      globalLogger = logger;
-    }
-    function getLogger() {
-      return globalLogger;
-    }
+  }
+});
+
+// ../../packages/shuttle/dist/credentials/index.js
+var require_credentials = __commonJS({
+  "../../packages/shuttle/dist/credentials/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.getCredentialResolver = exports2.registerCredentialResolver = exports2.createCredentialBroker = void 0;
+    var broker_1 = require_broker();
+    Object.defineProperty(exports2, "createCredentialBroker", { enumerable: true, get: function() {
+      return broker_1.createCredentialBroker;
+    } });
+    var registry_1 = require_registry2();
+    Object.defineProperty(exports2, "registerCredentialResolver", { enumerable: true, get: function() {
+      return registry_1.registerCredentialResolver;
+    } });
+    Object.defineProperty(exports2, "getCredentialResolver", { enumerable: true, get: function() {
+      return registry_1.getCredentialResolver;
+    } });
   }
 });
 
@@ -27527,9 +27660,8 @@ var require_shuttle = __commonJS({
     var loom_1 = require_dist();
     var chain_1 = require_chain();
     var types_1 = require_types2();
-    var workspace_1 = require_workspace();
+    var run_dispatch_1 = require_run_dispatch();
     var credentials_1 = require_credentials();
-    var output_gates_1 = require_output_gates();
     var keep_1 = require_dist2();
     var apply_1 = require_apply();
     var environment_1 = require_environment();
@@ -27549,7 +27681,6 @@ var require_shuttle = __commonJS({
     var audit_log_1 = require_audit_log();
     var spend_tracker_1 = require_spend_tracker();
     var store_1 = require_store();
-    var GATE_REPAIR_BUDGET = 2;
     var ENVIRONMENT_HOLD = "executor-environment";
     function requiredExecutor(dispatch, strategy) {
       if (strategy !== loom_1.PROMPT_EXECUTION_STRATEGY)
@@ -27616,36 +27747,6 @@ var require_shuttle = __commonJS({
     function formatInstant(epochMs) {
       return new Date(epochMs).toISOString().replace(/\.\d{3}Z$/, "Z");
     }
-    async function runOutputGates(dispatch, response, executor, signal, ctx) {
-      let spec;
-      try {
-        spec = (0, loom_1.readPromptExecutionSpec)(dispatch.inputs);
-      } catch {
-        return { ok: true, response };
-      }
-      const gates = spec.gates;
-      if (!gates || gates.length === 0)
-        return { ok: true, response };
-      let current = response;
-      let result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
-      let attempts = 0;
-      while (!result.ok && attempts < GATE_REPAIR_BUDGET && current.continuation !== void 0 && typeof executor.continue === "function") {
-        try {
-          current = await executor.continue(current.continuation, (0, output_gates_1.renderRepairPrompt)(result.findings), signal, ctx);
-        } catch {
-          break;
-        }
-        result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
-        attempts += 1;
-      }
-      if (result.ok)
-        return { ok: true, response: current };
-      const detail = result.findings.map((f) => `[${f.gate}] ${f.message}`).join(" | ");
-      return {
-        ok: false,
-        reason: `output gate(s) failed${attempts > 0 ? ` after ${attempts} repair attempt(s)` : ""}: ${detail}`
-      };
-    }
     var Shuttle = class {
       brand;
       config;
@@ -27837,35 +27938,16 @@ var require_shuttle = __commonJS({
           const runOn = async (executor) => {
             await observerChain.notify({ kind: "executor.dispatch.started", jobId, attendanceId, executor: executor.capability.id, strategy }, onObserverError);
             const dispatchStartedAt = Date.now();
-            const environment = executor.prepareEnvironment ? await executor.prepareEnvironment(dispatch) : void 0;
-            let preparedWorkspace = null;
-            if (environment?.workspaceRequest) {
-              try {
-                preparedWorkspace = await (0, workspace_1.materializeWorkspace)(environment.workspaceRequest, {
-                  ...environment.materializeOptions ?? {},
-                  credentials: this.broker,
-                  signal
-                });
-              } catch (err) {
-                (0, logger_1.getLogger)().warn("workspace materialization failed; running prompt-only", {
-                  jobId,
-                  error: err instanceof Error ? err.message : String(err)
-                });
-                preparedWorkspace = null;
-              }
-            }
-            const executionCtx = {
+            const outcome = await (0, run_dispatch_1.runDispatch)(dispatch, executor, {
+              credentials: this.broker,
+              signal,
               reportProgress: (channel, frames) => {
                 void jobsClient.postProgress(jobId, { channel, frames }).then(() => activity.record()).catch(() => {
                 });
-              },
-              workspace: preparedWorkspace,
-              credentials: this.broker
-            };
-            let response;
-            try {
-              response = await executor.execute(dispatch, signal, executionCtx);
-            } catch (err) {
+              }
+            });
+            if (outcome.kind === "executor-failed") {
+              const err = outcome.error;
               const reason = `executor failed: ${err instanceof Error ? err.message : String(err)}`;
               if (this.broker === null && (0, types_1.isExecutorEnvironmentError)(err)) {
                 this.markUnwell(executor, err, subscribeLogger);
@@ -27875,14 +27957,11 @@ var require_shuttle = __commonJS({
                 return { kind: "result", result: { status: "failed", reason, failureCode: types_1.MODEL_UNAVAILABLE } };
               }
               return { kind: "result", result: { status: "failed", reason } };
-            } finally {
-              if (preparedWorkspace)
-                await preparedWorkspace.cleanup();
             }
-            const gated = await runOutputGates(dispatch, response, executor, signal, executionCtx);
-            if (!gated.ok)
-              return { kind: "result", result: { status: "failed", reason: gated.reason } };
-            response = gated.response;
+            if (outcome.kind === "gate-failed") {
+              return { kind: "result", result: { status: "failed", reason: outcome.reason } };
+            }
+            const response = outcome.response;
             await observerChain.notify({
               kind: "executor.dispatch.completed",
               jobId,
@@ -28823,8 +28902,8 @@ var require_dist5 = __commonJS({
   "../../packages/shuttle/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.executorDefaultsFor = exports2.environmentReportJson = exports2.environmentPolledBy = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createCopilotExecutor = exports2.createCodexExecutor = exports2.createClaudeCodeExecutor = exports2.MODEL_UNAVAILABLE = exports2.ExecutorModelUnavailableError = exports2.ExecutorEnvironmentError = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
-    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.scaffoldedConfigPath = exports2.planScaffold = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = void 0;
+    exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.executorDefaultsFor = exports2.environmentReportJson = exports2.environmentPolledBy = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createCopilotExecutor = exports2.createCodexExecutor = exports2.createClaudeCodeExecutor = exports2.MODEL_UNAVAILABLE = exports2.ExecutorModelUnavailableError = exports2.ExecutorEnvironmentError = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.GATE_REPAIR_BUDGET = exports2.mergeRepairedResponse = exports2.runDispatch = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.scaffoldedConfigPath = exports2.planScaffold = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = void 0;
     var cli_1 = require_cli();
     Object.defineProperty(exports2, "createCli", { enumerable: true, get: function() {
       return cli_1.createCli;
@@ -28833,6 +28912,16 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "Shuttle", { enumerable: true, get: function() {
       return shuttle_1.Shuttle;
     } });
+    var run_dispatch_1 = require_run_dispatch();
+    Object.defineProperty(exports2, "runDispatch", { enumerable: true, get: function() {
+      return run_dispatch_1.runDispatch;
+    } });
+    Object.defineProperty(exports2, "mergeRepairedResponse", { enumerable: true, get: function() {
+      return run_dispatch_1.mergeRepairedResponse;
+    } });
+    Object.defineProperty(exports2, "GATE_REPAIR_BUDGET", { enumerable: true, get: function() {
+      return run_dispatch_1.GATE_REPAIR_BUDGET;
+    } });
     var loader_1 = require_loader();
     Object.defineProperty(exports2, "loadConfig", { enumerable: true, get: function() {
       return loader_1.loadConfig;
@@ -29043,7 +29132,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.34.0" : pkg.version;
+var buildVersion = true ? "0.35.0" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {