@whittlelabs/sifter 0.37.1 → 0.38.0

package/bin.js

@@ -10632,6 +10632,26 @@ var require_workspace_telemetry = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/executors/model-providers.js
+var require_model_providers = __commonJS({
+  "../../packages/shuttle/dist/executors/model-providers.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.MODEL_PROVIDER_ENV = void 0;
+    exports2.requireModelProvider = requireModelProvider;
+    exports2.MODEL_PROVIDER_ENV = {
+      anthropic: "ANTHROPIC_API_KEY"
+    };
+    function requireModelProvider(executor, accepts, credential) {
+      const provider = credential.provider;
+      if (!provider || !accepts.includes(provider)) {
+        throw new Error(`The ${executor} executor runs ${accepts.join(" or ")} models, and this customer's model key is ${provider ? `for ${provider}` : "for an unstated provider"}.`);
+      }
+      return provider;
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/executors/cli-version.js
 var require_cli_version = __commonJS({
   "../../packages/shuttle/dist/executors/cli-version.js"(exports2) {
@@ -10736,6 +10756,8 @@ var require_claude_code = __commonJS({
     var json_answer_1 = require_json_answer();
     var models_1 = require_models();
     var workspace_telemetry_1 = require_workspace_telemetry();
+    var model_providers_1 = require_model_providers();
+    var CLAUDE_CODE_PROVIDERS = ["anthropic"];
     var cli_version_1 = require_cli_version();
     var apply_1 = require_apply();
     var version_check_1 = require_version_check();
@@ -10849,18 +10871,22 @@ var require_claude_code = __commonJS({
       async execute(dispatch, signal, ctx) {
         const { prompt, spec } = (0, loom_1.renderPromptExecution)(dispatch.inputs);
         const workspace = ctx?.workspace ?? null;
-        let modelKey = null;
+        let modelEnv = null;
         if (ctx?.credentials) {
           const hints = (0, loom_1.pickProviderHints)(spec, "anthropic-api");
           const customerId = typeof hints.customerId === "string" ? hints.customerId : void 0;
           if (!customerId) {
             throw new Error("claude-code dynamic-key mode requires providerHints.anthropicApi.customerId on every job");
           }
-          modelKey = await ctx.credentials.reveal({ name: "managed-model-key", principal: customerId });
+          const credential = await ctx.credentials.reveal({ name: "model-credential", principal: customerId });
+          if (credential) {
+            const provider = (0, model_providers_1.requireModelProvider)("claude-code", CLAUDE_CODE_PROVIDERS, credential);
+            modelEnv = { [model_providers_1.MODEL_PROVIDER_ENV[provider]]: credential.secret };
+          }
         }
         let jobScratch = null;
         let configDir;
-        if (modelKey) {
+        if (modelEnv) {
           jobScratch = await fs_1.promises.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "shuttle-cc-"));
           configDir = path_1.default.join(jobScratch, "claude-config");
           await fs_1.promises.mkdir(configDir);
@@ -10869,7 +10895,7 @@ var require_claude_code = __commonJS({
         let promptOnlyScratch = null;
         const reporter = spec.progressChannel && ctx?.reportProgress ? new progress_1.ProgressReporter((frames) => ctx.reportProgress(spec.progressChannel, frames)) : null;
         try {
-          const childEnv = buildChildEnv(modelKey, configDir);
+          const childEnv = buildChildEnv(modelEnv, configDir);
           const claudeHints = (0, loom_1.pickProviderHints)(spec, "claude-code");
           const hintedModel = typeof claudeHints.model === "string" && claudeHints.model.length > 0 ? claudeHints.model : void 0;
           const effort = (0, models_1.hintedEffort)(claudeHints);
@@ -10890,7 +10916,7 @@ var require_claude_code = __commonJS({
             // Local mode is the operator's own login: a failure of THAT is the
             // machine's, and the runner pauses on it. With a revealed key it is one
             // customer's, and only their job fails.
-            modelKey === null,
+            modelEnv === null,
             effort
           );
           if (workspace) {
@@ -11163,8 +11189,8 @@ var require_claude_code = __commonJS({
       }
       return scoped;
     }
-    function buildChildEnv(modelKey, configDir) {
-      if (!modelKey && !configDir)
+    function buildChildEnv(modelEnv, configDir) {
+      if (!modelEnv && !configDir)
         return void 0;
       const env = {};
       for (const name of HOSTED_ENV_PASSTHROUGH) {
@@ -11173,7 +11199,7 @@ var require_claude_code = __commonJS({
       }
       return {
         ...env,
-        ...modelKey ? { ANTHROPIC_API_KEY: modelKey } : {},
+        ...modelEnv ?? {},
         ...configDir ? { CLAUDE_CONFIG_DIR: configDir } : {}
       };
     }
@@ -12708,18 +12734,16 @@ var require_client = __commonJS({
       }
       // ── Managed Sifter ──────────────────────────────────────────────
       /**
-       * Reveal a hosted-Sifter customer's plaintext Anthropic API key for
-       * one dispatch. Service-token only; requires the
-       * `keep:managed-sifter-key-material:read` scope, granted only to the
-       * `whittle-hosted-sifter` service identity.
+       * Reveal a person's model-provider key for one hosted dispatch, with the
+       * provider it is for (ADR-0127). Service-token only; requires
+       * `keep:managed-sifter-key-material:read` at that user, granted only to the
+       * `whittle-hosted-sifter` service identity. Keep refuses unless the person
+       * holds the hosted tier. Name `provider` when they may hold more than one.
        *
-       * Callers must use the returned key for a single Anthropic request
-       * and drop it from memory afterwards. Keep stamps `last_used_at` on
-       * every call and is the audit-of-record for who decrypted whose key
-       * when.
+       * Use the credential for the dispatch and drop it from memory afterwards.
        */
-      async revealManagedSifterKey(userId) {
-        return this.request("POST", `/api/managed-sifters/${encodeURIComponent(userId)}/reveal-key`);
+      async revealModelCredential(userId, options = {}) {
+        return this.request("POST", `/api/users/${encodeURIComponent(userId)}/model-credential`, options.provider ? { provider: options.provider } : {});
       }
       /**
        * Read a user's hosted-Sifter opt-in status. Returns `{enabled:
@@ -13358,6 +13382,7 @@ var require_anthropic_api = __commonJS({
     var keep_1 = require_dist2();
     var env_ref_1 = require_env_ref();
     var validate_output_1 = require_validate_output();
+    var model_providers_1 = require_model_providers();
     var types_1 = require_types2();
     var models_1 = require_models();
     var DEFAULT_BASE_URL = "https://api.anthropic.com/v1/messages";
@@ -13605,8 +13630,9 @@ var require_anthropic_api = __commonJS({
           throw new Error("AnthropicApiExecutor dynamic-key mode failed to exchange a Keep service token. Check KEEP_CLIENT_ID / KEEP_CLIENT_SECRET.");
         }
         const keep = keepClientFactory({ baseUrl: keepApiUrl, serviceToken });
-        const reveal = await keep.revealManagedSifterKey(customerId);
-        return reveal.apiKey;
+        const reveal = await keep.revealModelCredential(customerId);
+        (0, model_providers_1.requireModelProvider)("anthropic-api", ["anthropic"], { secret: reveal.credential, provider: reveal.provider });
+        return reveal.credential;
       };
     }
     function safeJsonParse(s) {
@@ -26642,7 +26668,7 @@ var require_git = __commonJS({
       let gitToken = null;
       if (ref && typeof ref.name === "string" && typeof ref.principal === "string" && options.credentials) {
         try {
-          gitToken = await options.credentials.reveal(ref);
+          gitToken = (await options.credentials.reveal(ref))?.secret ?? null;
         } catch {
           gitToken = null;
         }
@@ -27249,14 +27275,14 @@ var require_registry2 = __commonJS({
     function getCredentialResolver(name) {
       return resolvers.get(name);
     }
-    registerCredentialResolver("managed-model-key", async (keep, principal) => {
-      const reveal = await keep.revealManagedSifterKey(principal);
-      return reveal.apiKey;
+    registerCredentialResolver("model-credential", async (keep, principal) => {
+      const reveal = await keep.revealModelCredential(principal);
+      return { secret: reveal.credential, provider: reveal.provider };
     });
     registerCredentialResolver("github-user-token", async (keep, principal) => {
       try {
         const reveal = await keep.getUserGithubToken(principal);
-        return reveal.access_token;
+        return { secret: reveal.access_token, provider: "github" };
       } catch {
         return null;
       }
@@ -29388,7 +29414,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.37.1" : pkg.version;
+var buildVersion = true ? "0.38.0" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {