swarph-cli 0.12.0__tar.gz → 0.13.0__tar.gz

{swarph_cli-0.12.0/src/swarph_cli.egg-info → swarph_cli-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.12.0
+Version: 0.13.0
 Summary: The `swarph` binary — multi-LLM CLI + mesh-gateway integration: multi-provider `swarph spawn` (claude/codex/antigravity per cell.provider via a ProviderMembrane + subprocess billing-scrub), interactive `swarph init`, `swarph mesh` (send/inbox/register) + inbox sidecar, `assisted_memory` (git-backed durable memory), session import, watchdog. v0.9.5: foolproof Windows auto-relaunch (genuine-WT detection via process ancestry, not WT_SESSION).
 Author: Pierre Samson, Claude Opus
 License: MIT
@@ -25,7 +25,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: swarph-mesh>=0.5.0
-Requires-Dist: swarph-shared>=0.3.1
+Requires-Dist: swarph-shared>=0.3.3
 Requires-Dist: PyYAML>=6.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.12.0"
+version = "0.13.0"
 description = "The `swarph` binary — multi-LLM CLI + mesh-gateway integration: multi-provider `swarph spawn` (claude/codex/antigravity per cell.provider via a ProviderMembrane + subprocess billing-scrub), interactive `swarph init`, `swarph mesh` (send/inbox/register) + inbox sidecar, `assisted_memory` (git-backed durable memory), session import, watchdog. v0.9.5: foolproof Windows auto-relaunch (genuine-WT detection via process ancestry, not WT_SESSION)."
 readme = "README.md"
 license = { text = "MIT" }
@@ -40,7 +40,7 @@ dependencies = [
     # >=0.3.1 is load-bearing: 0.3.1 is the first release whose
     # scrub_env_for_subprocess closes the ANTHROPIC_AUTH_TOKEN/*_BASE_URL
     # billing-redirect class that the membrane env builders delegate to.
-    "swarph-shared>=0.3.1",
+    "swarph-shared>=0.3.3",
     # Phase 7 spawn — cell.yaml parser. PyYAML 6.x is the standard.
     # Stays a swarph-cli dep since file I/O is operator-tooling-layer
     # concern; swarph-shared cell module is pure-stdlib.

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.12.0"
+__version__ = "0.13.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/src/swarph_cli/capture/verify.py

@@ -18,7 +18,7 @@ Two checks:
 """
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import List, Optional, Tuple
 
@@ -27,7 +27,7 @@ from swarph_shared.cell import Cell, CellError
 from swarph_cli.cell import _read_session_sidecar, load_cell, resolve_cell_path, session_state_path
 from swarph_cli.capture import manifest
 from swarph_cli.capture.liveness import probe_holder_liveness
-from swarph_cli.capture.paths import CaptureRoleError, validate_role
+from swarph_cli.capture.paths import CaptureRoleError, manifest_path, validate_role
 
 
 @dataclass
@@ -35,6 +35,10 @@ class VerifyResult:
     ok: bool
     code: int
     reason: str
+    # Non-fatal advisories surfaced loudly (stderr/journal) regardless of `ok`.
+    # The gate stays fail-LOUD even when it ALLOWS: an un-hardened live cell
+    # passes (no manifest = no proof of double-resume) but must NOT pass mute.
+    warnings: List[str] = field(default_factory=list)
 
 
 def expected_project_dir(cwd: Path) -> str:
@@ -95,6 +99,28 @@ def verify_cell(role: str) -> VerifyResult:
             )
     # jsonls == [] → pin minted but session never ran; spawn will create it. OK.
 
+    # Un-hardened-but-LIVE warning (science-claude co-review, mesh #2811): a
+    # hand-deployed cell with a real running session (pin + jsonl) but NO capture
+    # manifest of its own is UNPROTECTED — it isn't registered as a holder, so the
+    # per-UUID sweep below can't see it and a second spawn wouldn't be refused.
+    # verify ALLOWS (no manifest = no proof of a double-resume) but must warn
+    # loudly, never pass mute (its fail-LOUD contract). Gated on jsonls so a
+    # minted-but-unstarted pin (benign fresh state) stays quiet.
+    #
+    # Existence check, NOT read_manifest(role) (science-claude #2826): read_manifest
+    # json.loads-RAISES on a corrupt manifest, and this runs in the @.service
+    # ExecStart gate — a throw here = no spawn. A manifest that EXISTS but is
+    # corrupt must route to find_pin_holders' fail-CLOSED (code 5) below, not throw
+    # here and not warn "no manifest" (the file is present, just damaged).
+    warnings: List[str] = []
+    if jsonls and not manifest_path(role).exists():
+        warnings.append(
+            f"no capture manifest for {role!r} — this cell is UNPROTECTED against "
+            f"double-resume whenever live (the per-UUID liveness check has nothing "
+            f"to probe for it). Run `swarph cell harden {role}` to capture its "
+            f"revival kit."
+        )
+
     # (b) liveness probe — cross-NAME sweep over every manifest pinning this
     # UUID, not just this role's own (spec §4.3 blocking fix: two roles
     # pinning one UUID both look clean per-role).
@@ -128,5 +154,6 @@ def verify_cell(role: str) -> VerifyResult:
         return VerifyResult(
             True, 0,
             f"cleared stale live-pin(s) ({', '.join(cleared)}) — allow",
+            warnings=warnings,
         )
-    return VerifyResult(True, 0, "ok")
+    return VerifyResult(True, 0, "ok", warnings=warnings)

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/src/swarph_cli/commands/cell.py

@@ -54,6 +54,10 @@ def _run_verify(rest: List[str]) -> int:
     result = _verify.verify_cell(role)
     stream = sys.stdout if result.ok else sys.stderr
     print(f"[verify {role}] {'OK' if result.ok else 'REFUSE'}: {result.reason}", file=stream)
+    # Warnings are always loud (stderr/journal) even on an OK verdict — the gate
+    # is fail-LOUD; a silent pass on an unprotected cell is the bug being fixed.
+    for w in result.warnings:
+        print(f"[verify {role}] WARN: {w}", file=sys.stderr)
     return result.code
 
 

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/src/swarph_cli/commands/spawn.py

@@ -484,6 +484,99 @@ def _scrubbed_codex_env() -> dict[str, str]:
     return env
 
 
+#: grok cell isolated-HOME subdir, created/used INSIDE the cell cwd so the
+#: cell's grok sessions + memory + auth.json symlink never mix with the
+#: operator's personal ``~/.grok`` (cell.yaml: "Separate HOME (~/.grok-cell
+#: inside cwd)").
+_GROK_CELL_HOME_SUBDIR = ".grok-cell"
+
+#: Metered xAI billing keys popped explicitly (belt-and-suspenders on top of the
+#: canonical ``*_API_KEY`` / ``*_BASE_URL`` suffix sweep) so a grok cell can
+#: never be flipped off its $0 OIDC auth onto a metered endpoint. The suffix
+#: sweep already catches ``XAI_API_KEY`` / ``GROK_API_KEY``; the ``*_API_BASE``
+#: / ``*_API_HOST`` variants do NOT match a suffix, so they live here.
+_GROK_EXTRA_LEAK_KEYS = (
+    "XAI_API_KEY",
+    "GROK_API_KEY",
+    "GROK_CODE_XAI_API_KEY",
+    "XAI_API_BASE",
+    "XAI_API_HOST",
+    "GROK_API_HOST",
+)
+
+
+def _grok_env(cell: Cell) -> dict[str, str]:
+    """Subscription/OIDC env for a local ``grok`` CELL session ($0 path).
+
+    On top of the canonical billing scrub:
+      * the explicit ``_GROK_EXTRA_LEAK_KEYS`` pop (metered xAI endpoints the
+        suffix sweep misses), keeping grok on its $0 OIDC auth.
+      * MESH_GATEWAY_TOKEN popped — the per-cell auth CUTOVER: with the shared
+        token absent the swarph resolver loads the cell's per-peer token file
+        (symlinked into the isolated HOME at
+        ``.grok-cell/.config/swarph/grok-researcher.peer_token``) instead of the
+        cell riding the operator's shared token. (``_TOKEN`` is not a scrub
+        suffix, so this MUST be explicit — omitting it is the mint≠cutover gap.)
+      * HOME → an ISOLATED dir inside the cell cwd (created if absent), with the
+        operator's ``~/.grok/auth.json`` symlinked in for $0 OIDC, so the cell's
+        sessions/memory/auth never mix with the operator's personal ``~/.grok``.
+      * SWARPH_SPAWN marker — the tmux re-entry loop-guard (see
+        ``_launch_via_tmux``) and the install-hook double-inject guard.
+    """
+    env = scrub_env_for_subprocess()
+    for key in _GROK_EXTRA_LEAK_KEYS:
+        env.pop(key, None)
+    env.pop("MESH_GATEWAY_TOKEN", None)
+    env["SWARPH_SPAWN"] = "1"
+
+    cell_home = cell.cwd / _GROK_CELL_HOME_SUBDIR
+    cell_home.mkdir(parents=True, exist_ok=True)
+    try:
+        op_auth = Path.home() / ".grok" / "auth.json"
+        link = cell_home / "auth.json"
+        if op_auth.exists() and not link.exists():
+            link.symlink_to(op_auth)
+    except OSError:
+        # Best-effort: a pre-existing link / race / read-only HOME must not
+        # crash the spawn — grok will fall back to its own auth flow.
+        pass
+    env["HOME"] = str(cell_home)
+    return env
+
+
+def _build_grok_argv(
+    cell: Cell,
+    session_id: Optional[str],
+    effective_role: Optional[str],
+    passthrough: list[str],
+) -> list[str]:
+    """``grok --cwd <cwd> [--resume <id>] [--agent <role>] --always-approve``.
+
+    Pinned-session (R5): ``--resume <session_id>`` attaches grok's native
+    cwd-keyed session (``~/.grok/sessions/<encoded-cwd>/<uuid>``) so the cell
+    keeps its continuity + identity + inbox across respawns — the load-bearing
+    reason grok ``uses_pinned_session`` (not fresh-per-spawn). ``--agent`` gives
+    the cell its role identity. ``--always-approve`` is the cell autonomy
+    posture (a mesh cell runs unattended — the spawn-equivalent of codex ``-a``
+    / agy ``--sandbox``); opt out via ``extra.always_approve: false``.
+
+    No starter flag: grok's interactive mode has no system-prompt-override (the
+    real flags ``--prompt-file`` / ``-p`` are single-turn/headless), and the
+    cell's identity is carried by ``--agent`` + grok's own durable memory, so a
+    swarph starter is neither needed nor expressible here.
+    """
+    argv = ["grok", "--cwd", str(cell.cwd)]
+    if session_id:
+        argv.extend(["--resume", session_id])
+    role_value = effective_role if effective_role is not None else cell.role
+    if role_value:
+        argv.extend(["--agent", role_value])
+    if cell.extra.get("always_approve", True) is not False:
+        argv.append("--always-approve")
+    argv.extend(passthrough)
+    return argv
+
+
 def _print_banner() -> None:
     sys.stderr.write(_BANNER.format(version=__version__))
     sys.stderr.flush()
@@ -1010,18 +1103,39 @@ class ClaudeMembrane(ProviderMembrane):
             print(f"swarph spawn: cannot chdir to {cell.cwd}: {exc}", file=sys.stderr)
             return 1
 
-        # Exec with the billing-redirect-scrubbed env (NOT raw inherited env) so
-        # a parent-set ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN can't silently
-        # flip the spawned claude off subscription billing. SWARPH_SPAWN=1 (set
-        # in _claude_env) tells a `swarph install-hook` SessionStart hook the
-        # prompt was already injected via --append-system-prompt, so it skips
-        # double-injection. execve carries exactly this env to the child.
+        # Launch with the billing-redirect-scrubbed env (NOT raw inherited env) so
+        # a parent-set ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN can't silently flip
+        # the spawned claude off subscription billing. SWARPH_SPAWN=1 (set in
+        # _claude_env) tells a `swarph install-hook` SessionStart hook the prompt
+        # was already injected via --append-system-prompt, so it skips double-
+        # injection. The env carries to the child either way.
+        env = _claude_env()
+
+        # Per-OS launch mechanism — the SAME split as the tmux attach, for the
+        # SAME reason:
+        #  * POSIX: os.execve = a TRUE in-place replace. The claude session
+        #    inherits stdio/signals cleanly under the same PID, so when this IS a
+        #    tmux pane's root command tmux keeps the pane running claude.
+        #  * Windows: os.exec* is emulated as spawn-and-exit, NOT a replace — this
+        #    Python process exits and a NEW claude process is spawned. Inside a
+        #    tmux/psmux pane that COLLAPSES the pane (its root command exited),
+        #    orphaning claude => "tmux created but no claude" (the v0.12.0 Windows
+        #    breakage: the create path's inner `swarph spawn` reaches here). A
+        #    BLOCKING subprocess.run keeps THIS process alive as the pane root with
+        #    claude as its child, so the pane survives until claude exits. argv[0]
+        #    is the conventional "claude" argv0; the real exe is `binary`.
+        if sys.platform == "win32":
+            try:
+                return subprocess.run([binary, *argv[1:]], env=env).returncode
+            except OSError as exc:
+                print(f"swarph spawn: launch failed: {exc}", file=sys.stderr)
+                return 1
         try:
-            os.execve(binary, argv, _claude_env())
+            os.execve(binary, argv, env)
         except OSError as exc:
             print(f"swarph spawn: exec failed: {exc}", file=sys.stderr)
             return 1
-        return 0  # unreachable, keeps type checker happy
+        return 0  # unreachable on POSIX (execve replaces); keeps type checker happy
 
 
 class CodexMembrane(ProviderMembrane):
@@ -1095,21 +1209,112 @@ class AntigravityMembrane(ProviderMembrane):
         return 0  # unreachable, keeps type checker happy
 
 
+class GrokMembrane(ProviderMembrane):
+    """Local ``grok`` CLI as a durable swarph CELL ($0 OIDC / subscription).
+
+    The CELL path — NOT the swarph-mesh ``--provider grok`` one-shot metered
+    lane: exec the local ``grok`` agent TUI with an ISOLATED HOME inside the
+    cell cwd (so the cell's sessions/memory/auth never mix with the operator's
+    personal grok), launched in a NAMED tmux session (same mechanism as the
+    claude cell) so it is durable + supervisable and lands in its OWN session,
+    never a window of another cell's session.
+
+    Pinned-session (``uses_pinned_session`` True): grok exposes a native
+    cwd-keyed session model under ``~/.grok/sessions/`` and a ``--resume <id>``
+    verb, so the cell pins its session UUID via the R5 store (like claude) and
+    ``--resume``\\s it on every respawn — preserving the cell's continuity,
+    identity, and mesh inbox. (Continuity is the whole point of a persistent
+    cell; a fresh session each spawn would orphan grok's running identity.)
+    """
+
+    name = "grok"
+
+    def uses_pinned_session(self) -> bool:
+        return True
+
+    def build_argv(
+        self,
+        cell: Cell,
+        *,
+        session_id: Optional[str],
+        no_starter: bool,
+        passthrough: list[str],
+        effective_role: Optional[str],
+    ) -> list[str]:
+        return _build_grok_argv(cell, session_id, effective_role, passthrough)
+
+    def resolve_binary(self) -> Optional[str]:
+        provider_bin = shutil.which("grok")
+        if provider_bin is None:
+            home_local = Path.home() / ".local" / "bin" / "grok"
+            if home_local.exists():
+                provider_bin = str(home_local)
+        return provider_bin
+
+    def binary_not_found_message(self) -> str:
+        return (
+            "swarph spawn: 'grok' binary not found on PATH. "
+            "Install the Grok CLI or set PATH explicitly."
+        )
+
+    def pre_launch(
+        self, cell: Cell, binary: str, argv: list[str], *, no_banner: bool,
+        session_name: Optional[str] = None,
+    ) -> Optional[int]:
+        # Durable named-tmux launch — identical mechanism to the claude cell, so
+        # the cell lands in its OWN tmux session (keyed on the operator-typed
+        # spawn name), never a window of another session. No-op (falls through
+        # to the in-place execve below) when already inside a tmux pane /
+        # SWARPH_SPAWN set / tmux absent. Unlike claude there is no
+        # Windows-Terminal relaunch fallback — grok's TUI has no conhost
+        # Enter-inserts-'m' bug.
+        if session_name and _launch_via_tmux(binary, argv, cell.cwd, session_name):
+            return 0
+        return None
+
+    def launch(self, cell: Cell, binary: str, argv: list[str]) -> int:
+        try:
+            os.chdir(cell.cwd)
+        except OSError as exc:
+            print(f"swarph spawn: cannot chdir to {cell.cwd}: {exc}", file=sys.stderr)
+            return 1
+        # execve carries the isolated-HOME + billing-scrubbed env to grok
+        # without mutating this process's os.environ first (a failed exec leaves
+        # us intact).
+        try:
+            os.execve(binary, argv, _grok_env(cell))
+        except OSError as exc:
+            print(f"swarph spawn: exec failed: {exc}", file=sys.stderr)
+            return 1
+        return 0  # unreachable on POSIX (execve replaces); keeps type checker happy
+
+
 MEMBRANES: dict[str, ProviderMembrane] = {
     "claude": ClaudeMembrane(),
     "codex": CodexMembrane(),
     "antigravity": AntigravityMembrane(),
+    "grok": GrokMembrane(),
 }
 
-# Defensive coupling: MEMBRANES must stay in lockstep with the shared provider
-# whitelist. A future VALID_PROVIDERS entry without a matching membrane would
-# otherwise surface as a raw KeyError at spawn time — fail loud at import instead.
+# Defensive coupling: every shared-whitelisted provider MUST have a membrane,
+# else a `cell.provider` that load_cell accepts would surface as a raw KeyError
+# in run_spawn — fail loud at import instead. The invariant is a SUBSET
+# (VALID_PROVIDERS ⊆ MEMBRANES), NOT equality: MEMBRANES may legitimately carry
+# a membrane AHEAD of the shared whitelist (e.g. GrokMembrane shipping before a
+# swarph_shared release adds 'grok' to VALID_PROVIDERS). An extra membrane is
+# harmless — load_cell still gates which providers are actually spawnable — so
+# strict equality would needlessly couple this package's release to the shared
+# one. (Cross-pkg: grok cells only become spawnable once swarph_shared whitelists
+# 'grok'; until then load_cell rejects them cleanly with "queued for a future
+# release", and this guard does not crash.)
 from swarph_shared.cell import VALID_PROVIDERS as _VALID_PROVIDERS  # noqa: E402
 
-if set(MEMBRANES) != _VALID_PROVIDERS:
+_unmembraned = _VALID_PROVIDERS - set(MEMBRANES)
+if _unmembraned:
     raise RuntimeError(
-        f"MEMBRANES {sorted(MEMBRANES)} out of sync with VALID_PROVIDERS "
-        f"{sorted(_VALID_PROVIDERS)} — add the missing provider membrane."
+        f"VALID_PROVIDERS {sorted(_VALID_PROVIDERS)} has providers with no "
+        f"membrane: {sorted(_unmembraned)} (MEMBRANES: {sorted(MEMBRANES)}) — "
+        f"add the missing provider membrane."
     )
 
 

{swarph_cli-0.12.0 → swarph_cli-0.13.0/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.12.0
+Version: 0.13.0
 Summary: The `swarph` binary — multi-LLM CLI + mesh-gateway integration: multi-provider `swarph spawn` (claude/codex/antigravity per cell.provider via a ProviderMembrane + subprocess billing-scrub), interactive `swarph init`, `swarph mesh` (send/inbox/register) + inbox sidecar, `assisted_memory` (git-backed durable memory), session import, watchdog. v0.9.5: foolproof Windows auto-relaunch (genuine-WT detection via process ancestry, not WT_SESSION).
 Author: Pierre Samson, Claude Opus
 License: MIT
@@ -25,7 +25,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: swarph-mesh>=0.5.0
-Requires-Dist: swarph-shared>=0.3.1
+Requires-Dist: swarph-shared>=0.3.3
 Requires-Dist: PyYAML>=6.0
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/src/swarph_cli.egg-info/requires.txt

@@ -1,5 +1,5 @@
 swarph-mesh>=0.5.0
-swarph-shared>=0.3.1
+swarph-shared>=0.3.3
 PyYAML>=6.0
 
 [dev]

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/tests/test_cell_command_dispatch.py

@@ -54,3 +54,17 @@ def test_main_routes_cell_verb(monkeypatch):
     # `swarph cell verify droplet` dispatches through main._VERB_HANDLERS
     from swarph_cli import main
     assert "cell" in main._VERB_HANDLERS
+
+
+def test_verify_warnings_print_to_stderr(monkeypatch, capsys):
+    # The loud-warning render: an OK-with-warnings verdict must still surface the
+    # warning on stderr (journal-visible from the @.service ExecStart).
+    monkeypatch.setattr(
+        verify, "verify_cell",
+        lambda role: verify.VerifyResult(True, 0, "ok", warnings=[
+            "no capture manifest for 'science-claude' — run swarph cell harden"]),
+    )
+    rc = cell_cmd.run_cell(["verify", "science-claude"])
+    assert rc == 0
+    err = capsys.readouterr().err
+    assert "WARN" in err and "harden" in err

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/tests/test_cell_verify.py

@@ -119,3 +119,75 @@ def test_cross_name_dead_holder_cleared_and_allowed(tmp_path, monkeypatch):
     assert r.ok and r.code == 0
     # the OTHER role's stale poison-pin got cleared
     assert manifest.read_manifest("drop-mother")["head"]["live_pin_holder"] is None
+
+
+def test_live_unhardened_cell_warns_but_allows(tmp_path, monkeypatch):
+    # science-claude's co-review case (mesh #2811): a cell that is demonstrably
+    # alive but was hand-deployed (never `harden`ed) has NO capture manifest, so
+    # the per-UUID liveness sweep finds nothing to probe. The pin is untouched
+    # (good) but verify used to pass MUTE — violating its own fail-LOUD contract.
+    # It must ALLOW (no manifest = no proof of double-resume) yet WARN loudly.
+    monkeypatch.setenv("XDG_STATE_HOME", str(tmp_path / "state"))
+    cwd = tmp_path / "right"
+    cwd.mkdir()
+    monkeypatch.setattr(verify, "_resolve_cell", lambda role: _cell(cwd))
+    monkeypatch.setattr(verify, "_read_pin", lambda role: ("uuid-1", str(cwd)))
+    good = Path(".claude/projects") / verify.expected_project_dir(cwd) / "uuid-1.jsonl"
+    monkeypatch.setattr(verify, "locate_session_jsonl", lambda u: [good])
+    # NO manifest written for this role -> un-hardened, unprotected
+    r = verify.verify_cell("science-claude")
+    assert r.ok and r.code == 0
+    assert r.warnings, "an un-hardened live cell must emit a loud warning, not pass mute"
+    assert any("harden" in w for w in r.warnings)
+
+
+def test_hardened_cell_emits_no_unprotected_warning(tmp_path, monkeypatch):
+    # The inverse: a cell WITH a manifest is protected -> no unprotected warning.
+    monkeypatch.setenv("XDG_STATE_HOME", str(tmp_path / "state"))
+    cwd = tmp_path / "right"
+    cwd.mkdir()
+    monkeypatch.setattr(verify, "_resolve_cell", lambda role: _cell(cwd))
+    monkeypatch.setattr(verify, "_read_pin", lambda role: ("uuid-1", str(cwd)))
+    good = Path(".claude/projects") / verify.expected_project_dir(cwd) / "uuid-1.jsonl"
+    monkeypatch.setattr(verify, "locate_session_jsonl", lambda u: [good])
+    manifest.write_manifest("droplet", recipe="r", pin="p", service="s",
+                            lineage="l", session_id="uuid-1", live_pin_holder="droplet")
+    monkeypatch.setattr(verify, "probe_holder_liveness", lambda h: False)
+    r = verify.verify_cell("droplet")
+    assert r.ok and r.code == 0
+    assert not r.warnings
+
+
+def test_unstarted_pin_no_jsonl_does_not_warn(tmp_path, monkeypatch):
+    # A pin minted but never run (no jsonl) is benign fresh state, not an
+    # unprotected live cell -> no noise.
+    monkeypatch.setenv("XDG_STATE_HOME", str(tmp_path / "state"))
+    monkeypatch.setattr(verify, "_resolve_cell", lambda role: _cell(tmp_path))
+    monkeypatch.setattr(verify, "_read_pin", lambda role: ("uuid-1", str(tmp_path)))
+    monkeypatch.setattr(verify, "locate_session_jsonl", lambda u: [])
+    r = verify.verify_cell("science-claude")
+    assert r.ok and r.code == 0
+    assert not r.warnings
+
+
+def test_corrupt_own_manifest_fails_closed_not_throws(tmp_path, monkeypatch):
+    # science-claude defensive co-review (mesh #2826): read_manifest RAISES on a
+    # corrupt manifest (json.loads). The un-hardened check must NOT parse — it
+    # runs in the @.service ExecStart gate, so a throw there = no spawn. A corrupt
+    # OWN manifest must route to the existing fail-CLOSED handling (code 5), never
+    # an unhandled exception, AND must not emit the "no manifest" warning (a
+    # manifest FILE exists — it's just damaged, not absent).
+    from swarph_cli.capture import paths as _paths
+    monkeypatch.setenv("XDG_STATE_HOME", str(tmp_path / "state"))
+    cwd = tmp_path / "right"
+    cwd.mkdir()
+    monkeypatch.setattr(verify, "_resolve_cell", lambda role: _cell(cwd))
+    monkeypatch.setattr(verify, "_read_pin", lambda role: ("uuid-1", str(cwd)))
+    good = Path(".claude/projects") / verify.expected_project_dir(cwd) / "uuid-1.jsonl"
+    monkeypatch.setattr(verify, "locate_session_jsonl", lambda u: [good])
+    mpath = _paths.manifest_path("science-claude")
+    mpath.parent.mkdir(parents=True, exist_ok=True)
+    mpath.write_text("{ this is not valid json", encoding="utf-8")
+    r = verify.verify_cell("science-claude")  # MUST NOT raise
+    assert not r.ok and r.code == 5
+    assert not any("no capture manifest" in w for w in r.warnings)

{swarph_cli-0.12.0 → swarph_cli-0.13.0}/tests/test_spawn_command.py

@@ -1012,3 +1012,222 @@ def test_run_spawn_codex_assisted_memory_injects_agents_md(tmp_path, isolated_xd
     assert len(exec_args) == 1
     argv = exec_args[0][1]
     assert "--prompt-interactive" not in argv
+
+
+# --- per-OS ClaudeMembrane.launch (v0.12.0 Windows fix) ------------------
+#
+# On Windows os.exec* is spawn-and-exit, NOT a true replace: inside a tmux/psmux
+# pane it collapses the pane (the root process exits) and orphans claude, so the
+# create path's inner `swarph spawn` produced "tmux created but no claude" and a
+# dropped auto-attach. launch() must BLOCK on Windows (subprocess.run, claude as
+# a child of a stable pane root) and only os.execve on POSIX (true in-place
+# replace). Mirrors the per-OS tmux attach split.
+
+
+def test_claude_launch_windows_blocks_not_execve(monkeypatch, tmp_path):
+    from swarph_cli.commands import spawn
+    monkeypatch.setattr(spawn.sys, "platform", "win32")
+    monkeypatch.setattr(spawn.os, "chdir", lambda p: None)
+
+    class _R:
+        returncode = 0
+
+    ran = []
+    monkeypatch.setattr(spawn.subprocess, "run",
+                        lambda cmd, **kw: ran.append((cmd, kw)) or _R())
+    execve_called = []
+    monkeypatch.setattr(spawn.os, "execve", lambda *a: execve_called.append(a))
+
+    cell = type("C", (), {"cwd": tmp_path})()
+    rc = spawn.ClaudeMembrane().launch(
+        cell, "/bin/claude", ["claude", "--name", "x", "--session-id", "u"])
+
+    assert rc == 0
+    assert not execve_called  # Windows must NOT execve (collapses the tmux pane)
+    assert ran and ran[0][0] == ["/bin/claude", "--name", "x", "--session-id", "u"]
+
+
+@pytest.mark.parametrize("platform", ["linux", "darwin"])
+def test_claude_launch_posix_uses_execve(monkeypatch, tmp_path, platform):
+    from swarph_cli.commands import spawn
+    monkeypatch.setattr(spawn.sys, "platform", platform)
+    monkeypatch.setattr(spawn.os, "chdir", lambda p: None)
+
+    run_called = []
+    monkeypatch.setattr(spawn.subprocess, "run",
+                        lambda cmd, **kw: run_called.append(cmd))
+    execve_args = []
+    monkeypatch.setattr(spawn.os, "execve",
+                        lambda p, a, e: execve_args.append((p, a, e)))
+
+    cell = type("C", (), {"cwd": tmp_path})()
+    spawn.ClaudeMembrane().launch(cell, "/bin/claude", ["claude", "--name", "x"])
+
+    assert execve_args and execve_args[0][0] == "/bin/claude"
+    assert execve_args[0][1] == ["claude", "--name", "x"]  # full argv incl argv0
+    assert not run_called  # POSIX launch uses execve, not subprocess.run
+
+
+
+
+# ---------------------------------------------------------------------------
+# Grok membrane (local `grok` CLI as a durable PINNED cell — $0 OIDC)
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def fake_grok_cell_yaml(tmp_path):
+    """Drop a valid grok cell.yaml under tmp_path/cell.yaml and return its path."""
+    payload = {
+        "schema_version": SCHEMA_VERSION_V1,
+        "name": "grok-researcher",
+        "role": "grok-researcher",
+        "cwd": str(tmp_path),
+        "provider": "grok",
+    }
+    p = tmp_path / "cell.yaml"
+    p.write_text(yaml.safe_dump(payload), encoding="utf-8")
+    return p
+
+
+def test_membranes_lockstep_includes_grok():
+    # The import-time lockstep guard only passes if every VALID_PROVIDERS entry
+    # has a membrane. A bare import proves the guard did not raise; assert grok
+    # is wired + pinned (regression for the GrokMembrane-missing crash that
+    # bricked every `swarph spawn`, and for the pinned-session contract).
+    from swarph_cli.commands.spawn import MEMBRANES, GrokMembrane
+    from swarph_shared.cell import VALID_PROVIDERS
+
+    # Invariant is a SUBSET, not equality: every whitelisted provider has a
+    # membrane, but MEMBRANES may carry one ahead of the shared whitelist (grok
+    # ships here before swarph_shared whitelists it — must not crash import).
+    assert VALID_PROVIDERS <= set(MEMBRANES)
+    assert isinstance(MEMBRANES["grok"], GrokMembrane)
+    assert MEMBRANES["grok"].uses_pinned_session() is True
+
+
+def test_build_grok_argv_pinned(fake_grok_cell_yaml):
+    from swarph_cli.commands.spawn import _build_grok_argv
+
+    cell = load_cell(fake_grok_cell_yaml)
+    argv = _build_grok_argv(
+        cell,
+        "15f1f31c-5a59-4162-9e4f-ecbed9c48403",
+        "grok-researcher",
+        [],
+    )
+    assert argv == [
+        "grok",
+        "--cwd",
+        str(cell.cwd),
+        "--resume",
+        "15f1f31c-5a59-4162-9e4f-ecbed9c48403",
+        "--agent",
+        "grok-researcher",
+        "--always-approve",
+    ]
+
+
+def test_build_grok_argv_no_session_falls_back_to_role(fake_grok_cell_yaml):
+    from swarph_cli.commands.spawn import _build_grok_argv
+
+    cell = load_cell(fake_grok_cell_yaml)
+    # No pinned id yet (first genesis) → no --resume; effective_role None falls
+    # back to cell.role for --agent.
+    argv = _build_grok_argv(cell, None, None, [])
+    assert "--resume" not in argv
+    assert argv == [
+        "grok",
+        "--cwd",
+        str(cell.cwd),
+        "--agent",
+        "grok-researcher",
+        "--always-approve",
+    ]
+
+
+def test_build_grok_argv_effective_role_and_passthrough(fake_grok_cell_yaml):
+    from swarph_cli.commands.spawn import _build_grok_argv
+
+    cell = load_cell(fake_grok_cell_yaml)
+    argv = _build_grok_argv(cell, "abc", "grok-researcher-2", ["--no-subagents"])
+    # effective_role (sibling slot) wins for --agent; passthrough is appended
+    # AFTER --always-approve.
+    assert argv[argv.index("--agent") + 1] == "grok-researcher-2"
+    assert argv[-1] == "--no-subagents"
+    assert argv.index("--no-subagents") > argv.index("--always-approve")
+
+
+def test_build_grok_argv_always_approve_optout(fake_grok_cell_yaml):
+    from swarph_cli.commands.spawn import _build_grok_argv
+
+    # Extra fields live at TOP LEVEL of cell.yaml; load_cell collects leftover
+    # keys into cell.extra. (A nested `extra:` block lands as cell.extra['extra']
+    # and would NOT be read here — top-level is the convention, matching agy's
+    # cell.extra.get('sandbox').)
+    payload = yaml.safe_load(fake_grok_cell_yaml.read_text())
+    payload["always_approve"] = False
+    fake_grok_cell_yaml.write_text(yaml.safe_dump(payload))
+    cell = load_cell(fake_grok_cell_yaml)
+
+    argv = _build_grok_argv(cell, None, None, [])
+    assert "--always-approve" not in argv
+
+
+def test_grok_env_isolates_home_scrubs_billing_and_token(
+    fake_grok_cell_yaml, monkeypatch
+):
+    from swarph_cli.commands.spawn import _grok_env
+
+    # Metered xAI keys + the shared mesh token in the parent env must NOT reach
+    # the spawned grok cell.
+    monkeypatch.setenv("XAI_API_KEY", "sk-xai-LEAK")
+    monkeypatch.setenv("XAI_API_BASE", "https://metered.example")
+    monkeypatch.setenv("MESH_GATEWAY_TOKEN", "shared-token")
+    cell = load_cell(fake_grok_cell_yaml)
+
+    env = _grok_env(cell)
+
+    # Isolated HOME inside the cell cwd (created), so the cell's grok state never
+    # mixes with the operator's personal ~/.grok.
+    assert env["HOME"] == str(cell.cwd / ".grok-cell")
+    assert (cell.cwd / ".grok-cell").is_dir()
+    # $0 OIDC preserved: metered endpoints scrubbed (incl the *_API_BASE the
+    # suffix sweep misses).
+    assert "XAI_API_KEY" not in env
+    assert "XAI_API_BASE" not in env
+    # Per-peer token CUTOVER: shared mesh token popped so the resolver loads the
+    # cell's per-peer token file (the mint!=cutover fix the /tmp draft omitted).
+    assert "MESH_GATEWAY_TOKEN" not in env
+    # tmux re-entry / hook loop-guard marker.
+    assert env["SWARPH_SPAWN"] == "1"
+
+
+def test_grok_env_symlinks_operator_auth(fake_grok_cell_yaml, monkeypatch, tmp_path):
+    from swarph_cli.commands.spawn import _grok_env
+
+    # Operator ~/.grok/auth.json gets symlinked into the cell HOME for $0 OIDC.
+    fake_home = tmp_path / "ophome"
+    (fake_home / ".grok").mkdir(parents=True)
+    (fake_home / ".grok" / "auth.json").write_text("{}")
+    monkeypatch.setattr(Path, "home", classmethod(lambda cls: fake_home))
+    cell = load_cell(fake_grok_cell_yaml)
+
+    env = _grok_env(cell)
+    link = Path(env["HOME"]) / "auth.json"
+    assert link.is_symlink()
+    assert link.resolve() == (fake_home / ".grok" / "auth.json")
+
+
+def test_grok_dry_run_emits_pinned_resume(
+    fake_grok_cell_yaml, isolated_xdg, monkeypatch, capsys
+):
+    # `swarph spawn <grok-cell-path> --dry-run` prints grok with the pinned
+    # --resume (R5 store mints the id on first run), matching the validated
+    # manual launch.
+    rc = run_spawn(["--dry-run", "--no-banner", str(fake_grok_cell_yaml)])
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert f"grok --cwd {fake_grok_cell_yaml.parent}" in out
+    assert "--resume" in out
+    assert "--agent grok-researcher --always-approve" in out